selftests/bpf: Add tests for add_const
Improve arena based tests and add several C and asm tests with specific pattern. These tests would have failed without add_const verifier support. Also add several loop_inside_iter*() tests that are not related to add_const, but nice to have. Signed-off-by: Alexei Starovoitov <ast@kernel.org> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Link: https://lore.kernel.org/bpf/20240613013815.953-5-alexei.starovoitov@gmail.com
This commit is contained in:
Alexei Starovoitov
Daniel Borkmann
parent
6870bdb3f4
commit
dedf56d775
@ -19,25 +19,35 @@ void __arena *htab_for_user;
|
||||
bool skip = false;
|
||||
|
||||
int zero = 0;
|
||||
char __arena arr1[100000];
|
||||
char arr2[1000];
|
||||
|
||||
SEC("syscall")
|
||||
int arena_htab_llvm(void *ctx)
|
||||
{
|
||||
#if defined(__BPF_FEATURE_ADDR_SPACE_CAST) || defined(BPF_ARENA_FORCE_ASM)
|
||||
struct htab __arena *htab;
|
||||
char __arena *arr = arr1;
|
||||
__u64 i;
|
||||
|
||||
htab = bpf_alloc(sizeof(*htab));
|
||||
cast_kern(htab);
|
||||
htab_init(htab);
|
||||
|
||||
/* first run. No old elems in the table */
|
||||
for (i = zero; i < 1000; i++)
|
||||
htab_update_elem(htab, i, i);
|
||||
cast_kern(arr);
|
||||
|
||||
/* should replace all elems with new ones */
|
||||
for (i = zero; i < 1000; i++)
|
||||
/* first run. No old elems in the table */
|
||||
for (i = zero; i < 100000 && can_loop; i++) {
|
||||
htab_update_elem(htab, i, i);
|
||||
arr[i] = i;
|
||||
}
|
||||
|
||||
/* should replace some elems with new ones */
|
||||
for (i = zero; i < 1000 && can_loop; i++) {
|
||||
htab_update_elem(htab, i, i);
|
||||
/* Access mem to make the verifier use bounded loop logic */
|
||||
arr2[i] = i;
|
||||
}
|
||||
cast_user(htab);
|
||||
htab_for_user = htab;
|
||||
#else
|
||||
|
||||
@ -405,4 +405,240 @@ int cond_break5(const void *ctx)
|
||||
return cnt1 > 1 && cnt2 > 1 ? 1 : 0;
|
||||
}
|
||||
|
||||
#define ARR2_SZ 1000
|
||||
SEC(".data.arr2")
|
||||
char arr2[ARR2_SZ];
|
||||
|
||||
SEC("socket")
|
||||
__success __flag(BPF_F_TEST_STATE_FREQ)
|
||||
int loop_inside_iter(const void *ctx)
|
||||
{
|
||||
struct bpf_iter_num it;
|
||||
int *v, sum = 0;
|
||||
__u64 i = 0;
|
||||
|
||||
bpf_iter_num_new(&it, 0, ARR2_SZ);
|
||||
while ((v = bpf_iter_num_next(&it))) {
|
||||
if (i < ARR2_SZ)
|
||||
sum += arr2[i++];
|
||||
}
|
||||
bpf_iter_num_destroy(&it);
|
||||
return sum;
|
||||
}
|
||||
|
||||
SEC("socket")
|
||||
__success __flag(BPF_F_TEST_STATE_FREQ)
|
||||
int loop_inside_iter_signed(const void *ctx)
|
||||
{
|
||||
struct bpf_iter_num it;
|
||||
int *v, sum = 0;
|
||||
long i = 0;
|
||||
|
||||
bpf_iter_num_new(&it, 0, ARR2_SZ);
|
||||
while ((v = bpf_iter_num_next(&it))) {
|
||||
if (i < ARR2_SZ && i >= 0)
|
