Commit 16a42573 authored by Eduard Zingerman's avatar Eduard Zingerman Committed by Alexei Starovoitov
Browse files

selftests/bpf: verifier/regalloc converted to inline assembly 



Test verifier/regalloc automatically converted to use inline assembly.

Signed-off-by: default avatarEduard Zingerman <eddyz87@gmail.com>
Link: https://lore.kernel.org/r/20230421174234.2391278-17-eddyz87@gmail.com


Signed-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
parent 8be63279

tools/testing/selftests/bpf/prog_tests/verifier.c

+2 −0
Original line number Original line Diff line number Diff line
@@ -46,6 +46,7 @@ 
#include "verifier_raw_tp_writable.skel.h"

#include "verifier_raw_tp_writable.skel.h"

#include "verifier_reg_equal.skel.h"

#include "verifier_reg_equal.skel.h"

#include "verifier_ref_tracking.skel.h"

#include "verifier_ref_tracking.skel.h"

#include "verifier_regalloc.skel.h"

#include "verifier_ringbuf.skel.h"

#include "verifier_ringbuf.skel.h"

#include "verifier_spill_fill.skel.h"

#include "verifier_spill_fill.skel.h"

#include "verifier_stack_ptr.skel.h"

#include "verifier_stack_ptr.skel.h"
@@ -134,6 +135,7 @@ void test_verifier_raw_stack(void) { RUN(verifier_raw_stack); } 
void test_verifier_raw_tp_writable(void)      { RUN(verifier_raw_tp_writable); }

void test_verifier_raw_tp_writable(void)      { RUN(verifier_raw_tp_writable); }

void test_verifier_reg_equal(void)            { RUN(verifier_reg_equal); }

void test_verifier_reg_equal(void)            { RUN(verifier_reg_equal); }

void test_verifier_ref_tracking(void)         { RUN(verifier_ref_tracking); }

void test_verifier_ref_tracking(void)         { RUN(verifier_ref_tracking); }

void test_verifier_regalloc(void)             { RUN(verifier_regalloc); }

void test_verifier_ringbuf(void)              { RUN(verifier_ringbuf); }

void test_verifier_ringbuf(void)              { RUN(verifier_ringbuf); }

void test_verifier_spill_fill(void)           { RUN(verifier_spill_fill); }

void test_verifier_spill_fill(void)           { RUN(verifier_spill_fill); }

void test_verifier_stack_ptr(void)            { RUN(verifier_stack_ptr); }

void test_verifier_stack_ptr(void)            { RUN(verifier_stack_ptr); }

tools/testing/selftests/bpf/progs/verifier_regalloc.c

0 → 100644
+364 −0
Original line number Original line Diff line number Diff line 
// SPDX-License-Identifier: GPL-2.0

/* Converted from tools/testing/selftests/bpf/verifier/regalloc.c */



#include <linux/bpf.h>

#include <bpf/bpf_helpers.h>

#include "bpf_misc.h"



#define MAX_ENTRIES 11



struct test_val {

	unsigned int index;

	int foo[MAX_ENTRIES];

};



struct {

	__uint(type, BPF_MAP_TYPE_HASH);

	__uint(max_entries, 1);

	__type(key, long long);

	__type(value, struct test_val);

} map_hash_48b SEC(".maps");



SEC("tracepoint")

__description("regalloc basic")

__success __flag(BPF_F_ANY_ALIGNMENT)

__naked void regalloc_basic(void)

{

	asm volatile ("					\

	r6 = r1;					\

	r1 = 0;						\

	*(u64*)(r10 - 8) = r1;				\

	r2 = r10;					\

	r2 += -8;					\

	r1 = %[map_hash_48b] ll;			\

	call %[bpf_map_lookup_elem];			\

	if r0 == 0 goto l0_%=;				\

	r7 = r0;					\

	call %[bpf_get_prandom_u32];			\

	r2 = r0;					\

	if r0 s> 20 goto l0_%=;				\

	if r2 s< 0 goto l0_%=;				\

	r7 += r0;					\

	r7 += r2;					\

	r0 = *(u64*)(r7 + 0);				\

l0_%=:	exit;						\

"	:

