1 // SPDX-License-Identifier: GPL-2.0-only 2 /* Copyright (c) 2017 Facebook 3 */ 4 #include <linux/bpf.h> 5 #include <linux/btf.h> 6 #include <linux/btf_ids.h> 7 #include <linux/slab.h> 8 #include <linux/init.h> 9 #include <linux/vmalloc.h> 10 #include <linux/etherdevice.h> 11 #include <linux/filter.h> 12 #include <linux/rcupdate_trace.h> 13 #include <linux/sched/signal.h> 14 #include <net/bpf_sk_storage.h> 15 #include <net/sock.h> 16 #include <net/tcp.h> 17 #include <net/net_namespace.h> 18 #include <net/page_pool.h> 19 #include <linux/error-injection.h> 20 #include <linux/smp.h> 21 #include <linux/sock_diag.h> 22 #include <net/xdp.h> 23 24 #define CREATE_TRACE_POINTS 25 #include <trace/events/bpf_test_run.h> 26 27 struct bpf_test_timer { 28 enum { NO_PREEMPT, NO_MIGRATE } mode; 29 u32 i; 30 u64 time_start, time_spent; 31 }; 32 33 static void bpf_test_timer_enter(struct bpf_test_timer *t) 34 __acquires(rcu) 35 { 36 rcu_read_lock(); 37 if (t->mode == NO_PREEMPT) 38 preempt_disable(); 39 else 40 migrate_disable(); 41 42 t->time_start = ktime_get_ns(); 43 } 44 45 static void bpf_test_timer_leave(struct bpf_test_timer *t) 46 __releases(rcu) 47 { 48 t->time_start = 0; 49 50 if (t->mode == NO_PREEMPT) 51 preempt_enable(); 52 else 53 migrate_enable(); 54 rcu_read_unlock(); 55 } 56 57 static bool bpf_test_timer_continue(struct bpf_test_timer *t, int iterations, 58 u32 repeat, int *err, u32 *duration) 59 __must_hold(rcu) 60 { 61 t->i += iterations; 62 if (t->i >= repeat) { 63 /* We're done. */ 64 t->time_spent += ktime_get_ns() - t->time_start; 65 do_div(t->time_spent, t->i); 66 *duration = t->time_spent > U32_MAX ? U32_MAX : (u32)t->time_spent; 67 *err = 0; 68 goto reset; 69 } 70 71 if (signal_pending(current)) { 72 /* During iteration: we've been cancelled, abort. */ 73 *err = -EINTR; 74 goto reset; 75 } 76 77 if (need_resched()) { 78 /* During iteration: we need to reschedule between runs. */ 79 t->time_spent += ktime_get_ns() - t->time_start; 80 bpf_test_timer_leave(t); 81 cond_resched(); 82 bpf_test_timer_enter(t); 83 } 84 85 /* Do another round. */ 86 return true; 87 88 reset: 89 t->i = 0; 90 return false; 91 } 92 93 /* We put this struct at the head of each page with a context and frame 94 * initialised when the page is allocated, so we don't have to do this on each 95 * repetition of the test run. 96 */ 97 struct xdp_page_head { 98 struct xdp_buff orig_ctx; 99 struct xdp_buff ctx; 100 union { 101 /* ::data_hard_start starts here */ 102 DECLARE_FLEX_ARRAY(struct xdp_frame, frame); 103 DECLARE_FLEX_ARRAY(u8, data); 104 }; 105 }; 106 107 struct xdp_test_data { 108 struct xdp_buff *orig_ctx; 109 struct xdp_rxq_info rxq; 110 struct net_device *dev; 111 struct page_pool *pp; 112 struct xdp_frame **frames; 113 struct sk_buff **skbs; 114 struct xdp_mem_info mem; 115 u32 batch_size; 116 u32 frame_cnt; 117 }; 118 119 /* tools/testing/selftests/bpf/prog_tests/xdp_do_redirect.c:%MAX_PKT_SIZE 120 * must be updated accordingly this gets changed, otherwise BPF selftests 121 * will fail. 122 */ 123 #define TEST_XDP_FRAME_SIZE (PAGE_SIZE - sizeof(struct xdp_page_head)) 124 #define TEST_XDP_MAX_BATCH 256 125 126 static void xdp_test_run_init_page(struct page *page, void *arg) 127 { 128 struct xdp_page_head *head = phys_to_virt(page_to_phys(page)); 129 struct xdp_buff *new_ctx, *orig_ctx; 130 u32 headroom = XDP_PACKET_HEADROOM; 131 struct xdp_test_data *xdp = arg; 132 size_t frm_len, meta_len; 133 struct xdp_frame *frm; 134 void *data; 135 136 orig_ctx = xdp->orig_ctx; 137 frm_len = orig_ctx->data_end - orig_ctx->data_meta; 138 meta_len = orig_ctx->data - orig_ctx->data_meta; 139 headroom -= meta_len; 140 141 new_ctx = &head->ctx; 142 frm = head->frame; 143 data = head->data; 144 memcpy(data + headroom, orig_ctx->data_meta, frm_len); 145 146 xdp_init_buff(new_ctx, TEST_XDP_FRAME_SIZE, &xdp->rxq); 147 xdp_prepare_buff(new_ctx, data, headroom, frm_len, true); 148 new_ctx->data = new_ctx->data_meta + meta_len; 149 150 xdp_update_frame_from_buff(new_ctx, frm); 151 frm->mem = new_ctx->rxq->mem; 152 153 memcpy(&head->orig_ctx, new_ctx, sizeof(head->orig_ctx)); 154 } 155 156 static int xdp_test_run_setup(struct xdp_test_data *xdp, struct xdp_buff *orig_ctx) 157 { 158 struct page_pool *pp; 159 int err = -ENOMEM; 160 struct page_pool_params pp_params = { 161 .order = 0, 162 .flags = 0, 163 .pool_size = xdp->batch_size, 164 .nid = NUMA_NO_NODE, 165 .init_callback = xdp_test_run_init_page, 166 .init_arg = xdp, 167 }; 168 169 xdp->frames = kvmalloc_array(xdp->batch_size, sizeof(void *), GFP_KERNEL); 170 if (!xdp->frames) 171 return -ENOMEM; 172 173 xdp->skbs = kvmalloc_array(xdp->batch_size, sizeof(void *), GFP_KERNEL); 174 if (!xdp->skbs) 175 goto err_skbs; 176 177 pp = page_pool_create(&pp_params); 178 if (IS_ERR(pp)) { 179 err = PTR_ERR(pp); 180 goto err_pp; 181 } 182 183 /* will copy 'mem.id' into pp->xdp_mem_id */ 184 err = xdp_reg_mem_model(&xdp->mem, MEM_TYPE_PAGE_POOL, pp); 185 if (err) 186 goto err_mmodel; 187 188 xdp->pp = pp; 189 190 /* We create a 'fake' RXQ referencing the original dev, but with an 191 * xdp_mem_info pointing to our page_pool 192 */ 193 xdp_rxq_info_reg(&xdp->rxq, orig_ctx->rxq->dev, 0, 0); 194 xdp->rxq.mem.type = MEM_TYPE_PAGE_POOL; 195 xdp->rxq.mem.id = pp->xdp_mem_id; 196 xdp->dev = orig_ctx->rxq->dev; 197 xdp->orig_ctx = orig_ctx; 198 199 return 0; 200 201 err_mmodel: 202 page_pool_destroy(pp); 203 err_pp: 204 kvfree(xdp->skbs); 205 err_skbs: 206 kvfree(xdp->frames); 207 return err; 208 } 209 210 static void xdp_test_run_teardown(struct xdp_test_data *xdp) 211 { 212 xdp_unreg_mem_model(&xdp->mem); 213 page_pool_destroy(xdp->pp); 214 kfree(xdp->frames); 215 kfree(xdp->skbs); 216 } 217 218 static bool ctx_was_changed(struct xdp_page_head *head) 219 { 220 return head->orig_ctx.data != head->ctx.data || 221 head->orig_ctx.data_meta != head->ctx.data_meta || 222 head->orig_ctx.data_end != head->ctx.data_end; 223 } 224 225 static void reset_ctx(struct xdp_page_head *head) 226 { 227 if (likely(!ctx_was_changed(head))) 228 return; 229 230 head->ctx.data = head->orig_ctx.data; 231 head->ctx.data_meta = head->orig_ctx.data_meta; 232 head->ctx.data_end = head->orig_ctx.data_end; 233 xdp_update_frame_from_buff(&head->ctx, head->frame); 234 } 235 236 static int xdp_recv_frames(struct xdp_frame **frames, int nframes, 237 struct sk_buff **skbs, 238 struct net_device *dev) 239 { 240 gfp_t gfp = __GFP_ZERO | GFP_ATOMIC; 241 int i, n; 242 LIST_HEAD(list); 243 244 n = kmem_cache_alloc_bulk(skbuff_cache, gfp, nframes, (void **)skbs); 245 if (unlikely(n == 0)) { 246 for (i = 0; i < nframes; i++) 247 xdp_return_frame(frames[i]); 248 return -ENOMEM; 249 } 250 251 for (i = 0; i < nframes; i++) { 252 struct xdp_frame *xdpf = frames[i]; 253 struct sk_buff *skb = skbs[i]; 254 255 skb = __xdp_build_skb_from_frame(xdpf, skb, dev); 256 if (!skb) { 257 xdp_return_frame(xdpf); 258 continue; 259 } 260 261 list_add_tail(&skb->list, &list); 262 } 263 netif_receive_skb_list(&list); 264 265 return 0; 266 } 267 268 static int xdp_test_run_batch(struct xdp_test_data *xdp, struct bpf_prog *prog, 269 u32 repeat) 270 { 271 struct bpf_redirect_info *ri = this_cpu_ptr(&bpf_redirect_info); 272 int err = 0, act, ret, i, nframes = 0, batch_sz; 273 struct xdp_frame **frames = xdp->frames; 274 struct xdp_page_head *head; 275 struct xdp_frame *frm; 276 bool redirect = false; 277 struct xdp_buff *ctx; 278 struct page *page; 279 280 batch_sz = min_t(u32, repeat, xdp->batch_size); 281 282 local_bh_disable(); 283 xdp_set_return_frame_no_direct(); 284 285 for (i = 0; i < batch_sz; i++) { 286 page = page_pool_dev_alloc_pages(xdp->pp); 287 if (!page) { 288 err = -ENOMEM; 289 goto out; 290 } 291 292 head = phys_to_virt(page_to_phys(page)); 293 reset_ctx(head); 294 ctx = &head->ctx; 295 frm = head->frame; 296 xdp->frame_cnt++; 297 298 act = bpf_prog_run_xdp(prog, ctx); 299 300 /* if program changed pkt bounds we need to update the xdp_frame */ 301 if (unlikely(ctx_was_changed(head))) { 302 ret = xdp_update_frame_from_buff(ctx, frm); 303 if (ret) { 304 xdp_return_buff(ctx); 305 continue; 306 } 307 } 308 309 switch (act) { 310 case XDP_TX: 311 /* we can't do a real XDP_TX since we're not in the 312 * driver, so turn it into a REDIRECT back to the same 313 * index 314 */ 315 ri->tgt_index = xdp->dev->ifindex; 316 ri->map_id = INT_MAX; 317 ri->map_type = BPF_MAP_TYPE_UNSPEC; 318 fallthrough; 319 case XDP_REDIRECT: 320 redirect = true; 321 ret = xdp_do_redirect_frame(xdp->dev, ctx, frm, prog); 322 if (ret) 323 xdp_return_buff(ctx); 324 break; 325 case XDP_PASS: 326 frames[nframes++] = frm; 327 break; 328 default: 329 bpf_warn_invalid_xdp_action(NULL, prog, act); 330 fallthrough; 331 case XDP_DROP: 332 xdp_return_buff(ctx); 333 break; 334 } 335 } 336 337 out: 338 if (redirect) 339 xdp_do_flush(); 340 if (nframes) { 341 ret = xdp_recv_frames(frames, nframes, xdp->skbs, xdp->dev); 342 if (ret) 343 err = ret; 344 } 345 346 xdp_clear_return_frame_no_direct(); 347 local_bh_enable(); 348 return err; 349 } 350 351 static int bpf_test_run_xdp_live(struct bpf_prog *prog, struct xdp_buff *ctx, 352 u32 repeat, u32 batch_size, u32 *time) 353 354 { 355 struct xdp_test_data xdp = { .batch_size = batch_size }; 356 struct bpf_test_timer t = { .mode = NO_MIGRATE }; 357 int ret; 358 359 if (!repeat) 360 repeat = 1; 361 362 ret = xdp_test_run_setup(&xdp, ctx); 363 if (ret) 364 return ret; 365 366 bpf_test_timer_enter(&t); 367 do { 368 xdp.frame_cnt = 0; 369 ret = xdp_test_run_batch(&xdp, prog, repeat - t.i); 370 if (unlikely(ret < 0)) 371 break; 372 } while (bpf_test_timer_continue(&t, xdp.frame_cnt, repeat, &ret, time)); 373 bpf_test_timer_leave(&t); 374 375 xdp_test_run_teardown(&xdp); 376 return ret; 377 } 378 379 static int bpf_test_run(struct bpf_prog *prog, void *ctx, u32 repeat, 380 u32 *retval, u32 *time, bool xdp) 381 { 382 struct bpf_prog_array_item item = {.prog = prog}; 383 struct bpf_run_ctx *old_ctx; 384 struct bpf_cg_run_ctx run_ctx; 385 struct bpf_test_timer t = { NO_MIGRATE }; 386 enum bpf_cgroup_storage_type stype; 387 int ret; 388 389 for_each_cgroup_storage_type(stype) { 390 item.cgroup_storage[stype] = bpf_cgroup_storage_alloc(prog, stype); 391 if (IS_ERR(item.cgroup_storage[stype])) { 392 item.cgroup_storage[stype] = NULL; 393 for_each_cgroup_storage_type(stype) 394 bpf_cgroup_storage_free(item.cgroup_storage[stype]); 395 return -ENOMEM; 396 } 397 } 398 399 if (!repeat) 400 repeat = 1; 401 402 bpf_test_timer_enter(&t); 403 old_ctx = bpf_set_run_ctx(&run_ctx.run_ctx); 404 do { 405 run_ctx.prog_item = &item; 406 local_bh_disable(); 407 if (xdp) 408 *retval = bpf_prog_run_xdp(prog, ctx); 409 else 410 *retval = bpf_prog_run(prog, ctx); 411 local_bh_enable(); 412 } while (bpf_test_timer_continue(&t, 1, repeat, &ret, time)); 413 bpf_reset_run_ctx(old_ctx); 414 bpf_test_timer_leave(&t); 415 416 for_each_cgroup_storage_type(stype) 417 bpf_cgroup_storage_free(item.cgroup_storage[stype]); 418 419 return ret; 420 } 421 422 static int bpf_test_finish(const union bpf_attr *kattr, 423 union bpf_attr __user *uattr, const void *data, 424 struct skb_shared_info *sinfo, u32 size, 425 u32 retval, u32 duration) 426 { 427 void __user *data_out = u64_to_user_ptr(kattr->test.data_out); 428 int err = -EFAULT; 429 u32 copy_size = size; 430 431 /* Clamp copy if the user has provided a size hint, but copy the full 432 * buffer if not to retain old behaviour. 