Commit a5b4867f authored by Cupertino Miranda's avatar Cupertino Miranda Committed by Alexei Starovoitov
Browse files

selftests/bpf: add verifier sign extension bound computation tests. 



This commit adds 3 tests to verify a common compiler generated
pattern for sign extension (r1 <<= 32; r1 s>>= 32).
The tests make sure the register bounds are correctly computed both for
positive and negative register values.

Signed-off-by: default avatarCupertino Miranda <cupertino.miranda@oracle.com>
Signed-off-by: default avatarAndrew Pinski <andrew.pinski@oss.qualcomm.com>
Acked-by: default avatarEduard Zingerman <eddyz87@gmail.com>
Cc: David Faust  <david.faust@oracle.com>
Cc: Jose Marchesi  <jose.marchesi@oracle.com>
Cc: Elena Zannoni  <elena.zannoni@oracle.com>
Link: https://lore.kernel.org/r/20251202180220.11128-3-cupertino.miranda@oracle.com


Signed-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
parent d18dec4b

tools/testing/selftests/bpf/progs/verifier_subreg.c

+68 −0
Original line number Diff line number Diff line
@@ -531,6 +531,74 @@ __naked void arsh32_imm_zero_extend_check(void) 
	: __clobber_all);

}



SEC("socket")

__description("arsh32 imm sign positive extend check")

__success __retval(0)

__log_level(2)

__msg("2: (57) r6 &= 4095                    ; R6=scalar(smin=smin32=0,smax=umax=smax32=umax32=4095,var_off=(0x0; 0xfff))")

__msg("3: (67) r6 <<= 32                     ; R6=scalar(smin=smin32=0,smax=umax=0xfff00000000,smax32=umax32=0,var_off=(0x0; 0xfff00000000))")

__msg("4: (c7) r6 s>>= 32                    ; R6=scalar(smin=smin32=0,smax=umax=smax32=umax32=4095,var_off=(0x0; 0xfff))")

__naked void arsh32_imm_sign_extend_positive_check(void)

{

	asm volatile ("					\

	call %[bpf_get_prandom_u32];			\

	r6 = r0;					\

	r6 &= 4095;					\

	r6 <<= 32;					\

	r6 s>>= 32;					\

	r0 = 0;						\

	exit;						\

"	:

	: __imm(bpf_get_prandom_u32)

	: __clobber_all);

}



SEC("socket")

__description("arsh32 imm sign negative extend check")

__success __retval(0)

__log_level(2)

__msg("3: (17) r6 -= 4095                    ; R6=scalar(smin=smin32=-4095,smax=smax32=0)")

__msg("4: (67) r6 <<= 32                     ; R6=scalar(smin=0xfffff00100000000,smax=smax32=umax32=0,umax=0xffffffff00000000,smin32=0,var_off=(0x0; 0xffffffff00000000))")

__msg("5: (c7) r6 s>>= 32                    ; R6=scalar(smin=smin32=-4095,smax=smax32=0)")

__naked void arsh32_imm_sign_extend_negative_check(void)

{

	asm volatile ("					\

	call %[bpf_get_prandom_u32];			\

	r6 = r0;					\

	r6 &= 4095;					\

	r6 -= 4095;					\

	r6 <<= 32;					\

	r6 s>>= 32;					\

	r0 = 0;						\

	exit;						\

"	:

	: __imm(bpf_get_prandom_u32)

	: __clobber_all);

}



SEC("socket")

__description("arsh32 imm sign extend check")

__success __retval(0)

__log_level(2)

__msg("3: (17) r6 -= 2047                    ; R6=scalar(smin=smin32=-2047,smax=smax32=2048)")

__msg("4: (67) r6 <<= 32                     ; R6=scalar(smin=0xfffff80100000000,smax=0x80000000000,umax=0xffffffff00000000,smin32=0,smax32=umax32=0,var_off=(0x0; 0xffffffff00000000))")

__msg("5: (c7) r6 s>>= 32                    ; R6=scalar(smin=smin32=-2047,smax=smax32=2048)")

__naked void arsh32_imm_sign_extend_check(void)

{

	asm volatile ("					\

	call %[bpf_get_prandom_u32];			\

	r6 = r0;					\

	r6 &= 4095;					\

	r6 -= 2047;					\

	r6 <<= 32;					\

	r6 s>>= 32;					\

	r0 = 0;						\

	exit;						\

"	:

	: __imm(bpf_get_prandom_u32)

	: __clobber_all);

}



SEC("socket")

__description("end16 (to_le) reg zero extend check")

__success __success_unpriv __retval(0)