Lines Matching +full:no +full:- +full:1 +full:- +full:8 +full:- +full:v
1 // SPDX-License-Identifier: GPL-2.0
35 int *v, i = zero; /* obscure initial value of i */ in iter_err_unsafe_c_loop() local
40 while ((v = bpf_iter_num_next(&it))) { in iter_err_unsafe_c_loop()
63 "r4 = 1;" in iter_err_unsafe_asm_loop()
69 "r6 += 1;" in iter_err_unsafe_asm_loop()
97 int *v; in iter_while_loop() local
102 while ((v = bpf_iter_num_next(&it))) { in iter_while_loop()
103 bpf_printk("ITER_BASIC: E1 VAL: v=%d", *v); in iter_while_loop()
115 int *v; in iter_while_loop_auto_cleanup() local
120 while ((v = bpf_iter_num_next(&it))) { in iter_while_loop_auto_cleanup()
121 bpf_printk("ITER_BASIC: E1 VAL: v=%d", *v); in iter_while_loop_auto_cleanup()
123 /* (!) no explicit bpf_iter_num_destroy() */ in iter_while_loop_auto_cleanup()
133 int *v; in iter_for_loop() local
138 for (v = bpf_iter_num_next(&it); v; v = bpf_iter_num_next(&it)) { in iter_for_loop()
139 bpf_printk("ITER_BASIC: E2 VAL: v=%d", *v); in iter_for_loop()
150 int *v; in iter_bpf_for_each_macro() local
154 bpf_for_each(num, v, 5, 10) { in iter_bpf_for_each_macro()
155 bpf_printk("ITER_BASIC: E2 VAL: v=%d", *v); in iter_bpf_for_each_macro()
170 bpf_printk("ITER_BASIC: E2 VAL: v=%d", i); in iter_bpf_for_macro()
181 int *v, i; in iter_pragma_unroll_loop() local
188 v = bpf_iter_num_next(&it); in iter_pragma_unroll_loop()
189 bpf_printk("ITER_BASIC: E3 VAL: i=%d v=%d", i, v ? *v : -1); in iter_pragma_unroll_loop()
201 int *v; in iter_manual_unroll_loop() local
206 v = bpf_iter_num_next(&it); in iter_manual_unroll_loop()
207 bpf_printk("ITER_BASIC: E4 VAL: v=%d", v ? *v : -1); in iter_manual_unroll_loop()
208 v = bpf_iter_num_next(&it); in iter_manual_unroll_loop()
209 bpf_printk("ITER_BASIC: E4 VAL: v=%d", v ? *v : -1); in iter_manual_unroll_loop()
210 v = bpf_iter_num_next(&it); in iter_manual_unroll_loop()
211 bpf_printk("ITER_BASIC: E4 VAL: v=%d", v ? *v : -1); in iter_manual_unroll_loop()
212 v = bpf_iter_num_next(&it); in iter_manual_unroll_loop()
213 bpf_printk("ITER_BASIC: E4 VAL: v=%d\n", v ? *v : -1); in iter_manual_unroll_loop()
224 int *v, i; in iter_multiple_sequential_loops() local
229 while ((v = bpf_iter_num_next(&it))) { in iter_multiple_sequential_loops()
230 bpf_printk("ITER_BASIC: E1 VAL: v=%d", *v); in iter_multiple_sequential_loops()
235 for (v = bpf_iter_num_next(&it); v; v = bpf_iter_num_next(&it)) { in iter_multiple_sequential_loops()
236 bpf_printk("ITER_BASIC: E2 VAL: v=%d", *v); in iter_multiple_sequential_loops()
243 v = bpf_iter_num_next(&it); in iter_multiple_sequential_loops()
244 bpf_printk("ITER_BASIC: E3 VAL: i=%d v=%d", i, v ? *v : -1); in iter_multiple_sequential_loops()
249 v = bpf_iter_num_next(&it); in iter_multiple_sequential_loops()
250 bpf_printk("ITER_BASIC: E4 VAL: v=%d", v ? *v : -1); in iter_multiple_sequential_loops()
251 v = bpf_iter_num_next(&it); in iter_multiple_sequential_loops()
252 bpf_printk("ITER_BASIC: E4 VAL: v=%d", v ? *v : -1); in iter_multiple_sequential_loops()
253 v = bpf_iter_num_next(&it); in iter_multiple_sequential_loops()
254 bpf_printk("ITER_BASIC: E4 VAL: v=%d", v ? *v : -1); in iter_multiple_sequential_loops()
255 v = bpf_iter_num_next(&it); in iter_multiple_sequential_loops()
