Skip to content

Commit fdfbe76

Browse files
cupermirKernel Patches Daemon
authored andcommitted
selftests/bpf: add verifier sign extension bound computation tests.
This commit adds 3 tests to verify a common compiler generated pattern for sign extension (r1 <<= 32; r1 s>>= 32). The tests make sure the register bounds are correctly computed both for positive and negative register values. Signed-off-by: Cupertino Miranda <[email protected]> Signed-off-by: Andrew Pinski <[email protected]> Acked-by: Eduard Zingerman <[email protected]> Cc: David Faust <[email protected]> Cc: Jose Marchesi <[email protected]> Cc: Elena Zannoni <[email protected]>
1 parent 9dbccf3 commit fdfbe76

File tree

1 file changed

+68
-0
lines changed

1 file changed

+68
-0
lines changed

tools/testing/selftests/bpf/progs/verifier_subreg.c

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -531,6 +531,74 @@ __naked void arsh32_imm_zero_extend_check(void)
531531
: __clobber_all);
532532
}
533533

534+
SEC("socket")
535+
__description("arsh32 imm sign positive extend check")
536+
__success __retval(0)
537+
__log_level(2)
538+
__msg("2: (57) r6 &= 4095 ; R6=scalar(smin=smin32=0,smax=umax=smax32=umax32=4095,var_off=(0x0; 0xfff))")
539+
__msg("3: (67) r6 <<= 32 ; R6=scalar(smin=smin32=0,smax=umax=0xfff00000000,smax32=umax32=0,var_off=(0x0; 0xfff00000000))")
540+
__msg("4: (c7) r6 s>>= 32 ; R6=scalar(smin=smin32=0,smax=umax=smax32=umax32=4095,var_off=(0x0; 0xfff))")
541+
__naked void arsh32_imm_sign_extend_positive_check(void)
542+
{
543+
asm volatile (" \
544+
call %[bpf_get_prandom_u32]; \
545+
r6 = r0; \
546+
r6 &= 4095; \
547+
r6 <<= 32; \
548+
r6 s>>= 32; \
549+
r0 = 0; \
550+
exit; \
551+
" :
552+
: __imm(bpf_get_prandom_u32)
553+
: __clobber_all);
554+
}
555+
556+
SEC("socket")
557+
__description("arsh32 imm sign negative extend check")
558+
__success __retval(0)
559+
__log_level(2)
560+
__msg("3: (17) r6 -= 4095 ; R6=scalar(smin=smin32=-4095,smax=smax32=0)")
561+
__msg("4: (67) r6 <<= 32 ; R6=scalar(smin=0xfffff00100000000,smax=smax32=umax32=0,umax=0xffffffff00000000,smin32=0,var_off=(0x0; 0xffffffff00000000))")
562+
__msg("5: (c7) r6 s>>= 32 ; R6=scalar(smin=smin32=-4095,smax=smax32=0)")
563+
__naked void arsh32_imm_sign_extend_negative_check(void)
564+
{
565+
asm volatile (" \
566+
call %[bpf_get_prandom_u32]; \
567+
r6 = r0; \
568+
r6 &= 4095; \
569+
r6 -= 4095; \
570+
r6 <<= 32; \
571+
r6 s>>= 32; \
572+
r0 = 0; \
573+
exit; \
574+
" :
575+
: __imm(bpf_get_prandom_u32)
576+
: __clobber_all);
577+
}
578+
579+
SEC("socket")
580+
__description("arsh32 imm sign extend check")
581+
__success __retval(0)
582+
__log_level(2)
583+
__msg("3: (17) r6 -= 2047 ; R6=scalar(smin=smin32=-2047,smax=smax32=2048)")
584+
__msg("4: (67) r6 <<= 32 ; R6=scalar(smin=0xfffff80100000000,smax=0x80000000000,umax=0xffffffff00000000,smin32=0,smax32=umax32=0,var_off=(0x0; 0xffffffff00000000))")
585+
__msg("5: (c7) r6 s>>= 32 ; R6=scalar(smin=smin32=-2047,smax=smax32=2048)")
586+
__naked void arsh32_imm_sign_extend_check(void)
587+
{
588+
asm volatile (" \
589+
call %[bpf_get_prandom_u32]; \
590+
r6 = r0; \
591+
r6 &= 4095; \
592+
r6 -= 2047; \
593+
r6 <<= 32; \
594+
r6 s>>= 32; \
595+
r0 = 0; \
596+
exit; \
597+
" :
598+
: __imm(bpf_get_prandom_u32)
599+
: __clobber_all);
600+
}
601+
534602
SEC("socket")
535603
__description("end16 (to_le) reg zero extend check")
536604
__success __success_unpriv __retval(0)

0 commit comments

Comments
 (0)