| Message ID | 20210125124516.3098129-6-liuhangbin@gmail.com (mailing list archive) |
|---|---|
| State | Superseded |
| Delegated to: | BPF |
| Headers | show |
| Series | xdp: add a new helper for dev map multicast support | expand |
| Context | Check | Description |
|---|---|---|
| netdev/cover_letter | success | Link |
| netdev/fixes_present | success | Link |
| netdev/patch_count | success | Link |
| netdev/tree_selection | success | Clearly marked for bpf-next |
| netdev/subject_prefix | success | Link |
| netdev/cc_maintainers | warning | 10 maintainers not CCed: shuah@kernel.org luke.r.nels@gmail.com yhs@fb.com songliubraving@fb.com linux-kselftest@vger.kernel.org andrii@kernel.org bjorn@kernel.org kpsingh@kernel.org kafai@fb.com rdna@fb.com |
| netdev/source_inline | success | Was 0 now: 0 |
| netdev/verify_signedoff | success | Link |
| netdev/module_param | success | Was 0 now: 0 |
| netdev/build_32bit | success | Errors and warnings before: 0 this patch: 0 |
| netdev/kdoc | success | Errors and warnings before: 0 this patch: 0 |
| netdev/verify_fixes | success | Link |
| netdev/checkpatch | success | total: 0 errors, 0 warnings, 0 checks, 119 lines checked |
| netdev/build_allmodconfig_warn | success | Errors and warnings before: 0 this patch: 0 |
| netdev/header_inline | success | Link |
| netdev/stable | success | Stable not CCed |
Hangbin Liu wrote: > Use helper bpf_redirect_map() and bpf_redirect_map_multi() to test bpf > arg ARG_CONST_MAP_PTR and ARG_CONST_MAP_PTR_OR_NULL. Make sure the > map arg could be verified correctly when it is NULL or valid map > pointer. > > Add devmap and devmap_hash in struct bpf_test due to bpf_redirect_{map, > map_multi} limit. > > Test result: > ]# ./test_verifier 713 716 > #713/p ARG_CONST_MAP_PTR: null pointer OK > #714/p ARG_CONST_MAP_PTR: valid map pointer OK > #715/p ARG_CONST_MAP_PTR_OR_NULL: null pointer for ex_map OK > #716/p ARG_CONST_MAP_PTR_OR_NULL: valid map pointer for ex_map OK > Summary: 4 PASSED, 0 SKIPPED, 0 FAILED > > Acked-by: Toke Høiland-Jørgensen <toke@redhat.com> > Signed-off-by: Hangbin Liu <liuhangbin@gmail.com> > --- > tools/testing/selftests/bpf/test_verifier.c | 22 +++++- > .../testing/selftests/bpf/verifier/map_ptr.c | 70 +++++++++++++++++++ > 2 files changed, 91 insertions(+), 1 deletion(-) > [...] > +{ > + "ARG_CONST_MAP_PTR_OR_NULL: null pointer for ex_map", > + .insns = { > + BPF_MOV64_IMM(BPF_REG_1, 0), > + /* bpf_redirect_map_multi arg1 (in_map) */ > + BPF_LD_MAP_FD(BPF_REG_1, 0), > + /* bpf_redirect_map_multi arg2 (ex_map) */ > + BPF_MOV64_IMM(BPF_REG_2, 0), > + /* bpf_redirect_map_multi arg3 (flags) */ > + BPF_MOV64_IMM(BPF_REG_3, 0), > + BPF_EMIT_CALL(BPF_FUNC_redirect_map_multi), > + BPF_EXIT_INSN(), > + }, > + .fixup_map_devmap = { 1 }, > + .result = ACCEPT, > + .prog_type = BPF_PROG_TYPE_XDP, > + .retval = 4, Do we need one more