starnix_core/bpf/
fs.rs

1// Copyright 2024 The Fuchsia Authors. All rights reserved.
2// Use of this source code is governed by a BSD-style license that can be
3// found in the LICENSE file.
4
5// TODO(https://github.com/rust-lang/rust/issues/39371): remove
6#![allow(non_upper_case_globals)]
7
8use crate::bpf::syscalls::BpfTypeFormat;
9use crate::bpf::{BpfMapHandle, ProgramHandle};
10use crate::mm::memory::MemoryObject;
11use crate::mm::{PAGE_SIZE, ProtectionFlags};
12use crate::security::{self, PermissionFlags};
13use crate::task::{
14    CurrentTask, EventHandler, SignalHandler, SignalHandlerInner, Task, WaitCanceler, Waiter,
15};
16use crate::vfs::buffers::{InputBuffer, OutputBuffer};
17use crate::vfs::{
18    CacheMode, CheckAccessReason, FdNumber, FileObject, FileOps, FileSystem, FileSystemHandle,
19    FileSystemOps, FileSystemOptions, FsNode, FsNodeHandle, FsNodeInfo, FsNodeOps, FsStr,
20    MemoryDirectoryFile, MemoryXattrStorage, NamespaceNode, XattrStorage as _,
21    fileops_impl_nonseekable, fileops_impl_noop_sync, fs_node_impl_not_dir,
22    fs_node_impl_xattr_delegate,
23};
24use bstr::BStr;
25use ebpf::{MapFlags, MapSchema};
26use ebpf_api::{RINGBUF_SIGNAL, compute_map_storage_size};
27use starnix_logging::track_stub;
28use starnix_sync::{FileOpsCore, LockEqualOrBefore, Locked, Unlocked};
29use starnix_types::vfs::default_statfs;
30use starnix_uapi::auth::FsCred;
31use starnix_uapi::device_type::DeviceType;
32use starnix_uapi::errors::Errno;
33use starnix_uapi::file_mode::{FileMode, mode};
34use starnix_uapi::math::round_up_to_increment;
35use starnix_uapi::open_flags::OpenFlags;
36use starnix_uapi::vfs::FdEvents;
37use starnix_uapi::{
38    BPF_FS_MAGIC, bpf_map_type_BPF_MAP_TYPE_ARRAY, bpf_map_type_BPF_MAP_TYPE_RINGBUF, errno, error,
39    statfs,
40};
41use std::sync::Arc;
42
43/// A reference to a BPF object that can be stored in either an FD or an entry in the /sys/fs/bpf
44/// filesystem.
45#[derive(Debug, Clone)]
46pub enum BpfHandle {
47    Program(ProgramHandle),
48
49    // Stub used to fake loading of programs of unknown types.
50    ProgramStub(u32),
51
52    Map(BpfMapHandle),
53    BpfTypeFormat(Arc<BpfTypeFormat>),
54}
55
56impl BpfHandle {
57    pub fn as_map(&self) -> Result<&BpfMapHandle, Errno> {
58        match self {
59            Self::Map(map) => Ok(map),
60            _ => error!(EINVAL),
61        }
62    }
63    pub fn as_program(&self) -> Result<&ProgramHandle, Errno> {
64        match self {
65            Self::Program(program) => Ok(program),
66            _ => error!(EINVAL),
67        }
68    }
69
70    pub fn into_program(self) -> Result<ProgramHandle, Errno> {
71        match self {
72            Self::Program(program) => Ok(program),
73            _ => error!(EINVAL),
74        }
75    }
76
77    // Returns VMO and schema if this handle references a map.
78    fn get_map_vmo(&self) -> Result<(&Arc<zx::Vmo>, MapSchema), Errno> {
79        match self {
80            Self::Map(map) => Ok((map.vmo(), map.schema)),
81            _ => error!(ENODEV),
82        }
83    }
84
85    pub fn type_name(&self) -> &'static str {
86        match self {
87            Self::Map(_) => "bpf-map",
88            Self::Program(_) | Self::ProgramStub(_) => "bpf-prog",
89            Self::BpfTypeFormat(_) => "bpf-type",
90        }
91    }
92
93    /// Performs security-related checks when opening a BPF map. If
94    /// `permission_flags` is `None`, then they are inferred from the map's
95    /// schema. `permission_flags` is ignored for programs.