256 bpf_printk("ITER_BASIC: E4 VAL: v=%d\n", v ? *v : -1); in iter_multiple_sequential_loops()
267 int *v, i = 0, sum = 0; in iter_limit_cond_break_loop() local
272 while ((v = bpf_iter_num_next(&it))) { in iter_limit_cond_break_loop()
273 bpf_printk("ITER_SIMPLE: i=%d v=%d", i, *v); in iter_limit_cond_break_loop()
274 sum += *v; in iter_limit_cond_break_loop()
292 int *v, sum = 0; in iter_obfuscate_counter() local
301 while ((v = bpf_iter_num_next(&it))) { in iter_obfuscate_counter()
304 i += 1; in iter_obfuscate_counter()
307 * track that i becomes 1 on first iteration after increment in iter_obfuscate_counter()
309 * and mark i as precise, ruining open-coded iterator logic in iter_obfuscate_counter()
311 * *precise* value of i, and thus there would be no in iter_obfuscate_counter()
313 * instruction limit, no matter what the limit is. in iter_obfuscate_counter()
315 if (i == 1) in iter_obfuscate_counter()
318 x = i * 3 + 1; in iter_obfuscate_counter()
320 bpf_printk("ITER_OBFUSCATE_COUNTER: i=%d v=%d x=%d", i, *v, x); in iter_obfuscate_counter()
336 int *v, *elem = NULL; in iter_search_loop() local
343 while ((v = bpf_iter_num_next(&it))) { in iter_search_loop()
344 bpf_printk("ITER_SEARCH_LOOP: v=%d", *v); in iter_search_loop()
346 if (*v == 2) { in iter_search_loop()
348 elem = v; in iter_search_loop()
409 /* zero-initialize sums */ in iter_nested_iters()
434 col == ARRAY_SIZE(arr2d[0]) - 1 ? "\n" : ""); in iter_nested_iters()
453 sum += 1; in iter_nested_deeply_iters()
499 /* zero-initialize sums */ in iter_subprog_iters()
521 col == ARRAY_SIZE(arr2d[0]) - 1 ? "\n" : ""); in iter_subprog_iters()
634 /* zero-init arr1 and arr2 in such a way that verifier doesn't know in iter_stack_array_loop()
636 * all combination of zero/non-zero stack slots for arr1/arr2, which in iter_stack_array_loop()
645 if (i & 1) { in iter_stack_array_loop()
732 * The call to bpf_iter_num_next() is reachable with r7 values &fp[-16] and 0xdead. in delayed_read_mark()
733 * State with r7=&fp[-16] is visited first and follows r6 != 42 ... continue branch. in delayed_read_mark()
734 * At this point iterator next() call is reached with r7 that has no read mark. in delayed_read_mark()
739 * r7 = &fp[-16] in delayed_read_mark()
740 * fp[-16] = 0 in delayed_read_mark()
742 * bpf_iter_num_new(&fp[-8], 0, 10) in delayed_read_mark()
743 * while (bpf_iter_num_next(&fp[-8])) { in delayed_read_mark()
749 * bpf_probe_read_user(r7, 8, 0xdeadbeef); // this is not safe in delayed_read_mark()
751 * bpf_iter_num_destroy(&fp[-8]) in delayed_read_mark()
756 "r7 += -16;" in delayed_read_mark()
762 "r1 += -8;" in delayed_read_mark()
766 "1:" in delayed_read_mark()
768 "r1 += -8;" in delayed_read_mark()
771 "r6 += 1;" in delayed_read_mark()
774 "goto 1b;" in delayed_read_mark()
777 "r2 = 8;" in delayed_read_mark()
780 "goto 1b;" in delayed_read_mark()
783 "r1 += -8;" in delayed_read_mark()
805 * The call to bpf_iter_num_next() is reachable with r7 values -16 and -32. in delayed_precision_mark()
806 * State with r7=-16 is visited first and follows r6 != 42 ... continue branch. in delayed_precision_mark()
807 * At this point iterator next() call is reached with r7 that has no read in delayed_precision_mark()
809 * Loop body with r7=-32 would only be visited if verifier would decide to continue in delayed_precision_mark()
