1 {
2 	"direct map access, write test 1",
3 	.insns = {
4 	BPF_MOV64_IMM(BPF_REG_0, 1),
5 	BPF_LD_MAP_VALUE(BPF_REG_1, 0, 0),
6 	BPF_ST_MEM(BPF_DW, BPF_REG_1, 0, 4242),
7 	BPF_EXIT_INSN(),
8 	},
9 	.fixup_map_array_48b = { 1 },
10 	.result = ACCEPT,
11 	.retval = 1,
12 },
13 {
14 	"direct map access, write test 2",
15 	.insns = {
16 	BPF_MOV64_IMM(BPF_REG_0, 1),
17 	BPF_LD_MAP_VALUE(BPF_REG_1, 0, 8),
18 	BPF_ST_MEM(BPF_DW, BPF_REG_1, 0, 4242),
19 	BPF_EXIT_INSN(),
20 	},
21 	.fixup_map_array_48b = { 1 },
22 	.result = ACCEPT,
23 	.retval = 1,
24 },
25 {
26 	"direct map access, write test 3",
27 	.insns = {
28 	BPF_MOV64_IMM(BPF_REG_0, 1),
29 	BPF_LD_MAP_VALUE(BPF_REG_1, 0, 8),
30 	BPF_ST_MEM(BPF_DW, BPF_REG_1, 8, 4242),
31 	BPF_EXIT_INSN(),
32 	},
33 	.fixup_map_array_48b = { 1 },
34 	.result = ACCEPT,
35 	.retval = 1,
36 },
37 {
38 	"direct map access, write test 4",
39 	.insns = {
40 	BPF_MOV64_IMM(BPF_REG_0, 1),
41 	BPF_LD_MAP_VALUE(BPF_REG_1, 0, 40),
42 	BPF_ST_MEM(BPF_DW, BPF_REG_1, 0, 4242),
43 	BPF_EXIT_INSN(),
44 	},
45 	.fixup_map_array_48b = { 1 },
46 	.result = ACCEPT,
47 	.retval = 1,
48 },
49 {
50 	"direct map access, write test 5",
51 	.insns = {
52 	BPF_MOV64_IMM(BPF_REG_0, 1),
53 	BPF_LD_MAP_VALUE(BPF_REG_1, 0, 32),
54 	BPF_ST_MEM(BPF_DW, BPF_REG_1, 8, 4242),
55 	BPF_EXIT_INSN(),
56 	},
57 	.fixup_map_array_48b = { 1 },
58 	.result = ACCEPT,
59 	.retval = 1,
60 },
61 {
62 	"direct map access, write test 6",
63 	.insns = {
64 	BPF_MOV64_IMM(BPF_REG_0, 1),
65 	BPF_LD_MAP_VALUE(BPF_REG_1, 0, 40),
66 	BPF_ST_MEM(BPF_DW, BPF_REG_1, 4, 4242),
67 	BPF_EXIT_INSN(),
68 	},
69 	.fixup_map_array_48b = { 1 },
70 	.result = REJECT,
71 	.errstr = "R1 min value is outside of the array range",
72 },
73 {
74 	"direct map access, write test 7",
75 	.insns = {
76 	BPF_MOV64_IMM(BPF_REG_0, 1),
77 	BPF_LD_MAP_VALUE(BPF_REG_1, 0, -1),
78 	BPF_ST_MEM(BPF_DW, BPF_REG_1, 4, 4242),
79 	BPF_EXIT_INSN(),
80 	},
81 	.fixup_map_array_48b = { 1 },
82 	.result = REJECT,
83 	.errstr = "direct value offset of 4294967295 is not allowed",
84 },
85 {
86 	"direct map access, write test 8",
87 	.insns = {
88 	BPF_MOV64_IMM(BPF_REG_0, 1),
89 	BPF_LD_MAP_VALUE(BPF_REG_1, 0, 1),
90 	BPF_ST_MEM(BPF_DW, BPF_REG_1, -1, 4242),
91 	BPF_EXIT_INSN(),
92 	},
93 	.fixup_map_array_48b = { 1 },
94 	.result = ACCEPT,
95 	.retval = 1,
96 },
97 {
98 	"direct map access, write test 9",
