1 /* SPDX-License-Identifier: GPL-2.0-only */ 2 /* Copyright (c) 2011-2014 PLUMgrid, http://plumgrid.com 3 */ 4 #ifndef _LINUX_BPF_H 5 #define _LINUX_BPF_H 1 6 7 #include <uapi/linux/bpf.h> 8 #include <uapi/linux/filter.h> 9 #include <linux/bpf_defs.h> 10 11 #include <crypto/sha2.h> 12 #include <linux/workqueue.h> 13 #include <linux/file.h> 14 #include <linux/percpu.h> 15 #include <linux/err.h> 16 #include <linux/rbtree_latch.h> 17 #include <linux/numa.h> 18 #include <linux/mm_types.h> 19 #include <linux/wait.h> 20 #include <linux/irq_work_types.h> 21 #include <linux/refcount.h> 22 #include <linux/mutex.h> 23 #include <linux/module.h> 24 #include <linux/kallsyms.h> 25 #include <linux/capability.h> 26 #include <linux/sched/mm.h> 27 #include <linux/slab.h> 28 #include <linux/percpu-refcount.h> 29 #include <linux/stddef.h> 30 #include <linux/bpfptr.h> 31 #include <linux/btf.h> 32 #include <linux/rcupdate_trace.h> 33 #include <linux/static_call.h> 34 #include <linux/memcontrol.h> 35 #include <linux/cfi.h> 36 #include <linux/xattr.h> 37 #include <linux/key.h> 38 #include <linux/ftrace.h> 39 #include <asm/rqspinlock.h> 40 41 struct bpf_verifier_env; 42 struct bpf_verifier_log; 43 struct perf_event; 44 struct bpf_prog; 45 struct bpf_prog_aux; 46 struct bpf_map; 47 struct bpf_arena; 48 struct sock; 49 struct seq_file; 50 struct btf; 51 struct btf_type; 52 struct exception_table_entry; 53 struct seq_operations; 54 struct bpf_iter_aux_info; 55 struct bpf_local_storage; 56 struct bpf_local_storage_map; 57 struct kobject; 58 struct mem_cgroup; 59 struct module; 60 struct bpf_func_state; 61 struct ftrace_ops; 62 struct cgroup; 63 struct bpf_token; 64 struct user_namespace; 65 struct super_block; 66 struct inode; 67 68 extern struct idr btf_idr; 69 extern spinlock_t btf_idr_lock; 70 extern struct kobject *btf_kobj; 71 extern struct bpf_mem_alloc bpf_global_ma, bpf_global_percpu_ma; 72 extern bool bpf_global_ma_set; 73 74 typedef u64 (*bpf_callback_t)(u64, u64, u64, u64, u64); 75 typedef int (*bpf_iter_init_seq_priv_t)(void *private_data, 76 struct bpf_iter_aux_info *aux); 77 typedef void (*bpf_iter_fini_seq_priv_t)(void *private_data); 78 typedef unsigned int (*bpf_func_t)(const void *, 79 const struct bpf_insn *); 80 struct bpf_iter_seq_info { 81 const struct seq_operations *seq_ops; 82 bpf_iter_init_seq_priv_t init_seq_private; 83 bpf_iter_fini_seq_priv_t fini_seq_private; 84 u32 seq_priv_size; 85 }; 86 87 /* map is generic key/value storage optionally accessible by eBPF programs */ 88 struct bpf_map_ops { 89 /* funcs callable from userspace (via syscall) */ 90 int (*map_alloc_check)(union bpf_attr *attr); 91 struct bpf_map *(*map_alloc)(union bpf_attr *attr); 92 void (*map_release)(struct bpf_map *map, struct file *map_file); 93 void (*map_free)(struct bpf_map *map); 94 void (*map_free_pre_rcu)(struct bpf_map *map); 95 int (*map_get_next_key)(struct bpf_map *map, void *key, void *next_key); 96 void (*map_release_uref)(struct bpf_map *map); 97 void *(*map_lookup_elem_sys_only)(struct bpf_map *map, void *key); 98 int (*map_lookup_batch)(struct bpf_map *map, const union bpf_attr *attr, 99 union bpf_attr __user *uattr); 100 int (*map_lookup_and_delete_elem)(struct bpf_map *map, void *key, 101 void *value, u64 flags); 102 int (*map_lookup_and_delete_batch)(struct bpf_map *map, 103 const union bpf_attr *attr, 104 union bpf_attr __user *uattr); 105 int (*map_update_batch)(struct bpf_map *map, struct file *map_file, 106 const union bpf_attr *attr, 107 union bpf_attr __user *uattr); 108 int (*map_delete_batch)(struct bpf_map *map, const union bpf_attr *attr, 109 union bpf_attr __user *uattr); 110 111 /* funcs callable from userspace and from eBPF programs */ 112 void *(*map_lookup_elem)(struct bpf_map *map, void *key); 113 long (*map_update_elem)(struct bpf_map *map, void *key, void *value, u64 flags); 114 long (*map_delete_elem)(struct bpf_map *map, void *key); 115 long (*map_push_elem)(struct bpf_map *map, void *value, u64 flags); 116 long (*map_pop_elem)(struct bpf_map *map, void *value); 117 long (*map_peek_elem)(struct bpf_map *map, void *value); 118 void *(*map_lookup_percpu_elem)(struct bpf_map *map, void *key, u32 cpu); 119 int (*map_get_hash)(struct bpf_map *map); 120 121 /* funcs called by prog_array and perf_event_array map */ 122 void *(*map_fd_get_ptr)(struct bpf_map *map, struct file *map_file, 123 int fd); 124 /* If need_defer is true, the implementation should guarantee that 125 * the to-be-put element is still alive before the bpf program, which 126 * may manipulate it, exists. 127 */ 128 void (*map_fd_put_ptr)(struct bpf_map *map, void *ptr, bool need_defer); 129 int (*map_gen_lookup)(struct bpf_map *map, struct bpf_insn *insn_buf); 130 u32 (*map_fd_sys_lookup_elem)(void *ptr); 131 void (*map_seq_show_elem)(struct bpf_map *map, void *key, 132 struct seq_file *m); 133 int (*map_check_btf)(struct bpf_map *map, 134 const struct btf *btf, 135 const struct btf_type *key_type, 136 const struct btf_type *value_type); 137 138 /* Prog poke tracking helpers. */ 139 int (*map_poke_track)(struct bpf_map *map, struct bpf_prog_aux *aux); 140 void (*map_poke_untrack)(struct bpf_map *map, struct bpf_prog_aux *aux); 141 void (*map_poke_run)(struct bpf_map *map, u32 key, struct bpf_prog *old, 142 struct bpf_prog *new); 143 144 /* Direct value access helpers. */ 145 int (*map_direct_value_addr)(const struct bpf_map *map, 146 u64 *imm, u32 off); 147 int (*map_direct_value_meta)(const struct bpf_map *map, 148 u64 imm, u32 *off); 149 int (*map_mmap)(struct bpf_map *map, struct vm_area_struct *vma); 150 vm_fault_t (*map_mmap_fault)(struct bpf_map *map, struct vm_fault *vmf); 151 __poll_t (*map_poll)(struct bpf_map *map, struct file *filp, 152 struct poll_table_struct *pts); 153 unsigned long (*map_get_unmapped_area)(struct file *filep, unsigned long addr, 154 unsigned long len, unsigned long pgoff, 155 unsigned long flags); 156 157 /* Functions called by bpf_local_storage maps */ 158 int (*map_local_storage_charge)(struct bpf_local_storage_map *smap, 159 void *owner, u32 size); 160 void (*map_local_storage_uncharge)(struct bpf_local_storage_map *smap, 161 void *owner, u32 size); 162 struct bpf_local_storage __rcu ** (*map_owner_storage_ptr)(void *owner); 163 164 /* Misc helpers.*/ 165 long (*map_redirect)(struct bpf_map *map, u64 key, u64 flags); 166 167 /* map_meta_equal must be implemented for maps that can be 168 * used as an inner map. It is a runtime check to ensure 169 * an inner map can be inserted to an outer map. 170 * 171 * Some properties of the inner map has been used during the 172 * verification time. When inserting an inner map at the runtime, 173 * map_meta_equal has to ensure the inserting map has the same 174 * properties that the verifier has used earlier. 175 */ 176 bool (*map_meta_equal)(const struct bpf_map *meta0, 177 const struct bpf_map *meta1); 178 179 180 int (*map_set_for_each_callback_args)(struct bpf_verifier_env *env, 181 struct bpf_func_state *caller, 182 struct bpf_func_state *callee); 183 long (*map_for_each_callback)(struct bpf_map *map, 184 bpf_callback_t callback_fn, 185 void *callback_ctx, u64 flags); 186 187 u64 (*map_mem_usage)(const struct bpf_map *map); 188 189 /* BTF id of struct allocated by map_alloc */ 190 int *map_btf_id; 191 192 /* bpf_iter info used to open a seq_file */ 193 const struct bpf_iter_seq_info *iter_seq_info; 194 }; 195 196 enum { 197 /* Support at most 11 fields in a BTF type */ 198 BTF_FIELDS_MAX = 11, 199 }; 200 201 enum btf_field_type { 202 BPF_SPIN_LOCK = (1 << 0), 203 BPF_TIMER = (1 << 1), 204 BPF_KPTR_UNREF = (1 << 2), 205 BPF_KPTR_REF = (1 << 3), 206 BPF_KPTR_PERCPU = (1 << 4), 207 BPF_KPTR = BPF_KPTR_UNREF | BPF_KPTR_REF | BPF_KPTR_PERCPU, 208 BPF_LIST_HEAD = (1 << 5), 209 BPF_LIST_NODE = (1 << 6), 210 BPF_RB_ROOT = (1 << 7), 211 BPF_RB_NODE = (1 << 8), 212 BPF_GRAPH_NODE = BPF_RB_NODE | BPF_LIST_NODE, 213 BPF_GRAPH_ROOT = BPF_RB_ROOT | BPF_LIST_HEAD, 214 BPF_REFCOUNT = (1 << 9), 215 BPF_WORKQUEUE = (1 << 10), 216 BPF_UPTR = (1 << 11), 217 BPF_RES_SPIN_LOCK = (1 << 12), 218 BPF_TASK_WORK = (1 << 13), 219 BPF_RCU_HEAD = (1 << 14), 220 }; 221 222 enum bpf_cgroup_storage_type { 223 BPF_CGROUP_STORAGE_SHARED, 224 BPF_CGROUP_STORAGE_PERCPU, 225 __BPF_CGROUP_STORAGE_MAX 226 #define MAX_BPF_CGROUP_STORAGE_TYPE __BPF_CGROUP_STORAGE_MAX 227 }; 228 229 #ifdef CONFIG_CGROUP_BPF 230 # define for_each_cgroup_storage_type(stype) \ 231 for (stype = 0; stype < MAX_BPF_CGROUP_STORAGE_TYPE; stype++) 232 #else 233 # define for_each_cgroup_storage_type(stype) for (; false; ) 234 #endif /* CONFIG_CGROUP_BPF */ 235 236 typedef void (*btf_dtor_kfunc_t)(void *); 237 238 struct btf_field_kptr { 239 struct btf *btf; 240 struct module *module; 241 /* dtor used if btf_is_kernel(btf), otherwise the type is 242 * program-allocated, dtor is NULL, and __bpf_obj_drop_impl is used 243 */ 244 btf_dtor_kfunc_t dtor; 245 u32 btf_id; 246 }; 247 248 struct btf_field_graph_root { 249 struct btf *btf; 250 u32 value_btf_id; 251 u32 node_offset; 252 struct btf_record *value_rec; 253 }; 254 255 struct btf_field { 256 u32 offset; 257 u32 size; 258 enum btf_field_type type; 259 union { 260 struct btf_field_kptr kptr; 261 struct btf_field_graph_root graph_root; 262 }; 263 }; 264 265 struct btf_record { 266 u32 cnt; 267 u32 field_mask; 268 int spin_lock_off; 269 int res_spin_lock_off; 270 int timer_off; 271 int wq_off; 272 int refcount_off; 273 int task_work_off; 274 int rcu_head_off; 275 struct btf_field fields[]; 276 }; 277 278 /* Non-opaque version of bpf_rb_node in uapi/linux/bpf.h */ 279 struct bpf_rb_node_kern { 280 struct rb_node rb_node; 281 void *owner; 282 } __attribute__((aligned(8))); 283 284 /* Non-opaque version of bpf_list_node in uapi/linux/bpf.h */ 285 struct bpf_list_node_kern { 286 struct list_head list_head; 287 void *owner; 288 } __attribute__((aligned(8))); 289 290 /* 'Ownership' of program-containing map is claimed by the first program 291 * that is going to use this map or by the first program which FD is 292 * stored in the map to make sure that all callers and callees have the 293 * same prog type, JITed flag and xdp_has_frags flag. 294 */ 295 struct bpf_map_owner { 296 enum bpf_prog_type type; 297 bool jited; 298 bool xdp_has_frags; 299 bool sleepable; 300 u64 storage_cookie[MAX_BPF_CGROUP_STORAGE_TYPE]; 301 const struct btf_type *attach_func_proto; 302 enum bpf_attach_type expected_attach_type; 303 }; 304 305 struct bpf_map { 306 u8 sha[SHA256_DIGEST_SIZE]; 307 const struct bpf_map_ops *ops; 308 struct bpf_map *inner_map_meta; 309 #ifdef CONFIG_SECURITY 310 void *security; 311 #endif 312 enum bpf_map_type map_type; 313 u32 key_size; 314 u32 value_size; 315 u32 max_entries; 316 u64 map_extra; /* any per-map-type extra fields */ 317 u32 map_flags; 318 u32 id; 319 struct btf_record *record; 320 int numa_node; 321 u32 btf_key_type_id; 322 u32 btf_value_type_id; 323 u32 btf_vmlinux_value_type_id; 324 struct btf *btf; 325 #ifdef CONFIG_MEMCG 326 struct obj_cgroup *objcg; 327 #endif 328 char name[BPF_OBJ_NAME_LEN]; 329 struct mutex freeze_mutex; 330 atomic64_t refcnt; 331 atomic64_t usercnt; 332 /* rcu is used before freeing and work is only used during freeing */ 333 union { 334 struct work_struct work; 335 struct rcu_head rcu; 336 }; 337 atomic64_t writecnt; 338 spinlock_t owner_lock; 339 struct bpf_map_owner *owner; 340 bool bypass_spec_v1; 341 bool frozen; /* write-once; write-protected by freeze_mutex */ 342 bool free_after_mult_rcu_gp; 343 bool free_after_rcu_gp; 344 bool was_inner_map; 345 atomic64_t sleepable_refcnt; 346 s64 __percpu *elem_count; 347 u64 cookie; /* write-once */ 348 char *excl_prog_sha; 349 /* 350 * Which programs use the map, see bpf_map_claim(): 0 - none so far, 351 * aux of the program - only that one, the same with BPF_MAP_USER_PATCHED 352 * set - only that one and it stored the addresses of its functions into 353 * the map, BPF_MAP_USER_MANY - more than one. 354 */ 355 unsigned long user; 356 }; 357 358 #define BPF_MAP_USER_MANY 1UL 359 #define BPF_MAP_USER_PATCHED 1UL 360 361 static inline const char *btf_field_type_name(enum btf_field_type type) 362 { 363 switch (type) { 364 case BPF_SPIN_LOCK: 365 return "bpf_spin_lock"; 366 case BPF_RES_SPIN_LOCK: 367 return "bpf_res_spin_lock"; 368 case BPF_TIMER: 369 return "bpf_timer"; 370 case BPF_WORKQUEUE: 371 return "bpf_wq"; 372 case BPF_KPTR_UNREF: 373 case BPF_KPTR_REF: 374 return "kptr"; 375 case BPF_KPTR_PERCPU: 376 return "percpu_kptr"; 377 case BPF_UPTR: 378 return "uptr"; 379 case BPF_LIST_HEAD: 380 return "bpf_list_head"; 381 case BPF_LIST_NODE: 382 return "bpf_list_node"; 383 case BPF_RB_ROOT: 384 return "bpf_rb_root"; 385 case BPF_RB_NODE: 386 return "bpf_rb_node"; 387 case BPF_REFCOUNT: 388 return "bpf_refcount"; 389 case BPF_TASK_WORK: 390 return "bpf_task_work"; 391 case BPF_RCU_HEAD: 392 return "bpf_rcu_head"; 393 default: 394 WARN_ON_ONCE(1); 395 return "unknown"; 396 } 397 } 398 399 #if IS_ENABLED(CONFIG_DEBUG_KERNEL) 400 #define BPF_WARN_ONCE(cond, format...) WARN_ONCE(cond, format) 401 #else 402 #define BPF_WARN_ONCE(cond, format...) BUILD_BUG_ON_INVALID(cond) 403 #endif 404 405 static inline u32 btf_field_type_size(enum btf_field_type type) 406 { 407 switch (type) { 408 case BPF_SPIN_LOCK: 409 return sizeof(struct bpf_spin_lock); 410 case BPF_RES_SPIN_LOCK: 411 return sizeof(struct bpf_res_spin_lock); 412 case BPF_TIMER: 413 return sizeof(struct bpf_timer); 414 case BPF_WORKQUEUE: 415 return sizeof(struct bpf_wq); 416 case BPF_KPTR_UNREF: 417 case BPF_KPTR_REF: 418 case BPF_KPTR_PERCPU: 419 case BPF_UPTR: 420 return sizeof(u64); 421 case BPF_LIST_HEAD: 422 return sizeof(struct bpf_list_head); 423 case BPF_LIST_NODE: 424 return sizeof(struct bpf_list_node); 425 case BPF_RB_ROOT: 426 return sizeof(struct bpf_rb_root); 427 case BPF_RB_NODE: 428 return sizeof(struct bpf_rb_node); 429 case BPF_REFCOUNT: 430 return sizeof(struct bpf_refcount); 431 case BPF_TASK_WORK: 432 return sizeof(struct bpf_task_work); 433 case BPF_RCU_HEAD: 434 return sizeof(struct bpf_rcu_head); 435 default: 436 WARN_ON_ONCE(1); 437 return 0; 438 } 439 } 440 441 static inline u32 btf_field_type_align(enum btf_field_type type) 442 { 443 switch (type) { 444 case BPF_SPIN_LOCK: 445 return __alignof__(struct bpf_spin_lock); 446 case BPF_RES_SPIN_LOCK: 447 return __alignof__(struct bpf_res_spin_lock); 448 case BPF_TIMER: 449 return __alignof__(struct bpf_timer); 450 case BPF_WORKQUEUE: 451 return __alignof__(struct bpf_wq); 452 case BPF_KPTR_UNREF: 453 case BPF_KPTR_REF: 454 case BPF_KPTR_PERCPU: 455 case BPF_UPTR: 456 return __alignof__(u64); 457 case BPF_LIST_HEAD: 458 return __alignof__(struct bpf_list_head); 459 case BPF_LIST_NODE: 460 return __alignof__(struct bpf_list_node); 461 case BPF_RB_ROOT: 462 return __alignof__(struct bpf_rb_root); 463 case BPF_RB_NODE: 464 return __alignof__(struct bpf_rb_node); 465 case BPF_REFCOUNT: 466 return __alignof__(struct bpf_refcount); 467 case BPF_TASK_WORK: 468 return __alignof__(struct bpf_task_work); 469 case BPF_RCU_HEAD: 470 return __alignof__(struct bpf_rcu_head); 471 default: 472 WARN_ON_ONCE(1); 473 return 0; 474 } 475 } 476 477 static inline void bpf_obj_init_field(const struct btf_field *field, void *addr) 478 { 479 memset(addr, 0, field->size); 480 481 switch (field->type) { 482 case BPF_REFCOUNT: 483 refcount_set((refcount_t *)addr, 1); 484 break; 485 case BPF_RB_NODE: 486 RB_CLEAR_NODE((struct rb_node *)addr); 487 break; 488 case BPF_LIST_HEAD: 489 case BPF_LIST_NODE: 490 INIT_LIST_HEAD((struct list_head *)addr); 491 break; 492 case BPF_RB_ROOT: 493 /* RB_ROOT_CACHED 0-inits, no need to do anything after memset */ 494 case BPF_SPIN_LOCK: 495 case BPF_RES_SPIN_LOCK: 496 case BPF_TIMER: 497 case BPF_WORKQUEUE: 498 case BPF_KPTR_UNREF: 499 case BPF_KPTR_REF: 500 case BPF_KPTR_PERCPU: 501 case BPF_UPTR: 502 case BPF_TASK_WORK: 503 case BPF_RCU_HEAD: 504 break; 505 default: 506 WARN_ON_ONCE(1); 507 return; 508 } 509 } 510 511 static inline bool btf_record_has_field(const struct btf_record *rec, enum btf_field_type type) 512 { 513 if (IS_ERR_OR_NULL(rec)) 514 return false; 515 return rec->field_mask & type; 516 } 517 518 static inline bool btf_field_is_nmi_safe(enum btf_field_type type) 519 { 520 switch (type) { 521 case BPF_SPIN_LOCK: 522 case BPF_RES_SPIN_LOCK: 523 case BPF_TIMER: 524 case BPF_WORKQUEUE: 525 case BPF_TASK_WORK: 526 case BPF_KPTR_UNREF: 527 case BPF_REFCOUNT: 528 return true; 529 default: 530 return false; 531 } 532 } 533 534 static inline bool btf_record_has_nmi_unsafe_fields(const struct btf_record *rec) 535 { 536 int i; 537 538 if (IS_ERR_OR_NULL(rec)) 539 return false; 540 for (i = 0; i < rec->cnt; i++) { 541 if (!btf_field_is_nmi_safe(rec->fields[i].type)) 542 return true; 543 } 544 return false; 545 } 546 547 static inline void bpf_obj_init(const struct btf_record *rec, void *obj) 548 { 549 int i; 550 551 if (IS_ERR_OR_NULL(rec)) 552 return; 553 for (i = 0; i < rec->cnt; i++) 554 bpf_obj_init_field(&rec->fields[i], obj + rec->fields[i].offset); 555 } 556 557 /* 'dst' must be a temporary buffer and should not point to memory that is being 558 * used in parallel by a bpf program or bpf syscall, otherwise the access from 559 * the bpf program or bpf syscall may be corrupted by the reinitialization, 560 * leading to weird problems. Even 'dst' is newly-allocated from bpf memory 561 * allocator, it is still possible for 'dst' to be used in parallel by a bpf 562 * program or bpf syscall. 563 */ 564 static inline void check_and_init_map_value(struct bpf_map *map, void *dst) 565 { 566 bpf_obj_init(map->record, dst); 567 } 568 569 /* memcpy that is used with 8-byte aligned pointers, power-of-8 size and 570 * forced to use 'long' read/writes to try to atomically copy long counters. 