linux/samples/bpf
Daniel Borkmann 2d2be8cab2 bpf: fix range propagation on direct packet access
LLVM can generate code that tests for direct packet access via
skb->data/data_end in a way that currently gets rejected by the
verifier, example:

  [...]
   7: (61) r3 = *(u32 *)(r6 +80)
   8: (61) r9 = *(u32 *)(r6 +76)
   9: (bf) r2 = r9
  10: (07) r2 += 54
  11: (3d) if r3 >= r2 goto pc+12
   R1=inv R2=pkt(id=0,off=54,r=0) R3=pkt_end R4=inv R6=ctx
   R9=pkt(id=0,off=0,r=0) R10=fp
  12: (18) r4 = 0xffffff7a
  14: (05) goto pc+430
  [...]

  from 11 to 24: R1=inv R2=pkt(id=0,off=54,r=0) R3=pkt_end R4=inv
                 R6=ctx R9=pkt(id=0,off=0,r=0) R10=fp
  24: (7b) *(u64 *)(r10 -40) = r1
  25: (b7) r1 = 0
  26: (63) *(u32 *)(r6 +56) = r1
  27: (b7) r2 = 40
  28: (71) r8 = *(u8 *)(r9 +20)
  invalid access to packet, off=20 size=1, R9(id=0,off=0,r=0)

The reason why this gets rejected despite a proper test is that we
currently call find_good_pkt_pointers() only in case where we detect
tests like rX > pkt_end, where rX is of type pkt(id=Y,off=Z,r=0) and
derived, for example, from a register of type pkt(id=Y,off=0,r=0)
pointing to skb->data. find_good_pkt_pointers() then fills the range
in the current branch to pkt(id=Y,off=0,r=Z) on success.

For above case, we need to extend that to recognize pkt_end >= rX
pattern and mark the other branch that is taken on success with the
appropriate pkt(id=Y,off=0,r=Z) type via find_good_pkt_pointers().
Since eBPF operates on BPF_JGT (>) and BPF_JGE (>=), these are the
only two practical options to test for from what LLVM could have
generated, since there's no such thing as BPF_JLT (<) or BPF_JLE (<=)
that we would need to take into account as well.

After the fix:

  [...]
   7: (61) r3 = *(u32 *)(r6 +80)
   8: (61) r9 = *(u32 *)(r6 +76)
   9: (bf) r2 = r9
  10: (07) r2 += 54
  11: (3d) if r3 >= r2 goto pc+12
   R1=inv R2=pkt(id=0,off=54,r=0) R3=pkt_end R4=inv R6=ctx
   R9=pkt(id=0,off=0,r=0) R10=fp
  12: (18) r4 = 0xffffff7a
  14: (05) goto pc+430
  [...]

  from 11 to 24: R1=inv R2=pkt(id=0,off=54,r=54) R3=pkt_end R4=inv
                 R6=ctx R9=pkt(id=0,off=0,r=54) R10=fp
  24: (7b) *(u64 *)(r10 -40) = r1
  25: (b7) r1 = 0
  26: (63) *(u32 *)(r6 +56) = r1
  27: (b7) r2 = 40
  28: (71) r8 = *(u8 *)(r9 +20)
  29: (bf) r1 = r8
  30: (25) if r8 > 0x3c goto pc+47
   R1=inv56 R2=imm40 R3=pkt_end R4=inv R6=ctx R8=inv56
   R9=pkt(id=0,off=0,r=54) R10=fp
  31: (b7) r1 = 1
  [...]

Verifier test cases are also added in this work, one that demonstrates
the mentioned example here and one that tries a bad packet access for
the current/fall-through branch (the one with types pkt(id=X,off=Y,r=0),
pkt(id=X,off=0,r=0)), then a case with good and bad accesses, and two
with both test variants (>, >=).