814 * fp[-16] = 0 in delayed_precision_mark()
815 * r7 = -16 in delayed_precision_mark()
817 * bpf_iter_num_new(&fp[-8], 0, 10) in delayed_precision_mark()
818 * while (bpf_iter_num_next(&fp[-8])) { in delayed_precision_mark()
820 * r7 = -32 in delayed_precision_mark()
829 * bpf_iter_num_destroy(&fp[-8]) in delayed_precision_mark()
834 "*(u64 *)(r10 - 16) = r8;" in delayed_precision_mark()
835 "r7 = -16;" in delayed_precision_mark()
839 "r1 += -8;" in delayed_precision_mark()
843 "1:" in delayed_precision_mark()
845 "r1 += -8;\n" in delayed_precision_mark()
849 "r7 = -33;" in delayed_precision_mark()
852 "goto 1b;\n" in delayed_precision_mark()
859 "goto 1b;\n" in delayed_precision_mark()
862 "r1 += -8;" in delayed_precision_mark()
885 * - states with c=-25 are explored only on a second iteration in __flag()
887 * - states with read+precise mark on c are explored only on in __flag()
893 * unsafe c=-25 memory access. in __flag()
895 * j = iter_new(); // fp[-16] in __flag()
898 * c = -24; // r8 in __flag()
900 * i = iter_new(); // fp[-8] in __flag()
904 * if (a == 1) { in __flag()
906 * b = 1; in __flag()
908 * a = 1; in __flag()
911 * if (b == 1) { in __flag()
922 * c = -25; in __flag()
929 "r1 += -16;" in __flag()
935 "r8 = -24;" in __flag()
938 "r1 += -16;" in __flag()
942 "r1 += -8;" in __flag()
950 "r1 += -8;" in __flag()
954 "if r6 != 1 goto check_zero_r6_%=;" in __flag()
956 "r7 = 1;" in __flag()
960 "r6 = 1;" in __flag()
965 "if r7 != 1 goto i_loop_%=;" in __flag()
971 "r1 += -8;" in __flag()
974 "r1 += -16;" in __flag()
980 "r1 += -8;" in __flag()
984 "r8 = -25;" in __flag()
988 "r1 += -16;" in __flag()
1010 * - states with read+precise mark on c are explored only on a second in __flag()
1013 * - states with c=-25 are explored only on a second iteration of the in __flag()
1019 * unsafe c=-25 memory access. in __flag()
1021 * j = iter_new(); // fp[-16] in __flag()
1024 * c = -24; // r8 in __flag()
1026 * i = iter_new(); // fp[-8] in __flag()
1030 * if (a == 1) { in __flag()
1032 * b = 1; in __flag()
1034 * a = 1; in __flag()
1037 * if (b == 1) { in __flag()
1046 * i = iter_new(); // fp[-8] in __flag()
1050 * if (a == 1) { in __flag()
1052 * b = 1; in __flag()
1054 * a = 1; in __flag()
1057 * if (b == 1) { in __flag()
1059 * c = -25; in __flag()
1070 "r1 += -16;" in __flag()
1076 "r8 = -24;" in __flag()
1079 "r1 += -16;" in __flag()
1085 "r1 += -8;" in __flag()
1093 "r1 += -8;" in __flag()
1097 "if r6 != 1 goto check_zero_r6_%=;" in __flag()
1099 "r7 = 1;" in __flag()
1103 "r6 = 1;" in __flag()
1108 "if r7 != 1 goto i_loop_%=;" in __flag()
1114 "r1 += -8;" in __flag()
1117 "r1 += -16;" in __flag()
1123 "r1 += -8;" in __flag()
1128 "r1 += -8;" in __flag()
1136 "r1 += -8;" in __flag()
1140 "if r6 != 1 goto check2_zero_r6_%=;" in __flag()
1142 "r7 = 1;" in __flag()
1146 "r6 = 1;" in __flag()
1151 "if r7 != 1 goto i2_loop_%=;" in __flag()
1153 "r8 = -25;" in __flag()
1157 "r1 += -8;" in __flag()
1165 "r1 += -16;" in __flag()
1188 * bpf_iter_num_new(&fp[-8], 0, 10) in triple_continue()
1189 * while (bpf_iter_num_next(&fp[-8])) { in triple_continue()
1198 * bpf_iter_num_destroy(&fp[-8]) in triple_continue()
1203 "r1 += -8;" in triple_continue()
