cachepc-linux

Fork of AMDESE/linux with modifications for CachePC side-channel attack
git clone https://git.sinitax.com/sinitax/cachepc-linux
Log | Files | Refs | README | LICENSE | sfeed.txt

direct_value_access.c (8390B)

      1{
      2	"direct map access, write test 1",
      3	.insns = {
      4	BPF_MOV64_IMM(BPF_REG_0, 1),
      5	BPF_LD_MAP_VALUE(BPF_REG_1, 0, 0),
      6	BPF_ST_MEM(BPF_DW, BPF_REG_1, 0, 4242),
      7	BPF_EXIT_INSN(),
      8	},
      9	.fixup_map_array_48b = { 1 },
     10	.result = ACCEPT,
     11	.retval = 1,
     12},
     13{
     14	"direct map access, write test 2",
     15	.insns = {
     16	BPF_MOV64_IMM(BPF_REG_0, 1),
     17	BPF_LD_MAP_VALUE(BPF_REG_1, 0, 8),
     18	BPF_ST_MEM(BPF_DW, BPF_REG_1, 0, 4242),
     19	BPF_EXIT_INSN(),
     20	},
     21	.fixup_map_array_48b = { 1 },
     22	.result = ACCEPT,
     23	.retval = 1,
     24},
     25{
     26	"direct map access, write test 3",
     27	.insns = {
     28	BPF_MOV64_IMM(BPF_REG_0, 1),
     29	BPF_LD_MAP_VALUE(BPF_REG_1, 0, 8),
     30	BPF_ST_MEM(BPF_DW, BPF_REG_1, 8, 4242),
     31	BPF_EXIT_INSN(),
     32	},
     33	.fixup_map_array_48b = { 1 },
     34	.result = ACCEPT,
     35	.retval = 1,
     36},
     37{
     38	"direct map access, write test 4",
     39	.insns = {
     40	BPF_MOV64_IMM(BPF_REG_0, 1),
     41	BPF_LD_MAP_VALUE(BPF_REG_1, 0, 40),
     42	BPF_ST_MEM(BPF_DW, BPF_REG_1, 0, 4242),
     43	BPF_EXIT_INSN(),
     44	},
     45	.fixup_map_array_48b = { 1 },
     46	.result = ACCEPT,
     47	.retval = 1,
     48},
     49{
     50	"direct map access, write test 5",
     51	.insns = {
     52	BPF_MOV64_IMM(BPF_REG_0, 1),
     53	BPF_LD_MAP_VALUE(BPF_REG_1, 0, 32),
     54	BPF_ST_MEM(BPF_DW, BPF_REG_1, 8, 4242),
     55	BPF_EXIT_INSN(),
     56	},
     57	.fixup_map_array_48b = { 1 },
     58	.result = ACCEPT,
     59	.retval = 1,
     60},
     61{
     62	"direct map access, write test 6",
     63	.insns = {
     64	BPF_MOV64_IMM(BPF_REG_0, 1),
     65	BPF_LD_MAP_VALUE(BPF_REG_1, 0, 40),
     66	BPF_ST_MEM(BPF_DW, BPF_REG_1, 4, 4242),
     67	BPF_EXIT_INSN(),
     68	},
     69	.fixup_map_array_48b = { 1 },
     70	.result = REJECT,
     71	.errstr = "R1 min value is outside of the allowed memory range",
     72	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
     73},
     74{
     75	"direct map access, write test 7",
     76	.insns = {
     77	BPF_MOV64_IMM(BPF_REG_0, 1),
     78	BPF_LD_MAP_VALUE(BPF_REG_1, 0, -1),
     79	BPF_ST_MEM(BPF_DW, BPF_REG_1, 4, 4242),
     80	BPF_EXIT_INSN(),
     81	},
     82	.fixup_map_array_48b = { 1 },
     83	.result = REJECT,
     84	.errstr = "direct value offset of 4294967295 is not allowed",
     85},
     86{
     87	"direct map access, write test 8",
     88	.insns = {
