Message ID | 20220119131209.36092-4-Kenta.Tada@sony.com (mailing list archive) |
---|---|
State | Superseded |
Delegated to: | BPF |
Headers | show |
Series | Fix the incorrect register read for syscalls on x86_64 | expand |
Context | Check | Description |
---|---|---|
bpf/vmtest-bpf-next | success | VM_Test |
bpf/vmtest-bpf-next-PR | success | PR summary |
netdev/tree_selection | success | Not a local patch, async |
On Wed, Jan 19, 2022 at 5:14 AM Kenta Tada <Kenta.Tada@sony.com> wrote: > > Add a selftest to verify the behavior of PT_REGS_xxx. > > Signed-off-by: Kenta Tada <Kenta.Tada@sony.com> > --- > .../bpf/prog_tests/test_bpf_syscall_macro.c | 49 ++++++++++++++++++ > .../selftests/bpf/progs/bpf_syscall_macro.c | 51 +++++++++++++++++++ > 2 files changed, 100 insertions(+) > create mode 100644 tools/testing/selftests/bpf/prog_tests/test_bpf_syscall_macro.c > create mode 100644 tools/testing/selftests/bpf/progs/bpf_syscall_macro.c > > diff --git a/tools/testing/selftests/bpf/prog_tests/test_bpf_syscall_macro.c b/tools/testing/selftests/bpf/prog_tests/test_bpf_syscall_macro.c > new file mode 100644 > index 000000000000..2f725393195b > --- /dev/null > +++ b/tools/testing/selftests/bpf/prog_tests/test_bpf_syscall_macro.c > @@ -0,0 +1,49 @@ > +// SPDX-License-Identifier: GPL-2.0 > +/* Copyright 2022 Sony Group Corporation */ > +#include <sys/prctl.h> > +#include <test_progs.h> > +#include "bpf_syscall_macro.skel.h" > + > +//void serial_bpf_syscall_macro(void) leftover > +void test_bpf_syscall_macro(void) > +{ > + struct bpf_syscall_macro *skel = NULL; > + int err; > + int exp_arg1 = 1001; > + unsigned long exp_arg2 = 12; > + unsigned long exp_arg3 = 13; > + unsigned long exp_arg4 = 14; > + unsigned long exp_arg5 = 15; > + > + /* check whether it can open program */ > + skel = bpf_syscall_macro__open(); > + if (!ASSERT_OK_PTR(skel, "bpf_syscall_macro__open")) > + return; > + > + skel->rodata->filter_pid = getpid(); > + > + /* check whether it can load program */ > + err = bpf_syscall_macro__load(skel); > + if (!ASSERT_OK(err, "bpf_syscall_macro__load")) > + goto cleanup; > + > + /* check whether it can attach kprobe */ > + err = bpf_syscall_macro__attach(skel); > + if (!ASSERT_OK(err, "bpf_syscall_macro__attach")) > + goto cleanup; > + > + /* check whether args of syscall are copied correctly */ > + prctl(exp_arg1, exp_arg2, exp_arg3, exp_arg4, exp_arg5); > + ASSERT_EQ(skel->bss->arg1, exp_arg1, "syscall_arg1"); > + ASSERT_EQ(skel->bss->arg2, exp_arg2, "syscall_arg2"); > + ASSERT_EQ(skel->bss->arg3, exp_arg3, "syscall_arg3"); > + /* it cannot copy arg4 when uses PT_REGS_PARM4 on x86_64 */ > +#ifdef __x86_64__ > + ASSERT_NEQ(skel->bss->arg4_cx, exp_arg4, "syscall_arg4_from_cx"); > +#endif else ASSERT_EQ(arg4_cx and exp_arg4) ? > + ASSERT_EQ(skel->bss->arg4, exp_arg4, "syscall_arg4"); > + ASSERT_EQ(skel->bss->arg5, exp_arg5, "syscall_arg5"); > + > +cleanup: > + bpf_syscall_macro__destroy(skel); > +} > diff --git a/tools/testing/selftests/bpf/progs/bpf_syscall_macro.c b/tools/testing/selftests/bpf/progs/bpf_syscall_macro.c > new file mode 100644 > index 000000000000..5a7063de27c3 > --- /dev/null > +++ b/tools/testing/selftests/bpf/progs/bpf_syscall_macro.c > @@ -0,0 +1,51 @@ > +// SPDX-License-Identifier: GPL-2.0 > +/* Copyright 2022 Sony Group Corporation */ > +#include <linux/bpf.h> > +#include <linux/ptrace.h> > +#include <sys/types.h> > +#include <unistd.h> Use #include <vmlinux.h> instead, please > + > +#include <bpf/bpf_helpers.h> > +#include <bpf/bpf_tracing.h> > +#include "bpf_misc.h" > + > +int arg1 = 0; > +unsigned long arg2 = 0; > +unsigned long arg3 = 0; > +unsigned long arg4_cx = 0; > +unsigned long arg4 = 0; > +unsigned long arg5 = 0; > + > +const volatile pid_t filter_pid = 0; > + > +SEC("kprobe/" SYS_PREFIX "sys_prctl") > +int BPF_KPROBE(handle_sys_prctl) > +{ > + struct pt_regs *real_regs; > + int orig_arg1; > + unsigned long orig_arg2, orig_arg3, orig_arg4_cx, orig_arg4, orig_arg5; > + pid_t pid = bpf_get_current_pid_tgid() >> 32; > + > + if (pid != filter_pid) > + return 0; > + > + real_regs = (struct pt_regs *)PT_REGS_PARM1(ctx); > + bpf_probe_read_kernel(&orig_arg1, sizeof(orig_arg1), &PT_REGS_PARM1_SYSCALL(real_regs)); orig_arg1 = PT_REGS_PARM1_CORE_SYSCALL(real_regs); and same for others (the whole point of _CORE_SYSCALL macros!) > + bpf_probe_read_kernel(&orig_arg2, sizeof(orig_arg2), &PT_REGS_PARM2_SYSCALL(real_regs)); > + bpf_probe_read_kernel(&orig_arg3, sizeof(orig_arg3), &PT_REGS_PARM3_SYSCALL(real_regs)); > + bpf_probe_read_kernel(&orig_arg4_cx, sizeof(orig_arg4_cx), &PT_REGS_PARM4(real_regs)); > + bpf_probe_read_kernel(&orig_arg4, sizeof(orig_arg4), &PT_REGS_PARM4_SYSCALL(real_regs)); > + bpf_probe_read_kernel(&orig_arg5, sizeof(orig_arg5), &PT_REGS_PARM5_SYSCALL(real_regs)); > + > + /* copy all actual args and the wrong arg4 on x86_64 */ > + arg1 = orig_arg1; > + arg2 = orig_arg2; > + arg3 = orig_arg3; > + arg4_cx = orig_arg4_cx; > + arg4 = orig_arg4; > + arg5 = orig_arg5; > + > + return 0; > +} > + > +char _license[] SEC("license") = "GPL"; > -- > 2.32.0 >
diff --git a/tools/testing/selftests/bpf/prog_tests/test_bpf_syscall_macro.c b/tools/testing/selftests/bpf/prog_tests/test_bpf_syscall_macro.c new file mode 100644 index 000000000000..2f725393195b --- /dev/null +++ b/tools/testing/selftests/bpf/prog_tests/test_bpf_syscall_macro.c @@ -0,0 +1,49 @@ +// SPDX-License-Identifier: GPL-2.0 +/* Copyright 2022 Sony Group Corporation */ +#include <sys/prctl.h> +#include <test_progs.h> +#include "bpf_syscall_macro.skel.h" + +//void serial_bpf_syscall_macro(void) +void test_bpf_syscall_macro(void) +{ + struct bpf_syscall_macro *skel = NULL; + int err; + int exp_arg1 = 1001; + unsigned long exp_arg2 = 12; + unsigned long exp_arg3 = 13; + unsigned long exp_arg4 = 14; + unsigned long exp_arg5 = 15; + + /* check whether it can open program */ + skel = bpf_syscall_macro__open(); + if (!ASSERT_OK_PTR(skel, "bpf_syscall_macro__open")) + return; + + skel->rodata->filter_pid = getpid(); + + /* check whether it can load program */ + err = bpf_syscall_macro__load(skel); + if (!ASSERT_OK(err, "bpf_syscall_macro__load")) + goto