Commit 87630188 authored by Andrii Nakryiko's avatar Andrii Nakryiko Committed by Alexei Starovoitov
Browse files

selftests/bpf: add stack access precision test 



Add a new selftests that validates precision tracking for stack access
instruction, using both r10-based and non-r10-based accesses. For
non-r10 ones we also make sure to have non-zero var_off to validate that
final stack offset is tracked properly in instruction history
information inside verifier.

Acked-by: default avatarEduard Zingerman <eddyz87@gmail.com>
Signed-off-by: default avatarAndrii Nakryiko <andrii@kernel.org>
Link: https://lore.kernel.org/r/20231205184248.1502704-3-andrii@kernel.org


Signed-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
parent 41f6f64e

tools/testing/selftests/bpf/progs/verifier_subprog_precision.c

+59 −5
Original line number Diff line number Diff line
@@ -641,14 +641,68 @@ __naked int subprog_spill_into_parent_stack_slot_precise(void) 
	);

}



__naked __noinline __used

static __u64 subprog_with_checkpoint(void)

SEC("?raw_tp")

__success __log_level(2)

__msg("17: (0f) r1 += r0")

__msg("mark_precise: frame0: last_idx 17 first_idx 0 subseq_idx -1")

__msg("mark_precise: frame0: regs=r0 stack= before 16: (bf) r1 = r7")

__msg("mark_precise: frame0: regs=r0 stack= before 15: (27) r0 *= 4")

__msg("mark_precise: frame0: regs=r0 stack= before 14: (79) r0 = *(u64 *)(r10 -16)")

__msg("mark_precise: frame0: regs= stack=-16 before 13: (7b) *(u64 *)(r7 -8) = r0")

__msg("mark_precise: frame0: regs=r0 stack= before 12: (79) r0 = *(u64 *)(r8 +16)")

__msg("mark_precise: frame0: regs= stack=-16 before 11: (7b) *(u64 *)(r8 +16) = r0")

__msg("mark_precise: frame0: regs=r0 stack= before 10: (79) r0 = *(u64 *)(r7 -8)")

__msg("mark_precise: frame0: regs= stack=-16 before 9: (7b) *(u64 *)(r10 -16) = r0")

__msg("mark_precise: frame0: regs=r0 stack= before 8: (07) r8 += -32")

__msg("mark_precise: frame0: regs=r0 stack= before 7: (bf) r8 = r10")

__msg("mark_precise: frame0: regs=r0 stack= before 6: (07) r7 += -8")

__msg("mark_precise: frame0: regs=r0 stack= before 5: (bf) r7 = r10")

__msg("mark_precise: frame0: regs=r0 stack= before 21: (95) exit")

__msg("mark_precise: frame1: regs=r0 stack= before 20: (bf) r0 = r1")

__msg("mark_precise: frame1: regs=r1 stack= before 4: (85) call pc+15")

__msg("mark_precise: frame0: regs=r1 stack= before 3: (bf) r1 = r6")

__msg("mark_precise: frame0: regs=r6 stack= before 2: (b7) r6 = 1")

__naked int stack_slot_aliases_precision(void)

{

	asm volatile (

		"r0 = 0;"

		/* guaranteed checkpoint if BPF_F_TEST_STATE_FREQ is used */

		"goto +0;"

		"r6 = 1;"

		/* pass r6 through r1 into subprog to get it back as r0;

		 * this whole chain will have to be marked as precise later

		 */

		"r1 = r6;"

		"call identity_subprog;"

		/* let's setup two registers that are aliased to r10 */

		"r7 = r10;"

		"r7 += -8;"			/* r7 = r10 - 8 */

		"r8 = r10;"

		"r8 += -32;"			/* r8 = r10 - 32 */

		/* now spill subprog's return value (a r6 -> r1 -> r0 chain)

		 * a few times through different stack pointer regs, making

		 * sure to use r10, r7, and r8 both in LDX and STX insns, and

		 * *importantly* also using a combination of const var_off and

		 * insn->off to validate that we record final stack slot

		 * correctly, instead of relying on just insn->off derivation,

		 * which is only valid for r10-based stack offset

		 */

		"*(u64 *)(r10 - 16) = r0;"

		"r0 = *(u64 *)(r7 - 8);"	/* r7 - 8 == r10 - 16 */

		"*(u64 *)(r8 + 16) = r0;"	/* r8 + 16 = r10 - 16 */

		"r0 = *(u64 *)(r8 + 16);"

		"*(u64 *)(r7 - 8) = r0;"

		"r0 = *(u64 *)(r10 - 16);"

		/* get ready to use r0 as an index into array to force precision */

		"r0 *= 4;"

		"r1 = %[vals];"

		/* here r0->r1->r6 chain is forced to be precise and has to be

		 * propagated back to the beginning, including through the

		 * subprog call and all the stack spills and loads

		 */

		"r1 += r0;"

		"r0 = *(u32 *)(r1 + 0);"

		"exit;"

		:

		: __imm_ptr(vals)

		: __clobber_common, "r6"

	);

}