Add a test written with inline assembly to check that the verifier does not incorrecly use the src_reg field of a BPF_ALU | BPF_TO_BE | BPF_END instruction. Signed-off-by: Shung-Hsi Yu <shung-hsi.yu@xxxxxxxx> --- This is the first time I'm writing a selftest so there's a lot of question I can't answer myself. Looking for suggestions regarding: 1. Whether BPF_NEG and other BPF_END cases should be tested as well 2. While the suggested way of writing BPF assembly is with inline assembly[0], as done here, maybe it is better to have this test case added in verifier/precise.c and written using macro instead? The rational is that ideally we want the selftest to be backport to the v5.3+ stable kernels alongside the fix, but __msg macro used here is only available since v6.2. 0: https://lore.kernel.org/bpf/CAADnVQJHAPid9HouwMEnfwDDKuy8BnGia269KSbby2gA030OBg@xxxxxxxxxxxxxx/ .../selftests/bpf/prog_tests/verifier.c | 2 ++ .../selftests/bpf/progs/verifier_precision.c | 29 +++++++++++++++++++ 2 files changed, 31 insertions(+) create mode 100644 tools/testing/selftests/bpf/progs/verifier_precision.c diff --git a/tools/testing/selftests/bpf/prog_tests/verifier.c b/tools/testing/selftests/bpf/prog_tests/verifier.c index e3e68c97b40c..e5c61aa6604a 100644 --- a/tools/testing/selftests/bpf/prog_tests/verifier.c +++ b/tools/testing/selftests/bpf/prog_tests/verifier.c @@ -46,6 +46,7 @@ #include "verifier_movsx.skel.h" #include "verifier_netfilter_ctx.skel.h" #include "verifier_netfilter_retcode.skel.h" +#include "verifier_precision.skel.h" #include "verifier_prevent_map_lookup.skel.h" #include "verifier_raw_stack.skel.h" #include "verifier_raw_tp_writable.skel.h" @@ -153,6 +154,7 @@ void test_verifier_meta_access(void) { RUN(verifier_meta_access); } void test_verifier_movsx(void) { RUN(verifier_movsx); } void test_verifier_netfilter_ctx(void) { RUN(verifier_netfilter_ctx); } void test_verifier_netfilter_retcode(void) { RUN(verifier_netfilter_retcode); } +void test_verifier_precision(void) { RUN(verifier_precision); } void test_verifier_prevent_map_lookup(void) { RUN(verifier_prevent_map_lookup); } void test_verifier_raw_stack(void) { RUN(verifier_raw_stack); } void test_verifier_raw_tp_writable(void) { RUN(verifier_raw_tp_writable); } diff --git a/tools/testing/selftests/bpf/progs/verifier_precision.c b/tools/testing/selftests/bpf/progs/verifier_precision.c new file mode 100644 index 000000000000..9236994387bf --- /dev/null +++ b/tools/testing/selftests/bpf/progs/verifier_precision.c @@ -0,0 +1,29 @@ +// SPDX-License-Identifier: GPL-2.0 +/* Copyright (C) 2023 SUSE LLC */ + +#include <linux/bpf.h> +#include <bpf/bpf_helpers.h> +#include "bpf_misc.h" + +int vals[] SEC(".data.vals") = {1, 2, 3, 4}; + +SEC("?raw_tp") +__success __log_level(2) +__msg("mark_precise: frame0: regs=r2 stack= before 5: (bf) r1 = r6") +__msg("mark_precise: frame0: regs=r2 stack= before 4: (57) r2 &= 3") +__msg("mark_precise: frame0: regs=r2 stack= before 3: (dc) r2 = be16 r2") +__msg("mark_precise: frame0: regs=r2 stack= before 2: (b7) r2 = 0") +__naked int bpf_end(void) +{ + asm volatile ( + "r2 = 0;" + "r2 = be16 r2;" + "r2 &= 0x3;" + "r1 = %[vals];" + "r1 += r2;" + "r0 = *(u32 *)(r1 + 0);" + "exit;" + : + : __imm_ptr(vals) + : __clobber_common); +} -- 2.42.0
