diff mbox series

[bpf-next,v3,4/5] selftests/bpf: BPF test_verifier selftests for bpf_loop inlining

Message ID 20220603141047.2163170-5-eddyz87@gmail.com (mailing list archive)
State Superseded
Delegated to: BPF
Headers show
Series bpf_loop inlining | expand

Checks

Context Check Description
netdev/tree_selection success Clearly marked for bpf-next, async
netdev/fixes_present success Fixes tag not required for -next series
netdev/subject_prefix success Link
netdev/cover_letter success Series has a cover letter
netdev/patch_count success Link
netdev/header_inline success No static functions without inline keyword in header files
netdev/build_32bit success Errors and warnings before: 0 this patch: 0
netdev/cc_maintainers warning 8 maintainers not CCed: netdev@vger.kernel.org songliubraving@fb.com linux-kselftest@vger.kernel.org yhs@fb.com john.fastabend@gmail.com kafai@fb.com shuah@kernel.org kpsingh@kernel.org
netdev/build_clang success Errors and warnings before: 0 this patch: 0
netdev/module_param success Was 0 now: 0
netdev/verify_signedoff success Signed-off-by tag matches author and committer
netdev/check_selftest success No net selftest shell script
netdev/verify_fixes success No Fixes tag
netdev/build_allmodconfig_warn success Errors and warnings before: 0 this patch: 0
netdev/checkpatch warning WARNING: Missing or malformed SPDX-License-Identifier tag in line 1 WARNING: added, moved or deleted file(s), does MAINTAINERS need updating? WARNING: line length of 82 exceeds 80 columns WARNING: line length of 83 exceeds 80 columns
netdev/kdoc success Errors and warnings before: 0 this patch: 0
netdev/source_inline fail Was 0 now: 3
bpf/vmtest-bpf-next-VM_Test-3 success Logs for Kernel LATEST on z15 with gcc
bpf/vmtest-bpf-next-PR success PR summary
bpf/vmtest-bpf-next-VM_Test-1 success Logs for Kernel LATEST on ubuntu-latest with gcc
bpf/vmtest-bpf-next-VM_Test-2 success Logs for Kernel LATEST on ubuntu-latest with llvm-15

Commit Message

Eduard Zingerman June 3, 2022, 2:10 p.m. UTC 
A number of test cases for BPF selftests test_verifier to check how
bpf_loop inline transformation rewrites the BPF program. The following
cases are covered:
 - happy path
 - no-rewrite when flags is non-zero
 - no-rewrite when callback is non-constant
 - subprogno in insn_aux is updated correctly when dead sub-programs
   are removed
 - check that correct stack offsets are assigned for spilling of R6-R8
   registers

Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
---
 .../selftests/bpf/verifier/bpf_loop_inline.c  | 244 ++++++++++++++++++
 1 file changed, 244 insertions(+)
 create mode 100644 tools/testing/selftests/bpf/verifier/bpf_loop_inline.c

Comments

Song Liu June 3, 2022, 10:38 p.m. UTC | #1 
On Fri, Jun 3, 2022 at 7:11 AM Eduard Zingerman <eddyz87@gmail.com> wrote:
>
> A number of test cases for BPF selftests test_verifier to check how
> bpf_loop inline transformation rewrites the BPF program. The following
> cases are covered:
>  - happy path
>  - no-rewrite when flags is non-zero
>  - no-rewrite when callback is non-constant
>  - subprogno in insn_aux is updated correctly when dead sub-programs
>    are removed
>  - check that correct stack offsets are assigned for spilling of R6-R8
>    registers
>
> Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>

