3497 lines · 87.4 KB · C
RawDownload
/* SPDX-License-Identifier: GPL-2.0 *//* Copyright (c) 2018 Facebook */ #include <uapi/linux/btf.h>#include <uapi/linux/types.h>#include <linux/seq_file.h>#include <linux/compiler.h>#include <linux/ctype.h>#include <linux/errno.h>#include <linux/slab.h>#include <linux/anon_inodes.h>#include <linux/file.h>#include <linux/uaccess.h>#include <linux/kernel.h>#include <linux/idr.h>#include <linux/sort.h>#include <linux/bpf_verifier.h>#include <linux/btf.h> /* BTF (BPF Type Format) is the meta data format which describes * the data types of BPF program/map.  Hence, it basically focus * on the C programming language which the modern BPF is primary * using. * * ELF Section: * ~~~~~~~~~~~ * The BTF data is stored under the ".BTF" ELF section * * struct btf_type: * ~~~~~~~~~~~~~~~ * Each 'struct btf_type' object describes a C data type. * Depending on the type it is describing, a 'struct btf_type' * object may be followed by more data.  F.e. * To describe an array, 'struct btf_type' is followed by * 'struct btf_array'. * * 'struct btf_type' and any extra data following it are * 4 bytes aligned. * * Type section: * ~~~~~~~~~~~~~ * The BTF type section contains a list of 'struct btf_type' objects. * Each one describes a C type.  Recall from the above section * that a 'struct btf_type' object could be immediately followed by extra * data in order to desribe some particular C types. * * type_id: * ~~~~~~~ * Each btf_type object is identified by a type_id.  The type_id * is implicitly implied by the location of the btf_type object in * the BTF type section.  The first one has type_id 1.  The second * one has type_id 2...etc.  Hence, an earlier btf_type has * a smaller type_id. * * A btf_type object may refer to another btf_type object by using * type_id (i.e. the "type" in the "struct btf_type"). * * NOTE that we cannot assume any reference-order. * A btf_type object can refer to an earlier btf_type object * but it can also refer to a later btf_type object. * * For example, to describe "const void *".  A btf_type * object describing "const" may refer to another btf_type * object describing "void *".  This type-reference is done * by specifying type_id: * * [1] CONST (anon) type_id=2 * [2] PTR (anon) type_id=0 * * The above is the btf_verifier debug log: *   - Each line started with "[?]" is a btf_type object *   - [?] is the type_id of the btf_type object. *   - CONST/PTR is the BTF_KIND_XXX *   - "(anon)" is the name of the type.  It just *     happens that CONST and PTR has no name. *   - type_id=XXX is the 'u32 type' in btf_type * * NOTE: "void" has type_id 0 * * String section: * ~~~~~~~~~~~~~~ * The BTF string section contains the names used by the type section. * Each string is referred by an "offset" from the beginning of the * string section. * * Each string is '\0' terminated. * * The first character in the string section must be '\0' * which is used to mean 'anonymous'. Some btf_type may not * have a name. */ /* BTF verification: * * To verify BTF data, two passes are needed. * * Pass #1 * ~~~~~~~ * The first pass is to collect all btf_type objects to * an array: "btf->types". * * Depending on the C type that a btf_type is describing, * a btf_type may be followed by extra data.  