sys/linux: describe call to BPF helper bpf_ringbuf_reserve

Describe a full call to bpf_ringbuf_reserve, using the map type created
in the previous commit. The test corresponds to this simple line:

     u64 *e;
     e = bpf_ringbuf_reserve(&rb, sizeof(*e), 0);
     [...]
     return e;

The pointer returned by bpf_ringbuf_reserve is kept in R9. The goal is
to keep it around so we can use it in other instructions later; several
other helpers take a pointer to ringbuf data as argument. There's of
course a risk that some instruction in between will clobber R9, but I
don't know another way. R9 is at least safe for calls (only R1--R5 get
clobbered).

We expect the program loading to fail with EINVAL because we never
release the reference to the ringbuf data. The verifier will therefore
reject the program with:

    0: R1=ctx(off=0,imm=0) R10=fp0
    0: (18) r0 = 0x0                      ; R0_w=0
    2: (18) r1 = 0xffff984e4b55da00       ; R1_w=map_ptr(off=0,ks=0,vs=0,imm=0)
    4: (b7) r2 = 20                       ; R2_w=20
    5: (b7) r3 = 0                        ; R3_w=0
    6: (85) call bpf_ringbuf_reserve#131  ; R0_w=ringbuf_mem_or_null(id=2,ref_obj_id=2,off=0,imm=0) refs=2
    7: (bf) r9 = r0                       ; R0_w=ringbuf_mem_or_null(id=2,ref_obj_id=2,off=0,imm=0)
                                            R9_w=ringbuf_mem_or_null(id=2,ref_obj_id=2,off=0,imm=0) refs=2
    8: (95) exit
    Unreleased reference id=2 alloc_insn=6

Signed-off-by: Paul Chaignon <paul.chaignon@gmail.com>

3 files changed, 25 insertions, 0 deletions

diff --git a/sys/linux/bpf.txt b/sys/linux/bpf.txt
index 974106867..eb1c2761b 100644
--- a/sys/linux/bpf.txt
+++ b/sys/linux/bpf.txt
@@ -387,6 +387,7 @@ bpf_core_relo {
 bpf_instructions [
 	raw	array[bpf_insn]
 	framed	bpf_framed_program
+	ringbuf	bpf_program_ringbuf
 ] [varlen]
 
 bpf_framed_program {
@@ -395,6 +396,13 @@ bpf_framed_program {
 	exit	bpf_insn_exit
 } [packed]
 
+bpf_program_ringbuf {
+	initr0	bpf_insn_init_r0
+	reserve	bpf_insn_ringbuf_reserve
+	body	array[bpf_insn]
+	exit	bpf_insn_exit
+} [packed]
+
 bpf_insn [
 	generic		bpf_insn_generic
 	ldst		bpf_insn_ldst
@@ -593,6 +601,7 @@ type bpf_insn_map_fd_t[DST, MAP_FD] {
 
 type bpf_insn_map_fd bpf_insn_map_fd_t[flags[bpf_reg, int8:4], fd_bpf_map]
 type bpf_insn_tail_call_map_fd[DST] bpf_insn_map_fd_t[const[DST, int8:4], tail_call_map]
+type bpf_insn_ringbuf_fd[DST] bpf_insn_map_fd_t[const[DST, int8:4], ringbuf_map_fd]
 
 bpf_insn_map_idx {
 	code	const[bpf_insn_load_imm_dw, int8]
@@ -727,6 +736,19 @@ bpf_insn_tail_call {
 	insn4	bpf_insn_mov_imm[BPF_REG_0, 0]
 }
 
+# (18) r1 = map[id:16]
+# (b7) r2 = 8
+# (b7) r3 = 0
+# (85) call bpf_ringbuf_reserve#320112
+# (bf) r9 = r0
+bpf_insn_ringbuf_reserve {
+	insn1	bpf_insn_ringbuf_fd[BPF_REG_1]
+	insn2	bpf_insn_mov_imm[BPF_REG_2, 20]
+	insn3	bpf_insn_mov_imm[BPF_REG_3, 0]
+	insn4	bpf_insn_call_helper_t[const[BPF_FUNC_ringbuf_reserve, int32]]
+	insn5	bpf_insn_mov_reg[BPF_REG_0, BPF_REG_9]
+}
+
 define MAX_BPF_REG	__MAX_BPF_REG
 
 bpf_obj_pin_map [
diff --git a/sys/linux/bpf.txt.const b/sys/linux/bpf.txt.const
index 4e55324c0..8091b3944 100644
--- a/sys/linux/bpf.txt.const
+++ b/sys/linux/bpf.txt.const
@@ -66,6 +66,7 @@ BPF_EXIST = 2
 BPF_EXIT0 = 9
 BPF_FLOW_DISSECTOR = 17
 BPF_FUNC_INFO_SIZE = 8
+BPF_FUNC_ringbuf_reserve = 131
 BPF_FUNC_snprintf = 165
 BPF_FUNC_tail_call = 12
 BPF_FUNC_trace_printk = 6
diff --git a/sys/linux/test/bpf_helpers b/sys/linux/test/bpf_helpers
index 246e903b0..0bc1ce513 100644
--- a/sys/linux/test/bpf_helpers
+++ b/sys/linux/test/bpf_helpers
@@ -24,3 +24,5 @@ r4 = bpf$PROG_LOAD(AUTO, &AUTO={0x3, AUTO, &AUTO=@framed={{AUTO, AUTO, AUTO, AUT
 # Prepare, load, and execute a BPF program that calls ringbuf helpers
 
 r1 = bpf$MAP_CREATE_RINGBUF(AUTO, &AUTO={AUTO, AUTO, AUTO, 0x40000, AUTO, 0x0, 0x0, "00000000000000000000000000000000", 0x0, 0x0, 0x0, 0x0, 0x0, AUTO}, 0x48)
+
+r2 = bpf$PROG_LOAD(AUTO, &AUTO={0x3, AUTO, &AUTO=@ringbuf={{AUTO, AUTO, AUTO, AUTO, 0x0, AUTO, AUTO, AUTO, 0x0}, {{AUTO, AUTO, AUTO, AUTO, r1, AUTO, AUTO, AUTO, AUTO}, {AUTO, AUTO, AUTO, AUTO, AUTO, AUTO, AUTO}, {AUTO, AUTO, AUTO, AUTO, AUTO, AUTO, AUTO}, {AUTO, AUTO, AUTO, AUTO}, {AUTO, AUTO, AUTO, AUTO, AUTO, AUTO, AUTO}}, [], {AUTO, AUTO, AUTO, AUTO}}, &AUTO='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, "00000000000000000000000000000000", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0xa0) # EINVAL