1 // SPDX-License-Identifier: GPL-2.0
2
3 #include <linux/bpf.h>
4 #include <bpf/bpf_helpers.h>
5 #include "bpf_misc.h"
6
7 /* Check that precision marks propagate through scalar IDs.
8 * Registers r{0,1,2} have the same scalar ID.
9 * Range information is propagated for scalars sharing same ID.
10 * Check that precision mark for r0 causes precision marks for r{1,2}
11 * when range information is propagated for 'if <reg> <op> <const>' insn.
12 */
13 SEC("socket")
14 __success __log_level(2)
15 /* first 'if' branch */
16 __msg("6: (0f) r3 += r0")
17 __msg("frame0: regs=r0 stack= before 4: (25) if r1 > 0x7 goto pc+0")
18 __msg("frame0: parent state regs=r0,r1,r2 stack=:")
19 __msg("frame0: regs=r0,r1,r2 stack= before 3: (bf) r2 = r0")
20 /* second 'if' branch */
21 __msg("from 4 to 5: ")
22 __msg("6: (0f) r3 += r0")
23 __msg("frame0: regs=r0 stack= before 5: (bf) r3 = r10")
24 __msg("frame0: regs=r0 stack= before 4: (25) if r1 > 0x7 goto pc+0")
25 /* parent state already has r{0,1,2} as precise */
26 __msg("frame0: parent state regs= stack=:")
__flag(BPF_F_TEST_STATE_FREQ)27 __flag(BPF_F_TEST_STATE_FREQ)
28 __naked void linked_regs_bpf_k(void)
29 {
30 asm volatile (
31 /* r0 = random number up to 0xff */
32 "call %[bpf_ktime_get_ns];"
33 "r0 &= 0xff;"
34 /* tie r0.id == r1.id == r2.id */
35 "r1 = r0;"
36 "r2 = r0;"
37 "if r1 > 7 goto +0;"
38 /* force r0 to be precise, this eventually marks r1 and r2 as
39 * precise as well because of shared IDs
40 */
41 "r3 = r10;"
42 "r3 += r0;"
43 /* Mark r1 and r2 as alive. */
44 "r1 = r1;"
45 "r2 = r2;"
46 "r0 = 0;"
47 "exit;"
48 :
49 : __imm(bpf_ktime_get_ns)
50 : __clobber_all);
51 }
52
53 /* Registers r{0,1,2} share same ID when 'if r1 > ...' insn is processed,
54 * check that verifier marks r{1,2} as precise while backtracking
55 * 'if r1 > ...' with r0 already marked.
56 */
57 SEC("socket")
58 __success __log_level(2)
__flag(BPF_F_TEST_STATE_FREQ)59 __flag(BPF_F_TEST_STATE_FREQ)
60 __msg("frame0: regs=r0 stack= before 5: (2d) if r1 > r3 goto pc+0")
61 __msg("frame0: parent state regs=r0,r1,r2,r3 stack=:")
62 __msg("frame0: regs=r0,r1,r2,r3 stack= before 4: (b7) r3 = 7")
63 __naked void linked_regs_bpf_x_src(void)
64 {
65 asm volatile (
66 /* r0 = random number up to 0xff */
67 "call %[bpf_ktime_get_ns];"
68 "r0 &= 0xff;"
69 /* tie r0.id == r1.id == r2.id */
70 "r1 = r0;"
71 "r2 = r0;"
72 "r3 = 7;"
73 "if r1 > r3 goto +0;"
74 /* force r0 to be precise, this eventually marks r1 and r2 as
75 * precise as well because of shared IDs
76 */
77 "r4 = r10;"
78 "r4 += r0;"
79 /* Mark r1 and r2 as alive. */
80 "r1 = r1;"
81 "r2 = r2;"
82 "r0 = 0;"
83 "exit;"
84 :
85 : __imm(bpf_ktime_get_ns)
86 : __clobber_all);
87 }
88
89 /* Registers r{0,1,2} share same ID when 'if r1 > r3' insn is processed,
90 * check that verifier marks r{0,1,2} as precise while backtracking
91 * 'if r1 > r3' with r3 already marked.
