1 // SPDX-License-Identifier: GPL-2.0
2 /* Converted from tools/testing/selftests/bpf/verifier/spin_lock.c */
3 
4 #include <linux/bpf.h>
5 #include <bpf/bpf_helpers.h>
6 #include "bpf_misc.h"
7 
8 struct val {
9 	int cnt;
10 	struct bpf_spin_lock l;
11 };
12 
13 struct {
14 	__uint(type, BPF_MAP_TYPE_ARRAY);
15 	__uint(max_entries, 1);
16 	__type(key, int);
17 	__type(value, struct val);
18 } map_spin_lock SEC(".maps");
19 
20 SEC("cgroup/skb")
21 __description("spin_lock: test1 success")
22 __success __failure_unpriv __msg_unpriv("")
23 __retval(0)
24 __naked void spin_lock_test1_success(void)
25 {
26 	asm volatile ("					\
27 	r1 = 0;						\
28 	*(u32*)(r10 - 4) = r1;				\
29 	r2 = r10;					\
30 	r2 += -4;					\
31 	r1 = %[map_spin_lock] ll;			\
32 	call %[bpf_map_lookup_elem];			\
33 	if r0 != 0 goto l0_%=;				\
34 	exit;						\
35 l0_%=:	r6 = r0;					\
36 	r1 = r0;					\
37 	r1 += 4;					\
38 	call %[bpf_spin_lock];				\
39 	r1 = r6;					\
40 	r1 += 4;					\
41 	r0 = *(u32*)(r6 + 0);				\
42 	call %[bpf_spin_unlock];			\
43 	r0 = 0;						\
44 	exit;						\
45 "	:
46 	: __imm(bpf_map_lookup_elem),
47 	  __imm(bpf_spin_lock),
48 	  __imm(bpf_spin_unlock),
49 	  __imm_addr(map_spin_lock)
50 	: __clobber_all);
51 }
52 
53 SEC("cgroup/skb")
54 __description("spin_lock: test2 direct ld/st")
55 __failure __msg("cannot be accessed directly")
56 __failure_unpriv __msg_unpriv("")
57 __naked void lock_test2_direct_ld_st(void)
58 {
59 	asm volatile ("					\
60 	r1 = 0;						\
61 	*(u32*)(r10 - 4) = r1;				\
62 	r2 = r10;					\
63 	r2 += -4;					\
64 	r1 = %[map_spin_lock] ll;			\
65 	call %[bpf_map_lookup_elem];			\
66 	if r0 != 0 goto l0_%=;				\
67 	exit;						\
68 l0_%=:	r6 = r0;					\
69 	r1 = r0;					\
70 	r1 += 4;					\
71 	call %[bpf_spin_lock];				\
72 	r1 = r6;					\
73 	r1 += 4;					\
74 	r0 = *(u32*)(r1 + 0);				\
75 	call %[bpf_spin_unlock];			\
76 	r0 = 0;						\
77 	exit;						\
78 "	:
79 	: __imm(bpf_map_lookup_elem),
80 	  __imm(bpf_spin_lock),
81 	  __imm(bpf_spin_unlock),
82 	  __imm_addr(map_spin_lock)
83 	: __clobber_all);
84 }
85 
86 SEC("cgroup/skb")
87 __description("spin_lock: test3 direct ld/st")
88 __failure __msg("cannot be accessed directly")
89 __failure_unpriv __msg_unpriv("")
90 __flag(BPF_F_ANY_ALIGNMENT)
91 __naked void lock_test3_direct_ld_st(void)
92 {
93 	asm volatile ("					\
94 	r1 = 0;						\
95 	*(u32*)(r10 - 4) = r1;				\
96 	r2 = r10;					\
97 	r2 += -4;					\
98 	r1 = %[map_spin_lock] ll;			\
99 	call %[bpf_map_lookup_elem];			\
100 	if r0 != 0 goto l0_%=;				\
101 	exit;						\
102 l0_%=:	r6 = r0;					\
103 	r1 = r0;					\
104 	r1 += 4;					\
105 	call %[bpf_spin_lock];				\
106 	r1 = r6;					\
107 	r1 += 4;					\
108 	r0 = *(u32*)(r6 + 1);				\
109 	call %[bpf_spin_unlock];			\
110 	r0 = 0;						\
111 	exit;						\
112 "	:
113 	: __imm(bpf_map_lookup_elem),
114 	  __imm(bpf_spin_lock),
115 	  __imm(bpf_spin_unlock),
