diff mbox series

[v2,bpf-next] selftests/bpf: validate eliminated global subprog is not freplaceable

Message ID 20231201170609.1187520-1-andrii@kernel.org (mailing list archive)
State Superseded
Delegated to: BPF
Headers show
Series [v2,bpf-next] selftests/bpf: validate eliminated global subprog is not freplaceable | expand

Checks

Context Check Description
bpf/vmtest-bpf-next-PR fail PR summary
bpf/vmtest-bpf-next-VM_Test-33 success Logs for x86_64-llvm-16 / veristat
bpf/vmtest-bpf-next-VM_Test-31 fail Logs for x86_64-llvm-16 / test (test_progs_no_alu32, false, 360) / test_progs_no_alu32 on x86_64 with llvm-16
bpf/vmtest-bpf-next-VM_Test-32 success Logs for x86_64-llvm-16 / test (test_verifier, false, 360) / test_verifier on x86_64 with llvm-16
bpf/vmtest-bpf-next-VM_Test-30 fail Logs for x86_64-llvm-16 / test (test_progs, false, 360) / test_progs on x86_64 with llvm-16
bpf/vmtest-bpf-next-VM_Test-0 success Logs for Lint
bpf/vmtest-bpf-next-VM_Test-2 success Logs for Validate matrix.py
bpf/vmtest-bpf-next-VM_Test-1 success Logs for ShellCheck
bpf/vmtest-bpf-next-VM_Test-3 success Logs for aarch64-gcc / build / build for aarch64 with gcc
bpf/vmtest-bpf-next-VM_Test-8 success Logs for aarch64-gcc / veristat
bpf/vmtest-bpf-next-VM_Test-4 success Logs for aarch64-gcc / test (test_maps, false, 360) / test_maps on aarch64 with gcc
bpf/vmtest-bpf-next-VM_Test-6 success Logs for aarch64-gcc / test (test_progs_no_alu32, false, 360) / test_progs_no_alu32 on aarch64 with gcc
bpf/vmtest-bpf-next-VM_Test-7 success Logs for aarch64-gcc / test (test_verifier, false, 360) / test_verifier on aarch64 with gcc
bpf/vmtest-bpf-next-VM_Test-5 success Logs for aarch64-gcc / test (test_progs, false, 360) / test_progs on aarch64 with gcc
bpf/vmtest-bpf-next-VM_Test-9 success Logs for s390x-gcc / build / build for s390x with gcc
bpf/vmtest-bpf-next-VM_Test-15 success Logs for set-matrix
bpf/vmtest-bpf-next-VM_Test-16 success Logs for x86_64-gcc / build / build for x86_64 with gcc
bpf/vmtest-bpf-next-VM_Test-14 success Logs for s390x-gcc / veristat
bpf/vmtest-bpf-next-VM_Test-17 success Logs for x86_64-gcc / test (test_maps, false, 360) / test_maps on x86_64 with gcc
bpf/vmtest-bpf-next-VM_Test-19 success Logs for x86_64-gcc / test (test_progs_no_alu32, false, 360) / test_progs_no_alu32 on x86_64 with gcc
bpf/vmtest-bpf-next-VM_Test-18 success Logs for x86_64-gcc / test (test_progs, false, 360) / test_progs on x86_64 with gcc
bpf/vmtest-bpf-next-VM_Test-20 success Logs for x86_64-gcc / test (test_progs_no_alu32_parallel, true, 30) / test_progs_no_alu32_parallel on x86_64 with gcc
bpf/vmtest-bpf-next-VM_Test-22 success Logs for x86_64-gcc / test (test_verifier, false, 360) / test_verifier on x86_64 with gcc
bpf/vmtest-bpf-next-VM_Test-21 success Logs for x86_64-gcc / test (test_progs_parallel, true, 30) / test_progs_parallel on x86_64 with gcc
bpf/vmtest-bpf-next-VM_Test-23 success Logs for x86_64-gcc / veristat / veristat on x86_64 with gcc
