mirror of
https://github.com/torvalds/linux.git
synced 2026-08-02 05:12:01 +02:00
Merge branch 'bpf-replace-min-max-fields-with-struct-cnum-32-64'
Eduard Zingerman says:
====================
bpf: replace min/max fields with struct cnum{32,64}
This RFC replaces s64, u64, s32, u32 scalar range domains tracked by
verifier by a pair of circular numbers (cnums): one for 64-bit domain
and another for 32-bit domain. Each cnum represents a range as a
single arc on the circular number line, from which signed and unsigned
bounds are derived on demand. See also wrapped intervals
representation as in [1].
The use of such representation simplifies arithmetic and conditions
handling in verifier.c and allows to express 32 <-> 64 bit deductions
in a more mathematically rigorous way.
[1] https://jorgenavas.github.io/papers/ACM-TOPLAS-wrapped.pdf
Changelog
=========
v2 -> v1:
- Fixes in source code comments highlighted by bot+bpf-ci.
RFCv1 -> v2:
- Dropped RFC tag.
- Dropped cnum{32,64}_mul(), too much complexity and no veristat
or selftests gains.
- cnum32_from_cnum64() normalizes to CNUM32_EMPTY when input
cnum64.size >= U32_MAX, previously only checked for > U32_MAX
(bot+bpf-ci).
- cnum32_from_cnum64() and cnum64_cnum32_intersect() now check for
empty inputs (sashiko).
- In regs_refine_cond_op() case BPF_JSLT use cnum{32,64}_from_srange
constructors instead of unsigned variants (sashiko).
- cnum{32,64}_intersect_with{,_urange,_srange}() helpers added
(Alexei)
[RFCv1] https://lore.kernel.org/bpf/0c47b0b7ea476647746806c46fded4353be885f7.camel@gmail.com/T/
[v2] https://lore.kernel.org/bpf/c4fb60bafd526ae2d92b86e2250255aef0ba5ee1.camel@gmail.com/T/
Patch set layout
================
Patch #1 introduces the cnum (circular number) data type and basic
operations: intersection, addition, multiplication, negation, 32-to-64
and 64-to-32 projections.
CBMC based proofs for these operations are available at [2].
(The proofs lag behind the current patch set and need an update if
this RFC moves further. Although, I don't expect any significant
changes).
[2] https://github.com/eddyz87/cnum-verif
Patch #2 mechanically converts all direct accesses to bpf_reg_state's
min/max fields to use accessor functions, preparing for the field
replacement.
Patch #3 replaces the eight independent min/max fields in
bpf_reg_state with two cnum fields. The signed and unsigned bounds are
derived on demand from the cnum via the accessor functions.
This eliminates the separate signed<->unsigned cross-deduction logic,
simplifies reg_bounds_sync(), regs_refine_cond_op() and some
arithmetic operations.
Patch #4 adds selftest cases for improved 32->64 range refinements
enabled by cnum64_cnum32_intersect().
Precision trade-offs
====================
A cnum represents a contiguous arc on the circular number line.
Current master tracks four independent ranges (s64, u64, s32, u32)
whose intersection could implicitly represent value sets that are
two disjoint arcs on the circle - something a single cnum cannot.
Cnums lose precision when a cross-domain conditional comparison
(e.g., unsigned comparison on a register with a signed-derived range)
produces an intersection that would be two disjoint arcs.
The cnum must over-approximate by returning one of the input arcs.
E.g. a pair of ranges u64:[1,U64_MAX] s:[-1,1] represents a set of two
values: {-1,1}, this can only be approximated as a set of three values
by cnum: {-1,0,1}.
Cnums gain precision in arithmetic: when addition, subtraction or
multiplication causes register value to cross both signed and unsigned
min/max boundaries. Current master resets the register as unbound in
such cases, while cnums preserve the exact wrapping arc.
In practice precision loss turned out to matter only for a set of
specifically crafted selftests from reg_bounds.c (see patch #3 for
more details). On the other hand, precision gains are observable for a
set real-life programs.
Verification performance measurements
=====================================
Tested on 6683 programs across four corpora: Cilium (134 programs),
selftests (4635), sched_ext (376), and Meta internal BPF corpus
(1540). Program verification verdicts are identical across all four
program sets - no program changes between success and failure.
Instruction count comparison (cnum vs signed/unsigned pair):
- 83 programs improve, 44 regress, 6596 unchanged
- Total saved: ~290K insns, total added: 10K insns
- Largest improvements:
-26% insns in a internal network firewall program;
-47% insns in rusty/wd40 sched_ext schedulers.
- Largest regression: +24% insns in one Cilium program (5062 insns
added).
Raw performance data is at the bottom of the email.