571 * Best-effort only. No barriers here, since it _will_ race with concurrent 572 * updates from BPF programs. Called from bpf syscall and mostly used with 573 * size 8 or 16 bytes, so ask compiler to inline it. 574 */ 575 static inline void bpf_long_memcpy(void *dst, const void *src, u32 size) 576 { 577 const long *lsrc = src; 578 long *ldst = dst; 579 580 size /= sizeof(long); 581 while (size--) 582 data_race(*ldst++ = *lsrc++); 583 } 584 585 /* copy everything but bpf_spin_lock, bpf_timer, and kptrs. There could be one of each. */ 586 static inline void bpf_obj_memcpy(struct btf_record *rec, 587 void *dst, void *src, u32 size, 588 bool long_memcpy) 589 { 590 u32 curr_off = 0; 591 int i; 592 593 if (IS_ERR_OR_NULL(rec)) { 594 if (long_memcpy) 595 bpf_long_memcpy(dst, src, size); 596 else 597 data_race(memcpy(dst, src, size)); 598 return; 599 } 600 601 for (i = 0; i < rec->cnt; i++) { 602 u32 next_off = rec->fields[i].offset; 603 u32 sz = next_off - curr_off; 604 605 data_race(memcpy(dst + curr_off, src + curr_off, sz)); 606 curr_off += rec->fields[i].size + sz; 607 } 608 data_race(memcpy(dst + curr_off, src + curr_off, size - curr_off)); 609 } 610 611 static inline void copy_map_value(struct bpf_map *map, void *dst, void *src) 612 { 613 bpf_obj_memcpy(map->record, dst, src, map->value_size, false); 614 } 615 616 static inline void copy_map_value_long(struct bpf_map *map, void *dst, void *src) 617 { 618 bpf_obj_memcpy(map->record, dst, src, round_up(map->value_size, 8), true); 619 } 620 621 static inline void bpf_obj_swap_uptrs(const struct btf_record *rec, void *dst, void *src) 622 { 623 unsigned long *src_uptr, *dst_uptr; 624 const struct btf_field *field; 625 int i; 626 627 if (!btf_record_has_field(rec, BPF_UPTR)) 628 return; 629 630 for (i = 0, field = rec->fields; i < rec->cnt; i++, field++) { 631 if (field->type != BPF_UPTR) 632 continue; 633 634 src_uptr = src + field->offset; 635 dst_uptr = dst + field->offset; 636 swap(*src_uptr, *dst_uptr); 637 } 638 } 639 640 static inline void bpf_obj_memzero(struct btf_record *rec, void *dst, u32 size) 641 { 642 u32 curr_off = 0; 643 int i; 644 645 if (IS_ERR_OR_NULL(rec)) { 646 memset(dst, 0, size); 647 return; 648 } 649 650 for (i = 0; i < rec->cnt; i++) { 651 u32 next_off = rec->fields[i].offset; 652 u32 sz = next_off - curr_off; 653 654 memset(dst + curr_off, 0, sz); 655 curr_off += rec->fields[i].size + sz; 656 } 657 memset(dst + curr_off, 0, size - curr_off); 658 } 659 660 static inline void zero_map_value(struct bpf_map *map, void *dst) 661 { 662 bpf_obj_memzero(map->record, dst, map->value_size); 663 } 664 665 void copy_map_value_locked(struct bpf_map *map, void *dst, void *src, 666 bool lock_src); 667 void bpf_timer_cancel_and_free(void *timer); 668 void bpf_wq_cancel_and_free(void *timer); 669 void bpf_task_work_cancel_and_free(void *timer); 670 void bpf_list_head_free(const struct btf_field *field, void *list_head, 671 struct bpf_spin_lock *spin_lock); 672 void bpf_rb_root_free(const struct btf_field *field, void *rb_root, 673 struct bpf_spin_lock *spin_lock); 674 u64 bpf_arena_get_kern_vm_start(struct bpf_arena *arena); 675 u64 bpf_arena_get_user_vm_start(struct bpf_arena *arena); 676 u64 bpf_arena_map_kern_vm_start(struct bpf_map *map); 677 struct bpf_map *bpf_prog_arena(struct bpf_prog *prog); 678 int bpf_obj_name_cpy(char *dst, const char *src, unsigned int size); 679 680 struct bpf_offload_dev; 681 struct bpf_offloaded_map; 682 683 struct bpf_map_dev_ops { 684 int (*map_get_next_key)(struct bpf_offloaded_map *map, 685 void *key, void *next_key); 686 int (*map_lookup_elem)(struct bpf_offloaded_map *map, 687 void *key, void *value); 688 int (*map_update_elem)(struct bpf_offloaded_map *map, 689 void *key, void *value, u64 flags); 690 int (*map_delete_elem)(struct bpf_offloaded_map *map, void *key); 691 }; 692 693 struct bpf_offloaded_map { 694 struct bpf_map map; 695 struct net_device *netdev; 696 const struct bpf_map_dev_ops *dev_ops; 697 void *dev_priv; 698 struct list_head offloads; 699 }; 700 701 static inline struct bpf_offloaded_map *map_to_offmap(struct bpf_map *map) 702 { 703 return container_of(map, struct bpf_offloaded_map, map); 704 } 705 706 static inline bool bpf_map_offload_neutral(const struct bpf_map *map) 707 { 708 return map->map_type == BPF_MAP_TYPE_PERF_EVENT_ARRAY; 709 } 710 711 static inline bool bpf_map_support_seq_show(const struct bpf_map *map) 712 { 713 return (map->btf_value_type_id || map->btf_vmlinux_value_type_id) && 714 map->ops->map_seq_show_elem; 715 } 716 717 int map_check_no_btf(struct bpf_map *map, 718 const struct btf *btf, 719 const struct btf_type *key_type, 720 const struct btf_type *value_type); 721 722 bool bpf_map_meta_equal(const struct bpf_map *meta0, 723 const struct bpf_map *meta1); 724 725 static inline bool bpf_map_has_internal_structs(struct bpf_map *map) 726 { 727 return btf_record_has_field(map->record, BPF_TIMER | BPF_WORKQUEUE | BPF_TASK_WORK); 728 } 729 730 void bpf_map_free_internal_structs(struct bpf_map *map, void *obj); 731 732 int bpf_dynptr_from_file_sleepable(struct file *file, u32 flags, 733 struct bpf_dynptr *ptr__uninit); 734 735 #if defined(CONFIG_MMU) && defined(CONFIG_64BIT) 736 void *bpf_arena_alloc_pages_non_sleepable(void *p__map, void *addr__ign, u32 page_cnt, int node_id, 737 u64 flags); 738 void bpf_arena_free_pages_non_sleepable(void *p__map, void *ptr__ign, u32 page_cnt); 739 void *bpf_arena_alloc_pages_sleepable(void *p__map, void *addr__ign, u32 page_cnt, int node_id, 740 u64 flags); 741 #else 742 static inline void *bpf_arena_alloc_pages_non_sleepable(void *p__map, void *addr__ign, u32 page_cnt, 743 int node_id, u64 flags) 744 { 745 return NULL; 746 } 747 748 static inline void bpf_arena_free_pages_non_sleepable(void *p__map, void *ptr__ign, u32 page_cnt) 749 { 750 } 751 752 static inline void *bpf_arena_alloc_pages_sleepable(void *p__map, void *addr__ign, u32 page_cnt, 753 int node_id, u64 flags) 754 { 755 return NULL; 756 } 757 #endif 758 759 extern const struct bpf_map_ops bpf_map_offload_ops; 760 761 /* bpf_type_flag contains a set of flags that are applicable to the values of 762 * arg_type, ret_type and reg_type. For example, a pointer value may be null, 763 * or a memory is read-only. We classify types into two categories: base types 764 * and extended types. Extended types are base types combined with a type flag. 765 * 766 * Currently there are no more than 32 base types in arg_type, ret_type and 767 * reg_types. 768 */ 769 #define BPF_BASE_TYPE_BITS 8 770 771 enum bpf_type_flag { 772 /* PTR may be NULL. */ 773 PTR_MAYBE_NULL = BIT(0 + BPF_BASE_TYPE_BITS), 774 775 /* MEM is read-only. When applied on bpf_arg, it indicates the arg is 776 * compatible with both mutable and immutable memory. 777 */ 778 MEM_RDONLY = BIT(1 + BPF_BASE_TYPE_BITS), 779 780 /* MEM points to BPF ring buffer reservation. */ 781 MEM_RINGBUF = BIT(2 + BPF_BASE_TYPE_BITS), 782 783 /* MEM is in user address space. */ 784 MEM_USER = BIT(3 + BPF_BASE_TYPE_BITS), 785 786 /* MEM is a percpu memory. MEM_PERCPU tags PTR_TO_BTF_ID. When tagged 787 * with MEM_PERCPU, PTR_TO_BTF_ID _cannot_ be directly accessed. In 788 * order to drop this tag, it must be passed into bpf_per_cpu_ptr() 789 * or bpf_this_cpu_ptr(), which will return the pointer corresponding 790 * to the specified cpu. 791 */ 792 MEM_PERCPU = BIT(4 + BPF_BASE_TYPE_BITS), 793 794 /* Indicates that the argument will be released. */ 795 OBJ_RELEASE = BIT(5 + BPF_BASE_TYPE_BITS), 796 797 /* PTR is not trusted. This is only used with PTR_TO_BTF_ID, to mark 798 * unreferenced and referenced kptr loaded from map value using a load 799 * instruction, so that they can only be dereferenced but not escape the 800 * BPF program into the kernel (i.e. cannot be passed as arguments to 801 * kfunc or bpf helpers). 802 */ 803 PTR_UNTRUSTED = BIT(6 + BPF_BASE_TYPE_BITS), 804 805 /* 806 * MEM can be uninitialized. Generic memory outputs need not be fully 807 * initialized by the callee. 808 */ 809 MEM_UNINIT = BIT(7 + BPF_BASE_TYPE_BITS), 810 811 /* DYNPTR points to memory local to the bpf program. */ 812 DYNPTR_TYPE_LOCAL = BIT(8 + BPF_BASE_TYPE_BITS), 813 814 /* DYNPTR points to a kernel-produced ringbuf record. */ 815 DYNPTR_TYPE_RINGBUF = BIT(9 + BPF_BASE_TYPE_BITS), 816 817 /* Size is known at compile time. */ 818 MEM_FIXED_SIZE = BIT(10 + BPF_BASE_TYPE_BITS), 819 820 /* MEM is of an allocated object of type in program BTF. This is used to 821 * tag PTR_TO_BTF_ID allocated using bpf_obj_new. 822 */ 823 MEM_ALLOC = BIT(11 + BPF_BASE_TYPE_BITS), 824 825 /* PTR was passed from the kernel in a trusted context, and may be 826 * passed to kfuncs or BPF helper functions. 827 * Confusingly, this is _not_ the opposite of PTR_UNTRUSTED above. 828 * PTR_UNTRUSTED refers to a kptr that was read directly from a map 829 * without invoking bpf_kptr_xchg(). What we really need to know is 830 * whether a pointer is safe to pass to a kfunc or BPF helper function. 831 * While PTR_UNTRUSTED pointers are unsafe to pass to kfuncs and BPF 832 * helpers, they do not cover all possible instances of unsafe 833 * pointers. For example, a pointer that was obtained from walking a 834 * struct will _not_ get the PTR_UNTRUSTED type modifier, despite the 835 * fact that it may be NULL, invalid, etc. This is due to backwards 836 * compatibility requirements, as this was the behavior that was first 837 * introduced when kptrs were added. The behavior is now considered 838 * deprecated, and PTR_UNTRUSTED will eventually be removed. 839 * 840 * PTR_TRUSTED, on the other hand, is a pointer that the kernel 841 * guarantees to be valid and safe to pass to kfuncs and BPF helpers. 842 * For example, pointers passed to tracepoint arguments are considered 843 * PTR_TRUSTED, as are pointers that are passed to struct_ops 844 * callbacks. As alluded to above, pointers that are obtained from 845 * walking PTR_TRUSTED pointers are _not_ trusted. For example, if a 846 * struct task_struct *task is PTR_TRUSTED, then accessing 847 * task->last_wakee will lose the PTR_TRUSTED modifier when it's stored 848 * in a BPF register. Similarly, pointers passed to certain programs 849 * types such as kretprobes are not guaranteed to be valid, as they may 850 * for example contain an object that was recently freed. 851 */ 852 PTR_TRUSTED = BIT(12 + BPF_BASE_TYPE_BITS), 853 854 /* MEM is tagged with rcu and memory access needs rcu_read_lock protection. */ 855 MEM_RCU = BIT(13 + BPF_BASE_TYPE_BITS), 856 857 /* Used to tag PTR_TO_BTF_ID | MEM_ALLOC references which are non-owning. 858 * Currently only valid for linked-list and rbtree nodes. If the nodes 859 * have a bpf_refcount_field, they must be tagged MEM_RCU as well. 860 */ 861 NON_OWN_REF = BIT(14 + BPF_BASE_TYPE_BITS), 862 863 /* DYNPTR points to sk_buff */ 864 DYNPTR_TYPE_SKB = BIT(15 + BPF_BASE_TYPE_BITS), 865 866 /* DYNPTR points to xdp_buff */ 867 DYNPTR_TYPE_XDP = BIT(16 + BPF_BASE_TYPE_BITS), 868 869 /* Memory must be aligned on some architectures, used in combination with 870 * MEM_FIXED_SIZE. 871 */ 872 MEM_ALIGNED = BIT(17 + BPF_BASE_TYPE_BITS), 873 874 /* MEM is being written to, often combined with MEM_UNINIT. Non-presence 875 * of MEM_WRITE means that MEM is only being read. MEM_WRITE without the 876 * MEM_UNINIT means that memory needs to be initialized since it is also 877 * read. 878 */ 879 MEM_WRITE = BIT(18 + BPF_BASE_TYPE_BITS), 880 881 /* DYNPTR points to skb_metadata_end()-skb_metadata_len() */ 882 DYNPTR_TYPE_SKB_META = BIT(19 + BPF_BASE_TYPE_BITS), 883 884 /* DYNPTR points to file */ 885 DYNPTR_TYPE_FILE = BIT(20 + BPF_BASE_TYPE_BITS), 886 887 __BPF_TYPE_FLAG_MAX, 888 __BPF_TYPE_LAST_FLAG = __BPF_TYPE_FLAG_MAX - 1, 889 }; 890 891 #define DYNPTR_TYPE_FLAG_MASK (DYNPTR_TYPE_LOCAL | DYNPTR_TYPE_RINGBUF | DYNPTR_TYPE_SKB \ 892 | DYNPTR_TYPE_XDP | DYNPTR_TYPE_SKB_META | DYNPTR_TYPE_FILE) 893 894 /* Max number of base types. */ 895 #define BPF_BASE_TYPE_LIMIT (1UL << BPF_BASE_TYPE_BITS) 896 897 /* Max number of all types. */ 898 #define BPF_TYPE_LIMIT (__BPF_TYPE_LAST_FLAG | (__BPF_TYPE_LAST_FLAG - 1)) 899 900 /* function argument constraints */ 901 enum bpf_arg_type { 902 ARG_UNUSED = 0, /* unused argument; terminates argument iteration */ 903 904 /* the following constraints used to prototype 905 * bpf_map_lookup/update/delete_elem() functions 906 */ 907 ARG_CONST_MAP_PTR, /* const argument used as pointer to bpf_map */ 908 ARG_PTR_TO_MAP_KEY, /* pointer to stack used as map key */ 909 ARG_PTR_TO_MAP_VALUE, /* pointer to stack used as map value */ 910 911 /* Used to prototype bpf_memcmp() and other functions that access data 912 * on eBPF program stack 913 */ 914 ARG_PTR_TO_MEM, /* pointer to valid memory (stack, packet, map value) */ 915 ARG_PTR_TO_ARENA, 916 917 ARG_MEM_SIZE, /* number of bytes accessed from memory */ 918 ARG_MEM_SIZE_OR_ZERO, /* number of bytes accessed from memory or 0 */ 919 920 ARG_PTR_TO_CTX, /* pointer to context */ 921 ARG_ANYTHING, /* any (initialized) argument is ok */ 922 ARG_SCALAR, /* scalar argument */ 923 ARG_PTR_TO_SPIN_LOCK, /* pointer to bpf_spin_lock */ 924 ARG_PTR_TO_SOCK_COMMON, /* pointer to sock_common */ 925 ARG_PTR_TO_SOCKET, /* pointer to bpf_sock (fullsock) */ 926 ARG_PTR_TO_BTF_ID, /* pointer to in-kernel struct */ 927 ARG_PTR_TO_RINGBUF_MEM, /* pointer to dynamically reserved ringbuf memory */ 928 ARG_CONST_ALLOC_SIZE_OR_ZERO, /* number of allocated bytes requested */ 929 ARG_PTR_TO_BTF_ID_SOCK_COMMON, /* pointer to in-kernel sock_common or bpf-mirrored bpf_sock */ 930 ARG_PTR_TO_PERCPU_BTF_ID, /* pointer to in-kernel percpu type */ 931 ARG_PTR_TO_FUNC, /* pointer to a bpf program function */ 932 ARG_PTR_TO_STACK, /* pointer to stack */ 933 ARG_PTR_TO_CONST_STR, /* pointer to a null terminated read-only string */ 934 ARG_PTR_TO_TIMER, /* pointer to bpf_timer */ 935 ARG_KPTR_XCHG_DEST, /* pointer to destination that kptrs are bpf_kptr_xchg'd into */ 936 ARG_PTR_TO_DYNPTR, /* pointer to bpf_dynptr. See bpf_type_flag for dynptr type */ 937 938 ARG_CONST_SCALAR, /* scalar known at verification time */ 939 ARG_CONST_MEM_SIZE, /* ARG_MEM_SIZE that must be constant */ 940 ARG_PTR_TO_ALLOC_BTF_ID, /* pointer to an allocated object */ 941 ARG_PTR_TO_REFCOUNTED_KPTR, /* pointer to a refcounted local kptr */ 942 ARG_PTR_TO_ITER, /* pointer to an iterator */ 943 ARG_PTR_TO_LIST_HEAD, /* pointer to bpf_list_head */ 944 ARG_PTR_TO_LIST_NODE, /* pointer to bpf_list_node */ 945 ARG_PTR_TO_RB_ROOT, /* pointer to bpf_rb_root */ 946 ARG_PTR_TO_RB_NODE, /* pointer to bpf_rb_node */ 947 ARG_PTR_TO_WORKQUEUE, /* pointer to bpf_wq */ 948 ARG_PTR_TO_TASK_WORK, /* pointer to bpf_task_work */ 949 ARG_PTR_TO_RCU_HEAD, /* pointer to bpf_rcu_head */ 950 ARG_PTR_TO_IRQ_FLAG, /* pointer to saved IRQ flags on the stack */ 951 ARG_PTR_TO_RES_SPIN_LOCK, /* pointer to bpf_res_spin_lock */ 952 ARG_PTR_TO_CTX_OUT, /* hook output argument passed through from ctx */ 953 ARG_PTR_TO_PROG_AUX, /* pointer to the caller's bpf_prog_aux */ 954 ARG_IGNORE, /* argument the verifier does not check at all */ 955 __BPF_ARG_TYPE_MAX, 956 957 /* Extended arg_types. */ 958 ARG_PTR_TO_MAP_VALUE_OR_NULL = PTR_MAYBE_NULL | ARG_PTR_TO_MAP_VALUE, 959 ARG_PTR_TO_MEM_OR_NULL = PTR_MAYBE_NULL | ARG_PTR_TO_MEM, 960 ARG_PTR_TO_CTX_OR_NULL = PTR_MAYBE_NULL | ARG_PTR_TO_CTX, 961 ARG_PTR_TO_SOCKET_OR_NULL = PTR_MAYBE_NULL | ARG_PTR_TO_SOCKET, 962 ARG_PTR_TO_STACK_OR_NULL = PTR_MAYBE_NULL | ARG_PTR_TO_STACK, 963 ARG_PTR_TO_BTF_ID_OR_NULL = PTR_MAYBE_NULL | ARG_PTR_TO_BTF_ID, 964 /* Pointer to memory does not need to be initialized, since helper function 965 * fills all bytes or clears them in error case. 966 */ 967 ARG_PTR_TO_UNINIT_MEM = MEM_UNINIT | MEM_WRITE | ARG_PTR_TO_MEM, 968 /* Pointer to valid memory of size known at compile time. */ 969 ARG_PTR_TO_FIXED_SIZE_MEM = MEM_FIXED_SIZE | ARG_PTR_TO_MEM, 970 971 /* This must be the last entry. Its purpose is to ensure the enum is 972 * wide enough to hold the higher bits reserved for bpf_type_flag. 973 */ 974 __BPF_ARG_TYPE_LIMIT = BPF_TYPE_LIMIT, 975 }; 976 static_assert(__BPF_ARG_TYPE_MAX <= BPF_BASE_TYPE_LIMIT); 977 978 /* type of values returned from helper functions */ 979 enum bpf_return_type { 980 RET_INTEGER, /* function returns integer */ 981 RET_VOID, /* function doesn't return anything */ 982 RET_PTR_TO_MAP_VALUE, /* returns a pointer to map elem value */ 983 RET_PTR_TO_SOCKET, /* returns a pointer to a socket */ 984 RET_PTR_TO_TCP_SOCK, /* returns a pointer to a tcp_sock */ 985 RET_PTR_TO_SOCK_COMMON, /* returns a pointer to a sock_common */ 986 RET_PTR_TO_MEM, /* returns a pointer to memory */ 987 RET_PTR_TO_MEM_OR_BTF_ID, /* returns a pointer to a valid memory or a btf_id */ 988 RET_PTR_TO_BTF_ID, /* returns a pointer to a btf_id */ 989 __BPF_RET_TYPE_MAX, 990 991 /* Extended ret_types. */ 992 RET_PTR_TO_MAP_VALUE_OR_NULL = PTR_MAYBE_NULL | RET_PTR_TO_MAP_VALUE, 993 RET_PTR_TO_SOCKET_OR_NULL = PTR_MAYBE_NULL | RET_PTR_TO_SOCKET, 994 RET_PTR_TO_TCP_SOCK_OR_NULL = PTR_MAYBE_NULL | RET_PTR_TO_TCP_SOCK, 995 RET_PTR_TO_SOCK_COMMON_OR_NULL = PTR_MAYBE_NULL | RET_PTR_TO_SOCK_COMMON, 996 RET_PTR_TO_RINGBUF_MEM_OR_NULL = PTR_MAYBE_NULL | MEM_RINGBUF | RET_PTR_TO_MEM, 997 RET_PTR_TO_DYNPTR_MEM_OR_NULL = PTR_MAYBE_NULL | RET_PTR_TO_MEM, 998 RET_PTR_TO_BTF_ID_OR_NULL = PTR_MAYBE_NULL | RET_PTR_TO_BTF_ID, 999 RET_PTR_TO_BTF_ID_TRUSTED = PTR_TRUSTED | RET_PTR_TO_BTF_ID, 1000 1001 /* This must be the last entry. Its purpose is to ensure the enum is 1002 * wide enough to hold the higher bits reserved for bpf_type_flag. 1003 */ 1004 __BPF_RET_TYPE_LIMIT = BPF_TYPE_LIMIT, 1005 }; 1006 static_assert(__BPF_RET_TYPE_MAX <= BPF_BASE_TYPE_LIMIT); 1007 1008 /* The longest tracepoint has 12 args. 1009 * See include/trace/bpf_probe.h 1010 * 1011 * Also reuse this macro for maximum number of arguments a BPF function 1012 * or a kfunc can have. Args 1-5 are passed in registers, args 6-12 via 1013 * stack arg slots. The JIT may map some stack arg slots to registers based 1014 * on the native calling convention (e.g., arg 6 to R9 on x86-64). 1015 */ 1016 #define MAX_BPF_FUNC_ARGS 12 1017 1018 /* The maximum number of arguments passed through registers 1019 * a single function may have. 1020 */ 1021 #define MAX_BPF_FUNC_REG_ARGS 5 1022 1023 /* A by-value argument takes two eightbytes at most, so the maximum number of 1024 * argument slots of any function is 2 * MAX_BPF_FUNC_ARGS. A local array may 1025 * need that size for processing, although eventually the maximum slots will 1026 * be capped at MAX_BPF_FUNC_ARGS. 1027 */ 1028 #define MAX_BPF_FUNC_ARG_SLOTS (2 * MAX_BPF_FUNC_ARGS) 1029 1030 /* eBPF function prototype used by verifier to allow BPF_CALLs from eBPF programs 1031 * to in-kernel helper functions and for adjusting imm32 field in BPF_CALL 1032 * instructions after verifying 1033 */ 1034 struct bpf_func_proto { 1035 u64 (*func)(u64 r1, u64 r2, u64 r3, u64 r4, u64 r5); 1036 bool gpl_only; 1037 bool pkt_access; 1038 bool might_sleep; 1039 /* set to true if helper follows contract for llvm 1040 * attribute bpf_fastcall: 1041 * - void functions do not scratch r0 1042 * - functions taking N arguments scratch only registers r1-rN 1043 */ 1044 bool allow_fastcall; 1045 enum bpf_return_type ret_type; 1046 union { 1047 struct { 1048 enum bpf_arg_type arg1_type; 1049 enum bpf_arg_type arg2_type; 1050 enum bpf_arg_type arg3_type; 1051 enum bpf_arg_type arg4_type; 1052 enum bpf_arg_type arg5_type; 1053 }; 1054 enum bpf_arg_type arg_type[MAX_BPF_FUNC_ARGS]; 1055 }; 1056 union { 1057 struct { 1058 const u32 *arg1_btf_id; 1059 const u32 *arg2_btf_id; 1060 const u32 *arg3_btf_id; 1061 const u32 *arg4_btf_id; 1062 const u32 *arg5_btf_id; 1063 }; 1064 const u32 *arg_btf_id[MAX_BPF_FUNC_ARGS]; 1065 struct { 1066 size_t arg1_size; 1067 size_t arg2_size; 1068 size_t arg3_size; 1069 size_t arg4_size; 1070 size_t arg5_size; 1071 }; 1072 size_t arg_size[MAX_BPF_FUNC_ARGS]; 1073 }; 1074 int *ret_btf_id; /* return value btf_id */ 1075 bool (*allowed)(const struct bpf_prog *prog); 1076 }; 1077 1078 /* bpf_context is intentionally undefined structure. Pointer to bpf_context is 1079 * the first argument to eBPF programs. 1080 * For socket filters: 'struct bpf_context *' == 'struct sk_buff *' 1081 */ 1082 struct bpf_context; 1083 1084 enum bpf_access_type { 1085 BPF_READ = 1, 1086 BPF_WRITE = 2 1087 }; 1088 1089 /* types of values stored in eBPF registers */ 1090 /* Pointer types represent: 1091 * pointer 1092 * pointer + imm 1093 * pointer + (u16) var 1094 * pointer + (u16) var + imm 1095 * if (range > 0) then [ptr, ptr + range - off) is safe to access 1096 * if (id > 0) means that some 'var' was added 1097 * if (off > 0) means that 'imm' was added 1098 */ 1099 enum bpf_reg_type { 1100 NOT_INIT = 0, /* nothing was written into register */ 1101 SCALAR_VALUE, /* reg doesn't contain a valid pointer */ 1102 PTR_TO_CTX, /* reg points to bpf_context */ 1103 CONST_PTR_TO_MAP, /* reg points to struct bpf_map */ 1104 PTR_TO_MAP_VALUE, /* reg points to map element value */ 1105 PTR_TO_MAP_KEY, /* reg points to a map element key */ 1106 PTR_TO_STACK, /* reg == frame_pointer + offset */ 1107 PTR_TO_PACKET_META, /* skb->data - meta_len */ 1108 PTR_TO_PACKET, /* reg points to skb->data */ 1109 PTR_TO_PACKET_END, /* skb->data + headlen */ 1110 PTR_TO_FLOW_KEYS, /* reg points to bpf_flow_keys */ 1111 PTR_TO_SOCKET, /* reg points to struct bpf_sock */ 1112 PTR_TO_SOCK_COMMON, /* reg points to sock_common */ 1113 PTR_TO_TCP_SOCK, /* reg points to struct tcp_sock */ 1114 PTR_TO_TP_BUFFER, /* reg points to a writable raw tp's buffer */ 1115 PTR_TO_XDP_SOCK, /* reg points to struct xdp_sock */ 1116 /* PTR_TO_BTF_ID points to a kernel struct that does not need 1117 * to be null checked by the BPF program. This does not imply the 1118 * pointer is _not_ null and in practice this can easily be a null 1119 * pointer when reading pointer chains. The assumption is program 1120 * context will handle null pointer dereference typically via fault 1121 * handling. The verifier must keep this in mind and can make no 1122 * assumptions about null or non-null when doing branch analysis. 