bpf/vmtest-bpf-next-VM_Test-24 success Logs for x86_64-llvm-16 / build / build for x86_64 with llvm-16
bpf/vmtest-bpf-next-VM_Test-25 success Logs for x86_64-llvm-16 / test (test_maps, false, 360) / test_maps on x86_64 with llvm-16
bpf/vmtest-bpf-next-VM_Test-26 success Logs for x86_64-llvm-16 / test (test_progs, false, 360) / test_progs on x86_64 with llvm-16
bpf/vmtest-bpf-next-VM_Test-27 fail Logs for x86_64-llvm-16 / test (test_progs_no_alu32, false, 360) / test_progs_no_alu32 on x86_64 with llvm-16
bpf/vmtest-bpf-next-VM_Test-28 success Logs for x86_64-llvm-16 / test (test_verifier, false, 360) / test_verifier on x86_64 with llvm-16
bpf/vmtest-bpf-next-VM_Test-29 success Logs for x86_64-llvm-16 / veristat
bpf/vmtest-bpf-next-VM_Test-13 success Logs for s390x-gcc / test (test_verifier, false, 360) / test_verifier on s390x with gcc
bpf/vmtest-bpf-next-VM_Test-12 success Logs for s390x-gcc / test (test_progs_no_alu32, false, 360) / test_progs_no_alu32 on s390x with gcc
bpf/vmtest-bpf-next-VM_Test-11 success Logs for s390x-gcc / test (test_progs, false, 360) / test_progs on s390x with gcc
netdev/series_format success Single patches do not need cover letters
netdev/tree_selection success Clearly marked for bpf-next, async
netdev/ynl success SINGLE THREAD; Generated files up to date; no warnings/errors;
netdev/fixes_present success Fixes tag not required for -next series
netdev/header_inline success No static functions without inline keyword in header files
netdev/build_32bit success Errors and warnings before: 8 this patch: 8
netdev/cc_maintainers warning 13 maintainers not CCed: haoluo@google.com jolsa@kernel.org kpsingh@kernel.org linux-kselftest@vger.kernel.org martin.lau@linux.dev mykolal@fb.com john.fastabend@gmail.com alan.maguire@oracle.com song@kernel.org eddyz87@gmail.com shuah@kernel.org sdf@google.com yonghong.song@linux.dev
netdev/build_clang success Errors and warnings before: 8 this patch: 8
netdev/verify_signedoff success Signed-off-by tag matches author and committer
netdev/deprecated_api success None detected
netdev/check_selftest success No net selftest shell script
netdev/verify_fixes success No Fixes tag
netdev/build_allmodconfig_warn success Errors and warnings before: 8 this patch: 8
netdev/checkpatch warning WARNING: Use of volatile is usually wrong: see Documentation/process/volatile-considered-harmful.rst WARNING: added, moved or deleted file(s), does MAINTAINERS need updating? WARNING: line length of 100 exceeds 80 columns WARNING: line length of 84 exceeds 80 columns WARNING: line length of 86 exceeds 80 columns WARNING: line length of 89 exceeds 80 columns WARNING: line length of 91 exceeds 80 columns WARNING: line length of 95 exceeds 80 columns
netdev/build_clang_rust success No Rust files in patch. Skipping build
netdev/kdoc success Errors and warnings before: 0 this patch: 0
netdev/source_inline success Was 0 now: 0
bpf/vmtest-bpf-next-VM_Test-10 success Logs for s390x-gcc / test (test_maps, false, 360) / test_maps on s390x with gcc

