18c2ecf20Sopenharmony_ci{ 28c2ecf20Sopenharmony_ci "valid map access into an array with a constant", 38c2ecf20Sopenharmony_ci .insns = { 48c2ecf20Sopenharmony_ci BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0), 58c2ecf20Sopenharmony_ci BPF_MOV64_REG(BPF_REG_2, BPF_REG_10), 68c2ecf20Sopenharmony_ci BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8), 78c2ecf20Sopenharmony_ci BPF_LD_MAP_FD(BPF_REG_1, 0), 88c2ecf20Sopenharmony_ci BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem), 98c2ecf20Sopenharmony_ci BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1), 108c2ecf20Sopenharmony_ci BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, offsetof(struct test_val, foo)), 118c2ecf20Sopenharmony_ci BPF_EXIT_INSN(), 128c2ecf20Sopenharmony_ci }, 138c2ecf20Sopenharmony_ci .fixup_map_hash_48b = { 3 }, 148c2ecf20Sopenharmony_ci .errstr_unpriv = "R0 leaks addr", 158c2ecf20Sopenharmony_ci .result_unpriv = REJECT, 168c2ecf20Sopenharmony_ci .result = ACCEPT, 178c2ecf20Sopenharmony_ci}, 188c2ecf20Sopenharmony_ci{ 198c2ecf20Sopenharmony_ci "valid map access into an array with a register", 208c2ecf20Sopenharmony_ci .insns = { 218c2ecf20Sopenharmony_ci BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0), 228c2ecf20Sopenharmony_ci BPF_MOV64_REG(BPF_REG_2, BPF_REG_10), 238c2ecf20Sopenharmony_ci BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8), 248c2ecf20Sopenharmony_ci BPF_LD_MAP_FD(BPF_REG_1, 0), 258c2ecf20Sopenharmony_ci BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem), 268c2ecf20Sopenharmony_ci BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4), 278c2ecf20Sopenharmony_ci BPF_MOV64_IMM(BPF_REG_1, 4), 288c2ecf20Sopenharmony_ci BPF_ALU64_IMM(BPF_LSH, BPF_REG_1, 2), 298c2ecf20Sopenharmony_ci BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1), 308c2ecf20Sopenharmony_ci BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, offsetof(struct test_val, foo)), 318c2ecf20Sopenharmony_ci BPF_EXIT_INSN(), 328c2ecf20Sopenharmony_ci }, 338c2ecf20Sopenharmony_ci .fixup_map_hash_48b = { 3 }, 348c2ecf20Sopenharmony_ci .errstr_unpriv = "R0 leaks addr", 358c2ecf20Sopenharmony_ci .result_unpriv = REJECT, 368c2ecf20Sopenharmony_ci .result = ACCEPT, 378c2ecf20Sopenharmony_ci .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS, 388c2ecf20Sopenharmony_ci}, 398c2ecf20Sopenharmony_ci{ 408c2ecf20Sopenharmony_ci "valid map access into an array with a variable", 418c2ecf20Sopenharmony_ci .insns = { 428c2ecf20Sopenharmony_ci BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0), 438c2ecf20Sopenharmony_ci BPF_MOV64_REG(BPF_REG_2, BPF_REG_10), 448c2ecf20Sopenharmony_ci BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8), 458c2ecf20Sopenharmony_ci BPF_LD_MAP_FD(BPF_REG_1, 0), 468c2ecf20Sopenharmony_ci BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem), 478c2ecf20Sopenharmony_ci BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5), 488c2ecf20Sopenharmony_ci BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0), 498c2ecf20Sopenharmony_ci BPF_JMP_IMM(BPF_JGE, BPF_REG_1, MAX_ENTRIES, 3), 508c2ecf20Sopenharmony_ci BPF_ALU64_IMM(BPF_LSH, BPF_REG_1, 2), 518c2ecf20Sopenharmony_ci BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1), 528c2ecf20Sopenharmony_ci BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, offsetof(struct test_val, foo)), 538c2ecf20Sopenharmony_ci BPF_EXIT_INSN(), 548c2ecf20Sopenharmony_ci }, 558c2ecf20Sopenharmony_ci .fixup_map_hash_48b = { 3 }, 568c2ecf20Sopenharmony_ci .errstr_unpriv = "R0 leaks addr", 578c2ecf20Sopenharmony_ci .result_unpriv = REJECT, 588c2ecf20Sopenharmony_ci .result = ACCEPT, 598c2ecf20Sopenharmony_ci .