1 /* Copyright (c) 2016 Facebook 2 * 3 * This program is free software; you can redistribute it and/or 4 * modify it under the terms of version 2 of the GNU General Public 5 * License as published by the Free Software Foundation. 6 */ 7 #include <linux/bpf.h> 8 #include <linux/jhash.h> 9 #include <linux/filter.h> 10 #include <linux/stacktrace.h> 11 #include <linux/perf_event.h> 12 #include <linux/elf.h> 13 #include <linux/pagemap.h> 14 #include <linux/irq_work.h> 15 #include "percpu_freelist.h" 16 17 #define STACK_CREATE_FLAG_MASK \ 18 (BPF_F_NUMA_NODE | BPF_F_RDONLY | BPF_F_WRONLY | \ 19 BPF_F_STACK_BUILD_ID) 20 21 struct stack_map_bucket { 22 struct pcpu_freelist_node fnode; 23 u32 hash; 24 u32 nr; 25 u64 data[]; 26 }; 27 28 struct bpf_stack_map { 29 struct bpf_map map; 30 void *elems; 31 struct pcpu_freelist freelist; 32 u32 n_buckets; 33 struct stack_map_bucket *buckets[]; 34 }; 35 36 /* irq_work to run up_read() for build_id lookup in nmi context */ 37 struct stack_map_irq_work { 38 struct irq_work irq_work; 39 struct rw_semaphore *sem; 40 }; 41 42 static void do_up_read(struct irq_work *entry) 43 { 44 struct stack_map_irq_work *work; 45 46 work = container_of(entry, struct stack_map_irq_work, irq_work); 47 up_read_non_owner(work->sem); 48 work->sem = NULL; 49 } 50 51 static DEFINE_PER_CPU(struct stack_map_irq_work, up_read_work); 52 53 static inline bool stack_map_use_build_id(struct bpf_map *map) 54 { 55 return (map->map_flags & BPF_F_STACK_BUILD_ID); 56 } 57 58 static inline int stack_map_data_size(struct bpf_map *map) 59 { 60 return stack_map_use_build_id(map) ? 61 sizeof(struct bpf_stack_build_id) : sizeof(u64); 62 } 63 64 static int prealloc_elems_and_freelist(struct bpf_stack_map *smap) 65 { 66 u32 elem_size = sizeof(struct stack_map_bucket) + smap->map.value_size; 67 int err; 68 69 smap->elems = bpf_map_area_alloc(elem_size * smap->map.max_entries, 70 smap->map.numa_node); 71 if (!smap->elems) 72 return -ENOMEM; 73 74 err = pcpu_freelist_init(&smap->freelist); 75 if (err) 76 goto free_elems; 77 78 pcpu_freelist_populate(&smap->freelist, smap->elems, elem_size, 79 smap->map.max_entries); 80 return 0; 81 82 free_elems: 83 bpf_map_area_free(smap->elems); 84 return err; 85 } 86 87 /* Called from syscall */ 88 static struct bpf_map *stack_map_alloc(union bpf_attr *attr) 89 { 90 u32 value_size = attr->value_size; 91 struct bpf_stack_map *smap; 92 u64 cost, n_buckets; 93 int err; 94 95 if (!capable(CAP_SYS_ADMIN)) 96 return ERR_PTR(-EPERM); 97 98 if (attr->map_flags & ~STACK_CREATE_FLAG_MASK) 99 return ERR_PTR(-EINVAL); 100 101 /* check sanity of attributes */ 102 if (attr->max_entries == 0 || attr->key_size != 4 || 103 value_size < 8 || value_size % 8) 104 return ERR_PTR(-EINVAL); 105 106 BUILD_BUG_ON(sizeof(struct bpf_stack_build_id) % sizeof(u64)); 107 if (attr->map_flags & BPF_F_STACK_BUILD_ID) { 108 if (value_size % sizeof(struct bpf_stack_build_id) || 109 value_size / sizeof(struct bpf_stack_build_id) 110 > sysctl_perf_event_max_stack) 111 return ERR_PTR(-EINVAL); 112 } else if (value_size / 8 > sysctl_perf_event_max_stack) 113 