diff mbox series

[RFC,bpf,2/2] selftests/bpf: precision tracking test for BPF_ALU | BPF_TO_BE | BPF_END

Message ID 20231030132145.20867-3-shung-hsi.yu@suse.com (mailing list archive)
State Superseded
Delegated to: BPF
Headers show
Series bpf: Fix precision tracking for BPF_ALU | BPF_TO_BE | BPF_END | expand

Checks

Context Check Description
bpf/vmtest-bpf-PR success PR summary
bpf/vmtest-bpf-VM_Test-0 success Logs for Lint
bpf/vmtest-bpf-VM_Test-1 success Logs for ShellCheck
bpf/vmtest-bpf-VM_Test-3 success Logs for aarch64-gcc / build / build for aarch64 with gcc
bpf/vmtest-bpf-VM_Test-2 success Logs for Validate matrix.py
bpf/vmtest-bpf-VM_Test-8 success Logs for aarch64-gcc / veristat
bpf/vmtest-bpf-VM_Test-7 success Logs for aarch64-gcc / test (test_verifier, false, 360) / test_verifier on aarch64 with gcc
bpf/vmtest-bpf-VM_Test-10 success Logs for set-matrix
bpf/vmtest-bpf-VM_Test-4 success Logs for aarch64-gcc / test (test_maps, false, 360) / test_maps on aarch64 with gcc
bpf/vmtest-bpf-VM_Test-5 success Logs for aarch64-gcc / test (test_progs, false, 360) / test_progs on aarch64 with gcc
bpf/vmtest-bpf-VM_Test-6 success Logs for aarch64-gcc / test (test_progs_no_alu32, false, 360) / test_progs_no_alu32 on aarch64 with gcc
bpf/vmtest-bpf-VM_Test-9 success Logs for s390x-gcc / build / build for s390x with gcc
bpf/vmtest-bpf-VM_Test-13 success Logs for s390x-gcc / test (test_verifier, false, 360) / test_verifier on s390x with gcc
bpf/vmtest-bpf-VM_Test-21 success Logs for x86_64-gcc / test (test_progs_parallel, true, 30) / test_progs_parallel on x86_64 with gcc
bpf/vmtest-bpf-VM_Test-14 success Logs for s390x-gcc / veristat
bpf/vmtest-bpf-VM_Test-16 success Logs for x86_64-gcc / build / build for x86_64 with gcc
bpf/vmtest-bpf-VM_Test-18 success Logs for x86_64-gcc / test (test_progs, false, 360) / test_progs on x86_64 with gcc
bpf/vmtest-bpf-VM_Test-24 success Logs for x86_64-llvm-16 / build / build for x86_64 with llvm-16
bpf/vmtest-bpf-VM_Test-26 success Logs for x86_64-llvm-16 / test (test_progs, false, 360) / test_progs on x86_64 with llvm-16
bpf/vmtest-bpf-VM_Test-25 success Logs for x86_64-llvm-16 / test (test_maps, false, 360) / test_maps on x86_64 with llvm-16
bpf/vmtest-bpf-VM_Test-28 success Logs for x86_64-llvm-16 / test (test_verifier, false, 360) / test_verifier on x86_64 with llvm-16
bpf/vmtest-bpf-VM_Test-15 success Logs for set-matrix
bpf/vmtest-bpf-VM_Test-17 success Logs for x86_64-gcc / test (test_maps, false, 360) / test_maps on x86_64 with gcc
bpf/vmtest-bpf-VM_Test-27 success Logs for x86_64-llvm-16 / test (test_progs_no_alu32, false, 360) / test_progs_no_alu32 on x86_64 with llvm-16
bpf/vmtest-bpf-VM_Test-23 success Logs for x86_64-gcc / veristat / veristat on x86_64 with gcc
bpf/vmtest-bpf-VM_Test-19 success Logs for x86_64-gcc / test (test_progs_no_alu32, false, 360) / test_progs_no_alu32 on x86_64 with gcc
bpf/vmtest-bpf-VM_Test-20 success Logs for x86_64-gcc / test (test_progs_no_alu32_parallel, true, 30) / test_progs_no_alu32_parallel on x86_64 with gcc
bpf/vmtest-bpf-VM_Test-22 success Logs for x86_64-gcc / test (test_verifier, false, 360) / test_verifier on x86_64 with gcc
bpf/vmtest-bpf-VM_Test-29 success Logs for x86_64-llvm-16 / veristat
netdev/series_format success Posting correctly formatted
netdev/tree_selection success Clearly marked for bpf, async
netdev/fixes_present success Fixes tag present in non-next series
netdev/header_inline success No static functions without inline keyword in header files
netdev/build_32bit success Errors and warnings before: 9 this patch: 9
netdev/cc_maintainers warning 1 maintainers not CCed: linux-kselftest@vger.kernel.org
netdev/build_clang success Errors and warnings before: 9 this patch: 9
netdev/verify_signedoff success Signed-off-by tag matches author and committer
netdev/deprecated_api success None detected
netdev/check_selftest success No net selftest shell script
netdev/verify_fixes success No Fixes tag
netdev/build_allmodconfig_warn success Errors and warnings before: 9 this patch: 9
netdev/checkpatch warning CHECK: Lines should not end with a '(' WARNING: added, moved or deleted file(s), does MAINTAINERS need updating?
netdev/build_clang_rust success No Rust files in patch. Skipping build
netdev/kdoc success Errors and warnings before: 0 this patch: 0
netdev/source_inline success Was 0 now: 0
bpf/vmtest-bpf-VM_Test-12 success Logs for s390x-gcc / test (test_progs_no_alu32, false, 360) / test_progs_no_alu32 on s390x with gcc
bpf/vmtest-bpf-VM_Test-11 success Logs for s390x-gcc / test (test_progs, false, 360) / test_progs on s390x with gcc