||||
sum += arr2[i++];
|
||||
}
|
||||
bpf_iter_num_destroy(&it);
|
||||
return sum;
|
||||
}
|
||||
|
||||
volatile const int limit = ARR2_SZ;
|
||||
|
||||
SEC("socket")
|
||||
__success __flag(BPF_F_TEST_STATE_FREQ)
|
||||
int loop_inside_iter_volatile_limit(const void *ctx)
|
||||
{
|
||||
struct bpf_iter_num it;
|
||||
int *v, sum = 0;
|
||||
__u64 i = 0;
|
||||
|
||||
bpf_iter_num_new(&it, 0, ARR2_SZ);
|
||||
while ((v = bpf_iter_num_next(&it))) {
|
||||
if (i < limit)
|
||||
sum += arr2[i++];
|
||||
}
|
||||
bpf_iter_num_destroy(&it);
|
||||
return sum;
|
||||
}
|
||||
|
||||
#define ARR_LONG_SZ 1000
|
||||
|
||||
SEC(".data.arr_long")
|
||||
long arr_long[ARR_LONG_SZ];
|
||||
|
||||
SEC("socket")
|
||||
__success
|
||||
int test1(const void *ctx)
|
||||
{
|
||||
long i;
|
||||
|
||||
for (i = 0; i < ARR_LONG_SZ && can_loop; i++)
|
||||
arr_long[i] = i;
|
||||
return 0;
|
||||
}
|
||||
|
||||
SEC("socket")
|
||||
__success
|
||||
int test2(const void *ctx)
|
||||
{
|
||||
__u64 i;
|
||||
|
||||
for (i = zero; i < ARR_LONG_SZ && can_loop; i++) {
|
||||
barrier_var(i);
|
||||
arr_long[i] = i;
|
||||
}
|
||||
return 0;
|
||||
}
|
||||
|
||||
SEC(".data.arr_foo")
|
||||
struct {
|
||||
int a;
|
||||
int b;
|
||||
} arr_foo[ARR_LONG_SZ];
|
||||
|
||||
SEC("socket")
|
||||
__success
|
||||
int test3(const void *ctx)
|
||||
{
|
||||
__u64 i;
|
||||
|
||||
for (i = zero; i < ARR_LONG_SZ && can_loop; i++) {
|
||||
barrier_var(i);
|
||||
arr_foo[i].a = i;
|
||||
arr_foo[i].b = i;
|
||||
}
|
||||
return 0;
|
||||
}
|
||||
|
||||
SEC("socket")
|
||||
__success
|
||||
int test4(const void *ctx)
|
||||
{
|
||||
long i;
|
||||
|
||||
for (i = zero + ARR_LONG_SZ - 1; i < ARR_LONG_SZ && i >= 0 && can_loop; i--) {
|
||||
barrier_var(i);
|
||||
arr_foo[i].a = i;
|
||||
arr_foo[i].b = i;
|
||||
}
|
||||
return 0;
|
||||
}
|
||||
|
||||
char buf[10] SEC(".data.buf");
|
||||
|
||||
SEC("socket")
|
||||
__description("check add const")
|
||||
__success
|
||||
__naked void check_add_const(void)
|
||||
{
|
||||
/* typical LLVM generated loop with may_goto */
|
||||
asm volatile (" \
|
||||
call %[bpf_ktime_get_ns]; \
|
||||
if r0 > 9 goto l1_%=; \
|
||||
l0_%=: r1 = %[buf]; \
|
||||
r2 = r0; \
|
||||
r1 += r2; \
|
||||
r3 = *(u8 *)(r1 +0); \
|
||||
.byte 0xe5; /* may_goto */ \
|
||||
.byte 0; /* regs */ \
|
||||
.short 4; /* off of l1_%=: */ \
|
||||
.long 0; /* imm */ \
|
||||
r0 = r2; \
|
||||
r0 += 1; \
|
||||
if r2 < 9 goto l0_%=; \
|
||||
exit; \
|
||||
l1_%=: r0 = 0; \
|
||||
exit; \
|
||||
" :
|
||||
: __imm(bpf_ktime_get_ns),
|
||||
__imm_ptr(buf)
|
||||
: __clobber_common);
|
||||
}
|
||||
|
||||
SEC("socket")
|
||||
__failure
|
||||
__msg("*(u8 *)(r7 +0) = r0")
|
||||
__msg("invalid access to map value, value_size=10 off=10 size=1")
|
