1*6e9e141aSEduard Zingerman // SPDX-License-Identifier: GPL-2.0
2*6e9e141aSEduard Zingerman /* Converted from tools/testing/selftests/bpf/verifier/xdp_direct_packet_access.c */
3*6e9e141aSEduard Zingerman
4*6e9e141aSEduard Zingerman #include <linux/bpf.h>
5*6e9e141aSEduard Zingerman #include <bpf/bpf_helpers.h>
6*6e9e141aSEduard Zingerman #include "bpf_misc.h"
7*6e9e141aSEduard Zingerman
8*6e9e141aSEduard Zingerman SEC("xdp")
9*6e9e141aSEduard Zingerman __description("XDP pkt read, pkt_end mangling, bad access 1")
10*6e9e141aSEduard Zingerman __failure __msg("R3 pointer arithmetic on pkt_end")
end_mangling_bad_access_1(void)11*6e9e141aSEduard Zingerman __naked void end_mangling_bad_access_1(void)
12*6e9e141aSEduard Zingerman {
13*6e9e141aSEduard Zingerman asm volatile (" \
14*6e9e141aSEduard Zingerman r2 = *(u32*)(r1 + %[xdp_md_data]); \
15*6e9e141aSEduard Zingerman r3 = *(u32*)(r1 + %[xdp_md_data_end]); \
16*6e9e141aSEduard Zingerman r1 = r2; \
17*6e9e141aSEduard Zingerman r1 += 8; \
18*6e9e141aSEduard Zingerman r3 += 8; \
19*6e9e141aSEduard Zingerman if r1 > r3 goto l0_%=; \
20*6e9e141aSEduard Zingerman r0 = *(u64*)(r1 - 8); \
21*6e9e141aSEduard Zingerman l0_%=: r0 = 0; \
22*6e9e141aSEduard Zingerman exit; \
23*6e9e141aSEduard Zingerman " :
24*6e9e141aSEduard Zingerman : __imm_const(xdp_md_data, offsetof(struct xdp_md, data)),
25*6e9e141aSEduard Zingerman __imm_const(xdp_md_data_end, offsetof(struct xdp_md, data_end))
26*6e9e141aSEduard Zingerman : __clobber_all);
27*6e9e141aSEduard Zingerman }
28*6e9e141aSEduard Zingerman
29*6e9e141aSEduard Zingerman SEC("xdp")
30*6e9e141aSEduard Zingerman __description("XDP pkt read, pkt_end mangling, bad access 2")
31*6e9e141aSEduard Zingerman __failure __msg("R3 pointer arithmetic on pkt_end")
end_mangling_bad_access_2(void)32*6e9e141aSEduard Zingerman __naked void end_mangling_bad_access_2(void)
33*6e9e141aSEduard Zingerman {
34*6e9e141aSEduard Zingerman asm volatile (" \
35*6e9e141aSEduard Zingerman r2 = *(u32*)(r1 + %[xdp_md_data]); \
36*6e9e141aSEduard Zingerman r3 = *(u32*)(r1 + %[xdp_md_data_end]); \
37*6e9e141aSEduard Zingerman r1 = r2; \
38*6e9e141aSEduard Zingerman r1 += 8; \
39*6e9e141aSEduard Zingerman r3 -= 8; \
40*6e9e141aSEduard Zingerman if r1 > r3 goto l0_%=; \
41*6e9e141aSEduard Zingerman r0 = *(u64*)(r1 - 8); \
42*6e9e141aSEduard Zingerman l0_%=: r0 = 0; \
43*6e9e141aSEduard Zingerman exit; \
44*6e9e141aSEduard Zingerman " :
45*6e9e141aSEduard Zingerman : __imm_const(xdp_md_data, offsetof(struct xdp_md, data)),
46*6e9e141aSEduard Zingerman __imm_const(xdp_md_data_end, offsetof(struct xdp_md, data_end))
47*6e9e141aSEduard Zingerman : __clobber_all);
48*6e9e141aSEduard Zingerman }
49*6e9e141aSEduard Zingerman
50*6e9e141aSEduard Zingerman SEC("xdp")
51*6e9e141aSEduard Zingerman __description("XDP pkt read, pkt_data' > pkt_end, corner case, good access")
__flag(BPF_F_ANY_ALIGNMENT)52*6e9e141aSEduard Zingerman __success __retval(0) __flag(BPF_F_ANY_ALIGNMENT)
53*6e9e141aSEduard Zingerman __naked void end_corner_case_good_access_1(void)
54*6e9e141aSEduard Zingerman {
55*6e9e141aSEduard Zingerman asm volatile (" \
56*6e9e141aSEduard Zingerman r2 = *(u32*)(r1 + %[xdp_md_data]); \
57*6e9e141aSEduard Zingerman r3 = *(u32*)(r1 + %[xdp_md_data_end]); \
58*6e9e141aSEduard Zingerman r1 = r2; \
59*6e9e141aSEduard Zingerman r1 += 8; \
60*6e9e141aSEduard Zingerman if r1 > r3 goto l0_%=; \
61*6e9e141aSEduard Zingerman r0 = *(u64*)(r1 - 8); \
62*6e9e141aSEduard Zingerman l0_%=: r0 = 0; \
63*6e9e141aSEduard Zingerman exit; \
64*6e9e141aSEduard Zingerman " :
65*6e9e141aSEduard Zingerman : __imm_const(xdp_md_data, offsetof(struct xdp_md, data)),
66*6e9e141aSEduard Zingerman __imm_const(xdp_md_data_end, offsetof(struct xdp_md, data_end))
67*6e9e141aSEduard Zingerman : __clobber_all);
68*6e9e141aSEduard Zingerman }
69*6e9e141aSEduard Zingerman
70*6e9e141aSEduard Zingerman SEC("xdp")
71*6e9e141aSEduard Zingerman __description("XDP pkt read, pkt_data' > pkt_end, bad access 1")
72*6e9e141aSEduard Zingerman __failure __msg("R1 offset is outside of the packet")
__flag(BPF_F_ANY_ALIGNMENT)73*6e9e141aSEduard Zingerman __flag(BPF_F_ANY_ALIGNMENT)
74*6e9e141aSEduard Zingerman __naked void pkt_end_bad_access_1_1(void)
75*6e9e141aSEduard Zingerman {
76*6e9e141aSEduard Zingerman asm volatile (" \
77*6e9e141aSEduard Zingerman r2 = *(u32*)(r1 + %[xdp_md_data]); \
78*6e9e141aSEduard Zingerman r3 = *(u32*)(r1 + %[xdp_md_data_end]); \
79*6e9e141aSEduard Zingerman r1 = r2; \
80*6e9e141aSEduard Zingerman r1 += 8; \
81*6e9e141aSEduard Zingerman if r1 > r3 goto l0_%=; \
82*6e9e141aSEduard Zingerman r0 = *(u64*)(r1 - 4); \
83*6e9e141aSEduard Zingerman l0_%=: r0 = 0; \
84*6e9e141aSEduard Zingerman exit; \
85*6e9e141aSEduard Zingerman " :
86*6e9e141aSEduard Zingerman : __imm_const(xdp_md_data, offsetof(struct xdp_md, data)),
87*6e9e141aSEduard Zingerman __imm_const(xdp_md_data_end, offsetof(struct xdp_md, data_end))
88*6e9e141aSEduard Zingerman : __clobber_all);
89*6e9e141aSEduard Zingerman }
90*6e9e141aSEduard Zingerman
91*6e9e141aSEduard Zingerman SEC("xdp")
92*6e9e141aSEduard Zingerman __description("XDP pkt read, pkt_data' > pkt_end, bad access 2")
93*6e9e141aSEduard Zingerman __failure __msg("R1 offset is outside of the packet")
__flag(BPF_F_ANY_ALIGNMENT)94*6e9e141aSEduard Zingerman __flag(BPF_F_ANY_ALIGNMENT)
95*6e9e141aSEduard Zingerman __naked void pkt_end_bad_access_2_1(void)
96*6e9e141aSEduard Zingerman {
97*6e9e141aSEduard Zingerman asm volatile (" \
98*6e9e141aSEduard Zingerman r2 = *(u32*)(r1 + %[xdp_md_data]); \
99*6e9e141aSEduard Zingerman r3 = *(u32*)(r1 + %[xdp_md_data_end]); \
100*6e9e141aSEduard Zingerman r1 = r2; \
101*6e9e141aSEduard Zingerman r1 += 8; \
102*6e9e141aSEduard Zingerman if r1 > r3 goto l0_%=; \
103*6e9e141aSEduard Zingerman l0_%=: r0 = *(u64*)(r1 - 8); \
104*6e9e141aSEduard Zingerman r0 = 0; \
105*6e9e141aSEduard Zingerman exit; \
106*6e9e141aSEduard Zingerman " :
107*6e9e141aSEduard Zingerman : __imm_const(xdp_md_data, offsetof(struct xdp_md, data)),
108*6e9e141aSEduard Zingerman __imm_const(xdp_md_data_end, offsetof(struct xdp_md, data_end))
109*6e9e141aSEduard Zingerman : __clobber_all);
110*6e9e141aSEduard Zingerman }
111*6e9e141aSEduard Zingerman
112*6e9e141aSEduard Zingerman SEC("xdp")
113*6e9e141aSEduard Zingerman __description("XDP pkt read, pkt_data' > pkt_end, corner case +1, good access")
__flag(BPF_F_ANY_ALIGNMENT)114*6e9e141aSEduard Zingerman __success __retval(0) __flag(BPF_F_ANY_ALIGNMENT)
115*6e9e141aSEduard Zingerman __naked void corner_case_1_good_access_1(void)
116*6e9e141aSEduard Zingerman {
117*6e9e141aSEduard Zingerman asm volatile (" \
118*6e9e141aSEduard Zingerman r2 = *(u32*)(r1 + %[xdp_md_data]); \
119*6e9e141aSEduard Zingerman r3 = *(u32*)(r1 + %[xdp_md_data_end]); \
120*6e9e141aSEduard Zingerman r1 = r2; \
121*6e9e141aSEduard Zingerman r1 += 9; \
122*6e9e141aSEduard Zingerman if r1 > r3 goto l0_%=; \
123*6e9e141aSEduard Zingerman r0 = *(u64*)(r1 - 9); \
124*6e9e141aSEduard Zingerman l0_%=: r0 = 0; \
125*6e9e141aSEduard Zingerman exit; \
126*6e9e141aSEduard Zingerman " :
127*6e9e141aSEduard Zingerman : __imm_const(xdp_md_data, offsetof(struct xdp_md, data)),
128*6e9e141aSEduard Zingerman __imm_const(xdp_md_data_end, offsetof(struct xdp_md, data_end))
129*6e9e141aSEduard Zingerman : __clobber_all);
130*6e9e141aSEduard Zingerman }
131*6e9e141aSEduard Zingerman
132*6e9e141aSEduard Zingerman SEC("xdp")
133*6e9e141aSEduard Zingerman __description("XDP pkt read, pkt_data' > pkt_end, corner case -1, bad access")
134*6e9e141aSEduard Zingerman __failure __msg("R1 offset is outside of the packet")
__flag(BPF_F_ANY_ALIGNMENT)135*6e9e141aSEduard Zingerman __flag(BPF_F_ANY_ALIGNMENT)
136*6e9e141aSEduard Zingerman __naked void corner_case_1_bad_access_1(void)
137*6e9e141aSEduard Zingerman {
138*6e9e141aSEduard Zingerman asm volatile (" \
139*6e9e141aSEduard Zingerman r2 = *(u32*)(r1 + %[xdp_md_data]); \
140*6e9e141aSEduard Zingerman r3 = *(u32*)(r1 + %[xdp_md_data_end]); \
141*6e9e141aSEduard Zingerman r1 = r2; \
142*6e9e141aSEduard Zingerman r1 += 7; \
143*6e9e141aSEduard Zingerman if r1 > r3 goto l0_%=; \
144*6e9e141aSEduard Zingerman r0 = *(u64*)(r1 - 7); \
145*6e9e141aSEduard Zingerman l0_%=: r0 = 0; \
146*6e9e141aSEduard Zingerman exit; \
147*6e9e141aSEduard Zingerman " :
148*6e9e141aSEduard Zingerman : __imm_const(xdp_md_data, offsetof(struct xdp_md, data)),
149*6e9e141aSEduard Zingerman __imm_const(xdp_md_data_end, offsetof(struct xdp_md, data_end))
150*6e9e141aSEduard Zingerman : __clobber_all);
151*6e9e141aSEduard Zingerman }
152*6e9e141aSEduard Zingerman
153*6e9e141aSEduard Zingerman SEC("xdp")
154*6e9e141aSEduard Zingerman __description("XDP pkt read, pkt_end > pkt_data', good access")
__flag(BPF_F_ANY_ALIGNMENT)155*6e9e141aSEduard Zingerman __success __retval(0) __flag(BPF_F_ANY_ALIGNMENT)
156*6e9e141aSEduard Zingerman __naked void end_pkt_data_good_access_1(void)
157*6e9e141aSEduard Zingerman {
158*6e9e141aSEduard Zingerman asm volatile (" \
159*6e9e141aSEduard Zingerman r2 = *(u32*)(r1 + %[xdp_md_data]); \
160*6e9e141aSEduard Zingerman r3 = *(u32*)(r1 + %[xdp_md_data_end]); \
161*6e9e141aSEduard Zingerman r1 = r2; \
162*6e9e141aSEduard Zingerman r1 += 8; \
163*6e9e141aSEduard Zingerman if r3 > r1 goto l0_%=; \
164*6e9e141aSEduard Zingerman goto l1_%=; \
165*6e9e141aSEduard Zingerman l0_%=: r0 = *(u32*)(r1 - 5); \
166*6e9e141aSEduard Zingerman l1_%=: r0 = 0; \
167*6e9e141aSEduard Zingerman exit; \
168*6e9e141aSEduard Zingerman " :
169*6e9e141aSEduard Zingerman : __imm_const(xdp_md_data, offsetof(struct xdp_md, data)),
170*6e9e141aSEduard Zingerman __imm_const(xdp_md_data_end, offsetof(struct xdp_md, data_end))
171*6e9e141aSEduard Zingerman : __clobber_all);
172*6e9e141aSEduard Zingerman }
173*6e9e141aSEduard Zingerman
174*6e9e141aSEduard Zingerman SEC("xdp")
175*6e9e141aSEduard Zingerman __description("XDP pkt read, pkt_end > pkt_data', corner case -1, bad access")
176*6e9e141aSEduard Zingerman __failure __msg("R1 offset is outside of the packet")
__flag(BPF_F_ANY_ALIGNMENT)177*6e9e141aSEduard Zingerman __flag(BPF_F_ANY_ALIGNMENT)
178*6e9e141aSEduard Zingerman __naked void corner_case_1_bad_access_2(void)
179*6e9e141aSEduard Zingerman {
180*6e9e141aSEduard Zingerman asm volatile (" \
181*6e9e141aSEduard Zingerman r2 = *(u32*)(r1 + %[xdp_md_data]); \
182*6e9e141aSEduard Zingerman r3 = *(u32*)(r1 + %[xdp_md_data_end]); \
183*6e9e141aSEduard Zingerman r1 = r2; \
184*6e9e141aSEduard Zingerman r1 += 6; \
185*6e9e141aSEduard Zingerman if r3 > r1 goto l0_%=; \
186*6e9e141aSEduard Zingerman goto l1_%=; \
187*6e9e141aSEduard Zingerman l0_%=: r0 = *(u64*)(r1 - 6); \
188*6e9e141aSEduard Zingerman l1_%=: r0 = 0; \
189*6e9e141aSEduard Zingerman exit; \
190*6e9e141aSEduard Zingerman " :
191*6e9e141aSEduard Zingerman : __imm_const(xdp_md_data, offsetof(struct xdp_md, data)),
192*6e9e141aSEduard Zingerman __imm_const(xdp_md_data_end, offsetof(struct xdp_md, data_end))
193*6e9e141aSEduard Zingerman : __clobber_all);
194*6e9e141aSEduard Zingerman }
195*6e9e141aSEduard Zingerman
196*6e9e141aSEduard Zingerman SEC("xdp")
197*6e9e141aSEduard Zingerman __description("XDP pkt read, pkt_end > pkt_data', bad access 2")
198*6e9e141aSEduard Zingerman __failure __msg("R1 offset is outside of the packet")
__flag(BPF_F_ANY_ALIGNMENT)199*6e9e141aSEduard Zingerman __flag(BPF_F_ANY_ALIGNMENT)
200*6e9e141aSEduard Zingerman __naked void pkt_data_bad_access_2_1(void)
201*6e9e141aSEduard Zingerman {
202*6e9e141aSEduard Zingerman asm volatile (" \
203*6e9e141aSEduard Zingerman r2 = *(u32*)(r1 + %[xdp_md_data]); \
204*6e9e141aSEduard Zingerman r3 = *(u32*)(r1 + %[xdp_md_data_end]); \
205*6e9e141aSEduard Zingerman r1 = r2; \
206*6e9e141aSEduard Zingerman r1 += 8; \
207*6e9e141aSEduard Zingerman if r3 > r1 goto l0_%=; \
208*6e9e141aSEduard Zingerman r0 = *(u64*)(r1 - 8); \
209*6e9e141aSEduard Zingerman l0_%=: r0 = 0; \
210*6e9e141aSEduard Zingerman exit; \
211*6e9e141aSEduard Zingerman " :
212*6e9e141aSEduard Zingerman : __imm_const(xdp_md_data, offsetof(struct xdp_md, data)),
213*6e9e141aSEduard Zingerman __imm_const(xdp_md_data_end, offsetof(struct xdp_md, data_end))
214*6e9e141aSEduard Zingerman : __clobber_all);
215*6e9e141aSEduard Zingerman }
216*6e9e141aSEduard Zingerman
217*6e9e141aSEduard Zingerman SEC("xdp")
218*6e9e141aSEduard Zingerman __description("XDP pkt read, pkt_end > pkt_data', corner case, good access")
