Skip to content

L
linux
Commit 554b36bf authored by Daniel Borkmann's avatar Daniel Borkmann
Browse files
Options

Merge branch 'bpf-verifier-misc-improvements' 

Alexei Starovoitov says:

====================
Small set of verifier improvements and cleanups which is
necessary for bigger patch set of bpf-to-bpf calls coming later.
See individual patches for details.
Tested on x86 and arm64 hw.
====================
Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
parents 51de0825 6a28b446
Hide whitespace changes
Inline Side-by-side
Showing with 120 additions and 98 deletions
kernel/bpf/verifier.c
View file @ 554b36bf
...@@ -216,6 +216,17 @@ static const char * const reg_type_str[] = { ...@@ -216,6 +216,17 @@ static const char * const reg_type_str[] = {
[PTR_TO_PACKET_END] = "pkt_end", [PTR_TO_PACKET_END] = "pkt_end",
}; };
static void print_liveness(struct bpf_verifier_env *env,
enum bpf_reg_liveness live)
{
if (live & (REG_LIVE_READ | REG_LIVE_WRITTEN))
verbose(env, "_");
if (live & REG_LIVE_READ)
verbose(env, "r");
if (live & REG_LIVE_WRITTEN)
verbose(env, "w");
}
static void print_verifier_state(struct bpf_verifier_env *env, static void print_verifier_state(struct bpf_verifier_env *env,
struct bpf_verifier_state *state) struct bpf_verifier_state *state)
{ {
...@@ -228,7 +239,9 @@ static void print_verifier_state(struct bpf_verifier_env *env, ...@@ -228,7 +239,9 @@ static void print_verifier_state(struct bpf_verifier_env *env,
t = reg->type; t = reg->type;
if (t == NOT_INIT) if (t == NOT_INIT)
continue; continue;
verbose(env, " R%d=%s", i, reg_type_str[t]); verbose(env, " R%d", i);
print_liveness(env, reg->live);
verbose(env, "=%s", reg_type_str[t]);
if ((t == SCALAR_VALUE || t == PTR_TO_STACK) && if ((t == SCALAR_VALUE || t == PTR_TO_STACK) &&
tnum_is_const(reg->var_off)) { tnum_is_const(reg->var_off)) {
/* reg->off should be 0 for SCALAR_VALUE */ /* reg->off should be 0 for SCALAR_VALUE */
...@@ -277,10 +290,13 @@ static void print_verifier_state(struct bpf_verifier_env *env, ...@@ -277,10 +290,13 @@ static void print_verifier_state(struct bpf_verifier_env *env,
} }
} }
for (i = 0; i < state->allocated_stack / BPF_REG_SIZE; i++) { for (i = 0; i < state->allocated_stack / BPF_REG_SIZE; i++) {
if (state->stack[i].slot_type[0] == STACK_SPILL) if (state->stack[i].slot_type[0] == STACK_SPILL) {
verbose(env, " fp%d=%s", verbose(env, " fp%d",
-MAX_BPF_STACK + i * BPF_REG_SIZE, (-i - 1) * BPF_REG_SIZE);
print_liveness(env, state->stack[i].spilled_ptr.live);
verbose(env, "=%s",
reg_type_str[state->stack[i].spilled_ptr.type]); reg_type_str[state->stack[i].spilled_ptr.type]);
}
} }
verbose(env, "\n"); verbose(env, "\n");
} }
...@@ -568,8 +584,8 @@ static void mark_reg_unknown(struct bpf_verifier_env *env, ...@@ -568,8 +584,8 @@ static void mark_reg_unknown(struct bpf_verifier_env *env,
{ {
if (WARN_ON(regno >= MAX_BPF_REG)) { if (WARN_ON(regno >= MAX_BPF_REG)) {
verbose(env, "mark_reg_unknown(regs, %u)\n", regno); verbose(env, "mark_reg_unknown(regs, %u)\n", regno);
/* Something bad happened, let's kill all regs */ /* Something bad happened, let's kill all regs except FP */
for (regno = 0; regno < MAX_BPF_REG; regno++) for (regno = 0; regno < BPF_REG_FP; regno++)
__mark_reg_not_init(regs + regno); __mark_reg_not_init(regs + regno);
return; return;
} }
...@@ -587,8 +603,8 @@ static void mark_reg_not_init(struct bpf_verifier_env *env, ...@@ -587,8 +603,8 @@ static void mark_reg_not_init(struct bpf_verifier_env *env,
{ {
if (WARN_ON(regno >= MAX_BPF_REG)) { if (WARN_ON(regno >= MAX_BPF_REG)) {
verbose(env, "mark_reg_not_init(regs, %u)\n", regno); verbose(env, "mark_reg_not_init(regs, %u)\n", regno);
/* Something bad happened, let's kill all regs */ /* Something bad happened, let's kill all regs except FP */
for (regno = 0; regno < MAX_BPF_REG; regno++) for (regno = 0; regno < BPF_REG_FP; regno++)
__mark_reg_not_init(regs + regno); __mark_reg_not_init(regs + regno);
return; return;
} }
