1 // SPDX-License-Identifier: GPL-2.0
2 /* Copyright (c) 2023 Meta Platforms, Inc. and affiliates. */
3
4 #include <errno.h>
5 #include <string.h>
6 #include <linux/bpf.h>
7 #include <bpf/bpf_helpers.h>
8 #include "bpf_misc.h"
9
10 char _license[] SEC("license") = "GPL";
11
12 #define ITER_HELPERS \
13 __imm(bpf_iter_num_new), \
14 __imm(bpf_iter_num_next), \
15 __imm(bpf_iter_num_destroy)
16
17 SEC("?raw_tp")
18 __success
19 int force_clang_to_emit_btf_for_externs(void *ctx)
20 {
21 /* we need this as a workaround to enforce compiler emitting BTF
22 * information for bpf_iter_num_{new,next,destroy}() kfuncs,
23 * as, apparently, it doesn't emit it for symbols only referenced from
24 * assembly (or cleanup attribute, for that matter, as well)
25 */
26 bpf_repeat(0);
27
28 return 0;
29 }
30
31 SEC("?raw_tp")
32 __success
33 int consume_first_item_only(void *ctx)
34 {
35 struct bpf_iter_num iter;
36
37 asm volatile (
38 /* create iterator */
39 "r1 = %[iter];"
40 "r2 = 0;"
41 "r3 = 1000;"
42 "call %[bpf_iter_num_new];"
43
44 /* consume first item */
45 "r1 = %[iter];"
46 "call %[bpf_iter_num_next];"
47
48 "if r0 == 0 goto +1;"
49 "r0 = *(u32 *)(r0 + 0);"
50
51 /* destroy iterator */
52 "r1 = %[iter];"
53 "call %[bpf_iter_num_destroy];"
54 :
55 : __imm_ptr(iter), ITER_HELPERS
56 : __clobber_common
57 );
58
59 return 0;
60 }
61
62 SEC("?raw_tp")
63 __failure __msg("R0 invalid mem access 'scalar'")
64 int missing_null_check_fail(void *ctx)
65 {
66 struct bpf_iter_num iter;
67
68 asm volatile (
69 /* create iterator */
70 "r1 = %[iter];"
71 "r2 = 0;"
72 "r3 = 1000;"
73 "call %[bpf_iter_num_new];"
74
75 /* consume first element */
76 "r1 = %[iter];"
77 "call %[bpf_iter_num_next];"
78
79 /* FAIL: deref with no NULL check */
80 "r1 = *(u32 *)(r0 + 0);"
81
82 /* destroy iterator */
83 "r1 = %[iter];"
84 "call %[bpf_iter_num_destroy];"
85 :
86 : __imm_ptr(iter), ITER_HELPERS
87 : __clobber_common
88 );
89
90 return 0;
91 }
92
93 SEC("?raw_tp")
94 __failure
95 __msg("invalid access to memory, mem_size=4 off=0 size=8")
96 __msg("R0 min value is outside of the allowed memory range")
97 int wrong_sized_read_fail(void *ctx)
98 {
99 struct bpf_iter_num iter;
100
101 asm volatile (
102 /* create iterator */
103 "r1 = %[iter];"
104 "r2 = 0;"
105 "r3 = 1000;"
106 "call %[bpf_iter_num_new];"
107
108 /* consume first element */
109 "r1 = %[iter];"
110 "call %[bpf_iter_num_next];"
111
112 "if r0 == 0 goto +1;"
113 /* FAIL: deref more than available 4 bytes */
114 "r0 = *(u64 *)(r0 + 0);"
115
116 /* destroy iterator */
117 "r1 = %[iter];"
118 "call %[bpf_iter_num_destroy];"
119 :
120 : __imm_ptr(iter), ITER_HELPERS
121 : __clobber_common
122 );
123
124 return 0;
125 }
126
127 SEC("?raw_tp")
128 __success __log_level(2)
129 __flag(BPF_F_TEST_STATE_FREQ)
130 int simplest_loop(void *ctx)
131 {
132 struct bpf_iter_num iter;
133
134 asm volatile (
135 "r6 = 0;" /* init sum */
136
137 /* create iterator */
138 "r1 = %[iter];"
139 "r2 = 0;"
140 "r3 = 10;"
141 "call %[bpf_iter_num_new];"
142
143 "1:"
144 /* consume next item */
145 "r1 = %[iter];"
146 "call %[bpf_iter_num_next];"
147
148 "if r0 == 0 goto 2f;"
149 "r0 = *(u32 *)(r0 + 0);"
150 "r6 += r0;" /* accumulate sum */
151 "goto 1b;"
152
153 "2:"
154 /* destroy iterator */
155 "r1 = %[iter];"
156 "call %[bpf_iter_num_destroy];"
157 :
158 : __imm_ptr(iter), ITER_HELPERS
159 : __clobber_common, "r6"
160 );
161
162 return 0;
163 }
164
Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.