If CONFIG_BPF_JIT_ALWAYS_ON is not set and bpf_jit_enable is 0, there
exist 6 failed tests.
[root@linux bpf]# echo 0 > /proc/sys/net/core/bpf_jit_enable
[root@linux bpf]# echo 0 > /proc/sys/kernel/unprivileged_bpf_disabled
[root@linux bpf]# ./test_verifier | grep FAIL
#106/p inline simple bpf_loop call FAIL
#107/p don't inline bpf_loop call, flags non-zero FAIL
#108/p don't inline bpf_loop call, callback non-constant FAIL
#109/p bpf_loop_inline and a dead func FAIL
#110/p bpf_loop_inline stack locations for loop vars FAIL
#111/p inline bpf_loop call in a big program FAIL
Summary: 768 PASSED, 15 SKIPPED, 6 FAILED
The test log shows that callbacks are not allowed in non-JITed programs,
interpreter doesn't support them yet, thus these tests should be skipped
if jit is disabled, just handle this case in do_test_single().
With this patch:
[root@linux bpf]# echo 0 > /proc/sys/net/core/bpf_jit_enable
[root@linux bpf]# echo 0 > /proc/sys/kernel/unprivileged_bpf_disabled
[root@linux bpf]# ./test_verifier | grep FAIL
Summary: 768 PASSED, 21 SKIPPED, 0 FAILED
Signed-off-by: Tiezhu Yang <yangtiezhu@loongson.cn>
Acked-by: Hou Tao <houtao1@huawei.com>
Acked-by: Song Liu <song@kernel.org>
---
tools/testing/selftests/bpf/test_verifier.c | 13 +++++++++++++
1 file changed, 13 insertions(+)
diff --git a/tools/testing/selftests/bpf/test_verifier.c b/tools/testing/selftests/bpf/test_verifier.c
index 1a09fc34d093..cf05448cfe13 100644
--- a/tools/testing/selftests/bpf/test_verifier.c
+++ b/tools/testing/selftests/bpf/test_verifier.c
@@ -74,6 +74,7 @@
1ULL << CAP_BPF)
#define UNPRIV_SYSCTL "kernel/unprivileged_bpf_disabled"
static bool unpriv_disabled = false;
+static bool jit_disabled;
static int skips;
static bool verbose = false;
static int verif_log_level = 0;
@@ -1622,6 +1623,16 @@ static void do_test_single(struct bpf_test *test, bool unpriv,
alignment_prevented_execution = 0;
if (expected_ret == ACCEPT || expected_ret == VERBOSE_ACCEPT) {
+ if (fd_prog < 0 && saved_errno == EINVAL && jit_disabled) {
+ for (i = 0; i < prog_len; i++, prog++) {
+ if (!insn_is_pseudo_func(prog))
+ continue;
+ printf("SKIP (callbacks are not allowed in non-JITed programs)\n");
+ skips++;
+ goto close_fds;
+ }
+ }
+
if (fd_prog < 0) {
printf("FAIL\nFailed to load prog '%s'!\n",
strerror(saved_errno));
@@ -1844,6 +1855,8 @@ int main(int argc, char **argv)
return EXIT_FAILURE;
}
+ jit_disabled = !is_jit_enabled();
+
/* Use libbpf 1.0 API mode */
libbpf_set_strict_mode(LIBBPF_STRICT_ALL);
--
2.42.0On Sun, Jan 21, 2024 at 11:57 PM Tiezhu Yang <yangtiezhu@loongson.cn> wrote:
>
> If CONFIG_BPF_JIT_ALWAYS_ON is not set and bpf_jit_enable is 0, there
> exist 6 failed tests.