...@@ -779,6 +795,11 @@ static int check_stack_read(struct bpf_verifier_env *env, ...@@ -779,6 +795,11 @@ static int check_stack_read(struct bpf_verifier_env *env,
if (value_regno >= 0) { if (value_regno >= 0) {
/* restore register state from stack */ /* restore register state from stack */
state->regs[value_regno] = state->stack[spi].spilled_ptr; state->regs[value_regno] = state->stack[spi].spilled_ptr;
/* mark reg as written since spilled pointer state likely
* has its liveness marks cleared by is_state_visited()
* which resets stack/reg liveness for state transitions
*/
state->regs[value_regno].live |= REG_LIVE_WRITTEN;
mark_stack_slot_read(state, spi); mark_stack_slot_read(state, spi);
} }
return 0; return 0;
...@@ -1244,9 +1265,9 @@ static int check_xadd(struct bpf_verifier_env *env, int insn_idx, struct bpf_ins ...@@ -1244,9 +1265,9 @@ static int check_xadd(struct bpf_verifier_env *env, int insn_idx, struct bpf_ins
} }
/* Does this register contain a constant zero? */ /* Does this register contain a constant zero? */
static bool register_is_null(struct bpf_reg_state reg) static bool register_is_null(struct bpf_reg_state *reg)
{ {
return reg.type == SCALAR_VALUE && tnum_equals_const(reg.var_off, 0); return reg->type == SCALAR_VALUE && tnum_equals_const(reg->var_off, 0);
} }
/* when register 'regno' is passed into function that will read 'access_size' /* when register 'regno' is passed into function that will read 'access_size'
...@@ -1259,31 +1280,31 @@ static int check_stack_boundary(struct bpf_verifier_env *env, int regno, ...@@ -1259,31 +1280,31 @@ static int check_stack_boundary(struct bpf_verifier_env *env, int regno,
int access_size, bool zero_size_allowed, int access_size, bool zero_size_allowed,
struct bpf_call_arg_meta *meta) struct bpf_call_arg_meta *meta)
{ {
struct bpf_reg_state *reg = cur_regs(env) + regno;
struct bpf_verifier_state *state = env->cur_state; struct bpf_verifier_state *state = env->cur_state;
struct bpf_reg_state *regs = state->regs;
int off, i, slot, spi; int off, i, slot, spi;
if (regs[regno].type != PTR_TO_STACK) { if (reg->type != PTR_TO_STACK) {
/* Allow zero-byte read from NULL, regardless of pointer type */ /* Allow zero-byte read from NULL, regardless of pointer type */
if (zero_size_allowed && access_size == 0 && if (zero_size_allowed && access_size == 0 &&
register_is_null(regs[regno])) register_is_null(reg))
return 0; return 0;
verbose(env, "R%d type=%s expected=%s\n", regno, verbose(env, "R%d type=%s expected=%s\n", regno,
reg_type_str[regs[regno].type], reg_type_str[reg->type],
reg_type_str[PTR_TO_STACK]); reg_type_str[PTR_TO_STACK]);
return -EACCES; return -EACCES;
} }
/* Only allow fixed-offset stack reads */ /* Only allow fixed-offset stack reads */
if (!tnum_is_const(regs[regno].var_off)) { if (!tnum_is_const(reg->var_off)) {
char tn_buf[48]; char tn_buf[48];
tnum_strn(tn_buf, sizeof(tn_buf), regs[regno].var_off); tnum_strn(tn_buf, sizeof(tn_buf), reg->var_off);
verbose(env, "invalid variable stack read R%d var_off=%s\n", verbose(env, "invalid variable stack read R%d var_off=%s\n",
regno, tn_buf); regno, tn_buf);
} }
off = regs[regno].off + regs[regno].var_off.value; off = reg->off + reg->var_off.value;
if (off >= 0 || off < -MAX_BPF_STACK || off + access_size > 0 || if (off >= 0 || off < -MAX_BPF_STACK || off + access_size > 0 ||
access_size < 0 || (access_size == 0 && !zero_size_allowed)) { access_size < 0 || (access_size == 0 && !zero_size_allowed)) {
verbose(env, "invalid stack type R%d off=%d access_size=%d\n", verbose(env, "invalid stack type R%d off=%d access_size=%d\n",
...@@ -1391,7 +1412,7 @@ static int check_func_arg(struct bpf_verifier_env *env, u32 regno, ...@@ -1391,7 +1412,7 @@ static int check_func_arg(struct bpf_verifier_env *env, u32 regno,
* passed in as argument, it's a SCALAR_VALUE type. Final test * passed in as argument, it's a SCALAR_VALUE type. Final test
* happens during stack boundary checking. * happens during stack boundary checking.
