Merge branch 'drm-next-5.1' of git://people.freedesktop.org/~agd5f/linux into drm...
[sfrench/cifs-2.6.git] / kernel / bpf / stackmap.c
1 /* Copyright (c) 2016 Facebook
2  *
3  * This program is free software; you can redistribute it and/or
4  * modify it under the terms of version 2 of the GNU General Public
5  * License as published by the Free Software Foundation.
6  */
7 #include <linux/bpf.h>
8 #include <linux/jhash.h>
9 #include <linux/filter.h>
10 #include <linux/stacktrace.h>
11 #include <linux/perf_event.h>
12 #include <linux/elf.h>
13 #include <linux/pagemap.h>
14 #include <linux/irq_work.h>
15 #include "percpu_freelist.h"
16
17 #define STACK_CREATE_FLAG_MASK                                  \
18         (BPF_F_NUMA_NODE | BPF_F_RDONLY | BPF_F_WRONLY |        \
19          BPF_F_STACK_BUILD_ID)
20
21 struct stack_map_bucket {
22         struct pcpu_freelist_node fnode;
23         u32 hash;
24         u32 nr;
25         u64 data[];
26 };
27
28 struct bpf_stack_map {
29         struct bpf_map map;
30         void *elems;
31         struct pcpu_freelist freelist;
32         u32 n_buckets;
33         struct stack_map_bucket *buckets[];
34 };
35
36 /* irq_work to run up_read() for build_id lookup in nmi context */
37 struct stack_map_irq_work {
38         struct irq_work irq_work;
39         struct rw_semaphore *sem;
40 };
41
42 static void do_up_read(struct irq_work *entry)
43 {
44         struct stack_map_irq_work *work;
45
46         work = container_of(entry, struct stack_map_irq_work, irq_work);
47         up_read_non_owner(work->sem);
48         work->sem = NULL;
49 }
50
51 static DEFINE_PER_CPU(struct stack_map_irq_work, up_read_work);
52
53 static inline bool stack_map_use_build_id(struct bpf_map *map)
54 {
55         return (map->map_flags & BPF_F_STACK_BUILD_ID);
56 }
57
58 static inline int stack_map_data_size(struct bpf_map *map)
59 {
60         return stack_map_use_build_id(map) ?
61                 sizeof(struct bpf_stack_build_id) : sizeof(u64);
62 }
63
64 static int prealloc_elems_and_freelist(struct bpf_stack_map *smap)
65 {
66         u32 elem_size = sizeof(struct stack_map_bucket) + smap->map.value_size;
67         int err;
68
69         smap->elems = bpf_map_area_alloc(elem_size * smap->map.max_entries,
70                                          smap->map.numa_node);
71         if (!smap->elems)
72                 return -ENOMEM;
73
74         err = pcpu_freelist_init(&smap->freelist);
75         if (err)
76                 goto free_elems;
77
78         pcpu_freelist_populate(&smap->freelist, smap->elems, elem_size,
79                                smap->map.max_entries);
80         return 0;
81
82 free_elems:
83         bpf_map_area_free(smap->elems);
84         return err;
85 }
86
87 /* Called from syscall */
88 static struct bpf_map *stack_map_alloc(union bpf_attr *attr)
89 {
90         u32 value_size = attr->value_size;
91         struct bpf_stack_map *smap;
92         u64 cost, n_buckets;
93         int err;
94
95         if (!capable(CAP_SYS_ADMIN))
96                 return ERR_PTR(-EPERM);
97
98         if (attr->map_flags & ~STACK_CREATE_FLAG_MASK)
99                 return ERR_PTR(-EINVAL);
100
101         /* check sanity of attributes */
102         if (attr->max_entries == 0 || attr->key_size != 4 ||
103             value_size < 8 || value_size % 8)
104                 return ERR_PTR(-EINVAL);
105
106         BUILD_BUG_ON(sizeof(struct bpf_stack_build_id) % sizeof(u64));
107         if (attr->map_flags & BPF_F_STACK_BUILD_ID) {
108                 if (value_size % sizeof(struct bpf_stack_build_id) ||
109                     value_size / sizeof(struct bpf_stack_build_id)
110                     > sysctl_perf_event_max_stack)
111                         return ERR_PTR(-EINVAL);
112         } else if (value_size / 8 > sysctl_perf_event_max_stack)