433 */ 434 if (kattr->test.data_size_out && 435 copy_size > kattr->test.data_size_out) { 436 copy_size = kattr->test.data_size_out; 437 err = -ENOSPC; 438 } 439 440 if (data_out) { 441 int len = sinfo ? copy_size - sinfo->xdp_frags_size : copy_size; 442 443 if (len < 0) { 444 err = -ENOSPC; 445 goto out; 446 } 447 448 if (copy_to_user(data_out, data, len)) 449 goto out; 450 451 if (sinfo) { 452 int i, offset = len; 453 u32 data_len; 454 455 for (i = 0; i < sinfo->nr_frags; i++) { 456 skb_frag_t *frag = &sinfo->frags[i]; 457 458 if (offset >= copy_size) { 459 err = -ENOSPC; 460 break; 461 } 462 463 data_len = min_t(u32, copy_size - offset, 464 skb_frag_size(frag)); 465 466 if (copy_to_user(data_out + offset, 467 skb_frag_address(frag), 468 data_len)) 469 goto out; 470 471 offset += data_len; 472 } 473 } 474 } 475 476 if (copy_to_user(&uattr->test.data_size_out, &size, sizeof(size))) 477 goto out; 478 if (copy_to_user(&uattr->test.retval, &retval, sizeof(retval))) 479 goto out; 480 if (copy_to_user(&uattr->test.duration, &duration, sizeof(duration))) 481 goto out; 482 if (err != -ENOSPC) 483 err = 0; 484 out: 485 trace_bpf_test_finish(&err); 486 return err; 487 } 488 489 /* Integer types of various sizes and pointer combinations cover variety of 490 * architecture dependent calling conventions. 7+ can be supported in the 491 * future. 492 */ 493 __diag_push(); 494 __diag_ignore_all("-Wmissing-prototypes", 495 "Global functions as their definitions will be in vmlinux BTF"); 496 __bpf_kfunc int bpf_fentry_test1(int a) 497 { 498 return a + 1; 499 } 500 EXPORT_SYMBOL_GPL(bpf_fentry_test1); 501 502 int noinline bpf_fentry_test2(int a, u64 b) 503 { 504 return a + b; 505 } 506 507 int noinline bpf_fentry_test3(char a, int b, u64 c) 508 { 509 return a + b + c; 510 } 511 512 int noinline bpf_fentry_test4(void *a, char b, int c, u64 d) 513 { 514 return (long)a + b + c + d; 515 } 516 517 int noinline bpf_fentry_test5(u64 a, void *b, short c, int d, u64 e) 518 { 519 return a + (long)b + c + d + e; 520 } 521 522 int noinline bpf_fentry_test6(u64 a, void *b, short c, int d, void *e, u64 f) 523 { 524 return a + (long)b + c + d + (long)e + f; 525 } 526 527 struct bpf_fentry_test_t { 528 struct bpf_fentry_test_t *a; 529 }; 530 531 int noinline bpf_fentry_test7(struct bpf_fentry_test_t *arg) 532 { 533 return (long)arg; 534 } 535 536 int noinline bpf_fentry_test8(struct bpf_fentry_test_t *arg) 537 { 538 return (long)arg->a; 539 } 540 541 __bpf_kfunc int bpf_modify_return_test(int a, int *b) 542 { 543 *b += 1; 544 return a + *b; 545 } 546 547 __bpf_kfunc u64 bpf_kfunc_call_test1(struct sock *sk, u32 a, u64 b, u32 c, u64 d) 548 { 549 return a + b + c + d; 550 } 551 552 __bpf_kfunc int bpf_kfunc_call_test2(struct sock *sk, u32 a, u32 b) 553 { 554 return a + b; 555 } 556 557 __bpf_kfunc struct sock *bpf_kfunc_call_test3(struct sock *sk) 558 { 559 return sk; 560 } 561 562 long noinline bpf_kfunc_call_test4(signed char a, short b, int c, long d) 563 { 564 /* Provoke the compiler to assume that the caller has sign-extended a, 565 * b and c on platforms where this is required (e.g. s390x). 566 */ 567 return (long)a + (long)b + (long)c + d; 568 } 569 570 struct prog_test_member1 { 571 int a; 572 }; 573 574 struct prog_test_member { 575 struct prog_test_member1 m; 576 int c; 577 }; 578 579 struct prog_test_ref_kfunc { 580 int a; 581 int b; 582 struct prog_test_member memb; 583 struct prog_test_ref_kfunc *next; 584 refcount_t cnt; 585 }; 586 587 static struct prog_test_ref_kfunc prog_test_struct = { 588 .a = 42, 589 .b = 108, 590 .next = &prog_test_struct, 591 .cnt = REFCOUNT_INIT(1), 592 }; 593 594 __bpf_kfunc struct prog_test_ref_kfunc * 595 bpf_kfunc_call_test_acquire(unsigned long *scalar_ptr) 596 { 597 refcount_inc(&prog_test_struct.cnt); 598 return &prog_test_struct; 599 } 600 601 __bpf_kfunc struct prog_test_member * 602 bpf_kfunc_call_memb_acquire(void) 603 { 604 WARN_ON_ONCE(1); 605 return NULL; 606 } 607 608 __bpf_kfunc void bpf_kfunc_call_test_release(struct prog_test_ref_kfunc *p) 609 { 610 if (!p) 611 return; 612 613 refcount_dec(&p->cnt); 614 } 615 616 __bpf_kfunc void bpf_kfunc_call_memb_release(struct prog_test_member *p) 617 { 618 } 619 620 __bpf_kfunc void bpf_kfunc_call_memb1_release(struct prog_test_member1 *p) 621 { 622 WARN_ON_ONCE(1); 623 } 624 625 static int *__bpf_kfunc_call_test_get_mem(struct prog_test_ref_kfunc *p, const int size) 626 { 627 if (size > 2 * sizeof(int)) 628 return NULL; 629 630 return (int *)p; 631 } 632 633 __bpf_kfunc int *bpf_kfunc_call_test_get_rdwr_mem(struct prog_test_ref_kfunc *p, 634 const int rdwr_buf_size) 635 { 636 return __bpf_kfunc_call_test_get_mem(p, rdwr_buf_size); 637 } 638 639 __bpf_kfunc int *bpf_kfunc_call_test_get_rdonly_mem(struct prog_test_ref_kfunc *p, 640 const int rdonly_buf_size) 641 { 642 return __bpf_kfunc_call_test_get_mem(p, rdonly_buf_size); 643 } 644 645 /* the next 2 ones can't be really used for testing expect to ensure 646 * that the verifier rejects the call. 647 * Acquire functions must return struct pointers, so these ones are 648 * failing. 649 */ 650 __bpf_kfunc int *bpf_kfunc_call_test_acq_rdonly_mem(struct prog_test_ref_kfunc *p, 651 const int rdonly_buf_size) 652 { 653 return __bpf_kfunc_call_test_get_mem(p, rdonly_buf_size); 654 } 655 656 __bpf_kfunc void bpf_kfunc_call_int_mem_release(int *p) 657 { 658 } 659 660 __bpf_kfunc struct prog_test_ref_kfunc * 661 bpf_kfunc_call_test_kptr_get(struct prog_test_ref_kfunc **pp, int a, int b) 662 { 663 struct prog_test_ref_kfunc *p = READ_ONCE(*pp); 664 665 if (!p) 666 return NULL; 667 refcount_inc(&p->cnt); 668 return p; 669 } 670 671 struct prog_test_pass1 { 672 int x0; 673 struct { 674 int x1; 675 struct { 676 int x2; 677 struct { 678 int x3; 679 }; 680 }; 681 }; 682 }; 683 684 struct prog_test_pass2 { 685 int len; 686 short arr1[4]; 687 struct { 688 char arr2[4]; 689 unsigned long arr3[8]; 690 } x; 691 }; 692 693 struct prog_test_fail1 { 694 void *p; 695 int x; 696 }; 