Raw verification performance metrics
====================================
Filtered out by -f insns_pct>5 -f !insns<10000
========= selftests: master vs cnums-everywhere-v2 =========
File Program Insns (A) Insns (B) Insns (DIFF)
---- ------- --------- --------- ------------
Total progs: 4665
total_insns diff min: -15.71%
total_insns diff max: 45.45%
-20 .. -10 %: 3
-5 .. 0 %: 6
0 .. 5 %: 4654
45 .. 50 %: 2
========= scx: master vs cnums-everywhere-v2 =========
File Program Insns (A) Insns (B) Insns (DIFF)
--------------- -------------- --------- --------- ----------------
scx_rusty.bpf.o rusty_enqueue 39842 22053 -17789 (-44.65%)
scx_rusty.bpf.o rusty_stopping 37738 19949 -17789 (-47.14%)
scx_wd40.bpf.o wd40_stopping 37729 19880 -17849 (-47.31%)
Total progs: 376
total_insns diff min: -47.31%
total_insns diff max: 19.61%
-50 .. -40 %: 3
-5 .. 0 %: 5
0 .. 5 %: 366
5 .. 15 %: 1
15 .. 20 %: 1
========= meta: master vs cnums-everywhere-v2 =========
File Program Insns (A) Insns (B) Insns (DIFF)
--------------------------------- ---------- --------- --------- ----------------
<meta-internal-firewall-program> ...egress 222327 164648 -57679 (-25.94%)
<meta-internal-firewall-program> ..._tc_eg 222839 164772 -58067 (-26.06%)
<meta-internal-firewall-program> ...egress 222327 164648 -57679 (-25.94%)
<meta-internal-firewall-program> ..._tc_eg 222839 164772 -58067 (-26.06%)
Total progs: 1540
total_insns diff min: -26.06%
total_insns diff max: 6.69%
-30 .. -20 %: 4
-15 .. -5 %: 6
-5 .. 0 %: 36
0 .. 5 %: 1493
5 .. 10 %: 1
========= cilium: master vs cnums-everywhere-v2 =========
File Program Insns (A) Insns (B) Insns (DIFF)
---------- ------------------------------- --------- --------- ---------------
bpf_host.o tail_handle_ipv4_cont_from_host 20962 26024 +5062 (+24.15%)
bpf_host.o tail_handle_ipv6_cont_from_host 17036 18672 +1636 (+9.60%)
Total progs: 134
total_insns diff min: -3.32%
total_insns diff max: 24.15%
-5 .. 0 %: 12
0 .. 5 %: 120
5 .. 15 %: 1
20 .. 25 %: 1
---
====================
Link: https://patch.msgid.link/20260424-cnums-everywhere-rfc-v1-v3-0-ca434b39a486@gmail.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
This commit is contained in:
Alexei Starovoitov
commit
6c60b2dd5a
|
|
@ -561,10 +561,10 @@ nfp_bpf_check_alu(struct nfp_prog *nfp_prog, struct nfp_insn_meta *meta,
|
|||
const struct bpf_reg_state *dreg =
|
||||
cur_regs(env) + meta->insn.dst_reg;
|
||||
|
||||
meta->umin_src = min(meta->umin_src, sreg->umin_value);
|
||||
meta->umax_src = max(meta->umax_src, sreg->umax_value);
|
||||
meta->umin_dst = min(meta->umin_dst, dreg->umin_value);
|
||||
meta->umax_dst = max(meta->umax_dst, dreg->umax_value);
|
||||
meta->umin_src = min(meta->umin_src, reg_umin(sreg));
|
||||
meta->umax_src = max(meta->umax_src, reg_umax(sreg));
|
||||
meta->umin_dst = min(meta->umin_dst, reg_umin(dreg));
|
||||
meta->umax_dst = max(meta->umax_dst, reg_umax(dreg));
|
||||
|
||||
/* NFP supports u16 and u32 multiplication.
|
||||
*
|
||||
|
|
|
|||
|
|
@ -8,6 +8,7 @@
|
|||
#include <linux/btf.h> /* for struct btf and btf_id() */
|
||||
#include <linux/filter.h> /* for MAX_BPF_STACK */
|
||||
#include <linux/tnum.h>
|
||||
#include <linux/cnum.h>
|
||||
|
||||
/* Maximum variable offset umax_value permitted when resolving memory accesses.
|
||||
* In practice this is far bigger than any realistic pointer offset; this limit
|
||||
|
|
@ -120,14 +121,8 @@ struct bpf_reg_state {
|
|||
* These refer to the same value as var_off, not necessarily the actual
|
||||
* contents of the register.
|
||||
*/
|
||||
s64 smin_value; /* minimum possible (s64)value */
|
||||
s64 smax_value; /* maximum possible (s64)value */
|
||||
u64 umin_value; /* minimum possible (u64)value */
|
||||
u64 umax_value; /* maximum possible (u64)value */
|
||||
s32 s32_min_value; /* minimum possible (s32)value */
|
||||
s32 s32_max_value; /* maximum possible (s32)value */
|
||||
u32 u32_min_value; /* minimum possible (u32)value */
|
||||
u32 u32_max_value; /* maximum possible (u32)value */
|
||||
struct cnum64 r64; /* 64-bit range as circular number */
|
||||
struct cnum32 r32; /* 32-bit range as circular number */
|
||||
/* For PTR_TO_PACKET, used to find other pointers with the same variable
|
||||
* offset, so they can share range knowledge.
|
||||
* For PTR_TO_MAP_VALUE_OR_NULL this is used to share which map value we
|
||||
|
|
@ -209,6 +204,66 @@ struct bpf_reg_state {
|
|||
bool precise;
|
||||
};
|
||||
|
||||
static inline s64 reg_smin(const struct bpf_reg_state *reg)
|
||||
{
|
||||
return cnum64_smin(reg->r64);
|
||||
}
|
||||
|
||||
static inline s64 reg_smax(const struct bpf_reg_state *reg)
|
||||
{
|
||||
return cnum64_smax(reg->r64);
|
||||
}
|
||||
|
||||
static inline u64 reg_umin(const struct bpf_reg_state *reg)
|
||||
{
|
||||
return cnum64_umin(reg->r64);
|
||||
}
|
||||
|
||||
static inline u64 reg_umax(const struct bpf_reg_state *reg)
|
||||
{
|
||||
return cnum64_umax(reg->r64);
|
||||
}
|
||||
|
||||
static inline s32 reg_s32_min(const struct bpf_reg_state *reg)
|
||||
{
|
||||
return cnum32_smin(reg->r32);
|
||||
}
|
||||
|
||||
static inline s32 reg_s32_max(const struct bpf_reg_state *reg)
|
||||
{
|
||||
return cnum32_smax(reg->r32);
|
||||
}
|
||||
|
||||
static inline u32 reg_u32_min(const struct bpf_reg_state *reg)
|
||||
{
|
||||
return cnum32_umin(reg->r32);
|
||||
}
|
||||
|
||||
static inline u32 reg_u32_max(const struct bpf_reg_state *reg)
|
||||
{
|
||||
return cnum32_umax(reg->r32);
|
||||
}
|
||||
|
||||
static inline void reg_set_srange32(struct bpf_reg_state *reg, s32 smin, s32 smax)
|
||||
{
|
||||
reg->r32 = cnum32_from_srange(smin, smax);
|
||||
}
|
||||
|
||||
static inline void reg_set_urange32(struct bpf_reg_state *reg, u32 umin, u32 umax)
|
||||
{
|
||||
reg->r32 = cnum32_from_urange(umin, umax);
|
||||
}
|
||||
|
||||
static inline void reg_set_srange64(struct bpf_reg_state *reg, s64 smin, s64 smax)
|
||||
{
|
||||
reg->r64 = cnum64_from_srange(smin, smax);
|
||||
}
|
||||
|
||||
static inline void reg_set_urange64(struct bpf_reg_state *reg, u64 umin, u64 umax)
|
||||
{
|
||||
reg->r64 = cnum64_from_urange(umin, umax);
|
||||
}
|
||||
|
||||
enum bpf_stack_slot_type {
|
||||
STACK_INVALID, /* nothing was stored in this stack slot */
|
||||
STACK_SPILL, /* register spilled into stack */
|
||||
|
|
|
|||
80
include/linux/cnum.h
Normal file
80
include/linux/cnum.h
Normal file
|
|
@ -0,0 +1,80 @@
|
|||
/* SPDX-License-Identifier: GPL-2.0-only */
|
||||
/* Copyright (c) 2026 Meta Platforms, Inc. and affiliates. */
|
||||
|
||||
#ifndef _LINUX_CNUM_H
|
||||
#define _LINUX_CNUM_H
|
||||
|
||||
#include <linux/types.h>
|
||||
|
||||
/*
|
||||
* cnum32: a circular number.