Acked-by: Song Liu <songliubraving@fb.com>

> ---
>  .../selftests/bpf/verifier/bpf_loop_inline.c  | 244 ++++++++++++++++++
>  1 file changed, 244 insertions(+)
>  create mode 100644 tools/testing/selftests/bpf/verifier/bpf_loop_inline.c
>
> diff --git a/tools/testing/selftests/bpf/verifier/bpf_loop_inline.c b/tools/testing/selftests/bpf/verifier/bpf_loop_inline.c
> new file mode 100644
> index 000000000000..d1fbcfef69f2
> --- /dev/null
> +++ b/tools/testing/selftests/bpf/verifier/bpf_loop_inline.c
> @@ -0,0 +1,244 @@
> +#define BTF_TYPES \
> +       .btf_strings = "\0int\0i\0ctx\0callback\0main\0", \
> +       .btf_types = { \
> +       /* 1: int   */ BTF_TYPE_INT_ENC(1, BTF_INT_SIGNED, 0, 32, 4), \
> +       /* 2: int*  */ BTF_PTR_ENC(1), \
> +       /* 3: void* */ BTF_PTR_ENC(0), \
> +       /* 4: int __(void*) */ BTF_FUNC_PROTO_ENC(1, 1), \
> +               BTF_FUNC_PROTO_ARG_ENC(7, 3), \
> +       /* 5: int __(int, int*) */ BTF_FUNC_PROTO_ENC(1, 2), \
> +               BTF_FUNC_PROTO_ARG_ENC(5, 1), \
> +               BTF_FUNC_PROTO_ARG_ENC(7, 2), \
> +       /* 6: main      */ BTF_FUNC_ENC(20, 4), \
> +       /* 7: callback  */ BTF_FUNC_ENC(11, 5), \
> +       BTF_END_RAW \
> +       }
> +
> +#define MAIN_TYPE      6
> +#define CALLBACK_TYPE  7
> +
> +/* can't use BPF_CALL_REL, jit_subprogs adjusts IMM & OFF
> + * fields for pseudo calls
> + */
> +#define PSEUDO_CALL_INSN() \
> +       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, BPF_PSEUDO_CALL, \
> +                    INSN_OFF_MASK, INSN_IMM_MASK)
> +
> +/* can't use BPF_FUNC_loop constant,
> + * do_mix_fixups adjusts the IMM field
> + */
> +#define HELPER_CALL_INSN() \
> +       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, INSN_OFF_MASK, INSN_IMM_MASK)
> +
> +{
> +       "inline simple bpf_loop call",
> +       .insns = {
> +       /* main */
> +       /* force verifier state branching to verify logic on first and
> +        * subsequent bpf_loop insn processing steps
> +        */
> +       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_jiffies64),
> +       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 777, 2),
> +       BPF_ALU64_IMM(BPF_MOV, BPF_REG_1, 1),
> +       BPF_JMP_IMM(BPF_JA, 0, 0, 1),
> +       BPF_ALU64_IMM(BPF_MOV, BPF_REG_1, 2),
> +
> +       BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, BPF_REG_2, BPF_PSEUDO_FUNC, 0, 6),
> +       BPF_RAW_INSN(0, 0, 0, 0, 0),
> +       BPF_ALU64_IMM(BPF_MOV, BPF_REG_3, 0),
> +       BPF_ALU64_IMM(BPF_MOV, BPF_REG_4, 0),
> +       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_loop),
> +       BPF_ALU64_IMM(BPF_MOV, BPF_REG_0, 0),
> +       BPF_EXIT_INSN(),
> +       /* callback */
> +       BPF_ALU64_IMM(BPF_MOV, BPF_REG_0, 1),
> +       BPF_EXIT_INSN(),
> +       },
> +       .expected_insns = { PSEUDO_CALL_INSN() },
> +       .unexpected_insns = { HELPER_CALL_INSN() },
> +       .prog_type = BPF_PROG_TYPE_TRACEPOINT,
> +       .result = ACCEPT,
> +       .runs = 0,
> +       .func_info = { { 0, MAIN_TYPE }, { 12, CALLBACK_TYPE } },
> +       .func_info_cnt = 2,
> +       BTF_TYPES
> +},
> +{
> +       "don't inline bpf_loop call, flags non-zero",
> +       .insns = {
> +       /* main */
> +       BPF_ALU64_IMM(BPF_MOV, BPF_REG_1, 1),
> +       BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, BPF_REG_2, BPF_PSEUDO_FUNC, 0, 6),
> +       BPF_RAW_INSN(0, 0, 0, 0, 0),
> +       BPF_ALU64_IMM(BPF_MOV, BPF_REG_3, 0),
> +       BPF_ALU64_IMM(BPF_MOV, BPF_REG_4, 1),