*/ */
if (register_is_null(*reg) && if (register_is_null(reg) &&
arg_type == ARG_PTR_TO_MEM_OR_NULL) arg_type == ARG_PTR_TO_MEM_OR_NULL)
/* final test in check_stack_boundary() */; /* final test in check_stack_boundary() */;
else if (!type_is_pkt_pointer(type) && else if (!type_is_pkt_pointer(type) &&
...@@ -2934,8 +2955,9 @@ static int check_cond_jmp_op(struct bpf_verifier_env *env, ...@@ -2934,8 +2955,9 @@ static int check_cond_jmp_op(struct bpf_verifier_env *env,
if (BPF_SRC(insn->code) == BPF_K && if (BPF_SRC(insn->code) == BPF_K &&
(opcode == BPF_JEQ || opcode == BPF_JNE) && (opcode == BPF_JEQ || opcode == BPF_JNE) &&
dst_reg->type == SCALAR_VALUE && dst_reg->type == SCALAR_VALUE &&
tnum_equals_const(dst_reg->var_off, insn->imm)) { tnum_is_const(dst_reg->var_off)) {
if (opcode == BPF_JEQ) { if ((opcode == BPF_JEQ && dst_reg->var_off.value == insn->imm) ||
(opcode == BPF_JNE && dst_reg->var_off.value != insn->imm)) {
/* if (imm == imm) goto pc+off; /* if (imm == imm) goto pc+off;
* only follow the goto, ignore fall-through * only follow the goto, ignore fall-through
*/ */
......
tools/testing/selftests/bpf/test_align.c
View file @ 554b36bf
...@@ -64,11 +64,11 @@ static struct bpf_align_test tests[] = { ...@@ -64,11 +64,11 @@ static struct bpf_align_test tests[] = {
.matches = { .matches = {
{1, "R1=ctx(id=0,off=0,imm=0)"}, {1, "R1=ctx(id=0,off=0,imm=0)"},
{1, "R10=fp0"}, {1, "R10=fp0"},
{1, "R3=inv2"}, {1, "R3_w=inv2"},
{2, "R3=inv4"}, {2, "R3_w=inv4"},
{3, "R3=inv8"}, {3, "R3_w=inv8"},
{4, "R3=inv16"}, {4, "R3_w=inv16"},
{5, "R3=inv32"}, {5, "R3_w=inv32"},
}, },
}, },
{ {
...@@ -92,17 +92,17 @@ static struct bpf_align_test tests[] = { ...@@ -92,17 +92,17 @@ static struct bpf_align_test tests[] = {
.matches = { .matches = {
{1, "R1=ctx(id=0,off=0,imm=0)"}, {1, "R1=ctx(id=0,off=0,imm=0)"},
{1, "R10=fp0"}, {1, "R10=fp0"},
{1, "R3=inv1"}, {1, "R3_w=inv1"},
{2, "R3=inv2"}, {2, "R3_w=inv2"},
{3, "R3=inv4"}, {3, "R3_w=inv4"},
{4, "R3=inv8"}, {4, "R3_w=inv8"},
{5, "R3=inv16"}, {5, "R3_w=inv16"},
{6, "R3=inv1"}, {6, "R3_w=inv1"},
{7, "R4=inv32"}, {7, "R4_w=inv32"},
{8, "R4=inv16"}, {8, "R4_w=inv16"},
{9, "R4=inv8"}, {9, "R4_w=inv8"},
{10, "R4=inv4"}, {10, "R4_w=inv4"},
{11, "R4=inv2"}, {11, "R4_w=inv2"},
}, },
}, },
{ {
...@@ -121,12 +121,12 @@ static struct bpf_align_test tests[] = { ...@@ -121,12 +121,12 @@ static struct bpf_align_test tests[] = {
.matches = { .matches = {
{1, "R1=ctx(id=0,off=0,imm=0)"}, {1, "R1=ctx(id=0,off=0,imm=0)"},
{1, "R10=fp0"}, {1, "R10=fp0"},
{1, "R3=inv4"}, {1, "R3_w=inv4"},
{2, "R3=inv8"}, {2, "R3_w=inv8"},
{3, "R3=inv10"}, {3, "R3_w=inv10"},
{4, "R4=inv8"}, {4, "R4_w=inv8"},
{5, "R4=inv12"}, {5, "R4_w=inv12"},
{6, "R4=inv14"}, {6, "R4_w=inv14"},
}, },
}, },
{ {
...@@ -143,10 +143,10 @@ static struct bpf_align_test tests[] = { ...@@ -143,10 +143,10 @@ static struct bpf_align_test tests[] = {
