1 // SPDX-License-Identifier: GPL-2.0-only
2 /* Copyright (c) 2017 Facebook
6 #include <linux/btf_ids.h>
7 #include <linux/slab.h>
8 #include <linux/init.h>
9 #include <linux/vmalloc.h>
10 #include <linux/etherdevice.h>
11 #include <linux/filter.h>
12 #include <linux/rcupdate_trace.h>
13 #include <linux/sched/signal.h>
14 #include <net/bpf_sk_storage.h>
17 #include <net/net_namespace.h>
18 #include <net/page_pool.h>
19 #include <linux/error-injection.h>
20 #include <linux/smp.h>
21 #include <linux/sock_diag.h>
24 #define CREATE_TRACE_POINTS
25 #include <trace/events/bpf_test_run.h>
27 struct bpf_test_timer {
28 enum { NO_PREEMPT, NO_MIGRATE } mode;
30 u64 time_start, time_spent;
33 static void bpf_test_timer_enter(struct bpf_test_timer *t)
37 if (t->mode == NO_PREEMPT)
42 t->time_start = ktime_get_ns();
45 static void bpf_test_timer_leave(struct bpf_test_timer *t)
50 if (t->mode == NO_PREEMPT)
57 static bool bpf_test_timer_continue(struct bpf_test_timer *t, int iterations,
58 u32 repeat, int *err, u32 *duration)
64 t->time_spent += ktime_get_ns() - t->time_start;
65 do_div(t->time_spent, t->i);
66 *duration = t->time_spent > U32_MAX ? U32_MAX : (u32)t->time_spent;
71 if (signal_pending(current)) {
72 /* During iteration: we've been cancelled, abort. */
78 /* During iteration: we need to reschedule between runs. */
79 t->time_spent += ktime_get_ns() - t->time_start;
80 bpf_test_timer_leave(t);
82 bpf_test_timer_enter(t);
85 /* Do another round. */
93 /* We put this struct at the head of each page with a context and frame
94 * initialised when the page is allocated, so we don't have to do this on each
95 * repetition of the test run.
97 struct xdp_page_head {
98 struct xdp_buff orig_ctx;
100 struct xdp_frame frm;
104 struct xdp_test_data {
105 struct xdp_buff *orig_ctx;
106 struct xdp_rxq_info rxq;
107 struct net_device *dev;
108 struct page_pool *pp;
109 struct xdp_frame **frames;
110 struct sk_buff **skbs;
115 #define TEST_XDP_FRAME_SIZE (PAGE_SIZE - sizeof(struct xdp_page_head))
116 #define TEST_XDP_MAX_BATCH 256
118 static void xdp_test_run_init_page(struct page *page, void *arg)
120 struct xdp_page_head *head = phys_to_virt(page_to_phys(page));
121 struct xdp_buff *new_ctx, *orig_ctx;
122 u32 headroom = XDP_PACKET_HEADROOM;
123 struct xdp_test_data *xdp = arg;
124 size_t frm_len, meta_len;
125 struct xdp_frame *frm;
128 orig_ctx = xdp->orig_ctx;
129 frm_len = orig_ctx->data_end - orig_ctx->data_meta;
130 meta_len = orig_ctx->data - orig_ctx->data_meta;
131 headroom -= meta_len;
133 new_ctx = &head->ctx;
136 memcpy(data + headroom, orig_ctx->data_meta, frm_len);
138 xdp_init_buff(new_ctx, TEST_XDP_FRAME_SIZE, &xdp->rxq);
139 xdp_prepare_buff(new_ctx, data, headroom, frm_len, true);
140 new_ctx->data = new_ctx->data_meta + meta_len;
142 xdp_update_frame_from_buff(new_ctx, frm);
143 frm->mem = new_ctx->rxq->mem;
145 memcpy(&head->orig_ctx, new_ctx, sizeof(head->orig_ctx));
148 static int xdp_test_run_setup(struct xdp_test_data *xdp, struct xdp_buff *orig_ctx)
150 struct xdp_mem_info mem = {};
151 struct page_pool *pp;
153 struct page_pool_params pp_params = {
156 .pool_size = xdp->batch_size,
158 .init_callback = xdp_test_run_init_page,
162 xdp->frames = kvmalloc_array(xdp->batch_size, sizeof(void *), GFP_KERNEL);
166 xdp->skbs = kvmalloc_array(xdp->batch_size, sizeof(void *), GFP_KERNEL);
170 pp = page_pool_create(&pp_params);
176 /* will copy 'mem.id' into pp->xdp_mem_id */
177 err = xdp_reg_mem_model(&mem, MEM_TYPE_PAGE_POOL, pp);
183 /* We create a 'fake' RXQ referencing the original dev, but with an
184 * xdp_mem_info pointing to our page_pool
186 xdp_rxq_info_reg(&xdp->rxq, orig_ctx->rxq->dev, 0, 0);
187 xdp->rxq.mem.type = MEM_TYPE_PAGE_POOL;
188 xdp->rxq.mem.id = pp->xdp_mem_id;
189 xdp->dev = orig_ctx->rxq->dev;
190 xdp->orig_ctx = orig_ctx;
195 page_pool_destroy(pp);
203 static void xdp_test_run_teardown(struct xdp_test_data *xdp)
205 page_pool_destroy(xdp->pp);
210 static bool ctx_was_changed(struct xdp_page_head *head)
212 return head->orig_ctx.data != head->ctx.data ||
213 head->orig_ctx.data_meta != head->ctx.data_meta ||
214 head->orig_ctx.data_end != head->ctx.data_end;
