820 		if (insn[i].src_reg != BPF_PSEUDO_CALL)  in check_subprogs()
1572 		if (insn[i].src_reg != BPF_PSEUDO_CALL)  in check_max_stack_depth()
1806 	err = check_reg_arg(env, insn->src_reg, SRC_OP);  in check_xadd()
1815 	if (is_pointer_value(env, insn->src_reg)) {  in check_xadd()
1816 		verbose(env, "R%d leaks addr into mem\n", insn->src_reg);  in check_xadd()
2890 				      struct bpf_reg_state src_reg)  in adjust_scalar_min_max_vals()  argument
2905 		coerce_reg_to_size(&src_reg, 4);  in adjust_scalar_min_max_vals()
2908 	smin_val = src_reg.smin_value;  in adjust_scalar_min_max_vals()
2909 	smax_val = src_reg.smax_value;  in adjust_scalar_min_max_vals()
2910 	umin_val = src_reg.umin_value;  in adjust_scalar_min_max_vals()
2911 	umax_val = src_reg.umax_value;  in adjust_scalar_min_max_vals()
2912 	src_known = tnum_is_const(src_reg.var_off);  in adjust_scalar_min_max_vals()
2948 		dst_reg->var_off = tnum_add(dst_reg->var_off, src_reg.var_off);  in adjust_scalar_min_max_vals()
2969 		dst_reg->var_off = tnum_sub(dst_reg->var_off, src_reg.var_off);  in adjust_scalar_min_max_vals()
2972 		dst_reg->var_off = tnum_mul(dst_reg->var_off, src_reg.var_off);  in adjust_scalar_min_max_vals()
3003 						  src_reg.var_off.value);  in adjust_scalar_min_max_vals()
3009 		dst_reg->var_off = tnum_and(dst_reg->var_off, src_reg.var_off);  in adjust_scalar_min_max_vals()
3031 						  src_reg.var_off.value);  in adjust_scalar_min_max_vals()
3037 		dst_reg->var_off = tnum_or(dst_reg->var_off, src_reg.var_off);  in adjust_scalar_min_max_vals()
3158 	struct bpf_reg_state *regs = state->regs, *dst_reg, *src_reg;  in adjust_reg_min_max_vals()  local
3163 	src_reg = NULL;  in adjust_reg_min_max_vals()
3167 		src_reg = &regs[insn->src_reg];  in adjust_reg_min_max_vals()
3168 		if (src_reg->type != SCALAR_VALUE) {  in adjust_reg_min_max_vals()
3188 							       src_reg, dst_reg);  in adjust_reg_min_max_vals()
3193 						       dst_reg, src_reg);  in adjust_reg_min_max_vals()
3201 		src_reg = &off_reg;  in adjust_reg_min_max_vals()
3204 						       ptr_reg, src_reg);  in adjust_reg_min_max_vals()
3213 	if (WARN_ON(!src_reg)) {  in adjust_reg_min_max_vals()
3218 	return adjust_scalar_min_max_vals(env, insn, dst_reg, *src_reg);  in adjust_reg_min_max_vals()
3231 			    insn->src_reg != BPF_REG_0 ||  in check_alu_op()
3237 			if (insn->src_reg != BPF_REG_0 || insn->off != 0 ||  in check_alu_op()
3270 			err = check_reg_arg(env, insn->src_reg, SRC_OP);  in check_alu_op()
3274 			if (insn->src_reg != BPF_REG_0 || insn->off != 0) {  in check_alu_op()
3290 				regs[insn->dst_reg] = regs[insn->src_reg];  in check_alu_op()
3294 				if (is_pointer_value(env, insn->src_reg)) {  in check_alu_op()
3297 						insn->src_reg);  in check_alu_op()
3331 			err = check_reg_arg(env, insn->src_reg, SRC_OP);  in check_alu_op()
3335 			if (insn->src_reg != BPF_REG_0 || insn->off != 0) {  in check_alu_op()
