diff mbox series

[bpf,3/7] netdevsim: Add debugfs toggle to reject BPF programs in verifier

Message ID 160703132036.162669.7719186299991611592.stgit@toke.dk (mailing list archive)
State Superseded
Delegated to: BPF
Headers show
Series selftests/bpf: Restore test_offload.py to working order | expand

Checks

Context Check Description
netdev/cover_letter success Link
netdev/fixes_present fail Series targets non-next tree, but doesn't contain any Fixes tags
netdev/patch_count success Link
netdev/tree_selection success Clearly marked for bpf
netdev/subject_prefix success Link
netdev/source_inline success Was 0 now: 0
netdev/verify_signedoff success Link
netdev/module_param success Was 0 now: 0
netdev/build_32bit success Errors and warnings before: 0 this patch: 0
netdev/kdoc success Errors and warnings before: 0 this patch: 0
netdev/verify_fixes success Link
netdev/checkpatch success total: 0 errors, 0 warnings, 0 checks, 38 lines checked
netdev/build_allmodconfig_warn success Errors and warnings before: 0 this patch: 0
netdev/header_inline success Link
netdev/stable success Stable not CCed

Commit Message

Toke Høiland-Jørgensen Dec. 3, 2020, 9:35 p.m. UTC 
From: Toke Høiland-Jørgensen <toke@redhat.com>

This adds a new debugfs toggle ('bpf_bind_verifier_accept') that can be
used to make netdevsim reject BPF programs from being accepted by the
verifier. If this toggle (which defaults to true) is set to false,
nsim_bpf_verify_insn() will return EOPNOTSUPP on the last
instruction (after outputting the 'Hello from netdevsim' verifier message).

This makes it possible to check the verification callback in the driver
from test_offload.py in selftests, since the verifier now clears the
verifier log on a successful load, hiding the message from the driver.

Signed-off-by: Toke Høiland-Jørgensen <toke@redhat.com>
---
 drivers/net/netdevsim/bpf.c       |   12 ++++++++++--
 drivers/net/netdevsim/netdevsim.h |    1 +
 2 files changed, 11 insertions(+), 2 deletions(-)

Comments

Jakub Kicinski Dec. 4, 2020, 1:44 a.m. UTC | #1 
On Thu, 03 Dec 2020 22:35:20 +0100 Toke Høiland-Jørgensen wrote:
> diff --git a/drivers/net/netdevsim/netdevsim.h b/drivers/net/netdevsim/netdevsim.h
> index 827fc80f50a0..d1d329af3e61 100644
> --- a/drivers/net/netdevsim/netdevsim.h
> +++ b/drivers/net/netdevsim/netdevsim.h
> @@ -190,6 +190,7 @@ struct nsim_dev {
>  	struct bpf_offload_dev *bpf_dev;
>  	bool bpf_bind_accept;
>  	u32 bpf_bind_verifier_delay;
> +	bool bpf_bind_verifier_accept;
>  	struct dentry *ddir_bpf_bound_progs;

nit: if you respin please reorder the bpf_bind_verifier_* fields so
that the structure packs better.

Acked-by: Jakub Kicinski <kuba@kernel.org>

Thanks for fixing this test!
Toke Høiland-Jørgensen Dec. 4, 2020, 9:39 a.m. UTC | #2 
Jakub Kicinski <kuba@kernel.org> writes:

> On Thu, 03 Dec 2020 22:35:20 +0100 Toke Høiland-Jørgensen wrote:
>> diff --git a/drivers/net/netdevsim/netdevsim.h b/drivers/net/netdevsim/netdevsim.h
>> index 827fc80f50a0..d1d329af3e61 100644
>> --- a/drivers/net/netdevsim/netdevsim.h
>> +++ b/drivers/net/netdevsim/netdevsim.h
>> @@ -190,6 +190,7 @@ struct nsim_dev {
>>  	struct bpf_offload_dev *bpf_dev;
>>  	bool bpf_bind_accept;
>>  	u32 bpf_bind_verifier_delay;
>> +	bool bpf_bind_verifier_accept;
>>  	struct dentry *ddir_bpf_bound_progs;
>
> nit: if you respin please reorder the bpf_bind_verifier_* fields so
> that the structure packs better.

Ah, good point, will do!

> Acked-by: Jakub Kicinski <kuba@kernel.org>
>
> Thanks for fixing this test!

You're welcome :)

I'll see if I can't get our CI people to also run it regularly so we can
avoid it regressing again...

-Toke
diff mbox series

Patch

diff --git a/drivers/net/netdevsim/bpf.c b/drivers/net/netdevsim/bpf.c
index 85546664bdd5..90aafb56f140 100644
--- a/drivers/net/netdevsim/bpf.c
+++ b/drivers/net/netdevsim/bpf.c
@@ -63,15 +63,20 @@  static int
 nsim_bpf_verify_insn(struct bpf_verifier_env *env, int insn_idx, int prev_insn)
 {
 	struct nsim_bpf_bound_prog *state;
+	int ret = 0;
 
 	state = env->prog->aux->offload->dev_priv;
 	if (state->nsim_dev->bpf_bind_verifier_delay && !insn_idx)
 		msleep(state->nsim_dev->bpf_bind_verifier_delay);
 
-	if (insn_idx == env->prog->len - 1)
+	if (insn_idx == env->prog->len - 1) {
 		pr_vlog(env, "Hello from netdevsim!\n");
 
-	return 0;
+		if (!state->nsim_dev->bpf_bind_verifier_accept)
+			ret = -EOPNOTSUPP;
+	}
+
+	return ret;
 }
 
 static int nsim_bpf_finalize(struct bpf_verifier_env *env)
@@ -595,6 +600,9 @@  int nsim_bpf_dev_init(struct nsim_dev *nsim_dev)
 			    &nsim_dev->bpf_bind_accept);
 	debugfs_create_u32("bpf_bind_verifier_delay", 0600, nsim_dev->ddir,
 			   &nsim_dev->bpf_bind_verifier_delay);
+	nsim_dev->bpf_bind_verifier_accept = true;
+	debugfs_create_bool("bpf_bind_verifier_accept", 0600, nsim_dev->ddir,
+			    &nsim_dev->bpf_bind_verifier_accept);
 	return 0;
 }
 
diff --git a/drivers/net/netdevsim/netdevsim.h b/drivers/net/netdevsim/netdevsim.h
index 827fc80f50a0..d1d329af3e61 100644
--- a/drivers/net/netdevsim/netdevsim.h
+++ b/drivers/net/netdevsim/netdevsim.h
@@ -190,6 +190,7 @@  struct nsim_dev {
 	struct bpf_offload_dev *bpf_dev;
 	bool bpf_bind_accept;
 	u32 bpf_bind_verifier_delay;
+	bool bpf_bind_verifier_accept;
 	struct dentry *ddir_bpf_bound_progs;
 	u32 prog_id_gen;
 	struct list_head bpf_bound_progs;