Commit dedf56d7 authored by Alexei Starovoitov's avatar Alexei Starovoitov Committed by Daniel Borkmann
Browse files

selftests/bpf: Add tests for add_const 



Improve arena based tests and add several C and asm tests
with specific pattern.
These tests would have failed without add_const verifier support.

Also add several loop_inside_iter*() tests that are not related to add_const,
but nice to have.

Signed-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
Link: https://lore.kernel.org/bpf/20240613013815.953-5-alexei.starovoitov@gmail.com
parent 6870bdb3

tools/testing/selftests/bpf/progs/arena_htab.c

+13 −3
Original line number Diff line number Diff line
@@ -19,25 +19,35 @@ void __arena *htab_for_user; 
bool skip = false;



int zero = 0;

char __arena arr1[100000];

char arr2[1000];



SEC("syscall")

int arena_htab_llvm(void *ctx)

{

#if defined(__BPF_FEATURE_ADDR_SPACE_CAST) || defined(BPF_ARENA_FORCE_ASM)

	struct htab __arena *htab;

	char __arena *arr = arr1;

	__u64 i;



	htab = bpf_alloc(sizeof(*htab));

	cast_kern(htab);

	htab_init(htab);



	cast_kern(arr);



	/* first run. No old elems in the table */

	for (i = zero; i < 1000; i++)

	for (i = zero; i < 100000 && can_loop; i++) {

		htab_update_elem(htab, i, i);

		arr[i] = i;

	}



	/* should replace all elems with new ones */

	for (i = zero; i < 1000; i++)

	/* should replace some elems with new ones */

	for (i = zero; i < 1000 && can_loop; i++) {

		htab_update_elem(htab, i, i);

		/* Access mem to make the verifier use bounded loop logic */

		arr2[i] = i;

	}

	cast_user(htab);

	htab_for_user = htab;

#else

tools/testing/selftests/bpf/progs/verifier_iterating_callbacks.c

+236 −0
Original line number Diff line number Diff line
@@ -405,4 +405,240 @@ int cond_break5(const void *ctx) 
	return cnt1 > 1 && cnt2 > 1 ? 1 : 0;

}



#define ARR2_SZ 1000

SEC(".data.arr2")

char arr2[ARR2_SZ];



SEC("socket")

__success __flag(BPF_F_TEST_STATE_FREQ)

int loop_inside_iter(const void *ctx)

{

	struct bpf_iter_num it;

	int *v, sum = 0;

	__u64 i = 0;



	bpf_iter_num_new(&it, 0, ARR2_SZ);

	while ((v = bpf_iter_num_next(&it))) {

		if (i < ARR2_SZ)

			sum += arr2[i++];

	}

	bpf_iter_num_destroy(&it);

	return sum;

}



SEC("socket")

__success __flag(BPF_F_TEST_STATE_FREQ)

int loop_inside_iter_signed(const void *ctx)

{

	struct bpf_iter_num it;

	int *v, sum = 0;

	long i = 0;



	bpf_iter_num_new(&it, 0, ARR2_SZ);

	while ((v = bpf_iter_num_next(&it))) {

		if (i < ARR2_SZ && i >= 0)

			sum += arr2[i++];

	}

	bpf_iter_num_destroy(&it);

	return sum;

}



volatile const int limit = ARR2_SZ;



SEC("socket")

__success __flag(BPF_F_TEST_STATE_FREQ)

int loop_inside_iter_volatile_limit(const void *ctx)

{

	struct bpf_iter_num it;

	int *v, sum = 0;

	__u64 i = 0;



	bpf_iter_num_new(&it, 0, ARR2_SZ);

	while ((v = bpf_iter_num_next(&it))) {

		if (i < limit)

			sum += arr2[i++];

	}

	bpf_iter_num_destroy(&it);

	return sum;

}



#define ARR_LONG_SZ 1000



SEC(".data.arr_long")

long arr_long[ARR_LONG_SZ];



SEC("socket")

__success

int test1(const void *ctx)

{

	long i;



	for (i = 0; i < ARR_LONG_SZ && can_loop; i++)

		arr_long[i] = i;

	return 0;

}



SEC("socket")

__success

int test2(const void *ctx)

{

	__u64 i;



	for (i = zero; i < ARR_LONG_SZ && can_loop; i++) {

		barrier_var(i);

		arr_long[i] = i;

	}

	return 0;

}



SEC(".data.arr_foo")

struct {

	int a;

	int b;

} arr_foo[ARR_LONG_SZ];



SEC("socket")

__success

int test3(const void *ctx)

{

	__u64 i;



	for (i = zero; i < ARR_LONG_SZ && can_loop; i++) {

		barrier_var(i);

		arr_foo[i].a = i;

		arr_foo[i].b = i;

	}

	return 0;

}



SEC("socket")

__success

int test4(const void *ctx)

