[linux-2.6-block.git] / net / bpf / bpf_dummy_struct_ops.c

// SPDX-License-Identifier: GPL-2.0
/*
 * Copyright (C) 2021. Huawei Technologies Co., Ltd
 */
#include <linux/kernel.h>
#include <linux/bpf_verifier.h>
#include <linux/bpf.h>
#include <linux/btf.h>

extern struct bpf_struct_ops bpf_bpf_dummy_ops;

/* A common type for test_N with return value in bpf_dummy_ops */
typedef int (*dummy_ops_test_ret_fn)(struct bpf_dummy_ops_state *state, ...);

static int dummy_ops_test_ret_function(struct bpf_dummy_ops_state *state, ...)
{
	return 0;
}

struct bpf_dummy_ops_test_args {
	u64 args[MAX_BPF_FUNC_ARGS];
	struct bpf_dummy_ops_state state;
};

static struct bpf_dummy_ops_test_args *
dummy_ops_init_args(const union bpf_attr *kattr, unsigned int nr)
{
	__u32 size_in;
	struct bpf_dummy_ops_test_args *args;
	void __user *ctx_in;
	void __user *u_state;

	size_in = kattr->test.ctx_size_in;
	if (size_in != sizeof(u64) * nr)
		return ERR_PTR(-EINVAL);

	args = kzalloc(sizeof(*args), GFP_KERNEL);
	if (!args)
		return ERR_PTR(-ENOMEM);

	ctx_in = u64_to_user_ptr(kattr->test.ctx_in);
	if (copy_from_user(args->args, ctx_in, size_in))
		goto out;

	/* args[0] is 0 means state argument of test_N will be NULL */
	u_state = u64_to_user_ptr(args->args[0]);
	if (u_state && copy_from_user(&args->state, u_state,
				      sizeof(args->state)))
		goto out;

	return args;
out:
	kfree(args);
	return ERR_PTR(-EFAULT);
}

static int dummy_ops_copy_args(struct bpf_dummy_ops_test_args *args)
{
	void __user *u_state;

	u_state = u64_to_user_ptr(args->args[0]);
	if (u_state && copy_to_user(u_state, &args->state, sizeof(args->state)))
		return -EFAULT;

	return 0;
}

static int dummy_ops_call_op(void *image, struct bpf_dummy_ops_test_args *args)
{
	dummy_ops_test_ret_fn test = (void *)image + cfi_get_offset();
	struct bpf_dummy_ops_state *state = NULL;

	/* state needs to be NULL if args[0] is 0 */
	if (args->args[0])
		state = &args->state;
	return test(state, args->args[1], args->args[2],
		    args->args[3], args->args[4]);
}

extern const struct bpf_link_ops bpf_struct_ops_link_lops;

int bpf_struct_ops_test_run(struct bpf_prog *prog, const union bpf_attr *kattr,
			    union bpf_attr __user *uattr)
{
	const struct bpf_struct_ops *st_ops = &bpf_bpf_dummy_ops;
	const struct btf_type *func_proto;
	struct bpf_dummy_ops_test_args *args;
	struct bpf_tramp_links *tlinks;
	struct bpf_tramp_link *link = NULL;
	void *image = NULL;
	unsigned int op_idx;
	int prog_ret;
	int err;

	if (prog->aux->attach_btf_id != st_ops->type_id)
		return -EOPNOTSUPP;

	func_proto = prog->aux->attach_func_proto;
	args = dummy_ops_init_args(kattr, btf_type_vlen(func_proto));
	if (IS_ERR(args))
		return PTR_ERR(args);

	tlinks = kcalloc(BPF_TRAMP_MAX, sizeof(*tlinks), GFP_KERNEL);
	if (!tlinks) {
		err = -ENOMEM;
		goto out;
	}

	image = arch_alloc_bpf_trampoline(PAGE_SIZE);
	if (!image) {
		err = -ENOMEM;
		goto out;
	}

	link = kzalloc(sizeof(*link), GFP_USER);
	if (!link) {
		err = -ENOMEM;
		goto out;
	}
	/* prog doesn't take the ownership of the reference from caller */
	bpf_prog_inc(prog);
	bpf_link_init(&link->link, BPF_LINK_TYPE_STRUCT_OPS, &bpf_struct_ops_link_lops, prog);

	op_idx = prog->expected_attach_type;
	err = bpf_struct_ops_prepare_trampoline(tlinks, link,
						&st_ops->func_models[op_idx],
						&dummy_ops_test_ret_function,
						image, image + PAGE_SIZE);
	if (err < 0)
		goto out;

	arch_protect_bpf_trampoline(image, PAGE_SIZE);
	prog_ret = dummy_ops_call_op(image, args);