We don't know * how many btf_type is there, and more importantly we don't * know where each btf_type is located in the type section. * * Without knowing the location of each type_id, most verifications * cannot be done.  e.g. an earlier btf_type may refer to a later * btf_type (recall the "const void *" above), so we cannot * check this type-reference in the first pass. * * In the first pass, it still does some verifications (e.g. * checking the name is a valid offset to the string section). * * Pass #2 * ~~~~~~~ * The main focus is to resolve a btf_type that is referring * to another type. * * We have to ensure the referring type: * 1) does exist in the BTF (i.e. in btf->types[]) * 2) does not cause a loop: *	struct A { *		struct B b; *	}; * *	struct B { *		struct A a; *	}; * * btf_type_needs_resolve() decides if a btf_type needs * to be resolved. * * The needs_resolve type implements the "resolve()" ops which * essentially does a DFS and detects backedge. * * During resolve (or DFS), different C types have different * "RESOLVED" conditions. * * When resolving a BTF_KIND_STRUCT, we need to resolve all its * members because a member is always referring to another * type.  A struct's member can be treated as "RESOLVED" if * it is referring to a BTF_KIND_PTR.  Otherwise, the * following valid C struct would be rejected: * *	struct A { *		int m; *		struct A *a; *	}; * * When resolving a BTF_KIND_PTR, it needs to keep resolving if * it is referring to another BTF_KIND_PTR.  Otherwise, we cannot * detect a pointer loop, e.g.: * BTF_KIND_CONST -> BTF_KIND_PTR -> BTF_KIND_CONST -> BTF_KIND_PTR + *                        ^                                         | *                        +-----------------------------------------+ * */ #define BITS_PER_U128 (sizeof(u64) * BITS_PER_BYTE * 2)#define BITS_PER_BYTE_MASK (BITS_PER_BYTE - 1)#define BITS_PER_BYTE_MASKED(bits) ((bits) & BITS_PER_BYTE_MASK)#define BITS_ROUNDDOWN_BYTES(bits) ((bits) >> 3)#define BITS_ROUNDUP_BYTES(bits) \	(BITS_ROUNDDOWN_BYTES(bits) + !!BITS_PER_BYTE_MASKED(bits)) #define BTF_INFO_MASK 0x8f00ffff#define BTF_INT_MASK 0x0fffffff#define BTF_TYPE_ID_VALID(type_id) ((type_id) <= BTF_MAX_TYPE)#define BTF_STR_OFFSET_VALID(name_off) ((name_off) <= BTF_MAX_NAME_OFFSET) /* 16MB for 64k structs and each has 16 members and * a few MB spaces for the string section. * The hard limit is S32_MAX. */#define BTF_MAX_SIZE (16 * 1024 * 1024) #define for_each_member(i, struct_type, member)			\	for (i = 0, member = btf_type_member(struct_type);	\	     i < btf_type_vlen(struct_type);			\	     i++, member++) #define for_each_member_from(i, from, struct_type, member)		\	for (i = from, member = btf_type_member(struct_type) + from;	\	     i < btf_type_vlen(struct_type);				\	     i++, member++) #define for_each_vsi(i, struct_type, member)			\	for (i = 0, member = btf_type_var_secinfo(struct_type);	\	     i < btf_type_vlen(struct_type);			\	     i++, member++) #define for_each_vsi_from(i, from, struct_type, member)				\	for (i = from, member = btf_type_var_secinfo(struct_type) + from;	\	     i < btf_type_vlen(struct_type);					\	     i++, member++) static DEFINE_IDR(btf_idr);static DEFINE_SPINLOCK(btf_idr_lock); struct btf {	void *data;	struct btf_type **types;	u32 *resolved_ids;	u32 *resolved_sizes;	const char *strings;	void *nohdr_data;	struct btf_header hdr;	u32 nr_types;	u32 types_size;	u32 data_size;	refcount_t refcnt;	u32 id;	struct rcu_head