1c196906dSHou Tao // SPDX-License-Identifier: GPL-2.0
2c196906dSHou Tao /*
3c196906dSHou Tao * Copyright (C) 2021. Huawei Technologies Co., Ltd
4c196906dSHou Tao */
5c196906dSHou Tao #include <linux/kernel.h>
6c196906dSHou Tao #include <linux/bpf_verifier.h>
7c196906dSHou Tao #include <linux/bpf.h>
8c196906dSHou Tao #include <linux/btf.h>
9c196906dSHou Tao
10c196906dSHou Tao extern struct bpf_struct_ops bpf_bpf_dummy_ops;
11c196906dSHou Tao
12c196906dSHou Tao /* A common type for test_N with return value in bpf_dummy_ops */
13c196906dSHou Tao typedef int (*dummy_ops_test_ret_fn)(struct bpf_dummy_ops_state *state, ...);
14c196906dSHou Tao
15c196906dSHou Tao struct bpf_dummy_ops_test_args {
16c196906dSHou Tao u64 args[MAX_BPF_FUNC_ARGS];
17c196906dSHou Tao struct bpf_dummy_ops_state state;
18c196906dSHou Tao };
19c196906dSHou Tao
20c196906dSHou Tao static struct bpf_dummy_ops_test_args *
dummy_ops_init_args(const union bpf_attr * kattr,unsigned int nr)21c196906dSHou Tao dummy_ops_init_args(const union bpf_attr *kattr, unsigned int nr)
22c196906dSHou Tao {
23c196906dSHou Tao __u32 size_in;
24c196906dSHou Tao struct bpf_dummy_ops_test_args *args;
25c196906dSHou Tao void __user *ctx_in;
26c196906dSHou Tao void __user *u_state;
27c196906dSHou Tao
28c196906dSHou Tao size_in = kattr->test.ctx_size_in;
29c196906dSHou Tao if (size_in != sizeof(u64) * nr)
30c196906dSHou Tao return ERR_PTR(-EINVAL);
31c196906dSHou Tao
32c196906dSHou Tao args = kzalloc(sizeof(*args), GFP_KERNEL);
33c196906dSHou Tao if (!args)
34c196906dSHou Tao return ERR_PTR(-ENOMEM);
35c196906dSHou Tao
36c196906dSHou Tao ctx_in = u64_to_user_ptr(kattr->test.ctx_in);
37c196906dSHou Tao if (copy_from_user(args->args, ctx_in, size_in))
38c196906dSHou Tao goto out;
39c196906dSHou Tao
40c196906dSHou Tao /* args[0] is 0 means state argument of test_N will be NULL */
41c196906dSHou Tao u_state = u64_to_user_ptr(args->args[0]);
42c196906dSHou Tao if (u_state && copy_from_user(&args->state, u_state,
43c196906dSHou Tao sizeof(args->state)))
44c196906dSHou Tao goto out;
45c196906dSHou Tao
46c196906dSHou Tao return args;
47c196906dSHou Tao out:
48c196906dSHou Tao kfree(args);
49c196906dSHou Tao return ERR_PTR(-EFAULT);
50c196906dSHou Tao }
51c196906dSHou Tao
dummy_ops_copy_args(struct bpf_dummy_ops_test_args * args)52c196906dSHou Tao static int dummy_ops_copy_args(struct bpf_dummy_ops_test_args *args)
53c196906dSHou Tao {
54c196906dSHou Tao void __user *u_state;
55c196906dSHou Tao
56c196906dSHou Tao u_state = u64_to_user_ptr(args->args[0]);
57c196906dSHou Tao if (u_state && copy_to_user(u_state, &args->state, sizeof(args->state)))
58c196906dSHou Tao return -EFAULT;
59c196906dSHou Tao
60c196906dSHou Tao return 0;
61c196906dSHou Tao }
62c196906dSHou Tao
dummy_ops_call_op(void * image,struct bpf_dummy_ops_test_args * args)63c196906dSHou Tao static int dummy_ops_call_op(void *image, struct bpf_dummy_ops_test_args *args)
64c196906dSHou Tao {
65c196906dSHou Tao dummy_ops_test_ret_fn test = (void *)image;
66c196906dSHou Tao struct bpf_dummy_ops_state *state = NULL;
67c196906dSHou Tao
68c196906dSHou Tao /* state needs to be NULL if args[0] is 0 */
69c196906dSHou Tao if (args->args[0])
70c196906dSHou Tao state = &args->state;
71c196906dSHou Tao return test(state, args->args[1], args->args[2],
72c196906dSHou Tao args->args[3], args->args[4]);
73c196906dSHou Tao }
74c196906dSHou Tao
75f7e0beafSKui-Feng Lee extern const struct bpf_link_ops bpf_struct_ops_link_lops;
76f7e0beafSKui-Feng Lee
bpf_struct_ops_test_run(struct bpf_prog * prog,const union bpf_attr * kattr,union bpf_attr __user * uattr)77c196906dSHou Tao int bpf_struct_ops_test_run(struct bpf_prog *prog, const union bpf_attr *kattr,