697 698 struct prog_test_fail2 { 699 int x8; 700 struct prog_test_pass1 x; 701 }; 702 703 struct prog_test_fail3 { 704 int len; 705 char arr1[2]; 706 char arr2[]; 707 }; 708 709 __bpf_kfunc void bpf_kfunc_call_test_pass_ctx(struct __sk_buff *skb) 710 { 711 } 712 713 __bpf_kfunc void bpf_kfunc_call_test_pass1(struct prog_test_pass1 *p) 714 { 715 } 716 717 __bpf_kfunc void bpf_kfunc_call_test_pass2(struct prog_test_pass2 *p) 718 { 719 } 720 721 __bpf_kfunc void bpf_kfunc_call_test_fail1(struct prog_test_fail1 *p) 722 { 723 } 724 725 __bpf_kfunc void bpf_kfunc_call_test_fail2(struct prog_test_fail2 *p) 726 { 727 } 728 729 __bpf_kfunc void bpf_kfunc_call_test_fail3(struct prog_test_fail3 *p) 730 { 731 } 732 733 __bpf_kfunc void bpf_kfunc_call_test_mem_len_pass1(void *mem, int mem__sz) 734 { 735 } 736 737 __bpf_kfunc void bpf_kfunc_call_test_mem_len_fail1(void *mem, int len) 738 { 739 } 740 741 __bpf_kfunc void bpf_kfunc_call_test_mem_len_fail2(u64 *mem, int len) 742 { 743 } 744 745 __bpf_kfunc void bpf_kfunc_call_test_ref(struct prog_test_ref_kfunc *p) 746 { 747 /* p != NULL, but p->cnt could be 0 */ 748 } 749 750 __bpf_kfunc void bpf_kfunc_call_test_destructive(void) 751 { 752 } 753 754 __bpf_kfunc static u32 bpf_kfunc_call_test_static_unused_arg(u32 arg, u32 unused) 755 { 756 return arg; 757 } 758 759 __diag_pop(); 760 761 BTF_SET8_START(bpf_test_modify_return_ids) 762 BTF_ID_FLAGS(func, bpf_modify_return_test) 763 BTF_ID_FLAGS(func, bpf_fentry_test1, KF_SLEEPABLE) 764 BTF_SET8_END(bpf_test_modify_return_ids) 765 766 static const struct btf_kfunc_id_set bpf_test_modify_return_set = { 767 .owner = THIS_MODULE, 768 .set = &bpf_test_modify_return_ids, 769 }; 770 771 BTF_SET8_START(test_sk_check_kfunc_ids) 772 BTF_ID_FLAGS(func, bpf_kfunc_call_test1) 773 BTF_ID_FLAGS(func, bpf_kfunc_call_test2) 774 BTF_ID_FLAGS(func, bpf_kfunc_call_test3) 775 BTF_ID_FLAGS(func, bpf_kfunc_call_test4) 776 BTF_ID_FLAGS(func, bpf_kfunc_call_test_acquire, KF_ACQUIRE | KF_RET_NULL) 777 BTF_ID_FLAGS(func, bpf_kfunc_call_memb_acquire, KF_ACQUIRE | KF_RET_NULL) 778 BTF_ID_FLAGS(func, bpf_kfunc_call_test_release, KF_RELEASE) 779 BTF_ID_FLAGS(func, bpf_kfunc_call_memb_release, KF_RELEASE) 780 BTF_ID_FLAGS(func, bpf_kfunc_call_memb1_release, KF_RELEASE) 781 BTF_ID_FLAGS(func, bpf_kfunc_call_test_get_rdwr_mem, KF_RET_NULL) 782 BTF_ID_FLAGS(func, bpf_kfunc_call_test_get_rdonly_mem, KF_RET_NULL) 783 BTF_ID_FLAGS(func, bpf_kfunc_call_test_acq_rdonly_mem, KF_ACQUIRE | KF_RET_NULL) 784 BTF_ID_FLAGS(func, bpf_kfunc_call_int_mem_release, KF_RELEASE) 785 BTF_ID_FLAGS(func, bpf_kfunc_call_test_kptr_get, KF_ACQUIRE | KF_RET_NULL | KF_KPTR_GET) 786 BTF_ID_FLAGS(func, bpf_kfunc_call_test_pass_ctx) 787 BTF_ID_FLAGS(func, bpf_kfunc_call_test_pass1) 788 BTF_ID_FLAGS(func, bpf_kfunc_call_test_pass2) 789 BTF_ID_FLAGS(func, bpf_kfunc_call_test_fail1) 790 BTF_ID_FLAGS(func, bpf_kfunc_call_test_fail2) 791 BTF_ID_FLAGS(func, bpf_kfunc_call_test_fail3) 792 BTF_ID_FLAGS(func, bpf_kfunc_call_test_mem_len_pass1) 793 BTF_ID_FLAGS(func, bpf_kfunc_call_test_mem_len_fail1) 794 BTF_ID_FLAGS(func, bpf_kfunc_call_test_mem_len_fail2) 795 BTF_ID_FLAGS(func, bpf_kfunc_call_test_ref, KF_TRUSTED_ARGS | KF_RCU) 796 BTF_ID_FLAGS(func, bpf_kfunc_call_test_destructive, KF_DESTRUCTIVE) 797 BTF_ID_FLAGS(func, bpf_kfunc_call_test_static_unused_arg) 798 BTF_SET8_END(test_sk_check_kfunc_ids) 799 800 static void *bpf_test_init(const union bpf_attr *kattr, u32 user_size, 801 u32 size, u32 headroom, u32 tailroom) 802 { 803 void __user *data_in = u64_to_user_ptr(kattr->test.data_in); 804 void *data; 805 806 if (size < ETH_HLEN || size > PAGE_SIZE - headroom - tailroom) 807 return ERR_PTR(-EINVAL); 808 809 if (user_size > size) 810 return ERR_PTR(-EMSGSIZE); 811 812 size = SKB_DATA_ALIGN(size); 813 data = kzalloc(size + headroom + tailroom, GFP_USER); 814 if (!data) 815 return ERR_PTR(-ENOMEM); 816 817 if (copy_from_user(data + headroom, data_in, user_size)) { 818 kfree(data); 819 return ERR_PTR(-EFAULT); 820 } 821 822 return data; 823 } 824 825 int bpf_prog_test_run_tracing(struct bpf_prog *prog, 826 const union bpf_attr *kattr, 827 union bpf_attr __user *uattr) 828 { 829 struct bpf_fentry_test_t arg = {}; 830 u16 side_effect = 0, ret = 0; 831 int b = 2, err = -EFAULT; 832 u32 retval = 0; 833 834 if (kattr->test.flags || kattr->test.cpu || kattr->test.batch_size) 835 return -EINVAL; 836 837 switch (prog->expected_attach_type) { 838 case BPF_TRACE_FENTRY: 839 case BPF_TRACE_FEXIT: 840 if (bpf_fentry_test1(1) != 2 || 841 bpf_fentry_test2(2, 3) != 5 || 842 bpf_fentry_test3(4, 5, 6) != 15 || 843 bpf_fentry_test4((void *)7, 8, 9, 10) != 34 || 844 bpf_fentry_test5(11, (void *)12, 13, 14, 15) != 65 || 845 bpf_fentry_test6(16, (void *)17, 18, 19, (void *)20, 21) != 111 || 846 bpf_fentry_test7((struct bpf_fentry_test_t *)0) != 0 || 847 bpf_fentry_test8(&arg) != 0) 848 goto out; 849 break; 850 case BPF_MODIFY_RETURN: 851 ret = bpf_modify_return_test(1, &b); 852 if (b != 2) 853 side_effect = 1; 854 break; 855 default: 856 goto out; 857 } 858 859 retval = ((u32)side_effect << 16) | ret; 860 if (copy_to_user(&uattr->test.retval, &retval, sizeof(retval))) 861 goto out; 862 863 err = 0; 864 out: 865 trace_bpf_test_finish(&err); 866 return err; 867 } 868 869 struct bpf_raw_tp_test_run_info { 870 struct bpf_prog *prog; 871 void *ctx; 872 u32 retval; 873 }; 874 875 static void 876 __bpf_prog_test_run_raw_tp(void *data) 877 { 878 struct bpf_raw_tp_test_run_info *info = data; 879 880 rcu_read_lock(); 881 info->retval = bpf_prog_run(info->prog, info->ctx); 882 rcu_read_unlock(); 883 } 884 885 int bpf_prog_test_run_raw_tp(struct bpf_prog *prog, 886 const union bpf_attr *kattr, 887 union bpf_attr __user *uattr) 888 { 889 void __user *ctx_in = u64_to_user_ptr(kattr->test.ctx_in); 890 __u32 