116 	  __imm_addr(map_spin_lock)
117 	: __clobber_all);
118 }
119 
120 SEC("cgroup/skb")
121 __description("spin_lock: test4 direct ld/st")
122 __failure __msg("cannot be accessed directly")
123 __failure_unpriv __msg_unpriv("")
124 __flag(BPF_F_ANY_ALIGNMENT)
125 __naked void lock_test4_direct_ld_st(void)
126 {
127 	asm volatile ("					\
128 	r1 = 0;						\
129 	*(u32*)(r10 - 4) = r1;				\
130 	r2 = r10;					\
131 	r2 += -4;					\
132 	r1 = %[map_spin_lock] ll;			\
133 	call %[bpf_map_lookup_elem];			\
134 	if r0 != 0 goto l0_%=;				\
135 	exit;						\
136 l0_%=:	r6 = r0;					\
137 	r1 = r0;					\
138 	r1 += 4;					\
139 	call %[bpf_spin_lock];				\
140 	r1 = r6;					\
141 	r1 += 4;					\
142 	r0 = *(u16*)(r6 + 3);				\
143 	call %[bpf_spin_unlock];			\
144 	r0 = 0;						\
145 	exit;						\
146 "	:
147 	: __imm(bpf_map_lookup_elem),
148 	  __imm(bpf_spin_lock),
149 	  __imm(bpf_spin_unlock),
150 	  __imm_addr(map_spin_lock)
151 	: __clobber_all);
152 }
153 
154 SEC("cgroup/skb")
155 __description("spin_lock: test5 call within a locked region")
156 __failure __msg("calls are not allowed")
157 __failure_unpriv __msg_unpriv("")
158 __naked void call_within_a_locked_region(void)
159 {
160 	asm volatile ("					\
161 	r1 = 0;						\
162 	*(u32*)(r10 - 4) = r1;				\
163 	r2 = r10;					\
164 	r2 += -4;					\
165 	r1 = %[map_spin_lock] ll;			\
166 	call %[bpf_map_lookup_elem];			\
167 	if r0 != 0 goto l0_%=;				\
168 	exit;						\
169 l0_%=:	r6 = r0;					\
170 	r1 = r0;					\
171 	r1 += 4;					\
172 	call %[bpf_spin_lock];				\
173 	call %[bpf_get_prandom_u32];			\
174 	r1 = r6;					\
175 	r1 += 4;					\
176 	call %[bpf_spin_unlock];			\
177 	r0 = 0;						\
178 	exit;						\
179 "	:
180 	: __imm(bpf_get_prandom_u32),
181 	  __imm(bpf_map_lookup_elem),
182 	  __imm(bpf_spin_lock),
183 	  __imm(bpf_spin_unlock),
184 	  __imm_addr(map_spin_lock)
185 	: __clobber_all);
186 }
187 
188 SEC("cgroup/skb")
189 __description("spin_lock: test6 missing unlock")
190 __failure __msg("unlock is missing")
191 __failure_unpriv __msg_unpriv("")
192 __naked void spin_lock_test6_missing_unlock(void)
193 {
194 	asm volatile ("					\
195 	r1 = 0;						\
196 	*(u32*)(r10 - 4) = r1;				\
197 	r2 = r10;					\
198 	r2 += -4;					\
199 	r1 = %[map_spin_lock] ll;			\
200 	call %[bpf_map_lookup_elem];			\
201 	if r0 != 0 goto l0_%=;				\
202 	exit;						\
203 l0_%=:	r6 = r0;					\
204 	r1 = r0;					\
205 	r1 += 4;					\
206 	call %[bpf_spin_lock];				\
207 	r1 = r6;					\
208 	r1 += 4;					\
209 	r0 = *(u32*)(r6 + 0);				\
210 	if r0 != 0 goto l1_%=;				\
211 	call %[bpf_spin_unlock];			\
212 l1_%=:	r0 = 0;						\
213 	exit;						\
214 "	:
215 	: __imm(bpf_map_lookup_elem),
216 	  __imm(bpf_spin_lock),
217 	  __imm(bpf_spin_unlock),
218 	  __imm_addr(map_spin_lock)
219 	: __clobber_all);
220 }
221 
222 SEC("cgroup/skb")
223 __description("spin_lock: test7 unlock without lock")