1209 "r1 += -8;" in triple_continue()
1222 "r1 += -8;" in triple_continue()
1240 * The counter is stored in fp[-16], if this counter is not widened in widen_spill()
1243 * fp[-16] = 0 in widen_spill()
1244 * bpf_iter_num_new(&fp[-8], 0, 10) in widen_spill()
1245 * while (bpf_iter_num_next(&fp[-8])) { in widen_spill()
1246 * r0 = fp[-16]; in widen_spill()
1247 * r0 += 1; in widen_spill()
1248 * fp[-16] = r0; in widen_spill()
1250 * bpf_iter_num_destroy(&fp[-8]) in widen_spill()
1255 "*(u64 *)(r10 - 16) = r0;" in widen_spill()
1257 "r1 += -8;" in widen_spill()
1263 "r1 += -8;" in widen_spill()
1266 "r0 = *(u64 *)(r10 - 16);" in widen_spill()
1267 "r0 += 1;" in widen_spill()
1268 "*(u64 *)(r10 - 16) = r0;" in widen_spill()
1272 "r1 += -8;" in widen_spill()
1299 * if (a) sum += 1; in checkpoint_states_deletion()
1300 * if (b) sum += 1; in checkpoint_states_deletion()
1301 * if (c) sum += 1; in checkpoint_states_deletion()
1302 * if (d) sum += 1; in checkpoint_states_deletion()
1303 * if (e) sum += 1; in checkpoint_states_deletion()
1304 * if (f) sum += 1; in checkpoint_states_deletion()
1309 * with different combination of NULL/non-NULL information for a/b/c/d/e/f. in checkpoint_states_deletion()
1314 * exploration would be finished (at-least for a specific path). in checkpoint_states_deletion()
1320 * sl->miss_cnt > sl->hit_cnt * N + N // if true sl->state is evicted in checkpoint_states_deletion()
1328 "*(u64 *)(r10 - 24) = r6;" /* d */ in checkpoint_states_deletion()
1329 "*(u64 *)(r10 - 32) = r6;" /* e */ in checkpoint_states_deletion()
1330 "*(u64 *)(r10 - 40) = r6;" /* f */ in checkpoint_states_deletion()
1333 "r1 += -8;" in checkpoint_states_deletion()
1339 "r1 += -8;" in checkpoint_states_deletion()
1343 "*(u64 *)(r10 - 16) = r0;" in checkpoint_states_deletion()
1347 "r2 += -16;" in checkpoint_states_deletion()
1353 "r2 += -16;" in checkpoint_states_deletion()
1359 "r2 += -16;" in checkpoint_states_deletion()
1365 "r2 += -16;" in checkpoint_states_deletion()
1367 "*(u64 *)(r10 - 24) = r0;" in checkpoint_states_deletion()
1371 "r2 += -16;" in checkpoint_states_deletion()
1373 "*(u64 *)(r10 - 32) = r0;" in checkpoint_states_deletion()
1377 "r2 += -16;" in checkpoint_states_deletion()
1379 "*(u64 *)(r10 - 40) = r0;" in checkpoint_states_deletion()
1381 "if r6 == 0 goto +1;" in checkpoint_states_deletion()
1382 "r9 += 1;" in checkpoint_states_deletion()
1383 "if r7 == 0 goto +1;" in checkpoint_states_deletion()
1384 "r9 += 1;" in checkpoint_states_deletion()
1385 "if r8 == 0 goto +1;" in checkpoint_states_deletion()
1386 "r9 += 1;" in checkpoint_states_deletion()
1387 "r0 = *(u64 *)(r10 - 24);" in checkpoint_states_deletion()
1388 "if r0 == 0 goto +1;" in checkpoint_states_deletion()
1389 "r9 += 1;" in checkpoint_states_deletion()
1390 "r0 = *(u64 *)(r10 - 32);" in checkpoint_states_deletion()
1391 "if r0 == 0 goto +1;" in checkpoint_states_deletion()
1392 "r9 += 1;" in checkpoint_states_deletion()
1393 "r0 = *(u64 *)(r10 - 40);" in checkpoint_states_deletion()
1394 "if r0 == 0 goto +1;" in checkpoint_states_deletion()
1395 "r9 += 1;" in checkpoint_states_deletion()
1400 "r1 += -8;" in checkpoint_states_deletion()
1429 /* no rechecking of i against ARRAY_SIZE(loop_data.n) */ in iter_arr_with_actual_elem_count()