1 // SPDX-License-Identifier: GPL-2.0-only 2 /* Copyright (c) 2011-2014 PLUMgrid, http://plumgrid.com 3 * Copyright (c) 2016,2017 Facebook 4 */ 5 #include <linux/bpf.h> 6 #include <linux/btf.h> 7 #include <linux/err.h> 8 #include <linux/slab.h> 9 #include <linux/mm.h> 10 #include <linux/filter.h> 11 #include <linux/perf_event.h> 12 #include <uapi/linux/btf.h> 13 #include <linux/rcupdate_trace.h> 14 #include <linux/btf_ids.h> 15 16 #include "map_in_map.h" 17 18 #define ARRAY_CREATE_FLAG_MASK \ 19 (BPF_F_NUMA_NODE | BPF_F_MMAPABLE | BPF_F_ACCESS_MASK | \ 20 BPF_F_PRESERVE_ELEMS | BPF_F_INNER_MAP) 21 22 static void bpf_array_free_percpu(struct bpf_array *array) 23 { 24 int i; 25 26 for (i = 0; i < array->map.max_entries; i++) { 27 free_percpu(array->pptrs[i]); 28 cond_resched(); 29 } 30 } 31 32 static int bpf_array_alloc_percpu(struct bpf_array *array) 33 { 34 void __percpu *ptr; 35 int i; 36 37 for (i = 0; i < array->map.max_entries; i++) { 38 ptr = bpf_map_alloc_percpu(&array->map, array->elem_size, 8, 39 GFP_USER | __GFP_NOWARN); 40 if (!ptr) { 41 bpf_array_free_percpu(array); 42 return -ENOMEM; 43 } 44 array->pptrs[i] = ptr; 45 cond_resched(); 46 } 47 48 return 0; 49 } 50 51 /* Called from syscall */ 52 int array_map_alloc_check(union bpf_attr *attr) 53 { 54 bool percpu = attr->map_type == BPF_MAP_TYPE_PERCPU_ARRAY; 55 int numa_node = bpf_map_attr_numa_node(attr); 56 57 /* check sanity of attributes */ 58 if (attr->max_entries == 0 || attr->key_size != 4 || 59 attr->value_size == 0 || 60 attr->map_flags & ~ARRAY_CREATE_FLAG_MASK || 61 !bpf_map_flags_access_ok(attr->map_flags) || 62 (percpu && numa_node != NUMA_NO_NODE)) 63 return -EINVAL; 64 65 if (attr->map_type != BPF_MAP_TYPE_ARRAY && 66 attr->map_flags & (BPF_F_MMAPABLE | BPF_F_INNER_MAP)) 67 return -EINVAL; 68 69 if (attr->map_type != BPF_MAP_TYPE_PERF_EVENT_ARRAY && 70 attr->map_flags & BPF_F_PRESERVE_ELEMS) 71 return -EINVAL; 72 73 /* avoid overflow on round_up(map->value_size) */ 74 if (attr->value_size > INT_MAX) 75 return -E2BIG; 76 /* percpu map value size is bound by PCPU_MIN_UNIT_SIZE */ 77 if (percpu && round_up(attr->value_size, 8) > PCPU_MIN_UNIT_SIZE) 78 return -E2BIG; 79 80 return 0; 81 } 82 83 static struct bpf_map *array_map_alloc(union bpf_attr *attr) 84 { 85 bool percpu = attr->map_type == BPF_MAP_TYPE_PERCPU_ARRAY; 86 int numa_node = bpf_map_attr_numa_node(attr); 87 u32 elem_size, index_mask, max_entries; 88 bool bypass_spec_v1 = bpf_bypass_spec_v1(NULL); 89 u64 array_size, mask64; 90 struct bpf_array *array; 91 92 elem_size = round_up(attr->value_size, 8); 93 94 max_entries = attr->max_entries; 95 96 /* On 32 bit archs roundup_pow_of_two() with max_entries that has 97 * upper most bit set in u32 space is undefined behavior due to 98 * resulting 1U << 32, so do it manually here in u64 space. 99 */ 100 mask64 = fls_long(max_entries - 1); 101 mask64 = 1ULL << mask64; 102 mask64 -= 1; 103 104 index_mask = mask64; 105 if (!bypass_spec_v1) { 106 /* round up array size to nearest power of 2, 107 * since cpu will speculate within index_mask limits 108 */ 109 max_entries = index_mask + 1; 110 /* Check for overflows. */ 111 if (max_entries < attr->max_entries) 112 return ERR_PTR(-E2BIG); 113 } 114 115 array_size = sizeof(*array); 116 if (percpu) { 117 array_size += (u64) max_entries * sizeof(void *); 118 } else { 119 /* rely on vmalloc() to return page-aligned memory and 120 * ensure array->value is exactly page-aligned 121 */ 122 if (attr->map_flags & BPF_F_MMAPABLE) { 123 array_size = PAGE_ALIGN(array_size); 124 array_size += PAGE_ALIGN((u64) max_entries * elem_size); 125 } else { 126 array_size += (u64) max_entries * elem_size; 127 } 128 } 129 130 /* allocate all map elements and zero-initialize them */ 131 if (attr->map_flags & BPF_F_MMAPABLE) { 132 void *data; 133 134 /* kmalloc'ed memory can't be mmap'ed, use explicit vmalloc */ 135 data = bpf_map_area_mmapable_alloc(array_size, numa_node); 136 if (!data) 137 return ERR_PTR(-ENOMEM); 138 array = data + PAGE_ALIGN(sizeof(struct bpf_array)) 139 - offsetof(struct bpf_array, value); 140 } else { 141 array = bpf_map_area_alloc(array_size, numa_node); 142 } 143 if (!array) 144 return ERR_PTR(-ENOMEM); 145 array->index_mask = index_mask; 146 array->map.bypass_spec_v1 = bypass_spec_v1; 147 148 /* copy mandatory map attributes */ 149 bpf_map_init_from_attr(&array->map, attr); 150 array->elem_size = elem_size; 151 152 if (percpu && bpf_array_alloc_percpu(array)) { 153 bpf_map_area_free(array); 154 return ERR_PTR(-ENOMEM); 155 } 156 157 return &array->map; 158 } 159 160 static void *array_map_elem_ptr(struct bpf_array* array, u32 index) 161 { 162 return array->value + (u64)array->elem_size * index; 163 } 164 165 /* Called from syscall or from eBPF program */ 166 static void *array_map_lookup_elem(struct bpf_map *map, void *key) 167 { 168 struct bpf_array *array = container_of(map, struct bpf_array, map); 169 u32 index = *(u32 *)key; 170 171 if (unlikely(index >= array->map.max_entries)) 172 return NULL; 173 174 return array->value + (u64)array->elem_size * (index & array->index_mask); 175 } 176 177 static int array_map_direct_value_addr(const struct bpf_map *map, u64 *imm, 178 u32 off) 179 { 180 struct bpf_array *array = container_of(map, struct bpf_array, map); 181 182 if (map->max_entries != 1) 183 return -ENOTSUPP; 184 if (off >= map->value_size) 185 return -EINVAL; 186 187 *imm = (unsigned long)array->value; 188 return 0; 189 } 190 191 static