|
||||
* A unified representation for signed and unsigned ranges.
|
||||
*
|
||||
* Assume that a 32-bit range is a circle, with 0 being in the 12 o'clock
|
||||
* position, numbers placed sequentially in clockwise order and U32_MAX
|
||||
* in the 11 o'clock position. Signed values map onto the same circle:
|
||||
* S32_MAX sits at 5 o'clock, S32_MIN sits at 6 o'clock (opposite 0),
|
||||
* negative values occupy the left half and positive values the right half.
|
||||
*
|
||||
* @cnum32 represents an arc on this circle drawn clockwise.
|
||||
* @base corresponds to the first value of the range.
|
||||
* @size corresponds to the number of integers in the range excluding @base.
|
||||
* (The @base is excluded to avoid integer overflow when representing the full
|
||||
* 0..U32_MAX range, which corresponds to 2^32, which can't be stored in u32).
|
||||
*
|
||||
* For example: {U32_MAX, 1} corresponds to signed range [-1, 0],
|
||||
* {S32_MAX, 1} corresponds to unsigned range [S32_MAX, S32_MIN].
|
||||
*/
|
||||
struct cnum32 {
|
||||
u32 base;
|
||||
u32 size;
|
||||
};
|
||||
|
||||
#define CNUM32_UNBOUNDED ((struct cnum32){ .base = 0, .size = U32_MAX })
|
||||
#define CNUM32_EMPTY ((struct cnum32){ .base = U32_MAX, .size = U32_MAX })
|
||||
|
||||
struct cnum32 cnum32_from_urange(u32 min, u32 max);
|
||||
struct cnum32 cnum32_from_srange(s32 min, s32 max);
|
||||
u32 cnum32_umin(struct cnum32 cnum);
|
||||
u32 cnum32_umax(struct cnum32 cnum);
|
||||
s32 cnum32_smin(struct cnum32 cnum);
|
||||
s32 cnum32_smax(struct cnum32 cnum);
|
||||
struct cnum32 cnum32_intersect(struct cnum32 a, struct cnum32 b);
|
||||
void cnum32_intersect_with(struct cnum32 *dst, struct cnum32 src);
|
||||
void cnum32_intersect_with_urange(struct cnum32 *dst, u32 min, u32 max);
|
||||
void cnum32_intersect_with_srange(struct cnum32 *dst, s32 min, s32 max);
|
||||
bool cnum32_contains(struct cnum32 cnum, u32 v);
|
||||
bool cnum32_is_const(struct cnum32 cnum);
|
||||
bool cnum32_is_empty(struct cnum32 cnum);
|
||||
struct cnum32 cnum32_add(struct cnum32 a, struct cnum32 b);
|
||||
struct cnum32 cnum32_negate(struct cnum32 a);
|
||||
|
||||
/* Same as cnum32 but for 64-bit ranges */
|
||||
struct cnum64 {
|
||||
u64 base;
|
||||
u64 size;
|
||||
};
|
||||
|
||||
#define CNUM64_UNBOUNDED ((struct cnum64){ .base = 0, .size = U64_MAX })
|
||||
#define CNUM64_EMPTY ((struct cnum64){ .base = U64_MAX, .size = U64_MAX })
|
||||
|
||||
struct cnum64 cnum64_from_urange(u64 min, u64 max);
|
||||
struct cnum64 cnum64_from_srange(s64 min, s64 max);
|
||||
u64 cnum64_umin(struct cnum64 cnum);
|
||||
u64 cnum64_umax(struct cnum64 cnum);
|
||||
s64 cnum64_smin(struct cnum64 cnum);
|
||||
s64 cnum64_smax(struct cnum64 cnum);
|
||||
struct cnum64 cnum64_intersect(struct cnum64 a, struct cnum64 b);
|
||||
void cnum64_intersect_with(struct cnum64 *dst, struct cnum64 src);
|
||||
void cnum64_intersect_with_urange(struct cnum64 *dst, u64 min, u64 max);
|
||||
void cnum64_intersect_with_srange(struct cnum64 *dst, s64 min, s64 max);
|
||||
bool cnum64_contains(struct cnum64 cnum, u64 v);
|
||||
bool cnum64_is_const(struct cnum64 cnum);
|
||||
bool cnum64_is_empty(struct cnum64 cnum);
|
||||
struct cnum64 cnum64_add(struct cnum64 a, struct cnum64 b);
|
||||
struct cnum64 cnum64_negate(struct cnum64 a);
|
||||
|
||||
struct cnum32 cnum32_from_cnum64(struct cnum64 cnum);
|
||||
struct cnum64 cnum64_cnum32_intersect(struct cnum64 a, struct cnum32 b);
|
||||
|
||||
#endif /* _LINUX_CNUM_H */
|
||||
|
|
@ -6,7 +6,7 @@ cflags-nogcse-$(CONFIG_X86)$(CONFIG_CC_IS_GCC) := -fno-gcse
|
|||
endif
|
||||
CFLAGS_core.o += -Wno-override-init $(cflags-nogcse-yy)
|
||||
|
||||
obj-$(CONFIG_BPF_SYSCALL) += syscall.o verifier.o inode.o helpers.o tnum.o log.o token.o liveness.o const_fold.o
|
||||
obj-$(CONFIG_BPF_SYSCALL) += syscall.o verifier.o inode.o helpers.o tnum.o cnum.o log.o token.o liveness.o const_fold.o
|
||||
obj-$(CONFIG_BPF_SYSCALL) += bpf_iter.o map_iter.o task_iter.o prog_iter.o link_iter.o
|
||||
obj-$(CONFIG_BPF_SYSCALL) += hashtab.o arraymap.o percpu_freelist.o bpf_lru_list.o lpm_trie.o map_in_map.o bloom_filter.o
|
||||
obj-$(CONFIG_BPF_SYSCALL) += local_storage.o queue_stack_maps.o ringbuf.o bpf_insn_array.o
|
||||
|
|
|
|||
120
kernel/bpf/cnum.c
Normal file
120
kernel/bpf/cnum.c
Normal file
|
|
@ -0,0 +1,120 @@
|
|||
// SPDX-License-Identifier: GPL-2.0-only
|
||||
/* Copyright (c) 2026 Meta Platforms, Inc. and affiliates. */
|
||||
|
||||
#include <linux/bits.h>
|
||||
|
||||
#define T 32
|
||||
#include "cnum_defs.h"
|
||||
#undef T
|
||||
|
||||
#define T 64
|
||||
#include "cnum_defs.h"
|
||||
#undef T
|
||||
|
||||
struct cnum32 cnum32_from_cnum64(struct cnum64 cnum)
|
||||
{
|
||||
if (cnum64_is_empty(cnum))
|
||||
return CNUM32_EMPTY;
|
||||
|
||||
if (cnum.size >= U32_MAX)
|
||||
return (struct cnum32){ .base = 0, .size = U32_MAX };
|
||||
else
|
||||
return (struct cnum32){ .base = (u32)cnum.base, .size = cnum.size };
|
||||
}
|
||||
|
||||
/*
|
||||
* Suppose 'a' and 'b' are laid out as follows:
|
||||
*
|
||||
* 64-bit number axis --->
|
||||
*
|
||||
* N*2^32 (N+1)*2^32 (N+2)*2^32 (N+3)*2^32
|
||||
* ||------|---|=====|-------||----------|=====|-------||----------|=====|----|--||
|
||||
* | |< b >| |< b >| |< b >| |
|
||||
* | | | |
|
||||
* |<--+--------------------------- a ---------------------------+--->|
|
||||
* | |
|
||||
* |<-------------------------- t -------------------------->|
|
||||
*
|
||||
* In such a case it is possible to infer a more tight representation t
|
||||
* such that ∀ v ∈ a, (u32)v ∈ b: v ∈ t.