> +       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_loop),
> +       BPF_ALU64_IMM(BPF_MOV, BPF_REG_0, 0),
> +       BPF_EXIT_INSN(),
> +       /* callback */
> +       BPF_ALU64_IMM(BPF_MOV, BPF_REG_0, 1),
> +       BPF_EXIT_INSN(),
> +       },
> +       .expected_insns = { HELPER_CALL_INSN() },
> +       .unexpected_insns = { PSEUDO_CALL_INSN() },
> +       .prog_type = BPF_PROG_TYPE_TRACEPOINT,
> +       .result = ACCEPT,
> +       .runs = 0,
> +       .func_info = { { 0, MAIN_TYPE }, { 8, CALLBACK_TYPE } },
> +       .func_info_cnt = 2,
> +       BTF_TYPES
> +},
> +{
> +       "don't inline bpf_loop call, callback non-constant",
> +       .insns = {
> +       /* main */
> +       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_jiffies64),
> +       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 777, 4), /* pick a random callback */
> +
> +       BPF_ALU64_IMM(BPF_MOV, BPF_REG_1, 1),
> +       BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, BPF_REG_2, BPF_PSEUDO_FUNC, 0, 10),
> +       BPF_RAW_INSN(0, 0, 0, 0, 0),
> +       BPF_JMP_IMM(BPF_JA, 0, 0, 3),
> +
> +       BPF_ALU64_IMM(BPF_MOV, BPF_REG_1, 1),
> +       BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, BPF_REG_2, BPF_PSEUDO_FUNC, 0, 8),
> +       BPF_RAW_INSN(0, 0, 0, 0, 0),
> +
> +       BPF_ALU64_IMM(BPF_MOV, BPF_REG_3, 0),
> +       BPF_ALU64_IMM(BPF_MOV, BPF_REG_4, 0),
> +       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_loop),
> +       BPF_ALU64_IMM(BPF_MOV, BPF_REG_0, 0),
> +       BPF_EXIT_INSN(),
> +       /* callback */
> +       BPF_ALU64_IMM(BPF_MOV, BPF_REG_0, 1),
> +       BPF_EXIT_INSN(),
> +       /* callback #2 */
> +       BPF_ALU64_IMM(BPF_MOV, BPF_REG_0, 1),
> +       BPF_EXIT_INSN(),
> +       },
> +       .expected_insns = { HELPER_CALL_INSN() },
> +       .unexpected_insns = { PSEUDO_CALL_INSN() },
> +       .prog_type = BPF_PROG_TYPE_TRACEPOINT,
> +       .result = ACCEPT,
> +       .runs = 0,
> +       .func_info = {
> +               { 0, MAIN_TYPE },
> +               { 14, CALLBACK_TYPE },
> +               { 16, CALLBACK_TYPE }
> +       },
> +       .func_info_cnt = 3,
> +       BTF_TYPES
> +},
> +{
> +       "bpf_loop_inline and a dead func",
> +       .insns = {
> +       /* main */
> +
> +       /* A reference to callback #1 to make verifier count it as a func.
> +        * This reference is overwritten below and callback #1 is dead.
> +        */
> +       BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, BPF_REG_2, BPF_PSEUDO_FUNC, 0, 9),
> +       BPF_RAW_INSN(0, 0, 0, 0, 0),
> +       BPF_ALU64_IMM(BPF_MOV, BPF_REG_1, 1),
> +       BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, BPF_REG_2, BPF_PSEUDO_FUNC, 0, 8),
> +       BPF_RAW_INSN(0, 0, 0, 0, 0),
> +       BPF_ALU64_IMM(BPF_MOV, BPF_REG_3, 0),
> +       BPF_ALU64_IMM(BPF_MOV, BPF_REG_4, 0),
> +       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_loop),
> +       BPF_ALU64_IMM(BPF_MOV, BPF_REG_0, 0),
> +       BPF_EXIT_INSN(),
> +       /* callback */
> +       BPF_ALU64_IMM(BPF_MOV, BPF_REG_0, 1),
> +       BPF_EXIT_INSN(),
> +       /* callback #2 */
> +       BPF_ALU64_IMM(BPF_MOV, BPF_REG_0, 1),
> +       BPF_EXIT_INSN(),
> +       },
> +       .expected_insns = { PSEUDO_CALL_INSN() },
> +       .unexpected_insns = { HELPER_CALL_INSN() },
> +       .prog_type = BPF_PROG_TYPE_TRACEPOINT,
> +       .result = ACCEPT,
> +       .runs = 0,
> +       .func_info = {
