diff mbox series

[bpf-next,v3,2/2] selftests/bpf: Add a selftest with not-8-byte aligned BPF_ST

Message ID 20240109040529.2314115-1-yonghong.song@linux.dev (mailing list archive)
State Superseded
Delegated to: BPF
Headers show
Series [bpf-next,v3,1/2] bpf: Track aligned st store as imprecise spilled registers | expand

Checks

Context Check Description
bpf/vmtest-bpf-next-PR success PR summary
bpf/vmtest-bpf-next-VM_Test-0 success Logs for Lint
bpf/vmtest-bpf-next-VM_Test-3 success Logs for Validate matrix.py
bpf/vmtest-bpf-next-VM_Test-1 success Logs for ShellCheck
bpf/vmtest-bpf-next-VM_Test-2 success Logs for Unittests
bpf/vmtest-bpf-next-VM_Test-5 success Logs for aarch64-gcc / build-release
netdev/series_format success Single patches do not need cover letters
netdev/tree_selection success Clearly marked for bpf-next
netdev/ynl success SINGLE THREAD; Generated files up to date; no warnings/errors; no diff in generated;
netdev/fixes_present success Fixes tag not required for -next series
netdev/header_inline success No static functions without inline keyword in header files
netdev/build_32bit success Errors and warnings before: 8 this patch: 8
netdev/cc_maintainers success CCed 0 of 0 maintainers
netdev/build_clang success Errors and warnings before: 8 this patch: 8
netdev/verify_signedoff success Signed-off-by tag matches author and committer
netdev/deprecated_api success None detected
netdev/check_selftest success No net selftest shell script
netdev/verify_fixes success No Fixes tag
netdev/build_allmodconfig_warn success Errors and warnings before: 8 this patch: 8
netdev/checkpatch warning CHECK: Lines should not end with a '(' WARNING: line length of 81 exceeds 80 columns WARNING: line length of 83 exceeds 80 columns
netdev/build_clang_rust success No Rust files in patch. Skipping build
netdev/kdoc success Errors and warnings before: 0 this patch: 0
netdev/source_inline success Was 0 now: 0
bpf/vmtest-bpf-next-VM_Test-7 success Logs for aarch64-gcc / test (test_progs, false, 360) / test_progs on aarch64 with gcc
bpf/vmtest-bpf-next-VM_Test-6 success Logs for aarch64-gcc / test (test_maps, false, 360) / test_maps on aarch64 with gcc
bpf/vmtest-bpf-next-VM_Test-12 success Logs for s390x-gcc / build-release
bpf/vmtest-bpf-next-VM_Test-10 success Logs for aarch64-gcc / veristat
bpf/vmtest-bpf-next-VM_Test-4 success Logs for aarch64-gcc / build / build for aarch64 with gcc
bpf/vmtest-bpf-next-VM_Test-8 success Logs for aarch64-gcc / test (test_progs_no_alu32, false, 360) / test_progs_no_alu32 on aarch64 with gcc
bpf/vmtest-bpf-next-VM_Test-9 success Logs for aarch64-gcc / test (test_verifier, false, 360) / test_verifier on aarch64 with gcc
bpf/vmtest-bpf-next-VM_Test-11 success Logs for s390x-gcc / build / build for s390x with gcc
bpf/vmtest-bpf-next-VM_Test-19 success Logs for x86_64-gcc / build / build for x86_64 with gcc
bpf/vmtest-bpf-next-VM_Test-21 success Logs for x86_64-gcc / test (test_maps, false, 360) / test_maps on x86_64 with gcc
bpf/vmtest-bpf-next-VM_Test-23 success Logs for x86_64-gcc / test (test_progs_no_alu32, false, 360) / test_progs_no_alu32 on x86_64 with gcc
bpf/vmtest-bpf-next-VM_Test-20 success Logs for x86_64-gcc / build-release
bpf/vmtest-bpf-next-VM_Test-31 success Logs for x86_64-llvm-17 / test (test_progs, false, 360) / test_progs on x86_64 with llvm-17
