Home Explore Help
Register Sign In
Aarav90-cpu
/
ARK-OS
1
0
Fork 0
Files Issues 0 Wiki
Tree: 96be7c1dab
Branches Tags
ARK-OS
/
arkos
/
kernel
/
tools
/
testing
/
selftests
/
bpf
/
verifier
/
atomic_fetch.c

atomic_fetch.c 6.5 KB
History Raw

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151 
  1. {
    2. 

  2. 	"atomic dw/fetch and address leakage of (map ptr & -1) via stack slot",
    3. 

  3. 	.insns = {
    4. 

  4. 		BPF_LD_IMM64(BPF_REG_1, -1),
    5. 

  5. 		BPF_LD_MAP_FD(BPF_REG_8, 0),
    6. 

  6. 		BPF_LD_MAP_FD(BPF_REG_9, 0),
    7. 

  7. 		BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
    8. 

  8. 		BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
    9. 

  9. 		BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_9, 0),
    10. 

  10. 		BPF_ATOMIC_OP(BPF_DW, BPF_AND | BPF_FETCH, BPF_REG_2, BPF_REG_1, 0),
    11. 

  11. 		BPF_LDX_MEM(BPF_DW, BPF_REG_9, BPF_REG_2, 0),
    12. 

  12. 		BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
    13. 

  13. 		BPF_MOV64_REG(BPF_REG_1, BPF_REG_8),
    14. 

  14. 		BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
    15. 

  15. 		BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
    16. 

  16. 		BPF_STX_MEM(BPF_DW, BPF_REG_0, BPF_REG_9, 0),
    17. 

  17. 		BPF_MOV64_IMM(BPF_REG_0, 0),
    18. 

  18. 		BPF_EXIT_INSN(),
    19. 

  19. 	},
    20. 

  20. 	.fixup_map_array_48b = { 2, 4 },
    21. 

  21. 	.result = ACCEPT,
    22. 

  22. 	.result_unpriv = REJECT,
    23. 

  23. 	.errstr_unpriv = "leaking pointer from stack off -8",
    24. 

  24. },
    25. 

  25. {
    26. 

  26. 	"atomic dw/fetch and address leakage of (map ptr & -1) via returned value",
    27. 

  27. 	.insns = {
    28. 

  28. 		BPF_LD_IMM64(BPF_REG_1, -1),
    29. 

  29. 		BPF_LD_MAP_FD(BPF_REG_8, 0),
    30. 

  30. 		BPF_LD_MAP_FD(BPF_REG_9, 0),
    31. 

  31. 		BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
    32. 

  32. 		BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
    33. 

  33. 		BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_9, 0),
    34. 

  34. 		BPF_ATOMIC_OP(BPF_DW, BPF_AND | BPF_FETCH, BPF_REG_2, BPF_REG_1, 0),
    35. 

  35. 		BPF_MOV64_REG(BPF_REG_9, BPF_REG_1),
    36. 

  36. 		BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
    37. 

  37. 		BPF_MOV64_REG(BPF_REG_1, BPF_REG_8),
    38. 

  38. 		BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
    39. 

  39. 		BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
    40. 

  40. 		BPF_STX_MEM(BPF_DW, BPF_REG_0, BPF_REG_9, 0),
    41. 

  41. 		BPF_MOV64_IMM(BPF_REG_0, 0),
    42. 

  42. 		BPF_EXIT_INSN(),
    43. 

  43. 	},
    44. 

  44. 	.fixup_map_array_48b = { 2, 4 },
    45. 

  45. 	.result = ACCEPT,
    46. 

  46. 	.result_unpriv = REJECT,
    47. 

  47. 	.errstr_unpriv = "leaking pointer from stack off -8",
    48. 

  48. },
    49. 

  49. {
    50. 

  50. 	"atomic w/fetch and address leakage of (map ptr & -1) via stack slot",
    51. 

  51. 	.insns = {
    52. 

  52. 		BPF_LD_IMM64(BPF_REG_1, -1),
    53. 

  53. 		BPF_LD_MAP_FD(BPF_REG_8, 0),
    54. 

  54. 		BPF_LD_MAP_FD(BPF_REG_9, 0),
    55. 

  55. 		BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
    56. 

  56. 		BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
    57. 

  57. 		BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_9, 0),
    58. 

  58. 		BPF_ATOMIC_OP(BPF_W, BPF_AND | BPF_FETCH, BPF_REG_2, BPF_REG_1, 0),
    59. 

  59. 		BPF_LDX_MEM(BPF_DW, BPF_REG_9, BPF_REG_2, 0),
    60. 

  60. 		BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
    61. 

  61. 		BPF_MOV64_REG(BPF_REG_1, BPF_REG_8),
    62. 

  62. 		BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
    63. 

  63. 		BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
    64. 

  64. 		BPF_STX_MEM(BPF_DW, BPF_REG_0, BPF_REG_9, 0),
    65. 

  65. 		BPF_MOV64_IMM(BPF_REG_0, 0),
    66. 

  66. 		BPF_EXIT_INSN(),
    67. 

  67. 	},
    68. 

