[mirror_ubuntu-jammy-kernel.git] / kernel / bpf / bpf_struct_ops.c

// SPDX-License-Identifier: GPL-2.0-only
/* Copyright (c) 2019 Facebook */

#include <linux/bpf.h>
#include <linux/bpf_verifier.h>
#include <linux/btf.h>
#include <linux/filter.h>
#include <linux/slab.h>
#include <linux/numa.h>
#include <linux/seq_file.h>
#include <linux/refcount.h>
#include <linux/mutex.h>

enum bpf_struct_ops_state {
	BPF_STRUCT_OPS_STATE_INIT,
	BPF_STRUCT_OPS_STATE_INUSE,
	BPF_STRUCT_OPS_STATE_TOBEFREE,
};

#define BPF_STRUCT_OPS_COMMON_VALUE			\
	refcount_t refcnt;				\
	enum bpf_struct_ops_state state

struct bpf_struct_ops_value {
	BPF_STRUCT_OPS_COMMON_VALUE;
	char data[0] ____cacheline_aligned_in_smp;
};

struct bpf_struct_ops_map {
	struct bpf_map map;
	const struct bpf_struct_ops *st_ops;
	/* protect map_update */
	struct mutex lock;
	/* progs has all the bpf_prog that is populated
	 * to the func ptr of the kernel's struct
	 * (in kvalue.data).
	 */
	struct bpf_prog **progs;
	/* image is a page that has all the trampolines
	 * that stores the func args before calling the bpf_prog.
	 * A PAGE_SIZE "image" is enough to store all trampoline for
	 * "progs[]".
	 */
	void *image;
	/* uvalue->data stores the kernel struct
	 * (e.g. tcp_congestion_ops) that is more useful
	 * to userspace than the kvalue.  For example,
	 * the bpf_prog's id is stored instead of the kernel
	 * address of a func ptr.
	 */
	struct bpf_struct_ops_value *uvalue;
	/* kvalue.data stores the actual kernel's struct
	 * (e.g. tcp_congestion_ops) that will be
	 * registered to the kernel subsystem.
	 */
	struct bpf_struct_ops_value kvalue;
};

#define VALUE_PREFIX "bpf_struct_ops_"
#define VALUE_PREFIX_LEN (sizeof(VALUE_PREFIX) - 1)

/* bpf_struct_ops_##_name (e.g. bpf_struct_ops_tcp_congestion_ops) is
 * the map's value exposed to the userspace and its btf-type-id is
 * stored at the map->btf_vmlinux_value_type_id.
 *
 */
#define BPF_STRUCT_OPS_TYPE(_name)				\
extern struct bpf_struct_ops bpf_##_name;			\
								\
struct bpf_struct_ops_##_name {						\
	BPF_STRUCT_OPS_COMMON_VALUE;				\
	struct _name data ____cacheline_aligned_in_smp;		\
};
#include "bpf_struct_ops_types.h"
#undef BPF_STRUCT_OPS_TYPE

enum {
#define BPF_STRUCT_OPS_TYPE(_name) BPF_STRUCT_OPS_TYPE_##_name,
#include "bpf_struct_ops_types.h"
#undef BPF_STRUCT_OPS_TYPE
	__NR_BPF_STRUCT_OPS_TYPE,
};

static struct bpf_struct_ops * const bpf_struct_ops[] = {
#define BPF_STRUCT_OPS_TYPE(_name)				\
	[BPF_STRUCT_OPS_TYPE_##_name] = &bpf_##_name,
#include "bpf_struct_ops_types.h"
#undef BPF_STRUCT_OPS_TYPE
};

const struct bpf_verifier_ops bpf_struct_ops_verifier_ops = {
};

const struct bpf_prog_ops bpf_struct_ops_prog_ops = {
};

static const struct btf_type *module_type;

void bpf_struct_ops_init(struct btf *btf)
{
	s32 type_id, value_id, module_id;
	const struct btf_member *member;
	struct bpf_struct_ops *st_ops;
	struct bpf_verifier_log log = {};
	const struct btf_type *t;
	char value_name[128];
	const char *mname;
	u32 i, j;

	/* Ensure BTF type is emitted for "struct bpf_struct_ops_##_name" */
#define BPF_STRUCT_OPS_TYPE(_name) BTF_TYPE_EMIT(struct bpf_struct_ops_##_name);
#include "bpf_struct_ops_types.h"
#undef BPF_STRUCT_OPS_TYPE

	module_id = btf_find_by_name_kind(btf, "module", BTF_KIND_STRUCT);
	if (module_id < 0) {
		pr_warn("Cannot find struct module in btf_vmlinux\n");
		return;
	}
	module_type = btf_type_by_id(btf, module_id);

	for (i = 0; i < ARRAY_SIZE(bpf_struct_ops); i++) {
		st_ops = bpf_struct_ops[i];

		if (strlen(st_ops->name) + VALUE_PREFIX_LEN >=
		    sizeof(value_name)) {
			pr_warn("struct_ops name %s is too long\n",
				st_ops->name);
			continue;
		}
		sprintf(value_name, "%s%s", VALUE_PREFIX, st_ops->name);

		value_id = btf_find_by_name_kind(btf, value_name,
						 BTF_KIND_STRUCT);
		if (value_id < 0) {
			pr_warn("Cannot find struct %s in btf_vmlinux\n",
				value_name);
			continue;
		}

		type_id = btf_find_by_name_kind(btf, st_ops->name,
						BTF_KIND_STRUCT);
		if (type_id < 0) {
			pr_warn("Cannot find struct %s in btf_vmlinux\n",
				st_ops->name);
			continue;
		}
		t = btf_type_by_id(btf, type_id);
		if (btf_type_vlen(t) > BPF_STRUCT_OPS_MAX_NR_MEMBERS) {
			pr_warn("Cannot support #%u members in struct %s\n",
				btf_type_vlen(t), st_ops->name);
			continue;
		}