int array_map_direct_value_meta(const struct bpf_map *map, u64 imm, 192 u32 *off) 193 { 194 struct bpf_array *array = container_of(map, struct bpf_array, map); 195 u64 base = (unsigned long)array->value; 196 u64 range = array->elem_size; 197 198 if (map->max_entries != 1) 199 return -ENOTSUPP; 200 if (imm < base || imm >= base + range) 201 return -ENOENT; 202 203 *off = imm - base; 204 return 0; 205 } 206 207 /* emit BPF instructions equivalent to C code of array_map_lookup_elem() */ 208 static int array_map_gen_lookup(struct bpf_map *map, struct bpf_insn *insn_buf) 209 { 210 struct bpf_array *array = container_of(map, struct bpf_array, map); 211 struct bpf_insn *insn = insn_buf; 212 u32 elem_size = array->elem_size; 213 const int ret = BPF_REG_0; 214 const int map_ptr = BPF_REG_1; 215 const int index = BPF_REG_2; 216 217 if (map->map_flags & BPF_F_INNER_MAP) 218 return -EOPNOTSUPP; 219 220 *insn++ = BPF_ALU64_IMM(BPF_ADD, map_ptr, offsetof(struct bpf_array, value)); 221 *insn++ = BPF_LDX_MEM(BPF_W, ret, index, 0); 222 if (!map->bypass_spec_v1) { 223 *insn++ = BPF_JMP_IMM(BPF_JGE, ret, map->max_entries, 4); 224 *insn++ = BPF_ALU32_IMM(BPF_AND, ret, array->index_mask); 225 } else { 226 *insn++ = BPF_JMP_IMM(BPF_JGE, ret, map->max_entries, 3); 227 } 228 229 if (is_power_of_2(elem_size)) { 230 *insn++ = BPF_ALU64_IMM(BPF_LSH, ret, ilog2(elem_size)); 231 } else { 232 *insn++ = BPF_ALU64_IMM(BPF_MUL, ret, elem_size); 233 } 234 *insn++ = BPF_ALU64_REG(BPF_ADD, ret, map_ptr); 235 *insn++ = BPF_JMP_IMM(BPF_JA, 0, 0, 1); 236 *insn++ = BPF_MOV64_IMM(ret, 0); 237 return insn - insn_buf; 238 } 239 240 /* Called from eBPF program */ 241 static void *percpu_array_map_lookup_elem(struct bpf_map *map, void *key) 242 { 243 struct bpf_array *array = container_of(map, struct bpf_array, map); 244 u32 index = *(u32 *)key; 245 246 if (unlikely(index >= array->map.max_entries)) 247 return NULL; 248 249 return this_cpu_ptr(array->pptrs[index & array->index_mask]); 250 } 251 252 /* emit BPF instructions equivalent to C code of percpu_array_map_lookup_elem() */ 253 static int percpu_array_map_gen_lookup(struct bpf_map *map, struct bpf_insn *insn_buf) 254 { 255 struct bpf_array *array = container_of(map, struct bpf_array, map); 256 struct bpf_insn *insn = insn_buf; 257 258 if (!bpf_jit_supports_percpu_insn()) 259 return -EOPNOTSUPP; 260 261 if (map->map_flags & BPF_F_INNER_MAP) 262 return -EOPNOTSUPP; 263 264 BUILD_BUG_ON(offsetof(struct bpf_array, map) != 0); 265 *insn++ = BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, offsetof(struct bpf_array, pptrs)); 266 267 *insn++ = BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_2, 0); 268 if (!map->bypass_spec_v1) { 269 *insn++ = BPF_JMP_IMM(BPF_JGE, BPF_REG_0, map->max_entries, 6); 270 *insn++ = BPF_ALU32_IMM(BPF_AND, BPF_REG_0, array->index_mask); 271 } else { 272 *insn++ = BPF_JMP_IMM(BPF_JGE, BPF_REG_0, map->max_entries, 5); 273 } 274 275 *insn++ = BPF_ALU64_IMM(BPF_LSH, BPF_REG_0, 3); 276 *insn++ = BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1); 277 *insn++ = BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_0, 0); 278 *insn++ = BPF_MOV64_PERCPU_REG(BPF_REG_0, BPF_REG_0); 279 *insn++ = BPF_JMP_IMM(BPF_JA, 0, 0, 1); 280 *insn++ = BPF_MOV64_IMM(BPF_REG_0, 0); 281 return insn - insn_buf; 282 } 283 284 static void *percpu_array_map_lookup_percpu_elem(struct bpf_map *map, void *key, u32 cpu) 285 { 286 struct bpf_array *array = container_of(map, struct bpf_array, map); 287 u32 index = *(u32 *)key; 288 289 if (cpu >= nr_cpu_ids) 290 return NULL; 291 292 if (unlikely(index >= array->map.max_entries)) 293 return NULL; 294 295 return per_cpu_ptr(array->pptrs[index & array->index_mask], cpu); 296 } 297 298 int bpf_percpu_array_copy(struct bpf_map *map, void *key, void *value) 299 { 300 struct bpf_array *array = container_of(map, struct bpf_array, map); 301 u32 index = *(u32 *)key; 302 void __percpu *pptr; 303 int cpu, off = 0; 304 u32 size; 305 306 if (unlikely(index >= array->map.max_entries)) 307 return -ENOENT; 308 309 /* per_cpu areas are zero-filled and bpf programs can only 310 * access 'value_size' of them, so copying rounded areas 311 * will not leak any kernel data 312 */ 313 size = array->elem_size; 314 rcu_read_lock(); 315 pptr = array->pptrs[index & array->index_mask]; 316 for_each_possible_cpu(cpu) { 317 copy_map_value_long(map, value + off, per_cpu_ptr(pptr, cpu)); 318 check_and_init_map_value(map, value + off); 319 off += size; 320 } 321 rcu_read_unlock(); 322 return 0; 323 } 324 325 /* Called from syscall */ 326 static int array_map_get_next_key(struct bpf_map *map, void *key, void *next_key) 327 { 328 struct bpf_array *array = container_of(map, struct bpf_array, map); 329 u32 index = key ? *(u32 *)key : U32_MAX; 330 u32 *next = (u32 *)next_key; 331 332 if (index >= array->map.max_entries) { 333 *next = 0; 334 return 0; 335 } 336 337 if (index == array->map.max_entries - 1) 338 return -ENOENT; 339 340 *next = index + 1; 341 return 0; 342 } 343 344 /* Called from syscall or from eBPF program */ 345 static long array_map_update_elem(struct bpf_map *map, void *key, void *value, 346 u64 map_flags) 347 { 348 struct bpf_array *array = container_of(map, struct bpf_array, map); 349 u32 index = *(u32 *)key; 350 char *val; 351 352 if (unlikely((map_flags & ~BPF_F_LOCK) > BPF_EXIST)) 353 /* unknown flags */ 354 return -EINVAL; 355 356 if (unlikely(index >= array->map.max_entries)) 357 /* all elements were