__flag(BPF_F_ANY_ALIGNMENT)219*6e9e141aSEduard Zingerman __success __retval(0) __flag(BPF_F_ANY_ALIGNMENT)
220*6e9e141aSEduard Zingerman __naked void data_corner_case_good_access_1(void)
221*6e9e141aSEduard Zingerman {
222*6e9e141aSEduard Zingerman asm volatile (" \
223*6e9e141aSEduard Zingerman r2 = *(u32*)(r1 + %[xdp_md_data]); \
224*6e9e141aSEduard Zingerman r3 = *(u32*)(r1 + %[xdp_md_data_end]); \
225*6e9e141aSEduard Zingerman r1 = r2; \
226*6e9e141aSEduard Zingerman r1 += 7; \
227*6e9e141aSEduard Zingerman if r3 > r1 goto l0_%=; \
228*6e9e141aSEduard Zingerman goto l1_%=; \
229*6e9e141aSEduard Zingerman l0_%=: r0 = *(u64*)(r1 - 7); \
230*6e9e141aSEduard Zingerman l1_%=: r0 = 0; \
231*6e9e141aSEduard Zingerman exit; \
232*6e9e141aSEduard Zingerman " :
233*6e9e141aSEduard Zingerman : __imm_const(xdp_md_data, offsetof(struct xdp_md, data)),
234*6e9e141aSEduard Zingerman __imm_const(xdp_md_data_end, offsetof(struct xdp_md, data_end))
235*6e9e141aSEduard Zingerman : __clobber_all);
236*6e9e141aSEduard Zingerman }
237*6e9e141aSEduard Zingerman
238*6e9e141aSEduard Zingerman SEC("xdp")
239*6e9e141aSEduard Zingerman __description("XDP pkt read, pkt_end > pkt_data', corner case +1, good access")
__flag(BPF_F_ANY_ALIGNMENT)240*6e9e141aSEduard Zingerman __success __retval(0) __flag(BPF_F_ANY_ALIGNMENT)
241*6e9e141aSEduard Zingerman __naked void corner_case_1_good_access_2(void)
242*6e9e141aSEduard Zingerman {
243*6e9e141aSEduard Zingerman asm volatile (" \
244*6e9e141aSEduard Zingerman r2 = *(u32*)(r1 + %[xdp_md_data]); \
245*6e9e141aSEduard Zingerman r3 = *(u32*)(r1 + %[xdp_md_data_end]); \
246*6e9e141aSEduard Zingerman r1 = r2; \
247*6e9e141aSEduard Zingerman r1 += 8; \
248*6e9e141aSEduard Zingerman if r3 > r1 goto l0_%=; \
249*6e9e141aSEduard Zingerman goto l1_%=; \
250*6e9e141aSEduard Zingerman l0_%=: r0 = *(u64*)(r1 - 8); \
251*6e9e141aSEduard Zingerman l1_%=: r0 = 0; \
252*6e9e141aSEduard Zingerman exit; \
253*6e9e141aSEduard Zingerman " :
254*6e9e141aSEduard Zingerman : __imm_const(xdp_md_data, offsetof(struct xdp_md, data)),
255*6e9e141aSEduard Zingerman __imm_const(xdp_md_data_end, offsetof(struct xdp_md, data_end))
256*6e9e141aSEduard Zingerman : __clobber_all);
257*6e9e141aSEduard Zingerman }
258*6e9e141aSEduard Zingerman
259*6e9e141aSEduard Zingerman SEC("xdp")
260*6e9e141aSEduard Zingerman __description("XDP pkt read, pkt_data' < pkt_end, good access")
__flag(BPF_F_ANY_ALIGNMENT)261*6e9e141aSEduard Zingerman __success __retval(0) __flag(BPF_F_ANY_ALIGNMENT)
262*6e9e141aSEduard Zingerman __naked void data_pkt_end_good_access_1(void)
263*6e9e141aSEduard Zingerman {
264*6e9e141aSEduard Zingerman asm volatile (" \
265*6e9e141aSEduard Zingerman r2 = *(u32*)(r1 + %[xdp_md_data]); \
266*6e9e141aSEduard Zingerman r3 = *(u32*)(r1 + %[xdp_md_data_end]); \
267*6e9e141aSEduard Zingerman r1 = r2; \
268*6e9e141aSEduard Zingerman r1 += 8; \
269*6e9e141aSEduard Zingerman if r1 < r3 goto l0_%=; \
270*6e9e141aSEduard Zingerman goto l1_%=; \
271*6e9e141aSEduard Zingerman l0_%=: r0 = *(u32*)(r1 - 5); \
272*6e9e141aSEduard Zingerman l1_%=: r0 = 0; \
273*6e9e141aSEduard Zingerman exit; \
274*6e9e141aSEduard Zingerman " :
275*6e9e141aSEduard Zingerman : __imm_const(xdp_md_data, offsetof(struct xdp_md, data)),
276*6e9e141aSEduard Zingerman __imm_const(xdp_md_data_end, offsetof(struct xdp_md, data_end))
277*6e9e141aSEduard Zingerman : __clobber_all);
278*6e9e141aSEduard Zingerman }
279*6e9e141aSEduard Zingerman
280*6e9e141aSEduard Zingerman SEC("xdp")
281*6e9e141aSEduard Zingerman __description("XDP pkt read, pkt_data' < pkt_end, corner case -1, bad access")
282*6e9e141aSEduard Zingerman __failure __msg("R1 offset is outside of the packet")
__flag(BPF_F_ANY_ALIGNMENT)283*6e9e141aSEduard Zingerman __flag(BPF_F_ANY_ALIGNMENT)
284*6e9e141aSEduard Zingerman __naked void corner_case_1_bad_access_3(void)
285*6e9e141aSEduard Zingerman {
286*6e9e141aSEduard Zingerman asm volatile (" \
287*6e9e141aSEduard Zingerman r2 = *(u32*)(r1 + %[xdp_md_data]); \
288*6e9e141aSEduard Zingerman r3 = *(u32*)(r1 + %[xdp_md_data_end]); \
289*6e9e141aSEduard Zingerman r1 = r2; \
290*6e9e141aSEduard Zingerman r1 += 6; \
291*6e9e141aSEduard Zingerman if r1 < r3 goto l0_%=; \
292*6e9e141aSEduard Zingerman goto l1_%=; \
293*6e9e141aSEduard Zingerman l0_%=: r0 = *(u64*)(r1 - 6); \
294*6e9e141aSEduard Zingerman l1_%=: r0 = 0; \
295*6e9e141aSEduard Zingerman exit; \
296*6e9e141aSEduard Zingerman " :
297*6e9e141aSEduard Zingerman : __imm_const(xdp_md_data, offsetof(struct xdp_md, data)),
298*6e9e141aSEduard Zingerman __imm_const(xdp_md_data_end, offsetof(struct xdp_md, data_end))
299*6e9e141aSEduard Zingerman : __clobber_all);
300*6e9e141aSEduard Zingerman }
301*6e9e141aSEduard Zingerman
302*6e9e141aSEduard Zingerman SEC("xdp")
303*6e9e141aSEduard Zingerman __description("XDP pkt read, pkt_data' < pkt_end, bad access 2")
304*6e9e141aSEduard Zingerman __failure __msg("R1 offset is outside of the packet")
__flag(BPF_F_ANY_ALIGNMENT)305*6e9e141aSEduard Zingerman __flag(BPF_F_ANY_ALIGNMENT)
306*6e9e141aSEduard Zingerman __naked void pkt_end_bad_access_2_2(void)
307*6e9e141aSEduard Zingerman {
308*6e9e141aSEduard Zingerman asm volatile (" \
309*6e9e141aSEduard Zingerman r2 = *(u32*)(r1 + %[xdp_md_data]); \
310*6e9e141aSEduard Zingerman r3 = *(u32*)(r1 + %[xdp_md_data_end]); \
311*6e9e141aSEduard Zingerman r1 = r2; \
312*6e9e141aSEduard Zingerman r1 += 8; \
313*6e9e141aSEduard Zingerman if r1 < r3 goto l0_%=; \
314*6e9e141aSEduard Zingerman r0 = *(u64*)(r1 - 8); \
315*6e9e141aSEduard Zingerman l0_%=: r0 = 0; \
316*6e9e141aSEduard Zingerman exit; \
317*6e9e141aSEduard Zingerman " :
318*6e9e141aSEduard Zingerman : __imm_const(xdp_md_data, offsetof(struct xdp_md, data)),
319*6e9e141aSEduard Zingerman __imm_const(xdp_md_data_end, offsetof(struct xdp_md, data_end))
320*6e9e141aSEduard Zingerman : __clobber_all);
321*6e9e141aSEduard Zingerman }
322*6e9e141aSEduard Zingerman
323*6e9e141aSEduard Zingerman SEC("xdp")
324*6e9e141aSEduard Zingerman __description("XDP pkt read, pkt_data' < pkt_end, corner case, good access")
__flag(BPF_F_ANY_ALIGNMENT)325*6e9e141aSEduard Zingerman __success __retval(0) __flag(BPF_F_ANY_ALIGNMENT)
326*6e9e141aSEduard Zingerman __naked void end_corner_case_good_access_2(void)
327*6e9e141aSEduard Zingerman {
328*6e9e141aSEduard Zingerman asm volatile (" \
329*6e9e141aSEduard Zingerman r2 = *(u32*)(r1 + %[xdp_md_data]); \
330*6e9e141aSEduard Zingerman r3 = *(u32*)(r1 + %[xdp_md_data_end]); \
331*6e9e141aSEduard Zingerman r1 = r2; \
332*6e9e141aSEduard Zingerman r1 += 7; \
333*6e9e141aSEduard Zingerman if r1 < r3 goto l0_%=; \
334*6e9e141aSEduard Zingerman goto l1_%=; \
335*6e9e141aSEduard Zingerman l0_%=: r0 = *(u64*)(r1 - 7); \
336*6e9e141aSEduard Zingerman l1_%=: r0 = 0; \
337*6e9e141aSEduard Zingerman exit; \
338*6e9e141aSEduard Zingerman " :
339*6e9e141aSEduard Zingerman : __imm_const(xdp_md_data, offsetof(struct xdp_md, data)),
340*6e9e141aSEduard Zingerman __imm_const(xdp_md_data_end, offsetof(struct xdp_md, data_end))
341*6e9e141aSEduard Zingerman : __clobber_all);
342*6e9e141aSEduard Zingerman }
343*6e9e141aSEduard Zingerman
344*6e9e141aSEduard Zingerman SEC("xdp")
345*6e9e141aSEduard Zingerman __description("XDP pkt read, pkt_data' < pkt_end, corner case +1, good access")
__flag(BPF_F_ANY_ALIGNMENT)346*6e9e141aSEduard Zingerman __success __retval(0) __flag(BPF_F_ANY_ALIGNMENT)
347*6e9e141aSEduard Zingerman __naked void corner_case_1_good_access_3(void)
348*6e9e141aSEduard Zingerman {
349*6e9e141aSEduard Zingerman asm volatile (" \
350*6e9e141aSEduard Zingerman r2 = *(u32*)(r1 + %[xdp_md_data]); \
351*6e9e141aSEduard Zingerman r3 = *(u32*)(r1 + %[xdp_md_data_end]); \
352*6e9e141aSEduard Zingerman r1 = r2; \
353*6e9e141aSEduard Zingerman r1 += 8; \
354*6e9e141aSEduard Zingerman if r1 < r3 goto l0_%=; \
355*6e9e141aSEduard Zingerman goto l1_%=; \
356*6e9e141aSEduard Zingerman l0_%=: r0 = *(u64*)(r1 - 8); \
357*6e9e141aSEduard Zingerman l1_%=: r0 = 0; \
358*6e9e141aSEduard Zingerman exit; \
359*6e9e141aSEduard Zingerman " :
360*6e9e141aSEduard Zingerman : __imm_const(xdp_md_data, offsetof(struct xdp_md, data)),
361*6e9e141aSEduard Zingerman __imm_const(xdp_md_data_end, offsetof(struct xdp_md, data_end))
362*6e9e141aSEduard Zingerman : __clobber_all);
363*6e9e141aSEduard Zingerman }
364*6e9e141aSEduard Zingerman
365*6e9e141aSEduard Zingerman SEC("xdp")
366*6e9e141aSEduard Zingerman __description("XDP pkt read, pkt_end < pkt_data', corner case, good access")
__flag(BPF_F_ANY_ALIGNMENT)367*6e9e141aSEduard Zingerman __success __retval(0) __flag(BPF_F_ANY_ALIGNMENT)
368*6e9e141aSEduard Zingerman __naked void data_corner_case_good_access_2(void)
369*6e9e141aSEduard Zingerman {
370*6e9e141aSEduard Zingerman asm volatile (" \
371*6e9e141aSEduard Zingerman r2 = *(u32*)(r1 + %[xdp_md_data]); \
372*6e9e141aSEduard Zingerman r3 = *(u32*)(r1 + %[xdp_md_data_end]); \
373*6e9e141aSEduard Zingerman r1 = r2; \
374*6e9e141aSEduard Zingerman r1 += 8; \
375*6e9e141aSEduard Zingerman if r3 < r1 goto l0_%=; \
376*6e9e141aSEduard Zingerman r0 = *(u64*)(r1 - 8); \
377*6e9e141aSEduard Zingerman l0_%=: r0 = 0; \
378*6e9e141aSEduard Zingerman exit; \
379*6e9e141aSEduard Zingerman " :
380*6e9e141aSEduard Zingerman : __imm_const(xdp_md_data, offsetof(struct xdp_md, data)),
381*6e9e141aSEduard Zingerman __imm_const(xdp_md_data_end, offsetof(struct xdp_md, data_end))
382*6e9e141aSEduard Zingerman : __clobber_all);
383*6e9e141aSEduard Zingerman }
384*6e9e141aSEduard Zingerman
385*6e9e141aSEduard Zingerman SEC("xdp")
386*6e9e141aSEduard Zingerman __description("XDP pkt read, pkt_end < pkt_data', bad access 1")
387*6e9e141aSEduard Zingerman __failure __msg("R1 offset is outside of the packet")
__flag(BPF_F_ANY_ALIGNMENT)388*6e9e141aSEduard Zingerman __flag(BPF_F_ANY_ALIGNMENT)
389*6e9e141aSEduard Zingerman __naked void pkt_data_bad_access_1_1(void)
390*6e9e141aSEduard Zingerman {
391*6e9e141aSEduard Zingerman asm volatile (" \
392*6e9e141aSEduard Zingerman r2 = *(u32*)(r1 + %[xdp_md_data]); \
393*6e9e141aSEduard Zingerman r3 = *(u32*)(r1 + %[xdp_md_data_end]); \
394*6e9e141aSEduard Zingerman r1 = r2; \
395*6e9e141aSEduard Zingerman r1 += 8; \
396*6e9e141aSEduard Zingerman if r3 < r1 goto l0_%=; \
397*6e9e141aSEduard Zingerman r0 = *(u64*)(r1 - 4); \
398*6e9e141aSEduard Zingerman l0_%=: r0 = 0; \
399*6e9e141aSEduard Zingerman exit; \
400*6e9e141aSEduard Zingerman " :
401*6e9e141aSEduard Zingerman : __imm_const(xdp_md_data, offsetof(struct xdp_md, data)),
402*6e9e141aSEduard Zingerman __imm_const(xdp_md_data_end, offsetof(struct xdp_md, data_end))
403*6e9e141aSEduard Zingerman : __clobber_all);
404*6e9e141aSEduard Zingerman }
405*6e9e141aSEduard Zingerman
406*6e9e141aSEduard Zingerman SEC("xdp")
407*6e9e141aSEduard Zingerman __description("XDP pkt read, pkt_end < pkt_data', bad access 2")
408*6e9e141aSEduard Zingerman __failure __msg("R1 offset is outside of the packet")
__flag(BPF_F_ANY_ALIGNMENT)409*6e9e141aSEduard Zingerman __flag(BPF_F_ANY_ALIGNMENT)
410*6e9e141aSEduard Zingerman __naked void pkt_data_bad_access_2_2(void)
411*6e9e141aSEduard Zingerman {
412*6e9e141aSEduard Zingerman asm volatile (" \
413*6e9e141aSEduard Zingerman r2 = *(u32*)(r1 + %[xdp_md_data]); \
414*6e9e141aSEduard Zingerman r3 = *(u32*)(r1 + %[xdp_md_data_end]); \
415*6e9e141aSEduard Zingerman r1 = r2; \
416*6e9e141aSEduard Zingerman r1 += 8; \
417*6e9e141aSEduard Zingerman if r3 < r1 goto l0_%=; \
418*6e9e141aSEduard Zingerman l0_%=: r0 = *(u64*)(r1 - 8); \
419*6e9e141aSEduard Zingerman r0 = 0; \
420*6e9e141aSEduard Zingerman exit; \
421*6e9e141aSEduard Zingerman " :
422*6e9e141aSEduard Zingerman : __imm_const(xdp_md_data, offsetof(struct xdp_md, data)),
423*6e9e141aSEduard Zingerman __imm_const(xdp_md_data_end, offsetof(struct xdp_md, data_end))
424*6e9e141aSEduard Zingerman : __clobber_all);
425*6e9e141aSEduard Zingerman }
426*6e9e141aSEduard Zingerman
427*6e9e141aSEduard Zingerman SEC("xdp")
428*6e9e141aSEduard Zingerman __description("XDP pkt read, pkt_end < pkt_data', corner case +1, good access")
__flag(BPF_F_ANY_ALIGNMENT)429*6e9e141aSEduard Zingerman __success __retval(0) __flag(BPF_F_ANY_ALIGNMENT)
430*6e9e141aSEduard Zingerman __naked void corner_case_1_good_access_4(void)
431*6e9e141aSEduard Zingerman {
432*6e9e141aSEduard Zingerman asm volatile (" \
433*6e9e141aSEduard Zingerman r2 = *(u32*)(r1 + %[xdp_md_data]); \
434*6e9e141aSEduard Zingerman r3 = *(u32*)(r1 + %[xdp_md_data_end]); \
435*6e9e141aSEduard Zingerman r1 = r2; \
436*6e9e141aSEduard Zingerman r1 += 9; \
