0001 {
0002 "direct map access, write test 1",
0003 .insns = {
0004 BPF_MOV64_IMM(BPF_REG_0, 1),
0005 BPF_LD_MAP_VALUE(BPF_REG_1, 0, 0),
0006 BPF_ST_MEM(BPF_DW, BPF_REG_1, 0, 4242),
0007 BPF_EXIT_INSN(),
0008 },
0009 .fixup_map_array_48b = { 1 },
0010 .result = ACCEPT,
0011 .retval = 1,
0012 },
0013 {
0014 "direct map access, write test 2",
0015 .insns = {
0016 BPF_MOV64_IMM(BPF_REG_0, 1),
0017 BPF_LD_MAP_VALUE(BPF_REG_1, 0, 8),
0018 BPF_ST_MEM(BPF_DW, BPF_REG_1, 0, 4242),
0019 BPF_EXIT_INSN(),
0020 },
0021 .fixup_map_array_48b = { 1 },
0022 .result = ACCEPT,
0023 .retval = 1,
0024 },
0025 {
0026 "direct map access, write test 3",
0027 .insns = {
0028 BPF_MOV64_IMM(BPF_REG_0, 1),
0029 BPF_LD_MAP_VALUE(BPF_REG_1, 0, 8),
0030 BPF_ST_MEM(BPF_DW, BPF_REG_1, 8, 4242),
0031 BPF_EXIT_INSN(),
0032 },
0033 .fixup_map_array_48b = { 1 },
0034 .result = ACCEPT,
0035 .retval = 1,
0036 },
0037 {
0038 "direct map access, write test 4",
0039 .insns = {
0040 BPF_MOV64_IMM(BPF_REG_0, 1),
0041 BPF_LD_MAP_VALUE(BPF_REG_1, 0, 40),
0042 BPF_ST_MEM(BPF_DW, BPF_REG_1, 0, 4242),
0043 BPF_EXIT_INSN(),
0044 },
0045 .fixup_map_array_48b = { 1 },
0046 .result = ACCEPT,
0047 .retval = 1,
0048 },
0049 {
0050 "direct map access, write test 5",
0051 .insns = {
0052 BPF_MOV64_IMM(BPF_REG_0, 1),
0053 BPF_LD_MAP_VALUE(BPF_REG_1, 0, 32),
0054 BPF_ST_MEM(BPF_DW, BPF_REG_1, 8, 4242),
0055 BPF_EXIT_INSN(),
0056 },
0057 .fixup_map_array_48b = { 1 },
0058 .result = ACCEPT,
0059 .retval = 1,
0060 },
0061 {
0062 "direct map access, write test 6",
0063 .insns = {
0064 BPF_MOV64_IMM(BPF_REG_0, 1),
0065 BPF_LD_MAP_VALUE(BPF_REG_1, 0, 40),
0066 BPF_ST_MEM(BPF_DW, BPF_REG_1, 4, 4242),
0067 BPF_EXIT_INSN(),
0068 },
0069 .fixup_map_array_48b = { 1 },
0070 .result = REJECT,
0071 .errstr = "R1 min value is outside of the allowed memory range",
0072 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
0073 },
0074 {
0075 "direct map access, write test 7",
0076 .insns = {
0077 BPF_MOV64_IMM(BPF_REG_0, 1),
0078 BPF_LD_MAP_VALUE(BPF_REG_1, 0, -1),
0079 BPF_ST_MEM(BPF_DW, BPF_REG_1, 4, 4242),
0080 BPF_EXIT_INSN(),
0081 },
0082 .fixup_map_array_48b = { 1 },
0083 .result = REJECT,
0084 .errstr = "direct value offset of 4294967295 is not allowed",
0085 },
0086 {
0087 "direct map access, write test 8",
0088 .insns = {
0089 BPF_MOV64_IMM(BPF_REG_0, 1),
0090 BPF_LD_MAP_VALUE(BPF_REG_1, 0, 1),
0091 BPF_ST_MEM(BPF_DW, BPF_REG_1, -1, 4242),
0092 BPF_EXIT_INSN(),
0093 },
0094 .fixup_map_array_48b = { 1 },