Commit Message

Andrii Nakryiko Dec. 1, 2023, 5:06 p.m. UTC 
Add selftest that establishes dead code-eliminated valid global subprog
(global_dead) and makes sure that it's not possible to freplace it, as
it's effectively not there. This test will fail with unexpected success
before 2afae08c9dcb ("bpf: Validate global subprogs lazily").

v1->v2:
  - don't rely on assembly output in verifier log, which changes between
    compiler versions (CI).

Suggested-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
---
 .../bpf/prog_tests/global_func_dead_code.c    | 60 +++++++++++++++++++
 .../bpf/progs/freplace_dead_global_func.c     | 11 ++++
 .../bpf/progs/verifier_global_subprogs.c      | 33 ++++++----
 3 files changed, 92 insertions(+), 12 deletions(-)
 create mode 100644 tools/testing/selftests/bpf/prog_tests/global_func_dead_code.c
 create mode 100644 tools/testing/selftests/bpf/progs/freplace_dead_global_func.c

Comments

Alan Maguire Dec. 1, 2023, 5:46 p.m. UTC | #1 
On 01/12/2023 17:06, Andrii Nakryiko wrote:
> Add selftest that establishes dead code-eliminated valid global subprog
> (global_dead) and makes sure that it's not possible to freplace it, as
> it's effectively not there. This test will fail with unexpected success
> before 2afae08c9dcb ("bpf: Validate global subprogs lazily").
> 
> v1->v2:
>   - don't rely on assembly output in verifier log, which changes between
>     compiler versions (CI).
> 
> Suggested-by: Alexei Starovoitov <ast@kernel.org>
> Signed-off-by: Andrii Nakryiko <andrii@kernel.org>

one minor thing below, but

Reviewed-by: Alan Maguire <alan.maguire@oracle.com>

> ---
>  .../bpf/prog_tests/global_func_dead_code.c    | 60 +++++++++++++++++++
>  .../bpf/progs/freplace_dead_global_func.c     | 11 ++++
>  .../bpf/progs/verifier_global_subprogs.c      | 33 ++++++----
>  3 files changed, 92 insertions(+), 12 deletions(-)
>  create mode 100644 tools/testing/selftests/bpf/prog_tests/global_func_dead_code.c
>  create mode 100644 tools/testing/selftests/bpf/progs/freplace_dead_global_func.c
> 
> diff --git a/tools/testing/selftests/bpf/prog_tests/global_func_dead_code.c b/tools/testing/selftests/bpf/prog_tests/global_func_dead_code.c
> new file mode 100644
> index 000000000000..d873eb20dd7c
> --- /dev/null
> +++ b/tools/testing/selftests/bpf/prog_tests/global_func_dead_code.c
> @@ -0,0 +1,60 @@
> +// SPDX-License-Identifier: GPL-2.0
> +/* Copyright (c) 2023 Meta Platforms, Inc. and affiliates. */
> +
> +#include <test_progs.h>
> +#include "verifier_global_subprogs.skel.h"
> +#include "freplace_dead_global_func.skel.h"
> +
> +void test_global_func_dead_code(void)
> +{
> +	struct verifier_global_subprogs *tgt_skel = NULL;
> +	struct freplace_dead_global_func *skel = NULL;
> +	char log_buf[4096];
> +	int err, tgt_fd;
> +
> +	/* first, try to load target with good global subprog */
> +	tgt_skel = verifier_global_subprogs__open();
> +	if (!ASSERT_OK_PTR(tgt_skel, "tgt_skel_good_open"))
> +		return;
> +
> +	bpf_program__set_autoload(tgt_skel->progs.chained_global_func_calls_success, true);
> +
> +	err = verifier_global_subprogs__load(tgt_skel);
> +	if (!ASSERT_OK(err, "tgt_skel_good_load"))
> +		goto out;
> +
> +	tgt_fd = bpf_program__fd(tgt_skel->progs.chained_global_func_calls_success);
> +
> +	/* Attach to good non-eliminated subprog */
> +	skel = freplace_dead_global_func__open();
> +	if (!ASSERT_OK_PTR(skel, "skel_good_open"))
> +		goto out;
> +
> +	bpf_program__set_attach_target(skel->progs.freplace_prog, tgt_fd, "global_good");

missing "err = " assignment here?