92 */
93 SEC("socket")
94 __success __log_level(2)
__flag(BPF_F_TEST_STATE_FREQ)95 __flag(BPF_F_TEST_STATE_FREQ)
96 __msg("frame0: regs=r3 stack= before 5: (2d) if r1 > r3 goto pc+0")
97 __msg("frame0: parent state regs=r0,r1,r2,r3 stack=:")
98 __msg("frame0: regs=r0,r1,r2,r3 stack= before 4: (b7) r3 = 7")
99 __naked void linked_regs_bpf_x_dst(void)
100 {
101 asm volatile (
102 /* r0 = random number up to 0xff */
103 "call %[bpf_ktime_get_ns];"
104 "r0 &= 0xff;"
105 /* tie r0.id == r1.id == r2.id */
106 "r1 = r0;"
107 "r2 = r0;"
108 "r3 = 7;"
109 "if r1 > r3 goto +0;"
110 /* force r0 to be precise, this eventually marks r1 and r2 as
111 * precise as well because of shared IDs
112 */
113 "r4 = r10;"
114 "r4 += r3;"
115 /* Mark r1 and r2 as alive. */
116 "r0 = r0;"
117 "r1 = r1;"
118 "r2 = r2;"
119 "r0 = 0;"
120 "exit;"
121 :
122 : __imm(bpf_ktime_get_ns)
123 : __clobber_all);
124 }
125
126 /* Same as linked_regs_bpf_k, but break one of the
127 * links, note that r1 is absent from regs=... in __msg below.
128 */
129 SEC("socket")
130 __success __log_level(2)
131 __msg("7: (0f) r3 += r0")
132 __msg("frame0: regs=r0 stack= before 6: (bf) r3 = r10")
133 __msg("frame0: parent state regs=r0 stack=:")
134 __msg("frame0: regs=r0 stack= before 5: (25) if r0 > 0x7 goto pc+0")
135 __msg("frame0: parent state regs=r0,r2 stack=:")
__flag(BPF_F_TEST_STATE_FREQ)136 __flag(BPF_F_TEST_STATE_FREQ)
137 __naked void linked_regs_broken_link(void)
138 {
139 asm volatile (
140 /* r0 = random number up to 0xff */
141 "call %[bpf_ktime_get_ns];"
142 "r0 &= 0xff;"
143 /* tie r0.id == r1.id == r2.id */
144 "r1 = r0;"
145 "r2 = r0;"
146 /* break link for r1, this is the only line that differs
147 * compared to the previous test
148 */
149 "r1 = 0;"
150 "if r0 > 7 goto +0;"
151 /* force r0 to be precise,
152 * this eventually marks r2 as precise because of shared IDs
153 */
154 "r3 = r10;"
155 "r3 += r0;"
156 /* Mark r1 and r2 as alive. */
157 "r1 = r1;"
158 "r2 = r2;"
159 "r0 = 0;"
160 "exit;"
161 :
162 : __imm(bpf_ktime_get_ns)
163 : __clobber_all);
164 }
165
166 /* Check that precision marks propagate through scalar IDs.
167 * Use the same scalar ID in multiple stack frames, check that
168 * precision information is propagated up the call stack.
169 */
170 SEC("socket")
171 __success __log_level(2)
172 __msg("17: (0f) r2 += r1")
173 /* Current state */
174 __msg("frame2: last_idx 17 first_idx 14 subseq_idx -1 ")
175 __msg("frame2: regs=r1 stack= before 16: (bf) r2 = r10")
176 __msg("frame2: parent state regs=r1 stack=")
177 __msg("frame1: parent state regs= stack=")
178 __msg("frame0: parent state regs= stack=")
179 /* Parent state */
180 __msg("frame2: last_idx 13 first_idx 13 subseq_idx 14 ")
181 __msg("frame2: regs=r1 stack= before 13: (25) if r1 > 0x7 goto pc+0")
182 __msg("frame2: parent state regs=r1 stack=")
183 /* frame1.r{6,7} are marked because mark_precise_scalar_ids()
184 * looks for all registers with frame2.r1.id in the current state
185 */
186 __msg("frame1: parent state regs=r6,r7 stack=")
187 __msg("frame0: parent state regs=r6 stack=")
188 /* Parent state */
189 __msg("frame2: last_idx 9 first_idx 9 subseq_idx 13")
190 __msg("frame2: regs=r1 stack= before 9: (85) call pc+3")
191 /* frame1.r1 is marked because of backtracking of call instruction */
192 __msg("frame1: parent state regs=r1,r6,r7 stack=")
193 __msg("frame0: parent state regs=r6 stack=")
194 /* Parent state */
195 __msg("frame1: last_idx 8 first_idx 7 subseq_idx 9")
196 __msg("frame1: regs=r1,r6,r7 stack= before 8: (bf) r7 = r1")
197 __msg("frame1: regs=r1,r6 stack= before 7: (bf) r6 = r1")
198 __msg("frame1: parent state regs=r1 stack=")
199 __msg("frame0: parent state regs=r6 stack=")
200 /* Parent state */
