bpf: verifier improvements and cleanups
Subsystems (6)
cover bpf: verifier improvements and cleanups
Small set of verifier improvements and cleanups which is necessary for bigger patch set of bpf-to-bpf calls coming later. See individual patches for details.
Tested on x86 and arm64 hw.
Alexei Starovoitov (7):
bpf: fix stack state printing in verifier log
bpf: print liveness info to verifier log
bpf: don't mark FP reg as uninit
bpf: improve verifier liveness marks
bpf: improve JEQ/JNE path walking
bpf: cleanup register_is_null() selftests/bpf: adjust test_align expected output
kernel/bpf/verifier.c | 62 ++++++++---- tools/testing/selftests/bpf/test_align.c | 156 +++++++++++++++---------------- 2 files changed, 120 insertions(+), 98 deletions(-)
Signature · 1 line
2.9.5
PATCH 1/7 bpf: fix stack state printing in verifier log
fix incorrect stack state prints in print_verifier_state()
Fixes 638f5b90d460 ("bpf: reduce verifier memory consumption")
Signed-off-by Alexei Starovoitov <[email protected]>
Acked-by John Fastabend <[email protected]>
Acked-by Daniel Borkmann <[email protected]>
--- kernel/bpf/verifier.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
kernel/bpf/verifier.c +1 -1
@@ -279,7 +279,7 @@ static void print_verifier_state(struct bpf_verifier_env *env,for (i =0 ; i < state->allocated_stack /BPF_REG_SIZE ; i++) {if (state->stack[i].slot_type[0 ] ==STACK_SPILL )verbose (env," fp%d=%s" , - -MAX_BPF_STACK + i *BPF_REG_SIZE , + (-i -1 ) *BPF_REG_SIZE , reg_type_str[state->stack[i].spilled_ptr.type]); }verbose (env,"\n" );
Signature · 1 line
2.9.5
PATCH 2/7 bpf: print liveness info to verifier log
In reply to Alexei Starovoitovlet verifier print register and stack liveness information into verifier log
Signed-off-by Alexei Starovoitov <[email protected]>
Acked-by John Fastabend <[email protected]>
Acked-by Daniel Borkmann <[email protected]>
--- kernel/bpf/verifier.c | 24 ++++++++++++++++++++---- 1 file changed, 20 insertions(+), 4 deletions(-)
kernel/bpf/verifier.c +20 -4
@@ -216,6 +216,17 @@ static const char * const reg_type_str[] = { [PTR_TO_PACKET_END] = "pkt_end", }; +static void print_liveness (struct bpf_verifier_env *env, +enum bpf_reg_liveness live) +{ +if (live & (REG_LIVE_READ |REG_LIVE_WRITTEN )) +verbose (env,"_" ); +if (live ®_LIVE_READ ) +verbose (env,"r" ); +if (live ®_LIVE_WRITTEN ) +verbose (env,"w" ); +} +static void print_verifier_state (struct bpf_verifier_env *env,struct bpf_verifier_state *state) {
@@ -228,7 +239,9 @@ static void print_verifier_state(struct bpf_verifier_env *env, t = reg->type;if (t ==NOT_INIT )continue ; -verbose (env," R%d=%s" , i, reg_type_str[t]); +verbose (env," R%d" , i); +print_liveness (env, reg->live); +verbose (env,"=%s" , reg_type_str[t]);if ((t ==SCALAR_VALUE || t ==PTR_TO_STACK ) &&tnum_is_const (reg->var_off)) {/* reg->off should be 0 for SCALAR_VALUE */
@@ -277,10 +290,13 @@ static void print_verifier_state(struct bpf_verifier_env *env, } }for (i =0 ; i < state->allocated_stack /BPF_REG_SIZE ; i++) { -if (state->stack[i].slot_type[0 ] ==STACK_SPILL ) -verbose (env," fp%d=%s" , - (-i -1 ) *BPF_REG_SIZE , +if (state->stack[i].slot_type[0 ] ==STACK_SPILL ) { +verbose (env," fp%d" , + (-i -1 ) *BPF_REG_SIZE ); +print_liveness (env, state->stack[i].spilled_ptr.live); +verbose (env,"=%s" , reg_type_str[state->stack[i].spilled_ptr.type]); + } }verbose (env,"\n" ); }
Signature · 1 line
2.9.5
PATCH 3/7 bpf: don't mark FP reg as uninit
In reply to Alexei Starovoitovwhen verifier hits an internal bug don't mark register R10==FP as uninit, since it's read only register and it's not technically correct to let verifier run further, since it may assume that R10 has valid auxiliary state.
