1 // SPDX-License-Identifier: GPL-2.0-only 2 /* Copyright (c) 2016 Facebook 3 */ 4 #include <linux/bpf.h> 5 #include <linux/jhash.h> 6 #include <linux/filter.h> 7 #include <linux/stacktrace.h> 8 #include <linux/perf_event.h> 9 #include <linux/elf.h> 10 #include <linux/pagemap.h> 11 #include <linux/irq_work.h> 12 #include "percpu_freelist.h" 13 14 #define STACK_CREATE_FLAG_MASK \ 15 (BPF_F_NUMA_NODE | BPF_F_RDONLY | BPF_F_WRONLY | \ 16 BPF_F_STACK_BUILD_ID) 17 18 struct stack_map_bucket { 19 struct pcpu_freelist_node fnode; 20 u32 hash; 21 u32 nr; 22 u64 data[]; 23 }; 24 25 struct bpf_stack_map { 26 struct bpf_map map; 27 void *elems; 28 struct pcpu_freelist freelist; 29 u32 n_buckets; 30 struct stack_map_bucket *buckets[]; 31 }; 32 33 /* irq_work to run up_read() for build_id lookup in nmi context */ 34 struct stack_map_irq_work { 35 struct irq_work irq_work; 36 struct rw_semaphore *sem; 37 }; 38 39 static void do_up_read(struct irq_work *entry) 40 { 41 struct stack_map_irq_work *work; 42 43 work = container_of(entry, struct stack_map_irq_work, irq_work); 44 up_read_non_owner(work->sem); 45 work->sem = NULL; 46 } 47 48 static DEFINE_PER_CPU(struct stack_map_irq_work, up_read_work); 49 50 static inline bool stack_map_use_build_id(struct bpf_map *map) 51 { 52 return (map->map_flags & BPF_F_STACK_BUILD_ID); 53 } 54 55 static inline int stack_map_data_size(struct bpf_map *map) 56 { 57 return stack_map_use_build_id(map) ? 58 sizeof(struct bpf_stack_build_id) : sizeof(u64); 59 } 60 61 static int prealloc_elems_and_freelist(struct bpf_stack_map *smap) 62 { 63 u32 elem_size = sizeof(struct stack_map_bucket) + smap->map.value_size; 64 int err; 65 66 smap->elems = bpf_map_area_alloc(elem_size * smap->map.max_entries, 67 smap->map.numa_node); 68 if (!smap->elems) 69 return -ENOMEM; 70 71 err = pcpu_freelist_init(&smap->freelist); 72 if (err) 73 goto free_elems; 74 75 pcpu_freelist_populate(&smap->freelist, smap->elems, elem_size, 76 smap->map.max_entries); 77 return 0; 78 79 free_elems: 80 bpf_map_area_free(smap->elems); 81 return err; 82 } 83 84 /* Called from syscall */ 85 static struct bpf_map *stack_map_alloc(union bpf_attr *attr) 86 { 87 u32 value_size = attr->value_size; 88 struct bpf_stack_map *smap; 89 u64 cost, n_buckets; 90 int err; 91 92 if (!capable(CAP_SYS_ADMIN)) 93 return ERR_PTR(-EPERM); 94 95 if (attr->map_flags & ~STACK_CREATE_FLAG_MASK) 96 return ERR_PTR(-EINVAL); 97 98 /* check sanity of attributes */ 99 if (attr->max_entries == 0 || attr->key_size != 4 || 100 value_size < 8 || value_size % 8) 101 return ERR_PTR(-EINVAL); 102 103 BUILD_BUG_ON(sizeof(struct bpf_stack_build_id) % sizeof(u64)); 104 if (attr->map_flags & BPF_F_STACK_BUILD_ID) { 105 if (value_size % sizeof(struct bpf_stack_build_id) || 106 value_size / sizeof(struct bpf_stack_build_id) 107 > sysctl_perf_event_max_stack) 108 return ERR_PTR(-EINVAL); 109 } else if (value_size / 8 > sysctl_perf_event_max_stack) 110 return ERR_PTR(-EINVAL); 111 112 /* hash table size must be power of 2 */ 113 n_buckets = roundup_pow_of_two(attr->max_entries); 114 