437*6e9e141aSEduard Zingerman if r3 < r1 goto l0_%=; \
438*6e9e141aSEduard Zingerman r0 = *(u64*)(r1 - 9); \
439*6e9e141aSEduard Zingerman l0_%=: r0 = 0; \
440*6e9e141aSEduard Zingerman exit; \
441*6e9e141aSEduard Zingerman " :
442*6e9e141aSEduard Zingerman : __imm_const(xdp_md_data, offsetof(struct xdp_md, data)),
443*6e9e141aSEduard Zingerman __imm_const(xdp_md_data_end, offsetof(struct xdp_md, data_end))
444*6e9e141aSEduard Zingerman : __clobber_all);
445*6e9e141aSEduard Zingerman }
446*6e9e141aSEduard Zingerman
447*6e9e141aSEduard Zingerman SEC("xdp")
448*6e9e141aSEduard Zingerman __description("XDP pkt read, pkt_end < pkt_data', corner case -1, bad access")
449*6e9e141aSEduard Zingerman __failure __msg("R1 offset is outside of the packet")
__flag(BPF_F_ANY_ALIGNMENT)450*6e9e141aSEduard Zingerman __flag(BPF_F_ANY_ALIGNMENT)
451*6e9e141aSEduard Zingerman __naked void corner_case_1_bad_access_4(void)
452*6e9e141aSEduard Zingerman {
453*6e9e141aSEduard Zingerman asm volatile (" \
454*6e9e141aSEduard Zingerman r2 = *(u32*)(r1 + %[xdp_md_data]); \
455*6e9e141aSEduard Zingerman r3 = *(u32*)(r1 + %[xdp_md_data_end]); \
456*6e9e141aSEduard Zingerman r1 = r2; \
457*6e9e141aSEduard Zingerman r1 += 7; \
458*6e9e141aSEduard Zingerman if r3 < r1 goto l0_%=; \
459*6e9e141aSEduard Zingerman r0 = *(u64*)(r1 - 7); \
460*6e9e141aSEduard Zingerman l0_%=: r0 = 0; \
461*6e9e141aSEduard Zingerman exit; \
462*6e9e141aSEduard Zingerman " :
463*6e9e141aSEduard Zingerman : __imm_const(xdp_md_data, offsetof(struct xdp_md, data)),
464*6e9e141aSEduard Zingerman __imm_const(xdp_md_data_end, offsetof(struct xdp_md, data_end))
465*6e9e141aSEduard Zingerman : __clobber_all);
466*6e9e141aSEduard Zingerman }
467*6e9e141aSEduard Zingerman
468*6e9e141aSEduard Zingerman SEC("xdp")
469*6e9e141aSEduard Zingerman __description("XDP pkt read, pkt_data' >= pkt_end, good access")
__flag(BPF_F_ANY_ALIGNMENT)470*6e9e141aSEduard Zingerman __success __retval(0) __flag(BPF_F_ANY_ALIGNMENT)
471*6e9e141aSEduard Zingerman __naked void data_pkt_end_good_access_2(void)
472*6e9e141aSEduard Zingerman {
473*6e9e141aSEduard Zingerman asm volatile (" \
474*6e9e141aSEduard Zingerman r2 = *(u32*)(r1 + %[xdp_md_data]); \
475*6e9e141aSEduard Zingerman r3 = *(u32*)(r1 + %[xdp_md_data_end]); \
476*6e9e141aSEduard Zingerman r1 = r2; \
477*6e9e141aSEduard Zingerman r1 += 8; \
478*6e9e141aSEduard Zingerman if r1 >= r3 goto l0_%=; \
479*6e9e141aSEduard Zingerman r0 = *(u32*)(r1 - 5); \
480*6e9e141aSEduard Zingerman l0_%=: r0 = 0; \
481*6e9e141aSEduard Zingerman exit; \
482*6e9e141aSEduard Zingerman " :
483*6e9e141aSEduard Zingerman : __imm_const(xdp_md_data, offsetof(struct xdp_md, data)),
484*6e9e141aSEduard Zingerman __imm_const(xdp_md_data_end, offsetof(struct xdp_md, data_end))
485*6e9e141aSEduard Zingerman : __clobber_all);
486*6e9e141aSEduard Zingerman }
487*6e9e141aSEduard Zingerman
488*6e9e141aSEduard Zingerman SEC("xdp")
489*6e9e141aSEduard Zingerman __description("XDP pkt read, pkt_data' >= pkt_end, corner case -1, bad access")
490*6e9e141aSEduard Zingerman __failure __msg("R1 offset is outside of the packet")
__flag(BPF_F_ANY_ALIGNMENT)491*6e9e141aSEduard Zingerman __flag(BPF_F_ANY_ALIGNMENT)
492*6e9e141aSEduard Zingerman __naked void corner_case_1_bad_access_5(void)
493*6e9e141aSEduard Zingerman {
494*6e9e141aSEduard Zingerman asm volatile (" \
495*6e9e141aSEduard Zingerman r2 = *(u32*)(r1 + %[xdp_md_data]); \
496*6e9e141aSEduard Zingerman r3 = *(u32*)(r1 + %[xdp_md_data_end]); \
497*6e9e141aSEduard Zingerman r1 = r2; \
498*6e9e141aSEduard Zingerman r1 += 6; \
499*6e9e141aSEduard Zingerman if r1 >= r3 goto l0_%=; \
500*6e9e141aSEduard Zingerman r0 = *(u64*)(r1 - 6); \
501*6e9e141aSEduard Zingerman l0_%=: r0 = 0; \
502*6e9e141aSEduard Zingerman exit; \
503*6e9e141aSEduard Zingerman " :
504*6e9e141aSEduard Zingerman : __imm_const(xdp_md_data, offsetof(struct xdp_md, data)),
505*6e9e141aSEduard Zingerman __imm_const(xdp_md_data_end, offsetof(struct xdp_md, data_end))
506*6e9e141aSEduard Zingerman : __clobber_all);
507*6e9e141aSEduard Zingerman }
508*6e9e141aSEduard Zingerman
509*6e9e141aSEduard Zingerman SEC("xdp")
510*6e9e141aSEduard Zingerman __description("XDP pkt read, pkt_data' >= pkt_end, bad access 2")
511*6e9e141aSEduard Zingerman __failure __msg("R1 offset is outside of the packet")
__flag(BPF_F_ANY_ALIGNMENT)512*6e9e141aSEduard Zingerman __flag(BPF_F_ANY_ALIGNMENT)
513*6e9e141aSEduard Zingerman __naked void pkt_end_bad_access_2_3(void)
514*6e9e141aSEduard Zingerman {
515*6e9e141aSEduard Zingerman asm volatile (" \
516*6e9e141aSEduard Zingerman r2 = *(u32*)(r1 + %[xdp_md_data]); \
517*6e9e141aSEduard Zingerman r3 = *(u32*)(r1 + %[xdp_md_data_end]); \
518*6e9e141aSEduard Zingerman r1 = r2; \
519*6e9e141aSEduard Zingerman r1 += 8; \
520*6e9e141aSEduard Zingerman if r1 >= r3 goto l0_%=; \
521*6e9e141aSEduard Zingerman l0_%=: r0 = *(u32*)(r1 - 5); \
522*6e9e141aSEduard Zingerman r0 = 0; \
523*6e9e141aSEduard Zingerman exit; \
524*6e9e141aSEduard Zingerman " :
525*6e9e141aSEduard Zingerman : __imm_const(xdp_md_data, offsetof(struct xdp_md, data)),
526*6e9e141aSEduard Zingerman __imm_const(xdp_md_data_end, offsetof(struct xdp_md, data_end))
527*6e9e141aSEduard Zingerman : __clobber_all);
528*6e9e141aSEduard Zingerman }
529*6e9e141aSEduard Zingerman
530*6e9e141aSEduard Zingerman SEC("xdp")
531*6e9e141aSEduard Zingerman __description("XDP pkt read, pkt_data' >= pkt_end, corner case, good access")
__flag(BPF_F_ANY_ALIGNMENT)532*6e9e141aSEduard Zingerman __success __retval(0) __flag(BPF_F_ANY_ALIGNMENT)
533*6e9e141aSEduard Zingerman __naked void end_corner_case_good_access_3(void)
534*6e9e141aSEduard Zingerman {
535*6e9e141aSEduard Zingerman asm volatile (" \
536*6e9e141aSEduard Zingerman r2 = *(u32*)(r1 + %[xdp_md_data]); \
537*6e9e141aSEduard Zingerman r3 = *(u32*)(r1 + %[xdp_md_data_end]); \
538*6e9e141aSEduard Zingerman r1 = r2; \
539*6e9e141aSEduard Zingerman r1 += 7; \
540*6e9e141aSEduard Zingerman if r1 >= r3 goto l0_%=; \
541*6e9e141aSEduard Zingerman r0 = *(u64*)(r1 - 7); \
542*6e9e141aSEduard Zingerman l0_%=: r0 = 0; \
543*6e9e141aSEduard Zingerman exit; \
544*6e9e141aSEduard Zingerman " :
545*6e9e141aSEduard Zingerman : __imm_const(xdp_md_data, offsetof(struct xdp_md, data)),
546*6e9e141aSEduard Zingerman __imm_const(xdp_md_data_end, offsetof(struct xdp_md, data_end))
547*6e9e141aSEduard Zingerman : __clobber_all);
548*6e9e141aSEduard Zingerman }
549*6e9e141aSEduard Zingerman
550*6e9e141aSEduard Zingerman SEC("xdp")
551*6e9e141aSEduard Zingerman __description("XDP pkt read, pkt_data' >= pkt_end, corner case +1, good access")
__flag(BPF_F_ANY_ALIGNMENT)552*6e9e141aSEduard Zingerman __success __retval(0) __flag(BPF_F_ANY_ALIGNMENT)
553*6e9e141aSEduard Zingerman __naked void corner_case_1_good_access_5(void)
554*6e9e141aSEduard Zingerman {
555*6e9e141aSEduard Zingerman asm volatile (" \
556*6e9e141aSEduard Zingerman r2 = *(u32*)(r1 + %[xdp_md_data]); \
557*6e9e141aSEduard Zingerman r3 = *(u32*)(r1 + %[xdp_md_data_end]); \
558*6e9e141aSEduard Zingerman r1 = r2; \
559*6e9e141aSEduard Zingerman r1 += 8; \
560*6e9e141aSEduard Zingerman if r1 >= r3 goto l0_%=; \
561*6e9e141aSEduard Zingerman r0 = *(u64*)(r1 - 8); \
562*6e9e141aSEduard Zingerman l0_%=: r0 = 0; \
563*6e9e141aSEduard Zingerman exit; \
564*6e9e141aSEduard Zingerman " :
565*6e9e141aSEduard Zingerman : __imm_const(xdp_md_data, offsetof(struct xdp_md, data)),
566*6e9e141aSEduard Zingerman __imm_const(xdp_md_data_end, offsetof(struct xdp_md, data_end))
567*6e9e141aSEduard Zingerman : __clobber_all);
568*6e9e141aSEduard Zingerman }
569*6e9e141aSEduard Zingerman
570*6e9e141aSEduard Zingerman SEC("xdp")
571*6e9e141aSEduard Zingerman __description("XDP pkt read, pkt_end >= pkt_data', corner case, good access")
__flag(BPF_F_ANY_ALIGNMENT)572*6e9e141aSEduard Zingerman __success __retval(0) __flag(BPF_F_ANY_ALIGNMENT)
573*6e9e141aSEduard Zingerman __naked void data_corner_case_good_access_3(void)
574*6e9e141aSEduard Zingerman {
575*6e9e141aSEduard Zingerman asm volatile (" \
576*6e9e141aSEduard Zingerman r2 = *(u32*)(r1 + %[xdp_md_data]); \
577*6e9e141aSEduard Zingerman r3 = *(u32*)(r1 + %[xdp_md_data_end]); \
578*6e9e141aSEduard Zingerman r1 = r2; \
579*6e9e141aSEduard Zingerman r1 += 8; \
580*6e9e141aSEduard Zingerman if r3 >= r1 goto l0_%=; \
581*6e9e141aSEduard Zingerman goto l1_%=; \
582*6e9e141aSEduard Zingerman l0_%=: r0 = *(u64*)(r1 - 8); \
583*6e9e141aSEduard Zingerman l1_%=: r0 = 0; \
584*6e9e141aSEduard Zingerman exit; \
585*6e9e141aSEduard Zingerman " :
586*6e9e141aSEduard Zingerman : __imm_const(xdp_md_data, offsetof(struct xdp_md, data)),
587*6e9e141aSEduard Zingerman __imm_const(xdp_md_data_end, offsetof(struct xdp_md, data_end))
588*6e9e141aSEduard Zingerman : __clobber_all);
589*6e9e141aSEduard Zingerman }
590*6e9e141aSEduard Zingerman
591*6e9e141aSEduard Zingerman SEC("xdp")
592*6e9e141aSEduard Zingerman __description("XDP pkt read, pkt_end >= pkt_data', bad access 1")
593*6e9e141aSEduard Zingerman __failure __msg("R1 offset is outside of the packet")
__flag(BPF_F_ANY_ALIGNMENT)594*6e9e141aSEduard Zingerman __flag(BPF_F_ANY_ALIGNMENT)
595*6e9e141aSEduard Zingerman __naked void pkt_data_bad_access_1_2(void)
596*6e9e141aSEduard Zingerman {
597*6e9e141aSEduard Zingerman asm volatile (" \
598*6e9e141aSEduard Zingerman r2 = *(u32*)(r1 + %[xdp_md_data]); \
599*6e9e141aSEduard Zingerman r3 = *(u32*)(r1 + %[xdp_md_data_end]); \
600*6e9e141aSEduard Zingerman r1 = r2; \
601*6e9e141aSEduard Zingerman r1 += 8; \
602*6e9e141aSEduard Zingerman if r3 >= r1 goto l0_%=; \
603*6e9e141aSEduard Zingerman goto l1_%=; \
604*6e9e141aSEduard Zingerman l0_%=: r0 = *(u64*)(r1 - 4); \
605*6e9e141aSEduard Zingerman l1_%=: r0 = 0; \
606*6e9e141aSEduard Zingerman exit; \
607*6e9e141aSEduard Zingerman " :
608*6e9e141aSEduard Zingerman : __imm_const(xdp_md_data, offsetof(struct xdp_md, data)),
609*6e9e141aSEduard Zingerman __imm_const(xdp_md_data_end, offsetof(struct xdp_md, data_end))
610*6e9e141aSEduard Zingerman : __clobber_all);
611*6e9e141aSEduard Zingerman }
612*6e9e141aSEduard Zingerman
613*6e9e141aSEduard Zingerman SEC("xdp")
614*6e9e141aSEduard Zingerman __description("XDP pkt read, pkt_end >= pkt_data', bad access 2")
615*6e9e141aSEduard Zingerman __failure __msg("R1 offset is outside of the packet")
__flag(BPF_F_ANY_ALIGNMENT)616*6e9e141aSEduard Zingerman __flag(BPF_F_ANY_ALIGNMENT)
617*6e9e141aSEduard Zingerman __naked void pkt_data_bad_access_2_3(void)
618*6e9e141aSEduard Zingerman {
619*6e9e141aSEduard Zingerman asm volatile (" \
620*6e9e141aSEduard Zingerman r2 = *(u32*)(r1 + %[xdp_md_data]); \
621*6e9e141aSEduard Zingerman r3 = *(u32*)(r1 + %[xdp_md_data_end]); \
622*6e9e141aSEduard Zingerman r1 = r2; \
623*6e9e141aSEduard Zingerman r1 += 8; \
624*6e9e141aSEduard Zingerman if r3 >= r1 goto l0_%=; \
625*6e9e141aSEduard Zingerman r0 = *(u64*)(r1 - 8); \
626*6e9e141aSEduard Zingerman l0_%=: r0 = 0; \
627*6e9e141aSEduard Zingerman exit; \
628*6e9e141aSEduard Zingerman " :
629*6e9e141aSEduard Zingerman : __imm_const(xdp_md_data, offsetof(struct xdp_md, data)),
630*6e9e141aSEduard Zingerman __imm_const(xdp_md_data_end, offsetof(struct xdp_md, data_end))
631*6e9e141aSEduard Zingerman : __clobber_all);
632*6e9e141aSEduard Zingerman }
633*6e9e141aSEduard Zingerman
634*6e9e141aSEduard Zingerman SEC("xdp")
635*6e9e141aSEduard Zingerman __description("XDP pkt read, pkt_end >= pkt_data', corner case +1, good access")
__flag(BPF_F_ANY_ALIGNMENT)636*6e9e141aSEduard Zingerman __success __retval(0) __flag(BPF_F_ANY_ALIGNMENT)
637*6e9e141aSEduard Zingerman __naked void corner_case_1_good_access_6(void)
638*6e9e141aSEduard Zingerman {
639*6e9e141aSEduard Zingerman asm volatile (" \
640*6e9e141aSEduard Zingerman r2 = *(u32*)(r1 + %[xdp_md_data]); \
641*6e9e141aSEduard Zingerman r3 = *(u32*)(r1 + %[xdp_md_data_end]); \
642*6e9e141aSEduard Zingerman r1 = r2; \
643*6e9e141aSEduard Zingerman r1 += 9; \
644*6e9e141aSEduard Zingerman if r3 >= r1 goto l0_%=; \
645*6e9e141aSEduard Zingerman goto l1_%=; \
646*6e9e141aSEduard Zingerman l0_%=: r0 = *(u64*)(r1 - 9); \
647*6e9e141aSEduard Zingerman l1_%=: r0 = 0; \
648*6e9e141aSEduard Zingerman exit; \
649*6e9e141aSEduard Zingerman " :
650*6e9e141aSEduard Zingerman : __imm_const(xdp_md_data, offsetof(struct xdp_md, data)),
651*6e9e141aSEduard Zingerman __imm_const(xdp_md_data_end, offsetof(struct xdp_md, data_end))
652*6e9e141aSEduard Zingerman : __clobber_all);
653*6e9e141aSEduard Zingerman }
