Modular verifier ci #8734
Closed
Modular verifier ci #8734
+5,965
−532
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
kernel-patches-daemon-bpf
bot
force-pushed
the
bpf-next_base
branch
from
0a09ea9 to
1a03c01
Compare
danobi
force-pushed
the
modular_verifier-ci
branch
2 times, most recently
from
3cb078e to
174f78e
Compare
kernel-patches-daemon-bpf
bot
force-pushed
the
bpf-next_base
branch
from
1a03c01 to
a4b8db7
Compare
danobi
force-pushed
the
modular_verifier-ci
branch
from
174f78e to
7e21385
Compare
kernel-patches-daemon-bpf
bot
force-pushed
the
bpf-next_base
branch
10 times, most recently
from
a218e9c to
16912c4
Compare
kernel-patches-daemon-bpf
bot
force-pushed
the
bpf-next_base
branch
from
16912c4 to
ceae011
Compare
danobi
force-pushed
the
modular_verifier-ci
branch
3 times, most recently
from
b6f2814 to
a88ef92
Compare
In an effort to reduce the amount of external references into verifier.c, move the body of this function into the header, as it's quite small. Signed-off-by: Daniel Xu <dxu@dxuuu.xyz>
Continuing with the effort to make verifier.c a leaf node, this commit moves out bpf_verifier_lock, btf_vmlinux, and bpf_get_btf_vmlinux(). These can be owned by btf.c (perhaps rightly so). Signed-off-by: Daniel Xu <dxu@dxuuu.xyz>
The BPF percpu memory allocator is used from multiple places. So move it into the core and have verifier.c simply consume it. Signed-off-by: Daniel Xu <dxu@dxuuu.xyz>
This routine is used in a few other places in BPF subsystem. In an effort to make verifier.c a leaf node, move the definition as well as some other single use helpers into core. Signed-off-by: Daniel Xu <dxu@dxuuu.xyz>
Currently all iteratable maps (maps that define map_for_each_callback) use the default callback. In an effort to reduce the number of incoming references to verifier.c, just remove this level of indirection, as it's unused. Signed-off-by: Daniel Xu <dxu@dxuuu.xyz>
Multiple files reference bpf_get_kfunc_addr(). But in order to move the definition out into core, we need to drag along the various struct definitions. Doing this also makes moving bpf_free_kfunc_btf_tab() in the next commit simpler as well. Signed-off-by: Daniel Xu <dxu@dxuuu.xyz>
This function is only used in one place in core. However, it was defined in verifier.c b/c a bunch of struct definitions were hidden in verifier.c. Now that those definitions are shared, we can move bpf_free_kfunc_btf_tab() into core and mark it static. Signed-off-by: Daniel Xu <dxu@dxuuu.xyz>
bpf_check(), as it currently exists, will soon be going away to make way for loadable BPF verifier support. Fixup selftests so they fentry attach to a more reliable location. Signed-off-by: Daniel Xu <dxu@dxuuu.xyz>
Export the static call so that the modularized BPF verifier can run static_call_query() against it. Signed-off-by: Daniel Xu <dxu@dxuuu.xyz>
kallsyms_lookup_name() cannot be exported from the kernel for policy reasons, so add this layer of indirection to allow the verifier to still do kfunc and global variable relocations. Signed-off-by: Daniel Xu <dxu@dxuuu.xyz>
This commit EXPORT_SYMBOL_GPL()'s all the unresolved symbols from verifier.o.
This is necessary to support loads and reloads of the verifier at
runtime.
The list of symbols was generated using:
nm -u kernel/bpf/verifier.o | grep -ve "__asan\|__ubsan\|__kasan" | awk '{print $2}'
This commit makes the BPF verifier loadable, with the default being the same as before (built in). Note that no matter the build configuration, it is always possible to load a new module (evicting the previous). Signed-off-by: Daniel Xu <dxu@dxuuu.xyz>
This supports out-of-tree builds against the in-tree verifier.ko. This
is intended to be used to build newer upstream verifiers against older
kernel sources.
You can also do an "in-tree out-of-tree" build as proof of concept:
$ make clean
$ make modules_prepare
$ cd kernel/bpf
$ make -C ../.. M=$PWD
danobi
force-pushed
the
modular_verifier-ci
branch
from
a88ef92 to
f296a28
Compare
kernel-patches-daemon-bpf
bot
force-pushed
the
bpf-next_base
branch
10 times, most recently
from
14a0235 to
00d9d99
Compare
|
Automatically cleaning up stale PR; feel free to reopen if needed |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
No description provided.