201 __msg("frame1: last_idx 4 first_idx 4 subseq_idx 7")
202 __msg("frame1: regs=r1 stack= before 4: (85) call pc+2")
203 __msg("frame0: parent state regs=r1,r6 stack=")
204 /* Parent state */
205 __msg("frame0: last_idx 3 first_idx 1 subseq_idx 4")
206 __msg("frame0: regs=r1,r6 stack= before 3: (bf) r6 = r0")
207 __msg("frame0: regs=r0,r1 stack= before 2: (bf) r1 = r0")
208 __msg("frame0: regs=r0 stack= before 1: (57) r0 &= 255")
__flag(BPF_F_TEST_STATE_FREQ)209 __flag(BPF_F_TEST_STATE_FREQ)
210 __naked void precision_many_frames(void)
211 {
212 asm volatile (
213 /* r0 = random number up to 0xff */
214 "call %[bpf_ktime_get_ns];"
215 "r0 &= 0xff;"
216 /* tie r0.id == r1.id == r6.id */
217 "r1 = r0;"
218 "r6 = r0;"
219 "call precision_many_frames__foo;"
220 "r6 = r6;" /* mark r6 as live */
221 "exit;"
222 :
223 : __imm(bpf_ktime_get_ns)
224 : __clobber_all);
225 }
226
227 static __naked __noinline __used
precision_many_frames__foo(void)228 void precision_many_frames__foo(void)
229 {
230 asm volatile (
231 /* conflate one of the register numbers (r6) with outer frame,
232 * to verify that those are tracked independently
233 */
234 "r6 = r1;"
235 "r7 = r1;"
236 "call precision_many_frames__bar;"
237 "r6 = r6;" /* mark r6 as live */
238 "r7 = r7;" /* mark r7 as live */
239 "exit"
240 ::: __clobber_all);
241 }
242
243 static __naked __noinline __used
precision_many_frames__bar(void)244 void precision_many_frames__bar(void)
245 {
246 asm volatile (
247 "if r1 > 7 goto +0;"
248 "r6 = 0;" /* mark r6 as live */
249 "r7 = 0;" /* mark r7 as live */
250 /* force r1 to be precise, this eventually marks:
251 * - bar frame r1
252 * - foo frame r{1,6,7}
253 * - main frame r{1,6}
254 */
255 "r2 = r10;"
256 "r2 += r1;"
257 "r0 = 0;"
258 "exit;"
259 ::: __clobber_all);
260 }
261
262 /* Check that scalars with the same IDs are marked precise on stack as
263 * well as in registers.
264 */
265 SEC("socket")
266 __success __log_level(2)
267 __msg("12: (0f) r2 += r1")
268 /* foo frame */
269 __msg("frame1: regs=r1 stack= before 11: (bf) r2 = r10")
270 __msg("frame1: regs=r1 stack= before 10: (25) if r1 > 0x7 goto pc+0")
271 __msg("frame1: regs=r1 stack=-8,-16 before 9: (7b) *(u64 *)(r10 -16) = r1")
272 __msg("frame1: regs=r1 stack=-8 before 8: (7b) *(u64 *)(r10 -8) = r1")
273 __msg("frame1: regs=r1 stack= before 4: (85) call pc+3")
274 /* main frame */
275 __msg("frame0: regs=r1 stack=-8 before 3: (7b) *(u64 *)(r10 -8) = r1")
276 __msg("frame0: regs=r1 stack= before 2: (bf) r1 = r0")
277 __msg("frame0: regs=r0 stack= before 1: (57) r0 &= 255")
__flag(BPF_F_TEST_STATE_FREQ)278 __flag(BPF_F_TEST_STATE_FREQ)
279 __naked void precision_stack(void)
280 {
281 asm volatile (
282 /* r0 = random number up to 0xff */
283 "call %[bpf_ktime_get_ns];"
284 "r0 &= 0xff;"
285 /* tie r0.id == r1.id == fp[-8].id */
286 "r1 = r0;"
287 "*(u64*)(r10 - 8) = r1;"
288 "call precision_stack__foo;"
289 "r0 = *(u64*)(r10 - 8);"
290 "r0 = 0;"
291 "exit;"
292 :
293 : __imm(bpf_ktime_get_ns)
294 : __clobber_all);
295 }
296
297 static __naked __noinline __used
precision_stack__foo(void)298 void precision_stack__foo(void)
299 {
300 asm volatile (
301 /* conflate one of the register numbers (r6) with outer frame,
302 * to verify that those are tracked independently
303 */
304 "*(u64*)(r10 - 8) = r1;"
305 "*(u64*)(r10 - 16) = r1;"
306 "if r1 > 7 goto +0;"
307 /* force r1 to be precise, this eventually marks:
308 * - foo frame r1,fp{-8,-16}
309 * - main frame r1,fp{-8}
310 */
311 "r2 = r10;"
312 "r2 += r1;"
313 "r0 = *(u64*)(r10 - 8);"
314 "r0 = *(u64*)(r10 - 16);"
315 "exit"
316 ::: __clobber_all);
317 }
318
319 /* Use two separate scalar IDs to check that these are propagated
320 * independently.