|
||||
*/
|
||||
struct cnum64 cnum64_cnum32_intersect(struct cnum64 a, struct cnum32 b)
|
||||
{
|
||||
/*
|
||||
* To simplify reasoning, rotate the circles so that [virtual] a1 starts
|
||||
* at u32 boundary, b1 represents b in this new frame of reference.
|
||||
*/
|
||||
struct cnum32 b1 = { b.base - (u32)a.base, b.size };
|
||||
struct cnum64 t = a;
|
||||
u64 d, b1_max;
|
||||
|
||||
if (cnum64_is_empty(a) || cnum32_is_empty(b))
|
||||
return CNUM64_EMPTY;
|
||||
|
||||
if (cnum32_urange_overflow(b1)) {
|
||||
b1_max = (u32)b1.base + (u32)b1.size; /* overflow here is fine and necessary */
|
||||
if ((u32)a.size > b1_max && (u32)a.size < b1.base) {
|
||||
/*
|
||||
* N*2^32 (N+1)*2^32
|
||||
* ||=====|------------|=====||=====|---------|---|=====||
|
||||
* |b1 ->| |<- b1||b1 ->| | |<- b1|
|
||||
* |<----------------- a1 ------------------>|
|
||||
* |<-------------- t ------------>|<-- d -->| (after adjustment)
|
||||
* ^
|
||||
* b1_max
|
||||
*/
|
||||
d = (u32)a.size - b1_max;
|
||||
t.size -= d;
|
||||
} else {
|
||||
/*
|
||||
* No adjustments possible in the following cases:
|
||||
*
|
||||
* ||=====|------------|=====||===|=|-------------|=|===||
|
||||
* |b1 ->| |<- b1||b1 +>| |<+ b1|
|
||||
* |<----------------- a1 ------>| |
|
||||
* |<----------------- (or) a1 ------------------->|
|
||||
*/
|
||||
}
|
||||
} else {
|
||||
if (t.size < b1.base)
|
||||
/*
|
||||
* N*2^32 (N+1)*2^32
|
||||
* ||----------|--|=======|--||------>
|
||||
* |<-- a1 -->| |<- b ->|
|
||||
*/
|
||||
return CNUM64_EMPTY;
|
||||
/*
|
||||
* N*2^32 (N+1)*2^32
|
||||
* ||-------------|========|-||-----| -------|========|-||
|
||||
* | |<- b1 ->| | |<- b1 ->|
|
||||
* |<------------+ a1 ------------>|
|
||||
* |<------ t ------>| (after adjustment)
|
||||
*/
|
||||
t.base += b1.base;
|
||||
t.size -= b1.base;
|
||||
b1_max = b1.base + b1.size;
|
||||
d = 0;
|
||||
if ((u32)a.size < b1.base)
|
||||
/*
|
||||
* N*2^32 (N+1)*2^32
|
||||
* ||-------------|========|-||------|-------|========|-||
|
||||
* | |<- b1 ->| | |<- b1 ->|
|
||||
* |<------------+-- a1 --+-------->|
|
||||
* |<- t ->|<-- d -->| (after adjustment)
|
||||
*/
|
||||
d = (u32)a.size + (BIT_ULL(32) - b1_max);
|
||||
else if ((u32)a.size >= b1_max)
|
||||
/*
|
||||
* N*2^32 (N+1)*2^32
|
||||
* ||--|========|------------||--|========|-------|-----||
|
||||
* | |<- b1 ->| |<- b1 ->| |
|
||||
* |<-+------------------ a1 ------------+------>|
|
||||
* |<-------------- t --------------->|<- d ->| (after adjustment)
|
||||
*/
|
||||
d = (u32)a.size - b1_max;
|
||||
if (t.size < d)
|
||||
return CNUM64_EMPTY;
|
||||
t.size -= d;
|
||||
}
|
||||
return t;
|
||||
}
|
||||
230
kernel/bpf/cnum_defs.h
Normal file
230
kernel/bpf/cnum_defs.h
Normal file
|
|
@ -0,0 +1,230 @@
|
|||
/* SPDX-License-Identifier: GPL-2.0-only */
|
||||
/* Copyright (c) 2026 Meta Platforms, Inc. and affiliates. */
|
||||
|
||||
#ifndef T
|
||||
#error "Define T (bit width: 32, 64) before including cnum_defs.h"
|
||||
#endif
|
||||
|
||||
#include <linux/cnum.h>
|
||||
#include <linux/limits.h>
|
||||
#include <linux/minmax.h>
|
||||
#include <linux/compiler_types.h>
|
||||
|
||||
#define cnum_t __PASTE(cnum, T)
|
||||
#define ut __PASTE(u, T)
|
||||
#define st __PASTE(s, T)
|
||||
#define UT_MAX __PASTE(__PASTE(U, T), _MAX)
|
||||
#define ST_MAX __PASTE(__PASTE(S, T), _MAX)
|
||||
#define ST_MIN __PASTE(__PASTE(S, T), _MIN)
|
||||
#define EMPTY __PASTE(__PASTE(CNUM, T), _EMPTY)
|
||||
#define FN(name) __PASTE(__PASTE(cnum, T), __PASTE(_, name))
|
||||
|
||||
struct cnum_t FN(from_urange)(ut min, ut max)
|
||||
{
|
||||
return (struct cnum_t){ .base = min, .size = (ut)max - min };
|
||||
}
|
||||
|
||||
struct cnum_t FN(from_srange)(st min, st max)
|
||||
{
|
||||
ut size = (ut)max - (ut)min;
|
||||
ut base = size == UT_MAX ? 0 : (ut)min;
|
||||
|
||||
return (struct cnum_t){ .base = base, .size = size };
|
||||
}
|
||||
|
||||
/* True if this cnum represents two unsigned ranges. */
|
||||
static inline bool FN(urange_overflow)(struct cnum_t cnum)
|
||||
{
|
||||
/* Same as cnum.base + cnum.size > UT_MAX but avoids overflow */
|
||||
return cnum.size > UT_MAX - (ut)cnum.base;
|
||||
}
|
||||
|
||||
/*
|
||||
* cnum{T}_umin / cnum{T}_umax query an unsigned range represented by this cnum.
