1137 		if (insn[i].src_reg != BPF_PSEUDO_CALL)  in check_subprogs()
1267 			if (insn->src_reg == BPF_PSEUDO_CALL)  in is_reg64()
1454 	u32 sreg = 1u << insn->src_reg;  in backtrack_insn()
1507 		if (insn->src_reg != BPF_REG_FP)  in backtrack_insn()
1548 			if (insn->src_reg == BPF_PSEUDO_CALL)  in backtrack_insn()
2619 		if (insn[i].src_reg != BPF_PSEUDO_CALL)  in check_max_stack_depth()
2898 	err = check_reg_arg(env, insn->src_reg, SRC_OP);  in check_xadd()
2907 	if (is_pointer_value(env, insn->src_reg)) {  in check_xadd()
2908 		verbose(env, "R%d leaks addr into mem\n", insn->src_reg);  in check_xadd()
4338 	u32 dst = insn->dst_reg, src = insn->src_reg;  in adjust_ptr_min_max_vals()
4569 				      struct bpf_reg_state src_reg)  in adjust_scalar_min_max_vals()  argument
4586 		coerce_reg_to_size(&src_reg, 4);  in adjust_scalar_min_max_vals()
4589 	smin_val = src_reg.smin_value;  in adjust_scalar_min_max_vals()
4590 	smax_val = src_reg.smax_value;  in adjust_scalar_min_max_vals()
4591 	umin_val = src_reg.umin_value;  in adjust_scalar_min_max_vals()
4592 	umax_val = src_reg.umax_value;  in adjust_scalar_min_max_vals()
4593 	src_known = tnum_is_const(src_reg.var_off);  in adjust_scalar_min_max_vals()
4634 		dst_reg->var_off = tnum_add(dst_reg->var_off, src_reg.var_off);  in adjust_scalar_min_max_vals()
4660 		dst_reg->var_off = tnum_sub(dst_reg->var_off, src_reg.var_off);  in adjust_scalar_min_max_vals()
4663 		dst_reg->var_off = tnum_mul(dst_reg->var_off, src_reg.var_off);  in adjust_scalar_min_max_vals()
4694 						  src_reg.var_off.value);  in adjust_scalar_min_max_vals()
4700 		dst_reg->var_off = tnum_and(dst_reg->var_off, src_reg.var_off);  in adjust_scalar_min_max_vals()
4722 						  src_reg.var_off.value);  in adjust_scalar_min_max_vals()
4728 		dst_reg->var_off = tnum_or(dst_reg->var_off, src_reg.var_off);  in adjust_scalar_min_max_vals()
4849 	struct bpf_reg_state *regs = state->regs, *dst_reg, *src_reg;  in adjust_reg_min_max_vals()  local
4855 	src_reg = NULL;  in adjust_reg_min_max_vals()
4859 		src_reg = &regs[insn->src_reg];  in adjust_reg_min_max_vals()
4860 		if (src_reg->type != SCALAR_VALUE) {  in adjust_reg_min_max_vals()
4883 							       src_reg, dst_reg);  in adjust_reg_min_max_vals()
4887 			err = mark_chain_precision(env, insn->src_reg);  in adjust_reg_min_max_vals()
4891 						       dst_reg, src_reg);  in adjust_reg_min_max_vals()
4899 		src_reg = &off_reg;  in adjust_reg_min_max_vals()
4902 						       ptr_reg, src_reg);  in adjust_reg_min_max_vals()
4911 	if (WARN_ON(!src_reg)) {  in adjust_reg_min_max_vals()
4916 	return adjust_scalar_min_max_vals(env, insn, dst_reg, *src_reg);  in adjust_reg_min_max_vals()
4929 			    insn->src_reg != BPF_REG_0 ||  in check_alu_op()
4935 			if (insn->src_reg != BPF_REG_0 || insn->off != 0 ||  in check_alu_op()
4968 			err = check_reg_arg(env, insn->src_reg, SRC_OP);  in check_alu_op()
4972 			if (insn->src_reg != BPF_REG_0 || insn->off != 0) {  in check_alu_op()
4984 			struct bpf_reg_state *src_reg = regs + insn->src_reg;  in check_alu_op()  local
4991 				*dst_reg = *src_reg;  in check_alu_op()
4996 				if (is_pointer_value(env, insn->src_reg)) {  in check_alu_op()
4999 						insn->src_reg);  in check_alu_op()
5001 				} else if (src_reg->type == SCALAR_VALUE) {  in check_alu_op()
5002 					*dst_reg = *src_reg;  in check_alu_op()
5039 			err = check_reg_arg(env, insn->src_reg, SRC_OP);  in check_alu_op()
5043 			if (insn->src_reg != BPF_REG_0 || insn->off != 0) {  in check_alu_op()
