Commit 40f2fbd5 authored by Jakub Kicinski's avatar Jakub Kicinski Committed by Alexei Starovoitov
Browse files

selftests: bpf: break up test_verifier 



Break up the first 10 kLoC of test verifier test cases
out into smaller files.  Looks like git line counting
gets a little flismy above 16 bit integers, so we need
two commits to break up test_verifier.

Signed-off-by: default avatarJakub Kicinski <jakub.kicinski@netronome.com>
Acked-by: default avatarJiong Wang <jiong.wang@netronome.com>
Signed-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
parent 2dfb4012

tools/testing/selftests/bpf/test_verifier.c

+0 −10136

File changed.

Preview size limit exceeded, changes collapsed.

tools/testing/selftests/bpf/verifier/and.c

0 → 100644
+50 −0
Original line number Diff line number Diff line 
{

	"invalid and of negative number",

	.insns = {

	BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),

	BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),

	BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),

	BPF_LD_MAP_FD(BPF_REG_1, 0),

	BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),

	BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),

	BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),

	BPF_ALU64_IMM(BPF_AND, BPF_REG_1, -4),

	BPF_ALU64_IMM(BPF_LSH, BPF_REG_1, 2),

	BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),

	BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, offsetof(struct test_val, foo)),

	BPF_EXIT_INSN(),

	},

	.fixup_map_hash_48b = { 3 },

	.errstr = "R0 max value is outside of the array range",

	.result = REJECT,

	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,

},

{

	"invalid range check",

	.insns = {

	BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),

	BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),

	BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),

	BPF_LD_MAP_FD(BPF_REG_1, 0),

	BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),

	BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 12),

	BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),

	BPF_MOV64_IMM(BPF_REG_9, 1),

	BPF_ALU32_IMM(BPF_MOD, BPF_REG_1, 2),

	BPF_ALU32_IMM(BPF_ADD, BPF_REG_1, 1),

	BPF_ALU32_REG(BPF_AND, BPF_REG_9, BPF_REG_1),

	BPF_ALU32_IMM(BPF_ADD, BPF_REG_9, 1),

	BPF_ALU32_IMM(BPF_RSH, BPF_REG_9, 1),

	BPF_MOV32_IMM(BPF_REG_3, 1),

	BPF_ALU32_REG(BPF_SUB, BPF_REG_3, BPF_REG_9),

	BPF_ALU32_IMM(BPF_MUL, BPF_REG_3, 0x10000000),

	BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_3),

	BPF_STX_MEM(BPF_W, BPF_REG_0, BPF_REG_3, 0),

	BPF_MOV64_REG(BPF_REG_0, 0),

	BPF_EXIT_INSN(),

	},

	.fixup_map_hash_48b = { 3 },

	.errstr = "R0 max value is outside of the array range",

	.result = REJECT,

	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,

},

tools/testing/selftests/bpf/verifier/array_access.c

0 → 100644
+219 −0
Original line number Diff line number Diff line 
{

	"valid map access into an array with a constant",

	.insns = {

	BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),

	BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),

	BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),

	BPF_LD_MAP_FD(BPF_REG_1, 0),

	BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),

	BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),

	BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, offsetof(struct test_val, foo)),

	BPF_EXIT_INSN(),

	},

	.fixup_map_hash_48b = { 3 },

	.errstr_unpriv = "R0 leaks addr",

	.result_unpriv = REJECT,

	.result = ACCEPT,

},

{

	"valid map access into an array with a register",

	.insns = {

	BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),

	BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),

	BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),

	BPF_LD_MAP_FD(BPF_REG_1, 0),

	BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),

	BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),

	BPF_MOV64_IMM(BPF_REG_1, 4),

	BPF_ALU64_IMM(BPF_LSH, BPF_REG_1, 2),

	BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),

	BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, offsetof(struct test_val, foo)),