115 cost = n_buckets * sizeof(struct stack_map_bucket *) + sizeof(*smap); 116 if (cost >= U32_MAX - PAGE_SIZE) 117 return ERR_PTR(-E2BIG); 118 119 smap = bpf_map_area_alloc(cost, bpf_map_attr_numa_node(attr)); 120 if (!smap) 121 return ERR_PTR(-ENOMEM); 122 123 err = -E2BIG; 124 cost += n_buckets * (value_size + sizeof(struct stack_map_bucket)); 125 if (cost >= U32_MAX - PAGE_SIZE) 126 goto free_smap; 127 128 bpf_map_init_from_attr(&smap->map, attr); 129 smap->map.value_size = value_size; 130 smap->n_buckets = n_buckets; 131 smap->map.pages = round_up(cost, PAGE_SIZE) >> PAGE_SHIFT; 132 133 err = bpf_map_precharge_memlock(smap->map.pages); 134 if (err) 135 goto free_smap; 136 137 err = get_callchain_buffers(sysctl_perf_event_max_stack); 138 if (err) 139 goto free_smap; 140 141 err = prealloc_elems_and_freelist(smap); 142 if (err) 143 goto put_buffers; 144 145 return &smap->map; 146 147 put_buffers: 148 put_callchain_buffers(); 149 free_smap: 150 bpf_map_area_free(smap); 151 return ERR_PTR(err); 152 } 153 154 #define BPF_BUILD_ID 3 155 /* 156 * Parse build id from the note segment. This logic can be shared between 157 * 32-bit and 64-bit system, because Elf32_Nhdr and Elf64_Nhdr are 158 * identical. 159 */ 160 static inline int stack_map_parse_build_id(void *page_addr, 161 unsigned char *build_id, 162 void *note_start, 163 Elf32_Word note_size) 164 { 165 Elf32_Word note_offs = 0, new_offs; 166 167 /* check for overflow */ 168 if (note_start < page_addr || note_start + note_size < note_start) 169 return -EINVAL; 170 171 /* only supports note that fits in the first page */ 172 if (note_start + note_size > page_addr + PAGE_SIZE) 173 return -EINVAL; 174 175 while (note_offs + sizeof(Elf32_Nhdr) < note_size) { 176 Elf32_Nhdr *nhdr = (Elf32_Nhdr *)(note_start + note_offs); 177 178 if (nhdr->n_type == BPF_BUILD_ID && 179 nhdr->n_namesz == sizeof("GNU") && 180 nhdr->n_descsz > 0 && 181 nhdr->n_descsz <= BPF_BUILD_ID_SIZE) { 182 memcpy(build_id, 183 note_start + note_offs + 184 ALIGN(sizeof("GNU"), 4) + sizeof(Elf32_Nhdr), 185 nhdr->n_descsz); 186 memset(build_id + nhdr->n_descsz, 0, 187 BPF_BUILD_ID_SIZE - nhdr->n_descsz); 188 return 0; 189 } 190 new_offs = note_offs + sizeof(Elf32_Nhdr) + 191 ALIGN(nhdr->n_namesz, 4) + ALIGN(nhdr->n_descsz, 4); 192 if (new_offs <= note_offs) /* overflow */ 193 break; 194 note_offs = new_offs; 195 } 196 return -EINVAL; 197 } 198 199 /* Parse build ID from 32-bit ELF */ 200 static int stack_map_get_build_id_32(void *page_addr, 201 unsigned char *build_id) 202 { 203 Elf32_Ehdr *ehdr = (Elf32_Ehdr *)page_addr; 204 Elf32_Phdr *phdr; 205 int i; 206 207 /* only supports phdr that fits in one page */ 208 if (ehdr->e_phnum > 209 (PAGE_SIZE - sizeof(Elf32_Ehdr)) / sizeof(Elf32_Phdr)) 210 return -EINVAL; 211 212 phdr = (Elf32_Phdr *)(page_addr + sizeof(Elf32_Ehdr)); 213 214 for (i = 0; i < ehdr->e_phnum; ++i) 215 if (phdr[i].p_type == PT_NOTE) 216 return stack_map_parse_build_id(page_addr, build_id, 217 page_addr + phdr[i].p_offset, 218 phdr[i].p_filesz); 219 return -EINVAL; 220 } 221 222 /* Parse