ctx_size_in = kattr->test.ctx_size_in; 891 struct bpf_raw_tp_test_run_info info; 892 int cpu = kattr->test.cpu, err = 0; 893 int current_cpu; 894 895 /* doesn't support data_in/out, ctx_out, duration, or repeat */ 896 if (kattr->test.data_in || kattr->test.data_out || 897 kattr->test.ctx_out || kattr->test.duration || 898 kattr->test.repeat || kattr->test.batch_size) 899 return -EINVAL; 900 901 if (ctx_size_in < prog->aux->max_ctx_offset || 902 ctx_size_in > MAX_BPF_FUNC_ARGS * sizeof(u64)) 903 return -EINVAL; 904 905 if ((kattr->test.flags & BPF_F_TEST_RUN_ON_CPU) == 0 && cpu != 0) 906 return -EINVAL; 907 908 if (ctx_size_in) { 909 info.ctx = memdup_user(ctx_in, ctx_size_in); 910 if (IS_ERR(info.ctx)) 911 return PTR_ERR(info.ctx); 912 } else { 913 info.ctx = NULL; 914 } 915 916 info.prog = prog; 917 918 current_cpu = get_cpu(); 919 if ((kattr->test.flags & BPF_F_TEST_RUN_ON_CPU) == 0 || 920 cpu == current_cpu) { 921 __bpf_prog_test_run_raw_tp(&info); 922 } else if (cpu >= nr_cpu_ids || !cpu_online(cpu)) { 923 /* smp_call_function_single() also checks cpu_online() 924 * after csd_lock(). However, since cpu is from user 925 * space, let's do an extra quick check to filter out 926 * invalid value before smp_call_function_single(). 927 */ 928 err = -ENXIO; 929 } else { 930 err = smp_call_function_single(cpu, __bpf_prog_test_run_raw_tp, 931 &info, 1); 932 } 933 put_cpu(); 934 935 if (!err && 936 copy_to_user(&uattr->test.retval, &info.retval, sizeof(u32))) 937 err = -EFAULT; 938 939 kfree(info.ctx); 940 return err; 941 } 942 943 static void *bpf_ctx_init(const union bpf_attr *kattr, u32 max_size) 944 { 945 void __user *data_in = u64_to_user_ptr(kattr->test.ctx_in); 946 void __user *data_out = u64_to_user_ptr(kattr->test.ctx_out); 947 u32 size = kattr->test.ctx_size_in; 948 void *data; 949 int err; 950 951 if (!data_in && !data_out) 952 return NULL; 953 954 data = kzalloc(max_size, GFP_USER); 955 if (!data) 956 return ERR_PTR(-ENOMEM); 957 958 if (data_in) { 959 err = bpf_check_uarg_tail_zero(USER_BPFPTR(data_in), max_size, size); 960 if (err) { 961 kfree(data); 962 return ERR_PTR(err); 963 } 964 965 size = min_t(u32, max_size, size); 966 if (copy_from_user(data, data_in, size)) { 967 kfree(data); 968 return ERR_PTR(-EFAULT); 969 } 970 } 971 return data; 972 } 973 974 static int bpf_ctx_finish(const union bpf_attr *kattr, 975 union bpf_attr __user *uattr, const void *data, 976 u32 size) 977 { 978 void __user *data_out = u64_to_user_ptr(kattr->test.ctx_out); 979 int err = -EFAULT; 980 u32 copy_size = size; 981 982 if (!data || !data_out) 983 return 0; 984 985 if (copy_size > kattr->test.ctx_size_out) { 986 copy_size = kattr->test.ctx_size_out; 987 err = -ENOSPC; 988 } 989 990 if (copy_to_user(data_out, data, copy_size)) 991 goto out; 992 if (copy_to_user(&uattr->test.ctx_size_out, &size, sizeof(size))) 993 goto out; 994 if (err != -ENOSPC) 995 err = 0; 996 out: 997 return err; 998 } 999 1000 /** 1001 * range_is_zero - test whether buffer is initialized 1002 * @buf: buffer to check 1003 * @from: check from this position 1004 * @to: check up until (excluding) this position 1005 * 1006 * This function returns true if the there is a non-zero byte 1007 * in the buf in the range [from,to). 1008 */ 1009 static inline bool range_is_zero(void *buf, size_t from, size_t to) 1010 { 1011 return !memchr_inv((u8 *)buf + from, 0, to - from); 1012 } 1013 1014 static int convert___skb_to_skb(struct sk_buff *skb, struct __sk_buff *__skb) 1015 { 1016 struct qdisc_skb_cb *cb = (struct qdisc_skb_cb *)skb->cb; 1017 1018 if (!__skb) 1019 return 0; 1020 1021 /* make sure the fields we don't use are zeroed */ 1022 if (!range_is_zero(__skb, 0, offsetof(struct __sk_buff, mark))) 1023 return -EINVAL; 1024 1025 /* mark is allowed */ 1026 1027 if (!range_is_zero(__skb, offsetofend(struct __sk_buff, mark), 1028 offsetof(struct __sk_buff, priority))) 1029 return -EINVAL; 1030 1031 /* priority is allowed */ 1032 /* ingress_ifindex is allowed */ 1033 /* ifindex is allowed */ 1034 1035 if (!range_is_zero(__skb, offsetofend(struct __sk_buff, ifindex), 1036 offsetof(struct __sk_buff, cb))) 1037 return -EINVAL; 1038 1039 /* cb is allowed */ 1040 1041 if (!range_is_zero(__skb, offsetofend(struct __sk_buff, cb), 1042 offsetof(struct __sk_buff, tstamp))) 1043 return -EINVAL; 1044 1045 /* tstamp is allowed */ 1046 /* wire_len is allowed */ 1047 /* gso_segs is allowed */ 1048 1049 if (!range_is_zero(__skb, offsetofend(struct __sk_buff, gso_segs), 1050 offsetof(struct __sk_buff, gso_size))) 1051 return -EINVAL; 1052 1053 /* gso_size is allowed */ 1054 1055 if (!range_is_zero(__skb, offsetofend(struct __sk_buff, gso_size), 1056 offsetof(struct __sk_buff, hwtstamp))) 1057 return -EINVAL; 1058 1059 /* hwtstamp is allowed */ 1060 1061 if (!range_is_zero(__skb, offsetofend(struct __sk_buff, hwtstamp), 1062 sizeof(struct __sk_buff))) 1063 return -EINVAL; 1064 1065 skb->mark = __skb->mark; 1066 skb->priority = __skb->priority; 1067 skb->skb_iif = __skb->ingress_ifindex; 1068 skb->tstamp = __skb->tstamp; 1069 memcpy(&cb->data, __skb->cb, QDISC_CB_PRIV_LEN); 1070 1071 if (__skb->wire_len == 0) { 1072 cb->pkt_len = skb->len; 1073 } else { 1074 if (__skb->wire_len < skb->len || 1075 __skb->wire_len > GSO_LEGACY_MAX_SIZE) 1076 return -EINVAL; 1077 cb->pkt_len = __skb->wire_len; 1078 } 1079 1080 if (__skb->gso_segs > GSO_MAX_SEGS) 1081 return -EINVAL; 1082 skb_shinfo(skb)->gso_segs = __skb->gso_segs; 1083 skb_shinfo(skb)->gso_size = __skb->gso_size; 1084 skb_shinfo(skb)->hwtstamps.hwtstamp = __skb->hwtstamp; 1085 1086 return 0; 1087 } 1088 1089 static void convert_skb_to___skb(struct sk_buff *skb, struct __sk_buff *__skb) 1090 { 1091 struct qdisc_skb_cb *cb = (struct qdisc_skb_cb *)skb->cb; 1092 1093 if (!