		for_each_member(j, t, member) {
			const struct btf_type *func_proto;

			mname = btf_name_by_offset(btf, member->name_off);
			if (!*mname) {
				pr_warn("anon member in struct %s is not supported\n",
					st_ops->name);
				break;
			}

			if (btf_member_bitfield_size(t, member)) {
				pr_warn("bit field member %s in struct %s is not supported\n",
					mname, st_ops->name);
				break;
			}

			func_proto = btf_type_resolve_func_ptr(btf,
							       member->type,
							       NULL);
			if (func_proto &&
			    btf_distill_func_proto(&log, btf,
						   func_proto, mname,
						   &st_ops->func_models[j])) {
				pr_warn("Error in parsing func ptr %s in struct %s\n",
					mname, st_ops->name);
				break;
			}
		}

		if (j == btf_type_vlen(t)) {
			if (st_ops->init(btf)) {
				pr_warn("Error in init bpf_struct_ops %s\n",
					st_ops->name);
			} else {
				st_ops->type_id = type_id;
				st_ops->type = t;
				st_ops->value_id = value_id;
				st_ops->value_type = btf_type_by_id(btf,
								    value_id);
			}
		}
	}
}

extern struct btf *btf_vmlinux;

static const struct bpf_struct_ops *
bpf_struct_ops_find_value(u32 value_id)
{
	unsigned int i;

	if (!value_id || !btf_vmlinux)
		return NULL;

	for (i = 0; i < ARRAY_SIZE(bpf_struct_ops); i++) {
		if (bpf_struct_ops[i]->value_id == value_id)
			return bpf_struct_ops[i];
	}

	return NULL;
}

const struct bpf_struct_ops *bpf_struct_ops_find(u32 type_id)
{
	unsigned int i;

	if (!type_id || !btf_vmlinux)
		return NULL;

	for (i = 0; i < ARRAY_SIZE(bpf_struct_ops); i++) {
		if (bpf_struct_ops[i]->type_id == type_id)
			return bpf_struct_ops[i];
	}

	return NULL;
}

static int bpf_struct_ops_map_get_next_key(struct bpf_map *map, void *key,
					   void *next_key)
{
	if (key && *(u32 *)key == 0)
		return -ENOENT;

	*(u32 *)next_key = 0;
	return 0;
}

int bpf_struct_ops_map_sys_lookup_elem(struct bpf_map *map, void *key,
				       void *value)
{
	struct bpf_struct_ops_map *st_map = (struct bpf_struct_ops_map *)map;
	struct bpf_struct_ops_value *uvalue, *kvalue;
	enum bpf_struct_ops_state state;

	if (unlikely(*(u32 *)key != 0))
		return -ENOENT;

	kvalue = &st_map->kvalue;
	/* Pair with smp_store_release() during map_update */
	state = smp_load_acquire(&kvalue->state);
	if (state == BPF_STRUCT_OPS_STATE_INIT) {
		memset(value, 0, map->value_size);
		return 0;
	}

	/* No lock is needed.  state and refcnt do not need
	 * to be updated together under atomic context.
	 */
	uvalue = (struct bpf_struct_ops_value *)value;
	memcpy(uvalue, st_map->uvalue, map->value_size);
	uvalue->state = state;
	refcount_set(&uvalue->refcnt, refcount_read(&kvalue->refcnt));

	return 0;
}

static void *bpf_struct_ops_map_lookup_elem(struct bpf_map *map, void *key)
{
	return ERR_PTR(-EINVAL);
}

static void bpf_struct_ops_map_put_progs(struct bpf_struct_ops_map *st_map)
{
	const struct btf_type *t = st_map->st_ops->type;
	u32 i;

	for (i = 0; i < btf_type_vlen(t); i++) {
		if (st_map->progs[i]) {
			bpf_prog_put(st_map->progs[i]);
			st_map->progs[i] = NULL;
		}
	}
}

static int check_zero_holes(const struct btf_type *t, void *data)
{
	const struct btf_member *member;
	u32 i, moff, msize, prev_mend = 0;
	const struct btf_type *mtype;

	for_each_member(i, t, member) {
		moff = btf_member_bit_offset(t, member) / 8;
		if (moff > prev_mend &&
		    memchr_inv(data + prev_mend, 0, moff - prev_mend))
			return -EINVAL;

		mtype = btf_type_by_id(btf_vmlinux, member->type);
		mtype = btf_resolve_size(btf_vmlinux, mtype, &msize,
					 NULL, NULL);
		if (IS_ERR(mtype))
			return PTR_ERR(mtype);
		prev_mend = moff + msize;
	}

	if (t->size > prev_mend &&
	    memchr_inv(data + prev_mend, 0, t->size - prev_mend))
		return -EINVAL;

	return 0;
}

static int bpf_struct_ops_map_update_elem(struct bpf_map *map, void *key,
					  void *value, u64 flags)
{
	struct bpf_struct_ops_map *st_map = (struct bpf_struct_ops_map *)map;
	const struct bpf_struct_ops *st_ops = st_map->st_ops;
	struct bpf_struct_ops_value *uvalue, *kvalue;
	const struct btf_member *member;
	const struct btf_type *t = st_ops->type;
	void *udata, *kdata;
	int prog_fd, err = 0;
	void *image;
	u32 i;

	if (flags)
		return -EINVAL;

	if (*(u32 *)key != 0)
		return -E2BIG;

	err = check_zero_holes(st_ops->value_type, value);
	if (err)
		return err;

	uvalue = (struct bpf_struct_ops_value *)value;
	err = check_zero_holes(t, uvalue->data);
	if (err)
		return err;

	if (uvalue->state || refcount_read(&uvalue->refcnt))
		return -EINVAL;