96    pub(super) fn security_check_open_fd(
97        &self,
98        current_task: &CurrentTask,
99        permission_flags: Option<PermissionFlags>,
100    ) -> Result<(), Errno> {
101        match self {
102            Self::Map(bpf_map) => security::check_bpf_map_access(
103                current_task,
104                &bpf_map,
105                permission_flags.unwrap_or_else(|| bpf_map.schema.flags.into()),
106            ),
107            Self::Program(program) => security::check_bpf_prog_access(current_task, &program),
108            _ => Ok(()),
109        }
110    }
111}
112
113impl From<ProgramHandle> for BpfHandle {
114    fn from(program: ProgramHandle) -> Self {
115        Self::Program(program)
116    }
117}
118
119impl From<BpfMapHandle> for BpfHandle {
120    fn from(map: BpfMapHandle) -> Self {
121        Self::Map(map)
122    }
123}
124
125impl From<BpfTypeFormat> for BpfHandle {
126    fn from(format: BpfTypeFormat) -> Self {
127        Self::BpfTypeFormat(Arc::new(format))
128    }
129}
130
131impl FileOps for BpfHandle {
132    fileops_impl_nonseekable!();
133    fileops_impl_noop_sync!();
134    fn read(
135        &self,
136        _locked: &mut Locked<FileOpsCore>,
137        _file: &FileObject,
138        _current_task: &crate::task::CurrentTask,
139        _offset: usize,
140        _data: &mut dyn OutputBuffer,
141    ) -> Result<usize, Errno> {
142        track_stub!(TODO("https://fxbug.dev/322874229"), "bpf handle read");
143        error!(EINVAL)
144    }
145    fn write(
146        &self,
147        _locked: &mut Locked<FileOpsCore>,
148        _file: &FileObject,
149        _current_task: &crate::task::CurrentTask,
150        _offset: usize,
151        _data: &mut dyn InputBuffer,
152    ) -> Result<usize, Errno> {
153        track_stub!(TODO("https://fxbug.dev/322873841"), "bpf handle write");
154        error!(EINVAL)
155    }
156
157    fn get_memory(
158        &self,
159        locked: &mut Locked<FileOpsCore>,
160        _file: &FileObject,
161        _current_task: &CurrentTask,
162        length: Option<usize>,
163        prot: ProtectionFlags,
164    ) -> Result<Arc<MemoryObject>, Errno> {
165        let (vmo, schema) = self.get_map_vmo()?;
166
167        // Because of the specific condition needed to map this object, the size must be known.
168        let length = length.ok_or_else(|| errno!(EINVAL))?;
169
170        // This cannot be mapped executable.
171        if prot.contains(ProtectionFlags::EXEC) {
172            return error!(EPERM);
173        }
174
175        match schema.map_type {
176            bpf_map_type_BPF_MAP_TYPE_RINGBUF => {
177                let page_size = *PAGE_SIZE as usize;
178                // Starting from the second page, this cannot be mapped writable.
179                if length > page_size {
180                    if prot.contains(ProtectionFlags::WRITE) {
181                        return error!(EPERM);
182                    }
183                    // This cannot be mapped outside of the 2 control pages and the 2 data sections.
184                    if length > 2 * page_size + 2 * schema.max_entries as usize {
185                        return error!(EINVAL);
186                    }
187                }
188
189                self.as_map()?.get_memory(locked, || {
190                    // The first page of the ring buffer VMO is not visible to
191                    // user-space processes. Return a VMO slice that doesn't
192                    // include the first page.
193                    let clone_size = 2 * page_size + schema.max_entries as usize;
194                    let vmo_dup = vmo
195                        .create_child(
196                            zx::VmoChildOptions::SLICE,
197                            page_size as u64,
198                            clone_size as u64,
199                        )
200                        .map_err(|_| errno!(EIO))?
201                        .into();
202                    Ok(Arc::new(MemoryObject::RingBuf(vmo_dup)))
203                })
204            }
205
206            bpf_map_type_BPF_MAP_TYPE_ARRAY => {
207                if !schema.flags.contains(MapFlags::Mmapable) {
208                    return error!(EPERM);
209                }
210
211                let array_size = round_up_to_increment(
212                    compute_map_storage_size(&schema).map_err(|_| errno!(EINVAL))?,
213                    *PAGE_SIZE as usize,
214                )?;
215                if length > array_size {
216                    return error!(EINVAL);
217                }
218
219                self.as_map()?.get_memory(locked, || {
220                    let vmo_dup = vmo
221                        .as_handle_ref()
222                        .duplicate(zx::Rights::SAME_RIGHTS)
223                        .map_err(|_| errno!(EIO))?
224                        .into();
225                    Ok(Arc::new(MemoryObject::Vmo(vmo_dup)))
226                })
227            }
228
229            // Other maps cannot be mmap'ed.