.matches = { .matches = {
{1, "R1=ctx(id=0,off=0,imm=0)"}, {1, "R1=ctx(id=0,off=0,imm=0)"},
{1, "R10=fp0"}, {1, "R10=fp0"},
{1, "R3=inv7"}, {1, "R3_w=inv7"},
{2, "R3=inv7"}, {2, "R3_w=inv7"},
{3, "R3=inv14"}, {3, "R3_w=inv14"},
{4, "R3=inv56"}, {4, "R3_w=inv56"},
}, },
}, },
...@@ -185,18 +185,18 @@ static struct bpf_align_test tests[] = { ...@@ -185,18 +185,18 @@ static struct bpf_align_test tests[] = {
.prog_type = BPF_PROG_TYPE_SCHED_CLS, .prog_type = BPF_PROG_TYPE_SCHED_CLS,
.matches = { .matches = {
{7, "R0=pkt(id=0,off=8,r=8,imm=0)"}, {7, "R0=pkt(id=0,off=8,r=8,imm=0)"},
{7, "R3=inv(id=0,umax_value=255,var_off=(0x0; 0xff))"}, {7, "R3_w=inv(id=0,umax_value=255,var_off=(0x0; 0xff))"},
{8, "R3=inv(id=0,umax_value=510,var_off=(0x0; 0x1fe))"}, {8, "R3_w=inv(id=0,umax_value=510,var_off=(0x0; 0x1fe))"},
{9, "R3=inv(id=0,umax_value=1020,var_off=(0x0; 0x3fc))"}, {9, "R3_w=inv(id=0,umax_value=1020,var_off=(0x0; 0x3fc))"},
{10, "R3=inv(id=0,umax_value=2040,var_off=(0x0; 0x7f8))"}, {10, "R3_w=inv(id=0,umax_value=2040,var_off=(0x0; 0x7f8))"},
{11, "R3=inv(id=0,umax_value=4080,var_off=(0x0; 0xff0))"}, {11, "R3_w=inv(id=0,umax_value=4080,var_off=(0x0; 0xff0))"},
{18, "R3=pkt_end(id=0,off=0,imm=0)"}, {18, "R3=pkt_end(id=0,off=0,imm=0)"},
{18, "R4=inv(id=0,umax_value=255,var_off=(0x0; 0xff))"}, {18, "R4_w=inv(id=0,umax_value=255,var_off=(0x0; 0xff))"},
{19, "R4=inv(id=0,umax_value=8160,var_off=(0x0; 0x1fe0))"}, {19, "R4_w=inv(id=0,umax_value=8160,var_off=(0x0; 0x1fe0))"},
{20, "R4=inv(id=0,umax_value=4080,var_off=(0x0; 0xff0))"}, {20, "R4_w=inv(id=0,umax_value=4080,var_off=(0x0; 0xff0))"},
{21, "R4=inv(id=0,umax_value=2040,var_off=(0x0; 0x7f8))"}, {21, "R4_w=inv(id=0,umax_value=2040,var_off=(0x0; 0x7f8))"},
{22, "R4=inv(id=0,umax_value=1020,var_off=(0x0; 0x3fc))"}, {22, "R4_w=inv(id=0,umax_value=1020,var_off=(0x0; 0x3fc))"},
{23, "R4=inv(id=0,umax_value=510,var_off=(0x0; 0x1fe))"}, {23, "R4_w=inv(id=0,umax_value=510,var_off=(0x0; 0x1fe))"},
}, },
}, },
{ {
...@@ -217,16 +217,16 @@ static struct bpf_align_test tests[] = { ...@@ -217,16 +217,16 @@ static struct bpf_align_test tests[] = {
}, },
.prog_type = BPF_PROG_TYPE_SCHED_CLS, .prog_type = BPF_PROG_TYPE_SCHED_CLS,
.matches = { .matches = {
{7, "R3=inv(id=0,umax_value=255,var_off=(0x0; 0xff))"}, {7, "R3_w=inv(id=0,umax_value=255,var_off=(0x0; 0xff))"},
{8, "R4=inv(id=0,umax_value=255,var_off=(0x0; 0xff))"}, {8, "R4_w=inv(id=0,umax_value=255,var_off=(0x0; 0xff))"},
{9, "R4=inv(id=0,umax_value=255,var_off=(0x0; 0xff))"}, {9, "R4_w=inv(id=0,umax_value=255,var_off=(0x0; 0xff))"},
{10, "R4=inv(id=0,umax_value=255,var_off=(0x0; 0xff))"}, {10, "R4_w=inv(id=0,umax_value=255,var_off=(0x0; 0xff))"},
{11, "R4=inv(id=0,umax_value=510,var_off=(0x0; 0x1fe))"}, {11, "R4_w=inv(id=0,umax_value=510,var_off=(0x0; 0x1fe))"},
{12, "R4=inv(id=0,umax_value=255,var_off=(0x0; 0xff))"}, {12, "R4_w=inv(id=0,umax_value=255,var_off=(0x0; 0xff))"},