build ID from 64-bit ELF */ 223 static int stack_map_get_build_id_64(void *page_addr, 224 unsigned char *build_id) 225 { 226 Elf64_Ehdr *ehdr = (Elf64_Ehdr *)page_addr; 227 Elf64_Phdr *phdr; 228 int i; 229 230 /* only supports phdr that fits in one page */ 231 if (ehdr->e_phnum > 232 (PAGE_SIZE - sizeof(Elf64_Ehdr)) / sizeof(Elf64_Phdr)) 233 return -EINVAL; 234 235 phdr = (Elf64_Phdr *)(page_addr + sizeof(Elf64_Ehdr)); 236 237 for (i = 0; i < ehdr->e_phnum; ++i) 238 if (phdr[i].p_type == PT_NOTE) 239 return stack_map_parse_build_id(page_addr, build_id, 240 page_addr + phdr[i].p_offset, 241 phdr[i].p_filesz); 242 return -EINVAL; 243 } 244 245 /* Parse build ID of ELF file mapped to vma */ 246 static int stack_map_get_build_id(struct vm_area_struct *vma, 247 unsigned char *build_id) 248 { 249 Elf32_Ehdr *ehdr; 250 struct page *page; 251 void *page_addr; 252 int ret; 253 254 /* only works for page backed storage */ 255 if (!vma->vm_file) 256 return -EINVAL; 257 258 page = find_get_page(vma->vm_file->f_mapping, 0); 259 if (!page) 260 return -EFAULT; /* page not mapped */ 261 262 ret = -EINVAL; 263 page_addr = kmap_atomic(page); 264 ehdr = (Elf32_Ehdr *)page_addr; 265 266 /* compare magic x7f "ELF" */ 267 if (memcmp(ehdr->e_ident, ELFMAG, SELFMAG) != 0) 268 goto out; 269 270 /* only support executable file and shared object file */ 271 if (ehdr->e_type != ET_EXEC && ehdr->e_type != ET_DYN) 272 goto out; 273 274 if (ehdr->e_ident[EI_CLASS] == ELFCLASS32) 275 ret = stack_map_get_build_id_32(page_addr, build_id); 276 else if (ehdr->e_ident[EI_CLASS] == ELFCLASS64) 277 ret = stack_map_get_build_id_64(page_addr, build_id); 278 out: 279 kunmap_atomic(page_addr); 280 put_page(page); 281 return ret; 282 } 283 284 static void stack_map_get_build_id_offset(struct bpf_stack_build_id *id_offs, 285 u64 *ips, u32 trace_nr, bool user) 286 { 287 int i; 288 struct vm_area_struct *vma; 289 bool irq_work_busy = false; 290 struct stack_map_irq_work *work = NULL; 291 292 if (in_nmi()) { 293 work = this_cpu_ptr(&up_read_work); 294 if (work->irq_work.flags & IRQ_WORK_BUSY) 295 /* cannot queue more up_read, fallback */ 296 irq_work_busy = true; 297 } 298 299 /* 300 * We cannot do up_read() in nmi context. To do build_id lookup 301 * in nmi context, we need to run up_read() in irq_work. We use 302 * a percpu variable to do the irq_work. If the irq_work is 303 * already used by another lookup, we fall back to report ips. 304 * 305 * Same fallback is used for kernel stack (!user) on a stackmap 306 * with build_id. 307 */ 308 if (!user || !current || !current->mm || irq_work_busy || 309 down_read_trylock(¤t->mm->mmap_sem) == 0) { 310 /* cannot access current->mm, fall back to ips */ 311 for (i = 0; i < trace_nr; i++) { 312 id_offs[i].status = BPF_STACK_BUILD_ID_IP; 313 id_offs[i].ip = ips[i]; 314 memset(id_offs[i].build_id, 0, BPF_BUILD_ID_SIZE); 315 } 316 return; 317 } 318 319 for (i = 0; i < trace_nr; i++) { 320 vma = find_vma(current->mm, ips[i]); 321 if (!vma || stack_map_get_build_id(vma, id_offs[i].build_id)) { 322 /* per entry fall back