     89	BPF_MOV64_IMM(BPF_REG_0, 1),
     90	BPF_LD_MAP_VALUE(BPF_REG_1, 0, 1),
     91	BPF_ST_MEM(BPF_DW, BPF_REG_1, -1, 4242),
     92	BPF_EXIT_INSN(),
     93	},
     94	.fixup_map_array_48b = { 1 },
     95	.result = ACCEPT,
     96	.retval = 1,
     97},
     98{
     99	"direct map access, write test 9",
    100	.insns = {
    101	BPF_MOV64_IMM(BPF_REG_0, 1),
    102	BPF_LD_MAP_VALUE(BPF_REG_1, 0, 48),
    103	BPF_ST_MEM(BPF_DW, BPF_REG_1, 0, 4242),
    104	BPF_EXIT_INSN(),
    105	},
    106	.fixup_map_array_48b = { 1 },
    107	.result = REJECT,
    108	.errstr = "invalid access to map value pointer",
    109},
    110{
    111	"direct map access, write test 10",
    112	.insns = {
    113	BPF_MOV64_IMM(BPF_REG_0, 1),
    114	BPF_LD_MAP_VALUE(BPF_REG_1, 0, 47),
    115	BPF_ST_MEM(BPF_B, BPF_REG_1, 0, 4),
    116	BPF_EXIT_INSN(),
    117	},
    118	.fixup_map_array_48b = { 1 },
    119	.result = ACCEPT,
    120	.retval = 1,
    121},
    122{
    123	"direct map access, write test 11",
    124	.insns = {
    125	BPF_MOV64_IMM(BPF_REG_0, 1),
    126	BPF_LD_MAP_VALUE(BPF_REG_1, 0, 48),
    127	BPF_ST_MEM(BPF_B, BPF_REG_1, 0, 4),
    128	BPF_EXIT_INSN(),
    129	},
    130	.fixup_map_array_48b = { 1 },
    131	.result = REJECT,
    132	.errstr = "invalid access to map value pointer",
    133},
    134{
    135	"direct map access, write test 12",
    136	.insns = {
    137	BPF_MOV64_IMM(BPF_REG_0, 1),
    138	BPF_LD_MAP_VALUE(BPF_REG_1, 0, (1<<29)),
    139	BPF_ST_MEM(BPF_B, BPF_REG_1, 0, 4),
    140	BPF_EXIT_INSN(),
    141	},
    142	.fixup_map_array_48b = { 1 },
    143	.result = REJECT,
    144	.errstr = "direct value offset of 536870912 is not allowed",
    145},
    146{
    147	"direct map access, write test 13",
    148	.insns = {
    149	BPF_MOV64_IMM(BPF_REG_0, 1),
    150	BPF_LD_MAP_VALUE(BPF_REG_1, 0, (1<<29)-1),
    151	BPF_ST_MEM(BPF_B, BPF_REG_1, 0, 4),
    152	BPF_EXIT_INSN(),
    153	},
    154	.fixup_map_array_48b = { 1 },
    155	.result = REJECT,
    156	.errstr = "invalid access to map value pointer, value_size=48 off=536870911",
    157},
    158{
    159	"direct map access, write test 14",
    160	.insns = {
    161	BPF_MOV64_IMM(BPF_REG_0, 1),
    162	BPF_LD_MAP_VALUE(BPF_REG_1, 0, 47),
    163	BPF_LD_MAP_VALUE(BPF_REG_2, 0, 46),
    164	BPF_ST_MEM(BPF_H, BPF_REG_2, 0, 0xffff),
    165	BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1, 0),
    166	BPF_EXIT_INSN(),
    167	},
    168	.fixup_map_array_48b = { 1, 3 },
    169	.result = ACCEPT,
    170	.retval = 0xff,
    171},
    172{
    173	"direct map access, write test 15",
    174	.insns = {
    175	BPF_MOV64_IMM(BPF_REG_0, 1),
    176	BPF_LD_MAP_VALUE(BPF_REG_1, 0, 46),
    177	BPF_LD_MAP_VALUE(BPF_REG_2, 0, 46),
    178	BPF_ST_MEM(BPF_H, BPF_REG_2, 0, 0xffff),