{13, "R4=inv(id=0,umax_value=1020,var_off=(0x0; 0x3fc))"}, {13, "R4_w=inv(id=0,umax_value=1020,var_off=(0x0; 0x3fc))"},
{14, "R4=inv(id=0,umax_value=255,var_off=(0x0; 0xff))"}, {14, "R4_w=inv(id=0,umax_value=255,var_off=(0x0; 0xff))"},
{15, "R4=inv(id=0,umax_value=2040,var_off=(0x0; 0x7f8))"}, {15, "R4_w=inv(id=0,umax_value=2040,var_off=(0x0; 0x7f8))"},
{16, "R4=inv(id=0,umax_value=4080,var_off=(0x0; 0xff0))"}, {16, "R4_w=inv(id=0,umax_value=4080,var_off=(0x0; 0xff0))"},
}, },
}, },
{ {
...@@ -257,14 +257,14 @@ static struct bpf_align_test tests[] = { ...@@ -257,14 +257,14 @@ static struct bpf_align_test tests[] = {
}, },
.prog_type = BPF_PROG_TYPE_SCHED_CLS, .prog_type = BPF_PROG_TYPE_SCHED_CLS,
.matches = { .matches = {
{4, "R5=pkt(id=0,off=0,r=0,imm=0)"}, {4, "R5_w=pkt(id=0,off=0,r=0,imm=0)"},
{5, "R5=pkt(id=0,off=14,r=0,imm=0)"}, {5, "R5_w=pkt(id=0,off=14,r=0,imm=0)"},
{6, "R4=pkt(id=0,off=14,r=0,imm=0)"}, {6, "R4_w=pkt(id=0,off=14,r=0,imm=0)"},
{10, "R2=pkt(id=0,off=0,r=18,imm=0)"}, {10, "R2=pkt(id=0,off=0,r=18,imm=0)"},
{10, "R5=pkt(id=0,off=14,r=18,imm=0)"}, {10, "R5=pkt(id=0,off=14,r=18,imm=0)"},
{10, "R4=inv(id=0,umax_value=255,var_off=(0x0; 0xff))"}, {10, "R4_w=inv(id=0,umax_value=255,var_off=(0x0; 0xff))"},
{14, "R4=inv(id=0,umax_value=65535,var_off=(0x0; 0xffff))"}, {14, "R4_w=inv(id=0,umax_value=65535,var_off=(0x0; 0xffff))"},
{15, "R4=inv(id=0,umax_value=65535,var_off=(0x0; 0xffff))"}, {15, "R4_w=inv(id=0,umax_value=65535,var_off=(0x0; 0xffff))"},
}, },
}, },
{ {
...@@ -320,11 +320,11 @@ static struct bpf_align_test tests[] = { ...@@ -320,11 +320,11 @@ static struct bpf_align_test tests[] = {
* alignment of 4. * alignment of 4.
*/ */
{8, "R2=pkt(id=0,off=0,r=8,imm=0)"}, {8, "R2=pkt(id=0,off=0,r=8,imm=0)"},
{8, "R6=inv(id=0,umax_value=1020,var_off=(0x0; 0x3fc))"}, {8, "R6_w=inv(id=0,umax_value=1020,var_off=(0x0; 0x3fc))"},
/* Offset is added to packet pointer R5, resulting in /* Offset is added to packet pointer R5, resulting in
* known fixed offset, and variable offset from R6. * known fixed offset, and variable offset from R6.
*/ */
{11, "R5=pkt(id=1,off=14,r=0,umax_value=1020,var_off=(0x0; 0x3fc))"}, {11, "R5_w=pkt(id=1,off=14,r=0,umax_value=1020,var_off=(0x0; 0x3fc))"},
/* At the time the word size load is performed from R5, /* At the time the word size load is performed from R5,
* it's total offset is NET_IP_ALIGN + reg->off (0) + * it's total offset is NET_IP_ALIGN + reg->off (0) +
* reg->aux_off (14) which is 16. Then the variable * reg->aux_off (14) which is 16. Then the variable
...@@ -336,11 +336,11 @@ static struct bpf_align_test tests[] = { ...@@ -336,11 +336,11 @@ static struct bpf_align_test tests[] = {
/* Variable offset is added to R5 packet pointer, /* Variable offset is added to R5 packet pointer,
* resulting in auxiliary alignment of 4. * resulting in auxiliary alignment of 4.