> +	ASSERT_OK(err, "attach_target_good");
> +
> +	err = freplace_dead_global_func__load(skel);
> +	if (!ASSERT_OK(err, "skel_good_load"))
> +		goto out;
> +
> +	freplace_dead_global_func__destroy(skel);
> +
> +	/* Try attaching to dead code-eliminated subprog */
> +	skel = freplace_dead_global_func__open();
> +	if (!ASSERT_OK_PTR(skel, "skel_dead_open"))
> +		goto out;
> +
> +	bpf_program__set_log_buf(skel->progs.freplace_prog, log_buf, sizeof(log_buf));
> +	err = bpf_program__set_attach_target(skel->progs.freplace_prog, tgt_fd, "global_dead");
> +	ASSERT_OK(err, "attach_target_dead");
> +
> +	err = freplace_dead_global_func__load(skel);
> +	if (!ASSERT_ERR(err, "skel_dead_load"))
> +		goto out;
> +
> +	ASSERT_HAS_SUBSTR(log_buf, "Subprog global_dead doesn't exist", "dead_subprog_missing_msg");
> +
> +out:
> +	verifier_global_subprogs__destroy(tgt_skel);
> +	freplace_dead_global_func__destroy(skel);
> +}
> diff --git a/tools/testing/selftests/bpf/progs/freplace_dead_global_func.c b/tools/testing/selftests/bpf/progs/freplace_dead_global_func.c
> new file mode 100644
> index 000000000000..808738eac578
> --- /dev/null
> +++ b/tools/testing/selftests/bpf/progs/freplace_dead_global_func.c
> @@ -0,0 +1,11 @@
> +// SPDX-License-Identifier: GPL-2.0
> +#include <linux/bpf.h>
> +#include <bpf/bpf_helpers.h>
> +
> +SEC("freplace")
> +int freplace_prog(int x)
> +{
> +	return 0;
> +}
> +
> +char _license[] SEC("license") = "GPL";
> diff --git a/tools/testing/selftests/bpf/progs/verifier_global_subprogs.c b/tools/testing/selftests/bpf/progs/verifier_global_subprogs.c
> index a0a5efd1caa1..8ddc2f354be9 100644
> --- a/tools/testing/selftests/bpf/progs/verifier_global_subprogs.c
> +++ b/tools/testing/selftests/bpf/progs/verifier_global_subprogs.c
> @@ -10,50 +10,59 @@
>  
>  int arr[1];
>  int unkn_idx;
> +const volatile bool call_dead_subprog = false;
>  
> -__noinline long global_bad(void)
> +__noinline long global_bad(int x)
>  {
> -	return arr[unkn_idx]; /* BOOM */
> +	return arr[unkn_idx] + x; /* BOOM */
>  }
>  
> -__noinline long global_good(void)
> +__noinline long global_good(int x)
>  {
> -	return arr[0];
> +	return arr[0] + x;
>  }
>  
> -__noinline long global_calls_bad(void)
> +__noinline long global_calls_bad(int x)
>  {
> -	return global_good() + global_bad() /* does BOOM indirectly */;
> +	return global_good(x) + global_bad(x) /* does BOOM indirectly */;
>  }
>  
> -__noinline long global_calls_good_only(void)
> +__noinline long global_calls_good_only(int x)
>  {
> -	return global_good();
> +	return global_good(x);
> +}
> +
> +__noinline long global_dead(int x)
> +{
> +	return x * 2;
>  }
>  
>  SEC("?raw_tp")
>  __success __log_level(2)
>  /* main prog is validated completely first */
>  __msg("('global_calls_good_only') is global and assumed valid.")
> -__msg("1: (95) exit")
>  /* eventually global_good() is transitively validated as well */
>  __msg("Validating global_good() func")
>  __msg("('global_good') is safe for any args that match its prototype")
>  int chained_global_func_calls_success(void)
>  {
> -	return global_calls_good_only();
> +	int sum = 0;
> +
> +	if (call_dead_subprog)
> +		sum += global_dead(42);
> +	return global_calls_good_only(42) + sum;
>  }
>  
>  SEC("?raw_tp")
>  __failure __log_level(2)
>  /* main prog validated successfully first */
> -__msg("1: (95) exit")
