On Mon, 2023-10-30 at 21:21 +0800, Shung-Hsi Yu wrote:
> Add a test written with inline assembly to check that the verifier does
> not incorrecly use the src_reg field of a BPF_ALU | BPF_TO_BE | BPF_END
> instruction.
>
> Signed-off-by: Shung-Hsi Yu <shung-hsi.yu@xxxxxxxx>
> ---
>
> This is the first time I'm writing a selftest so there's a lot of
> question I can't answer myself. Looking for suggestions regarding:
>
> 1. Whether BPF_NEG and other BPF_END cases should be tested as well
It is probably good to test BPF_NEG, unfortunately verifier does not
track range information for BPF_NEG, so I ended up with the following
contraption:
SEC("?raw_tp")
__success __log_level(2)
__msg("mark_precise: frame0: regs=r2 stack= before 3: (bf) r1 = r10")
__msg("mark_precise: frame0: regs=r2 stack= before 2: (55) if r2 != 0xfffffff8 goto pc+2")
__msg("mark_precise: frame0: regs=r2 stack= before 1: (87) r2 = -r2")
__msg("mark_precise: frame0: regs=r2 stack= before 0: (b7) r2 = 8")
__naked int bpf_neg(void)
{
asm volatile (
"r2 = 8;"
"r2 = -r2;"
"if r2 != -8 goto 1f;"
"r1 = r10;"
"r1 += r2;"
"1:"
"r0 = 0;"
"exit;"
::: __clobber_all);
}
Also, maybe it's good to test bswap version of BPF_END (CPU v4
instruction) for completeness, e.g. as follows:
#if (defined(__TARGET_ARCH_arm64) || defined(__TARGET_ARCH_x86) || \
(defined(__TARGET_ARCH_riscv) && __riscv_xlen == 64) || \
defined(__TARGET_ARCH_arm) || defined(__TARGET_ARCH_s390)) && \
__clang_major__ >= 18
...
"r2 = bswap16 r2;"
...
#endif
> 2. While the suggested way of writing BPF assembly is with inline
> assembly[0], as done here, maybe it is better to have this test case
> added in verifier/precise.c and written using macro instead?
> The rational is that ideally we want the selftest to be backport to
> the v5.3+ stable kernels alongside the fix, but __msg macro used here
> is only available since v6.2.
As far as I understand we want to have new tests written in assembly,
but let's wait for Alexei or Andrii to comment.
>
> 0: https://lore.kernel.org/bpf/CAADnVQJHAPid9HouwMEnfwDDKuy8BnGia269KSbby2gA030OBg@xxxxxxxxxxxxxx/
>
> .../selftests/bpf/prog_tests/verifier.c | 2 ++
> .../selftests/bpf/progs/verifier_precision.c | 29 +++++++++++++++++++
> 2 files changed, 31 insertions(+)
> create mode 100644 tools/testing/selftests/bpf/progs/verifier_precision.c
>
> diff --git a/tools/testing/selftests/bpf/prog_tests/verifier.c b/tools/testing/selftests/bpf/prog_tests/verifier.c
> index e3e68c97b40c..e5c61aa6604a 100644
> --- a/tools/testing/selftests/bpf/prog_tests/verifier.c
> +++ b/tools/testing/selftests/bpf/prog_tests/verifier.c
> @@ -46,6 +46,7 @@
> #include "verifier_movsx.skel.h"
> #include "verifier_netfilter_ctx.skel.h"
> #include "verifier_netfilter_retcode.skel.h"
> +#include "verifier_precision.skel.h"
> #include "verifier_prevent_map_lookup.skel.h"
> #include "verifier_raw_stack.skel.h"
> #include "verifier_raw_tp_writable.skel.h"
> @@ -153,6 +154,7 @@ void test_verifier_meta_access(void) { RUN(verifier_meta_access); }
> void test_verifier_movsx(void) { RUN(verifier_movsx); }
> void test_verifier_netfilter_ctx(void) { RUN(verifier_netfilter_ctx); }
> void test_verifier_netfilter_retcode(void) { RUN(verifier_netfilter_retcode); }
> +void test_verifier_precision(void) { RUN(verifier_precision); }
> void test_verifier_prevent_map_lookup(void) { RUN(verifier_prevent_map_lookup); }
> void test_verifier_raw_stack(void) { RUN(verifier_raw_stack); }
> void test_verifier_raw_tp_writable(void) { RUN(verifier_raw_tp_writable); }
> diff --git a/tools/testing/selftests/bpf/progs/verifier_precision.c b/tools/testing/selftests/bpf/progs/verifier_precision.c
> new file mode 100644
> index 000000000000..9236994387bf
> --- /dev/null
> +++ b/tools/testing/selftests/bpf/progs/verifier_precision.c
> @@ -0,0 +1,29 @@
> +// SPDX-License-Identifier: GPL-2.0
> +/* Copyright (C) 2023 SUSE LLC */
> +
> +#include <linux/bpf.h>
> +#include <bpf/bpf_helpers.h>
> +#include "bpf_misc.h"
> +
> +int vals[] SEC(".data.vals") = {1, 2, 3, 4};
> +
> +SEC("?raw_tp")
> +__success __log_level(2)
> +__msg("mark_precise: frame0: regs=r2 stack= before 5: (bf) r1 = r6")
> +__msg("mark_precise: frame0: regs=r2 stack= before 4: (57) r2 &= 3")
> +__msg("mark_precise: frame0: regs=r2 stack= before 3: (dc) r2 = be16 r2")
> +__msg("mark_precise: frame0: regs=r2 stack= before 2: (b7) r2 = 0")
> +__naked int bpf_end(void)
> +{
> + asm volatile (
> + "r2 = 0;"
> + "r2 = be16 r2;"
> + "r2 &= 0x3;"
> + "r1 = %[vals];"
> + "r1 += r2;"
> + "r0 = *(u32 *)(r1 + 0);"
> + "exit;"
> + :
> + : __imm_ptr(vals)
> + : __clobber_common);
> +}
Note: there are a simpler ways to force r2 precise, e.g. add it to r10:
SEC("?raw_tp")
__success __log_level(2)
__msg("mark_precise: frame0: regs=r2 stack= before 2: (57) r2 &= 3")
__msg("mark_precise: frame0: regs=r2 stack= before 1: (dc) r2 = be16 r2")
__msg("mark_precise: frame0: regs=r2 stack= before 0: (b7) r2 = 0")
__naked int bpf_end(void)
{
asm volatile (
"r2 = 0;"
"r2 = be16 r2;"
"r2 &= 0x3;"
"r1 = r10;"
"r1 += r2;"
"r0 = 0;"
"exit;"
::: __clobber_all);
}