321 */
322 SEC("socket")
323 __success __log_level(2)
324 /* r{6,7} */
325 __msg("12: (0f) r3 += r7")
326 __msg("frame0: regs=r7 stack= before 11: (bf) r3 = r10")
327 __msg("frame0: regs=r7 stack= before 9: (25) if r7 > 0x7 goto pc+0")
328 /* ... skip some insns ... */
329 __msg("frame0: regs=r6,r7 stack= before 3: (bf) r7 = r0")
330 __msg("frame0: regs=r0,r6 stack= before 2: (bf) r6 = r0")
331 /* r{8,9} */
332 __msg("13: (0f) r3 += r9")
333 __msg("frame0: regs=r9 stack= before 12: (0f) r3 += r7")
334 /* ... skip some insns ... */
335 __msg("frame0: regs=r9 stack= before 10: (25) if r9 > 0x7 goto pc+0")
336 __msg("frame0: regs=r8,r9 stack= before 7: (bf) r9 = r0")
337 __msg("frame0: regs=r0,r8 stack= before 6: (bf) r8 = r0")
__flag(BPF_F_TEST_STATE_FREQ)338 __flag(BPF_F_TEST_STATE_FREQ)
339 __naked void precision_two_ids(void)
340 {
341 asm volatile (
342 /* r6 = random number up to 0xff
343 * r6.id == r7.id
344 */
345 "call %[bpf_ktime_get_ns];"
346 "r0 &= 0xff;"
347 "r6 = r0;"
348 "r7 = r0;"
349 /* same, but for r{8,9} */
350 "call %[bpf_ktime_get_ns];"
351 "r0 &= 0xff;"
352 "r8 = r0;"
353 "r9 = r0;"
354 /* clear r0 id */
355 "r0 = 0;"
356 /* propagate equal scalars precision */
357 "if r7 > 7 goto +0;"
358 "if r9 > 7 goto +0;"
359 "r3 = r10;"
360 /* force r7 to be precise, this also marks r6 */
361 "r3 += r7;"
362 /* force r9 to be precise, this also marks r8 */
363 "r3 += r9;"
364 "r6 = r6;" /* mark r6 as live */
365 "r8 = r8;" /* mark r8 as live */
366 "exit;"
367 :
368 : __imm(bpf_ktime_get_ns)
369 : __clobber_all);
370 }
371
372 SEC("socket")
373 __success __log_level(2)
__flag(BPF_F_TEST_STATE_FREQ)374 __flag(BPF_F_TEST_STATE_FREQ)
375 /* check that r0 and r6 have different IDs after 'if',
376 * collect_linked_regs() can't tie more than 6 registers for a single insn.
377 */
378 __msg("8: (25) if r0 > 0x7 goto pc+0 ; R0=scalar(id=1")
379 __msg("14: (bf) r6 = r6 ; R6=scalar(id=2")
380 /* check that r{0-5} are marked precise after 'if' */
381 __msg("frame0: regs=r0 stack= before 8: (25) if r0 > 0x7 goto pc+0")
382 __msg("frame0: parent state regs=r0,r1,r2,r3,r4,r5 stack=:")
383 __naked void linked_regs_too_many_regs(void)
384 {
385 asm volatile (
386 /* r0 = random number up to 0xff */
387 "call %[bpf_ktime_get_ns];"
388 "r0 &= 0xff;"
389 /* tie r{0-6} IDs */
390 "r1 = r0;"
391 "r2 = r0;"
392 "r3 = r0;"
393 "r4 = r0;"
394 "r5 = r0;"
395 "r6 = r0;"
396 /* propagate range for r{0-6} */
397 "if r0 > 7 goto +0;"
398 /* keep r{1-5} live */
399 "r1 = r1;"
400 "r2 = r2;"
401 "r3 = r3;"
402 "r4 = r4;"
403 "r5 = r5;"
404 /* make r6 appear in the log */
405 "r6 = r6;"
406 /* force r0 to be precise,
407 * this would cause r{0-4} to be precise because of shared IDs
408 */
409 "r7 = r10;"
410 "r7 += r0;"
411 "r0 = 0;"
412 "exit;"
413 :
414 : __imm(bpf_ktime_get_ns)
415 : __clobber_all);
416 }
417
418 SEC("socket")
419 __failure __log_level(2)
__flag(BPF_F_TEST_STATE_FREQ)420 __flag(BPF_F_TEST_STATE_FREQ)
421 __msg("regs=r7 stack= before 5: (3d) if r8 >= r0")
422 __msg("parent state regs=r0,r7,r8")
423 __msg("regs=r0,r7,r8 stack= before 4: (25) if r0 > 0x1")
424 __msg("div by zero")
425 __naked void linked_regs_broken_link_2(void)
426 {
427 asm volatile (
428 "call %[bpf_get_prandom_u32];"
429 "r7 = r0;"
430 "r8 = r0;"
431 "call %[bpf_get_prandom_u32];"
432 "if r0 > 1 goto +0;"
433 /* r7.id == r8.id,
434 * thus r7 precision implies r8 precision,
435 * which implies r0 precision because of the conditional below.