654*6e9e141aSEduard Zingerman
655*6e9e141aSEduard Zingerman SEC("xdp")
656*6e9e141aSEduard Zingerman __description("XDP pkt read, pkt_end >= pkt_data', corner case -1, bad access")
657*6e9e141aSEduard Zingerman __failure __msg("R1 offset is outside of the packet")
__flag(BPF_F_ANY_ALIGNMENT)658*6e9e141aSEduard Zingerman __flag(BPF_F_ANY_ALIGNMENT)
659*6e9e141aSEduard Zingerman __naked void corner_case_1_bad_access_6(void)
660*6e9e141aSEduard Zingerman {
661*6e9e141aSEduard Zingerman asm volatile (" \
662*6e9e141aSEduard Zingerman r2 = *(u32*)(r1 + %[xdp_md_data]); \
663*6e9e141aSEduard Zingerman r3 = *(u32*)(r1 + %[xdp_md_data_end]); \
664*6e9e141aSEduard Zingerman r1 = r2; \
665*6e9e141aSEduard Zingerman r1 += 7; \
666*6e9e141aSEduard Zingerman if r3 >= r1 goto l0_%=; \
667*6e9e141aSEduard Zingerman goto l1_%=; \
668*6e9e141aSEduard Zingerman l0_%=: r0 = *(u64*)(r1 - 7); \
669*6e9e141aSEduard Zingerman l1_%=: r0 = 0; \
670*6e9e141aSEduard Zingerman exit; \
671*6e9e141aSEduard Zingerman " :
672*6e9e141aSEduard Zingerman : __imm_const(xdp_md_data, offsetof(struct xdp_md, data)),
673*6e9e141aSEduard Zingerman __imm_const(xdp_md_data_end, offsetof(struct xdp_md, data_end))
674*6e9e141aSEduard Zingerman : __clobber_all);
675*6e9e141aSEduard Zingerman }
676*6e9e141aSEduard Zingerman
677*6e9e141aSEduard Zingerman SEC("xdp")
678*6e9e141aSEduard Zingerman __description("XDP pkt read, pkt_data' <= pkt_end, corner case, good access")
__flag(BPF_F_ANY_ALIGNMENT)679*6e9e141aSEduard Zingerman __success __retval(0) __flag(BPF_F_ANY_ALIGNMENT)
680*6e9e141aSEduard Zingerman __naked void end_corner_case_good_access_4(void)
681*6e9e141aSEduard Zingerman {
682*6e9e141aSEduard Zingerman asm volatile (" \
683*6e9e141aSEduard Zingerman r2 = *(u32*)(r1 + %[xdp_md_data]); \
684*6e9e141aSEduard Zingerman r3 = *(u32*)(r1 + %[xdp_md_data_end]); \
685*6e9e141aSEduard Zingerman r1 = r2; \
686*6e9e141aSEduard Zingerman r1 += 8; \
687*6e9e141aSEduard Zingerman if r1 <= r3 goto l0_%=; \
688*6e9e141aSEduard Zingerman goto l1_%=; \
689*6e9e141aSEduard Zingerman l0_%=: r0 = *(u64*)(r1 - 8); \
690*6e9e141aSEduard Zingerman l1_%=: r0 = 0; \
691*6e9e141aSEduard Zingerman exit; \
692*6e9e141aSEduard Zingerman " :
693*6e9e141aSEduard Zingerman : __imm_const(xdp_md_data, offsetof(struct xdp_md, data)),
694*6e9e141aSEduard Zingerman __imm_const(xdp_md_data_end, offsetof(struct xdp_md, data_end))
695*6e9e141aSEduard Zingerman : __clobber_all);
696*6e9e141aSEduard Zingerman }
697*6e9e141aSEduard Zingerman
698*6e9e141aSEduard Zingerman SEC("xdp")
699*6e9e141aSEduard Zingerman __description("XDP pkt read, pkt_data' <= pkt_end, bad access 1")
700*6e9e141aSEduard Zingerman __failure __msg("R1 offset is outside of the packet")
__flag(BPF_F_ANY_ALIGNMENT)701*6e9e141aSEduard Zingerman __flag(BPF_F_ANY_ALIGNMENT)
702*6e9e141aSEduard Zingerman __naked void pkt_end_bad_access_1_2(void)
703*6e9e141aSEduard Zingerman {
704*6e9e141aSEduard Zingerman asm volatile (" \
705*6e9e141aSEduard Zingerman r2 = *(u32*)(r1 + %[xdp_md_data]); \
706*6e9e141aSEduard Zingerman r3 = *(u32*)(r1 + %[xdp_md_data_end]); \
707*6e9e141aSEduard Zingerman r1 = r2; \
708*6e9e141aSEduard Zingerman r1 += 8; \
709*6e9e141aSEduard Zingerman if r1 <= r3 goto l0_%=; \
710*6e9e141aSEduard Zingerman goto l1_%=; \
711*6e9e141aSEduard Zingerman l0_%=: r0 = *(u64*)(r1 - 4); \
712*6e9e141aSEduard Zingerman l1_%=: r0 = 0; \
713*6e9e141aSEduard Zingerman exit; \
714*6e9e141aSEduard Zingerman " :
715*6e9e141aSEduard Zingerman : __imm_const(xdp_md_data, offsetof(struct xdp_md, data)),
716*6e9e141aSEduard Zingerman __imm_const(xdp_md_data_end, offsetof(struct xdp_md, data_end))
717*6e9e141aSEduard Zingerman : __clobber_all);
718*6e9e141aSEduard Zingerman }
719*6e9e141aSEduard Zingerman
720*6e9e141aSEduard Zingerman SEC("xdp")
721*6e9e141aSEduard Zingerman __description("XDP pkt read, pkt_data' <= pkt_end, bad access 2")
722*6e9e141aSEduard Zingerman __failure __msg("R1 offset is outside of the packet")
__flag(BPF_F_ANY_ALIGNMENT)723*6e9e141aSEduard Zingerman __flag(BPF_F_ANY_ALIGNMENT)
724*6e9e141aSEduard Zingerman __naked void pkt_end_bad_access_2_4(void)
725*6e9e141aSEduard Zingerman {
726*6e9e141aSEduard Zingerman asm volatile (" \
727*6e9e141aSEduard Zingerman r2 = *(u32*)(r1 + %[xdp_md_data]); \
728*6e9e141aSEduard Zingerman r3 = *(u32*)(r1 + %[xdp_md_data_end]); \
729*6e9e141aSEduard Zingerman r1 = r2; \
730*6e9e141aSEduard Zingerman r1 += 8; \
731*6e9e141aSEduard Zingerman if r1 <= r3 goto l0_%=; \
732*6e9e141aSEduard Zingerman r0 = *(u64*)(r1 - 8); \
733*6e9e141aSEduard Zingerman l0_%=: r0 = 0; \
734*6e9e141aSEduard Zingerman exit; \
735*6e9e141aSEduard Zingerman " :
736*6e9e141aSEduard Zingerman : __imm_const(xdp_md_data, offsetof(struct xdp_md, data)),
737*6e9e141aSEduard Zingerman __imm_const(xdp_md_data_end, offsetof(struct xdp_md, data_end))
738*6e9e141aSEduard Zingerman : __clobber_all);
739*6e9e141aSEduard Zingerman }
740*6e9e141aSEduard Zingerman
741*6e9e141aSEduard Zingerman SEC("xdp")
742*6e9e141aSEduard Zingerman __description("XDP pkt read, pkt_data' <= pkt_end, corner case +1, good access")
__flag(BPF_F_ANY_ALIGNMENT)743*6e9e141aSEduard Zingerman __success __retval(0) __flag(BPF_F_ANY_ALIGNMENT)
744*6e9e141aSEduard Zingerman __naked void corner_case_1_good_access_7(void)
745*6e9e141aSEduard Zingerman {
746*6e9e141aSEduard Zingerman asm volatile (" \
747*6e9e141aSEduard Zingerman r2 = *(u32*)(r1 + %[xdp_md_data]); \
748*6e9e141aSEduard Zingerman r3 = *(u32*)(r1 + %[xdp_md_data_end]); \
749*6e9e141aSEduard Zingerman r1 = r2; \
750*6e9e141aSEduard Zingerman r1 += 9; \
751*6e9e141aSEduard Zingerman if r1 <= r3 goto l0_%=; \
752*6e9e141aSEduard Zingerman goto l1_%=; \
753*6e9e141aSEduard Zingerman l0_%=: r0 = *(u64*)(r1 - 9); \
754*6e9e141aSEduard Zingerman l1_%=: r0 = 0; \
755*6e9e141aSEduard Zingerman exit; \
756*6e9e141aSEduard Zingerman " :
757*6e9e141aSEduard Zingerman : __imm_const(xdp_md_data, offsetof(struct xdp_md, data)),
758*6e9e141aSEduard Zingerman __imm_const(xdp_md_data_end, offsetof(struct xdp_md, data_end))
759*6e9e141aSEduard Zingerman : __clobber_all);
760*6e9e141aSEduard Zingerman }
761*6e9e141aSEduard Zingerman
762*6e9e141aSEduard Zingerman SEC("xdp")
763*6e9e141aSEduard Zingerman __description("XDP pkt read, pkt_data' <= pkt_end, corner case -1, bad access")
764*6e9e141aSEduard Zingerman __failure __msg("R1 offset is outside of the packet")
__flag(BPF_F_ANY_ALIGNMENT)765*6e9e141aSEduard Zingerman __flag(BPF_F_ANY_ALIGNMENT)
766*6e9e141aSEduard Zingerman __naked void corner_case_1_bad_access_7(void)
767*6e9e141aSEduard Zingerman {
768*6e9e141aSEduard Zingerman asm volatile (" \
769*6e9e141aSEduard Zingerman r2 = *(u32*)(r1 + %[xdp_md_data]); \
770*6e9e141aSEduard Zingerman r3 = *(u32*)(r1 + %[xdp_md_data_end]); \
771*6e9e141aSEduard Zingerman r1 = r2; \
772*6e9e141aSEduard Zingerman r1 += 7; \
773*6e9e141aSEduard Zingerman if r1 <= r3 goto l0_%=; \
774*6e9e141aSEduard Zingerman goto l1_%=; \
775*6e9e141aSEduard Zingerman l0_%=: r0 = *(u64*)(r1 - 7); \
776*6e9e141aSEduard Zingerman l1_%=: r0 = 0; \
777*6e9e141aSEduard Zingerman exit; \
778*6e9e141aSEduard Zingerman " :
779*6e9e141aSEduard Zingerman : __imm_const(xdp_md_data, offsetof(struct xdp_md, data)),
780*6e9e141aSEduard Zingerman __imm_const(xdp_md_data_end, offsetof(struct xdp_md, data_end))
781*6e9e141aSEduard Zingerman : __clobber_all);
782*6e9e141aSEduard Zingerman }
783*6e9e141aSEduard Zingerman
784*6e9e141aSEduard Zingerman SEC("xdp")
785*6e9e141aSEduard Zingerman __description("XDP pkt read, pkt_end <= pkt_data', good access")
__flag(BPF_F_ANY_ALIGNMENT)786*6e9e141aSEduard Zingerman __success __retval(0) __flag(BPF_F_ANY_ALIGNMENT)
787*6e9e141aSEduard Zingerman __naked void end_pkt_data_good_access_2(void)
788*6e9e141aSEduard Zingerman {
789*6e9e141aSEduard Zingerman asm volatile (" \
790*6e9e141aSEduard Zingerman r2 = *(u32*)(r1 + %[xdp_md_data]); \
791*6e9e141aSEduard Zingerman r3 = *(u32*)(r1 + %[xdp_md_data_end]); \
792*6e9e141aSEduard Zingerman r1 = r2; \
793*6e9e141aSEduard Zingerman r1 += 8; \
794*6e9e141aSEduard Zingerman if r3 <= r1 goto l0_%=; \
795*6e9e141aSEduard Zingerman r0 = *(u32*)(r1 - 5); \
796*6e9e141aSEduard Zingerman l0_%=: r0 = 0; \
797*6e9e141aSEduard Zingerman exit; \
798*6e9e141aSEduard Zingerman " :
799*6e9e141aSEduard Zingerman : __imm_const(xdp_md_data, offsetof(struct xdp_md, data)),
800*6e9e141aSEduard Zingerman __imm_const(xdp_md_data_end, offsetof(struct xdp_md, data_end))
801*6e9e141aSEduard Zingerman : __clobber_all);
802*6e9e141aSEduard Zingerman }
803*6e9e141aSEduard Zingerman
804*6e9e141aSEduard Zingerman SEC("xdp")
805*6e9e141aSEduard Zingerman __description("XDP pkt read, pkt_end <= pkt_data', corner case -1, bad access")
806*6e9e141aSEduard Zingerman __failure __msg("R1 offset is outside of the packet")
__flag(BPF_F_ANY_ALIGNMENT)807*6e9e141aSEduard Zingerman __flag(BPF_F_ANY_ALIGNMENT)
808*6e9e141aSEduard Zingerman __naked void corner_case_1_bad_access_8(void)
809*6e9e141aSEduard Zingerman {
810*6e9e141aSEduard Zingerman asm volatile (" \
811*6e9e141aSEduard Zingerman r2 = *(u32*)(r1 + %[xdp_md_data]); \
812*6e9e141aSEduard Zingerman r3 = *(u32*)(r1 + %[xdp_md_data_end]); \
813*6e9e141aSEduard Zingerman r1 = r2; \
814*6e9e141aSEduard Zingerman r1 += 6; \
815*6e9e141aSEduard Zingerman if r3 <= r1 goto l0_%=; \
816*6e9e141aSEduard Zingerman r0 = *(u64*)(r1 - 6); \
817*6e9e141aSEduard Zingerman l0_%=: r0 = 0; \
818*6e9e141aSEduard Zingerman exit; \
819*6e9e141aSEduard Zingerman " :
820*6e9e141aSEduard Zingerman : __imm_const(xdp_md_data, offsetof(struct xdp_md, data)),
821*6e9e141aSEduard Zingerman __imm_const(xdp_md_data_end, offsetof(struct xdp_md, data_end))
822*6e9e141aSEduard Zingerman : __clobber_all);
823*6e9e141aSEduard Zingerman }
824*6e9e141aSEduard Zingerman
825*6e9e141aSEduard Zingerman SEC("xdp")
826*6e9e141aSEduard Zingerman __description("XDP pkt read, pkt_end <= pkt_data', bad access 2")
827*6e9e141aSEduard Zingerman __failure __msg("R1 offset is outside of the packet")
__flag(BPF_F_ANY_ALIGNMENT)828*6e9e141aSEduard Zingerman __flag(BPF_F_ANY_ALIGNMENT)
829*6e9e141aSEduard Zingerman __naked void pkt_data_bad_access_2_4(void)
830*6e9e141aSEduard Zingerman {
831*6e9e141aSEduard Zingerman asm volatile (" \
832*6e9e141aSEduard Zingerman r2 = *(u32*)(r1 + %[xdp_md_data]); \
833*6e9e141aSEduard Zingerman r3 = *(u32*)(r1 + %[xdp_md_data_end]); \
834*6e9e141aSEduard Zingerman r1 = r2; \
835*6e9e141aSEduard Zingerman r1 += 8; \
836*6e9e141aSEduard Zingerman if r3 <= r1 goto l0_%=; \
837*6e9e141aSEduard Zingerman l0_%=: r0 = *(u32*)(r1 - 5); \
838*6e9e141aSEduard Zingerman r0 = 0; \
839*6e9e141aSEduard Zingerman exit; \
840*6e9e141aSEduard Zingerman " :
841*6e9e141aSEduard Zingerman : __imm_const(xdp_md_data, offsetof(struct xdp_md, data)),
842*6e9e141aSEduard Zingerman __imm_const(xdp_md_data_end, offsetof(struct xdp_md, data_end))
843*6e9e141aSEduard Zingerman : __clobber_all);
844*6e9e141aSEduard Zingerman }
845*6e9e141aSEduard Zingerman
846*6e9e141aSEduard Zingerman SEC("xdp")
847*6e9e141aSEduard Zingerman __description("XDP pkt read, pkt_end <= pkt_data', corner case, good access")
__flag(BPF_F_ANY_ALIGNMENT)848*6e9e141aSEduard Zingerman __success __retval(0) __flag(BPF_F_ANY_ALIGNMENT)
849*6e9e141aSEduard Zingerman __naked void data_corner_case_good_access_4(void)
850*6e9e141aSEduard Zingerman {
851*6e9e141aSEduard Zingerman asm volatile (" \
852*6e9e141aSEduard Zingerman r2 = *(u32*)(r1 + %[xdp_md_data]); \
853*6e9e141aSEduard Zingerman r3 = *(u32*)(r1 + %[xdp_md_data_end]); \
854*6e9e141aSEduard Zingerman r1 = r2; \
855*6e9e141aSEduard Zingerman r1 += 7; \
856*6e9e141aSEduard Zingerman if r3 <= r1 goto l0_%=; \
857*6e9e141aSEduard Zingerman r0 = *(u64*)(r1 - 7); \
858*6e9e141aSEduard Zingerman l0_%=: r0 = 0; \
859*6e9e141aSEduard Zingerman exit; \
860*6e9e141aSEduard Zingerman " :
861*6e9e141aSEduard Zingerman : __imm_const(xdp_md_data, offsetof(struct xdp_md, data)),
862*6e9e141aSEduard Zingerman __imm_const(xdp_md_data_end, offsetof(struct xdp_md, data_end))
863*6e9e141aSEduard Zingerman : __clobber_all);
864*6e9e141aSEduard Zingerman }
865*6e9e141aSEduard Zingerman
866*6e9e141aSEduard Zingerman SEC("xdp")
867*6e9e141aSEduard Zingerman __description("XDP pkt read, pkt_end <= pkt_data', corner case +1, good access")
__flag(BPF_F_ANY_ALIGNMENT)868*6e9e141aSEduard Zingerman __success __retval(0) __flag(BPF_F_ANY_ALIGNMENT)
869*6e9e141aSEduard Zingerman __naked void corner_case_1_good_access_8(void)
