Commit fb2abb73 authored by Daniel Borkmann's avatar Daniel Borkmann Committed by Alexei Starovoitov
Browse files

bpf, selftest: test {rd, wr}only flags and direct value access 



Extend test_verifier with various test cases around the two kernel
extensions, that is, {rd,wr}only map support as well as direct map
value access. All passing, one skipped due to xskmap not present
on test machine:

  # ./test_verifier
  [...]
  #948/p XDP pkt read, pkt_meta' <= pkt_data, bad access 1 OK
  #949/p XDP pkt read, pkt_meta' <= pkt_data, bad access 2 OK
  #950/p XDP pkt read, pkt_data <= pkt_meta', good access OK
  #951/p XDP pkt read, pkt_data <= pkt_meta', bad access 1 OK
  #952/p XDP pkt read, pkt_data <= pkt_meta', bad access 2 OK
  Summary: 1410 PASSED, 1 SKIPPED, 0 FAILED

Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
Acked-by: default avatarMartin KaFai Lau <kafai@fb.com>
Signed-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
parent 817998af

tools/include/linux/filter.h

+20 −1
Original line number Diff line number Diff line
@@ -278,10 +278,29 @@ 
		.off   = 0,					\

		.imm   = ((__u64) (IMM)) >> 32 })



#define BPF_LD_IMM64_RAW_FULL(DST, SRC, OFF1, OFF2, IMM1, IMM2)	\

	((struct bpf_insn) {					\

		.code  = BPF_LD | BPF_DW | BPF_IMM,		\

		.dst_reg = DST,					\

		.src_reg = SRC,					\

		.off   = OFF1,					\

		.imm   = IMM1 }),				\

	((struct bpf_insn) {					\

		.code  = 0, /* zero is reserved opcode */	\

		.dst_reg = 0,					\

		.src_reg = 0,					\

		.off   = OFF2,					\

		.imm   = IMM2 })



/* pseudo BPF_LD_IMM64 insn used to refer to process-local map_fd */



#define BPF_LD_MAP_FD(DST, MAP_FD)				\

	BPF_LD_IMM64_RAW(DST, BPF_PSEUDO_MAP_FD, MAP_FD)

	BPF_LD_IMM64_RAW_FULL(DST, BPF_PSEUDO_MAP_FD, 0, 0,	\

			      MAP_FD, 0)



#define BPF_LD_MAP_VALUE(DST, MAP_FD, VALUE_OFF)		\

	BPF_LD_IMM64_RAW_FULL(DST, BPF_PSEUDO_MAP_VALUE, 0, 0,	\

			      MAP_FD, VALUE_OFF)



/* Relative call */

tools/testing/selftests/bpf/test_verifier.c

+47 −4
Original line number Diff line number Diff line
@@ -52,7 +52,7 @@ 
#define MAX_INSNS	BPF_MAXINSNS

#define MAX_TEST_INSNS	1000000

#define MAX_FIXUPS	8

#define MAX_NR_MAPS	14

#define MAX_NR_MAPS	16

#define MAX_TEST_RUNS	8

#define POINTER_VALUE	0xcafe4all

#define TEST_DATA_LEN	64
@@ -82,6 +82,9 @@ struct bpf_test { 
	int fixup_cgroup_storage[MAX_FIXUPS];

	int fixup_percpu_cgroup_storage[MAX_FIXUPS];

	int fixup_map_spin_lock[MAX_FIXUPS];

	int fixup_map_array_ro[MAX_FIXUPS];

	int fixup_map_array_wo[MAX_FIXUPS];

	int fixup_map_array_small[MAX_FIXUPS];

	const char *errstr;

	const char *errstr_unpriv;

	uint32_t retval, retval_unpriv, insn_processed;
@@ -285,13 +288,15 @@ static bool skip_unsupported_map(enum bpf_map_type map_type) 
	return false;

}



static int create_map(uint32_t type, uint32_t size_key,

		      uint32_t size_value, uint32_t max_elem)

static int __create_map(uint32_t type, uint32_t size_key,

			uint32_t size_value, uint32_t max_elem,

			uint32_t extra_flags)

{

	int fd;



	fd = bpf_create_map(type, size_key, size_value, max_elem,

			    type == BPF_MAP_TYPE_HASH ? BPF_F_NO_PREALLOC : 0);

			    (type == BPF_MAP_TYPE_HASH ?