113                 return ERR_PTR(-EINVAL);
114
115         /* hash table size must be power of 2 */
116         n_buckets = roundup_pow_of_two(attr->max_entries);
117
118         cost = n_buckets * sizeof(struct stack_map_bucket *) + sizeof(*smap);
119         if (cost >= U32_MAX - PAGE_SIZE)
120                 return ERR_PTR(-E2BIG);
121
122         smap = bpf_map_area_alloc(cost, bpf_map_attr_numa_node(attr));
123         if (!smap)
124                 return ERR_PTR(-ENOMEM);
125
126         err = -E2BIG;
127         cost += n_buckets * (value_size + sizeof(struct stack_map_bucket));
128         if (cost >= U32_MAX - PAGE_SIZE)
129                 goto free_smap;
130
131         bpf_map_init_from_attr(&smap->map, attr);
132         smap->map.value_size = value_size;
133         smap->n_buckets = n_buckets;
134         smap->map.pages = round_up(cost, PAGE_SIZE) >> PAGE_SHIFT;
135
136         err = bpf_map_precharge_memlock(smap->map.pages);
137         if (err)
138                 goto free_smap;
139
140         err = get_callchain_buffers(sysctl_perf_event_max_stack);
141         if (err)
142                 goto free_smap;
143
144         err = prealloc_elems_and_freelist(smap);
145         if (err)
146                 goto put_buffers;
147
148         return &smap->map;
149
150 put_buffers:
151         put_callchain_buffers();
152 free_smap:
153         bpf_map_area_free(smap);
154         return ERR_PTR(err);
155 }
156
157 #define BPF_BUILD_ID 3
158 /*
159  * Parse build id from the note segment. This logic can be shared between
160  * 32-bit and 64-bit system, because Elf32_Nhdr and Elf64_Nhdr are
161  * identical.
162  */
163 static inline int stack_map_parse_build_id(void *page_addr,
164                                            unsigned char *build_id,
165                                            void *note_start,
166                                            Elf32_Word note_size)
167 {
168         Elf32_Word note_offs = 0, new_offs;
169
170         /* check for overflow */
171         if (note_start < page_addr || note_start + note_size < note_start)
172                 return -EINVAL;
173
174         /* only supports note that fits in the first page */
175         if (note_start + note_size > page_addr + PAGE_SIZE)
176                 return -EINVAL;
177
178         while (note_offs + sizeof(Elf32_Nhdr) < note_size) {
179                 Elf32_Nhdr *nhdr = (Elf32_Nhdr *)(note_start + note_offs);
180
181                 if (nhdr->n_type == BPF_BUILD_ID &&
182                     nhdr->n_namesz == sizeof("GNU") &&
183                     nhdr->n_descsz > 0 &&
184                     nhdr->n_descsz <= BPF_BUILD_ID_SIZE) {
185                         memcpy(build_id,
186                                note_start + note_offs +
187                                ALIGN(sizeof("GNU"), 4) + sizeof(Elf32_Nhdr),
188                                nhdr->n_descsz);
189                         memset(build_id + nhdr->n_descsz, 0,
190                                BPF_BUILD_ID_SIZE - nhdr->n_descsz);
191                         return 0;
192                 }
193                 new_offs = note_offs + sizeof(Elf32_Nhdr) +
194                         ALIGN(nhdr->n_namesz, 4) + ALIGN(nhdr->n_descsz, 4);
195                 if (new_offs <= note_offs)  /* overflow */
196                         break;
197                 note_offs = new_offs;
198         }
199         return -EINVAL;
200 }
201
202 /* Parse build ID from 32-bit ELF */
203 static int stack_map_get_build_id_32(void *page_addr,
204                                      unsigned char *build_id)
205 {
206         Elf32_Ehdr *ehdr = (Elf32_Ehdr *)page_addr;
207         Elf32_Phdr *phdr;
208         int i;
209
210         /* only supports phdr that fits in one page */
211         if (ehdr->e_phnum >