|
||||
* If cnum represents a range crossing the UT_MAX/0 boundary, the unbound range
|
||||
* [0..UT_MAX] is returned.
|
||||
*/
|
||||
ut FN(umin)(struct cnum_t cnum)
|
||||
{
|
||||
return FN(urange_overflow)(cnum) ? 0 : cnum.base;
|
||||
}
|
||||
|
||||
ut FN(umax)(struct cnum_t cnum)
|
||||
{
|
||||
return FN(urange_overflow)(cnum) ? UT_MAX : cnum.base + cnum.size;
|
||||
}
|
||||
|
||||
/* True if this cnum represents two signed ranges. */
|
||||
static inline bool FN(srange_overflow)(struct cnum_t cnum)
|
||||
{
|
||||
return FN(contains)(cnum, (ut)ST_MAX) && FN(contains)(cnum, (ut)ST_MIN);
|
||||
}
|
||||
|
||||
/*
|
||||
* cnum{T}_smin / cnum{T}_smax query a signed range represented by this cnum.
|
||||
* If cnum represents a range crossing the ST_MAX/ST_MIN boundary, the unbound range
|
||||
* [ST_MIN..ST_MAX] is returned.
|
||||
*/
|
||||
st FN(smin)(struct cnum_t cnum)
|
||||
{
|
||||
return FN(srange_overflow)(cnum)
|
||||
? ST_MIN
|
||||
: min((st)cnum.base, (st)(cnum.base + cnum.size));
|
||||
}
|
||||
|
||||
st FN(smax)(struct cnum_t cnum)
|
||||
{
|
||||
return FN(srange_overflow)(cnum)
|
||||
? ST_MAX
|
||||
: max((st)cnum.base, (st)(cnum.base + cnum.size));
|
||||
}
|
||||
|
||||
/*
|
||||
* Returns a possibly empty intersection of cnums 'a' and 'b'.
|
||||
* If 'a' and 'b' intersect in two sub-arcs, the function over-approximates
|
||||
* and returns either 'a' or 'b', whichever is smaller.
|
||||
*/
|
||||
struct cnum_t FN(intersect)(struct cnum_t a, struct cnum_t b)
|
||||
{
|
||||
struct cnum_t b1;
|
||||
ut dbase;
|
||||
|
||||
if (FN(is_empty)(a) || FN(is_empty)(b))
|
||||
return EMPTY;
|
||||
|
||||
if (a.base > b.base)
|
||||
swap(a, b);
|
||||
|
||||
/*
|
||||
* Rotate frame of reference such that a.base is 0.
|
||||
* 'b1' is 'b' in this frame of reference.
|
||||
*/
|
||||
dbase = b.base - a.base;
|
||||
b1 = (struct cnum_t){ dbase, b.size };
|
||||
if (FN(urange_overflow)(b1)) {
|
||||
if (b1.base <= a.size) {
|
||||
/*
|
||||
* Rotated frame (a.base at origin):
|
||||
*
|
||||
* 0 UT_MAX
|
||||
* |--------------------------------------------|
|
||||
* [=== a ==========================] |
|
||||
* [= b1 tail =] [========= b1 main ==========>]
|
||||
* ^-- b1.base <= a.size
|
||||
*
|
||||
* 'a' and 'b' intersect in two disjoint arcs,
|
||||
* can't represent as single cnum, over-approximate
|
||||
* the result.
|
||||
*/
|
||||
return a.size <= b.size ? a : b;
|
||||
} else {
|
||||
/*
|
||||
* Rotated frame (a.base at origin):
|
||||
*
|
||||
* 0 UT_MAX
|
||||
* |--------------------------------------------|
|
||||
* [=== a =============] | |
|
||||
* [= b1 tail =] [======= b1 main ====>]
|
||||
* ^-- b1.base > a.size
|
||||
*
|
||||
* Only 'b' tail intersects 'a'.
|
||||
*/
|
||||
return (struct cnum_t) {
|
||||
.base = a.base,
|
||||
.size = min(a.size, (ut)(b1.base + b1.size)),
|
||||
};
|
||||
}
|
||||
} else if (a.size >= b1.base) {
|
||||
/*
|
||||
* Rotated frame (a.base at origin):
|
||||
*
|
||||
* 0 UT_MAX
|
||||
* |--------------------------------------------------|
|
||||
* [=== a ==================================] |
|
||||
* [== b1 =====================]
|
||||
*
|
||||
* 0 UT_MAX
|
||||
* |--------------------------------------------------|
|
||||
* [=== a ==================================] |
|
||||
* [== b1 ====]
|
||||
* ^-- b1.base <= a.size
|
||||
* |<-- a.size - dbase -->|
|
||||
*
|
||||
* 'a' and 'b' intersect as one cnum.