			     BPF_F_NO_PREALLOC : 0) | extra_flags);

	if (fd < 0) {

		if (skip_unsupported_map(type))

			return -1;
@@ -301,6 +306,12 @@ static int create_map(uint32_t type, uint32_t size_key, 
	return fd;

}



static int create_map(uint32_t type, uint32_t size_key,

		      uint32_t size_value, uint32_t max_elem)

{

	return __create_map(type, size_key, size_value, max_elem, 0);

}



static void update_map(int fd, int index)

{

	struct test_val value = {
@@ -527,6 +538,9 @@ static void do_test_fixup(struct bpf_test *test, enum bpf_prog_type prog_type, 
	int *fixup_cgroup_storage = test->fixup_cgroup_storage;

	int *fixup_percpu_cgroup_storage = test->fixup_percpu_cgroup_storage;

	int *fixup_map_spin_lock = test->fixup_map_spin_lock;

	int *fixup_map_array_ro = test->fixup_map_array_ro;

	int *fixup_map_array_wo = test->fixup_map_array_wo;

	int *fixup_map_array_small = test->fixup_map_array_small;



	if (test->fill_helper) {

		test->fill_insns = calloc(MAX_TEST_INSNS, sizeof(struct bpf_insn));
@@ -652,6 +666,35 @@ static void do_test_fixup(struct bpf_test *test, enum bpf_prog_type prog_type, 
			fixup_map_spin_lock++;

		} while (*fixup_map_spin_lock);

	}

	if (*fixup_map_array_ro) {

		map_fds[14] = __create_map(BPF_MAP_TYPE_ARRAY, sizeof(int),

					   sizeof(struct test_val), 1,

					   BPF_F_RDONLY_PROG);

		update_map(map_fds[14], 0);

		do {

			prog[*fixup_map_array_ro].imm = map_fds[14];

			fixup_map_array_ro++;

		} while (*fixup_map_array_ro);

	}

	if (*fixup_map_array_wo) {

		map_fds[15] = __create_map(BPF_MAP_TYPE_ARRAY, sizeof(int),

					   sizeof(struct test_val), 1,

					   BPF_F_WRONLY_PROG);

		update_map(map_fds[15], 0);

		do {

			prog[*fixup_map_array_wo].imm = map_fds[15];

			fixup_map_array_wo++;

		} while (*fixup_map_array_wo);

	}

	if (*fixup_map_array_small) {

		map_fds[16] = __create_map(BPF_MAP_TYPE_ARRAY, sizeof(int),

					   1, 1, 0);

		update_map(map_fds[16], 0);

		do {

			prog[*fixup_map_array_small].imm = map_fds[16];

			fixup_map_array_small++;

		} while (*fixup_map_array_small);

	}

}



static int set_admin(bool admin)

tools/testing/selftests/bpf/verifier/array_access.c

+159 −0
Original line number Diff line number Diff line
@@ -217,3 +217,162 @@ 
	.result = REJECT,