While developing subsequent patches this issue was discovered, though the code eventually changed that aux reg state doesn't have pointers any more it is still safer to avoid clearing readonly register.
Signed-off-by Alexei Starovoitov <[email protected]>
Acked-by John Fastabend <[email protected]>
Acked-by Daniel Borkmann <[email protected]>
--- kernel/bpf/verifier.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
kernel/bpf/verifier.c +4 -4
@@ -584,8 +584,8 @@ static void mark_reg_unknown(struct bpf_verifier_env *env, {if (WARN_ON (regno >=MAX_BPF_REG )) {verbose (env,"mark_reg_unknown(regs, %u)\n" , regno); -/* Something bad happened, let's kill all regs */ -for (regno =0 ; regno <MAX_BPF_REG ; regno++) +/* Something bad happened, let's kill all regs except FP */ +for (regno =0 ; regno <BPF_REG_FP ; regno++)__mark_reg_not_init (regs + regno);return ; }
@@ -603,8 +603,8 @@ static void mark_reg_not_init(struct bpf_verifier_env *env, {if (WARN_ON (regno >=MAX_BPF_REG )) {verbose (env,"mark_reg_not_init(regs, %u)\n" , regno); -/* Something bad happened, let's kill all regs */ -for (regno =0 ; regno <MAX_BPF_REG ; regno++) +/* Something bad happened, let's kill all regs except FP */ +for (regno =0 ; regno <BPF_REG_FP ; regno++)__mark_reg_not_init (regs + regno);return ; }
Signature · 1 line
2.9.5
PATCH 4/7 bpf: improve verifier liveness marks
In reply to Alexei Starovoitovregisters with pointers filled from stack were missing live_written marks which caused liveness propagation to unnecessary mark more registers as live_read and miss state pruning opportunities later on.
before after bpf_lb-DLB_L3.o 2285 2270 bpf_lb-DLB_L4.o 3723 3682 bpf_lb-DUNKNOWN.o 1110 1110 bpf_lxc-DDROP_ALL.o 27954 27876 bpf_lxc-DUNKNOWN.o 38954 38780 bpf_netdev.o 16943 16937 bpf_overlay.o 7929 7929
Signed-off-by Alexei Starovoitov <[email protected]>
Acked-by John Fastabend <[email protected]>
Acked-by Daniel Borkmann <[email protected]>
--- kernel/bpf/verifier.c | 5 +++++ 1 file changed, 5 insertions(+)
kernel/bpf/verifier.c +5 -0
@@ -795,6 +795,11 @@ static int check_stack_read(struct bpf_verifier_env *env,if (value_regno >=0 ) {/* restore register state from stack */ state->regs[value_regno] = state->stack[spi].spilled_ptr; +/* mark reg as written since spilled pointer state likely +* has its liveness marks cleared by is_state_visited() +* which resets stack/reg liveness for state transitions +*/ + state->regs[value_regno].live |=REG_LIVE_WRITTEN ;mark_stack_slot_read (state, spi); }return 0 ;
Signature · 1 line
2.9.5
PATCH 5/7 bpf: improve JEQ/JNE path walking
In reply to Alexei Starovoitovverifier knows how to trim paths that are known not to be taken at run-time when register containing run-time constant is compared with another constant.
It was done only for JEQ comparison.
Extend it to include JNE as well.