0095 .result = ACCEPT,
0096 .retval = 1,
0097 },
0098 {
0099 "direct map access, write test 9",
0100 .insns = {
0101 BPF_MOV64_IMM(BPF_REG_0, 1),
0102 BPF_LD_MAP_VALUE(BPF_REG_1, 0, 48),
0103 BPF_ST_MEM(BPF_DW, BPF_REG_1, 0, 4242),
0104 BPF_EXIT_INSN(),
0105 },
0106 .fixup_map_array_48b = { 1 },
0107 .result = REJECT,
0108 .errstr = "invalid access to map value pointer",
0109 },
0110 {
0111 "direct map access, write test 10",
0112 .insns = {
0113 BPF_MOV64_IMM(BPF_REG_0, 1),
0114 BPF_LD_MAP_VALUE(BPF_REG_1, 0, 47),
0115 BPF_ST_MEM(BPF_B, BPF_REG_1, 0, 4),
0116 BPF_EXIT_INSN(),
0117 },
0118 .fixup_map_array_48b = { 1 },
0119 .result = ACCEPT,
0120 .retval = 1,
0121 },
0122 {
0123 "direct map access, write test 11",
0124 .insns = {
0125 BPF_MOV64_IMM(BPF_REG_0, 1),
0126 BPF_LD_MAP_VALUE(BPF_REG_1, 0, 48),
0127 BPF_ST_MEM(BPF_B, BPF_REG_1, 0, 4),
0128 BPF_EXIT_INSN(),
0129 },
0130 .fixup_map_array_48b = { 1 },
0131 .result = REJECT,
0132 .errstr = "invalid access to map value pointer",
0133 },
0134 {
0135 "direct map access, write test 12",
0136 .insns = {
0137 BPF_MOV64_IMM(BPF_REG_0, 1),
0138 BPF_LD_MAP_VALUE(BPF_REG_1, 0, (1<<29)),
0139 BPF_ST_MEM(BPF_B, BPF_REG_1, 0, 4),
0140 BPF_EXIT_INSN(),
0141 },
0142 .fixup_map_array_48b = { 1 },
0143 .result = REJECT,
0144 .errstr = "direct value offset of 536870912 is not allowed",
0145 },
0146 {
0147 "direct map access, write test 13",
0148 .insns = {
0149 BPF_MOV64_IMM(BPF_REG_0, 1),
0150 BPF_LD_MAP_VALUE(BPF_REG_1, 0, (1<<29)-1),
0151 BPF_ST_MEM(BPF_B, BPF_REG_1, 0, 4),
0152 BPF_EXIT_INSN(),
0153 },
0154 .fixup_map_array_48b = { 1 },
0155 .result = REJECT,
0156 .errstr = "invalid access to map value pointer, value_size=48 off=536870911",
0157 },
0158 {
0159 "direct map access, write test 14",
0160 .insns = {
0161 BPF_MOV64_IMM(BPF_REG_0, 1),
0162 BPF_LD_MAP_VALUE(BPF_REG_1, 0, 47),
0163 BPF_LD_MAP_VALUE(BPF_REG_2, 0, 46),
0164 BPF_ST_MEM(BPF_H, BPF_REG_2, 0, 0xffff),
0165 BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1, 0),
0166 BPF_EXIT_INSN(),
0167 },
0168 .fixup_map_array_48b = { 1, 3 },
0169 .result = ACCEPT,
0170 .retval = 0xff,
0171 },
0172 {
0173 "direct map access, write test 15",
0174 .insns = {
0175 BPF_MOV64_IMM(BPF_REG_0, 1),
0176 BPF_LD_MAP_VALUE(BPF_REG_1, 0, 46),
0177 BPF_LD_MAP_VALUE(BPF_REG_2, 0, 46),
0178 BPF_ST_MEM(BPF_H, BPF_REG_2, 0, 0xffff),
0179 BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1, 0),
0180 BPF_EXIT_INSN(),
0181 },
0182 .fixup_map_array_48b = { 1, 3 },