> +               { 0, MAIN_TYPE },
> +               { 10, CALLBACK_TYPE },
> +               { 12, CALLBACK_TYPE }
> +       },
> +       .func_info_cnt = 3,
> +       BTF_TYPES
> +},
> +{
> +       "bpf_loop_inline stack locations for loop vars",
> +       .insns = {
> +       /* main */
> +       BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, 0x77),
> +       /* bpf_loop call #1 */
> +       BPF_ALU64_IMM(BPF_MOV, BPF_REG_1, 1),
> +       BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, BPF_REG_2, BPF_PSEUDO_FUNC, 0, 22),
> +       BPF_RAW_INSN(0, 0, 0, 0, 0),
> +       BPF_ALU64_IMM(BPF_MOV, BPF_REG_3, 0),
> +       BPF_ALU64_IMM(BPF_MOV, BPF_REG_4, 0),
> +       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_loop),
> +       /* bpf_loop call #2 */
> +       BPF_ALU64_IMM(BPF_MOV, BPF_REG_1, 2),
> +       BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, BPF_REG_2, BPF_PSEUDO_FUNC, 0, 16),
> +       BPF_RAW_INSN(0, 0, 0, 0, 0),
> +       BPF_ALU64_IMM(BPF_MOV, BPF_REG_3, 0),
> +       BPF_ALU64_IMM(BPF_MOV, BPF_REG_4, 0),
> +       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_loop),
> +       /* call func and exit */
> +       BPF_CALL_REL(2),
> +       BPF_ALU64_IMM(BPF_MOV, BPF_REG_0, 0),
> +       BPF_EXIT_INSN(),
> +       /* func */
> +       BPF_ST_MEM(BPF_DW, BPF_REG_10, -32, 0x55),
> +       BPF_ALU64_IMM(BPF_MOV, BPF_REG_1, 2),
> +       BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, BPF_REG_2, BPF_PSEUDO_FUNC, 0, 6),
> +       BPF_RAW_INSN(0, 0, 0, 0, 0),
> +       BPF_ALU64_IMM(BPF_MOV, BPF_REG_3, 0),
> +       BPF_ALU64_IMM(BPF_MOV, BPF_REG_4, 0),
> +       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_loop),
> +       BPF_ALU64_IMM(BPF_MOV, BPF_REG_0, 0),
> +       BPF_EXIT_INSN(),
> +       /* callback */
> +       BPF_ALU64_IMM(BPF_MOV, BPF_REG_0, 1),
> +       BPF_EXIT_INSN(),
> +       },
> +       .expected_insns = {
> +       BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, 0x77),
> +       SKIP_INSNS(),
> +       BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_6, -40),
> +       BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_7, -32),
> +       BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_8, -24),
> +       SKIP_INSNS(),
> +       /* offsets are the same as in the first call */
> +       BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_6, -40),
> +       BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_7, -32),
> +       BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_8, -24),
> +       SKIP_INSNS(),
> +       BPF_ST_MEM(BPF_DW, BPF_REG_10, -32, 0x55),
> +       SKIP_INSNS(),
> +       /* offsets differ from main because of different offset
> +        * in BPF_ST_MEM instruction
> +        */
> +       BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_6, -56),
> +       BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_7, -48),
> +       BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_8, -40),
> +       },
> +       .unexpected_insns = { HELPER_CALL_INSN() },
> +       .prog_type = BPF_PROG_TYPE_TRACEPOINT,
> +       .result = ACCEPT,
> +       .func_info = {
> +               { 0, MAIN_TYPE },
> +               { 16, MAIN_TYPE },
> +               { 25, CALLBACK_TYPE },
> +       },
> +       .func_info_cnt = 3,
> +       BTF_TYPES
> +},
> +
> +#undef HELPER_CALL_INSN
> +#undef PSEUDO_CALL_INSN
> +#undef CALLBACK_TYPE
> +#undef MAIN_TYPE
> +#undef BTF_TYPES
> --
> 2.25.1
>
diff mbox series