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS, 608c2ecf20Sopenharmony_ci}, 618c2ecf20Sopenharmony_ci{ 628c2ecf20Sopenharmony_ci "valid map access into an array with a signed variable", 638c2ecf20Sopenharmony_ci .insns = { 648c2ecf20Sopenharmony_ci BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0), 658c2ecf20Sopenharmony_ci BPF_MOV64_REG(BPF_REG_2, BPF_REG_10), 668c2ecf20Sopenharmony_ci BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8), 678c2ecf20Sopenharmony_ci BPF_LD_MAP_FD(BPF_REG_1, 0), 688c2ecf20Sopenharmony_ci BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem), 698c2ecf20Sopenharmony_ci BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9), 708c2ecf20Sopenharmony_ci BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0), 718c2ecf20Sopenharmony_ci BPF_JMP32_IMM(BPF_JSGT, BPF_REG_1, 0xffffffff, 1), 728c2ecf20Sopenharmony_ci BPF_MOV32_IMM(BPF_REG_1, 0), 738c2ecf20Sopenharmony_ci BPF_MOV32_IMM(BPF_REG_2, MAX_ENTRIES), 748c2ecf20Sopenharmony_ci BPF_JMP_REG(BPF_JSGT, BPF_REG_2, BPF_REG_1, 1), 758c2ecf20Sopenharmony_ci BPF_MOV32_IMM(BPF_REG_1, 0), 768c2ecf20Sopenharmony_ci BPF_ALU32_IMM(BPF_LSH, BPF_REG_1, 2), 778c2ecf20Sopenharmony_ci BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1), 788c2ecf20Sopenharmony_ci BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, offsetof(struct test_val, foo)), 798c2ecf20Sopenharmony_ci BPF_EXIT_INSN(), 808c2ecf20Sopenharmony_ci }, 818c2ecf20Sopenharmony_ci .fixup_map_hash_48b = { 3 }, 828c2ecf20Sopenharmony_ci .errstr_unpriv = "R0 leaks addr", 838c2ecf20Sopenharmony_ci .result_unpriv = REJECT, 848c2ecf20Sopenharmony_ci .result = ACCEPT, 858c2ecf20Sopenharmony_ci .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS, 868c2ecf20Sopenharmony_ci}, 878c2ecf20Sopenharmony_ci{ 888c2ecf20Sopenharmony_ci "invalid map access into an array with a constant", 898c2ecf20Sopenharmony_ci .insns = { 908c2ecf20Sopenharmony_ci BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0), 918c2ecf20Sopenharmony_ci BPF_MOV64_REG(BPF_REG_2, BPF_REG_10), 928c2ecf20Sopenharmony_ci BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8), 938c2ecf20Sopenharmony_ci BPF_LD_MAP_FD(BPF_REG_1, 0), 948c2ecf20Sopenharmony_ci BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem), 958c2ecf20Sopenharmony_ci BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1), 968c2ecf20Sopenharmony_ci BPF_ST_MEM(BPF_DW, BPF_REG_0, (MAX_ENTRIES + 1) << 2, 978c2ecf20Sopenharmony_ci offsetof(struct test_val, foo)), 988c2ecf20Sopenharmony_ci BPF_EXIT_INSN(), 998c2ecf20Sopenharmony_ci }, 1008c2ecf20Sopenharmony_ci .fixup_map_hash_48b = { 3 }, 1018c2ecf20Sopenharmony_ci .errstr = "invalid access to map value, value_size=48 off=48 size=8", 1028c2ecf20Sopenharmony_ci .result = REJECT, 1038c2ecf20Sopenharmony_ci}, 1048c2ecf20Sopenharmony_ci{ 1058c2ecf20Sopenharmony_ci "invalid map access into an array with a register", 1068c2ecf20Sopenharmony_ci .insns = { 1078c2ecf20Sopenharmony_ci BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0), 1088c2ecf20Sopenharmony_ci BPF_MOV64_REG(BPF_REG_2, BPF_REG_10), 