  68. 	.fixup_map_array_48b = { 2, 4 },
    69. 

  69. 	.result = REJECT,
    70. 

  70. 	.errstr = "invalid size of register fill",
    71. 

  71. },
    72. 

  72. {
    73. 

  73. 	"atomic w/fetch and address leakage of (map ptr & -1) via returned value",
    74. 

  74. 	.insns = {
    75. 

  75. 		BPF_LD_IMM64(BPF_REG_1, -1),
    76. 

  76. 		BPF_LD_MAP_FD(BPF_REG_8, 0),
    77. 

  77. 		BPF_LD_MAP_FD(BPF_REG_9, 0),
    78. 

  78. 		BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
    79. 

  79. 		BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
    80. 

  80. 		BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_9, 0),
    81. 

  81. 		BPF_ATOMIC_OP(BPF_W, BPF_AND | BPF_FETCH, BPF_REG_2, BPF_REG_1, 0),
    82. 

  82. 		BPF_MOV64_REG(BPF_REG_9, BPF_REG_1),
    83. 

  83. 		BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
    84. 

  84. 		BPF_MOV64_REG(BPF_REG_1, BPF_REG_8),
    85. 

  85. 		BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
    86. 

  86. 		BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
    87. 

  87. 		BPF_STX_MEM(BPF_DW, BPF_REG_0, BPF_REG_9, 0),
    88. 

  88. 		BPF_MOV64_IMM(BPF_REG_0, 0),
    89. 

  89. 		BPF_EXIT_INSN(),
    90. 

  90. 	},
    91. 

  91. 	.fixup_map_array_48b = { 2, 4 },
    92. 

  92. 	.result = REJECT,
    93. 

  93. 	.errstr = "invalid size of register fill",
    94. 

  94. },
    95. 

  95. #define __ATOMIC_FETCH_OP_TEST(src_reg, dst_reg, operand1, op, operand2, expect) \
    96. 

  96. 	{								\
    97. 

  97. 		"atomic fetch " #op ", src=" #dst_reg " dst=" #dst_reg,	\
    98. 

  98. 		.insns = {						\
    99. 

  99. 			/* u64 val = operan1; */			\
    100. 

  100. 			BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, operand1),	\
    101. 

  101. 			/* u64 old = atomic_fetch_add(&val, operand2); */ \
    102. 

  102. 			BPF_MOV64_REG(dst_reg, BPF_REG_10),		\
    103. 

  103. 			BPF_MOV64_IMM(src_reg, operand2),		\
    104. 

  104. 			BPF_ATOMIC_OP(BPF_DW, op,			\
    105. 

  105. 				      dst_reg, src_reg, -8),		\
    106. 

  106. 			/* if (old != operand1) exit(1); */		\
    107. 

  107. 			BPF_JMP_IMM(BPF_JEQ, src_reg, operand1, 2),	\
    108. 

  108. 			BPF_MOV64_IMM(BPF_REG_0, 1),			\
    109. 

  109. 			BPF_EXIT_INSN(),				\
    110. 

  110. 			/* if (val != result) exit (2); */		\
    111. 

  111. 			BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -8),	\
    112. 

  112. 			BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, expect, 2),	\
    113. 

  113. 			BPF_MOV64_IMM(BPF_REG_0, 2),			\
    114. 

  114. 			BPF_EXIT_INSN(),				\
    115. 

  115. 			/* exit(0); */					\
    116. 

  116. 			BPF_MOV64_IMM(BPF_REG_0, 0),			\
    117. 

  117. 			BPF_EXIT_INSN(),				\
    118. 

  118. 		},							\
    119. 

  119. 		.result = ACCEPT,					\
    120. 

  120. 	}
    121. 

  121. __ATOMIC_FETCH_OP_TEST(BPF_REG_1, BPF_REG_2, 1, BPF_ADD | BPF_FETCH, 2, 3),
    122. 

  122. __ATOMIC_FETCH_OP_TEST(BPF_REG_0, BPF_REG_1, 1, BPF_ADD | BPF_FETCH, 2, 3),
    123. 

  123. __ATOMIC_FETCH_OP_TEST(BPF_REG_1, BPF_REG_0, 1, BPF_ADD | BPF_FETCH, 2, 3),
    124. 

  124. __ATOMIC_FETCH_OP_TEST(BPF_REG_2, BPF_REG_3, 1, BPF_ADD | BPF_FETCH, 2, 3),
    125. 

  125. __ATOMIC_FETCH_OP_TEST(BPF_REG_4, BPF_REG_5, 1, BPF_ADD | BPF_FETCH, 2, 3),
    126. 