1123 * Further, when passed into helpers the helpers can not, without 1124 * additional context, assume the value is non-null. 1125 */ 1126 PTR_TO_BTF_ID, 1127 PTR_TO_MEM, /* reg points to valid memory region */ 1128 PTR_TO_ARENA, 1129 PTR_TO_BUF, /* reg points to a read/write buffer */ 1130 PTR_TO_FUNC, /* reg points to a bpf program function */ 1131 PTR_TO_INSN, /* reg points to a bpf program instruction */ 1132 CONST_PTR_TO_DYNPTR, /* reg points to a const struct bpf_dynptr */ 1133 __BPF_REG_TYPE_MAX, 1134 1135 /* Extended reg_types. */ 1136 PTR_TO_MAP_VALUE_OR_NULL = PTR_MAYBE_NULL | PTR_TO_MAP_VALUE, 1137 PTR_TO_SOCKET_OR_NULL = PTR_MAYBE_NULL | PTR_TO_SOCKET, 1138 PTR_TO_SOCK_COMMON_OR_NULL = PTR_MAYBE_NULL | PTR_TO_SOCK_COMMON, 1139 PTR_TO_TCP_SOCK_OR_NULL = PTR_MAYBE_NULL | PTR_TO_TCP_SOCK, 1140 /* PTR_TO_BTF_ID_OR_NULL points to a kernel struct that has not 1141 * been checked for null. Used primarily to inform the verifier 1142 * an explicit null check is required for this struct. 1143 */ 1144 PTR_TO_BTF_ID_OR_NULL = PTR_MAYBE_NULL | PTR_TO_BTF_ID, 1145 1146 /* This must be the last entry. Its purpose is to ensure the enum is 1147 * wide enough to hold the higher bits reserved for bpf_type_flag. 1148 */ 1149 __BPF_REG_TYPE_LIMIT = BPF_TYPE_LIMIT, 1150 }; 1151 static_assert(__BPF_REG_TYPE_MAX <= BPF_BASE_TYPE_LIMIT); 1152 1153 /* The information passed from prog-specific *_is_valid_access 1154 * back to the verifier. 1155 */ 1156 struct bpf_insn_access_aux { 1157 enum bpf_reg_type reg_type; 1158 bool is_ldsx; 1159 union { 1160 int ctx_field_size; 1161 struct { 1162 struct btf *btf; 1163 u32 btf_id; 1164 u32 ref_id; 1165 }; 1166 }; 1167 u32 mem_size; 1168 struct bpf_verifier_log *log; /* for verbose logs */ 1169 bool is_retval; /* is accessing function return value ? */ 1170 }; 1171 1172 static inline void 1173 bpf_ctx_record_field_size(struct bpf_insn_access_aux *aux, u32 size) 1174 { 1175 aux->ctx_field_size = size; 1176 } 1177 1178 static bool bpf_is_ldimm64(const struct bpf_insn *insn) 1179 { 1180 return insn->code == (BPF_LD | BPF_IMM | BPF_DW); 1181 } 1182 1183 static inline bool bpf_pseudo_func(const struct bpf_insn *insn) 1184 { 1185 return bpf_is_ldimm64(insn) && insn->src_reg == BPF_PSEUDO_FUNC; 1186 } 1187 1188 struct bpf_prog_ops { 1189 int (*test_run)(struct bpf_prog *prog, const union bpf_attr *kattr, 1190 union bpf_attr __user *uattr); 1191 }; 1192 1193 struct bpf_reg_state; 1194 struct bpf_verifier_ops { 1195 /* return eBPF function prototype for verification */ 1196 const struct bpf_func_proto * 1197 (*get_func_proto)(enum bpf_func_id func_id, 1198 const struct bpf_prog *prog); 1199 1200 /* return true if 'size' wide access at offset 'off' within bpf_context 1201 * with 'type' (read or write) is allowed 1202 */ 1203 bool (*is_valid_access)(int off, int size, enum bpf_access_type type, 1204 const struct bpf_prog *prog, 1205 struct bpf_insn_access_aux *info); 1206 int (*gen_prologue)(struct bpf_insn *insn, bool direct_write, 1207 const struct bpf_prog *prog); 1208 int (*gen_epilogue)(struct bpf_insn *insn, const struct bpf_prog *prog, 1209 s16 ctx_stack_off); 1210 int (*gen_ld_abs)(const struct bpf_insn *orig, 1211 struct bpf_insn *insn_buf); 1212 u32 (*convert_ctx_access)(enum bpf_access_type type, 1213 const struct bpf_insn *src, 1214 struct bpf_insn *dst, 1215 struct bpf_prog *prog, u32 *target_size); 1216 int (*btf_struct_access)(struct bpf_verifier_log *log, 1217 const struct bpf_reg_state *reg, 1218 int off, int size); 1219 }; 1220 1221 struct bpf_prog_offload_ops { 1222 /* verifier basic callbacks */ 1223 int (*insn_hook)(struct bpf_verifier_env *env, 1224 int insn_idx, int prev_insn_idx); 1225 int (*finalize)(struct bpf_verifier_env *env); 1226 /* verifier optimization callbacks (called after .finalize) */ 1227 int (*replace_insn)(struct bpf_verifier_env *env, u32 off, 1228 struct bpf_insn *insn); 1229 int (*remove_insns)(struct bpf_verifier_env *env, u32 off, u32 cnt); 1230 /* program management callbacks */ 1231 int (*prepare)(struct bpf_prog *prog); 1232 int (*translate)(struct bpf_prog *prog); 1233 void (*destroy)(struct bpf_prog *prog); 1234 }; 1235 1236 struct bpf_prog_offload { 1237 struct bpf_prog *prog; 1238 struct net_device *netdev; 1239 struct bpf_offload_dev *offdev; 1240 void *dev_priv; 1241 struct list_head offloads; 1242 bool dev_state; 1243 bool opt_failed; 1244 void *jited_image; 1245 u32 jited_len; 1246 }; 1247 1248 /* The argument is aligned to 16 bytes. */ 1249 #define BTF_FMODEL_ALIGN16_ARG BIT(0) 1250 1251 /* The argument is signed. */ 1252 #define BTF_FMODEL_SIGNED_ARG BIT(1) 1253 1254 /* The argument is an arena pointer. */ 1255 #define BTF_FMODEL_ARENA_ARG BIT(2) 1256 1257 /* The argument is nullable. */ 1258 #define BTF_FMODEL_NULLABLE_ARG BIT(3) 1259 1260 struct btf_func_model { 1261 u8 ret_size; 1262 u8 ret_flags; 1263 u8 nr_args; 1264 u8 arg_size[MAX_BPF_FUNC_ARGS]; 1265 u8 arg_flags[MAX_BPF_FUNC_ARGS]; 1266 }; 1267 1268 static inline u32 btf_func_model_arg_slots(const struct btf_func_model *m, u32 arg) 1269 { 1270 return (m->arg_size[arg] + sizeof(u64) - 1) / sizeof(u64); 1271 } 1272 1273 /* Restore arguments before returning from trampoline to let original function 1274 * continue executing. This flag is used for fentry progs when there are no 1275 * fexit progs. 1276 */ 1277 #define BPF_TRAMP_F_RESTORE_REGS BIT(0) 1278 /* Call original function after fentry progs, but before fexit progs. 1279 * Makes sense for fentry/fexit, normal calls and indirect calls. 1280 */ 1281 #define BPF_TRAMP_F_CALL_ORIG BIT(1) 1282 /* Skip current frame and return to parent. Makes sense for fentry/fexit 1283 * programs only. Should not be used with normal calls and indirect calls. 1284 */ 1285 #define BPF_TRAMP_F_SKIP_FRAME BIT(2) 1286 /* Store IP address of the caller on the trampoline stack, 1287 * so it's available for trampoline's programs. 1288 */ 1289 #define BPF_TRAMP_F_IP_ARG BIT(3) 1290 /* Return the return value of fentry prog. Only used by bpf_struct_ops. */ 1291 #define BPF_TRAMP_F_RET_FENTRY_RET BIT(4) 1292 1293 /* Get original function from stack instead of from provided direct address. 1294 * Makes sense for trampolines with fexit or fmod_ret programs. 1295 */ 1296 #define BPF_TRAMP_F_ORIG_STACK BIT(5) 1297 1298 /* This trampoline is on a function with another ftrace_ops with IPMODIFY, 1299 * e.g., a live patch. This flag is set and cleared by ftrace call backs, 1300 */ 1301 #define BPF_TRAMP_F_SHARE_IPMODIFY BIT(6) 1302 1303 /* Indicate that current trampoline is in a tail call context. Then, it has to 1304 * cache and restore tail_call_cnt to avoid infinite tail call loop. 1305 */ 1306 #define BPF_TRAMP_F_TAIL_CALL_CTX BIT(7) 1307 1308 /* 1309 * Indicate the trampoline should be suitable to receive indirect calls; 1310 * without this indirectly calling the generated code can result in #UD/#CP, 1311 * depending on the CFI options. 1312 * 1313 * Used by bpf_struct_ops. 1314 * 1315 * Incompatible with FENTRY usage, overloads @func_addr argument. 1316 */ 1317 #define BPF_TRAMP_F_INDIRECT BIT(8) 1318 1319 /* Each call __bpf_prog_enter + call bpf_func + call __bpf_prog_exit is ~50 1320 * bytes on x86. The trampoline image has to fit in PAGE_SIZE. 1321 */ 1322 enum { 1323 #if defined(__s390x__) || defined(__powerpc64__) 1324 BPF_MAX_TRAMP_LINKS = 27, 1325 #elif defined(__x86_64__) 1326 BPF_MAX_TRAMP_LINKS = 36, 1327 #elif defined(__aarch64__) 1328 BPF_MAX_TRAMP_LINKS = 37, 1329 #else 1330 BPF_MAX_TRAMP_LINKS = 38, 1331 #endif 1332 }; 1333 1334 #define BPF_TRAMP_COOKIE_INDEX_SHIFT 8 1335 #define BPF_TRAMP_IS_RETURN_SHIFT 63 1336 1337 struct bpf_tramp_nodes { 1338 struct bpf_tramp_node *nodes[BPF_MAX_TRAMP_LINKS]; 1339 int nr_nodes; 1340 }; 1341 1342 /* 1343 * The arena base against which a struct_ops trampoline converts the 1344 * arguments marked with BTF_FMODEL_ARENA_ARG while saving them into the BPF 1345 * ctx, ctx[arg] = (u32)(kaddr - kern_vm_start). Zero when the trampoline 1346 * converts nothing. 1347 */ 1348 u64 bpf_tramp_arena_base(const struct btf_func_model *m, 1349 struct bpf_tramp_nodes *tnodes, u32 flags); 1350 1351 struct bpf_tramp_run_ctx; 1352 1353 /* Different use cases for BPF trampoline: 1354 * 1. replace nop at the function entry (kprobe equivalent) 1355 * flags = BPF_TRAMP_F_RESTORE_REGS 1356 * fentry = a set of programs to run before returning from trampoline 1357 * 1358 * 2. replace nop at the function entry (kprobe + kretprobe equivalent) 1359 * flags = BPF_TRAMP_F_CALL_ORIG | BPF_TRAMP_F_SKIP_FRAME 1360 * orig_call = fentry_ip + MCOUNT_INSN_SIZE 1361 * fentry = a set of program to run before calling original function 1362 * fexit = a set of program to run after original function 1363 * 1364 * 3. replace direct call instruction anywhere in the function body 1365 * or assign a function pointer for indirect call (like tcp_congestion_ops->cong_avoid) 1366 * With flags = 0 1367 * fentry = a set of programs to run before returning from trampoline 1368 * With flags = BPF_TRAMP_F_CALL_ORIG 1369 * orig_call = original callback addr or direct function addr 1370 * fentry = a set of program to run before calling original function 1371 * fexit = a set of program to run after original function 1372 */ 1373 struct bpf_tramp_image; 1374 int arch_prepare_bpf_trampoline(struct bpf_tramp_image *im, void *image, void *image_end, 1375 const struct btf_func_model *m, u32 flags, 1376 struct bpf_tramp_nodes *tnodes, 1377 void *func_addr); 1378 void *arch_alloc_bpf_trampoline(unsigned int size); 1379 void arch_free_bpf_trampoline(void *image, unsigned int size); 1380 int __must_check arch_protect_bpf_trampoline(void *image, unsigned int size); 1381 int arch_bpf_trampoline_skip(void *nop, void *target); 1382 int arch_bpf_trampoline_size(const struct btf_func_model *m, u32 flags, 1383 struct bpf_tramp_nodes *tnodes, void *func_addr); 1384 1385 u64 notrace __bpf_prog_enter_sleepable_recur(struct bpf_prog *prog, 1386 struct bpf_tramp_run_ctx *run_ctx); 1387 void notrace __bpf_prog_exit_sleepable_recur(struct bpf_prog *prog, u64 start, 1388 struct bpf_tramp_run_ctx *run_ctx); 1389 void notrace __bpf_tramp_enter(struct bpf_tramp_image *tr); 1390 void notrace __bpf_tramp_exit(struct bpf_tramp_image *tr); 1391 typedef u64 (*bpf_trampoline_enter_t)(struct bpf_prog *prog, 1392 struct bpf_tramp_run_ctx *run_ctx); 1393 typedef void (*bpf_trampoline_exit_t)(struct bpf_prog *prog, u64 start, 1394 struct bpf_tramp_run_ctx *run_ctx); 1395 bpf_trampoline_enter_t bpf_trampoline_enter(const struct bpf_prog *prog); 1396 bpf_trampoline_exit_t bpf_trampoline_exit(const struct bpf_prog *prog); 1397 1398 #ifdef CONFIG_DYNAMIC_FTRACE_WITH_JMP 1399 static inline bool bpf_trampoline_use_jmp(u64 flags) 1400 { 1401 return flags & BPF_TRAMP_F_CALL_ORIG && !(flags & BPF_TRAMP_F_SKIP_FRAME); 1402 } 1403 #else 1404 static inline bool bpf_trampoline_use_jmp(u64 flags) 1405 { 1406 return false; 1407 } 1408 #endif 1409 1410 struct bpf_ksym { 1411 unsigned long start; 1412 unsigned long end; 1413 char name[KSYM_NAME_LEN]; 1414 struct list_head lnode; 1415 struct latch_tree_node tnode; 1416 bool prog; 1417 u32 fp_start; 1418 u32 fp_end; 1419 }; 1420 1421 enum bpf_tramp_prog_type { 1422 BPF_TRAMP_FENTRY, 1423 BPF_TRAMP_FEXIT, 1424 BPF_TRAMP_MODIFY_RETURN, 1425 BPF_TRAMP_MAX, 1426 BPF_TRAMP_REPLACE, /* more than MAX */ 1427 BPF_TRAMP_FSESSION, 1428 }; 1429 1430 /* 1431 * Each prog call in a trampoline image is preceded by a nop. When the prog is 1432 * detached, the nop is patched to a jump to target, right after the call, so 1433 * that tasks still running in the image skip the prog. 1434 */ 1435 struct bpf_tramp_skip { 1436 struct bpf_prog *prog; 1437 void *nop; 1438 void *target; 1439 }; 1440 1441 struct bpf_tramp_image { 1442 void *image; 1443 int size; 1444 struct bpf_ksym ksym; 1445 struct percpu_ref pcref; 1446 bool call_orig; 1447 /* entry in tr->images, the image holds a reference on tr */ 1448 struct bpf_trampoline *tr; 1449 struct list_head list; 1450 int nr_skips; 1451 struct bpf_tramp_skip *skips; 1452 union { 1453 struct rcu_head rcu; 1454 struct work_struct work; 1455 }; 1456 }; 1457 1458 static inline void bpf_tramp_image_add_skip(struct bpf_tramp_image *im, struct bpf_prog *prog, 1459 void *nop, void *target) 1460 { 1461 struct bpf_tramp_skip *skip; 1462 1463 /* struct_ops trampolines and arch_bpf_trampoline_size() have no image */ 1464 if (!im || !im->skips) 1465 return; 1466 skip = &im->skips[im->nr_skips++]; 1467 skip->prog = prog; 1468 skip->nop = nop; 1469 skip->target = target; 1470 } 1471 1472 struct bpf_trampoline { 1473 /* hlist for trampoline_key_table */ 1474 struct hlist_node hlist_key; 1475 /* hlist for trampoline_ip_table */ 1476 struct hlist_node hlist_ip; 1477 struct ftrace_ops *fops; 1478 refcount_t refcnt; 1479 u32 flags; 1480 u64 key; 1481 unsigned long ip; 1482 struct { 1483 struct btf_func_model model; 1484 void *addr; 1485 bool ftrace_managed; 1486 } func; 1487 /* if !NULL this is BPF_PROG_TYPE_EXT program that extends another BPF 1488 * program by replacing one of its functions. func.addr is the address 1489 * of the function it replaced. 1490 */ 1491 struct bpf_prog *extension_prog; 1492 /* list of BPF programs using this trampoline */ 1493 struct hlist_head progs_hlist[BPF_TRAMP_MAX]; 1494 /* Number of attached programs. A counter per kind. */ 1495 int progs_cnt[BPF_TRAMP_MAX]; 1496 /* Executable image of trampoline */ 1497 struct bpf_tramp_image *cur_image; 1498 /* Images not freed yet, cur_image and older ones still in use */ 1499 struct list_head images; 1500 /* Used as temporary old image storage for multi_attach */ 1501 struct { 1502 struct bpf_tramp_image *old_image; 1503 u32 old_flags; 1504 } multi_attach; 1505 }; 1506 1507 struct bpf_attach_target_info { 1508 struct btf_func_model fmodel; 1509 long tgt_addr; 1510 struct module *tgt_mod; 1511 const char *tgt_name; 1512 const struct btf_type *tgt_type; 1513 }; 1514 1515 #define BPF_DISPATCHER_MAX 48 /* Fits in 2048B */ 1516 1517 struct bpf_dispatcher_prog { 1518 struct bpf_prog *prog; 1519 refcount_t users; 1520 }; 1521 1522 struct bpf_dispatcher { 1523 /* dispatcher mutex */ 1524 struct mutex mutex; 1525 void *func; 1526 struct bpf_dispatcher_prog progs[BPF_DISPATCHER_MAX]; 1527 int num_progs; 1528 void *image; 1529 void *rw_image; 1530 u32 image_off; 1531 struct bpf_ksym ksym; 1532 #ifdef CONFIG_HAVE_STATIC_CALL 1533 struct static_call_key *sc_key; 1534 void *sc_tramp; 1535 #endif 1536 }; 1537 1538 #ifndef __bpfcall 1539 #define __bpfcall __nocfi 1540 #endif 1541 1542 static __always_inline __bpfcall unsigned int bpf_dispatcher_nop_func( 1543 const void *ctx, 1544 const struct bpf_insn *insnsi, 1545 bpf_func_t bpf_func) 1546 { 1547 return bpf_func(ctx, insnsi); 1548 } 1549 1550 /* the implementation of the opaque uapi struct bpf_dynptr */ 1551 struct bpf_dynptr_kern { 1552 void *data; 1553 /* Size represents the number of usable bytes of dynptr data. 1554 * If for example the offset is at 4 for a local dynptr whose data is 1555 * of type u64, the number of usable bytes is 4. 1556 * 1557 * The upper 8 bits are reserved. It is as follows: 1558 * Bits 0 - 23 = size 1559 * Bits 24 - 30 = dynptr type 1560 * Bit 31 = whether dynptr is read-only 1561 */ 1562 u32 size; 1563 u32 offset; 1564 } __aligned(8); 1565 1566 enum bpf_dynptr_type { 1567 BPF_DYNPTR_TYPE_INVALID, 1568 /* Points to memory that is local to the bpf program */ 1569 BPF_DYNPTR_TYPE_LOCAL, 1570 /* Underlying data is a ringbuf record */ 1571 BPF_DYNPTR_TYPE_RINGBUF, 1572 /* Underlying data is a sk_buff */ 1573 BPF_DYNPTR_TYPE_SKB, 1574 /* Underlying data is a xdp_buff */ 1575 BPF_DYNPTR_TYPE_XDP, 1576 /* Points to skb_metadata_end()-skb_metadata_len() */ 1577 BPF_DYNPTR_TYPE_SKB_META, 1578 /* Underlying data is a file */ 1579 BPF_DYNPTR_TYPE_FILE, 1580 }; 1581 1582 int bpf_dynptr_check_size(u64 size); 1583 u64 __bpf_dynptr_size(const struct bpf_dynptr_kern *ptr); 1584 const void *__bpf_dynptr_data(const struct bpf_dynptr_kern *ptr, u64 len); 1585 void *__bpf_dynptr_data_rw(const struct bpf_dynptr_kern *ptr, u64 len); 1586 bool __bpf_dynptr_is_rdonly(const struct bpf_dynptr_kern *ptr); 1587 int __bpf_dynptr_write(const struct bpf_dynptr_kern *dst, u64 offset, 1588 void *src, u64 len, u64 flags); 1589 void *bpf_dynptr_slice_rdwr(const struct bpf_dynptr *p, u64 offset, 1590 void *buffer__nullable, u64 buffer__szk); 1591 1592 static inline int bpf_dynptr_check_off_len(const struct bpf_dynptr_kern *ptr, u64 offset, u64 len) 1593 { 1594 u64 size = __bpf_dynptr_size(ptr); 1595 1596 if (len > size || offset > size - len) 1597 return -E2BIG; 1598 1599 return 0; 1600 } 1601 1602 struct bpf_tracing_multi_link; 1603 1604 #ifdef CONFIG_BPF_JIT 1605 int bpf_trampoline_link_prog(struct bpf_tramp_node *node, 1606 struct bpf_trampoline *tr, 1607 struct bpf_prog *tgt_prog); 1608 int bpf_trampoline_unlink_prog(struct bpf_tramp_node *node, 1609 struct bpf_trampoline *tr, 1610 struct bpf_prog *tgt_prog); 1611 struct bpf_trampoline *bpf_trampoline_get(u64 key, 1612 struct bpf_attach_target_info *tgt_info); 1613 void bpf_trampoline_put(struct bpf_trampoline *tr); 1614 int arch_prepare_bpf_dispatcher(void *image, void *buf, s64 *funcs, int num_funcs); 1615 1616 int bpf_trampoline_multi_attach(struct bpf_prog *prog, u32 *ids, 1617 struct bpf_tracing_multi_link *link); 1618 void bpf_trampoline_multi_detach(struct bpf_prog *prog, 1619 struct bpf_tracing_multi_link *link); 1620 void bpf_trampoline_set_flags(struct bpf_trampoline *tr, u32 flags); 1621 1622 /* 1623 * When the architecture supports STATIC_CALL replace the bpf_dispatcher_fn 1624 * indirection with a direct call to the bpf program. If the architecture does 1625 * not have STATIC_CALL, avoid a double-indirection. 