Commit c0e19f2c authored by Stanislav Fomichev's avatar Stanislav Fomichev Committed by Alexei Starovoitov
Browse files

bpf: minimize number of allocated lsm slots per program 



Previous patch adds 1:1 mapping between all 211 LSM hooks
and bpf_cgroup program array. Instead of reserving a slot per
possible hook, reserve 10 slots per cgroup for lsm programs.
Those slots are dynamically allocated on demand and reclaimed.

struct cgroup_bpf {
	struct bpf_prog_array *    effective[33];        /*     0   264 */
	/* --- cacheline 4 boundary (256 bytes) was 8 bytes ago --- */
	struct hlist_head          progs[33];            /*   264   264 */
	/* --- cacheline 8 boundary (512 bytes) was 16 bytes ago --- */
	u8                         flags[33];            /*   528    33 */

	/* XXX 7 bytes hole, try to pack */

	struct list_head           storages;             /*   568    16 */
	/* --- cacheline 9 boundary (576 bytes) was 8 bytes ago --- */
	struct bpf_prog_array *    inactive;             /*   584     8 */
	struct percpu_ref          refcnt;               /*   592    16 */
	struct work_struct         release_work;         /*   608    72 */

	/* size: 680, cachelines: 11, members: 7 */
	/* sum members: 673, holes: 1, sum holes: 7 */
	/* last cacheline: 40 bytes */
};

Reviewed-by: default avatarMartin KaFai Lau <kafai@fb.com>
Signed-off-by: default avatarStanislav Fomichev <sdf@google.com>
Link: https://lore.kernel.org/r/20220628174314.1216643-5-sdf@google.com


Signed-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
parent 69fd337a

include/linux/bpf-cgroup-defs.h

+2 −1
Original line number Diff line number Diff line
@@ -11,7 +11,8 @@ 
struct bpf_prog_array;



#ifdef CONFIG_BPF_LSM

#define CGROUP_LSM_NUM 211 /* will be addressed in the next patch */

/* Maximum number of concurrently attachable per-cgroup LSM hooks. */

#define CGROUP_LSM_NUM 10

#else

#define CGROUP_LSM_NUM 0

#endif

include/linux/bpf.h

+8 −1
Original line number Diff line number Diff line
@@ -2508,7 +2508,6 @@ int bpf_arch_text_invalidate(void *dst, size_t len); 


struct btf_id_set;

bool btf_id_set_contains(const struct btf_id_set *set, u32 id);

int btf_id_set_index(const struct btf_id_set *set, u32 id);



#define MAX_BPRINTF_VARARGS		12
@@ -2545,4 +2544,12 @@ void bpf_dynptr_init(struct bpf_dynptr_kern *ptr, void *data, 
void bpf_dynptr_set_null(struct bpf_dynptr_kern *ptr);

int bpf_dynptr_check_size(u32 size);



#ifdef CONFIG_BPF_LSM

void bpf_cgroup_atype_get(u32 attach_btf_id, int cgroup_atype);

void bpf_cgroup_atype_put(int cgroup_atype);

#else

static inline void bpf_cgroup_atype_get(u32 attach_btf_id, int cgroup_atype) {}

static inline void bpf_cgroup_atype_put(int cgroup_atype) {}

#endif /* CONFIG_BPF_LSM */



#endif /* _LINUX_BPF_H */

include/linux/bpf_lsm.h

+0 −6
Original line number Diff line number Diff line
@@ -42,7 +42,6 @@ extern const struct bpf_func_proto bpf_inode_storage_get_proto; 
extern const struct bpf_func_proto bpf_inode_storage_delete_proto;

void bpf_inode_storage_free(struct inode *inode);



int bpf_lsm_hook_idx(u32 btf_id);

void bpf_lsm_find_cgroup_shim(const struct bpf_prog *prog, bpf_func_t *bpf_func);



#else /* !CONFIG_BPF_LSM */
@@ -73,11 +72,6 @@ static inline void bpf_lsm_find_cgroup_shim(const struct bpf_prog *prog, 
{

}



static inline int bpf_lsm_hook_idx(u32 btf_id)

{

	return -EINVAL;

}



#endif /* CONFIG_BPF_LSM */



#endif /* _LINUX_BPF_LSM_H */

kernel/bpf/bpf_lsm.c

+0 −5
Original line number Diff line number Diff line
@@ -69,11 +69,6 @@ void bpf_lsm_find_cgroup_shim(const struct bpf_prog *prog, 
		*bpf_func = __cgroup_bpf_run_lsm_current;

}



int bpf_lsm_hook_idx(u32 btf_id)

{

	return btf_id_set_index(&bpf_lsm_hooks, btf_id);

}



int bpf_lsm_verify_prog(struct bpf_verifier_log *vlog,

			const struct bpf_prog *prog)

{

kernel/bpf/btf.c

+0 −10
Original line number Diff line number Diff line
@@ -6843,16 +6843,6 @@ static int btf_id_cmp_func(const void *a, const void *b) 
	return *pa - *pb;

}



int btf_id_set_index(const struct btf_id_set *set, u32 id)

{

	const u32 *p;



	p = bsearch(&id, set->ids, set->cnt, sizeof(u32), btf_id_cmp_func);

	if (!p)

		return -1;

	return p - set->ids;

}



bool btf_id_set_contains(const struct btf_id_set *set, u32 id)

{

	return bsearch(&id, set->ids, set->cnt, sizeof(u32), btf_id_cmp_func) != NULL;