__skb) 1094 return; 1095 1096 __skb->mark = skb->mark; 1097 __skb->priority = skb->priority; 1098 __skb->ingress_ifindex = skb->skb_iif; 1099 __skb->ifindex = skb->dev->ifindex; 1100 __skb->tstamp = skb->tstamp; 1101 memcpy(__skb->cb, &cb->data, QDISC_CB_PRIV_LEN); 1102 __skb->wire_len = cb->pkt_len; 1103 __skb->gso_segs = skb_shinfo(skb)->gso_segs; 1104 __skb->hwtstamp = skb_shinfo(skb)->hwtstamps.hwtstamp; 1105 } 1106 1107 static struct proto bpf_dummy_proto = { 1108 .name = "bpf_dummy", 1109 .owner = THIS_MODULE, 1110 .obj_size = sizeof(struct sock), 1111 }; 1112 1113 int bpf_prog_test_run_skb(struct bpf_prog *prog, const union bpf_attr *kattr, 1114 union bpf_attr __user *uattr) 1115 { 1116 bool is_l2 = false, is_direct_pkt_access = false; 1117 struct net *net = current->nsproxy->net_ns; 1118 struct net_device *dev = net->loopback_dev; 1119 u32 size = kattr->test.data_size_in; 1120 u32 repeat = kattr->test.repeat; 1121 struct __sk_buff *ctx = NULL; 1122 u32 retval, duration; 1123 int hh_len = ETH_HLEN; 1124 struct sk_buff *skb; 1125 struct sock *sk; 1126 void *data; 1127 int ret; 1128 1129 if (kattr->test.flags || kattr->test.cpu || kattr->test.batch_size) 1130 return -EINVAL; 1131 1132 data = bpf_test_init(kattr, kattr->test.data_size_in, 1133 size, NET_SKB_PAD + NET_IP_ALIGN, 1134 SKB_DATA_ALIGN(sizeof(struct skb_shared_info))); 1135 if (IS_ERR(data)) 1136 return PTR_ERR(data); 1137 1138 ctx = bpf_ctx_init(kattr, sizeof(struct __sk_buff)); 1139 if (IS_ERR(ctx)) { 1140 kfree(data); 1141 return PTR_ERR(ctx); 1142 } 1143 1144 switch (prog->type) { 1145 case BPF_PROG_TYPE_SCHED_CLS: 1146 case BPF_PROG_TYPE_SCHED_ACT: 1147 is_l2 = true; 1148 fallthrough; 1149 case BPF_PROG_TYPE_LWT_IN: 1150 case BPF_PROG_TYPE_LWT_OUT: 1151 case BPF_PROG_TYPE_LWT_XMIT: 1152 is_direct_pkt_access = true; 1153 break; 1154 default: 1155 break; 1156 } 1157 1158 sk = sk_alloc(net, AF_UNSPEC, GFP_USER, &bpf_dummy_proto, 1); 1159 if (!sk) { 1160 kfree(data); 1161 kfree(ctx); 1162 return -ENOMEM; 1163 } 1164 sock_init_data(NULL, sk); 1165 1166 skb = slab_build_skb(data); 1167 if (!skb) { 1168 kfree(data); 1169 kfree(ctx); 1170 sk_free(sk); 1171 return -ENOMEM; 1172 } 1173 skb->sk = sk; 1174 1175 skb_reserve(skb, NET_SKB_PAD + NET_IP_ALIGN); 1176 __skb_put(skb, size); 1177 if (ctx && ctx->ifindex > 1) { 1178 dev = dev_get_by_index(net, ctx->ifindex); 1179 if (!dev) { 1180 ret = -ENODEV; 1181 goto out; 1182 } 1183 } 1184 skb->protocol = eth_type_trans(skb, dev); 1185 skb_reset_network_header(skb); 1186 1187 switch (skb->protocol) { 1188 case htons(ETH_P_IP): 1189 sk->sk_family = AF_INET; 1190 if (sizeof(struct iphdr) <= skb_headlen(skb)) { 1191 sk->sk_rcv_saddr = ip_hdr(skb)->saddr; 1192 sk->sk_daddr = ip_hdr(skb)->daddr; 1193 } 1194 break; 1195 #if IS_ENABLED(CONFIG_IPV6) 1196 case htons(ETH_P_IPV6): 1197 sk->sk_family = AF_INET6; 1198 if (sizeof(struct ipv6hdr) <= skb_headlen(skb)) { 1199 sk->sk_v6_rcv_saddr = ipv6_hdr(skb)->saddr; 1200 sk->sk_v6_daddr = ipv6_hdr(skb)->daddr; 1201 } 1202 break; 1203 #endif 1204 default: 1205 break; 1206 } 1207 1208 if (is_l2) 1209 __skb_push(skb, hh_len); 1210 if (is_direct_pkt_access) 1211 bpf_compute_data_pointers(skb); 1212 ret = convert___skb_to_skb(skb, ctx); 1213 if (ret) 1214 goto out; 1215 ret = bpf_test_run(prog, skb, repeat, &retval, &duration, false); 1216 if (ret) 1217 goto out; 1218 if (!is_l2) { 1219 if (skb_headroom(skb) < hh_len) { 1220 int nhead = HH_DATA_ALIGN(hh_len - skb_headroom(skb)); 1221 1222 if (pskb_expand_head(skb, nhead, 0, GFP_USER)) { 1223 ret = -ENOMEM; 1224 goto out; 1225 } 1226 } 1227 memset(__skb_push(skb, hh_len), 0, hh_len); 1228 } 1229 convert_skb_to___skb(skb, ctx); 1230 1231 size = skb->len; 1232 /* bpf program can never convert linear skb to non-linear */ 1233 if (WARN_ON_ONCE(skb_is_nonlinear(skb))) 1234 size = skb_headlen(skb); 1235 ret = bpf_test_finish(kattr, uattr, skb->data, NULL, size, retval, 1236 duration); 1237 if (!ret) 1238 ret = bpf_ctx_finish(kattr, uattr, ctx, 1239 sizeof(struct __sk_buff)); 1240 out: 1241 if (dev && dev != net->loopback_dev) 1242 dev_put(dev); 1243 kfree_skb(skb); 1244 sk_free(sk); 1245 kfree(ctx); 1246 return ret; 1247 } 1248 1249 static int xdp_convert_md_to_buff(struct xdp_md *xdp_md, struct xdp_buff *xdp) 1250 { 1251 unsigned int ingress_ifindex, rx_queue_index; 1252 struct netdev_rx_queue *rxqueue; 1253 struct net_device *device; 1254 1255 if (!xdp_md) 1256 return 0; 1257 1258 if (xdp_md->egress_ifindex != 0) 1259 return -EINVAL; 1260 1261 ingress_ifindex = xdp_md->ingress_ifindex; 1262 rx_queue_index = xdp_md->rx_queue_index; 1263 1264 if (!ingress_ifindex && rx_queue_index) 1265 return -EINVAL; 1266 1267 if (ingress_ifindex) { 1268 device = dev_get_by_index(current->nsproxy->net_ns, 1269 ingress_ifindex); 1270 if (!device) 1271 return -ENODEV; 1272 1273 if (rx_queue_index >= device->real_num_rx_queues) 1274 goto free_dev; 1275 1276 rxqueue = __netif_get_rx_queue(device, rx_queue_index); 1277 1278 if (!xdp_rxq_info_is_reg(&rxqueue->xdp_rxq)) 1279 goto free_dev; 1280 1281 xdp->rxq = &rxqueue->xdp_rxq; 1282 /* The device is now tracked in the xdp->rxq for later 1283 * dev_put() 1284 */ 1285 } 1286 1287 xdp->data = xdp->data_meta + xdp_md->data; 1288 return 0; 1289 1290 free_dev: 1291 dev_put(device); 1292 return -EINVAL; 1293 } 1294 1295 static void xdp_convert_buff_to_md(struct xdp_buff *xdp, struct xdp_md *xdp_md) 1296 { 1297 if (!xdp_md) 1298 return; 1299 1300 xdp_md->data = xdp->data - xdp->data_meta; 1301 xdp_md->data_end = xdp->data_end - xdp->data_meta; 1302 1303 if (xdp_md->ingress_ifindex) 1304 dev_put(xdp->rxq->dev); 1305 } 1306 1307 int bpf_prog_test_run_xdp(struct bpf_prog *prog, const union bpf_attr *kattr, 1308 union bpf_attr __user *uattr) 1309 { 1310 bool do_live = (kattr->test.flags & BPF_F_TEST_XDP_LIVE_FRAMES); 1311 u32 