99 	.insns = {
100 	BPF_MOV64_IMM(BPF_REG_0, 1),
101 	BPF_LD_MAP_VALUE(BPF_REG_1, 0, 48),
102 	BPF_ST_MEM(BPF_DW, BPF_REG_1, 0, 4242),
103 	BPF_EXIT_INSN(),
104 	},
105 	.fixup_map_array_48b = { 1 },
106 	.result = REJECT,
107 	.errstr = "invalid access to map value pointer",
108 },
109 {
110 	"direct map access, write test 10",
111 	.insns = {
112 	BPF_MOV64_IMM(BPF_REG_0, 1),
113 	BPF_LD_MAP_VALUE(BPF_REG_1, 0, 47),
114 	BPF_ST_MEM(BPF_B, BPF_REG_1, 0, 4),
115 	BPF_EXIT_INSN(),
116 	},
117 	.fixup_map_array_48b = { 1 },
118 	.result = ACCEPT,
119 	.retval = 1,
120 },
121 {
122 	"direct map access, write test 11",
123 	.insns = {
124 	BPF_MOV64_IMM(BPF_REG_0, 1),
125 	BPF_LD_MAP_VALUE(BPF_REG_1, 0, 48),
126 	BPF_ST_MEM(BPF_B, BPF_REG_1, 0, 4),
127 	BPF_EXIT_INSN(),
128 	},
129 	.fixup_map_array_48b = { 1 },
130 	.result = REJECT,
131 	.errstr = "invalid access to map value pointer",
132 },
133 {
134 	"direct map access, write test 12",
135 	.insns = {
136 	BPF_MOV64_IMM(BPF_REG_0, 1),
137 	BPF_LD_MAP_VALUE(BPF_REG_1, 0, (1<<29)),
138 	BPF_ST_MEM(BPF_B, BPF_REG_1, 0, 4),
139 	BPF_EXIT_INSN(),
140 	},
141 	.fixup_map_array_48b = { 1 },
142 	.result = REJECT,
143 	.errstr = "direct value offset of 536870912 is not allowed",
144 },
145 {
146 	"direct map access, write test 13",
147 	.insns = {
148 	BPF_MOV64_IMM(BPF_REG_0, 1),
149 	BPF_LD_MAP_VALUE(BPF_REG_1, 0, (1<<29)-1),
150 	BPF_ST_MEM(BPF_B, BPF_REG_1, 0, 4),
151 	BPF_EXIT_INSN(),
152 	},
153 	.fixup_map_array_48b = { 1 },
154 	.result = REJECT,
155 	.errstr = "invalid access to map value pointer, value_size=48 off=536870911",
156 },
157 {
158 	"direct map access, write test 14",
159 	.insns = {
160 	BPF_MOV64_IMM(BPF_REG_0, 1),
161 	BPF_LD_MAP_VALUE(BPF_REG_1, 0, 47),
162 	BPF_LD_MAP_VALUE(BPF_REG_2, 0, 46),
163 	BPF_ST_MEM(BPF_H, BPF_REG_2, 0, 0xffff),
164 	BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1, 0),
165 	BPF_EXIT_INSN(),
166 	},
167 	.fixup_map_array_48b = { 1, 3 },
168 	.result = ACCEPT,
169 	.retval = 0xff,
170 },
171 {
172 	"direct map access, write test 15",
173 	.insns = {
174 	BPF_MOV64_IMM(BPF_REG_0, 1),
175 	BPF_LD_MAP_VALUE(BPF_REG_1, 0, 46),
176 	BPF_LD_MAP_VALUE(BPF_REG_2, 0, 46),
177 	BPF_ST_MEM(BPF_H, BPF_REG_2, 0, 0xffff),
178 	BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1, 0),
179 	BPF_EXIT_INSN(),
180 	},
181 	.fixup_map_array_48b = { 1, 3 },
182 	.result = ACCEPT,