More cases can be added in the future.
before after
bpf_lb-DLB_L3.o 2270 2051 bpf_lb-DLB_L4.o 3682 3287 bpf_lb-DUNKNOWN.o 1110 1080 bpf_lxc-DDROP_ALL.o 27876 24980 bpf_lxc-DUNKNOWN.o 38780 34308 bpf_netdev.o 16937 15404 bpf_overlay.o 7929 7191
Signed-off-by Alexei Starovoitov <[email protected]>
Acked-by John Fastabend <[email protected]>
Acked-by Daniel Borkmann <[email protected]>
--- kernel/bpf/verifier.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
kernel/bpf/verifier.c +3 -2
@@ -2955,8 +2955,9 @@ static int check_cond_jmp_op(struct bpf_verifier_env *env,if (BPF_SRC (insn->code) ==BPF_K && (opcode ==BPF_JEQ || opcode ==BPF_JNE ) && dst_reg->type ==SCALAR_VALUE && -tnum_equals_const (dst_reg->var_off, insn->imm)) { -if (opcode ==BPF_JEQ ) { +tnum_is_const (dst_reg->var_off)) { +if ((opcode ==BPF_JEQ && dst_reg->var_off.value == insn->imm) || + (opcode ==BPF_JNE && dst_reg->var_off.value != insn->imm)) {/* if (imm == imm) goto pc+off; * only follow the goto, ignore fall-through */
Signature · 1 line
2.9.5
PATCH 6/7 bpf: cleanup register_is_null()
In reply to Alexei Starovoitovdon't pass large struct bpf_reg_state by value. Instead pass it by pointer.
Signed-off-by Alexei Starovoitov <[email protected]>
Acked-by John Fastabend <[email protected]>
Acked-by Daniel Borkmann <[email protected]>
--- kernel/bpf/verifier.c | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-)
kernel/bpf/verifier.c +10 -10
@@ -1265,9 +1265,9 @@ static int check_xadd(struct bpf_verifier_env *env, int insn_idx, struct bpf_ins }/* Does this register contain a constant zero? */ -static bool register_is_null (struct bpf_reg_state reg) +static bool register_is_null (struct bpf_reg_state *reg) { -return reg.type ==SCALAR_VALUE &&tnum_equals_const (reg.var_off,0 ); +return reg->type ==SCALAR_VALUE &&tnum_equals_const (reg->var_off,0 ); }/* when register 'regno' is passed into function that will read 'access_size'
@@ -1280,31 +1280,31 @@ static int check_stack_boundary(struct bpf_verifier_env *env, int regno, int access_size, bool zero_size_allowed, struct bpf_call_arg_meta *meta) { + struct bpf_reg_state *reg = cur_regs(env) + regno;struct bpf_verifier_state *state = env->cur_state; -struct bpf_reg_state *regs = state->regs;int off, i, slot, spi; -if (regs[regno].type !=PTR_TO_STACK ) { +if (reg->type !=PTR_TO_STACK ) {/* Allow zero-byte read from NULL, regardless of pointer type */ if (zero_size_allowed && access_size ==0 && -register_is_null (regs[regno])) +register_is_null (reg))return 0 ;verbose (env,"R%d type=%s expected=%s\n" , regno, - reg_type_str[regs[regno].type], + reg_type_str[reg->type], reg_type_str[PTR_TO_STACK ]);return -EACCES ; }/* Only allow fixed-offset stack reads */ -if (!tnum_is_const (regs[regno].var_off)) { +if (!tnum_is_const (reg->var_off)) {char tn_buf[48 ]; -tnum_strn (tn_buf,sizeof (tn_buf), regs[regno].var_off); +tnum_strn (tn_buf,sizeof (tn_buf), reg->var_off);verbose (env,"invalid variable stack read R%d var_off=%s\n" , regno, tn_buf); } - off = regs[regno].off + regs[regno].var_off.value; + off = reg->off + reg->var_off.value;if (off >=0 || off < -MAX_BPF_STACK || off + access_size >0 || access_size <0 || (access_size ==0 && !zero_size_allowed)) { verbose(env, "invalid stack type R%d off=%d access_size=%d\n",
@@ -1412,7 +1412,7 @@ static int check_func_arg(struct bpf_verifier_env *env, u32 regno,* passed in as argument, it's a SCALAR_VALUE type. Final test * happens during stack boundary checking. */ -if (register_is_null (*reg) && +if (register_is_null (reg) && arg_type ==ARG_PTR_TO_MEM_OR_NULL )/* final test in check_stack_boundary() */ ; else if (!type_is_pkt_pointer(type) &&
Signature · 1 line
2.9.5
PATCH 7/7 selftests/bpf: adjust test_align expected output
In reply to Alexei Starovoitovsince verifier started to print liveness state of the registers adjust expected output of test_align.
