1 | // SPDX-License-Identifier: GPL-2.0 |
2 | /* |
3 | * Copyright (C) 2021. Huawei Technologies Co., Ltd |
4 | */ |
5 | #include <linux/kernel.h> |
6 | #include <linux/bpf_verifier.h> |
7 | #include <linux/bpf.h> |
8 | #include <linux/btf.h> |
9 | |
10 | static struct bpf_struct_ops bpf_bpf_dummy_ops; |
11 | |
12 | /* A common type for test_N with return value in bpf_dummy_ops */ |
13 | typedef int (*dummy_ops_test_ret_fn)(struct bpf_dummy_ops_state *state, ...); |
14 | |
15 | static int dummy_ops_test_ret_function(struct bpf_dummy_ops_state *state, ...) |
16 | { |
17 | return 0; |
18 | } |
19 | |
20 | struct bpf_dummy_ops_test_args { |
21 | u64 args[MAX_BPF_FUNC_ARGS]; |
22 | struct bpf_dummy_ops_state state; |
23 | }; |
24 | |
25 | static struct btf *bpf_dummy_ops_btf; |
26 | |
27 | static struct bpf_dummy_ops_test_args * |
28 | dummy_ops_init_args(const union bpf_attr *kattr, unsigned int nr) |
29 | { |
30 | __u32 size_in; |
31 | struct bpf_dummy_ops_test_args *args; |
32 | void __user *ctx_in; |
33 | void __user *u_state; |
34 | |
35 | size_in = kattr->test.ctx_size_in; |
36 | if (size_in != sizeof(u64) * nr) |
37 | return ERR_PTR(error: -EINVAL); |
38 | |
39 | args = kzalloc(size: sizeof(*args), GFP_KERNEL); |
40 | if (!args) |
41 | return ERR_PTR(error: -ENOMEM); |
42 | |
43 | ctx_in = u64_to_user_ptr(kattr->test.ctx_in); |
44 | if (copy_from_user(to: args->args, from: ctx_in, n: size_in)) |
45 | goto out; |
46 | |
47 | /* args[0] is 0 means state argument of test_N will be NULL */ |
48 | u_state = u64_to_user_ptr(args->args[0]); |
49 | if (u_state && copy_from_user(to: &args->state, from: u_state, |
50 | n: sizeof(args->state))) |
51 | goto out; |
52 | |
53 | return args; |
54 | out: |
55 | kfree(objp: args); |
56 | return ERR_PTR(error: -EFAULT); |
57 | } |
58 | |
59 | static int dummy_ops_copy_args(struct bpf_dummy_ops_test_args *args) |
60 | { |
61 | void __user *u_state; |
62 | |
63 | u_state = u64_to_user_ptr(args->args[0]); |
64 | if (u_state && copy_to_user(to: u_state, from: &args->state, n: sizeof(args->state))) |
65 | return -EFAULT; |
66 | |
67 | return 0; |
68 | } |
69 | |
70 | static int dummy_ops_call_op(void *image, struct bpf_dummy_ops_test_args *args) |
71 | { |
72 | dummy_ops_test_ret_fn test = (void *)image + cfi_get_offset(); |
73 | struct bpf_dummy_ops_state *state = NULL; |
74 | |
75 | /* state needs to be NULL if args[0] is 0 */ |
76 | if (args->args[0]) |
77 | state = &args->state; |
78 | return test(state, args->args[1], args->args[2], |
79 | args->args[3], args->args[4]); |
80 | } |
81 | |
82 | extern const struct bpf_link_ops bpf_struct_ops_link_lops; |
83 | |
84 | int bpf_struct_ops_test_run(struct bpf_prog *prog, const union bpf_attr *kattr, |
85 | union bpf_attr __user *uattr) |
86 | { |
87 | const struct bpf_struct_ops *st_ops = &bpf_bpf_dummy_ops; |
88 | const struct btf_type *func_proto; |