return ERR_PTR(-EINVAL); 114 115 /* hash table size must be power of 2 */ 116 n_buckets = roundup_pow_of_two(attr->max_entries); 117 118 cost = n_buckets * sizeof(struct stack_map_bucket *) + sizeof(*smap); 119 if (cost >= U32_MAX - PAGE_SIZE) 120 return ERR_PTR(-E2BIG); 121 122 smap = bpf_map_area_alloc(cost, bpf_map_attr_numa_node(attr)); 123 if (!smap) 124 return ERR_PTR(-ENOMEM); 125 126 err = -E2BIG; 127 cost += n_buckets * (value_size + sizeof(struct stack_map_bucket)); 128 if (cost >= U32_MAX - PAGE_SIZE) 129 goto free_smap; 130 131 bpf_map_init_from_attr(&smap->map, attr); 132 smap->map.value_size = value_size; 133 smap->n_buckets = n_buckets; 134 smap->map.pages = round_up(cost, PAGE_SIZE) >> PAGE_SHIFT; 135 136 err = bpf_map_precharge_memlock(smap->map.pages); 137 if (err) 138 goto free_smap; 139 140 err = get_callchain_buffers(sysctl_perf_event_max_stack); 141 if (err) 142 goto free_smap; 143 144 err = prealloc_elems_and_freelist(smap); 145 if (err) 146 goto put_buffers; 147 148 return &smap->map; 149 150 put_buffers: 151 put_callchain_buffers(); 152 free_smap: 153 bpf_map_area_free(smap); 154 return ERR_PTR(err); 155 } 156 157 #define BPF_BUILD_ID 3 158 /* 159 * Parse build id from the note segment. This logic can be shared between 160 * 32-bit and 64-bit system, because Elf32_Nhdr and Elf64_Nhdr are 161 * identical. 162 */ 163 static inline int stack_map_parse_build_id(void *page_addr, 164 unsigned char *build_id, 165 void *note_start, 166 Elf32_Word note_size) 167 { 168 Elf32_Word note_offs = 0, new_offs; 169 170 /* check for overflow */ 171 if (note_start < page_addr || note_start + note_size < note_start) 172 return -EINVAL; 173 174 /* only supports note that fits in the first page */ 175 if (note_start + note_size > page_addr + PAGE_SIZE) 176 return -EINVAL; 177 178 while (note_offs + sizeof(Elf32_Nhdr) < note_size) { 179 Elf32_Nhdr *nhdr = (Elf32_Nhdr *)(note_start + note_offs); 180 181 if (nhdr->n_type == BPF_BUILD_ID && 182 nhdr->n_namesz == sizeof("GNU") && 183 nhdr->n_descsz > 0 && 184 nhdr->n_descsz <= BPF_BUILD_ID_SIZE) { 185 memcpy(build_id, 186 note_start + note_offs + 187 ALIGN(sizeof("GNU"), 4) + sizeof(Elf32_Nhdr), 188 nhdr->n_descsz); 189 memset(build_id + nhdr->n_descsz, 0, 190 BPF_BUILD_ID_SIZE - nhdr->n_descsz); 191 return 0; 192 } 193 new_offs = note_offs + sizeof(Elf32_Nhdr) + 194 ALIGN(nhdr->n_namesz, 4) + ALIGN(nhdr->n_descsz, 4); 195 if (new_offs <= note_offs) /* overflow */ 196 break; 197 note_offs = new_offs; 198 } 199 return -EINVAL; 200 } 201 202 /* Parse build ID from 32-bit ELF */ 203 static int stack_map_get_build_id_32(void *page_addr, 204 unsigned char *build_id) 205 { 206 Elf32_Ehdr *ehdr = (Elf32_Ehdr *)page_addr; 207 Elf32_Phdr *phdr; 208 int i; 209 210 /* only supports phdr that fits in one page */ 211 if (ehdr->e_phnum > 212 (PAGE_SIZE - sizeof(Elf32_Ehdr)) / sizeof(Elf32_Phdr)) 213 return -EINVAL; 214 215 phdr = (Elf32_Phdr *)(page_addr + sizeof(Elf32_Ehdr)); 216 217 for (i = 0; i < ehdr->e_phnum; ++i) 218 if (phdr[i].p_type == PT_NOTE) 219 return stack_map_parse_build_id(page_addr, build_id, 