pre-allocated, cannot insert a new one */ 358 return -E2BIG; 359 360 if (unlikely(map_flags & BPF_NOEXIST)) 361 /* all elements already exist */ 362 return -EEXIST; 363 364 if (unlikely((map_flags & BPF_F_LOCK) && 365 !btf_record_has_field(map->record, BPF_SPIN_LOCK))) 366 return -EINVAL; 367 368 if (array->map.map_type == BPF_MAP_TYPE_PERCPU_ARRAY) { 369 val = this_cpu_ptr(array->pptrs[index & array->index_mask]); 370 copy_map_value(map, val, value); 371 bpf_obj_free_fields(array->map.record, val); 372 } else { 373 val = array->value + 374 (u64)array->elem_size * (index & array->index_mask); 375 if (map_flags & BPF_F_LOCK) 376 copy_map_value_locked(map, val, value, false); 377 else 378 copy_map_value(map, val, value); 379 bpf_obj_free_fields(array->map.record, val); 380 } 381 return 0; 382 } 383 384 int bpf_percpu_array_update(struct bpf_map *map, void *key, void *value, 385 u64 map_flags) 386 { 387 struct bpf_array *array = container_of(map, struct bpf_array, map); 388 u32 index = *(u32 *)key; 389 void __percpu *pptr; 390 int cpu, off = 0; 391 u32 size; 392 393 if (unlikely(map_flags > BPF_EXIST)) 394 /* unknown flags */ 395 return -EINVAL; 396 397 if (unlikely(index >= array->map.max_entries)) 398 /* all elements were pre-allocated, cannot insert a new one */ 399 return -E2BIG; 400 401 if (unlikely(map_flags == BPF_NOEXIST)) 402 /* all elements already exist */ 403 return -EEXIST; 404 405 /* the user space will provide round_up(value_size, 8) bytes that 406 * will be copied into per-cpu area. bpf programs can only access 407 * value_size of it. During lookup the same extra bytes will be 408 * returned or zeros which were zero-filled by percpu_alloc, 409 * so no kernel data leaks possible 410 */ 411 size = array->elem_size; 412 rcu_read_lock(); 413 pptr = array->pptrs[index & array->index_mask]; 414 for_each_possible_cpu(cpu) { 415 copy_map_value_long(map, per_cpu_ptr(pptr, cpu), value + off); 416 bpf_obj_free_fields(array->map.record, per_cpu_ptr(pptr, cpu)); 417 off += size; 418 } 419 rcu_read_unlock(); 420 return 0; 421 } 422 423 /* Called from syscall or from eBPF program */ 424 static long array_map_delete_elem(struct bpf_map *map, void *key) 425 { 426 return -EINVAL; 427 } 428 429 static void *array_map_vmalloc_addr(struct bpf_array *array) 430 { 431 return (void *)round_down((unsigned long)array, PAGE_SIZE); 432 } 433 434 static void array_map_free_timers_wq(struct bpf_map *map) 435 { 436 struct bpf_array *array = container_of(map, struct bpf_array, map); 437 int i; 438 439 /* We don't reset or free fields other than timer and workqueue 440 * on uref dropping to zero. 441 */ 442 if (btf_record_has_field(map->record, BPF_TIMER | BPF_WORKQUEUE)) { 443 for (i = 0; i < array->map.max_entries; i++) { 444 if (btf_record_has_field(map->record, BPF_TIMER)) 445 bpf_obj_free_timer(map->record, array_map_elem_ptr(array, i)); 446 if (btf_record_has_field(map->record, BPF_WORKQUEUE)) 447 bpf_obj_free_workqueue(map->record, array_map_elem_ptr(array, i)); 448 } 449 } 450 } 451 452 /* Called when map->refcnt goes to zero, either from workqueue or from syscall */ 453 static void array_map_free(struct bpf_map *map) 454 { 455 struct bpf_array *array = container_of(map, struct bpf_array, map); 456 int i; 457 458 if (!IS_ERR_OR_NULL(map->record)) { 459 if (array->map.map_type == BPF_MAP_TYPE_PERCPU_ARRAY) { 460 for (i = 0; i < array->map.max_entries; i++) { 461 void __percpu *pptr = array->pptrs[i & array->index_mask]; 462 int cpu; 463 464 for_each_possible_cpu(cpu) { 465 bpf_obj_free_fields(map->record, per_cpu_ptr(pptr, cpu)); 466 cond_resched(); 467 } 468 } 469 } else { 470 for (i = 0; i < array->map.max_entries; i++) 471 bpf_obj_free_fields(map->record, array_map_elem_ptr(array, i)); 472 } 473 } 474 475 if (array->map.map_type == BPF_MAP_TYPE_PERCPU_ARRAY) 476 bpf_array_free_percpu(array); 477 478 if (array->map.map_flags & BPF_F_MMAPABLE) 479 bpf_map_area_free(array_map_vmalloc_addr(array)); 480 else 481 bpf_map_area_free(array); 482 } 483 484 static void array_map_seq_show_elem(struct bpf_map *map, void *key, 485 struct seq_file *m) 486 { 487 void *value; 488 489 rcu_read_lock(); 490 491 value = array_map_lookup_elem(map, key); 492 if (!value) { 493 rcu_read_unlock(); 494 return; 495 } 496 497 if (map->btf_key_type_id) 498 seq_printf(m, "%u: ", *(u32 *)key); 499 btf_type_seq_show(map->btf, map->btf_value_type_id, value, m); 500 seq_putc(m, '\n'); 501 502 rcu_read_unlock(); 503 } 504 505 static void percpu_array_map_seq_show_elem(struct bpf_map *map, void *key, 506 struct seq_file *m) 507 { 508 struct bpf_array *array = container_of(map, struct bpf_array, map); 509 u32 index = *(u32 *)key; 510 void __percpu *pptr; 511 int cpu; 512 513 rcu_read_lock(); 514 515 seq_printf(m, "%u: {\n", *(u32 *)key); 516 pptr = array->pptrs[index & array->index_mask]; 517 for_each_possible_cpu(cpu) { 518 seq_printf(m, "\tcpu%d: ", cpu); 519 btf_type_seq_show(map->btf, map->btf_value_type_id, 520 per_cpu_ptr(pptr, cpu), m); 521 seq_putc(m, '\n'); 522 } 523 seq_puts(m, "}\n"); 524 525 rcu_read_unlock(); 526 } 527 528 static int array_map_check_btf(const struct bpf_map *map, 529 const struct btf *btf, 530 const struct btf_type *key_type, 531 const struct btf_type *value_type) 532 { 533 /* One exception for keyless BTF: .bss/.data/.rodata map */ 534 if (btf_type_is_void(key_type)) { 535 if (map->map_type != BPF_MAP_TYPE_ARRAY || 536 map->max_entries != 1) 537 return -EINVAL; 538 539 if (BTF_INFO_KIND(value_type->info) != BTF_KIND_DATASEC) 540 return -EINVAL; 541 542 return 0; 543 } 544 545 /* 546 * Bpf array can only take a u32 key. This check makes sure 547 * that the btf matches the attr used during map_create. 