Patch

diff --git a/tools/testing/selftests/bpf/verifier/bpf_loop_inline.c b/tools/testing/selftests/bpf/verifier/bpf_loop_inline.c
new file mode 100644
index 000000000000..d1fbcfef69f2
--- /dev/null
+++ b/tools/testing/selftests/bpf/verifier/bpf_loop_inline.c
@@ -0,0 +1,244 @@ 
+#define BTF_TYPES \
+	.btf_strings = "\0int\0i\0ctx\0callback\0main\0", \
+	.btf_types = { \
+	/* 1: int   */ BTF_TYPE_INT_ENC(1, BTF_INT_SIGNED, 0, 32, 4), \
+	/* 2: int*  */ BTF_PTR_ENC(1), \
+	/* 3: void* */ BTF_PTR_ENC(0), \
+	/* 4: int __(void*) */ BTF_FUNC_PROTO_ENC(1, 1), \
+		BTF_FUNC_PROTO_ARG_ENC(7, 3), \
+	/* 5: int __(int, int*) */ BTF_FUNC_PROTO_ENC(1, 2), \
+		BTF_FUNC_PROTO_ARG_ENC(5, 1), \
+		BTF_FUNC_PROTO_ARG_ENC(7, 2), \
+	/* 6: main      */ BTF_FUNC_ENC(20, 4), \
+	/* 7: callback  */ BTF_FUNC_ENC(11, 5), \
+	BTF_END_RAW \
+	}
+
+#define MAIN_TYPE	6
+#define CALLBACK_TYPE	7
+
+/* can't use BPF_CALL_REL, jit_subprogs adjusts IMM & OFF
+ * fields for pseudo calls
+ */
+#define PSEUDO_CALL_INSN() \
+	BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, BPF_PSEUDO_CALL, \
+		     INSN_OFF_MASK, INSN_IMM_MASK)
+
+/* can't use BPF_FUNC_loop constant,
+ * do_mix_fixups adjusts the IMM field
+ */
+#define HELPER_CALL_INSN() \
+	BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, INSN_OFF_MASK, INSN_IMM_MASK)
+
+{
+	"inline simple bpf_loop call",
+	.insns = {
+	/* main */
+	/* force verifier state branching to verify logic on first and
+	 * subsequent bpf_loop insn processing steps
+	 */
+	BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_jiffies64),
+	BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 777, 2),
+	BPF_ALU64_IMM(BPF_MOV, BPF_REG_1, 1),
+	BPF_JMP_IMM(BPF_JA, 0, 0, 1),
+	BPF_ALU64_IMM(BPF_MOV, BPF_REG_1, 2),
+
+	BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, BPF_REG_2, BPF_PSEUDO_FUNC, 0, 6),
+	BPF_RAW_INSN(0, 0, 0, 0, 0),
+	BPF_ALU64_IMM(BPF_MOV, BPF_REG_3, 0),
+	BPF_ALU64_IMM(BPF_MOV, BPF_REG_4, 0),
+	BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_loop),
+	BPF_ALU64_IMM(BPF_MOV, BPF_REG_0, 0),
+	BPF_EXIT_INSN(),
+	/* callback */
+	BPF_ALU64_IMM(BPF_MOV, BPF_REG_0, 1),
+	BPF_EXIT_INSN(),
+	},
+	.expected_insns = { PSEUDO_CALL_INSN() },
+	.unexpected_insns = { HELPER_CALL_INSN() },
+	.prog_type = BPF_PROG_TYPE_TRACEPOINT,
+	.result = ACCEPT,
+	.runs = 0,
+	.func_info = { { 0, MAIN_TYPE }, { 12, CALLBACK_TYPE } },
+	.func_info_cnt = 2,
+	BTF_TYPES
+},
+{
+	"don't inline bpf_loop call, flags non-zero",
+	.insns = {
+	/* main */
+	BPF_ALU64_IMM(BPF_MOV, BPF_REG_1, 1),
+	BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, BPF_REG_2, BPF_PSEUDO_FUNC, 0, 6),
+	BPF_RAW_INSN(0, 0, 0, 0, 0),
+	BPF_ALU64_IMM(BPF_MOV, BPF_REG_3, 0),
+	BPF_ALU64_IMM(BPF_MOV, BPF_REG_4, 1),
+	BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_loop),