|
||||
*/
|
||||
return (struct cnum_t) {
|
||||
.base = b.base,
|
||||
.size = min((ut)(a.size - dbase), b.size),
|
||||
};
|
||||
} else {
|
||||
return EMPTY;
|
||||
}
|
||||
}
|
||||
|
||||
void FN(intersect_with)(struct cnum_t *dst, struct cnum_t src)
|
||||
{
|
||||
*dst = FN(intersect)(*dst, src);
|
||||
}
|
||||
|
||||
void FN(intersect_with_urange)(struct cnum_t *dst, ut min, ut max)
|
||||
{
|
||||
FN(intersect_with)(dst, FN(from_urange)(min, max));
|
||||
}
|
||||
|
||||
void FN(intersect_with_srange)(struct cnum_t *dst, st min, st max)
|
||||
{
|
||||
FN(intersect_with)(dst, FN(from_srange)(min, max));
|
||||
}
|
||||
|
||||
static inline struct cnum_t FN(normalize)(struct cnum_t cnum)
|
||||
{
|
||||
if (cnum.size == UT_MAX && cnum.base != 0 && cnum.base != (ut)ST_MAX)
|
||||
cnum.base = 0;
|
||||
return cnum;
|
||||
}
|
||||
|
||||
struct cnum_t FN(add)(struct cnum_t a, struct cnum_t b)
|
||||
{
|
||||
if (FN(is_empty)(a) || FN(is_empty)(b))
|
||||
return EMPTY;
|
||||
if (a.size > UT_MAX - b.size)
|
||||
return (struct cnum_t){ 0, (ut)UT_MAX };
|
||||
else
|
||||
return FN(normalize)((struct cnum_t){ a.base + b.base, a.size + b.size });
|
||||
}
|
||||
|
||||
struct cnum_t FN(negate)(struct cnum_t a)
|
||||
{
|
||||
if (FN(is_empty)(a))
|
||||
return EMPTY;
|
||||
return FN(normalize)((struct cnum_t){ -((ut)a.base + a.size), a.size });
|
||||
}
|
||||
|
||||
bool FN(is_empty)(struct cnum_t cnum)
|
||||
{
|
||||
return cnum.base == EMPTY.base && cnum.size == EMPTY.size;
|
||||
}
|
||||
|
||||
bool FN(contains)(struct cnum_t cnum, ut v)
|
||||
{
|
||||
if (FN(is_empty)(cnum))
|
||||
return false;
|
||||
if (FN(urange_overflow)(cnum))
|
||||
return v >= cnum.base || v <= (ut)cnum.base + cnum.size;
|
||||
else
|
||||
return v >= cnum.base && v <= (ut)cnum.base + cnum.size;
|
||||
}
|
||||
|
||||
bool FN(is_const)(struct cnum_t cnum)
|
||||
{
|
||||
return cnum.size == 0;
|
||||
}
|
||||
|
||||
#undef EMPTY
|
||||
#undef cnum_t
|
||||
#undef ut
|
||||
#undef st
|
||||
#undef UT_MAX
|
||||
#undef ST_MAX
|
||||
#undef ST_MIN
|
||||
#undef FN
|
||||
|
|
@ -571,20 +571,20 @@ static void print_scalar_ranges(struct bpf_verifier_env *env,
|
|||
u64 val;
|
||||
bool omit;
|
||||
} minmaxs[] = {
|
||||
{"smin", reg->smin_value, reg->smin_value == S64_MIN},
|
||||
{"smax", reg->smax_value, reg->smax_value == S64_MAX},
|
||||
{"umin", reg->umin_value, reg->umin_value == 0},
|
||||
{"umax", reg->umax_value, reg->umax_value == U64_MAX},
|
||||
{"smin", reg_smin(reg), reg_smin(reg) == S64_MIN},
|
||||
{"smax", reg_smax(reg), reg_smax(reg) == S64_MAX},
|
||||
{"umin", reg_umin(reg), reg_umin(reg) == 0},
|
||||
{"umax", reg_umax(reg), reg_umax(reg) == U64_MAX},
|
||||
{"smin32",
|
||||
is_snum_decimal((s64)reg->s32_min_value)
|
||||
? (s64)reg->s32_min_value
|
||||
: (u32)reg->s32_min_value, reg->s32_min_value == S32_MIN},
|
||||
is_snum_decimal((s64)reg_s32_min(reg))
|
||||
? (s64)reg_s32_min(reg)
|
||||
: (u32)reg_s32_min(reg), reg_s32_min(reg) == S32_MIN},
|
||||
{"smax32",
|
||||
is_snum_decimal((s64)reg->s32_max_value)
|
||||
? (s64)reg->s32_max_value
|
||||
: (u32)reg->s32_max_value, reg->s32_max_value == S32_MAX},
|
||||
{"umin32", reg->u32_min_value, reg->u32_min_value == 0},
|
||||
{"umax32", reg->u32_max_value, reg->u32_max_value == U32_MAX},
|
||||
is_snum_decimal((s64)reg_s32_max(reg))
|
||||
? (s64)reg_s32_max(reg)
|
||||
: (u32)reg_s32_max(reg), reg_s32_max(reg) == S32_MAX},
|
||||
{"umin32", reg_u32_min(reg), reg_u32_min(reg) == 0},
|
||||
{"umax32", reg_u32_max(reg), reg_u32_max(reg) == U32_MAX},
|
||||
}, *m1, *m2, *mend = &minmaxs[ARRAY_SIZE(minmaxs)];
|
||||
bool neg1, neg2;
|
||||
|
||||
|
|
|
|||
|
|
@ -301,14 +301,14 @@ int bpf_update_branch_counts(struct bpf_verifier_env *env, struct bpf_verifier_s
|
|||
static bool range_within(const struct bpf_reg_state *old,
|
||||
const struct bpf_reg_state *cur)
|
||||
{
|
||||
return old->umin_value <= cur->umin_value &&
|
||||
old->umax_value >= cur->umax_value &&
|
||||
old->smin_value <= cur->smin_value &&
|
||||
old->smax_value >= cur->smax_value &&
|
||||
old->u32_min_value <= cur->u32_min_value &&
|
||||
old->u32_max_value >= cur->u32_max_value &&
|
||||
old->s32_min_value <= cur->s32_min_value &&
|
||||
old->s32_max_value >= cur->s32_max_value;
|
||||
return reg_umin(old) <= reg_umin(cur) &&
|
||||
reg_umax(old) >= reg_umax(cur) &&
|
||||
reg_smin(old) <= reg_smin(cur) &&
|
||||
reg_smax(old) >= reg_smax(cur) &&
|
||||
reg_u32_min(old) <= reg_u32_min(cur) &&
|
||||
reg_u32_max(old) >= reg_u32_max(cur) &&
|
||||
reg_s32_min(old) <= reg_s32_min(cur) &&
|
||||
reg_s32_max(old) >= reg_s32_max(cur);
|
||||
}
|
||||