Commit Message

Shung-Hsi Yu Oct. 30, 2023, 1:21 p.m. UTC 
Add a test written with inline assembly to check that the verifier does
not incorrecly use the src_reg field of a BPF_ALU | BPF_TO_BE | BPF_END
instruction.

Signed-off-by: Shung-Hsi Yu <shung-hsi.yu@suse.com>
---

This is the first time I'm writing a selftest so there's a lot of
question I can't answer myself. Looking for suggestions regarding:

1. Whether BPF_NEG and other BPF_END cases should be tested as well
2. While the suggested way of writing BPF assembly is with inline
   assembly[0], as done here, maybe it is better to have this test case
   added in verifier/precise.c and written using macro instead?
   The rational is that ideally we want the selftest to be backport to
   the v5.3+ stable kernels alongside the fix, but __msg macro used here
   is only available since v6.2.

0: https://lore.kernel.org/bpf/CAADnVQJHAPid9HouwMEnfwDDKuy8BnGia269KSbby2gA030OBg@mail.gmail.com/

 .../selftests/bpf/prog_tests/verifier.c       |  2 ++
 .../selftests/bpf/progs/verifier_precision.c  | 29 +++++++++++++++++++
 2 files changed, 31 insertions(+)
 create mode 100644 tools/testing/selftests/bpf/progs/verifier_precision.c

Comments

Eduard Zingerman Oct. 30, 2023, 2:36 p.m. UTC | #1 
On Mon, 2023-10-30 at 21:21 +0800, Shung-Hsi Yu wrote:
> Add a test written with inline assembly to check that the verifier does
> not incorrecly use the src_reg field of a BPF_ALU | BPF_TO_BE | BPF_END
> instruction.
> 
> Signed-off-by: Shung-Hsi Yu <shung-hsi.yu@suse.com>
> ---
> 
> This is the first time I'm writing a selftest so there's a lot of
> question I can't answer myself. Looking for suggestions regarding:
> 
> 1. Whether BPF_NEG and other BPF_END cases should be tested as well