case where this is map_or_null? In above ex_map will be scalar tnum_const=0 and be exactly a null. This will push verifier here, meta->map_ptr = register_is_null(reg) ? NULL : reg->map_ptr; In the below case it is known to be not null. Is it also interesting to have a case where register_is_null(reg) check fails and reg->map_ptr is set, but may be null. > +}, > +{ > + "ARG_CONST_MAP_PTR_OR_NULL: valid map pointer for ex_map", > + .insns = { > + BPF_MOV64_IMM(BPF_REG_1, 0), > + /* bpf_redirect_map_multi arg1 (in_map) */ > + BPF_LD_MAP_FD(BPF_REG_1, 0), > + /* bpf_redirect_map_multi arg2 (ex_map) */ > + BPF_LD_MAP_FD(BPF_REG_2, 1), > + /* bpf_redirect_map_multi arg3 (flags) */ > + BPF_MOV64_IMM(BPF_REG_3, 0), > + BPF_EMIT_CALL(BPF_FUNC_redirect_map_multi), > + BPF_EXIT_INSN(), > + }, > + .fixup_map_devmap = { 1 }, > + .fixup_map_devmap_hash = { 3 }, > + .result = ACCEPT, > + .prog_type = BPF_PROG_TYPE_XDP, > + .retval = 4, > +}, > -- > 2.26.2 >
On Wed, Jan 27, 2021 at 02:24:47PM -0800, John Fastabend wrote: > [...] > > > +{ > > + "ARG_CONST_MAP_PTR_OR_NULL: null pointer for ex_map", > > + .insns = { > > + BPF_MOV64_IMM(BPF_REG_1, 0), > > + /* bpf_redirect_map_multi arg1 (in_map) */ > > + BPF_LD_MAP_FD(BPF_REG_1, 0), > > + /* bpf_redirect_map_multi arg2 (ex_map) */ > > + BPF_MOV64_IMM(BPF_REG_2, 0), > > + /* bpf_redirect_map_multi arg3 (flags) */ > > + BPF_MOV64_IMM(BPF_REG_3, 0), > > + BPF_EMIT_CALL(BPF_FUNC_redirect_map_multi), > > + BPF_EXIT_INSN(), > > + }, > > + .fixup_map_devmap = { 1 }, > > + .result = ACCEPT, > > + .prog_type = BPF_PROG_TYPE_XDP, > > + .retval = 4, > > Do we need one more case where this is map_or_null? In above > ex_map will be scalar tnum_const=0 and be exactly a null. This > will push verifier here, > > meta->map_ptr = register_is_null(reg) ? NULL : reg->map_ptr; > > In the below case it is known to be not null. > > Is it also interesting to have a case where register_is_null(reg) > check fails and reg->map_ptr is set, but may be null. Hi John, I'm not familiar with the test_verifier syntax. Doesn't BPF_LD_MAP_FD(BPF_REG_1, 0) just assign the register with map NULL? Thanks hangbin
Hangbin Liu wrote: > On Wed, Jan 27, 2021 at 02:24:47PM -0800, John Fastabend wrote: > > [...] > > > > > +{ > > > + "ARG_CONST_MAP_PTR_OR_NULL: null pointer for ex_map", > > > + .insns = { > > > + BPF_MOV64_IMM(BPF_REG_1, 0), > > > + /* bpf_redirect_map_multi arg1 (in_map) */ > > > + BPF_LD_MAP_FD(BPF_REG_1, 0), > > > + /* bpf_redirect_map_multi arg2 (ex_map) */ > > > + BPF_MOV64_IMM(BPF_REG_2, 0), > > > + /* bpf_redirect_map_multi arg3 (flags) */ > > > + BPF_MOV64_IMM(BPF_REG_3, 0), > > > + BPF_EMIT_CALL(BPF_FUNC_redirect_map_multi), > > > + BPF_EXIT_INSN(), > > > + }, > > > + .fixup_map_devmap = { 1 }, > > > + .result = ACCEPT, > > > + .prog_type = BPF_PROG_TYPE_XDP, > > > + .retval = 4, > > > > Do we need one more