bpf: Enable more helpers for BPF_PROG_TYPE_CGROUP_{DEVICE,SYSCTL,SOCKOPT}

Currently the following prog types don't fall back to bpf_base_func_proto()
(instead they have cgroup_base_func_proto which has a limited set of
helpers from bpf_base_func_proto):
* BPF_PROG_TYPE_CGROUP_DEVICE
* BPF_PROG_TYPE_CGROUP_SYSCTL
* BPF_PROG_TYPE_CGROUP_SOCKOPT

I don't see any specific reason why we shouldn't use bpf_base_func_proto(),
every other type of program (except bpf-lirc and, understandably, tracing)
use it, so let's fall back to bpf_base_func_proto for those prog types
as well.

This basically boils down to adding access to the following helpers:
* BPF_FUNC_get_prandom_u32
* BPF_FUNC_get_smp_processor_id
* BPF_FUNC_get_numa_node_id
* BPF_FUNC_tail_call
* BPF_FUNC_ktime_get_ns
* BPF_FUNC_spin_lock (CAP_SYS_ADMIN)
* BPF_FUNC_spin_unlock (CAP_SYS_ADMIN)
* BPF_FUNC_jiffies64 (CAP_SYS_ADMIN)

I've also added bpf_perf_event_output() because it's really handy for
logging and debugging.

Signed-off-by: Stanislav Fomichev <sdf@google.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Link: https://lore.kernel.org/bpf/20200420174610.77494-1-sdf@google.com

diff --git a/include/linux/bpf.h b/include/linux/bpf.h
index fd2b232..25da6ff 100644 (file)
--- a/include/linux/bpf.h
+++ b/include/linux/bpf.h
@@ -1523,6 +1523,7 @@ extern const struct bpf_func_proto bpf_strtoul_proto;
 extern const struct bpf_func_proto bpf_tcp_sock_proto;
 extern const struct bpf_func_proto bpf_jiffies64_proto;
 extern const struct bpf_func_proto bpf_get_ns_current_pid_tgid_proto;
+extern const struct bpf_func_proto bpf_event_output_data_proto;
 
 const struct bpf_func_proto *bpf_tracing_func_proto(
        enum bpf_func_id func_id, const struct bpf_prog *prog);

diff --git a/kernel/bpf/cgroup.c b/kernel/bpf/cgroup.c
index cb305e7..4d748c5 100644 (file)
--- a/kernel/bpf/cgroup.c
+++ b/kernel/bpf/cgroup.c
@@ -1060,30 +1060,16 @@ static const struct bpf_func_proto *
 cgroup_base_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog)
 {
        switch (func_id) {
-       case BPF_FUNC_map_lookup_elem:
-               return &bpf_map_lookup_elem_proto;
-       case BPF_FUNC_map_update_elem:
-               return &bpf_map_update_elem_proto;
-       case BPF_FUNC_map_delete_elem:
-               return &bpf_map_delete_elem_proto;
-       case BPF_FUNC_map_push_elem:
-               return &bpf_map_push_elem_proto;
-       case BPF_FUNC_map_pop_elem:
-               return &bpf_map_pop_elem_proto;
-       case BPF_FUNC_map_peek_elem:
-               return &bpf_map_peek_elem_proto;
        case BPF_FUNC_get_current_uid_gid:
                return &bpf_get_current_uid_gid_proto;
        case BPF_FUNC_get_local_storage:
                return &bpf_get_local_storage_proto;
        case BPF_FUNC_get_current_cgroup_id:
                return &bpf_get_current_cgroup_id_proto;
-       case BPF_FUNC_trace_printk:
-               if (capable(CAP_SYS_ADMIN))
-                       return bpf_get_trace_printk_proto();
-               /* fall through */
+       case BPF_FUNC_perf_event_output:
+               return &bpf_event_output_data_proto;
        default:
-               return NULL;
+               return bpf_base_func_proto(func_id);
        }
 }
 

diff --git a/net/core/filter.c b/net/core/filter.c
index 7d6ceaa..a943df3 100644 (file)
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -4214,7 +4214,7 @@ BPF_CALL_5(bpf_event_output_data, void *, ctx, struct bpf_map *, map, u64, flags
        return bpf_event_output(map, flags, data, size, NULL, 0, NULL);
 }
 
-static const struct bpf_func_proto bpf_event_output_data_proto =  {
+const struct bpf_func_proto bpf_event_output_data_proto =  {
        .func           = bpf_event_output_data,
        .gpl_only       = true,
        .ret_type       = RET_INTEGER,

diff --git a/tools/testing/selftests/bpf/verifier/event_output.c b/tools/testing/selftests/bpf/verifier/event_output.c
index 130553e..99f8f58 100644 (file)
--- a/tools/testing/selftests/bpf/verifier/event_output.c
+++ b/tools/testing/selftests/bpf/verifier/event_output.c
@@ -92,3 +92,27 @@
        .result = ACCEPT,
        .retval = 1,
 },
+{
+       "perfevent for cgroup dev",
+       .insns =  { __PERF_EVENT_INSNS__ },
+       .prog_type = BPF_PROG_TYPE_CGROUP_DEVICE,
+       .fixup_map_event_output = { 4 },
+       .result = ACCEPT,
+       .retval = 1,
+},
+{
+       "perfevent for cgroup sysctl",
+       .insns =  { __PERF_EVENT_INSNS__ },
+       .prog_type = BPF_PROG_TYPE_CGROUP_SYSCTL,
+       .fixup_map_event_output = { 4 },
+       .result = ACCEPT,
+       .retval = 1,
+},
+{
+       "perfevent for cgroup sockopt",
+       .insns =  { __PERF_EVENT_INSNS__ },
+       .prog_type = BPF_PROG_TYPE_CGROUP_SOCKOPT,
+       .fixup_map_event_output = { 4 },
+       .result = ACCEPT,
+       .retval = 1,
+},