1 // SPDX-License-Identifier: GPL-2.0
12 	"*(u32*)(r10 - 8) = r2;"	\
13 	"*(u64*)(r10 - 16) = r2;"	\
14 	"*(u64*)(r10 - 24) = r2;"	\
15 	"*(u64*)(r10 - 32) = r2;"	\
16 	"*(u64*)(r10 - 40) = r2;"	\
17 	"*(u64*)(r10 - 48) = r2;"	\
20 	"r2 += -48;"			\
31 } map_hash_8b SEC(".maps");
42 } map_prog1_socket SEC(".maps") = {
50 SEC("socket")
57 SEC("socket")
64 SEC("socket")
80 SEC("socket")
92 SEC("socket")
104 SEC("socket")
117 SEC("socket")
124 	r1 = -r1;					\  in unpriv_neg_pointer()
130 SEC("socket")
143 SEC("socket")
156 SEC("tracepoint")
163 	*(u64*)(r10 - 8) = r1;				\  in check_that_printk_is_disallowed()
165 	r1 += -8;					\  in check_that_printk_is_disallowed()
176 SEC("socket")
184 	*(u64*)(r10 - 8) = r1;				\  in pass_pointer_to_helper_function()
186 	r2 += -8;					\  in pass_pointer_to_helper_function()
199 SEC("socket")
202 __msg_unpriv("invalid read from stack R2 off -8+0 size 8")
207 	*(u64*)(r10 - 8) = r10;				\  in on_stack_to_helper_function()
209 	r2 += -8;					\  in on_stack_to_helper_function()
220 SEC("socket")
227 	*(u64*)(r10 - 8) = r10;				\  in mangle_pointer_on_stack_1()
229 	*(u32*)(r10 - 8) = r0;				\  in mangle_pointer_on_stack_1()
235 SEC("socket")
242 	*(u64*)(r10 - 8) = r10;				\  in mangle_pointer_on_stack_2()
244 	*(u8*)(r10 - 1) = r0;				\  in mangle_pointer_on_stack_2()
250 SEC("socket")
257 	*(u64*)(r10 - 8) = r10;				\  in from_stack_in_small_chunks()
258 	r0 = *(u32*)(r10 - 8);				\  in from_stack_in_small_chunks()
264 SEC("socket")
277 SEC("socket")
284 	r6 += -8;					\  in unpriv_spill_fill_of_ctx()
292 SEC("tc")
299 	r6 += -8;					\  in spill_fill_of_ctx_2()
310 SEC("tc")
317 	r6 += -8;					\  in spill_fill_of_ctx_3()
328 SEC("tc")
335 	r6 += -8;					\  in spill_fill_of_ctx_4()
338 	lock *(u64 *)(r10 - 8) += r0;			\  in spill_fill_of_ctx_4()
347 SEC("tc")
355 	r6 += -8;					\  in fill_of_different_pointers_stx()
358 	r2 += -16;					\  in fill_of_different_pointers_stx()
374 SEC("tc")
381 	r6 += -8;					\  in fill_of_different_pointers_st()
384 	r2 += -16;					\  in fill_of_different_pointers_st()
399 SEC("tc")
400 __description("unpriv: spill/fill of different pointers stx - ctx and sock")
412 	r6 += -8;					\  in pointers_stx_ctx_and_sock()
422 	/* skb->mark = 42; */				\  in pointers_stx_ctx_and_sock()
438 SEC("tc")
439 __description("unpriv: spill/fill of different pointers stx - leak sock")
453 	r6 += -8;					\  in different_pointers_stx_leak_sock()
463 	/* skb->mark = 42; */				\  in different_pointers_stx_leak_sock()
474 SEC("tc")
475 __description("unpriv: spill/fill of different pointers stx - sock and ctx (read)")
487 	r6 += -8;					\  in stx_sock_and_ctx_read()
497 	/* if (sk) u32 foo = sk->mark; bpf_sk_release(sk); */\  in stx_sock_and_ctx_read()
511 SEC("tc")
512 __description("unpriv: spill/fill of different pointers stx - sock and ctx (write)")
