kernel/bpf/verifier.c

18909 	struct bpf_insn insn_buf[16], *insn;
18920 		cnt = ops->gen_prologue(insn_buf, env->seen_direct_write,
18922 		if (cnt >= ARRAY_SIZE(insn_buf)) {
18926 			new_prog = bpf_patch_insn_data(env, 0, insn_buf, cnt);
19061 		cnt = convert_ctx_access(type, insn, insn_buf, env->prog,
19063 		if (cnt == 0 || cnt >= ARRAY_SIZE(insn_buf) ||
19072 			if (shift && cnt + 1 >= ARRAY_SIZE(insn_buf)) {
19078 					insn_buf[cnt++] = BPF_ALU32_IMM(BPF_RSH,
19081 				insn_buf[cnt++] = BPF_ALU32_IMM(BPF_AND, insn->dst_reg,
19085 					insn_buf[cnt++] = BPF_ALU64_IMM(BPF_RSH,
19088 				insn_buf[cnt++] = BPF_ALU32_IMM(BPF_AND, insn->dst_reg,
19093 			insn_buf[cnt++] = BPF_RAW_INSN(BPF_ALU64 | BPF_MOV | BPF_X,
19097 		new_prog = bpf_patch_insn_data(env, i + delta, insn_buf, cnt);
19446 					    struct bpf_insn *insn_buf,
19452 	insn_buf[0] = addr[0];
19453 	insn_buf[1] = addr[1];
19454 	insn_buf[2] = BPF_MOV64_IMM(node_offset_reg, insn_aux->insert_off);
19455 	insn_buf[3] = *insn;
19460 			    struct bpf_insn *insn_buf, int insn_idx, int *cnt)
19498 		insn_buf[0] = BPF_MOV64_IMM(BPF_REG_1, obj_new_size);
19499 		insn_buf[1] = addr[0];
19500 		insn_buf[2] = addr[1];
19501 		insn_buf[3] = *insn;
19522 		insn_buf[0] = addr[0];
19523 		insn_buf[1] = addr[1];
19524 		insn_buf[2] = *insn;
19546 						node_offset_reg, insn, insn_buf, cnt);
19549 		insn_buf[0] = BPF_MOV64_REG(BPF_REG_0, BPF_REG_1);
19595 	struct bpf_insn insn_buf[16];
19683 			cnt = env->ops->gen_ld_abs(insn, insn_buf);
19684 			if (cnt == 0 || cnt >= ARRAY_SIZE(insn_buf)) {
19689 			new_prog = bpf_patch_insn_data(env, i + delta, insn_buf, cnt);
19704 			struct bpf_insn *patch = &insn_buf[0];
19740 			cnt = patch - insn_buf;
19742 			new_prog = bpf_patch_insn_data(env, i + delta, insn_buf, cnt);
19756 			insn_buf[0] = BPF_LDX_MEM(BPF_DW, BPF_REG_AX, BPF_REG_10, stack_off);
19757 			insn_buf[1] = BPF_JMP_IMM(BPF_JEQ, BPF_REG_AX, 0, insn->off + 2);
19758 			insn_buf[2] = BPF_ALU64_IMM(BPF_SUB, BPF_REG_AX, 1);
19759 			insn_buf[3] = BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_AX, stack_off);
19762 			new_prog = bpf_patch_insn_data(env, i + delta, insn_buf, cnt);
19777 			ret = fixup_kfunc_call(env, insn, insn_buf, i + delta, &cnt);
19783 			new_prog = bpf_patch_insn_data(env, i + delta, insn_buf, cnt);
19856 			insn_buf[0] = BPF_JMP_IMM(BPF_JGE, BPF_REG_3,
19858 			insn_buf[1] = BPF_ALU32_IMM(BPF_AND, BPF_REG_3,
19862 			insn_buf[2] = *insn;
19864 			new_prog = bpf_patch_insn_data(env, i + delta, insn_buf, cnt);
19892 			insn_buf[0] = ld_addrs[0];
19893 			insn_buf[1] = ld_addrs[1];
19894 			insn_buf[2] = *insn;
19897 			new_prog = bpf_patch_insn_data(env, i + delta, insn_buf, cnt);
19910 				insn_buf[0] = BPF_MOV64_IMM(BPF_REG_5, (__force __s32)GFP_ATOMIC);
19912 				insn_buf[0] = BPF_MOV64_IMM(BPF_REG_5, (__force __s32)GFP_KERNEL);
