bpf/verifier/bounds.c

2 	"subtraction bounds (map value) variant 1",
12 	BPF_LDX_MEM(BPF_B, BPF_REG_3, BPF_REG_0, 1),
37 	BPF_LDX_MEM(BPF_B, BPF_REG_3, BPF_REG_0, 1),
67 	BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
73 	.fixup_map_hash_8b = { 1, 9 },
163 	BPF_ALU64_IMM(BPF_AND, BPF_REG_6, 1),
164 	BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, (1 << 29) - 1),
166 	BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, (1 << 29) - 1),
187 	BPF_ALU64_IMM(BPF_AND, BPF_REG_6, 1),
188 	BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, (1 << 30) - 1),
190 	BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, (1 << 29) - 1),
211 	BPF_MOV64_IMM(BPF_REG_2, 1),
234 	"bounds check after truncation of boundary-crossing range (1)",
244 	BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 0xffffff80 >> 1),
245 	/* r1 = [0xffff'ff80, 0x1'0000'007f] */
246 	BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 0xffffff80 >> 1),
247 	/* r1 = [0xffff'ff80, 0xffff'ffff] or
251 	BPF_ALU64_IMM(BPF_SUB, BPF_REG_1, 0xffffff80 >> 1),
255 	BPF_ALU64_IMM(BPF_SUB, BPF_REG_1, 0xffffff80 >> 1),
280 	BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 0xffffff80 >> 1),
281 	/* r1 = [0xffff'ff80, 0x1'0000'007f] */
282 	BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 0xffffff80 >> 1),
283 	/* r1 = [0xffff'ff80, 0xffff'ffff] or
289 	BPF_ALU64_IMM(BPF_SUB, BPF_REG_1, 0xffffff80 >> 1),
293 	BPF_ALU64_IMM(BPF_SUB, BPF_REG_1, 0xffffff80 >> 1),
343 	BPF_MOV64_IMM(BPF_REG_1, 1),
344 	/* r1 = (u32)1 << (u32)32 = ? */
372 	BPF_ALU64_IMM(BPF_SUB, BPF_REG_1, 1),
400 	/* r1 = 1<<32 */
424 	BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
443 	BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
465 	BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
486 	BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
503 	BPF_MOV64_IMM(BPF_REG_1, -1),
505 	BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 1),
507 	BPF_JMP32_IMM(BPF_JGT, BPF_REG_1, 1, 3),
509 	BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 1),
510 	BPF_JMP32_IMM(BPF_JGT, BPF_REG_1, 2, 1),
511 	BPF_JMP_A(1),
513 	BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_0, -1),
522 	BPF_MOV64_IMM(BPF_REG_1, -1),
524 	BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 1),
528 	BPF_ALU32_IMM(BPF_ADD, BPF_REG_1, 1),
530 	BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_2, 1),
531 	BPF_JMP_A(1),
533 	BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_0, -1),
551 	BPF_JMP_REG(BPF_JGT, BPF_REG_3, BPF_REG_8, 1),
561 	"bounds check for reg = 0, reg xor 1",
568 	BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
571 	BPF_ALU64_IMM(BPF_XOR, BPF_REG_1, 1),
572 	BPF_JMP_IMM(BPF_JNE, BPF_REG_1, 0, 1),
581 	"bounds check for reg32 = 0, reg32 xor 1",
588 	BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
591 	BPF_ALU32_IMM(BPF_XOR, BPF_REG_1, 1),
592 	BPF_JMP32_IMM(BPF_JNE, BPF_REG_1, 0, 1),
608 	BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
612 	BPF_JMP_IMM(BPF_JGT, BPF_REG_1, 0, 1),
628 	BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
632 	BPF_JMP_IMM(BPF_JNE, BPF_REG_1, 0, 1),
650 	BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
654 	BPF_JMP32_IMM(BPF_JNE, BPF_REG_1, 0, 1),
672 	BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
677 	BPF_JMP_IMM(BPF_JGE, BPF_REG_1, 0, 1),
693 	BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
698 	BPF_JMP32_IMM(BPF_JGE, BPF_REG_1, 0, 1),
707 	"bounds checks after 32-bit truncation. test 1",
717 	BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 1),
718 	BPF_JMP_IMM(BPF_JGT, BPF_REG_1, 0x7fffffff, 1),
737 	BPF_JMP_IMM(BPF_JSLT, BPF_REG_1, 1, 1),
738 	BPF_JMP32_IMM(BPF_JSLT, BPF_REG_1, 0, 1),