1626 */ 1627 #ifdef CONFIG_HAVE_STATIC_CALL 1628 1629 #define __BPF_DISPATCHER_SC_INIT(_name) \ 1630 .sc_key = &STATIC_CALL_KEY(_name), \ 1631 .sc_tramp = STATIC_CALL_TRAMP_ADDR(_name), 1632 1633 #define __BPF_DISPATCHER_SC(name) \ 1634 DEFINE_STATIC_CALL(bpf_dispatcher_##name##_call, bpf_dispatcher_nop_func) 1635 1636 #define __BPF_DISPATCHER_CALL(name) \ 1637 static_call(bpf_dispatcher_##name##_call)(ctx, insnsi, bpf_func) 1638 1639 #define __BPF_DISPATCHER_UPDATE(_d, _new) \ 1640 __static_call_update((_d)->sc_key, (_d)->sc_tramp, (_new)) 1641 1642 #else 1643 #define __BPF_DISPATCHER_SC_INIT(name) 1644 #define __BPF_DISPATCHER_SC(name) 1645 #define __BPF_DISPATCHER_CALL(name) bpf_func(ctx, insnsi) 1646 #define __BPF_DISPATCHER_UPDATE(_d, _new) 1647 #endif 1648 1649 #define BPF_DISPATCHER_INIT(_name) { \ 1650 .mutex = __MUTEX_INITIALIZER(_name.mutex), \ 1651 .func = &_name##_func, \ 1652 .progs = {}, \ 1653 .num_progs = 0, \ 1654 .image = NULL, \ 1655 .image_off = 0, \ 1656 .ksym = { \ 1657 .name = #_name, \ 1658 .lnode = LIST_HEAD_INIT(_name.ksym.lnode), \ 1659 }, \ 1660 __BPF_DISPATCHER_SC_INIT(_name##_call) \ 1661 } 1662 1663 #define DEFINE_BPF_DISPATCHER(name) \ 1664 __BPF_DISPATCHER_SC(name); \ 1665 noinline __bpfcall unsigned int bpf_dispatcher_##name##_func( \ 1666 const void *ctx, \ 1667 const struct bpf_insn *insnsi, \ 1668 bpf_func_t bpf_func) \ 1669 { \ 1670 return __BPF_DISPATCHER_CALL(name); \ 1671 } \ 1672 EXPORT_SYMBOL(bpf_dispatcher_##name##_func); \ 1673 struct bpf_dispatcher bpf_dispatcher_##name = \ 1674 BPF_DISPATCHER_INIT(bpf_dispatcher_##name); 1675 1676 #define DECLARE_BPF_DISPATCHER(name) \ 1677 unsigned int bpf_dispatcher_##name##_func( \ 1678 const void *ctx, \ 1679 const struct bpf_insn *insnsi, \ 1680 bpf_func_t bpf_func); \ 1681 extern struct bpf_dispatcher bpf_dispatcher_##name; 1682 1683 #define BPF_DISPATCHER_FUNC(name) bpf_dispatcher_##name##_func 1684 #define BPF_DISPATCHER_PTR(name) (&bpf_dispatcher_##name) 1685 void bpf_dispatcher_change_prog(struct bpf_dispatcher *d, struct bpf_prog *from, 1686 struct bpf_prog *to); 1687 /* Called only from JIT-enabled code, so there's no need for stubs. */ 1688 void bpf_image_ksym_init(void *data, unsigned int size, struct bpf_ksym *ksym); 1689 void bpf_image_ksym_add(struct bpf_ksym *ksym); 1690 void bpf_image_ksym_del(struct bpf_ksym *ksym); 1691 void bpf_ksym_add(struct bpf_ksym *ksym); 1692 void bpf_ksym_del(struct bpf_ksym *ksym); 1693 bool bpf_has_frame_pointer(unsigned long ip); 1694 int bpf_jit_charge_modmem(u32 size); 1695 void bpf_jit_uncharge_modmem(u32 size); 1696 bool bpf_prog_has_trampoline(const struct bpf_prog *prog); 1697 bool bpf_insn_is_indirect_target(const struct bpf_verifier_env *env, const struct bpf_prog *prog, 1698 int insn_idx); 1699 u16 bpf_out_stack_arg_cnt(const struct bpf_verifier_env *env, const struct bpf_prog *prog); 1700 #else 1701 static inline int bpf_trampoline_link_prog(struct bpf_tramp_node *node, 1702 struct bpf_trampoline *tr, 1703 struct bpf_prog *tgt_prog) 1704 { 1705 return -ENOTSUPP; 1706 } 1707 static inline int bpf_trampoline_unlink_prog(struct bpf_tramp_node *node, 1708 struct bpf_trampoline *tr, 1709 struct bpf_prog *tgt_prog) 1710 { 1711 return -ENOTSUPP; 1712 } 1713 static inline struct bpf_trampoline *bpf_trampoline_get(u64 key, 1714 struct bpf_attach_target_info *tgt_info) 1715 { 1716 return NULL; 1717 } 1718 static inline void bpf_trampoline_put(struct bpf_trampoline *tr) {} 1719 #define DEFINE_BPF_DISPATCHER(name) 1720 #define DECLARE_BPF_DISPATCHER(name) 1721 #define BPF_DISPATCHER_FUNC(name) bpf_dispatcher_nop_func 1722 #define BPF_DISPATCHER_PTR(name) NULL 1723 static inline void bpf_dispatcher_change_prog(struct bpf_dispatcher *d, 1724 struct bpf_prog *from, 1725 struct bpf_prog *to) {} 1726 static inline bool is_bpf_image_address(unsigned long address) 1727 { 1728 return false; 1729 } 1730 static inline bool bpf_prog_has_trampoline(const struct bpf_prog *prog) 1731 { 1732 return false; 1733 } 1734 static inline int bpf_trampoline_multi_attach(struct bpf_prog *prog, u32 *ids, 1735 struct bpf_tracing_multi_link *link) 1736 { 1737 return -ENOTSUPP; 1738 } 1739 static inline void bpf_trampoline_multi_detach(struct bpf_prog *prog, 1740 struct bpf_tracing_multi_link *link) 1741 { 1742 } 1743 static inline void bpf_trampoline_set_flags(struct bpf_trampoline *tr, u32 flags) {} 1744 #endif 1745 1746 /* The contexts that a global function is called in, and is verified for. */ 1747 enum bpf_func_context { 1748 BPF_FUNC_CTX_NON_SLEEPABLE, 1749 BPF_FUNC_CTX_SLEEPABLE, 1750 /* Sleepable code has disabled preemption or interrupts: no RCU read lock. */ 1751 BPF_FUNC_CTX_NO_RCU_LOCK, 1752 BPF_FUNC_CTX_CNT, 1753 }; 1754 1755 struct bpf_func_info_aux { 1756 u16 linkage; 1757 bool unreliable; 1758 bool called[BPF_FUNC_CTX_CNT]; 1759 bool verified[BPF_FUNC_CTX_CNT]; 1760 bool called_with_pkt_ptrs; 1761 }; 1762 1763 enum bpf_jit_poke_reason { 1764 BPF_POKE_REASON_TAIL_CALL, 1765 }; 1766 1767 /* Descriptor of pokes pointing /into/ the JITed image. */ 1768 struct bpf_jit_poke_descriptor { 1769 void *tailcall_target; 1770 void *tailcall_bypass; 1771 void *bypass_addr; 1772 void *aux; 1773 union { 1774 struct { 1775 struct bpf_map *map; 1776 u32 key; 1777 } tail_call; 1778 }; 1779 bool tailcall_target_stable; 1780 u8 adj_off; 1781 u16 reason; 1782 u32 insn_idx; 1783 }; 1784 1785 /* reg_type info for ctx arguments */ 1786 struct bpf_ctx_arg_aux { 1787 u32 offset; 1788 enum bpf_reg_type reg_type; 1789 struct btf *btf; 1790 u32 btf_id; 1791 u32 ref_id; 1792 u32 mem_size; 1793 bool refcounted; 1794 }; 1795 1796 struct btf_mod_pair { 1797 struct btf *btf; 1798 struct module *module; 1799 }; 1800 1801 struct bpf_kfunc_desc_tab; 1802 1803 enum bpf_stream_id { 1804 BPF_STDOUT = 1, 1805 BPF_STDERR = 2, 1806 }; 1807 1808 struct bpf_stream_elem { 1809 struct llist_node node; 1810 int total_len; 1811 int consumed_len; 1812 char str[]; 1813 }; 1814 1815 enum { 1816 /* 100k bytes */ 1817 BPF_STREAM_MAX_CAPACITY = 100000ULL, 1818 }; 1819 1820 struct bpf_stream { 1821 refcount_t refcnt; 1822 atomic_t capacity; /* bytes reserved against the stream limit */ 1823 atomic_t readable; /* published bytes available to readers */ 1824 struct llist_head log; /* list of in-flight stream elements in LIFO order */ 1825 1826 struct mutex lock; /* lock protecting backlog_{head,tail} */ 1827 struct llist_node *backlog_head; /* list of in-flight stream elements in FIFO order */ 1828 struct llist_node *backlog_tail; /* tail of the list above */ 1829 wait_queue_head_t waitq; 1830 struct irq_work notify_work; 1831 bool notify_used; /* notify_work was queued at least once */ 1832 bool dead; 1833 }; 1834 1835 struct bpf_stream_stage { 1836 struct llist_head log; 1837 int len; 1838 }; 1839 1840 enum bpf_sig_verdict { 1841 BPF_SIG_UNSIGNED = 0, 1842 BPF_SIG_VERIFIED, 1843 }; 1844 1845 enum bpf_sig_keyring { 1846 BPF_SIG_KEYRING_NONE = 0, 1847 BPF_SIG_KEYRING_BUILTIN, 1848 BPF_SIG_KEYRING_SECONDARY, 1849 BPF_SIG_KEYRING_PLATFORM, 1850 BPF_SIG_KEYRING_USER, 1851 BPF_SIG_KEYRING_BPF, 1852 }; 1853 1854 struct bpf_prog_aux { 1855 atomic64_t refcnt; 1856 u32 used_map_cnt; 1857 u32 used_btf_cnt; 1858 u32 max_ctx_offset; 1859 u32 max_pkt_offset; 1860 u32 max_tp_access; 1861 u32 stack_depth; 1862 u32 id; 1863 u32 func_cnt; /* used by non-func prog as the number of func progs */ 1864 u32 real_func_cnt; /* includes hidden progs, only used for JIT and freeing progs */ 1865 u32 func_idx; /* 0 for non-func prog, the index in func array for func prog */ 1866 u32 attach_btf_id; /* in-kernel BTF type id to attach to */ 1867 u32 attach_st_ops_member_off; 1868 u32 ctx_arg_info_size; 1869 u32 max_rdonly_access; 1870 u32 max_rdwr_access; 1871 /* [min, max): the bytes of a rdwr buffer that may be written */ 1872 u32 min_rdwr_write; 1873 u32 max_rdwr_write; 1874 u32 subprog_start; 1875 struct btf *attach_btf; 1876 struct bpf_ctx_arg_aux *ctx_arg_info; 1877 void __percpu *priv_stack_ptr; 1878 struct mutex dst_mutex; /* protects dst_* pointers below, *after* prog becomes visible */ 1879 struct bpf_prog *dst_prog; 1880 struct bpf_trampoline *dst_trampoline; 1881 enum bpf_prog_type saved_dst_prog_type; 1882 enum bpf_attach_type saved_dst_attach_type; 1883 bool verifier_zext; /* Zero extensions has been inserted by verifier. */ 1884 bool dev_bound; /* Program is bound to the netdev. */ 1885 bool offload_requested; /* Program is bound and offloaded to the netdev. */ 1886 bool attach_btf_trace; /* true if attaching to BTF-enabled raw tp */ 1887 bool attach_tracing_prog; /* true if tracing another tracing program */ 1888 bool tramp_linked; /* true if it was ever linked to a trampoline */ 1889 bool sleepable_async_cb; /* has a bpf_wq or bpf_task_work callback */ 1890 bool func_proto_unreliable; 1891 bool tail_call_reachable; 1892 bool xdp_has_frags; 1893 bool exception_cb; 1894 bool exception_boundary; 1895 bool jits_use_priv_stack; 1896 bool priv_stack_requested; 1897 bool changes_pkt_data; 1898 bool has_prologue; 1899 bool might_sleep; 1900 bool can_unwind; 1901 bool kprobe_write_ctx; 1902 /* has insns that work with the arena base, see bpf_prog_has_arena_insns() */ 1903 bool uses_arena_insns; 1904 struct { 1905 s32 keyring_serial; 1906 u8 keyring_type; 1907 u8 verdict; 1908 } sig; 1909 u64 prog_array_member_cnt; /* counts how many times as member of prog_array */ 1910 struct mutex ext_mutex; /* mutex for freplace_link_cnt and prog_array_member_cnt */ 1911 struct bpf_arena *arena; 1912 void (*recursion_detected)(struct bpf_prog *prog); /* callback if recursion is detected */ 1913 /* BTF_KIND_FUNC_PROTO for valid attach_btf_id */ 1914 const struct btf_type *attach_func_proto; 1915 /* function name for valid attach_btf_id */ 1916 const char *attach_func_name; 1917 struct bpf_prog **func; 1918 struct bpf_prog_aux *main_prog_aux; 1919 void *jit_data; /* JIT specific data. arch dependent */ 1920 struct bpf_jit_poke_descriptor *poke_tab; 1921 struct bpf_kfunc_desc_tab *kfunc_tab; 1922 struct bpf_kfunc_btf_tab *kfunc_btf_tab; 1923 u32 size_poke_tab; 1924 #ifdef CONFIG_FINEIBT 1925 struct bpf_ksym ksym_prefix; 1926 #endif 1927 struct bpf_ksym ksym; 1928 const struct bpf_prog_ops *ops; 1929 const struct bpf_struct_ops *st_ops; 1930 struct bpf_map **used_maps; 1931 struct mutex used_maps_mutex; /* mutex for used_maps and used_map_cnt */ 1932 struct btf_mod_pair *used_btfs; 1933 struct bpf_prog *prog; 1934 struct user_struct *user; 1935 u64 load_time; /* ns since boottime */ 1936 u32 verified_insns; 1937 int cgroup_atype; /* enum cgroup_bpf_attach_type */ 1938 struct bpf_map *cgroup_storage[MAX_BPF_CGROUP_STORAGE_TYPE]; 1939 char name[BPF_OBJ_NAME_LEN]; 1940 u64 (*bpf_exception_cb)(u64 cookie, u64 sp, u64 bp, u64, u64); 1941 u16 stack_arg_sp_adjust; 1942 u16 freplace_link_cnt; /* counts freplace links extending this prog */ 1943 #ifdef CONFIG_SECURITY 1944 void *security; 1945 #endif 1946 struct bpf_token *token; 1947 struct bpf_prog_offload *offload; 1948 struct btf *btf; 1949 struct bpf_func_info *func_info; 1950 struct bpf_func_info_aux *func_info_aux; 1951 /* bpf_line_info loaded from userspace. linfo->insn_off 1952 * has the xlated insn offset. 1953 * Both the main and sub prog share the same linfo. 1954 * The subprog can access its first linfo by 1955 * using the linfo_idx. 1956 */ 1957 struct bpf_line_info *linfo; 1958 /* jited_linfo is the jited addr of the linfo. It has a 1959 * one to one mapping to linfo: 1960 * jited_linfo[i] is the jited addr for the linfo[i]->insn_off. 1961 * Both the main and sub prog share the same jited_linfo. 1962 * The subprog can access its first jited_linfo by 1963 * using the linfo_idx. 1964 */ 1965 void **jited_linfo; 1966 u32 func_info_cnt; 1967 u32 nr_linfo; 1968 /* subprog can use linfo_idx to access its first linfo and 1969 * jited_linfo. 1970 * main prog always has linfo_idx == 0 1971 */ 1972 u32 linfo_idx; 1973 struct module *mod; 1974 u32 num_exentries; 1975 struct exception_table_entry *extable; 1976 union { 1977 struct work_struct work; 1978 struct rcu_head rcu; 1979 struct rcu_work rwork; 1980 }; 1981 struct bpf_stream *stream[2]; 1982 struct mutex st_ops_assoc_mutex; 1983 struct bpf_map __rcu *st_ops_assoc; 1984 }; 1985 1986 #define BPF_NR_CONTEXTS 4 /* normal, softirq, hardirq, NMI */ 1987 1988 struct bpf_prog { 1989 u16 pages; /* Number of allocated pages */ 1990 u32 jited:1, /* Is our filter JIT'ed? */ 1991 jit_requested:1,/* archs need to JIT the prog */ 1992 jit_required:1, /* program strictly requires JIT compiler */ 1993 gpl_compatible:1, /* Is filter GPL compatible? */ 1994 cb_access:1, /* Is control block accessed? */ 1995 dst_needed:1, /* Do we need dst entry? */ 1996 blinding_requested:1, /* needs constant blinding */ 1997 blinded:1, /* Was blinded */ 1998 is_func:1, /* program is a bpf function */ 1999 kprobe_override:1, /* Do we override a kprobe? */ 2000 has_callchain_buf:1, /* callchain buffer allocated? */ 2001 enforce_expected_attach_type:1, /* Enforce expected_attach_type checking at attach time */ 2002 call_get_stack:1, /* Do we call bpf_get_stack() or bpf_get_stackid() */ 2003 call_get_func_ip:1, /* Do we call get_func_ip() */ 2004 call_session_cookie:1, /* Do we call bpf_session_cookie() */ 2005 tstamp_type_access:1, /* Accessed __sk_buff->tstamp_type */ 2006 sleepable:1; /* BPF program is sleepable */ 2007 enum bpf_prog_type type; /* Type of BPF program */ 2008 enum bpf_attach_type expected_attach_type; /* For some prog types */ 2009 u32 len; /* Number of filter blocks */ 2010 u32 jited_len; /* Size of jited insns in bytes */ 2011 union { 2012 u8 digest[SHA256_DIGEST_SIZE]; 2013 u8 tag[BPF_TAG_SIZE]; 2014 }; 2015 struct bpf_prog_stats __percpu *stats; 2016 u8 __percpu *active; /* u8[BPF_NR_CONTEXTS] for recursion protection */ 2017 unsigned int (*bpf_func)(const void *ctx, 2018 const struct bpf_insn *insn); 2019 struct bpf_prog_aux *aux; /* Auxiliary fields */ 2020 struct sock_fprog_kern *orig_prog; /* Original BPF program */ 2021 /* Instructions for interpreter */ 2022 union { 2023 DECLARE_FLEX_ARRAY(struct sock_filter, insns); 2024 DECLARE_FLEX_ARRAY(struct bpf_insn, insnsi); 2025 }; 2026 }; 2027 2028 /* 2029 * Does the program, or a callback of it, run under RCU Tasks Trace protection 2030 * only, outside of any RCU read side critical section? 2031 */ 2032 static inline bool bpf_prog_runs_sleepable(const struct bpf_prog *prog) 2033 { 2034 return prog->sleepable || prog->aux->sleepable_async_cb; 2035 } 2036 2037 struct bpf_array_aux { 2038 /* Programs with direct jumps into programs part of this array. */ 2039 struct list_head poke_progs; 2040 struct bpf_map *map; 2041 struct mutex poke_mutex; 2042 struct work_struct work; 2043 }; 2044 2045 struct bpf_link { 2046 atomic64_t refcnt; 2047 u32 id; 2048 enum bpf_link_type type; 2049 const struct bpf_link_ops *ops; 2050 struct bpf_prog *prog; 2051 2052 u32 flags; 2053 enum bpf_attach_type attach_type; 2054 2055 /* rcu is used before freeing, work can be used to schedule that 2056 * RCU-based freeing before that, so they never overlap 2057 */ 2058 union { 2059 struct rcu_head rcu; 2060 struct work_struct work; 2061 }; 2062 /* whether BPF link itself has "sleepable" semantics, which can differ 2063 * from underlying BPF program having a "sleepable" semantics, as BPF 2064 * link's semantics is determined by target attach hook 2065 */ 2066 bool sleepable; 2067 }; 2068 2069 struct bpf_link_ops { 2070 void (*release)(struct bpf_link *link); 2071 /* deallocate link resources callback, called without RCU grace period 2072 * waiting 2073 */ 2074 void (*dealloc)(struct bpf_link *link); 2075 /* deallocate link resources callback, called after RCU grace period; 2076 * if either the underlying BPF program is sleepable or BPF link's 2077 * target hook is sleepable, we'll go through tasks trace RCU GP and 2078 * then "classic" RCU GP; this need for chaining tasks trace and 2079 * classic RCU GPs is designated by setting bpf_link->sleepable flag 2080 * 2081 * For non-sleepable tracepoint links we go through SRCU gp instead, 2082 * since RCU is not used in that case. Sleepable tracepoints still 2083 * follow the scheme above. 2084 */ 2085 void (*dealloc_deferred)(struct bpf_link *link); 2086 int (*detach)(struct bpf_link *link); 2087 int (*update_prog)(struct bpf_link *link, struct bpf_prog *new_prog, 2088 struct bpf_prog *old_prog); 2089 void (*show_fdinfo)(const struct bpf_link *link, struct seq_file *seq); 2090 int (*fill_link_info)(const struct bpf_link *link, 2091 struct bpf_link_info *info); 2092 int (*update_map)(struct bpf_link *link, struct bpf_map *new_map, 2093 struct bpf_map *old_map); 2094 __poll_t (*poll)(struct file *file, struct poll_table_struct *pts); 2095 }; 2096 2097 struct bpf_tramp_node { 2098 struct bpf_link *link; 2099 struct hlist_node tramp_hlist; 2100 u64 cookie; 2101 }; 2102 2103 struct bpf_tramp_link { 2104 struct bpf_link link; 2105 struct bpf_tramp_node node; 2106 }; 2107 2108 struct bpf_shim_tramp_link { 2109 struct bpf_tramp_link link; 2110 struct bpf_trampoline *trampoline; 2111 }; 2112 2113 struct bpf_tracing_link { 2114 struct bpf_tramp_link link; 2115 struct bpf_tramp_node fexit; 2116 struct bpf_trampoline *trampoline; 2117 struct bpf_prog *tgt_prog; 2118 }; 2119 2120 struct bpf_tracing_multi_node { 2121 struct bpf_tramp_node node; 2122 struct bpf_trampoline *trampoline; 2123 struct ftrace_func_entry entry; 2124 }; 2125 2126 struct bpf_tracing_multi_data { 2127 struct ftrace_hash *unreg; 2128 struct ftrace_hash *modify; 2129 struct ftrace_hash *reg; 2130 struct ftrace_func_entry *entry; 2131 }; 2132 2133 struct bpf_tracing_multi_link { 2134 struct bpf_link link; 2135 struct bpf_tracing_multi_data data; 2136 u64 *cookies; 2137 struct bpf_tramp_node *fexits; 2138 int nodes_cnt; 2139 struct bpf_tracing_multi_node nodes[] __counted_by(nodes_cnt); 2140 }; 2141 2142 struct bpf_raw_tp_link { 2143 struct bpf_link link; 2144 struct bpf_raw_event_map *btp; 2145 u64 cookie; 2146 }; 2147 2148 struct bpf_link_primer { 2149 struct bpf_link *link; 2150 struct file *file; 2151 int fd; 2152 u32 id; 2153 }; 2154 2155 struct bpf_mount_opts { 2156 kuid_t uid; 2157 kgid_t gid; 2158 umode_t mode; 2159 2160 /* BPF token-related delegation options */ 2161 u64 delegate_cmds; 2162 u64 delegate_maps; 2163 u64 delegate_progs; 2164 u64 delegate_attachs; 2165 2166 struct simple_xattr_cache xa_cache; 2167 }; 2168 2169 struct bpf_token { 2170 struct work_struct work; 2171 atomic64_t refcnt; 2172 struct user_namespace *userns; 2173 u64 allowed_cmds; 2174 u64 allowed_maps; 2175 u64 allowed_progs; 2176 u64 allowed_attachs; 2177 #ifdef CONFIG_SECURITY 2178 void *security; 2179 #endif 2180 }; 2181 2182 struct bpf_struct_ops_value; 2183 struct btf_member; 2184 2185 #define BPF_STRUCT_OPS_MAX_NR_MEMBERS 64 2186 /** 2187 * struct bpf_struct_ops - A structure of callbacks allowing a subsystem to 2188 * define a BPF_MAP_TYPE_STRUCT_OPS map type composed 2189 * of BPF_PROG_TYPE_STRUCT_OPS progs. 2190 * @verifier_ops: A structure of callbacks that are invoked by the verifier 2191 * when determining whether the struct_ops progs in the 2192 * struct_ops map are valid. 2193 * @init: A callback that is invoked a single time, and before any other 2194 * callback, to initialize the structure. A nonzero return value means 2195 * the subsystem could not be initialized. 2196 * @check_member: When defined, a callback invoked by the verifier to allow 2197 * the subsystem to determine if an entry in the struct_ops map 2198 * is valid. A nonzero return value means that the map is 2199 * invalid and should be rejected by the verifier. 2200 * @init_member: A callback that is invoked for each member of the struct_ops 2201 * map to allow the subsystem to initialize the member. A nonzero 2202 * value means the member could not be initialized. This callback 2203 * is exclusive with the @type, @type_id, @value_type, and 2204 * @value_id fields. 2205 * @reg: A callback that is invoked when the struct_ops map has been 2206 * initialized and is being attached to. Zero means the struct_ops map 2207 * has been successfully registered and is live. A nonzero return value 2208 * means the struct_ops map could not be registered. 2209 * @unreg: A callback that is invoked when the struct_ops map should be 2210 * unregistered. 