bpf/vmtest-bpf-next-VM_Test-18 success Logs for set-matrix
bpf/vmtest-bpf-next-VM_Test-29 success Logs for x86_64-llvm-17 / build-release / build for x86_64 with llvm-17 and -O2 optimization
bpf/vmtest-bpf-next-VM_Test-32 success Logs for x86_64-llvm-17 / test (test_progs_no_alu32, false, 360) / test_progs_no_alu32 on x86_64 with llvm-17
bpf/vmtest-bpf-next-VM_Test-33 success Logs for x86_64-llvm-17 / test (test_verifier, false, 360) / test_verifier on x86_64 with llvm-17
bpf/vmtest-bpf-next-VM_Test-24 success Logs for x86_64-gcc / test (test_progs_no_alu32_parallel, true, 30) / test_progs_no_alu32_parallel on x86_64 with gcc
bpf/vmtest-bpf-next-VM_Test-25 success Logs for x86_64-gcc / test (test_progs_parallel, true, 30) / test_progs_parallel on x86_64 with gcc
bpf/vmtest-bpf-next-VM_Test-26 success Logs for x86_64-gcc / test (test_verifier, false, 360) / test_verifier on x86_64 with gcc
bpf/vmtest-bpf-next-VM_Test-27 success Logs for x86_64-gcc / veristat / veristat on x86_64 with gcc
bpf/vmtest-bpf-next-VM_Test-17 success Logs for s390x-gcc / veristat
bpf/vmtest-bpf-next-VM_Test-42 success Logs for x86_64-llvm-18 / veristat
bpf/vmtest-bpf-next-VM_Test-40 success Logs for x86_64-llvm-18 / test (test_progs_no_alu32, false, 360) / test_progs_no_alu32 on x86_64 with llvm-18
bpf/vmtest-bpf-next-VM_Test-37 success Logs for x86_64-llvm-18 / test (test_maps, false, 360) / test_maps on x86_64 with llvm-18
bpf/vmtest-bpf-next-VM_Test-41 success Logs for x86_64-llvm-18 / test (test_verifier, false, 360) / test_verifier on x86_64 with llvm-18
bpf/vmtest-bpf-next-VM_Test-38 success Logs for x86_64-llvm-18 / test (test_progs, false, 360) / test_progs on x86_64 with llvm-18
bpf/vmtest-bpf-next-VM_Test-22 success Logs for x86_64-gcc / test (test_progs, false, 360) / test_progs on x86_64 with gcc
bpf/vmtest-bpf-next-VM_Test-28 success Logs for x86_64-llvm-17 / build / build for x86_64 with llvm-17
bpf/vmtest-bpf-next-VM_Test-30 success Logs for x86_64-llvm-17 / test (test_maps, false, 360) / test_maps on x86_64 with llvm-17
bpf/vmtest-bpf-next-VM_Test-36 success Logs for x86_64-llvm-18 / build-release / build for x86_64 with llvm-18 and -O2 optimization
bpf/vmtest-bpf-next-VM_Test-39 success Logs for x86_64-llvm-18 / test (test_progs_cpuv4, false, 360) / test_progs_cpuv4 on x86_64 with llvm-18
bpf/vmtest-bpf-next-VM_Test-34 success Logs for x86_64-llvm-17 / veristat
bpf/vmtest-bpf-next-VM_Test-35 success Logs for x86_64-llvm-18 / build / build for x86_64 with llvm-18
bpf/vmtest-bpf-next-VM_Test-16 success Logs for s390x-gcc / test (test_verifier, false, 360) / test_verifier on s390x with gcc
bpf/vmtest-bpf-next-VM_Test-15 success Logs for s390x-gcc / test (test_progs_no_alu32, false, 360) / test_progs_no_alu32 on s390x with gcc
bpf/vmtest-bpf-next-VM_Test-14 success Logs for s390x-gcc / test (test_progs, false, 360) / test_progs on s390x with gcc
bpf/vmtest-bpf-next-VM_Test-13 success Logs for s390x-gcc / test (test_maps, false, 360) / test_maps on s390x with gcc

Commit Message

Yonghong Song Jan. 9, 2024, 4:05 a.m. UTC 
Add a selftest with a 4 bytes BPF_ST of 0 where the store is not
8-byte aligned. The goal is to ensure that STACK_ZERO is properly
marked for the spill and the STACK_ZERO value can propagate
properly during the load.