224 __failure __msg("without taking a lock")
225 __failure_unpriv __msg_unpriv("")
226 __naked void lock_test7_unlock_without_lock(void)
227 {
228 	asm volatile ("					\
229 	r1 = 0;						\
230 	*(u32*)(r10 - 4) = r1;				\
231 	r2 = r10;					\
232 	r2 += -4;					\
233 	r1 = %[map_spin_lock] ll;			\
234 	call %[bpf_map_lookup_elem];			\
235 	if r0 != 0 goto l0_%=;				\
236 	exit;						\
237 l0_%=:	r6 = r0;					\
238 	r1 = r0;					\
239 	r1 += 4;					\
240 	if r1 != 0 goto l1_%=;				\
241 	call %[bpf_spin_lock];				\
242 l1_%=:	r1 = r6;					\
243 	r1 += 4;					\
244 	r0 = *(u32*)(r6 + 0);				\
245 	call %[bpf_spin_unlock];			\
246 	r0 = 0;						\
247 	exit;						\
248 "	:
249 	: __imm(bpf_map_lookup_elem),
250 	  __imm(bpf_spin_lock),
251 	  __imm(bpf_spin_unlock),
252 	  __imm_addr(map_spin_lock)
253 	: __clobber_all);
254 }
255 
256 SEC("cgroup/skb")
257 __description("spin_lock: test8 double lock")
258 __failure __msg("calls are not allowed")
259 __failure_unpriv __msg_unpriv("")
260 __naked void spin_lock_test8_double_lock(void)
261 {
262 	asm volatile ("					\
263 	r1 = 0;						\
264 	*(u32*)(r10 - 4) = r1;				\
265 	r2 = r10;					\
266 	r2 += -4;					\
267 	r1 = %[map_spin_lock] ll;			\
268 	call %[bpf_map_lookup_elem];			\
269 	if r0 != 0 goto l0_%=;				\
270 	exit;						\
271 l0_%=:	r6 = r0;					\
272 	r1 = r0;					\
273 	r1 += 4;					\
274 	call %[bpf_spin_lock];				\
275 	r1 = r6;					\
276 	r1 += 4;					\
277 	call %[bpf_spin_lock];				\
278 	r1 = r6;					\
279 	r1 += 4;					\
280 	r0 = *(u32*)(r6 + 0);				\
281 	call %[bpf_spin_unlock];			\
282 	r0 = 0;						\
283 	exit;						\
284 "	:
285 	: __imm(bpf_map_lookup_elem),
286 	  __imm(bpf_spin_lock),
287 	  __imm(bpf_spin_unlock),
288 	  __imm_addr(map_spin_lock)
289 	: __clobber_all);
290 }
291 
292 SEC("cgroup/skb")
293 __description("spin_lock: test9 different lock")
294 __failure __msg("unlock of different lock")
295 __failure_unpriv __msg_unpriv("")
296 __naked void spin_lock_test9_different_lock(void)
297 {
298 	asm volatile ("					\
299 	r1 = 0;						\
300 	*(u32*)(r10 - 4) = r1;				\
301 	r2 = r10;					\
302 	r2 += -4;					\
303 	r1 = %[map_spin_lock] ll;			\
304 	call %[bpf_map_lookup_elem];			\
305 	if r0 != 0 goto l0_%=;				\
306 	exit;						\
307 l0_%=:	r6 = r0;					\
308 	r2 = r10;					\
309 	r2 += -4;					\
310 	r1 = %[map_spin_lock] ll;			\
311 	call %[bpf_map_lookup_elem];			\
312 	if r0 != 0 goto l1_%=;				\
313 	exit;						\
314 l1_%=:	r7 = r0;					\
315 	r1 = r6;					\
316 	r1 += 4;					\
317 	call %[bpf_spin_lock];				\
318 	r1 = r7;					\
319 	r1 += 4;					\
320 	call %[bpf_spin_unlock];			\
321 	r0 = 0;						\
322 	exit;						\
323 "	:
324 	: __imm(bpf_map_lookup_elem),
325 	  __imm(bpf_spin_lock),
326 	  __imm(bpf_spin_unlock),
327 	  __imm_addr(map_spin_lock)
328 	: __clobber_all);
329 }
330 
331 SEC("cgroup/skb")
332 __description("spin_lock: test10 lock in subprog without unlock")