	uvalue = (struct bpf_struct_ops_value *)st_map->uvalue;
	kvalue = (struct bpf_struct_ops_value *)&st_map->kvalue;

	mutex_lock(&st_map->lock);

	if (kvalue->state != BPF_STRUCT_OPS_STATE_INIT) {
		err = -EBUSY;
		goto unlock;
	}

	memcpy(uvalue, value, map->value_size);

	udata = &uvalue->data;
	kdata = &kvalue->data;
	image = st_map->image;

	for_each_member(i, t, member) {
		const struct btf_type *mtype, *ptype;
		struct bpf_prog *prog;
		u32 moff;

		moff = btf_member_bit_offset(t, member) / 8;
		ptype = btf_type_resolve_ptr(btf_vmlinux, member->type, NULL);
		if (ptype == module_type) {
			if (*(void **)(udata + moff))
				goto reset_unlock;
			*(void **)(kdata + moff) = BPF_MODULE_OWNER;
			continue;
		}

		err = st_ops->init_member(t, member, kdata, udata);
		if (err < 0)
			goto reset_unlock;

		/* The ->init_member() has handled this member */
		if (err > 0)
			continue;

		/* If st_ops->init_member does not handle it,
		 * we will only handle func ptrs and zero-ed members
		 * here.  Reject everything else.
		 */

		/* All non func ptr member must be 0 */
		if (!ptype || !btf_type_is_func_proto(ptype)) {
			u32 msize;

			mtype = btf_type_by_id(btf_vmlinux, member->type);
			mtype = btf_resolve_size(btf_vmlinux, mtype, &msize,
						 NULL, NULL);
			if (IS_ERR(mtype)) {
				err = PTR_ERR(mtype);
				goto reset_unlock;
			}

			if (memchr_inv(udata + moff, 0, msize)) {
				err = -EINVAL;
				goto reset_unlock;
			}

			continue;
		}

		prog_fd = (int)(*(unsigned long *)(udata + moff));
		/* Similar check as the attr->attach_prog_fd */
		if (!prog_fd)
			continue;

		prog = bpf_prog_get(prog_fd);
		if (IS_ERR(prog)) {
			err = PTR_ERR(prog);
			goto reset_unlock;
		}
		st_map->progs[i] = prog;

		if (prog->type != BPF_PROG_TYPE_STRUCT_OPS ||
		    prog->aux->attach_btf_id != st_ops->type_id ||
		    prog->expected_attach_type != i) {
			err = -EINVAL;
			goto reset_unlock;
		}

		err = arch_prepare_bpf_trampoline(image,
						  st_map->image + PAGE_SIZE,
						  &st_ops->func_models[i], 0,
						  &prog, 1, NULL, 0, NULL);
		if (err < 0)
			goto reset_unlock;

		*(void **)(kdata + moff) = image;
		image += err;

		/* put prog_id to udata */
		*(unsigned long *)(udata + moff) = prog->aux->id;
	}

	refcount_set(&kvalue->refcnt, 1);
	bpf_map_inc(map);

	set_memory_ro((long)st_map->image, 1);
	set_memory_x((long)st_map->image, 1);
	err = st_ops->reg(kdata);
	if (likely(!err)) {
		/* Pair with smp_load_acquire() during lookup_elem().
		 * It ensures the above udata updates (e.g. prog->aux->id)
		 * can be seen once BPF_STRUCT_OPS_STATE_INUSE is set.
		 */
		smp_store_release(&kvalue->state, BPF_STRUCT_OPS_STATE_INUSE);
		goto unlock;
	}

	/* Error during st_ops->reg().  It is very unlikely since
	 * the above init_member() should have caught it earlier
	 * before reg().  The only possibility is if there was a race
	 * in registering the struct_ops (under the same name) to
	 * a sub-system through different struct_ops's maps.
	 */
	set_memory_nx((long)st_map->image, 1);
	set_memory_rw((long)st_map->image, 1);
	bpf_map_put(map);

reset_unlock:
	bpf_struct_ops_map_put_progs(st_map);
	memset(uvalue, 0, map->value_size);
	memset(kvalue, 0, map->value_size);
unlock:
	mutex_unlock(&st_map->lock);
	return err;
}

static int bpf_struct_ops_map_delete_elem(struct bpf_map *map, void *key)
{
	enum bpf_struct_ops_state prev_state;
	struct bpf_struct_ops_map *st_map;

	st_map = (struct bpf_struct_ops_map *)map;
	prev_state = cmpxchg(&st_map->kvalue.state,
			     BPF_STRUCT_OPS_STATE_INUSE,
			     BPF_STRUCT_OPS_STATE_TOBEFREE);
	if (prev_state == BPF_STRUCT_OPS_STATE_INUSE) {
		st_map->st_ops->unreg(&st_map->kvalue.data);
		if (refcount_dec_and_test(&st_map->kvalue.refcnt))
			bpf_map_put(map);
	}

	return 0;
}

static void bpf_struct_ops_map_seq_show_elem(struct bpf_map *map, void *key,
					     struct seq_file *m)
{
	void *value;
	int err;

	value = kmalloc(map->value_size, GFP_USER | __GFP_NOWARN);
	if (!value)
		return;

	err = bpf_struct_ops_map_sys_lookup_elem(map, key, value);
	if (!err) {
		btf_type_seq_show(btf_vmlinux, map->btf_vmlinux_value_type_id,
				  value, m);
		seq_puts(m, "\n");
	}

	kfree(value);
}

static void bpf_struct_ops_map_free(struct bpf_map *map)
{
	struct bpf_struct_ops_map *st_map = (struct bpf_struct_ops_map *)map;

	if (st_map->progs)
		bpf_struct_ops_map_put_progs(st_map);
	bpf_map_area_free(st_map->progs);
	bpf_jit_free_exec(st_map->image);
	bpf_map_area_free(st_map->uvalue);
	bpf_map_area_free(st_map);
}

