// SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause)
/* Copyright (C) 2016-2018 Netronome Systems, Inc. */
#include <linux/bpf.h>
#include <linux/bpf_verifier.h>
#include <linux/kernel.h>
#include <linux/netdevice.h>
#include <linux/pkt_cls.h>
#include "../nfp_app.h"
#include "../nfp_main.h"
#include "../nfp_net.h"
#include "fw.h"
#include "main.h"
#define pr_vlog(env, fmt, ...) \
bpf_verifier_log_write(env, "[nfp] " fmt, ##__VA_ARGS__)
struct nfp_insn_meta *
nfp_bpf_goto_meta(struct nfp_prog *nfp_prog, struct nfp_insn_meta *meta,
unsigned int insn_idx)
{
unsigned int forward, backward, i;
backward = meta->n - insn_idx;
forward = insn_idx - meta->n;
if (min(forward, backward) > nfp_prog->n_insns - insn_idx - 1) {
backward = nfp_prog->n_insns - insn_idx - 1;
meta = nfp_prog_last_meta(nfp_prog);
}
if (min(forward, backward) > insn_idx && backward > insn_idx) {
forward = insn_idx;
meta = nfp_prog_first_meta(nfp_prog);
}
if (forward < backward)
for (i = 0; i < forward; i++)
meta = nfp_meta_next(meta);
else
for (i = 0; i < backward; i++)
meta = nfp_meta_prev(meta);
return meta;
}
static void
nfp_record_adjust_head(struct nfp_app_bpf *bpf, struct nfp_prog *nfp_prog,
struct nfp_insn_meta *meta,
const struct bpf_reg_state *reg2)
{
unsigned int location = UINT_MAX;
int imm;
/* Datapath usually can give us guarantees on how much adjust head
* can be done without the need for any checks. Optimize the simple
* case where there is only one adjust head by a constant.
*/
if (reg2->type != SCALAR_VALUE || !tnum_is_const(reg2->var_off))
goto exit_set_location;
imm = reg2->var_off.value;
/* Translator will skip all checks, we need to guarantee min pkt len */
if (imm > ETH_ZLEN - ETH_HLEN)
goto exit_set_location;
if (imm > (int)bpf->adjust_head.guaranteed_add ||
imm < -bpf->adjust_head.guaranteed_sub)
goto exit_set_location;
if (nfp_prog->adjust_head_location) {
/* Only one call per program allowed */
if (nfp_prog->adjust_head_location != meta->n)
goto exit_set_location;
if (meta->arg2.reg.var_off.value != imm)
goto exit_set_location;
}
location = meta->n;
exit_set_location:
nfp_prog->adjust_head_location = location;
}
static bool nfp_bpf_map_update_value_ok(struct bpf_verifier_env *env)
{
const struct bpf_reg_state *reg1 = cur_regs(env) + BPF_REG_1;
const struct bpf_reg_state *reg3 = cur_regs(env) + BPF_REG_3;
struct bpf_offloaded_map *offmap;
struct bpf_func_state *state;
struct nfp_bpf_map *nfp_map;
int off, i;
state = env->cur_state->frame[reg3->frameno];
/* We need to record each time update happens with non-zero words,
* in case such word is used in atomic operations.
* Implicitly depend on nfp_bpf_stack_arg_ok(reg3) being run before.
*/
offmap = map_to_offmap(reg1->map_ptr);
nfp_map = offmap->dev_priv;
off = reg3->off + reg3->var_off.value;
for (i = 0; i < offmap->map.value_size; i++) {
struct bpf_stack_state *stack_entry;
unsigned int soff;
soff = -(off + i) - 1;
stack_entry = &state->stack[soff / BPF_REG_SIZE];
if (stack_entry->slot_type[soff % BPF_REG_SIZE] == STACK_ZERO)
continue;
if (nfp_map->use_map[i / 4].type == NFP_MAP_USE_ATOMIC_CNT) {
pr_vlog(env, "value at offset %d/%d may be non-zero, bpf_map_update_elem() is required to initialize atomic counters to zero to avoid offload endian issues\n",
i, soff);
return false;
}
nfp_map->use_map[i / 4].non_zero_update = 1;
}
return true;
}
static int
nfp_bpf_stack_arg_ok(const char *fname, struct bpf_verifier_env *env,
const struct bpf_reg_state *reg,
struct nfp_bpf_reg_state *old_arg)
{
s64 off, old_off;
if (reg->type != PTR_TO_STACK) {
pr_vlog(env, "%s: unsupported ptr type %d\n",
fname, reg->type);
return false;
}
if (!tnum_is_const(reg->var_off)) {
pr_vlog(env, "%s: variable pointer\n", fname);
return false;
}
off = reg->var_off.value + reg->off;
if (-off % 4) {
pr_vlog(env, "%s: unaligned stack pointer %lld\n", fname, -off);