	err = dummy_ops_copy_args(args);
	if (err)
		goto out;
	if (put_user(prog_ret, &uattr->test.retval))
		err = -EFAULT;
out:
	kfree(args);
	arch_free_bpf_trampoline(image, PAGE_SIZE);
	if (link)
		bpf_link_put(&link->link);
	kfree(tlinks);
	return err;
}

static int bpf_dummy_init(struct btf *btf)
{
	return 0;
}

static bool bpf_dummy_ops_is_valid_access(int off, int size,
					  enum bpf_access_type type,
					  const struct bpf_prog *prog,
					  struct bpf_insn_access_aux *info)
{
	return bpf_tracing_btf_ctx_access(off, size, type, prog, info);
}

static int bpf_dummy_ops_check_member(const struct btf_type *t,
				      const struct btf_member *member,
				      const struct bpf_prog *prog)
{
	u32 moff = __btf_member_bit_offset(t, member) / 8;

	switch (moff) {
	case offsetof(struct bpf_dummy_ops, test_sleepable):
		break;
	default:
		if (prog->aux->sleepable)
			return -EINVAL;
	}

	return 0;
}

static int bpf_dummy_ops_btf_struct_access(struct bpf_verifier_log *log,
					   const struct bpf_reg_state *reg,
					   int off, int size)
{
	const struct btf_type *state;
	const struct btf_type *t;
	s32 type_id;

	type_id = btf_find_by_name_kind(reg->btf, "bpf_dummy_ops_state",
					BTF_KIND_STRUCT);
	if (type_id < 0)
		return -EINVAL;

	t = btf_type_by_id(reg->btf, reg->btf_id);
	state = btf_type_by_id(reg->btf, type_id);
	if (t != state) {
		bpf_log(log, "only access to bpf_dummy_ops_state is supported\n");
		return -EACCES;
	}

	if (off + size > sizeof(struct bpf_dummy_ops_state)) {
		bpf_log(log, "write access at off %d with size %d\n", off, size);
		return -EACCES;
	}

	return NOT_INIT;
}

static const struct bpf_verifier_ops bpf_dummy_verifier_ops = {
	.is_valid_access = bpf_dummy_ops_is_valid_access,
	.btf_struct_access = bpf_dummy_ops_btf_struct_access,
};

static int bpf_dummy_init_member(const struct btf_type *t,
				 const struct btf_member *member,
				 void *kdata, const void *udata)
{
	return -EOPNOTSUPP;
}

static int bpf_dummy_reg(void *kdata)
{
	return -EOPNOTSUPP;
}

static void bpf_dummy_unreg(void *kdata)
{
}

static int bpf_dummy_test_1(struct bpf_dummy_ops_state *cb)
{
	return 0;
}

static int bpf_dummy_test_2(struct bpf_dummy_ops_state *cb, int a1, unsigned short a2,
			    char a3, unsigned long a4)
{
	return 0;
}

static int bpf_dummy_test_sleepable(struct bpf_dummy_ops_state *cb)
{
	return 0;
}

static struct bpf_dummy_ops __bpf_bpf_dummy_ops = {
	.test_1 = bpf_dummy_test_1,
	.test_2 = bpf_dummy_test_2,
	.test_sleepable = bpf_dummy_test_sleepable,
};