436 */
437 "if r8 >= r0 goto 1f;"
438 /* break id relation between r7 and r8 */
439 "r8 += r8;"
440 /* make r7 precise */
441 "if r7 == 0 goto 1f;"
442 "r0 /= 0;"
443 "1:"
444 "r0 = 42;"
445 "exit;"
446 :
447 : __imm(bpf_get_prandom_u32)
448 : __clobber_all);
449 }
450
451 /* Check that mark_chain_precision() for one of the conditional jump
452 * operands does not trigger equal scalars precision propagation.
453 */
454 SEC("socket")
455 __success __log_level(2)
456 __msg("3: (25) if r1 > 0x100 goto pc+0")
457 __msg("frame0: regs=r1 stack= before 2: (bf) r1 = r0")
cjmp_no_linked_regs_trigger(void)458 __naked void cjmp_no_linked_regs_trigger(void)
459 {
460 asm volatile (
461 /* r0 = random number up to 0xff */
462 "call %[bpf_ktime_get_ns];"
463 "r0 &= 0xff;"
464 /* tie r0.id == r1.id */
465 "r1 = r0;"
466 /* the jump below would be predicted, thus r1 would be marked precise,
467 * this should not imply precision mark for r0
468 */
469 "if r1 > 256 goto +0;"
470 "r0 = 0;"
471 "exit;"
472 :
473 : __imm(bpf_ktime_get_ns)
474 : __clobber_all);
475 }
476
477 /* Verify that check_ids() is used by regsafe() for scalars.
478 *
479 * r9 = ... some pointer with range X ...
480 * r6 = ... unbound scalar ID=a ...
481 * r7 = ... unbound scalar ID=b ...
482 * if (r6 > r7) goto +1
483 * r7 = r6
484 * if (r7 > X) goto exit
485 * r9 += r6
486 * ... access memory using r9 ...
487 *
488 * The memory access is safe only if r7 is bounded,
489 * which is true for one branch and not true for another.
490 */
491 SEC("socket")
492 __failure __msg("register with unbounded min value")
__flag(BPF_F_TEST_STATE_FREQ)493 __flag(BPF_F_TEST_STATE_FREQ)
494 __naked void check_ids_in_regsafe(void)
495 {
496 asm volatile (
497 /* Bump allocated stack */
498 "r1 = 0;"
499 "*(u64*)(r10 - 8) = r1;"
500 /* r9 = pointer to stack */
501 "r9 = r10;"
502 "r9 += -8;"
503 /* r7 = ktime_get_ns() */
504 "call %[bpf_ktime_get_ns];"
505 "r7 = r0;"
506 /* r6 = ktime_get_ns() */
507 "call %[bpf_ktime_get_ns];"
508 "r6 = r0;"
509 /* if r6 > r7 is an unpredictable jump */
510 "if r6 > r7 goto l1_%=;"
511 "r7 = r6;"
512 "l1_%=:"
513 /* if r7 > 4 ...; transfers range to r6 on one execution path
514 * but does not transfer on another
515 */
516 "if r7 > 4 goto l2_%=;"
517 /* Access memory at r9[r6], r6 is not always bounded */
518 "r9 += r6;"
519 "r0 = *(u8*)(r9 + 0);"
520 "l2_%=:"
521 "r0 = 0;"
522 "exit;"
523 :
524 : __imm(bpf_ktime_get_ns)
525 : __clobber_all);
526 }
527
528 /* Similar to check_ids_in_regsafe.
529 * The l0 could be reached in two states:
530 *
531 * (1) r6{.id=A}, r7{.id=A}, r8{.id=B}
532 * (2) r6{.id=B}, r7{.id=A}, r8{.id=B}
533 *
534 * Where (2) is not safe, as "r7 > 4" check won't propagate range for it.
535 * This example would be considered safe without changes to
536 * mark_chain_precision() to track scalar values with equal IDs.