Fixes: 969bf05eb3 ("bpf: direct packet access")
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2016-09-08 17:28:37 -07:00
..
bpf_helpers.h samples/bpf: add perf_event+bpf example 2016-09-02 10:46:45 -07:00
bpf_load.c samples/bpf: add perf_event+bpf example 2016-09-02 10:46:45 -07:00
bpf_load.h samples/bpf: move ksym_search() into library 2016-03-08 15:28:32 -05:00
fds_example.c samples/bpf: add map_flags to bpf loader 2016-03-08 15:28:32 -05:00
lathist_kern.c bpf: BPF based latency tracing 2015-06-23 06:09:58 -07:00
lathist_user.c bpf: BPF based latency tracing 2015-06-23 06:09:58 -07:00
libbpf.c samples/bpf: add map_flags to bpf loader 2016-03-08 15:28:32 -05:00
libbpf.h samples/bpf: add map_flags to bpf loader 2016-03-08 15:28:32 -05:00
Makefile samples/bpf: add sampleip example 2016-09-02 10:46:45 -07:00
map_perf_test_kern.c samples/bpf: add map performance test 2016-03-08 23:22:03 -05:00
map_perf_test_user.c samples/bpf: Fix build breakage with map_perf_test_user.c 2016-04-06 16:01:28 -04:00
offwaketime_kern.c bpf, samples: don't zero data when not needed 2016-04-14 21:40:42 -04:00
offwaketime_user.c samples/bpf: move ksym_search() into library 2016-03-08 15:28:32 -05:00
parse_ldabs.c samples/bpf: add 'pointer to packet' tests 2016-05-06 16:01:54 -04:00
parse_simple.c samples/bpf: add 'pointer to packet' tests 2016-05-06 16:01:54 -04:00
parse_varlen.c samples/bpf: add 'pointer to packet' tests 2016-05-06 16:01:54 -04:00
README.rst samples/bpf: like LLC also verify and allow redefining CLANG command 2016-04-29 14:26:08 -04:00
sampleip_kern.c samples/bpf: add sampleip example 2016-09-02 10:46:45 -07:00
sampleip_user.c samples/bpf: add sampleip example 2016-09-02 10:46:45 -07:00
sock_example.c samples/bpf: add map_flags to bpf loader 2016-03-08 15:28:32 -05:00
sockex1_kern.c samples: bpf: add skb->field examples and tests 2015-03-15 22:02:28 -04:00
sockex1_user.c samples: bpf: add skb->field examples and tests 2015-03-15 22:02:28 -04:00
sockex2_kern.c samples: bpf: add skb->field examples and tests 2015-03-15 22:02:28 -04:00
sockex2_user.c samples/bpf: set max locked memory to ulimited 2016-06-25 12:03:46 -04:00
sockex3_kern.c bpf: allow programs to write to certain skb fields 2015-06-07 02:01:33 -07:00
sockex3_user.c samples/bpf: set max locked memory to ulimited 2016-06-25 12:03:46 -04:00
spintest_kern.c samples/bpf: Enable powerpc support 2016-04-06 16:01:29 -04:00
spintest_user.c samples/bpf: add bpf map stress test 2016-03-08 23:22:02 -05:00
tcbpf1_kern.c bpf: add bpf_redirect() helper 2015-09-17 21:09:07 -07:00
tcbpf2_kern.c samples/bpf: Add tunnel set/get tests. 2016-08-19 22:42:44 -07:00
test_cgrp2_array_pin.c cgroup: bpf: Add an example to do cgroup checking in BPF 2016-07-01 16:32:13 -04:00
test_cgrp2_tc_kern.c bpf: fix bpf_skb_in_cgroup helper naming 2016-08-12 21:53:33 -07:00
test_cgrp2_tc.sh cgroup: bpf: Add an example to do cgroup checking in BPF 2016-07-01 16:32:13 -04:00
test_cls_bpf.sh samples/bpf: add 'pointer to packet' tests 2016-05-06 16:01:54 -04:00
test_current_task_under_cgroup_kern.c samples/bpf: Add test_current_task_under_cgroup test 2016-08-12 21:49:42 -07:00
test_current_task_under_cgroup_user.c samples/bpf: Add test_current_task_under_cgroup test 2016-08-12 21:49:42 -07:00
test_maps.c samples/bpf: add bpf_map_update_elem() tests 2016-08-06 20:49:19 -04:00
test_overhead_kprobe_kern.c samples/bpf: add tracepoint vs kprobe performance tests 2016-04-07 21:04:27 -04:00
test_overhead_tp_kern.c samples/bpf: add tracepoint vs kprobe performance tests 2016-04-07 21:04:27 -04:00
test_overhead_user.c samples/bpf: add tracepoint vs kprobe performance tests 2016-04-07 21:04:27 -04:00
test_probe_write_user_kern.c samples/bpf: Add test/example of using bpf_probe_write_user bpf helper 2016-07-25 18:07:48 -07:00
test_probe_write_user_user.c samples/bpf: Add test/example of using bpf_probe_write_user bpf helper 2016-07-25 18:07:48 -07:00
test_tunnel_bpf.sh samples/bpf: Add tunnel set/get tests. 2016-08-19 22:42:44 -07:00
test_verifier.c bpf: fix range propagation on direct packet access 2016-09-08 17:28:37 -07:00
trace_event_kern.c samples/bpf: add perf_event+bpf example 2016-09-02 10:46:45 -07:00
trace_event_user.c samples/bpf: add perf_event+bpf example 2016-09-02 10:46:45 -07:00
trace_output_kern.c samples/bpf: fix trace_output example 2016-04-28 17:29:45 -04:00
trace_output_user.c samples: bpf: add bpf_perf_event_output example 2015-10-22 06:42:15 -07:00
tracex1_kern.c bpf, samples: don't zero data when not needed 2016-04-14 21:40:42 -04:00
tracex1_user.c samples/bpf: Add simple non-portable kprobe filter example 2015-04-02 13:25:50 +02:00
tracex2_kern.c bpf, samples: don't zero data when not needed 2016-04-14 21:40:42 -04:00
tracex2_user.c samples/bpf: update tracex[23] examples to use per-cpu maps 2016-02-06 03:34:36 -05:00
tracex3_kern.c samples/bpf: update tracex[23] examples to use per-cpu maps 2016-02-06 03:34:36 -05:00
tracex3_user.c samples/bpf: update tracex[23] examples to use per-cpu maps 2016-02-06 03:34:36 -05:00
tracex4_kern.c samples/bpf: Enable powerpc support 2016-04-06 16:01:29 -04:00
tracex4_user.c samples/bpf: Add kmem_alloc()/free() tracker tool 2015-04-02 13:25:51 +02:00
tracex5_kern.c bpf, samples: don't zero data when not needed 2016-04-14 21:40:42 -04:00
tracex5_user.c samples/bpf: bpf_tail_call example for tracing 2015-05-21 17:07:59 -04:00
tracex6_kern.c bpf: fix build warnings and add function read_trace_pipe() 2015-08-12 16:39:12 -07:00
tracex6_user.c bpf: fix build warnings and add function read_trace_pipe() 2015-08-12 16:39:12 -07:00
xdp1_kern.c bpf: make xdp sample variable names more meaningful 2016-07-20 22:07:24 -07:00
xdp1_user.c Add sample for adding simple drop program to link 2016-07-19 21:46:32 -07:00
xdp2_kern.c bpf: make xdp sample variable names more meaningful 2016-07-20 22:07:24 -07:00