    179	BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1, 0),
    180	BPF_EXIT_INSN(),
    181	},
    182	.fixup_map_array_48b = { 1, 3 },
    183	.result = ACCEPT,
    184	.retval = 0xffff,
    185},
    186{
    187	"direct map access, write test 16",
    188	.insns = {
    189	BPF_MOV64_IMM(BPF_REG_0, 1),
    190	BPF_LD_MAP_VALUE(BPF_REG_1, 0, 46),
    191	BPF_LD_MAP_VALUE(BPF_REG_2, 0, 47),
    192	BPF_ST_MEM(BPF_H, BPF_REG_2, 0, 0xffff),
    193	BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1, 0),
    194	BPF_EXIT_INSN(),
    195	},
    196	.fixup_map_array_48b = { 1, 3 },
    197	.result = REJECT,
    198	.errstr = "invalid access to map value, value_size=48 off=47 size=2",
    199	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
    200},
    201{
    202	"direct map access, write test 17",
    203	.insns = {
    204	BPF_MOV64_IMM(BPF_REG_0, 1),
    205	BPF_LD_MAP_VALUE(BPF_REG_1, 0, 46),
    206	BPF_LD_MAP_VALUE(BPF_REG_2, 0, 46),
    207	BPF_ST_MEM(BPF_H, BPF_REG_2, 1, 0xffff),
    208	BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1, 0),
    209	BPF_EXIT_INSN(),
    210	},
    211	.fixup_map_array_48b = { 1, 3 },
    212	.result = REJECT,
    213	.errstr = "invalid access to map value, value_size=48 off=47 size=2",
    214	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
    215},
    216{
    217	"direct map access, write test 18",
    218	.insns = {
    219	BPF_MOV64_IMM(BPF_REG_0, 1),
    220	BPF_LD_MAP_VALUE(BPF_REG_1, 0, 0),
    221	BPF_ST_MEM(BPF_H, BPF_REG_1, 0, 42),
    222	BPF_EXIT_INSN(),
    223	},
    224	.fixup_map_array_small = { 1 },
    225	.result = REJECT,
    226	.errstr = "R1 min value is outside of the allowed memory range",
    227},
    228{
    229	"direct map access, write test 19",
    230	.insns = {
    231	BPF_MOV64_IMM(BPF_REG_0, 1),
    232	BPF_LD_MAP_VALUE(BPF_REG_1, 0, 0),
    233	BPF_ST_MEM(BPF_B, BPF_REG_1, 0, 42),
    234	BPF_EXIT_INSN(),
    235	},
    236	.fixup_map_array_small = { 1 },
    237	.result = ACCEPT,
    238	.retval = 1,
    239},
    240{
    241	"direct map access, write test 20",
    242	.insns = {
    243	BPF_MOV64_IMM(BPF_REG_0, 1),
    244	BPF_LD_MAP_VALUE(BPF_REG_1, 0, 1),
    245	BPF_ST_MEM(BPF_B, BPF_REG_1, 0, 42),
    246	BPF_EXIT_INSN(),
    247	},
    248	.fixup_map_array_small = { 1 },
    249	.result = REJECT,
    250	.errstr = "invalid access to map value pointer",
    251},
    252{
    253	"direct map access, invalid insn test 1",
    254	.insns = {
    255	BPF_MOV64_IMM(BPF_REG_0, 1),
    256	BPF_LD_IMM64_RAW_FULL(BPF_REG_1, BPF_PSEUDO_MAP_VALUE, 0, 1, 0, 47),
    257	BPF_EXIT_INSN(),
    258	},
    259	.fixup_map_array_48b = { 1 },
    260	.result = REJECT,
    261	.errstr = "invalid bpf_ld_imm64 insn",
    262},
    263{