5554 static void __reg_combine_min_max(struct bpf_reg_state *src_reg,  in __reg_combine_min_max()  argument
5557 	src_reg->umin_value = dst_reg->umin_value = max(src_reg->umin_value,  in __reg_combine_min_max()
5559 	src_reg->umax_value = dst_reg->umax_value = min(src_reg->umax_value,  in __reg_combine_min_max()
5561 	src_reg->smin_value = dst_reg->smin_value = max(src_reg->smin_value,  in __reg_combine_min_max()
5563 	src_reg->smax_value = dst_reg->smax_value = min(src_reg->smax_value,  in __reg_combine_min_max()
5565 	src_reg->var_off = dst_reg->var_off = tnum_intersect(src_reg->var_off,  in __reg_combine_min_max()
5568 	__update_reg_bounds(src_reg);  in __reg_combine_min_max()
5571 	__reg_deduce_bounds(src_reg);  in __reg_combine_min_max()
5574 	__reg_bound_offset(src_reg);  in __reg_combine_min_max()
5580 	__update_reg_bounds(src_reg);  in __reg_combine_min_max()
5694 				   struct bpf_reg_state *src_reg,  in try_match_pkt_pointers()  argument
5708 		     src_reg->type == PTR_TO_PACKET_END) ||  in try_match_pkt_pointers()
5710 		     reg_is_init_pkt_pointer(src_reg, PTR_TO_PACKET))) {  in try_match_pkt_pointers()
5715 			    src_reg->type == PTR_TO_PACKET) ||  in try_match_pkt_pointers()
5717 			    src_reg->type == PTR_TO_PACKET_META)) {  in try_match_pkt_pointers()
5719 			find_good_pkt_pointers(other_branch, src_reg,  in try_match_pkt_pointers()
5720 					       src_reg->type, true);  in try_match_pkt_pointers()
5727 		     src_reg->type == PTR_TO_PACKET_END) ||  in try_match_pkt_pointers()
5729 		     reg_is_init_pkt_pointer(src_reg, PTR_TO_PACKET))) {  in try_match_pkt_pointers()
5734 			    src_reg->type == PTR_TO_PACKET) ||  in try_match_pkt_pointers()
5736 			    src_reg->type == PTR_TO_PACKET_META)) {  in try_match_pkt_pointers()
5738 			find_good_pkt_pointers(this_branch, src_reg,  in try_match_pkt_pointers()
5739 					       src_reg->type, false);  in try_match_pkt_pointers()
5746 		     src_reg->type == PTR_TO_PACKET_END) ||  in try_match_pkt_pointers()
5748 		     reg_is_init_pkt_pointer(src_reg, PTR_TO_PACKET))) {  in try_match_pkt_pointers()
5753 			    src_reg->type == PTR_TO_PACKET) ||  in try_match_pkt_pointers()
5755 			    src_reg->type == PTR_TO_PACKET_META)) {  in try_match_pkt_pointers()
5757 			find_good_pkt_pointers(other_branch, src_reg,  in try_match_pkt_pointers()
5758 					       src_reg->type, false);  in try_match_pkt_pointers()
5765 		     src_reg->type == PTR_TO_PACKET_END) ||  in try_match_pkt_pointers()
5767 		     reg_is_init_pkt_pointer(src_reg, PTR_TO_PACKET))) {  in try_match_pkt_pointers()
5772 			    src_reg->type == PTR_TO_PACKET) ||  in try_match_pkt_pointers()
5774 			    src_reg->type == PTR_TO_PACKET_META)) {  in try_match_pkt_pointers()
5776 			find_good_pkt_pointers(this_branch, src_reg,  in try_match_pkt_pointers()
5777 					       src_reg->type, true);  in try_match_pkt_pointers()
5795 	struct bpf_reg_state *dst_reg, *other_branch_regs, *src_reg = NULL;  in check_cond_jmp_op()  local
5814 		err = check_reg_arg(env, insn->src_reg, SRC_OP);  in check_cond_jmp_op()
5818 		if (is_pointer_value(env, insn->src_reg)) {  in check_cond_jmp_op()
5820 				insn->src_reg);  in check_cond_jmp_op()
5823 		src_reg = &regs[insn->src_reg];  in check_cond_jmp_op()
5825 		if (insn->src_reg != BPF_REG_0) {  in check_cond_jmp_op()
5842 	else if (src_reg->type == SCALAR_VALUE &&  in check_cond_jmp_op()
5843 		 tnum_is_const(src_reg->var_off))  in check_cond_jmp_op()
5844 		pred = is_branch_taken(dst_reg, src_reg->var_off.value,  in check_cond_jmp_op()
