selftests/bpf: add stack access precision test

Add a new selftests that validates precision tracking for stack access
instruction, using both r10-based and non-r10-based accesses. For
non-r10 ones we also make sure to have non-zero var_off to validate that
final stack offset is tracked properly in instruction history
information inside verifier.

Acked-by: Eduard Zingerman <eddyz87@gmail.com>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Link: https://lore.kernel.org/r/20231205184248.1502704-3-andrii@kernel.org
Signed-off-by: Alexei Starovoitov <ast@kernel.org>

diff --git a/tools/testing/selftests/bpf/progs/verifier_subprog_precision.c b/tools/testing/selftests/bpf/progs/verifier_subprog_precision.c
index eba98fab2f54513c2af43dd03cd827577c2f77c1..6f5d19665cf67d0478a6f978a3695d012b5f6df2 100644 (file)
--- a/tools/testing/selftests/bpf/progs/verifier_subprog_precision.c
+++ b/tools/testing/selftests/bpf/progs/verifier_subprog_precision.c
@@ -641,14 +641,68 @@ __naked int subprog_spill_into_parent_stack_slot_precise(void)
        );
 }
 
-__naked __noinline __used
-static __u64 subprog_with_checkpoint(void)
+SEC("?raw_tp")
+__success __log_level(2)
+__msg("17: (0f) r1 += r0")
+__msg("mark_precise: frame0: last_idx 17 first_idx 0 subseq_idx -1")
+__msg("mark_precise: frame0: regs=r0 stack= before 16: (bf) r1 = r7")
+__msg("mark_precise: frame0: regs=r0 stack= before 15: (27) r0 *= 4")
+__msg("mark_precise: frame0: regs=r0 stack= before 14: (79) r0 = *(u64 *)(r10 -16)")
+__msg("mark_precise: frame0: regs= stack=-16 before 13: (7b) *(u64 *)(r7 -8) = r0")
+__msg("mark_precise: frame0: regs=r0 stack= before 12: (79) r0 = *(u64 *)(r8 +16)")
+__msg("mark_precise: frame0: regs= stack=-16 before 11: (7b) *(u64 *)(r8 +16) = r0")
+__msg("mark_precise: frame0: regs=r0 stack= before 10: (79) r0 = *(u64 *)(r7 -8)")
+__msg("mark_precise: frame0: regs= stack=-16 before 9: (7b) *(u64 *)(r10 -16) = r0")
+__msg("mark_precise: frame0: regs=r0 stack= before 8: (07) r8 += -32")
+__msg("mark_precise: frame0: regs=r0 stack= before 7: (bf) r8 = r10")
+__msg("mark_precise: frame0: regs=r0 stack= before 6: (07) r7 += -8")
+__msg("mark_precise: frame0: regs=r0 stack= before 5: (bf) r7 = r10")
+__msg("mark_precise: frame0: regs=r0 stack= before 21: (95) exit")
+__msg("mark_precise: frame1: regs=r0 stack= before 20: (bf) r0 = r1")
+__msg("mark_precise: frame1: regs=r1 stack= before 4: (85) call pc+15")
+__msg("mark_precise: frame0: regs=r1 stack= before 3: (bf) r1 = r6")
+__msg("mark_precise: frame0: regs=r6 stack= before 2: (b7) r6 = 1")
+__naked int stack_slot_aliases_precision(void)
 {
        asm volatile (
-               "r0 = 0;"
-               /* guaranteed checkpoint if BPF_F_TEST_STATE_FREQ is used */
-               "goto +0;"
+               "r6 = 1;"
+               /* pass r6 through r1 into subprog to get it back as r0;
+                * this whole chain will have to be marked as precise later
+                */
+               "r1 = r6;"
+               "call identity_subprog;"
+               /* let's setup two registers that are aliased to r10 */
+               "r7 = r10;"
+               "r7 += -8;"                     /* r7 = r10 - 8 */
+               "r8 = r10;"
+               "r8 += -32;"                    /* r8 = r10 - 32 */
+               /* now spill subprog's return value (a r6 -> r1 -> r0 chain)
+                * a few times through different stack pointer regs, making
+                * sure to use r10, r7, and r8 both in LDX and STX insns, and
+                * *importantly* also using a combination of const var_off and
+                * insn->off to validate that we record final stack slot
+                * correctly, instead of relying on just insn->off derivation,
+                * which is only valid for r10-based stack offset
+                */
+               "*(u64 *)(r10 - 16) = r0;"
+               "r0 = *(u64 *)(r7 - 8);"        /* r7 - 8 == r10 - 16 */
+               "*(u64 *)(r8 + 16) = r0;"       /* r8 + 16 = r10 - 16 */
+               "r0 = *(u64 *)(r8 + 16);"
+               "*(u64 *)(r7 - 8) = r0;"
+               "r0 = *(u64 *)(r10 - 16);"
+               /* get ready to use r0 as an index into array to force precision */
+               "r0 *= 4;"
+               "r1 = %[vals];"
+               /* here r0->r1->r6 chain is forced to be precise and has to be
+                * propagated back to the beginning, including through the
+                * subprog call and all the stack spills and loads
+                */
+               "r1 += r0;"
+               "r0 = *(u32 *)(r1 + 0);"
                "exit;"
+               :
+               : __imm_ptr(vals)
+               : __clobber_common, "r6"
        );
 }