xref: /linux/net/bpf/bpf_dummy_struct_ops.c (revision 860a9bed265146b10311bcadbbcef59c3af4454d)
1 // SPDX-License-Identifier: GPL-2.0
2 /*
3  * Copyright (C) 2021. Huawei Technologies Co., Ltd
4  */
5 #include <linux/kernel.h>
6 #include <linux/bpf_verifier.h>
7 #include <linux/bpf.h>
8 #include <linux/btf.h>
9 
10 static struct bpf_struct_ops bpf_bpf_dummy_ops;
11 
12 /* A common type for test_N with return value in bpf_dummy_ops */
13 typedef int (*dummy_ops_test_ret_fn)(struct bpf_dummy_ops_state *state, ...);
14 
15 static int dummy_ops_test_ret_function(struct bpf_dummy_ops_state *state, ...)
16 {
17 	return 0;
18 }
19 
20 struct bpf_dummy_ops_test_args {
21 	u64 args[MAX_BPF_FUNC_ARGS];
22 	struct bpf_dummy_ops_state state;
23 };
24 
25 static struct btf *bpf_dummy_ops_btf;
26 
27 static struct bpf_dummy_ops_test_args *
28 dummy_ops_init_args(const union bpf_attr *kattr, unsigned int nr)
29 {
30 	__u32 size_in;
31 	struct bpf_dummy_ops_test_args *args;
32 	void __user *ctx_in;
33 	void __user *u_state;
34 
35 	size_in = kattr->test.ctx_size_in;
36 	if (size_in != sizeof(u64) * nr)
37 		return ERR_PTR(-EINVAL);
38 
39 	args = kzalloc(sizeof(*args), GFP_KERNEL);
40 	if (!args)
41 		return ERR_PTR(-ENOMEM);
42 
43 	ctx_in = u64_to_user_ptr(kattr->test.ctx_in);
44 	if (copy_from_user(args->args, ctx_in, size_in))
45 		goto out;
46 
47 	/* args[0] is 0 means state argument of test_N will be NULL */
48 	u_state = u64_to_user_ptr(args->args[0]);
49 	if (u_state && copy_from_user(&args->state, u_state,
50 				      sizeof(args->state)))
51 		goto out;
52 
53 	return args;
54 out:
55 	kfree(args);
56 	return ERR_PTR(-EFAULT);
57 }
58 
59 static int dummy_ops_copy_args(struct bpf_dummy_ops_test_args *args)
60 {
61 	void __user *u_state;
62 
63 	u_state = u64_to_user_ptr(args->args[0]);
64 	if (u_state && copy_to_user(u_state, &args->state, sizeof(args->state)))
65 		return -EFAULT;
66 
67 	return 0;
68 }
69 
70 static int dummy_ops_call_op(void *image, struct bpf_dummy_ops_test_args *args)
71 {
72 	dummy_ops_test_ret_fn test = (void *)image + cfi_get_offset();
73 	struct bpf_dummy_ops_state *state = NULL;
74 
75 	/* state needs to be NULL if args[0] is 0 */
76 	if (args->args[0])
77 		state = &args->state;
78 	return test(state, args->args[1], args->args[2],
79 		    args->args[3], args->args[4]);
80 }
81 
82 extern const struct bpf_link_ops bpf_struct_ops_link_lops;
83 
84 int bpf_struct_ops_test_run(struct bpf_prog *prog, const union bpf_attr *kattr,
85 			    union bpf_attr __user *uattr)
86 {
87 	const struct bpf_struct_ops *st_ops = &bpf_bpf_dummy_ops;
88 	const struct btf_type *func_proto;
89 	struct bpf_dummy_ops_test_args *args;
90 	struct bpf_tramp_links *tlinks;
91 	struct bpf_tramp_link *link = NULL;
92 	void *image = NULL;
93 	unsigned int op_idx;
94 	u32 image_off = 0;
95 	int prog_ret;
96 	s32 type_id;
97 	int err;
98 
99 	type_id = btf_find_by_name_kind(bpf_dummy_ops_btf,
100 					bpf_bpf_dummy_ops.name,
101 					BTF_KIND_STRUCT);
102 	if (type_id < 0)
103 		return -EINVAL;
104 	if (prog->aux->attach_btf_id != type_id)
105 		return -EOPNOTSUPP;
106 
107 	func_proto = prog->aux->attach_func_proto;
108 	args = dummy_ops_init_args(kattr, btf_type_vlen(func_proto));
109 	if (IS_ERR(args))
110 		return PTR_ERR(args);
111 
112 	tlinks = kcalloc(BPF_TRAMP_MAX, sizeof(*tlinks), GFP_KERNEL);
113 	if (!tlinks) {
114 		err = -ENOMEM;
115 		goto out;
116 	}
117 
118 	link = kzalloc(sizeof(*link), GFP_USER);
119 	if (!link) {
120 		err = -ENOMEM;
121 		goto out;
122 	}
123 	/* prog doesn't take the ownership of the reference from caller */
124 	bpf_prog_inc(prog);
125 	bpf_link_init(&link->link, BPF_LINK_TYPE_STRUCT_OPS, &bpf_struct_ops_link_lops, prog);
126 
127 	op_idx = prog->expected_attach_type;
128 	err = bpf_struct_ops_prepare_trampoline(tlinks, link,
129 						&st_ops->func_models[op_idx],