+	BPF_ALU64_IMM(BPF_MOV, BPF_REG_0, 0),
+	BPF_EXIT_INSN(),
+	/* callback */
+	BPF_ALU64_IMM(BPF_MOV, BPF_REG_0, 1),
+	BPF_EXIT_INSN(),
+	},
+	.expected_insns = { HELPER_CALL_INSN() },
+	.unexpected_insns = { PSEUDO_CALL_INSN() },
+	.prog_type = BPF_PROG_TYPE_TRACEPOINT,
+	.result = ACCEPT,
+	.runs = 0,
+	.func_info = { { 0, MAIN_TYPE }, { 8, CALLBACK_TYPE } },
+	.func_info_cnt = 2,
+	BTF_TYPES
+},
+{
+	"don't inline bpf_loop call, callback non-constant",
+	.insns = {
+	/* main */
+	BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_jiffies64),
+	BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 777, 4), /* pick a random callback */
+
+	BPF_ALU64_IMM(BPF_MOV, BPF_REG_1, 1),
+	BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, BPF_REG_2, BPF_PSEUDO_FUNC, 0, 10),
+	BPF_RAW_INSN(0, 0, 0, 0, 0),
+	BPF_JMP_IMM(BPF_JA, 0, 0, 3),
+
+	BPF_ALU64_IMM(BPF_MOV, BPF_REG_1, 1),
+	BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, BPF_REG_2, BPF_PSEUDO_FUNC, 0, 8),
+	BPF_RAW_INSN(0, 0, 0, 0, 0),
+
+	BPF_ALU64_IMM(BPF_MOV, BPF_REG_3, 0),
+	BPF_ALU64_IMM(BPF_MOV, BPF_REG_4, 0),
+	BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_loop),
+	BPF_ALU64_IMM(BPF_MOV, BPF_REG_0, 0),
+	BPF_EXIT_INSN(),
+	/* callback */
+	BPF_ALU64_IMM(BPF_MOV, BPF_REG_0, 1),
+	BPF_EXIT_INSN(),
+	/* callback #2 */
+	BPF_ALU64_IMM(BPF_MOV, BPF_REG_0, 1),
+	BPF_EXIT_INSN(),
+	},
+	.expected_insns = { HELPER_CALL_INSN() },
+	.unexpected_insns = { PSEUDO_CALL_INSN() },
+	.prog_type = BPF_PROG_TYPE_TRACEPOINT,
+	.result = ACCEPT,
+	.runs = 0,
+	.func_info = {
+		{ 0, MAIN_TYPE },
+		{ 14, CALLBACK_TYPE },
+		{ 16, CALLBACK_TYPE }
+	},
+	.func_info_cnt = 3,
+	BTF_TYPES
+},
+{
+	"bpf_loop_inline and a dead func",
+	.insns = {
+	/* main */
+
+	/* A reference to callback #1 to make verifier count it as a func.
+	 * This reference is overwritten below and callback #1 is dead.
+	 */
+	BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, BPF_REG_2, BPF_PSEUDO_FUNC, 0, 9),
+	BPF_RAW_INSN(0, 0, 0, 0, 0),
+	BPF_ALU64_IMM(BPF_MOV, BPF_REG_1, 1),
+	BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, BPF_REG_2, BPF_PSEUDO_FUNC, 0, 8),
+	BPF_RAW_INSN(0, 0, 0, 0, 0),
+	BPF_ALU64_IMM(BPF_MOV, BPF_REG_3, 0),
+	BPF_ALU64_IMM(BPF_MOV, BPF_REG_4, 0),
+	BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_loop),
+	BPF_ALU64_IMM(BPF_MOV, BPF_REG_0, 0),
+	BPF_EXIT_INSN(),
+	/* callback */
+	BPF_ALU64_IMM(BPF_MOV, BPF_REG_0, 1),
+	BPF_EXIT_INSN(),
+	/* callback #2 */
+	BPF_ALU64_IMM(BPF_MOV, BPF_REG_0, 1),
+	BPF_EXIT_INSN(),
+	},
+	.expected_insns = { PSEUDO_CALL_INSN() },
+	.unexpected_insns = { HELPER_CALL_INSN() },
+	.prog_type = BPF_PROG_TYPE_TRACEPOINT,
+	.result = ACCEPT,
+	.runs = 0,
+	.func_info = {
+		{ 0, MAIN_TYPE },
+		{ 10, CALLBACK_TYPE },