2211 * @update: A callback that is invoked when the live struct_ops map is being 2212 * updated to contain new values. This callback is only invoked when 2213 * the struct_ops map is loaded with BPF_F_LINK. If not defined, the 2214 * it is assumed that the struct_ops map cannot be updated. 2215 * @validate: A callback that is invoked after all of the members have been 2216 * initialized. This callback should perform static checks on the 2217 * map, meaning that it should either fail or succeed 2218 * deterministically. A struct_ops map that has been validated may 2219 * not necessarily succeed in being registered if the call to @reg 2220 * fails. For example, a valid struct_ops map may be loaded, but 2221 * then fail to be registered due to there being another active 2222 * struct_ops map on the system in the subsystem already. For this 2223 * reason, if this callback is not defined, the check is skipped as 2224 * the struct_ops map will have final verification performed in 2225 * @reg. 2226 * @cfi_stubs: Pointer to a structure of stub functions for CFI. These stubs 2227 * provide the correct Control Flow Integrity hashes for the 2228 * trampolines generated by BPF struct_ops. 2229 * @owner: The module that owns this struct_ops. Used for module reference 2230 * counting to ensure the module providing the struct_ops cannot be 2231 * unloaded while in use. 2232 * @name: The name of the struct bpf_struct_ops object. 2233 * @func_models: Func models 2234 * @cgroup_atype: A value in enum cgroup_bpf_attach_type for cgroup attachment. 2235 * 0 means the struct_ops type does not support cgroup attachment. 2236 * If cgroup_atype is non-zero, the @reg and @unreg must be NULL 2237 * because the attachment/detachment will be handled by the bpf core. 2238 * @free_after_tasks_rcu_gp: Set to true if it needs the bpf core to wait for 2239 * a tasks_rcu gp before freeing the struct_ops map 2240 * and its progs. It is unnecessary if the @unreg 2241 * has waited for the correct rcu gp or the @unreg 2242 * has ensured all struct_ops prog has finished running. 2243 * @free_after_mult_rcu_gp: Same as @free_after_tasks_rcu_gp but waiting for 2244 * both tasks_trace_rcu and regular rcu grace period. 2245 * It is usually needed if the struct_ops has sleepable prog. 2246 */ 2247 struct bpf_struct_ops { 2248 const struct bpf_verifier_ops *verifier_ops; 2249 int (*init)(struct btf *btf); 2250 int (*check_member)(const struct btf_type *t, 2251 const struct btf_member *member, 2252 const struct bpf_prog *prog); 2253 int (*init_member)(const struct btf_type *t, 2254 const struct btf_member *member, 2255 void *kdata, const void *udata); 2256 int (*reg)(void *kdata, struct bpf_link *link); 2257 void (*unreg)(void *kdata, struct bpf_link *link); 2258 int (*update)(void *kdata, void *old_kdata, struct bpf_link *link); 2259 int (*validate)(void *kdata); 2260 void *cfi_stubs; 2261 struct module *owner; 2262 const char *name; 2263 struct btf_func_model func_models[BPF_STRUCT_OPS_MAX_NR_MEMBERS]; 2264 int cgroup_atype; 2265 bool free_after_tasks_rcu_gp; 2266 bool free_after_mult_rcu_gp; 2267 }; 2268 2269 /* Every member of a struct_ops type has an instance even a member is not 2270 * an operator (function pointer). The "info" field will be assigned to 2271 * prog->aux->ctx_arg_info of BPF struct_ops programs to provide the 2272 * argument information required by the verifier to verify the program. 2273 * 2274 * btf_ctx_access() will lookup prog->aux->ctx_arg_info to find the 2275 * corresponding entry for an given argument. 2276 */ 2277 struct bpf_struct_ops_arg_info { 2278 struct bpf_ctx_arg_aux *info; 2279 u32 cnt; 2280 }; 2281 2282 struct bpf_struct_ops_desc { 2283 struct bpf_struct_ops *st_ops; 2284 2285 const struct btf_type *type; 2286 const struct btf_type *value_type; 2287 u32 type_id; 2288 u32 value_id; 2289 2290 /* Collection of argument information for each member */ 2291 struct bpf_struct_ops_arg_info *arg_info; 2292 }; 2293 2294 enum bpf_struct_ops_state { 2295 BPF_STRUCT_OPS_STATE_INIT, 2296 BPF_STRUCT_OPS_STATE_INUSE, 2297 BPF_STRUCT_OPS_STATE_TOBEFREE, 2298 BPF_STRUCT_OPS_STATE_READY, 2299 }; 2300 2301 struct bpf_struct_ops_common_value { 2302 refcount_t refcnt; 2303 enum bpf_struct_ops_state state; 2304 }; 2305 2306 static inline bool bpf_prog_get_recursion_context(struct bpf_prog *prog) 2307 { 2308 #ifdef CONFIG_ARM64 2309 u8 rctx = interrupt_context_level(); 2310 u8 *active = this_cpu_ptr(prog->active); 2311 u32 val; 2312 2313 preempt_disable(); 2314 active[rctx]++; 2315 val = le32_to_cpu(*(__le32 *)active); 2316 preempt_enable(); 2317 if (val != BIT(rctx * 8)) 2318 return false; 2319 2320 return true; 2321 #else 2322 return this_cpu_inc_return(*(int __percpu *)(prog->active)) == 1; 2323 #endif 2324 } 2325 2326 static inline void bpf_prog_put_recursion_context(struct bpf_prog *prog) 2327 { 2328 #ifdef CONFIG_ARM64 2329 u8 rctx = interrupt_context_level(); 2330 u8 *active = this_cpu_ptr(prog->active); 2331 2332 preempt_disable(); 2333 active[rctx]--; 2334 preempt_enable(); 2335 #else 2336 this_cpu_dec(*(int __percpu *)(prog->active)); 2337 #endif 2338 } 2339 2340 static inline bool is_tracing_multi(enum bpf_attach_type type) 2341 { 2342 return type == BPF_TRACE_FENTRY_MULTI || type == BPF_TRACE_FEXIT_MULTI || 2343 type == BPF_TRACE_FSESSION_MULTI; 2344 } 2345 2346 static inline bool is_struct_ops_tramp(const struct bpf_tramp_nodes *fentry_nodes) 2347 { 2348 return fentry_nodes->nr_nodes == 1 && 2349 fentry_nodes->nodes[0]->link->type == BPF_LINK_TYPE_STRUCT_OPS; 2350 } 2351 2352 #if defined(CONFIG_BPF_JIT) && defined(CONFIG_BPF_SYSCALL) 2353 /* This macro helps developer to register a struct_ops type and generate 2354 * type information correctly. Developers should use this macro to register 2355 * a struct_ops type instead of calling __register_bpf_struct_ops() directly. 2356 */ 2357 #define register_bpf_struct_ops(st_ops, type) \ 2358 ({ \ 2359 struct bpf_struct_ops_##type { \ 2360 struct bpf_struct_ops_common_value common; \ 2361 struct type data ____cacheline_aligned_in_smp; \ 2362 }; \ 2363 BTF_TYPE_EMIT(struct bpf_struct_ops_##type); \ 2364 __register_bpf_struct_ops(st_ops); \ 2365 }) 2366 #define BPF_MODULE_OWNER ((void *)((0xeB9FUL << 2) + POISON_POINTER_DELTA)) 2367 bool bpf_struct_ops_get(const void *kdata); 2368 void bpf_struct_ops_put(const void *kdata); 2369 int bpf_struct_ops_supported(const struct bpf_struct_ops *st_ops, u32 moff); 2370 int bpf_struct_ops_map_sys_lookup_elem(struct bpf_map *map, void *key, 2371 void *value); 2372 int bpf_struct_ops_prepare_trampoline(struct bpf_tramp_nodes *tnodes, 2373 struct bpf_tramp_node *node, 2374 const struct btf_func_model *model, 2375 void *stub_func, 2376 void **image, u32 *image_off, 2377 bool allow_alloc); 2378 void bpf_struct_ops_image_free(void *image); 2379 static inline bool bpf_try_module_get(const void *data, struct module *owner) 2380 { 2381 if (owner == BPF_MODULE_OWNER) 2382 return bpf_struct_ops_get(data); 2383 else 2384 return try_module_get(owner); 2385 } 2386 static inline void bpf_module_put(const void *data, struct module *owner) 2387 { 2388 if (owner == BPF_MODULE_OWNER) 2389 bpf_struct_ops_put(data); 2390 else 2391 module_put(owner); 2392 } 2393 int bpf_struct_ops_link_create(union bpf_attr *attr); 2394 int bpf_prog_assoc_struct_ops(struct bpf_prog *prog, struct bpf_map *map); 2395 void bpf_prog_disassoc_struct_ops(struct bpf_prog *prog); 2396 void *bpf_prog_get_assoc_struct_ops(const struct bpf_prog_aux *aux); 2397 u32 bpf_struct_ops_id(const void *kdata); 2398 int bpf_struct_ops_for_each_prog(const void *kdata, 2399 int (*cb)(struct bpf_prog *prog, void *data), 2400 void *data); 2401 void *bpf_struct_ops_map_kdata(struct bpf_map *map); 2402 void *bpf_struct_ops_map_cfi_stubs(struct bpf_map *map); 2403 bool bpf_struct_ops_valid_to_reg(struct bpf_map *map); 2404 int bpf_struct_ops_link_update_check(struct bpf_map *new_map, struct bpf_map *old_map, 2405 struct bpf_map *expected_old_map); 2406 int bpf_struct_ops_map_cgroup_atype(struct bpf_map *map); 2407 2408 #ifdef CONFIG_NET 2409 /* Define it here to avoid the use of forward declaration */ 2410 struct bpf_dummy_ops_state { 2411 int val; 2412 }; 2413 2414 struct bpf_dummy_ops { 2415 int (*test_1)(struct bpf_dummy_ops_state *cb); 2416 int (*test_2)(struct bpf_dummy_ops_state *cb, int a1, unsigned short a2, 2417 char a3, unsigned long a4); 2418 int (*test_sleepable)(struct bpf_dummy_ops_state *cb); 2419 }; 2420 2421 int bpf_struct_ops_test_run(struct bpf_prog *prog, const union bpf_attr *kattr, 2422 union bpf_attr __user *uattr); 2423 #endif 2424 int bpf_struct_ops_desc_init(struct bpf_struct_ops_desc *st_ops_desc, 2425 struct btf *btf, 2426 struct bpf_verifier_log *log); 2427 void bpf_map_struct_ops_info_fill(struct bpf_map_info *info, struct bpf_map *map); 2428 void bpf_struct_ops_desc_release(struct bpf_struct_ops_desc *st_ops_desc); 2429 #else 2430 #define register_bpf_struct_ops(st_ops, type) ({ (void *)(st_ops); 0; }) 2431 static inline bool bpf_try_module_get(const void *data, struct module *owner) 2432 { 2433 return try_module_get(owner); 2434 } 2435 static inline void bpf_module_put(const void *data, struct module *owner) 2436 { 2437 module_put(owner); 2438 } 2439 static inline int bpf_struct_ops_supported(const struct bpf_struct_ops *st_ops, u32 moff) 2440 { 2441 return -ENOTSUPP; 2442 } 2443 static inline int bpf_struct_ops_map_sys_lookup_elem(struct bpf_map *map, 2444 void *key, 2445 void *value) 2446 { 2447 return -EINVAL; 2448 } 2449 static inline int bpf_struct_ops_link_create(union bpf_attr *attr) 2450 { 2451 return -EOPNOTSUPP; 2452 } 2453 static inline int bpf_prog_assoc_struct_ops(struct bpf_prog *prog, struct bpf_map *map) 2454 { 2455 return -EOPNOTSUPP; 2456 } 2457 static inline void bpf_prog_disassoc_struct_ops(struct bpf_prog *prog) 2458 { 2459 } 2460 static inline void *bpf_prog_get_assoc_struct_ops(const struct bpf_prog_aux *aux) 2461 { 2462 return NULL; 2463 } 2464 static inline void bpf_map_struct_ops_info_fill(struct bpf_map_info *info, struct bpf_map *map) 2465 { 2466 } 2467 2468 static inline void bpf_struct_ops_desc_release(struct bpf_struct_ops_desc *st_ops_desc) 2469 { 2470 } 2471 static inline u32 bpf_struct_ops_id(void *kdata) 2472 { 2473 return 0; 2474 } 2475 static inline void *bpf_struct_ops_map_kdata(struct bpf_map *map) 2476 { 2477 return NULL; 2478 } 2479 static inline int bpf_struct_ops_map_cgroup_atype(struct bpf_map *map) 2480 { 2481 return 0; 2482 } 2483 static inline void *bpf_struct_ops_map_cfi_stubs(struct bpf_map *map) 2484 { 2485 return NULL; 2486 } 2487 static inline bool bpf_struct_ops_valid_to_reg(struct bpf_map *map) 2488 { 2489 return false; 2490 } 2491 static inline int bpf_struct_ops_link_update_check(struct bpf_map *new_map, 2492 struct bpf_map *old_map, 2493 struct bpf_map *expected_old_map) 2494 { 2495 return -EOPNOTSUPP; 2496 } 2497 2498 #endif 2499 2500 static inline int bpf_fsession_cnt(struct bpf_tramp_nodes *nodes) 2501 { 2502 struct bpf_tramp_nodes fentries = nodes[BPF_TRAMP_FENTRY]; 2503 int cnt = 0; 2504 2505 for (int i = 0; i < nodes[BPF_TRAMP_FENTRY].nr_nodes; i++) { 2506 if (fentries.nodes[i]->link->prog->expected_attach_type == BPF_TRACE_FSESSION) 2507 cnt++; 2508 if (fentries.nodes[i]->link->prog->expected_attach_type == BPF_TRACE_FSESSION_MULTI) 2509 cnt++; 2510 } 2511 2512 return cnt; 2513 } 2514 2515 static inline bool bpf_prog_calls_session_cookie(struct bpf_tramp_node *node) 2516 { 2517 return node->link->prog->call_session_cookie; 2518 } 2519 2520 static inline int bpf_fsession_cookie_cnt(struct bpf_tramp_nodes *nodes) 2521 { 2522 struct bpf_tramp_nodes fentries = nodes[BPF_TRAMP_FENTRY]; 2523 int cnt = 0; 2524 2525 for (int i = 0; i < nodes[BPF_TRAMP_FENTRY].nr_nodes; i++) { 2526 if (bpf_prog_calls_session_cookie(fentries.nodes[i])) 2527 cnt++; 2528 } 2529 2530 return cnt; 2531 } 2532 2533 int bpf_prog_ctx_arg_info_init(struct bpf_prog *prog, 2534 const struct bpf_ctx_arg_aux *info, u32 cnt); 2535 2536 #if defined(CONFIG_CGROUP_BPF) && defined(CONFIG_BPF_LSM) 2537 int bpf_trampoline_link_cgroup_shim(struct bpf_prog *prog, 2538 int cgroup_atype, 2539 enum bpf_attach_type attach_type); 2540 void bpf_trampoline_unlink_cgroup_shim(struct bpf_prog *prog); 2541 #else 2542 static inline int bpf_trampoline_link_cgroup_shim(struct bpf_prog *prog, 2543 int cgroup_atype, 2544 enum bpf_attach_type attach_type) 2545 { 2546 return -EOPNOTSUPP; 2547 } 2548 static inline void bpf_trampoline_unlink_cgroup_shim(struct bpf_prog *prog) 2549 { 2550 } 2551 #endif 2552 2553 struct bpf_array { 2554 struct bpf_map map; 2555 u32 elem_size; 2556 u32 index_mask; 2557 struct bpf_array_aux *aux; 2558 union { 2559 DECLARE_FLEX_ARRAY(char, value) __aligned(8); 2560 DECLARE_FLEX_ARRAY(void *, ptrs) __aligned(8); 2561 DECLARE_FLEX_ARRAY(void __percpu *, pptrs) __aligned(8); 2562 }; 2563 }; 2564 2565 /* 2566 * The bpf_array_get_next_key() function may be used for all array-like 2567 * maps, i.e., maps with u32 keys with range [0 ,..., max_entries) 2568 */ 2569 int bpf_array_get_next_key(struct bpf_map *map, void *key, void *next_key); 2570 2571 #define BPF_COMPLEXITY_LIMIT_INSNS 1000000 /* yes. 1M insns */ 2572 #define MAX_TAIL_CALL_CNT 33 2573 2574 /* Maximum number of loops for bpf_loop and bpf_iter_num. 2575 * It's enum to expose it (and thus make it discoverable) through BTF. 2576 */ 2577 enum { 2578 BPF_MAX_LOOPS = 8 * 1024 * 1024, 2579 BPF_MAX_TIMED_LOOPS = 0xffff, 2580 }; 2581 2582 #define BPF_F_ACCESS_MASK (BPF_F_RDONLY | \ 2583 BPF_F_RDONLY_PROG | \ 2584 BPF_F_WRONLY | \ 2585 BPF_F_WRONLY_PROG) 2586 2587 #define BPF_MAP_CAN_READ BIT(0) 2588 #define BPF_MAP_CAN_WRITE BIT(1) 2589 2590 /* Maximum number of user-producer ring buffer samples that can be drained in 2591 * a call to bpf_user_ringbuf_drain(). 2592 */ 2593 #define BPF_MAX_USER_RINGBUF_SAMPLES (128 * 1024) 2594 2595 static inline u32 bpf_map_flags_to_cap(struct bpf_map *map) 2596 { 2597 u32 access_flags = map->map_flags & (BPF_F_RDONLY_PROG | BPF_F_WRONLY_PROG); 2598 2599 /* Combination of BPF_F_RDONLY_PROG | BPF_F_WRONLY_PROG is 2600 * not possible. 2601 */ 2602 if (access_flags & BPF_F_RDONLY_PROG) 2603 return BPF_MAP_CAN_READ; 2604 else if (access_flags & BPF_F_WRONLY_PROG) 2605 return BPF_MAP_CAN_WRITE; 2606 else 2607 return BPF_MAP_CAN_READ | BPF_MAP_CAN_WRITE; 2608 } 2609 2610 static inline bool bpf_map_flags_access_ok(u32 access_flags) 2611 { 2612 return (access_flags & (BPF_F_RDONLY_PROG | BPF_F_WRONLY_PROG)) != 2613 (BPF_F_RDONLY_PROG | BPF_F_WRONLY_PROG); 2614 } 2615 2616 static inline struct bpf_map_owner *bpf_map_owner_alloc(struct bpf_map *map) 2617 { 2618 return kzalloc_obj(*map->owner, GFP_ATOMIC); 2619 } 2620 2621 static inline void bpf_map_owner_free(struct bpf_map *map) 2622 { 2623 kfree(map->owner); 2624 } 2625 2626 struct bpf_event_entry { 2627 struct perf_event *event; 2628 struct file *perf_file; 2629 struct file *map_file; 2630 struct rcu_head rcu; 2631 }; 2632 2633 static inline bool map_type_contains_progs(struct bpf_map *map) 2634 { 2635 return map->map_type == BPF_MAP_TYPE_PROG_ARRAY || 2636 map->map_type == BPF_MAP_TYPE_DEVMAP || 2637 map->map_type == BPF_MAP_TYPE_CPUMAP; 2638 } 2639 2640 bool bpf_prog_map_compatible(struct bpf_map *map, const struct bpf_prog *fp); 2641 int bpf_prog_calc_tag(struct bpf_prog *fp); 2642 2643 const struct bpf_func_proto *bpf_get_trace_printk_proto(void); 2644 const struct bpf_func_proto *bpf_get_trace_vprintk_proto(void); 2645 2646 const struct bpf_func_proto *bpf_get_perf_event_read_value_proto(void); 2647 2648 typedef unsigned long (*bpf_ctx_copy_t)(void *dst, const void *src, 2649 unsigned long off, unsigned long len); 2650 typedef u32 (*bpf_convert_ctx_access_t)(enum bpf_access_type type, 2651 const struct bpf_insn *src, 2652 struct bpf_insn *dst, 2653 struct bpf_prog *prog, 2654 u32 *target_size); 2655 2656 u64 bpf_event_output(struct bpf_map *map, u64 flags, void *meta, u64 meta_size, 2657 void *ctx, u64 ctx_size, bpf_ctx_copy_t ctx_copy); 2658 2659 /* an array of programs to be executed under rcu_lock. 2660 * 2661 * Typical usage: 2662 * ret = bpf_prog_run_array(rcu_dereference(&bpf_prog_array), ctx, bpf_prog_run); 2663 * 2664 * the structure returned by bpf_prog_array_alloc() should be populated 2665 * with program pointers and the last pointer must be NULL. 2666 * The user has to keep refcnt on the program and make sure the program 2667 * is removed from the array before bpf_prog_put(). 2668 * The 'struct bpf_prog_array *' should only be replaced with xchg() 2669 * since other cpus are walking the array of pointers in parallel. 2670 */ 2671 struct bpf_prog_array_item { 2672 union { 2673 struct bpf_prog *prog; 2674 void *kdata; 2675 }; 2676 union { 2677 struct bpf_cgroup_storage *cgroup_storage[MAX_BPF_CGROUP_STORAGE_TYPE]; 2678 u64 bpf_cookie; 2679 }; 2680 }; 2681 2682 struct bpf_prog_array { 2683 struct rcu_head rcu; 2684 struct bpf_prog_array_item items[]; 2685 }; 2686 2687 /* to avoid allocating empty bpf_prog_array for cgroups that 2688 * don't have bpf program attached use one global 'bpf_empty_prog_array' 2689 * It will not be modified the caller of bpf_prog_array_alloc() 2690 * (since caller requested prog_cnt == 0) 2691 * that pointer should be 'freed' by bpf_prog_array_free() 2692 */ 2693 extern struct bpf_prog_array bpf_empty_prog_array; 2694 2695 struct bpf_prog_array *bpf_prog_array_alloc(u32 prog_cnt, gfp_t flags); 2696 void bpf_prog_array_free(struct bpf_prog_array *progs); 2697 /* Use when traversal over the bpf_prog_array uses tasks_trace rcu */ 2698 void bpf_prog_array_free_sleepable(struct bpf_prog_array *progs); 2699 int bpf_prog_array_length(struct bpf_prog_array *progs); 2700 bool bpf_prog_array_is_empty(struct bpf_prog_array *array); 2701 int bpf_prog_array_copy_to_user(struct bpf_prog_array *progs, 2702 __u32 __user *prog_ids, u32 cnt); 2703 2704 void bpf_prog_array_delete_safe(struct bpf_prog_array *progs, 2705 struct bpf_prog *old_prog); 2706 int bpf_prog_array_delete_safe_at(struct bpf_prog_array *array, int index); 2707 int bpf_prog_array_update_at(struct bpf_prog_array *array, int index, 2708 struct bpf_prog *prog); 2709 int bpf_prog_array_copy_info(struct bpf_prog_array *array, 2710 u32 *prog_ids, u32 request_cnt, 2711 u32 *prog_cnt); 2712 int bpf_prog_array_copy(struct bpf_prog_array *old_array, 2713 struct bpf_prog *exclude_prog, 2714 struct bpf_prog *include_prog, 2715 u64 bpf_cookie, 2716 struct bpf_prog_array **new_array); 2717 struct bpf_prog *bpf_prog_dummy(void); 2718 2719 struct bpf_run_ctx {}; 2720 2721 struct bpf_cg_run_ctx { 2722 struct bpf_run_ctx run_ctx; 2723 const struct bpf_prog_array_item *prog_item; 2724 int retval; 2725 }; 2726 2727 struct bpf_trace_run_ctx { 2728 struct bpf_run_ctx run_ctx; 2729 u64 bpf_cookie; 2730 bool is_uprobe; 2731 }; 2732 2733 struct bpf_tramp_run_ctx { 2734 struct bpf_run_ctx run_ctx; 2735 u64 bpf_cookie; 2736 int retval; 2737 struct bpf_run_ctx *saved_run_ctx; 2738 }; 2739 2740 static inline struct bpf_run_ctx *bpf_set_run_ctx(struct bpf_run_ctx *new_ctx) 2741 { 2742 struct bpf_run_ctx *old_ctx = NULL; 2743 2744 #ifdef CONFIG_BPF_SYSCALL 2745 old_ctx = current->bpf_ctx; 2746 current->bpf_ctx = new_ctx; 2747 #endif 2748 return old_ctx; 2749 } 2750 2751 static inline void bpf_reset_run_ctx(struct bpf_run_ctx *old_ctx) 2752 { 2753 #ifdef CONFIG_BPF_SYSCALL 2754 current->bpf_ctx = old_ctx; 2755 #endif 2756 } 2757 2758 /* BPF program asks to bypass CAP_NET_BIND_SERVICE in bind. */ 2759 #define BPF_RET_BIND_NO_CAP_NET_BIND_SERVICE (1 << 0) 2760 /* BPF program asks to set CN on the packet. */ 2761 #define BPF_RET_SET_CN (1 << 0) 2762 2763 typedef u32 (*bpf_prog_run_fn)(const struct bpf_prog *prog, const void *ctx); 2764 2765 static __always_inline u32 2766 bpf_prog_run_array(const struct bpf_prog_array *array, 2767 const void *ctx, bpf_prog_run_fn run_prog) 2768 { 2769 const struct bpf_prog_array_item *item; 2770 const struct bpf_prog *prog; 2771 struct bpf_run_ctx *old_run_ctx; 2772 struct bpf_trace_run_ctx run_ctx; 2773 u32 ret = 1; 2774 2775 RCU_LOCKDEP_WARN(!rcu_read_lock_held(), "no rcu lock held"); 2776 2777 if (unlikely(!array)) 2778 return ret; 2779 2780 run_ctx.is_uprobe = false; 2781 2782 migrate_disable(); 2783 old_run_ctx = bpf_set_run_ctx(&run_ctx.run_ctx); 2784 item = &array->items[0]; 2785 while ((prog = READ_ONCE(item->prog))) { 2786 run_ctx.bpf_cookie = item->bpf_cookie; 2787 ret &= run_prog(prog, ctx); 2788 item++; 2789 } 2790 bpf_reset_run_ctx(old_run_ctx); 2791 migrate_enable(); 2792 return ret; 2793 } 2794 2795 /* Notes on RCU design for bpf_prog_arrays containing sleepable programs: 2796 * 2797 * We use the tasks_trace rcu flavor read section to protect the bpf_prog_array 2798 * overall. As a result, we must use the bpf_prog_array_free_sleepable 2799 * in order to use the tasks_trace rcu grace period. 