537 */
538 SEC("socket")
539 __failure __msg("register with unbounded min value")
__flag(BPF_F_TEST_STATE_FREQ)540 __flag(BPF_F_TEST_STATE_FREQ)
541 __naked void check_ids_in_regsafe_2(void)
542 {
543 asm volatile (
544 /* Bump allocated stack */
545 "r1 = 0;"
546 "*(u64*)(r10 - 8) = r1;"
547 /* r9 = pointer to stack */
548 "r9 = r10;"
549 "r9 += -16;"
550 /* r8 = ktime_get_ns() */
551 "call %[bpf_ktime_get_ns];"
552 "r8 = r0;"
553 /* r7 = ktime_get_ns() */
554 "call %[bpf_ktime_get_ns];"
555 "r7 = r0;"
556 /* r6 = ktime_get_ns() */
557 "call %[bpf_ktime_get_ns];"
558 "r6 = r0;"
559 /* scratch .id from r0 */
560 "r0 = 0;"
561 /* if r6 > r7 is an unpredictable jump */
562 "if r6 > r7 goto l1_%=;"
563 /* tie r6 and r7 .id */
564 "r6 = r7;"
565 "l0_%=:"
566 /* if r7 > 4 exit(0) */
567 "if r7 > 4 goto l2_%=;"
568 /* Access memory at r9[r6] */
569 "r9 += r6;"
570 "r9 += r7;"
571 "r9 += r8;"
572 "r0 = *(u8*)(r9 + 0);"
573 "l2_%=:"
574 "r0 = 0;"
575 "exit;"
576 "l1_%=:"
577 /* tie r6 and r8 .id */
578 "r6 = r8;"
579 "goto l0_%=;"
580 :
581 : __imm(bpf_ktime_get_ns)
582 : __clobber_all);
583 }
584
585 /* Check that scalar IDs *are not* generated on register to register
586 * assignments if source register is a constant.
587 *
588 * If such IDs *are* generated the 'l1' below would be reached in
589 * two states:
590 *
591 * (1) r1{.id=A}, r2{.id=A}
592 * (2) r1{.id=C}, r2{.id=C}
593 *
594 * Thus forcing 'if r1 == r2' verification twice.
595 */
596 SEC("socket")
597 __success __log_level(2)
598 __msg("14: (1d) if r3 == r4 goto pc+0")
599 __msg("frame 0: propagating r3,r4")
600 __msg("14: safe")
601 __msg("processed 18 insns")
__flag(BPF_F_TEST_STATE_FREQ)602 __flag(BPF_F_TEST_STATE_FREQ)
603 __naked void no_scalar_id_for_const(void)
604 {
605 asm volatile (
606 "call %[bpf_ktime_get_ns];"
607 /* unpredictable jump */
608 "if r0 > 7 goto l0_%=;"
609 /* possibly generate same scalar ids for r3 and r4 */
610 "r1 = 0;"
611 "r1 ^= r1;" /* prevent bpf_prune_dead_branches from folding the branch */
612 "r1 = r1;"
613 "r3 = r1;"
614 "r4 = r1;"
615 "goto l1_%=;"
616 "l0_%=:"
617 /* possibly generate different scalar ids for r3 and r4 */
618 "r1 = 0;"
619 "r1 ^= r1;"
620 "r2 = 0;"
621 "r2 ^= r2;"
622 "r3 = r1;"
623 "r4 = r2;"
624 "l1_%=:"
625 /* predictable jump, marks r3 and r4 precise */
626 "if r3 == r4 goto +0;"
627 "r0 = 0;"
628 "exit;"
629 :
630 : __imm(bpf_ktime_get_ns)
631 : __clobber_all);
632 }
633
634 /* Same as no_scalar_id_for_const() but for 32-bit values */
635 SEC("socket")
636 __success __log_level(2)
637 __msg("14: (1e) if w3 == w4 goto pc+0")
638 __msg("frame 0: propagating r3,r4")
639 __msg("14: safe")
640 __msg("processed 18 insns")
__flag(BPF_F_TEST_STATE_FREQ)641 __flag(BPF_F_TEST_STATE_FREQ)
642 __naked void no_scalar_id_for_const32(void)
643 {
644 asm volatile (
645 "call %[bpf_ktime_get_ns];"
646 /* unpredictable jump */
647 "if r0 > 7 goto l0_%=;"
648 /* possibly generate same scalar ids for r3 and r4 */
649 "w1 = 0;"
650 "w1 ^= w1;" /* prevent bpf_prune_dead_branches from folding the branch */
651 "w1 = w1;"
652 "w3 = w1;"
653 "w4 = w1;"
654 "goto l1_%=;"
655 "l0_%=:"
656 /* possibly generate different scalar ids for r3 and r4 */
657 "w1 = 0;"
658 "w1 ^= w1;"
659 "w2 = 0;"
660 "w2 ^= w2;"
661 "w3 = w1;"
662 "w4 = w2;"
663 "l1_%=:"
664 /* predictable jump, marks r3 and r4 precise */
665 "if w3 == w4 goto +0;"
666 "r0 = 0;"
667 "exit;"
668 :
669 : __imm(bpf_ktime_get_ns)
670 : __clobber_all);
671 }
672
673 /* Check that unique scalar IDs are ignored when new verifier state is