tailroom = SKB_DATA_ALIGN(sizeof(struct skb_shared_info)); 1312 u32 batch_size = kattr->test.batch_size; 1313 u32 retval = 0, duration, max_data_sz; 1314 u32 size = kattr->test.data_size_in; 1315 u32 headroom = XDP_PACKET_HEADROOM; 1316 u32 repeat = kattr->test.repeat; 1317 struct netdev_rx_queue *rxqueue; 1318 struct skb_shared_info *sinfo; 1319 struct xdp_buff xdp = {}; 1320 int i, ret = -EINVAL; 1321 struct xdp_md *ctx; 1322 void *data; 1323 1324 if (prog->expected_attach_type == BPF_XDP_DEVMAP || 1325 prog->expected_attach_type == BPF_XDP_CPUMAP) 1326 return -EINVAL; 1327 1328 if (kattr->test.flags & ~BPF_F_TEST_XDP_LIVE_FRAMES) 1329 return -EINVAL; 1330 1331 if (bpf_prog_is_dev_bound(prog->aux)) 1332 return -EINVAL; 1333 1334 if (do_live) { 1335 if (!batch_size) 1336 batch_size = NAPI_POLL_WEIGHT; 1337 else if (batch_size > TEST_XDP_MAX_BATCH) 1338 return -E2BIG; 1339 1340 headroom += sizeof(struct xdp_page_head); 1341 } else if (batch_size) { 1342 return -EINVAL; 1343 } 1344 1345 ctx = bpf_ctx_init(kattr, sizeof(struct xdp_md)); 1346 if (IS_ERR(ctx)) 1347 return PTR_ERR(ctx); 1348 1349 if (ctx) { 1350 /* There can't be user provided data before the meta data */ 1351 if (ctx->data_meta || ctx->data_end != size || 1352 ctx->data > ctx->data_end || 1353 unlikely(xdp_metalen_invalid(ctx->data)) || 1354 (do_live && (kattr->test.data_out || kattr->test.ctx_out))) 1355 goto free_ctx; 1356 /* Meta data is allocated from the headroom */ 1357 headroom -= ctx->data; 1358 } 1359 1360 max_data_sz = 4096 - headroom - tailroom; 1361 if (size > max_data_sz) { 1362 /* disallow live data mode for jumbo frames */ 1363 if (do_live) 1364 goto free_ctx; 1365 size = max_data_sz; 1366 } 1367 1368 data = bpf_test_init(kattr, size, max_data_sz, headroom, tailroom); 1369 if (IS_ERR(data)) { 1370 ret = PTR_ERR(data); 1371 goto free_ctx; 1372 } 1373 1374 rxqueue = __netif_get_rx_queue(current->nsproxy->net_ns->loopback_dev, 0); 1375 rxqueue->xdp_rxq.frag_size = headroom + max_data_sz + tailroom; 1376 xdp_init_buff(&xdp, rxqueue->xdp_rxq.frag_size, &rxqueue->xdp_rxq); 1377 xdp_prepare_buff(&xdp, data, headroom, size, true); 1378 sinfo = xdp_get_shared_info_from_buff(&xdp); 1379 1380 ret = xdp_convert_md_to_buff(ctx, &xdp); 1381 if (ret) 1382 goto free_data; 1383 1384 if (unlikely(kattr->test.data_size_in > size)) { 1385 void __user *data_in = u64_to_user_ptr(kattr->test.data_in); 1386 1387 while (size < kattr->test.data_size_in) { 1388 struct page *page; 1389 skb_frag_t *frag; 1390 u32 data_len; 1391 1392 if (sinfo->nr_frags == MAX_SKB_FRAGS) { 1393 ret = -ENOMEM; 1394 goto out; 1395 } 1396 1397 page = alloc_page(GFP_KERNEL); 1398 if (!page) { 1399 ret = -ENOMEM; 1400 goto out; 1401 } 1402 1403 frag = &sinfo->frags[sinfo->nr_frags++]; 1404 __skb_frag_set_page(frag, page); 1405 1406 data_len = min_t(u32, kattr->test.data_size_in - size, 1407 PAGE_SIZE); 1408 skb_frag_size_set(frag, data_len); 1409 1410 if (copy_from_user(page_address(page), data_in + size, 1411 data_len)) { 1412 ret = -EFAULT; 1413 goto out; 1414 } 1415 sinfo->xdp_frags_size += data_len; 1416 size += data_len; 1417 } 1418 xdp_buff_set_frags_flag(&xdp); 1419 } 1420 1421 if (repeat > 1) 1422 bpf_prog_change_xdp(NULL, prog); 1423 1424 if (do_live) 1425 ret = bpf_test_run_xdp_live(prog, &xdp, repeat, batch_size, &duration); 1426 else 1427 ret = bpf_test_run(prog, &xdp, repeat, &retval, &duration, true); 1428 /* We convert the xdp_buff back to an xdp_md before checking the return 1429 * code so the reference count of any held netdevice will be decremented 1430 * even if the test run failed. 1431 */ 1432 xdp_convert_buff_to_md(&xdp, ctx); 1433 if (ret) 1434 goto out; 1435 1436 size = xdp.data_end - xdp.data_meta + sinfo->xdp_frags_size; 1437 ret = bpf_test_finish(kattr, uattr, xdp.data_meta, sinfo, size, 1438 retval, duration); 1439 if (!ret) 1440 ret = bpf_ctx_finish(kattr, uattr, ctx, 1441 sizeof(struct xdp_md)); 1442 1443 out: 1444 if (repeat > 1) 1445 bpf_prog_change_xdp(prog, NULL); 1446 free_data: 1447 for (i = 0; i < sinfo->nr_frags; i++) 1448 __free_page(skb_frag_page(&sinfo->frags[i])); 1449 kfree(data); 1450 free_ctx: 1451 kfree(ctx); 1452 return ret; 1453 } 1454 1455 static int verify_user_bpf_flow_keys(struct bpf_flow_keys *ctx) 1456 { 1457 /* make sure the fields we don't use are zeroed */ 1458 if (!range_is_zero(ctx, 0, offsetof(struct bpf_flow_keys, flags))) 1459 return -EINVAL; 1460 1461 /* flags is allowed */ 1462 1463 if (!range_is_zero(ctx, offsetofend(struct bpf_flow_keys, flags), 1464 sizeof(struct bpf_flow_keys))) 1465 return -EINVAL; 1466 1467 return 0; 1468 } 1469 1470 int bpf_prog_test_run_flow_dissector(struct bpf_prog *prog, 1471 const union bpf_attr *kattr, 1472 union bpf_attr __user *uattr) 1473 { 1474 struct bpf_test_timer t = { NO_PREEMPT }; 1475 u32 size = kattr->test.data_size_in; 1476 struct bpf_flow_dissector ctx = {}; 1477 u32 repeat = kattr->test.repeat; 1478 struct bpf_flow_keys *user_ctx; 1479 struct bpf_flow_keys flow_keys; 1480 const struct ethhdr *eth; 1481 unsigned int flags = 0; 1482 u32 retval, duration; 1483 void *data; 1484 int ret; 1485 1486 if (kattr->test.flags || kattr->test.cpu || kattr->test.batch_size) 1487 return -EINVAL; 1488 1489 if (size < ETH_HLEN) 1490 return -EINVAL; 1491 1492 data = bpf_test_init(kattr, kattr->test.data_size_in, size, 0, 0); 1493 if (IS_ERR(data)) 1494 return PTR_ERR(data); 1495 1496 eth = (struct ethhdr *)data; 1497 1498 if (!repeat) 1499 repeat = 1; 1500 1501 user_ctx = bpf_ctx_init(kattr, sizeof(struct bpf_flow_keys)); 1502 if (IS_ERR(user_ctx)) { 1503 kfree(data); 1504 return PTR_ERR(user_ctx); 1505 } 1506 if (user_ctx) { 1507 ret = verify_user_bpf_flow_keys(user_ctx); 1508 if (ret) 1509 goto out; 1510 flags = user_ctx->flags; 1511 } 1512 1513 ctx.flow_keys = &flow_keys; 