19913 			insn_buf[1] = *insn;
19916 			new_prog = bpf_patch_insn_data(env, i + delta, insn_buf, cnt);
19931 			insn_buf[0] = BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_1, 0);
19932 			insn_buf[1] = *insn;
19935 			new_prog = bpf_patch_insn_data(env, i + delta, insn_buf, cnt);
19967 				cnt = ops->map_gen_lookup(map_ptr, insn_buf);
19970 				if (cnt <= 0 || cnt >= ARRAY_SIZE(insn_buf)) {
19976 							       insn_buf, cnt);
20052 			insn_buf[0] = ld_jiffies_addr[0];
20053 			insn_buf[1] = ld_jiffies_addr[1];
20054 			insn_buf[2] = BPF_LDX_MEM(BPF_DW, BPF_REG_0,
20058 			new_prog = bpf_patch_insn_data(env, i + delta, insn_buf,
20073 			insn_buf[0] = BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8);
20074 			insn_buf[1] = BPF_JMP32_REG(BPF_JGE, BPF_REG_2, BPF_REG_0, 6);
20075 			insn_buf[2] = BPF_ALU64_IMM(BPF_LSH, BPF_REG_2, 3);
20076 			insn_buf[3] = BPF_ALU64_REG(BPF_ADD, BPF_REG_2, BPF_REG_1);
20077 			insn_buf[4] = BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_2, 0);
20078 			insn_buf[5] = BPF_STX_MEM(BPF_DW, BPF_REG_3, BPF_REG_0, 0);
20079 			insn_buf[6] = BPF_MOV64_IMM(BPF_REG_0, 0);
20080 			insn_buf[7] = BPF_JMP_A(1);
20081 			insn_buf[8] = BPF_MOV64_IMM(BPF_REG_0, -EINVAL);
20084 			new_prog = bpf_patch_insn_data(env, i + delta, insn_buf, cnt);
20100 				insn_buf[0] = BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8);
20101 				insn_buf[1] = BPF_ALU64_IMM(BPF_LSH, BPF_REG_0, 3);
20102 				insn_buf[2] = BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1);
20103 				insn_buf[3] = BPF_LDX_MEM(BPF_DW, BPF_REG_3, BPF_REG_0, 0);
20104 				insn_buf[4] = BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_3, 0);
20105 				insn_buf[5] = BPF_MOV64_IMM(BPF_REG_0, 0);
20108 				insn_buf[0] = BPF_MOV64_IMM(BPF_REG_0, -EOPNOTSUPP);
20112 			new_prog = bpf_patch_insn_data(env, i + delta, insn_buf, cnt);
20126 			insn_buf[0] = BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8);
20128 			new_prog = bpf_patch_insn_data(env, i + delta, insn_buf, 1);
20141 			insn_buf[0] = BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -16);
20143 			new_prog = bpf_patch_insn_data(env, i + delta, insn_buf, 1);
20156 			insn_buf[0] = BPF_MOV64_REG(BPF_REG_0, BPF_REG_2);
20157 			insn_buf[1] = BPF_ATOMIC_OP(BPF_DW, BPF_XCHG, BPF_REG_1, BPF_REG_0, 0);
20160 			new_prog = bpf_patch_insn_data(env, i + delta, insn_buf, cnt);
20206 		insn_buf[0] = BPF_ST_MEM(BPF_DW, BPF_REG_FP,
20209 		insn_buf[1] = env->prog->insnsi[subprog_start];
20211 		new_prog = bpf_patch_insn_data(env, subprog_start, insn_buf, 2);
20260 	struct bpf_insn insn_buf[] = {
20299 	*cnt = ARRAY_SIZE(insn_buf);
20300 	new_prog = bpf_patch_insn_data(env, position, insn_buf, *cnt);
20306 	/* Note: insn_buf[12] is an offset of BPF_CALL_REL instruction */