static int bpf_struct_ops_map_alloc_check(union bpf_attr *attr)
{
	if (attr->key_size != sizeof(unsigned int) || attr->max_entries != 1 ||
	    attr->map_flags || !attr->btf_vmlinux_value_type_id)
		return -EINVAL;
	return 0;
}

static struct bpf_map *bpf_struct_ops_map_alloc(union bpf_attr *attr)
{
	const struct bpf_struct_ops *st_ops;
	size_t map_total_size, st_map_size;
	struct bpf_struct_ops_map *st_map;
	const struct btf_type *t, *vt;
	struct bpf_map_memory mem;
	struct bpf_map *map;
	int err;

	if (!capable(CAP_SYS_ADMIN))
		return ERR_PTR(-EPERM);

	st_ops = bpf_struct_ops_find_value(attr->btf_vmlinux_value_type_id);
	if (!st_ops)
		return ERR_PTR(-ENOTSUPP);

	vt = st_ops->value_type;
	if (attr->value_size != vt->size)
		return ERR_PTR(-EINVAL);

	t = st_ops->type;

	st_map_size = sizeof(*st_map) +
		/* kvalue stores the
		 * struct bpf_struct_ops_tcp_congestions_ops
		 */
		(vt->size - sizeof(struct bpf_struct_ops_value));
	map_total_size = st_map_size +
		/* uvalue */
		sizeof(vt->size) +
		/* struct bpf_progs **progs */
		 btf_type_vlen(t) * sizeof(struct bpf_prog *);
	err = bpf_map_charge_init(&mem, map_total_size);
	if (err < 0)
		return ERR_PTR(err);

	st_map = bpf_map_area_alloc(st_map_size, NUMA_NO_NODE);
	if (!st_map) {
		bpf_map_charge_finish(&mem);
		return ERR_PTR(-ENOMEM);
	}
	st_map->st_ops = st_ops;
	map = &st_map->map;

	st_map->uvalue = bpf_map_area_alloc(vt->size, NUMA_NO_NODE);
	st_map->progs =
		bpf_map_area_alloc(btf_type_vlen(t) * sizeof(struct bpf_prog *),
				   NUMA_NO_NODE);
	st_map->image = bpf_jit_alloc_exec(PAGE_SIZE);
	if (!st_map->uvalue || !st_map->progs || !st_map->image) {
		bpf_struct_ops_map_free(map);
		bpf_map_charge_finish(&mem);
		return ERR_PTR(-ENOMEM);
	}

	mutex_init(&st_map->lock);
	set_vm_flush_reset_perms(st_map->image);
	bpf_map_init_from_attr(map, attr);
	bpf_map_charge_move(&map->memory, &mem);

	return map;
}

const struct bpf_map_ops bpf_struct_ops_map_ops = {
	.map_alloc_check = bpf_struct_ops_map_alloc_check,
	.map_alloc = bpf_struct_ops_map_alloc,
	.map_free = bpf_struct_ops_map_free,
	.map_get_next_key = bpf_struct_ops_map_get_next_key,
	.map_lookup_elem = bpf_struct_ops_map_lookup_elem,
	.map_delete_elem = bpf_struct_ops_map_delete_elem,
	.map_update_elem = bpf_struct_ops_map_update_elem,
	.map_seq_show_elem = bpf_struct_ops_map_seq_show_elem,
};

/* "const void *" because some subsystem is
 * passing a const (e.g. const struct tcp_congestion_ops *)
 */
bool bpf_struct_ops_get(const void *kdata)
{
	struct bpf_struct_ops_value *kvalue;

	kvalue = container_of(kdata, struct bpf_struct_ops_value, data);

	return refcount_inc_not_zero(&kvalue->refcnt);
}

void bpf_struct_ops_put(const void *kdata)
{
	struct bpf_struct_ops_value *kvalue;

	kvalue = container_of(kdata, struct bpf_struct_ops_value, data);
	if (refcount_dec_and_test(&kvalue->refcnt)) {
		struct bpf_struct_ops_map *st_map;