struct bpf_struct_ops bpf_bpf_dummy_ops = {
	.verifier_ops = &bpf_dummy_verifier_ops,
	.init = bpf_dummy_init,
	.check_member = bpf_dummy_ops_check_member,
	.init_member = bpf_dummy_init_member,
	.reg = bpf_dummy_reg,
	.unreg = bpf_dummy_unreg,
	.name = "bpf_dummy_ops",
	.cfi_stubs = &__bpf_bpf_dummy_ops,
};
Commit	Line	Data
c196906d HT	1	// SPDX-License-Identifier: GPL-2.0
	2	/*
	3	* Copyright (C) 2021. Huawei Technologies Co., Ltd
	4	*/
	5	#include <linux/kernel.h>
	6	#include <linux/bpf_verifier.h>
	7	#include <linux/bpf.h>
	8	#include <linux/btf.h>
	9
	10	extern struct bpf_struct_ops bpf_bpf_dummy_ops;
	11
	12	/* A common type for test_N with return value in bpf_dummy_ops */
	13	typedef int (dummy_ops_test_ret_fn)(struct bpf_dummy_ops_state state, ...);
	14
2cd3e377 PZ	15	static int dummy_ops_test_ret_function(struct bpf_dummy_ops_state *state, ...)
	16	{
	17	return 0;
	18	}
	19
c196906d HT	20	struct bpf_dummy_ops_test_args {
	21	u64 args[MAX_BPF_FUNC_ARGS];
	22	struct bpf_dummy_ops_state state;
	23	};
	24
	25	static struct bpf_dummy_ops_test_args *
	26	dummy_ops_init_args(const union bpf_attr *kattr, unsigned int nr)
	27	{
	28	__u32 size_in;
	29	struct bpf_dummy_ops_test_args *args;
	30	void __user *ctx_in;
	31	void __user *u_state;
	32
	33	size_in = kattr->test.ctx_size_in;
	34	if (size_in != sizeof(u64) * nr)
	35	return ERR_PTR(-EINVAL);
	36
	37	args = kzalloc(sizeof(*args), GFP_KERNEL);
	38	if (!args)
	39	return ERR_PTR(-ENOMEM);
	40
	41	ctx_in = u64_to_user_ptr(kattr->test.ctx_in);
	42	if (copy_from_user(args->args, ctx_in, size_in))
	43	goto out;
	44
	45	/* args[0] is 0 means state argument of test_N will be NULL */
	46	u_state = u64_to_user_ptr(args->args[0]);
	47	if (u_state && copy_from_user(&args->state, u_state,
	48	sizeof(args->state)))
	49	goto out;
	50
	51	return args;
	52	out:
	53	kfree(args);
	54	return ERR_PTR(-EFAULT);
	55	}
	56
	57	static int dummy_ops_copy_args(struct bpf_dummy_ops_test_args *args)
	58	{
	59	void __user *u_state;
	60
	61	u_state = u64_to_user_ptr(args->args[0]);
	62	if (u_state && copy_to_user(u_state, &args->state, sizeof(args->state)))
	63	return -EFAULT;
	64
	65	return 0;
	66	}
	67
	68	static int dummy_ops_call_op(void image, struct bpf_dummy_ops_test_args args)
	69	{
2cd3e377	70	dummy_ops_test_ret_fn test = (void *)image + cfi_get_offset();
c196906d HT	71	struct bpf_dummy_ops_state *state = NULL;
	72
	73	/* state needs to be NULL if args[0] is 0 */
	74	if (args->args[0])
	75	state = &args->state;
	76	return test(state, args->args[1], args->args[2],
	77	args->args[3], args->args[4]);
	78	}
	79
f7e0beaf KFL	80	extern const struct bpf_link_ops bpf_struct_ops_link_lops;
f7e0beaf KFL	81
c196906d HT	82	int bpf_struct_ops_test_run(struct bpf_prog prog, const union bpf_attr kattr,
	83	union bpf_attr __user *uattr)
	84	{
	85	const struct bpf_struct_ops *st_ops = &bpf_bpf_dummy_ops;
	86	const struct btf_type *func_proto;
	87	struct bpf_dummy_ops_test_args *args;
f7e0beaf KFL	88	struct bpf_tramp_links *tlinks;
f7e0beaf KFL	89	struct bpf_tramp_link *link = NULL;
c196906d HT	90	void *image = NULL;
	91	unsigned int op_idx;
	92	int prog_ret;
	93	int err;
	94
	95	if (prog->aux->attach_btf_id != st_ops->type_id)
	96	return -EOPNOTSUPP;
	97
	98	func_proto = prog->aux->attach_func_proto;
	99	args = dummy_ops_init_args(kattr, btf_type_vlen(func_proto));
	100	if (IS_ERR(args))
	101	return PTR_ERR(args);
	102
f7e0beaf KFL	103	tlinks = kcalloc(BPF_TRAMP_MAX, sizeof(*tlinks), GFP_KERNEL);
f7e0beaf KFL	104	if (!tlinks) {
c196906d HT	105	err = -ENOMEM;
	106	goto out;
	107	}
	108
82583daa	109	image = arch_alloc_bpf_trampoline(PAGE_SIZE);
c196906d HT	110	if (!image) {
	111	err = -ENOMEM;
	112	goto out;
	113	}
c196906d	114
f7e0beaf KFL	115	link = kzalloc(sizeof(*link), GFP_USER);
	116	if (!link) {
	117	err = -ENOMEM;
	118	goto out;
	119	}
	120	/* prog doesn't take the ownership of the reference from caller */
	121	bpf_prog_inc(prog);
	122	bpf_link_init(&link->link, BPF_LINK_TYPE_STRUCT_OPS, &bpf_struct_ops_link_lops, prog);