674 * compared to cached verifier state. For this test:
675 * - cached state has no id on r1
676 * - new state has a unique id on r1
677 */
678 SEC("socket")
679 __success __log_level(2)
680 __msg("6: (25) if r6 > 0x7 goto pc+1")
681 __msg("7: (57) r1 &= 255")
682 __msg("8: (bf) r2 = r10")
683 __msg("from 6 to 8: safe")
684 __msg("processed 12 insns")
__flag(BPF_F_TEST_STATE_FREQ)685 __flag(BPF_F_TEST_STATE_FREQ)
686 __naked void ignore_unique_scalar_ids_cur(void)
687 {
688 asm volatile (
689 "call %[bpf_ktime_get_ns];"
690 "r6 = r0;"
691 "call %[bpf_ktime_get_ns];"
692 "r0 &= 0xff;"
693 /* r1.id == r0.id */
694 "r1 = r0;"
695 /* make r1.id unique */
696 "r0 = 0;"
697 "if r6 > 7 goto l0_%=;"
698 /* clear r1 id, but keep the range compatible */
699 "r1 &= 0xff;"
700 "l0_%=:"
701 /* get here in two states:
702 * - first: r1 has no id (cached state)
703 * - second: r1 has a unique id (should be considered equivalent)
704 */
705 "r2 = r10;"
706 "r2 += r1;"
707 "exit;"
708 :
709 : __imm(bpf_ktime_get_ns)
710 : __clobber_all);
711 }
712
713 /* Check that unique scalar IDs are ignored when new verifier state is
714 * compared to cached verifier state. For this test:
715 * - cached state has a unique id on r1
716 * - new state has no id on r1
717 */
718 SEC("socket")
719 __success __log_level(2)
720 __msg("6: (25) if r6 > 0x7 goto pc+1")
721 __msg("7: (05) goto pc+1")
722 __msg("9: (bf) r2 = r10")
723 __msg("9: safe")
724 __msg("processed 13 insns")
__flag(BPF_F_TEST_STATE_FREQ)725 __flag(BPF_F_TEST_STATE_FREQ)
726 __naked void ignore_unique_scalar_ids_old(void)
727 {
728 asm volatile (
729 "call %[bpf_ktime_get_ns];"
730 "r6 = r0;"
731 "call %[bpf_ktime_get_ns];"
732 "r0 &= 0xff;"
733 /* r1.id == r0.id */
734 "r1 = r0;"
735 /* make r1.id unique */
736 "r0 = 0;"
737 "if r6 > 7 goto l1_%=;"
738 "goto l0_%=;"
739 "l1_%=:"
740 /* clear r1 id, but keep the range compatible */
741 "r1 &= 0xff;"
742 "l0_%=:"
743 /* get here in two states:
744 * - first: r1 has a unique id (cached state)
745 * - second: r1 has no id (should be considered equivalent)
746 */
747 "r2 = r10;"
748 "r2 += r1;"
749 "exit;"
750 :
751 : __imm(bpf_ktime_get_ns)
752 : __clobber_all);
753 }
754
755 /* Check that two registers with 0 scalar IDs in a verified state can be mapped
756 * to the same scalar ID in current state.
757 */
758 SEC("socket")
759 __success __log_level(2)
760 /* The states should be equivalent on reaching insn 12.
761 */
762 __msg("12: safe")
763 __msg("processed 17 insns")
__flag(BPF_F_TEST_STATE_FREQ)764 __flag(BPF_F_TEST_STATE_FREQ)
765 __naked void two_nil_old_ids_one_cur_id(void)
766 {
767 asm volatile (
768 /* Give unique scalar IDs to r{6,7} */
769 "call %[bpf_ktime_get_ns];"
770 "r0 &= 0xff;"
771 "r6 = r0;"
772 "r6 *= 1;"
773 "call %[bpf_ktime_get_ns];"
774 "r0 &= 0xff;"
775 "r7 = r0;"
776 "r7 *= 1;"
777 "r0 = 0;"
778 /* Maybe make r{6,7} IDs identical */
779 "if r6 > r7 goto l0_%=;"
780 "goto l1_%=;"
781 "l0_%=:"
782 "r6 = r7;"
783 "l1_%=:"
784 /* Mark r{6,7} precise.
785 * Get here in two states:
786 * - first: r6{.id=0}, r7{.id=0} (cached state)
787 * - second: r6{.id=A}, r7{.id=A}
788 * Verifier considers such states equivalent.
789 * Thus "exit;" would be verified only once.
790 */
791 "r2 = r10;"
792 "r2 += r6;"
793 "r2 += r7;"
794 "exit;"
795 :
796 : __imm(bpf_ktime_get_ns)
797 : __clobber_all);
798 }
799
800 /* Check that two different scalar IDs in a verified state can't be
801 * mapped to the same scalar ID in current state.