Signed-off-by: Yonghong Song <yonghong.song@linux.dev>
---
 .../selftests/bpf/progs/verifier_spill_fill.c | 44 +++++++++++++++++++
 1 file changed, 44 insertions(+)

Comments

Andrii Nakryiko Jan. 9, 2024, 10:47 p.m. UTC | #1 
On Mon, Jan 8, 2024 at 8:05 PM Yonghong Song <yonghong.song@linux.dev> wrote:
>
> Add a selftest with a 4 bytes BPF_ST of 0 where the store is not
> 8-byte aligned. The goal is to ensure that STACK_ZERO is properly
> marked for the spill and the STACK_ZERO value can propagate
> properly during the load.
>
> Signed-off-by: Yonghong Song <yonghong.song@linux.dev>
> ---
>  .../selftests/bpf/progs/verifier_spill_fill.c | 44 +++++++++++++++++++
>  1 file changed, 44 insertions(+)
>
> diff --git a/tools/testing/selftests/bpf/progs/verifier_spill_fill.c b/tools/testing/selftests/bpf/progs/verifier_spill_fill.c
> index d4b3188afe07..6017b26d957d 100644
> --- a/tools/testing/selftests/bpf/progs/verifier_spill_fill.c
> +++ b/tools/testing/selftests/bpf/progs/verifier_spill_fill.c
> @@ -583,6 +583,50 @@ __naked void partial_stack_load_preserves_zeros(void)
>         : __clobber_common);
>  }
>
> +SEC("raw_tp")
> +__log_level(2)
> +__success
> +/* fp-4 is STACK_ZERO */
> +__msg("2: (62) *(u32 *)(r10 -4) = 0          ; R10=fp0 fp-8=0000????")
> +/* validate that assigning R2 from STACK_ZERO with zero value doesn't mark register
> + * precise immediately; if necessary, it will be marked precise later
> + */

this comment is not accurate in this test, this unaligned write
doesn't preserve register and writes STACK_ZERO, so there is no
precision going on here, right?

