1// SPDX-License-Identifier: GPL-2.0
2/* Converted from tools/testing/selftests/bpf/verifier/map_ptr.c */
3
4#include <linux/bpf.h>
5#include <bpf/bpf_helpers.h>
6#include "bpf_misc.h"
7
8#define MAX_ENTRIES 11
9
10struct test_val {
11	unsigned int index;
12	int foo[MAX_ENTRIES];
13};
14
15struct {
16	__uint(type, BPF_MAP_TYPE_ARRAY);
17	__uint(max_entries, 1);
18	__type(key, int);
19	__type(value, struct test_val);
20} map_array_48b SEC(".maps");
21
22struct other_val {
23	long long foo;
24	long long bar;
25};
26
27struct {
28	__uint(type, BPF_MAP_TYPE_HASH);
29	__uint(max_entries, 1);
30	__type(key, long long);
31	__type(value, struct other_val);
32} map_hash_16b SEC(".maps");
33
34SEC("socket")
35__description("bpf_map_ptr: read with negative offset rejected")
36__failure __msg("R1 is bpf_array invalid negative access: off=-8")
37__failure_unpriv
38__msg_unpriv("access is allowed only to CAP_PERFMON and CAP_SYS_ADMIN")
39__naked void read_with_negative_offset_rejected(void)
40{
41	asm volatile ("					\
42	r1 = r10;					\
43	r1 = %[map_array_48b] ll;			\
44	r6 = *(u64*)(r1 - 8);				\
45	r0 = 1;						\
46	exit;						\
47"	:
48	: __imm_addr(map_array_48b)
49	: __clobber_all);
50}
51
52SEC("socket")
53__description("bpf_map_ptr: write rejected")
54__failure __msg("only read from bpf_array is supported")
55__failure_unpriv
56__msg_unpriv("access is allowed only to CAP_PERFMON and CAP_SYS_ADMIN")
57__naked void bpf_map_ptr_write_rejected(void)
58{
59	asm volatile ("					\
60	r0 = 0;						\
61	*(u64*)(r10 - 8) = r0;				\
62	r2 = r10;					\
63	r2 += -8;					\
64	r1 = %[map_array_48b] ll;			\
65	*(u64*)(r1 + 0) = r2;				\
66	r0 = 1;						\
67	exit;						\
68"	:
69	: __imm_addr(map_array_48b)
70	: __clobber_all);
71}
72
73SEC("socket")
74__description("bpf_map_ptr: read non-existent field rejected")
75__failure
76__msg("cannot access ptr member ops with moff 0 in struct bpf_map with off 1 size 4")
77__failure_unpriv
78__msg_unpriv("access is allowed only to CAP_PERFMON and CAP_SYS_ADMIN")
79__flag(BPF_F_ANY_ALIGNMENT)
80__naked void read_non_existent_field_rejected(void)
81{
82	asm volatile ("					\
83	r6 = 0;						\
84	r1 = %[map_array_48b] ll;			\
85	r6 = *(u32*)(r1 + 1);				\
86	r0 = 1;						\
87	exit;						\
88"	:
89	: __imm_addr(map_array_48b)
90	: __clobber_all);
91}
92
93SEC("socket")
94__description("bpf_map_ptr: read ops field accepted")
95__success __failure_unpriv
96__msg_unpriv("access is allowed only to CAP_PERFMON and CAP_SYS_ADMIN")
97__retval(1)
98__naked void ptr_read_ops_field_accepted(void)
99{
100	asm volatile ("					\
101	r6 = 0;						\
102	r1 = %[map_array_48b] ll;			\
103	r6 = *(u64*)(r1 + 0);				\
104	r0 = 1;						\
105	exit;						\
106"	:
107	: __imm_addr(map_array_48b)
108	: __clobber_all);
109}
110
111SEC("socket")
112__description("bpf_map_ptr: r = 0, map_ptr = map_ptr + r")
113__success __failure_unpriv
114__msg_unpriv("R1 has pointer with unsupported alu operation")
115__retval(0)
116__naked void map_ptr_map_ptr_r(void)
117{
118	asm volatile ("					\
119	r0 = 0;						\
120	*(u64*)(r10 - 8) = r0;				\
121	r2 = r10;					\
122	r2 += -8;					\
123	r0 = 0;						\
124	r1 = %[map_hash_16b] ll;			\
125	r1 += r0;					\
126	call %[bpf_map_lookup_elem];			\
127	r0 = 0;						\
128	exit;						\
129"	:
130	: __imm(bpf_map_lookup_elem),
131	  __imm_addr(map_hash_16b)
132	: __clobber_all);
133}
134
135SEC("socket")
136__description("bpf_map_ptr: r = 0, r = r + map_ptr")
137__success __failure_unpriv
138__msg_unpriv("R0 has pointer with unsupported alu operation")
139__retval(0)
140__naked void _0_r_r_map_ptr(void)
141{
142	asm volatile ("					\
143	r0 = 0;						\
144	*(u64*)(r10 - 8) = r0;				\
145	r2 = r10;					\
146	r2 += -8;					\
147	r1 = 0;						\
148	r0 = %[map_hash_16b] ll;			\
149	r1 += r0;					\
150	call %[bpf_map_lookup_elem];			\
151	r0 = 0;						\
152	exit;						\
153"	:
154	: __imm(bpf_map_lookup_elem),
155	  __imm_addr(map_hash_16b)
156	: __clobber_all);
157}
158
159char _license[] SEC("license") = "GPL";
160