217 static void reset_ctx(struct xdp_page_head *head)
219 if (likely(!ctx_was_changed(head)))
222 head->ctx.data = head->orig_ctx.data;
223 head->ctx.data_meta = head->orig_ctx.data_meta;
224 head->ctx.data_end = head->orig_ctx.data_end;
225 xdp_update_frame_from_buff(&head->ctx, &head->frm);
228 static int xdp_recv_frames(struct xdp_frame **frames, int nframes,
229 struct sk_buff **skbs,
230 struct net_device *dev)
232 gfp_t gfp = __GFP_ZERO | GFP_ATOMIC;
236 n = kmem_cache_alloc_bulk(skbuff_head_cache, gfp, nframes, (void **)skbs);
237 if (unlikely(n == 0)) {
238 for (i = 0; i < nframes; i++)
239 xdp_return_frame(frames[i]);
243 for (i = 0; i < nframes; i++) {
244 struct xdp_frame *xdpf = frames[i];
245 struct sk_buff *skb = skbs[i];
247 skb = __xdp_build_skb_from_frame(xdpf, skb, dev);
249 xdp_return_frame(xdpf);
253 list_add_tail(&skb->list, &list);
255 netif_receive_skb_list(&list);
260 static int xdp_test_run_batch(struct xdp_test_data *xdp, struct bpf_prog *prog,
263 struct bpf_redirect_info *ri = this_cpu_ptr(&bpf_redirect_info);
264 int err = 0, act, ret, i, nframes = 0, batch_sz;
265 struct xdp_frame **frames = xdp->frames;
266 struct xdp_page_head *head;
267 struct xdp_frame *frm;
268 bool redirect = false;
269 struct xdp_buff *ctx;
272 batch_sz = min_t(u32, repeat, xdp->batch_size);
275 xdp_set_return_frame_no_direct();
277 for (i = 0; i < batch_sz; i++) {
278 page = page_pool_dev_alloc_pages(xdp->pp);
284 head = phys_to_virt(page_to_phys(page));
290 act = bpf_prog_run_xdp(prog, ctx);
292 /* if program changed pkt bounds we need to update the xdp_frame */
293 if (unlikely(ctx_was_changed(head))) {
294 ret = xdp_update_frame_from_buff(ctx, frm);
296 xdp_return_buff(ctx);
303 /* we can't do a real XDP_TX since we're not in the
304 * driver, so turn it into a REDIRECT back to the same
307 ri->tgt_index = xdp->dev->ifindex;
308 ri->map_id = INT_MAX;
309 ri->map_type = BPF_MAP_TYPE_UNSPEC;
313 ret = xdp_do_redirect_frame(xdp->dev, ctx, frm, prog);
315 xdp_return_buff(ctx);
318 frames[nframes++] = frm;
321 bpf_warn_invalid_xdp_action(NULL, prog, act);
324 xdp_return_buff(ctx);
333 ret = xdp_recv_frames(frames, nframes, xdp->skbs, xdp->dev);
338 xdp_clear_return_frame_no_direct();
343 static int bpf_test_run_xdp_live(struct bpf_prog *prog, struct xdp_buff *ctx,
344 u32 repeat, u32 batch_size, u32 *time)
347 struct xdp_test_data xdp = { .batch_size = batch_size };
348 struct bpf_test_timer t = { .mode = NO_MIGRATE };
354 ret = xdp_test_run_setup(&xdp, ctx);
358 bpf_test_timer_enter(&t);
361 ret = xdp_test_run_batch(&xdp, prog, repeat - t.i);
362 if (unlikely(ret < 0))
364 } while (bpf_test_timer_continue(&t, xdp.frame_cnt, repeat, &ret, time));
365 bpf_test_timer_leave(&t);
367 xdp_test_run_teardown(&xdp);
371 static int bpf_test_run(struct bpf_prog *prog, void *ctx, u32 repeat,
372 u32 *retval, u32 *time, bool xdp)
374 struct bpf_prog_array_item item = {.prog = prog};
375 struct bpf_run_ctx *old_ctx;
376 struct bpf_cg_run_ctx run_ctx;
377 struct bpf_test_timer t = { NO_MIGRATE };
378 enum bpf_cgroup_storage_type stype;
381 for_each_cgroup_storage_type(stype) {
382 item.cgroup_storage[stype] = bpf_cgroup_storage_alloc(prog, stype);
383 if (IS_ERR(item.cgroup_storage[stype])) {
384 item.cgroup_storage[stype] = NULL;
385 for_each_cgroup_storage_type(stype)
386 bpf_cgroup_storage_free(item.cgroup_storage[stype]);
394 bpf_test_timer_enter(&t);
395 old_ctx = bpf_set_run_ctx(&run_ctx.run_ctx);
397 run_ctx.prog_item = &item;
399 *retval = bpf_prog_run_xdp(prog, ctx);
401 *retval = bpf_prog_run(prog, ctx);
402 } while (bpf_test_timer_continue(&t, 1, repeat, &ret, time));
403 bpf_reset_run_ctx(old_ctx);
404 bpf_test_timer_leave(&t);
406 for_each_cgroup_storage_type(stype)
407 bpf_cgroup_storage_free(item.cgroup_storage[stype]);
412 static int bpf_test_finish(const union bpf_attr *kattr,
413 union bpf_attr __user *uattr, const void *data,
414 struct skb_shared_info *sinfo, u32 size,
415 u32 retval, u32 duration)
417 void __user *data_out = u64_to_user_ptr(kattr->test.data_out);
419 u32 copy_size = size;
421 /* Clamp copy if the user has provided a size hint, but copy the full
422 * buffer if not to retain old behaviour.