Now this test checks for both proper alignment handling by verifier and correctness of liveness marks.
Signed-off-by Alexei Starovoitov <[email protected]>
Acked-by Daniel Borkmann <[email protected]>
--- tools/testing/selftests/bpf/test_align.c | 156 +++++++++++++++---------------- 1 file changed, 78 insertions(+), 78 deletions(-)
tools/testing/selftests/bpf/test_align.c +78 -78
@@ -64,11 +64,11 @@ static struct bpf_align_test tests[] = { .matches = { {1, "R1=ctx(id=0,off=0,imm=0)"}, {1, "R10=fp0"}, - {1, "R3=inv2"}, - {2, "R3=inv4"}, - {3, "R3=inv8"}, - {4, "R3=inv16"}, - {5, "R3=inv32"}, + {1, "R3_w=inv2"}, + {2, "R3_w=inv4"}, + {3, "R3_w=inv8"}, + {4, "R3_w=inv16"}, + {5, "R3_w=inv32"}, }, }, {
@@ -92,17 +92,17 @@ static struct bpf_align_test tests[] = { .matches = { {1, "R1=ctx(id=0,off=0,imm=0)"}, {1, "R10=fp0"}, - {1, "R3=inv1"}, - {2, "R3=inv2"}, - {3, "R3=inv4"}, - {4, "R3=inv8"}, - {5, "R3=inv16"}, - {6, "R3=inv1"}, - {7, "R4=inv32"}, - {8, "R4=inv16"}, - {9, "R4=inv8"}, - {10, "R4=inv4"}, - {11, "R4=inv2"}, + {1, "R3_w=inv1"}, + {2, "R3_w=inv2"}, + {3, "R3_w=inv4"}, + {4, "R3_w=inv8"}, + {5, "R3_w=inv16"}, + {6, "R3_w=inv1"}, + {7, "R4_w=inv32"}, + {8, "R4_w=inv16"}, + {9, "R4_w=inv8"}, + {10, "R4_w=inv4"}, + {11, "R4_w=inv2"}, }, }, {
@@ -121,12 +121,12 @@ static struct bpf_align_test tests[] = { .matches = { {1, "R1=ctx(id=0,off=0,imm=0)"}, {1, "R10=fp0"}, - {1, "R3=inv4"}, - {2, "R3=inv8"}, - {3, "R3=inv10"}, - {4, "R4=inv8"}, - {5, "R4=inv12"}, - {6, "R4=inv14"}, + {1, "R3_w=inv4"}, + {2, "R3_w=inv8"}, + {3, "R3_w=inv10"}, + {4, "R4_w=inv8"}, + {5, "R4_w=inv12"}, + {6, "R4_w=inv14"}, }, }, {
@@ -143,10 +143,10 @@ static struct bpf_align_test tests[] = { .matches = { {1, "R1=ctx(id=0,off=0,imm=0)"}, {1, "R10=fp0"}, - {1, "R3=inv7"}, - {2, "R3=inv7"}, - {3, "R3=inv14"}, - {4, "R3=inv56"}, + {1, "R3_w=inv7"}, + {2, "R3_w=inv7"}, + {3, "R3_w=inv14"}, + {4, "R3_w=inv56"}, }, },
@@ -185,18 +185,18 @@ static struct bpf_align_test tests[] = { .prog_type = BPF_PROG_TYPE_SCHED_CLS, .matches = { {7, "R0=pkt(id=0,off=8,r=8,imm=0)"}, - {7, "R3=inv(id=0,umax_value=255,var_off=(0x0; 0xff))"}, - {8, "R3=inv(id=0,umax_value=510,var_off=(0x0; 0x1fe))"}, - {9, "R3=inv(id=0,umax_value=1020,var_off=(0x0; 0x3fc))"}, - {10, "R3=inv(id=0,umax_value=2040,var_off=(0x0; 0x7f8))"}, - {11, "R3=inv(id=0,umax_value=4080,var_off=(0x0; 0xff0))"}, + {7, "R3_w=inv(id=0,umax_value=255,var_off=(0x0; 0xff))"}, + {8, "R3_w=inv(id=0,umax_value=510,var_off=(0x0; 0x1fe))"}, + {9, "R3_w=inv(id=0,umax_value=1020,var_off=(0x0; 0x3fc))"}, + {10, "R3_w=inv(id=0,umax_value=2040,var_off=(0x0; 0x7f8))"}, + {11, "R3_w=inv(id=0,umax_value=4080,var_off=(0x0; 