Re: [PATCH v4 bpf-next 2/2] bpf: add selftest to check the verifier's abstract multiplication

[Eduard Zingerman <eddyz87@gmail.com>]

On Fri, 2025-08-22 at 22:38 +0530, Nandakumar Edamana wrote:
> This commit adds selftest to test the abstract multiplication
> technique(s) used by the verifier, following the recent improvement in
> tnum multiplication (tnum_mul). One of the newly added programs,
> verifier_mul/mul_precise, results in a false positive with the old
> tnum_mul, while the program passes with the latest one.
> 
> Signed-off-by: Nandakumar Edamana <nandakumar@nandakumar.co.in>
> ---

Thank you for adding the test cases.

[...]

Given that other two cases pass both with old and new algo and don't
look particularly interesting I'd keep only this one.

> +SEC("fentry/bpf_fentry_test1")
> +void BPF_PROG(mul_precise, int x)
> +{
> +	/* First, force the verifier to be uncertain about the value:
> +	 *     unsigned int a = (bpf_get_prandom_u32() & 0x2) | 0x1;
> +	 *
> +	 * Assuming the verifier is using tnum, a must be tnum{.v=0x1, .m=0x2}.
> +	 * Then a * 0x3 would be m0m1 (m for uncertain). Added imprecision
> +	 * would cause the following to fail, because the required return value
> +	 * is 0:
> +	 *     return (a * 0x3) & 0x4);
> +	 */
> +	asm volatile ("\
> +	call %[bpf_get_prandom_u32];\
> +	r0 &= 0x2;\
> +	r0 |= 0x1;\
> +	r0 *= 0x3;\
> +	r0 &= 0x4;\
> +	if r0 != 0 goto l0_%=;\
> +	r0 = 0;\
> +	goto l1_%=;\
> +l0_%=:\
> +	r0 = 1;\
> +l1_%=:\
> +"	:
> +	: __imm(bpf_get_prandom_u32)
> +	: __clobber_all);
> +}