to ips */ 323 id_offs[i].status = BPF_STACK_BUILD_ID_IP; 324 id_offs[i].ip = ips[i]; 325 memset(id_offs[i].build_id, 0, BPF_BUILD_ID_SIZE); 326 continue; 327 } 328 id_offs[i].offset = (vma->vm_pgoff << PAGE_SHIFT) + ips[i] 329 - vma->vm_start; 330 id_offs[i].status = BPF_STACK_BUILD_ID_VALID; 331 } 332 333 if (!work) { 334 up_read(¤t->mm->mmap_sem); 335 } else { 336 work->sem = ¤t->mm->mmap_sem; 337 irq_work_queue(&work->irq_work); 338 /* 339 * The irq_work will release the mmap_sem with 340 * up_read_non_owner(). The rwsem_release() is called 341 * here to release the lock from lockdep's perspective. 342 */ 343 rwsem_release(¤t->mm->mmap_sem.dep_map, 1, _RET_IP_); 344 } 345 } 346 347 BPF_CALL_3(bpf_get_stackid, struct pt_regs *, regs, struct bpf_map *, map, 348 u64, flags) 349 { 350 struct bpf_stack_map *smap = container_of(map, struct bpf_stack_map, map); 351 struct perf_callchain_entry *trace; 352 struct stack_map_bucket *bucket, *new_bucket, *old_bucket; 353 u32 max_depth = map->value_size / stack_map_data_size(map); 354 /* stack_map_alloc() checks that max_depth <= sysctl_perf_event_max_stack */ 355 u32 init_nr = sysctl_perf_event_max_stack - max_depth; 356 u32 skip = flags & BPF_F_SKIP_FIELD_MASK; 357 u32 hash, id, trace_nr, trace_len; 358 bool user = flags & BPF_F_USER_STACK; 359 bool kernel = !user; 360 u64 *ips; 361 bool hash_matches; 362 363 if (unlikely(flags & ~(BPF_F_SKIP_FIELD_MASK | BPF_F_USER_STACK | 364 BPF_F_FAST_STACK_CMP | BPF_F_REUSE_STACKID))) 365 return -EINVAL; 366 367 trace = get_perf_callchain(regs, init_nr, kernel, user, 368 sysctl_perf_event_max_stack, false, false); 369 370 if (unlikely(!trace)) 371 /* couldn't fetch the stack trace */ 372 return -EFAULT; 373 374 /* get_perf_callchain() guarantees that trace->nr >= init_nr 375 * and trace-nr <= sysctl_perf_event_max_stack, so trace_nr <= max_depth 376 */ 377 trace_nr = trace->nr - init_nr; 378 379 if (trace_nr <= skip) 380 /* skipping more than usable stack trace */ 381 return -EFAULT; 382 383 trace_nr -= skip; 384 trace_len = trace_nr * sizeof(u64); 385 ips = trace->ip + skip + init_nr; 386 hash = jhash2((u32 *)ips, trace_len / sizeof(u32), 0); 387 id = hash & (smap->n_buckets - 1); 388 bucket = READ_ONCE(smap->buckets[id]); 389 390 hash_matches = bucket && bucket->hash == hash; 391 /* fast cmp */ 392 if (hash_matches && flags & BPF_F_FAST_STACK_CMP) 393 return id; 394 395 if (stack_map_use_build_id(map)) { 396 /* for build_id+offset, pop a bucket before slow cmp */ 397 new_bucket = (struct stack_map_bucket *) 398 pcpu_freelist_pop(&smap->freelist); 399 if (unlikely(!new_bucket)) 400 return -ENOMEM; 401 new_bucket->nr = trace_nr; 402 stack_map_get_build_id_offset( 403 (struct bpf_stack_build_id *)new_bucket->data, 404 ips, trace_nr, user); 405 trace_len = trace_nr * sizeof(struct bpf_stack_build_id); 406 if (hash_matches && bucket->nr == trace_nr && 407 memcmp(bucket->data, new_bucket->data, trace_len) == 0) { 408 pcpu_freelist_push(&smap->freelist, &new_bucket->fnode); 409 return id; 410 } 411 if (bucket && !