It is probably good to test BPF_NEG, unfortunately verifier does not
track range information for BPF_NEG, so I ended up with the following
contraption:

SEC("?raw_tp")
__success __log_level(2)
__msg("mark_precise: frame0: regs=r2 stack= before 3: (bf) r1 = r10")
__msg("mark_precise: frame0: regs=r2 stack= before 2: (55) if r2 != 0xfffffff8 goto pc+2")
__msg("mark_precise: frame0: regs=r2 stack= before 1: (87) r2 = -r2")
__msg("mark_precise: frame0: regs=r2 stack= before 0: (b7) r2 = 8")
__naked int bpf_neg(void)
{
	asm volatile (
		"r2 = 8;"
		"r2 = -r2;"
		"if r2 != -8 goto 1f;"
		"r1 = r10;"
		"r1 += r2;"
	"1:"
		"r0 = 0;"
		"exit;"
		::: __clobber_all);
}

Also, maybe it's good to test bswap version of BPF_END (CPU v4
instruction) for completeness, e.g. as follows:

#if (defined(__TARGET_ARCH_arm64) || defined(__TARGET_ARCH_x86) || \
	(defined(__TARGET_ARCH_riscv) && __riscv_xlen == 64) || \
        defined(__TARGET_ARCH_arm) || defined(__TARGET_ARCH_s390)) && \
	__clang_major__ >= 18

...
		"r2 = bswap16 r2;"
...

#endif


> 2. While the suggested way of writing BPF assembly is with inline
>    assembly[0], as done here, maybe it is better to have this test case
>    added in verifier/precise.c and written using macro instead?
>    The rational is that ideally we want the selftest to be backport to
>    the v5.3+ stable kernels alongside the fix, but __msg macro used here
>    is only available since v6.2.

As far as I understand we want to have new tests written in assembly,
but let's wait for Alexei or Andrii to comment.

> 
> 0: https://lore.kernel.org/bpf/CAADnVQJHAPid9HouwMEnfwDDKuy8BnGia269KSbby2gA030OBg@mail.gmail.com/
> 
>  .../selftests/bpf/prog_tests/verifier.c       |  2 ++
>  .../selftests/bpf/progs/verifier_precision.c  | 29 +++++++++++++++++++
>  2 files changed, 31 insertions(+)
>  create mode 100644 tools/testing/selftests/bpf/progs/verifier_precision.c
> 
> diff --git a/tools/testing/selftests/bpf/prog_tests/verifier.c b/tools/testing/selftests/bpf/prog_tests/verifier.c
> index e3e68c97b40c..e5c61aa6604a 100644
> --- a/tools/testing/selftests/bpf/prog_tests/verifier.c
> +++ b/tools/testing/selftests/bpf/prog_tests/verifier.c
> @@ -46,6 +46,7 @@
>  #include "verifier_movsx.skel.h"
>  #include "verifier_netfilter_ctx.skel.h"
>  #include "verifier_netfilter_retcode.skel.h"
> +#include "verifier_precision.skel.h"
>  #include "verifier_prevent_map_lookup.skel.h"
>  #include "verifier_raw_stack.skel.h"
>  #include "verifier_raw_tp_writable.skel.h"
> @@ -153,6 +154,7 @@ void test_verifier_meta_access(void)          { RUN(verifier_meta_access); }
>  void test_verifier_movsx(void)                 { RUN(verifier_movsx); }
>  void test_verifier_netfilter_ctx(void)        { RUN(verifier_netfilter_ctx); }
>  void test_verifier_netfilter_retcode(void)    { RUN(verifier_netfilter_retcode); }
> +void test_verifier_precision(void)            { RUN(verifier_precision); }
>  void test_verifier_prevent_map_lookup(void)   { RUN(verifier_prevent_map_lookup); }
>  void test_verifier_raw_stack(void)            { RUN(verifier_raw_stack); }
>  void test_verifier_raw_tp_writable(void)      { RUN(verifier_raw_tp_writable); }
> diff --git a/tools/testing/selftests/bpf/progs/verifier_precision.c b/tools/testing/selftests/bpf/progs/verifier_precision.c
> new file mode 100644
> index 000000000000..9236994387bf
> --- /dev/null
> +++ b/tools/testing/selftests/bpf/progs/verifier_precision.c
> @@ -0,0 +1,29 @@
> +// SPDX-License-Identifier: GPL-2.0
> +/* Copyright (C) 2023 SUSE LLC */
> +
> +#include <linux/bpf.h>
> +#include <bpf/bpf_helpers.h>
> +#include "bpf_misc.h"
> +
> +int vals[] SEC(".data.vals") = {1, 2, 3, 4};
> +
> +SEC("?raw_tp")
> +__success __log_level(2)
> +__msg("mark_precise: frame0: regs=r2 stack= before 5: (bf) r1 = r6")
> +__msg("mark_precise: frame0: regs=r2 stack= before 4: (57) r2 &= 3")
> +__msg("mark_precise: frame0: regs=r2 stack= before 3: (dc) r2 = be16 r2")
> +__msg("mark_precise: frame0: regs=r2 stack= before 2: (b7) r2 = 0")
> +__naked int bpf_end(void)
> +{
> +	asm volatile (
> +		"r2 = 0;"
> +		"r2 = be16 r2;"
> +		"r2 &= 0x3;"
> +		"r1 = %[vals];"
> +		"r1 += r2;"
> +		"r0 = *(u32 *)(r1 + 0);"
> +		"exit;"
> +		:
> +		: __imm_ptr(vals)
> +		: __clobber_common);
> +}

