Commit e4ff5aa4 authored by Toke Høiland-Jørgensen's avatar Toke Høiland-Jørgensen Committed by Daniel Borkmann
Browse files

netdevsim: Add debugfs toggle to reject BPF programs in verifier 



This adds a new debugfs toggle ('bpf_bind_verifier_accept') that can be
used to make netdevsim reject BPF programs from being accepted by the
verifier. If this toggle (which defaults to true) is set to false,
nsim_bpf_verify_insn() will return EOPNOTSUPP on the last
instruction (after outputting the 'Hello from netdevsim' verifier message).

This makes it possible to check the verification callback in the driver
from test_offload.py in selftests, since the verifier now clears the
verifier log on a successful load, hiding the message from the driver.

Fixes: 6f8a57cc ("bpf: Make verifier log more relevant by default")
Signed-off-by: default avatarToke Høiland-Jørgensen <toke@redhat.com>
Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
Acked-by: default avatarJakub Kicinski <kuba@kernel.org>
Link: https://lore.kernel.org/bpf/160752225964.110217.12584017165318065332.stgit@toke.dk
parent 0b5b6e74

drivers/net/netdevsim/bpf.c

+10 −2
Original line number Diff line number Diff line
@@ -63,15 +63,20 @@ static int 
nsim_bpf_verify_insn(struct bpf_verifier_env *env, int insn_idx, int prev_insn)

{

	struct nsim_bpf_bound_prog *state;

	int ret = 0;



	state = env->prog->aux->offload->dev_priv;

	if (state->nsim_dev->bpf_bind_verifier_delay && !insn_idx)

		msleep(state->nsim_dev->bpf_bind_verifier_delay);



	if (insn_idx == env->prog->len - 1)

	if (insn_idx == env->prog->len - 1) {

		pr_vlog(env, "Hello from netdevsim!\n");



	return 0;

		if (!state->nsim_dev->bpf_bind_verifier_accept)

			ret = -EOPNOTSUPP;

	}



	return ret;

}



static int nsim_bpf_finalize(struct bpf_verifier_env *env)
@@ -595,6 +600,9 @@ int nsim_bpf_dev_init(struct nsim_dev *nsim_dev) 
			    &nsim_dev->bpf_bind_accept);

	debugfs_create_u32("bpf_bind_verifier_delay", 0600, nsim_dev->ddir,

			   &nsim_dev->bpf_bind_verifier_delay);

	nsim_dev->bpf_bind_verifier_accept = true;

	debugfs_create_bool("bpf_bind_verifier_accept", 0600, nsim_dev->ddir,

			    &nsim_dev->bpf_bind_verifier_accept);

	return 0;

}

drivers/net/netdevsim/netdevsim.h

+1 −0
Original line number Diff line number Diff line
@@ -189,6 +189,7 @@ struct nsim_dev { 
	struct dentry *take_snapshot;

	struct bpf_offload_dev *bpf_dev;

	bool bpf_bind_accept;

	bool bpf_bind_verifier_accept;

	u32 bpf_bind_verifier_delay;

	struct dentry *ddir_bpf_bound_progs;

	u32 prog_id_gen;