220 page_addr + phdr[i].p_offset, 221 phdr[i].p_filesz); 222 return -EINVAL; 223 } 224 225 /* Parse build ID from 64-bit ELF */ 226 static int stack_map_get_build_id_64(void *page_addr, 227 unsigned char *build_id) 228 { 229 Elf64_Ehdr *ehdr = (Elf64_Ehdr *)page_addr; 230 Elf64_Phdr *phdr; 231 int i; 232 233 /* only supports phdr that fits in one page */ 234 if (ehdr->e_phnum > 235 (PAGE_SIZE - sizeof(Elf64_Ehdr)) / sizeof(Elf64_Phdr)) 236 return -EINVAL; 237 238 phdr = (Elf64_Phdr *)(page_addr + sizeof(Elf64_Ehdr)); 239 240 for (i = 0; i < ehdr->e_phnum; ++i) 241 if (phdr[i].p_type == PT_NOTE) 242 return stack_map_parse_build_id(page_addr, build_id, 243 page_addr + phdr[i].p_offset, 244 phdr[i].p_filesz); 245 return -EINVAL; 246 } 247 248 /* Parse build ID of ELF file mapped to vma */ 249 static int stack_map_get_build_id(struct vm_area_struct *vma, 250 unsigned char *build_id) 251 { 252 Elf32_Ehdr *ehdr; 253 struct page *page; 254 void *page_addr; 255 int ret; 256 257 /* only works for page backed storage */ 258 if (!vma->vm_file) 259 return -EINVAL; 260 261 page = find_get_page(vma->vm_file->f_mapping, 0); 262 if (!page) 263 return -EFAULT; /* page not mapped */ 264 265 ret = -EINVAL; 266 page_addr = kmap_atomic(page); 267 ehdr = (Elf32_Ehdr *)page_addr; 268 269 /* compare magic x7f "ELF" */ 270 if (memcmp(ehdr->e_ident, ELFMAG, SELFMAG) != 0) 271 goto out; 272 273 /* only support executable file and shared object file */ 274 if (ehdr->e_type != ET_EXEC && ehdr->e_type != ET_DYN) 275 goto out; 276 277 if (ehdr->e_ident[EI_CLASS] == ELFCLASS32) 278 ret = stack_map_get_build_id_32(page_addr, build_id); 279 else if (ehdr->e_ident[EI_CLASS] == ELFCLASS64) 280 ret = stack_map_get_build_id_64(page_addr, build_id); 281 out: 282 kunmap_atomic(page_addr); 283 put_page(page); 284 return ret; 285 } 286 287 static void stack_map_get_build_id_offset(struct bpf_stack_build_id *id_offs, 288 u64 *ips, u32 trace_nr, bool user) 289 { 290 int i; 291 struct vm_area_struct *vma; 292 bool irq_work_busy = false; 293 struct stack_map_irq_work *work = NULL; 294 295 if (in_nmi()) { 296 work = this_cpu_ptr(&up_read_work); 297 if (work->irq_work.flags & IRQ_WORK_BUSY) 298 /* cannot queue more up_read, fallback */ 299 irq_work_busy = true; 300 } 301 302 /* 303 * We cannot do up_read() in nmi context. To do build_id lookup 304 * in nmi context, we need to run up_read() in irq_work. We use 305 * a percpu variable to do the irq_work. If the irq_work is 306 * already used by another lookup, we fall back to report ips. 307 * 308 * Same fallback is used for kernel stack (!user) on a stackmap 309 * with build_id. 310 */ 311 if (!user || !current || !current->mm || irq_work_busy || 312 down_read_trylock(¤t->mm->mmap_sem) == 0) { 313 /* cannot access current->mm, fall back to ips */ 314 for (i = 0; i < trace_nr; i++) { 315 id_offs[i].status = BPF_STACK_BUILD_ID_IP; 316 id_offs[i].ip = ips[i]; 317 memset(id_offs[i].build_id, 0, BPF_BUILD_ID_SIZE); 318 } 319 return; 320 } 321 322 for (i = 0; i < trace_nr; i++) { 323 vma = find_vma(current->mm, ips[i]); 324 if (!vma || stack_map_get_build_id(vma, id_offs[i].build_id)) { 325 /* per entry fall back to ips */ 326 id_offs[i].status = BPF_STACK_BUILD_ID_IP; 327 id_offs[i].ip = ips[i]; 328 memset(id_offs[i].build_id, 0, BPF_BUILD_ID_SIZE); 329 continue; 330 } 331 id_offs[i].offset = (vma->vm_pgoff << PAGE_SHIFT) + ips[i] 332 - vma->vm_start; 333 id_offs[i].status = BPF_STACK_BUILD_ID_VALID; 334 } 335 336 if (!work) { 337 up_read(¤t->mm->mmap_sem); 338 } else { 339 work->sem = ¤t->mm->mmap_sem; 340 irq_work_queue(&work->irq_work); 341 /* 342 * The irq_work will release the mmap_sem with 343 * up_read_non_owner(). The rwsem_release() is called 344 * here to release the lock from lockdep's perspective. 345 */ 346 rwsem_release(¤t->mm->mmap_sem.dep_map, 1, _RET_IP_); 347 } 348 } 349 350 BPF_CALL_3(bpf_get_stackid, struct pt_regs *, regs, struct bpf_map *, map, 351 u64, flags) 352 { 353 struct bpf_stack_map *smap = container_of(map, struct bpf_stack_map, map); 354 struct perf_callchain_entry *trace; 355 struct stack_map_bucket *bucket, *new_bucket, *old_bucket; 356 u32 max_depth = map->value_size / stack_map_data_size(map); 357 /* stack_map_alloc() checks that max_depth <= sysctl_perf_event_max_stack */ 358 u32 init_nr = sysctl_perf_event_max_stack - max_depth; 359 u32 skip = flags & BPF_F_SKIP_FIELD_MASK; 360 u32 hash, id, trace_nr, trace_len; 361 bool user = flags & BPF_F_USER_STACK; 362 bool kernel = !user; 363 u64 *ips; 364 bool hash_matches; 365 366 if (unlikely(flags & ~(BPF_F_SKIP_FIELD_MASK | BPF_F_USER_STACK | 367 BPF_F_FAST_STACK_CMP | BPF_F_REUSE_STACKID))) 368 return -EINVAL; 369 370 trace = get_perf_callchain(regs, init_nr, kernel, user, 371 sysctl_perf_event_max_stack, false, false); 372 373 if (unlikely(!trace)) 374 /* couldn't fetch the stack trace */ 375 return -EFAULT; 376 377 /* get_perf_callchain() guarantees that trace->nr >= init_nr 378 * and trace-nr <= sysctl_perf_event_max_stack, so trace_nr <= max_depth 379 */ 380 trace_nr = trace->nr - init_nr; 381 382 if (trace_nr <= skip) 383 /* skipping more than usable stack trace */ 384 return -EFAULT; 385 386 trace_nr -= skip; 387 trace_len = trace_nr * sizeof(u64); 388 ips = trace->ip + skip + init_nr; 389 hash = jhash2((u32 *)ips, trace_len / sizeof(u32), 0); 390 id = hash & (smap->n_buckets - 1); 391 bucket = READ_ONCE(smap->buckets[id]); 392 393 hash_matches = bucket && bucket->hash == hash; 394 /* fast cmp */ 395 if (hash_matches && flags & BPF_F_FAST_STACK_CMP) 396 return id; 397 398 if (stack_map_use_build_id(map)) { 399 /* for build_id+offset, pop a bucket before slow cmp */ 400 new_bucket = (struct stack_map_bucket *) 401 pcpu_freelist_pop(&smap->freelist); 402 if (unlikely(!new_bucket)) 403 return -ENOMEM; 404 new_bucket->nr = trace_nr; 405 stack_map_get_build_id_offset( 406 (struct bpf_stack_build_id *)new_bucket->data, 407 ips, trace_nr, user); 408 trace_len = trace_nr * sizeof(struct bpf_stack_build_id); 409 if (hash_matches && bucket->nr == trace_nr && 410 memcmp(bucket->data, new_bucket->data, trace_len) == 0) { 411 pcpu_freelist_push(&smap->freelist, &new_bucket->fnode); 412 return id; 413 } 414 if (bucket && !