bpf/verifier/bpf_get_stack.c

0001 {
0002     "bpf_get_stack return R0 within range",
0003     .insns = {
0004     BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
0005     BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
0006     BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
0007     BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
0008     BPF_LD_MAP_FD(BPF_REG_1, 0),
0009     BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
0010     BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 28),
0011     BPF_MOV64_REG(BPF_REG_7, BPF_REG_0),
0012     BPF_MOV64_IMM(BPF_REG_9, sizeof(struct test_val)/2),
0013     BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
0014     BPF_MOV64_REG(BPF_REG_2, BPF_REG_7),
0015     BPF_MOV64_IMM(BPF_REG_3, sizeof(struct test_val)/2),
0016     BPF_MOV64_IMM(BPF_REG_4, 256),
0017     BPF_EMIT_CALL(BPF_FUNC_get_stack),
0018     BPF_MOV64_IMM(BPF_REG_1, 0),
0019     BPF_MOV64_REG(BPF_REG_8, BPF_REG_0),
0020     BPF_ALU64_IMM(BPF_LSH, BPF_REG_8, 32),
0021     BPF_ALU64_IMM(BPF_ARSH, BPF_REG_8, 32),
0022     BPF_JMP_REG(BPF_JSGT, BPF_REG_1, BPF_REG_8, 16),
0023     BPF_ALU64_REG(BPF_SUB, BPF_REG_9, BPF_REG_8),
0024     BPF_MOV64_REG(BPF_REG_2, BPF_REG_7),
0025     BPF_ALU64_REG(BPF_ADD, BPF_REG_2, BPF_REG_8),
0026     BPF_MOV64_REG(BPF_REG_1, BPF_REG_9),
0027     BPF_ALU64_IMM(BPF_LSH, BPF_REG_1, 32),
0028     BPF_ALU64_IMM(BPF_ARSH, BPF_REG_1, 32),
0029     BPF_MOV64_REG(BPF_REG_3, BPF_REG_2),
0030     BPF_ALU64_REG(BPF_ADD, BPF_REG_3, BPF_REG_1),
0031     BPF_MOV64_REG(BPF_REG_1, BPF_REG_7),
0032     BPF_MOV64_IMM(BPF_REG_5, sizeof(struct test_val)/2),
0033     BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_5),
0034     BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_1, 4),
0035     BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
0036     BPF_MOV64_REG(BPF_REG_3, BPF_REG_9),
0037     BPF_MOV64_IMM(BPF_REG_4, 0),
0038     BPF_EMIT_CALL(BPF_FUNC_get_stack),
0039     BPF_EXIT_INSN(),
0040     },
0041     .fixup_map_hash_48b = { 4 },
0042     .result = ACCEPT,
0043     .prog_type = BPF_PROG_TYPE_TRACEPOINT,
0044 },
0045 {
0046     "bpf_get_task_stack return R0 range is refined",
0047     .insns = {
0048     BPF_LDX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, 0),
0049     BPF_LDX_MEM(BPF_DW, BPF_REG_6, BPF_REG_6, 0), // ctx->meta->seq
0050     BPF_LDX_MEM(BPF_DW, BPF_REG_7, BPF_REG_1, 8), // ctx->task
0051     BPF_LD_MAP_FD(BPF_REG_1, 0), // fixup_map_array_48b
0052     BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
0053     BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
0054     BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
0055     BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
0056     BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 2),
0057     BPF_MOV64_IMM(BPF_REG_0, 0),
0058     BPF_EXIT_INSN(),
0059     BPF_JMP_IMM(BPF_JNE, BPF_REG_7, 0, 2),
0060     BPF_MOV64_IMM(BPF_REG_0, 0),
0061     BPF_EXIT_INSN(),
0062
0063     BPF_MOV64_REG(BPF_REG_1, BPF_REG_7),
0064     BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
0065     BPF_MOV64_REG(BPF_REG_9, BPF_REG_0), // keep buf for seq_write
0066     BPF_MOV64_IMM(BPF_REG_3, 48),
0067     BPF_MOV64_IMM(BPF_REG_4, 0),
0068     BPF_EMIT_CALL(BPF_FUNC_get_task_stack),
0069     BPF_JMP_IMM(BPF_JSGT, BPF_REG_0, 0, 2),
0070     BPF_MOV64_IMM(BPF_REG_0, 0),
0071     BPF_EXIT_INSN(),
0072
0073     BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
0074     BPF_MOV64_REG(BPF_REG_2, BPF_REG_9),
0075     BPF_MOV64_REG(BPF_REG_3, BPF_REG_0),
0076     BPF_EMIT_CALL(BPF_FUNC_seq_write),
0077
0078     BPF_MOV64_IMM(BPF_REG_0, 0),
0079     BPF_EXIT_INSN(),
0080     },
0081     .result = ACCEPT,
0082     .prog_type = BPF_PROG_TYPE_TRACING,
0083     .expected_attach_type = BPF_TRACE_ITER,
0084     .kfunc = "task",
0085     .runs = -1, // Don't run, just load
0086     .fixup_map_array_48b = { 3 },
0087 },