	: __imm(bpf_get_prandom_u32),

	  __imm(bpf_map_lookup_elem),

	  __imm_addr(map_hash_48b)

	: __clobber_all);

}



SEC("tracepoint")

__description("regalloc negative")

__failure __msg("invalid access to map value, value_size=48 off=48 size=1")

__naked void regalloc_negative(void)

{

	asm volatile ("					\

	r6 = r1;					\

	r1 = 0;						\

	*(u64*)(r10 - 8) = r1;				\

	r2 = r10;					\

	r2 += -8;					\

	r1 = %[map_hash_48b] ll;			\

	call %[bpf_map_lookup_elem];			\

	if r0 == 0 goto l0_%=;				\

	r7 = r0;					\

	call %[bpf_get_prandom_u32];			\

	r2 = r0;					\

	if r0 s> 24 goto l0_%=;				\

	if r2 s< 0 goto l0_%=;				\

	r7 += r0;					\

	r7 += r2;					\

	r0 = *(u8*)(r7 + 0);				\

l0_%=:	exit;						\

"	:

	: __imm(bpf_get_prandom_u32),

	  __imm(bpf_map_lookup_elem),

	  __imm_addr(map_hash_48b)

	: __clobber_all);

}



SEC("tracepoint")

__description("regalloc src_reg mark")

__success __flag(BPF_F_ANY_ALIGNMENT)

__naked void regalloc_src_reg_mark(void)

{

	asm volatile ("					\

	r6 = r1;					\

	r1 = 0;						\

	*(u64*)(r10 - 8) = r1;				\

	r2 = r10;					\

	r2 += -8;					\

	r1 = %[map_hash_48b] ll;			\

	call %[bpf_map_lookup_elem];			\

	if r0 == 0 goto l0_%=;				\

	r7 = r0;					\

	call %[bpf_get_prandom_u32];			\

	r2 = r0;					\

	if r0 s> 20 goto l0_%=;				\

	r3 = 0;						\

	if r3 s>= r2 goto l0_%=;			\

	r7 += r0;					\

	r7 += r2;					\

	r0 = *(u64*)(r7 + 0);				\

l0_%=:	exit;						\

"	:

	: __imm(bpf_get_prandom_u32),

	  __imm(bpf_map_lookup_elem),

	  __imm_addr(map_hash_48b)

	: __clobber_all);

}



SEC("tracepoint")

__description("regalloc src_reg negative")

__failure __msg("invalid access to map value, value_size=48 off=44 size=8")

__flag(BPF_F_ANY_ALIGNMENT)

__naked void regalloc_src_reg_negative(void)

{

	asm volatile ("					\

	r6 = r1;					\

	r1 = 0;						\

	*(u64*)(r10 - 8) = r1;				\

	r2 = r10;					\

	r2 += -8;					\

	r1 = %[map_hash_48b] ll;			\

	call %[bpf_map_lookup_elem];			\

	if r0 == 0 goto l0_%=;				\

	r7 = r0;					\

	call %[bpf_get_prandom_u32];			\

	r2 = r0;					\

	if r0 s> 22 goto l0_%=;				\

	r3 = 0;						\

	if r3 s>= r2 goto l0_%=;			\

	r7 += r0;					\

	r7 += r2;					\

	r0 = *(u64*)(r7 + 0);				\

l0_%=:	exit;						\

"	:

	: __imm(bpf_get_prandom_u32),

	  __imm(bpf_map_lookup_elem),

	  __imm_addr(map_hash_48b)

	: __clobber_all);

}



SEC("tracepoint")