>
> [root@linux bpf]# echo 0 > /proc/sys/net/core/bpf_jit_enable
> [root@linux bpf]# echo 0 > /proc/sys/kernel/unprivileged_bpf_disabled
> [root@linux bpf]# ./test_verifier | grep FAIL
> #106/p inline simple bpf_loop call FAIL
> #107/p don't inline bpf_loop call, flags non-zero FAIL
> #108/p don't inline bpf_loop call, callback non-constant FAIL
> #109/p bpf_loop_inline and a dead func FAIL
> #110/p bpf_loop_inline stack locations for loop vars FAIL
> #111/p inline bpf_loop call in a big program FAIL
> Summary: 768 PASSED, 15 SKIPPED, 6 FAILED
>
> The test log shows that callbacks are not allowed in non-JITed programs,
> interpreter doesn't support them yet, thus these tests should be skipped
> if jit is disabled, just handle this case in do_test_single().
>
> With this patch:
>
> [root@linux bpf]# echo 0 > /proc/sys/net/core/bpf_jit_enable
> [root@linux bpf]# echo 0 > /proc/sys/kernel/unprivileged_bpf_disabled
> [root@linux bpf]# ./test_verifier | grep FAIL
> Summary: 768 PASSED, 21 SKIPPED, 0 FAILED
>
> Signed-off-by: Tiezhu Yang <yangtiezhu@loongson.cn>
> Acked-by: Hou Tao <houtao1@huawei.com>
> Acked-by: Song Liu <song@kernel.org>
> ---
> tools/testing/selftests/bpf/test_verifier.c | 13 +++++++++++++
> 1 file changed, 13 insertions(+)
>
> diff --git a/tools/testing/selftests/bpf/test_verifier.c b/tools/testing/selftests/bpf/test_verifier.c
> index 1a09fc34d093..cf05448cfe13 100644
> --- a/tools/testing/selftests/bpf/test_verifier.c
> +++ b/tools/testing/selftests/bpf/test_verifier.c
> @@ -74,6 +74,7 @@
> 1ULL << CAP_BPF)
> #define UNPRIV_SYSCTL "kernel/unprivileged_bpf_disabled"
> static bool unpriv_disabled = false;
> +static bool jit_disabled;
> static int skips;
> static bool verbose = false;
> static int verif_log_level = 0;
> @@ -1622,6 +1623,16 @@ static void do_test_single(struct bpf_test *test, bool unpriv,
> alignment_prevented_execution = 0;
>
> if (expected_ret == ACCEPT || expected_ret == VERBOSE_ACCEPT) {
> + if (fd_prog < 0 && saved_errno == EINVAL && jit_disabled) {
> + for (i = 0; i < prog_len; i++, prog++) {
> + if (!insn_is_pseudo_func(prog))
> + continue;
> + printf("SKIP (callbacks are not allowed in non-JITed programs)\n");
> + skips++;
> + goto close_fds;
> + }
> + }
Wouldn't it be better to add an explicit flag to those tests to mark
that they require JIT enabled, instead of trying to derive this from
analysing their BPF instructions?
> +
> if (fd_prog < 0) {
> printf("FAIL\nFailed to load prog '%s'!\n",
> strerror(saved_errno));
> @@ -1844,6 +1855,8 @@ int main(int argc, char **argv)
> return EXIT_FAILURE;
> }
>
> + jit_disabled = !is_jit_enabled();
> +
> /* Use libbpf 1.0 API mode */
> libbpf_set_strict_mode(LIBBPF_STRICT_ALL);
>
> --
> 2.42.0
>
On 01/23/2024 09:08 AM, Andrii Nakryiko wrote:
> On Sun, Jan 21, 2024 at 11:57 PM Tiezhu Yang <yangtiezhu@loongson.cn> wrote:
>>
>> If CONFIG_BPF_JIT_ALWAYS_ON is not set and bpf_jit_enable is 0, there
>> exist 6 failed tests.
...
>> if (expected_ret == ACCEPT || expected_ret == VERBOSE_ACCEPT) {
>> + if (fd_prog < 0 && saved_errno == EINVAL && jit_disabled) {
>> + for (i = 0; i < prog_len; i++, prog++) {
>> + if (!insn_is_pseudo_func(prog))
>> + continue;
>> + printf("SKIP (callbacks are not allowed in non-JITed programs)\n");
>> + skips++;
>> + goto close_fds;
>> + }
>> + }
>
> Wouldn't it be better to add an explicit flag to those tests to mark
> that they require JIT enabled, instead of trying to derive this from
> analysing their BPF instructions?