||||
__naked void check_add_const_3regs(void)
|
||||
{
|
||||
asm volatile (
|
||||
"r6 = %[buf];"
|
||||
"r7 = %[buf];"
|
||||
"call %[bpf_ktime_get_ns];"
|
||||
"r1 = r0;" /* link r0.id == r1.id == r2.id */
|
||||
"r2 = r0;"
|
||||
"r1 += 1;" /* r1 == r0+1 */
|
||||
"r2 += 2;" /* r2 == r0+2 */
|
||||
"if r0 > 8 goto 1f;" /* r0 range [0, 8] */
|
||||
"r6 += r1;" /* r1 range [1, 9] */
|
||||
"r7 += r2;" /* r2 range [2, 10] */
|
||||
"*(u8 *)(r6 +0) = r0;" /* safe, within bounds */
|
||||
"*(u8 *)(r7 +0) = r0;" /* unsafe, out of bounds */
|
||||
"1: exit;"
|
||||
:
|
||||
: __imm(bpf_ktime_get_ns),
|
||||
__imm_ptr(buf)
|
||||
: __clobber_common);
|
||||
}
|
||||
|
||||
SEC("socket")
|
||||
__failure
|
||||
__msg("*(u8 *)(r8 -1) = r0")
|
||||
__msg("invalid access to map value, value_size=10 off=10 size=1")
|
||||
__naked void check_add_const_3regs_2if(void)
|
||||
{
|
||||
asm volatile (
|
||||
"r6 = %[buf];"
|
||||
"r7 = %[buf];"
|
||||
"r8 = %[buf];"
|
||||
"call %[bpf_ktime_get_ns];"
|
||||
"if r0 < 2 goto 1f;"
|
||||
"r1 = r0;" /* link r0.id == r1.id == r2.id */
|
||||
"r2 = r0;"
|
||||
"r1 += 1;" /* r1 == r0+1 */
|
||||
"r2 += 2;" /* r2 == r0+2 */
|
||||
"if r2 > 11 goto 1f;" /* r2 range [0, 11] -> r0 range [-2, 9]; r1 range [-1, 10] */
|
||||
"if r0 s< 0 goto 1f;" /* r0 range [0, 9] -> r1 range [1, 10]; r2 range [2, 11]; */
|
||||
"r6 += r0;" /* r0 range [0, 9] */
|
||||
"r7 += r1;" /* r1 range [1, 10] */
|
||||
"r8 += r2;" /* r2 range [2, 11] */
|
||||
"*(u8 *)(r6 +0) = r0;" /* safe, within bounds */
|
||||
"*(u8 *)(r7 -1) = r0;" /* safe */
|
||||
"*(u8 *)(r8 -1) = r0;" /* unsafe */
|
||||
"1: exit;"
|
||||
:
|
||||
: __imm(bpf_ktime_get_ns),
|
||||
__imm_ptr(buf)
|
||||
: __clobber_common);
|
||||
}
|
||||
|
||||
SEC("socket")
|
||||
__failure
|
||||
__flag(BPF_F_TEST_STATE_FREQ)
|
||||
__naked void check_add_const_regsafe_off(void)
|
||||
{
|
||||
asm volatile (
|
||||
"r8 = %[buf];"
|
||||
"call %[bpf_ktime_get_ns];"
|
||||
"r6 = r0;"
|
||||
"call %[bpf_ktime_get_ns];"
|
||||
"r7 = r0;"
|
||||
"call %[bpf_ktime_get_ns];"
|
||||
"r1 = r0;" /* same ids for r1 and r0 */
|
||||
"if r6 > r7 goto 1f;" /* this jump can't be predicted */
|
||||
"r1 += 1;" /* r1.off == +1 */
|
||||
"goto 2f;"
|
||||
"1: r1 += 100;" /* r1.off == +100 */
|
||||
"goto +0;" /* verify r1.off in regsafe() after this insn */
|
||||
"2: if r0 > 8 goto 3f;" /* r0 range [0,8], r1 range either [1,9] or [100,108]*/
|
||||
"r8 += r1;"
|
||||
"*(u8 *)(r8 +0) = r0;" /* potentially unsafe, buf size is 10 */
|
||||
"3: exit;"
|
||||
:
|
||||
: __imm(bpf_ktime_get_ns),
|
||||
__imm_ptr(buf)
|
||||
: __clobber_common);
|
||||
}
|
||||
|
||||
char _license[] SEC("license") = "GPL";
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user