> +__msg("('global_calls_bad') is global and assumed valid.")
>  /* eventually we validate global_bad() and fail */
>  __msg("Validating global_bad() func")
>  __msg("math between map_value pointer and register") /* BOOM */
>  int chained_global_func_calls_bad(void)
>  {
> -	return global_calls_bad();
> +	return global_calls_bad(13);
>  }
>  
>  /* do out of bounds access forcing verifier to fail verification if this
Andrii Nakryiko Dec. 1, 2023, 7:04 p.m. UTC | #2 
On Fri, Dec 1, 2023 at 9:47 AM Alan Maguire <alan.maguire@oracle.com> wrote:
>
> On 01/12/2023 17:06, Andrii Nakryiko wrote:
> > Add selftest that establishes dead code-eliminated valid global subprog
> > (global_dead) and makes sure that it's not possible to freplace it, as
> > it's effectively not there. This test will fail with unexpected success
> > before 2afae08c9dcb ("bpf: Validate global subprogs lazily").
> >
> > v1->v2:
> >   - don't rely on assembly output in verifier log, which changes between
> >     compiler versions (CI).
> >
> > Suggested-by: Alexei Starovoitov <ast@kernel.org>
> > Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
>
> one minor thing below, but
>
> Reviewed-by: Alan Maguire <alan.maguire@oracle.com>
>
> > ---
> >  .../bpf/prog_tests/global_func_dead_code.c    | 60 +++++++++++++++++++
> >  .../bpf/progs/freplace_dead_global_func.c     | 11 ++++
> >  .../bpf/progs/verifier_global_subprogs.c      | 33 ++++++----
> >  3 files changed, 92 insertions(+), 12 deletions(-)
> >  create mode 100644 tools/testing/selftests/bpf/prog_tests/global_func_dead_code.c
> >  create mode 100644 tools/testing/selftests/bpf/progs/freplace_dead_global_func.c
> >
> > diff --git a/tools/testing/selftests/bpf/prog_tests/global_func_dead_code.c b/tools/testing/selftests/bpf/prog_tests/global_func_dead_code.c
> > new file mode 100644
> > index 000000000000..d873eb20dd7c
> > --- /dev/null
> > +++ b/tools/testing/selftests/bpf/prog_tests/global_func_dead_code.c
> > @@ -0,0 +1,60 @@
> > +// SPDX-License-Identifier: GPL-2.0
> > +/* Copyright (c) 2023 Meta Platforms, Inc. and affiliates. */
> > +
> > +#include <test_progs.h>
> > +#include "verifier_global_subprogs.skel.h"
> > +#include "freplace_dead_global_func.skel.h"
> > +
> > +void test_global_func_dead_code(void)
> > +{
> > +     struct verifier_global_subprogs *tgt_skel = NULL;
> > +     struct freplace_dead_global_func *skel = NULL;
> > +     char log_buf[4096];
> > +     int err, tgt_fd;
> > +
> > +     /* first, try to load target with good global subprog */
> > +     tgt_skel = verifier_global_subprogs__open();
> > +     if (!ASSERT_OK_PTR(tgt_skel, "tgt_skel_good_open"))
> > +             return;
> > +
> > +     bpf_program__set_autoload(tgt_skel->progs.chained_global_func_calls_success, true);
> > +
> > +     err = verifier_global_subprogs__load(tgt_skel);
> > +     if (!ASSERT_OK(err, "tgt_skel_good_load"))
> > +             goto out;
> > +
> > +     tgt_fd = bpf_program__fd(tgt_skel->progs.chained_global_func_calls_success);
> > +
> > +     /* Attach to good non-eliminated subprog */
> > +     skel = freplace_dead_global_func__open();
> > +     if (!ASSERT_OK_PTR(skel, "skel_good_open"))
> > +             goto out;
> > +
> > +     bpf_program__set_attach_target(skel->progs.freplace_prog, tgt_fd, "global_good");
>
> missing "err = " assignment here?