1098c2ecf20Sopenharmony_ci BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8), 1108c2ecf20Sopenharmony_ci BPF_LD_MAP_FD(BPF_REG_1, 0), 1118c2ecf20Sopenharmony_ci BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem), 1128c2ecf20Sopenharmony_ci BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4), 1138c2ecf20Sopenharmony_ci BPF_MOV64_IMM(BPF_REG_1, MAX_ENTRIES + 1), 1148c2ecf20Sopenharmony_ci BPF_ALU64_IMM(BPF_LSH, BPF_REG_1, 2), 1158c2ecf20Sopenharmony_ci BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1), 1168c2ecf20Sopenharmony_ci BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, offsetof(struct test_val, foo)), 1178c2ecf20Sopenharmony_ci BPF_EXIT_INSN(), 1188c2ecf20Sopenharmony_ci }, 1198c2ecf20Sopenharmony_ci .fixup_map_hash_48b = { 3 }, 1208c2ecf20Sopenharmony_ci .errstr = "R0 min value is outside of the allowed memory range", 1218c2ecf20Sopenharmony_ci .result = REJECT, 1228c2ecf20Sopenharmony_ci .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS, 1238c2ecf20Sopenharmony_ci}, 1248c2ecf20Sopenharmony_ci{ 1258c2ecf20Sopenharmony_ci "invalid map access into an array with a variable", 1268c2ecf20Sopenharmony_ci .insns = { 1278c2ecf20Sopenharmony_ci BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0), 1288c2ecf20Sopenharmony_ci BPF_MOV64_REG(BPF_REG_2, BPF_REG_10), 1298c2ecf20Sopenharmony_ci BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8), 1308c2ecf20Sopenharmony_ci BPF_LD_MAP_FD(BPF_REG_1, 0), 1318c2ecf20Sopenharmony_ci BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem), 1328c2ecf20Sopenharmony_ci BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4), 1338c2ecf20Sopenharmony_ci BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0), 1348c2ecf20Sopenharmony_ci BPF_ALU64_IMM(BPF_LSH, BPF_REG_1, 2), 1358c2ecf20Sopenharmony_ci BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1), 1368c2ecf20Sopenharmony_ci BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, offsetof(struct test_val, foo)), 1378c2ecf20Sopenharmony_ci BPF_EXIT_INSN(), 1388c2ecf20Sopenharmony_ci }, 1398c2ecf20Sopenharmony_ci .fixup_map_hash_48b = { 3 }, 1408c2ecf20Sopenharmony_ci .errstr = "R0 unbounded memory access, make sure to bounds check any such access", 1418c2ecf20Sopenharmony_ci .result = REJECT, 1428c2ecf20Sopenharmony_ci .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS, 1438c2ecf20Sopenharmony_ci}, 1448c2ecf20Sopenharmony_ci{ 1458c2ecf20Sopenharmony_ci "invalid map access into an array with no floor check", 1468c2ecf20Sopenharmony_ci .insns = { 1478c2ecf20Sopenharmony_ci BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0), 1488c2ecf20Sopenharmony_ci BPF_MOV64_REG(BPF_REG_2, BPF_REG_10), 1498c2ecf20Sopenharmony_ci BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8), 1508c2ecf20Sopenharmony_ci BPF_LD_MAP_FD(BPF_REG_1, 0), 1518c2ecf20Sopenharmony_ci BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem), 1528c2ecf20Sopenharmony_ci BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7), 1538c2ecf20Sopenharmony_ci BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0, 0), 1548c2ecf20Sopenharmony_ci BPF_MOV32_IMM(BPF_REG_2, MAX_ENTRIES), 1558c2ecf20Sopenharmony_ci BPF_JMP_REG(BPF_JSGT, BPF_REG_2, BPF_REG_1, 1), 1568c2ecf20Sopenharmony_ci BPF_MOV32_IMM(BPF_REG_1, 0), 1578c2ecf20Sopenharmony_ci BPF_ALU32_IMM(BPF_LSH, BPF_REG_1, 2), 1588c2ecf20Sopenharmony_ci BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1), 1598c2ecf20Sopenharmony_ci BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, offsetof(struct test_val, foo)), 1608c2ecf20Sopenharmony_ci BPF_EXIT_INSN(), 1618c2ecf20Sopenharmony_ci }, 1628c2ecf20Sopenharmony_ci .fixup_map_hash_48b = { 3 }, 1638c2ecf20Sopenharmony_ci .errstr_unpriv = "R0 leaks addr", 1648c2ecf20Sopenharmony_ci .errstr = "R0 unbounded memory access", 1658c2ecf20Sopenharmony_ci .result_unpriv = REJECT, 1668c2ecf20Sopenharmony_ci .result = REJECT, 1678c2ecf20Sopenharmony_ci .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS, 1688c2ecf20Sopenharmony_ci}, 1698c2ecf20Sopenharmony_ci{ 1708c2ecf20Sopenharmony_ci "invalid map access into an array with a invalid max check", 1718c2ecf20Sopenharmony_ci .insns = { 1728c2ecf20Sopenharmony_ci BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0), 1738c2ecf20Sopenharmony_ci BPF_MOV64_REG(BPF_REG_2, BPF_REG_10), 1748c2ecf20Sopenharmony_ci BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8), 1758c2ecf20Sopenharmony_ci BPF_LD_MAP_FD(BPF_REG_1, 0), 1768c2ecf20Sopenharmony_ci BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem), 1778c2ecf20Sopenharmony_ci BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7), 1788c2ecf20Sopenharmony_ci BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0), 1798c2ecf20Sopenharmony_ci BPF_MOV32_IMM(BPF_REG_2, MAX_ENTRIES + 1), 1808c2ecf20Sopenharmony_ci BPF_JMP_REG(BPF_JGT, BPF_REG_2, BPF_REG_1, 1), 1818c2ecf20Sopenharmony_ci BPF_MOV32_IMM(BPF_REG_1, 0), 1828c2ecf20Sopenharmony_ci BPF_ALU32_IMM(BPF_LSH, BPF_REG_1, 2), 1838c2ecf20Sopenharmony_ci BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1), 1848c2ecf20Sopenharmony_ci BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, offsetof(struct test_val, foo)), 1858c2ecf20Sopenharmony_ci BPF_EXIT_INSN(), 1868c2ecf20Sopenharmony_ci }, 1878c2ecf20Sopenharmony_ci .fixup_map_hash_48b = { 3 }, 1888c2ecf20Sopenharmony_ci .errstr_unpriv = "R0 leaks addr", 1898c2ecf20Sopenharmony_ci .errstr = "invalid access to map value, value_size=48 off=44 size=8", 1908c2ecf20Sopenharmony_ci .result_unpriv = REJECT, 1918c2ecf20Sopenharmony_ci .result = REJECT, 1928c2ecf20Sopenharmony_ci .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS, 1938c2ecf20Sopenharmony_ci}, 1948c2ecf20Sopenharmony_ci{ 1958c2ecf20Sopenharmony_ci "invalid map access into an array with a invalid max check", 1968c2ecf20Sopenharmony_ci .insns = { 1978c2ecf20Sopenharmony_ci BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0), 1988c2ecf20Sopenharmony_ci BPF_MOV64_REG(BPF_REG_2, BPF_REG_10), 1998c2ecf20Sopenharmony_ci BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8), 2008c2ecf20Sopenharmony_ci BPF_LD_MAP_FD(BPF_REG_1, 0), 2018c2ecf20Sopenharmony_ci BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem), 2028c2ecf20Sopenharmony_ci BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 10), 2038c2ecf20Sopenharmony_ci BPF_MOV64_REG(BPF_REG_8, BPF_REG_0), 2048c2ecf20Sopenharmony_ci BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0), 2058c2ecf20Sopenharmony_ci BPF_MOV64_REG(BPF_REG_2, BPF_REG_10), 2068c2ecf20Sopenharmony_ci BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8), 2078c2ecf20Sopenharmony_ci BPF_LD_MAP_FD(BPF_REG_1, 0), 2088c2ecf20Sopenharmony_ci BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem), 