[RFC,bpf-next,0/5] Share user memory to BPF program through task storage map.

Message

Kui-Feng Lee Aug. 7, 2024, 11:57 p.m. UTC

Some of BPF schedulers (sched_ext) need hints from user programs to do
a better job. For example, a scheduler can handle a task in a
different way if it knows a task is doing GC. So, we need an efficient
way to share the information between user programs and BPF
programs. Sharing memory between user programs and BPF programs is
what this patchset does.

== REQUIREMENT ==

This patchset tries to let every task in every process can share a
small chunk of memory of it's own with a BPF scheduler. So, they can
update the hints without expensive overhead of syscalls. It also wants
every task sees only the data/memory belong to the task/or the task's
process.

== DESIGN ==

This patchset enables BPF prorams to embed __kptr_user; user kptr, a
new type of kptrs, in the values of task storage maps. A user kptr
field can only be set by user programs by updating map element value
through a syscall. A user kptr points to a block of memory allocated
by the user program updating the element value. The memory will be
pinned to ensure it staying in the core memory and to avoid a page
fault when the BPF program accesses it.

For example, the following code fragment is a part of a BPF program
that embeds a __kptr_user field "udata" in the value type "struct
value_type" of the task storage map "datamap". The size of the memory
pointed by a user kptr is determized by its type. Here we have "struct
user_data". The BPF program can read and write this block of memory
directly.

File task_ls_kptr_user.c:

    struct user_data {
    	int a;
    	int b;
    	int result;
    };
    
    struct value_type {
    	struct user_data __kptr_user *udata;
    };
    
    struct {
    	__uint(type, BPF_MAP_TYPE_TASK_STORAGE);
    	__uint(map_flags, BPF_F_NO_PREALLOC);
    	__type(key, int);
    	__type(value, struct value_type);
    } datamap SEC(".maps");
    
    pid_t target_pid = 0;
    
    SEC("tp_btf/sys_enter")
    int BPF_PROG(on_enter, struct pt_regs *regs, long id)
    {
    	struct task_struct *task;
    	struct value_type *ptr;
    	struct user_data *udata;
    
    	task = bpf_get_current_task_btf();
    	if (task->pid != target_pid)
    		return 0;
    
    	ptr = bpf_task_storage_get(&datamap, task, 0,
    				   BPF_LOCAL_STORAGE_GET_F_CREATE);
    	if (!ptr)
    		return 0;
    
    	udata = ptr->udata;
    	if (udata)
    		udata->result = udata->a + udata->b;
    
    	return 0;
    }

The following code fragment is a corresponding user program. It calls
bpf_map_update_elem() to update "datamap" and point "udata" to a
mmaped memory. The memory pointed by "udata" will be shared between
the BPF program and the user program.

    static void test_kptr_user(void)
    {
    	struct task_ls_kptr_user *skel = NULL;
    	struct user_data *user_data;
    	struct value_type value;
    	int task_fd = -1;
    	int err;
    
    	user_data = mmap(NULL, sizeof(user_data), PROT_READ | PROT_WRITE,
    			 MAP_SHARED | MAP_ANONYMOUS, -1, 0);
    	if (!ASSERT_NEQ(user_data, MAP_FAILED, "mmap"))
    		return;
    	user_data->a = 1;
    	user_data->b = 2;
    	user_data->result = 0;
    	value.udata = user_data;
    
    	task_fd = sys_pidfd_open(getpid(), 0);
    	if (!ASSERT_NEQ(task_fd, -1, "sys_pidfd_open"))
    		goto out;
    
    	skel = task_ls_kptr_user__open_and_load();
    	if (!ASSERT_OK_PTR(skel, "skel_open_and_load"))
    		goto out;
    
    	err = bpf_map_update_elem(bpf_map__fd(skel->maps.datamap), &task_fd, &value, 0);
    	if (!ASSERT_OK(err, "update datamap"))
    		goto out;
    
    	skel->bss->target_pid = syscall(SYS_gettid);
    
    	err = task_ls_kptr_user__attach(skel);
    	if (!ASSERT_OK(err, "skel_attach"))
    		goto out;
    
    	syscall(SYS_gettid);
    	syscall(SYS_gettid);
    
    	ASSERT_EQ(user_data->a + user_data->b, user_data->result, "result");
    out:
    	task_ls_kptr_user__destroy(skel);
    	close(task_fd);
    	munmap(user_data, sizeof(user_data));
    }

== MEMORY ==

In order to use memory efficiently, we don't want to pin a large
number of pages. To archieve that, user programs should collect the
memory blocks pointed by user kptrs together to share memory pages if
possible. It avoid the situation that pin one page for each thread in
a process.  Instead, we can have several threads pointing their user
kptrs to the same page but with different offsets.

Although it is not necessary, avoiding the memory pointed by a user
kptr crossing the boundary of a page can prevent an additional mapping
in the kernel address space.

== RESTRICT ==

There is a limitation on the number of pinned pages for one user kptr,
KPTR_USER_MAX_PAGES(16). This is random picked number for safety. We
can remove this limitation if we don't want it.

Only task storage map have been supported at the moment.

The values of user kptrs can only be updated by user programs through
syscalls. You can not change the values of user kptrs in BPF programs.

bpf_map_lookup_elem() from userspace returns zeroed values for user
kptrs to prevent leaking information of the kernel.

Kui-Feng Lee (5):
  bpf: Parse and support "kptr_user" tag.
  bpf: Handle BPF_KPTR_USER in verifier.
  bpf: pin, translate, and unpin __kptr_user from syscalls.
  libbpf: define __kptr_user.
  selftests/bpf: test __kptr_user on the value of a task storage map.

 include/linux/bpf.h                           |  43 ++++-
 include/linux/bpf_local_storage.h             |   2 +-
 kernel/bpf/bpf_local_storage.c                |  18 +-
 kernel/bpf/btf.c                              |   5 +
 kernel/bpf/helpers.c                          |  12 +-
 kernel/bpf/local_storage.c                    |   2 +-
 kernel/bpf/syscall.c                          | 179 +++++++++++++++++-
 kernel/bpf/verifier.c                         |  11 ++
 net/core/bpf_sk_storage.c                     |   2 +-
 tools/lib/bpf/bpf_helpers.h                   |   1 +
 .../bpf/prog_tests/task_local_storage.c       | 122 ++++++++++++
 .../selftests/bpf/progs/task_ls_kptr_user.c   |  72 +++++++
 12 files changed, 447 insertions(+), 22 deletions(-)
 create mode 100644 tools/testing/selftests/bpf/progs/task_ls_kptr_user.c