		st_map = container_of(kvalue, struct bpf_struct_ops_map,
				      kvalue);
		bpf_map_put(&st_map->map);
	}
}
Commit	Line	Data
27ae7997 MKL	1	// SPDX-License-Identifier: GPL-2.0-only
	2	/* Copyright (c) 2019 Facebook */
	3
	4	#include <linux/bpf.h>
	5	#include <linux/bpf_verifier.h>
	6	#include <linux/btf.h>
	7	#include <linux/filter.h>
	8	#include <linux/slab.h>
	9	#include <linux/numa.h>
	10	#include <linux/seq_file.h>
	11	#include <linux/refcount.h>
85d33df3	12	#include <linux/mutex.h>
27ae7997	13
85d33df3 MKL	14	enum bpf_struct_ops_state {
	15	BPF_STRUCT_OPS_STATE_INIT,
	16	BPF_STRUCT_OPS_STATE_INUSE,
	17	BPF_STRUCT_OPS_STATE_TOBEFREE,
	18	};
	19
	20	#define BPF_STRUCT_OPS_COMMON_VALUE \
	21	refcount_t refcnt; \
	22	enum bpf_struct_ops_state state
	23
	24	struct bpf_struct_ops_value {
	25	BPF_STRUCT_OPS_COMMON_VALUE;
	26	char data[0] ____cacheline_aligned_in_smp;
	27	};
	28
	29	struct bpf_struct_ops_map {
	30	struct bpf_map map;
	31	const struct bpf_struct_ops *st_ops;
	32	/* protect map_update */
	33	struct mutex lock;
	34	/* progs has all the bpf_prog that is populated
	35	* to the func ptr of the kernel's struct
	36	* (in kvalue.data).
	37	*/
	38	struct bpf_prog **progs;
	39	/* image is a page that has all the trampolines
	40	* that stores the func args before calling the bpf_prog.
	41	* A PAGE_SIZE "image" is enough to store all trampoline for
	42	* "progs[]".
	43	*/
	44	void *image;
	45	/* uvalue->data stores the kernel struct
	46	* (e.g. tcp_congestion_ops) that is more useful
	47	* to userspace than the kvalue. For example,
	48	* the bpf_prog's id is stored instead of the kernel
	49	* address of a func ptr.
	50	*/
	51	struct bpf_struct_ops_value *uvalue;
	52	/* kvalue.data stores the actual kernel's struct
	53	* (e.g. tcp_congestion_ops) that will be
	54	* registered to the kernel subsystem.
	55	*/
	56	struct bpf_struct_ops_value kvalue;
	57	};
	58
	59	#define VALUE_PREFIX "bpf_struct_ops_"
	60	#define VALUE_PREFIX_LEN (sizeof(VALUE_PREFIX) - 1)
	61
	62	/* bpf_struct_ops_##_name (e.g. bpf_struct_ops_tcp_congestion_ops) is
	63	* the map's value exposed to the userspace and its btf-type-id is
	64	* stored at the map->btf_vmlinux_value_type_id.
	65	*
	66	*/
27ae7997	67	#define BPF_STRUCT_OPS_TYPE(_name) \
85d33df3 MKL	68	extern struct bpf_struct_ops bpf_##_name; \
	69	\
	70	struct bpf_struct_ops_##_name { \
	71	BPF_STRUCT_OPS_COMMON_VALUE; \
	72	struct _name data ____cacheline_aligned_in_smp; \
	73	};
27ae7997 MKL	74	#include "bpf_struct_ops_types.h"
	75	#undef BPF_STRUCT_OPS_TYPE
	76
	77	enum {
	78	#define BPF_STRUCT_OPS_TYPE(_name) BPF_STRUCT_OPS_TYPE_##_name,
	79	#include "bpf_struct_ops_types.h"
	80	#undef BPF_STRUCT_OPS_TYPE
	81	__NR_BPF_STRUCT_OPS_TYPE,
	82	};
	83
	84	static struct bpf_struct_ops * const bpf_struct_ops[] = {
	85	#define BPF_STRUCT_OPS_TYPE(_name) \
	86	[BPF_STRUCT_OPS_TYPE_##_name] = &bpf_##_name,
	87	#include "bpf_struct_ops_types.h"
	88	#undef BPF_STRUCT_OPS_TYPE
	89	};
	90
	91	const struct bpf_verifier_ops bpf_struct_ops_verifier_ops = {
	92	};
	93
	94	const struct bpf_prog_ops bpf_struct_ops_prog_ops = {
	95	};
	96
85d33df3 MKL	97	static const struct btf_type *module_type;
85d33df3 MKL	98
27ae7997 MKL	99	void bpf_struct_ops_init(struct btf *btf)
27ae7997 MKL	100	{
85d33df3	101	s32 type_id, value_id, module_id;
27ae7997 MKL	102	const struct btf_member *member;
	103	struct bpf_struct_ops *st_ops;
	104	struct bpf_verifier_log log = {};
	105	const struct btf_type *t;
85d33df3	106	char value_name[128];
27ae7997	107	const char *mname;
27ae7997 MKL	108	u32 i, j;
27ae7997 MKL	109
85d33df3 MKL	110	/* Ensure BTF type is emitted for "struct bpf_struct_ops_##_name" */
	111	#define BPF_STRUCT_OPS_TYPE(_name) BTF_TYPE_EMIT(struct bpf_struct_ops_##_name);
	112	#include "bpf_struct_ops_types.h"
	113	#undef BPF_STRUCT_OPS_TYPE
	114
	115	module_id = btf_find_by_name_kind(btf, "module", BTF_KIND_STRUCT);
	116	if (module_id < 0) {
	117	pr_warn("Cannot find struct module in btf_vmlinux\n");
	118	return;
	119	}
	120	module_type = btf_type_by_id(btf, module_id);
	121
27ae7997 MKL	122	for (i = 0; i < ARRAY_SIZE(bpf_struct_ops); i++) {
	123	st_ops = bpf_struct_ops[i];
	124
85d33df3 MKL	125	if (strlen(st_ops->name) + VALUE_PREFIX_LEN >=
	126	sizeof(value_name)) {
	127	pr_warn("struct_ops name %s is too long\n",
	128	st_ops->name);
	129	continue;
	130	}
	131	sprintf(value_name, "%s%s", VALUE_PREFIX, st_ops->name);
	132
	133	value_id = btf_find_by_name_kind(btf, value_name,
	134	BTF_KIND_STRUCT);
	135	if (value_id < 0) {
	136	pr_warn("Cannot find struct %s in btf_vmlinux\n",
	137	value_name);
	138	continue;
	139	}
