1 | // SPDX-License-Identifier: GPL-2.0 |
2 | /* |
3 | * Copyright (C) 2021. Huawei Technologies Co., Ltd |
4 | */ |
5 | #include <linux/kernel.h> |
6 | #include <linux/bpf_verifier.h> |
7 | #include <linux/bpf.h> |
8 | #include <linux/btf.h> |
9 | |
10 | extern struct bpf_struct_ops bpf_bpf_dummy_ops; |
11 | |
12 | /* A common type for test_N with return value in bpf_dummy_ops */ |
13 | typedef int (*dummy_ops_test_ret_fn)(struct bpf_dummy_ops_state *state, ...); |
14 | |
15 | struct bpf_dummy_ops_test_args { |
16 | u64 args[MAX_BPF_FUNC_ARGS]; |
17 | struct bpf_dummy_ops_state state; |
18 | }; |
19 | |
20 | static struct bpf_dummy_ops_test_args * |
21 | dummy_ops_init_args(const union bpf_attr *kattr, unsigned int nr) |
22 | { |
23 | __u32 size_in; |
24 | struct bpf_dummy_ops_test_args *args; |
25 | void __user *ctx_in; |
26 | void __user *u_state; |
27 | |
28 | size_in = kattr->test.ctx_size_in; |
29 | if (size_in != sizeof(u64) * nr) |
30 | return ERR_PTR(error: -EINVAL); |
31 | |
32 | args = kzalloc(size: sizeof(*args), GFP_KERNEL); |
33 | if (!args) |
34 | return ERR_PTR(error: -ENOMEM); |
35 | |
36 | ctx_in = u64_to_user_ptr(kattr->test.ctx_in); |
37 | if (copy_from_user(to: args->args, from: ctx_in, n: size_in)) |
38 | goto out; |
39 | |
40 | /* args[0] is 0 means state argument of test_N will be NULL */ |
41 | u_state = u64_to_user_ptr(args->args[0]); |
42 | if (u_state && copy_from_user(to: &args->state, from: u_state, |
43 | n: sizeof(args->state))) |
44 | goto out; |
45 | |
46 | return args; |
47 | out: |
48 | kfree(objp: args); |
49 | return ERR_PTR(error: -EFAULT); |
50 | } |
51 | |
52 | static int dummy_ops_copy_args(struct bpf_dummy_ops_test_args *args) |
53 | { |
54 | void __user *u_state; |
55 | |
56 | u_state = u64_to_user_ptr(args->args[0]); |
57 | if (u_state && copy_to_user(to: u_state, from: &args->state, n: sizeof(args->state))) |
58 | return -EFAULT; |
59 | |
60 | return 0; |
61 | } |
62 | |
63 | static int dummy_ops_call_op(void *image, struct bpf_dummy_ops_test_args *args) |
64 | { |
65 | dummy_ops_test_ret_fn test = (void *)image; |
66 | struct bpf_dummy_ops_state *state = NULL; |
67 | |
68 | /* state needs to be NULL if args[0] is 0 */ |
69 | if (args->args[0]) |
70 | state = &args->state; |
71 | return test(state, args->args[1], args->args[2], |
72 | args->args[3], args->args[4]); |
73 | } |
74 | |
75 | extern const struct bpf_link_ops bpf_struct_ops_link_lops; |
76 | |
77 | int bpf_struct_ops_test_run(struct bpf_prog *prog, const union bpf_attr *kattr, |
78 | union bpf_attr __user *uattr) |
79 | { |
80 | const struct bpf_struct_ops *st_ops = &bpf_bpf_dummy_ops; |
81 | const struct btf_type *func_proto; |
82 | struct bpf_dummy_ops_test_args *args; |
83 | struct bpf_tramp_links *tlinks; |
84 | struct bpf_tramp_link *link = NULL; |
85 | void *image = NULL; |
86 | unsigned int op_idx; |
87 | int prog_ret; |
88 | int err; |
89 | |
90 | if (prog->aux->attach_btf_id != st_ops->type_id) |
91 | return -EOPNOTSUPP; |
92 | |
93 | func_proto = prog->aux->attach_func_proto; |
94 | args = dummy_ops_init_args(kattr, nr: btf_type_vlen(t: func_proto)); |
95 | if (IS_ERR(ptr: args)) |
96 | return PTR_ERR(ptr: args); |
97 | |
98 | tlinks = kcalloc(n: BPF_TRAMP_MAX, size: sizeof(*tlinks), GFP_KERNEL); |
99 | if (!tlinks) { |
100 | err = -ENOMEM; |
101 | goto out; |
102 | } |
103 | |
104 | image = bpf_jit_alloc_exec(PAGE_SIZE); |
105 | if (!image) { |
106 | err = -ENOMEM; |
107 | goto out; |
108 | } |
109 | set_vm_flush_reset_perms(image); |
110 | |
111 | link = kzalloc(size: sizeof(*link), GFP_USER); |
112 | if (!link) { |
113 | err = -ENOMEM; |
114 | goto out; |
115 | } |
