[PATCH bpf-next v3] selftests/bpf: Add test for indirect struct_ops trampoline

[Tiezhu Yang]

Add a test case to verify that arguments passed on the stack are
correctly read by an indirect struct_ops trampoline.

This test ensures the correctness of stack offsets across various
architectures. It is particularly critical for architectures like
LoongArch, RISC-V, ARM64, and PowerPC where arguments beyond the
first 8 registers are passed on the stack, as well as x86_64 and
s390x which have lower register argument limits.

Signed-off-by: Tiezhu Yang <yangtiezhu@xxxxxxxxxxx>
---
v3:
  -- Use bpf_program__set_log_buf() to capture and verify the log
  -- Drop global state and mutex, just use kdata in bpf_dummy_reg()

Test results for reference:

(1) Before JIT fixes:
    $ sudo ./test_progs -t struct_ops_multi_args
    #487/1   struct_ops_multi_args/test_refcounted_multi:OK
    ...
    test_trampoline_stack_args:FAIL:check_stack_passed_arg9 unexpected check_stack_passed_arg9: actual 1286686720 != expected 9999
    #487/2   struct_ops_multi_args/test_trampoline_stack_args:FAIL
    #487     struct_ops_multi_args:FAIL
    Summary: 0/1 PASSED, 0 SKIPPED, 1/1 FAILED

(2) After JIT fixes:
    $ sudo ./test_progs -t struct_ops_multi_args
    #487/1   struct_ops_multi_args/test_refcounted_multi:OK
    #487/2   struct_ops_multi_args/test_trampoline_stack_args:OK
    #487     struct_ops_multi_args:OK
    Summary: 1/2 PASSED, 0 SKIPPED, 0/0 FAILED

 .../prog_tests/test_struct_ops_multi_args.c   | 57 ++++++++++++++++++-
 .../bpf/progs/struct_ops_multi_args.c         | 14 ++++-
 .../selftests/bpf/test_kmods/bpf_testmod.c    | 10 ++++
 .../selftests/bpf/test_kmods/bpf_testmod.h    |  5 ++
 4 files changed, 84 insertions(+), 2 deletions(-)

diff --git a/tools/testing/selftests/bpf/prog_tests/test_struct_ops_multi_args.c b/tools/testing/selftests/bpf/prog_tests/test_struct_ops_multi_args.c
index 0f321e889862..8767e5f8bcc7 100644
--- a/tools/testing/selftests/bpf/prog_tests/test_struct_ops_multi_args.c
+++ b/tools/testing/selftests/bpf/prog_tests/test_struct_ops_multi_args.c
@@ -3,7 +3,62 @@
 #include <test_progs.h>
 #include "struct_ops_multi_args.skel.h"
 
+static void test_refcounted_multi(void)
+{
+	struct struct_ops_multi_args *skel;
+	char log_buf[4096] = {};
+	int err;
+
+	skel = struct_ops_multi_args__open();
+	if (!ASSERT_OK_PTR(skel, "struct_ops_multi_args__open"))
+		return;
+
+	bpf_program__set_log_buf(skel->progs.test_refcounted_multi, log_buf, sizeof(log_buf));
+
+	err = struct_ops_multi_args__load(skel);
+	if (!ASSERT_EQ(err, -EINVAL, "struct_ops_multi_args__load"))
+		goto out;
+
+	ASSERT_HAS_SUBSTR(log_buf, "program with __ref argument cannot tail call",
+			  "check_verifier_log_message");
+
+out:
+	struct_ops_multi_args__destroy(skel);
+}
+
+static void test_trampoline_stack_args(void)
+{
+	struct struct_ops_multi_args *skel;
+	struct bpf_link *link = NULL;
+	int err;
+
+	skel = struct_ops_multi_args__open();
+	if (!ASSERT_OK_PTR(skel, "struct_ops_multi_args__open"))
+		return;
+
+	bpf_program__set_autoload(skel->progs.test_refcounted_multi, false);
+	skel->struct_ops.testmod_ref_acquire->test_refcounted_multi = NULL;
+
+	err = struct_ops_multi_args__load(skel);
+	if (!ASSERT_OK(err, "struct_ops_multi_args__load"))
+		goto out;
+
+	link = bpf_map__attach_struct_ops(skel->maps.testmod_ref_acquire);
+	if (!ASSERT_OK_PTR(link, "bpf_map__attach_struct_ops"))
+		goto out;
+
+	ASSERT_EQ(skel->bss->trampoline_stack_arg9, 9999, "check_stack_passed_arg9");
+
+out:
+	bpf_link__destroy(link);
+	struct_ops_multi_args__destroy(skel);
+}
+
 void test_struct_ops_multi_args(void)
 {
-	RUN_TESTS(struct_ops_multi_args);
+	if (test__start_subtest("test_refcounted_multi"))
+		test_refcounted_multi();
+
+	if (test__start_subtest("test_trampoline_stack_args"))
+		test_trampoline_stack_args();
 }
diff --git a/tools/testing/selftests/bpf/progs/struct_ops_multi_args.c b/tools/testing/selftests/bpf/progs/struct_ops_multi_args.c
index c62be15757f0..9d290f22b492 100644
--- a/tools/testing/selftests/bpf/progs/struct_ops_multi_args.c
+++ b/tools/testing/selftests/bpf/progs/struct_ops_multi_args.c
@@ -17,7 +17,6 @@ struct {
 } prog_array SEC(".maps");
 