{

	long i;



	for (i = zero + ARR_LONG_SZ - 1; i < ARR_LONG_SZ && i >= 0 && can_loop; i--) {

		barrier_var(i);

		arr_foo[i].a = i;

		arr_foo[i].b = i;

	}

	return 0;

}



char buf[10] SEC(".data.buf");



SEC("socket")

__description("check add const")

__success

__naked void check_add_const(void)

{

	/* typical LLVM generated loop with may_goto */

	asm volatile ("			\

	call %[bpf_ktime_get_ns];	\

	if r0 > 9 goto l1_%=;		\

l0_%=:	r1 = %[buf];			\

	r2 = r0;			\

	r1 += r2;			\

	r3 = *(u8 *)(r1 +0);		\

	.byte 0xe5; /* may_goto */	\

	.byte 0; /* regs */		\

	.short 4; /* off of l1_%=: */	\

	.long 0; /* imm */		\

	r0 = r2;			\

	r0 += 1;			\

	if r2 < 9 goto l0_%=;		\

	exit;				\

l1_%=:	r0 = 0;				\

	exit;				\

"	:

	: __imm(bpf_ktime_get_ns),

	  __imm_ptr(buf)

	: __clobber_common);

}



SEC("socket")

__failure

__msg("*(u8 *)(r7 +0) = r0")

__msg("invalid access to map value, value_size=10 off=10 size=1")

__naked void check_add_const_3regs(void)

{

	asm volatile (

	"r6 = %[buf];"

	"r7 = %[buf];"

	"call %[bpf_ktime_get_ns];"

	"r1 = r0;"              /* link r0.id == r1.id == r2.id */

	"r2 = r0;"

	"r1 += 1;"              /* r1 == r0+1 */

	"r2 += 2;"              /* r2 == r0+2 */

	"if r0 > 8 goto 1f;"    /* r0 range [0, 8]  */

	"r6 += r1;"             /* r1 range [1, 9]  */

	"r7 += r2;"             /* r2 range [2, 10] */

	"*(u8 *)(r6 +0) = r0;"  /* safe, within bounds   */

	"*(u8 *)(r7 +0) = r0;"  /* unsafe, out of bounds */

	"1: exit;"

	:

	: __imm(bpf_ktime_get_ns),

	  __imm_ptr(buf)

	: __clobber_common);

}



SEC("socket")

__failure

__msg("*(u8 *)(r8 -1) = r0")

__msg("invalid access to map value, value_size=10 off=10 size=1")

__naked void check_add_const_3regs_2if(void)

{

	asm volatile (

	"r6 = %[buf];"

	"r7 = %[buf];"

	"r8 = %[buf];"

	"call %[bpf_ktime_get_ns];"

	"if r0 < 2 goto 1f;"

	"r1 = r0;"              /* link r0.id == r1.id == r2.id */

	"r2 = r0;"

	"r1 += 1;"              /* r1 == r0+1 */

	"r2 += 2;"              /* r2 == r0+2 */

	"if r2 > 11 goto 1f;"   /* r2 range [0, 11] -> r0 range [-2, 9]; r1 range [-1, 10] */

	"if r0 s< 0 goto 1f;"   /* r0 range [0, 9] -> r1 range [1, 10]; r2 range [2, 11]; */

	"r6 += r0;"             /* r0 range [0, 9]  */

	"r7 += r1;"             /* r1 range [1, 10] */

	"r8 += r2;"             /* r2 range [2, 11] */

	"*(u8 *)(r6 +0) = r0;"  /* safe, within bounds   */

	"*(u8 *)(r7 -1) = r0;"  /* safe */

	"*(u8 *)(r8 -1) = r0;"  /* unsafe */

	"1: exit;"

	:

	: __imm(bpf_ktime_get_ns),

	  __imm_ptr(buf)

	: __clobber_common);

}



SEC("socket")

__failure

__flag(BPF_F_TEST_STATE_FREQ)

__naked void check_add_const_regsafe_off(void)

{

	asm volatile (

	"r8 = %[buf];"

	"call %[bpf_ktime_get_ns];"

	"r6 = r0;"

	"call %[bpf_ktime_get_ns];"

	"r7 = r0;"

	"call %[bpf_ktime_get_ns];"

	"r1 = r0;"              /* same ids for r1 and r0 */

	"if r6 > r7 goto 1f;"   /* this jump can't be predicted */

	"r1 += 1;"              /* r1.off == +1 */

	"goto 2f;"

	"1: r1 += 100;"         /* r1.off == +100 */

	"goto +0;"              /* verify r1.off in regsafe() after this insn */

	"2: if r0 > 8 goto 3f;" /* r0 range [0,8], r1 range either [1,9] or [100,108]*/

	"r8 += r1;"

	"*(u8 *)(r8 +0) = r0;"  /* potentially unsafe, buf size is 10 */

	"3: exit;"

	:

	: __imm(bpf_ktime_get_ns),

	  __imm_ptr(buf)

	: __clobber_common);

}



char _license[] SEC("license") = "GPL";