selftests/bpf: iterator based loop and STACK_MISC states pruning

The test case first initializes 9 stack slots as STACK_MISC,
then conditionally updates each of them to SCALAR spill inside an
iterator based loop. This leads to 2**9 combinations of MISC/SPILL
marks for these slots at the iterator next call.
The loop converges only if the verifier treats such states as
equivalent, otherwise visited states are evicted from the states cache
too quickly.

Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
Link: https://lore.kernel.org/r/20251230-loop-stack-misc-pruning-v1-2-585cfd6cec51@gmail.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>

diff --git a/tools/testing/selftests/bpf/progs/iters.c b/tools/testing/selftests/bpf/progs/iters.c
index 69061f0309579eada74e5f2a68640470ff94a8b3..7f27b517d5d5668a0d2204cb8f9a0632806c3959 100644 (file)
--- a/tools/testing/selftests/bpf/progs/iters.c
+++ b/tools/testing/selftests/bpf/progs/iters.c
@@ -1997,6 +1997,71 @@ static void loop_cb4(void)
                "goto 2b;"
                :
                : __imm(bpf_get_prandom_u32)
+       );
+}
+
+SEC("raw_tp")
+__success
+__naked int stack_misc_vs_scalar_in_a_loop(void)
+{
+       asm volatile(
+               "*(u8 *)(r10 - 15) = 1;" /* This marks stack slot fp[-16] as STACK_MISC. */
+               "*(u8 *)(r10 - 23) = 1;"
+               "*(u8 *)(r10 - 31) = 1;"
+               "*(u8 *)(r10 - 39) = 1;"
+               "*(u8 *)(r10 - 47) = 1;"
+               "*(u8 *)(r10 - 55) = 1;"
+               "*(u8 *)(r10 - 63) = 1;"
+               "*(u8 *)(r10 - 71) = 1;"
+               "*(u8 *)(r10 - 79) = 1;"
+               "r1 = r10;"
+               "r1 += -8;"
+               "r2 = 0;"
+               "r3 = 10;"
+               "call %[bpf_iter_num_new];"
+       "loop_%=:"
+               "r1 = r10;"
+               "r1 += -8;"
+               "call %[bpf_iter_num_next];"
+               "if r0 == 0 goto loop_end_%=;"
+
+#define maybe_change_stack_slot(off) \
+               "call %[bpf_get_prandom_u32];"  \
+               "if r0 == 42 goto +1;"          \
+               "goto +1;"                      \
+               "*(u64 *)(r10 " #off ") = r0;"
+
+               /*
+                * When comparing verifier states fp[-16] will be
+                * either STACK_MISC or SCALAR. Pruning logic should
+                * consider old STACK_MISC equivalent to current SCALAR
+                * to avoid states explosion.
+                */
+               maybe_change_stack_slot(-16)
+               maybe_change_stack_slot(-24)
+               maybe_change_stack_slot(-32)
+               maybe_change_stack_slot(-40)
+               maybe_change_stack_slot(-48)
+               maybe_change_stack_slot(-56)
+               maybe_change_stack_slot(-64)
+               maybe_change_stack_slot(-72)
+               maybe_change_stack_slot(-80)
+
+#undef maybe_change_stack_slot
+
+               "goto loop_%=;"
+       "loop_end_%=:"
+               "r1 = r10;"
+               "r1 += -8;"
+               "call %[bpf_iter_num_destroy];"
+               "r0 = 0;"
+               "exit;"
+               :
+               : __imm(bpf_get_prandom_u32),
+                 __imm(bpf_iter_num_new),
+                 __imm(bpf_iter_num_next),
+                 __imm(bpf_iter_num_destroy),
+                 __imm_addr(amap)
                : __clobber_all
        );
 }