|
||||
/* If in the old state two registers had the same id, then they need to have
|
||||
|
|
|
|||
File diff suppressed because it is too large
Load Diff
|
|
@ -478,6 +478,52 @@ static struct range range_refine_in_halves(enum num_t x_t, struct range x,
|
|||
|
||||
}
|
||||
|
||||
static __always_inline u64 next_u32_block(u64 x) { return x + (1ULL << 32); }
|
||||
static __always_inline u64 prev_u32_block(u64 x) { return x - (1ULL << 32); }
|
||||
|
||||
/* Is v within the circular u64 range [base, base + len]? */
|
||||
static __always_inline bool u64_range_contains(u64 v, u64 base, u64 len)
|
||||
{
|
||||
return v - base <= len;
|
||||
}
|
||||
|
||||
/* Is v within the circular u32 range [base, base + len]? */
|
||||
static __always_inline bool u32_range_contains(u32 v, u32 base, u32 len)
|
||||
{
|
||||
return v - base <= len;
|
||||
}
|
||||
|
||||
static bool range64_range32_intersect(enum num_t a_t,
|
||||
struct range a /* 64 */,
|
||||
struct range b /* 32 */,
|
||||
struct range *out /* 64 */)
|
||||
{
|
||||
u64 b_len = (u32)(b.b - b.a);
|
||||
u64 a_len = a.b - a.a;
|
||||
u64 lo, hi;
|
||||
|
||||
if (u32_range_contains((u32)a.a, (u32)b.a, b_len)) {
|
||||
lo = a.a;
|
||||
} else {
|
||||
lo = swap_low32(a.a, (u32)b.a);
|
||||
if (!u64_range_contains(lo, a.a, a_len))
|
||||
lo = next_u32_block(lo);
|
||||
if (!u64_range_contains(lo, a.a, a_len))
|
||||
return false;
|
||||
}
|
||||
if (u32_range_contains(a.b, (u32)b.a, b_len)) {
|
||||
hi = a.b;
|
||||
} else {
|
||||
hi = swap_low32(a.b, (u32)b.b);
|
||||
if (!u64_range_contains(hi, a.a, a_len))
|
||||
hi = prev_u32_block(hi);
|
||||
if (!u64_range_contains(hi, a.a, a_len))
|
||||
return false;
|
||||
}
|
||||
*out = range(a_t, lo, hi);
|
||||
return true;
|
||||
}
|
||||
|
||||
static struct range range_refine(enum num_t x_t, struct range x, enum num_t y_t, struct range y)
|
||||
{
|
||||
struct range y_cast;
|
||||
|
|
@ -533,23 +579,12 @@ static struct range range_refine(enum num_t x_t, struct range x, enum num_t y_t,
|
|||
}
|
||||
}
|
||||
|
||||
/* the case when new range knowledge, *y*, is a 32-bit subregister
|
||||
* range, while previous range knowledge, *x*, is a full register
|
||||
* 64-bit range, needs special treatment to take into account upper 32
|
||||
* bits of full register range
|
||||
*/
|
||||
if (t_is_32(y_t) && !t_is_32(x_t)) {
|
||||
struct range x_swap;
|
||||
struct range x1;
|
||||
|
||||
/* some combinations of upper 32 bits and sign bit can lead to
|
||||
* invalid ranges, in such cases it's easier to detect them
|
||||
* after cast/swap than try to enumerate all the conditions
|
||||
* under which transformation and knowledge transfer is valid
|
||||
*/
|
||||
x_swap = range(x_t, swap_low32(x.a, y_cast.a), swap_low32(x.b, y_cast.b));
|
||||
if (!is_valid_range(x_t, x_swap))
|
||||
return x;
|
||||
return range_intersection(x_t, x, x_swap);
|
||||
if (range64_range32_intersect(x_t, x, y, &x1))
|
||||
return x1;
|
||||
return x;
|
||||
}
|
||||
|
||||
/* otherwise, plain range cast and intersection works */
|
||||
|
|
@ -1300,6 +1335,26 @@ static bool assert_range_eq(enum num_t t, struct range x, struct range y,
|
|||
return false;
|
||||
}
|
||||
|
||||
/* For a pair of signed/unsigned t1/t2 checks if r1/r2 intersect in two intervals. */
|
||||
static bool needs_two_arcs(enum num_t t1, struct range r1,
|
||||
enum num_t t2, struct range r2)
|
||||
{
|
||||
u64 lo = cast_t(t1, r2.a);
|
||||
u64 hi = cast_t(t1, r2.b);
|
||||
|
||||
/* does r2 wrap in t1's domain: [0, hi] ∪ [lo, MAX]? */
|
||||
return lo > hi && r1.a <= hi && r1.b >= lo;
|
||||
}
|
||||
|
||||
static bool reg_state_needs_two_arcs(struct reg_state *s)
|
||||
{
|
||||
if (!s->valid)
|
||||
return false;
|
||||
|
||||
return needs_two_arcs(U64, s->r[U64], S64, s->r[S64]) ||
|
||||
needs_two_arcs(U32, s->r[U32], S32, s->r[S32]);
|
||||
}
|
||||
|
||||
/* Validate that register states match, and print details if they don't */
|
||||
static bool assert_reg_state_eq(struct reg_state *r, struct reg_state *e, const char *ctx)
|
||||
{
|
||||
|
|
@ -1524,6 +1579,11 @@ static int verify_case_op(enum num_t init_t, enum num_t cond_t,
|
|||
!assert_reg_state_eq(&fr2, &fe2, "false_reg2") ||
|
||||
!assert_reg_state_eq(&tr1, &te1, "true_reg1") ||
|
||||
!assert_reg_state_eq(&tr2, &te2, "true_reg2")) {
|
||||
if (reg_state_needs_two_arcs(&fe1) || reg_state_needs_two_arcs(&fe2) ||
|
||||
reg_state_needs_two_arcs(&te1) || reg_state_needs_two_arcs(&te2)) {
|
||||
test__skip();
|
||||
return 0;
|
||||
}
|
||||
failed = true;
|
||||
}
|
||||
|
||||
|
|
|
|||
|
|
@ -1239,7 +1239,8 @@ l0_%=: r0 = 0; \
|
|||
SEC("tc")
|
||||