130 						&dummy_ops_test_ret_function,
131 						&image, &image_off,
132 						true);
133 	if (err < 0)
134 		goto out;
135 
136 	err = arch_protect_bpf_trampoline(image, PAGE_SIZE);
137 	if (err)
138 		goto out;
139 	prog_ret = dummy_ops_call_op(image, args);
140 
141 	err = dummy_ops_copy_args(args);
142 	if (err)
143 		goto out;
144 	if (put_user(prog_ret, &uattr->test.retval))
145 		err = -EFAULT;
146 out:
147 	kfree(args);
148 	bpf_struct_ops_image_free(image);
149 	if (link)
150 		bpf_link_put(&link->link);
151 	kfree(tlinks);
152 	return err;
153 }
154 
155 static int bpf_dummy_init(struct btf *btf)
156 {
157 	bpf_dummy_ops_btf = btf;
158 	return 0;
159 }
160 
161 static bool bpf_dummy_ops_is_valid_access(int off, int size,
162 					  enum bpf_access_type type,
163 					  const struct bpf_prog *prog,
164 					  struct bpf_insn_access_aux *info)
165 {
166 	return bpf_tracing_btf_ctx_access(off, size, type, prog, info);
167 }
168 
169 static int bpf_dummy_ops_check_member(const struct btf_type *t,
170 				      const struct btf_member *member,
171 				      const struct bpf_prog *prog)
172 {
173 	u32 moff = __btf_member_bit_offset(t, member) / 8;
174 
175 	switch (moff) {
176 	case offsetof(struct bpf_dummy_ops, test_sleepable):
177 		break;
178 	default:
179 		if (prog->sleepable)
180 			return -EINVAL;
181 	}
182 
183 	return 0;
184 }
185 
186 static int bpf_dummy_ops_btf_struct_access(struct bpf_verifier_log *log,
187 					   const struct bpf_reg_state *reg,
188 					   int off, int size)
189 {
190 	const struct btf_type *state;
191 	const struct btf_type *t;
192 	s32 type_id;
193 
194 	type_id = btf_find_by_name_kind(reg->btf, "bpf_dummy_ops_state",
195 					BTF_KIND_STRUCT);
196 	if (type_id < 0)
197 		return -EINVAL;
198 
199 	t = btf_type_by_id(reg->btf, reg->btf_id);
200 	state = btf_type_by_id(reg->btf, type_id);
201 	if (t != state) {
202 		bpf_log(log, "only access to bpf_dummy_ops_state is supported\n");
203 		return -EACCES;
204 	}
205 
206 	if (off + size > sizeof(struct bpf_dummy_ops_state)) {
207 		bpf_log(log, "write access at off %d with size %d\n", off, size);
208 		return -EACCES;
209 	}
210 
211 	return NOT_INIT;
212 }
213 
214 static const struct bpf_verifier_ops bpf_dummy_verifier_ops = {
215 	.is_valid_access = bpf_dummy_ops_is_valid_access,
216 	.btf_struct_access = bpf_dummy_ops_btf_struct_access,
217 };
218 
219 static int bpf_dummy_init_member(const struct btf_type *t,
220 				 const struct btf_member *member,
221 				 void *kdata, const void *udata)
222 {
223 	return -EOPNOTSUPP;
224 }
225 
226 static int bpf_dummy_reg(void *kdata)
227 {
228 	return -EOPNOTSUPP;
229 }
230 
231 static void bpf_dummy_unreg(void *kdata)
232 {
233 }
234 
235 static int bpf_dummy_test_1(struct bpf_dummy_ops_state *cb)
236 {
237 	return 0;
238 }
239 
240 static int bpf_dummy_test_2(struct bpf_dummy_ops_state *cb, int a1, unsigned short a2,
241 			    char a3, unsigned long a4)
242 {
243 	return 0;
244 }
245 
246 static int bpf_dummy_test_sleepable(struct bpf_dummy_ops_state *cb)
247 {
248 	return 0;
249 }
250 
251 static struct bpf_dummy_ops __bpf_bpf_dummy_ops = {
252 	.test_1 = bpf_dummy_test_1,
253 	.test_2 = bpf_dummy_test_2,
254 	.test_sleepable = bpf_dummy_test_sleepable,
255 };
256 
257 static struct bpf_struct_ops bpf_bpf_dummy_ops = {
258 	.verifier_ops = &bpf_dummy_verifier_ops,
259 	.init = bpf_dummy_init,
260 	.check_member = bpf_dummy_ops_check_member,
261 	.init_member = bpf_dummy_init_member,
262 	.reg = bpf_dummy_reg,
263 	.unreg = bpf_dummy_unreg,
264 	.name = "bpf_dummy_ops",
265 	.cfi_stubs = &__bpf_bpf_dummy_ops,
266 	.owner = THIS_MODULE,
267 };
268 
269 static int __init bpf_dummy_struct_ops_init(void)
270 {
271 	return register_bpf_struct_ops(&bpf_bpf_dummy_ops, bpf_dummy_ops);
272 }
273 late_initcall(bpf_dummy_struct_ops_init);
274