548 */ 549 if (!btf_type_is_i32(key_type)) 550 return -EINVAL; 551 552 return 0; 553 } 554 555 static int array_map_mmap(struct bpf_map *map, struct vm_area_struct *vma) 556 { 557 struct bpf_array *array = container_of(map, struct bpf_array, map); 558 pgoff_t pgoff = PAGE_ALIGN(sizeof(*array)) >> PAGE_SHIFT; 559 560 if (!(map->map_flags & BPF_F_MMAPABLE)) 561 return -EINVAL; 562 563 if (vma->vm_pgoff * PAGE_SIZE + (vma->vm_end - vma->vm_start) > 564 PAGE_ALIGN((u64)array->map.max_entries * array->elem_size)) 565 return -EINVAL; 566 567 return remap_vmalloc_range(vma, array_map_vmalloc_addr(array), 568 vma->vm_pgoff + pgoff); 569 } 570 571 static bool array_map_meta_equal(const struct bpf_map *meta0, 572 const struct bpf_map *meta1) 573 { 574 if (!bpf_map_meta_equal(meta0, meta1)) 575 return false; 576 return meta0->map_flags & BPF_F_INNER_MAP ? true : 577 meta0->max_entries == meta1->max_entries; 578 } 579 580 struct bpf_iter_seq_array_map_info { 581 struct bpf_map *map; 582 void *percpu_value_buf; 583 u32 index; 584 }; 585 586 static void *bpf_array_map_seq_start(struct seq_file *seq, loff_t *pos) 587 { 588 struct bpf_iter_seq_array_map_info *info = seq->private; 589 struct bpf_map *map = info->map; 590 struct bpf_array *array; 591 u32 index; 592 593 if (info->index >= map->max_entries) 594 return NULL; 595 596 if (*pos == 0) 597 ++*pos; 598 array = container_of(map, struct bpf_array, map); 599 index = info->index & array->index_mask; 600 if (info->percpu_value_buf) 601 return (void *)(uintptr_t)array->pptrs[index]; 602 return array_map_elem_ptr(array, index); 603 } 604 605 static void *bpf_array_map_seq_next(struct seq_file *seq, void *v, loff_t *pos) 606 { 607 struct bpf_iter_seq_array_map_info *info = seq->private; 608 struct bpf_map *map = info->map; 609 struct bpf_array *array; 610 u32 index; 611 612 ++*pos; 613 ++info->index; 614 if (info->index >= map->max_entries) 615 return NULL; 616 617 array = container_of(map, struct bpf_array, map); 618 index = info->index & array->index_mask; 619 if (info->percpu_value_buf) 620 return (void *)(uintptr_t)array->pptrs[index]; 621 return array_map_elem_ptr(array, index); 622 } 623 624 static int __bpf_array_map_seq_show(struct seq_file *seq, void *v) 625 { 626 struct bpf_iter_seq_array_map_info *info = seq->private; 627 struct bpf_iter__bpf_map_elem ctx = {}; 628 struct bpf_map *map = info->map; 629 struct bpf_array *array = container_of(map, struct bpf_array, map); 630 struct bpf_iter_meta meta; 631 struct bpf_prog *prog; 632 int off = 0, cpu = 0; 633 void __percpu *pptr; 634 u32 size; 635 636 meta.seq = seq; 637 prog = bpf_iter_get_info(&meta, v == NULL); 638 if (!prog) 639 return 0; 640 641 ctx.meta = &meta; 642 ctx.map = info->map; 643 if (v) { 644 ctx.key = &info->index; 645 646 if (!info->percpu_value_buf) { 647 ctx.value = v; 648 } else { 649 pptr = (void __percpu *)(uintptr_t)v; 650 size = array->elem_size; 651 for_each_possible_cpu(cpu) { 652 copy_map_value_long(map, info->percpu_value_buf + off, 653 per_cpu_ptr(pptr, cpu)); 654 check_and_init_map_value(map, info->percpu_value_buf + off); 655 off += size; 656 } 657 ctx.value = info->percpu_value_buf; 658 } 659 } 660 661 return bpf_iter_run_prog(prog, &ctx); 662 } 663 664 static int bpf_array_map_seq_show(struct seq_file *seq, void *v) 665 { 666 return __bpf_array_map_seq_show(seq, v); 667 } 668 669 static void bpf_array_map_seq_stop(struct seq_file *seq, void *v) 670 { 671 if (!v) 672 (void)__bpf_array_map_seq_show(seq, NULL); 673 } 674 675 static int bpf_iter_init_array_map(void *priv_data, 676 struct bpf_iter_aux_info *aux) 677 { 678 struct bpf_iter_seq_array_map_info *seq_info = priv_data; 679 struct bpf_map *map = aux->map; 680 struct bpf_array *array = container_of(map, struct bpf_array, map); 681 void *value_buf; 682 u32 buf_size; 683 684 if (map->map_type == BPF_MAP_TYPE_PERCPU_ARRAY) { 685 buf_size = array->elem_size * num_possible_cpus(); 686 value_buf = kmalloc(buf_size, GFP_USER | __GFP_NOWARN); 687 if (!value_buf) 688 return -ENOMEM; 689 690 seq_info->percpu_value_buf = value_buf; 691 } 692 693 /* bpf_iter_attach_map() acquires a map uref, and the uref may be 694 * released before or in the middle of iterating map elements, so 695 * acquire an extra map uref for iterator. 696 */ 697 bpf_map_inc_with_uref(map); 698 seq_info->map = map; 699 return 0; 700 } 701 702 static void bpf_iter_fini_array_map(void *priv_data) 703 { 704 struct bpf_iter_seq_array_map_info *seq_info = priv_data; 705 706 bpf_map_put_with_uref(seq_info->map); 707 kfree(seq_info->percpu_value_buf); 708 } 709 710 static const struct seq_operations bpf_array_map_seq_ops = { 711 .start = bpf_array_map_seq_start, 712 .next = bpf_array_map_seq_next, 713 .stop = bpf_array_map_seq_stop, 714 .show = bpf_array_map_seq_show, 715 }; 716 717 static const struct bpf_iter_seq_info iter_seq_info = { 718 .seq_ops = &bpf_array_map_seq_ops, 719 .init_seq_private = bpf_iter_init_array_map, 720 .fini_seq_private = bpf_iter_fini_array_map, 721 .seq_priv_size = sizeof(struct bpf_iter_seq_array_map_info), 722 }; 723 724 static long bpf_for_each_array_elem(struct bpf_map *map, bpf_callback_t callback_fn, 725 void *callback_ctx, u64 flags) 726 { 727 u32 i, key, num_elems = 0; 