212             (PAGE_SIZE - sizeof(Elf32_Ehdr)) / sizeof(Elf32_Phdr))
213                 return -EINVAL;
214
215         phdr = (Elf32_Phdr *)(page_addr + sizeof(Elf32_Ehdr));
216
217         for (i = 0; i < ehdr->e_phnum; ++i)
218                 if (phdr[i].p_type == PT_NOTE)
219                         return stack_map_parse_build_id(page_addr, build_id,
220                                         page_addr + phdr[i].p_offset,
221                                         phdr[i].p_filesz);
222         return -EINVAL;
223 }
224
225 /* Parse build ID from 64-bit ELF */
226 static int stack_map_get_build_id_64(void *page_addr,
227                                      unsigned char *build_id)
228 {
229         Elf64_Ehdr *ehdr = (Elf64_Ehdr *)page_addr;
230         Elf64_Phdr *phdr;
231         int i;
232
233         /* only supports phdr that fits in one page */
234         if (ehdr->e_phnum >
235             (PAGE_SIZE - sizeof(Elf64_Ehdr)) / sizeof(Elf64_Phdr))
236                 return -EINVAL;
237
238         phdr = (Elf64_Phdr *)(page_addr + sizeof(Elf64_Ehdr));
239
240         for (i = 0; i < ehdr->e_phnum; ++i)
241                 if (phdr[i].p_type == PT_NOTE)
242                         return stack_map_parse_build_id(page_addr, build_id,
243                                         page_addr + phdr[i].p_offset,
244                                         phdr[i].p_filesz);
245         return -EINVAL;
246 }
247
248 /* Parse build ID of ELF file mapped to vma */
249 static int stack_map_get_build_id(struct vm_area_struct *vma,
250                                   unsigned char *build_id)
251 {
252         Elf32_Ehdr *ehdr;
253         struct page *page;
254         void *page_addr;
255         int ret;
256
257         /* only works for page backed storage  */
258         if (!vma->vm_file)
259                 return -EINVAL;
260
261         page = find_get_page(vma->vm_file->f_mapping, 0);
262         if (!page)
263                 return -EFAULT; /* page not mapped */
264
265         ret = -EINVAL;
266         page_addr = kmap_atomic(page);
267         ehdr = (Elf32_Ehdr *)page_addr;
268
269         /* compare magic x7f "ELF" */
270         if (memcmp(ehdr->e_ident, ELFMAG, SELFMAG) != 0)
271                 goto out;
272
273         /* only support executable file and shared object file */
274         if (ehdr->e_type != ET_EXEC && ehdr->e_type != ET_DYN)
275                 goto out;
276
277         if (ehdr->e_ident[EI_CLASS] == ELFCLASS32)
278                 ret = stack_map_get_build_id_32(page_addr, build_id);
279         else if (ehdr->e_ident[EI_CLASS] == ELFCLASS64)
280                 ret = stack_map_get_build_id_64(page_addr, build_id);
281 out:
282         kunmap_atomic(page_addr);
283         put_page(page);
284         return ret;
285 }
286
287 static void stack_map_get_build_id_offset(struct bpf_stack_build_id *id_offs,
288                                           u64 *ips, u32 trace_nr, bool user)
289 {
290         int i;
291         struct vm_area_struct *vma;
292         bool irq_work_busy = false;
293         struct stack_map_irq_work *work = NULL;
294
295         if (in_nmi()) {
296                 work = this_cpu_ptr(&up_read_work);
297                 if (work->irq_work.flags & IRQ_WORK_BUSY)
298                         /* cannot queue more up_read, fallback */
299                         irq_work_busy = true;
300         }
301
302         /*
303          * We cannot do up_read() in nmi context. To do build_id lookup
304          * in nmi context, we need to run up_read() in irq_work. We use
305          * a percpu variable to do the irq_work. If the irq_work is
306          * already used by another lookup, we fall back to report ips.
307          *
308          * Same fallback is used for kernel stack (!user) on a stackmap
309          * with build_id.