yep, thanks for spotting, will fix

>
> > +     ASSERT_OK(err, "attach_target_good");
> > +
> > +     err = freplace_dead_global_func__load(skel);
> > +     if (!ASSERT_OK(err, "skel_good_load"))
> > +             goto out;
> > +
> > +     freplace_dead_global_func__destroy(skel);
> > +
> > +     /* Try attaching to dead code-eliminated subprog */
> > +     skel = freplace_dead_global_func__open();
> > +     if (!ASSERT_OK_PTR(skel, "skel_dead_open"))
> > +             goto out;
> > +
> > +     bpf_program__set_log_buf(skel->progs.freplace_prog, log_buf, sizeof(log_buf));
> > +     err = bpf_program__set_attach_target(skel->progs.freplace_prog, tgt_fd, "global_dead");
> > +     ASSERT_OK(err, "attach_target_dead");
> > +
> > +     err = freplace_dead_global_func__load(skel);
> > +     if (!ASSERT_ERR(err, "skel_dead_load"))
> > +             goto out;
> > +
> > +     ASSERT_HAS_SUBSTR(log_buf, "Subprog global_dead doesn't exist", "dead_subprog_missing_msg");
> > +
> > +out:
> > +     verifier_global_subprogs__destroy(tgt_skel);
> > +     freplace_dead_global_func__destroy(skel);
> > +}

[...]
diff mbox series

Patch

diff --git a/tools/testing/selftests/bpf/prog_tests/global_func_dead_code.c b/tools/testing/selftests/bpf/prog_tests/global_func_dead_code.c
new file mode 100644
index 000000000000..d873eb20dd7c
--- /dev/null
+++ b/tools/testing/selftests/bpf/prog_tests/global_func_dead_code.c
@@ -0,0 +1,60 @@ 
+// SPDX-License-Identifier: GPL-2.0
+/* Copyright (c) 2023 Meta Platforms, Inc. and affiliates. */
+
+#include <test_progs.h>
+#include "verifier_global_subprogs.skel.h"
+#include "freplace_dead_global_func.skel.h"
+
+void test_global_func_dead_code(void)
+{
+	struct verifier_global_subprogs *tgt_skel = NULL;
+	struct freplace_dead_global_func *skel = NULL;
+	char log_buf[4096];
+	int err, tgt_fd;
+
+	/* first, try to load target with good global subprog */
+	tgt_skel = verifier_global_subprogs__open();
+	if (!ASSERT_OK_PTR(tgt_skel, "tgt_skel_good_open"))
+		return;
+
+	bpf_program__set_autoload(tgt_skel->progs.chained_global_func_calls_success, true);
+
+	err = verifier_global_subprogs__load(tgt_skel);
+	if (!ASSERT_OK(err, "tgt_skel_good_load"))
+		goto out;
+
+	tgt_fd = bpf_program__fd(tgt_skel->progs.chained_global_func_calls_success);
+
+	/* Attach to good non-eliminated subprog */
+	skel = freplace_dead_global_func__open();
+	if (!ASSERT_OK_PTR(skel, "skel_good_open"))
+		goto out;
+
+	bpf_program__set_attach_target(skel->progs.freplace_prog, tgt_fd, "global_good");
+	ASSERT_OK(err, "attach_target_good");
+
+	err = freplace_dead_global_func__load(skel);
+	if (!ASSERT_OK(err, "skel_good_load"))
+		goto out;
+
+	freplace_dead_global_func__destroy(skel);
+
+	/* Try attaching to dead code-eliminated subprog */
+	skel = freplace_dead_global_func__open();
+	if (!ASSERT_OK_PTR(skel, "skel_dead_open"))
+		goto out;
+
+	bpf_program__set_log_buf(skel->progs.freplace_prog, log_buf, sizeof(log_buf));
+	err = bpf_program__set_attach_target(skel->progs.freplace_prog, tgt_fd, "global_dead");
+	ASSERT_OK(err, "attach_target_dead");
+
+	err = freplace_dead_global_func__load(skel);
+	if (!ASSERT_ERR(err, "skel_dead_load"))
+		goto out;
+
+	ASSERT_HAS_SUBSTR(log_buf, "Subprog global_dead doesn't exist", "dead_subprog_missing_msg");
+
+out:
+	verifier_global_subprogs__destroy(tgt_skel);
+	freplace_dead_global_func__destroy(skel);
+}
diff --git a/tools/testing/selftests/bpf/progs/freplace_dead_global_func.c b/tools/testing/selftests/bpf/progs/freplace_dead_global_func.c
new file mode 100644
index 000000000000..808738eac578
--- /dev/null
+++ b/tools/testing/selftests/bpf/progs/freplace_dead_global_func.c
@@ -0,0 +1,11 @@ 
+// SPDX-License-Identifier: GPL-2.0
+#include <linux/bpf.h>
+#include <bpf/bpf_helpers.h>
+
+SEC("freplace")
+int freplace_prog(int x)
+{
+	return 0;
+}
+
+char _license[] SEC("license") = "GPL";
diff --git a/tools/testing/selftests/bpf/progs/verifier_global_subprogs.c b/tools/testing/selftests/bpf/progs/verifier_global_subprogs.c
index a0a5efd1caa1..8ddc2f354be9 100644
--- a/tools/testing/selftests/bpf/progs/verifier_global_subprogs.c
+++ b/tools/testing/selftests/bpf/progs/verifier_global_subprogs.c
@@ -10,50 +10,59 @@ 
 