	BPF_EXIT_INSN(),

	},

	.fixup_map_hash_48b = { 3 },

	.errstr_unpriv = "R0 leaks addr",

	.result_unpriv = REJECT,

	.result = ACCEPT,

	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,

},

{

	"valid map access into an array with a variable",

	.insns = {

	BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),

	BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),

	BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),

	BPF_LD_MAP_FD(BPF_REG_1, 0),

	BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),

	BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),

	BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),

	BPF_JMP_IMM(BPF_JGE, BPF_REG_1, MAX_ENTRIES, 3),

	BPF_ALU64_IMM(BPF_LSH, BPF_REG_1, 2),

	BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),

	BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, offsetof(struct test_val, foo)),

	BPF_EXIT_INSN(),

	},

	.fixup_map_hash_48b = { 3 },

	.errstr_unpriv = "R0 leaks addr",

	.result_unpriv = REJECT,

	.result = ACCEPT,

	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,

},

{

	"valid map access into an array with a signed variable",

	.insns = {

	BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),

	BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),

	BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),

	BPF_LD_MAP_FD(BPF_REG_1, 0),

	BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),

	BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9),

	BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),

	BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 0xffffffff, 1),

	BPF_MOV32_IMM(BPF_REG_1, 0),

	BPF_MOV32_IMM(BPF_REG_2, MAX_ENTRIES),

	BPF_JMP_REG(BPF_JSGT, BPF_REG_2, BPF_REG_1, 1),

	BPF_MOV32_IMM(BPF_REG_1, 0),

	BPF_ALU32_IMM(BPF_LSH, BPF_REG_1, 2),

	BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),

	BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, offsetof(struct test_val, foo)),

	BPF_EXIT_INSN(),

	},

	.fixup_map_hash_48b = { 3 },

	.errstr_unpriv = "R0 leaks addr",

	.result_unpriv = REJECT,

	.result = ACCEPT,

	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,

},

{

	"invalid map access into an array with a constant",

	.insns = {

	BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),

	BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),

	BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),

	BPF_LD_MAP_FD(BPF_REG_1, 0),

	BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),

	BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),

	BPF_ST_MEM(BPF_DW, BPF_REG_0, (MAX_ENTRIES + 1) << 2,

		   offsetof(struct test_val, foo)),

	BPF_EXIT_INSN(),

	},

	.fixup_map_hash_48b = { 3 },

	.errstr = "invalid access to map value, value_size=48 off=48 size=8",

	.result = REJECT,

},

{

	"invalid map access into an array with a register",

	.insns = {

	BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),

	BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),

	BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),

	BPF_LD_MAP_FD(BPF_REG_1, 0),

	BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),

	BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),

	BPF_MOV64_IMM(BPF_REG_1, MAX_ENTRIES + 1),

	BPF_ALU64_IMM(BPF_LSH, BPF_REG_1, 2),

	BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),

	BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, offsetof(struct test_val, foo)),

	BPF_EXIT_INSN(),

	},

	.fixup_map_hash_48b = { 3 },

	.errstr = "R0 min value is outside of the array range",

	.result = REJECT,

	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,

},

{

	"invalid map access into an array with a variable",

	.insns = {

	BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),

	BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),

	BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),

	BPF_LD_MAP_FD(BPF_REG_1, 0),

	BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),

	BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),

	BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),

	BPF_ALU64_IMM(BPF_LSH, BPF_REG_1, 2),

	BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),

	BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, offsetof(struct test_val, foo)),

	BPF_EXIT_INSN(),

	},

	.fixup_map_hash_48b = { 3 },

	.errstr = "R0 unbounded memory access, make sure to bounds check any array access into a map",

	.result = REJECT,

	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,

},

{

	"invalid map access into an array with no floor check",

	.insns = {

	BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),

	BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),

	BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),

	BPF_LD_MAP_FD(BPF_REG_1, 0),

	BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),

	BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),

	BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0, 0),

	BPF_MOV32_IMM(BPF_REG_2, MAX_ENTRIES),

	BPF_JMP_REG(BPF_JSGT, BPF_REG_2, BPF_REG_1, 1),

	BPF_MOV32_IMM(BPF_REG_1, 0),

	BPF_ALU32_IMM(BPF_LSH, BPF_REG_1, 2),

	BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),

	BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, offsetof(struct test_val, foo)),