	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,

},

{

	"valid read map access into a read-only array 1",

	.insns = {

	BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),

	BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),

	BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),

	BPF_LD_MAP_FD(BPF_REG_1, 0),

	BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),

	BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),

	BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_0, 0),

	BPF_EXIT_INSN(),

	},

	.fixup_map_array_ro = { 3 },

	.result = ACCEPT,

	.retval = 28,

},

{

	"valid read map access into a read-only array 2",

	.insns = {

	BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),

	BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),

	BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),

	BPF_LD_MAP_FD(BPF_REG_1, 0),

	BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),

	BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),



	BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),

	BPF_MOV64_IMM(BPF_REG_2, 4),

	BPF_MOV64_IMM(BPF_REG_3, 0),

	BPF_MOV64_IMM(BPF_REG_4, 0),

	BPF_MOV64_IMM(BPF_REG_5, 0),

	BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,

		     BPF_FUNC_csum_diff),

	BPF_EXIT_INSN(),

	},

	.prog_type = BPF_PROG_TYPE_SCHED_CLS,

	.fixup_map_array_ro = { 3 },

	.result = ACCEPT,

	.retval = -29,

},

{

	"invalid write map access into a read-only array 1",

	.insns = {

	BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),

	BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),

	BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),

	BPF_LD_MAP_FD(BPF_REG_1, 0),

	BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),

	BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),

	BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 42),

	BPF_EXIT_INSN(),

	},

	.fixup_map_array_ro = { 3 },

	.result = REJECT,

	.errstr = "write into map forbidden",

},

{

	"invalid write map access into a read-only array 2",

	.insns = {

	BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),

	BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),

	BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),

	BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),

	BPF_LD_MAP_FD(BPF_REG_1, 0),

	BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),

	BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),

	BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),

	BPF_MOV64_IMM(BPF_REG_2, 0),

	BPF_MOV64_REG(BPF_REG_3, BPF_REG_0),

	BPF_MOV64_IMM(BPF_REG_4, 8),

	BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,

		     BPF_FUNC_skb_load_bytes),

	BPF_EXIT_INSN(),

	},

	.prog_type = BPF_PROG_TYPE_SCHED_CLS,

	.fixup_map_array_ro = { 4 },

	.result = REJECT,

	.errstr = "write into map forbidden",

},

{

	"valid write map access into a write-only array 1",

	.insns = {

	BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),

	BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),

	BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),

	BPF_LD_MAP_FD(BPF_REG_1, 0),

	BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),

	BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),

	BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 42),

	BPF_MOV64_IMM(BPF_REG_0, 1),

	BPF_EXIT_INSN(),

	},

	.fixup_map_array_wo = { 3 },

	.result = ACCEPT,

	.retval = 1,

},

{

	"valid write map access into a write-only array 2",

	.insns = {

	BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),

	BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),

	BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),

	BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),

	BPF_LD_MAP_FD(BPF_REG_1, 0),

	BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),

	BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),

	BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),

	BPF_MOV64_IMM(BPF_REG_2, 0),

	BPF_MOV64_REG(BPF_REG_3, BPF_REG_0),

	BPF_MOV64_IMM(BPF_REG_4, 8),

	BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,

		     BPF_FUNC_skb_load_bytes),

	BPF_EXIT_INSN(),

	},

	.prog_type = BPF_PROG_TYPE_SCHED_CLS,

	.fixup_map_array_wo = { 4 },

	.result = ACCEPT,

	.retval = 0,

},

{

	"invalid read map access into a write-only array 1",

	.insns = {

	BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),

	BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),

	BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),

	BPF_LD_MAP_FD(BPF_REG_1, 0),

	BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),

	BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),

	BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_0, 0),

	BPF_EXIT_INSN(),

	},

	.fixup_map_array_wo = { 3 },

	.result = REJECT,

	.errstr = "read from map forbidden",

},

{

	"invalid read map access into a write-only array 2",

	.insns = {

	BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),

	BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),

	BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),

	BPF_LD_MAP_FD(BPF_REG_1, 0),

	BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),

	BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),



	BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),

	BPF_MOV64_IMM(BPF_REG_2, 4),

	BPF_MOV64_IMM(BPF_REG_3, 0),

	BPF_MOV64_IMM(BPF_REG_4, 0),

	BPF_MOV64_IMM(BPF_REG_5, 0),

	BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,

		     BPF_FUNC_csum_diff),

	BPF_EXIT_INSN(),

	},

	.prog_type = BPF_PROG_TYPE_SCHED_CLS,

	.fixup_map_array_wo = { 3 },

	.result = REJECT,

	.errstr = "read from map forbidden",

},

tools/testing/selftests/bpf/verifier/direct_value_access.c

0 → 100644
+347 −0
Original line number Diff line number Diff line 
{

	"direct map access, write test 1",

	.insns = {

	BPF_MOV64_IMM(BPF_REG_0, 1),

	BPF_LD_MAP_VALUE(BPF_REG_1, 0, 0),

	BPF_ST_MEM(BPF_DW, BPF_REG_1, 0, 4242),

	BPF_EXIT_INSN(),

	},

	.fixup_map_array_48b = { 1 },

	.result = ACCEPT,

	.retval = 1,

},

{

	"direct map access, write test 2",

	.insns = {

	BPF_MOV64_IMM(BPF_REG_0, 1),

	BPF_LD_MAP_VALUE(BPF_REG_1, 0, 8),

	BPF_ST_MEM(BPF_DW, BPF_REG_1, 0, 4242),

	BPF_EXIT_INSN(),

	},

	.fixup_map_array_48b = { 1 },

	.result = ACCEPT,

	.retval = 1,

},

{

	"direct map access, write test 3",

	.insns = {

	BPF_MOV64_IMM(BPF_REG_0, 1),

	BPF_LD_MAP_VALUE(BPF_REG_1, 0, 8),

	BPF_ST_MEM(BPF_DW, BPF_REG_1, 8, 4242),

	BPF_EXIT_INSN(),

	},

	.fixup_map_array_48b = { 1 },

	.result = ACCEPT,

	.retval = 1,

},

{

	"direct map access, write test 4",

	.insns = {

	BPF_MOV64_IMM(BPF_REG_0, 1),

	BPF_LD_MAP_VALUE(BPF_REG_1, 0, 40),

	BPF_ST_MEM(BPF_DW, BPF_REG_1, 0, 4242),

	BPF_EXIT_INSN(),

	},

	.fixup_map_array_48b = { 1 },

	.result = ACCEPT,

	.retval = 1,

},

{

	"direct map access, write test 5",

	.insns = {

	BPF_MOV64_IMM(BPF_REG_0, 1),

	BPF_LD_MAP_VALUE(BPF_REG_1, 0, 32),

	BPF_ST_MEM(BPF_DW, BPF_REG_1, 8, 4242),

	BPF_EXIT_INSN(),

	},

	.fixup_map_array_48b = { 1 },

	.result = ACCEPT,

	.retval = 1,

},

{

	"direct map access, write test 6",

	.insns = {

	BPF_MOV64_IMM(BPF_REG_0, 1),

	BPF_LD_MAP_VALUE(BPF_REG_1, 0, 40),

	BPF_ST_MEM(BPF_DW, BPF_REG_1, 4, 4242),