2098c2ecf20Sopenharmony_ci BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2), 2108c2ecf20Sopenharmony_ci BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_8), 2118c2ecf20Sopenharmony_ci BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_0, 2128c2ecf20Sopenharmony_ci offsetof(struct test_val, foo)), 2138c2ecf20Sopenharmony_ci BPF_EXIT_INSN(), 2148c2ecf20Sopenharmony_ci }, 2158c2ecf20Sopenharmony_ci .fixup_map_hash_48b = { 3, 11 }, 2168c2ecf20Sopenharmony_ci .errstr = "R0 pointer += pointer", 2178c2ecf20Sopenharmony_ci .result = REJECT, 2188c2ecf20Sopenharmony_ci .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS, 2198c2ecf20Sopenharmony_ci}, 2208c2ecf20Sopenharmony_ci{ 2218c2ecf20Sopenharmony_ci "valid read map access into a read-only array 1", 2228c2ecf20Sopenharmony_ci .insns = { 2238c2ecf20Sopenharmony_ci BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0), 2248c2ecf20Sopenharmony_ci BPF_MOV64_REG(BPF_REG_2, BPF_REG_10), 2258c2ecf20Sopenharmony_ci BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8), 2268c2ecf20Sopenharmony_ci BPF_LD_MAP_FD(BPF_REG_1, 0), 2278c2ecf20Sopenharmony_ci BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem), 2288c2ecf20Sopenharmony_ci BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1), 2298c2ecf20Sopenharmony_ci BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_0, 0), 2308c2ecf20Sopenharmony_ci BPF_EXIT_INSN(), 2318c2ecf20Sopenharmony_ci }, 2328c2ecf20Sopenharmony_ci .fixup_map_array_ro = { 3 }, 2338c2ecf20Sopenharmony_ci .result = ACCEPT, 2348c2ecf20Sopenharmony_ci .retval = 28, 2358c2ecf20Sopenharmony_ci}, 2368c2ecf20Sopenharmony_ci{ 2378c2ecf20Sopenharmony_ci "valid read map access into a read-only array 2", 2388c2ecf20Sopenharmony_ci .insns = { 2398c2ecf20Sopenharmony_ci BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0), 2408c2ecf20Sopenharmony_ci BPF_MOV64_REG(BPF_REG_2, BPF_REG_10), 2418c2ecf20Sopenharmony_ci BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8), 2428c2ecf20Sopenharmony_ci BPF_LD_MAP_FD(BPF_REG_1, 0), 2438c2ecf20Sopenharmony_ci BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem), 2448c2ecf20Sopenharmony_ci BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6), 2458c2ecf20Sopenharmony_ci 2468c2ecf20Sopenharmony_ci BPF_MOV64_REG(BPF_REG_1, BPF_REG_0), 2478c2ecf20Sopenharmony_ci BPF_MOV64_IMM(BPF_REG_2, 4), 2488c2ecf20Sopenharmony_ci BPF_MOV64_IMM(BPF_REG_3, 0), 2498c2ecf20Sopenharmony_ci BPF_MOV64_IMM(BPF_REG_4, 0), 2508c2ecf20Sopenharmony_ci BPF_MOV64_IMM(BPF_REG_5, 0), 2518c2ecf20Sopenharmony_ci BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, 2528c2ecf20Sopenharmony_ci BPF_FUNC_csum_diff), 2538c2ecf20Sopenharmony_ci BPF_ALU64_IMM(BPF_AND, BPF_REG_0, 0xffff), 2548c2ecf20Sopenharmony_ci BPF_EXIT_INSN(), 2558c2ecf20Sopenharmony_ci }, 2568c2ecf20Sopenharmony_ci .prog_type = BPF_PROG_TYPE_SCHED_CLS, 2578c2ecf20Sopenharmony_ci .fixup_map_array_ro = { 3 }, 2588c2ecf20Sopenharmony_ci .result = ACCEPT, 2598c2ecf20Sopenharmony_ci .retval = 65507, 2608c2ecf20Sopenharmony_ci}, 2618c2ecf20Sopenharmony_ci{ 2628c2ecf20Sopenharmony_ci "invalid write map access into a read-only array 1", 2638c2ecf20Sopenharmony_ci .insns = { 2648c2ecf20Sopenharmony_ci BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0), 2658c2ecf20Sopenharmony_ci BPF_MOV64_REG(BPF_REG_2, BPF_REG_10), 2668c2ecf20Sopenharmony_ci BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8), 2678c2ecf20Sopenharmony_ci BPF_LD_MAP_FD(BPF_REG_1, 0), 2688c2ecf20Sopenharmony_ci BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem), 2698c2ecf20Sopenharmony_ci BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1), 2708c2ecf20Sopenharmony_ci BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 42), 2718c2ecf20Sopenharmony_ci BPF_EXIT_INSN(), 2728c2ecf20Sopenharmony_ci }, 2738c2ecf20Sopenharmony_ci .fixup_map_array_ro = { 3 }, 2748c2ecf20Sopenharmony_ci .result = REJECT, 2758c2ecf20Sopenharmony_ci .errstr = "write into map forbidden", 2768c2ecf20Sopenharmony_ci}, 2778c2ecf20Sopenharmony_ci{ 2788c2ecf20Sopenharmony_ci "invalid write map access into a read-only array 2", 2798c2ecf20Sopenharmony_ci .insns = { 2808c2ecf20Sopenharmony_ci BPF_MOV64_REG(BPF_REG_6, BPF_REG_1), 2818c2ecf20Sopenharmony_ci BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0), 2828c2ecf20Sopenharmony_ci BPF_MOV64_REG(BPF_REG_2, BPF_REG_10), 2838c2ecf20Sopenharmony_ci BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8), 2848c2ecf20Sopenharmony_ci BPF_LD_MAP_FD(BPF_REG_1, 0), 2858c2ecf20Sopenharmony_ci BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem), 2868c2ecf20Sopenharmony_ci BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5), 2878c2ecf20Sopenharmony_ci BPF_MOV64_REG(BPF_REG_1, BPF_REG_6), 2888c2ecf20Sopenharmony_ci BPF_MOV64_IMM(BPF_REG_2, 0), 2898c2ecf20Sopenharmony_ci BPF_MOV64_REG(BPF_REG_3, BPF_REG_0), 2908c2ecf20Sopenharmony_ci BPF_MOV64_IMM(BPF_REG_4, 8), 2918c2ecf20Sopenharmony_ci BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, 2928c2ecf20Sopenharmony_ci BPF_FUNC_skb_load_bytes), 2938c2ecf20Sopenharmony_ci BPF_EXIT_INSN(), 2948c2ecf20Sopenharmony_ci }, 2958c2ecf20Sopenharmony_ci .prog_type = BPF_PROG_TYPE_SCHED_CLS, 2968c2ecf20Sopenharmony_ci .fixup_map_array_ro = { 4 }, 2978c2ecf20Sopenharmony_ci .result = REJECT, 2988c2ecf20Sopenharmony_ci .errstr = "write into map forbidden", 2998c2ecf20Sopenharmony_ci}, 3008c2ecf20Sopenharmony_ci{ 3018c2ecf20Sopenharmony_ci "valid write map access into a write-only array 1", 3028c2ecf20Sopenharmony_ci .insns = { 3038c2ecf20Sopenharmony_ci BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0), 3048c2ecf20Sopenharmony_ci BPF_MOV64_REG(BPF_REG_2, BPF_REG_10), 3058c2ecf20Sopenharmony_ci BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8), 3068c2ecf20Sopenharmony_ci BPF_LD_MAP_FD(BPF_REG_1, 0), 3078c2ecf20Sopenharmony_ci BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem), 3088c2ecf20Sopenharmony_ci BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1), 3098c2ecf20Sopenharmony_ci BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 42), 3108c2ecf20Sopenharmony_ci BPF_MOV64_IMM(BPF_REG_0, 1), 3118c2ecf20Sopenharmony_ci BPF_EXIT_INSN(), 3128c2ecf20Sopenharmony_ci }, 3138c2ecf20Sopenharmony_ci .fixup_map_array_wo = { 3 }, 3148c2ecf20Sopenharmony_ci .result = ACCEPT, 3158c2ecf20Sopenharmony_ci .retval = 1, 3168c2ecf20Sopenharmony_ci}, 3178c2ecf20Sopenharmony_ci{ 3188c2ecf20Sopenharmony_ci "valid write map access into a write-only array 2", 3198c2ecf20Sopenharmony_ci .insns = { 3208c2ecf20Sopenharmony_ci BPF_MOV64_REG(BPF_REG_6, BPF_REG_1), 3218c2ecf20Sopenharmony_ci BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0), 3228c2ecf20Sopenharmony_ci BPF_MOV64_REG(BPF_REG_2, BPF_REG_10), 