310          */
311         if (!user || !current || !current->mm || irq_work_busy ||
312             down_read_trylock(&current->mm->mmap_sem) == 0) {
313                 /* cannot access current->mm, fall back to ips */
314                 for (i = 0; i < trace_nr; i++) {
315                         id_offs[i].status = BPF_STACK_BUILD_ID_IP;
316                         id_offs[i].ip = ips[i];
317                         memset(id_offs[i].build_id, 0, BPF_BUILD_ID_SIZE);
318                 }
319                 return;
320         }
321
322         for (i = 0; i < trace_nr; i++) {
323                 vma = find_vma(current->mm, ips[i]);
324                 if (!vma || stack_map_get_build_id(vma, id_offs[i].build_id)) {
325                         /* per entry fall back to ips */
326                         id_offs[i].status = BPF_STACK_BUILD_ID_IP;
327                         id_offs[i].ip = ips[i];
328                         memset(id_offs[i].build_id, 0, BPF_BUILD_ID_SIZE);
329                         continue;
330                 }
331                 id_offs[i].offset = (vma->vm_pgoff << PAGE_SHIFT) + ips[i]
332                         - vma->vm_start;
333                 id_offs[i].status = BPF_STACK_BUILD_ID_VALID;
334         }
335
336         if (!work) {
337                 up_read(&current->mm->mmap_sem);
338         } else {
339                 work->sem = &current->mm->mmap_sem;
340                 irq_work_queue(&work->irq_work);
341                 /*
342                  * The irq_work will release the mmap_sem with
343                  * up_read_non_owner(). The rwsem_release() is called
344                  * here to release the lock from lockdep's perspective.
345                  */
346                 rwsem_release(&current->mm->mmap_sem.dep_map, 1, _RET_IP_);
347         }
348 }
349
350 BPF_CALL_3(bpf_get_stackid, struct pt_regs *, regs, struct bpf_map *, map,
351            u64, flags)
352 {
353         struct bpf_stack_map *smap = container_of(map, struct bpf_stack_map, map);
354         struct perf_callchain_entry *trace;
355         struct stack_map_bucket *bucket, *new_bucket, *old_bucket;
356         u32 max_depth = map->value_size / stack_map_data_size(map);
357         /* stack_map_alloc() checks that max_depth <= sysctl_perf_event_max_stack */
358         u32 init_nr = sysctl_perf_event_max_stack - max_depth;
359         u32 skip = flags & BPF_F_SKIP_FIELD_MASK;
360         u32 hash, id, trace_nr, trace_len;
361         bool user = flags & BPF_F_USER_STACK;
362         bool kernel = !user;
363         u64 *ips;
364         bool hash_matches;
365
366         if (unlikely(flags & ~(BPF_F_SKIP_FIELD_MASK | BPF_F_USER_STACK |
367                                BPF_F_FAST_STACK_CMP | BPF_F_REUSE_STACKID)))
368                 return -EINVAL;
369
370         trace = get_perf_callchain(regs, init_nr, kernel, user,
371                                    sysctl_perf_event_max_stack, false, false);
372
373         if (unlikely(!trace))
374                 /* couldn't fetch the stack trace */
375                 return -EFAULT;
376
377         /* get_perf_callchain() guarantees that trace->nr >= init_nr
378          * and trace-nr <= sysctl_perf_event_max_stack, so trace_nr <= max_depth
379          */
380         trace_nr = trace->nr - init_nr;
381
382         if (trace_nr <= skip)
383                 /* skipping more than usable stack trace */
384                 return -EFAULT;
385
386         trace_nr -= skip;
387         trace_len = trace_nr * sizeof(u64);
388         ips = trace->ip + skip + init_nr;
389         hash = jhash2((u32 *)ips, trace_len / sizeof(u32), 0);
390         id = hash & (smap->n_buckets - 1);
391         bucket = READ_ONCE(smap->buckets[id]);
392
393         hash_matches = bucket && bucket->hash == hash;
394         /* fast cmp */
395         if (hash_matches && flags & BPF_F_FAST_STACK_CMP)
396                 return id;
397
398         if (stack_map_use_build_id(map)) {
399                 /* for build_id+offset, pop a bucket before slow cmp */
400                 new_bucket = (struct stack_map_bucket *)
401                         pcpu_freelist_pop(&smap->freelist);
402                 if (unlikely(!new_bucket))
403                         return -ENOMEM;
