[PATCH bpf-next 4/4] selftests/bpf: Add test for arena pointer zext across state pruning

[Daniel Borkmann <daniel@iogearbox.net>]

Add the arena counterpart to the sub-register zero extension pruning tests:
r6 is defined as an arena pointer twice, by a 64-bit copy on the path the
verifier explores first and by a 32-bit addr_space_cast on the path explored
second, and it is dereferenced only after the two paths meet. The second
path is pruned at the merge, so the cast never reaches the 64-bit read and
its zero extension has to be marked at the pruning point. The test is only
relevant for bpf_jit_needs_zext() architecture such as s390x.

  # ./vmtest.sh -- ./test_progs -t verifier_arena
  [...]
  #564/1   verifier_arena/basic_alloc1_nosleep:OK
  #564/2   verifier_arena/basic_alloc2_nosleep:OK
  #564/3   verifier_arena/basic_alloc3_nosleep:OK
  #564/4   verifier_arena/basic_reserve1_nosleep:OK
  #564/5   verifier_arena/basic_reserve2_nosleep:OK
  #564/6   verifier_arena/reserve_twice_nosleep:OK
  #564/7   verifier_arena/reserve_invalid_region_nosleep:OK
  #564/8   verifier_arena/subreg zero extend check across state pruning with arena pointer:OK
  #564/9   verifier_arena/basic_alloc1:OK
  [...]
  #564/26  verifier_arena/iter_maps3:OK
  #564     verifier_arena:OK
  Summary: 4/35 PASSED, 0 SKIPPED, 0 FAILED

Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
---
 .../selftests/bpf/progs/verifier_arena.c      | 35 +++++++++++++++++++
 1 file changed, 35 insertions(+)

diff --git a/tools/testing/selftests/bpf/progs/verifier_arena.c b/tools/testing/selftests/bpf/progs/verifier_arena.c
index b241bbcf54a8..b5f5b81a27e7 100644
--- a/tools/testing/selftests/bpf/progs/verifier_arena.c
+++ b/tools/testing/selftests/bpf/progs/verifier_arena.c
@@ -635,6 +635,41 @@ int non_arena_ptr_add_to_arena_ptr(void *ctx)
 	return 0;
 }
 
+/*
+ * The verifier walks from a sub-register definition to its 64-bit read to mark
+ * the definition for zero extension. When the walk stops at a pruned state, the
+ * definitions live at that point must be marked there instead, and that set
+ * includes PTR_TO_ARENA: on a pure bpf_jit_needs_zext() architecture such as
+ * s390 the addr_space_cast defining an arena pointer emits no zero extension
+ * of its own and relies solely on the mark driven zero extension, so a missing
+ * mark otherwise leaves the pointer's upper half undefined.
+ */
+SEC("socket")
+__description("subreg zero extend check across state pruning with arena pointer")
+__flag(BPF_F_TEST_RND_HI32)
+__flag(BPF_F_TEST_STATE_FREQ)
+__success __retval(0)
+__naked void subreg_zero_extend_check_pruning_arena(void)
+{
+	asm volatile ("					\
+	r7 = *(u32 *)(r1 + %[__sk_buff_len]);		\
+	r9 = %[arena] ll;				\
+	r2 = 0;						\
+	r2 = addr_space_cast(r2, 0x0, 0x1);		\
+	r6 = r2;		/* 64-bit define */	\
+	if r7 != 0 goto l1_%=;				\
+	goto l0_%=;					\
+l1_%=:	r6 = 0;			/* 32-bit define */	\
+	r6 = addr_space_cast(r6, 0x0, 0x1);		\
+l0_%=:	r0 = *(u32 *)(r6 + 0);	/* 64-bit read */	\
+	r0 = 0;						\
+	exit;						\
+"	:
+	: __imm_addr(arena),
+	  __imm_const(__sk_buff_len, offsetof(struct __sk_buff, len))
+	: __clobber_all);
+}
+
 #endif
 
 static __noinline
-- 
2.43.0