Note: there are a simpler ways to force r2 precise, e.g. add it to r10:

SEC("?raw_tp")
__success __log_level(2)
__msg("mark_precise: frame0: regs=r2 stack= before 2: (57) r2 &= 3")
__msg("mark_precise: frame0: regs=r2 stack= before 1: (dc) r2 = be16 r2")
__msg("mark_precise: frame0: regs=r2 stack= before 0: (b7) r2 = 0")
__naked int bpf_end(void)
{
	asm volatile (
		"r2 = 0;"
		"r2 = be16 r2;"
		"r2 &= 0x3;"
		"r1 = r10;"
		"r1 += r2;"
		"r0 = 0;"
		"exit;"
		::: __clobber_all);
}
Alexei Starovoitov Oct. 30, 2023, 5:17 p.m. UTC | #2 
On Mon, Oct 30, 2023 at 7:36 AM Eduard Zingerman <eddyz87@gmail.com> wrote:
>
> On Mon, 2023-10-30 at 21:21 +0800, Shung-Hsi Yu wrote:
> > Add a test written with inline assembly to check that the verifier does
> > not incorrecly use the src_reg field of a BPF_ALU | BPF_TO_BE | BPF_END
> > instruction.
> >
> > Signed-off-by: Shung-Hsi Yu <shung-hsi.yu@suse.com>
> > ---
> >
> > This is the first time I'm writing a selftest so there's a lot of
> > question I can't answer myself. Looking for suggestions regarding:
> >
> > 1. Whether BPF_NEG and other BPF_END cases should be tested as well
>
> It is probably good to test BPF_NEG, unfortunately verifier does not
> track range information for BPF_NEG, so I ended up with the following
> contraption:

Makes sense to me.