0183 .result = ACCEPT,
0184 .retval = 0xffff,
0185 },
0186 {
0187 "direct map access, write test 16",
0188 .insns = {
0189 BPF_MOV64_IMM(BPF_REG_0, 1),
0190 BPF_LD_MAP_VALUE(BPF_REG_1, 0, 46),
0191 BPF_LD_MAP_VALUE(BPF_REG_2, 0, 47),
0192 BPF_ST_MEM(BPF_H, BPF_REG_2, 0, 0xffff),
0193 BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1, 0),
0194 BPF_EXIT_INSN(),
0195 },
0196 .fixup_map_array_48b = { 1, 3 },
0197 .result = REJECT,
0198 .errstr = "invalid access to map value, value_size=48 off=47 size=2",
0199 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
0200 },
0201 {
0202 "direct map access, write test 17",
0203 .insns = {
0204 BPF_MOV64_IMM(BPF_REG_0, 1),
0205 BPF_LD_MAP_VALUE(BPF_REG_1, 0, 46),
0206 BPF_LD_MAP_VALUE(BPF_REG_2, 0, 46),
0207 BPF_ST_MEM(BPF_H, BPF_REG_2, 1, 0xffff),
0208 BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1, 0),
0209 BPF_EXIT_INSN(),
0210 },
0211 .fixup_map_array_48b = { 1, 3 },
0212 .result = REJECT,
0213 .errstr = "invalid access to map value, value_size=48 off=47 size=2",
0214 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
0215 },
0216 {
0217 "direct map access, write test 18",
0218 .insns = {
0219 BPF_MOV64_IMM(BPF_REG_0, 1),
0220 BPF_LD_MAP_VALUE(BPF_REG_1, 0, 0),
0221 BPF_ST_MEM(BPF_H, BPF_REG_1, 0, 42),
0222 BPF_EXIT_INSN(),
0223 },
0224 .fixup_map_array_small = { 1 },
0225 .result = REJECT,
0226 .errstr = "R1 min value is outside of the allowed memory range",
0227 },
0228 {
0229 "direct map access, write test 19",
0230 .insns = {
0231 BPF_MOV64_IMM(BPF_REG_0, 1),
0232 BPF_LD_MAP_VALUE(BPF_REG_1, 0, 0),
0233 BPF_ST_MEM(BPF_B, BPF_REG_1, 0, 42),
0234 BPF_EXIT_INSN(),
0235 },
0236 .fixup_map_array_small = { 1 },
0237 .result = ACCEPT,
0238 .retval = 1,
0239 },
0240 {
0241 "direct map access, write test 20",
0242 .insns = {
0243 BPF_MOV64_IMM(BPF_REG_0, 1),
0244 BPF_LD_MAP_VALUE(BPF_REG_1, 0, 1),
0245 BPF_ST_MEM(BPF_B, BPF_REG_1, 0, 42),
0246 BPF_EXIT_INSN(),
0247 },
0248 .fixup_map_array_small = { 1 },
0249 .result = REJECT,
0250 .errstr = "invalid access to map value pointer",
0251 },
0252 {
0253 "direct map access, invalid insn test 1",
0254 .insns = {
0255 BPF_MOV64_IMM(BPF_REG_0, 1),
0256 BPF_LD_IMM64_RAW_FULL(BPF_REG_1, BPF_PSEUDO_MAP_VALUE, 0, 1, 0, 47),
0257 BPF_EXIT_INSN(),
0258 },
0259 .fixup_map_array_48b = { 1 },
0260 .result = REJECT,
0261 .errstr = "invalid bpf_ld_imm64 insn",
0262 },
0263 {
0264 "direct map access, invalid insn test 2",
0265 .insns = {