2800 * 2801 * When a non-sleepable program is inside the array, we take the rcu read 2802 * section and disable preemption for that program alone, so it can access 2803 * rcu-protected dynamically sized maps. 2804 */ 2805 static __always_inline u32 2806 bpf_prog_run_array_uprobe(const struct bpf_prog_array *array, 2807 const void *ctx, bpf_prog_run_fn run_prog) 2808 { 2809 const struct bpf_prog_array_item *item; 2810 const struct bpf_prog *prog; 2811 struct bpf_run_ctx *old_run_ctx; 2812 struct bpf_trace_run_ctx run_ctx; 2813 u32 ret = 1; 2814 2815 might_fault(); 2816 RCU_LOCKDEP_WARN(!rcu_read_lock_trace_held(), "no rcu lock held"); 2817 2818 if (unlikely(!array)) 2819 return ret; 2820 2821 migrate_disable(); 2822 2823 run_ctx.is_uprobe = true; 2824 2825 old_run_ctx = bpf_set_run_ctx(&run_ctx.run_ctx); 2826 item = &array->items[0]; 2827 while ((prog = READ_ONCE(item->prog))) { 2828 if (!prog->sleepable) 2829 rcu_read_lock(); 2830 2831 run_ctx.bpf_cookie = item->bpf_cookie; 2832 ret &= run_prog(prog, ctx); 2833 item++; 2834 2835 if (!prog->sleepable) 2836 rcu_read_unlock(); 2837 } 2838 bpf_reset_run_ctx(old_run_ctx); 2839 migrate_enable(); 2840 return ret; 2841 } 2842 2843 bool bpf_jit_bypass_spec_v1(void); 2844 bool bpf_jit_bypass_spec_v4(void); 2845 2846 #define bpf_rcu_lock_held() \ 2847 (rcu_read_lock_held() || rcu_read_lock_trace_held() || rcu_read_lock_bh_held()) 2848 2849 #ifdef CONFIG_BPF_SYSCALL 2850 DECLARE_PER_CPU(int, bpf_prog_active); 2851 extern struct mutex bpf_stats_enabled_mutex; 2852 2853 /* 2854 * Block execution of BPF programs attached to instrumentation (perf, 2855 * kprobes, tracepoints) to prevent deadlocks on map operations as any of 2856 * these events can happen inside a region which holds a map bucket lock 2857 * and can deadlock on it. 2858 */ 2859 static inline void bpf_disable_instrumentation(void) 2860 { 2861 migrate_disable(); 2862 this_cpu_inc(bpf_prog_active); 2863 } 2864 2865 static inline void bpf_enable_instrumentation(void) 2866 { 2867 this_cpu_dec(bpf_prog_active); 2868 migrate_enable(); 2869 } 2870 2871 extern const struct super_operations bpf_super_ops; 2872 extern const struct file_operations bpf_map_fops; 2873 extern const struct file_operations bpf_prog_fops; 2874 extern const struct file_operations bpf_iter_fops; 2875 extern const struct file_operations bpf_token_fops; 2876 2877 #define BPF_PROG_TYPE(_id, _name, prog_ctx_type, kern_ctx_type) \ 2878 extern const struct bpf_prog_ops _name ## _prog_ops; \ 2879 extern const struct bpf_verifier_ops _name ## _verifier_ops; 2880 #define BPF_MAP_TYPE(_id, _ops) \ 2881 extern const struct bpf_map_ops _ops; 2882 #define BPF_LINK_TYPE(_id, _name) 2883 #include <linux/bpf_types.h> 2884 #undef BPF_PROG_TYPE 2885 #undef BPF_MAP_TYPE 2886 #undef BPF_LINK_TYPE 2887 2888 extern const struct bpf_prog_ops bpf_offload_prog_ops; 2889 extern const struct bpf_verifier_ops tc_cls_act_analyzer_ops; 2890 extern const struct bpf_verifier_ops xdp_analyzer_ops; 2891 2892 struct bpf_prog *bpf_prog_get(u32 ufd); 2893 struct bpf_prog *bpf_prog_get_type_dev(u32 ufd, enum bpf_prog_type type, 2894 bool attach_drv); 2895 void bpf_prog_add(struct bpf_prog *prog, int i); 2896 void bpf_prog_sub(struct bpf_prog *prog, int i); 2897 void bpf_prog_inc(struct bpf_prog *prog); 2898 struct bpf_prog * __must_check bpf_prog_inc_not_zero(struct bpf_prog *prog); 2899 void bpf_prog_put(struct bpf_prog *prog); 2900 2901 void bpf_prog_free_id(struct bpf_prog *prog); 2902 void bpf_map_free_id(struct bpf_map *map); 2903 2904 struct btf_field *btf_record_find(const struct btf_record *rec, 2905 u32 offset, u32 field_mask); 2906 void btf_record_free(struct btf_record *rec); 2907 void bpf_map_free_record(struct bpf_map *map); 2908 struct btf_record *btf_record_dup(const struct btf_record *rec); 2909 bool btf_record_equal(const struct btf_record *rec_a, const struct btf_record *rec_b); 2910 void bpf_obj_free_timer(const struct btf_record *rec, void *obj); 2911 void bpf_obj_free_workqueue(const struct btf_record *rec, void *obj); 2912 void bpf_obj_free_task_work(const struct btf_record *rec, void *obj); 2913 void bpf_obj_cancel_fields(struct bpf_map *map, void *obj); 2914 void bpf_obj_free_fields(const struct btf_record *rec, void *obj); 2915 void __bpf_obj_drop_impl(void *p, const struct btf_record *rec, bool percpu); 2916 2917 struct bpf_map *bpf_map_get(u32 ufd); 2918 struct bpf_map *bpf_map_get_with_uref(u32 ufd); 2919 2920 /* 2921 * The __bpf_map_get() and __btf_get_by_fd() functions parse a file 2922 * descriptor and return a corresponding map or btf object. 2923 * Their names are double underscored to emphasize the fact that they 2924 * do not increase refcnt. To also increase refcnt use corresponding 2925 * bpf_map_get() and btf_get_by_fd() functions. 2926 */ 2927 2928 static inline struct bpf_map *__bpf_map_get(struct fd f) 2929 { 2930 if (fd_empty(f)) 2931 return ERR_PTR(-EBADF); 2932 if (unlikely(fd_file(f)->f_op != &bpf_map_fops)) 2933 return ERR_PTR(-EINVAL); 2934 return fd_file(f)->private_data; 2935 } 2936 2937 static inline struct btf *__btf_get_by_fd(struct fd f) 2938 { 2939 if (fd_empty(f)) 2940 return ERR_PTR(-EBADF); 2941 if (unlikely(fd_file(f)->f_op != &btf_fops)) 2942 return ERR_PTR(-EINVAL); 2943 return fd_file(f)->private_data; 2944 } 2945 2946 void bpf_map_inc(struct bpf_map *map); 2947 void bpf_map_inc_with_uref(struct bpf_map *map); 2948 struct bpf_map *__bpf_map_inc_not_zero(struct bpf_map *map, bool uref); 2949 struct bpf_map * __must_check bpf_map_inc_not_zero(struct bpf_map *map); 2950 void bpf_map_put_with_uref(struct bpf_map *map); 2951 void bpf_map_put(struct bpf_map *map); 2952 void *bpf_map_area_alloc(u64 size, int numa_node); 2953 void *bpf_map_area_mmapable_alloc(u64 size, int numa_node); 2954 void bpf_map_area_free(void *base); 2955 bool bpf_map_write_active(const struct bpf_map *map); 2956 void bpf_map_init_from_attr(struct bpf_map *map, union bpf_attr *attr); 2957 int generic_map_lookup_batch(struct bpf_map *map, 2958 const union bpf_attr *attr, 2959 union bpf_attr __user *uattr); 2960 int generic_map_update_batch(struct bpf_map *map, struct file *map_file, 2961 const union bpf_attr *attr, 2962 union bpf_attr __user *uattr); 2963 int generic_map_delete_batch(struct bpf_map *map, 2964 const union bpf_attr *attr, 2965 union bpf_attr __user *uattr); 2966 struct bpf_map *bpf_map_get_curr_or_next(u32 *id); 2967 struct bpf_prog *bpf_prog_get_curr_or_next(u32 *id); 2968 2969 2970 struct page *bpf_alloc_page(int nid, bool sleepable); 2971 int bpf_alloc_pages(int nid, unsigned long nr_pages, 2972 struct llist_head *pages, bool sleepable); 2973 void bpf_free_pages(struct llist_head *pages); 2974 #ifdef CONFIG_MEMCG 2975 void bpf_map_memcg_enter(const struct bpf_map *map, struct mem_cgroup **old_memcg, 2976 struct mem_cgroup **new_memcg); 2977 void bpf_map_memcg_exit(struct mem_cgroup *old_memcg, 2978 struct mem_cgroup *memcg); 2979 void *bpf_map_kmalloc_node(const struct bpf_map *map, size_t size, gfp_t flags, 2980 int node); 2981 void *bpf_map_kmalloc_nolock(const struct bpf_map *map, size_t size, gfp_t flags, 2982 int node); 2983 void *bpf_map_kzalloc(const struct bpf_map *map, size_t size, gfp_t flags); 2984 void *bpf_map_kvcalloc(struct bpf_map *map, size_t n, size_t size, 2985 gfp_t flags); 2986 void __percpu *bpf_map_alloc_percpu(const struct bpf_map *map, size_t size, 2987 size_t align, gfp_t flags); 2988 #else 2989 /* 2990 * These specialized allocators have to be macros for their allocations to be 2991 * accounted separately (to have separate alloc_tag). 2992 */ 2993 #define bpf_map_kmalloc_node(_map, _size, _flags, _node) \ 2994 kmalloc_node(_size, _flags, _node) 2995 #define bpf_map_kmalloc_nolock(_map, _size, _flags, _node) \ 2996 kmalloc_nolock(_size, _flags, _node) 2997 #define bpf_map_kzalloc(_map, _size, _flags) \ 2998 kzalloc(_size, _flags) 2999 #define bpf_map_kvcalloc(_map, _n, _size, _flags) \ 3000 kvcalloc(_n, _size, _flags) 3001 #define bpf_map_alloc_percpu(_map, _size, _align, _flags) \ 3002 __alloc_percpu_gfp(_size, _align, _flags) 3003 static inline void bpf_map_memcg_enter(const struct bpf_map *map, struct mem_cgroup **old_memcg, 3004 struct mem_cgroup **new_memcg) 3005 { 3006 *new_memcg = NULL; 3007 *old_memcg = NULL; 3008 } 3009 3010 static inline void bpf_map_memcg_exit(struct mem_cgroup *old_memcg, 3011 struct mem_cgroup *memcg) 3012 { 3013 } 3014 #endif 3015 3016 static inline int 3017 bpf_map_init_elem_count(struct bpf_map *map) 3018 { 3019 size_t size = sizeof(*map->elem_count), align = size; 3020 gfp_t flags = GFP_USER | __GFP_NOWARN; 3021 3022 map->elem_count = bpf_map_alloc_percpu(map, size, align, flags); 3023 if (!map->elem_count) 3024 return -ENOMEM; 3025 3026 return 0; 3027 } 3028 3029 static inline void 3030 bpf_map_free_elem_count(struct bpf_map *map) 3031 { 3032 free_percpu(map->elem_count); 3033 } 3034 3035 static inline void bpf_map_inc_elem_count(struct bpf_map *map) 3036 { 3037 this_cpu_inc(*map->elem_count); 3038 } 3039 3040 static inline void bpf_map_dec_elem_count(struct bpf_map *map) 3041 { 3042 this_cpu_dec(*map->elem_count); 3043 } 3044 3045 extern int sysctl_unprivileged_bpf_disabled; 3046 3047 bool bpf_token_capable(const struct bpf_token *token, int cap); 3048 3049 static inline bool bpf_allow_ptr_leaks(const struct bpf_token *token) 3050 { 3051 return bpf_token_capable(token, CAP_PERFMON); 3052 } 3053 3054 static inline bool bpf_allow_uninit_stack(const struct bpf_token *token) 3055 { 3056 return bpf_token_capable(token, CAP_PERFMON); 3057 } 3058 3059 static inline bool bpf_bypass_spec_v1(const struct bpf_token *token) 3060 { 3061 return bpf_jit_bypass_spec_v1() || 3062 cpu_mitigations_off() || 3063 bpf_token_capable(token, CAP_PERFMON); 3064 } 3065 3066 static inline bool bpf_bypass_spec_v4(const struct bpf_token *token) 3067 { 3068 return bpf_jit_bypass_spec_v4() || 3069 cpu_mitigations_off() || 3070 bpf_token_capable(token, CAP_PERFMON); 3071 } 3072 3073 int bpf_map_new_fd(struct bpf_map *map, int flags); 3074 int bpf_prog_new_fd(struct bpf_prog *prog); 3075 3076 void bpf_link_init(struct bpf_link *link, enum bpf_link_type type, 3077 const struct bpf_link_ops *ops, struct bpf_prog *prog, 3078 enum bpf_attach_type attach_type); 3079 void bpf_link_init_sleepable(struct bpf_link *link, enum bpf_link_type type, 3080 const struct bpf_link_ops *ops, struct bpf_prog *prog, 3081 enum bpf_attach_type attach_type, bool sleepable); 3082 void bpf_tramp_link_init(struct bpf_tramp_link *link, enum bpf_link_type type, 3083 const struct bpf_link_ops *ops, struct bpf_prog *prog, 3084 enum bpf_attach_type attach_type, u64 cookie); 3085 int bpf_link_prime(struct bpf_link *link, struct bpf_link_primer *primer); 3086 int bpf_link_settle(struct bpf_link_primer *primer); 3087 void bpf_link_cleanup(struct bpf_link_primer *primer); 3088 void bpf_link_inc(struct bpf_link *link); 3089 struct bpf_link *bpf_link_inc_not_zero(struct bpf_link *link); 3090 void bpf_link_put(struct bpf_link *link); 3091 int bpf_link_new_fd(struct bpf_link *link); 3092 struct bpf_link *bpf_link_get_from_fd(u32 ufd); 3093 struct bpf_link *bpf_link_get_curr_or_next(u32 *id); 3094 3095 void bpf_token_inc(struct bpf_token *token); 3096 void bpf_token_put(struct bpf_token *token); 3097 int bpf_token_create(union bpf_attr *attr); 3098 struct bpf_token *bpf_token_get_from_fd(u32 ufd); 3099 int bpf_token_get_info_by_fd(struct bpf_token *token, 3100 const union bpf_attr *attr, 3101 union bpf_attr __user *uattr); 3102 3103 bool bpf_token_allow_cmd(const struct bpf_token *token, enum bpf_cmd cmd); 3104 bool bpf_token_allow_map_type(const struct bpf_token *token, enum bpf_map_type type); 3105 bool bpf_token_allow_prog_type(const struct bpf_token *token, 3106 enum bpf_prog_type prog_type, 3107 enum bpf_attach_type attach_type); 3108 3109 int bpf_obj_pin_user(u32 ufd, int path_fd, const char __user *pathname); 3110 int bpf_obj_get_user(int path_fd, const char __user *pathname, int flags); 3111 struct inode *bpf_get_inode(struct super_block *sb, const struct inode *dir, 3112 umode_t mode); 3113 3114 #define BPF_ITER_FUNC_PREFIX "bpf_iter_" 3115 #define DEFINE_BPF_ITER_FUNC(target, args...) \ 3116 extern int bpf_iter_ ## target(args); \ 3117 int __init bpf_iter_ ## target(args) { return 0; } 3118 3119 /* 3120 * The task type of iterators. 3121 * 3122 * For BPF task iterators, they can be parameterized with various 3123 * parameters to visit only some of tasks. 3124 * 3125 * BPF_TASK_ITER_ALL (default) 3126 * Iterate over resources of every task. 3127 * 3128 * BPF_TASK_ITER_TID 3129 * Iterate over resources of a task/tid. 3130 * 3131 * BPF_TASK_ITER_TGID 3132 * Iterate over resources of every task of a process / task group. 3133 */ 3134 enum bpf_iter_task_type { 3135 BPF_TASK_ITER_ALL = 0, 3136 BPF_TASK_ITER_TID, 3137 BPF_TASK_ITER_TGID, 3138 }; 3139 3140 struct bpf_iter_aux_info { 3141 /* for map_elem iter */ 3142 struct bpf_map *map; 3143 3144 /* for cgroup iter */ 3145 struct { 3146 struct cgroup *start; /* starting cgroup */ 3147 enum bpf_cgroup_iter_order order; 3148 } cgroup; 3149 struct { 3150 enum bpf_iter_task_type type; 3151 u32 pid; 3152 } task; 3153 }; 3154 3155 typedef int (*bpf_iter_attach_target_t)(struct bpf_prog *prog, 3156 union bpf_iter_link_info *linfo, 3157 struct bpf_iter_aux_info *aux); 3158 typedef void (*bpf_iter_detach_target_t)(struct bpf_iter_aux_info *aux); 3159 typedef int (*bpf_iter_check_prog_t)(const struct bpf_prog *prog, 3160 const struct bpf_iter_aux_info *aux); 3161 typedef void (*bpf_iter_show_fdinfo_t) (const struct bpf_iter_aux_info *aux, 3162 struct seq_file *seq); 3163 typedef int (*bpf_iter_fill_link_info_t)(const struct bpf_iter_aux_info *aux, 3164 struct bpf_link_info *info); 3165 typedef const struct bpf_func_proto * 3166 (*bpf_iter_get_func_proto_t)(enum bpf_func_id func_id, 3167 const struct bpf_prog *prog); 3168 3169 enum bpf_iter_feature { 3170 BPF_ITER_RESCHED = BIT(0), /* may cond_resched() between objects */ 3171 BPF_ITER_NOSLEEP = BIT(1), /* ->show() can't run sleepable progs */ 3172 }; 3173 3174 #define BPF_ITER_CTX_ARG_MAX 2 3175 struct bpf_iter_reg { 3176 const char *target; 3177 bpf_iter_attach_target_t attach_target; 3178 bpf_iter_detach_target_t detach_target; 3179 /* may the program run on what the link is attached to? */ 3180 bpf_iter_check_prog_t check_prog; 3181 bpf_iter_show_fdinfo_t show_fdinfo; 3182 bpf_iter_fill_link_info_t fill_link_info; 3183 bpf_iter_get_func_proto_t get_func_proto; 3184 u32 ctx_arg_info_size; 3185 u32 feature; 3186 struct bpf_ctx_arg_aux ctx_arg_info[BPF_ITER_CTX_ARG_MAX]; 3187 const struct bpf_iter_seq_info *seq_info; 3188 }; 3189 3190 struct bpf_iter_meta { 3191 __bpf_md_ptr(struct seq_file *, seq); 3192 u64 session_id; 3193 u64 seq_num; 3194 }; 3195 3196 struct bpf_iter__bpf_map_elem { 3197 __bpf_md_ptr(struct bpf_iter_meta *, meta); 3198 __bpf_md_ptr(struct bpf_map *, map); 3199 __bpf_md_ptr(void *, key); 3200 __bpf_md_ptr(void *, value); 3201 }; 3202 3203 int bpf_iter_reg_target(const struct bpf_iter_reg *reg_info); 3204 void bpf_iter_unreg_target(const struct bpf_iter_reg *reg_info); 3205 int bpf_iter_prog_supported(struct bpf_prog *prog); 3206 const struct bpf_func_proto * 3207 bpf_iter_get_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog); 3208 int bpf_iter_link_attach(const union bpf_attr *attr, bpfptr_t uattr, struct bpf_prog *prog); 3209 int bpf_iter_new_fd(struct bpf_link *link); 3210 bool bpf_link_is_iter(struct bpf_link *link); 3211 struct bpf_prog *bpf_iter_get_info(struct bpf_iter_meta *meta, bool in_stop); 3212 int bpf_iter_run_prog(struct bpf_prog *prog, void *ctx); 3213 void bpf_iter_map_show_fdinfo(const struct bpf_iter_aux_info *aux, 3214 struct seq_file *seq); 3215 int bpf_iter_map_fill_link_info(const struct bpf_iter_aux_info *aux, 3216 struct bpf_link_info *info); 3217 int bpf_iter_map_check_value_write(const struct bpf_prog *prog, 3218 const struct bpf_map *map); 3219 3220 int map_set_for_each_callback_args(struct bpf_verifier_env *env, 3221 struct bpf_func_state *caller, 3222 struct bpf_func_state *callee); 3223 3224 int bpf_percpu_hash_copy(struct bpf_map *map, void *key, void *value, u64 flags); 3225 int bpf_percpu_array_copy(struct bpf_map *map, void *key, void *value, u64 flags); 3226 int bpf_percpu_hash_update(struct bpf_map *map, void *key, void *value, 3227 u64 flags); 3228 int bpf_percpu_array_update(struct bpf_map *map, void *key, void *value, 3229 u64 flags); 3230 3231 int bpf_stackmap_extract(struct bpf_map *map, void *key, void *value, bool delete); 3232 3233 int bpf_fd_array_map_update_elem(struct bpf_map *map, struct file *map_file, 3234 void *key, void *value, u64 map_flags); 3235 int bpf_fd_array_map_lookup_elem(struct bpf_map *map, void *key, u32 *value); 3236 int bpf_fd_htab_map_update_elem(struct bpf_map *map, struct file *map_file, 3237 void *key, void *value, u64 map_flags); 3238 int bpf_fd_htab_map_lookup_elem(struct bpf_map *map, void *key, u32 *value); 3239 3240 int bpf_get_file_flag(int flags); 3241 int bpf_check_uarg_tail_zero(bpfptr_t uaddr, size_t expected_size, 3242 size_t actual_size); 3243 3244 /* verify correctness of eBPF program */ 3245 struct bpf_log_attr; 3246 int bpf_check(struct bpf_prog **fp, union bpf_attr *attr, bpfptr_t uattr, 3247 struct bpf_log_attr *attr_log); 3248 3249 #ifndef CONFIG_BPF_JIT_ALWAYS_ON 3250 int bpf_patch_call_args(struct bpf_insn *insn, u32 stack_depth); 3251 s32 bpf_call_args_imm(s16 idx); 3252 #else 3253 static inline s32 bpf_call_args_imm(s16 idx) 3254 { 3255 return 0; 3256 } 3257 #endif 3258 3259 struct btf *bpf_get_btf_vmlinux(void); 3260 3261 /* Map specifics */ 3262 struct xdp_frame; 3263 struct sk_buff; 3264 struct bpf_dtab_netdev; 3265 struct bpf_cpu_map_entry; 3266 3267 void __dev_flush(struct list_head *flush_list); 3268 int dev_xdp_enqueue(struct net_device *dev, struct xdp_frame *xdpf, 3269 struct net_device *dev_rx); 3270 int dev_map_enqueue(struct bpf_dtab_netdev *dst, struct xdp_frame *xdpf, 3271 struct net_device *dev_rx); 3272 int dev_map_enqueue_multi(struct xdp_frame *xdpf, struct net_device *dev_rx, 3273 struct bpf_map *map, bool exclude_ingress); 3274 int dev_map_generic_redirect(struct bpf_dtab_netdev *dst, struct sk_buff *skb, 3275 const struct bpf_prog *xdp_prog); 3276 int dev_map_redirect_multi(struct net_device *dev, struct sk_buff *skb, 3277 const struct bpf_prog *xdp_prog, 3278 struct bpf_map *map, bool exclude_ingress); 3279 3280 void __cpu_map_flush(struct list_head *flush_list); 3281 int cpu_map_enqueue(struct bpf_cpu_map_entry *rcpu, struct xdp_frame *xdpf, 3282 struct net_device *dev_rx); 3283 int cpu_map_generic_redirect(struct bpf_cpu_map_entry *rcpu, 3284 struct sk_buff *skb); 3285 3286 /* Return map's numa specified by userspace */ 3287 static inline int bpf_map_attr_numa_node(const union bpf_attr *attr) 3288 { 3289 return (attr->map_flags & BPF_F_NUMA_NODE) ? 