870*6e9e141aSEduard Zingerman {
871*6e9e141aSEduard Zingerman asm volatile (" \
872*6e9e141aSEduard Zingerman r2 = *(u32*)(r1 + %[xdp_md_data]); \
873*6e9e141aSEduard Zingerman r3 = *(u32*)(r1 + %[xdp_md_data_end]); \
874*6e9e141aSEduard Zingerman r1 = r2; \
875*6e9e141aSEduard Zingerman r1 += 8; \
876*6e9e141aSEduard Zingerman if r3 <= r1 goto l0_%=; \
877*6e9e141aSEduard Zingerman r0 = *(u64*)(r1 - 8); \
878*6e9e141aSEduard Zingerman l0_%=: r0 = 0; \
879*6e9e141aSEduard Zingerman exit; \
880*6e9e141aSEduard Zingerman " :
881*6e9e141aSEduard Zingerman : __imm_const(xdp_md_data, offsetof(struct xdp_md, data)),
882*6e9e141aSEduard Zingerman __imm_const(xdp_md_data_end, offsetof(struct xdp_md, data_end))
883*6e9e141aSEduard Zingerman : __clobber_all);
884*6e9e141aSEduard Zingerman }
885*6e9e141aSEduard Zingerman
886*6e9e141aSEduard Zingerman SEC("xdp")
887*6e9e141aSEduard Zingerman __description("XDP pkt read, pkt_meta' > pkt_data, corner case, good access")
__flag(BPF_F_ANY_ALIGNMENT)888*6e9e141aSEduard Zingerman __success __retval(0) __flag(BPF_F_ANY_ALIGNMENT)
889*6e9e141aSEduard Zingerman __naked void data_corner_case_good_access_5(void)
890*6e9e141aSEduard Zingerman {
891*6e9e141aSEduard Zingerman asm volatile (" \
892*6e9e141aSEduard Zingerman r2 = *(u32*)(r1 + %[xdp_md_data_meta]); \
893*6e9e141aSEduard Zingerman r3 = *(u32*)(r1 + %[xdp_md_data]); \
894*6e9e141aSEduard Zingerman r1 = r2; \
895*6e9e141aSEduard Zingerman r1 += 8; \
896*6e9e141aSEduard Zingerman if r1 > r3 goto l0_%=; \
897*6e9e141aSEduard Zingerman r0 = *(u64*)(r1 - 8); \
898*6e9e141aSEduard Zingerman l0_%=: r0 = 0; \
899*6e9e141aSEduard Zingerman exit; \
900*6e9e141aSEduard Zingerman " :
901*6e9e141aSEduard Zingerman : __imm_const(xdp_md_data, offsetof(struct xdp_md, data)),
902*6e9e141aSEduard Zingerman __imm_const(xdp_md_data_meta, offsetof(struct xdp_md, data_meta))
903*6e9e141aSEduard Zingerman : __clobber_all);
904*6e9e141aSEduard Zingerman }
905*6e9e141aSEduard Zingerman
906*6e9e141aSEduard Zingerman SEC("xdp")
907*6e9e141aSEduard Zingerman __description("XDP pkt read, pkt_meta' > pkt_data, bad access 1")
908*6e9e141aSEduard Zingerman __failure __msg("R1 offset is outside of the packet")
__flag(BPF_F_ANY_ALIGNMENT)909*6e9e141aSEduard Zingerman __flag(BPF_F_ANY_ALIGNMENT)
910*6e9e141aSEduard Zingerman __naked void pkt_data_bad_access_1_3(void)
911*6e9e141aSEduard Zingerman {
912*6e9e141aSEduard Zingerman asm volatile (" \
913*6e9e141aSEduard Zingerman r2 = *(u32*)(r1 + %[xdp_md_data_meta]); \
914*6e9e141aSEduard Zingerman r3 = *(u32*)(r1 + %[xdp_md_data]); \
915*6e9e141aSEduard Zingerman r1 = r2; \
916*6e9e141aSEduard Zingerman r1 += 8; \
917*6e9e141aSEduard Zingerman if r1 > r3 goto l0_%=; \
918*6e9e141aSEduard Zingerman r0 = *(u64*)(r1 - 4); \
919*6e9e141aSEduard Zingerman l0_%=: r0 = 0; \
920*6e9e141aSEduard Zingerman exit; \
921*6e9e141aSEduard Zingerman " :
922*6e9e141aSEduard Zingerman : __imm_const(xdp_md_data, offsetof(struct xdp_md, data)),
923*6e9e141aSEduard Zingerman __imm_const(xdp_md_data_meta, offsetof(struct xdp_md, data_meta))
924*6e9e141aSEduard Zingerman : __clobber_all);
925*6e9e141aSEduard Zingerman }
926*6e9e141aSEduard Zingerman
927*6e9e141aSEduard Zingerman SEC("xdp")
928*6e9e141aSEduard Zingerman __description("XDP pkt read, pkt_meta' > pkt_data, bad access 2")
929*6e9e141aSEduard Zingerman __failure __msg("R1 offset is outside of the packet")
__flag(BPF_F_ANY_ALIGNMENT)930*6e9e141aSEduard Zingerman __flag(BPF_F_ANY_ALIGNMENT)
931*6e9e141aSEduard Zingerman __naked void pkt_data_bad_access_2_5(void)
932*6e9e141aSEduard Zingerman {
933*6e9e141aSEduard Zingerman asm volatile (" \
934*6e9e141aSEduard Zingerman r2 = *(u32*)(r1 + %[xdp_md_data_meta]); \
935*6e9e141aSEduard Zingerman r3 = *(u32*)(r1 + %[xdp_md_data]); \
936*6e9e141aSEduard Zingerman r1 = r2; \
937*6e9e141aSEduard Zingerman r1 += 8; \
938*6e9e141aSEduard Zingerman if r1 > r3 goto l0_%=; \
939*6e9e141aSEduard Zingerman l0_%=: r0 = *(u64*)(r1 - 8); \
940*6e9e141aSEduard Zingerman r0 = 0; \
941*6e9e141aSEduard Zingerman exit; \
942*6e9e141aSEduard Zingerman " :
943*6e9e141aSEduard Zingerman : __imm_const(xdp_md_data, offsetof(struct xdp_md, data)),
944*6e9e141aSEduard Zingerman __imm_const(xdp_md_data_meta, offsetof(struct xdp_md, data_meta))
945*6e9e141aSEduard Zingerman : __clobber_all);
946*6e9e141aSEduard Zingerman }
947*6e9e141aSEduard Zingerman
948*6e9e141aSEduard Zingerman SEC("xdp")
949*6e9e141aSEduard Zingerman __description("XDP pkt read, pkt_meta' > pkt_data, corner case +1, good access")
__flag(BPF_F_ANY_ALIGNMENT)950*6e9e141aSEduard Zingerman __success __retval(0) __flag(BPF_F_ANY_ALIGNMENT)
951*6e9e141aSEduard Zingerman __naked void corner_case_1_good_access_9(void)
952*6e9e141aSEduard Zingerman {
953*6e9e141aSEduard Zingerman asm volatile (" \
954*6e9e141aSEduard Zingerman r2 = *(u32*)(r1 + %[xdp_md_data_meta]); \
955*6e9e141aSEduard Zingerman r3 = *(u32*)(r1 + %[xdp_md_data]); \
956*6e9e141aSEduard Zingerman r1 = r2; \
957*6e9e141aSEduard Zingerman r1 += 9; \
958*6e9e141aSEduard Zingerman if r1 > r3 goto l0_%=; \
959*6e9e141aSEduard Zingerman r0 = *(u64*)(r1 - 9); \
960*6e9e141aSEduard Zingerman l0_%=: r0 = 0; \
961*6e9e141aSEduard Zingerman exit; \
962*6e9e141aSEduard Zingerman " :
963*6e9e141aSEduard Zingerman : __imm_const(xdp_md_data, offsetof(struct xdp_md, data)),
964*6e9e141aSEduard Zingerman __imm_const(xdp_md_data_meta, offsetof(struct xdp_md, data_meta))
965*6e9e141aSEduard Zingerman : __clobber_all);
966*6e9e141aSEduard Zingerman }
967*6e9e141aSEduard Zingerman
968*6e9e141aSEduard Zingerman SEC("xdp")
969*6e9e141aSEduard Zingerman __description("XDP pkt read, pkt_meta' > pkt_data, corner case -1, bad access")
970*6e9e141aSEduard Zingerman __failure __msg("R1 offset is outside of the packet")
__flag(BPF_F_ANY_ALIGNMENT)971*6e9e141aSEduard Zingerman __flag(BPF_F_ANY_ALIGNMENT)
972*6e9e141aSEduard Zingerman __naked void corner_case_1_bad_access_9(void)
973*6e9e141aSEduard Zingerman {
974*6e9e141aSEduard Zingerman asm volatile (" \
975*6e9e141aSEduard Zingerman r2 = *(u32*)(r1 + %[xdp_md_data_meta]); \
976*6e9e141aSEduard Zingerman r3 = *(u32*)(r1 + %[xdp_md_data]); \
977*6e9e141aSEduard Zingerman r1 = r2; \
978*6e9e141aSEduard Zingerman r1 += 7; \
979*6e9e141aSEduard Zingerman if r1 > r3 goto l0_%=; \
980*6e9e141aSEduard Zingerman r0 = *(u64*)(r1 - 7); \
981*6e9e141aSEduard Zingerman l0_%=: r0 = 0; \
982*6e9e141aSEduard Zingerman exit; \
983*6e9e141aSEduard Zingerman " :
984*6e9e141aSEduard Zingerman : __imm_const(xdp_md_data, offsetof(struct xdp_md, data)),
985*6e9e141aSEduard Zingerman __imm_const(xdp_md_data_meta, offsetof(struct xdp_md, data_meta))
986*6e9e141aSEduard Zingerman : __clobber_all);
987*6e9e141aSEduard Zingerman }
988*6e9e141aSEduard Zingerman
989*6e9e141aSEduard Zingerman SEC("xdp")
990*6e9e141aSEduard Zingerman __description("XDP pkt read, pkt_data > pkt_meta', good access")
__flag(BPF_F_ANY_ALIGNMENT)991*6e9e141aSEduard Zingerman __success __retval(0) __flag(BPF_F_ANY_ALIGNMENT)
992*6e9e141aSEduard Zingerman __naked void data_pkt_meta_good_access_1(void)
993*6e9e141aSEduard Zingerman {
994*6e9e141aSEduard Zingerman asm volatile (" \
995*6e9e141aSEduard Zingerman r2 = *(u32*)(r1 + %[xdp_md_data_meta]); \
996*6e9e141aSEduard Zingerman r3 = *(u32*)(r1 + %[xdp_md_data]); \
997*6e9e141aSEduard Zingerman r1 = r2; \
998*6e9e141aSEduard Zingerman r1 += 8; \
999*6e9e141aSEduard Zingerman if r3 > r1 goto l0_%=; \
1000*6e9e141aSEduard Zingerman goto l1_%=; \
1001*6e9e141aSEduard Zingerman l0_%=: r0 = *(u32*)(r1 - 5); \
1002*6e9e141aSEduard Zingerman l1_%=: r0 = 0; \
1003*6e9e141aSEduard Zingerman exit; \
1004*6e9e141aSEduard Zingerman " :
1005*6e9e141aSEduard Zingerman : __imm_const(xdp_md_data, offsetof(struct xdp_md, data)),
1006*6e9e141aSEduard Zingerman __imm_const(xdp_md_data_meta, offsetof(struct xdp_md, data_meta))
1007*6e9e141aSEduard Zingerman : __clobber_all);
1008*6e9e141aSEduard Zingerman }
1009*6e9e141aSEduard Zingerman
1010*6e9e141aSEduard Zingerman SEC("xdp")
1011*6e9e141aSEduard Zingerman __description("XDP pkt read, pkt_data > pkt_meta', corner case -1, bad access")
1012*6e9e141aSEduard Zingerman __failure __msg("R1 offset is outside of the packet")
__flag(BPF_F_ANY_ALIGNMENT)1013*6e9e141aSEduard Zingerman __flag(BPF_F_ANY_ALIGNMENT)
1014*6e9e141aSEduard Zingerman __naked void corner_case_1_bad_access_10(void)
1015*6e9e141aSEduard Zingerman {
1016*6e9e141aSEduard Zingerman asm volatile (" \
1017*6e9e141aSEduard Zingerman r2 = *(u32*)(r1 + %[xdp_md_data_meta]); \
1018*6e9e141aSEduard Zingerman r3 = *(u32*)(r1 + %[xdp_md_data]); \
1019*6e9e141aSEduard Zingerman r1 = r2; \
1020*6e9e141aSEduard Zingerman r1 += 6; \
1021*6e9e141aSEduard Zingerman if r3 > r1 goto l0_%=; \
1022*6e9e141aSEduard Zingerman goto l1_%=; \
1023*6e9e141aSEduard Zingerman l0_%=: r0 = *(u64*)(r1 - 6); \
1024*6e9e141aSEduard Zingerman l1_%=: r0 = 0; \
1025*6e9e141aSEduard Zingerman exit; \
1026*6e9e141aSEduard Zingerman " :
1027*6e9e141aSEduard Zingerman : __imm_const(xdp_md_data, offsetof(struct xdp_md, data)),
1028*6e9e141aSEduard Zingerman __imm_const(xdp_md_data_meta, offsetof(struct xdp_md, data_meta))
1029*6e9e141aSEduard Zingerman : __clobber_all);
1030*6e9e141aSEduard Zingerman }
1031*6e9e141aSEduard Zingerman
1032*6e9e141aSEduard Zingerman SEC("xdp")
1033*6e9e141aSEduard Zingerman __description("XDP pkt read, pkt_data > pkt_meta', bad access 2")
1034*6e9e141aSEduard Zingerman __failure __msg("R1 offset is outside of the packet")
__flag(BPF_F_ANY_ALIGNMENT)1035*6e9e141aSEduard Zingerman __flag(BPF_F_ANY_ALIGNMENT)
1036*6e9e141aSEduard Zingerman __naked void pkt_meta_bad_access_2_1(void)
1037*6e9e141aSEduard Zingerman {
1038*6e9e141aSEduard Zingerman asm volatile (" \
1039*6e9e141aSEduard Zingerman r2 = *(u32*)(r1 + %[xdp_md_data_meta]); \
1040*6e9e141aSEduard Zingerman r3 = *(u32*)(r1 + %[xdp_md_data]); \
1041*6e9e141aSEduard Zingerman r1 = r2; \
1042*6e9e141aSEduard Zingerman r1 += 8; \
1043*6e9e141aSEduard Zingerman if r3 > r1 goto l0_%=; \
1044*6e9e141aSEduard Zingerman r0 = *(u64*)(r1 - 8); \
1045*6e9e141aSEduard Zingerman l0_%=: r0 = 0; \
1046*6e9e141aSEduard Zingerman exit; \
1047*6e9e141aSEduard Zingerman " :
1048*6e9e141aSEduard Zingerman : __imm_const(xdp_md_data, offsetof(struct xdp_md, data)),
1049*6e9e141aSEduard Zingerman __imm_const(xdp_md_data_meta, offsetof(struct xdp_md, data_meta))
1050*6e9e141aSEduard Zingerman : __clobber_all);
1051*6e9e141aSEduard Zingerman }
1052*6e9e141aSEduard Zingerman
1053*6e9e141aSEduard Zingerman SEC("xdp")
1054*6e9e141aSEduard Zingerman __description("XDP pkt read, pkt_data > pkt_meta', corner case, good access")
__flag(BPF_F_ANY_ALIGNMENT)1055*6e9e141aSEduard Zingerman __success __retval(0) __flag(BPF_F_ANY_ALIGNMENT)
1056*6e9e141aSEduard Zingerman __naked void meta_corner_case_good_access_1(void)
1057*6e9e141aSEduard Zingerman {
1058*6e9e141aSEduard Zingerman asm volatile (" \
1059*6e9e141aSEduard Zingerman r2 = *(u32*)(r1 + %[xdp_md_data_meta]); \
1060*6e9e141aSEduard Zingerman r3 = *(u32*)(r1 + %[xdp_md_data]); \
1061*6e9e141aSEduard Zingerman r1 = r2; \
1062*6e9e141aSEduard Zingerman r1 += 7; \
1063*6e9e141aSEduard Zingerman if r3 > r1 goto l0_%=; \
1064*6e9e141aSEduard Zingerman goto l1_%=; \
1065*6e9e141aSEduard Zingerman l0_%=: r0 = *(u64*)(r1 - 7); \
1066*6e9e141aSEduard Zingerman l1_%=: r0 = 0; \
1067*6e9e141aSEduard Zingerman exit; \
1068*6e9e141aSEduard Zingerman " :
1069*6e9e141aSEduard Zingerman : __imm_const(xdp_md_data, offsetof(struct xdp_md, data)),
1070*6e9e141aSEduard Zingerman __imm_const(xdp_md_data_meta, offsetof(struct xdp_md, data_meta))
1071*6e9e141aSEduard Zingerman : __clobber_all);
1072*6e9e141aSEduard Zingerman }
1073*6e9e141aSEduard Zingerman
1074*6e9e141aSEduard Zingerman SEC("xdp")
1075*6e9e141aSEduard Zingerman __description("XDP pkt read, pkt_data > pkt_meta', corner case +1, good access")
__flag(BPF_F_ANY_ALIGNMENT)1076*6e9e141aSEduard Zingerman __success __retval(0) __flag(BPF_F_ANY_ALIGNMENT)
1077*6e9e141aSEduard Zingerman __naked void corner_case_1_good_access_10(void)
1078*6e9e141aSEduard Zingerman {
1079*6e9e141aSEduard Zingerman asm volatile (" \
1080*6e9e141aSEduard Zingerman r2 = *(u32*)(r1 + %[xdp_md_data_meta]); \
1081*6e9e141aSEduard Zingerman r3 = *(u32*)(r1 + %[xdp_md_data]); \
1082*6e9e141aSEduard Zingerman r1 = r2; \
1083*6e9e141aSEduard Zingerman r1 += 8; \
1084*6e9e141aSEduard Zingerman if r3 > r1 goto l0_%=; \