424 if (kattr->test.data_size_out &&
425 copy_size > kattr->test.data_size_out) {
426 copy_size = kattr->test.data_size_out;
431 int len = sinfo ? copy_size - sinfo->xdp_frags_size : copy_size;
438 if (copy_to_user(data_out, data, len))
445 for (i = 0; i < sinfo->nr_frags; i++) {
446 skb_frag_t *frag = &sinfo->frags[i];
448 if (offset >= copy_size) {
453 data_len = min_t(u32, copy_size - offset,
454 skb_frag_size(frag));
456 if (copy_to_user(data_out + offset,
457 skb_frag_address(frag),
466 if (copy_to_user(&uattr->test.data_size_out, &size, sizeof(size)))
468 if (copy_to_user(&uattr->test.retval, &retval, sizeof(retval)))
470 if (copy_to_user(&uattr->test.duration, &duration, sizeof(duration)))
475 trace_bpf_test_finish(&err);
479 /* Integer types of various sizes and pointer combinations cover variety of
480 * architecture dependent calling conventions. 7+ can be supported in the
484 __diag_ignore_all("-Wmissing-prototypes",
485 "Global functions as their definitions will be in vmlinux BTF");
486 int noinline bpf_fentry_test1(int a)
490 EXPORT_SYMBOL_GPL(bpf_fentry_test1);
491 ALLOW_ERROR_INJECTION(bpf_fentry_test1, ERRNO);
493 int noinline bpf_fentry_test2(int a, u64 b)
498 int noinline bpf_fentry_test3(char a, int b, u64 c)
503 int noinline bpf_fentry_test4(void *a, char b, int c, u64 d)
505 return (long)a + b + c + d;
508 int noinline bpf_fentry_test5(u64 a, void *b, short c, int d, u64 e)
510 return a + (long)b + c + d + e;
513 int noinline bpf_fentry_test6(u64 a, void *b, short c, int d, void *e, u64 f)
515 return a + (long)b + c + d + (long)e + f;
518 struct bpf_fentry_test_t {
519 struct bpf_fentry_test_t *a;
522 int noinline bpf_fentry_test7(struct bpf_fentry_test_t *arg)
527 int noinline bpf_fentry_test8(struct bpf_fentry_test_t *arg)
532 int noinline bpf_modify_return_test(int a, int *b)
538 u64 noinline bpf_kfunc_call_test1(struct sock *sk, u32 a, u64 b, u32 c, u64 d)
540 return a + b + c + d;
543 int noinline bpf_kfunc_call_test2(struct sock *sk, u32 a, u32 b)
548 struct sock * noinline bpf_kfunc_call_test3(struct sock *sk)
553 struct prog_test_member {
557 struct prog_test_ref_kfunc {
560 struct prog_test_member memb;
561 struct prog_test_ref_kfunc *next;
564 static struct prog_test_ref_kfunc prog_test_struct = {
567 .next = &prog_test_struct,
570 noinline struct prog_test_ref_kfunc *
571 bpf_kfunc_call_test_acquire(unsigned long *scalar_ptr)
573 /* randomly return NULL */
574 if (get_jiffies_64() % 2)
576 return &prog_test_struct;
579 noinline void bpf_kfunc_call_test_release(struct prog_test_ref_kfunc *p)
583 noinline void bpf_kfunc_call_memb_release(struct prog_test_member *p)
587 struct prog_test_pass1 {
600 struct prog_test_pass2 {
605 unsigned long arr3[8];
609 struct prog_test_fail1 {
614 struct prog_test_fail2 {
616 struct prog_test_pass1 x;
619 struct prog_test_fail3 {
625 noinline void bpf_kfunc_call_test_pass_ctx(struct __sk_buff *skb)
629 noinline void bpf_kfunc_call_test_pass1(struct prog_test_pass1 *p)
633 noinline void bpf_kfunc_call_test_pass2(struct prog_test_pass2 *p)
637 noinline void bpf_kfunc_call_test_fail1(struct prog_test_fail1 *p)
641 noinline void bpf_kfunc_call_test_fail2(struct prog_test_fail2 *p)
645 noinline void bpf_kfunc_call_test_fail3(struct prog_test_fail3 *p)
649 noinline void bpf_kfunc_call_test_mem_len_pass1(void *mem, int mem__sz)
653 noinline void bpf_kfunc_call_test_mem_len_fail1(void *mem, int len)
657 noinline void bpf_kfunc_call_test_mem_len_fail2(u64 *mem, int len)
663 ALLOW_ERROR_INJECTION(bpf_modify_return_test, ERRNO);
665 BTF_SET_START(test_sk_check_kfunc_ids)
666 BTF_ID(func, bpf_kfunc_call_test1)
667 BTF_ID(func, bpf_kfunc_call_test2)
668 BTF_ID(func, bpf_kfunc_call_test3)
669 BTF_ID(func, bpf_kfunc_call_test_acquire)
670 BTF_ID(func, bpf_kfunc_call_test_release)
671 BTF_ID(func, bpf_kfunc_call_memb_release)