728 struct bpf_array *array; 729 bool is_percpu; 730 u64 ret = 0; 731 void *val; 732 733 cant_migrate(); 734 735 if (flags != 0) 736 return -EINVAL; 737 738 is_percpu = map->map_type == BPF_MAP_TYPE_PERCPU_ARRAY; 739 array = container_of(map, struct bpf_array, map); 740 for (i = 0; i < map->max_entries; i++) { 741 if (is_percpu) 742 val = this_cpu_ptr(array->pptrs[i]); 743 else 744 val = array_map_elem_ptr(array, i); 745 num_elems++; 746 key = i; 747 ret = callback_fn((u64)(long)map, (u64)(long)&key, 748 (u64)(long)val, (u64)(long)callback_ctx, 0); 749 /* return value: 0 - continue, 1 - stop and return */ 750 if (ret) 751 break; 752 } 753 754 return num_elems; 755 } 756 757 static u64 array_map_mem_usage(const struct bpf_map *map) 758 { 759 struct bpf_array *array = container_of(map, struct bpf_array, map); 760 bool percpu = map->map_type == BPF_MAP_TYPE_PERCPU_ARRAY; 761 u32 elem_size = array->elem_size; 762 u64 entries = map->max_entries; 763 u64 usage = sizeof(*array); 764 765 if (percpu) { 766 usage += entries * sizeof(void *); 767 usage += entries * elem_size * num_possible_cpus(); 768 } else { 769 if (map->map_flags & BPF_F_MMAPABLE) { 770 usage = PAGE_ALIGN(usage); 771 usage += PAGE_ALIGN(entries * elem_size); 772 } else { 773 usage += entries * elem_size; 774 } 775 } 776 return usage; 777 } 778 779 BTF_ID_LIST_SINGLE(array_map_btf_ids, struct, bpf_array) 780 const struct bpf_map_ops array_map_ops = { 781 .map_meta_equal = array_map_meta_equal, 782 .map_alloc_check = array_map_alloc_check, 783 .map_alloc = array_map_alloc, 784 .map_free = array_map_free, 785 .map_get_next_key = array_map_get_next_key, 786 .map_release_uref = array_map_free_timers_wq, 787 .map_lookup_elem = array_map_lookup_elem, 788 .map_update_elem = array_map_update_elem, 789 .map_delete_elem = array_map_delete_elem, 790 .map_gen_lookup = array_map_gen_lookup, 791 .map_direct_value_addr = array_map_direct_value_addr, 792 .map_direct_value_meta = array_map_direct_value_meta, 793 .map_mmap = array_map_mmap, 794 .map_seq_show_elem = array_map_seq_show_elem, 795 .map_check_btf = array_map_check_btf, 796 .map_lookup_batch = generic_map_lookup_batch, 797 .map_update_batch = generic_map_update_batch, 798 .map_set_for_each_callback_args = map_set_for_each_callback_args, 799 .map_for_each_callback = bpf_for_each_array_elem, 800 .map_mem_usage = array_map_mem_usage, 801 .map_btf_id = &array_map_btf_ids[0], 802 .iter_seq_info = &iter_seq_info, 803 }; 804 805 const struct bpf_map_ops percpu_array_map_ops = { 806 .map_meta_equal = bpf_map_meta_equal, 807 .map_alloc_check = array_map_alloc_check, 808 .map_alloc = array_map_alloc, 809 .map_free = array_map_free, 810 .map_get_next_key = array_map_get_next_key, 811 .map_lookup_elem = percpu_array_map_lookup_elem, 812 .map_gen_lookup = percpu_array_map_gen_lookup, 813 .map_update_elem = array_map_update_elem, 814 .map_delete_elem = array_map_delete_elem, 815 .map_lookup_percpu_elem = percpu_array_map_lookup_percpu_elem, 816 .map_seq_show_elem = percpu_array_map_seq_show_elem, 817 .map_check_btf = array_map_check_btf, 818 .map_lookup_batch = generic_map_lookup_batch, 819 .map_update_batch = generic_map_update_batch, 820 .map_set_for_each_callback_args = map_set_for_each_callback_args, 821 .map_for_each_callback = bpf_for_each_array_elem, 822 .map_mem_usage = array_map_mem_usage, 823 .map_btf_id = &array_map_btf_ids[0], 824 .iter_seq_info = &iter_seq_info, 825 }; 826 827 static int fd_array_map_alloc_check(union bpf_attr *attr) 828 { 829 /* only file descriptors can be stored in this type of map */ 830 if (attr->value_size != sizeof(u32)) 831 return -EINVAL; 832 /* Program read-only/write-only not supported for special maps yet. */ 833 if (attr->map_flags & (BPF_F_RDONLY_PROG | BPF_F_WRONLY_PROG)) 834 return -EINVAL; 835 return array_map_alloc_check(attr); 836 } 837 838 static void fd_array_map_free(struct bpf_map *map) 839 { 840 struct bpf_array *array = container_of(map, struct bpf_array, map); 841 int i; 842 843 /* make sure it's empty */ 844 for (i = 0; i < array->map.max_entries; i++) 845 BUG_ON(array->ptrs[i] != NULL); 846 847 bpf_map_area_free(array); 848 } 849 850 static void *fd_array_map_lookup_elem(struct bpf_map *map, void *key) 851 { 852 return ERR_PTR(-EOPNOTSUPP); 853 } 854 855 /* only called from syscall */ 856 int bpf_fd_array_map_lookup_elem(struct bpf_map *map, void *key, u32 *value) 857 { 858 void **elem, *ptr; 859 int ret = 0; 860 861 if (!map->ops->map_fd_sys_lookup_elem) 862 return -ENOTSUPP; 863 864 rcu_read_lock(); 865 elem = array_map_lookup_elem(map, key); 866 if (elem && (ptr = READ_ONCE(*elem))) 867 *value = map->ops->map_fd_sys_lookup_elem(ptr); 868 else 869 ret = -ENOENT; 870 rcu_read_unlock(); 871 872 return ret; 873 } 874 875 /* only called from syscall */ 876 int bpf_fd_array_map_update_elem(struct bpf_map *map, struct file *map_file, 877 void *key, void *value, u64 map_flags) 878 { 879 struct bpf_array *array = container_of(map, struct bpf_array, map); 880 void *new_ptr, *old_ptr; 881 u32 index = *(u32 *)key, ufd; 882 883 if (map_flags != BPF_ANY) 884 return -EINVAL; 885 886 if (index >= array->map.max_entries) 887 return -E2BIG; 888 889 ufd = *(u32 *)value; 890 new_ptr = map->ops->map_fd_get_ptr(map, map_file, ufd); 891 if (IS_ERR(new_ptr)) 892 return PTR_ERR(new_ptr); 893 894 if (map->ops->map_poke_run) { 895 mutex_lock(&array->aux->poke_mutex); 896 old_ptr = xchg(array->ptrs + index, new_ptr); 897 