    264	"direct map access, invalid insn test 2",
    265	.insns = {
    266	BPF_MOV64_IMM(BPF_REG_0, 1),
    267	BPF_LD_IMM64_RAW_FULL(BPF_REG_1, BPF_PSEUDO_MAP_VALUE, 1, 0, 0, 47),
    268	BPF_EXIT_INSN(),
    269	},
    270	.fixup_map_array_48b = { 1 },
    271	.result = REJECT,
    272	.errstr = "BPF_LD_IMM64 uses reserved fields",
    273},
    274{
    275	"direct map access, invalid insn test 3",
    276	.insns = {
    277	BPF_MOV64_IMM(BPF_REG_0, 1),
    278	BPF_LD_IMM64_RAW_FULL(BPF_REG_1, BPF_PSEUDO_MAP_VALUE, ~0, 0, 0, 47),
    279	BPF_EXIT_INSN(),
    280	},
    281	.fixup_map_array_48b = { 1 },
    282	.result = REJECT,
    283	.errstr = "BPF_LD_IMM64 uses reserved fields",
    284},
    285{
    286	"direct map access, invalid insn test 4",
    287	.insns = {
    288	BPF_MOV64_IMM(BPF_REG_0, 1),
    289	BPF_LD_IMM64_RAW_FULL(BPF_REG_1, BPF_PSEUDO_MAP_VALUE, 0, ~0, 0, 47),
    290	BPF_EXIT_INSN(),
    291	},
    292	.fixup_map_array_48b = { 1 },
    293	.result = REJECT,
    294	.errstr = "invalid bpf_ld_imm64 insn",
    295},
    296{
    297	"direct map access, invalid insn test 5",
    298	.insns = {
    299	BPF_MOV64_IMM(BPF_REG_0, 1),
    300	BPF_LD_IMM64_RAW_FULL(BPF_REG_1, BPF_PSEUDO_MAP_VALUE, ~0, ~0, 0, 47),
    301	BPF_EXIT_INSN(),
    302	},
    303	.fixup_map_array_48b = { 1 },
    304	.result = REJECT,
    305	.errstr = "invalid bpf_ld_imm64 insn",
    306},
    307{
    308	"direct map access, invalid insn test 6",
    309	.insns = {
    310	BPF_MOV64_IMM(BPF_REG_0, 1),
    311	BPF_LD_IMM64_RAW_FULL(BPF_REG_1, BPF_PSEUDO_MAP_FD, ~0, 0, 0, 0),
    312	BPF_EXIT_INSN(),
    313	},
    314	.fixup_map_array_48b = { 1 },
    315	.result = REJECT,
    316	.errstr = "BPF_LD_IMM64 uses reserved fields",
    317},
    318{
    319	"direct map access, invalid insn test 7",
    320	.insns = {
    321	BPF_MOV64_IMM(BPF_REG_0, 1),
    322	BPF_LD_IMM64_RAW_FULL(BPF_REG_1, BPF_PSEUDO_MAP_FD, 0, ~0, 0, 0),
    323	BPF_EXIT_INSN(),
    324	},
    325	.fixup_map_array_48b = { 1 },
    326	.result = REJECT,
    327	.errstr = "invalid bpf_ld_imm64 insn",
    328},
    329{
    330	"direct map access, invalid insn test 8",
    331	.insns = {
    332	BPF_MOV64_IMM(BPF_REG_0, 1),
    333	BPF_LD_IMM64_RAW_FULL(BPF_REG_1, BPF_PSEUDO_MAP_FD, ~0, ~0, 0, 0),
    334	BPF_EXIT_INSN(),
    335	},
    336	.fixup_map_array_48b = { 1 },
    337	.result = REJECT,
    338	.errstr = "invalid bpf_ld_imm64 insn",
    339},
    340{
    341	"direct map access, invalid insn test 9",
    342	.insns = {
    343	BPF_MOV64_IMM(BPF_REG_0, 1),
    344	BPF_LD_IMM64_RAW_FULL(BPF_REG_1, BPF_PSEUDO_MAP_FD, 0, 0, 0, 47),
    345	BPF_EXIT_INSN(),
    346	},
    347	.fixup_map_array_48b = { 1 },
    348	.result = REJECT,
    349	.errstr = "unrecognized bpf_ld_imm64 insn",
    350},