Maybe something like this, add test flag F_NEEDS_JIT_ENABLED in
bpf_loop_inline.c, check the flag and jit_disabled at the beginning
of do_test_single(), no need to check fd_prog, saved_errno and the other
conditions, the patch #2 can be removed too.
If you are OK with the following changes, I will send v7 later.
----->8-----
diff --git a/tools/testing/selftests/bpf/test_verifier.c
b/tools/testing/selftests/bpf/test_verifier.c
index 1a09fc34d093..c65915188d7c 100644
--- a/tools/testing/selftests/bpf/test_verifier.c
+++ b/tools/testing/selftests/bpf/test_verifier.c
@@ -67,6 +67,7 @@
#define F_NEEDS_EFFICIENT_UNALIGNED_ACCESS (1 << 0)
#define F_LOAD_WITH_STRICT_ALIGNMENT (1 << 1)
+#define F_NEEDS_JIT_ENABLED (1 << 2)
/* need CAP_BPF, CAP_NET_ADMIN, CAP_PERFMON to load progs */
#define ADMIN_CAPS (1ULL << CAP_NET_ADMIN | \
@@ -74,6 +75,7 @@
1ULL << CAP_BPF)
#define UNPRIV_SYSCTL "kernel/unprivileged_bpf_disabled"
static bool unpriv_disabled = false;
+static bool jit_disabled;
static int skips;
static bool verbose = false;
static int verif_log_level = 0;
@@ -1524,6 +1526,13 @@ static void do_test_single(struct bpf_test *test,
bool unpriv,
__u32 pflags;
int i, err;
+ if ((test->flags & F_NEEDS_JIT_ENABLED) && jit_disabled) {
+ printf("SKIP (callbacks are not allowed in non-JITed
programs)\n");
+ skips++;
+ sched_yield();
+ return;
+ }
+
fd_prog = -1;
for (i = 0; i < MAX_NR_MAPS; i++)
map_fds[i] = -1;
@@ -1844,6 +1853,8 @@ int main(int argc, char **argv)
return EXIT_FAILURE;
}
+ jit_disabled = !is_jit_enabled();
+
/* Use libbpf 1.0 API mode */
libbpf_set_strict_mode(LIBBPF_STRICT_ALL);
diff --git a/tools/testing/selftests/bpf/verifier/bpf_loop_inline.c
b/tools/testing/selftests/bpf/verifier/bpf_loop_inline.c
index a535d41dc20d..59125b22ae39 100644
--- a/tools/testing/selftests/bpf/verifier/bpf_loop_inline.c
+++ b/tools/testing/selftests/bpf/verifier/bpf_loop_inline.c
@@ -57,6 +57,7 @@
.expected_insns = { PSEUDO_CALL_INSN() },
.unexpected_insns = { HELPER_CALL_INSN() },
.prog_type = BPF_PROG_TYPE_TRACEPOINT,
+ .flags = F_NEEDS_JIT_ENABLED,
.result = ACCEPT,
.runs = 0,
.func_info = { { 0, MAIN_TYPE }, { 12, CALLBACK_TYPE } },
@@ -90,6 +91,7 @@
.expected_insns = { HELPER_CALL_INSN() },
.unexpected_insns = { PSEUDO_CALL_INSN() },
.prog_type = BPF_PROG_TYPE_TRACEPOINT,