__description("regalloc and spill")

__success __flag(BPF_F_ANY_ALIGNMENT)

__naked void regalloc_and_spill(void)

{

	asm volatile ("					\

	r6 = r1;					\

	r1 = 0;						\

	*(u64*)(r10 - 8) = r1;				\

	r2 = r10;					\

	r2 += -8;					\

	r1 = %[map_hash_48b] ll;			\

	call %[bpf_map_lookup_elem];			\

	if r0 == 0 goto l0_%=;				\

	r7 = r0;					\

	call %[bpf_get_prandom_u32];			\

	r2 = r0;					\

	if r0 s> 20 goto l0_%=;				\

	/* r0 has upper bound that should propagate into r2 */\

	*(u64*)(r10 - 8) = r2;		/* spill r2 */	\

	r0 = 0;						\

	r2 = 0;				/* clear r0 and r2 */\

	r3 = *(u64*)(r10 - 8);		/* fill r3 */	\

	if r0 s>= r3 goto l0_%=;			\

	/* r3 has lower and upper bounds */		\

	r7 += r3;					\

	r0 = *(u64*)(r7 + 0);				\

l0_%=:	exit;						\

"	:

	: __imm(bpf_get_prandom_u32),

	  __imm(bpf_map_lookup_elem),

	  __imm_addr(map_hash_48b)

	: __clobber_all);

}



SEC("tracepoint")

__description("regalloc and spill negative")

__failure __msg("invalid access to map value, value_size=48 off=48 size=8")

__flag(BPF_F_ANY_ALIGNMENT)

__naked void regalloc_and_spill_negative(void)

{

	asm volatile ("					\

	r6 = r1;					\

	r1 = 0;						\

	*(u64*)(r10 - 8) = r1;				\

	r2 = r10;					\

	r2 += -8;					\

	r1 = %[map_hash_48b] ll;			\

	call %[bpf_map_lookup_elem];			\

	if r0 == 0 goto l0_%=;				\

	r7 = r0;					\

	call %[bpf_get_prandom_u32];			\

	r2 = r0;					\

	if r0 s> 48 goto l0_%=;				\

	/* r0 has upper bound that should propagate into r2 */\

	*(u64*)(r10 - 8) = r2;		/* spill r2 */	\

	r0 = 0;						\

	r2 = 0;				/* clear r0 and r2 */\

	r3 = *(u64*)(r10 - 8);		/* fill r3 */\

	if r0 s>= r3 goto l0_%=;			\

	/* r3 has lower and upper bounds */		\

	r7 += r3;					\

	r0 = *(u64*)(r7 + 0);				\

l0_%=:	exit;						\

"	:

	: __imm(bpf_get_prandom_u32),

	  __imm(bpf_map_lookup_elem),

	  __imm_addr(map_hash_48b)

	: __clobber_all);

}



SEC("tracepoint")

__description("regalloc three regs")

__success __flag(BPF_F_ANY_ALIGNMENT)

__naked void regalloc_three_regs(void)

{

	asm volatile ("					\

	r6 = r1;					\

	r1 = 0;						\

	*(u64*)(r10 - 8) = r1;				\

	r2 = r10;					\

	r2 += -8;					\

	r1 = %[map_hash_48b] ll;			\

	call %[bpf_map_lookup_elem];			\

	if r0 == 0 goto l0_%=;				\

	r7 = r0;					\

	call %[bpf_get_prandom_u32];			\

	r2 = r0;					\

	r4 = r2;					\

	if r0 s> 12 goto l0_%=;				\

	if r2 s< 0 goto l0_%=;				\

	r7 += r0;					\

	r7 += r2;					\

	r7 += r4;					\

	r0 = *(u64*)(r7 + 0);				\

l0_%=:	exit;						\

"	:

	: __imm(bpf_get_prandom_u32),

	  __imm(bpf_map_lookup_elem),

	  __imm_addr(map_hash_48b)

	: __clobber_all);

}



SEC("tracepoint")