 int arr[1];
 int unkn_idx;
+const volatile bool call_dead_subprog = false;
 
-__noinline long global_bad(void)
+__noinline long global_bad(int x)
 {
-	return arr[unkn_idx]; /* BOOM */
+	return arr[unkn_idx] + x; /* BOOM */
 }
 
-__noinline long global_good(void)
+__noinline long global_good(int x)
 {
-	return arr[0];
+	return arr[0] + x;
 }
 
-__noinline long global_calls_bad(void)
+__noinline long global_calls_bad(int x)
 {
-	return global_good() + global_bad() /* does BOOM indirectly */;
+	return global_good(x) + global_bad(x) /* does BOOM indirectly */;
 }
 
-__noinline long global_calls_good_only(void)
+__noinline long global_calls_good_only(int x)
 {
-	return global_good();
+	return global_good(x);
+}
+
+__noinline long global_dead(int x)
+{
+	return x * 2;
 }
 
 SEC("?raw_tp")
 __success __log_level(2)
 /* main prog is validated completely first */
 __msg("('global_calls_good_only') is global and assumed valid.")
-__msg("1: (95) exit")
 /* eventually global_good() is transitively validated as well */
 __msg("Validating global_good() func")
 __msg("('global_good') is safe for any args that match its prototype")
 int chained_global_func_calls_success(void)
 {
-	return global_calls_good_only();
+	int sum = 0;
+
+	if (call_dead_subprog)
+		sum += global_dead(42);
+	return global_calls_good_only(42) + sum;
 }
 
 SEC("?raw_tp")
 __failure __log_level(2)
 /* main prog validated successfully first */
-__msg("1: (95) exit")
+__msg("('global_calls_bad') is global and assumed valid.")
 /* eventually we validate global_bad() and fail */
 __msg("Validating global_bad() func")
 __msg("math between map_value pointer and register") /* BOOM */
 int chained_global_func_calls_bad(void)
 {
-	return global_calls_bad();
+	return global_calls_bad(13);
 }
 
 /* do out of bounds access forcing verifier to fail verification if this