3290 attr->numa_node : NUMA_NO_NODE; 3291 } 3292 3293 struct bpf_prog *bpf_prog_get_type_path(const char *name, enum bpf_prog_type type); 3294 int array_map_alloc_check(union bpf_attr *attr); 3295 3296 int bpf_prog_test_run_xdp(struct bpf_prog *prog, const union bpf_attr *kattr, 3297 union bpf_attr __user *uattr); 3298 int bpf_prog_test_run_skb(struct bpf_prog *prog, const union bpf_attr *kattr, 3299 union bpf_attr __user *uattr); 3300 int bpf_prog_test_run_tracing(struct bpf_prog *prog, 3301 const union bpf_attr *kattr, 3302 union bpf_attr __user *uattr); 3303 int bpf_prog_test_run_flow_dissector(struct bpf_prog *prog, 3304 const union bpf_attr *kattr, 3305 union bpf_attr __user *uattr); 3306 int bpf_prog_test_run_raw_tp(struct bpf_prog *prog, 3307 const union bpf_attr *kattr, 3308 union bpf_attr __user *uattr); 3309 int bpf_prog_test_run_sk_lookup(struct bpf_prog *prog, 3310 const union bpf_attr *kattr, 3311 union bpf_attr __user *uattr); 3312 int bpf_prog_test_run_nf(struct bpf_prog *prog, 3313 const union bpf_attr *kattr, 3314 union bpf_attr __user *uattr); 3315 bool btf_ctx_access(int off, int size, enum bpf_access_type type, 3316 const struct bpf_prog *prog, 3317 struct bpf_insn_access_aux *info); 3318 3319 static inline bool bpf_tracing_ctx_access(int off, int size, 3320 enum bpf_access_type type) 3321 { 3322 if (off < 0 || off >= sizeof(__u64) * MAX_BPF_FUNC_ARGS) 3323 return false; 3324 if (type != BPF_READ) 3325 return false; 3326 if (off % size != 0) 3327 return false; 3328 return true; 3329 } 3330 3331 static inline bool bpf_tracing_btf_ctx_access(int off, int size, 3332 enum bpf_access_type type, 3333 const struct bpf_prog *prog, 3334 struct bpf_insn_access_aux *info) 3335 { 3336 if (!bpf_tracing_ctx_access(off, size, type)) 3337 return false; 3338 return btf_ctx_access(off, size, type, prog, info); 3339 } 3340 3341 int btf_struct_access(struct bpf_verifier_log *log, 3342 const struct bpf_reg_state *reg, 3343 int off, int size, enum bpf_access_type atype, 3344 u32 *next_btf_id, enum bpf_type_flag *flag, const char **field_name); 3345 bool btf_struct_ids_match(struct bpf_verifier_log *log, 3346 const struct btf *btf, u32 id, int off, 3347 const struct btf *need_btf, u32 need_type_id, 3348 bool strict, bool walk_flex_arrays); 3349 3350 int btf_distill_func_proto(struct bpf_verifier_log *log, 3351 struct btf *btf, 3352 const struct btf_type *func_proto, 3353 const char *func_name, 3354 struct btf_func_model *m); 3355 3356 struct bpf_reg_state; 3357 int btf_prepare_func_args(struct bpf_verifier_env *env, int subprog); 3358 int btf_check_type_match(struct bpf_verifier_log *log, const struct bpf_prog *prog, 3359 struct btf *btf, const struct btf_type *t); 3360 const char *btf_find_decl_tag_value(const struct btf *btf, const struct btf_type *pt, 3361 int comp_idx, const char *tag_key); 3362 int btf_find_next_decl_tag(const struct btf *btf, const struct btf_type *pt, 3363 int comp_idx, const char *tag_key, int last_id); 3364 3365 struct bpf_prog *bpf_prog_by_id(u32 id); 3366 struct bpf_link *bpf_link_by_id(u32 id); 3367 3368 const struct bpf_func_proto *bpf_base_func_proto(enum bpf_func_id func_id, 3369 const struct bpf_prog *prog); 3370 void bpf_task_storage_free(struct task_struct *task); 3371 void bpf_cgrp_storage_free(struct cgroup *cgroup); 3372 const struct btf_func_model * 3373 bpf_jit_find_kfunc_model(const struct bpf_prog *prog, 3374 const struct bpf_insn *insn); 3375 int bpf_get_kfunc_addr(const struct bpf_prog *prog, u32 func_id, 3376 u16 desc_idx, u8 **func_addr); 3377 3378 struct bpf_core_ctx { 3379 struct bpf_verifier_log *log; 3380 const struct btf *btf; 3381 }; 3382 3383 bool btf_nested_type_is_trusted(struct bpf_verifier_log *log, 3384 const struct bpf_reg_state *reg, 3385 const char *field_name, u32 btf_id, const char *suffix); 3386 3387 bool btf_type_ids_nocast_alias(struct bpf_verifier_log *log, 3388 const struct btf *reg_btf, u32 reg_id, 3389 const struct btf *arg_btf, u32 arg_id); 3390 3391 int bpf_core_apply(struct bpf_core_ctx *ctx, const struct bpf_core_relo *relo, 3392 int relo_idx, void *insn); 3393 3394 static inline bool unprivileged_ebpf_enabled(void) 3395 { 3396 return !sysctl_unprivileged_bpf_disabled; 3397 } 3398 3399 /* Not all bpf prog type has the bpf_ctx. 3400 * For the bpf prog type that has initialized the bpf_ctx, 3401 * this function can be used to decide if a kernel function 3402 * is called by a bpf program. 3403 */ 3404 static inline bool has_current_bpf_ctx(void) 3405 { 3406 return !!current->bpf_ctx; 3407 } 3408 3409 void notrace bpf_prog_inc_misses_counter(struct bpf_prog *prog); 3410 3411 void bpf_dynptr_init(struct bpf_dynptr_kern *ptr, void *data, 3412 enum bpf_dynptr_type type, u32 offset, u32 size); 3413 void bpf_dynptr_set_null(struct bpf_dynptr_kern *ptr); 3414 void bpf_dynptr_set_rdonly(struct bpf_dynptr_kern *ptr); 3415 void bpf_prog_report_arena_violation(bool write, unsigned long addr, unsigned long fault_ip); 3416 3417 static __always_inline u32 3418 bpf_prog_run_array_sleepable(const struct bpf_prog_array *array, 3419 const void *ctx, bpf_prog_run_fn run_prog) 3420 { 3421 const struct bpf_prog_array_item *item; 3422 struct bpf_prog *prog; 3423 struct bpf_run_ctx *old_run_ctx; 3424 struct bpf_trace_run_ctx run_ctx; 3425 u32 ret = 1; 3426 3427 if (unlikely(!array)) 3428 return ret; 3429 3430 migrate_disable(); 3431 3432 run_ctx.is_uprobe = false; 3433 3434 old_run_ctx = bpf_set_run_ctx(&run_ctx.run_ctx); 3435 item = &array->items[0]; 3436 while ((prog = READ_ONCE(item->prog))) { 3437 /* Skip dummy_bpf_prog placeholder (len == 0) */ 3438 if (unlikely(!prog->len)) { 3439 item++; 3440 continue; 3441 } 3442 3443 if (unlikely(!bpf_prog_get_recursion_context(prog))) { 3444 bpf_prog_inc_misses_counter(prog); 3445 bpf_prog_put_recursion_context(prog); 3446 item++; 3447 continue; 3448 } 3449 3450 run_ctx.bpf_cookie = item->bpf_cookie; 3451 3452 if (!prog->sleepable) { 3453 guard(rcu)(); 3454 ret &= run_prog(prog, ctx); 3455 } else { 3456 ret &= run_prog(prog, ctx); 3457 } 3458 3459 bpf_prog_put_recursion_context(prog); 3460 item++; 3461 } 3462 bpf_reset_run_ctx(old_run_ctx); 3463 migrate_enable(); 3464 return ret; 3465 } 3466 3467 #else /* !CONFIG_BPF_SYSCALL */ 3468 static inline struct bpf_prog *bpf_prog_get(u32 ufd) 3469 { 3470 return ERR_PTR(-EOPNOTSUPP); 3471 } 3472 3473 static inline struct bpf_prog *bpf_prog_get_type_dev(u32 ufd, 3474 enum bpf_prog_type type, 3475 bool attach_drv) 3476 { 3477 return ERR_PTR(-EOPNOTSUPP); 3478 } 3479 3480 static inline void bpf_prog_add(struct bpf_prog *prog, int i) 3481 { 3482 } 3483 3484 static inline void bpf_prog_sub(struct bpf_prog *prog, int i) 3485 { 3486 } 3487 3488 static inline void bpf_prog_put(struct bpf_prog *prog) 3489 { 3490 } 3491 3492 static inline void bpf_prog_inc(struct bpf_prog *prog) 3493 { 3494 } 3495 3496 static inline struct bpf_prog *__must_check 3497 bpf_prog_inc_not_zero(struct bpf_prog *prog) 3498 { 3499 return ERR_PTR(-EOPNOTSUPP); 3500 } 3501 3502 static inline void bpf_link_init(struct bpf_link *link, enum bpf_link_type type, 3503 const struct bpf_link_ops *ops, 3504 struct bpf_prog *prog, enum bpf_attach_type attach_type) 3505 { 3506 } 3507 3508 static inline void bpf_link_init_sleepable(struct bpf_link *link, enum bpf_link_type type, 3509 const struct bpf_link_ops *ops, struct bpf_prog *prog, 3510 enum bpf_attach_type attach_type, bool sleepable) 3511 { 3512 } 3513 3514 static inline void bpf_tramp_link_init(struct bpf_tramp_link *link, enum bpf_link_type type, 3515 const struct bpf_link_ops *ops, struct bpf_prog *prog, 3516 enum bpf_attach_type attach_type, u64 cookie) 3517 { 3518 } 3519 3520 static inline int bpf_link_prime(struct bpf_link *link, 3521 struct bpf_link_primer *primer) 3522 { 3523 return -EOPNOTSUPP; 3524 } 3525 3526 static inline int bpf_link_settle(struct bpf_link_primer *primer) 3527 { 3528 return -EOPNOTSUPP; 3529 } 3530 3531 static inline void bpf_link_cleanup(struct bpf_link_primer *primer) 3532 { 3533 } 3534 3535 static inline void bpf_link_inc(struct bpf_link *link) 3536 { 3537 } 3538 3539 static inline struct bpf_link *bpf_link_inc_not_zero(struct bpf_link *link) 3540 { 3541 return NULL; 3542 } 3543 3544 static inline void bpf_link_put(struct bpf_link *link) 3545 { 3546 } 3547 3548 static inline int bpf_obj_get_user(const char __user *pathname, int flags) 3549 { 3550 return -EOPNOTSUPP; 3551 } 3552 3553 static inline bool bpf_token_capable(const struct bpf_token *token, int cap) 3554 { 3555 return capable(cap) || (cap != CAP_SYS_ADMIN && capable(CAP_SYS_ADMIN)); 3556 } 3557 3558 static inline void bpf_token_inc(struct bpf_token *token) 3559 { 3560 } 3561 3562 static inline void bpf_token_put(struct bpf_token *token) 3563 { 3564 } 3565 3566 static inline struct bpf_token *bpf_token_get_from_fd(u32 ufd) 3567 { 3568 return ERR_PTR(-EOPNOTSUPP); 3569 } 3570 3571 static inline int bpf_token_get_info_by_fd(struct bpf_token *token, 3572 const union bpf_attr *attr, 3573 union bpf_attr __user *uattr) 3574 { 3575 return -EOPNOTSUPP; 3576 } 3577 3578 static inline void __dev_flush(struct list_head *flush_list) 3579 { 3580 } 3581 3582 struct xdp_frame; 3583 struct bpf_dtab_netdev; 3584 struct bpf_cpu_map_entry; 3585 3586 static inline 3587 int dev_xdp_enqueue(struct net_device *dev, struct xdp_frame *xdpf, 3588 struct net_device *dev_rx) 3589 { 3590 return 0; 3591 } 3592 3593 static inline 3594 int dev_map_enqueue(struct bpf_dtab_netdev *dst, struct xdp_frame *xdpf, 3595 struct net_device *dev_rx) 3596 { 3597 return 0; 3598 } 3599 3600 static inline 3601 int dev_map_enqueue_multi(struct xdp_frame *xdpf, struct net_device *dev_rx, 3602 struct bpf_map *map, bool exclude_ingress) 3603 { 3604 return 0; 3605 } 3606 3607 struct sk_buff; 3608 3609 static inline int dev_map_generic_redirect(struct bpf_dtab_netdev *dst, 3610 struct sk_buff *skb, 3611 const struct bpf_prog *xdp_prog) 3612 { 3613 return 0; 3614 } 3615 3616 static inline 3617 int dev_map_redirect_multi(struct net_device *dev, struct sk_buff *skb, 3618 const struct bpf_prog *xdp_prog, 3619 struct bpf_map *map, bool exclude_ingress) 3620 { 3621 return 0; 3622 } 3623 3624 static inline void __cpu_map_flush(struct list_head *flush_list) 3625 { 3626 } 3627 3628 static inline int cpu_map_enqueue(struct bpf_cpu_map_entry *rcpu, 3629 struct xdp_frame *xdpf, 3630 struct net_device *dev_rx) 3631 { 3632 return 0; 3633 } 3634 3635 static inline int cpu_map_generic_redirect(struct bpf_cpu_map_entry *rcpu, 3636 struct sk_buff *skb) 3637 { 3638 return -EOPNOTSUPP; 3639 } 3640 3641 static inline struct bpf_prog *bpf_prog_get_type_path(const char *name, 3642 enum bpf_prog_type type) 3643 { 3644 return ERR_PTR(-EOPNOTSUPP); 3645 } 3646 3647 static inline int bpf_prog_test_run_xdp(struct bpf_prog *prog, 3648 const union bpf_attr *kattr, 3649 union bpf_attr __user *uattr) 3650 { 3651 return -ENOTSUPP; 3652 } 3653 3654 static inline int bpf_prog_test_run_skb(struct bpf_prog *prog, 3655 const union bpf_attr *kattr, 3656 union bpf_attr __user *uattr) 3657 { 3658 return -ENOTSUPP; 3659 } 3660 3661 static inline int bpf_prog_test_run_tracing(struct bpf_prog *prog, 3662 const union bpf_attr *kattr, 3663 union bpf_attr __user *uattr) 3664 { 3665 return -ENOTSUPP; 3666 } 3667 3668 static inline int bpf_prog_test_run_flow_dissector(struct bpf_prog *prog, 3669 const union bpf_attr *kattr, 3670 union bpf_attr __user *uattr) 3671 { 3672 return -ENOTSUPP; 3673 } 3674 3675 static inline int bpf_prog_test_run_sk_lookup(struct bpf_prog *prog, 3676 const union bpf_attr *kattr, 3677 union bpf_attr __user *uattr) 3678 { 3679 return -ENOTSUPP; 3680 } 3681 3682 static inline void bpf_map_put(struct bpf_map *map) 3683 { 3684 } 3685 3686 static inline struct bpf_prog *bpf_prog_by_id(u32 id) 3687 { 3688 return ERR_PTR(-ENOTSUPP); 3689 } 3690 3691 static inline int btf_struct_access(struct bpf_verifier_log *log, 3692 const struct bpf_reg_state *reg, 3693 int off, int size, enum bpf_access_type atype, 3694 u32 *next_btf_id, enum bpf_type_flag *flag, 3695 const char **field_name) 3696 { 3697 return -EACCES; 3698 } 3699 3700 static inline const struct bpf_func_proto * 3701 bpf_base_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog) 3702 { 3703 return NULL; 3704 } 3705 3706 static inline void bpf_task_storage_free(struct task_struct *task) 3707 { 3708 } 3709 3710 static inline const struct btf_func_model * 3711 bpf_jit_find_kfunc_model(const struct bpf_prog *prog, 3712 const struct bpf_insn *insn) 3713 { 3714 return NULL; 3715 } 3716 3717 static inline int 3718 bpf_get_kfunc_addr(const struct bpf_prog *prog, u32 func_id, 3719 u16 desc_idx, u8 **func_addr) 3720 { 3721 return -ENOTSUPP; 3722 } 3723 3724 static inline bool unprivileged_ebpf_enabled(void) 3725 { 3726 return false; 3727 } 3728 3729 static inline bool has_current_bpf_ctx(void) 3730 { 3731 return false; 3732 } 3733 3734 static inline void bpf_prog_inc_misses_counter(struct bpf_prog *prog) 3735 { 3736 } 3737 3738 static inline void bpf_cgrp_storage_free(struct cgroup *cgroup) 3739 { 3740 } 3741 3742 static inline void bpf_dynptr_init(struct bpf_dynptr_kern *ptr, void *data, 3743 enum bpf_dynptr_type type, u32 offset, u32 size) 3744 { 3745 } 3746 3747 static inline void bpf_dynptr_set_null(struct bpf_dynptr_kern *ptr) 3748 { 3749 } 3750 3751 static inline void bpf_dynptr_set_rdonly(struct bpf_dynptr_kern *ptr) 3752 { 3753 } 3754 3755 static inline void bpf_prog_report_arena_violation(bool write, unsigned long addr, 3756 unsigned long fault_ip) 3757 { 3758 } 3759 #endif /* CONFIG_BPF_SYSCALL */ 3760 3761 static inline bool bpf_net_capable(void) 3762 { 3763 return capable(CAP_NET_ADMIN) || capable(CAP_SYS_ADMIN); 3764 } 3765 3766 static __always_inline int 3767 bpf_probe_read_kernel_common(void *dst, u32 size, const void *unsafe_ptr) 3768 { 3769 int ret = -EFAULT; 3770 3771 if (IS_ENABLED(CONFIG_BPF_EVENTS)) 3772 ret = copy_from_kernel_nofault(dst, unsafe_ptr, size); 3773 if (unlikely(ret < 0)) 3774 memset(dst, 0, size); 3775 return ret; 3776 } 3777 3778 void __bpf_free_used_btfs(struct btf_mod_pair *used_btfs, u32 len); 3779 3780 static inline struct bpf_prog *bpf_prog_get_type(u32 ufd, 3781 enum bpf_prog_type type) 3782 { 3783 return bpf_prog_get_type_dev(ufd, type, false); 3784 } 3785 3786 void __bpf_free_used_maps(struct bpf_prog_aux *aux, 3787 struct bpf_map **used_maps, u32 len); 3788 3789 bool bpf_prog_get_ok(struct bpf_prog *, enum bpf_prog_type *, bool); 3790 3791 int bpf_prog_offload_compile(struct bpf_prog *prog); 3792 void bpf_prog_dev_bound_destroy(struct bpf_prog *prog); 3793 int bpf_prog_offload_info_fill(struct bpf_prog_info *info, 3794 struct bpf_prog *prog); 3795 3796 int bpf_map_offload_info_fill(struct bpf_map_info *info, struct bpf_map *map); 3797 3798 int bpf_map_offload_lookup_elem(struct bpf_map *map, void *key, void *value); 3799 int bpf_map_offload_update_elem(struct bpf_map *map, 3800 void *key, void *value, u64 flags); 3801 int bpf_map_offload_delete_elem(struct bpf_map *map, void *key); 3802 int bpf_map_offload_get_next_key(struct bpf_map *map, 3803 void *key, void *next_key); 3804 3805 bool bpf_offload_prog_map_match(struct bpf_prog *prog, struct bpf_map *map); 3806 3807 struct bpf_offload_dev * 3808 bpf_offload_dev_create(const struct bpf_prog_offload_ops *ops, void *priv); 3809 void bpf_offload_dev_destroy(struct bpf_offload_dev *offdev); 3810 void *bpf_offload_dev_priv(struct bpf_offload_dev *offdev); 3811 int bpf_offload_dev_netdev_register(struct bpf_offload_dev *offdev, 3812 struct net_device *netdev); 3813 void bpf_offload_dev_netdev_unregister(struct bpf_offload_dev *offdev, 3814 struct net_device *netdev); 3815 bool bpf_offload_dev_match(struct bpf_prog *prog, struct net_device *netdev); 3816 3817 void unpriv_ebpf_notify(int new_state); 3818 3819 #if defined(CONFIG_NET) && defined(CONFIG_BPF_SYSCALL) 3820 int bpf_dev_bound_kfunc_check(struct bpf_verifier_log *log, 3821 struct bpf_prog_aux *prog_aux); 3822 void *bpf_dev_bound_resolve_kfunc(struct bpf_prog *prog, u32 func_id); 3823 int bpf_prog_dev_bound_init(struct bpf_prog *prog, union bpf_attr *attr); 3824 int bpf_prog_dev_bound_inherit(struct bpf_prog *new_prog, struct bpf_prog *old_prog); 3825 void bpf_prog_dev_bound_moved(struct bpf_prog *prog); 3826 void bpf_dev_bound_netdev_unregister(struct net_device *dev); 3827 3828 static inline bool bpf_prog_is_dev_bound(const struct bpf_prog_aux *aux) 3829 { 3830 return aux->dev_bound; 3831 } 3832 3833 static inline bool bpf_prog_is_offloaded(const struct bpf_prog_aux *aux) 3834 { 3835 return aux->offload_requested; 3836 } 3837 3838 bool bpf_prog_dev_bound_match(const struct bpf_prog *lhs, const struct bpf_prog *rhs); 3839 3840 static inline bool bpf_map_is_offloaded(struct bpf_map *map) 3841 { 3842 return unlikely(map->ops == &bpf_map_offload_ops); 3843 } 3844 3845 struct bpf_map *bpf_map_offload_map_alloc(union bpf_attr *attr); 3846 void bpf_map_offload_map_free(struct bpf_map *map); 3847 u64 bpf_map_offload_map_mem_usage(const struct bpf_map *map); 3848 int bpf_prog_test_run_syscall(struct bpf_prog *prog, 3849 const union bpf_attr *kattr, 3850 union bpf_attr __user *uattr); 3851 3852 int sock_map_get_from_fd(const union bpf_attr *attr, struct bpf_prog *prog); 3853 int sock_map_prog_detach(const union bpf_attr *attr, enum bpf_prog_type ptype); 3854 int sock_map_update_elem_sys(struct bpf_map *map, void *key, void *value, u64 flags); 3855 int sock_map_bpf_prog_query(const union bpf_attr *attr, 3856 union bpf_attr __user *uattr); 3857 int sock_map_link_create(const union bpf_attr *attr, struct bpf_prog *prog); 3858 3859 void sock_map_unhash(struct sock *sk); 3860 void sock_map_destroy(struct sock *sk); 3861 void sock_map_close(struct sock *sk, long timeout); 3862 #else 3863 static inline int bpf_dev_bound_kfunc_check(struct bpf_verifier_log *log, 3864 struct bpf_prog_aux *prog_aux) 3865 { 3866 return -EOPNOTSUPP; 3867 } 3868 3869 static inline void *bpf_dev_bound_resolve_kfunc(struct bpf_prog *prog, 3870 u32 func_id) 3871 { 3872 return NULL; 3873 } 3874 3875 static inline int bpf_prog_dev_bound_init(struct bpf_prog *prog, 3876 union bpf_attr *attr) 3877 { 3878 return -EOPNOTSUPP; 3879 } 3880 3881 static inline int bpf_prog_dev_bound_inherit(struct bpf_prog *new_prog, 3882 struct bpf_prog *old_prog) 3883 { 3884 return -EOPNOTSUPP; 3885 } 3886 3887 static inline void bpf_prog_dev_bound_moved(struct bpf_prog *prog) 3888 { 3889 } 3890 3891 static inline void bpf_dev_bound_netdev_unregister(struct net_device *dev) 3892 { 3893 } 3894 3895 static inline bool bpf_prog_is_dev_bound(const struct bpf_prog_aux *aux) 3896 { 3897 return false; 3898 } 3899 