78c196906dSHou Tao union bpf_attr __user *uattr)
79c196906dSHou Tao {
80c196906dSHou Tao const struct bpf_struct_ops *st_ops = &bpf_bpf_dummy_ops;
81c196906dSHou Tao const struct btf_type *func_proto;
82c196906dSHou Tao struct bpf_dummy_ops_test_args *args;
83f7e0beafSKui-Feng Lee struct bpf_tramp_links *tlinks;
84f7e0beafSKui-Feng Lee struct bpf_tramp_link *link = NULL;
85c196906dSHou Tao void *image = NULL;
86c196906dSHou Tao unsigned int op_idx;
87c196906dSHou Tao int prog_ret;
88c196906dSHou Tao int err;
89c196906dSHou Tao
90c196906dSHou Tao if (prog->aux->attach_btf_id != st_ops->type_id)
91c196906dSHou Tao return -EOPNOTSUPP;
92c196906dSHou Tao
93c196906dSHou Tao func_proto = prog->aux->attach_func_proto;
94c196906dSHou Tao args = dummy_ops_init_args(kattr, btf_type_vlen(func_proto));
95c196906dSHou Tao if (IS_ERR(args))
96c196906dSHou Tao return PTR_ERR(args);
97c196906dSHou Tao
98f7e0beafSKui-Feng Lee tlinks = kcalloc(BPF_TRAMP_MAX, sizeof(*tlinks), GFP_KERNEL);
99f7e0beafSKui-Feng Lee if (!tlinks) {
100c196906dSHou Tao err = -ENOMEM;
101c196906dSHou Tao goto out;
102c196906dSHou Tao }
103c196906dSHou Tao
104c196906dSHou Tao image = bpf_jit_alloc_exec(PAGE_SIZE);
105c196906dSHou Tao if (!image) {
106c196906dSHou Tao err = -ENOMEM;
107c196906dSHou Tao goto out;
108c196906dSHou Tao }
109c196906dSHou Tao set_vm_flush_reset_perms(image);
110c196906dSHou Tao
111f7e0beafSKui-Feng Lee link = kzalloc(sizeof(*link), GFP_USER);
112f7e0beafSKui-Feng Lee if (!link) {
113f7e0beafSKui-Feng Lee err = -ENOMEM;
114f7e0beafSKui-Feng Lee goto out;
115f7e0beafSKui-Feng Lee }
116f7e0beafSKui-Feng Lee /* prog doesn't take the ownership of the reference from caller */
117f7e0beafSKui-Feng Lee bpf_prog_inc(prog);
118f7e0beafSKui-Feng Lee bpf_link_init(&link->link, BPF_LINK_TYPE_STRUCT_OPS, &bpf_struct_ops_link_lops, prog);
119f7e0beafSKui-Feng Lee
120c196906dSHou Tao op_idx = prog->expected_attach_type;
121f7e0beafSKui-Feng Lee err = bpf_struct_ops_prepare_trampoline(tlinks, link,
122c196906dSHou Tao &st_ops->func_models[op_idx],
123c196906dSHou Tao image, image + PAGE_SIZE);
124c196906dSHou Tao if (err < 0)
125c196906dSHou Tao goto out;
126c196906dSHou Tao
127d48567c9SPeter Zijlstra set_memory_rox((long)image, 1);
128c196906dSHou Tao prog_ret = dummy_ops_call_op(image, args);
129c196906dSHou Tao
130c196906dSHou Tao err = dummy_ops_copy_args(args);
131c196906dSHou Tao if (err)
132c196906dSHou Tao goto out;
133c196906dSHou Tao if (put_user(prog_ret, &uattr->test.retval))
134c196906dSHou Tao err = -EFAULT;
135c196906dSHou Tao out:
136c196906dSHou Tao kfree(args);
137c196906dSHou Tao bpf_jit_free_exec(image);
138f7e0beafSKui-Feng Lee if (link)
139f7e0beafSKui-Feng Lee bpf_link_put(&link->link);
140f7e0beafSKui-Feng Lee kfree(tlinks);
141c196906dSHou Tao return err;
142c196906dSHou Tao }
143c196906dSHou Tao
bpf_dummy_init(struct btf * btf)144c196906dSHou Tao static int bpf_dummy_init(struct btf *btf)
145c196906dSHou Tao {
146c196906dSHou Tao return 0;
147c196906dSHou Tao }
148c196906dSHou Tao
bpf_dummy_ops_is_valid_access(int off,int size,enum bpf_access_type type,const struct bpf_prog * prog,struct bpf_insn_access_aux * info)149c196906dSHou Tao static bool bpf_dummy_ops_is_valid_access(int off, int size,
150c196906dSHou Tao enum bpf_access_type type,
151c196906dSHou Tao const struct bpf_prog *prog,
152c196906dSHou Tao struct bpf_insn_access_aux *info)
153c196906dSHou Tao {
154c196906dSHou Tao return bpf_tracing_btf_ctx_access(off, size, type, prog, info);
155c196906dSHou Tao }
156c196906dSHou Tao
bpf_dummy_ops_check_member(const struct btf_type * t,const struct btf_member * member,const struct bpf_prog * prog)1577dd88059SDavid Vernet static int bpf_dummy_ops_check_member(const struct btf_type *t,