case where this is map_or_null? In above > > ex_map will be scalar tnum_const=0 and be exactly a null. This > > will push verifier here, > > > > meta->map_ptr = register_is_null(reg) ? NULL : reg->map_ptr; > > > > In the below case it is known to be not null. > > > > Is it also interesting to have a case where register_is_null(reg) > > check fails and reg->map_ptr is set, but may be null. > > Hi John, > > I'm not familiar with the test_verifier syntax. Doesn't > BPF_LD_MAP_FD(BPF_REG_1, 0) just assign the register with map NULL? On second thought because we are only running the verifier here and not actually calling the helper I guess both paths are in fact covered here. Acked-by: John Fastabend <john.fastabend@gmail.com>
diff --git a/tools/testing/selftests/bpf/test_verifier.c b/tools/testing/selftests/bpf/test_verifier.c index 59bfa6201d1d..c0e10a6f1911 100644 --- a/tools/testing/selftests/bpf/test_verifier.c +++ b/tools/testing/selftests/bpf/test_verifier.c @@ -50,7 +50,7 @@ #define MAX_INSNS BPF_MAXINSNS #define MAX_TEST_INSNS 1000000 #define MAX_FIXUPS 8 -#define MAX_NR_MAPS 21 +#define MAX_NR_MAPS 23 #define MAX_TEST_RUNS 8 #define POINTER_VALUE 0xcafe4all #define TEST_DATA_LEN 64 @@ -88,6 +88,8 @@ struct bpf_test { int fixup_map_event_output[MAX_FIXUPS]; int fixup_map_reuseport_array[MAX_FIXUPS]; int fixup_map_ringbuf[MAX_FIXUPS]; + int fixup_map_devmap[MAX_FIXUPS]; + int fixup_map_devmap_hash[MAX_FIXUPS]; const char *errstr; const char *errstr_unpriv; uint32_t insn_processed; @@ -714,6 +716,8 @@ static void do_test_fixup(struct bpf_test *test, enum bpf_prog_type prog_type, int *fixup_map_event_output = test->fixup_map_event_output; int *fixup_map_reuseport_array = test->fixup_map_reuseport_array; int *fixup_map_ringbuf = test->fixup_map_ringbuf; + int *fixup_map_devmap = test->fixup_map_devmap; + int *fixup_map_devmap_hash = test->fixup_map_devmap_hash; if (test->fill_helper) { test->fill_insns = calloc(MAX_TEST_INSNS, sizeof(struct bpf_insn)); @@ -899,6 +903,22 @@ static void do_test_fixup(struct bpf_test *test, enum bpf_prog_type prog_type, fixup_map_ringbuf++; } while (*fixup_map_ringbuf); } + if (*fixup_map_devmap) { + map_fds[20] = __create_map(BPF_MAP_TYPE_DEVMAP, + sizeof(u32), sizeof(u32), 1, 0); + do { + prog[*fixup_map_devmap].imm = map_fds[20]; + fixup_map_devmap++; + } while (*fixup_map_devmap); + } + if (*fixup_map_devmap_hash) { + map_fds[21] = __create_map(BPF_MAP_TYPE_DEVMAP_HASH, + sizeof(u32), sizeof(u32), 1, 0); + do { + prog[*fixup_map_devmap_hash].imm = map_fds[21]; + fixup_map_devmap_hash++; + } while (*fixup_map_devmap_hash); + } } struct libcap { diff --git a/tools/testing/selftests/bpf/verifier/map_ptr.c b/tools/testing/selftests/bpf/verifier/map_ptr.c index b117bdd3806d..1a532198c9c1 100644 --- a/tools/testing/selftests/bpf/verifier/map_ptr.c +++ b/tools/testing/selftests/bpf/verifier/map_ptr.c @@ -93,3 +93,73 @@ .fixup_map_hash_16b = { 4 }, .result = ACCEPT, }, +{ + "ARG_CONST_MAP_PTR: null pointer", + .insns = { + /* bpf_redirect_map arg1 (map) */ + BPF_MOV64_IMM(BPF_REG_1, 0), + /* bpf_redirect_map arg2 (ifindex) */ + BPF_MOV64_IMM(BPF_REG_2, 0), + /* bpf_redirect_map arg3 (flags) */ + BPF_MOV64_IMM(BPF_REG_3, 0), + BPF_EMIT_CALL(BPF_FUNC_redirect_map), + BPF_EXIT_INSN(), + }, + .result = REJECT, + .prog_type = BPF_PROG_TYPE_XDP, + .errstr = "R1 type=inv expected=map_ptr", +}, +{ + "ARG_CONST_MAP_PTR: valid map pointer", + .insns = { + BPF_MOV64_IMM(BPF_REG_1, 0), + /* bpf_redirect_map arg1 (map) */ + BPF_LD_MAP_FD(BPF_REG_1, 0), + /* bpf_redirect_map arg2 (ifindex) */ + BPF_MOV64_IMM(BPF_REG_2, 0), + /* bpf_redirect_map arg3 (flags) */ + BPF_MOV64_IMM(BPF_REG_3, 0), + BPF_EMIT_CALL(BPF_FUNC_redirect_map), + BPF_EXIT_INSN(), + }, + .fixup_map_devmap = { 1 }, + .result = ACCEPT, + .prog_type = BPF_PROG_TYPE_XDP, +}, +{ + "ARG_CONST_MAP_PTR_OR_NULL: null pointer for ex_map", + .insns = { + BPF_MOV64_IMM(BPF_REG_1, 0), + /* bpf_redirect_map_multi arg1 (in_map) */ + BPF_LD_MAP_FD(BPF_REG_1, 0), + /* bpf_redirect_map_multi arg2 (ex_map) */ + BPF_MOV64_IMM(BPF_REG_2, 0), + /* bpf_redirect_map_multi arg3 (flags) */ + BPF_MOV64_IMM(BPF_REG_3, 0), + BPF_EMIT_CALL(BPF_FUNC_redirect_map_multi), + BPF_EXIT_INSN(), + }, + .fixup_map_devmap = { 1 }, + .result = ACCEPT, + .prog_type = BPF_PROG_TYPE_XDP, + .retval = 4, +}, +{ + "ARG_CONST_MAP_PTR_OR_NULL: valid map pointer for ex_map", + .insns = { + BPF_MOV64_IMM(BPF_REG_1, 0), + /* bpf_redirect_map_multi arg1 (in_map) */ + BPF_LD_MAP_FD(BPF_REG_1, 0), + /* bpf_redirect_map_multi arg2 (ex_map) */ + BPF_LD_MAP_FD(BPF_REG_2, 1), + /* bpf_redirect_map_multi arg3 (flags) */ + BPF_MOV64_IMM(BPF_REG_3, 0), + BPF_EMIT_CALL(BPF_FUNC_redirect_map_multi), + BPF_EXIT_INSN(), + }, + .fixup_map_devmap = { 1 }, + .fixup_map_devmap_hash = { 3 }, + .result = ACCEPT, + .prog_type = BPF_PROG_TYPE_XDP, + .retval = 4, +},
Use helper bpf_redirect_map() and bpf_redirect_map_multi() to test bpf arg ARG_CONST_MAP_PTR and ARG_CONST_MAP_PTR_OR_NULL. Make sure the map arg could be verified correctly when it is NULL or valid map pointer. Add devmap and devmap_hash in struct bpf_test due to bpf_redirect_{map, map_multi} limit. Test result: ]# ./test_verifier 713 716 #713/p ARG_CONST_MAP_PTR: null pointer OK #714/p ARG_CONST_MAP_PTR: valid map pointer OK #715/p ARG_CONST_MAP_PTR_OR_NULL: null pointer for ex_map OK #716/p ARG_CONST_MAP_PTR_OR_NULL: valid map pointer for ex_map OK Summary: 4 PASSED, 0 SKIPPED, 0 FAILED Acked-by: Toke Høiland-Jørgensen <toke@redhat.com> Signed-off-by: Hangbin Liu <liuhangbin@gmail.com> --- tools/testing/selftests/bpf/test_verifier.c | 22 +++++- .../testing/selftests/bpf/verifier/map_ptr.c | 70 +++++++++++++++++++ 2 files changed, 91 insertions(+), 1 deletion(-)