404                 new_bucket->nr = trace_nr;
405                 stack_map_get_build_id_offset(
406                         (struct bpf_stack_build_id *)new_bucket->data,
407                         ips, trace_nr, user);
408                 trace_len = trace_nr * sizeof(struct bpf_stack_build_id);
409                 if (hash_matches && bucket->nr == trace_nr &&
410                     memcmp(bucket->data, new_bucket->data, trace_len) == 0) {
411                         pcpu_freelist_push(&smap->freelist, &new_bucket->fnode);
412                         return id;
413                 }
414                 if (bucket && !(flags & BPF_F_REUSE_STACKID)) {
415                         pcpu_freelist_push(&smap->freelist, &new_bucket->fnode);
416                         return -EEXIST;
417                 }
418         } else {
419                 if (hash_matches && bucket->nr == trace_nr &&
420                     memcmp(bucket->data, ips, trace_len) == 0)
421                         return id;
422                 if (bucket && !(flags & BPF_F_REUSE_STACKID))
423                         return -EEXIST;
424
425                 new_bucket = (struct stack_map_bucket *)
426                         pcpu_freelist_pop(&smap->freelist);
427                 if (unlikely(!new_bucket))
428                         return -ENOMEM;
429                 memcpy(new_bucket->data, ips, trace_len);
430         }
431
432         new_bucket->hash = hash;
433         new_bucket->nr = trace_nr;
434
435         old_bucket = xchg(&smap->buckets[id], new_bucket);
436         if (old_bucket)
437                 pcpu_freelist_push(&smap->freelist, &old_bucket->fnode);
438         return id;
439 }
440
441 const struct bpf_func_proto bpf_get_stackid_proto = {
442         .func           = bpf_get_stackid,
443         .gpl_only       = true,
444         .ret_type       = RET_INTEGER,
445         .arg1_type      = ARG_PTR_TO_CTX,
446         .arg2_type      = ARG_CONST_MAP_PTR,
447         .arg3_type      = ARG_ANYTHING,
448 };
449
450 BPF_CALL_4(bpf_get_stack, struct pt_regs *, regs, void *, buf, u32, size,
451            u64, flags)
452 {
453         u32 init_nr, trace_nr, copy_len, elem_size, num_elem;
454         bool user_build_id = flags & BPF_F_USER_BUILD_ID;
455         u32 skip = flags & BPF_F_SKIP_FIELD_MASK;
456         bool user = flags & BPF_F_USER_STACK;
457         struct perf_callchain_entry *trace;
458         bool kernel = !user;
459         int err = -EINVAL;
460         u64 *ips;
461
462         if (unlikely(flags & ~(BPF_F_SKIP_FIELD_MASK | BPF_F_USER_STACK |
463                                BPF_F_USER_BUILD_ID)))
464                 goto clear;
465         if (kernel && user_build_id)
466                 goto clear;
467
468         elem_size = (user && user_build_id) ? sizeof(struct bpf_stack_build_id)
469                                             : sizeof(u64);
470         if (unlikely(size % elem_size))
471                 goto clear;
472
473         num_elem = size / elem_size;
474         if (sysctl_perf_event_max_stack < num_elem)
475                 init_nr = 0;
476         else
477                 init_nr = sysctl_perf_event_max_stack - num_elem;
478         trace = get_perf_callchain(regs, init_nr, kernel, user,
479                                    sysctl_perf_event_max_stack, false, false);
480         if (unlikely(!trace))
481                 goto err_fault;
482
483         trace_nr = trace->nr - init_nr;
484         if (trace_nr < skip)
485                 goto err_fault;
486
487         trace_nr -= skip;
488         trace_nr = (trace_nr <= num_elem) ? trace_nr : num_elem;
489         copy_len = trace_nr * elem_size;
490         ips = trace->ip + skip + init_nr;
491         if (user && user_build_id)
492                 stack_map_get_build_id_offset(buf, ips, trace_nr, user);
493         else
494                 memcpy(buf, ips, copy_len);
495
496         if (size > copy_len)
497                 memset(buf + copy_len, 0, size - copy_len);
498         return copy_len;
499
500 err_fault:
501         err = -EFAULT;
502 clear:
503         memset(buf, 0, size);
504         return err;
505 }
506
507 const struct bpf_func_proto bpf_get_stack_proto = {
508         .func           = bpf_get_stack,
509         .gpl_only       = true,
510         .ret_type       = RET_INTEGER,