1587dd88059SDavid Vernet const struct btf_member *member,
1597dd88059SDavid Vernet const struct bpf_prog *prog)
1607dd88059SDavid Vernet {
1617dd88059SDavid Vernet u32 moff = __btf_member_bit_offset(t, member) / 8;
1627dd88059SDavid Vernet
1637dd88059SDavid Vernet switch (moff) {
1647dd88059SDavid Vernet case offsetof(struct bpf_dummy_ops, test_sleepable):
1657dd88059SDavid Vernet break;
1667dd88059SDavid Vernet default:
1677dd88059SDavid Vernet if (prog->aux->sleepable)
1687dd88059SDavid Vernet return -EINVAL;
1697dd88059SDavid Vernet }
1707dd88059SDavid Vernet
1717dd88059SDavid Vernet return 0;
1727dd88059SDavid Vernet }
1737dd88059SDavid Vernet
bpf_dummy_ops_btf_struct_access(struct bpf_verifier_log * log,const struct bpf_reg_state * reg,int off,int size)174c196906dSHou Tao static int bpf_dummy_ops_btf_struct_access(struct bpf_verifier_log *log,
1756728aea7SKumar Kartikeya Dwivedi const struct bpf_reg_state *reg,
176*b7e852a9SAlexei Starovoitov int off, int size)
177c196906dSHou Tao {
178c196906dSHou Tao const struct btf_type *state;
1796728aea7SKumar Kartikeya Dwivedi const struct btf_type *t;
180c196906dSHou Tao s32 type_id;
181c196906dSHou Tao
1826728aea7SKumar Kartikeya Dwivedi type_id = btf_find_by_name_kind(reg->btf, "bpf_dummy_ops_state",
183c196906dSHou Tao BTF_KIND_STRUCT);
184c196906dSHou Tao if (type_id < 0)
185c196906dSHou Tao return -EINVAL;
186c196906dSHou Tao
1876728aea7SKumar Kartikeya Dwivedi t = btf_type_by_id(reg->btf, reg->btf_id);
1886728aea7SKumar Kartikeya Dwivedi state = btf_type_by_id(reg->btf, type_id);
189c196906dSHou Tao if (t != state) {
190c196906dSHou Tao bpf_log(log, "only access to bpf_dummy_ops_state is supported\n");
191c196906dSHou Tao return -EACCES;
192c196906dSHou Tao }
193c196906dSHou Tao
194*b7e852a9SAlexei Starovoitov if (off + size > sizeof(struct bpf_dummy_ops_state)) {
195*b7e852a9SAlexei Starovoitov bpf_log(log, "write access at off %d with size %d\n", off, size);
196*b7e852a9SAlexei Starovoitov return -EACCES;
197*b7e852a9SAlexei Starovoitov }
198c196906dSHou Tao
1997d64c513SAlexei Starovoitov return NOT_INIT;
200c196906dSHou Tao }
201c196906dSHou Tao
202c196906dSHou Tao static const struct bpf_verifier_ops bpf_dummy_verifier_ops = {
203c196906dSHou Tao .is_valid_access = bpf_dummy_ops_is_valid_access,
204c196906dSHou Tao .btf_struct_access = bpf_dummy_ops_btf_struct_access,
205c196906dSHou Tao };
206c196906dSHou Tao
bpf_dummy_init_member(const struct btf_type * t,const struct btf_member * member,void * kdata,const void * udata)207c196906dSHou Tao static int bpf_dummy_init_member(const struct btf_type *t,
208c196906dSHou Tao const struct btf_member *member,
209c196906dSHou Tao void *kdata, const void *udata)
210c196906dSHou Tao {
211c196906dSHou Tao return -EOPNOTSUPP;
212c196906dSHou Tao }
213c196906dSHou Tao
bpf_dummy_reg(void * kdata)214c196906dSHou Tao static int bpf_dummy_reg(void *kdata)
215c196906dSHou Tao {
216c196906dSHou Tao return -EOPNOTSUPP;
217c196906dSHou Tao }
218c196906dSHou Tao
bpf_dummy_unreg(void * kdata)219c196906dSHou Tao static void bpf_dummy_unreg(void *kdata)
220c196906dSHou Tao {
221c196906dSHou Tao }
222c196906dSHou Tao
223c196906dSHou Tao struct bpf_struct_ops bpf_bpf_dummy_ops = {
224c196906dSHou Tao .verifier_ops = &bpf_dummy_verifier_ops,
225c196906dSHou Tao .init = bpf_dummy_init,
2267dd88059SDavid Vernet .check_member = bpf_dummy_ops_check_member,
227c196906dSHou Tao .init_member = bpf_dummy_init_member,
228c196906dSHou Tao .reg = bpf_dummy_reg,
229c196906dSHou Tao .unreg = bpf_dummy_unreg,
230c196906dSHou Tao .name = "bpf_dummy_ops",
231c196906dSHou Tao };
232