0xff0))"}, {18, "R3=pkt_end(id=0,off=0,imm=0)"}, - {18, "R4=inv(id=0,umax_value=255,var_off=(0x0; 0xff))"}, - {19, "R4=inv(id=0,umax_value=8160,var_off=(0x0; 0x1fe0))"}, - {20, "R4=inv(id=0,umax_value=4080,var_off=(0x0; 0xff0))"}, - {21, "R4=inv(id=0,umax_value=2040,var_off=(0x0; 0x7f8))"}, - {22, "R4=inv(id=0,umax_value=1020,var_off=(0x0; 0x3fc))"}, - {23, "R4=inv(id=0,umax_value=510,var_off=(0x0; 0x1fe))"}, + {18, "R4_w=inv(id=0,umax_value=255,var_off=(0x0; 0xff))"}, + {19, "R4_w=inv(id=0,umax_value=8160,var_off=(0x0; 0x1fe0))"}, + {20, "R4_w=inv(id=0,umax_value=4080,var_off=(0x0; 0xff0))"}, + {21, "R4_w=inv(id=0,umax_value=2040,var_off=(0x0; 0x7f8))"}, + {22, "R4_w=inv(id=0,umax_value=1020,var_off=(0x0; 0x3fc))"}, + {23, "R4_w=inv(id=0,umax_value=510,var_off=(0x0; 0x1fe))"}, }, }, {
@@ -217,16 +217,16 @@ static struct bpf_align_test tests[] = { }, .prog_type = BPF_PROG_TYPE_SCHED_CLS, .matches = { - {7, "R3=inv(id=0,umax_value=255,var_off=(0x0; 0xff))"}, - {8, "R4=inv(id=0,umax_value=255,var_off=(0x0; 0xff))"}, - {9, "R4=inv(id=0,umax_value=255,var_off=(0x0; 0xff))"}, - {10, "R4=inv(id=0,umax_value=255,var_off=(0x0; 0xff))"}, - {11, "R4=inv(id=0,umax_value=510,var_off=(0x0; 0x1fe))"}, - {12, "R4=inv(id=0,umax_value=255,var_off=(0x0; 0xff))"}, - {13, "R4=inv(id=0,umax_value=1020,var_off=(0x0; 0x3fc))"}, - {14, "R4=inv(id=0,umax_value=255,var_off=(0x0; 0xff))"}, - {15, "R4=inv(id=0,umax_value=2040,var_off=(0x0; 0x7f8))"}, - {16, "R4=inv(id=0,umax_value=4080,var_off=(0x0; 0xff0))"}, + {7, "R3_w=inv(id=0,umax_value=255,var_off=(0x0; 0xff))"}, + {8, "R4_w=inv(id=0,umax_value=255,var_off=(0x0; 0xff))"}, + {9, "R4_w=inv(id=0,umax_value=255,var_off=(0x0; 0xff))"}, + {10, "R4_w=inv(id=0,umax_value=255,var_off=(0x0; 0xff))"}, + {11, "R4_w=inv(id=0,umax_value=510,var_off=(0x0; 0x1fe))"}, + {12, "R4_w=inv(id=0,umax_value=255,var_off=(0x0; 0xff))"}, + {13, "R4_w=inv(id=0,umax_value=1020,var_off=(0x0; 0x3fc))"}, + {14, "R4_w=inv(id=0,umax_value=255,var_off=(0x0; 0xff))"}, + {15, "R4_w=inv(id=0,umax_value=2040,var_off=(0x0; 0x7f8))"}, + {16, "R4_w=inv(id=0,umax_value=4080,var_off=(0x0; 0xff0))"}, }, }, {
@@ -257,14 +257,14 @@ static struct bpf_align_test tests[] = { }, .prog_type = BPF_PROG_TYPE_SCHED_CLS, .matches = { - {4, "R5=pkt(id=0,off=0,r=0,imm=0)"}, - {5, "R5=pkt(id=0,off=14,r=0,imm=0)"}, - {6, "R4=pkt(id=0,off=14,r=0,imm=0)"}, + {4, "R5_w=pkt(id=0,off=0,r=0,imm=0)"}, + {5, "R5_w=pkt(id=0,off=14,r=0,imm=0)"}, + {6, "R4_w=pkt(id=0,off=14,r=0,imm=0)"}, {10, "R2=pkt(id=0,off=0,r=18,imm=0)"}, {10, "R5=pkt(id=0,off=14,r=18,imm=0)"}, - {10, "R4=inv(id=0,umax_value=255,var_off=(0x0; 0xff))"}, - {14, "R4=inv(id=0,umax_value=65535,var_off=(0x0; 0xffff))"}, - {15, "R4=inv(id=0,umax_value=65535,var_off=(0x0; 0xffff))"}, + {10, "R4_w=inv(id=0,umax_value=255,var_off=(0x0; 0xff))"}, + {14, "R4_w=inv(id=0,umax_value=65535,var_off=(0x0; 0xffff))"}, + {15, "R4_w=inv(id=0,umax_value=65535,var_off=(0x0; 0xffff))"}, }, }, {