cleanup; + + /* check whether it can attach kprobe */ + err = bpf_syscall_macro__attach(skel); + if (!ASSERT_OK(err, "bpf_syscall_macro__attach")) + goto cleanup; + + /* check whether args of syscall are copied correctly */ + prctl(exp_arg1, exp_arg2, exp_arg3, exp_arg4, exp_arg5); + ASSERT_EQ(skel->bss->arg1, exp_arg1, "syscall_arg1"); + ASSERT_EQ(skel->bss->arg2, exp_arg2, "syscall_arg2"); + ASSERT_EQ(skel->bss->arg3, exp_arg3, "syscall_arg3"); + /* it cannot copy arg4 when uses PT_REGS_PARM4 on x86_64 */ +#ifdef __x86_64__ + ASSERT_NEQ(skel->bss->arg4_cx, exp_arg4, "syscall_arg4_from_cx"); +#endif + ASSERT_EQ(skel->bss->arg4, exp_arg4, "syscall_arg4"); + ASSERT_EQ(skel->bss->arg5, exp_arg5, "syscall_arg5"); + +cleanup: + bpf_syscall_macro__destroy(skel); +} diff --git a/tools/testing/selftests/bpf/progs/bpf_syscall_macro.c b/tools/testing/selftests/bpf/progs/bpf_syscall_macro.c new file mode 100644 index 000000000000..5a7063de27c3 --- /dev/null +++ b/tools/testing/selftests/bpf/progs/bpf_syscall_macro.c @@ -0,0 +1,51 @@ +// SPDX-License-Identifier: GPL-2.0 +/* Copyright 2022 Sony Group Corporation */ +#include <linux/bpf.h> +#include <linux/ptrace.h> +#include <sys/types.h> +#include <unistd.h> + +#include <bpf/bpf_helpers.h> +#include <bpf/bpf_tracing.h> +#include "bpf_misc.h" + +int arg1 = 0; +unsigned long arg2 = 0; +unsigned long arg3 = 0; +unsigned long arg4_cx = 0; +unsigned long arg4 = 0; +unsigned long arg5 = 0; + +const volatile pid_t filter_pid = 0; + +SEC("kprobe/" SYS_PREFIX "sys_prctl") +int BPF_KPROBE(handle_sys_prctl) +{ + struct pt_regs *real_regs; + int orig_arg1; + unsigned long orig_arg2, orig_arg3, orig_arg4_cx, orig_arg4, orig_arg5; + pid_t pid = bpf_get_current_pid_tgid() >> 32; + + if (pid != filter_pid) + return 0; + + real_regs = (struct pt_regs *)PT_REGS_PARM1(ctx); + bpf_probe_read_kernel(&orig_arg1, sizeof(orig_arg1), &PT_REGS_PARM1_SYSCALL(real_regs)); + bpf_probe_read_kernel(&orig_arg2, sizeof(orig_arg2), &PT_REGS_PARM2_SYSCALL(real_regs)); + bpf_probe_read_kernel(&orig_arg3, sizeof(orig_arg3), &PT_REGS_PARM3_SYSCALL(real_regs)); + bpf_probe_read_kernel(&orig_arg4_cx, sizeof(orig_arg4_cx), &PT_REGS_PARM4(real_regs)); + bpf_probe_read_kernel(&orig_arg4, sizeof(orig_arg4), &PT_REGS_PARM4_SYSCALL(real_regs)); + bpf_probe_read_kernel(&orig_arg5, sizeof(orig_arg5), &PT_REGS_PARM5_SYSCALL(real_regs)); + + /* copy all actual args and the wrong arg4 on x86_64 */ + arg1 = orig_arg1; + arg2 = orig_arg2; + arg3 = orig_arg3; + arg4_cx = orig_arg4_cx; + arg4 = orig_arg4; + arg5 = orig_arg5; + + return 0; +} + +char _license[] SEC("license") = "GPL";
Add a selftest to verify the behavior of PT_REGS_xxx. Signed-off-by: Kenta Tada <Kenta.Tada@sony.com> --- .../bpf/prog_tests/test_bpf_syscall_macro.c | 49 ++++++++++++++++++ .../selftests/bpf/progs/bpf_syscall_macro.c | 51 +++++++++++++++++++ 2 files changed, 100 insertions(+) create mode 100644 tools/testing/selftests/bpf/prog_tests/test_bpf_syscall_macro.c create mode 100644 tools/testing/selftests/bpf/progs/bpf_syscall_macro.c