89 | struct bpf_dummy_ops_test_args *args; |
90 | struct bpf_tramp_links *tlinks; |
91 | struct bpf_tramp_link *link = NULL; |
92 | void *image = NULL; |
93 | unsigned int op_idx; |
94 | u32 image_off = 0; |
95 | int prog_ret; |
96 | s32 type_id; |
97 | int err; |
98 | |
99 | type_id = btf_find_by_name_kind(btf: bpf_dummy_ops_btf, |
100 | name: bpf_bpf_dummy_ops.name, |
101 | kind: BTF_KIND_STRUCT); |
102 | if (type_id < 0) |
103 | return -EINVAL; |
104 | if (prog->aux->attach_btf_id != type_id) |
105 | return -EOPNOTSUPP; |
106 | |
107 | func_proto = prog->aux->attach_func_proto; |
108 | args = dummy_ops_init_args(kattr, nr: btf_type_vlen(t: func_proto)); |
109 | if (IS_ERR(ptr: args)) |
110 | return PTR_ERR(ptr: args); |
111 | |
112 | tlinks = kcalloc(n: BPF_TRAMP_MAX, size: sizeof(*tlinks), GFP_KERNEL); |
113 | if (!tlinks) { |
114 | err = -ENOMEM; |
115 | goto out; |
116 | } |
117 | |
118 | link = kzalloc(size: sizeof(*link), GFP_USER); |
119 | if (!link) { |
120 | err = -ENOMEM; |
121 | goto out; |
122 | } |
123 | /* prog doesn't take the ownership of the reference from caller */ |
124 | bpf_prog_inc(prog); |
125 | bpf_link_init(link: &link->link, type: BPF_LINK_TYPE_STRUCT_OPS, ops: &bpf_struct_ops_link_lops, prog); |
126 | |
127 | op_idx = prog->expected_attach_type; |
128 | err = bpf_struct_ops_prepare_trampoline(tlinks, link, |
129 | model: &st_ops->func_models[op_idx], |
130 | stub_func: &dummy_ops_test_ret_function, |
131 | image: &image, image_off: &image_off, |
132 | allow_alloc: true); |
133 | if (err < 0) |
134 | goto out; |
135 | |
136 | arch_protect_bpf_trampoline(image, PAGE_SIZE); |
137 | prog_ret = dummy_ops_call_op(image, args); |
138 | |
139 | err = dummy_ops_copy_args(args); |
140 | if (err) |
141 | goto out; |
142 | if (put_user(prog_ret, &uattr->test.retval)) |
143 | err = -EFAULT; |
144 | out: |
145 | kfree(objp: args); |
146 | bpf_struct_ops_image_free(image); |
147 | if (link) |
148 | bpf_link_put(link: &link->link); |
149 | kfree(objp: tlinks); |
150 | return err; |
151 | } |
152 | |
153 | static int bpf_dummy_init(struct btf *btf) |
154 | { |
155 | bpf_dummy_ops_btf = btf; |
156 | return 0; |
157 | } |
158 | |
159 | static bool bpf_dummy_ops_is_valid_access(int off, int size, |
160 | enum bpf_access_type type, |
161 | const struct bpf_prog *prog, |
162 | struct bpf_insn_access_aux *info) |
163 | { |
164 | return bpf_tracing_btf_ctx_access(off, size, type, prog, info); |
165 | } |
166 | |
167 | static int bpf_dummy_ops_check_member(const struct btf_type *t, |
168 | const struct btf_member *member, |
169 | const struct bpf_prog *prog) |
170 | { |
171 | u32 moff = __btf_member_bit_offset(struct_type: t, member) / 8; |
172 | |
173 | switch (moff) { |
174 | case offsetof(struct bpf_dummy_ops, test_sleepable): |
175 | break; |
176 | default: |
177 | if (prog->sleepable) |