0266 BPF_MOV64_IMM(BPF_REG_0, 1),
0267 BPF_LD_IMM64_RAW_FULL(BPF_REG_1, BPF_PSEUDO_MAP_VALUE, 1, 0, 0, 47),
0268 BPF_EXIT_INSN(),
0269 },
0270 .fixup_map_array_48b = { 1 },
0271 .result = REJECT,
0272 .errstr = "BPF_LD_IMM64 uses reserved fields",
0273 },
0274 {
0275 "direct map access, invalid insn test 3",
0276 .insns = {
0277 BPF_MOV64_IMM(BPF_REG_0, 1),
0278 BPF_LD_IMM64_RAW_FULL(BPF_REG_1, BPF_PSEUDO_MAP_VALUE, ~0, 0, 0, 47),
0279 BPF_EXIT_INSN(),
0280 },
0281 .fixup_map_array_48b = { 1 },
0282 .result = REJECT,
0283 .errstr = "BPF_LD_IMM64 uses reserved fields",
0284 },
0285 {
0286 "direct map access, invalid insn test 4",
0287 .insns = {
0288 BPF_MOV64_IMM(BPF_REG_0, 1),
0289 BPF_LD_IMM64_RAW_FULL(BPF_REG_1, BPF_PSEUDO_MAP_VALUE, 0, ~0, 0, 47),
0290 BPF_EXIT_INSN(),
0291 },
0292 .fixup_map_array_48b = { 1 },
0293 .result = REJECT,
0294 .errstr = "invalid bpf_ld_imm64 insn",
0295 },
0296 {
0297 "direct map access, invalid insn test 5",
0298 .insns = {
0299 BPF_MOV64_IMM(BPF_REG_0, 1),
0300 BPF_LD_IMM64_RAW_FULL(BPF_REG_1, BPF_PSEUDO_MAP_VALUE, ~0, ~0, 0, 47),
0301 BPF_EXIT_INSN(),
0302 },
0303 .fixup_map_array_48b = { 1 },
0304 .result = REJECT,
0305 .errstr = "invalid bpf_ld_imm64 insn",
0306 },
0307 {
0308 "direct map access, invalid insn test 6",
0309 .insns = {
0310 BPF_MOV64_IMM(BPF_REG_0, 1),
0311 BPF_LD_IMM64_RAW_FULL(BPF_REG_1, BPF_PSEUDO_MAP_FD, ~0, 0, 0, 0),
0312 BPF_EXIT_INSN(),
0313 },
0314 .fixup_map_array_48b = { 1 },
0315 .result = REJECT,
0316 .errstr = "BPF_LD_IMM64 uses reserved fields",
0317 },
0318 {
0319 "direct map access, invalid insn test 7",
0320 .insns = {
0321 BPF_MOV64_IMM(BPF_REG_0, 1),
0322 BPF_LD_IMM64_RAW_FULL(BPF_REG_1, BPF_PSEUDO_MAP_FD, 0, ~0, 0, 0),
0323 BPF_EXIT_INSN(),
0324 },
0325 .fixup_map_array_48b = { 1 },
0326 .result = REJECT,
0327 .errstr = "invalid bpf_ld_imm64 insn",
0328 },
0329 {
0330 "direct map access, invalid insn test 8",
0331 .insns = {
0332 BPF_MOV64_IMM(BPF_REG_0, 1),
0333 BPF_LD_IMM64_RAW_FULL(BPF_REG_1, BPF_PSEUDO_MAP_FD, ~0, ~0, 0, 0),
0334 BPF_EXIT_INSN(),
0335 },
0336 .fixup_map_array_48b = { 1 },
0337 .result = REJECT,
0338 .errstr = "invalid bpf_ld_imm64 insn",
0339 },
0340 {
0341 "direct map access, invalid insn test 9",
0342 .insns = {
0343 BPF_MOV64_IMM(BPF_REG_0, 1),
0344 BPF_LD_IMM64_RAW_FULL(BPF_REG_1, BPF_PSEUDO_MAP_FD, 0, 0, 0, 47),
0345 BPF_EXIT_INSN(),
0346 },
0347 .fixup_map_array_48b = { 1 },
0348 .result = REJECT,
0349 .errstr = "unrecognized bpf_ld_imm64 insn",
0350 },