	123
c196906d	124	op_idx = prog->expected_attach_type;
f7e0beaf	125	err = bpf_struct_ops_prepare_trampoline(tlinks, link,
c196906d	126	&st_ops->func_models[op_idx],
2cd3e377	127	&dummy_ops_test_ret_function,
c196906d HT	128	image, image + PAGE_SIZE);
	129	if (err < 0)
	130	goto out;
	131
82583daa	132	arch_protect_bpf_trampoline(image, PAGE_SIZE);
c196906d HT	133	prog_ret = dummy_ops_call_op(image, args);
	134
	135	err = dummy_ops_copy_args(args);
	136	if (err)
	137	goto out;
	138	if (put_user(prog_ret, &uattr->test.retval))
	139	err = -EFAULT;
	140	out:
	141	kfree(args);
82583daa	142	arch_free_bpf_trampoline(image, PAGE_SIZE);
f7e0beaf KFL	143	if (link)
	144	bpf_link_put(&link->link);
	145	kfree(tlinks);
c196906d HT	146	return err;
	147	}
	148
	149	static int bpf_dummy_init(struct btf *btf)
	150	{
	151	return 0;
	152	}
	153
	154	static bool bpf_dummy_ops_is_valid_access(int off, int size,
	155	enum bpf_access_type type,
	156	const struct bpf_prog *prog,
	157	struct bpf_insn_access_aux *info)
	158	{
	159	return bpf_tracing_btf_ctx_access(off, size, type, prog, info);
	160	}
	161
7dd88059 DV	162	static int bpf_dummy_ops_check_member(const struct btf_type *t,
	163	const struct btf_member *member,
	164	const struct bpf_prog *prog)
	165	{
	166	u32 moff = __btf_member_bit_offset(t, member) / 8;
	167
	168	switch (moff) {
	169	case offsetof(struct bpf_dummy_ops, test_sleepable):
	170	break;
	171	default:
	172	if (prog->aux->sleepable)
	173	return -EINVAL;
	174	}
	175
	176	return 0;
	177	}
	178
c196906d	179	static int bpf_dummy_ops_btf_struct_access(struct bpf_verifier_log *log,
6728aea7	180	const struct bpf_reg_state *reg,
b7e852a9	181	int off, int size)
c196906d HT	182	{
c196906d HT	183	const struct btf_type *state;
6728aea7	184	const struct btf_type *t;
c196906d	185	s32 type_id;
c196906d	186
6728aea7	187	type_id = btf_find_by_name_kind(reg->btf, "bpf_dummy_ops_state",
c196906d HT	188	BTF_KIND_STRUCT);
	189	if (type_id < 0)
	190	return -EINVAL;
	191
6728aea7 KKD	192	t = btf_type_by_id(reg->btf, reg->btf_id);
6728aea7 KKD	193	state = btf_type_by_id(reg->btf, type_id);
c196906d HT	194	if (t != state) {
	195	bpf_log(log, "only access to bpf_dummy_ops_state is supported\n");
	196	return -EACCES;
	197	}
	198
b7e852a9 AS	199	if (off + size > sizeof(struct bpf_dummy_ops_state)) {
	200	bpf_log(log, "write access at off %d with size %d\n", off, size);
	201	return -EACCES;
	202	}
c196906d	203
7d64c513	204	return NOT_INIT;
c196906d HT	205	}
	206
	207	static const struct bpf_verifier_ops bpf_dummy_verifier_ops = {
	208	.is_valid_access = bpf_dummy_ops_is_valid_access,
	209	.btf_struct_access = bpf_dummy_ops_btf_struct_access,
	210	};
	211
	212	static int bpf_dummy_init_member(const struct btf_type *t,
	213	const struct btf_member *member,
	214	void kdata, const void udata)
	215	{
	216	return -EOPNOTSUPP;
	217	}
	218
	219	static int bpf_dummy_reg(void *kdata)
	220	{
	221	return -EOPNOTSUPP;
	222	}
	223
	224	static void bpf_dummy_unreg(void *kdata)
	225	{
	226	}
	227
2cd3e377 PZ	228	static int bpf_dummy_test_1(struct bpf_dummy_ops_state *cb)
	229	{
	230	return 0;
	231	}
	232
	233	static int bpf_dummy_test_2(struct bpf_dummy_ops_state *cb, int a1, unsigned short a2,
	234	char a3, unsigned long a4)
	235	{
	236	return 0;
	237	}
	238
	239	static int bpf_dummy_test_sleepable(struct bpf_dummy_ops_state *cb)
	240	{
	241	return 0;
	242	}
	243
	244	static struct bpf_dummy_ops __bpf_bpf_dummy_ops = {
	245	.test_1 = bpf_dummy_test_1,
	246	.test_2 = bpf_dummy_test_2,
	247	.test_sleepable = bpf_dummy_test_sleepable,
	248	};
	249
c196906d HT	250	struct bpf_struct_ops bpf_bpf_dummy_ops = {
	251	.verifier_ops = &bpf_dummy_verifier_ops,
	252	.init = bpf_dummy_init,
7dd88059	253	.check_member = bpf_dummy_ops_check_member,
c196906d HT	254	.init_member = bpf_dummy_init_member,
	255	.reg = bpf_dummy_reg,
	256	.unreg = bpf_dummy_unreg,
	257	.name = "bpf_dummy_ops",
2cd3e377	258	.cfi_stubs = &__bpf_bpf_dummy_ops,
c196906d	259	};