map->ops->map_poke_run(map, index, old_ptr, new_ptr); 898 mutex_unlock(&array->aux->poke_mutex); 899 } else { 900 old_ptr = xchg(array->ptrs + index, new_ptr); 901 } 902 903 if (old_ptr) 904 map->ops->map_fd_put_ptr(map, old_ptr, true); 905 return 0; 906 } 907 908 static long __fd_array_map_delete_elem(struct bpf_map *map, void *key, bool need_defer) 909 { 910 struct bpf_array *array = container_of(map, struct bpf_array, map); 911 void *old_ptr; 912 u32 index = *(u32 *)key; 913 914 if (index >= array->map.max_entries) 915 return -E2BIG; 916 917 if (map->ops->map_poke_run) { 918 mutex_lock(&array->aux->poke_mutex); 919 old_ptr = xchg(array->ptrs + index, NULL); 920 map->ops->map_poke_run(map, index, old_ptr, NULL); 921 mutex_unlock(&array->aux->poke_mutex); 922 } else { 923 old_ptr = xchg(array->ptrs + index, NULL); 924 } 925 926 if (old_ptr) { 927 map->ops->map_fd_put_ptr(map, old_ptr, need_defer); 928 return 0; 929 } else { 930 return -ENOENT; 931 } 932 } 933 934 static long fd_array_map_delete_elem(struct bpf_map *map, void *key) 935 { 936 return __fd_array_map_delete_elem(map, key, true); 937 } 938 939 static void *prog_fd_array_get_ptr(struct bpf_map *map, 940 struct file *map_file, int fd) 941 { 942 struct bpf_prog *prog = bpf_prog_get(fd); 943 bool is_extended; 944 945 if (IS_ERR(prog)) 946 return prog; 947 948 if (prog->type == BPF_PROG_TYPE_EXT || 949 !bpf_prog_map_compatible(map, prog)) { 950 bpf_prog_put(prog); 951 return ERR_PTR(-EINVAL); 952 } 953 954 mutex_lock(&prog->aux->ext_mutex); 955 is_extended = prog->aux->is_extended; 956 if (!is_extended) 957 prog->aux->prog_array_member_cnt++; 958 mutex_unlock(&prog->aux->ext_mutex); 959 if (is_extended) { 960 /* Extended prog can not be tail callee. It's to prevent a 961 * potential infinite loop like: 962 * tail callee prog entry -> tail callee prog subprog -> 963 * freplace prog entry --tailcall-> tail callee prog entry. 964 */ 965 bpf_prog_put(prog); 966 return ERR_PTR(-EBUSY); 967 } 968 969 return prog; 970 } 971 972 static void prog_fd_array_put_ptr(struct bpf_map *map, void *ptr, bool need_defer) 973 { 974 struct bpf_prog *prog = ptr; 975 976 mutex_lock(&prog->aux->ext_mutex); 977 prog->aux->prog_array_member_cnt--; 978 mutex_unlock(&prog->aux->ext_mutex); 979 /* bpf_prog is freed after one RCU or tasks trace grace period */ 980 bpf_prog_put(prog); 981 } 982 983 static u32 prog_fd_array_sys_lookup_elem(void *ptr) 984 { 985 return ((struct bpf_prog *)ptr)->aux->id; 986 } 987 988 /* decrement refcnt of all bpf_progs that are stored in this map */ 989 static void bpf_fd_array_map_clear(struct bpf_map *map, bool need_defer) 990 { 991 struct bpf_array *array = container_of(map, struct bpf_array, map); 992 int i; 993 994 for (i = 0; i < array->map.max_entries; i++) 995 __fd_array_map_delete_elem(map, &i, need_defer); 996 } 997 998 static void prog_array_map_seq_show_elem(struct bpf_map *map, void *key, 999 struct seq_file *m) 1000 { 1001 void **elem, *ptr; 1002 u32 prog_id; 1003 1004 rcu_read_lock(); 1005 1006 elem = array_map_lookup_elem(map, key); 1007 if (elem) { 1008 ptr = READ_ONCE(*elem); 1009 if (ptr) { 1010 seq_printf(m, "%u: ", *(u32 *)key); 1011 prog_id = prog_fd_array_sys_lookup_elem(ptr); 1012 btf_type_seq_show(map->btf, map->btf_value_type_id, 1013 &prog_id, m); 1014 seq_putc(m, '\n'); 1015 } 1016 } 1017 1018 rcu_read_unlock(); 1019 } 1020 1021 struct prog_poke_elem { 1022 struct list_head list; 1023 struct bpf_prog_aux *aux; 1024 }; 1025 1026 static int prog_array_map_poke_track(struct bpf_map *map, 1027 struct bpf_prog_aux *prog_aux) 1028 { 1029 struct prog_poke_elem *elem; 1030 struct bpf_array_aux *aux; 1031 int ret = 0; 1032 1033 aux = container_of(map, struct bpf_array, map)->aux; 1034 mutex_lock(&aux->poke_mutex); 1035 list_for_each_entry(elem, &aux->poke_progs, list) { 1036 if (elem->aux == prog_aux) 1037 goto out; 1038 } 1039 1040 elem = kmalloc(sizeof(*elem), GFP_KERNEL); 1041 if (!elem) { 1042 ret = -ENOMEM; 1043 goto out; 1044 } 1045 1046 INIT_LIST_HEAD(&elem->list); 1047 /* We must track the program's aux info at this point in time 1048 * since the program pointer itself may not be stable yet, see 1049 * also comment in prog_array_map_poke_run(). 1050 */ 1051 elem->aux = prog_aux; 1052 1053 list_add_tail(&elem->list, &aux->poke_progs); 1054 out: 1055 mutex_unlock(&aux->poke_mutex); 1056 return ret; 1057 } 1058 1059 static void prog_array_map_poke_untrack(struct bpf_map *map, 1060 struct bpf_prog_aux *prog_aux) 1061 { 1062 struct prog_poke_elem *elem, *tmp; 1063 struct bpf_array_aux *aux; 1064 1065 aux = container_of(map, struct bpf_array, map)->aux; 1066 mutex_lock(&aux->poke_mutex); 1067 list_for_each_entry_safe(elem, tmp, &aux->poke_progs, list) { 1068 if (elem->aux == prog_aux) { 1069 list_del_init(&elem->list); 1070 kfree(elem); 1071 break; 1072 } 1073 } 1074 mutex_unlock(&aux->poke_mutex); 1075 } 1076 1077 void __weak bpf_arch_poke_desc_update(struct bpf_jit_poke_descriptor *poke, 1078 struct bpf_prog *new, struct bpf_prog *old) 1079 { 1080 WARN_ON_ONCE(1); 1081 } 1082 1083 static void prog_array_map_poke_run(struct bpf_map *map, u32 key, 1084 struct bpf_prog *old, 1085 struct bpf_prog *new) 1086 { 1087 struct prog_poke_elem *elem; 1088 struct bpf_array_aux *aux; 1089 1090 aux = container_of(map, struct bpf_array, map)->aux; 1091 WARN_ON_ONCE(!mutex_is_locked(&aux->poke_mutex)); 1092 1093 list_for_each_entry(elem, &aux->poke_progs, list) { 1094 struct bpf_jit_poke_descriptor *poke; 1095 int i; 1096 1097 for (i = 0; i < elem->aux->size_poke_tab; i++) { 1098 poke = &elem->aux->poke_tab[i]; 1099 1100 /* Few things to be aware of: 1101 * 1102 * 1) We can only ever access aux in this context, but 1103 * not aux->prog since it might not be stable yet and 1104 * there could be danger of use after free otherwise. 