*/ */
{18, "R5=pkt(id=2,off=0,r=0,umax_value=1020,var_off=(0x0; 0x3fc))"}, {18, "R5_w=pkt(id=2,off=0,r=0,umax_value=1020,var_off=(0x0; 0x3fc))"},
/* Constant offset is added to R5, resulting in /* Constant offset is added to R5, resulting in
* reg->off of 14. * reg->off of 14.
*/ */
{19, "R5=pkt(id=2,off=14,r=0,umax_value=1020,var_off=(0x0; 0x3fc))"}, {19, "R5_w=pkt(id=2,off=14,r=0,umax_value=1020,var_off=(0x0; 0x3fc))"},
/* At the time the word size load is performed from R5, /* At the time the word size load is performed from R5,
* its total fixed offset is NET_IP_ALIGN + reg->off * its total fixed offset is NET_IP_ALIGN + reg->off
* (14) which is 16. Then the variable offset is 4-byte * (14) which is 16. Then the variable offset is 4-byte
...@@ -352,18 +352,18 @@ static struct bpf_align_test tests[] = { ...@@ -352,18 +352,18 @@ static struct bpf_align_test tests[] = {
/* Constant offset is added to R5 packet pointer, /* Constant offset is added to R5 packet pointer,
* resulting in reg->off value of 14. * resulting in reg->off value of 14.
*/ */
{26, "R5=pkt(id=0,off=14,r=8"}, {26, "R5_w=pkt(id=0,off=14,r=8"},
/* Variable offset is added to R5, resulting in a /* Variable offset is added to R5, resulting in a
* variable offset of (4n). * variable offset of (4n).
*/ */
{27, "R5=pkt(id=3,off=14,r=0,umax_value=1020,var_off=(0x0; 0x3fc))"}, {27, "R5_w=pkt(id=3,off=14,r=0,umax_value=1020,var_off=(0x0; 0x3fc))"},
/* Constant is added to R5 again, setting reg->off to 18. */ /* Constant is added to R5 again, setting reg->off to 18. */
{28, "R5=pkt(id=3,off=18,r=0,umax_value=1020,var_off=(0x0; 0x3fc))"}, {28, "R5_w=pkt(id=3,off=18,r=0,umax_value=1020,var_off=(0x0; 0x3fc))"},
/* And once more we add a variable; resulting var_off /* And once more we add a variable; resulting var_off
* is still (4n), fixed offset is not changed. * is still (4n), fixed offset is not changed.
* Also, we create a new reg->id. * Also, we create a new reg->id.
*/ */
{29, "R5=pkt(id=4,off=18,r=0,umax_value=2040,var_off=(0x0; 0x7fc))"}, {29, "R5_w=pkt(id=4,off=18,r=0,umax_value=2040,var_off=(0x0; 0x7fc))"},
/* At the time the word size load is performed from R5, /* At the time the word size load is performed from R5,
* its total fixed offset is NET_IP_ALIGN + reg->off (18) * its total fixed offset is NET_IP_ALIGN + reg->off (18)
* which is 20. Then the variable offset is (4n), so * which is 20. Then the variable offset is (4n), so
...@@ -410,11 +410,11 @@ static struct bpf_align_test tests[] = { ...@@ -410,11 +410,11 @@ static struct bpf_align_test tests[] = {
* alignment of 4. * alignment of 4.
*/ */
{8, "R2=pkt(id=0,off=0,r=8,imm=0)"}, {8, "R2=pkt(id=0,off=0,r=8,imm=0)"},
{8, "R6=inv(id=0,umax_value=1020,var_off=(0x0; 0x3fc))"}, {8, "R6_w=inv(id=0,umax_value=1020,var_off=(0x0; 0x3fc))"},
/* Adding 14 makes R6 be (4n+2) */ /* Adding 14 makes R6 be (4n+2) */
{9, "R6=inv(id=0,umin_value=14,umax_value=1034,var_off=(0x2; 0x7fc))"}, {9, "R6_w=inv(id=0,umin_value=14,umax_value=1034,var_off=(0x2; 0x7fc))"},
/* Packet pointer has (4n+2) offset */ /* Packet pointer has (4n+2) offset */
{11, "R5=pkt(id=1,off=0,r=0,umin_value=14,umax_value=1034,var_off=(0x2; 0x7fc))"}, {11, "R5_w=pkt(id=1,off=0,r=0,umin_value=14,umax_value=1034,var_off=(0x2; 0x7fc))"},
{13, "R4=pkt(id=1,off=4,r=0,umin_value=14,umax_value=1034,var_off=(0x2; 0x7fc))"}, {13, "R4=pkt(id=1,off=4,r=0,umin_value=14,umax_value=1034,var_off=(0x2; 0x7fc))"},
/* At the time the word size load is performed from R5, /* At the time the word size load is performed from R5,
* its total fixed offset is NET_IP_ALIGN + reg->off (0) * its total fixed offset is NET_IP_ALIGN + reg->off (0)
...@@ -426,11 +426,11 @@ static struct bpf_align_test tests[] = { ...@@ -426,11 +426,11 @@ static struct bpf_align_test tests[] = {
/* Newly read value in R6 was shifted left by 2, so has /* Newly read value in R6 was shifted left by 2, so has
* known alignment of 4. * known alignment of 4.