Other than that LGTM

Acked-by: Andrii Nakryiko <andrii@kernel.org>

> +__msg("4: (71) r2 = *(u8 *)(r10 -1)          ; R2_w=0 R10=fp0 fp-8=0000????")
> +__msg("5: (0f) r1 += r2")
> +__msg("mark_precise: frame0: last_idx 5 first_idx 0 subseq_idx -1")
> +__msg("mark_precise: frame0: regs=r2 stack= before 4: (71) r2 = *(u8 *)(r10 -1)")
> +__naked void partial_stack_load_preserves_partial_zeros(void)
> +{
> +       asm volatile (
> +               /* fp-4 is value zero */
> +               ".8byte %[fp4_st_zero];" /* LLVM-18+: *(u32 *)(r10 -4) = 0; */
> +
> +               /* load single U8 from non-aligned stack zero slot */
> +               "r1 = %[single_byte_buf];"
> +               "r2 = *(u8 *)(r10 -1);"
> +               "r1 += r2;"
> +               "*(u8 *)(r1 + 0) = r2;" /* this should be fine */
> +
> +               /* load single U16 from non-aligned stack zero slot */
> +               "r1 = %[single_byte_buf];"
> +               "r2 = *(u16 *)(r10 -2);"
> +               "r1 += r2;"
> +               "*(u8 *)(r1 + 0) = r2;" /* this should be fine */
> +
> +               /* load single U32 from non-aligned stack zero slot */
> +               "r1 = %[single_byte_buf];"
> +               "r2 = *(u32 *)(r10 -4);"
> +               "r1 += r2;"
> +               "*(u8 *)(r1 + 0) = r2;" /* this should be fine */
> +
> +               "r0 = 0;"
> +               "exit;"
> +       :
> +       : __imm_ptr(single_byte_buf),
> +         __imm_insn(fp4_st_zero, BPF_ST_MEM(BPF_W, BPF_REG_FP, -4, 0))
> +       : __clobber_common);
> +}
> +
>  char two_byte_buf[2] SEC(".data.two_byte_buf");
>
>  SEC("raw_tp")
> --
> 2.34.1
>
Yonghong Song Jan. 10, 2024, 4:29 a.m. UTC | #2 
On 1/9/24 2:47 PM, Andrii Nakryiko wrote:
> On Mon, Jan 8, 2024 at 8:05 PM Yonghong Song <yonghong.song@linux.dev> wrote:
>> Add a selftest with a 4 bytes BPF_ST of 0 where the store is not
>> 8-byte aligned. The goal is to ensure that STACK_ZERO is properly
>> marked for the spill and the STACK_ZERO value can propagate
>> properly during the load.
>>
>> Signed-off-by: Yonghong Song <yonghong.song@linux.dev>
>> ---
>>   .../selftests/bpf/progs/verifier_spill_fill.c | 44 +++++++++++++++++++
>>   1 file changed, 44 insertions(+)
>>
>> diff --git a/tools/testing/selftests/bpf/progs/verifier_spill_fill.c b/tools/testing/selftests/bpf/progs/verifier_spill_fill.c
>> index d4b3188afe07..6017b26d957d 100644
>> --- a/tools/testing/selftests/bpf/progs/verifier_spill_fill.c
>> +++ b/tools/testing/selftests/bpf/progs/verifier_spill_fill.c
>> @@ -583,6 +583,50 @@ __naked void partial_stack_load_preserves_zeros(void)
>>          : __clobber_common);
>>   }
>>
>> +SEC("raw_tp")
>> +__log_level(2)
>> +__success
>> +/* fp-4 is STACK_ZERO */
>> +__msg("2: (62) *(u32 *)(r10 -4) = 0          ; R10=fp0 fp-8=0000????")
>> +/* validate that assigning R2 from STACK_ZERO with zero value doesn't mark register
>> + * precise immediately; if necessary, it will be marked precise later
>> + */
> this comment is not accurate in this test, this unaligned write
> doesn't preserve register and writes STACK_ZERO, so there is no
> precision going on here, right?

I checked the source code again in check_stack_write_fixed_off() and
backtrack_insn(). Indeed, check_stack_write_fixed_off() assigned
STACK_ZERO to the stack slot and with imm = 0 and value_regno = -1
mark_chain_precision() will be an nop. Also, in backtrack_insn()
load with STACK_ZERO will stop the backtracking.

Will remove the above comments.

