From: "Toke Høiland-Jørgensen" <toke@redhat.com>
To: Jakub Kicinski <kuba@kernel.org>
Cc: "David S. Miller" <davem@davemloft.net>,
Daniel Borkmann <daniel@iogearbox.net>,
Alexei Starovoitov <ast@kernel.org>,
Andrii Nakryiko <andriin@fb.com>, Martin KaFai Lau <kafai@fb.com>,
Song Liu <songliubraving@fb.com>, Yonghong Song <yhs@fb.com>,
John Fastabend <john.fastabend@gmail.com>,
KP Singh <kpsingh@chromium.org>,
Jesper Dangaard Brouer <hawk@kernel.org>,
"Michael S. Tsirkin" <mst@redhat.com>,
Romain Perier <romain.perier@gmail.com>,
Allen Pais <apais@linux.microsoft.com>,
Grygorii Strashko <grygorii.strashko@ti.com>,
Simon Horman <simon.horman@netronome.com>,
"Gustavo A. R. Silva" <gustavoars@kernel.org>,
Lorenzo Bianconi <lorenzo@kernel.org>,
Wei Yongjun <weiyongjun1@huawei.com>,
Jiri Benc <jbenc@redhat.com>,
oss-drivers@netronome.com, linux-omap@vger.kernel.org,
netdev@vger.kernel.org, bpf@vger.kernel.org
Subject: [PATCH bpf v4 3/7] netdevsim: Add debugfs toggle to reject BPF programs in verifier
Date: Wed, 09 Dec 2020 14:57:39 +0100 [thread overview]
Message-ID: <160752225964.110217.12584017165318065332.stgit@toke.dk> (raw)
In-Reply-To: <160752225643.110217.4104692937165406635.stgit@toke.dk>
From: Toke Høiland-Jørgensen <toke@redhat.com>
This adds a new debugfs toggle ('bpf_bind_verifier_accept') that can be
used to make netdevsim reject BPF programs from being accepted by the
verifier. If this toggle (which defaults to true) is set to false,
nsim_bpf_verify_insn() will return EOPNOTSUPP on the last
instruction (after outputting the 'Hello from netdevsim' verifier message).
This makes it possible to check the verification callback in the driver
from test_offload.py in selftests, since the verifier now clears the
verifier log on a successful load, hiding the message from the driver.
Fixes: 6f8a57ccf851 ("bpf: Make verifier log more relevant by default")
Acked-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Toke Høiland-Jørgensen <toke@redhat.com>
---
drivers/net/netdevsim/bpf.c | 12 ++++++++++--
drivers/net/netdevsim/netdevsim.h | 1 +
2 files changed, 11 insertions(+), 2 deletions(-)
diff --git a/drivers/net/netdevsim/bpf.c b/drivers/net/netdevsim/bpf.c
index 85546664bdd5..90aafb56f140 100644
--- a/drivers/net/netdevsim/bpf.c
+++ b/drivers/net/netdevsim/bpf.c
@@ -63,15 +63,20 @@ static int
nsim_bpf_verify_insn(struct bpf_verifier_env *env, int insn_idx, int prev_insn)
{
struct nsim_bpf_bound_prog *state;
+ int ret = 0;
state = env->prog->aux->offload->dev_priv;
if (state->nsim_dev->bpf_bind_verifier_delay && !insn_idx)
msleep(state->nsim_dev->bpf_bind_verifier_delay);
- if (insn_idx == env->prog->len - 1)
+ if (insn_idx == env->prog->len - 1) {
pr_vlog(env, "Hello from netdevsim!\n");
- return 0;
+ if (!state->nsim_dev->bpf_bind_verifier_accept)
+ ret = -EOPNOTSUPP;
+ }
+
+ return ret;
}
static int nsim_bpf_finalize(struct bpf_verifier_env *env)
