static int nfp_bpf_check_call(struct nfp_prog *nfp_prog, struct bpf_verifier_env *env, struct nfp_insn_meta *meta) { const struct bpf_reg_state *reg1 = cur_regs(env) + BPF_REG_1; const struct bpf_reg_state *reg2 = cur_regs(env) + BPF_REG_2; const struct bpf_reg_state *reg3 = cur_regs(env) + BPF_REG_3; struct nfp_app_bpf *bpf = nfp_prog->bpf; u32 func_id = meta->insn.imm; switch (func_id) { case BPF_FUNC_xdp_adjust_head: if (!bpf->adjust_head.off_max) { pr_vlog(env, "adjust_head not supported by FW\n"); return -EOPNOTSUPP; } if (!(bpf->adjust_head.flags & NFP_BPF_ADJUST_HEAD_NO_META)) { pr_vlog(env, "adjust_head: FW requires shifting metadata, not supported by the driver\n"); return -EOPNOTSUPP; } nfp_record_adjust_head(bpf, nfp_prog, meta, reg2); break; case BPF_FUNC_map_lookup_elem: if (!nfp_bpf_map_call_ok("map_lookup", env, meta, bpf->helpers.map_lookup, reg1) || !nfp_bpf_stack_arg_ok("map_lookup", env, reg2, meta->func_id ? &meta->arg2 : NULL)) return -EOPNOTSUPP; break; case BPF_FUNC_map_update_elem: if (!nfp_bpf_map_call_ok("map_update", env, meta, bpf->helpers.map_update, reg1) || !nfp_bpf_stack_arg_ok("map_update", env, reg2, meta->func_id ? &meta->arg2 : NULL) || !nfp_bpf_stack_arg_ok("map_update", env, reg3, NULL)) return -EOPNOTSUPP; break; case BPF_FUNC_map_delete_elem: if (!nfp_bpf_map_call_ok("map_delete", env, meta, bpf->helpers.map_delete, reg1) || !nfp_bpf_stack_arg_ok("map_delete", env, reg2, meta->func_id ? &meta->arg2 : NULL)) return -EOPNOTSUPP; break; case BPF_FUNC_get_prandom_u32: if (bpf->pseudo_random) break; pr_vlog(env, "bpf_get_prandom_u32(): FW doesn't support random number generation\n"); return -EOPNOTSUPP; case BPF_FUNC_perf_event_output: BUILD_BUG_ON(NFP_BPF_SCALAR_VALUE != SCALAR_VALUE || NFP_BPF_MAP_VALUE != PTR_TO_MAP_VALUE || NFP_BPF_STACK != PTR_TO_STACK || NFP_BPF_PACKET_DATA != PTR_TO_PACKET); if (!bpf->helpers.perf_event_output) { pr_vlog(env, "event_output: not supported by FW\n"); return -EOPNOTSUPP; } /* Force current CPU to make sure we can report the event * wherever we get the control message from FW. */ if (reg3->var_off.mask & BPF_F_INDEX_MASK || (reg3->var_off.value & BPF_F_INDEX_MASK) != BPF_F_CURRENT_CPU) { char tn_buf[48]; tnum_strn(tn_buf, sizeof(tn_buf), reg3->var_off); pr_vlog(env, "event_output: must use BPF_F_CURRENT_CPU, var_off: %s\n", tn_buf); return -EOPNOTSUPP; } /* Save space in meta, we don't care about arguments other * than 4th meta, shove it into arg1. */ reg1 = cur_regs(env) + BPF_REG_4; if (reg1->type != SCALAR_VALUE /* NULL ptr */ && reg1->type != PTR_TO_STACK && reg1->type != PTR_TO_MAP_VALUE && reg1->type != PTR_TO_PACKET) { pr_vlog(env, "event_output: unsupported ptr type: %d\n", reg1->type); return -EOPNOTSUPP; } if (reg1->type == PTR_TO_STACK && !nfp_bpf_stack_arg_ok("event_output", env, reg1, NULL)) return -EOPNOTSUPP; /* Warn user that on offload NFP may return success even if map * is not going to accept the event, since the event output is * fully async and device won't know the state of the map. * There is also FW limitation on the event length. * * Lost events will not show up on the perf ring, driver * won't see them at all. Events may also get reordered. */ dev_warn_once(&nfp_prog->bpf->app->pf->pdev->dev, "bpf: note: return codes and behavior of bpf_event_output() helper differs for offloaded programs!\n"); pr_vlog(env, "warning: return codes and behavior of event_output helper differ for offload!\n"); if (!meta->func_id) break; if (reg1->type != meta->arg1.type) { pr_vlog(env, "event_output: ptr type changed: %d %d\n", meta->arg1.type, reg1->type); return -EINVAL; } break; default: pr_vlog(env, "unsupported function id: %d\n", func_id); return -EOPNOTSUPP; } meta->func_id = func_id; meta->arg1 = *reg1; meta->arg2.reg = *reg2; return 0; }
static int nfp_bpf_check_call(struct nfp_prog *nfp_prog, struct bpf_verifier_env *env, struct nfp_insn_meta *meta) { const struct bpf_reg_state *reg1 = cur_regs(env) + BPF_REG_1; const struct bpf_reg_state *reg2 = cur_regs(env) + BPF_REG_2; struct nfp_app_bpf *bpf = nfp_prog->bpf; u32 func_id = meta->insn.imm; s64 off, old_off; switch (func_id) { case BPF_FUNC_xdp_adjust_head: if (!bpf->adjust_head.off_max) { pr_vlog(env, "adjust_head not supported by FW\n"); return -EOPNOTSUPP; } if (!(bpf->adjust_head.flags & NFP_BPF_ADJUST_HEAD_NO_META)) { pr_vlog(env, "adjust_head: FW requires shifting metadata, not supported by the driver\n"); return -EOPNOTSUPP; } nfp_record_adjust_head(bpf, nfp_prog, meta, reg2); break; case BPF_FUNC_map_lookup_elem: if (!bpf->helpers.map_lookup) { pr_vlog(env, "map_lookup: not supported by FW\n"); return -EOPNOTSUPP; } if (reg2->type != PTR_TO_STACK) { pr_vlog(env, "map_lookup: unsupported key ptr type %d\n", reg2->type); return -EOPNOTSUPP; } if (!tnum_is_const(reg2->var_off)) { pr_vlog(env, "map_lookup: variable key pointer\n"); return -EOPNOTSUPP; } off = reg2->var_off.value + reg2->off; if (-off % 4) { pr_vlog(env, "map_lookup: unaligned stack pointer %lld\n", -off); return -EOPNOTSUPP; } /* Rest of the checks is only if we re-parse the same insn */ if (!meta->func_id) break; old_off = meta->arg2.var_off.value + meta->arg2.off; meta->arg2_var_off |= off != old_off; if (meta->arg1.map_ptr != reg1->map_ptr) { pr_vlog(env, "map_lookup: called for different map\n"); return -EOPNOTSUPP; } break; default: pr_vlog(env, "unsupported function id: %d\n", func_id); return -EOPNOTSUPP; } meta->func_id = func_id; meta->arg1 = *reg1; meta->arg2 = *reg2; return 0; }