+ .flags = F_NEEDS_JIT_ENABLED,
.result = ACCEPT,
.runs = 0,
.func_info = { { 0, MAIN_TYPE }, { 16, CALLBACK_TYPE } },
@@ -127,6 +129,7 @@
.expected_insns = { HELPER_CALL_INSN() },
.unexpected_insns = { PSEUDO_CALL_INSN() },
.prog_type = BPF_PROG_TYPE_TRACEPOINT,
+ .flags = F_NEEDS_JIT_ENABLED,
.result = ACCEPT,
.runs = 0,
.func_info = {
@@ -165,6 +168,7 @@
.expected_insns = { PSEUDO_CALL_INSN() },
.unexpected_insns = { HELPER_CALL_INSN() },
.prog_type = BPF_PROG_TYPE_TRACEPOINT,
+ .flags = F_NEEDS_JIT_ENABLED,
.result = ACCEPT,
.runs = 0,
.func_info = {
@@ -235,6 +239,7 @@
},
.unexpected_insns = { HELPER_CALL_INSN() },
.prog_type = BPF_PROG_TYPE_TRACEPOINT,
+ .flags = F_NEEDS_JIT_ENABLED,
.result = ACCEPT,
.func_info = {
{ 0, MAIN_TYPE },
@@ -252,6 +257,7 @@
.unexpected_insns = { HELPER_CALL_INSN() },
.result = ACCEPT,
.prog_type = BPF_PROG_TYPE_TRACEPOINT,
+ .flags = F_NEEDS_JIT_ENABLED,
.func_info = { { 0, MAIN_TYPE }, { 16, CALLBACK_TYPE } },
.func_info_cnt = 2,
BTF_TYPES
Thanks,
Tiezhu
On Mon, Jan 22, 2024 at 7:35 PM Tiezhu Yang <yangtiezhu@loongson.cn> wrote:
>
>
>
> On 01/23/2024 09:08 AM, Andrii Nakryiko wrote:
> > On Sun, Jan 21, 2024 at 11:57 PM Tiezhu Yang <yangtiezhu@loongson.cn> wrote:
> >>
> >> If CONFIG_BPF_JIT_ALWAYS_ON is not set and bpf_jit_enable is 0, there
> >> exist 6 failed tests.
>
> ...
>
> >> if (expected_ret == ACCEPT || expected_ret == VERBOSE_ACCEPT) {
> >> + if (fd_prog < 0 && saved_errno == EINVAL && jit_disabled) {
> >> + for (i = 0; i < prog_len; i++, prog++) {
> >> + if (!insn_is_pseudo_func(prog))
> >> + continue;
> >> + printf("SKIP (callbacks are not allowed in non-JITed programs)\n");
> >> + skips++;
> >> + goto close_fds;
> >> + }
> >> + }
> >
> > Wouldn't it be better to add an explicit flag to those tests to mark
> > that they require JIT enabled, instead of trying to derive this from
> > analysing their BPF instructions?
>
> Maybe something like this, add test flag F_NEEDS_JIT_ENABLED in
> bpf_loop_inline.c, check the flag and jit_disabled at the beginning
> of do_test_single(), no need to check fd_prog, saved_errno and the other
> conditions, the patch #2 can be removed too.
>
> If you are OK with the following changes, I will send v7 later.
>
Yes, I think this approach is much better, thanks.