1085*6e9e141aSEduard Zingerman goto l1_%=; \
1086*6e9e141aSEduard Zingerman l0_%=: r0 = *(u64*)(r1 - 8); \
1087*6e9e141aSEduard Zingerman l1_%=: r0 = 0; \
1088*6e9e141aSEduard Zingerman exit; \
1089*6e9e141aSEduard Zingerman " :
1090*6e9e141aSEduard Zingerman : __imm_const(xdp_md_data, offsetof(struct xdp_md, data)),
1091*6e9e141aSEduard Zingerman __imm_const(xdp_md_data_meta, offsetof(struct xdp_md, data_meta))
1092*6e9e141aSEduard Zingerman : __clobber_all);
1093*6e9e141aSEduard Zingerman }
1094*6e9e141aSEduard Zingerman
1095*6e9e141aSEduard Zingerman SEC("xdp")
1096*6e9e141aSEduard Zingerman __description("XDP pkt read, pkt_meta' < pkt_data, good access")
__flag(BPF_F_ANY_ALIGNMENT)1097*6e9e141aSEduard Zingerman __success __retval(0) __flag(BPF_F_ANY_ALIGNMENT)
1098*6e9e141aSEduard Zingerman __naked void meta_pkt_data_good_access_1(void)
1099*6e9e141aSEduard Zingerman {
1100*6e9e141aSEduard Zingerman asm volatile (" \
1101*6e9e141aSEduard Zingerman r2 = *(u32*)(r1 + %[xdp_md_data_meta]); \
1102*6e9e141aSEduard Zingerman r3 = *(u32*)(r1 + %[xdp_md_data]); \
1103*6e9e141aSEduard Zingerman r1 = r2; \
1104*6e9e141aSEduard Zingerman r1 += 8; \
1105*6e9e141aSEduard Zingerman if r1 < r3 goto l0_%=; \
1106*6e9e141aSEduard Zingerman goto l1_%=; \
1107*6e9e141aSEduard Zingerman l0_%=: r0 = *(u32*)(r1 - 5); \
1108*6e9e141aSEduard Zingerman l1_%=: r0 = 0; \
1109*6e9e141aSEduard Zingerman exit; \
1110*6e9e141aSEduard Zingerman " :
1111*6e9e141aSEduard Zingerman : __imm_const(xdp_md_data, offsetof(struct xdp_md, data)),
1112*6e9e141aSEduard Zingerman __imm_const(xdp_md_data_meta, offsetof(struct xdp_md, data_meta))
1113*6e9e141aSEduard Zingerman : __clobber_all);
1114*6e9e141aSEduard Zingerman }
1115*6e9e141aSEduard Zingerman
1116*6e9e141aSEduard Zingerman SEC("xdp")
1117*6e9e141aSEduard Zingerman __description("XDP pkt read, pkt_meta' < pkt_data, corner case -1, bad access")
1118*6e9e141aSEduard Zingerman __failure __msg("R1 offset is outside of the packet")
__flag(BPF_F_ANY_ALIGNMENT)1119*6e9e141aSEduard Zingerman __flag(BPF_F_ANY_ALIGNMENT)
1120*6e9e141aSEduard Zingerman __naked void corner_case_1_bad_access_11(void)
1121*6e9e141aSEduard Zingerman {
1122*6e9e141aSEduard Zingerman asm volatile (" \
1123*6e9e141aSEduard Zingerman r2 = *(u32*)(r1 + %[xdp_md_data_meta]); \
1124*6e9e141aSEduard Zingerman r3 = *(u32*)(r1 + %[xdp_md_data]); \
1125*6e9e141aSEduard Zingerman r1 = r2; \
1126*6e9e141aSEduard Zingerman r1 += 6; \
1127*6e9e141aSEduard Zingerman if r1 < r3 goto l0_%=; \
1128*6e9e141aSEduard Zingerman goto l1_%=; \
1129*6e9e141aSEduard Zingerman l0_%=: r0 = *(u64*)(r1 - 6); \
1130*6e9e141aSEduard Zingerman l1_%=: r0 = 0; \
1131*6e9e141aSEduard Zingerman exit; \
1132*6e9e141aSEduard Zingerman " :
1133*6e9e141aSEduard Zingerman : __imm_const(xdp_md_data, offsetof(struct xdp_md, data)),
1134*6e9e141aSEduard Zingerman __imm_const(xdp_md_data_meta, offsetof(struct xdp_md, data_meta))
1135*6e9e141aSEduard Zingerman : __clobber_all);
1136*6e9e141aSEduard Zingerman }
1137*6e9e141aSEduard Zingerman
1138*6e9e141aSEduard Zingerman SEC("xdp")
1139*6e9e141aSEduard Zingerman __description("XDP pkt read, pkt_meta' < pkt_data, bad access 2")
1140*6e9e141aSEduard Zingerman __failure __msg("R1 offset is outside of the packet")
__flag(BPF_F_ANY_ALIGNMENT)1141*6e9e141aSEduard Zingerman __flag(BPF_F_ANY_ALIGNMENT)
1142*6e9e141aSEduard Zingerman __naked void pkt_data_bad_access_2_6(void)
1143*6e9e141aSEduard Zingerman {
1144*6e9e141aSEduard Zingerman asm volatile (" \
1145*6e9e141aSEduard Zingerman r2 = *(u32*)(r1 + %[xdp_md_data_meta]); \
1146*6e9e141aSEduard Zingerman r3 = *(u32*)(r1 + %[xdp_md_data]); \
1147*6e9e141aSEduard Zingerman r1 = r2; \
1148*6e9e141aSEduard Zingerman r1 += 8; \
1149*6e9e141aSEduard Zingerman if r1 < r3 goto l0_%=; \
1150*6e9e141aSEduard Zingerman r0 = *(u64*)(r1 - 8); \
1151*6e9e141aSEduard Zingerman l0_%=: r0 = 0; \
1152*6e9e141aSEduard Zingerman exit; \
1153*6e9e141aSEduard Zingerman " :
1154*6e9e141aSEduard Zingerman : __imm_const(xdp_md_data, offsetof(struct xdp_md, data)),
1155*6e9e141aSEduard Zingerman __imm_const(xdp_md_data_meta, offsetof(struct xdp_md, data_meta))
1156*6e9e141aSEduard Zingerman : __clobber_all);
1157*6e9e141aSEduard Zingerman }
1158*6e9e141aSEduard Zingerman
1159*6e9e141aSEduard Zingerman SEC("xdp")
1160*6e9e141aSEduard Zingerman __description("XDP pkt read, pkt_meta' < pkt_data, corner case, good access")
__flag(BPF_F_ANY_ALIGNMENT)1161*6e9e141aSEduard Zingerman __success __retval(0) __flag(BPF_F_ANY_ALIGNMENT)
1162*6e9e141aSEduard Zingerman __naked void data_corner_case_good_access_6(void)
1163*6e9e141aSEduard Zingerman {
1164*6e9e141aSEduard Zingerman asm volatile (" \
1165*6e9e141aSEduard Zingerman r2 = *(u32*)(r1 + %[xdp_md_data_meta]); \
1166*6e9e141aSEduard Zingerman r3 = *(u32*)(r1 + %[xdp_md_data]); \
1167*6e9e141aSEduard Zingerman r1 = r2; \
1168*6e9e141aSEduard Zingerman r1 += 7; \
1169*6e9e141aSEduard Zingerman if r1 < r3 goto l0_%=; \
1170*6e9e141aSEduard Zingerman goto l1_%=; \
1171*6e9e141aSEduard Zingerman l0_%=: r0 = *(u64*)(r1 - 7); \
1172*6e9e141aSEduard Zingerman l1_%=: r0 = 0; \
1173*6e9e141aSEduard Zingerman exit; \
1174*6e9e141aSEduard Zingerman " :
1175*6e9e141aSEduard Zingerman : __imm_const(xdp_md_data, offsetof(struct xdp_md, data)),
1176*6e9e141aSEduard Zingerman __imm_const(xdp_md_data_meta, offsetof(struct xdp_md, data_meta))
1177*6e9e141aSEduard Zingerman : __clobber_all);
1178*6e9e141aSEduard Zingerman }
1179*6e9e141aSEduard Zingerman
1180*6e9e141aSEduard Zingerman SEC("xdp")
1181*6e9e141aSEduard Zingerman __description("XDP pkt read, pkt_meta' < pkt_data, corner case +1, good access")
__flag(BPF_F_ANY_ALIGNMENT)1182*6e9e141aSEduard Zingerman __success __retval(0) __flag(BPF_F_ANY_ALIGNMENT)
1183*6e9e141aSEduard Zingerman __naked void corner_case_1_good_access_11(void)
1184*6e9e141aSEduard Zingerman {
1185*6e9e141aSEduard Zingerman asm volatile (" \
1186*6e9e141aSEduard Zingerman r2 = *(u32*)(r1 + %[xdp_md_data_meta]); \
1187*6e9e141aSEduard Zingerman r3 = *(u32*)(r1 + %[xdp_md_data]); \
1188*6e9e141aSEduard Zingerman r1 = r2; \
1189*6e9e141aSEduard Zingerman r1 += 8; \
1190*6e9e141aSEduard Zingerman if r1 < r3 goto l0_%=; \
1191*6e9e141aSEduard Zingerman goto l1_%=; \
1192*6e9e141aSEduard Zingerman l0_%=: r0 = *(u64*)(r1 - 8); \
1193*6e9e141aSEduard Zingerman l1_%=: r0 = 0; \
1194*6e9e141aSEduard Zingerman exit; \
1195*6e9e141aSEduard Zingerman " :
1196*6e9e141aSEduard Zingerman : __imm_const(xdp_md_data, offsetof(struct xdp_md, data)),
1197*6e9e141aSEduard Zingerman __imm_const(xdp_md_data_meta, offsetof(struct xdp_md, data_meta))
1198*6e9e141aSEduard Zingerman : __clobber_all);
1199*6e9e141aSEduard Zingerman }
1200*6e9e141aSEduard Zingerman
1201*6e9e141aSEduard Zingerman SEC("xdp")
1202*6e9e141aSEduard Zingerman __description("XDP pkt read, pkt_data < pkt_meta', corner case, good access")
__flag(BPF_F_ANY_ALIGNMENT)1203*6e9e141aSEduard Zingerman __success __retval(0) __flag(BPF_F_ANY_ALIGNMENT)
1204*6e9e141aSEduard Zingerman __naked void meta_corner_case_good_access_2(void)
1205*6e9e141aSEduard Zingerman {
1206*6e9e141aSEduard Zingerman asm volatile (" \
1207*6e9e141aSEduard Zingerman r2 = *(u32*)(r1 + %[xdp_md_data_meta]); \
1208*6e9e141aSEduard Zingerman r3 = *(u32*)(r1 + %[xdp_md_data]); \
1209*6e9e141aSEduard Zingerman r1 = r2; \
1210*6e9e141aSEduard Zingerman r1 += 8; \
1211*6e9e141aSEduard Zingerman if r3 < r1 goto l0_%=; \
1212*6e9e141aSEduard Zingerman r0 = *(u64*)(r1 - 8); \
1213*6e9e141aSEduard Zingerman l0_%=: r0 = 0; \
1214*6e9e141aSEduard Zingerman exit; \
1215*6e9e141aSEduard Zingerman " :
1216*6e9e141aSEduard Zingerman : __imm_const(xdp_md_data, offsetof(struct xdp_md, data)),
1217*6e9e141aSEduard Zingerman __imm_const(xdp_md_data_meta, offsetof(struct xdp_md, data_meta))
1218*6e9e141aSEduard Zingerman : __clobber_all);
1219*6e9e141aSEduard Zingerman }
1220*6e9e141aSEduard Zingerman
1221*6e9e141aSEduard Zingerman SEC("xdp")
1222*6e9e141aSEduard Zingerman __description("XDP pkt read, pkt_data < pkt_meta', bad access 1")
1223*6e9e141aSEduard Zingerman __failure __msg("R1 offset is outside of the packet")
__flag(BPF_F_ANY_ALIGNMENT)1224*6e9e141aSEduard Zingerman __flag(BPF_F_ANY_ALIGNMENT)
1225*6e9e141aSEduard Zingerman __naked void pkt_meta_bad_access_1_1(void)
1226*6e9e141aSEduard Zingerman {
1227*6e9e141aSEduard Zingerman asm volatile (" \
1228*6e9e141aSEduard Zingerman r2 = *(u32*)(r1 + %[xdp_md_data_meta]); \
1229*6e9e141aSEduard Zingerman r3 = *(u32*)(r1 + %[xdp_md_data]); \
1230*6e9e141aSEduard Zingerman r1 = r2; \
1231*6e9e141aSEduard Zingerman r1 += 8; \
1232*6e9e141aSEduard Zingerman if r3 < r1 goto l0_%=; \
1233*6e9e141aSEduard Zingerman r0 = *(u64*)(r1 - 4); \
1234*6e9e141aSEduard Zingerman l0_%=: r0 = 0; \
1235*6e9e141aSEduard Zingerman exit; \
1236*6e9e141aSEduard Zingerman " :
1237*6e9e141aSEduard Zingerman : __imm_const(xdp_md_data, offsetof(struct xdp_md, data)),
1238*6e9e141aSEduard Zingerman __imm_const(xdp_md_data_meta, offsetof(struct xdp_md, data_meta))
1239*6e9e141aSEduard Zingerman : __clobber_all);
1240*6e9e141aSEduard Zingerman }
1241*6e9e141aSEduard Zingerman
1242*6e9e141aSEduard Zingerman SEC("xdp")
1243*6e9e141aSEduard Zingerman __description("XDP pkt read, pkt_data < pkt_meta', bad access 2")
1244*6e9e141aSEduard Zingerman __failure __msg("R1 offset is outside of the packet")
__flag(BPF_F_ANY_ALIGNMENT)1245*6e9e141aSEduard Zingerman __flag(BPF_F_ANY_ALIGNMENT)
1246*6e9e141aSEduard Zingerman __naked void pkt_meta_bad_access_2_2(void)
1247*6e9e141aSEduard Zingerman {
1248*6e9e141aSEduard Zingerman asm volatile (" \
1249*6e9e141aSEduard Zingerman r2 = *(u32*)(r1 + %[xdp_md_data_meta]); \
1250*6e9e141aSEduard Zingerman r3 = *(u32*)(r1 + %[xdp_md_data]); \
1251*6e9e141aSEduard Zingerman r1 = r2; \
1252*6e9e141aSEduard Zingerman r1 += 8; \
1253*6e9e141aSEduard Zingerman if r3 < r1 goto l0_%=; \
1254*6e9e141aSEduard Zingerman l0_%=: r0 = *(u64*)(r1 - 8); \
1255*6e9e141aSEduard Zingerman r0 = 0; \
1256*6e9e141aSEduard Zingerman exit; \
1257*6e9e141aSEduard Zingerman " :
1258*6e9e141aSEduard Zingerman : __imm_const(xdp_md_data, offsetof(struct xdp_md, data)),
1259*6e9e141aSEduard Zingerman __imm_const(xdp_md_data_meta, offsetof(struct xdp_md, data_meta))
1260*6e9e141aSEduard Zingerman : __clobber_all);
1261*6e9e141aSEduard Zingerman }
1262*6e9e141aSEduard Zingerman
1263*6e9e141aSEduard Zingerman SEC("xdp")
1264*6e9e141aSEduard Zingerman __description("XDP pkt read, pkt_data < pkt_meta', corner case +1, good access")
__flag(BPF_F_ANY_ALIGNMENT)1265*6e9e141aSEduard Zingerman __success __retval(0) __flag(BPF_F_ANY_ALIGNMENT)
1266*6e9e141aSEduard Zingerman __naked void corner_case_1_good_access_12(void)
1267*6e9e141aSEduard Zingerman {
1268*6e9e141aSEduard Zingerman asm volatile (" \
1269*6e9e141aSEduard Zingerman r2 = *(u32*)(r1 + %[xdp_md_data_meta]); \
1270*6e9e141aSEduard Zingerman r3 = *(u32*)(r1 + %[xdp_md_data]); \
1271*6e9e141aSEduard Zingerman r1 = r2; \
1272*6e9e141aSEduard Zingerman r1 += 9; \
1273*6e9e141aSEduard Zingerman if r3 < r1 goto l0_%=; \
1274*6e9e141aSEduard Zingerman r0 = *(u64*)(r1 - 9); \
1275*6e9e141aSEduard Zingerman l0_%=: r0 = 0; \
1276*6e9e141aSEduard Zingerman exit; \
1277*6e9e141aSEduard Zingerman " :
1278*6e9e141aSEduard Zingerman : __imm_const(xdp_md_data, offsetof(struct xdp_md, data)),
1279*6e9e141aSEduard Zingerman __imm_const(xdp_md_data_meta, offsetof(struct xdp_md, data_meta))
1280*6e9e141aSEduard Zingerman : __clobber_all);
1281*6e9e141aSEduard Zingerman }
1282*6e9e141aSEduard Zingerman
1283*6e9e141aSEduard Zingerman SEC("xdp")
1284*6e9e141aSEduard Zingerman __description("XDP pkt read, pkt_data < pkt_meta', corner case -1, bad access")
1285*6e9e141aSEduard Zingerman __failure __msg("R1 offset is outside of the packet")
__flag(BPF_F_ANY_ALIGNMENT)1286*6e9e141aSEduard Zingerman __flag(BPF_F_ANY_ALIGNMENT)
1287*6e9e141aSEduard Zingerman __naked void corner_case_1_bad_access_12(void)
1288*6e9e141aSEduard Zingerman {
1289*6e9e141aSEduard Zingerman asm volatile (" \
1290*6e9e141aSEduard Zingerman r2 = *(u32*)(r1 + %[xdp_md_data_meta]); \
1291*6e9e141aSEduard Zingerman r3 = *(u32*)(r1 + %[xdp_md_data]); \
1292*6e9e141aSEduard Zingerman r1 = r2; \
1293*6e9e141aSEduard Zingerman r1 += 7; \
1294*6e9e141aSEduard Zingerman if r3 < r1 goto l0_%=; \
1295*6e9e141aSEduard Zingerman r0 = *(u64*)(r1 - 7); \
1296*6e9e141aSEduard Zingerman l0_%=: r0 = 0; \
1297*6e9e141aSEduard Zingerman exit; \
1298*6e9e141aSEduard Zingerman " :
