selftests/bpf: Add tests for add_const

Improve arena based tests and add several C and asm tests
with specific pattern.
These tests would have failed without add_const verifier support.

Also add several loop_inside_iter*() tests that are not related to add_const,
but nice to have.

Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Link: https://lore.kernel.org/bpf/20240613013815.953-5-alexei.starovoitov@gmail.com

diff --git a/tools/testing/selftests/bpf/progs/arena_htab.c b/tools/testing/selftests/bpf/progs/arena_htab.c
index cf938cf8c11ea379a407981e902fdac0b57aee10..81eaa94afeb01c2447fc947aa4d970f49e16657e 100644 (file)
--- a/tools/testing/selftests/bpf/progs/arena_htab.c
+++ b/tools/testing/selftests/bpf/progs/arena_htab.c
@@ -19,25 +19,35 @@ void __arena *htab_for_user;
 bool skip = false;
 
 int zero = 0;
+char __arena arr1[100000];
+char arr2[1000];
 
 SEC("syscall")
 int arena_htab_llvm(void *ctx)
 {
 #if defined(__BPF_FEATURE_ADDR_SPACE_CAST) || defined(BPF_ARENA_FORCE_ASM)
        struct htab __arena *htab;
+       char __arena *arr = arr1;
        __u64 i;
 
        htab = bpf_alloc(sizeof(*htab));
        cast_kern(htab);
        htab_init(htab);
 
+       cast_kern(arr);
+
        /* first run. No old elems in the table */
-       for (i = zero; i < 1000; i++)
+       for (i = zero; i < 100000 && can_loop; i++) {
                htab_update_elem(htab, i, i);
+               arr[i] = i;
+       }
 
-       /* should replace all elems with new ones */
-       for (i = zero; i < 1000; i++)
+       /* should replace some elems with new ones */
+       for (i = zero; i < 1000 && can_loop; i++) {
                htab_update_elem(htab, i, i);
+               /* Access mem to make the verifier use bounded loop logic */
+               arr2[i] = i;
+       }
        cast_user(htab);
        htab_for_user = htab;
 #else

diff --git a/tools/testing/selftests/bpf/progs/verifier_iterating_callbacks.c b/tools/testing/selftests/bpf/progs/verifier_iterating_callbacks.c
index bd676d7e615fd538aadaf890b90ec902221e79bc..53679252e8a1d585018dffa9236b2ac1a538bc5b 100644 (file)
--- a/tools/testing/selftests/bpf/progs/verifier_iterating_callbacks.c
+++ b/tools/testing/selftests/bpf/progs/verifier_iterating_callbacks.c
@@ -405,4 +405,240 @@ int cond_break5(const void *ctx)
        return cnt1 > 1 && cnt2 > 1 ? 1 : 0;
 }
 