1514 ctx.data = data; 1515 ctx.data_end = (__u8 *)data + size; 1516 1517 bpf_test_timer_enter(&t); 1518 do { 1519 retval = bpf_flow_dissect(prog, &ctx, eth->h_proto, ETH_HLEN, 1520 size, flags); 1521 } while (bpf_test_timer_continue(&t, 1, repeat, &ret, &duration)); 1522 bpf_test_timer_leave(&t); 1523 1524 if (ret < 0) 1525 goto out; 1526 1527 ret = bpf_test_finish(kattr, uattr, &flow_keys, NULL, 1528 sizeof(flow_keys), retval, duration); 1529 if (!ret) 1530 ret = bpf_ctx_finish(kattr, uattr, user_ctx, 1531 sizeof(struct bpf_flow_keys)); 1532 1533 out: 1534 kfree(user_ctx); 1535 kfree(data); 1536 return ret; 1537 } 1538 1539 int bpf_prog_test_run_sk_lookup(struct bpf_prog *prog, const union bpf_attr *kattr, 1540 union bpf_attr __user *uattr) 1541 { 1542 struct bpf_test_timer t = { NO_PREEMPT }; 1543 struct bpf_prog_array *progs = NULL; 1544 struct bpf_sk_lookup_kern ctx = {}; 1545 u32 repeat = kattr->test.repeat; 1546 struct bpf_sk_lookup *user_ctx; 1547 u32 retval, duration; 1548 int ret = -EINVAL; 1549 1550 if (kattr->test.flags || kattr->test.cpu || kattr->test.batch_size) 1551 return -EINVAL; 1552 1553 if (kattr->test.data_in || kattr->test.data_size_in || kattr->test.data_out || 1554 kattr->test.data_size_out) 1555 return -EINVAL; 1556 1557 if (!repeat) 1558 repeat = 1; 1559 1560 user_ctx = bpf_ctx_init(kattr, sizeof(*user_ctx)); 1561 if (IS_ERR(user_ctx)) 1562 return PTR_ERR(user_ctx); 1563 1564 if (!user_ctx) 1565 return -EINVAL; 1566 1567 if (user_ctx->sk) 1568 goto out; 1569 1570 if (!range_is_zero(user_ctx, offsetofend(typeof(*user_ctx), local_port), sizeof(*user_ctx))) 1571 goto out; 1572 1573 if (user_ctx->local_port > U16_MAX) { 1574 ret = -ERANGE; 1575 goto out; 1576 } 1577 1578 ctx.family = (u16)user_ctx->family; 1579 ctx.protocol = (u16)user_ctx->protocol; 1580 ctx.dport = (u16)user_ctx->local_port; 1581 ctx.sport = user_ctx->remote_port; 1582 1583 switch (ctx.family) { 1584 case AF_INET: 1585 ctx.v4.daddr = (__force __be32)user_ctx->local_ip4; 1586 ctx.v4.saddr = (__force __be32)user_ctx->remote_ip4; 1587 break; 1588 1589 #if IS_ENABLED(CONFIG_IPV6) 1590 case AF_INET6: 1591 ctx.v6.daddr = (struct in6_addr *)user_ctx->local_ip6; 1592 ctx.v6.saddr = (struct in6_addr *)user_ctx->remote_ip6; 1593 break; 1594 #endif 1595 1596 default: 1597 ret = -EAFNOSUPPORT; 1598 goto out; 1599 } 1600 1601 progs = bpf_prog_array_alloc(1, GFP_KERNEL); 1602 if (!progs) { 1603 ret = -ENOMEM; 1604 goto out; 1605 } 1606 1607 progs->items[0].prog = prog; 1608 1609 bpf_test_timer_enter(&t); 1610 do { 1611 ctx.selected_sk = NULL; 1612 retval = BPF_PROG_SK_LOOKUP_RUN_ARRAY(progs, ctx, bpf_prog_run); 1613 } while (bpf_test_timer_continue(&t, 1, repeat, &ret, &duration)); 1614 bpf_test_timer_leave(&t); 1615 1616 if (ret < 0) 1617 goto out; 1618 1619 user_ctx->cookie = 0; 1620 if (ctx.selected_sk) { 1621 if (ctx.selected_sk->sk_reuseport && !ctx.no_reuseport) { 1622 ret = -EOPNOTSUPP; 1623 goto out; 1624 } 1625 1626 user_ctx->cookie = sock_gen_cookie(ctx.selected_sk); 1627 } 1628 1629 ret = bpf_test_finish(kattr, uattr, NULL, NULL, 0, retval, duration); 1630 if (!ret) 1631 ret = bpf_ctx_finish(kattr, uattr, user_ctx, sizeof(*user_ctx)); 1632 1633 out: 1634 bpf_prog_array_free(progs); 1635 kfree(user_ctx); 1636 return ret; 1637 } 1638 1639 int bpf_prog_test_run_syscall(struct bpf_prog *prog, 1640 const union bpf_attr *kattr, 1641 union bpf_attr __user *uattr) 1642 { 1643 void __user *ctx_in = u64_to_user_ptr(kattr->test.ctx_in); 1644 __u32 ctx_size_in = kattr->test.ctx_size_in; 1645 void *ctx = NULL; 1646 u32 retval; 1647 int err = 0; 1648 1649 /* doesn't support data_in/out, ctx_out, duration, or repeat or flags */ 1650 if (kattr->test.data_in || kattr->test.data_out || 1651 kattr->test.ctx_out || kattr->test.duration || 1652 kattr->test.repeat || kattr->test.flags || 1653 kattr->test.batch_size) 1654 return -EINVAL; 1655 1656 if (ctx_size_in < prog->aux->max_ctx_offset || 1657 ctx_size_in > U16_MAX) 1658 return -EINVAL; 1659 1660 if (ctx_size_in) { 1661 ctx = memdup_user(ctx_in, ctx_size_in); 1662 if (IS_ERR(ctx)) 1663 return PTR_ERR(ctx); 1664 } 1665 1666 rcu_read_lock_trace(); 1667 retval = bpf_prog_run_pin_on_cpu(prog, ctx); 1668 rcu_read_unlock_trace(); 1669 1670 if (copy_to_user(&uattr->test.retval, &retval, sizeof(u32))) { 1671 err = -EFAULT; 1672 goto out; 1673 } 1674 if (ctx_size_in) 1675 if (copy_to_user(ctx_in, ctx, ctx_size_in)) 1676 err = -EFAULT; 1677 out: 1678 kfree(ctx); 1679 return err; 1680 } 1681 1682 static const struct btf_kfunc_id_set bpf_prog_test_kfunc_set = { 1683 .owner = THIS_MODULE, 1684 .set = &test_sk_check_kfunc_ids, 1685 }; 1686 1687 BTF_ID_LIST(bpf_prog_test_dtor_kfunc_ids) 1688 BTF_ID(struct, prog_test_ref_kfunc) 1689 BTF_ID(func, bpf_kfunc_call_test_release) 1690 BTF_ID(struct, prog_test_member) 1691 BTF_ID(func, bpf_kfunc_call_memb_release) 1692 1693 static int __init bpf_prog_test_run_init(void) 1694 { 1695 const struct btf_id_dtor_kfunc bpf_prog_test_dtor_kfunc[] = { 1696 { 1697 .btf_id = bpf_prog_test_dtor_kfunc_ids[0], 1698 .kfunc_btf_id = bpf_prog_test_dtor_kfunc_ids[1] 1699 }, 1700 { 1701 .btf_id = bpf_prog_test_dtor_kfunc_ids[2], 1702 .kfunc_btf_id = bpf_prog_test_dtor_kfunc_ids[3], 1703 }, 1704 }; 1705 int ret; 1706 1707 ret = register_btf_fmodret_id_set(&bpf_test_modify_return_set); 1708 ret = ret ?: register_btf_kfunc_id_set(BPF_PROG_TYPE_SCHED_CLS, &bpf_prog_test_kfunc_set); 1709 ret = ret ?: register_btf_kfunc_id_set(BPF_PROG_TYPE_TRACING, &bpf_prog_test_kfunc_set); 1710 ret = ret ?: register_btf_kfunc_id_set(BPF_PROG_TYPE_SYSCALL, &bpf_prog_test_kfunc_set); 1711 return ret ?: register_btf_id_dtor_kfuncs(bpf_prog_test_dtor_kfunc, 1712 ARRAY_SIZE(bpf_prog_test_dtor_kfunc), 1713 THIS_MODULE); 1714 } 1715 late_initcall(bpf_prog_test_run_init); 1716