@@ -595,6 +600,9 @@ int nsim_bpf_dev_init(struct nsim_dev *nsim_dev)
&nsim_dev->bpf_bind_accept);
debugfs_create_u32("bpf_bind_verifier_delay", 0600, nsim_dev->ddir,
&nsim_dev->bpf_bind_verifier_delay);
+ nsim_dev->bpf_bind_verifier_accept = true;
+ debugfs_create_bool("bpf_bind_verifier_accept", 0600, nsim_dev->ddir,
+ &nsim_dev->bpf_bind_verifier_accept);
return 0;
}
diff --git a/drivers/net/netdevsim/netdevsim.h b/drivers/net/netdevsim/netdevsim.h
index 827fc80f50a0..c4e7ad2a1964 100644
--- a/drivers/net/netdevsim/netdevsim.h
+++ b/drivers/net/netdevsim/netdevsim.h
@@ -189,6 +189,7 @@ struct nsim_dev {
struct dentry *take_snapshot;
struct bpf_offload_dev *bpf_dev;
bool bpf_bind_accept;
+ bool bpf_bind_verifier_accept;
u32 bpf_bind_verifier_delay;
struct dentry *ddir_bpf_bound_progs;
u32 prog_id_gen;
next prev parent reply other threads:[~2020-12-09 14:05 UTC|newest]
Thread overview: 11+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-12-09 13:57 [PATCH bpf v4 0/7] selftests/bpf: Restore test_offload.py to working order Toke Høiland-Jørgensen
2020-12-09 13:57 ` [PATCH bpf v4 1/7] xdp: remove the xdp_attachment_flags_ok() callback Toke Høiland-Jørgensen
2020-12-09 13:57 ` [PATCH bpf v4 2/7] selftests/bpf/test_offload.py: Remove check for program load flags match Toke Høiland-Jørgensen
2020-12-09 13:57 ` Toke Høiland-Jørgensen [this message]
2020-12-09 13:57 ` [PATCH bpf v4 4/7] selftests/bpf/test_offload.py: only check verifier log on verification fails Toke Høiland-Jørgensen
2020-12-09 13:57 ` [PATCH bpf v4 5/7] selftests/bpf/test_offload.py: fix expected case of extack messages Toke Høiland-Jørgensen
2020-12-09 13:57 ` [PATCH bpf v4 6/7] selftests/bpf/test_offload.py: reset ethtool features after failed setting Toke Høiland-Jørgensen
2020-12-09 13:57 ` [PATCH bpf v4 7/7] selftests/bpf/test_offload.py: filter bpftool internal map when counting maps Toke Høiland-Jørgensen
2020-12-09 15:40 ` [PATCH bpf v4 0/7] selftests/bpf: Restore test_offload.py to working order patchwork-bot+netdevbpf
2020-12-09 15:40 ` Daniel Borkmann
2020-12-09 16:35 ` Toke Høiland-Jørgensen
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=160752225964.110217.12584017165318065332.stgit@toke.dk \
--to=toke@redhat.com \
--cc=andriin@fb.com \
--cc=apais@linux.microsoft.com \
--cc=ast@kernel.org \
--cc=bpf@vger.kernel.org \
--cc=daniel@iogearbox.net \
--cc=davem@davemloft.net \
--cc=grygorii.strashko@ti.com \
--cc=gustavoars@kernel.org \
--cc=hawk@kernel.org \
--cc=jbenc@redhat.com \
--cc=john.fastabend@gmail.com \
--cc=kafai@fb.com \
--cc=kpsingh@chromium.org \
--cc=kuba@kernel.org \
--cc=linux-omap@vger.kernel.org \
--cc=lorenzo@kernel.org \
--cc=mst@redhat.com \
--cc=netdev@vger.kernel.org \
--cc=oss-drivers@netronome.com \
--cc=romain.perier@gmail.com \
--cc=simon.horman@netronome.com \
--cc=songliubraving@fb.com \
--cc=weiyongjun1@huawei.com \
--cc=yhs@fb.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).