eBPF sample programs
====================

This directory contains a mini eBPF library, test stubs, verifier
test-suite and examples for using eBPF.

Build dependencies
==================

Compiling requires having installed:
 * clang >= version 3.4.0
 * llvm >= version 3.7.1

Note that LLVM's tool 'llc' must support target 'bpf', list version
and supported targets with command: ``llc --version``

Kernel headers
--------------

There are usually dependencies to header files of the current kernel.
To avoid installing devel kernel headers system wide, as a normal
user, simply call::

 make headers_install

This will creates a local "usr/include" directory in the git/build top
level directory, that the make system automatically pickup first.

Compiling
=========

For building the BPF samples, issue the below command from the kernel
top level directory::

 make samples/bpf/

Do notice the "/" slash after the directory name.

It is also possible to call make from this directory.  This will just
hide the the invocation of make as above with the appended "/".

Manually compiling LLVM with 'bpf' support
------------------------------------------

Since version 3.7.0, LLVM adds a proper LLVM backend target for the
BPF bytecode architecture.

By default llvm will build all non-experimental backends including bpf.
To generate a smaller llc binary one can use::

 -DLLVM_TARGETS_TO_BUILD="BPF"

Quick sniplet for manually compiling LLVM and clang
(build dependencies are cmake and gcc-c++)::

 $ git clone http://llvm.org/git/llvm.git
 $ cd llvm/tools
 $ git clone --depth 1 http://llvm.org/git/clang.git
 $ cd ..; mkdir build; cd build
 $ cmake .. -DLLVM_TARGETS_TO_BUILD="BPF;X86"
 $ make -j $(getconf _NPROCESSORS_ONLN)

It is also possible to point make to the newly compiled 'llc' or
'clang' command via redefining LLC or CLANG on the make command line::

 make samples/bpf/ LLC=~/git/llvm/build/bin/llc CLANG=~/git/llvm/build/bin/clang