5849 			err = mark_chain_precision(env, insn->src_reg);  in check_cond_jmp_op()
5878 		struct bpf_reg_state *src_reg = &regs[insn->src_reg];  in check_cond_jmp_op()  local
5880 		struct bpf_reg_state lo_reg1 = *src_reg;  in check_cond_jmp_op()
5889 		    src_reg->type == SCALAR_VALUE) {  in check_cond_jmp_op()
5890 			if (tnum_is_const(src_reg->var_off) ||  in check_cond_jmp_op()
5896 						: src_reg->var_off.value,  in check_cond_jmp_op()
5900 				reg_set_min_max_inv(&other_branch_regs[insn->src_reg],  in check_cond_jmp_op()
5901 						    src_reg,  in check_cond_jmp_op()
5909 				reg_combine_min_max(&other_branch_regs[insn->src_reg],  in check_cond_jmp_op()
5911 						    src_reg, dst_reg, opcode);  in check_cond_jmp_op()
5932 	} else if (!try_match_pkt_pointers(insn, dst_reg, &regs[insn->src_reg],  in check_cond_jmp_op()
5965 	if (insn->src_reg == 0) {  in check_ld_imm()
5977 	if (insn->src_reg == BPF_PSEUDO_MAP_VALUE) {  in check_ld_imm()
5982 	} else if (insn->src_reg == BPF_PSEUDO_MAP_FD) {  in check_ld_imm()
6049 	    (mode == BPF_ABS && insn->src_reg != BPF_REG_0)) {  in check_ld_abs()
6082 		err = check_reg_arg(env, insn->src_reg, SRC_OP);  in check_ld_abs()
6315 			if (insns[t].src_reg == BPF_PSEUDO_CALL) {  in check_cfg()
7586 			err = check_reg_arg(env, insn->src_reg, SRC_OP);  in do_check()
7594 			src_reg_type = regs[insn->src_reg].type;  in do_check()
7599 			err = check_mem_access(env, env->insn_idx, insn->src_reg,  in do_check()
7638 			err = check_reg_arg(env, insn->src_reg, SRC_OP);  in do_check()
7651 					       BPF_WRITE, insn->src_reg, false);  in do_check()
7666 			    insn->src_reg != BPF_REG_0) {  in do_check()
7696 				    (insn->src_reg != BPF_REG_0 &&  in do_check()
7697 				     insn->src_reg != BPF_PSEUDO_CALL) ||  in do_check()
7705 				    (insn->src_reg == BPF_PSEUDO_CALL ||  in do_check()
7710 				if (insn->src_reg == BPF_PSEUDO_CALL)  in do_check()
7720 				    insn->src_reg != BPF_REG_0 ||  in do_check()
7733 				    insn->src_reg != BPF_REG_0 ||  in do_check()
7923 			    insn[1].dst_reg != 0 || insn[1].src_reg != 0 ||  in replace_map_fd_with_map_ptr()
7929 			if (insn[0].src_reg == 0)  in replace_map_fd_with_map_ptr()
7936 			if ((insn[0].src_reg != BPF_PSEUDO_MAP_FD &&  in replace_map_fd_with_map_ptr()
7937 			     insn[0].src_reg != BPF_PSEUDO_MAP_VALUE) ||  in replace_map_fd_with_map_ptr()
7938 			    (insn[0].src_reg == BPF_PSEUDO_MAP_FD &&  in replace_map_fd_with_map_ptr()
7960 			if (insn->src_reg == BPF_PSEUDO_MAP_FD) {  in replace_map_fd_with_map_ptr()
8074 			insn->src_reg = 0;  in convert_pseudo_ld_imm64()
8467 		zext_patch[1].src_reg = insn.dst_reg;  in opt_subreg_zext_lo32_rnd_hi32()
8673 		    insn->src_reg != BPF_PSEUDO_CALL)  in jit_subprogs()
8756 			    insn->src_reg != BPF_PSEUDO_CALL)  in jit_subprogs()
8802 		    insn->src_reg != BPF_PSEUDO_CALL)  in jit_subprogs()
8825 		    insn->src_reg != BPF_PSEUDO_CALL)  in jit_subprogs()
8854 		    insn->src_reg != BPF_PSEUDO_CALL)  in fixup_call_args()
8891 				BPF_MOV32_REG(insn->src_reg, insn->src_reg),  in fixup_bpf_calls()
8893 				BPF_JMP_IMM(BPF_JNE, insn->src_reg, 0, 2),  in fixup_bpf_calls()
8899 				BPF_MOV32_REG(insn->src_reg, insn->src_reg),  in fixup_bpf_calls()
8901 				BPF_JMP_IMM(BPF_JEQ, insn->src_reg, 0, 1),  in fixup_bpf_calls()
8962 			off_reg = issrc ? insn->src_reg : insn->dst_reg;  in fixup_bpf_calls()
8973 				insn->src_reg = BPF_REG_AX;  in fixup_bpf_calls()
8998 		if (insn->src_reg == BPF_PSEUDO_CALL)  in fixup_bpf_calls()