183 	.retval = 0xffff,
184 },
185 {
186 	"direct map access, write test 16",
187 	.insns = {
188 	BPF_MOV64_IMM(BPF_REG_0, 1),
189 	BPF_LD_MAP_VALUE(BPF_REG_1, 0, 46),
190 	BPF_LD_MAP_VALUE(BPF_REG_2, 0, 47),
191 	BPF_ST_MEM(BPF_H, BPF_REG_2, 0, 0xffff),
192 	BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1, 0),
193 	BPF_EXIT_INSN(),
194 	},
195 	.fixup_map_array_48b = { 1, 3 },
196 	.result = REJECT,
197 	.errstr = "invalid access to map value, value_size=48 off=47 size=2",
198 },
199 {
200 	"direct map access, write test 17",
201 	.insns = {
202 	BPF_MOV64_IMM(BPF_REG_0, 1),
203 	BPF_LD_MAP_VALUE(BPF_REG_1, 0, 46),
204 	BPF_LD_MAP_VALUE(BPF_REG_2, 0, 46),
205 	BPF_ST_MEM(BPF_H, BPF_REG_2, 1, 0xffff),
206 	BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1, 0),
207 	BPF_EXIT_INSN(),
208 	},
209 	.fixup_map_array_48b = { 1, 3 },
210 	.result = REJECT,
211 	.errstr = "invalid access to map value, value_size=48 off=47 size=2",
212 },
213 {
214 	"direct map access, write test 18",
215 	.insns = {
216 	BPF_MOV64_IMM(BPF_REG_0, 1),
217 	BPF_LD_MAP_VALUE(BPF_REG_1, 0, 0),
218 	BPF_ST_MEM(BPF_H, BPF_REG_1, 0, 42),
219 	BPF_EXIT_INSN(),
220 	},
221 	.fixup_map_array_small = { 1 },
222 	.result = REJECT,
223 	.errstr = "R1 min value is outside of the array range",
224 },
225 {
226 	"direct map access, write test 19",
227 	.insns = {
228 	BPF_MOV64_IMM(BPF_REG_0, 1),
229 	BPF_LD_MAP_VALUE(BPF_REG_1, 0, 0),
230 	BPF_ST_MEM(BPF_B, BPF_REG_1, 0, 42),
231 	BPF_EXIT_INSN(),
232 	},
233 	.fixup_map_array_small = { 1 },
234 	.result = ACCEPT,
235 	.retval = 1,
236 },
237 {
238 	"direct map access, write test 20",
239 	.insns = {
240 	BPF_MOV64_IMM(BPF_REG_0, 1),
241 	BPF_LD_MAP_VALUE(BPF_REG_1, 0, 1),
242 	BPF_ST_MEM(BPF_B, BPF_REG_1, 0, 42),
243 	BPF_EXIT_INSN(),
244 	},
245 	.fixup_map_array_small = { 1 },
246 	.result = REJECT,
247 	.errstr = "invalid access to map value pointer",
248 },
249 {
250 	"direct map access, invalid insn test 1",
251 	.insns = {
252 	BPF_MOV64_IMM(BPF_REG_0, 1),
253 	BPF_LD_IMM64_RAW_FULL(BPF_REG_1, BPF_PSEUDO_MAP_VALUE, 0, 1, 0, 47),
254 	BPF_EXIT_INSN(),
255 	},
256 	.fixup_map_array_48b = { 1 },
257 	.result = REJECT,
258 	.errstr = "invalid bpf_ld_imm64 insn",
259 },
260 {
261 	"direct map access, invalid insn test 2",
262 	.insns = {
263 	BPF_MOV64_IMM(BPF_REG_0, 1),
264 	BPF_LD_IMM64_RAW_FULL(BPF_REG_1, BPF_PSEUDO_MAP_VALUE, 1, 0, 0, 47),