802 */
803 SEC("socket")
804 __success __log_level(2)
805 /* The exit instruction should be reachable from two states,
806 * use two matches and "processed .. insns" to ensure this.
807 */
808 __msg("16: (95) exit")
809 __msg("16: (95) exit")
810 __msg("processed 22 insns")
__flag(BPF_F_TEST_STATE_FREQ)811 __flag(BPF_F_TEST_STATE_FREQ)
812 __naked void two_old_ids_one_cur_id(void)
813 {
814 asm volatile (
815 /* Give unique scalar IDs to r{6,7} */
816 "call %[bpf_ktime_get_ns];"
817 "r0 &= 0xff;"
818 "r6 = r0;"
819 "r8 = r0;"
820 "call %[bpf_ktime_get_ns];"
821 "r0 &= 0xff;"
822 "r7 = r0;"
823 "r9 = r0;"
824 "r0 = 0;"
825 /* Maybe make r{6,7} IDs identical */
826 "if r6 > r7 goto l0_%=;"
827 "goto l1_%=;"
828 "l0_%=:"
829 "r6 = r7;"
830 "l1_%=:"
831 /* Mark r{6,7} precise.
832 * Get here in two states:
833 * - first: r6{.id=A}, r7{.id=B} (cached state)
834 * - second: r6{.id=A}, r7{.id=A}
835 * Currently we don't want to consider such states equivalent.
836 * Thus "exit;" would be verified twice.
837 */
838 "r2 = r10;"
839 "r2 += r6;"
840 "r2 += r7;"
841 /*
842 * keep r8 and r9 live, otherwise r6->id and r7->id
843 * will become singular and reset to zero before if r6 > r7
844 */
845 "r9 += r8;"
846 "exit;"
847 :
848 : __imm(bpf_ktime_get_ns)
849 : __clobber_all);
850 }
851
852 SEC("socket")
853 /* Note the flag, see verifier.c:opt_subreg_zext_lo32_rnd_hi32() */
__flag(BPF_F_TEST_RND_HI32)854 __flag(BPF_F_TEST_RND_HI32)
855 __success
856 /* This test was added because of a bug in verifier.c:sync_linked_regs(),
857 * upon range propagation it destroyed subreg_def marks for registers.
858 * The subreg_def mark is used to decide whether zero extension instructions
859 * are needed when register is read. When BPF_F_TEST_RND_HI32 is set it
860 * also causes generation of statements to randomize upper halves of
861 * read registers.
862 *
863 * The test is written in a way to return an upper half of a register
864 * that is affected by range propagation and must have it's subreg_def
865 * preserved. This gives a return value of 0 and leads to undefined
866 * return value if subreg_def mark is not preserved.
867 */
868 __retval(0)
869 /* Check that verifier believes r1/r0 are zero at exit */
870 __log_level(2)
871 __msg("4: (77) r1 >>= 32 ; R1=0")
872 __msg("5: (bf) r0 = r1 ; R0=0 R1=0")
873 __msg("6: (95) exit")
874 __msg("from 3 to 4")
875 __msg("4: (77) r1 >>= 32 ; R1=0")
876 __msg("5: (bf) r0 = r1 ; R0=0 R1=0")
877 __msg("6: (95) exit")
878 /* Verify that statements to randomize upper half of r1 had not been
879 * generated.
880 */
881 __xlated("call unknown")
882 __xlated("r0 &= 2147483647")
883 __xlated("w1 = w0")
884 /* This is how disasm.c prints BPF_ZEXT_REG at the moment, x86 and arm
885 * are the only CI archs that do not need zero extension for subregs.
886 */
887 #if !defined(__TARGET_ARCH_x86) && !defined(__TARGET_ARCH_arm64)
888 __xlated("w1 = w1")
889 #endif
890 __xlated("if w0 < 0xa goto pc+0")
891 __xlated("r1 >>= 32")
892 __xlated("r0 = r1")
893 __xlated("exit")
894 __naked void linked_regs_and_subreg_def(void)
895 {
896 asm volatile (
897 "call %[bpf_ktime_get_ns];"
898 /* make sure r0 is in 32-bit range, otherwise w1 = w0 won't
899 * assign same IDs to registers.
900 */
901 "r0 &= 0x7fffffff;"
902 /* link w1 and w0 via ID */
903 "w1 = w0;"
904 /* 'if' statement propagates range info from w0 to w1,
905 * but should not affect w1->subreg_def property.
906 */
907 "if w0 < 10 goto +0;"
908 /* r1 is read here, on archs that require subreg zero
909 * extension this would cause zext patch generation.
910 */
911 "r1 >>= 32;"
912 "r0 = r1;"
913 "exit;"
914 :
915 : __imm(bpf_ktime_get_ns)
916 : __clobber_all);
917 }
918
919 char _license[] SEC("license") = "GPL";
920