672 BTF_ID(func, bpf_kfunc_call_test_pass_ctx)
673 BTF_ID(func, bpf_kfunc_call_test_pass1)
674 BTF_ID(func, bpf_kfunc_call_test_pass2)
675 BTF_ID(func, bpf_kfunc_call_test_fail1)
676 BTF_ID(func, bpf_kfunc_call_test_fail2)
677 BTF_ID(func, bpf_kfunc_call_test_fail3)
678 BTF_ID(func, bpf_kfunc_call_test_mem_len_pass1)
679 BTF_ID(func, bpf_kfunc_call_test_mem_len_fail1)
680 BTF_ID(func, bpf_kfunc_call_test_mem_len_fail2)
681 BTF_SET_END(test_sk_check_kfunc_ids)
683 BTF_SET_START(test_sk_acquire_kfunc_ids)
684 BTF_ID(func, bpf_kfunc_call_test_acquire)
685 BTF_SET_END(test_sk_acquire_kfunc_ids)
687 BTF_SET_START(test_sk_release_kfunc_ids)
688 BTF_ID(func, bpf_kfunc_call_test_release)
689 BTF_ID(func, bpf_kfunc_call_memb_release)
690 BTF_SET_END(test_sk_release_kfunc_ids)
692 BTF_SET_START(test_sk_ret_null_kfunc_ids)
693 BTF_ID(func, bpf_kfunc_call_test_acquire)
694 BTF_SET_END(test_sk_ret_null_kfunc_ids)
696 static void *bpf_test_init(const union bpf_attr *kattr, u32 user_size,
697 u32 size, u32 headroom, u32 tailroom)
699 void __user *data_in = u64_to_user_ptr(kattr->test.data_in);
702 if (size < ETH_HLEN || size > PAGE_SIZE - headroom - tailroom)
703 return ERR_PTR(-EINVAL);
705 if (user_size > size)
706 return ERR_PTR(-EMSGSIZE);
708 data = kzalloc(size + headroom + tailroom, GFP_USER);
710 return ERR_PTR(-ENOMEM);
712 if (copy_from_user(data + headroom, data_in, user_size)) {
714 return ERR_PTR(-EFAULT);
720 int bpf_prog_test_run_tracing(struct bpf_prog *prog,
721 const union bpf_attr *kattr,
722 union bpf_attr __user *uattr)
724 struct bpf_fentry_test_t arg = {};
725 u16 side_effect = 0, ret = 0;
726 int b = 2, err = -EFAULT;
729 if (kattr->test.flags || kattr->test.cpu || kattr->test.batch_size)
732 switch (prog->expected_attach_type) {
733 case BPF_TRACE_FENTRY:
734 case BPF_TRACE_FEXIT:
735 if (bpf_fentry_test1(1) != 2 ||
736 bpf_fentry_test2(2, 3) != 5 ||
737 bpf_fentry_test3(4, 5, 6) != 15 ||
738 bpf_fentry_test4((void *)7, 8, 9, 10) != 34 ||
739 bpf_fentry_test5(11, (void *)12, 13, 14, 15) != 65 ||
740 bpf_fentry_test6(16, (void *)17, 18, 19, (void *)20, 21) != 111 ||
741 bpf_fentry_test7((struct bpf_fentry_test_t *)0) != 0 ||
742 bpf_fentry_test8(&arg) != 0)
745 case BPF_MODIFY_RETURN:
746 ret = bpf_modify_return_test(1, &b);
754 retval = ((u32)side_effect << 16) | ret;
755 if (copy_to_user(&uattr->test.retval, &retval, sizeof(retval)))
760 trace_bpf_test_finish(&err);
764 struct bpf_raw_tp_test_run_info {
765 struct bpf_prog *prog;
771 __bpf_prog_test_run_raw_tp(void *data)
773 struct bpf_raw_tp_test_run_info *info = data;
776 info->retval = bpf_prog_run(info->prog, info->ctx);
780 int bpf_prog_test_run_raw_tp(struct bpf_prog *prog,
781 const union bpf_attr *kattr,
782 union bpf_attr __user *uattr)
784 void __user *ctx_in = u64_to_user_ptr(kattr->test.ctx_in);
785 __u32 ctx_size_in = kattr->test.ctx_size_in;
786 struct bpf_raw_tp_test_run_info info;
787 int cpu = kattr->test.cpu, err = 0;
790 /* doesn't support data_in/out, ctx_out, duration, or repeat */
791 if (kattr->test.data_in || kattr->test.data_out ||
792 kattr->test.ctx_out || kattr->test.duration ||
793 kattr->test.repeat || kattr->test.batch_size)
796 if (ctx_size_in < prog->aux->max_ctx_offset ||
797 ctx_size_in > MAX_BPF_FUNC_ARGS * sizeof(u64))
800 if ((kattr->test.flags & BPF_F_TEST_RUN_ON_CPU) == 0 && cpu != 0)
804 info.ctx = memdup_user(ctx_in, ctx_size_in);
805 if (IS_ERR(info.ctx))
806 return PTR_ERR(info.ctx);
813 current_cpu = get_cpu();
814 if ((kattr->test.flags & BPF_F_TEST_RUN_ON_CPU) == 0 ||
815 cpu == current_cpu) {
816 __bpf_prog_test_run_raw_tp(&info);
817 } else if (cpu >= nr_cpu_ids || !cpu_online(cpu)) {
818 /* smp_call_function_single() also checks cpu_online()
819 * after csd_lock(). However, since cpu is from user
820 * space, let's do an extra quick check to filter out
821 * invalid value before smp_call_function_single().