+#define ARR2_SZ 1000
+SEC(".data.arr2")
+char arr2[ARR2_SZ];
+
+SEC("socket")
+__success __flag(BPF_F_TEST_STATE_FREQ)
+int loop_inside_iter(const void *ctx)
+{
+       struct bpf_iter_num it;
+       int *v, sum = 0;
+       __u64 i = 0;
+
+       bpf_iter_num_new(&it, 0, ARR2_SZ);
+       while ((v = bpf_iter_num_next(&it))) {
+               if (i < ARR2_SZ)
+                       sum += arr2[i++];
+       }
+       bpf_iter_num_destroy(&it);
+       return sum;
+}
+
+SEC("socket")
+__success __flag(BPF_F_TEST_STATE_FREQ)
+int loop_inside_iter_signed(const void *ctx)
+{
+       struct bpf_iter_num it;
+       int *v, sum = 0;
+       long i = 0;
+
+       bpf_iter_num_new(&it, 0, ARR2_SZ);
+       while ((v = bpf_iter_num_next(&it))) {
+               if (i < ARR2_SZ && i >= 0)
+                       sum += arr2[i++];
+       }
+       bpf_iter_num_destroy(&it);
+       return sum;
+}
+
+volatile const int limit = ARR2_SZ;
+
+SEC("socket")
+__success __flag(BPF_F_TEST_STATE_FREQ)
+int loop_inside_iter_volatile_limit(const void *ctx)
+{
+       struct bpf_iter_num it;
+       int *v, sum = 0;
+       __u64 i = 0;
+
+       bpf_iter_num_new(&it, 0, ARR2_SZ);
+       while ((v = bpf_iter_num_next(&it))) {
+               if (i < limit)
+                       sum += arr2[i++];
+       }
+       bpf_iter_num_destroy(&it);
+       return sum;
+}
+
+#define ARR_LONG_SZ 1000
+
+SEC(".data.arr_long")
+long arr_long[ARR_LONG_SZ];
+
+SEC("socket")
+__success
+int test1(const void *ctx)
+{
+       long i;
+
+       for (i = 0; i < ARR_LONG_SZ && can_loop; i++)
+               arr_long[i] = i;
+       return 0;
+}
+
+SEC("socket")
+__success
+int test2(const void *ctx)
+{
+       __u64 i;
+
+       for (i = zero; i < ARR_LONG_SZ && can_loop; i++) {
+               barrier_var(i);
+               arr_long[i] = i;
+       }
+       return 0;
+}
+
+SEC(".data.arr_foo")
+struct {
+       int a;
+       int b;
+} arr_foo[ARR_LONG_SZ];
+
+SEC("socket")
+__success
+int test3(const void *ctx)
+{
+       __u64 i;
+
+       for (i = zero; i < ARR_LONG_SZ && can_loop; i++) {
+               barrier_var(i);
+               arr_foo[i].a = i;
+               arr_foo[i].b = i;
+       }
+       return 0;
+}
+
+SEC("socket")
+__success
+int test4(const void *ctx)
+{
+       long i;
+
+       for (i = zero + ARR_LONG_SZ - 1; i < ARR_LONG_SZ && i >= 0 && can_loop; i--) {
+               barrier_var(i);
+               arr_foo[i].a = i;
+               arr_foo[i].b = i;
+       }
+       return 0;
+}
+
+char buf[10] SEC(".data.buf");
+
+SEC("socket")
+__description("check add const")
+__success
+__naked void check_add_const(void)
+{
+       /* typical LLVM generated loop with may_goto */
+       asm volatile ("                 \
+       call %[bpf_ktime_get_ns];       \
+       if r0 > 9 goto l1_%=;           \
+l0_%=: r1 = %[buf];                    \
+       r2 = r0;                        \
+       r1 += r2;                       \
+       r3 = *(u8 *)(r1 +0);            \
+       .byte 0xe5; /* may_goto */      \
+       .byte 0; /* regs */             \
+       .short 4; /* off of l1_%=: */   \
+       .long 0; /* imm */              \
+       r0 = r2;                        \
+       r0 += 1;                        \
+       if r2 < 9 goto l0_%=;           \
+       exit;                           \
+l1_%=: r0 = 0;                         \
+       exit;                           \
+"      :
+       : __imm(bpf_ktime_get_ns),
+         __imm_ptr(buf)
+       : __clobber_common);
+}
+
+SEC("socket")
+__failure
+__msg("*(u8 *)(r7 +0) = r0")
+__msg("invalid access to map value, value_size=10 off=10 size=1")
+__naked void check_add_const_3regs(void)
+{
+       asm volatile (
+       "r6 = %[buf];"
+       "r7 = %[buf];"
+       "call %[bpf_ktime_get_ns];"
+       "r1 = r0;"              /* link r0.id == r1.id == r2.id */
+       "r2 = r0;"
+       "r1 += 1;"              /* r1 == r0+1 */
+       "r2 += 2;"              /* r2 == r0+2 */
+       "if r0 > 8 goto 1f;"    /* r0 range [0, 8]  */
+       "r6 += r1;"             /* r1 range [1, 9]  */
+       "r7 += r2;"             /* r2 range [2, 10] */
+       "*(u8 *)(r6 +0) = r0;"  /* safe, within bounds   */
+       "*(u8 *)(r7 +0) = r0;"  /* unsafe, out of bounds */
+       "1: exit;"
+       :
+       : __imm(bpf_ktime_get_ns),
+         __imm_ptr(buf)
+       : __clobber_common);
+}
+
+SEC("socket")
+__failure
+__msg("*(u8 *)(r8 -1) = r0")
+__msg("invalid access to map value, value_size=10 off=10 size=1")
+__naked void check_add_const_3regs_2if(void)
+{
+       asm volatile (
+       "r6 = %[buf];"
+       "r7 = %[buf];"
+       "r8 = %[buf];"
+       "call %[bpf_ktime_get_ns];"
+       "if r0 < 2 goto 1f;"
+       "r1 = r0;"              /* link r0.id == r1.id == r2.id */
+       "r2 = r0;"
+       "r1 += 1;"              /* r1 == r0+1 */
+       "r2 += 2;"              /* r2 == r0+2 */
+       "if r2 > 11 goto 1f;"   /* r2 range [0, 11] -> r0 range [-2, 9]; r1 range [-1, 10] */
+       "if r0 s< 0 goto 1f;"   /* r0 range [0, 9] -> r1 range [1, 10]; r2 range [2, 11]; */
+       "r6 += r0;"             /* r0 range [0, 9]  */
+       "r7 += r1;"             /* r1 range [1, 10] */
+       "r8 += r2;"             /* r2 range [2, 11] */
+       "*(u8 *)(r6 +0) = r0;"  /* safe, within bounds   */
+       "*(u8 *)(r7 -1) = r0;"  /* safe */
+       "*(u8 *)(r8 -1) = r0;"  /* unsafe */
+       "1: exit;"
+       :
+       : __imm(bpf_ktime_get_ns),
+         __imm_ptr(buf)
+       : __clobber_common);
+}
+
+SEC("socket")
+__failure
+__flag(BPF_F_TEST_STATE_FREQ)
+__naked void check_add_const_regsafe_off(void)
+{
+       asm volatile (
+       "r8 = %[buf];"
+       "call %[bpf_ktime_get_ns];"
+       "r6 = r0;"
+       "call %[bpf_ktime_get_ns];"
+       "r7 = r0;"
+       "call %[bpf_ktime_get_ns];"
+       "r1 = r0;"              /* same ids for r1 and r0 */
+       "if r6 > r7 goto 1f;"   /* this jump can't be predicted */
+       "r1 += 1;"              /* r1.off == +1 */
+       "goto 2f;"
+       "1: r1 += 100;"         /* r1.off == +100 */
+       "goto +0;"              /* verify r1.off in regsafe() after this insn */
+       "2: if r0 > 8 goto 3f;" /* r0 range [0,8], r1 range either [1,9] or [100,108]*/
+       "r8 += r1;"
+       "*(u8 *)(r8 +0) = r0;"  /* potentially unsafe, buf size is 10 */
+       "3: exit;"
+       :
+       : __imm(bpf_ktime_get_ns),
+         __imm_ptr(buf)
+       : __clobber_common);
+}
+
 char _license[] SEC("license") = "GPL";