178 | return -EINVAL; |
179 | } |
180 | |
181 | return 0; |
182 | } |
183 | |
184 | static int bpf_dummy_ops_btf_struct_access(struct bpf_verifier_log *log, |
185 | const struct bpf_reg_state *reg, |
186 | int off, int size) |
187 | { |
188 | const struct btf_type *state; |
189 | const struct btf_type *t; |
190 | s32 type_id; |
191 | |
192 | type_id = btf_find_by_name_kind(btf: reg->btf, name: "bpf_dummy_ops_state" , |
193 | kind: BTF_KIND_STRUCT); |
194 | if (type_id < 0) |
195 | return -EINVAL; |
196 | |
197 | t = btf_type_by_id(btf: reg->btf, type_id: reg->btf_id); |
198 | state = btf_type_by_id(btf: reg->btf, type_id); |
199 | if (t != state) { |
200 | bpf_log(log, fmt: "only access to bpf_dummy_ops_state is supported\n" ); |
201 | return -EACCES; |
202 | } |
203 | |
204 | if (off + size > sizeof(struct bpf_dummy_ops_state)) { |
205 | bpf_log(log, fmt: "write access at off %d with size %d\n" , off, size); |
206 | return -EACCES; |
207 | } |
208 | |
209 | return NOT_INIT; |
210 | } |
211 | |
212 | static const struct bpf_verifier_ops bpf_dummy_verifier_ops = { |
213 | .is_valid_access = bpf_dummy_ops_is_valid_access, |
214 | .btf_struct_access = bpf_dummy_ops_btf_struct_access, |
215 | }; |
216 | |
217 | static int bpf_dummy_init_member(const struct btf_type *t, |
218 | const struct btf_member *member, |
219 | void *kdata, const void *udata) |
220 | { |
221 | return -EOPNOTSUPP; |
222 | } |
223 | |
224 | static int bpf_dummy_reg(void *kdata) |
225 | { |
226 | return -EOPNOTSUPP; |
227 | } |
228 | |
229 | static void bpf_dummy_unreg(void *kdata) |
230 | { |
231 | } |
232 | |
233 | static int bpf_dummy_test_1(struct bpf_dummy_ops_state *cb) |
234 | { |
235 | return 0; |
236 | } |
237 | |
238 | static int bpf_dummy_test_2(struct bpf_dummy_ops_state *cb, int a1, unsigned short a2, |
239 | char a3, unsigned long a4) |
240 | { |
241 | return 0; |
242 | } |
243 | |
244 | static int bpf_dummy_test_sleepable(struct bpf_dummy_ops_state *cb) |
245 | { |
246 | return 0; |
247 | } |
248 | |
249 | static struct bpf_dummy_ops __bpf_bpf_dummy_ops = { |
250 | .test_1 = bpf_dummy_test_1, |
251 | .test_2 = bpf_dummy_test_2, |
252 | .test_sleepable = bpf_dummy_test_sleepable, |
253 | }; |
254 | |
255 | static struct bpf_struct_ops bpf_bpf_dummy_ops = { |
256 | .verifier_ops = &bpf_dummy_verifier_ops, |
257 | .init = bpf_dummy_init, |
258 | .check_member = bpf_dummy_ops_check_member, |
259 | .init_member = bpf_dummy_init_member, |
260 | .reg = bpf_dummy_reg, |
261 | .unreg = bpf_dummy_unreg, |
262 | .name = "bpf_dummy_ops" , |
263 | .cfi_stubs = &__bpf_bpf_dummy_ops, |
264 | .owner = THIS_MODULE, |
265 | }; |
266 | |
267 | static int __init bpf_dummy_struct_ops_init(void) |
268 | { |
269 | return register_bpf_struct_ops(&bpf_bpf_dummy_ops, bpf_dummy_ops); |
270 | } |
271 | late_initcall(bpf_dummy_struct_ops_init); |
272 | |