1299*6e9e141aSEduard Zingerman : __imm_const(xdp_md_data, offsetof(struct xdp_md, data)),
1300*6e9e141aSEduard Zingerman __imm_const(xdp_md_data_meta, offsetof(struct xdp_md, data_meta))
1301*6e9e141aSEduard Zingerman : __clobber_all);
1302*6e9e141aSEduard Zingerman }
1303*6e9e141aSEduard Zingerman
1304*6e9e141aSEduard Zingerman SEC("xdp")
1305*6e9e141aSEduard Zingerman __description("XDP pkt read, pkt_meta' >= pkt_data, good access")
__flag(BPF_F_ANY_ALIGNMENT)1306*6e9e141aSEduard Zingerman __success __retval(0) __flag(BPF_F_ANY_ALIGNMENT)
1307*6e9e141aSEduard Zingerman __naked void meta_pkt_data_good_access_2(void)
1308*6e9e141aSEduard Zingerman {
1309*6e9e141aSEduard Zingerman asm volatile (" \
1310*6e9e141aSEduard Zingerman r2 = *(u32*)(r1 + %[xdp_md_data_meta]); \
1311*6e9e141aSEduard Zingerman r3 = *(u32*)(r1 + %[xdp_md_data]); \
1312*6e9e141aSEduard Zingerman r1 = r2; \
1313*6e9e141aSEduard Zingerman r1 += 8; \
1314*6e9e141aSEduard Zingerman if r1 >= r3 goto l0_%=; \
1315*6e9e141aSEduard Zingerman r0 = *(u32*)(r1 - 5); \
1316*6e9e141aSEduard Zingerman l0_%=: r0 = 0; \
1317*6e9e141aSEduard Zingerman exit; \
1318*6e9e141aSEduard Zingerman " :
1319*6e9e141aSEduard Zingerman : __imm_const(xdp_md_data, offsetof(struct xdp_md, data)),
1320*6e9e141aSEduard Zingerman __imm_const(xdp_md_data_meta, offsetof(struct xdp_md, data_meta))
1321*6e9e141aSEduard Zingerman : __clobber_all);
1322*6e9e141aSEduard Zingerman }
1323*6e9e141aSEduard Zingerman
1324*6e9e141aSEduard Zingerman SEC("xdp")
1325*6e9e141aSEduard Zingerman __description("XDP pkt read, pkt_meta' >= pkt_data, corner case -1, bad access")
1326*6e9e141aSEduard Zingerman __failure __msg("R1 offset is outside of the packet")
__flag(BPF_F_ANY_ALIGNMENT)1327*6e9e141aSEduard Zingerman __flag(BPF_F_ANY_ALIGNMENT)
1328*6e9e141aSEduard Zingerman __naked void corner_case_1_bad_access_13(void)
1329*6e9e141aSEduard Zingerman {
1330*6e9e141aSEduard Zingerman asm volatile (" \
1331*6e9e141aSEduard Zingerman r2 = *(u32*)(r1 + %[xdp_md_data_meta]); \
1332*6e9e141aSEduard Zingerman r3 = *(u32*)(r1 + %[xdp_md_data]); \
1333*6e9e141aSEduard Zingerman r1 = r2; \
1334*6e9e141aSEduard Zingerman r1 += 6; \
1335*6e9e141aSEduard Zingerman if r1 >= r3 goto l0_%=; \
1336*6e9e141aSEduard Zingerman r0 = *(u64*)(r1 - 6); \
1337*6e9e141aSEduard Zingerman l0_%=: r0 = 0; \
1338*6e9e141aSEduard Zingerman exit; \
1339*6e9e141aSEduard Zingerman " :
1340*6e9e141aSEduard Zingerman : __imm_const(xdp_md_data, offsetof(struct xdp_md, data)),
1341*6e9e141aSEduard Zingerman __imm_const(xdp_md_data_meta, offsetof(struct xdp_md, data_meta))
1342*6e9e141aSEduard Zingerman : __clobber_all);
1343*6e9e141aSEduard Zingerman }
1344*6e9e141aSEduard Zingerman
1345*6e9e141aSEduard Zingerman SEC("xdp")
1346*6e9e141aSEduard Zingerman __description("XDP pkt read, pkt_meta' >= pkt_data, bad access 2")
1347*6e9e141aSEduard Zingerman __failure __msg("R1 offset is outside of the packet")
__flag(BPF_F_ANY_ALIGNMENT)1348*6e9e141aSEduard Zingerman __flag(BPF_F_ANY_ALIGNMENT)
1349*6e9e141aSEduard Zingerman __naked void pkt_data_bad_access_2_7(void)
1350*6e9e141aSEduard Zingerman {
1351*6e9e141aSEduard Zingerman asm volatile (" \
1352*6e9e141aSEduard Zingerman r2 = *(u32*)(r1 + %[xdp_md_data_meta]); \
1353*6e9e141aSEduard Zingerman r3 = *(u32*)(r1 + %[xdp_md_data]); \
1354*6e9e141aSEduard Zingerman r1 = r2; \
1355*6e9e141aSEduard Zingerman r1 += 8; \
1356*6e9e141aSEduard Zingerman if r1 >= r3 goto l0_%=; \
1357*6e9e141aSEduard Zingerman l0_%=: r0 = *(u32*)(r1 - 5); \
1358*6e9e141aSEduard Zingerman r0 = 0; \
1359*6e9e141aSEduard Zingerman exit; \
1360*6e9e141aSEduard Zingerman " :
1361*6e9e141aSEduard Zingerman : __imm_const(xdp_md_data, offsetof(struct xdp_md, data)),
1362*6e9e141aSEduard Zingerman __imm_const(xdp_md_data_meta, offsetof(struct xdp_md, data_meta))
1363*6e9e141aSEduard Zingerman : __clobber_all);
1364*6e9e141aSEduard Zingerman }
1365*6e9e141aSEduard Zingerman
1366*6e9e141aSEduard Zingerman SEC("xdp")
1367*6e9e141aSEduard Zingerman __description("XDP pkt read, pkt_meta' >= pkt_data, corner case, good access")
__flag(BPF_F_ANY_ALIGNMENT)1368*6e9e141aSEduard Zingerman __success __retval(0) __flag(BPF_F_ANY_ALIGNMENT)
1369*6e9e141aSEduard Zingerman __naked void data_corner_case_good_access_7(void)
1370*6e9e141aSEduard Zingerman {
1371*6e9e141aSEduard Zingerman asm volatile (" \
1372*6e9e141aSEduard Zingerman r2 = *(u32*)(r1 + %[xdp_md_data_meta]); \
1373*6e9e141aSEduard Zingerman r3 = *(u32*)(r1 + %[xdp_md_data]); \
1374*6e9e141aSEduard Zingerman r1 = r2; \
1375*6e9e141aSEduard Zingerman r1 += 7; \
1376*6e9e141aSEduard Zingerman if r1 >= r3 goto l0_%=; \
1377*6e9e141aSEduard Zingerman r0 = *(u64*)(r1 - 7); \
1378*6e9e141aSEduard Zingerman l0_%=: r0 = 0; \
1379*6e9e141aSEduard Zingerman exit; \
1380*6e9e141aSEduard Zingerman " :
1381*6e9e141aSEduard Zingerman : __imm_const(xdp_md_data, offsetof(struct xdp_md, data)),
1382*6e9e141aSEduard Zingerman __imm_const(xdp_md_data_meta, offsetof(struct xdp_md, data_meta))
1383*6e9e141aSEduard Zingerman : __clobber_all);
1384*6e9e141aSEduard Zingerman }
1385*6e9e141aSEduard Zingerman
1386*6e9e141aSEduard Zingerman SEC("xdp")
1387*6e9e141aSEduard Zingerman __description("XDP pkt read, pkt_meta' >= pkt_data, corner case +1, good access")
__flag(BPF_F_ANY_ALIGNMENT)1388*6e9e141aSEduard Zingerman __success __retval(0) __flag(BPF_F_ANY_ALIGNMENT)
1389*6e9e141aSEduard Zingerman __naked void corner_case_1_good_access_13(void)
1390*6e9e141aSEduard Zingerman {
1391*6e9e141aSEduard Zingerman asm volatile (" \
1392*6e9e141aSEduard Zingerman r2 = *(u32*)(r1 + %[xdp_md_data_meta]); \
1393*6e9e141aSEduard Zingerman r3 = *(u32*)(r1 + %[xdp_md_data]); \
1394*6e9e141aSEduard Zingerman r1 = r2; \
1395*6e9e141aSEduard Zingerman r1 += 8; \
1396*6e9e141aSEduard Zingerman if r1 >= r3 goto l0_%=; \
1397*6e9e141aSEduard Zingerman r0 = *(u64*)(r1 - 8); \
1398*6e9e141aSEduard Zingerman l0_%=: r0 = 0; \
1399*6e9e141aSEduard Zingerman exit; \
1400*6e9e141aSEduard Zingerman " :
1401*6e9e141aSEduard Zingerman : __imm_const(xdp_md_data, offsetof(struct xdp_md, data)),
1402*6e9e141aSEduard Zingerman __imm_const(xdp_md_data_meta, offsetof(struct xdp_md, data_meta))
1403*6e9e141aSEduard Zingerman : __clobber_all);
1404*6e9e141aSEduard Zingerman }
1405*6e9e141aSEduard Zingerman
1406*6e9e141aSEduard Zingerman SEC("xdp")
1407*6e9e141aSEduard Zingerman __description("XDP pkt read, pkt_data >= pkt_meta', corner case, good access")
__flag(BPF_F_ANY_ALIGNMENT)1408*6e9e141aSEduard Zingerman __success __retval(0) __flag(BPF_F_ANY_ALIGNMENT)
1409*6e9e141aSEduard Zingerman __naked void meta_corner_case_good_access_3(void)
1410*6e9e141aSEduard Zingerman {
1411*6e9e141aSEduard Zingerman asm volatile (" \
1412*6e9e141aSEduard Zingerman r2 = *(u32*)(r1 + %[xdp_md_data_meta]); \
1413*6e9e141aSEduard Zingerman r3 = *(u32*)(r1 + %[xdp_md_data]); \
1414*6e9e141aSEduard Zingerman r1 = r2; \
1415*6e9e141aSEduard Zingerman r1 += 8; \
1416*6e9e141aSEduard Zingerman if r3 >= r1 goto l0_%=; \
1417*6e9e141aSEduard Zingerman goto l1_%=; \
1418*6e9e141aSEduard Zingerman l0_%=: r0 = *(u64*)(r1 - 8); \
1419*6e9e141aSEduard Zingerman l1_%=: r0 = 0; \
1420*6e9e141aSEduard Zingerman exit; \
1421*6e9e141aSEduard Zingerman " :
1422*6e9e141aSEduard Zingerman : __imm_const(xdp_md_data, offsetof(struct xdp_md, data)),
1423*6e9e141aSEduard Zingerman __imm_const(xdp_md_data_meta, offsetof(struct xdp_md, data_meta))
1424*6e9e141aSEduard Zingerman : __clobber_all);
1425*6e9e141aSEduard Zingerman }
1426*6e9e141aSEduard Zingerman
1427*6e9e141aSEduard Zingerman SEC("xdp")
1428*6e9e141aSEduard Zingerman __description("XDP pkt read, pkt_data >= pkt_meta', bad access 1")
1429*6e9e141aSEduard Zingerman __failure __msg("R1 offset is outside of the packet")
__flag(BPF_F_ANY_ALIGNMENT)1430*6e9e141aSEduard Zingerman __flag(BPF_F_ANY_ALIGNMENT)
1431*6e9e141aSEduard Zingerman __naked void pkt_meta_bad_access_1_2(void)
1432*6e9e141aSEduard Zingerman {
1433*6e9e141aSEduard Zingerman asm volatile (" \
1434*6e9e141aSEduard Zingerman r2 = *(u32*)(r1 + %[xdp_md_data_meta]); \
1435*6e9e141aSEduard Zingerman r3 = *(u32*)(r1 + %[xdp_md_data]); \
1436*6e9e141aSEduard Zingerman r1 = r2; \
1437*6e9e141aSEduard Zingerman r1 += 8; \
1438*6e9e141aSEduard Zingerman if r3 >= r1 goto l0_%=; \
1439*6e9e141aSEduard Zingerman goto l1_%=; \
1440*6e9e141aSEduard Zingerman l0_%=: r0 = *(u64*)(r1 - 4); \
1441*6e9e141aSEduard Zingerman l1_%=: r0 = 0; \
1442*6e9e141aSEduard Zingerman exit; \
1443*6e9e141aSEduard Zingerman " :
1444*6e9e141aSEduard Zingerman : __imm_const(xdp_md_data, offsetof(struct xdp_md, data)),
1445*6e9e141aSEduard Zingerman __imm_const(xdp_md_data_meta, offsetof(struct xdp_md, data_meta))
1446*6e9e141aSEduard Zingerman : __clobber_all);
1447*6e9e141aSEduard Zingerman }
1448*6e9e141aSEduard Zingerman
1449*6e9e141aSEduard Zingerman SEC("xdp")
1450*6e9e141aSEduard Zingerman __description("XDP pkt read, pkt_data >= pkt_meta', bad access 2")
1451*6e9e141aSEduard Zingerman __failure __msg("R1 offset is outside of the packet")
__flag(BPF_F_ANY_ALIGNMENT)1452*6e9e141aSEduard Zingerman __flag(BPF_F_ANY_ALIGNMENT)
1453*6e9e141aSEduard Zingerman __naked void pkt_meta_bad_access_2_3(void)
1454*6e9e141aSEduard Zingerman {
1455*6e9e141aSEduard Zingerman asm volatile (" \
1456*6e9e141aSEduard Zingerman r2 = *(u32*)(r1 + %[xdp_md_data_meta]); \
1457*6e9e141aSEduard Zingerman r3 = *(u32*)(r1 + %[xdp_md_data]); \
1458*6e9e141aSEduard Zingerman r1 = r2; \
1459*6e9e141aSEduard Zingerman r1 += 8; \
1460*6e9e141aSEduard Zingerman if r3 >= r1 goto l0_%=; \
1461*6e9e141aSEduard Zingerman r0 = *(u64*)(r1 - 8); \
1462*6e9e141aSEduard Zingerman l0_%=: r0 = 0; \
1463*6e9e141aSEduard Zingerman exit; \
1464*6e9e141aSEduard Zingerman " :
1465*6e9e141aSEduard Zingerman : __imm_const(xdp_md_data, offsetof(struct xdp_md, data)),
1466*6e9e141aSEduard Zingerman __imm_const(xdp_md_data_meta, offsetof(struct xdp_md, data_meta))
1467*6e9e141aSEduard Zingerman : __clobber_all);
1468*6e9e141aSEduard Zingerman }
1469*6e9e141aSEduard Zingerman
1470*6e9e141aSEduard Zingerman SEC("xdp")
1471*6e9e141aSEduard Zingerman __description("XDP pkt read, pkt_data >= pkt_meta', corner case +1, good access")
__flag(BPF_F_ANY_ALIGNMENT)1472*6e9e141aSEduard Zingerman __success __retval(0) __flag(BPF_F_ANY_ALIGNMENT)
1473*6e9e141aSEduard Zingerman __naked void corner_case_1_good_access_14(void)
1474*6e9e141aSEduard Zingerman {
1475*6e9e141aSEduard Zingerman asm volatile (" \
1476*6e9e141aSEduard Zingerman r2 = *(u32*)(r1 + %[xdp_md_data_meta]); \
1477*6e9e141aSEduard Zingerman r3 = *(u32*)(r1 + %[xdp_md_data]); \
1478*6e9e141aSEduard Zingerman r1 = r2; \
1479*6e9e141aSEduard Zingerman r1 += 9; \
1480*6e9e141aSEduard Zingerman if r3 >= r1 goto l0_%=; \
1481*6e9e141aSEduard Zingerman goto l1_%=; \
1482*6e9e141aSEduard Zingerman l0_%=: r0 = *(u64*)(r1 - 9); \
1483*6e9e141aSEduard Zingerman l1_%=: r0 = 0; \
1484*6e9e141aSEduard Zingerman exit; \
1485*6e9e141aSEduard Zingerman " :
1486*6e9e141aSEduard Zingerman : __imm_const(xdp_md_data, offsetof(struct xdp_md, data)),
1487*6e9e141aSEduard Zingerman __imm_const(xdp_md_data_meta, offsetof(struct xdp_md, data_meta))
1488*6e9e141aSEduard Zingerman : __clobber_all);
1489*6e9e141aSEduard Zingerman }
1490*6e9e141aSEduard Zingerman
1491*6e9e141aSEduard Zingerman SEC("xdp")
1492*6e9e141aSEduard Zingerman __description("XDP pkt read, pkt_data >= pkt_meta', corner case -1, bad access")
1493*6e9e141aSEduard Zingerman __failure __msg("R1 offset is outside of the packet")
__flag(BPF_F_ANY_ALIGNMENT)1494*6e9e141aSEduard Zingerman __flag(BPF_F_ANY_ALIGNMENT)
1495*6e9e141aSEduard Zingerman __naked void corner_case_1_bad_access_14(void)
1496*6e9e141aSEduard Zingerman {
1497*6e9e141aSEduard Zingerman asm volatile (" \
1498*6e9e141aSEduard Zingerman r2 = *(u32*)(r1 + %[xdp_md_data_meta]); \
1499*6e9e141aSEduard Zingerman r3 = *(u32*)(r1 + %[xdp_md_data]); \
1500*6e9e141aSEduard Zingerman r1 = r2; \
1501*6e9e141aSEduard Zingerman r1 += 7; \
1502*6e9e141aSEduard Zingerman if r3 >= r1 goto l0_%=; \
1503*6e9e141aSEduard Zingerman goto l1_%=; \
1504*6e9e141aSEduard Zingerman l0_%=: r0 = *(u64*)(r1 - 7); \
1505*6e9e141aSEduard Zingerman l1_%=: r0 = 0; \
1506*6e9e141aSEduard Zingerman exit; \
1507*6e9e141aSEduard Zingerman " :
1508*6e9e141aSEduard Zingerman : __imm_const(xdp_md_data, offsetof(struct xdp_md, data)),
1509*6e9e141aSEduard Zingerman __imm_const(xdp_md_data_meta, offsetof(struct xdp_md, data_meta))
