nfp: bpf: double check vNIC capabilities after object sharing

Program translation stage checks that program can be offloaded to
the netdev which was passed during the load (bpf_attr->prog_ifindex).
After program sharing was introduced, however, the netdev on which
program is loaded can theoretically be different, and therefore
we should recheck the program size and max stack size at load time.

This was found by code inspection, AFAIK today all vNICs have
identical caps.

Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
Reviewed-by: Quentin Monnet <quentin.monnet@netronome.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>

diff --git a/drivers/net/ethernet/netronome/nfp/bpf/main.h b/drivers/net/ethernet/netronome/nfp/bpf/main.h
index 12e98a0a58e5494002b07acee68eabffb8905942..7f591d71ab28d4e13f49c4e1bee3a76aedbe6a09 100644 (file)
--- a/drivers/net/ethernet/netronome/nfp/bpf/main.h
+++ b/drivers/net/ethernet/netronome/nfp/bpf/main.h
@@ -441,6 +441,7 @@ struct nfp_bpf_subprog_info {
  * @prog: machine code
  * @prog_len: number of valid instructions in @prog array
  * @__prog_alloc_len: alloc size of @prog array
+ * @stack_size: total amount of stack used
  * @verifier_meta: temporary storage for verifier's insn meta
  * @type: BPF program type
  * @last_bpf_off: address of the last instruction translated from BPF
@@ -465,6 +466,8 @@ struct nfp_prog {
        unsigned int prog_len;
        unsigned int __prog_alloc_len;
 
+       unsigned int stack_size;
+
        struct nfp_insn_meta *verifier_meta;
 
        enum bpf_prog_type type;

diff --git a/drivers/net/ethernet/netronome/nfp/bpf/offload.c b/drivers/net/ethernet/netronome/nfp/bpf/offload.c
index 658c7143d59c8700c136f4ab2950e7b53e7ae086..ba8ceedcf6a28a9cac11fb5abc81fee7c897770a 100644 (file)
--- a/drivers/net/ethernet/netronome/nfp/bpf/offload.c
+++ b/drivers/net/ethernet/netronome/nfp/bpf/offload.c
@@ -489,7 +489,7 @@ nfp_net_bpf_load(struct nfp_net *nn, struct bpf_prog *prog,
                 struct netlink_ext_ack *extack)
 {
        struct nfp_prog *nfp_prog = prog->aux->offload->dev_priv;
-       unsigned int max_mtu;
+       unsigned int max_mtu, max_stack, max_prog_len;
        dma_addr_t dma_addr;
        void *img;
        int err;
@@ -500,6 +500,18 @@ nfp_net_bpf_load(struct nfp_net *nn, struct bpf_prog *prog,
                return -EOPNOTSUPP;
        }
 
+       max_stack = nn_readb(nn, NFP_NET_CFG_BPF_STACK_SZ) * 64;
+       if (nfp_prog->stack_size > max_stack) {
+               NL_SET_ERR_MSG_MOD(extack, "stack too large");
+               return -EOPNOTSUPP;
+       }
+
+       max_prog_len = nn_readw(nn, NFP_NET_CFG_BPF_MAX_LEN);
+       if (nfp_prog->prog_len > max_prog_len) {
+               NL_SET_ERR_MSG_MOD(extack, "program too long");
+               return -EOPNOTSUPP;
+       }
+
        img = nfp_bpf_relo_for_vnic(nfp_prog, nn->app_priv);
        if (IS_ERR(img))
                return PTR_ERR(img);

diff --git a/drivers/net/ethernet/netronome/nfp/bpf/verifier.c b/drivers/net/ethernet/netronome/nfp/bpf/verifier.c
index e04035c116a4b68a574bd566b5016aa748a1bf6d..99f977bfd8ccd55a4c6dfb75f7988311348bb2f1 100644 (file)
--- a/drivers/net/ethernet/netronome/nfp/bpf/verifier.c
+++ b/drivers/net/ethernet/netronome/nfp/bpf/verifier.c
@@ -747,9 +747,9 @@ continue_subprog:
 
 static int nfp_bpf_finalize(struct bpf_verifier_env *env)
 {
-       unsigned int stack_size, stack_needed;
        struct bpf_subprog_info *info;
        struct nfp_prog *nfp_prog;
+       unsigned int max_stack;
        struct nfp_net *nn;
        int i;
 
@@ -777,11 +777,12 @@ static int nfp_bpf_finalize(struct bpf_verifier_env *env)
        }
 
        nn = netdev_priv(env->prog->aux->offload->netdev);
-       stack_size = nn_readb(nn, NFP_NET_CFG_BPF_STACK_SZ) * 64;
-       stack_needed = nfp_bpf_get_stack_usage(nfp_prog, env->prog->len);
-       if (stack_needed > stack_size) {
+       max_stack = nn_readb(nn, NFP_NET_CFG_BPF_STACK_SZ) * 64;
+       nfp_prog->stack_size = nfp_bpf_get_stack_usage(nfp_prog,
+                                                      env->prog->len);
+       if (nfp_prog->stack_size > max_stack) {
                pr_vlog(env, "stack too large: program %dB > FW stack %dB\n",
-                       stack_needed, stack_size);
+                       nfp_prog->stack_size, max_stack);
                return -EOPNOTSUPP;
        }