	140
27ae7997 MKL	141	type_id = btf_find_by_name_kind(btf, st_ops->name,
	142	BTF_KIND_STRUCT);
	143	if (type_id < 0) {
	144	pr_warn("Cannot find struct %s in btf_vmlinux\n",
	145	st_ops->name);
	146	continue;
	147	}
	148	t = btf_type_by_id(btf, type_id);
	149	if (btf_type_vlen(t) > BPF_STRUCT_OPS_MAX_NR_MEMBERS) {
	150	pr_warn("Cannot support #%u members in struct %s\n",
	151	btf_type_vlen(t), st_ops->name);
	152	continue;
	153	}
	154
	155	for_each_member(j, t, member) {
	156	const struct btf_type *func_proto;
	157
	158	mname = btf_name_by_offset(btf, member->name_off);
	159	if (!*mname) {
	160	pr_warn("anon member in struct %s is not supported\n",
	161	st_ops->name);
	162	break;
	163	}
	164
	165	if (btf_member_bitfield_size(t, member)) {
	166	pr_warn("bit field member %s in struct %s is not supported\n",
	167	mname, st_ops->name);
	168	break;
	169	}
	170
	171	func_proto = btf_type_resolve_func_ptr(btf,
	172	member->type,
	173	NULL);
	174	if (func_proto &&
	175	btf_distill_func_proto(&log, btf,
	176	func_proto, mname,
	177	&st_ops->func_models[j])) {
	178	pr_warn("Error in parsing func ptr %s in struct %s\n",
	179	mname, st_ops->name);
	180	break;
	181	}
	182	}
	183
	184	if (j == btf_type_vlen(t)) {
	185	if (st_ops->init(btf)) {
	186	pr_warn("Error in init bpf_struct_ops %s\n",
	187	st_ops->name);
	188	} else {
	189	st_ops->type_id = type_id;
	190	st_ops->type = t;
85d33df3 MKL	191	st_ops->value_id = value_id;
	192	st_ops->value_type = btf_type_by_id(btf,
	193	value_id);
27ae7997 MKL	194	}
	195	}
	196	}
	197	}
	198
	199	extern struct btf *btf_vmlinux;
	200
85d33df3 MKL	201	static const struct bpf_struct_ops *
	202	bpf_struct_ops_find_value(u32 value_id)
	203	{
	204	unsigned int i;
	205
	206	if (!value_id \|\| !btf_vmlinux)
	207	return NULL;
	208
	209	for (i = 0; i < ARRAY_SIZE(bpf_struct_ops); i++) {
	210	if (bpf_struct_ops[i]->value_id == value_id)
	211	return bpf_struct_ops[i];
	212	}
	213
	214	return NULL;
	215	}
	216
27ae7997 MKL	217	const struct bpf_struct_ops *bpf_struct_ops_find(u32 type_id)
	218	{
	219	unsigned int i;
	220
	221	if (!type_id \|\| !btf_vmlinux)
	222	return NULL;
	223
	224	for (i = 0; i < ARRAY_SIZE(bpf_struct_ops); i++) {
	225	if (bpf_struct_ops[i]->type_id == type_id)
	226	return bpf_struct_ops[i];
	227	}
	228
	229	return NULL;
	230	}
85d33df3 MKL	231
	232	static int bpf_struct_ops_map_get_next_key(struct bpf_map map, void key,
	233	void *next_key)
	234	{
	235	if (key && (u32 )key == 0)
	236	return -ENOENT;
	237
	238	(u32 )next_key = 0;
	239	return 0;
	240	}
	241
	242	int bpf_struct_ops_map_sys_lookup_elem(struct bpf_map map, void key,
	243	void *value)
	244	{
	245	struct bpf_struct_ops_map st_map = (struct bpf_struct_ops_map )map;
	246	struct bpf_struct_ops_value uvalue, kvalue;
	247	enum bpf_struct_ops_state state;
	248
	249	if (unlikely((u32 )key != 0))
	250	return -ENOENT;
	251
	252	kvalue = &st_map->kvalue;
	253	/* Pair with smp_store_release() during map_update */
	254	state = smp_load_acquire(&kvalue->state);
	255	if (state == BPF_STRUCT_OPS_STATE_INIT) {
	256	memset(value, 0, map->value_size);
	257	return 0;
	258	}
	259
	260	/* No lock is needed. state and refcnt do not need
	261	* to be updated together under atomic context.
	262	*/
	263	uvalue = (struct bpf_struct_ops_value *)value;
	264	memcpy(uvalue, st_map->uvalue, map->value_size);
	265	uvalue->state = state;
	266	refcount_set(&uvalue->refcnt, refcount_read(&kvalue->refcnt));
	267
	268	return 0;
	269	}
	270
	271	static void bpf_struct_ops_map_lookup_elem(struct bpf_map map, void *key)
	272	{
	273	return ERR_PTR(-EINVAL);
	274	}
	275
	276	static void bpf_struct_ops_map_put_progs(struct bpf_struct_ops_map *st_map)
	277	{
	278	const struct btf_type *t = st_map->st_ops->type;
	279	u32 i;
	280
	281	for (i = 0; i < btf_type_vlen(t); i++) {
	282	if (st_map->progs[i]) {
	283	bpf_prog_put(st_map->progs[i]);
	284	st_map->progs[i] = NULL;
	285	}
	286	}
	287	}
	288
	289	static int check_zero_holes(const struct btf_type t, void data)
	290	{
	291	const struct btf_member *member;
	292	u32 i, moff, msize, prev_mend = 0;
	293	const struct btf_type *mtype;
	294
295	for_each_member(i, t, member) {
296	moff = btf_member_bit_offset(t, member) / 8;
297	if (moff > prev_mend &&
298	memchr_inv(data + prev_mend, 0, moff - prev_mend))
299	return -EINVAL;
300
301	mtype = btf_type_by_id(btf_vmlinux, member->type);
302	mtype = btf_resolve_size(btf_vmlinux, mtype, &msize,
303	NULL, NULL);
304	if (IS_ERR(mtype))
305	return PTR_ERR(mtype);
306	prev_mend = moff + msize;
307	}
308
309	if (t->size > prev_mend &&
310	memchr_inv(data + prev_mend, 0, t->size - prev_mend))