(flags & BPF_F_REUSE_STACKID)) { 415 pcpu_freelist_push(&smap->freelist, &new_bucket->fnode); 416 return -EEXIST; 417 } 418 } else { 419 if (hash_matches && bucket->nr == trace_nr && 420 memcmp(bucket->data, ips, trace_len) == 0) 421 return id; 422 if (bucket && !(flags & BPF_F_REUSE_STACKID)) 423 return -EEXIST; 424 425 new_bucket = (struct stack_map_bucket *) 426 pcpu_freelist_pop(&smap->freelist); 427 if (unlikely(!new_bucket)) 428 return -ENOMEM; 429 memcpy(new_bucket->data, ips, trace_len); 430 } 431 432 new_bucket->hash = hash; 433 new_bucket->nr = trace_nr; 434 435 old_bucket = xchg(&smap->buckets[id], new_bucket); 436 if (old_bucket) 437 pcpu_freelist_push(&smap->freelist, &old_bucket->fnode); 438 return id; 439 } 440 441 const struct bpf_func_proto bpf_get_stackid_proto = { 442 .func = bpf_get_stackid, 443 .gpl_only = true, 444 .ret_type = RET_INTEGER, 445 .arg1_type = ARG_PTR_TO_CTX, 446 .arg2_type = ARG_CONST_MAP_PTR, 447 .arg3_type = ARG_ANYTHING, 448 }; 449 450 BPF_CALL_4(bpf_get_stack, struct pt_regs *, regs, void *, buf, u32, size, 451 u64, flags) 452 { 453 u32 init_nr, trace_nr, copy_len, elem_size, num_elem; 454 bool user_build_id = flags & BPF_F_USER_BUILD_ID; 455 u32 skip = flags & BPF_F_SKIP_FIELD_MASK; 456 bool user = flags & BPF_F_USER_STACK; 457 struct perf_callchain_entry *trace; 458 bool kernel = !user; 459 int err = -EINVAL; 460 u64 *ips; 461 462 if (unlikely(flags & ~(BPF_F_SKIP_FIELD_MASK | BPF_F_USER_STACK | 463 BPF_F_USER_BUILD_ID))) 464 goto clear; 465 if (kernel && user_build_id) 466 goto clear; 467 468 elem_size = (user && user_build_id) ? sizeof(struct bpf_stack_build_id) 469 : sizeof(u64); 470 if (unlikely(size % elem_size)) 471 goto clear; 472 473 num_elem = size / elem_size; 474 if (sysctl_perf_event_max_stack < num_elem) 475 init_nr = 0; 476 else 477 init_nr = sysctl_perf_event_max_stack - num_elem; 478 trace = get_perf_callchain(regs, init_nr, kernel, user, 479 sysctl_perf_event_max_stack, false, false); 480 if (unlikely(!trace)) 481 goto err_fault; 482 483 trace_nr = trace->nr - init_nr; 484 if (trace_nr < skip) 485 goto err_fault; 486 487 trace_nr -= skip; 488 trace_nr = (trace_nr <= num_elem) ? trace_nr : num_elem; 489 copy_len = trace_nr * elem_size; 490 ips = trace->ip + skip + init_nr; 491 if (user && user_build_id) 492 stack_map_get_build_id_offset(buf, ips, trace_nr, user); 493 else 494 memcpy(buf, ips, copy_len); 495 496 if (size > copy_len) 497 memset(buf + copy_len, 0, size - copy_len); 498 return copy_len; 499 500 err_fault: 501 err = -EFAULT; 502 clear: 503 memset(buf, 0, size); 504 return err; 505 } 506 507 const struct bpf_func_proto bpf_get_stack_proto = { 508 .func = bpf_get_stack, 509 .gpl_only = true, 510 .ret_type = RET_INTEGER, 511 .arg1_type = ARG_PTR_TO_CTX, 512 .arg2_type = ARG_PTR_TO_UNINIT_MEM, 513 .arg3_type = ARG_CONST_SIZE_OR_ZERO, 514 .arg4_type = ARG_ANYTHING, 515 }; 516 517 /* Called from eBPF program */ 518 static void *stack_map_lookup_elem(struct bpf_map *map, void *key) 519 { 520 return ERR_PTR(-EOPNOTSUPP); 521 } 522 523 /* Called from