rcu;}; enum verifier_phase {	CHECK_META,	CHECK_TYPE,}; struct resolve_vertex {	const struct btf_type *t;	u32 type_id;	u16 next_member;}; enum visit_state {	NOT_VISITED,	VISITED,	RESOLVED,}; enum resolve_mode {	RESOLVE_TBD,	/* To Be Determined */	RESOLVE_PTR,	/* Resolving for Pointer */	RESOLVE_STRUCT_OR_ARRAY,	/* Resolving for struct/union					 * or array					 */}; #define MAX_RESOLVE_DEPTH 32 struct btf_sec_info {	u32 off;	u32 len;}; struct btf_verifier_env {	struct btf *btf;	u8 *visit_states;	struct resolve_vertex stack[MAX_RESOLVE_DEPTH];	struct bpf_verifier_log log;	u32 log_type_id;	u32 top_stack;	enum verifier_phase phase;	enum resolve_mode resolve_mode;}; static const char * const btf_kind_str[NR_BTF_KINDS] = {	[BTF_KIND_UNKN]		= "UNKNOWN",	[BTF_KIND_INT]		= "INT",	[BTF_KIND_PTR]		= "PTR",	[BTF_KIND_ARRAY]	= "ARRAY",	[BTF_KIND_STRUCT]	= "STRUCT",	[BTF_KIND_UNION]	= "UNION",	[BTF_KIND_ENUM]		= "ENUM",	[BTF_KIND_FWD]		= "FWD",	[BTF_KIND_TYPEDEF]	= "TYPEDEF",	[BTF_KIND_VOLATILE]	= "VOLATILE",	[BTF_KIND_CONST]	= "CONST",	[BTF_KIND_RESTRICT]	= "RESTRICT",	[BTF_KIND_FUNC]		= "FUNC",	[BTF_KIND_FUNC_PROTO]	= "FUNC_PROTO",	[BTF_KIND_VAR]		= "VAR",	[BTF_KIND_DATASEC]	= "DATASEC",}; struct btf_kind_operations {	s32 (*check_meta)(struct btf_verifier_env *env,			  const struct btf_type *t,			  u32 meta_left);	int (*resolve)(struct btf_verifier_env *env,		       const struct resolve_vertex *v);	int (*check_member)(struct btf_verifier_env *env,			    const struct btf_type *struct_type,			    const struct btf_member *member,			    const struct btf_type *member_type);	int (*check_kflag_member)(struct btf_verifier_env *env,				  const struct btf_type *struct_type,				  const struct btf_member *member,				  const struct btf_type *member_type);	void (*log_details)(struct btf_verifier_env *env,			    const struct btf_type *t);	void (*seq_show)(const struct btf *btf, const struct btf_type *t,			 u32 type_id, void *data, u8 bits_offsets,			 struct seq_file *m);}; static const struct btf_kind_operations * const kind_ops[NR_BTF_KINDS];static struct btf_type btf_void; static int btf_resolve(struct btf_verifier_env *env,		       const struct btf_type *t, u32 type_id); static bool btf_type_is_modifier(const struct btf_type *t){	/* Some of them is not strictly a C modifier	 * but they are grouped into the same bucket	 * for BTF concern:	 *   A type (t) that refers to another	 *   type through t->type AND its size cannot	 *   be determined without following the t->type.	 *	 * ptr does not fall into this bucket	 * because its size is always sizeof(void *).	 */	switch (BTF_INFO_KIND(t->info)) {	case BTF_KIND_TYPEDEF:	case BTF_KIND_VOLATILE:	case BTF_KIND_CONST:	case BTF_KIND_RESTRICT:		return true;	} 	return false;} bool btf_type_is_void(const struct btf_type *t){	return t == &btf_void;} static bool btf_type_is_fwd(const struct btf_type *t){	return BTF_INFO_KIND(t->info) == BTF_KIND_FWD;} static bool btf_type_is_func(const struct btf_type *t){	return BTF_INFO_KIND(t->info) == BTF_KIND_FUNC;} static bool btf_type_is_func_proto(const struct btf_type *t){	return BTF_INFO_KIND(t->info) == BTF_KIND_FUNC_PROTO;} static bool btf_type_nosize(const struct btf_type *t){	return btf_type_is_void(t) || btf_type_is_fwd(t) ||	       btf_type_is_func(t) || btf_type_is_func_proto(t);} static bool btf_type_nosize_or_null(const struct btf_type *t){	return !t || btf_type_nosize(t);} /* union is only a special case of struct: * all its offsetof(member) == 0 */static bool btf_type_is_struct(const struct btf_type *t){	u8 kind = BTF_INFO_KIND(t->info); 	return kind == BTF_KIND_STRUCT || kind == BTF_KIND_UNION;} static bool __btf_type_is_struct(const struct btf_type *t){	return BTF_INFO_KIND(t->info) == BTF_KIND_STRUCT;} static bool btf_type_is_array(const struct btf_type *t){	return BTF_INFO_KIND(t->info) == BTF_KIND_ARRAY;} static bool btf_type_is_ptr(const struct btf_type *t){	return BTF_INFO_KIND(t->info) == BTF_KIND_PTR;} static bool btf_type_is_int(const struct btf_type *t){	return BTF_INFO_KIND(t->info) == BTF_KIND_INT;} static bool btf_type_is_var(const struct btf_type *t){	return BTF_INFO_KIND(t->info) == BTF_KIND_VAR;} static bool btf_type_is_datasec(const struct btf_type *t){	return BTF_INFO_KIND(t->info) == BTF_KIND_DATASEC;} /* Types that act only as a source, not sink or intermediate * type when resolving. */static bool btf_type_is_resolve_source_only(const struct btf_type *t){	return btf_type_is_var(t) ||	       btf_type_is_datasec(t);} /* What types need to be resolved? * * btf_type_is_modifier() is an obvious one. * * btf_type_is_struct() because its member refers to * another type (through member->type). * * btf_type_is_var() because the variable refers to * another type. btf_type_is_datasec() holds multiple * btf_type_is_var() types that need resolving. * * btf_type_is_array() because its element (array->type) * refers to another type.  Array can be thought of a * special case of struct while array just has the same * member-type repeated by array->nelems of times. */static bool btf_type_needs_resolve(const struct btf_type *t){	return btf_type_is_modifier(t) ||	       btf_type_is_ptr(t) ||	       btf_type_is_struct(t) ||	       btf_type_is_array(t) ||	       btf_type_is_var(t) ||	       btf_type_is_datasec(t);} /* t->size can be used */static bool btf_type_has_size(const struct btf_type *t){	switch (BTF_INFO_KIND(t->info)) {	case BTF_KIND_INT:	case BTF_KIND_STRUCT:	case BTF_KIND_UNION:	case BTF_KIND_ENUM:	case BTF_KIND_DATASEC:		return true;	} 	return false;} static const char *btf_int_encoding_str(u8 encoding){	if (encoding == 0)		return "(none)";	else if (encoding == BTF_INT_SIGNED)		return "SIGNED";	else if (encoding == BTF_INT_CHAR)		return "CHAR";	else if (encoding == BTF_INT_BOOL)		return "BOOL";	else		return "UNKN";} static u16 btf_type_vlen(const struct btf_type *t){	return BTF_INFO_VLEN(t->info);} static bool btf_type_kflag(const struct btf_type *t){	return BTF_INFO_KFLAG(t->info);} static u32 btf_member_bit_offset(const struct btf_type *struct_type,			     const struct btf_member *member){	return btf_type_kflag(struct_type) ? BTF_MEMBER_BIT_OFFSET(member->offset)					   : member->offset;} static u32 btf_member_bitfield_size(const struct btf_type *struct_type,				    const struct btf_member *member){	return btf_type_kflag(struct_type) ? BTF_MEMBER_BITFIELD_SIZE(member->offset)					   : 0;} static u32 btf_type_int(const struct btf_type *t){	return *(u32 *)(t + 1);} static const struct btf_array *btf_type_array(const struct btf_type *t){	return (const struct btf_array *)(t + 1);} static const struct btf_member *btf_type_member(const struct btf_type *t){	return (const struct btf_member *)(t + 1);

Lines 1–500 of 3497.