230            _ => error!(ENODEV),
231        }
232    }
233
234    fn wait_async(
235        &self,
236        _locked: &mut Locked<FileOpsCore>,
237        _file: &FileObject,
238        _current_task: &CurrentTask,
239        waiter: &Waiter,
240        events: FdEvents,
241        handler: EventHandler,
242    ) -> Option<WaitCanceler> {
243        let (vmo, schema) = self.get_map_vmo().ok()?;
244
245        // Only ringbuffers can be polled for POLLIN.
246        if schema.map_type != bpf_map_type_BPF_MAP_TYPE_RINGBUF
247            || !events.contains(FdEvents::POLLIN)
248        {
249            return Some(WaitCanceler::new_noop());
250        }
251
252        let handler = SignalHandler {
253            inner: SignalHandlerInner::ZxHandle(|signals| {
254                if signals.contains(RINGBUF_SIGNAL) { FdEvents::POLLIN } else { FdEvents::empty() }
255            }),
256            event_handler: handler,
257            err_code: None,
258        };
259
260        // Reset the signal before waiting. The case when the ring buffer already has some data
261        // is handled by the caller: it should call `query_events` after starting the waiter.
262        vmo.as_handle_ref()
263            .signal(RINGBUF_SIGNAL, zx::Signals::empty())
264            .expect("Failed to set signal or a ring buffer VMO");
265
266        let canceler = waiter
267            .wake_on_zircon_signals(&vmo.as_handle_ref(), RINGBUF_SIGNAL, handler)
268            .expect("Failed to wait for signals on ringbuf VMO");
269        Some(WaitCanceler::new_port(canceler))
270    }
271
272    fn query_events(
273        &self,
274        _locked: &mut Locked<FileOpsCore>,
275        _file: &FileObject,
276        _current_task: &CurrentTask,
277    ) -> Result<FdEvents, Errno> {
278        match self {
279            Self::Map(map) => {
280                let events = match map.can_read() {
281                    Some(true) => FdEvents::POLLIN,
282                    Some(false) => FdEvents::empty(),
283                    None => FdEvents::POLLERR,
284                };
285                Ok(events)
286            }
287            _ => error!(EPERM),
288        }
289    }
290}
291
292pub fn get_bpf_object(task: &Task, fd: FdNumber) -> Result<BpfHandle, Errno> {
293    Ok((*task.live()?.files.get(fd)?.downcast_file::<BpfHandle>().ok_or_else(|| errno!(EBADF))?)
294        .clone())
295}
296pub struct BpfFs;
297impl BpfFs {
298    pub fn new_fs(
299        locked: &mut Locked<Unlocked>,
300        current_task: &CurrentTask,
301        options: FileSystemOptions,
302    ) -> Result<FileSystemHandle, Errno> {
303        let kernel = current_task.kernel();
304        let fs = FileSystem::new(locked, kernel, CacheMode::Permanent, BpfFs, options)?;
305        let root_ino = fs.allocate_ino();
306        fs.create_root_with_info(
307            root_ino,
308            BpfFsDir::new(),
309            FsNodeInfo::new(mode!(IFDIR, 0o777) | FileMode::ISVTX, FsCred::root()),
310        );
311        Ok(fs)
312    }
313}
314
315impl FileSystemOps for BpfFs {
316    fn statfs(
317        &self,
318        _locked: &mut Locked<FileOpsCore>,
319        _fs: &FileSystem,
320        _current_task: &CurrentTask,
321    ) -> Result<statfs, Errno> {
322        Ok(default_statfs(BPF_FS_MAGIC))
323    }
324    fn name(&self) -> &'static FsStr {
325        "bpf".into()
326    }
327
328    fn rename(
329        &self,
330        _locked: &mut Locked<FileOpsCore>,
331        _fs: &FileSystem,
332        _current_task: &CurrentTask,
333        _old_parent: &FsNodeHandle,
334        _old_name: &FsStr,
335        _new_parent: &FsNodeHandle,
336        _new_name: &FsStr,
337        _renamed: &FsNodeHandle,
338        _replaced: Option<&FsNodeHandle>,
339    ) -> Result<(), Errno> {
340        Ok(())
341    }
342}
343
344pub struct BpfFsDir {
345    xattrs: MemoryXattrStorage,
346}
347
348impl BpfFsDir {
349    fn new() -> Self {
350        Self { xattrs: MemoryXattrStorage::default() }
351    }
352
353    pub fn register_pin<L>(
354        &self,
355        locked: &mut Locked<L>,
356        current_task: &CurrentTask,
357        node: &NamespaceNode,
358        name: &FsStr,
359        object: BpfHandle,
360    ) -> Result<(), Errno>
361    where