syscall */ 524 int bpf_stackmap_copy(struct bpf_map *map, void *key, void *value) 525 { 526 struct bpf_stack_map *smap = container_of(map, struct bpf_stack_map, map); 527 struct stack_map_bucket *bucket, *old_bucket; 528 u32 id = *(u32 *)key, trace_len; 529 530 if (unlikely(id >= smap->n_buckets)) 531 return -ENOENT; 532 533 bucket = xchg(&smap->buckets[id], NULL); 534 if (!bucket) 535 return -ENOENT; 536 537 trace_len = bucket->nr * stack_map_data_size(map); 538 memcpy(value, bucket->data, trace_len); 539 memset(value + trace_len, 0, map->value_size - trace_len); 540 541 old_bucket = xchg(&smap->buckets[id], bucket); 542 if (old_bucket) 543 pcpu_freelist_push(&smap->freelist, &old_bucket->fnode); 544 return 0; 545 } 546 547 static int stack_map_get_next_key(struct bpf_map *map, void *key, 548 void *next_key) 549 { 550 struct bpf_stack_map *smap = container_of(map, 551 struct bpf_stack_map, map); 552 u32 id; 553 554 WARN_ON_ONCE(!rcu_read_lock_held()); 555 556 if (!key) { 557 id = 0; 558 } else { 559 id = *(u32 *)key; 560 if (id >= smap->n_buckets || !smap->buckets[id]) 561 id = 0; 562 else 563 id++; 564 } 565 566 while (id < smap->n_buckets && !smap->buckets[id]) 567 id++; 568 569 if (id >= smap->n_buckets) 570 return -ENOENT; 571 572 *(u32 *)next_key = id; 573 return 0; 574 } 575 576 static int stack_map_update_elem(struct bpf_map *map, void *key, void *value, 577 u64 map_flags) 578 { 579 return -EINVAL; 580 } 581 582 /* Called from syscall or from eBPF program */ 583 static int stack_map_delete_elem(struct bpf_map *map, void *key) 584 { 585 struct bpf_stack_map *smap = container_of(map, struct bpf_stack_map, map); 586 struct stack_map_bucket *old_bucket; 587 u32 id = *(u32 *)key; 588 589 if (unlikely(id >= smap->n_buckets)) 590 return -E2BIG; 591 592 old_bucket = xchg(&smap->buckets[id], NULL); 593 if (old_bucket) { 594 pcpu_freelist_push(&smap->freelist, &old_bucket->fnode); 595 return 0; 596 } else { 597 return -ENOENT; 598 } 599 } 600 601 /* Called when map->refcnt goes to zero, either from workqueue or from syscall */ 602 static void stack_map_free(struct bpf_map *map) 603 { 604 struct bpf_stack_map *smap = container_of(map, struct bpf_stack_map, map); 605 606 /* wait for bpf programs to complete before freeing stack map */ 607 synchronize_rcu(); 608 609 bpf_map_area_free(smap->elems); 610 pcpu_freelist_destroy(&smap->freelist); 611 bpf_map_area_free(smap); 612 put_callchain_buffers(); 613 } 614 615 const struct bpf_map_ops stack_trace_map_ops = { 616 .map_alloc = stack_map_alloc, 617 .map_free = stack_map_free, 618 .map_get_next_key = stack_map_get_next_key, 619 .map_lookup_elem = stack_map_lookup_elem, 620 .map_update_elem = stack_map_update_elem, 621 .map_delete_elem = stack_map_delete_elem, 622 .map_check_btf = map_check_no_btf, 623 }; 624 625 static int __init stack_map_init(void) 626 { 627 int cpu; 628 struct stack_map_irq_work *work; 629 630 for_each_possible_cpu(cpu) { 631 work = per_cpu_ptr(&up_read_work, cpu); 632 init_irq_work(&work->irq_work, do_up_read); 633 } 634 return 0; 635 } 636 subsys_initcall(stack_map_init); 637