(flags & BPF_F_REUSE_STACKID)) { 412 pcpu_freelist_push(&smap->freelist, &new_bucket->fnode); 413 return -EEXIST; 414 } 415 } else { 416 if (hash_matches && bucket->nr == trace_nr && 417 memcmp(bucket->data, ips, trace_len) == 0) 418 return id; 419 if (bucket && !(flags & BPF_F_REUSE_STACKID)) 420 return -EEXIST; 421 422 new_bucket = (struct stack_map_bucket *) 423 pcpu_freelist_pop(&smap->freelist); 424 if (unlikely(!new_bucket)) 425 return -ENOMEM; 426 memcpy(new_bucket->data, ips, trace_len); 427 } 428 429 new_bucket->hash = hash; 430 new_bucket->nr = trace_nr; 431 432 old_bucket = xchg(&smap->buckets[id], new_bucket); 433 if (old_bucket) 434 pcpu_freelist_push(&smap->freelist, &old_bucket->fnode); 435 return id; 436 } 437 438 const struct bpf_func_proto bpf_get_stackid_proto = { 439 .func = bpf_get_stackid, 440 .gpl_only = true, 441 .ret_type = RET_INTEGER, 442 .arg1_type = ARG_PTR_TO_CTX, 443 .arg2_type = ARG_CONST_MAP_PTR, 444 .arg3_type = ARG_ANYTHING, 445 }; 446 447 BPF_CALL_4(bpf_get_stack, struct pt_regs *, regs, void *, buf, u32, size, 448 u64, flags) 449 { 450 u32 init_nr, trace_nr, copy_len, elem_size, num_elem; 451 bool user_build_id = flags & BPF_F_USER_BUILD_ID; 452 u32 skip = flags & BPF_F_SKIP_FIELD_MASK; 453 bool user = flags & BPF_F_USER_STACK; 454 struct perf_callchain_entry *trace; 455 bool kernel = !user; 456 int err = -EINVAL; 457 u64 *ips; 458 459 if (unlikely(flags & ~(BPF_F_SKIP_FIELD_MASK | BPF_F_USER_STACK | 460 BPF_F_USER_BUILD_ID))) 461 goto clear; 462 if (kernel && user_build_id) 463 goto clear; 464 465 elem_size = (user && user_build_id) ? sizeof(struct bpf_stack_build_id) 466 : sizeof(u64); 467 if (unlikely(size % elem_size)) 468 goto clear; 469 470 num_elem = size / elem_size; 471 if (sysctl_perf_event_max_stack < num_elem) 472 init_nr = 0; 473 else 474 init_nr = sysctl_perf_event_max_stack - num_elem; 475 trace = get_perf_callchain(regs, init_nr, kernel, user, 476 sysctl_perf_event_max_stack, false, false); 477 if (unlikely(!trace)) 478 goto err_fault; 479 480 trace_nr = trace->nr - init_nr; 481 if (trace_nr < skip) 482 goto err_fault; 483 484 trace_nr -= skip; 485 trace_nr = (trace_nr <= num_elem) ? trace_nr : num_elem; 486 copy_len = trace_nr * elem_size; 487 ips = trace->ip + skip + init_nr; 488 if (user && user_build_id) 489 stack_map_get_build_id_offset(buf, ips, trace_nr, user); 490 else 491 memcpy(buf, ips, copy_len); 492 493 if (size > copy_len) 494 memset(buf + copy_len, 0, size - copy_len); 495 return copy_len; 496 497 err_fault: 498 err = -EFAULT; 499 clear: 500 memset(buf, 0, size); 501 return err; 502 } 503 504 const struct bpf_func_proto bpf_get_stack_proto = { 505 .func = bpf_get_stack, 506 .gpl_only = true, 507 .ret_type = RET_INTEGER, 508 .arg1_type = ARG_PTR_TO_CTX, 509 .arg2_type = ARG_PTR_TO_UNINIT_MEM, 510 .arg3_type = ARG_CONST_SIZE_OR_ZERO, 511 .arg4_type = ARG_ANYTHING, 512 }; 513 514 /* Called from eBPF program */ 515 static void *stack_map_lookup_elem(struct bpf_map *map, void *key) 516 { 517 return ERR_PTR(-EOPNOTSUPP); 518 } 519 520 /* Called from syscall */ 521 int