@@ -320,11 +320,11 @@ static struct bpf_align_test tests[] = {* alignment of 4. */ {8, "R2=pkt(id=0,off=0,r=8,imm=0)"}, - {8, "R6=inv(id=0,umax_value=1020,var_off=(0x0; 0x3fc))"}, + {8, "R6_w=inv(id=0,umax_value=1020,var_off=(0x0; 0x3fc))"},/* Offset is added to packet pointer R5, resulting in * known fixed offset, and variable offset from R6. */ - {11, "R5=pkt(id=1,off=14,r=0,umax_value=1020,var_off=(0x0; 0x3fc))"}, + {11, "R5_w=pkt(id=1,off=14,r=0,umax_value=1020,var_off=(0x0; 0x3fc))"},/* At the time the word size load is performed from R5, * it's total offset is NET_IP_ALIGN + reg->off (0) + * reg->aux_off (14) which is 16. Then the variable
@@ -336,11 +336,11 @@ static struct bpf_align_test tests[] = {/* Variable offset is added to R5 packet pointer, * resulting in auxiliary alignment of 4. */ - {18, "R5=pkt(id=2,off=0,r=0,umax_value=1020,var_off=(0x0; 0x3fc))"}, + {18, "R5_w=pkt(id=2,off=0,r=0,umax_value=1020,var_off=(0x0; 0x3fc))"},/* Constant offset is added to R5, resulting in * reg->off of 14. */ - {19, "R5=pkt(id=2,off=14,r=0,umax_value=1020,var_off=(0x0; 0x3fc))"}, + {19, "R5_w=pkt(id=2,off=14,r=0,umax_value=1020,var_off=(0x0; 0x3fc))"},/* At the time the word size load is performed from R5, * its total fixed offset is NET_IP_ALIGN + reg->off * (14) which is 16. Then the variable offset is 4-byte
@@ -352,18 +352,18 @@ static struct bpf_align_test tests[] = {/* Constant offset is added to R5 packet pointer, * resulting in reg->off value of 14. */ - {26, "R5=pkt(id=0,off=14,r=8"}, + {26, "R5_w=pkt(id=0,off=14,r=8"},/* Variable offset is added to R5, resulting in a * variable offset of (4n). */ - {27, "R5=pkt(id=3,off=14,r=0,umax_value=1020,var_off=(0x0; 0x3fc))"}, + {27, "R5_w=pkt(id=3,off=14,r=0,umax_value=1020,var_off=(0x0; 0x3fc))"},/* Constant is added to R5 again, setting reg->off to 18. */ - {28, "R5=pkt(id=3,off=18,r=0,umax_value=1020,var_off=(0x0; 0x3fc))"}, + {28, "R5_w=pkt(id=3,off=18,r=0,umax_value=1020,var_off=(0x0; 0x3fc))"},/* And once more we add a variable; resulting var_off * is still (4n), fixed offset is not changed. * Also, we create a new reg->id. */ - {29, "R5=pkt(id=4,off=18,r=0,umax_value=2040,var_off=(0x0; 0x7fc))"}, + {29, "R5_w=pkt(id=4,off=18,r=0,umax_value=2040,var_off=(0x0; 0x7fc))"},/* At the time the word size load is performed from R5, * its total fixed offset is NET_IP_ALIGN + reg->off (18) * which is 20. Then the variable offset is (4n), so