1105 * 2) Initially when we start tracking aux, the program 1106 * is not JITed yet and also does not have a kallsyms 1107 * entry. We skip these as poke->tailcall_target_stable 1108 * is not active yet. The JIT will do the final fixup 1109 * before setting it stable. The various 1110 * poke->tailcall_target_stable are successively 1111 * activated, so tail call updates can arrive from here 1112 * while JIT is still finishing its final fixup for 1113 * non-activated poke entries. 1114 * 3) Also programs reaching refcount of zero while patching 1115 * is in progress is okay since we're protected under 1116 * poke_mutex and untrack the programs before the JIT 1117 * buffer is freed. 1118 */ 1119 if (!READ_ONCE(poke->tailcall_target_stable)) 1120 continue; 1121 if (poke->reason != BPF_POKE_REASON_TAIL_CALL) 1122 continue; 1123 if (poke->tail_call.map != map || 1124 poke->tail_call.key != key) 1125 continue; 1126 1127 bpf_arch_poke_desc_update(poke, new, old); 1128 } 1129 } 1130 } 1131 1132 static void prog_array_map_clear_deferred(struct work_struct *work) 1133 { 1134 struct bpf_map *map = container_of(work, struct bpf_array_aux, 1135 work)->map; 1136 bpf_fd_array_map_clear(map, true); 1137 bpf_map_put(map); 1138 } 1139 1140 static void prog_array_map_clear(struct bpf_map *map) 1141 { 1142 struct bpf_array_aux *aux = container_of(map, struct bpf_array, 1143 map)->aux; 1144 bpf_map_inc(map); 1145 schedule_work(&aux->work); 1146 } 1147 1148 static struct bpf_map *prog_array_map_alloc(union bpf_attr *attr) 1149 { 1150 struct bpf_array_aux *aux; 1151 struct bpf_map *map; 1152 1153 aux = kzalloc(sizeof(*aux), GFP_KERNEL_ACCOUNT); 1154 if (!aux) 1155 return ERR_PTR(-ENOMEM); 1156 1157 INIT_WORK(&aux->work, prog_array_map_clear_deferred); 1158 INIT_LIST_HEAD(&aux->poke_progs); 1159 mutex_init(&aux->poke_mutex); 1160 1161 map = array_map_alloc(attr); 1162 if (IS_ERR(map)) { 1163 kfree(aux); 1164 return map; 1165 } 1166 1167 container_of(map, struct bpf_array, map)->aux = aux; 1168 aux->map = map; 1169 1170 return map; 1171 } 1172 1173 static void prog_array_map_free(struct bpf_map *map) 1174 { 1175 struct prog_poke_elem *elem, *tmp; 1176 struct bpf_array_aux *aux; 1177 1178 aux = container_of(map, struct bpf_array, map)->aux; 1179 list_for_each_entry_safe(elem, tmp, &aux->poke_progs, list) { 1180 list_del_init(&elem->list); 1181 kfree(elem); 1182 } 1183 kfree(aux); 1184 fd_array_map_free(map); 1185 } 1186 1187 /* prog_array->aux->{type,jited} is a runtime binding. 1188 * Doing static check alone in the verifier is not enough. 1189 * Thus, prog_array_map cannot be used as an inner_map 1190 * and map_meta_equal is not implemented. 1191 */ 1192 const struct bpf_map_ops prog_array_map_ops = { 1193 .map_alloc_check = fd_array_map_alloc_check, 1194 .map_alloc = prog_array_map_alloc, 1195 .map_free = prog_array_map_free, 1196 .map_poke_track = prog_array_map_poke_track, 1197 .map_poke_untrack = prog_array_map_poke_untrack, 1198 .map_poke_run = prog_array_map_poke_run, 1199 .map_get_next_key = array_map_get_next_key, 1200 .map_lookup_elem = fd_array_map_lookup_elem, 1201 .map_delete_elem = fd_array_map_delete_elem, 1202 .map_fd_get_ptr = prog_fd_array_get_ptr, 1203 .map_fd_put_ptr = prog_fd_array_put_ptr, 1204 .map_fd_sys_lookup_elem = prog_fd_array_sys_lookup_elem, 1205 .map_release_uref = prog_array_map_clear, 1206 .map_seq_show_elem = prog_array_map_seq_show_elem, 1207 .map_mem_usage = array_map_mem_usage, 1208 .map_btf_id = &array_map_btf_ids[0], 1209 }; 1210 1211 static struct bpf_event_entry *bpf_event_entry_gen(struct file *perf_file, 1212 struct file *map_file) 1213 { 1214 struct bpf_event_entry *ee; 1215 1216 ee = kzalloc(sizeof(*ee), GFP_KERNEL); 1217 if (ee) { 1218 ee->event = perf_file->private_data; 1219 ee->perf_file = perf_file; 1220 ee->map_file = map_file; 1221 } 1222 1223 return ee; 1224 } 1225 1226 static void __bpf_event_entry_free(struct rcu_head *rcu) 1227 { 1228 struct bpf_event_entry *ee; 1229 1230 ee = container_of(rcu, struct bpf_event_entry, rcu); 1231 fput(ee->perf_file); 1232 kfree(ee); 1233 } 1234 1235 static void bpf_event_entry_free_rcu(struct bpf_event_entry *ee) 1236 { 1237 call_rcu(&ee->rcu, __bpf_event_entry_free); 1238 } 1239 1240 static void *perf_event_fd_array_get_ptr(struct bpf_map *map, 1241 struct file *map_file, int fd) 1242 { 1243 struct bpf_event_entry *ee; 1244 struct perf_event *event; 1245 struct file *perf_file; 1246 u64 value; 1247 1248 perf_file = perf_event_get(fd); 1249 if (IS_ERR(perf_file)) 1250 return perf_file; 1251 1252 ee = ERR_PTR(-EOPNOTSUPP); 1253 event = perf_file->private_data; 1254 if (perf_event_read_local(event, &value, NULL, NULL) == -EOPNOTSUPP) 1255 goto err_out; 1256 1257 ee = bpf_event_entry_gen(perf_file, map_file); 1258 if (ee) 1259 return ee; 1260 ee = ERR_PTR(-ENOMEM); 1261 err_out: 1262 fput(perf_file); 1263 return ee; 1264 } 1265 1266 static void perf_event_fd_array_put_ptr(struct bpf_map *map, void *ptr, bool need_defer) 1267 { 1268 /* bpf_perf_event is freed after one RCU grace period */ 1269 bpf_event_entry_free_rcu(ptr); 1270 } 1271 1272 static void perf_event_fd_array_release(struct