>
> Other than that LGTM
>
> Acked-by: Andrii Nakryiko <andrii@kernel.org>
>
>> +__msg("4: (71) r2 = *(u8 *)(r10 -1)          ; R2_w=0 R10=fp0 fp-8=0000????")
>> +__msg("5: (0f) r1 += r2")
>> +__msg("mark_precise: frame0: last_idx 5 first_idx 0 subseq_idx -1")
>> +__msg("mark_precise: frame0: regs=r2 stack= before 4: (71) r2 = *(u8 *)(r10 -1)")
>> +__naked void partial_stack_load_preserves_partial_zeros(void)
>> +{
>> +       asm volatile (
>> +               /* fp-4 is value zero */
>> +               ".8byte %[fp4_st_zero];" /* LLVM-18+: *(u32 *)(r10 -4) = 0; */
>> +
>> +               /* load single U8 from non-aligned stack zero slot */
>> +               "r1 = %[single_byte_buf];"
>> +               "r2 = *(u8 *)(r10 -1);"
>> +               "r1 += r2;"
>> +               "*(u8 *)(r1 + 0) = r2;" /* this should be fine */
>> +
>> +               /* load single U16 from non-aligned stack zero slot */
>> +               "r1 = %[single_byte_buf];"
>> +               "r2 = *(u16 *)(r10 -2);"
>> +               "r1 += r2;"
>> +               "*(u8 *)(r1 + 0) = r2;" /* this should be fine */
>> +
>> +               /* load single U32 from non-aligned stack zero slot */
>> +               "r1 = %[single_byte_buf];"
>> +               "r2 = *(u32 *)(r10 -4);"
>> +               "r1 += r2;"
>> +               "*(u8 *)(r1 + 0) = r2;" /* this should be fine */
>> +
>> +               "r0 = 0;"
>> +               "exit;"
>> +       :
>> +       : __imm_ptr(single_byte_buf),
>> +         __imm_insn(fp4_st_zero, BPF_ST_MEM(BPF_W, BPF_REG_FP, -4, 0))
>> +       : __clobber_common);
>> +}
>> +
>>   char two_byte_buf[2] SEC(".data.two_byte_buf");
>>
>>   SEC("raw_tp")
>> --
>> 2.34.1
>>
diff mbox series

Patch

diff --git a/tools/testing/selftests/bpf/progs/verifier_spill_fill.c b/tools/testing/selftests/bpf/progs/verifier_spill_fill.c
index d4b3188afe07..6017b26d957d 100644
--- a/tools/testing/selftests/bpf/progs/verifier_spill_fill.c
+++ b/tools/testing/selftests/bpf/progs/verifier_spill_fill.c
@@ -583,6 +583,50 @@  __naked void partial_stack_load_preserves_zeros(void)
 	: __clobber_common);
 }
 
+SEC("raw_tp")
+__log_level(2)
+__success
+/* fp-4 is STACK_ZERO */
+__msg("2: (62) *(u32 *)(r10 -4) = 0          ; R10=fp0 fp-8=0000????")
+/* validate that assigning R2 from STACK_ZERO with zero value doesn't mark register
+ * precise immediately; if necessary, it will be marked precise later
+ */
+__msg("4: (71) r2 = *(u8 *)(r10 -1)          ; R2_w=0 R10=fp0 fp-8=0000????")
+__msg("5: (0f) r1 += r2")
+__msg("mark_precise: frame0: last_idx 5 first_idx 0 subseq_idx -1")
+__msg("mark_precise: frame0: regs=r2 stack= before 4: (71) r2 = *(u8 *)(r10 -1)")
+__naked void partial_stack_load_preserves_partial_zeros(void)
+{
+	asm volatile (
+		/* fp-4 is value zero */
+		".8byte %[fp4_st_zero];" /* LLVM-18+: *(u32 *)(r10 -4) = 0; */
+
+		/* load single U8 from non-aligned stack zero slot */
+		"r1 = %[single_byte_buf];"
+		"r2 = *(u8 *)(r10 -1);"
+		"r1 += r2;"
+		"*(u8 *)(r1 + 0) = r2;" /* this should be fine */
+
+		/* load single U16 from non-aligned stack zero slot */
+		"r1 = %[single_byte_buf];"
+		"r2 = *(u16 *)(r10 -2);"
+		"r1 += r2;"
+		"*(u8 *)(r1 + 0) = r2;" /* this should be fine */
+
+		/* load single U32 from non-aligned stack zero slot */
+		"r1 = %[single_byte_buf];"
+		"r2 = *(u32 *)(r10 -4);"
+		"r1 += r2;"
+		"*(u8 *)(r1 + 0) = r2;" /* this should be fine */
+
+		"r0 = 0;"
+		"exit;"
+	:
+	: __imm_ptr(single_byte_buf),
+	  __imm_insn(fp4_st_zero, BPF_ST_MEM(BPF_W, BPF_REG_FP, -4, 0))
+	: __clobber_common);
+}
+
 char two_byte_buf[2] SEC(".data.two_byte_buf");
 
 SEC("raw_tp")