[PATCH bpf-next v2 06/13] selftests/bpf: cover sign extensions that cannot change the range

[Vineet Gupta]

Both programs build a range that straddles zero but still fits the target
field, so the sign extension is a no-op: [-4095, 0] for (s32) and [-63, 0]
for (s8). The guard that follows can only be resolved statically if the
range survives, and it protects a div by zero, so a widened range is a
verification failure rather than a silently weaker test.

These sit in verifier_movsx.c rather than with the linked-scalar tests:
they exercise the range a sign-extending mov produces, which has nothing
to do with the ->id machinery, and the file already gates on the cpuv4
support they need.

Signed-off-by: Vineet Gupta <vineet.gupta@xxxxxxxxx>
---
v2: new, with 5/13.
 .../selftests/bpf/progs/verifier_movsx.c      | 51 +++++++++++++++++++
 1 file changed, 51 insertions(+)

diff --git a/tools/testing/selftests/bpf/progs/verifier_movsx.c b/tools/testing/selftests/bpf/progs/verifier_movsx.c
index 195b27a51224..3a0e67ebb963 100644
--- a/tools/testing/selftests/bpf/progs/verifier_movsx.c
+++ b/tools/testing/selftests/bpf/progs/verifier_movsx.c
@@ -202,6 +202,57 @@ l0_%=:							\
 	: __clobber_all);
 }
 
+/*
+ * A range that already fits the field is unchanged by the sign extension.
+ * Both of these straddle zero, so the high bits of smin and smax differ and
+ * the top_s*_value test alone would fall back to the full field range.
+ */
+SEC("socket")
+__description("MOV64SX, S32, negative range is preserved")
+__success __success_unpriv __retval(0)
+__naked void mov64sx_s32_negative_range(void)
+{
+	asm volatile ("					\
+	call %[bpf_get_prandom_u32];			\
+	w0 &= 0xfff;					\
+	r0 -= 0xfff;					\
+	/* r0 is [-4095, 0], already a valid s32 */	\
+	r0 = (s32)r0;					\
+	if r0 s< -0xfff goto l0_%=;			\
+	r0 = 0;						\
+	exit;						\
+l0_%=:							\
+	/* unreachable unless the range was widened */	\
+	r0 /= 0;					\
+	exit;						\
+"	:
+	: __imm(bpf_get_prandom_u32)
+	: __clobber_all);
+}
+
+SEC("socket")
+__description("MOV64SX, S8, negative range is preserved")
+__success __success_unpriv __retval(0)
+__naked void mov64sx_s8_negative_range(void)
+{
+	asm volatile ("					\
+	call %[bpf_get_prandom_u32];			\
+	w0 &= 0x3f;					\
+	r0 -= 0x3f;					\
+	/* r0 is [-63, 0], already a valid s8 */	\
+	r0 = (s8)r0;					\
+	if r0 s< -0x3f goto l0_%=;			\
+	r0 = 0;						\
+	exit;						\
+l0_%=:							\
+	/* unreachable unless the range was widened */	\
+	r0 /= 0;					\
+	exit;						\
+"	:
+	: __imm(bpf_get_prandom_u32)
+	: __clobber_all);
+}
+
 SEC("socket")
 __description("MOV64SX, S16, R10 Sign Extension")
 __failure __msg("R1 type=scalar expected=fp, pkt, pkt_meta, map_key, map_value, mem, ringbuf_mem, buf, trusted_ptr_")
-- 
2.53.0-Meta