@@ -410,11 +410,11 @@ static struct bpf_align_test tests[] = {* alignment of 4. */ {8, "R2=pkt(id=0,off=0,r=8,imm=0)"}, - {8, "R6=inv(id=0,umax_value=1020,var_off=(0x0; 0x3fc))"}, + {8, "R6_w=inv(id=0,umax_value=1020,var_off=(0x0; 0x3fc))"},/* Adding 14 makes R6 be (4n+2) */ - {9, "R6=inv(id=0,umin_value=14,umax_value=1034,var_off=(0x2; 0x7fc))"}, + {9, "R6_w=inv(id=0,umin_value=14,umax_value=1034,var_off=(0x2; 0x7fc))"},/* Packet pointer has (4n+2) offset */ - {11, "R5=pkt(id=1,off=0,r=0,umin_value=14,umax_value=1034,var_off=(0x2; 0x7fc))"}, + {11, "R5_w=pkt(id=1,off=0,r=0,umin_value=14,umax_value=1034,var_off=(0x2; 0x7fc))"}, {13, "R4=pkt(id=1,off=4,r=0,umin_value=14,umax_value=1034,var_off=(0x2; 0x7fc))"},/* At the time the word size load is performed from R5, * its total fixed offset is NET_IP_ALIGN + reg->off (0)
@@ -426,11 +426,11 @@ static struct bpf_align_test tests[] = {/* Newly read value in R6 was shifted left by 2, so has * known alignment of 4. */ - {18, "R6=inv(id=0,umax_value=1020,var_off=(0x0; 0x3fc))"}, + {18, "R6_w=inv(id=0,umax_value=1020,var_off=(0x0; 0x3fc))"},/* Added (4n) to packet pointer's (4n+2) var_off, giving * another (4n+2). */ - {19, "R5=pkt(id=2,off=0,r=0,umin_value=14,umax_value=2054,var_off=(0x2; 0xffc))"}, + {19, "R5_w=pkt(id=2,off=0,r=0,umin_value=14,umax_value=2054,var_off=(0x2; 0xffc))"}, {21, "R4=pkt(id=2,off=4,r=0,umin_value=14,umax_value=2054,var_off=(0x2; 0xffc))"},/* At the time the word size load is performed from R5, * its total fixed offset is NET_IP_ALIGN + reg->off (0)
@@ -473,11 +473,11 @@ static struct bpf_align_test tests[] = { .prog_type = BPF_PROG_TYPE_SCHED_CLS, .result = REJECT, .matches = { - {4, "R5=pkt(id=0,off=0,r=0,imm=0)"}, + {4, "R5_w=pkt(id=0,off=0,r=0,imm=0)"},/* ptr & 0x40 == either 0 or 0x40 */ - {5, "R5=inv(id=0,umax_value=64,var_off=(0x0; 0x40))"}, + {5, "R5_w=inv(id=0,umax_value=64,var_off=(0x0; 0x40))"},/* ptr << 2 == unknown, (4n) */ - {7, "R5=inv(id=0,smax_value=9223372036854775804,umax_value=18446744073709551612,var_off=(0x0; 0xfffffffffffffffc))"}, + {7, "R5_w=inv(id=0,smax_value=9223372036854775804,umax_value=18446744073709551612,var_off=(0x0; 0xfffffffffffffffc))"},/* (4n) + 14 == (4n+2). We blow our bounds, because * the add could overflow. */
@@ -485,7 +485,7 @@ static struct bpf_align_test tests[] = {/* Checked s>=0 */ {10, "R5=inv(id=0,umin_value=2,umax_value=9223372036854775806,var_off=(0x2; 0x7ffffffffffffffc))"},/* packet pointer + nonnegative (4n+2) */ - {12, "R6=pkt(id=1,off=0,r=0,umin_value=2,umax_value=9223372036854775806,var_off=(0x2; 0x7ffffffffffffffc))"}, + {12, "R6_w=pkt(id=1,off=0,r=0,umin_value=2,umax_value=9223372036854775806,var_off=(0x2; 0x7ffffffffffffffc))"}, {14, "R4=pkt(id=1,off=4,r=0,umin_value=2,umax_value=9223372036854775806,var_off=(0x2; 0x7ffffffffffffffc))"},/* NET_IP_ALIGN + (4n+2) == (4n), alignment is fine. * We checked the bounds, but it might have been able