3621 static void __reg_combine_min_max(struct bpf_reg_state *src_reg,  in __reg_combine_min_max()  argument
3624 	src_reg->umin_value = dst_reg->umin_value = max(src_reg->umin_value,  in __reg_combine_min_max()
3626 	src_reg->umax_value = dst_reg->umax_value = min(src_reg->umax_value,  in __reg_combine_min_max()
3628 	src_reg->smin_value = dst_reg->smin_value = max(src_reg->smin_value,  in __reg_combine_min_max()
3630 	src_reg->smax_value = dst_reg->smax_value = min(src_reg->smax_value,  in __reg_combine_min_max()
3632 	src_reg->var_off = dst_reg->var_off = tnum_intersect(src_reg->var_off,  in __reg_combine_min_max()
3635 	__update_reg_bounds(src_reg);  in __reg_combine_min_max()
3638 	__reg_deduce_bounds(src_reg);  in __reg_combine_min_max()
3641 	__reg_bound_offset(src_reg);  in __reg_combine_min_max()
3647 	__update_reg_bounds(src_reg);  in __reg_combine_min_max()
3725 				   struct bpf_reg_state *src_reg,  in try_match_pkt_pointers()  argument
3735 		     src_reg->type == PTR_TO_PACKET_END) ||  in try_match_pkt_pointers()
3737 		     reg_is_init_pkt_pointer(src_reg, PTR_TO_PACKET))) {  in try_match_pkt_pointers()
3742 			    src_reg->type == PTR_TO_PACKET) ||  in try_match_pkt_pointers()
3744 			    src_reg->type == PTR_TO_PACKET_META)) {  in try_match_pkt_pointers()
3746 			find_good_pkt_pointers(other_branch, src_reg,  in try_match_pkt_pointers()
3747 					       src_reg->type, true);  in try_match_pkt_pointers()
3754 		     src_reg->type == PTR_TO_PACKET_END) ||  in try_match_pkt_pointers()
3756 		     reg_is_init_pkt_pointer(src_reg, PTR_TO_PACKET))) {  in try_match_pkt_pointers()
3761 			    src_reg->type == PTR_TO_PACKET) ||  in try_match_pkt_pointers()
3763 			    src_reg->type == PTR_TO_PACKET_META)) {  in try_match_pkt_pointers()
3765 			find_good_pkt_pointers(this_branch, src_reg,  in try_match_pkt_pointers()
3766 					       src_reg->type, false);  in try_match_pkt_pointers()
3773 		     src_reg->type == PTR_TO_PACKET_END) ||  in try_match_pkt_pointers()
3775 		     reg_is_init_pkt_pointer(src_reg, PTR_TO_PACKET))) {  in try_match_pkt_pointers()
3780 			    src_reg->type == PTR_TO_PACKET) ||  in try_match_pkt_pointers()
3782 			    src_reg->type == PTR_TO_PACKET_META)) {  in try_match_pkt_pointers()
3784 			find_good_pkt_pointers(other_branch, src_reg,  in try_match_pkt_pointers()
3785 					       src_reg->type, false);  in try_match_pkt_pointers()
3792 		     src_reg->type == PTR_TO_PACKET_END) ||  in try_match_pkt_pointers()
3794 		     reg_is_init_pkt_pointer(src_reg, PTR_TO_PACKET))) {  in try_match_pkt_pointers()
3799 			    src_reg->type == PTR_TO_PACKET) ||  in try_match_pkt_pointers()
3801 			    src_reg->type == PTR_TO_PACKET_META)) {  in try_match_pkt_pointers()
3803 			find_good_pkt_pointers(this_branch, src_reg,  in try_match_pkt_pointers()
3804 					       src_reg->type, true);  in try_match_pkt_pointers()