825 err = smp_call_function_single(cpu, __bpf_prog_test_run_raw_tp,
831 copy_to_user(&uattr->test.retval, &info.retval, sizeof(u32)))
838 static void *bpf_ctx_init(const union bpf_attr *kattr, u32 max_size)
840 void __user *data_in = u64_to_user_ptr(kattr->test.ctx_in);
841 void __user *data_out = u64_to_user_ptr(kattr->test.ctx_out);
842 u32 size = kattr->test.ctx_size_in;
846 if (!data_in && !data_out)
849 data = kzalloc(max_size, GFP_USER);
851 return ERR_PTR(-ENOMEM);
854 err = bpf_check_uarg_tail_zero(USER_BPFPTR(data_in), max_size, size);
860 size = min_t(u32, max_size, size);
861 if (copy_from_user(data, data_in, size)) {
863 return ERR_PTR(-EFAULT);
869 static int bpf_ctx_finish(const union bpf_attr *kattr,
870 union bpf_attr __user *uattr, const void *data,
873 void __user *data_out = u64_to_user_ptr(kattr->test.ctx_out);
875 u32 copy_size = size;
877 if (!data || !data_out)
880 if (copy_size > kattr->test.ctx_size_out) {
881 copy_size = kattr->test.ctx_size_out;
885 if (copy_to_user(data_out, data, copy_size))
887 if (copy_to_user(&uattr->test.ctx_size_out, &size, sizeof(size)))
896 * range_is_zero - test whether buffer is initialized
897 * @buf: buffer to check
898 * @from: check from this position
899 * @to: check up until (excluding) this position
901 * This function returns true if the there is a non-zero byte
902 * in the buf in the range [from,to).
904 static inline bool range_is_zero(void *buf, size_t from, size_t to)
906 return !memchr_inv((u8 *)buf + from, 0, to - from);
909 static int convert___skb_to_skb(struct sk_buff *skb, struct __sk_buff *__skb)
911 struct qdisc_skb_cb *cb = (struct qdisc_skb_cb *)skb->cb;
916 /* make sure the fields we don't use are zeroed */
917 if (!range_is_zero(__skb, 0, offsetof(struct __sk_buff, mark)))
920 /* mark is allowed */
922 if (!range_is_zero(__skb, offsetofend(struct __sk_buff, mark),
923 offsetof(struct __sk_buff, priority)))
926 /* priority is allowed */
927 /* ingress_ifindex is allowed */
928 /* ifindex is allowed */
930 if (!range_is_zero(__skb, offsetofend(struct __sk_buff, ifindex),
931 offsetof(struct __sk_buff, cb)))
936 if (!range_is_zero(__skb, offsetofend(struct __sk_buff, cb),
937 offsetof(struct __sk_buff, tstamp)))
940 /* tstamp is allowed */
941 /* wire_len is allowed */
942 /* gso_segs is allowed */
944 if (!range_is_zero(__skb, offsetofend(struct __sk_buff, gso_segs),
945 offsetof(struct __sk_buff, gso_size)))
948 /* gso_size is allowed */
950 if (!range_is_zero(__skb, offsetofend(struct __sk_buff, gso_size),
951 offsetof(struct __sk_buff, hwtstamp)))
954 /* hwtstamp is allowed */
956 if (!range_is_zero(__skb, offsetofend(struct __sk_buff, hwtstamp),
957 sizeof(struct __sk_buff)))
960 skb->mark = __skb->mark;
961 skb->priority = __skb->priority;
962 skb->skb_iif = __skb->ingress_ifindex;
963 skb->tstamp = __skb->tstamp;
964 memcpy(&cb->data, __skb->cb, QDISC_CB_PRIV_LEN);
966 if (__skb->wire_len == 0) {
967 cb->pkt_len = skb->len;
969 if (__skb->wire_len < skb->len ||
970 __skb->wire_len > GSO_MAX_SIZE)
972 cb->pkt_len = __skb->wire_len;
975 if (__skb->gso_segs > GSO_MAX_SEGS)
977 skb_shinfo(skb)->gso_segs = __skb->gso_segs;
978 skb_shinfo(skb)->gso_size = __skb->gso_size;
979 skb_shinfo(skb)->hwtstamps.hwtstamp = __skb->hwtstamp;
984 static void convert_skb_to___skb(struct sk_buff *skb, struct __sk_buff *__skb)
986 struct qdisc_skb_cb *cb = (struct qdisc_skb_cb *)skb->cb;
991 __skb->mark = skb->mark;
992 __skb->priority = skb->priority;
993 __skb->ingress_ifindex = skb->skb_iif;
994 __skb->ifindex = skb->dev->ifindex;
995 __skb->tstamp = skb->tstamp;
996 memcpy(__skb->cb, &cb->data, QDISC_CB_PRIV_LEN);
997 __skb->wire_len = cb->pkt_len;
998 __skb->gso_segs = skb_shinfo(skb)->gso_segs;
999 __skb->hwtstamp = skb_shinfo(skb)->hwtstamps.hwtstamp;
1002 static struct proto bpf_dummy_proto = {
1003 .name = "bpf_dummy",
1004 .owner = THIS_MODULE,
1005 .obj_size = sizeof(struct sock),
1008 int bpf_prog_test_run_skb(struct bpf_prog *prog, const union bpf_attr *kattr,