__description("regalloc after call")

__success __flag(BPF_F_ANY_ALIGNMENT)

__naked void regalloc_after_call(void)

{

	asm volatile ("					\

	r6 = r1;					\

	r1 = 0;						\

	*(u64*)(r10 - 8) = r1;				\

	r2 = r10;					\

	r2 += -8;					\

	r1 = %[map_hash_48b] ll;			\

	call %[bpf_map_lookup_elem];			\

	if r0 == 0 goto l0_%=;				\

	r7 = r0;					\

	call %[bpf_get_prandom_u32];			\

	r8 = r0;					\

	r9 = r0;					\

	call regalloc_after_call__1;			\

	if r8 s> 20 goto l0_%=;				\

	if r9 s< 0 goto l0_%=;				\

	r7 += r8;					\

	r7 += r9;					\

	r0 = *(u64*)(r7 + 0);				\

l0_%=:	exit;						\

"	:

	: __imm(bpf_get_prandom_u32),

	  __imm(bpf_map_lookup_elem),

	  __imm_addr(map_hash_48b)

	: __clobber_all);

}



static __naked __noinline __attribute__((used))

void regalloc_after_call__1(void)

{

	asm volatile ("					\

	r0 = 0;						\

	exit;						\

"	::: __clobber_all);

}



SEC("tracepoint")

__description("regalloc in callee")

__success __flag(BPF_F_ANY_ALIGNMENT)

__naked void regalloc_in_callee(void)

{

	asm volatile ("					\

	r6 = r1;					\

	r1 = 0;						\

	*(u64*)(r10 - 8) = r1;				\

	r2 = r10;					\

	r2 += -8;					\

	r1 = %[map_hash_48b] ll;			\

	call %[bpf_map_lookup_elem];			\

	if r0 == 0 goto l0_%=;				\

	r7 = r0;					\

	call %[bpf_get_prandom_u32];			\

	r1 = r0;					\

	r2 = r0;					\

	r3 = r7;					\

	call regalloc_in_callee__1;			\

l0_%=:	exit;						\

"	:

	: __imm(bpf_get_prandom_u32),

	  __imm(bpf_map_lookup_elem),

	  __imm_addr(map_hash_48b)

	: __clobber_all);

}



static __naked __noinline __attribute__((used))

void regalloc_in_callee__1(void)

{

	asm volatile ("					\

	if r1 s> 20 goto l0_%=;				\

	if r2 s< 0 goto l0_%=;				\

	r3 += r1;					\

	r3 += r2;					\

	r0 = *(u64*)(r3 + 0);				\

	exit;						\

l0_%=:	r0 = 0;						\

	exit;						\

"	::: __clobber_all);

}



SEC("tracepoint")

__description("regalloc, spill, JEQ")

__success

__naked void regalloc_spill_jeq(void)

{

	asm volatile ("					\

	r6 = r1;					\

	r1 = 0;						\

	*(u64*)(r10 - 8) = r1;				\

	r2 = r10;					\

	r2 += -8;					\

	r1 = %[map_hash_48b] ll;			\

	call %[bpf_map_lookup_elem];			\

	*(u64*)(r10 - 8) = r0;		/* spill r0 */	\

	if r0 == 0 goto l0_%=;				\

l0_%=:	/* The verifier will walk the rest twice with r0 == 0 and r0 == map_value */\

	call %[bpf_get_prandom_u32];			\

	r2 = r0;					\

	if r2 == 20 goto l1_%=;				\

l1_%=:	/* The verifier will walk the rest two more times with r0 == 20 and r0 == unknown */\

	r3 = *(u64*)(r10 - 8);		/* fill r3 with map_value */\

	if r3 == 0 goto l2_%=;		/* skip ldx if map_value == NULL */\

	/* Buggy verifier will think that r3 == 20 here */\

	r0 = *(u64*)(r3 + 0);		/* read from map_value */\

l2_%=:	exit;						\

"	:

	: __imm(bpf_get_prandom_u32),

	  __imm(bpf_map_lookup_elem),

	  __imm_addr(map_hash_48b)

	: __clobber_all);

}



char _license[] SEC("license") = "GPL";

tools/testing/selftests/bpf/verifier/regalloc.c

deleted100644 → 0
+0 −277
Original line number Original line Diff line number Diff line 
{

