netdevsim: Add debugfs toggle to reject BPF programs in verifier

This adds a new debugfs toggle ('bpf_bind_verifier_accept') that can be
used to make netdevsim reject BPF programs from being accepted by the
verifier. If this toggle (which defaults to true) is set to false,
nsim_bpf_verify_insn() will return EOPNOTSUPP on the last
instruction (after outputting the 'Hello from netdevsim' verifier message).

This makes it possible to check the verification callback in the driver
from test_offload.py in selftests, since the verifier now clears the
verifier log on a successful load, hiding the message from the driver.

Fixes: 6f8a57ccf851 ("bpf: Make verifier log more relevant by default")
Signed-off-by: Toke Høiland-Jørgensen <toke@redhat.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Jakub Kicinski <kuba@kernel.org>
Link: https://lore.kernel.org/bpf/160752225964.110217.12584017165318065332.stgit@toke.dk

diff --git a/drivers/net/netdevsim/bpf.c b/drivers/net/netdevsim/bpf.c
index 85546664bdd5e57122e358d3b2041d984fa99b15..90aafb56f1409ed7be70dd5c4e8b4a8cce7f7dda 100644 (file)
--- a/drivers/net/netdevsim/bpf.c
+++ b/drivers/net/netdevsim/bpf.c
@@ -63,15 +63,20 @@ static int
 nsim_bpf_verify_insn(struct bpf_verifier_env *env, int insn_idx, int prev_insn)
 {
        struct nsim_bpf_bound_prog *state;
+       int ret = 0;
 
        state = env->prog->aux->offload->dev_priv;
        if (state->nsim_dev->bpf_bind_verifier_delay && !insn_idx)
                msleep(state->nsim_dev->bpf_bind_verifier_delay);
 
-       if (insn_idx == env->prog->len - 1)
+       if (insn_idx == env->prog->len - 1) {
                pr_vlog(env, "Hello from netdevsim!\n");
 
-       return 0;
+               if (!state->nsim_dev->bpf_bind_verifier_accept)
+                       ret = -EOPNOTSUPP;
+       }
+
+       return ret;
 }
 
 static int nsim_bpf_finalize(struct bpf_verifier_env *env)
@@ -595,6 +600,9 @@ int nsim_bpf_dev_init(struct nsim_dev *nsim_dev)
                            &nsim_dev->bpf_bind_accept);
        debugfs_create_u32("bpf_bind_verifier_delay", 0600, nsim_dev->ddir,
                           &nsim_dev->bpf_bind_verifier_delay);
+       nsim_dev->bpf_bind_verifier_accept = true;
+       debugfs_create_bool("bpf_bind_verifier_accept", 0600, nsim_dev->ddir,
+                           &nsim_dev->bpf_bind_verifier_accept);
        return 0;
 }
 

diff --git a/drivers/net/netdevsim/netdevsim.h b/drivers/net/netdevsim/netdevsim.h
index 827fc80f50a07b53277d75bba73a2b109e827caf..c4e7ad2a19642de819b4615033a9131013859b34 100644 (file)
--- a/drivers/net/netdevsim/netdevsim.h
+++ b/drivers/net/netdevsim/netdevsim.h
@@ -189,6 +189,7 @@ struct nsim_dev {
        struct dentry *take_snapshot;
        struct bpf_offload_dev *bpf_dev;
        bool bpf_bind_accept;
+       bool bpf_bind_verifier_accept;
        u32 bpf_bind_verifier_delay;
        struct dentry *ddir_bpf_bound_progs;
        u32 prog_id_gen;