+		{ 12, CALLBACK_TYPE }
+	},
+	.func_info_cnt = 3,
+	BTF_TYPES
+},
+{
+	"bpf_loop_inline stack locations for loop vars",
+	.insns = {
+	/* main */
+	BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, 0x77),
+	/* bpf_loop call #1 */
+	BPF_ALU64_IMM(BPF_MOV, BPF_REG_1, 1),
+	BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, BPF_REG_2, BPF_PSEUDO_FUNC, 0, 22),
+	BPF_RAW_INSN(0, 0, 0, 0, 0),
+	BPF_ALU64_IMM(BPF_MOV, BPF_REG_3, 0),
+	BPF_ALU64_IMM(BPF_MOV, BPF_REG_4, 0),
+	BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_loop),
+	/* bpf_loop call #2 */
+	BPF_ALU64_IMM(BPF_MOV, BPF_REG_1, 2),
+	BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, BPF_REG_2, BPF_PSEUDO_FUNC, 0, 16),
+	BPF_RAW_INSN(0, 0, 0, 0, 0),
+	BPF_ALU64_IMM(BPF_MOV, BPF_REG_3, 0),
+	BPF_ALU64_IMM(BPF_MOV, BPF_REG_4, 0),
+	BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_loop),
+	/* call func and exit */
+	BPF_CALL_REL(2),
+	BPF_ALU64_IMM(BPF_MOV, BPF_REG_0, 0),
+	BPF_EXIT_INSN(),
+	/* func */
+	BPF_ST_MEM(BPF_DW, BPF_REG_10, -32, 0x55),
+	BPF_ALU64_IMM(BPF_MOV, BPF_REG_1, 2),
+	BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, BPF_REG_2, BPF_PSEUDO_FUNC, 0, 6),
+	BPF_RAW_INSN(0, 0, 0, 0, 0),
+	BPF_ALU64_IMM(BPF_MOV, BPF_REG_3, 0),
+	BPF_ALU64_IMM(BPF_MOV, BPF_REG_4, 0),
+	BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_loop),
+	BPF_ALU64_IMM(BPF_MOV, BPF_REG_0, 0),
+	BPF_EXIT_INSN(),
+	/* callback */
+	BPF_ALU64_IMM(BPF_MOV, BPF_REG_0, 1),
+	BPF_EXIT_INSN(),
+	},
+	.expected_insns = {
+	BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, 0x77),
+	SKIP_INSNS(),
+	BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_6, -40),
+	BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_7, -32),
+	BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_8, -24),
+	SKIP_INSNS(),
+	/* offsets are the same as in the first call */
+	BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_6, -40),
+	BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_7, -32),
+	BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_8, -24),
+	SKIP_INSNS(),
+	BPF_ST_MEM(BPF_DW, BPF_REG_10, -32, 0x55),
+	SKIP_INSNS(),
+	/* offsets differ from main because of different offset
+	 * in BPF_ST_MEM instruction
+	 */
+	BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_6, -56),
+	BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_7, -48),
+	BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_8, -40),
+	},
+	.unexpected_insns = { HELPER_CALL_INSN() },
+	.prog_type = BPF_PROG_TYPE_TRACEPOINT,
+	.result = ACCEPT,
+	.func_info = {
+		{ 0, MAIN_TYPE },
+		{ 16, MAIN_TYPE },
+		{ 25, CALLBACK_TYPE },
+	},
+	.func_info_cnt = 3,
+	BTF_TYPES
+},
+
+#undef HELPER_CALL_INSN
+#undef PSEUDO_CALL_INSN
+#undef CALLBACK_TYPE
+#undef MAIN_TYPE
+#undef BTF_TYPES