 SEC("struct_ops/test_refcounted_multi")
-__failure __msg("program with __ref argument cannot tail call")
 int test_refcounted_multi(unsigned long long *ctx)
 {
 	/* ctx[2] is used because the refcounted variable is the third argument */
@@ -29,7 +28,20 @@ int test_refcounted_multi(unsigned long long *ctx)
 	return 0;
 }
 
+__u64 trampoline_stack_arg9 = 0;
+
+SEC("struct_ops/test_trampoline_stack_args")
+int BPF_PROG(test_trampoline_stack_args, int arg1, int arg2, int arg3,
+					 int arg4, int arg5, int arg6,
+					 int arg7, int arg8, int arg9)
+{
+	trampoline_stack_arg9 = arg9;
+
+	return 0;
+}
+
 SEC(".struct_ops.link")
 struct bpf_testmod_ops testmod_ref_acquire = {
 	.test_refcounted_multi = (void *)test_refcounted_multi,
+	.test_trampoline_stack_args = (void *)test_trampoline_stack_args,
 };
diff --git a/tools/testing/selftests/bpf/test_kmods/bpf_testmod.c b/tools/testing/selftests/bpf/test_kmods/bpf_testmod.c
index f798bbbb4d13..df50b408972a 100644
--- a/tools/testing/selftests/bpf/test_kmods/bpf_testmod.c
+++ b/tools/testing/selftests/bpf/test_kmods/bpf_testmod.c
@@ -1774,6 +1774,8 @@ static int bpf_dummy_reg(void *kdata, struct bpf_link *link)
 	 */
 	if (ops->test_2)
 		ops->test_2(4, ops->data);
+	if (ops->test_trampoline_stack_args)
+		ops->test_trampoline_stack_args(1, 2, 3, 4, 5, 6, 7, 8, 9999);
 
 	return 0;
 }
@@ -1821,6 +1823,13 @@ bpf_testmod_ops__test_return_ref_kptr(int dummy, struct task_struct *task__ref,
 	return NULL;
 }
 
+static int bpf_testmod_ops__test_trampoline_stack_args(int arg1, int arg2, int arg3,
+						       int arg4, int arg5, int arg6,
+						       int arg7, int arg8, int arg9)
+{
+	return arg9;
+}
+
 static struct bpf_testmod_ops __bpf_testmod_ops = {
 	.test_1 = bpf_testmod_test_1,
 	.test_2 = bpf_testmod_test_2,
@@ -1828,6 +1837,7 @@ static struct bpf_testmod_ops __bpf_testmod_ops = {
 	.test_refcounted = bpf_testmod_ops__test_refcounted,
 	.test_refcounted_multi = bpf_testmod_ops__test_refcounted_multi,
 	.test_return_ref_kptr = bpf_testmod_ops__test_return_ref_kptr,
+	.test_trampoline_stack_args = bpf_testmod_ops__test_trampoline_stack_args,
 };
 
 struct bpf_struct_ops bpf_bpf_testmod_ops = {
diff --git a/tools/testing/selftests/bpf/test_kmods/bpf_testmod.h b/tools/testing/selftests/bpf/test_kmods/bpf_testmod.h
index 210b919290cc..505cd6779ff7 100644
--- a/tools/testing/selftests/bpf/test_kmods/bpf_testmod.h
+++ b/tools/testing/selftests/bpf/test_kmods/bpf_testmod.h
@@ -46,6 +46,11 @@ struct bpf_testmod_ops {
 	struct task_struct *(*test_return_ref_kptr)(int dummy, struct task_struct *task,
 						    struct cgroup *cgrp);
 
+	/* Used to test indirect struct_ops trampoline with stack-passed arguments. */
+	int (*test_trampoline_stack_args)(int arg1, int arg2, int arg3,
+					  int arg4, int arg5, int arg6,
+					  int arg7, int arg8, int arg9);
+
 	/* The following fields are used to test shadow copies. */
 	char onebyte;
 	struct {
-- 
2.42.0