	"regalloc basic",

	.insns = {

	BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),

	BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),

	BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),

	BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),

	BPF_LD_MAP_FD(BPF_REG_1, 0),

	BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),

	BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 8),

	BPF_MOV64_REG(BPF_REG_7, BPF_REG_0),

	BPF_EMIT_CALL(BPF_FUNC_get_prandom_u32),

	BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),

	BPF_JMP_IMM(BPF_JSGT, BPF_REG_0, 20, 4),

	BPF_JMP_IMM(BPF_JSLT, BPF_REG_2, 0, 3),

	BPF_ALU64_REG(BPF_ADD, BPF_REG_7, BPF_REG_0),

	BPF_ALU64_REG(BPF_ADD, BPF_REG_7, BPF_REG_2),

	BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_7, 0),

	BPF_EXIT_INSN(),

	},

	.fixup_map_hash_48b = { 4 },

	.result = ACCEPT,

	.prog_type = BPF_PROG_TYPE_TRACEPOINT,

	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,

},

{

	"regalloc negative",

	.insns = {

	BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),

	BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),

	BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),

	BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),

	BPF_LD_MAP_FD(BPF_REG_1, 0),

	BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),

	BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 8),

	BPF_MOV64_REG(BPF_REG_7, BPF_REG_0),

	BPF_EMIT_CALL(BPF_FUNC_get_prandom_u32),

	BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),

	BPF_JMP_IMM(BPF_JSGT, BPF_REG_0, 24, 4),

	BPF_JMP_IMM(BPF_JSLT, BPF_REG_2, 0, 3),

	BPF_ALU64_REG(BPF_ADD, BPF_REG_7, BPF_REG_0),

	BPF_ALU64_REG(BPF_ADD, BPF_REG_7, BPF_REG_2),

	BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_7, 0),

	BPF_EXIT_INSN(),

	},

	.fixup_map_hash_48b = { 4 },

	.result = REJECT,

	.errstr = "invalid access to map value, value_size=48 off=48 size=1",

	.prog_type = BPF_PROG_TYPE_TRACEPOINT,

},

{

	"regalloc src_reg mark",

	.insns = {

	BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),

	BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),

	BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),

	BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),

	BPF_LD_MAP_FD(BPF_REG_1, 0),

	BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),

	BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9),

	BPF_MOV64_REG(BPF_REG_7, BPF_REG_0),

	BPF_EMIT_CALL(BPF_FUNC_get_prandom_u32),

	BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),

	BPF_JMP_IMM(BPF_JSGT, BPF_REG_0, 20, 5),

	BPF_MOV64_IMM(BPF_REG_3, 0),

	BPF_JMP_REG(BPF_JSGE, BPF_REG_3, BPF_REG_2, 3),

	BPF_ALU64_REG(BPF_ADD, BPF_REG_7, BPF_REG_0),

	BPF_ALU64_REG(BPF_ADD, BPF_REG_7, BPF_REG_2),

	BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_7, 0),

	BPF_EXIT_INSN(),

	},

	.fixup_map_hash_48b = { 4 },

	.result = ACCEPT,

	.prog_type = BPF_PROG_TYPE_TRACEPOINT,

	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,

},

{

	"regalloc src_reg negative",

	.insns = {

	BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),

	BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),

	BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),

	BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),

	BPF_LD_MAP_FD(BPF_REG_1, 0),

	BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),

	BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9),

	BPF_MOV64_REG(BPF_REG_7, BPF_REG_0),

	BPF_EMIT_CALL(BPF_FUNC_get_prandom_u32),

	BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),

	BPF_JMP_IMM(BPF_JSGT, BPF_REG_0, 22, 5),

	BPF_MOV64_IMM(BPF_REG_3, 0),

	BPF_JMP_REG(BPF_JSGE, BPF_REG_3, BPF_REG_2, 3),

	BPF_ALU64_REG(BPF_ADD, BPF_REG_7, BPF_REG_0),

	BPF_ALU64_REG(BPF_ADD, BPF_REG_7, BPF_REG_2),

	BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_7, 0),

	BPF_EXIT_INSN(),

	},

	.fixup_map_hash_48b = { 4 },

	.result = REJECT,

	.errstr = "invalid access to map value, value_size=48 off=44 size=8",

	.prog_type = BPF_PROG_TYPE_TRACEPOINT,

	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,

},

{

	"regalloc and spill",

	.insns = {

	BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),

	BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),

	BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),

	BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),

	BPF_LD_MAP_FD(BPF_REG_1, 0),

	BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),

	BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 11),

	BPF_MOV64_REG(BPF_REG_7, BPF_REG_0),

	BPF_EMIT_CALL(BPF_FUNC_get_prandom_u32),

	BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),

	BPF_JMP_IMM(BPF_JSGT, BPF_REG_0, 20, 7),

	/* r0 has upper bound that should propagate into r2 */

	BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_2, -8), /* spill r2 */

	BPF_MOV64_IMM(BPF_REG_0, 0),

	BPF_MOV64_IMM(BPF_REG_2, 0), /* clear r0 and r2 */

	BPF_LDX_MEM(BPF_DW, BPF_REG_3, BPF_REG_10, -8), /* fill r3 */

	BPF_JMP_REG(BPF_JSGE, BPF_REG_0, BPF_REG_3, 2),

	/* r3 has lower and upper bounds */

	BPF_ALU64_REG(BPF_ADD, BPF_REG_7, BPF_REG_3),

	BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_7, 0),

	BPF_EXIT_INSN(),

	},

	.fixup_map_hash_48b = { 4 },

	.result = ACCEPT,

	.prog_type = BPF_PROG_TYPE_TRACEPOINT,

	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,

},

{

	"regalloc and spill negative",

	.insns = {

	BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),

	BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),

	BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),

	BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),

	BPF_LD_MAP_FD(BPF_REG_1, 0),

	BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),

	BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 11),

	BPF_MOV64_REG(BPF_REG_7, BPF_REG_0),

	BPF_EMIT_CALL(BPF_FUNC_get_prandom_u32),

	BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),

	BPF_JMP_IMM(BPF_JSGT, BPF_REG_0, 48, 7),

	/* r0 has upper bound that should propagate into r2 */

	BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_2, -8), /* spill r2 */

	BPF_MOV64_IMM(BPF_REG_0, 0),

	BPF_MOV64_IMM(BPF_REG_2, 0), /* clear r0 and r2 */

	BPF_LDX_MEM(BPF_DW, BPF_REG_3, BPF_REG_10, -8), /* fill r3 */

	BPF_JMP_REG(BPF_JSGE, BPF_REG_0, BPF_REG_3, 2),

	/* r3 has lower and upper bounds */

	BPF_ALU64_REG(BPF_ADD, BPF_REG_7, BPF_REG_3),

	BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_7, 0),

	BPF_EXIT_INSN(),

	},

	.fixup_map_hash_48b = { 4 },

	.result = REJECT,

	.errstr = "invalid access to map value, value_size=48 off=48 size=8",

	.prog_type = BPF_PROG_TYPE_TRACEPOINT,

	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,

},

{

	"regalloc three regs",

	.insns = {

	BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),

	BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),

	BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),

	BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),

	BPF_LD_MAP_FD(BPF_REG_1, 0),

	BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),

	BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 10),

	BPF_MOV64_REG(BPF_REG_7, BPF_REG_0),

	BPF_EMIT_CALL(BPF_FUNC_get_prandom_u32),

	BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),

	BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),

	BPF_JMP_IMM(BPF_JSGT, BPF_REG_0, 12, 5),

	BPF_JMP_IMM(BPF_JSLT, BPF_REG_2, 0, 4),

	BPF_ALU64_REG(BPF_ADD, BPF_REG_7, BPF_REG_0),

	BPF_ALU64_REG(BPF_ADD, BPF_REG_7, BPF_REG_2),

	BPF_ALU64_REG(BPF_ADD, BPF_REG_7, BPF_REG_4),

	BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_7, 0),

	BPF_EXIT_INSN(),

	},

	.fixup_map_hash_48b = { 4 },

	.result = ACCEPT,

	.prog_type = BPF_PROG_TYPE_TRACEPOINT,

	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,

},

{

	"regalloc after call",

	.insns = {

	BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),

	BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),

	BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),

	BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),

	BPF_LD_MAP_FD(BPF_REG_1, 0),

	BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),

	BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 10),

	BPF_MOV64_REG(BPF_REG_7, BPF_REG_0),

	BPF_EMIT_CALL(BPF_FUNC_get_prandom_u32),

	BPF_MOV64_REG(BPF_REG_8, BPF_REG_0),

	BPF_MOV64_REG(BPF_REG_9, BPF_REG_0),

	BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 6),

	BPF_JMP_IMM(BPF_JSGT, BPF_REG_8, 20, 4),

	BPF_JMP_IMM(BPF_JSLT, BPF_REG_9, 0, 3),

	BPF_ALU64_REG(BPF_ADD, BPF_REG_7, BPF_REG_8),

	BPF_ALU64_REG(BPF_ADD, BPF_REG_7, BPF_REG_9),

	BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_7, 0),

	BPF_EXIT_INSN(),

	BPF_MOV64_IMM(BPF_REG_0, 0),

	BPF_EXIT_INSN(),

	},

	.fixup_map_hash_48b = { 4 },

	.result = ACCEPT,

	.prog_type = BPF_PROG_TYPE_TRACEPOINT,

	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,

},

{

	"regalloc in callee",

	.insns = {

	BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),

	BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),

	BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),

	BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),

	BPF_LD_MAP_FD(BPF_REG_1, 0),

	BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),

	BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),

	BPF_MOV64_REG(BPF_REG_7, BPF_REG_0),

	BPF_EMIT_CALL(BPF_FUNC_get_prandom_u32),

	BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),

	BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),

	BPF_MOV64_REG(BPF_REG_3, BPF_REG_7),

	BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),

	BPF_EXIT_INSN(),

	BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 20, 5),

	BPF_JMP_IMM(BPF_JSLT, BPF_REG_2, 0, 4),

	BPF_ALU64_REG(BPF_ADD, BPF_REG_3, BPF_REG_1),

	BPF_ALU64_REG(BPF_ADD, BPF_REG_3, BPF_REG_2),

	BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_3, 0),

	BPF_EXIT_INSN(),

	BPF_MOV64_IMM(BPF_REG_0, 0),

	BPF_EXIT_INSN(),

	},

	.fixup_map_hash_48b = { 4 },

	.result = ACCEPT,

	.prog_type = BPF_PROG_TYPE_TRACEPOINT,

	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,

},

{

	"regalloc, spill, JEQ",

	.insns = {

	BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),

	BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),

	BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),

	BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),

	BPF_LD_MAP_FD(BPF_REG_1, 0),

	BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),

	BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -8), /* spill r0 */

	BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 0),

	/* The verifier will walk the rest twice with r0 == 0 and r0 == map_value */

	BPF_EMIT_CALL(BPF_FUNC_get_prandom_u32),

	BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),

	BPF_JMP_IMM(BPF_JEQ, BPF_REG_2, 20, 0),

	/* The verifier will walk the rest two more times with r0 == 20 and r0 == unknown */

	BPF_LDX_MEM(BPF_DW, BPF_REG_3, BPF_REG_10, -8), /* fill r3 with map_value */

	BPF_JMP_IMM(BPF_JEQ, BPF_REG_3, 0, 1), /* skip ldx if map_value == NULL */

	/* Buggy verifier will think that r3 == 20 here */

	BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_3, 0), /* read from map_value */

	BPF_EXIT_INSN(),

	},

	.fixup_map_hash_48b = { 4 },

	.result = ACCEPT,

	.prog_type = BPF_PROG_TYPE_TRACEPOINT,

},