1009 union bpf_attr __user *uattr)
1011 bool is_l2 = false, is_direct_pkt_access = false;
1012 struct net *net = current->nsproxy->net_ns;
1013 struct net_device *dev = net->loopback_dev;
1014 u32 size = kattr->test.data_size_in;
1015 u32 repeat = kattr->test.repeat;
1016 struct __sk_buff *ctx = NULL;
1017 u32 retval, duration;
1018 int hh_len = ETH_HLEN;
1019 struct sk_buff *skb;
1024 if (kattr->test.flags || kattr->test.cpu || kattr->test.batch_size)
1027 data = bpf_test_init(kattr, kattr->test.data_size_in,
1028 size, NET_SKB_PAD + NET_IP_ALIGN,
1029 SKB_DATA_ALIGN(sizeof(struct skb_shared_info)));
1031 return PTR_ERR(data);
1033 ctx = bpf_ctx_init(kattr, sizeof(struct __sk_buff));
1036 return PTR_ERR(ctx);
1039 switch (prog->type) {
1040 case BPF_PROG_TYPE_SCHED_CLS:
1041 case BPF_PROG_TYPE_SCHED_ACT:
1044 case BPF_PROG_TYPE_LWT_IN:
1045 case BPF_PROG_TYPE_LWT_OUT:
1046 case BPF_PROG_TYPE_LWT_XMIT:
1047 is_direct_pkt_access = true;
1053 sk = sk_alloc(net, AF_UNSPEC, GFP_USER, &bpf_dummy_proto, 1);
1059 sock_init_data(NULL, sk);
1061 skb = build_skb(data, 0);
1070 skb_reserve(skb, NET_SKB_PAD + NET_IP_ALIGN);
1071 __skb_put(skb, size);
1072 if (ctx && ctx->ifindex > 1) {
1073 dev = dev_get_by_index(net, ctx->ifindex);
1079 skb->protocol = eth_type_trans(skb, dev);
1080 skb_reset_network_header(skb);
1082 switch (skb->protocol) {
1083 case htons(ETH_P_IP):
1084 sk->sk_family = AF_INET;
1085 if (sizeof(struct iphdr) <= skb_headlen(skb)) {
1086 sk->sk_rcv_saddr = ip_hdr(skb)->saddr;
1087 sk->sk_daddr = ip_hdr(skb)->daddr;
1090 #if IS_ENABLED(CONFIG_IPV6)
1091 case htons(ETH_P_IPV6):
1092 sk->sk_family = AF_INET6;
1093 if (sizeof(struct ipv6hdr) <= skb_headlen(skb)) {
1094 sk->sk_v6_rcv_saddr = ipv6_hdr(skb)->saddr;
1095 sk->sk_v6_daddr = ipv6_hdr(skb)->daddr;
1104 __skb_push(skb, hh_len);
1105 if (is_direct_pkt_access)
1106 bpf_compute_data_pointers(skb);
1107 ret = convert___skb_to_skb(skb, ctx);
1110 ret = bpf_test_run(prog, skb, repeat, &retval, &duration, false);
1114 if (skb_headroom(skb) < hh_len) {
1115 int nhead = HH_DATA_ALIGN(hh_len - skb_headroom(skb));
1117 if (pskb_expand_head(skb, nhead, 0, GFP_USER)) {
1122 memset(__skb_push(skb, hh_len), 0, hh_len);
1124 convert_skb_to___skb(skb, ctx);
1127 /* bpf program can never convert linear skb to non-linear */
1128 if (WARN_ON_ONCE(skb_is_nonlinear(skb)))
1129 size = skb_headlen(skb);
1130 ret = bpf_test_finish(kattr, uattr, skb->data, NULL, size, retval,
1133 ret = bpf_ctx_finish(kattr, uattr, ctx,
1134 sizeof(struct __sk_buff));
1136 if (dev && dev != net->loopback_dev)
1144 static int xdp_convert_md_to_buff(struct xdp_md *xdp_md, struct xdp_buff *xdp)
1146 unsigned int ingress_ifindex, rx_queue_index;
1147 struct netdev_rx_queue *rxqueue;
1148 struct net_device *device;
1153 if (xdp_md->egress_ifindex != 0)
1156 ingress_ifindex = xdp_md->ingress_ifindex;
1157 rx_queue_index = xdp_md->rx_queue_index;
1159 if (!ingress_ifindex && rx_queue_index)
1162 if (ingress_ifindex) {
1163 device = dev_get_by_index(current->nsproxy->net_ns,
1168 if (rx_queue_index >= device->real_num_rx_queues)
1171 rxqueue = __netif_get_rx_queue(device, rx_queue_index);
1173 if (!xdp_rxq_info_is_reg(&rxqueue->xdp_rxq))
1176 xdp->rxq = &rxqueue->xdp_rxq;
1177 /* The device is now tracked in the xdp->rxq for later
1182 xdp->data = xdp->data_meta + xdp_md->data;
1190 static void xdp_convert_buff_to_md(struct xdp_buff *xdp, struct xdp_md *xdp_md)
1195 xdp_md->data = xdp->data - xdp->data_meta;
1196 xdp_md->data_end = xdp->data_end - xdp->data_meta;
1198 if (xdp_md->ingress_ifindex)
1199 dev_put(xdp->rxq->dev);
1202 int bpf_prog_test_run_xdp(struct bpf_prog *prog, const union bpf_attr *kattr,
1203 union bpf_attr __user *uattr)
1205 bool do_live = (kattr->test.flags & BPF_F_TEST_XDP_LIVE_FRAMES);
1206 u32 tailroom = SKB_DATA_ALIGN(sizeof(struct skb_shared_info));
1207 u32 batch_size = kattr->test.batch_size;
1208 u32 retval = 0, duration, max_data_sz;
1209 u32 size = kattr->test.data_size_in;