362        L: LockEqualOrBefore<FileOpsCore>,
363    {
364        node.entry.create_entry(
365            locked,
366            current_task,
367            &node.mount,
368            name,
369            |_locked, dir, _mount, _name| {
370                Ok(dir.fs().create_node_and_allocate_node_id(
371                    BpfFsObject::new(object),
372                    FsNodeInfo::new(mode!(IFREG, 0o600), current_task.current_fscred()),
373                ))
374            },
375        )?;
376        Ok(())
377    }
378}
379
380impl FsNodeOps for BpfFsDir {
381    fs_node_impl_xattr_delegate!(self, self.xattrs);
382
383    fn create_file_ops(
384        &self,
385        _locked: &mut Locked<FileOpsCore>,
386        _node: &FsNode,
387        _current_task: &CurrentTask,
388        _flags: OpenFlags,
389    ) -> Result<Box<dyn FileOps>, Errno> {
390        Ok(Box::new(MemoryDirectoryFile::new()))
391    }
392
393    fn mkdir(
394        &self,
395        _locked: &mut Locked<FileOpsCore>,
396        node: &FsNode,
397        _current_task: &CurrentTask,
398        _name: &FsStr,
399        mode: FileMode,
400        owner: FsCred,
401    ) -> Result<FsNodeHandle, Errno> {
402        Ok(node.fs().create_node_and_allocate_node_id(
403            BpfFsDir::new(),
404            FsNodeInfo::new(mode | FileMode::ISVTX, owner),
405        ))
406    }
407
408    fn mknod(
409        &self,
410        _locked: &mut Locked<FileOpsCore>,
411        _node: &FsNode,
412        _current_task: &CurrentTask,
413        _name: &FsStr,
414        _mode: FileMode,
415        _dev: DeviceType,
416        _owner: FsCred,
417    ) -> Result<FsNodeHandle, Errno> {
418        error!(EPERM)
419    }
420
421    fn create_symlink(
422        &self,
423        _locked: &mut Locked<FileOpsCore>,
424        _node: &FsNode,
425        _current_task: &CurrentTask,
426        _name: &FsStr,
427        _target: &FsStr,
428        _owner: FsCred,
429    ) -> Result<FsNodeHandle, Errno> {
430        error!(EPERM)
431    }
432
433    fn link(
434        &self,
435        _locked: &mut Locked<FileOpsCore>,
436        _node: &FsNode,
437        _current_task: &CurrentTask,
438        _name: &FsStr,
439        _child: &FsNodeHandle,
440    ) -> Result<(), Errno> {
441        Ok(())
442    }
443
444    fn unlink(
445        &self,
446        _locked: &mut Locked<FileOpsCore>,
447        _node: &FsNode,
448        _current_task: &CurrentTask,
449        _name: &FsStr,
450        _child: &FsNodeHandle,
451    ) -> Result<(), Errno> {
452        Ok(())
453    }
454}
455
456pub struct BpfFsObject {
457    pub handle: BpfHandle,
458    xattrs: MemoryXattrStorage,
459}
460
461impl BpfFsObject {
462    fn new(handle: BpfHandle) -> Self {
463        Self { handle, xattrs: MemoryXattrStorage::default() }
464    }
465}
466
467impl FsNodeOps for BpfFsObject {
468    fs_node_impl_not_dir!();
469    fs_node_impl_xattr_delegate!(self, self.xattrs);
470
471    fn create_file_ops(
472        &self,
473        _locked: &mut Locked<FileOpsCore>,
474        _node: &FsNode,
475        _current_task: &CurrentTask,
476        _flags: OpenFlags,
477    ) -> Result<Box<dyn FileOps>, Errno> {
478        error!(EIO)
479    }
480}
481
482/// Resolves a pinned BPF object from a path, returning the handle and the node.
483/// Performs DAC and MAC checks using the specified `open_flags `. Also updates
484/// atime unless `NOATIME` flag is set.
485pub fn resolve_pinned_bpf_object(
486    locked: &mut Locked<Unlocked>,
487    current_task: &CurrentTask,
488    path: &BStr,
489    open_flags: OpenFlags,
490) -> Result<(BpfHandle, NamespaceNode), Errno> {
491    let node = current_task.lookup_path_from_root(locked, path.as_ref())?;
492
493    let permission_flags = PermissionFlags::from(open_flags);
494    node.check_access(locked, current_task, permission_flags, CheckAccessReason::Access)?;
495
496    let object = node.entry.node.downcast_ops::<BpfFsObject>().ok_or_else(|| errno!(EPERM))?;
497    object.handle.security_check_open_fd(current_task, Some(permission_flags))?;
498
499    if !open_flags.contains(OpenFlags::NOATIME) {
500        node.update_atime();
501    }
502
503    Ok((object.handle.clone(), node))
504}
starnix_core/bpf/fs.rs

starnix_core/bpf/
fs.rs