3838 		err = check_reg_arg(env, insn->src_reg, SRC_OP);  in check_cond_jmp_op()
3842 		if (is_pointer_value(env, insn->src_reg)) {  in check_cond_jmp_op()
3844 				insn->src_reg);  in check_cond_jmp_op()
3848 		if (insn->src_reg != BPF_REG_0) {  in check_cond_jmp_op()
3896 		    regs[insn->src_reg].type == SCALAR_VALUE) {  in check_cond_jmp_op()
3897 			if (tnum_is_const(regs[insn->src_reg].var_off))  in check_cond_jmp_op()
3899 						dst_reg, regs[insn->src_reg].var_off.value,  in check_cond_jmp_op()
3902 				reg_set_min_max_inv(&other_branch_regs[insn->src_reg],  in check_cond_jmp_op()
3903 						    &regs[insn->src_reg],  in check_cond_jmp_op()
3907 				reg_combine_min_max(&other_branch_regs[insn->src_reg],  in check_cond_jmp_op()
3909 						    &regs[insn->src_reg],  in check_cond_jmp_op()
3926 	} else if (!try_match_pkt_pointers(insn, dst_reg, &regs[insn->src_reg],  in check_cond_jmp_op()
3965 	if (insn->src_reg == 0) {  in check_ld_imm()
3974 	BUG_ON(insn->src_reg != BPF_PSEUDO_MAP_FD);  in check_ld_imm()
4038 	    (mode == BPF_ABS && insn->src_reg != BPF_REG_0)) {  in check_ld_abs()
4056 		err = check_reg_arg(env, insn->src_reg, SRC_OP);  in check_ld_abs()
4249 			if (insns[t].src_reg == BPF_PSEUDO_CALL) {  in check_cfg()
4836 			err = check_reg_arg(env, insn->src_reg, SRC_OP);  in do_check()
4844 			src_reg_type = regs[insn->src_reg].type;  in do_check()
4849 			err = check_mem_access(env, insn_idx, insn->src_reg, insn->off,  in do_check()
4890 			err = check_reg_arg(env, insn->src_reg, SRC_OP);  in do_check()
4903 					       insn->src_reg, false);  in do_check()
4920 			    insn->src_reg != BPF_REG_0) {  in do_check()
4948 				    (insn->src_reg != BPF_REG_0 &&  in do_check()
4949 				     insn->src_reg != BPF_PSEUDO_CALL) ||  in do_check()
4955 				if (insn->src_reg == BPF_PSEUDO_CALL)  in do_check()
4965 				    insn->src_reg != BPF_REG_0 ||  in do_check()
4977 				    insn->src_reg != BPF_REG_0 ||  in do_check()
5138 			    insn[1].dst_reg != 0 || insn[1].src_reg != 0 ||  in replace_map_fd_with_map_ptr()
5144 			if (insn->src_reg == 0)  in replace_map_fd_with_map_ptr()
5148 			if (insn->src_reg != BPF_PSEUDO_MAP_FD) {  in replace_map_fd_with_map_ptr()
5247 			insn->src_reg = 0;  in convert_pseudo_ld_imm64()
5484 		    insn->src_reg != BPF_PSEUDO_CALL)  in jit_subprogs()
5548 			    insn->src_reg != BPF_PSEUDO_CALL)  in jit_subprogs()
5595 		    insn->src_reg != BPF_PSEUDO_CALL)  in jit_subprogs()
5617 		    insn->src_reg != BPF_PSEUDO_CALL)  in jit_subprogs()
5645 		    insn->src_reg != BPF_PSEUDO_CALL)  in fixup_call_args()
5682 				BPF_MOV32_REG(insn->src_reg, insn->src_reg),  in fixup_bpf_calls()
5684 				BPF_JMP_IMM(BPF_JNE, insn->src_reg, 0, 2),  in fixup_bpf_calls()
5690 				BPF_MOV32_REG(insn->src_reg, insn->src_reg),  in fixup_bpf_calls()
5692 				BPF_JMP_IMM(BPF_JEQ, insn->src_reg, 0, 1),  in fixup_bpf_calls()
5737 		if (insn->src_reg == BPF_PSEUDO_CALL)  in fixup_bpf_calls()