*/ */
{18, "R6=inv(id=0,umax_value=1020,var_off=(0x0; 0x3fc))"}, {18, "R6_w=inv(id=0,umax_value=1020,var_off=(0x0; 0x3fc))"},
/* Added (4n) to packet pointer's (4n+2) var_off, giving /* Added (4n) to packet pointer's (4n+2) var_off, giving
* another (4n+2). * another (4n+2).
*/ */
{19, "R5=pkt(id=2,off=0,r=0,umin_value=14,umax_value=2054,var_off=(0x2; 0xffc))"}, {19, "R5_w=pkt(id=2,off=0,r=0,umin_value=14,umax_value=2054,var_off=(0x2; 0xffc))"},
{21, "R4=pkt(id=2,off=4,r=0,umin_value=14,umax_value=2054,var_off=(0x2; 0xffc))"}, {21, "R4=pkt(id=2,off=4,r=0,umin_value=14,umax_value=2054,var_off=(0x2; 0xffc))"},
/* At the time the word size load is performed from R5, /* At the time the word size load is performed from R5,
* its total fixed offset is NET_IP_ALIGN + reg->off (0) * its total fixed offset is NET_IP_ALIGN + reg->off (0)
...@@ -473,11 +473,11 @@ static struct bpf_align_test tests[] = { ...@@ -473,11 +473,11 @@ static struct bpf_align_test tests[] = {
.prog_type = BPF_PROG_TYPE_SCHED_CLS, .prog_type = BPF_PROG_TYPE_SCHED_CLS,
.result = REJECT, .result = REJECT,
.matches = { .matches = {
{4, "R5=pkt(id=0,off=0,r=0,imm=0)"}, {4, "R5_w=pkt(id=0,off=0,r=0,imm=0)"},
/* ptr & 0x40 == either 0 or 0x40 */ /* ptr & 0x40 == either 0 or 0x40 */
{5, "R5=inv(id=0,umax_value=64,var_off=(0x0; 0x40))"}, {5, "R5_w=inv(id=0,umax_value=64,var_off=(0x0; 0x40))"},
/* ptr << 2 == unknown, (4n) */ /* ptr << 2 == unknown, (4n) */
{7, "R5=inv(id=0,smax_value=9223372036854775804,umax_value=18446744073709551612,var_off=(0x0; 0xfffffffffffffffc))"}, {7, "R5_w=inv(id=0,smax_value=9223372036854775804,umax_value=18446744073709551612,var_off=(0x0; 0xfffffffffffffffc))"},
/* (4n) + 14 == (4n+2). We blow our bounds, because /* (4n) + 14 == (4n+2). We blow our bounds, because
* the add could overflow. * the add could overflow.
*/ */
...@@ -485,7 +485,7 @@ static struct bpf_align_test tests[] = { ...@@ -485,7 +485,7 @@ static struct bpf_align_test tests[] = {
/* Checked s>=0 */ /* Checked s>=0 */
{10, "R5=inv(id=0,umin_value=2,umax_value=9223372036854775806,var_off=(0x2; 0x7ffffffffffffffc))"}, {10, "R5=inv(id=0,umin_value=2,umax_value=9223372036854775806,var_off=(0x2; 0x7ffffffffffffffc))"},
/* packet pointer + nonnegative (4n+2) */ /* packet pointer + nonnegative (4n+2) */
{12, "R6=pkt(id=1,off=0,r=0,umin_value=2,umax_value=9223372036854775806,var_off=(0x2; 0x7ffffffffffffffc))"}, {12, "R6_w=pkt(id=1,off=0,r=0,umin_value=2,umax_value=9223372036854775806,var_off=(0x2; 0x7ffffffffffffffc))"},
{14, "R4=pkt(id=1,off=4,r=0,umin_value=2,umax_value=9223372036854775806,var_off=(0x2; 0x7ffffffffffffffc))"}, {14, "R4=pkt(id=1,off=4,r=0,umin_value=2,umax_value=9223372036854775806,var_off=(0x2; 0x7ffffffffffffffc))"},
/* NET_IP_ALIGN + (4n+2) == (4n), alignment is fine. /* NET_IP_ALIGN + (4n+2) == (4n), alignment is fine.
