@@ -1200,4 +1200,138 @@ l0_%=: r0 = 0; \
1200
1200
: __clobber_all );
1201
1201
}
1202
1202
1203
+ SEC ("tc" )
1204
+ __description ("multiply mixed sign bounds. test 1" )
1205
+ __success __log_level (2 )
1206
+ __msg ("r6 *= r7 {{.*}}; R6_w=scalar(smin=umin=0x1bc16d5cd4927ee1,smax=umax=0x1bc16d674ec80000,smax32=0x7ffffeff,umax32=0xfffffeff,var_off=(0x1bc16d4000000000; 0x3ffffffeff))" )
1207
+ __naked void mult_mixed0_sign (void )
1208
+ {
1209
+ asm volatile (
1210
+ "call %[bpf_get_prandom_u32];"
1211
+ "r6 = r0;"
1212
+ "call %[bpf_get_prandom_u32];"
1213
+ "r7 = r0;"
1214
+ "r6 &= 0xf;"
1215
+ "r6 -= 1000000000;"
1216
+ "r7 &= 0xf;"
1217
+ "r7 -= 2000000000;"
1218
+ "r6 *= r7;"
1219
+ "exit"
1220
+ :
1221
+ : __imm (bpf_get_prandom_u32 ),
1222
+ __imm (bpf_skb_store_bytes )
1223
+ : __clobber_all );
1224
+ }
1225
+
1226
+ SEC ("tc" )
1227
+ __description ("multiply mixed sign bounds. test 2" )
1228
+ __success __log_level (2 )
1229
+ __msg ("r6 *= r7 {{.*}}; R6_w=scalar(smin=smin32=-100,smax=smax32=200)" )
1230
+ __naked void mult_mixed1_sign (void )
1231
+ {
1232
+ asm volatile (
1233
+ "call %[bpf_get_prandom_u32];"
1234
+ "r6 = r0;"
1235
+ "call %[bpf_get_prandom_u32];"
1236
+ "r7 = r0;"
1237
+ "r6 &= 0xf;"
1238
+ "r6 -= 0xa;"
1239
+ "r7 &= 0xf;"
1240
+ "r7 -= 0x14;"
1241
+ "r6 *= r7;"
1242
+ "exit"
1243
+ :
1244
+ : __imm (bpf_get_prandom_u32 ),
1245
+ __imm (bpf_skb_store_bytes )
1246
+ : __clobber_all );
1247
+ }
1248
+
1249
+ SEC ("tc" )
1250
+ __description ("multiply negative bounds" )
1251
+ __success __log_level (2 )
1252
+ __msg ("r6 *= r7 {{.*}}; R6_w=scalar(smin=umin=smin32=umin32=0x3ff280b0,smax=umax=smax32=umax32=0x3fff0001,var_off=(0x3ff00000; 0xf81ff))" )
1253
+ __naked void mult_sign_bounds (void )
1254
+ {
1255
+ asm volatile (
1256
+ "r8 = 0x7fff;"
1257
+ "call %[bpf_get_prandom_u32];"
1258
+ "r6 = r0;"
1259
+ "call %[bpf_get_prandom_u32];"
1260
+ "r7 = r0;"
1261
+ "r6 &= 0xa;"
1262
+ "r6 -= r8;"
1263
+ "r7 &= 0xf;"
1264
+ "r7 -= r8;"
1265
+ "r6 *= r7;"
1266
+ "exit"
1267
+ :
1268
+ : __imm (bpf_get_prandom_u32 ),
1269
+ __imm (bpf_skb_store_bytes )
1270
+ : __clobber_all );
1271
+ }
1272
+
1273
+ SEC ("tc" )
1274
+ __description ("multiply bounds that don't cross signed boundary" )
1275
+ __success __log_level (2 )
1276
+ __msg ("r8 *= r6 {{.*}}; R6_w=scalar(smin=smin32=0,smax=umax=smax32=umax32=11,var_off=(0x0; 0xb)) R8_w=scalar(smin=0,smax=umax=0x7b96bb0a94a3a7cd,var_off=(0x0; 0x7fffffffffffffff))" )
1277
+ __naked void mult_no_sign_crossing (void )
1278
+ {
1279
+ asm volatile (
1280
+ "r6 = 0xb;"
1281
+ "r8 = 0xb3c3f8c99262687 ll;"
1282
+ "call %[bpf_get_prandom_u32];"
1283
+ "r7 = r0;"
1284
+ "r6 &= r7;"
1285
+ "r8 *= r6;"
1286
+ "exit"
1287
+ :
1288
+ : __imm (bpf_get_prandom_u32 ),
1289
+ __imm (bpf_skb_store_bytes )
1290
+ : __clobber_all );
1291
+ }
1292
+
1293
+ SEC ("tc" )
1294
+ __description ("multiplication overflow, result in unbounded reg. test 1" )
1295
+ __success __log_level (2 )
1296
+ __msg ("r6 *= r7 {{.*}}; R6_w=scalar()" )
1297
+ __naked void mult_unsign_ovf (void )
1298
+ {
1299
+ asm volatile (
1300
+ "r8 = 0x7ffffffffff ll;"
1301
+ "call %[bpf_get_prandom_u32];"
1302
+ "r6 = r0;"
1303
+ "call %[bpf_get_prandom_u32];"
1304
+ "r7 = r0;"
1305
+ "r6 &= 0x7fffffff;"
1306
+ "r7 &= r8;"
1307
+ "r6 *= r7;"
1308
+ "exit"
1309
+ :
1310
+ : __imm (bpf_get_prandom_u32 ),
1311
+ __imm (bpf_skb_store_bytes )
1312
+ : __clobber_all );
1313
+ }
1314
+
1315
+ SEC ("tc" )
1316
+ __description ("multiplication overflow, result in unbounded reg. test 2" )
1317
+ __success __log_level (2 )
1318
+ __msg ("r6 *= r7 {{.*}}; R6_w=scalar()" )
1319
+ __naked void mult_sign_ovf (void )
1320
+ {
1321
+ asm volatile (
1322
+ "r8 = 0x7ffffffff ll;"
1323
+ "call %[bpf_get_prandom_u32];"
1324
+ "r6 = r0;"
1325
+ "call %[bpf_get_prandom_u32];"
1326
+ "r7 = r0;"
1327
+ "r6 &= 0xa;"
1328
+ "r6 -= r8;"
1329
+ "r7 &= 0x7fffffff;"
1330
+ "r6 *= r7;"
1331
+ "exit"
1332
+ :
1333
+ : __imm (bpf_get_prandom_u32 ),
1334
+ __imm (bpf_skb_store_bytes )
1335
+ : __clobber_all );
1336
+ }
1203
1337
char _license [] SEC ("license" ) = "GPL" ;
0 commit comments