Re: [PATCH RFC v2 bpf-next 9/9] selftests/bpf: Add iter_task_vma_buildid test

[Andrii Nakryiko]

On Tue, Feb 28, 2023 at 1:34 AM Jiri Olsa <jolsa@xxxxxxxxxx> wrote:
>
> Testing iterator access to build id in vma->vm_file->f_inode
> object by storing each binary with buildid into map and checking
> it against buildid retrieved in user space.
>
> Signed-off-by: Jiri Olsa <jolsa@xxxxxxxxxx>
> ---
>  .../selftests/bpf/prog_tests/bpf_iter.c       | 78 +++++++++++++++++++
>  .../bpf/progs/bpf_iter_task_vma_buildid.c     | 60 ++++++++++++++
>  2 files changed, 138 insertions(+)
>  create mode 100644 tools/testing/selftests/bpf/progs/bpf_iter_task_vma_buildid.c
>
> diff --git a/tools/testing/selftests/bpf/prog_tests/bpf_iter.c b/tools/testing/selftests/bpf/prog_tests/bpf_iter.c
> index 1f02168103dd..c7dd89e7cad0 100644
> --- a/tools/testing/selftests/bpf/prog_tests/bpf_iter.c
> +++ b/tools/testing/selftests/bpf/prog_tests/bpf_iter.c
> @@ -33,6 +33,7 @@
>  #include "bpf_iter_bpf_link.skel.h"
>  #include "bpf_iter_ksym.skel.h"
>  #include "bpf_iter_sockmap.skel.h"
> +#include "bpf_iter_task_vma_buildid.skel.h"
>
>  static int duration;
>
> @@ -1536,6 +1537,81 @@ static void test_task_vma_dead_task(void)
>         bpf_iter_task_vma__destroy(skel);
>  }
>
> +#define D_PATH_BUF_SIZE        1024
> +
> +struct build_id {
> +       u32 sz;
> +       char data[BPF_BUILD_ID_SIZE];
> +};
> +
> +static void test_task_vma_buildid(void)
> +{
> +       int err, iter_fd = -1, proc_maps_fd = -1, sz;
> +       struct bpf_iter_task_vma_buildid *skel;
> +       char key[D_PATH_BUF_SIZE], *prev_key;
> +       char build_id[BPF_BUILD_ID_SIZE];
> +       int len, files_fd, cnt = 0;
> +       struct build_id val;
> +       char c;
> +
> +       skel = bpf_iter_task_vma_buildid__open_and_load();
> +       if (!ASSERT_OK_PTR(skel, "bpf_iter_task_vma_buildid__open_and_load"))
> +               return;
> +
> +       skel->links.proc_maps = bpf_program__attach_iter(
> +               skel->progs.proc_maps, NULL);
> +
> +       if (!ASSERT_OK_PTR(skel->links.proc_maps, "bpf_program__attach_iter")) {
> +               skel->links.proc_maps = NULL;
> +               goto out;
> +       }
> +
> +       iter_fd = bpf_iter_create(bpf_link__fd(skel->links.proc_maps));
> +       if (!ASSERT_GE(iter_fd, 0, "create_iter"))
> +               goto out;
> +
> +       /* trigger the iterator, there's no output, just map */
> +       len = read(iter_fd, &c, 1);
> +       ASSERT_EQ(len, 0, "len_check");
> +
> +       files_fd = bpf_map__fd(skel->maps.files);
> +
> +       prev_key = NULL;
> +
> +       while (true) {
> +               err = bpf_map_get_next_key(files_fd, prev_key, &key);
> +               if (err) {
> +                       if (errno == ENOENT)
> +                               err = 0;
> +                       break;
> +               }
> +               if (bpf_map_lookup_elem(files_fd, key, &val))
> +                       break;
> +               if (!ASSERT_LE(val.sz, BPF_BUILD_ID_SIZE, "buildid_size"))
> +                       break;
> +
> +               sz = read_build_id(key, build_id);
> +               /* If there's an error, the build id is not present or malformed, kernel
> +                * should see the same result and bpf program pushed zero build id.
> +                */
> +               if (sz < 0) {
> +                       memset(build_id, 0x0, BPF_BUILD_ID_SIZE);