bpf_stackmap_copy(struct bpf_map *map, void *key, void *value) 522 { 523 struct bpf_stack_map *smap = container_of(map, struct bpf_stack_map, map); 524 struct stack_map_bucket *bucket, *old_bucket; 525 u32 id = *(u32 *)key, trace_len; 526 527 if (unlikely(id >= smap->n_buckets)) 528 return -ENOENT; 529 530 bucket = xchg(&smap->buckets[id], NULL); 531 if (!bucket) 532 return -ENOENT; 533 534 trace_len = bucket->nr * stack_map_data_size(map); 535 memcpy(value, bucket->data, trace_len); 536 memset(value + trace_len, 0, map->value_size - trace_len); 537 538 old_bucket = xchg(&smap->buckets[id], bucket); 539 if (old_bucket) 540 pcpu_freelist_push(&smap->freelist, &old_bucket->fnode); 541 return 0; 542 } 543 544 static int stack_map_get_next_key(struct bpf_map *map, void *key, 545 void *next_key) 546 { 547 struct bpf_stack_map *smap = container_of(map, 548 struct bpf_stack_map, map); 549 u32 id; 550 551 WARN_ON_ONCE(!rcu_read_lock_held()); 552 553 if (!key) { 554 id = 0; 555 } else { 556 id = *(u32 *)key; 557 if (id >= smap->n_buckets || !smap->buckets[id]) 558 id = 0; 559 else 560 id++; 561 } 562 563 while (id < smap->n_buckets && !smap->buckets[id]) 564 id++; 565 566 if (id >= smap->n_buckets) 567 return -ENOENT; 568 569 *(u32 *)next_key = id; 570 return 0; 571 } 572 573 static int stack_map_update_elem(struct bpf_map *map, void *key, void *value, 574 u64 map_flags) 575 { 576 return -EINVAL; 577 } 578 579 /* Called from syscall or from eBPF program */ 580 static int stack_map_delete_elem(struct bpf_map *map, void *key) 581 { 582 struct bpf_stack_map *smap = container_of(map, struct bpf_stack_map, map); 583 struct stack_map_bucket *old_bucket; 584 u32 id = *(u32 *)key; 585 586 if (unlikely(id >= smap->n_buckets)) 587 return -E2BIG; 588 589 old_bucket = xchg(&smap->buckets[id], NULL); 590 if (old_bucket) { 591 pcpu_freelist_push(&smap->freelist, &old_bucket->fnode); 592 return 0; 593 } else { 594 return -ENOENT; 595 } 596 } 597 598 /* Called when map->refcnt goes to zero, either from workqueue or from syscall */ 599 static void stack_map_free(struct bpf_map *map) 600 { 601 struct bpf_stack_map *smap = container_of(map, struct bpf_stack_map, map); 602 603 /* wait for bpf programs to complete before freeing stack map */ 604 synchronize_rcu(); 605 606 bpf_map_area_free(smap->elems); 607 pcpu_freelist_destroy(&smap->freelist); 608 bpf_map_area_free(smap); 609 put_callchain_buffers(); 610 } 611 612 const struct bpf_map_ops stack_trace_map_ops = { 613 .map_alloc = stack_map_alloc, 614 .map_free = stack_map_free, 615 .map_get_next_key = stack_map_get_next_key, 616 .map_lookup_elem = stack_map_lookup_elem, 617 .map_update_elem = stack_map_update_elem, 618 .map_delete_elem = stack_map_delete_elem, 619 .map_check_btf = map_check_no_btf, 620 }; 621 622 static int __init stack_map_init(void) 623 { 624 int cpu; 625 struct stack_map_irq_work *work; 626 627 for_each_possible_cpu(cpu) { 628 work = per_cpu_ptr(&up_read_work, cpu); 629 init_irq_work(&work->irq_work, do_up_read); 630 } 631 return 0; 632 } 633 subsys_initcall(stack_map_init); 634