Re: [PATCHv3 bpf-next 5/7] selftests/bpf: Add uretprobe syscall call from user space test
On Mon, Apr 29, 2024 at 12:33 AM Jiri Olsa wrote: > > On Fri, Apr 26, 2024 at 11:03:29AM -0700, Andrii Nakryiko wrote: > > On Sun, Apr 21, 2024 at 12:43 PM Jiri Olsa wrote: > > > > > > Adding test to verify that when called from outside of the > > > trampoline provided by kernel, the uretprobe syscall will cause > > > calling process to receive SIGILL signal and the attached bpf > > > program is no executed. > > > > > > Signed-off-by: Jiri Olsa > > > --- > > > .../selftests/bpf/prog_tests/uprobe_syscall.c | 92 +++ > > > .../selftests/bpf/progs/uprobe_syscall_call.c | 15 +++ > > > 2 files changed, 107 insertions(+) > > > create mode 100644 > > > tools/testing/selftests/bpf/progs/uprobe_syscall_call.c > > > > > > > See nits below, but overall LGTM > > > > Acked-by: Andrii Nakryiko > > > > [...] > > > > > @@ -219,6 +301,11 @@ static void test_uretprobe_regs_change(void) > > > { > > > test__skip(); > > > } > > > + > > > +static void test_uretprobe_syscall_call(void) > > > +{ > > > + test__skip(); > > > +} > > > #endif > > > > > > void test_uprobe_syscall(void) > > > @@ -228,3 +315,8 @@ void test_uprobe_syscall(void) > > > if (test__start_subtest("uretprobe_regs_change")) > > > test_uretprobe_regs_change(); > > > } > > > + > > > +void serial_test_uprobe_syscall_call(void) > > > > does it need to be serial? non-serial are still run sequentially > > within a process (there is no multi-threading), it's more about some > > global effects on system. > > plz see below > > > > > > +{ > > > + test_uretprobe_syscall_call(); > > > +} > > > diff --git a/tools/testing/selftests/bpf/progs/uprobe_syscall_call.c > > > b/tools/testing/selftests/bpf/progs/uprobe_syscall_call.c > > > new file mode 100644 > > > index ..5ea03bb47198 > > > --- /dev/null > > > +++ b/tools/testing/selftests/bpf/progs/uprobe_syscall_call.c > > > @@ -0,0 +1,15 @@ > > > +// SPDX-License-Identifier: GPL-2.0 > > > +#include "vmlinux.h" > > > +#include > > > +#include > > > + > > > +struct pt_regs regs; > > > + > > > +char _license[] SEC("license") = "GPL"; > > > + > > > +SEC("uretprobe//proc/self/exe:uretprobe_syscall_call") > > > +int uretprobe(struct pt_regs *regs) > > > +{ > > > + bpf_printk("uretprobe called"); > > > > debugging leftover? we probably don't want to pollute trace_pipe from test > > the reason for this is to make sure the bpf program was not executed, > > the test makes sure the child gets killed with SIGILL and also that > the bpf program was not executed by checking the trace_pipe and > making sure nothing was received > > the trace_pipe reading is also why it's serial you could have attached BPF program from parent process and use a global variable (and thus eliminate all the trace_pipe system-wide dependency), but ok, it's fine by me the way this is done > > jirka > > > > > > + return 0; > > > +} > > > -- > > > 2.44.0 > > >
Re: [PATCHv3 bpf-next 5/7] selftests/bpf: Add uretprobe syscall call from user space test
On Fri, Apr 26, 2024 at 11:03:29AM -0700, Andrii Nakryiko wrote: > On Sun, Apr 21, 2024 at 12:43 PM Jiri Olsa wrote: > > > > Adding test to verify that when called from outside of the > > trampoline provided by kernel, the uretprobe syscall will cause > > calling process to receive SIGILL signal and the attached bpf > > program is no executed. > > > > Signed-off-by: Jiri Olsa > > --- > > .../selftests/bpf/prog_tests/uprobe_syscall.c | 92 +++ > > .../selftests/bpf/progs/uprobe_syscall_call.c | 15 +++ > > 2 files changed, 107 insertions(+) > > create mode 100644 tools/testing/selftests/bpf/progs/uprobe_syscall_call.c > > > > See nits below, but overall LGTM > > Acked-by: Andrii Nakryiko > > [...] > > > @@ -219,6 +301,11 @@ static void test_uretprobe_regs_change(void) > > { > > test__skip(); > > } > > + > > +static void test_uretprobe_syscall_call(void) > > +{ > > + test__skip(); > > +} > > #endif > > > > void test_uprobe_syscall(void) > > @@ -228,3 +315,8 @@ void test_uprobe_syscall(void) > > if (test__start_subtest("uretprobe_regs_change")) > > test_uretprobe_regs_change(); > > } > > + > > +void serial_test_uprobe_syscall_call(void) > > does it need to be serial? non-serial are still run sequentially > within a process (there is no multi-threading), it's more about some > global effects on system. plz see below > > > +{ > > + test_uretprobe_syscall_call(); > > +} > > diff --git a/tools/testing/selftests/bpf/progs/uprobe_syscall_call.c > > b/tools/testing/selftests/bpf/progs/uprobe_syscall_call.c > > new file mode 100644 > > index ..5ea03bb47198 > > --- /dev/null > > +++ b/tools/testing/selftests/bpf/progs/uprobe_syscall_call.c > > @@ -0,0 +1,15 @@ > > +// SPDX-License-Identifier: GPL-2.0 > > +#include "vmlinux.h" > > +#include > > +#include > > + > > +struct pt_regs regs; > > + > > +char _license[] SEC("license") = "GPL"; > > + > > +SEC("uretprobe//proc/self/exe:uretprobe_syscall_call") > > +int uretprobe(struct pt_regs *regs) > > +{ > > + bpf_printk("uretprobe called"); > > debugging leftover? we probably don't want to pollute trace_pipe from test the reason for this is to make sure the bpf program was not executed, the test makes sure the child gets killed with SIGILL and also that the bpf program was not executed by checking the trace_pipe and making sure nothing was received the trace_pipe reading is also why it's serial jirka > > > + return 0; > > +} > > -- > > 2.44.0 > >
Re: [PATCHv3 bpf-next 5/7] selftests/bpf: Add uretprobe syscall call from user space test
On Sun, Apr 21, 2024 at 12:43 PM Jiri Olsa wrote: > > Adding test to verify that when called from outside of the > trampoline provided by kernel, the uretprobe syscall will cause > calling process to receive SIGILL signal and the attached bpf > program is no executed. > > Signed-off-by: Jiri Olsa > --- > .../selftests/bpf/prog_tests/uprobe_syscall.c | 92 +++ > .../selftests/bpf/progs/uprobe_syscall_call.c | 15 +++ > 2 files changed, 107 insertions(+) > create mode 100644 tools/testing/selftests/bpf/progs/uprobe_syscall_call.c > See nits below, but overall LGTM Acked-by: Andrii Nakryiko [...] > @@ -219,6 +301,11 @@ static void test_uretprobe_regs_change(void) > { > test__skip(); > } > + > +static void test_uretprobe_syscall_call(void) > +{ > + test__skip(); > +} > #endif > > void test_uprobe_syscall(void) > @@ -228,3 +315,8 @@ void test_uprobe_syscall(void) > if (test__start_subtest("uretprobe_regs_change")) > test_uretprobe_regs_change(); > } > + > +void serial_test_uprobe_syscall_call(void) does it need to be serial? non-serial are still run sequentially within a process (there is no multi-threading), it's more about some global effects on system. > +{ > + test_uretprobe_syscall_call(); > +} > diff --git a/tools/testing/selftests/bpf/progs/uprobe_syscall_call.c > b/tools/testing/selftests/bpf/progs/uprobe_syscall_call.c > new file mode 100644 > index ..5ea03bb47198 > --- /dev/null > +++ b/tools/testing/selftests/bpf/progs/uprobe_syscall_call.c > @@ -0,0 +1,15 @@ > +// SPDX-License-Identifier: GPL-2.0 > +#include "vmlinux.h" > +#include > +#include > + > +struct pt_regs regs; > + > +char _license[] SEC("license") = "GPL"; > + > +SEC("uretprobe//proc/self/exe:uretprobe_syscall_call") > +int uretprobe(struct pt_regs *regs) > +{ > + bpf_printk("uretprobe called"); debugging leftover? we probably don't want to pollute trace_pipe from test > + return 0; > +} > -- > 2.44.0 >