> ----->8-----
>
> diff --git a/tools/testing/selftests/bpf/test_verifier.c
> b/tools/testing/selftests/bpf/test_verifier.c
> index 1a09fc34d093..c65915188d7c 100644
> --- a/tools/testing/selftests/bpf/test_verifier.c
> +++ b/tools/testing/selftests/bpf/test_verifier.c
> @@ -67,6 +67,7 @@
>
> #define F_NEEDS_EFFICIENT_UNALIGNED_ACCESS (1 << 0)
> #define F_LOAD_WITH_STRICT_ALIGNMENT (1 << 1)
> +#define F_NEEDS_JIT_ENABLED (1 << 2)
>
> /* need CAP_BPF, CAP_NET_ADMIN, CAP_PERFMON to load progs */
> #define ADMIN_CAPS (1ULL << CAP_NET_ADMIN | \
> @@ -74,6 +75,7 @@
> 1ULL << CAP_BPF)
> #define UNPRIV_SYSCTL "kernel/unprivileged_bpf_disabled"
> static bool unpriv_disabled = false;
> +static bool jit_disabled;
> static int skips;
> static bool verbose = false;
> static int verif_log_level = 0;
> @@ -1524,6 +1526,13 @@ static void do_test_single(struct bpf_test *test,
> bool unpriv,
> __u32 pflags;
> int i, err;
>
> + if ((test->flags & F_NEEDS_JIT_ENABLED) && jit_disabled) {
> + printf("SKIP (callbacks are not allowed in non-JITed
> programs)\n");
> + skips++;
> + sched_yield();
> + return;
> + }
> +
> fd_prog = -1;
> for (i = 0; i < MAX_NR_MAPS; i++)
> map_fds[i] = -1;
> @@ -1844,6 +1853,8 @@ int main(int argc, char **argv)
> return EXIT_FAILURE;
> }
>
> + jit_disabled = !is_jit_enabled();
> +
> /* Use libbpf 1.0 API mode */
> libbpf_set_strict_mode(LIBBPF_STRICT_ALL);
>
> diff --git a/tools/testing/selftests/bpf/verifier/bpf_loop_inline.c
> b/tools/testing/selftests/bpf/verifier/bpf_loop_inline.c
> index a535d41dc20d..59125b22ae39 100644
> --- a/tools/testing/selftests/bpf/verifier/bpf_loop_inline.c
> +++ b/tools/testing/selftests/bpf/verifier/bpf_loop_inline.c
> @@ -57,6 +57,7 @@
> .expected_insns = { PSEUDO_CALL_INSN() },
> .unexpected_insns = { HELPER_CALL_INSN() },
> .prog_type = BPF_PROG_TYPE_TRACEPOINT,
> + .flags = F_NEEDS_JIT_ENABLED,
> .result = ACCEPT,
> .runs = 0,
> .func_info = { { 0, MAIN_TYPE }, { 12, CALLBACK_TYPE } },
> @@ -90,6 +91,7 @@
> .expected_insns = { HELPER_CALL_INSN() },
> .unexpected_insns = { PSEUDO_CALL_INSN() },
> .prog_type = BPF_PROG_TYPE_TRACEPOINT,
> + .flags = F_NEEDS_JIT_ENABLED,
> .result = ACCEPT,
> .runs = 0,
> .func_info = { { 0, MAIN_TYPE }, { 16, CALLBACK_TYPE } },
> @@ -127,6 +129,7 @@
> .expected_insns = { HELPER_CALL_INSN() },
> .unexpected_insns = { PSEUDO_CALL_INSN() },
> .prog_type = BPF_PROG_TYPE_TRACEPOINT,
> + .flags = F_NEEDS_JIT_ENABLED,
> .result = ACCEPT,
> .runs = 0,
> .func_info = {
> @@ -165,6 +168,7 @@
> .expected_insns = { PSEUDO_CALL_INSN() },
> .unexpected_insns = { HELPER_CALL_INSN() },
> .prog_type = BPF_PROG_TYPE_TRACEPOINT,
> + .flags = F_NEEDS_JIT_ENABLED,
> .result = ACCEPT,
> .runs = 0,
> .func_info = {
> @@ -235,6 +239,7 @@
> },
> .unexpected_insns = { HELPER_CALL_INSN() },
> .prog_type = BPF_PROG_TYPE_TRACEPOINT,
> + .flags = F_NEEDS_JIT_ENABLED,
> .result = ACCEPT,
> .func_info = {
> { 0, MAIN_TYPE },
> @@ -252,6 +257,7 @@
> .unexpected_insns = { HELPER_CALL_INSN() },
> .result = ACCEPT,
> .prog_type = BPF_PROG_TYPE_TRACEPOINT,
> + .flags = F_NEEDS_JIT_ENABLED,
> .func_info = { { 0, MAIN_TYPE }, { 16, CALLBACK_TYPE } },
> .func_info_cnt = 2,
> BTF_TYPES
>
> Thanks,
> Tiezhu
>
© 2016 - 2025 Red Hat, Inc.