> SEC("?raw_tp")
> __success __log_level(2)
> __msg("mark_precise: frame0: regs=r2 stack= before 3: (bf) r1 = r10")
> __msg("mark_precise: frame0: regs=r2 stack= before 2: (55) if r2 != 0xfffffff8 goto pc+2")
> __msg("mark_precise: frame0: regs=r2 stack= before 1: (87) r2 = -r2")
> __msg("mark_precise: frame0: regs=r2 stack= before 0: (b7) r2 = 8")
> __naked int bpf_neg(void)
> {
>         asm volatile (
>                 "r2 = 8;"
>                 "r2 = -r2;"
>                 "if r2 != -8 goto 1f;"
>                 "r1 = r10;"
>                 "r1 += r2;"
>         "1:"
>                 "r0 = 0;"
>                 "exit;"
>                 ::: __clobber_all);
> }
>
> Also, maybe it's good to test bswap version of BPF_END (CPU v4
> instruction) for completeness, e.g. as follows:
>
> #if (defined(__TARGET_ARCH_arm64) || defined(__TARGET_ARCH_x86) || \
>         (defined(__TARGET_ARCH_riscv) && __riscv_xlen == 64) || \
>         defined(__TARGET_ARCH_arm) || defined(__TARGET_ARCH_s390)) && \
>         __clang_major__ >= 18
>
> ...
>                 "r2 = bswap16 r2;"

+1. Let's have a test for this one as well.

> ...
>
> #endif
>
>
> > 2. While the suggested way of writing BPF assembly is with inline
> >    assembly[0], as done here, maybe it is better to have this test case
> >    added in verifier/precise.c and written using macro instead?
> >    The rational is that ideally we want the selftest to be backport to
> >    the v5.3+ stable kernels alongside the fix, but __msg macro used here
> >    is only available since v6.2.
>
> As far as I understand we want to have new tests written in assembly,
> but let's wait for Alexei or Andrii to comment.

Backports is not a reason to use macros.
Please continue with inline asm.
Shung-Hsi Yu Oct. 31, 2023, 5:22 a.m. UTC | #3 
On Mon, Oct 30, 2023 at 10:17:10AM -0700, Alexei Starovoitov wrote:
> On Mon, Oct 30, 2023 at 7:36 AM Eduard Zingerman <eddyz87@gmail.com> wrote:
> > On Mon, 2023-10-30 at 21:21 +0800, Shung-Hsi Yu wrote:
> > > Add a test written with inline assembly to check that the verifier does
> > > not incorrecly use the src_reg field of a BPF_ALU | BPF_TO_BE | BPF_END
> > > instruction.
> > >
> > > Signed-off-by: Shung-Hsi Yu <shung-hsi.yu@suse.com>
> > > ---
> > >
> > > This is the first time I'm writing a selftest so there's a lot of
> > > question I can't answer myself. Looking for suggestions regarding:
> > >
> > > 1. Whether BPF_NEG and other BPF_END cases should be tested as well
> >
> > It is probably good to test BPF_NEG, unfortunately verifier does not
> > track range information for BPF_NEG, so I ended up with the following
> > contraption:
> 
> Makes sense to me.
> 
> > SEC("?raw_tp")
> > __success __log_level(2)
> > __msg("mark_precise: frame0: regs=r2 stack= before 3: (bf) r1 = r10")
> > __msg("mark_precise: frame0: regs=r2 stack= before 2: (55) if r2 != 0xfffffff8 goto pc+2")
> > __msg("mark_precise: frame0: regs=r2 stack= before 1: (87) r2 = -r2")
> > __msg("mark_precise: frame0: regs=r2 stack= before 0: (b7) r2 = 8")
> > __naked int bpf_neg(void)
> > {
> >         asm volatile (
> >                 "r2 = 8;"
> >                 "r2 = -r2;"
> >                 "if r2 != -8 goto 1f;"
> >                 "r1 = r10;"
> >                 "r1 += r2;"
> >         "1:"
> >                 "r0 = 0;"
> >                 "exit;"
> >                 ::: __clobber_all);
> > }
> >
> > Also, maybe it's good to test bswap version of BPF_END (CPU v4
> > instruction) for completeness, e.g. as follows:
> >
> > #if (defined(__TARGET_ARCH_arm64) || defined(__TARGET_ARCH_x86) || \
> >         (defined(__TARGET_ARCH_riscv) && __riscv_xlen == 64) || \
> >         defined(__TARGET_ARCH_arm) || defined(__TARGET_ARCH_s390)) && \
> >         __clang_major__ >= 18
> >
> > ...
> >                 "r2 = bswap16 r2;"
> 
> +1. Let's have a test for this one as well.
> 
> > ...
> >
> > #endif
> >
> > > 2. While the suggested way of writing BPF assembly is with inline
> > >    assembly[0], as done here, maybe it is better to have this test case
> > >    added in verifier/precise.c and written using macro instead?
> > >    The rational is that ideally we want the selftest to be backport to
> > >    the v5.3+ stable kernels alongside the fix, but __msg macro used here
> > >    is only available since v6.2.
> >
> > As far as I understand we want to have new tests written in assembly,
> > but let's wait for Alexei or Andrii to comment.
> 
> Backports is not a reason to use macros.
> Please continue with inline asm.