1210 u32 headroom = XDP_PACKET_HEADROOM;
1211 u32 repeat = kattr->test.repeat;
1212 struct netdev_rx_queue *rxqueue;
1213 struct skb_shared_info *sinfo;
1214 struct xdp_buff xdp = {};
1215 int i, ret = -EINVAL;
1219 if (prog->expected_attach_type == BPF_XDP_DEVMAP ||
1220 prog->expected_attach_type == BPF_XDP_CPUMAP)
1223 if (kattr->test.flags & ~BPF_F_TEST_XDP_LIVE_FRAMES)
1228 batch_size = NAPI_POLL_WEIGHT;
1229 else if (batch_size > TEST_XDP_MAX_BATCH)
1232 headroom += sizeof(struct xdp_page_head);
1233 } else if (batch_size) {
1237 ctx = bpf_ctx_init(kattr, sizeof(struct xdp_md));
1239 return PTR_ERR(ctx);
1242 /* There can't be user provided data before the meta data */
1243 if (ctx->data_meta || ctx->data_end != size ||
1244 ctx->data > ctx->data_end ||
1245 unlikely(xdp_metalen_invalid(ctx->data)) ||
1246 (do_live && (kattr->test.data_out || kattr->test.ctx_out)))
1248 /* Meta data is allocated from the headroom */
1249 headroom -= ctx->data;
1252 max_data_sz = 4096 - headroom - tailroom;
1253 if (size > max_data_sz) {
1254 /* disallow live data mode for jumbo frames */
1260 data = bpf_test_init(kattr, size, max_data_sz, headroom, tailroom);
1262 ret = PTR_ERR(data);
1266 rxqueue = __netif_get_rx_queue(current->nsproxy->net_ns->loopback_dev, 0);
1267 rxqueue->xdp_rxq.frag_size = headroom + max_data_sz + tailroom;
1268 xdp_init_buff(&xdp, rxqueue->xdp_rxq.frag_size, &rxqueue->xdp_rxq);
1269 xdp_prepare_buff(&xdp, data, headroom, size, true);
1270 sinfo = xdp_get_shared_info_from_buff(&xdp);
1272 ret = xdp_convert_md_to_buff(ctx, &xdp);
1276 if (unlikely(kattr->test.data_size_in > size)) {
1277 void __user *data_in = u64_to_user_ptr(kattr->test.data_in);
1279 while (size < kattr->test.data_size_in) {
1284 if (sinfo->nr_frags == MAX_SKB_FRAGS) {
1289 page = alloc_page(GFP_KERNEL);
1295 frag = &sinfo->frags[sinfo->nr_frags++];
1296 __skb_frag_set_page(frag, page);
1298 data_len = min_t(u32, kattr->test.data_size_in - size,
1300 skb_frag_size_set(frag, data_len);
1302 if (copy_from_user(page_address(page), data_in + size,
1307 sinfo->xdp_frags_size += data_len;
1310 xdp_buff_set_frags_flag(&xdp);
1314 bpf_prog_change_xdp(NULL, prog);
1317 ret = bpf_test_run_xdp_live(prog, &xdp, repeat, batch_size, &duration);
1319 ret = bpf_test_run(prog, &xdp, repeat, &retval, &duration, true);
1320 /* We convert the xdp_buff back to an xdp_md before checking the return
1321 * code so the reference count of any held netdevice will be decremented
1322 * even if the test run failed.
1324 xdp_convert_buff_to_md(&xdp, ctx);
1328 size = xdp.data_end - xdp.data_meta + sinfo->xdp_frags_size;
1329 ret = bpf_test_finish(kattr, uattr, xdp.data_meta, sinfo, size,
1332 ret = bpf_ctx_finish(kattr, uattr, ctx,
1333 sizeof(struct xdp_md));
1337 bpf_prog_change_xdp(prog, NULL);
1339 for (i = 0; i < sinfo->nr_frags; i++)
1340 __free_page(skb_frag_page(&sinfo->frags[i]));
1347 static int verify_user_bpf_flow_keys(struct bpf_flow_keys *ctx)
1349 /* make sure the fields we don't use are zeroed */
1350 if (!range_is_zero(ctx, 0, offsetof(struct bpf_flow_keys, flags)))
1353 /* flags is allowed */
1355 if (!range_is_zero(ctx, offsetofend(struct bpf_flow_keys, flags),
1356 sizeof(struct bpf_flow_keys)))
1362 int bpf_prog_test_run_flow_dissector(struct bpf_prog *prog,
1363 const union bpf_attr *kattr,
1364 union bpf_attr __user *uattr)
1366 struct bpf_test_timer t = { NO_PREEMPT };
1367 u32 size = kattr->test.data_size_in;
1368 struct bpf_flow_dissector ctx = {};
1369 u32 repeat = kattr->test.repeat;
1370 struct bpf_flow_keys *user_ctx;
1371 struct bpf_flow_keys flow_keys;
1372 const struct ethhdr *eth;
1373 unsigned int flags = 0;
1374 u32 retval, duration;
1378 if (prog->type != BPF_PROG_TYPE_FLOW_DISSECTOR)
1381 if (kattr->test.flags || kattr->test.cpu || kattr->test.batch_size)
1384 if (size < ETH_HLEN)
1387 data = bpf_test_init(kattr, kattr->test.data_size_in, size, 0, 0);
1389 return PTR_ERR(data);
1391 eth = (struct ethhdr *)data;