  126. __ATOMIC_FETCH_OP_TEST(BPF_REG_9, BPF_REG_8, 1, BPF_ADD | BPF_FETCH, 2, 3),
    127. 

  127. __ATOMIC_FETCH_OP_TEST(BPF_REG_1, BPF_REG_2, 0x010, BPF_AND | BPF_FETCH, 0x011, 0x010),
    128. 

  128. __ATOMIC_FETCH_OP_TEST(BPF_REG_0, BPF_REG_1, 0x010, BPF_AND | BPF_FETCH, 0x011, 0x010),
    129. 

  129. __ATOMIC_FETCH_OP_TEST(BPF_REG_1, BPF_REG_0, 0x010, BPF_AND | BPF_FETCH, 0x011, 0x010),
    130. 

  130. __ATOMIC_FETCH_OP_TEST(BPF_REG_2, BPF_REG_3, 0x010, BPF_AND | BPF_FETCH, 0x011, 0x010),
    131. 

  131. __ATOMIC_FETCH_OP_TEST(BPF_REG_4, BPF_REG_5, 0x010, BPF_AND | BPF_FETCH, 0x011, 0x010),
    132. 

  132. __ATOMIC_FETCH_OP_TEST(BPF_REG_9, BPF_REG_8, 0x010, BPF_AND | BPF_FETCH, 0x011, 0x010),
    133. 

  133. __ATOMIC_FETCH_OP_TEST(BPF_REG_1, BPF_REG_2, 0x010, BPF_OR | BPF_FETCH, 0x011, 0x011),
    134. 

  134. __ATOMIC_FETCH_OP_TEST(BPF_REG_0, BPF_REG_1, 0x010, BPF_OR | BPF_FETCH, 0x011, 0x011),
    135. 

  135. __ATOMIC_FETCH_OP_TEST(BPF_REG_1, BPF_REG_0, 0x010, BPF_OR | BPF_FETCH, 0x011, 0x011),
    136. 

  136. __ATOMIC_FETCH_OP_TEST(BPF_REG_2, BPF_REG_3, 0x010, BPF_OR | BPF_FETCH, 0x011, 0x011),
    137. 

  137. __ATOMIC_FETCH_OP_TEST(BPF_REG_4, BPF_REG_5, 0x010, BPF_OR | BPF_FETCH, 0x011, 0x011),
    138. 

  138. __ATOMIC_FETCH_OP_TEST(BPF_REG_9, BPF_REG_8, 0x010, BPF_OR | BPF_FETCH, 0x011, 0x011),
    139. 

  139. __ATOMIC_FETCH_OP_TEST(BPF_REG_1, BPF_REG_2, 0x010, BPF_XOR | BPF_FETCH, 0x011, 0x001),
    140. 

  140. __ATOMIC_FETCH_OP_TEST(BPF_REG_0, BPF_REG_1, 0x010, BPF_XOR | BPF_FETCH, 0x011, 0x001),
    141. 

  141. __ATOMIC_FETCH_OP_TEST(BPF_REG_1, BPF_REG_0, 0x010, BPF_XOR | BPF_FETCH, 0x011, 0x001),
    142. 

  142. __ATOMIC_FETCH_OP_TEST(BPF_REG_2, BPF_REG_3, 0x010, BPF_XOR | BPF_FETCH, 0x011, 0x001),
    143. 

  143. __ATOMIC_FETCH_OP_TEST(BPF_REG_4, BPF_REG_5, 0x010, BPF_XOR | BPF_FETCH, 0x011, 0x001),
    144. 

  144. __ATOMIC_FETCH_OP_TEST(BPF_REG_9, BPF_REG_8, 0x010, BPF_XOR | BPF_FETCH, 0x011, 0x001),
    145. 

  145. __ATOMIC_FETCH_OP_TEST(BPF_REG_1, BPF_REG_2, 0x010, BPF_XCHG, 0x011, 0x011),
    146. 

  146. __ATOMIC_FETCH_OP_TEST(BPF_REG_0, BPF_REG_1, 0x010, BPF_XCHG, 0x011, 0x011),
    147. 

  147. __ATOMIC_FETCH_OP_TEST(BPF_REG_1, BPF_REG_0, 0x010, BPF_XCHG, 0x011, 0x011),
    148. 

  148. __ATOMIC_FETCH_OP_TEST(BPF_REG_2, BPF_REG_3, 0x010, BPF_XCHG, 0x011, 0x011),
    149. 

  149. __ATOMIC_FETCH_OP_TEST(BPF_REG_4, BPF_REG_5, 0x010, BPF_XCHG, 0x011, 0x011),
    150. 

  150. __ATOMIC_FETCH_OP_TEST(BPF_REG_9, BPF_REG_8, 0x010, BPF_XCHG, 0x011, 0x011),
    151. 

  151. #undef __ATOMIC_FETCH_OP_TEST
    152.