333 __failure __msg("unlock is missing")
334 __failure_unpriv __msg_unpriv("")
335 __naked void lock_in_subprog_without_unlock(void)
336 {
337 	asm volatile ("					\
338 	r1 = 0;						\
339 	*(u32*)(r10 - 4) = r1;				\
340 	r2 = r10;					\
341 	r2 += -4;					\
342 	r1 = %[map_spin_lock] ll;			\
343 	call %[bpf_map_lookup_elem];			\
344 	if r0 != 0 goto l0_%=;				\
345 	exit;						\
346 l0_%=:	r6 = r0;					\
347 	r1 = r0;					\
348 	r1 += 4;					\
349 	call lock_in_subprog_without_unlock__1;		\
350 	r1 = r6;					\
351 	r1 += 4;					\
352 	call %[bpf_spin_unlock];			\
353 	r0 = 1;						\
354 	exit;						\
355 "	:
356 	: __imm(bpf_map_lookup_elem),
357 	  __imm(bpf_spin_unlock),
358 	  __imm_addr(map_spin_lock)
359 	: __clobber_all);
360 }
361 
362 static __naked __noinline __attribute__((used))
363 void lock_in_subprog_without_unlock__1(void)
364 {
365 	asm volatile ("					\
366 	call %[bpf_spin_lock];				\
367 	r0 = 0;						\
368 	exit;						\
369 "	:
370 	: __imm(bpf_spin_lock)
371 	: __clobber_all);
372 }
373 
374 SEC("tc")
375 __description("spin_lock: test11 ld_abs under lock")
376 __failure __msg("inside bpf_spin_lock")
377 __naked void test11_ld_abs_under_lock(void)
378 {
379 	asm volatile ("					\
380 	r6 = r1;					\
381 	r1 = 0;						\
382 	*(u32*)(r10 - 4) = r1;				\
383 	r2 = r10;					\
384 	r2 += -4;					\
385 	r1 = %[map_spin_lock] ll;			\
386 	call %[bpf_map_lookup_elem];			\
387 	if r0 != 0 goto l0_%=;				\
388 	exit;						\
389 l0_%=:	r7 = r0;					\
390 	r1 = r0;					\
391 	r1 += 4;					\
392 	call %[bpf_spin_lock];				\
393 	r0 = *(u8*)skb[0];				\
394 	r1 = r7;					\
395 	r1 += 4;					\
396 	call %[bpf_spin_unlock];			\
397 	r0 = 0;						\
398 	exit;						\
399 "	:
400 	: __imm(bpf_map_lookup_elem),
401 	  __imm(bpf_spin_lock),
402 	  __imm(bpf_spin_unlock),
403 	  __imm_addr(map_spin_lock)
404 	: __clobber_all);
405 }
406 
407 SEC("tc")
408 __description("spin_lock: regsafe compare reg->id for map value")
409 __failure __msg("bpf_spin_unlock of different lock")
410 __flag(BPF_F_TEST_STATE_FREQ)
411 __naked void reg_id_for_map_value(void)
412 {
413 	asm volatile ("					\
414 	r6 = r1;					\
415 	r6 = *(u32*)(r6 + %[__sk_buff_mark]);		\
416 	r1 = %[map_spin_lock] ll;			\
417 	r9 = r1;					\
418 	r2 = 0;						\
419 	*(u32*)(r10 - 4) = r2;				\
420 	r2 = r10;					\
421 	r2 += -4;					\
422 	call %[bpf_map_lookup_elem];			\
423 	if r0 != 0 goto l0_%=;				\
424 	exit;						\
425 l0_%=:	r7 = r0;					\
426 	r1 = r9;					\
427 	r2 = r10;					\
428 	r2 += -4;					\
429 	call %[bpf_map_lookup_elem];			\
430 	if r0 != 0 goto l1_%=;				\
431 	exit;						\
432 l1_%=:	r8 = r0;					\
433 	r1 = r7;					\
434 	r1 += 4;					\
435 	call %[bpf_spin_lock];				\
436 	if r6 == 0 goto l2_%=;				\
437 	goto l3_%=;					\
438 l2_%=:	r7 = r8;					\
439 l3_%=:	r1 = r7;					\
440 	r1 += 4;					\
441 	call %[bpf_spin_unlock];			\