Got it, will add tests for negation and bswap with inline assembly.

Thanks you both for feedbacks and suggestions!
diff mbox series

Patch

diff --git a/tools/testing/selftests/bpf/prog_tests/verifier.c b/tools/testing/selftests/bpf/prog_tests/verifier.c
index e3e68c97b40c..e5c61aa6604a 100644
--- a/tools/testing/selftests/bpf/prog_tests/verifier.c
+++ b/tools/testing/selftests/bpf/prog_tests/verifier.c
@@ -46,6 +46,7 @@ 
 #include "verifier_movsx.skel.h"
 #include "verifier_netfilter_ctx.skel.h"
 #include "verifier_netfilter_retcode.skel.h"
+#include "verifier_precision.skel.h"
 #include "verifier_prevent_map_lookup.skel.h"
 #include "verifier_raw_stack.skel.h"
 #include "verifier_raw_tp_writable.skel.h"
@@ -153,6 +154,7 @@  void test_verifier_meta_access(void)          { RUN(verifier_meta_access); }
 void test_verifier_movsx(void)                 { RUN(verifier_movsx); }
 void test_verifier_netfilter_ctx(void)        { RUN(verifier_netfilter_ctx); }
 void test_verifier_netfilter_retcode(void)    { RUN(verifier_netfilter_retcode); }
+void test_verifier_precision(void)            { RUN(verifier_precision); }
 void test_verifier_prevent_map_lookup(void)   { RUN(verifier_prevent_map_lookup); }
 void test_verifier_raw_stack(void)            { RUN(verifier_raw_stack); }
 void test_verifier_raw_tp_writable(void)      { RUN(verifier_raw_tp_writable); }
diff --git a/tools/testing/selftests/bpf/progs/verifier_precision.c b/tools/testing/selftests/bpf/progs/verifier_precision.c
new file mode 100644
index 000000000000..9236994387bf
--- /dev/null
+++ b/tools/testing/selftests/bpf/progs/verifier_precision.c
@@ -0,0 +1,29 @@ 
+// SPDX-License-Identifier: GPL-2.0
+/* Copyright (C) 2023 SUSE LLC */
+
+#include <linux/bpf.h>
+#include <bpf/bpf_helpers.h>
+#include "bpf_misc.h"
+
+int vals[] SEC(".data.vals") = {1, 2, 3, 4};
+
+SEC("?raw_tp")
+__success __log_level(2)
+__msg("mark_precise: frame0: regs=r2 stack= before 5: (bf) r1 = r6")
+__msg("mark_precise: frame0: regs=r2 stack= before 4: (57) r2 &= 3")
+__msg("mark_precise: frame0: regs=r2 stack= before 3: (dc) r2 = be16 r2")
+__msg("mark_precise: frame0: regs=r2 stack= before 2: (b7) r2 = 0")
+__naked int bpf_end(void)
+{
+	asm volatile (
+		"r2 = 0;"
+		"r2 = be16 r2;"
+		"r2 &= 0x3;"
+		"r1 = %[vals];"
+		"r1 += r2;"
+		"r0 = *(u32 *)(r1 + 0);"
+		"exit;"
+		:
+		: __imm_ptr(vals)
+		: __clobber_common);
+}