	BPF_EXIT_INSN(),

	},

	.fixup_map_hash_48b = { 3 },

	.errstr_unpriv = "R0 leaks addr",

	.errstr = "R0 unbounded memory access",

	.result_unpriv = REJECT,

	.result = REJECT,

	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,

},

{

	"invalid map access into an array with a invalid max check",

	.insns = {

	BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),

	BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),

	BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),

	BPF_LD_MAP_FD(BPF_REG_1, 0),

	BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),

	BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),

	BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),

	BPF_MOV32_IMM(BPF_REG_2, MAX_ENTRIES + 1),

	BPF_JMP_REG(BPF_JGT, BPF_REG_2, BPF_REG_1, 1),

	BPF_MOV32_IMM(BPF_REG_1, 0),

	BPF_ALU32_IMM(BPF_LSH, BPF_REG_1, 2),

	BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),

	BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, offsetof(struct test_val, foo)),

	BPF_EXIT_INSN(),

	},

	.fixup_map_hash_48b = { 3 },

	.errstr_unpriv = "R0 leaks addr",

	.errstr = "invalid access to map value, value_size=48 off=44 size=8",

	.result_unpriv = REJECT,

	.result = REJECT,

	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,

},

{

	"invalid map access into an array with a invalid max check",

	.insns = {

	BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),

	BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),

	BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),

	BPF_LD_MAP_FD(BPF_REG_1, 0),

	BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),

	BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 10),

	BPF_MOV64_REG(BPF_REG_8, BPF_REG_0),

	BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),

	BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),

	BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),

	BPF_LD_MAP_FD(BPF_REG_1, 0),

	BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),

	BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),

	BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_8),

	BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_0,

		    offsetof(struct test_val, foo)),

	BPF_EXIT_INSN(),

	},

	.fixup_map_hash_48b = { 3, 11 },

	.errstr = "R0 pointer += pointer",

	.result = REJECT,

	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,

},

tools/testing/selftests/bpf/verifier/basic.c

0 → 100644
+23 −0
Original line number Diff line number Diff line 
{

	"empty prog",

	.insns = {

	},

	.errstr = "unknown opcode 00",

	.result = REJECT,

},

{

	"only exit insn",

	.insns = {

	BPF_EXIT_INSN(),

	},

	.errstr = "R0 !read_ok",

	.result = REJECT,

},

{

	"no bpf_exit",

	.insns = {

	BPF_ALU64_REG(BPF_MOV, BPF_REG_0, BPF_REG_2),

	},

	.errstr = "not an exit",

	.result = REJECT,

},

tools/testing/selftests/bpf/verifier/basic_call.c

0 → 100644
+50 −0
Original line number Diff line number Diff line 
{

	"invalid call insn1",

	.insns = {

	BPF_RAW_INSN(BPF_JMP | BPF_CALL | BPF_X, 0, 0, 0, 0),

	BPF_EXIT_INSN(),

	},

	.errstr = "unknown opcode 8d",

	.result = REJECT,

},

{

	"invalid call insn2",

	.insns = {

	BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 1, 0),

	BPF_EXIT_INSN(),

	},

	.errstr = "BPF_CALL uses reserved",

	.result = REJECT,

},

{

	"invalid function call",

	.insns = {

	BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, 1234567),

	BPF_EXIT_INSN(),

	},

	.errstr = "invalid func unknown#1234567",

	.result = REJECT,

},

{

	"invalid argument register",

	.insns = {

	BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_get_cgroup_classid),

	BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_get_cgroup_classid),

	BPF_EXIT_INSN(),

	},

	.errstr = "R1 !read_ok",

	.result = REJECT,

	.prog_type = BPF_PROG_TYPE_SCHED_CLS,

},

{

	"non-invalid argument register",

	.insns = {

	BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_1),

	BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_get_cgroup_classid),

	BPF_ALU64_REG(BPF_MOV, BPF_REG_1, BPF_REG_6),

	BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_get_cgroup_classid),

	BPF_EXIT_INSN(),

	},

	.result = ACCEPT,

	.prog_type = BPF_PROG_TYPE_SCHED_CLS,

},

CRA Git | Maintained and supported by SUSTech CRA and CCSE