* We checked the bounds, but it might have been able * We checked the bounds, but it might have been able
...@@ -530,11 +530,11 @@ static struct bpf_align_test tests[] = { ...@@ -530,11 +530,11 @@ static struct bpf_align_test tests[] = {
* alignment of 4. * alignment of 4.
*/ */
{7, "R2=pkt(id=0,off=0,r=8,imm=0)"}, {7, "R2=pkt(id=0,off=0,r=8,imm=0)"},
{9, "R6=inv(id=0,umax_value=1020,var_off=(0x0; 0x3fc))"}, {9, "R6_w=inv(id=0,umax_value=1020,var_off=(0x0; 0x3fc))"},
/* Adding 14 makes R6 be (4n+2) */ /* Adding 14 makes R6 be (4n+2) */
{10, "R6=inv(id=0,umin_value=14,umax_value=1034,var_off=(0x2; 0x7fc))"}, {10, "R6_w=inv(id=0,umin_value=14,umax_value=1034,var_off=(0x2; 0x7fc))"},
/* New unknown value in R7 is (4n) */ /* New unknown value in R7 is (4n) */
{11, "R7=inv(id=0,umax_value=1020,var_off=(0x0; 0x3fc))"}, {11, "R7_w=inv(id=0,umax_value=1020,var_off=(0x0; 0x3fc))"},
/* Subtracting it from R6 blows our unsigned bounds */ /* Subtracting it from R6 blows our unsigned bounds */
{12, "R6=inv(id=0,smin_value=-1006,smax_value=1034,var_off=(0x2; 0xfffffffffffffffc))"}, {12, "R6=inv(id=0,smin_value=-1006,smax_value=1034,var_off=(0x2; 0xfffffffffffffffc))"},
/* Checked s>= 0 */ /* Checked s>= 0 */
...@@ -583,15 +583,15 @@ static struct bpf_align_test tests[] = { ...@@ -583,15 +583,15 @@ static struct bpf_align_test tests[] = {
* alignment of 4. * alignment of 4.
*/ */
{7, "R2=pkt(id=0,off=0,r=8,imm=0)"}, {7, "R2=pkt(id=0,off=0,r=8,imm=0)"},
{10, "R6=inv(id=0,umax_value=60,var_off=(0x0; 0x3c))"}, {10, "R6_w=inv(id=0,umax_value=60,var_off=(0x0; 0x3c))"},
/* Adding 14 makes R6 be (4n+2) */ /* Adding 14 makes R6 be (4n+2) */
{11, "R6=inv(id=0,umin_value=14,umax_value=74,var_off=(0x2; 0x7c))"}, {11, "R6_w=inv(id=0,umin_value=14,umax_value=74,var_off=(0x2; 0x7c))"},
/* Subtracting from packet pointer overflows ubounds */ /* Subtracting from packet pointer overflows ubounds */
{13, "R5=pkt(id=1,off=0,r=8,umin_value=18446744073709551542,umax_value=18446744073709551602,var_off=(0xffffffffffffff82; 0x7c))"}, {13, "R5_w=pkt(id=1,off=0,r=8,umin_value=18446744073709551542,umax_value=18446744073709551602,var_off=(0xffffffffffffff82; 0x7c))"},
/* New unknown value in R7 is (4n), >= 76 */ /* New unknown value in R7 is (4n), >= 76 */
{15, "R7=inv(id=0,umin_value=76,umax_value=1096,var_off=(0x0; 0x7fc))"}, {15, "R7_w=inv(id=0,umin_value=76,umax_value=1096,var_off=(0x0; 0x7fc))"},
/* Adding it to packet pointer gives nice bounds again */ /* Adding it to packet pointer gives nice bounds again */
{16, "R5=pkt(id=2,off=0,r=0,umin_value=2,umax_value=1082,var_off=(0x2; 0x7fc))"}, {16, "R5_w=pkt(id=2,off=0,r=0,umin_value=2,umax_value=1082,var_off=(0x2; 0x7fc))"},
/* At the time the word size load is performed from R5, /* At the time the word size load is performed from R5,
* its total fixed offset is NET_IP_ALIGN + reg->off (0) * its total fixed offset is NET_IP_ALIGN + reg->off (0)
* which is 2. Then the variable offset is (4n+2), so * which is 2. Then the variable offset is (4n+2), so
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment
GitLab Nexedi Edition | About GitLab | About Nexedi | 沪ICP备2021021310号-2 | 沪ICP备2021021310号-7