116 | /* prog doesn't take the ownership of the reference from caller */ |
117 | bpf_prog_inc(prog); |
118 | bpf_link_init(link: &link->link, type: BPF_LINK_TYPE_STRUCT_OPS, ops: &bpf_struct_ops_link_lops, prog); |
119 | |
120 | op_idx = prog->expected_attach_type; |
121 | err = bpf_struct_ops_prepare_trampoline(tlinks, link, |
122 | model: &st_ops->func_models[op_idx], |
123 | image, image_end: image + PAGE_SIZE); |
124 | if (err < 0) |
125 | goto out; |
126 | |
127 | set_memory_rox(addr: (long)image, numpages: 1); |
128 | prog_ret = dummy_ops_call_op(image, args); |
129 | |
130 | err = dummy_ops_copy_args(args); |
131 | if (err) |
132 | goto out; |
133 | if (put_user(prog_ret, &uattr->test.retval)) |
134 | err = -EFAULT; |
135 | out: |
136 | kfree(objp: args); |
137 | bpf_jit_free_exec(addr: image); |
138 | if (link) |
139 | bpf_link_put(link: &link->link); |
140 | kfree(objp: tlinks); |
141 | return err; |
142 | } |
143 | |
144 | static int bpf_dummy_init(struct btf *btf) |
145 | { |
146 | return 0; |
147 | } |
148 | |
149 | static bool bpf_dummy_ops_is_valid_access(int off, int size, |
150 | enum bpf_access_type type, |
151 | const struct bpf_prog *prog, |
152 | struct bpf_insn_access_aux *info) |
153 | { |
154 | return bpf_tracing_btf_ctx_access(off, size, type, prog, info); |
155 | } |
156 | |
157 | static int bpf_dummy_ops_check_member(const struct btf_type *t, |
158 | const struct btf_member *member, |
159 | const struct bpf_prog *prog) |
160 | { |
161 | u32 moff = __btf_member_bit_offset(struct_type: t, member) / 8; |
162 | |
163 | switch (moff) { |
164 | case offsetof(struct bpf_dummy_ops, test_sleepable): |
165 | break; |
166 | default: |
167 | if (prog->aux->sleepable) |
168 | return -EINVAL; |
169 | } |
170 | |
171 | return 0; |
172 | } |
173 | |
174 | static int bpf_dummy_ops_btf_struct_access(struct bpf_verifier_log *log, |
175 | const struct bpf_reg_state *reg, |
176 | int off, int size) |
177 | { |
178 | const struct btf_type *state; |
179 | const struct btf_type *t; |
180 | s32 type_id; |
181 | |
182 | type_id = btf_find_by_name_kind(btf: reg->btf, name: "bpf_dummy_ops_state" , |
183 | kind: BTF_KIND_STRUCT); |
184 | if (type_id < 0) |
185 | return -EINVAL; |
186 | |
187 | t = btf_type_by_id(btf: reg->btf, type_id: reg->btf_id); |
188 | state = btf_type_by_id(btf: reg->btf, type_id); |
189 | if (t != state) { |
190 | bpf_log(log, fmt: "only access to bpf_dummy_ops_state is supported\n" ); |
191 | return -EACCES; |
192 | } |
193 | |
194 | if (off + size > sizeof(struct bpf_dummy_ops_state)) { |
195 | bpf_log(log, fmt: "write access at off %d with size %d\n" , off, size); |
196 | return -EACCES; |
197 | } |
198 | |
199 | return NOT_INIT; |
200 | } |
201 | |
202 | static const struct bpf_verifier_ops bpf_dummy_verifier_ops = { |
203 | .is_valid_access = bpf_dummy_ops_is_valid_access, |
204 | .btf_struct_access = bpf_dummy_ops_btf_struct_access, |
205 | }; |
206 | |
207 | static int bpf_dummy_init_member(const struct btf_type *t, |
208 | const struct btf_member *member, |
209 | void *kdata, const void *udata) |
210 | { |
211 | return -EOPNOTSUPP; |
212 | } |
213 | |
214 | static int bpf_dummy_reg(void *kdata) |
215 | { |
216 | return -EOPNOTSUPP; |
217 | } |
218 | |
219 | static void bpf_dummy_unreg(void *kdata) |
220 | { |
221 | } |
222 | |
223 | struct bpf_struct_ops bpf_bpf_dummy_ops = { |
224 | .verifier_ops = &bpf_dummy_verifier_ops, |
225 | .init = bpf_dummy_init, |
226 | .check_member = bpf_dummy_ops_check_member, |
227 | .init_member = bpf_dummy_init_member, |
228 | .reg = bpf_dummy_reg, |
229 | .unreg = bpf_dummy_unreg, |
230 | .name = "bpf_dummy_ops" , |
231 | }; |
232 | |