> +                       sz = BPF_BUILD_ID_SIZE;
> +               }
> +               ASSERT_EQ(val.sz, sz, "build_id_size");
> +               ASSERT_MEMEQ(val.data, build_id, sz, "build_id_data");
> +
> +               prev_key = key;
> +               cnt++;
> +       }
> +
> +       printf("checked %d files\n", cnt);
> +out:
> +       close(proc_maps_fd);
> +       close(iter_fd);
> +       bpf_iter_task_vma_buildid__destroy(skel);
> +}
> +
>  void test_bpf_sockmap_map_iter_fd(void)
>  {
>         struct bpf_iter_sockmap *skel;
> @@ -1659,6 +1735,8 @@ void test_bpf_iter(void)
>                 test_task_vma();
>         if (test__start_subtest("task_vma_dead_task"))
>                 test_task_vma_dead_task();
> +       if (test__start_subtest("task_vma_buildid"))
> +               test_task_vma_buildid();
>         if (test__start_subtest("task_btf"))
>                 test_task_btf();
>         if (test__start_subtest("tcp4"))
> diff --git a/tools/testing/selftests/bpf/progs/bpf_iter_task_vma_buildid.c b/tools/testing/selftests/bpf/progs/bpf_iter_task_vma_buildid.c
> new file mode 100644
> index 000000000000..dc528a4783ec
> --- /dev/null
> +++ b/tools/testing/selftests/bpf/progs/bpf_iter_task_vma_buildid.c
> @@ -0,0 +1,60 @@
> +// SPDX-License-Identifier: GPL-2.0
> +
> +#include "bpf_iter.h"
> +#include "err.h"
> +#include <bpf/bpf_helpers.h>
> +#include <string.h>
> +
> +char _license[] SEC("license") = "GPL";
> +
> +#define VM_EXEC                0x00000004
> +#define D_PATH_BUF_SIZE        1024
> +
> +struct {
> +       __uint(type, BPF_MAP_TYPE_HASH);
> +       __uint(max_entries, 10000);
> +       __type(key, char[D_PATH_BUF_SIZE]);
> +       __type(value, struct build_id);
> +} files SEC(".maps");
> +
> +static char path[D_PATH_BUF_SIZE];
> +static struct build_id build_id;
> +
> +SEC("iter/task_vma")
> +int proc_maps(struct bpf_iter__task_vma *ctx)
> +{
> +       struct vm_area_struct *vma = ctx->vma;
> +       struct seq_file *seq = ctx->meta->seq;
> +       struct task_struct *task = ctx->task;
> +       unsigned long file_key;
> +       struct inode *inode;
> +       struct file *file;
> +
> +       if (task == (void *)0 || vma == (void *)0)
> +               return 0;
> +
> +       if (!(vma->vm_flags & VM_EXEC))
> +               return 0;
> +
> +       file = vma->vm_file;
> +       if (!file)
> +               return 0;
> +
> +       __builtin_memset(path, 0x0, D_PATH_BUF_SIZE);
> +       bpf_d_path(&file->f_path, (char *) &path, D_PATH_BUF_SIZE);
> +
> +       if (bpf_map_lookup_elem(&files, &path))
> +               return 0;
> +
> +       inode = file->f_inode;
> +       if (IS_ERR_OR_NULL(inode->i_build_id)) {
> +               /* On error return empty build id. */
> +               __builtin_memset(&build_id.data, 0x0, sizeof(build_id.data));
> +               build_id.sz = 20;

let's replace `#define BUILD_ID_SIZE_MAX 20` in
include/linux/buildid.h with `enum { BUILD_ID_SIZE_MAX = 20 };`. This
will "expose" this constant into BTF and thus vmlinux.h, so we won't
have to hard-code anything. BPF users would be grateful as well.

No downsides of doing this.

> +       } else {
> +               __builtin_memcpy(&build_id, inode->i_build_id, sizeof(*inode->i_build_id));
> +       }
> +
> +       bpf_map_update_elem(&files, &path, &build_id, 0);
> +       return 0;
> +}
> --
> 2.39.2
>