1396 user_ctx = bpf_ctx_init(kattr, sizeof(struct bpf_flow_keys));
1397 if (IS_ERR(user_ctx)) {
1399 return PTR_ERR(user_ctx);
1402 ret = verify_user_bpf_flow_keys(user_ctx);
1405 flags = user_ctx->flags;
1408 ctx.flow_keys = &flow_keys;
1410 ctx.data_end = (__u8 *)data + size;
1412 bpf_test_timer_enter(&t);
1414 retval = bpf_flow_dissect(prog, &ctx, eth->h_proto, ETH_HLEN,
1416 } while (bpf_test_timer_continue(&t, 1, repeat, &ret, &duration));
1417 bpf_test_timer_leave(&t);
1422 ret = bpf_test_finish(kattr, uattr, &flow_keys, NULL,
1423 sizeof(flow_keys), retval, duration);
1425 ret = bpf_ctx_finish(kattr, uattr, user_ctx,
1426 sizeof(struct bpf_flow_keys));
1434 int bpf_prog_test_run_sk_lookup(struct bpf_prog *prog, const union bpf_attr *kattr,
1435 union bpf_attr __user *uattr)
1437 struct bpf_test_timer t = { NO_PREEMPT };
1438 struct bpf_prog_array *progs = NULL;
1439 struct bpf_sk_lookup_kern ctx = {};
1440 u32 repeat = kattr->test.repeat;
1441 struct bpf_sk_lookup *user_ctx;
1442 u32 retval, duration;
1445 if (prog->type != BPF_PROG_TYPE_SK_LOOKUP)
1448 if (kattr->test.flags || kattr->test.cpu || kattr->test.batch_size)
1451 if (kattr->test.data_in || kattr->test.data_size_in || kattr->test.data_out ||
1452 kattr->test.data_size_out)
1458 user_ctx = bpf_ctx_init(kattr, sizeof(*user_ctx));
1459 if (IS_ERR(user_ctx))
1460 return PTR_ERR(user_ctx);
1468 if (!range_is_zero(user_ctx, offsetofend(typeof(*user_ctx), local_port), sizeof(*user_ctx)))
1471 if (user_ctx->local_port > U16_MAX) {
1476 ctx.family = (u16)user_ctx->family;
1477 ctx.protocol = (u16)user_ctx->protocol;
1478 ctx.dport = (u16)user_ctx->local_port;
1479 ctx.sport = user_ctx->remote_port;
1481 switch (ctx.family) {
1483 ctx.v4.daddr = (__force __be32)user_ctx->local_ip4;
1484 ctx.v4.saddr = (__force __be32)user_ctx->remote_ip4;
1487 #if IS_ENABLED(CONFIG_IPV6)
1489 ctx.v6.daddr = (struct in6_addr *)user_ctx->local_ip6;
1490 ctx.v6.saddr = (struct in6_addr *)user_ctx->remote_ip6;
1495 ret = -EAFNOSUPPORT;
1499 progs = bpf_prog_array_alloc(1, GFP_KERNEL);
1505 progs->items[0].prog = prog;
1507 bpf_test_timer_enter(&t);
1509 ctx.selected_sk = NULL;
1510 retval = BPF_PROG_SK_LOOKUP_RUN_ARRAY(progs, ctx, bpf_prog_run);
1511 } while (bpf_test_timer_continue(&t, 1, repeat, &ret, &duration));
1512 bpf_test_timer_leave(&t);
1517 user_ctx->cookie = 0;
1518 if (ctx.selected_sk) {
1519 if (ctx.selected_sk->sk_reuseport && !ctx.no_reuseport) {
1524 user_ctx->cookie = sock_gen_cookie(ctx.selected_sk);
1527 ret = bpf_test_finish(kattr, uattr, NULL, NULL, 0, retval, duration);
1529 ret = bpf_ctx_finish(kattr, uattr, user_ctx, sizeof(*user_ctx));
1532 bpf_prog_array_free(progs);
1537 int bpf_prog_test_run_syscall(struct bpf_prog *prog,
1538 const union bpf_attr *kattr,
1539 union bpf_attr __user *uattr)
1541 void __user *ctx_in = u64_to_user_ptr(kattr->test.ctx_in);
1542 __u32 ctx_size_in = kattr->test.ctx_size_in;
1547 /* doesn't support data_in/out, ctx_out, duration, or repeat or flags */
1548 if (kattr->test.data_in || kattr->test.data_out ||
1549 kattr->test.ctx_out || kattr->test.duration ||
1550 kattr->test.repeat || kattr->test.flags ||
1551 kattr->test.batch_size)
1554 if (ctx_size_in < prog->aux->max_ctx_offset ||
1555 ctx_size_in > U16_MAX)
1559 ctx = memdup_user(ctx_in, ctx_size_in);
1561 return PTR_ERR(ctx);
1564 rcu_read_lock_trace();
1565 retval = bpf_prog_run_pin_on_cpu(prog, ctx);
1566 rcu_read_unlock_trace();
1568 if (copy_to_user(&uattr->test.retval, &retval, sizeof(u32))) {
1573 if (copy_to_user(ctx_in, ctx, ctx_size_in))
1580 static const struct btf_kfunc_id_set bpf_prog_test_kfunc_set = {
1581 .owner = THIS_MODULE,
1582 .check_set = &test_sk_check_kfunc_ids,
1583 .acquire_set = &test_sk_acquire_kfunc_ids,
1584 .release_set = &test_sk_release_kfunc_ids,
1585 .ret_null_set = &test_sk_ret_null_kfunc_ids,
1588 static int __init bpf_prog_test_run_init(void)
1590 return register_btf_kfunc_id_set(BPF_PROG_TYPE_SCHED_CLS, &bpf_prog_test_kfunc_set);
1592 late_initcall(bpf_prog_test_run_init);