bpf_map *map, 1273 struct file *map_file) 1274 { 1275 struct bpf_array *array = container_of(map, struct bpf_array, map); 1276 struct bpf_event_entry *ee; 1277 int i; 1278 1279 if (map->map_flags & BPF_F_PRESERVE_ELEMS) 1280 return; 1281 1282 rcu_read_lock(); 1283 for (i = 0; i < array->map.max_entries; i++) { 1284 ee = READ_ONCE(array->ptrs[i]); 1285 if (ee && ee->map_file == map_file) 1286 __fd_array_map_delete_elem(map, &i, true); 1287 } 1288 rcu_read_unlock(); 1289 } 1290 1291 static void perf_event_fd_array_map_free(struct bpf_map *map) 1292 { 1293 if (map->map_flags & BPF_F_PRESERVE_ELEMS) 1294 bpf_fd_array_map_clear(map, false); 1295 fd_array_map_free(map); 1296 } 1297 1298 const struct bpf_map_ops perf_event_array_map_ops = { 1299 .map_meta_equal = bpf_map_meta_equal, 1300 .map_alloc_check = fd_array_map_alloc_check, 1301 .map_alloc = array_map_alloc, 1302 .map_free = perf_event_fd_array_map_free, 1303 .map_get_next_key = array_map_get_next_key, 1304 .map_lookup_elem = fd_array_map_lookup_elem, 1305 .map_delete_elem = fd_array_map_delete_elem, 1306 .map_fd_get_ptr = perf_event_fd_array_get_ptr, 1307 .map_fd_put_ptr = perf_event_fd_array_put_ptr, 1308 .map_release = perf_event_fd_array_release, 1309 .map_check_btf = map_check_no_btf, 1310 .map_mem_usage = array_map_mem_usage, 1311 .map_btf_id = &array_map_btf_ids[0], 1312 }; 1313 1314 #ifdef CONFIG_CGROUPS 1315 static void *cgroup_fd_array_get_ptr(struct bpf_map *map, 1316 struct file *map_file /* not used */, 1317 int fd) 1318 { 1319 return cgroup_get_from_fd(fd); 1320 } 1321 1322 static void cgroup_fd_array_put_ptr(struct bpf_map *map, void *ptr, bool need_defer) 1323 { 1324 /* cgroup_put free cgrp after a rcu grace period */ 1325 cgroup_put(ptr); 1326 } 1327 1328 static void cgroup_fd_array_free(struct bpf_map *map) 1329 { 1330 bpf_fd_array_map_clear(map, false); 1331 fd_array_map_free(map); 1332 } 1333 1334 const struct bpf_map_ops cgroup_array_map_ops = { 1335 .map_meta_equal = bpf_map_meta_equal, 1336 .map_alloc_check = fd_array_map_alloc_check, 1337 .map_alloc = array_map_alloc, 1338 .map_free = cgroup_fd_array_free, 1339 .map_get_next_key = array_map_get_next_key, 1340 .map_lookup_elem = fd_array_map_lookup_elem, 1341 .map_delete_elem = fd_array_map_delete_elem, 1342 .map_fd_get_ptr = cgroup_fd_array_get_ptr, 1343 .map_fd_put_ptr = cgroup_fd_array_put_ptr, 1344 .map_check_btf = map_check_no_btf, 1345 .map_mem_usage = array_map_mem_usage, 1346 .map_btf_id = &array_map_btf_ids[0], 1347 }; 1348 #endif 1349 1350 static struct bpf_map *array_of_map_alloc(union bpf_attr *attr) 1351 { 1352 struct bpf_map *map, *inner_map_meta; 1353 1354 inner_map_meta = bpf_map_meta_alloc(attr->inner_map_fd); 1355 if (IS_ERR(inner_map_meta)) 1356 return inner_map_meta; 1357 1358 map = array_map_alloc(attr); 1359 if (IS_ERR(map)) { 1360 bpf_map_meta_free(inner_map_meta); 1361 return map; 1362 } 1363 1364 map->inner_map_meta = inner_map_meta; 1365 1366 return map; 1367 } 1368 1369 static void array_of_map_free(struct bpf_map *map) 1370 { 1371 /* map->inner_map_meta is only accessed by syscall which 1372 * is protected by fdget/fdput. 1373 */ 1374 bpf_map_meta_free(map->inner_map_meta); 1375 bpf_fd_array_map_clear(map, false); 1376 fd_array_map_free(map); 1377 } 1378 1379 static void *array_of_map_lookup_elem(struct bpf_map *map, void *key) 1380 { 1381 struct bpf_map **inner_map = array_map_lookup_elem(map, key); 1382 1383 if (!inner_map) 1384 return NULL; 1385 1386 return READ_ONCE(*inner_map); 1387 } 1388 1389 static int array_of_map_gen_lookup(struct bpf_map *map, 1390 struct bpf_insn *insn_buf) 1391 { 1392 struct bpf_array *array = container_of(map, struct bpf_array, map); 1393 u32 elem_size = array->elem_size; 1394 struct bpf_insn *insn = insn_buf; 1395 const int ret = BPF_REG_0; 1396 const int map_ptr = BPF_REG_1; 1397 const int index = BPF_REG_2; 1398 1399 *insn++ = BPF_ALU64_IMM(BPF_ADD, map_ptr, offsetof(struct bpf_array, value)); 1400 *insn++ = BPF_LDX_MEM(BPF_W, ret, index, 0); 1401 if (!map->bypass_spec_v1) { 1402 *insn++ = BPF_JMP_IMM(BPF_JGE, ret, map->max_entries, 6); 1403 *insn++ = BPF_ALU32_IMM(BPF_AND, ret, array->index_mask); 1404 } else { 1405 *insn++ = BPF_JMP_IMM(BPF_JGE, ret, map->max_entries, 5); 1406 } 1407 if (is_power_of_2(elem_size)) 1408 *insn++ = BPF_ALU64_IMM(BPF_LSH, ret, ilog2(elem_size)); 1409 else 1410 *insn++ = BPF_ALU64_IMM(BPF_MUL, ret, elem_size); 1411 *insn++ = BPF_ALU64_REG(BPF_ADD, ret, map_ptr); 1412 *insn++ = BPF_LDX_MEM(BPF_DW, ret, ret, 0); 1413 *insn++ = BPF_JMP_IMM(BPF_JEQ, ret, 0, 1); 1414 *insn++ = BPF_JMP_IMM(BPF_JA, 0, 0, 1); 1415 *insn++ = BPF_MOV64_IMM(ret, 0); 1416 1417 return insn - insn_buf; 1418 } 1419 1420 const struct bpf_map_ops array_of_maps_map_ops = { 1421 .map_alloc_check = fd_array_map_alloc_check, 1422 .map_alloc = array_of_map_alloc, 1423 .map_free = array_of_map_free, 1424 .map_get_next_key = array_map_get_next_key, 1425 .map_lookup_elem = array_of_map_lookup_elem, 1426 .map_delete_elem = fd_array_map_delete_elem, 1427 .map_fd_get_ptr = bpf_map_fd_get_ptr, 1428 .map_fd_put_ptr = bpf_map_fd_put_ptr, 1429 .map_fd_sys_lookup_elem = bpf_map_fd_sys_lookup_elem, 1430 .map_gen_lookup = array_of_map_gen_lookup, 1431 .map_lookup_batch = generic_map_lookup_batch, 1432 .map_update_batch = generic_map_update_batch, 1433 .map_check_btf = map_check_no_btf, 1434 .map_mem_usage = array_map_mem_usage, 1435 .map_btf_id = &array_map_btf_ids[0], 1436 }; 1437