526 	r6 += -8;					\  in stx_sock_and_ctx_write()
536 	/* if (sk) sk->mark = 42; bpf_sk_release(sk); */\  in stx_sock_and_ctx_write()
551 SEC("socket")
559 	*(u64*)(r10 - 8) = r1;				\  in pointer_into_map_elem_value()
561 	r2 += -8;					\  in pointer_into_map_elem_value()
573 SEC("socket")
580 __xlated_unpriv("goto pc-1") /* sanitized dead code */
595 SEC("socket")
608 SEC("socket")
626 SEC("socket")
642 SEC("socket")
658 SEC("socket")
671 SEC("socket")
679 	r6 += -8;					\  in unpriv_spill_fill_frame_pointer()
687 SEC("socket")
700 SEC("socket")
711 	*(u64*)(r1 - 8) = r0;				\  in unpriv_adding_of_fp_reg()
716 SEC("socket")
727 	*(u64*)(r1 - 8) = r0;				\  in unpriv_adding_of_fp_imm()
732 SEC("socket")
740 	r2 += -8;					\  in unpriv_cmp_of_stack_pointer()
747 SEC("socket")
748 __description("unpriv: Spectre v1 path-based type confusion of scalar as stack-ptr")
765 	*(u64*)(r10 - 8) = r1;				\  in unpriv_spec_v1_type_confusion()
767 	r2 += -8;					\  in unpriv_spec_v1_type_confusion()
773 	r2 += -8;					\  in unpriv_spec_v1_type_confusion()
777 	r6 += -8;					\  in unpriv_spec_v1_type_confusion()
790 	*(u64*)(r10 - 8) = r9;				\  in unpriv_spec_v1_type_confusion()
804 SEC("socket")
805 __description("unpriv: ldimm64 before Spectre v4 barrier")
810 __xlated_unpriv("*(u64 *)(r10 -8) = r1")
817 	*(u64 *)(r10 -8) = r1;				\  in unpriv_ldimm64_spectre_v4()
823 SEC("socket")
824 __description("unpriv: Spectre v1 and v4 barrier")
834 /* Following nospec required to prevent following dangerous `*(u64 *)(NOT_FP -64)
836  * test therefore ensures the Spectre-v4--induced nospec does not prevent the
837  * Spectre-v1--induced speculative path from being fully analyzed.
840 __xlated_unpriv("*(u64 *)(r2 -64) = r1") /* could be used to leak r2 */
841 __xlated_unpriv("nospec") /* Spectre v4 */
848 	*(u64*)(r10 - 8) = r1;				\  in unpriv_spectre_v1_and_v4()
850 	r2 += -8;					\  in unpriv_spectre_v1_and_v4()
855 	r2 += -8;					\  in unpriv_spectre_v1_and_v4()
869 l2_%=:	*(u64 *)(r2 -64) = r1;				\  in unpriv_spectre_v1_and_v4()
878 SEC("socket")
879 __description("unpriv: Spectre v1 and v4 barrier (simple)")
886 __xlated_unpriv("goto pc-1") /* if r9 == 0 goto l3_%= */
887 __xlated_unpriv("goto pc-1") /* r2 = r0 */
889 __xlated_unpriv("*(u64 *)(r2 -64) = r1")
908 l2_%=:	*(u64 *)(r2 -64) = r1;				\  in unpriv_spectre_v1_and_v4_simple()
914 SEC("socket")
915 __description("unpriv: ldimm64 before Spectre v1 and v4 barrier (simple)")
922 __xlated_unpriv("goto pc-1") /* if r9 == 0 goto l3_%= */
923 __xlated_unpriv("goto pc-1") /* r2 = r0 */
924 __xlated_unpriv("goto pc-1") /* r1 = 0x2020200005642020 ll */
925 __xlated_unpriv("goto pc-1") /* second part of ldimm64 */
927 __xlated_unpriv("*(u64 *)(r2 -64) = r1")
947 l2_%=:	*(u64 *)(r2 -64) = r1;				\  in unpriv_ldimm64_spectre_v1_and_v4_simple()
953 char _license[] SEC("license") = "GPL";