1// SPDX-License-Identifier: GPL-2.0-only
2#include <stddef.h>
3#include <linux/bpf.h>
4#include <bpf/bpf_helpers.h>
5#include "bpf_misc.h"
6
7__noinline int foo(unsigned int *v)
8{
9	if (v)
10		*v = bpf_get_prandom_u32();
11
12	return 0;
13}
14
15SEC("cgroup_skb/ingress")
16__failure __msg("At program exit the register R0 has ")
17int global_func15(struct __sk_buff *skb)
18{
19	unsigned int v = 1;
20
21	foo(&v);
22
23	return v;
24}
25
26SEC("cgroup_skb/ingress")
27__log_level(2) __flag(BPF_F_TEST_STATE_FREQ)
28__failure
29/* check that fallthrough code path marks r0 as precise */
30__msg("mark_precise: frame0: regs=r0 stack= before 2: (b7) r0 = 1")
31/* check that branch code path marks r0 as precise */
32__msg("mark_precise: frame0: regs=r0 stack= before 0: (85) call bpf_get_prandom_u32#7")
33__msg("At program exit the register R0 has ")
34__naked int global_func15_tricky_pruning(void)
35{
36	asm volatile (
37		"call %[bpf_get_prandom_u32];"
38		"if r0 s> 1000 goto 1f;"
39		"r0 = 1;"
40	"1:"
41		"goto +0;" /* checkpoint */
42		/* cgroup_skb/ingress program is expected to return [0, 1]
43		 * values, so branch above makes sure that in a fallthrough
44		 * case we have a valid 1 stored in R0 register, but in
45		 * a branch case we assign some random value to R0.  So if
46		 * there is something wrong with precision tracking for R0 at
47		 * program exit, we might erronenously prune branch case,
48		 * because R0 in fallthrough case is imprecise (and thus any
49		 * value is valid from POV of verifier is_state_equal() logic)
50		 */
51		"exit;"
52		:
53		: __imm(bpf_get_prandom_u32)
54		: __clobber_common
55	);
56}
57