3900 static inline bool bpf_prog_is_offloaded(struct bpf_prog_aux *aux) 3901 { 3902 return false; 3903 } 3904 3905 static inline bool bpf_prog_dev_bound_match(const struct bpf_prog *lhs, const struct bpf_prog *rhs) 3906 { 3907 return false; 3908 } 3909 3910 static inline bool bpf_map_is_offloaded(struct bpf_map *map) 3911 { 3912 return false; 3913 } 3914 3915 static inline struct bpf_map *bpf_map_offload_map_alloc(union bpf_attr *attr) 3916 { 3917 return ERR_PTR(-EOPNOTSUPP); 3918 } 3919 3920 static inline void bpf_map_offload_map_free(struct bpf_map *map) 3921 { 3922 } 3923 3924 static inline u64 bpf_map_offload_map_mem_usage(const struct bpf_map *map) 3925 { 3926 return 0; 3927 } 3928 3929 static inline int bpf_prog_test_run_syscall(struct bpf_prog *prog, 3930 const union bpf_attr *kattr, 3931 union bpf_attr __user *uattr) 3932 { 3933 return -ENOTSUPP; 3934 } 3935 3936 #ifdef CONFIG_BPF_SYSCALL 3937 static inline int sock_map_get_from_fd(const union bpf_attr *attr, 3938 struct bpf_prog *prog) 3939 { 3940 return -EINVAL; 3941 } 3942 3943 static inline int sock_map_prog_detach(const union bpf_attr *attr, 3944 enum bpf_prog_type ptype) 3945 { 3946 return -EOPNOTSUPP; 3947 } 3948 3949 static inline int sock_map_update_elem_sys(struct bpf_map *map, void *key, void *value, 3950 u64 flags) 3951 { 3952 return -EOPNOTSUPP; 3953 } 3954 3955 static inline int sock_map_bpf_prog_query(const union bpf_attr *attr, 3956 union bpf_attr __user *uattr) 3957 { 3958 return -EINVAL; 3959 } 3960 3961 static inline int sock_map_link_create(const union bpf_attr *attr, struct bpf_prog *prog) 3962 { 3963 return -EOPNOTSUPP; 3964 } 3965 #endif /* CONFIG_BPF_SYSCALL */ 3966 #endif /* CONFIG_NET && CONFIG_BPF_SYSCALL */ 3967 3968 static __always_inline void 3969 bpf_prog_inc_misses_counters(const struct bpf_prog_array *array) 3970 { 3971 const struct bpf_prog_array_item *item; 3972 struct bpf_prog *prog; 3973 3974 if (unlikely(!array)) 3975 return; 3976 3977 item = &array->items[0]; 3978 while ((prog = READ_ONCE(item->prog))) { 3979 bpf_prog_inc_misses_counter(prog); 3980 item++; 3981 } 3982 } 3983 3984 #if defined(CONFIG_INET) && defined(CONFIG_BPF_SYSCALL) 3985 void bpf_sk_reuseport_detach(struct sock *sk); 3986 int bpf_fd_reuseport_array_lookup_elem(struct bpf_map *map, void *key, 3987 void *value); 3988 int bpf_fd_reuseport_array_update_elem(struct bpf_map *map, void *key, 3989 void *value, u64 map_flags); 3990 #else 3991 static inline void bpf_sk_reuseport_detach(struct sock *sk) 3992 { 3993 } 3994 3995 #ifdef CONFIG_BPF_SYSCALL 3996 static inline int bpf_fd_reuseport_array_lookup_elem(struct bpf_map *map, 3997 void *key, void *value) 3998 { 3999 return -EOPNOTSUPP; 4000 } 4001 4002 static inline int bpf_fd_reuseport_array_update_elem(struct bpf_map *map, 4003 void *key, void *value, 4004 u64 map_flags) 4005 { 4006 return -EOPNOTSUPP; 4007 } 4008 #endif /* CONFIG_BPF_SYSCALL */ 4009 #endif /* defined(CONFIG_INET) && defined(CONFIG_BPF_SYSCALL) */ 4010 4011 #ifdef CONFIG_KEYS 4012 struct bpf_key { 4013 struct key *key; 4014 bool has_ref; 4015 }; 4016 #endif /* CONFIG_KEYS */ 4017 4018 #if defined(CONFIG_KEYS) && defined(CONFIG_BPF_SYSCALL) 4019 struct bpf_key *bpf_lookup_user_key(s32 serial, u64 flags); 4020 struct bpf_key *bpf_lookup_system_key(u64 id); 4021 struct bpf_key *bpf_lookup_keyring(void); 4022 bool bpf_keyring_enforced(void); 4023 void bpf_key_put(struct bpf_key *bkey); 4024 int bpf_verify_pkcs7_signature(const struct bpf_dynptr *data_p, 4025 const struct bpf_dynptr *sig_p, 4026 struct bpf_key *trusted_keyring); 4027 4028 static inline s32 bpf_key_serial(const struct bpf_key *key) 4029 { 4030 return key->has_ref ? key->key->serial : 0; 4031 } 4032 #else 4033 static inline struct bpf_key *bpf_lookup_user_key(u32 serial, u64 flags) 4034 { 4035 return NULL; 4036 } 4037 4038 static inline struct bpf_key *bpf_lookup_system_key(u64 id) 4039 { 4040 return NULL; 4041 } 4042 4043 static inline struct bpf_key *bpf_lookup_keyring(void) 4044 { 4045 return NULL; 4046 } 4047 4048 static inline bool bpf_keyring_enforced(void) 4049 { 4050 return false; 4051 } 4052 4053 static inline void bpf_key_put(struct bpf_key *bkey) 4054 { 4055 } 4056 4057 static inline int bpf_verify_pkcs7_signature(const struct bpf_dynptr *data_p, 4058 const struct bpf_dynptr *sig_p, 4059 struct bpf_key *trusted_keyring) 4060 { 4061 return -EOPNOTSUPP; 4062 } 4063 4064 static inline s32 bpf_key_serial(const struct bpf_key *key) 4065 { 4066 return 0; 4067 } 4068 #endif /* defined(CONFIG_KEYS) && defined(CONFIG_BPF_SYSCALL) */ 4069 4070 /* verifier prototypes for helper functions called from eBPF programs */ 4071 extern const struct bpf_func_proto bpf_map_lookup_elem_proto; 4072 extern const struct bpf_func_proto bpf_map_update_elem_proto; 4073 extern const struct bpf_func_proto bpf_map_delete_elem_proto; 4074 extern const struct bpf_func_proto bpf_map_push_elem_proto; 4075 extern const struct bpf_func_proto bpf_map_pop_elem_proto; 4076 extern const struct bpf_func_proto bpf_map_peek_elem_proto; 4077 extern const struct bpf_func_proto bpf_map_lookup_percpu_elem_proto; 4078 4079 extern const struct bpf_func_proto bpf_get_prandom_u32_proto; 4080 extern const struct bpf_func_proto bpf_get_smp_processor_id_proto; 4081 extern const struct bpf_func_proto bpf_get_numa_node_id_proto; 4082 extern const struct bpf_func_proto bpf_tail_call_proto; 4083 extern const struct bpf_func_proto bpf_ktime_get_ns_proto; 4084 extern const struct bpf_func_proto bpf_ktime_get_boot_ns_proto; 4085 extern const struct bpf_func_proto bpf_ktime_get_tai_ns_proto; 4086 extern const struct bpf_func_proto bpf_get_current_pid_tgid_proto; 4087 extern const struct bpf_func_proto bpf_get_current_uid_gid_proto; 4088 extern const struct bpf_func_proto bpf_get_current_comm_proto; 4089 extern const struct bpf_func_proto bpf_get_stackid_proto; 4090 extern const struct bpf_func_proto bpf_get_stack_proto; 4091 extern const struct bpf_func_proto bpf_get_stack_sleepable_proto; 4092 extern const struct bpf_func_proto bpf_get_task_stack_proto; 4093 extern const struct bpf_func_proto bpf_get_task_stack_sleepable_proto; 4094 extern const struct bpf_func_proto bpf_get_stackid_proto_pe; 4095 extern const struct bpf_func_proto bpf_get_stack_proto_pe; 4096 extern const struct bpf_func_proto bpf_sock_map_update_proto; 4097 extern const struct bpf_func_proto bpf_sock_hash_update_proto; 4098 extern const struct bpf_func_proto bpf_get_current_cgroup_id_proto; 4099 extern const struct bpf_func_proto bpf_get_current_ancestor_cgroup_id_proto; 4100 extern const struct bpf_func_proto bpf_get_cgroup_classid_curr_proto; 4101 extern const struct bpf_func_proto bpf_current_task_under_cgroup_proto; 4102 extern const struct bpf_func_proto bpf_msg_redirect_hash_proto; 4103 extern const struct bpf_func_proto bpf_msg_redirect_map_proto; 4104 extern const struct bpf_func_proto bpf_sk_redirect_hash_proto; 4105 extern const struct bpf_func_proto bpf_sk_redirect_map_proto; 4106 extern const struct bpf_func_proto bpf_spin_lock_proto; 4107 extern const struct bpf_func_proto bpf_spin_unlock_proto; 4108 extern const struct bpf_func_proto bpf_get_local_storage_proto; 4109 extern const struct bpf_func_proto bpf_strtol_proto; 4110 extern const struct bpf_func_proto bpf_strtoul_proto; 4111 extern const struct bpf_func_proto bpf_tcp_sock_proto; 4112 extern const struct bpf_func_proto bpf_jiffies64_proto; 4113 extern const struct bpf_func_proto bpf_get_ns_current_pid_tgid_proto; 4114 extern const struct bpf_func_proto bpf_event_output_data_proto; 4115 extern const struct bpf_func_proto bpf_ringbuf_output_proto; 4116 extern const struct bpf_func_proto bpf_ringbuf_reserve_proto; 4117 extern const struct bpf_func_proto bpf_ringbuf_submit_proto; 4118 extern const struct bpf_func_proto bpf_ringbuf_discard_proto; 4119 extern const struct bpf_func_proto bpf_ringbuf_query_proto; 4120 extern const struct bpf_func_proto bpf_ringbuf_reserve_dynptr_proto; 4121 extern const struct bpf_func_proto bpf_ringbuf_submit_dynptr_proto; 4122 extern const struct bpf_func_proto bpf_ringbuf_discard_dynptr_proto; 4123 extern const struct bpf_func_proto bpf_skc_to_tcp6_sock_proto; 4124 extern const struct bpf_func_proto bpf_skc_to_tcp_sock_proto; 4125 extern const struct bpf_func_proto bpf_skc_to_tcp_timewait_sock_proto; 4126 extern const struct bpf_func_proto bpf_skc_to_tcp_request_sock_proto; 4127 extern const struct bpf_func_proto bpf_skc_to_udp6_sock_proto; 4128 extern const struct bpf_func_proto bpf_skc_to_unix_sock_proto; 4129 extern const struct bpf_func_proto bpf_skc_to_mptcp_sock_proto; 4130 extern const struct bpf_func_proto bpf_copy_from_user_proto; 4131 extern const struct bpf_func_proto bpf_snprintf_btf_proto; 4132 extern const struct bpf_func_proto bpf_snprintf_proto; 4133 extern const struct bpf_func_proto bpf_per_cpu_ptr_proto; 4134 extern const struct bpf_func_proto bpf_this_cpu_ptr_proto; 4135 extern const struct bpf_func_proto bpf_ktime_get_coarse_ns_proto; 4136 extern const struct bpf_func_proto bpf_sock_from_file_proto; 4137 extern const struct bpf_func_proto bpf_get_socket_ptr_cookie_proto; 4138 extern const struct bpf_func_proto bpf_task_storage_get_recur_proto; 4139 extern const struct bpf_func_proto bpf_task_storage_get_proto; 4140 extern const struct bpf_func_proto bpf_task_storage_delete_recur_proto; 4141 extern const struct bpf_func_proto bpf_task_storage_delete_proto; 4142 extern const struct bpf_func_proto bpf_for_each_map_elem_proto; 4143 extern const struct bpf_func_proto bpf_btf_find_by_name_kind_proto; 4144 extern const struct bpf_func_proto bpf_sk_setsockopt_proto; 4145 extern const struct bpf_func_proto bpf_sk_getsockopt_proto; 4146 extern const struct bpf_func_proto bpf_sk_setsockopt_nodelay_proto; 4147 extern const struct bpf_func_proto bpf_unlocked_sk_setsockopt_proto; 4148 extern const struct bpf_func_proto bpf_unlocked_sk_getsockopt_proto; 4149 extern const struct bpf_func_proto bpf_find_vma_proto; 4150 extern const struct bpf_func_proto bpf_loop_proto; 4151 extern const struct bpf_func_proto bpf_copy_from_user_task_proto; 4152 extern const struct bpf_func_proto bpf_set_retval_proto; 4153 extern const struct bpf_func_proto bpf_get_retval_proto; 4154 extern const struct bpf_func_proto bpf_user_ringbuf_drain_proto; 4155 extern const struct bpf_func_proto bpf_cgrp_storage_get_proto; 4156 extern const struct bpf_func_proto bpf_cgrp_storage_delete_proto; 4157 4158 const struct bpf_func_proto *tracing_prog_func_proto( 4159 enum bpf_func_id func_id, const struct bpf_prog *prog); 4160 4161 /* Shared helpers among cBPF and eBPF. */ 4162 void bpf_user_rnd_init_once(void); 4163 u64 bpf_user_rnd_u32(u64 r1, u64 r2, u64 r3, u64 r4, u64 r5); 4164 u64 bpf_get_raw_cpu_id(u64 r1, u64 r2, u64 r3, u64 r4, u64 r5); 4165 4166 #if defined(CONFIG_NET) 4167 bool bpf_sock_common_is_valid_access(int off, int size, 4168 enum bpf_access_type type, 4169 struct bpf_insn_access_aux *info); 4170 bool bpf_sock_is_valid_access(int off, int size, enum bpf_access_type type, 4171 struct bpf_insn_access_aux *info); 4172 u32 bpf_sock_convert_ctx_access(enum bpf_access_type type, 4173 const struct bpf_insn *si, 4174 struct bpf_insn *insn_buf, 4175 struct bpf_prog *prog, 4176 u32 *target_size); 4177 int bpf_dynptr_from_skb_rdonly(struct __sk_buff *skb, u64 flags, 4178 struct bpf_dynptr *ptr); 4179 #else 4180 static inline bool bpf_sock_common_is_valid_access(int off, int size, 4181 enum bpf_access_type type, 4182 struct bpf_insn_access_aux *info) 4183 { 4184 return false; 4185 } 4186 static inline bool bpf_sock_is_valid_access(int off, int size, 4187 enum bpf_access_type type, 4188 struct bpf_insn_access_aux *info) 4189 { 4190 return false; 4191 } 4192 static inline u32 bpf_sock_convert_ctx_access(enum bpf_access_type type, 4193 const struct bpf_insn *si, 4194 struct bpf_insn *insn_buf, 4195 struct bpf_prog *prog, 4196 u32 *target_size) 4197 { 4198 return 0; 4199 } 4200 static inline int bpf_dynptr_from_skb_rdonly(struct __sk_buff *skb, u64 flags, 4201 struct bpf_dynptr *ptr) 4202 { 4203 return -EOPNOTSUPP; 4204 } 4205 #endif 4206 4207 #ifdef CONFIG_INET 4208 struct sk_reuseport_kern { 4209 struct sk_buff *skb; 4210 struct sock *sk; 4211 struct sock *selected_sk; 4212 struct sock *migrating_sk; 4213 void *data_end; 4214 u32 hash; 4215 u32 reuseport_id; 4216 bool bind_inany; 4217 }; 4218 bool bpf_tcp_sock_is_valid_access(int off, int size, enum bpf_access_type type, 4219 struct bpf_insn_access_aux *info); 4220 4221 u32 bpf_tcp_sock_convert_ctx_access(enum bpf_access_type type, 4222 const struct bpf_insn *si, 4223 struct bpf_insn *insn_buf, 4224 struct bpf_prog *prog, 4225 u32 *target_size); 4226 4227 bool bpf_xdp_sock_is_valid_access(int off, int size, enum bpf_access_type type, 4228 struct bpf_insn_access_aux *info); 4229 4230 u32 bpf_xdp_sock_convert_ctx_access(enum bpf_access_type type, 4231 const struct bpf_insn *si, 4232 struct bpf_insn *insn_buf, 4233 struct bpf_prog *prog, 4234 u32 *target_size); 4235 #else 4236 static inline bool bpf_tcp_sock_is_valid_access(int off, int size, 4237 enum bpf_access_type type, 4238 struct bpf_insn_access_aux *info) 4239 { 4240 return false; 4241 } 4242 4243 static inline u32 bpf_tcp_sock_convert_ctx_access(enum bpf_access_type type, 4244 const struct bpf_insn *si, 4245 struct bpf_insn *insn_buf, 4246 struct bpf_prog *prog, 4247 u32 *target_size) 4248 { 4249 return 0; 4250 } 4251 static inline bool bpf_xdp_sock_is_valid_access(int off, int size, 4252 enum bpf_access_type type, 4253 struct bpf_insn_access_aux *info) 4254 { 4255 return false; 4256 } 4257 4258 static inline u32 bpf_xdp_sock_convert_ctx_access(enum bpf_access_type type, 4259 const struct bpf_insn *si, 4260 struct bpf_insn *insn_buf, 4261 struct bpf_prog *prog, 4262 u32 *target_size) 4263 { 4264 return 0; 4265 } 4266 #endif /* CONFIG_INET */ 4267 4268 enum bpf_text_poke_type { 4269 BPF_MOD_NOP, 4270 BPF_MOD_CALL, 4271 BPF_MOD_JUMP, 4272 }; 4273 4274 int bpf_arch_text_poke(void *ip, enum bpf_text_poke_type old_t, 4275 enum bpf_text_poke_type new_t, void *old_addr, 4276 void *new_addr); 4277 4278 void bpf_arch_poke_desc_update(struct bpf_jit_poke_descriptor *poke, 4279 struct bpf_prog *new, struct bpf_prog *old); 4280 4281 void *bpf_arch_text_copy(void *dst, void *src, size_t len); 4282 int bpf_arch_text_invalidate(void *dst, size_t len); 4283 4284 struct btf_id_set; 4285 bool btf_id_set_contains(const struct btf_id_set *set, u32 id); 4286 4287 #define MAX_BPRINTF_VARARGS 12 4288 #define MAX_BPRINTF_BUF 1024 4289 4290 /* Per-cpu temp buffers used by printf-like helpers to store the bprintf binary 4291 * arguments representation. 4292 */ 4293 #define MAX_BPRINTF_BIN_ARGS 512 4294 4295 struct bpf_bprintf_buffers { 4296 char bin_args[MAX_BPRINTF_BIN_ARGS]; 4297 char buf[MAX_BPRINTF_BUF]; 4298 }; 4299 4300 struct bpf_bprintf_data { 4301 u32 *bin_args; 4302 char *buf; 4303 bool get_bin_args; 4304 bool get_buf; 4305 }; 4306 4307 int bpf_bprintf_prepare(const char *fmt, u32 fmt_size, const u64 *raw_args, 4308 u32 num_args, struct bpf_bprintf_data *data); 4309 void bpf_bprintf_cleanup(struct bpf_bprintf_data *data); 4310 int bpf_try_get_buffers(struct bpf_bprintf_buffers **bufs); 4311 void bpf_put_buffers(void); 4312 4313 int bpf_prog_stream_init(struct bpf_prog *prog, gfp_t gfp_extra_flags); 4314 void bpf_prog_stream_free(struct bpf_prog *prog); 4315 int bpf_prog_stream_read(struct bpf_prog *prog, enum bpf_stream_id stream_id, void __user *buf, u32 len); 4316 int bpf_prog_stream_new_fd(struct bpf_prog *prog, enum bpf_stream_id stream_id, u32 flags); 4317 void bpf_stream_stage_init(struct bpf_stream_stage *ss); 4318 void bpf_stream_stage_free(struct bpf_stream_stage *ss); 4319 __printf(2, 3) 4320 int bpf_stream_stage_printk(struct bpf_stream_stage *ss, const char *fmt, ...); 4321 int bpf_stream_stage_commit(struct bpf_stream_stage *ss, struct bpf_prog *prog, 4322 enum bpf_stream_id stream_id); 4323 int bpf_stream_stage_dump_stack(struct bpf_stream_stage *ss); 4324 4325 #define bpf_stream_printk(ss, ...) bpf_stream_stage_printk(&ss, __VA_ARGS__) 4326 #define bpf_stream_dump_stack(ss) bpf_stream_stage_dump_stack(&ss) 4327 4328 #define bpf_stream_stage(ss, prog, stream_id, expr) \ 4329 ({ \ 4330 bpf_stream_stage_init(&ss); \ 4331 (expr); \ 4332 bpf_stream_stage_commit(&ss, prog, stream_id); \ 4333 bpf_stream_stage_free(&ss); \ 4334 }) 4335 4336 #ifdef CONFIG_BPF_LSM 4337 void bpf_cgroup_atype_get(u32 attach_btf_id, int cgroup_atype); 4338 void bpf_cgroup_atype_put(int cgroup_atype); 4339 #else 4340 static inline void bpf_cgroup_atype_get(u32 attach_btf_id, int cgroup_atype) {} 4341 static inline void bpf_cgroup_atype_put(int cgroup_atype) {} 4342 #endif /* CONFIG_BPF_LSM */ 4343 4344 static inline bool type_is_alloc(u32 type) 4345 { 4346 return type & MEM_ALLOC; 4347 } 4348 4349 static inline gfp_t bpf_memcg_flags(gfp_t flags) 4350 { 4351 if (memcg_bpf_enabled()) 4352 return flags | __GFP_ACCOUNT; 4353 return flags; 4354 } 4355 4356 static inline bool bpf_is_subprog(const struct bpf_prog *prog) 4357 { 4358 return prog->aux->func_idx != 0; 4359 } 4360 4361 const struct bpf_line_info *bpf_find_linfo(const struct bpf_prog *prog, u32 insn_off); 4362 struct bpf_linfo_source { 4363 const char *file; 4364 const char *line; 4365 u32 file_name_off; 4366 int line_num; 4367 int line_col; 4368 }; 4369 4370 void bpf_get_linfo_source(struct btf *btf, const struct bpf_line_info *linfo, 4371 struct bpf_linfo_source *src); 4372 int bpf_prog_get_file_line(struct bpf_prog *prog, unsigned long ip, const char **filep, 4373 const char **linep, int *nump); 4374 struct bpf_prog *bpf_prog_find_from_stack(void); 4375 4376 int bpf_insn_array_init(struct bpf_map *map, const struct bpf_prog *prog); 4377 int bpf_insn_array_ready(struct bpf_map *map); 4378 void bpf_insn_array_release(struct bpf_map *map); 4379 void bpf_insn_array_adjust(struct bpf_map *map, u32 first, u32 len); 4380 void bpf_insn_array_adjust_after_remove(struct bpf_map *map, u32 off, u32 len); 4381 4382 #ifdef CONFIG_BPF_SYSCALL 4383 void bpf_prog_update_insn_ptrs(struct bpf_prog *prog, u32 *offsets, void *image); 4384 #else 4385 static inline void 4386 bpf_prog_update_insn_ptrs(struct bpf_prog *prog, u32 *offsets, void *image) 4387 { 4388 } 4389 #endif 4390 4391 static inline bool bpf_map_is_percpu_map(enum bpf_map_type map_type) 4392 { 4393 switch (map_type) { 4394 case BPF_MAP_TYPE_PERCPU_ARRAY: 4395 case BPF_MAP_TYPE_PERCPU_HASH: 4396 case BPF_MAP_TYPE_LRU_PERCPU_HASH: 4397 case BPF_MAP_TYPE_PERCPU_CGROUP_STORAGE: 4398 return true; 4399 default: 4400 return false; 4401 } 4402 } 4403 4404 #define BPF_EXIST_FLAGS (BPF_EXIST | BPF_NOEXIST) 4405 #define BPF_CPU_FLAGS (BPF_F_CPU | BPF_F_ALL_CPUS) 4406 4407 static inline int bpf_map_check_op_flags(struct bpf_map *map, u64 flags, u64 allowed_flags) 4408 { 4409 u32 cpu; 4410 4411 if ((u32)flags & ~allowed_flags) 4412 return -EINVAL; 4413 4414 if ((flags & BPF_F_LOCK) && !btf_record_has_field(map->record, BPF_SPIN_LOCK)) 4415 return -EINVAL; 4416 4417 if (!(flags & BPF_F_CPU) && flags >> 32) 4418 return -EINVAL; 4419 4420 if (flags & (BPF_F_CPU | BPF_F_ALL_CPUS)) { 4421 if (!bpf_map_is_percpu_map(map->map_type)) 4422 return -EINVAL; 4423 if ((flags & BPF_F_CPU) && (flags & BPF_F_ALL_CPUS)) 4424 return -EINVAL; 4425 4426 cpu = flags >> 32; 4427 if ((flags & BPF_F_CPU) && (cpu >= nr_cpu_ids || !cpu_possible(cpu))) 4428 return -ERANGE; 4429 } 4430 4431 return 0; 4432 } 4433 4434 #endif /* _LINUX_BPF_H */ 4435