511         .arg1_type      = ARG_PTR_TO_CTX,
512         .arg2_type      = ARG_PTR_TO_UNINIT_MEM,
513         .arg3_type      = ARG_CONST_SIZE_OR_ZERO,
514         .arg4_type      = ARG_ANYTHING,
515 };
516
517 /* Called from eBPF program */
518 static void *stack_map_lookup_elem(struct bpf_map *map, void *key)
519 {
520         return ERR_PTR(-EOPNOTSUPP);
521 }
522
523 /* Called from syscall */
524 int bpf_stackmap_copy(struct bpf_map *map, void *key, void *value)
525 {
526         struct bpf_stack_map *smap = container_of(map, struct bpf_stack_map, map);
527         struct stack_map_bucket *bucket, *old_bucket;
528         u32 id = *(u32 *)key, trace_len;
529
530         if (unlikely(id >= smap->n_buckets))
531                 return -ENOENT;
532
533         bucket = xchg(&smap->buckets[id], NULL);
534         if (!bucket)
535                 return -ENOENT;
536
537         trace_len = bucket->nr * stack_map_data_size(map);
538         memcpy(value, bucket->data, trace_len);
539         memset(value + trace_len, 0, map->value_size - trace_len);
540
541         old_bucket = xchg(&smap->buckets[id], bucket);
542         if (old_bucket)
543                 pcpu_freelist_push(&smap->freelist, &old_bucket->fnode);
544         return 0;
545 }
546
547 static int stack_map_get_next_key(struct bpf_map *map, void *key,
548                                   void *next_key)
549 {
550         struct bpf_stack_map *smap = container_of(map,
551                                                   struct bpf_stack_map, map);
552         u32 id;
553
554         WARN_ON_ONCE(!rcu_read_lock_held());
555
556         if (!key) {
557                 id = 0;
558         } else {
559                 id = *(u32 *)key;
560                 if (id >= smap->n_buckets || !smap->buckets[id])
561                         id = 0;
562                 else
563                         id++;
564         }
565
566         while (id < smap->n_buckets && !smap->buckets[id])
567                 id++;
568
569         if (id >= smap->n_buckets)
570                 return -ENOENT;
571
572         *(u32 *)next_key = id;
573         return 0;
574 }
575
576 static int stack_map_update_elem(struct bpf_map *map, void *key, void *value,
577                                  u64 map_flags)
578 {
579         return -EINVAL;
580 }
581
582 /* Called from syscall or from eBPF program */
583 static int stack_map_delete_elem(struct bpf_map *map, void *key)
584 {
585         struct bpf_stack_map *smap = container_of(map, struct bpf_stack_map, map);
586         struct stack_map_bucket *old_bucket;
587         u32 id = *(u32 *)key;
588
589         if (unlikely(id >= smap->n_buckets))
590                 return -E2BIG;
591
592         old_bucket = xchg(&smap->buckets[id], NULL);
593         if (old_bucket) {
594                 pcpu_freelist_push(&smap->freelist, &old_bucket->fnode);
595                 return 0;
596         } else {
597                 return -ENOENT;
598         }
599 }
600
601 /* Called when map->refcnt goes to zero, either from workqueue or from syscall */
602 static void stack_map_free(struct bpf_map *map)
603 {
604         struct bpf_stack_map *smap = container_of(map, struct bpf_stack_map, map);
605
606         /* wait for bpf programs to complete before freeing stack map */
607         synchronize_rcu();
608
609         bpf_map_area_free(smap->elems);
610         pcpu_freelist_destroy(&smap->freelist);
611         bpf_map_area_free(smap);
612         put_callchain_buffers();
613 }
614
615 const struct bpf_map_ops stack_trace_map_ops = {
616         .map_alloc = stack_map_alloc,
617         .map_free = stack_map_free,
618         .map_get_next_key = stack_map_get_next_key,
619         .map_lookup_elem = stack_map_lookup_elem,
620         .map_update_elem = stack_map_update_elem,
621         .map_delete_elem = stack_map_delete_elem,
622         .map_check_btf = map_check_no_btf,
623 };
624
625 static int __init stack_map_init(void)
626 {
627         int cpu;
628         struct stack_map_irq_work *work;
629
630         for_each_possible_cpu(cpu) {
631                 work = per_cpu_ptr(&up_read_work, cpu);
632                 init_irq_work(&work->irq_work, do_up_read);
633         }
634         return 0;
635 }
636 subsys_initcall(stack_map_init);