Commit 7c0c6095 authored by Alexei Starovoitov's avatar Alexei Starovoitov Committed by Daniel Borkmann
Browse files

selftests/bpf: adjust verifier scale test 



Adjust scale tests to check for new jmp sequence limit.

BPF_JGT had to be changed to BPF_JEQ because the verifier was
too smart. It tracked the known safe range of R0 values
and pruned the search earlier before hitting exact 8192 limit.
bpf_semi_rand_get() was too (un)?lucky.

k = 0; was missing in bpf_fill_scale2.
It was testing a bit shorter sequence of jumps than intended.

Signed-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
Acked-by: default avatarAndrii Nakryiko <andriin@fb.com>
Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
parent b285fcb7

tools/testing/selftests/bpf/test_verifier.c

+17 −14
Original line number Diff line number Diff line
@@ -210,33 +210,35 @@ static void bpf_fill_rand_ld_dw(struct bpf_test *self) 
	self->retval = (uint32_t)res;

}



/* test the sequence of 1k jumps */

#define MAX_JMP_SEQ 8192



/* test the sequence of 8k jumps */

static void bpf_fill_scale1(struct bpf_test *self)

{

	struct bpf_insn *insn = self->fill_insns;

	int i = 0, k = 0;



	insn[i++] = BPF_MOV64_REG(BPF_REG_6, BPF_REG_1);

	/* test to check that the sequence of 1024 jumps is acceptable */

	while (k++ < 1024) {

	/* test to check that the long sequence of jumps is acceptable */

	while (k++ < MAX_JMP_SEQ) {

		insn[i++] = BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,

					 BPF_FUNC_get_prandom_u32);

		insn[i++] = BPF_JMP_IMM(BPF_JGT, BPF_REG_0, bpf_semi_rand_get(), 2);

		insn[i++] = BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, bpf_semi_rand_get(), 2);

		insn[i++] = BPF_MOV64_REG(BPF_REG_1, BPF_REG_10);

		insn[i++] = BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_6,

					-8 * (k % 64 + 1));

	}

	/* every jump adds 1024 steps to insn_processed, so to stay exactly

	 * within 1m limit add MAX_TEST_INSNS - 1025 MOVs and 1 EXIT

	/* every jump adds 1 step to insn_processed, so to stay exactly

	 * within 1m limit add MAX_TEST_INSNS - MAX_JMP_SEQ - 1 MOVs and 1 EXIT

	 */

	while (i < MAX_TEST_INSNS - 1025)

	while (i < MAX_TEST_INSNS - MAX_JMP_SEQ - 1)

		insn[i++] = BPF_ALU32_IMM(BPF_MOV, BPF_REG_0, 42);

	insn[i] = BPF_EXIT_INSN();

	self->prog_len = i + 1;

	self->retval = 42;

}



/* test the sequence of 1k jumps in inner most function (function depth 8)*/

/* test the sequence of 8k jumps in inner most function (function depth 8)*/

static void bpf_fill_scale2(struct bpf_test *self)

{

	struct bpf_insn *insn = self->fill_insns;
@@ -248,19 +250,20 @@ static void bpf_fill_scale2(struct bpf_test *self) 
		insn[i++] = BPF_EXIT_INSN();

	}

	insn[i++] = BPF_MOV64_REG(BPF_REG_6, BPF_REG_1);

	/* test to check that the sequence of 1024 jumps is acceptable */

	while (k++ < 1024) {

	/* test to check that the long sequence of jumps is acceptable */

	k = 0;

	while (k++ < MAX_JMP_SEQ) {

		insn[i++] = BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,

					 BPF_FUNC_get_prandom_u32);

		insn[i++] = BPF_JMP_IMM(BPF_JGT, BPF_REG_0, bpf_semi_rand_get(), 2);

		insn[i++] = BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, bpf_semi_rand_get(), 2);

		insn[i++] = BPF_MOV64_REG(BPF_REG_1, BPF_REG_10);

		insn[i++] = BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_6,

					-8 * (k % (64 - 4 * FUNC_NEST) + 1));

	}

	/* every jump adds 1024 steps to insn_processed, so to stay exactly

	 * within 1m limit add MAX_TEST_INSNS - 1025 MOVs and 1 EXIT

	/* every jump adds 1 step to insn_processed, so to stay exactly

	 * within 1m limit add MAX_TEST_INSNS - MAX_JMP_SEQ - 1 MOVs and 1 EXIT

	 */

	while (i < MAX_TEST_INSNS - 1025)

	while (i < MAX_TEST_INSNS - MAX_JMP_SEQ - 1)

		insn[i++] = BPF_ALU32_IMM(BPF_MOV, BPF_REG_0, 42);

	insn[i] = BPF_EXIT_INSN();

	self->prog_len = i + 1;

CRA Git | Maintained and supported by SUSTech CRA and CCSE