@@ -530,11 +530,11 @@ static struct bpf_align_test tests[] = {* alignment of 4. */ {7, "R2=pkt(id=0,off=0,r=8,imm=0)"}, - {9, "R6=inv(id=0,umax_value=1020,var_off=(0x0; 0x3fc))"}, + {9, "R6_w=inv(id=0,umax_value=1020,var_off=(0x0; 0x3fc))"},/* Adding 14 makes R6 be (4n+2) */ - {10, "R6=inv(id=0,umin_value=14,umax_value=1034,var_off=(0x2; 0x7fc))"}, + {10, "R6_w=inv(id=0,umin_value=14,umax_value=1034,var_off=(0x2; 0x7fc))"},/* New unknown value in R7 is (4n) */ - {11, "R7=inv(id=0,umax_value=1020,var_off=(0x0; 0x3fc))"}, + {11, "R7_w=inv(id=0,umax_value=1020,var_off=(0x0; 0x3fc))"},/* Subtracting it from R6 blows our unsigned bounds */ {12, "R6=inv(id=0,smin_value=-1006,smax_value=1034,var_off=(0x2; 0xfffffffffffffffc))"},/* Checked s>= 0 */
@@ -583,15 +583,15 @@ static struct bpf_align_test tests[] = {* alignment of 4. */ {7, "R2=pkt(id=0,off=0,r=8,imm=0)"}, - {10, "R6=inv(id=0,umax_value=60,var_off=(0x0; 0x3c))"}, + {10, "R6_w=inv(id=0,umax_value=60,var_off=(0x0; 0x3c))"},/* Adding 14 makes R6 be (4n+2) */ - {11, "R6=inv(id=0,umin_value=14,umax_value=74,var_off=(0x2; 0x7c))"}, + {11, "R6_w=inv(id=0,umin_value=14,umax_value=74,var_off=(0x2; 0x7c))"},/* Subtracting from packet pointer overflows ubounds */ - {13, "R5=pkt(id=1,off=0,r=8,umin_value=18446744073709551542,umax_value=18446744073709551602,var_off=(0xffffffffffffff82; 0x7c))"}, + {13, "R5_w=pkt(id=1,off=0,r=8,umin_value=18446744073709551542,umax_value=18446744073709551602,var_off=(0xffffffffffffff82; 0x7c))"},/* New unknown value in R7 is (4n), >= 76 */ - {15, "R7=inv(id=0,umin_value=76,umax_value=1096,var_off=(0x0; 0x7fc))"}, + {15, "R7_w=inv(id=0,umin_value=76,umax_value=1096,var_off=(0x0; 0x7fc))"},/* Adding it to packet pointer gives nice bounds again */ - {16, "R5=pkt(id=2,off=0,r=0,umin_value=2,umax_value=1082,var_off=(0x2; 0x7fc))"}, + {16, "R5_w=pkt(id=2,off=0,r=0,umin_value=2,umax_value=1082,var_off=(0x2; 0x7fc))"},/* At the time the word size load is performed from R5, * its total fixed offset is NET_IP_ALIGN + reg->off (0) * which is 2. Then the variable offset is (4n+2), so
Signature · 1 line
2.9.5
Daniel Borkmann
maintainerQuoted 4 lines · Alexei Starovoitov
Small set of verifier improvements and cleanups which is necessary for bigger patch set of bpf-to-bpf calls coming later. See individual patches for details.
Tested on x86 and arm64 hw.
Series applied to bpf-next, thanks Alexei!