1 {
2 "BPF_ATOMIC_FETCH_ADD smoketest - 64bit",
3 .insns = {
4 BPF_MOV64_IMM(BPF_REG_0, 0),
5 /* Write 3 to stack */
6 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 3),
7 /* Put a 1 in R1, add it to the 3 on the stack, and load the value back into R1 */
8 BPF_MOV64_IMM(BPF_REG_1, 1),
9 BPF_ATOMIC_OP(BPF_DW, BPF_ADD | BPF_FETCH, BPF_REG_10, BPF_REG_1, -8),
10 /* Check the value we loaded back was 3 */
11 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 3, 2),
12 BPF_MOV64_IMM(BPF_REG_0, 1),
13 BPF_EXIT_INSN(),
14 /* Load value from stack */
15 BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -8),
16 /* Check value loaded from stack was 4 */
17 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 4, 1),
18 BPF_MOV64_IMM(BPF_REG_0, 2),
19 BPF_EXIT_INSN(),
20 },
21 .result = ACCEPT,
22 },
23 {
24 "BPF_ATOMIC_FETCH_ADD smoketest - 32bit",
25 .insns = {
26 BPF_MOV64_IMM(BPF_REG_0, 0),
27 /* Write 3 to stack */
28 BPF_ST_MEM(BPF_W, BPF_REG_10, -4, 3),
29 /* Put a 1 in R1, add it to the 3 on the stack, and load the value back into R1 */
30 BPF_MOV32_IMM(BPF_REG_1, 1),
31 BPF_ATOMIC_OP(BPF_W, BPF_ADD | BPF_FETCH, BPF_REG_10, BPF_REG_1, -4),
32 /* Check the value we loaded back was 3 */
33 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 3, 2),
34 BPF_MOV64_IMM(BPF_REG_0, 1),
35 BPF_EXIT_INSN(),
36 /* Load value from stack */
37 BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_10, -4),
38 /* Check value loaded from stack was 4 */
39 BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 4, 1),
40 BPF_MOV64_IMM(BPF_REG_0, 2),
41 BPF_EXIT_INSN(),
42 },
43 .result = ACCEPT,
44 },
45 {
46 "Can't use ATM_FETCH_ADD on frame pointer",
47 .insns = {
48 BPF_MOV64_IMM(BPF_REG_0, 0),
49 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 3),
50 BPF_ATOMIC_OP(BPF_DW, BPF_ADD | BPF_FETCH, BPF_REG_10, BPF_REG_10, -8),
51 BPF_EXIT_INSN(),
52 },
53 .result = REJECT,
54 .errstr_unpriv = "R10 leaks addr into mem",
55 .errstr = "frame pointer is read only",
56 },
57 {
58 "Can't use ATM_FETCH_ADD on uninit src reg",
59 .insns = {
60 BPF_MOV64_IMM(BPF_REG_0, 0),
61 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 3),
62 BPF_ATOMIC_OP(BPF_DW, BPF_ADD | BPF_FETCH, BPF_REG_10, BPF_REG_2, -8),
63 BPF_EXIT_INSN(),
64 },
65 .result = REJECT,
66 /* It happens that the address leak check is first, but it would also be
67 * complain about the fact that we're trying to modify R10.
68 */
69 .errstr = "!read_ok",
70 },
71 {
72 "Can't use ATM_FETCH_ADD on uninit dst reg",
73 .insns = {
74 BPF_MOV64_IMM(BPF_REG_0, 0),
75 BPF_ATOMIC_OP(BPF_DW, BPF_ADD | BPF_FETCH, BPF_REG_2, BPF_REG_0, -8),
76 BPF_EXIT_INSN(),
77 },
78 .result = REJECT,
79 /* It happens that the address leak check is first, but it would also be
80 * complain about the fact that we're trying to modify R10.
81 */
82 .errstr = "!read_ok",
83 },
84 {
85 "Can't use ATM_FETCH_ADD on kernel memory",
86 .insns = {
87 /* This is an fentry prog, context is array of the args of the
88 * kernel function being called. Load first arg into R2.
89 */
90 BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, 0),
91 /* First arg of bpf_fentry_test7 is a pointer to a struct.
92 * Attempt to modify that struct. Verifier shouldn't let us
93 * because it's kernel memory.
94 */
95 BPF_MOV64_IMM(BPF_REG_3, 1),
96 BPF_ATOMIC_OP(BPF_DW, BPF_ADD | BPF_FETCH, BPF_REG_2, BPF_REG_3, 0),
97 /* Done */
98 BPF_MOV64_IMM(BPF_REG_0, 0),
99 BPF_EXIT_INSN(),
100 },
101 .prog_type = BPF_PROG_TYPE_TRACING,
102 .expected_attach_type = BPF_TRACE_FENTRY,
103 .kfunc = "bpf_fentry_test7",
104 .result = REJECT,
105 .errstr = "only read is supported",
106 },
107
Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.