	BPF_EXIT_INSN(),

	},

	.fixup_map_array_48b = { 1 },

	.result = REJECT,

	.errstr = "R1 min value is outside of the array range",

},

{

	"direct map access, write test 7",

	.insns = {

	BPF_MOV64_IMM(BPF_REG_0, 1),

	BPF_LD_MAP_VALUE(BPF_REG_1, 0, -1),

	BPF_ST_MEM(BPF_DW, BPF_REG_1, 4, 4242),

	BPF_EXIT_INSN(),

	},

	.fixup_map_array_48b = { 1 },

	.result = REJECT,

	.errstr = "direct value offset of 4294967295 is not allowed",

},

{

	"direct map access, write test 8",

	.insns = {

	BPF_MOV64_IMM(BPF_REG_0, 1),

	BPF_LD_MAP_VALUE(BPF_REG_1, 0, 1),

	BPF_ST_MEM(BPF_DW, BPF_REG_1, -1, 4242),

	BPF_EXIT_INSN(),

	},

	.fixup_map_array_48b = { 1 },

	.result = ACCEPT,

	.retval = 1,

},

{

	"direct map access, write test 9",

	.insns = {

	BPF_MOV64_IMM(BPF_REG_0, 1),

	BPF_LD_MAP_VALUE(BPF_REG_1, 0, 48),

	BPF_ST_MEM(BPF_DW, BPF_REG_1, 0, 4242),

	BPF_EXIT_INSN(),

	},

	.fixup_map_array_48b = { 1 },

	.result = REJECT,

	.errstr = "invalid access to map value pointer",

},

{

	"direct map access, write test 10",

	.insns = {

	BPF_MOV64_IMM(BPF_REG_0, 1),

	BPF_LD_MAP_VALUE(BPF_REG_1, 0, 47),

	BPF_ST_MEM(BPF_B, BPF_REG_1, 0, 4),

	BPF_EXIT_INSN(),

	},

	.fixup_map_array_48b = { 1 },

	.result = ACCEPT,

	.retval = 1,

},

{

	"direct map access, write test 11",

	.insns = {

	BPF_MOV64_IMM(BPF_REG_0, 1),

	BPF_LD_MAP_VALUE(BPF_REG_1, 0, 48),

	BPF_ST_MEM(BPF_B, BPF_REG_1, 0, 4),

	BPF_EXIT_INSN(),

	},

	.fixup_map_array_48b = { 1 },

	.result = REJECT,

	.errstr = "invalid access to map value pointer",

},

{

	"direct map access, write test 12",

	.insns = {

	BPF_MOV64_IMM(BPF_REG_0, 1),

	BPF_LD_MAP_VALUE(BPF_REG_1, 0, (1<<29)),

	BPF_ST_MEM(BPF_B, BPF_REG_1, 0, 4),

	BPF_EXIT_INSN(),

	},

	.fixup_map_array_48b = { 1 },

	.result = REJECT,

	.errstr = "direct value offset of 536870912 is not allowed",

},

{

	"direct map access, write test 13",

	.insns = {

	BPF_MOV64_IMM(BPF_REG_0, 1),

	BPF_LD_MAP_VALUE(BPF_REG_1, 0, (1<<29)-1),

	BPF_ST_MEM(BPF_B, BPF_REG_1, 0, 4),

	BPF_EXIT_INSN(),

	},

	.fixup_map_array_48b = { 1 },

	.result = REJECT,

	.errstr = "invalid access to map value pointer, value_size=48 off=536870911",

},

{

	"direct map access, write test 14",

	.insns = {

	BPF_MOV64_IMM(BPF_REG_0, 1),

	BPF_LD_MAP_VALUE(BPF_REG_1, 0, 47),

	BPF_LD_MAP_VALUE(BPF_REG_2, 0, 46),

	BPF_ST_MEM(BPF_H, BPF_REG_2, 0, 0xffff),

	BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1, 0),

	BPF_EXIT_INSN(),

	},

	.fixup_map_array_48b = { 1, 3 },

	.result = ACCEPT,

	.retval = 0xff,

},

{

	"direct map access, write test 15",

	.insns = {

	BPF_MOV64_IMM(BPF_REG_0, 1),

	BPF_LD_MAP_VALUE(BPF_REG_1, 0, 46),

	BPF_LD_MAP_VALUE(BPF_REG_2, 0, 46),

	BPF_ST_MEM(BPF_H, BPF_REG_2, 0, 0xffff),

	BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1, 0),

	BPF_EXIT_INSN(),

	},

	.fixup_map_array_48b = { 1, 3 },

	.result = ACCEPT,

	.retval = 0xffff,

},

{

	"direct map access, write test 16",

	.insns = {

	BPF_MOV64_IMM(BPF_REG_0, 1),

	BPF_LD_MAP_VALUE(BPF_REG_1, 0, 46),

	BPF_LD_MAP_VALUE(BPF_REG_2, 0, 47),

	BPF_ST_MEM(BPF_H, BPF_REG_2, 0, 0xffff),

	BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1, 0),

	BPF_EXIT_INSN(),

	},

	.fixup_map_array_48b = { 1, 3 },

	.result = REJECT,

	.errstr = "invalid access to map value, value_size=48 off=47 size=2",

},

{

	"direct map access, write test 17",

	.insns = {

	BPF_MOV64_IMM(BPF_REG_0, 1),

	BPF_LD_MAP_VALUE(BPF_REG_1, 0, 46),

	BPF_LD_MAP_VALUE(BPF_REG_2, 0, 46),

	BPF_ST_MEM(BPF_H, BPF_REG_2, 1, 0xffff),

	BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1, 0),