3238c2ecf20Sopenharmony_ci BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8), 3248c2ecf20Sopenharmony_ci BPF_LD_MAP_FD(BPF_REG_1, 0), 3258c2ecf20Sopenharmony_ci BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem), 3268c2ecf20Sopenharmony_ci BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5), 3278c2ecf20Sopenharmony_ci BPF_MOV64_REG(BPF_REG_1, BPF_REG_6), 3288c2ecf20Sopenharmony_ci BPF_MOV64_IMM(BPF_REG_2, 0), 3298c2ecf20Sopenharmony_ci BPF_MOV64_REG(BPF_REG_3, BPF_REG_0), 3308c2ecf20Sopenharmony_ci BPF_MOV64_IMM(BPF_REG_4, 8), 3318c2ecf20Sopenharmony_ci BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, 3328c2ecf20Sopenharmony_ci BPF_FUNC_skb_load_bytes), 3338c2ecf20Sopenharmony_ci BPF_EXIT_INSN(), 3348c2ecf20Sopenharmony_ci }, 3358c2ecf20Sopenharmony_ci .prog_type = BPF_PROG_TYPE_SCHED_CLS, 3368c2ecf20Sopenharmony_ci .fixup_map_array_wo = { 4 }, 3378c2ecf20Sopenharmony_ci .result = ACCEPT, 3388c2ecf20Sopenharmony_ci .retval = 0, 3398c2ecf20Sopenharmony_ci}, 3408c2ecf20Sopenharmony_ci{ 3418c2ecf20Sopenharmony_ci "invalid read map access into a write-only array 1", 3428c2ecf20Sopenharmony_ci .insns = { 3438c2ecf20Sopenharmony_ci BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0), 3448c2ecf20Sopenharmony_ci BPF_MOV64_REG(BPF_REG_2, BPF_REG_10), 3458c2ecf20Sopenharmony_ci BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8), 3468c2ecf20Sopenharmony_ci BPF_LD_MAP_FD(BPF_REG_1, 0), 3478c2ecf20Sopenharmony_ci BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem), 3488c2ecf20Sopenharmony_ci BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1), 3498c2ecf20Sopenharmony_ci BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_0, 0), 3508c2ecf20Sopenharmony_ci BPF_EXIT_INSN(), 3518c2ecf20Sopenharmony_ci }, 3528c2ecf20Sopenharmony_ci .fixup_map_array_wo = { 3 }, 3538c2ecf20Sopenharmony_ci .result = REJECT, 3548c2ecf20Sopenharmony_ci .errstr = "read from map forbidden", 3558c2ecf20Sopenharmony_ci}, 3568c2ecf20Sopenharmony_ci{ 3578c2ecf20Sopenharmony_ci "invalid read map access into a write-only array 2", 3588c2ecf20Sopenharmony_ci .insns = { 3598c2ecf20Sopenharmony_ci BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0), 3608c2ecf20Sopenharmony_ci BPF_MOV64_REG(BPF_REG_2, BPF_REG_10), 3618c2ecf20Sopenharmony_ci BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8), 3628c2ecf20Sopenharmony_ci BPF_LD_MAP_FD(BPF_REG_1, 0), 3638c2ecf20Sopenharmony_ci BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem), 3648c2ecf20Sopenharmony_ci BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6), 3658c2ecf20Sopenharmony_ci 3668c2ecf20Sopenharmony_ci BPF_MOV64_REG(BPF_REG_1, BPF_REG_0), 3678c2ecf20Sopenharmony_ci BPF_MOV64_IMM(BPF_REG_2, 4), 3688c2ecf20Sopenharmony_ci BPF_MOV64_IMM(BPF_REG_3, 0), 3698c2ecf20Sopenharmony_ci BPF_MOV64_IMM(BPF_REG_4, 0), 3708c2ecf20Sopenharmony_ci BPF_MOV64_IMM(BPF_REG_5, 0), 3718c2ecf20Sopenharmony_ci BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, 3728c2ecf20Sopenharmony_ci BPF_FUNC_csum_diff), 3738c2ecf20Sopenharmony_ci BPF_EXIT_INSN(), 3748c2ecf20Sopenharmony_ci }, 3758c2ecf20Sopenharmony_ci .prog_type = BPF_PROG_TYPE_SCHED_CLS, 3768c2ecf20Sopenharmony_ci .fixup_map_array_wo = { 3 }, 3778c2ecf20Sopenharmony_ci .result = REJECT, 3788c2ecf20Sopenharmony_ci .errstr = "read from map forbidden", 3798c2ecf20Sopenharmony_ci}, 380