442 	r0 = 0;						\
443 	exit;						\
444 "	:
445 	: __imm(bpf_map_lookup_elem),
446 	  __imm(bpf_spin_lock),
447 	  __imm(bpf_spin_unlock),
448 	  __imm_addr(map_spin_lock),
449 	  __imm_const(__sk_buff_mark, offsetof(struct __sk_buff, mark))
450 	: __clobber_all);
451 }
452 
453 /* Make sure that regsafe() compares ids for spin lock records using
454  * check_ids():
455  *  1: r9 = map_lookup_elem(...)  ; r9.id == 1
456  *  2: r8 = map_lookup_elem(...)  ; r8.id == 2
457  *  3: r7 = ktime_get_ns()
458  *  4: r6 = ktime_get_ns()
459  *  5: if r6 > r7 goto <9>
460  *  6: spin_lock(r8)
461  *  7: r9 = r8
462  *  8: goto <10>
463  *  9: spin_lock(r9)
464  * 10: spin_unlock(r9)             ; r9.id == 1 || r9.id == 2 and lock is active,
465  *                                 ; second visit to (10) should be considered safe
466  *                                 ; if check_ids() is used.
467  * 11: exit(0)
468  */
469 
470 SEC("cgroup/skb")
471 __description("spin_lock: regsafe() check_ids() similar id mappings")
472 __success __msg("29: safe")
473 __failure_unpriv __msg_unpriv("")
474 __log_level(2) __retval(0) __flag(BPF_F_TEST_STATE_FREQ)
475 __naked void check_ids_similar_id_mappings(void)
476 {
477 	asm volatile ("					\
478 	r1 = 0;						\
479 	*(u32*)(r10 - 4) = r1;				\
480 	/* r9 = map_lookup_elem(...) */			\
481 	r2 = r10;					\
482 	r2 += -4;					\
483 	r1 = %[map_spin_lock] ll;			\
484 	call %[bpf_map_lookup_elem];			\
485 	if r0 == 0 goto l0_%=;				\
486 	r9 = r0;					\
487 	/* r8 = map_lookup_elem(...) */			\
488 	r2 = r10;					\
489 	r2 += -4;					\
490 	r1 = %[map_spin_lock] ll;			\
491 	call %[bpf_map_lookup_elem];			\
492 	if r0 == 0 goto l1_%=;				\
493 	r8 = r0;					\
494 	/* r7 = ktime_get_ns() */			\
495 	call %[bpf_ktime_get_ns];			\
496 	r7 = r0;					\
497 	/* r6 = ktime_get_ns() */			\
498 	call %[bpf_ktime_get_ns];			\
499 	r6 = r0;					\
500 	/* if r6 > r7 goto +5      ; no new information about the state is derived from\
501 	 *                         ; this check, thus produced verifier states differ\
502 	 *                         ; only in 'insn_idx'	\
503 	 * spin_lock(r8)				\
504 	 * r9 = r8					\
505 	 * goto unlock					\
506 	 */						\
507 	if r6 > r7 goto l2_%=;				\
508 	r1 = r8;					\
509 	r1 += 4;					\
510 	call %[bpf_spin_lock];				\
511 	r9 = r8;					\
512 	goto l3_%=;					\
513 l2_%=:	/* spin_lock(r9) */				\
514 	r1 = r9;					\
515 	r1 += 4;					\
516 	call %[bpf_spin_lock];				\
517 l3_%=:	/* spin_unlock(r9) */				\
518 	r1 = r9;					\
519 	r1 += 4;					\
520 	call %[bpf_spin_unlock];			\
521 l0_%=:	/* exit(0) */					\
522 	r0 = 0;						\
523 l1_%=:	exit;						\
524 "	:
525 	: __imm(bpf_ktime_get_ns),
526 	  __imm(bpf_map_lookup_elem),
527 	  __imm(bpf_spin_lock),
528 	  __imm(bpf_spin_unlock),
529 	  __imm_addr(map_spin_lock)
530 	: __clobber_all);
531 }
532 
533 char _license[] SEC("license") = "GPL";
534