1510*6e9e141aSEduard Zingerman : __clobber_all);
1511*6e9e141aSEduard Zingerman }
1512*6e9e141aSEduard Zingerman
1513*6e9e141aSEduard Zingerman SEC("xdp")
1514*6e9e141aSEduard Zingerman __description("XDP pkt read, pkt_meta' <= pkt_data, corner case, good access")
__flag(BPF_F_ANY_ALIGNMENT)1515*6e9e141aSEduard Zingerman __success __retval(0) __flag(BPF_F_ANY_ALIGNMENT)
1516*6e9e141aSEduard Zingerman __naked void data_corner_case_good_access_8(void)
1517*6e9e141aSEduard Zingerman {
1518*6e9e141aSEduard Zingerman asm volatile (" \
1519*6e9e141aSEduard Zingerman r2 = *(u32*)(r1 + %[xdp_md_data_meta]); \
1520*6e9e141aSEduard Zingerman r3 = *(u32*)(r1 + %[xdp_md_data]); \
1521*6e9e141aSEduard Zingerman r1 = r2; \
1522*6e9e141aSEduard Zingerman r1 += 8; \
1523*6e9e141aSEduard Zingerman if r1 <= r3 goto l0_%=; \
1524*6e9e141aSEduard Zingerman goto l1_%=; \
1525*6e9e141aSEduard Zingerman l0_%=: r0 = *(u64*)(r1 - 8); \
1526*6e9e141aSEduard Zingerman l1_%=: r0 = 0; \
1527*6e9e141aSEduard Zingerman exit; \
1528*6e9e141aSEduard Zingerman " :
1529*6e9e141aSEduard Zingerman : __imm_const(xdp_md_data, offsetof(struct xdp_md, data)),
1530*6e9e141aSEduard Zingerman __imm_const(xdp_md_data_meta, offsetof(struct xdp_md, data_meta))
1531*6e9e141aSEduard Zingerman : __clobber_all);
1532*6e9e141aSEduard Zingerman }
1533*6e9e141aSEduard Zingerman
1534*6e9e141aSEduard Zingerman SEC("xdp")
1535*6e9e141aSEduard Zingerman __description("XDP pkt read, pkt_meta' <= pkt_data, bad access 1")
1536*6e9e141aSEduard Zingerman __failure __msg("R1 offset is outside of the packet")
__flag(BPF_F_ANY_ALIGNMENT)1537*6e9e141aSEduard Zingerman __flag(BPF_F_ANY_ALIGNMENT)
1538*6e9e141aSEduard Zingerman __naked void pkt_data_bad_access_1_4(void)
1539*6e9e141aSEduard Zingerman {
1540*6e9e141aSEduard Zingerman asm volatile (" \
1541*6e9e141aSEduard Zingerman r2 = *(u32*)(r1 + %[xdp_md_data_meta]); \
1542*6e9e141aSEduard Zingerman r3 = *(u32*)(r1 + %[xdp_md_data]); \
1543*6e9e141aSEduard Zingerman r1 = r2; \
1544*6e9e141aSEduard Zingerman r1 += 8; \
1545*6e9e141aSEduard Zingerman if r1 <= r3 goto l0_%=; \
1546*6e9e141aSEduard Zingerman goto l1_%=; \
1547*6e9e141aSEduard Zingerman l0_%=: r0 = *(u64*)(r1 - 4); \
1548*6e9e141aSEduard Zingerman l1_%=: r0 = 0; \
1549*6e9e141aSEduard Zingerman exit; \
1550*6e9e141aSEduard Zingerman " :
1551*6e9e141aSEduard Zingerman : __imm_const(xdp_md_data, offsetof(struct xdp_md, data)),
1552*6e9e141aSEduard Zingerman __imm_const(xdp_md_data_meta, offsetof(struct xdp_md, data_meta))
1553*6e9e141aSEduard Zingerman : __clobber_all);
1554*6e9e141aSEduard Zingerman }
1555*6e9e141aSEduard Zingerman
1556*6e9e141aSEduard Zingerman SEC("xdp")
1557*6e9e141aSEduard Zingerman __description("XDP pkt read, pkt_meta' <= pkt_data, bad access 2")
1558*6e9e141aSEduard Zingerman __failure __msg("R1 offset is outside of the packet")
__flag(BPF_F_ANY_ALIGNMENT)1559*6e9e141aSEduard Zingerman __flag(BPF_F_ANY_ALIGNMENT)
1560*6e9e141aSEduard Zingerman __naked void pkt_data_bad_access_2_8(void)
1561*6e9e141aSEduard Zingerman {
1562*6e9e141aSEduard Zingerman asm volatile (" \
1563*6e9e141aSEduard Zingerman r2 = *(u32*)(r1 + %[xdp_md_data_meta]); \
1564*6e9e141aSEduard Zingerman r3 = *(u32*)(r1 + %[xdp_md_data]); \
1565*6e9e141aSEduard Zingerman r1 = r2; \
1566*6e9e141aSEduard Zingerman r1 += 8; \
1567*6e9e141aSEduard Zingerman if r1 <= r3 goto l0_%=; \
1568*6e9e141aSEduard Zingerman r0 = *(u64*)(r1 - 8); \
1569*6e9e141aSEduard Zingerman l0_%=: r0 = 0; \
1570*6e9e141aSEduard Zingerman exit; \
1571*6e9e141aSEduard Zingerman " :
1572*6e9e141aSEduard Zingerman : __imm_const(xdp_md_data, offsetof(struct xdp_md, data)),
1573*6e9e141aSEduard Zingerman __imm_const(xdp_md_data_meta, offsetof(struct xdp_md, data_meta))
1574*6e9e141aSEduard Zingerman : __clobber_all);
1575*6e9e141aSEduard Zingerman }
1576*6e9e141aSEduard Zingerman
1577*6e9e141aSEduard Zingerman SEC("xdp")
1578*6e9e141aSEduard Zingerman __description("XDP pkt read, pkt_meta' <= pkt_data, corner case +1, good access")
__flag(BPF_F_ANY_ALIGNMENT)1579*6e9e141aSEduard Zingerman __success __retval(0) __flag(BPF_F_ANY_ALIGNMENT)
1580*6e9e141aSEduard Zingerman __naked void corner_case_1_good_access_15(void)
1581*6e9e141aSEduard Zingerman {
1582*6e9e141aSEduard Zingerman asm volatile (" \
1583*6e9e141aSEduard Zingerman r2 = *(u32*)(r1 + %[xdp_md_data_meta]); \
1584*6e9e141aSEduard Zingerman r3 = *(u32*)(r1 + %[xdp_md_data]); \
1585*6e9e141aSEduard Zingerman r1 = r2; \
1586*6e9e141aSEduard Zingerman r1 += 9; \
1587*6e9e141aSEduard Zingerman if r1 <= r3 goto l0_%=; \
1588*6e9e141aSEduard Zingerman goto l1_%=; \
1589*6e9e141aSEduard Zingerman l0_%=: r0 = *(u64*)(r1 - 9); \
1590*6e9e141aSEduard Zingerman l1_%=: r0 = 0; \
1591*6e9e141aSEduard Zingerman exit; \
1592*6e9e141aSEduard Zingerman " :
1593*6e9e141aSEduard Zingerman : __imm_const(xdp_md_data, offsetof(struct xdp_md, data)),
1594*6e9e141aSEduard Zingerman __imm_const(xdp_md_data_meta, offsetof(struct xdp_md, data_meta))
1595*6e9e141aSEduard Zingerman : __clobber_all);
1596*6e9e141aSEduard Zingerman }
1597*6e9e141aSEduard Zingerman
1598*6e9e141aSEduard Zingerman SEC("xdp")
1599*6e9e141aSEduard Zingerman __description("XDP pkt read, pkt_meta' <= pkt_data, corner case -1, bad access")
1600*6e9e141aSEduard Zingerman __failure __msg("R1 offset is outside of the packet")
__flag(BPF_F_ANY_ALIGNMENT)1601*6e9e141aSEduard Zingerman __flag(BPF_F_ANY_ALIGNMENT)
1602*6e9e141aSEduard Zingerman __naked void corner_case_1_bad_access_15(void)
1603*6e9e141aSEduard Zingerman {
1604*6e9e141aSEduard Zingerman asm volatile (" \
1605*6e9e141aSEduard Zingerman r2 = *(u32*)(r1 + %[xdp_md_data_meta]); \
1606*6e9e141aSEduard Zingerman r3 = *(u32*)(r1 + %[xdp_md_data]); \
1607*6e9e141aSEduard Zingerman r1 = r2; \
1608*6e9e141aSEduard Zingerman r1 += 7; \
1609*6e9e141aSEduard Zingerman if r1 <= r3 goto l0_%=; \
1610*6e9e141aSEduard Zingerman goto l1_%=; \
1611*6e9e141aSEduard Zingerman l0_%=: r0 = *(u64*)(r1 - 7); \
1612*6e9e141aSEduard Zingerman l1_%=: r0 = 0; \
1613*6e9e141aSEduard Zingerman exit; \
1614*6e9e141aSEduard Zingerman " :
1615*6e9e141aSEduard Zingerman : __imm_const(xdp_md_data, offsetof(struct xdp_md, data)),
1616*6e9e141aSEduard Zingerman __imm_const(xdp_md_data_meta, offsetof(struct xdp_md, data_meta))
1617*6e9e141aSEduard Zingerman : __clobber_all);
1618*6e9e141aSEduard Zingerman }
1619*6e9e141aSEduard Zingerman
1620*6e9e141aSEduard Zingerman SEC("xdp")
1621*6e9e141aSEduard Zingerman __description("XDP pkt read, pkt_data <= pkt_meta', good access")
__flag(BPF_F_ANY_ALIGNMENT)1622*6e9e141aSEduard Zingerman __success __retval(0) __flag(BPF_F_ANY_ALIGNMENT)
1623*6e9e141aSEduard Zingerman __naked void data_pkt_meta_good_access_2(void)
1624*6e9e141aSEduard Zingerman {
1625*6e9e141aSEduard Zingerman asm volatile (" \
1626*6e9e141aSEduard Zingerman r2 = *(u32*)(r1 + %[xdp_md_data_meta]); \
1627*6e9e141aSEduard Zingerman r3 = *(u32*)(r1 + %[xdp_md_data]); \
1628*6e9e141aSEduard Zingerman r1 = r2; \
1629*6e9e141aSEduard Zingerman r1 += 8; \
1630*6e9e141aSEduard Zingerman if r3 <= r1 goto l0_%=; \
1631*6e9e141aSEduard Zingerman r0 = *(u32*)(r1 - 5); \
1632*6e9e141aSEduard Zingerman l0_%=: r0 = 0; \
1633*6e9e141aSEduard Zingerman exit; \
1634*6e9e141aSEduard Zingerman " :
1635*6e9e141aSEduard Zingerman : __imm_const(xdp_md_data, offsetof(struct xdp_md, data)),
1636*6e9e141aSEduard Zingerman __imm_const(xdp_md_data_meta, offsetof(struct xdp_md, data_meta))
1637*6e9e141aSEduard Zingerman : __clobber_all);
1638*6e9e141aSEduard Zingerman }
1639*6e9e141aSEduard Zingerman
1640*6e9e141aSEduard Zingerman SEC("xdp")
1641*6e9e141aSEduard Zingerman __description("XDP pkt read, pkt_data <= pkt_meta', corner case -1, bad access")
1642*6e9e141aSEduard Zingerman __failure __msg("R1 offset is outside of the packet")
__flag(BPF_F_ANY_ALIGNMENT)1643*6e9e141aSEduard Zingerman __flag(BPF_F_ANY_ALIGNMENT)
1644*6e9e141aSEduard Zingerman __naked void corner_case_1_bad_access_16(void)
1645*6e9e141aSEduard Zingerman {
1646*6e9e141aSEduard Zingerman asm volatile (" \
1647*6e9e141aSEduard Zingerman r2 = *(u32*)(r1 + %[xdp_md_data_meta]); \
1648*6e9e141aSEduard Zingerman r3 = *(u32*)(r1 + %[xdp_md_data]); \
1649*6e9e141aSEduard Zingerman r1 = r2; \
1650*6e9e141aSEduard Zingerman r1 += 6; \
1651*6e9e141aSEduard Zingerman if r3 <= r1 goto l0_%=; \
1652*6e9e141aSEduard Zingerman r0 = *(u64*)(r1 - 6); \
1653*6e9e141aSEduard Zingerman l0_%=: r0 = 0; \
1654*6e9e141aSEduard Zingerman exit; \
1655*6e9e141aSEduard Zingerman " :
1656*6e9e141aSEduard Zingerman : __imm_const(xdp_md_data, offsetof(struct xdp_md, data)),
1657*6e9e141aSEduard Zingerman __imm_const(xdp_md_data_meta, offsetof(struct xdp_md, data_meta))
1658*6e9e141aSEduard Zingerman : __clobber_all);
1659*6e9e141aSEduard Zingerman }
1660*6e9e141aSEduard Zingerman
1661*6e9e141aSEduard Zingerman SEC("xdp")
1662*6e9e141aSEduard Zingerman __description("XDP pkt read, pkt_data <= pkt_meta', bad access 2")
1663*6e9e141aSEduard Zingerman __failure __msg("R1 offset is outside of the packet")
__flag(BPF_F_ANY_ALIGNMENT)1664*6e9e141aSEduard Zingerman __flag(BPF_F_ANY_ALIGNMENT)
1665*6e9e141aSEduard Zingerman __naked void pkt_meta_bad_access_2_4(void)
1666*6e9e141aSEduard Zingerman {
1667*6e9e141aSEduard Zingerman asm volatile (" \
1668*6e9e141aSEduard Zingerman r2 = *(u32*)(r1 + %[xdp_md_data_meta]); \
1669*6e9e141aSEduard Zingerman r3 = *(u32*)(r1 + %[xdp_md_data]); \
1670*6e9e141aSEduard Zingerman r1 = r2; \
1671*6e9e141aSEduard Zingerman r1 += 8; \
1672*6e9e141aSEduard Zingerman if r3 <= r1 goto l0_%=; \
1673*6e9e141aSEduard Zingerman l0_%=: r0 = *(u32*)(r1 - 5); \
1674*6e9e141aSEduard Zingerman r0 = 0; \
1675*6e9e141aSEduard Zingerman exit; \
1676*6e9e141aSEduard Zingerman " :
1677*6e9e141aSEduard Zingerman : __imm_const(xdp_md_data, offsetof(struct xdp_md, data)),
1678*6e9e141aSEduard Zingerman __imm_const(xdp_md_data_meta, offsetof(struct xdp_md, data_meta))
1679*6e9e141aSEduard Zingerman : __clobber_all);
1680*6e9e141aSEduard Zingerman }
1681*6e9e141aSEduard Zingerman
1682*6e9e141aSEduard Zingerman SEC("xdp")
1683*6e9e141aSEduard Zingerman __description("XDP pkt read, pkt_data <= pkt_meta', corner case, good access")
__flag(BPF_F_ANY_ALIGNMENT)1684*6e9e141aSEduard Zingerman __success __retval(0) __flag(BPF_F_ANY_ALIGNMENT)
1685*6e9e141aSEduard Zingerman __naked void meta_corner_case_good_access_4(void)
1686*6e9e141aSEduard Zingerman {
1687*6e9e141aSEduard Zingerman asm volatile (" \
1688*6e9e141aSEduard Zingerman r2 = *(u32*)(r1 + %[xdp_md_data_meta]); \
1689*6e9e141aSEduard Zingerman r3 = *(u32*)(r1 + %[xdp_md_data]); \
1690*6e9e141aSEduard Zingerman r1 = r2; \
1691*6e9e141aSEduard Zingerman r1 += 7; \
1692*6e9e141aSEduard Zingerman if r3 <= r1 goto l0_%=; \
1693*6e9e141aSEduard Zingerman r0 = *(u64*)(r1 - 7); \
1694*6e9e141aSEduard Zingerman l0_%=: r0 = 0; \
1695*6e9e141aSEduard Zingerman exit; \
1696*6e9e141aSEduard Zingerman " :
1697*6e9e141aSEduard Zingerman : __imm_const(xdp_md_data, offsetof(struct xdp_md, data)),
1698*6e9e141aSEduard Zingerman __imm_const(xdp_md_data_meta, offsetof(struct xdp_md, data_meta))
1699*6e9e141aSEduard Zingerman : __clobber_all);
1700*6e9e141aSEduard Zingerman }
1701*6e9e141aSEduard Zingerman
1702*6e9e141aSEduard Zingerman SEC("xdp")
1703*6e9e141aSEduard Zingerman __description("XDP pkt read, pkt_data <= pkt_meta', corner case +1, good access")
__flag(BPF_F_ANY_ALIGNMENT)1704*6e9e141aSEduard Zingerman __success __retval(0) __flag(BPF_F_ANY_ALIGNMENT)
1705*6e9e141aSEduard Zingerman __naked void corner_case_1_good_access_16(void)
1706*6e9e141aSEduard Zingerman {
1707*6e9e141aSEduard Zingerman asm volatile (" \
1708*6e9e141aSEduard Zingerman r2 = *(u32*)(r1 + %[xdp_md_data_meta]); \
1709*6e9e141aSEduard Zingerman r3 = *(u32*)(r1 + %[xdp_md_data]); \
1710*6e9e141aSEduard Zingerman r1 = r2; \
1711*6e9e141aSEduard Zingerman r1 += 8; \
1712*6e9e141aSEduard Zingerman if r3 <= r1 goto l0_%=; \
1713*6e9e141aSEduard Zingerman r0 = *(u64*)(r1 - 8); \
1714*6e9e141aSEduard Zingerman l0_%=: r0 = 0; \
1715*6e9e141aSEduard Zingerman exit; \
1716*6e9e141aSEduard Zingerman " :
1717*6e9e141aSEduard Zingerman : __imm_const(xdp_md_data, offsetof(struct xdp_md, data)),
1718*6e9e141aSEduard Zingerman __imm_const(xdp_md_data_meta, offsetof(struct xdp_md, data_meta))
1719*6e9e141aSEduard Zingerman : __clobber_all);
1720*6e9e141aSEduard Zingerman }
1721*6e9e141aSEduard Zingerman
1722*6e9e141aSEduard Zingerman char _license[] SEC("license") = "GPL";
1723