311	return -EINVAL;
312
313	return 0;
314	}
315
316	static int bpf_struct_ops_map_update_elem(struct bpf_map map, void key,
317	void *value, u64 flags)
318	{
319	struct bpf_struct_ops_map st_map = (struct bpf_struct_ops_map )map;
320	const struct bpf_struct_ops *st_ops = st_map->st_ops;
321	struct bpf_struct_ops_value uvalue, kvalue;
322	const struct btf_member *member;
323	const struct btf_type *t = st_ops->type;
324	void udata, kdata;
325	int prog_fd, err = 0;
326	void *image;
327	u32 i;
328
329	if (flags)
330	return -EINVAL;
331
332	if ((u32 )key != 0)
333	return -E2BIG;
334
335	err = check_zero_holes(st_ops->value_type, value);
336	if (err)
337	return err;
338
339	uvalue = (struct bpf_struct_ops_value *)value;
340	err = check_zero_holes(t, uvalue->data);
341	if (err)
342	return err;
343
344	if (uvalue->state \|\| refcount_read(&uvalue->refcnt))
345	return -EINVAL;
346
347	uvalue = (struct bpf_struct_ops_value *)st_map->uvalue;
348	kvalue = (struct bpf_struct_ops_value *)&st_map->kvalue;
349
350	mutex_lock(&st_map->lock);
351
352	if (kvalue->state != BPF_STRUCT_OPS_STATE_INIT) {
353	err = -EBUSY;
354	goto unlock;
355	}
356
357	memcpy(uvalue, value, map->value_size);
358
359	udata = &uvalue->data;
360	kdata = &kvalue->data;
361	image = st_map->image;
362
363	for_each_member(i, t, member) {
364	const struct btf_type mtype, ptype;
365	struct bpf_prog *prog;
366	u32 moff;
367
368	moff = btf_member_bit_offset(t, member) / 8;
369	ptype = btf_type_resolve_ptr(btf_vmlinux, member->type, NULL);
370	if (ptype == module_type) {
371	if ((void *)(udata + moff))
372	goto reset_unlock;
373	(void *)(kdata + moff) = BPF_MODULE_OWNER;
374	continue;
375	}
376
377	err = st_ops->init_member(t, member, kdata, udata);
378	if (err < 0)
379	goto reset_unlock;
380
381	/* The ->init_member() has handled this member */
382	if (err > 0)
383	continue;
384
385	/* If st_ops->init_member does not handle it,
386	* we will only handle func ptrs and zero-ed members
387	* here. Reject everything else.
388	*/
389
390	/* All non func ptr member must be 0 */
391	if (!ptype \|\| !btf_type_is_func_proto(ptype)) {
392	u32 msize;
393
394	mtype = btf_type_by_id(btf_vmlinux, member->type);
395	mtype = btf_resolve_size(btf_vmlinux, mtype, &msize,
396	NULL, NULL);
397	if (IS_ERR(mtype)) {
398	err = PTR_ERR(mtype);
399	goto reset_unlock;
400	}
401
402	if (memchr_inv(udata + moff, 0, msize)) {
403	err = -EINVAL;
404	goto reset_unlock;
405	}
406
407	continue;
408	}
409
410	prog_fd = (int)((unsigned long )(udata + moff));
411	/* Similar check as the attr->attach_prog_fd */
412	if (!prog_fd)
413	continue;
414
415	prog = bpf_prog_get(prog_fd);
416	if (IS_ERR(prog)) {
417	err = PTR_ERR(prog);
418	goto reset_unlock;
419	}
420	st_map->progs[i] = prog;
421
422	if (prog->type != BPF_PROG_TYPE_STRUCT_OPS \|\|
423	prog->aux->attach_btf_id != st_ops->type_id \|\|
424	prog->expected_attach_type != i) {
425	err = -EINVAL;
426	goto reset_unlock;
427	}
428
429	err = arch_prepare_bpf_trampoline(image,
430	st_map->image + PAGE_SIZE,
431	&st_ops->func_models[i], 0,
432	&prog, 1, NULL, 0, NULL);
433	if (err < 0)
434	goto reset_unlock;
435
436	(void *)(kdata + moff) = image;
437	image += err;
438
439	/* put prog_id to udata */
440	(unsigned long )(udata + moff) = prog->aux->id;
441	}
442
443	refcount_set(&kvalue->refcnt, 1);
444	bpf_map_inc(map);
445
446	set_memory_ro((long)st_map->image, 1);
447	set_memory_x((long)st_map->image, 1);
448	err = st_ops->reg(kdata);
449	if (likely(!err)) {
450	/* Pair with smp_load_acquire() during lookup_elem().
451	* It ensures the above udata updates (e.g. prog->aux->id)
452	* can be seen once BPF_STRUCT_OPS_STATE_INUSE is set.
453	*/
454	smp_store_release(&kvalue->state, BPF_STRUCT_OPS_STATE_INUSE);
455	goto unlock;
456	}
457
458	/* Error during st_ops->reg(). It is very unlikely since
459	* the above init_member() should have caught it earlier
460	* before reg(). The only possibility is if there was a race
461	* in registering the struct_ops (under the same name) to
462	* a sub-system through different struct_ops's maps.
463	*/
464	set_memory_nx((long)st_map->image, 1);
465	set_memory_rw((long)st_map->image, 1);
466	bpf_map_put(map);
467
468	reset_unlock:
469	bpf_struct_ops_map_put_progs(st_map);
470	memset(uvalue, 0, map->value_size);
471	memset(kvalue, 0, map->value_size);
472	unlock:
473	mutex_unlock(&st_map->lock);
474	return err;
475	}
476
477	static int bpf_struct_ops_map_delete_elem(struct bpf_map map, void key)
478	{
479	enum bpf_struct_ops_state prev_state;
480	struct bpf_struct_ops_map *st_map;
481
482	st_map = (struct bpf_struct_ops_map *)map;