	BPF_EXIT_INSN(),

	},

	.fixup_map_array_48b = { 1, 3 },

	.result = REJECT,

	.errstr = "invalid access to map value, value_size=48 off=47 size=2",

},

{

	"direct map access, write test 18",

	.insns = {

	BPF_MOV64_IMM(BPF_REG_0, 1),

	BPF_LD_MAP_VALUE(BPF_REG_1, 0, 0),

	BPF_ST_MEM(BPF_H, BPF_REG_1, 0, 42),

	BPF_EXIT_INSN(),

	},

	.fixup_map_array_small = { 1 },

	.result = REJECT,

	.errstr = "R1 min value is outside of the array range",

},

{

	"direct map access, write test 19",

	.insns = {

	BPF_MOV64_IMM(BPF_REG_0, 1),

	BPF_LD_MAP_VALUE(BPF_REG_1, 0, 0),

	BPF_ST_MEM(BPF_B, BPF_REG_1, 0, 42),

	BPF_EXIT_INSN(),

	},

	.fixup_map_array_small = { 1 },

	.result = ACCEPT,

	.retval = 1,

},

{

	"direct map access, write test 20",

	.insns = {

	BPF_MOV64_IMM(BPF_REG_0, 1),

	BPF_LD_MAP_VALUE(BPF_REG_1, 0, 1),

	BPF_ST_MEM(BPF_B, BPF_REG_1, 0, 42),

	BPF_EXIT_INSN(),

	},

	.fixup_map_array_small = { 1 },

	.result = REJECT,

	.errstr = "invalid access to map value pointer",

},

{

	"direct map access, invalid insn test 1",

	.insns = {

	BPF_MOV64_IMM(BPF_REG_0, 1),

	BPF_LD_IMM64_RAW_FULL(BPF_REG_1, BPF_PSEUDO_MAP_VALUE, 0, 1, 0, 47),

	BPF_EXIT_INSN(),

	},

	.fixup_map_array_48b = { 1 },

	.result = REJECT,

	.errstr = "invalid bpf_ld_imm64 insn",

},

{

	"direct map access, invalid insn test 2",

	.insns = {

	BPF_MOV64_IMM(BPF_REG_0, 1),

	BPF_LD_IMM64_RAW_FULL(BPF_REG_1, BPF_PSEUDO_MAP_VALUE, 1, 0, 0, 47),

	BPF_EXIT_INSN(),

	},

	.fixup_map_array_48b = { 1 },

	.result = REJECT,

	.errstr = "BPF_LD_IMM64 uses reserved fields",

},

{

	"direct map access, invalid insn test 3",

	.insns = {

	BPF_MOV64_IMM(BPF_REG_0, 1),

	BPF_LD_IMM64_RAW_FULL(BPF_REG_1, BPF_PSEUDO_MAP_VALUE, ~0, 0, 0, 47),

	BPF_EXIT_INSN(),

	},

	.fixup_map_array_48b = { 1 },

	.result = REJECT,

	.errstr = "BPF_LD_IMM64 uses reserved fields",

},

{

	"direct map access, invalid insn test 4",

	.insns = {

	BPF_MOV64_IMM(BPF_REG_0, 1),

	BPF_LD_IMM64_RAW_FULL(BPF_REG_1, BPF_PSEUDO_MAP_VALUE, 0, ~0, 0, 47),

	BPF_EXIT_INSN(),

	},

	.fixup_map_array_48b = { 1 },

	.result = REJECT,

	.errstr = "invalid bpf_ld_imm64 insn",

},

{

	"direct map access, invalid insn test 5",

	.insns = {

	BPF_MOV64_IMM(BPF_REG_0, 1),

	BPF_LD_IMM64_RAW_FULL(BPF_REG_1, BPF_PSEUDO_MAP_VALUE, ~0, ~0, 0, 47),

	BPF_EXIT_INSN(),

	},

	.fixup_map_array_48b = { 1 },

	.result = REJECT,

	.errstr = "invalid bpf_ld_imm64 insn",

},

{

	"direct map access, invalid insn test 6",

	.insns = {

	BPF_MOV64_IMM(BPF_REG_0, 1),

	BPF_LD_IMM64_RAW_FULL(BPF_REG_1, BPF_PSEUDO_MAP_FD, ~0, 0, 0, 0),

	BPF_EXIT_INSN(),

	},

	.fixup_map_array_48b = { 1 },

	.result = REJECT,

	.errstr = "BPF_LD_IMM64 uses reserved fields",

},

{

	"direct map access, invalid insn test 7",

	.insns = {

	BPF_MOV64_IMM(BPF_REG_0, 1),

	BPF_LD_IMM64_RAW_FULL(BPF_REG_1, BPF_PSEUDO_MAP_FD, 0, ~0, 0, 0),

	BPF_EXIT_INSN(),

	},

	.fixup_map_array_48b = { 1 },

	.result = REJECT,

	.errstr = "invalid bpf_ld_imm64 insn",

},

{

	"direct map access, invalid insn test 8",

	.insns = {

	BPF_MOV64_IMM(BPF_REG_0, 1),

	BPF_LD_IMM64_RAW_FULL(BPF_REG_1, BPF_PSEUDO_MAP_FD, ~0, ~0, 0, 0),

	BPF_EXIT_INSN(),

	},

	.fixup_map_array_48b = { 1 },

	.result = REJECT,

	.errstr = "invalid bpf_ld_imm64 insn",

},

{

	"direct map access, invalid insn test 9",

	.insns = {

	BPF_MOV64_IMM(BPF_REG_0, 1),

	BPF_LD_IMM64_RAW_FULL(BPF_REG_1, BPF_PSEUDO_MAP_FD, 0, 0, 0, 47),

	BPF_EXIT_INSN(),

	},

	.fixup_map_array_48b = { 1 },

	.result = REJECT,

	.errstr = "unrecognized bpf_ld_imm64 insn",

},

CRA Git | Maintained and supported by SUSTech CRA and CCSE