265 	BPF_EXIT_INSN(),
266 	},
267 	.fixup_map_array_48b = { 1 },
268 	.result = REJECT,
269 	.errstr = "BPF_LD_IMM64 uses reserved fields",
270 },
271 {
272 	"direct map access, invalid insn test 3",
273 	.insns = {
274 	BPF_MOV64_IMM(BPF_REG_0, 1),
275 	BPF_LD_IMM64_RAW_FULL(BPF_REG_1, BPF_PSEUDO_MAP_VALUE, ~0, 0, 0, 47),
276 	BPF_EXIT_INSN(),
277 	},
278 	.fixup_map_array_48b = { 1 },
279 	.result = REJECT,
280 	.errstr = "BPF_LD_IMM64 uses reserved fields",
281 },
282 {
283 	"direct map access, invalid insn test 4",
284 	.insns = {
285 	BPF_MOV64_IMM(BPF_REG_0, 1),
286 	BPF_LD_IMM64_RAW_FULL(BPF_REG_1, BPF_PSEUDO_MAP_VALUE, 0, ~0, 0, 47),
287 	BPF_EXIT_INSN(),
288 	},
289 	.fixup_map_array_48b = { 1 },
290 	.result = REJECT,
291 	.errstr = "invalid bpf_ld_imm64 insn",
292 },
293 {
294 	"direct map access, invalid insn test 5",
295 	.insns = {
296 	BPF_MOV64_IMM(BPF_REG_0, 1),
297 	BPF_LD_IMM64_RAW_FULL(BPF_REG_1, BPF_PSEUDO_MAP_VALUE, ~0, ~0, 0, 47),
298 	BPF_EXIT_INSN(),
299 	},
300 	.fixup_map_array_48b = { 1 },
301 	.result = REJECT,
302 	.errstr = "invalid bpf_ld_imm64 insn",
303 },
304 {
305 	"direct map access, invalid insn test 6",
306 	.insns = {
307 	BPF_MOV64_IMM(BPF_REG_0, 1),
308 	BPF_LD_IMM64_RAW_FULL(BPF_REG_1, BPF_PSEUDO_MAP_FD, ~0, 0, 0, 0),
309 	BPF_EXIT_INSN(),
310 	},
311 	.fixup_map_array_48b = { 1 },
312 	.result = REJECT,
313 	.errstr = "BPF_LD_IMM64 uses reserved fields",
314 },
315 {
316 	"direct map access, invalid insn test 7",
317 	.insns = {
318 	BPF_MOV64_IMM(BPF_REG_0, 1),
319 	BPF_LD_IMM64_RAW_FULL(BPF_REG_1, BPF_PSEUDO_MAP_FD, 0, ~0, 0, 0),
320 	BPF_EXIT_INSN(),
321 	},
322 	.fixup_map_array_48b = { 1 },
323 	.result = REJECT,
324 	.errstr = "invalid bpf_ld_imm64 insn",
325 },
326 {
327 	"direct map access, invalid insn test 8",
328 	.insns = {
329 	BPF_MOV64_IMM(BPF_REG_0, 1),
330 	BPF_LD_IMM64_RAW_FULL(BPF_REG_1, BPF_PSEUDO_MAP_FD, ~0, ~0, 0, 0),
331 	BPF_EXIT_INSN(),
332 	},
333 	.fixup_map_array_48b = { 1 },
334 	.result = REJECT,
335 	.errstr = "invalid bpf_ld_imm64 insn",
336 },
337 {
338 	"direct map access, invalid insn test 9",
339 	.insns = {
340 	BPF_MOV64_IMM(BPF_REG_0, 1),
341 	BPF_LD_IMM64_RAW_FULL(BPF_REG_1, BPF_PSEUDO_MAP_FD, 0, 0, 0, 47),
342 	BPF_EXIT_INSN(),
343 	},
344 	.fixup_map_array_48b = { 1 },
345 	.result = REJECT,
346 	.errstr = "unrecognized bpf_ld_imm64 insn",
347 },
348