483	prev_state = cmpxchg(&st_map->kvalue.state,
484	BPF_STRUCT_OPS_STATE_INUSE,
485	BPF_STRUCT_OPS_STATE_TOBEFREE);
486	if (prev_state == BPF_STRUCT_OPS_STATE_INUSE) {
487	st_map->st_ops->unreg(&st_map->kvalue.data);
488	if (refcount_dec_and_test(&st_map->kvalue.refcnt))
489	bpf_map_put(map);
490	}
491
492	return 0;
493	}
494
495	static void bpf_struct_ops_map_seq_show_elem(struct bpf_map map, void key,
496	struct seq_file *m)
497	{
498	void *value;
3b413041	499	int err;
85d33df3	500
3b413041	501	value = kmalloc(map->value_size, GFP_USER \| __GFP_NOWARN);
85d33df3 MKL	502	if (!value)
	503	return;
	504
3b413041 MKL	505	err = bpf_struct_ops_map_sys_lookup_elem(map, key, value);
	506	if (!err) {
	507	btf_type_seq_show(btf_vmlinux, map->btf_vmlinux_value_type_id,
	508	value, m);
	509	seq_puts(m, "\n");
	510	}
	511
	512	kfree(value);
85d33df3 MKL	513	}
	514
	515	static void bpf_struct_ops_map_free(struct bpf_map *map)
	516	{
	517	struct bpf_struct_ops_map st_map = (struct bpf_struct_ops_map )map;
	518
	519	if (st_map->progs)
	520	bpf_struct_ops_map_put_progs(st_map);
	521	bpf_map_area_free(st_map->progs);
	522	bpf_jit_free_exec(st_map->image);
	523	bpf_map_area_free(st_map->uvalue);
	524	bpf_map_area_free(st_map);
	525	}
	526
	527	static int bpf_struct_ops_map_alloc_check(union bpf_attr *attr)
	528	{
	529	if (attr->key_size != sizeof(unsigned int) \|\| attr->max_entries != 1 \|\|
	530	attr->map_flags \|\| !attr->btf_vmlinux_value_type_id)
	531	return -EINVAL;
	532	return 0;
	533	}
	534
	535	static struct bpf_map bpf_struct_ops_map_alloc(union bpf_attr attr)
	536	{
	537	const struct bpf_struct_ops *st_ops;
	538	size_t map_total_size, st_map_size;
	539	struct bpf_struct_ops_map *st_map;
	540	const struct btf_type t, vt;
	541	struct bpf_map_memory mem;
	542	struct bpf_map *map;
	543	int err;
	544
	545	if (!capable(CAP_SYS_ADMIN))
	546	return ERR_PTR(-EPERM);
	547
	548	st_ops = bpf_struct_ops_find_value(attr->btf_vmlinux_value_type_id);
	549	if (!st_ops)
	550	return ERR_PTR(-ENOTSUPP);
	551
	552	vt = st_ops->value_type;
	553	if (attr->value_size != vt->size)
	554	return ERR_PTR(-EINVAL);
	555
	556	t = st_ops->type;
	557
	558	st_map_size = sizeof(*st_map) +
	559	/* kvalue stores the
	560	* struct bpf_struct_ops_tcp_congestions_ops
	561	*/
	562	(vt->size - sizeof(struct bpf_struct_ops_value));
	563	map_total_size = st_map_size +
	564	/* uvalue */
	565	sizeof(vt->size) +
	566	/* struct bpf_progs *progs /
	567	btf_type_vlen(t) * sizeof(struct bpf_prog *);
	568	err = bpf_map_charge_init(&mem, map_total_size);
	569	if (err < 0)
	570	return ERR_PTR(err);
	571
	572	st_map = bpf_map_area_alloc(st_map_size, NUMA_NO_NODE);
	573	if (!st_map) {
	574	bpf_map_charge_finish(&mem);
	575	return ERR_PTR(-ENOMEM);
	576	}
577	st_map->st_ops = st_ops;
578	map = &st_map->map;
579
580	st_map->uvalue = bpf_map_area_alloc(vt->size, NUMA_NO_NODE);
581	st_map->progs =
582	bpf_map_area_alloc(btf_type_vlen(t) * sizeof(struct bpf_prog *),
583	NUMA_NO_NODE);
584	st_map->image = bpf_jit_alloc_exec(PAGE_SIZE);
585	if (!st_map->uvalue \|\| !st_map->progs \|\| !st_map->image) {
586	bpf_struct_ops_map_free(map);
587	bpf_map_charge_finish(&mem);
588	return ERR_PTR(-ENOMEM);
589	}
590
591	mutex_init(&st_map->lock);
592	set_vm_flush_reset_perms(st_map->image);
593	bpf_map_init_from_attr(map, attr);
594	bpf_map_charge_move(&map->memory, &mem);
595
596	return map;
597	}
598
599	const struct bpf_map_ops bpf_struct_ops_map_ops = {
600	.map_alloc_check = bpf_struct_ops_map_alloc_check,
601	.map_alloc = bpf_struct_ops_map_alloc,
602	.map_free = bpf_struct_ops_map_free,
603	.map_get_next_key = bpf_struct_ops_map_get_next_key,
604	.map_lookup_elem = bpf_struct_ops_map_lookup_elem,
605	.map_delete_elem = bpf_struct_ops_map_delete_elem,
606	.map_update_elem = bpf_struct_ops_map_update_elem,
607	.map_seq_show_elem = bpf_struct_ops_map_seq_show_elem,
608	};
609
610	/* "const void *" because some subsystem is
611	* passing a const (e.g. const struct tcp_congestion_ops *)
612	*/
613	bool bpf_struct_ops_get(const void *kdata)
614	{
615	struct bpf_struct_ops_value *kvalue;
616
617	kvalue = container_of(kdata, struct bpf_struct_ops_value, data);
618
619	return refcount_inc_not_zero(&kvalue->refcnt);
620	}
621
622	void bpf_struct_ops_put(const void *kdata)
623	{
624	struct bpf_struct_ops_value *kvalue;
625
626	kvalue = container_of(kdata, struct bpf_struct_ops_value, data);
627	if (refcount_dec_and_test(&kvalue->refcnt)) {
628	struct bpf_struct_ops_map *st_map;
629
630	st_map = container_of(kvalue, struct bpf_struct_ops_map,
631	kvalue);
632	bpf_map_put(&st_map->map);
633	}
634	}