__description("multiply mixed sign bounds. test 1")
|
||||
__success __log_level(2)
|
||||
__msg("r6 *= r7 {{.*}}; R6=scalar(smin=umin=0x1bc16d5cd4927ee1,smax=umax=0x1bc16d674ec80000,smax32=0x7ffffeff,umax32=0xfffffeff,var_off=(0x1bc16d4000000000; 0x3ffffffeff))")
|
||||
__msg("r6 *= r7 {{.*}}; R6=scalar(smin=umin=0x1bc16d5cd4927ee1,smax=umax=0x1bc16d674ec80000,smax32=0x7ffffeff,var_off=(0x1bc16d4000000000; 0x3ffffffeff))")
|
||||
/* cnum can't represent both [0, 0xffff_feff] and [0x8000_0000, 0x7fff_feff], so it picks one */
|
||||
__naked void mult_mixed0_sign(void)
|
||||
{
|
||||
asm volatile (
|
||||
|
|
@ -1648,7 +1649,8 @@ l0_%=: r0 = 0; \
|
|||
SEC("socket")
|
||||
__description("bounds deduction cross sign boundary, two overlaps")
|
||||
__failure
|
||||
__msg("3: (2d) if r0 > r1 {{.*}} R0=scalar(smin=smin32=-128,smax=smax32=127,umax=0xffffffffffffff80)")
|
||||
__msg("3: (2d) if r0 > r1 {{.*}} R0=scalar(smin=smin32=-128,smax=smax32=127)")
|
||||
/* smin=-128 includes point 0xffffffffffffff80 */
|
||||
__msg("frame pointer is read only")
|
||||
__naked void bounds_deduct_two_overlaps(void)
|
||||
{
|
||||
|
|
@ -2043,7 +2045,8 @@ __naked void signed_unsigned_intersection32_case2(void *ctx)
|
|||
*/
|
||||
SEC("socket")
|
||||
__description("bounds refinement: 64bits ranges not overwritten by 32bits ranges")
|
||||
__msg("3: (65) if r0 s> 0x2 {{.*}} R0=scalar(smin=0x8000000000000002,smax=2,umin=smin32=umin32=2,umax=0xffffffff00000003,smax32=umax32=3")
|
||||
__msg("3: (65) if r0 s> 0x2 {{.*}} R0=scalar(smin=0x8000000000000002,smax=2,smin32=umin32=2,smax32=umax32=3,var_off{{.*}}))")
|
||||
/* Can't represent both [S64_MIN+2, 2] and [2, U64_MAX - U32_MAX + 2] at the same time, picks shorter interval */
|
||||
__msg("4: (25) if r0 > 0x13 {{.*}} R0=2")
|
||||
__success __log_level(2)
|
||||
__naked void refinement_32bounds_not_overwriting_64bounds(void *ctx)
|
||||
|
|
@ -2184,4 +2187,84 @@ __naked void tnums_equal_impossible_constant(void *ctx)
|
|||
: __clobber_all);
|
||||
}
|
||||
|
||||
/*
|
||||
* 32-bit range starts before 64-bit range low bits in each 2^32 block.
|
||||
*
|
||||
* N*2^32 (N+1)*2^32 (N+2)*2^32 (N+3)*2^32
|
||||
* ||----|=====|--|----------||----|=====|-------------||--|-|=====|-------------||
|
||||
* |< b >| | |< b >| | |< b >|
|
||||
* | | | |
|
||||
* |<---------------+- a -+---------------->|
|
||||
* | |
|
||||
* |< t >| refined r0 range
|
||||
*
|
||||
* a = u64 [0x1'00000008, 0x3'00000001]
|
||||
* b = u32 [2, 5]
|
||||
* t = u64 [0x2'00000002, 0x2'00000005]
|
||||
*/
|
||||
SEC("socket")
|
||||
__success
|
||||
__flag(BPF_F_TEST_REG_INVARIANTS)
|
||||
__naked void deduce64_from_32_before_block_start(void)
|
||||
{
|
||||
asm volatile (" \
|
||||
call %[bpf_get_prandom_u32]; \
|
||||
r1 = 0x100000008 ll; \
|
||||
if r0 < r1 goto 2f; \
|
||||
r1 = 0x300000001 ll; \
|
||||
if r0 > r1 goto 2f; /* u64: [0x1'00000008, 0x3'00000001] */ \
|
||||
if w0 < 2 goto 2f; \
|
||||
if w0 > 5 goto 2f; /* u32: [2, 5] */ \
|
||||
r2 = 0x200000002 ll; \
|
||||
r3 = 0x200000005 ll; \
|
||||
if r0 >= r2 goto 1f; /* should be always true */ \
|
||||
r10 = 0; /* dead code */ \
|
||||
1: if r0 <= r3 goto 2f; /* should be always true */ \
|
||||
r10 = 0; /* dead code */ \
|
||||
2: exit; \
|
||||
"
|
||||
:: __imm(bpf_get_prandom_u32)
|
||||
: __clobber_all);
|
||||
}
|
||||
|
||||
/*
|
||||
* 32-bit range crossing U32_MAX / 0 boundary.
|
||||
*
|
||||
* N*2^32 (N+1)*2^32 (N+2)*2^32 (N+3)*2^32
|
||||
* ||===|---------|------|===||===|----------------|===||===|---------|------|===||
|
||||
* |b >| | |< b||b >| |< b||b >| | |< b|
|
||||
* | | | |
|
||||
* |<-----+----------------- a --------------+-------->|
|
||||
* | |
|
||||
* |<---------------- t ------------->| refined r0 range
|
||||
*
|
||||
* a = u64 [0x1'00000006, 0x2'FFFFFFEF]
|
||||
* b = s32 [-16, 5] (u32 wrapping [0xFFFFFFF0, 0x00000005])
|
||||
* t = u64 [0x1'FFFFFFF0, 0x2'00000005]
|
||||
*/
|
||||
SEC("socket")
|
||||
__success
|
||||
__flag(BPF_F_TEST_REG_INVARIANTS)
|
||||
__naked void deduce64_from_32_wrapping_32bit(void)
|
||||
{
|
||||
asm volatile (" \
|
||||
call %[bpf_get_prandom_u32]; \
|
||||
r1 = 0x100000006 ll; \
|
||||
if r0 < r1 goto 2f; \
|
||||
r1 = 0x2ffffffef ll; \
|
||||
if r0 > r1 goto 2f; /* u64: [0x1'00000006, 0x2'FFFFFFEF] */ \
|
||||
if w0 s< -16 goto 2f; \
|
||||
if w0 s> 5 goto 2f; /* s32: [-16, 5] */ \
|
||||
r1 = 0x1fffffff0 ll; \
|
||||
r2 = 0x200000005 ll; \
|
||||
if r0 >= r1 goto 1f; /* should be always true */ \
|
||||
r10 = 0; /* dead code */ \
|
||||
1: if r0 <= r2 goto 2f; /* should be always true */ \
|
||||
r10 = 0; /* dead code */ \
|
||||
2: exit; \
|
||||
"
|
||||
:: __imm(bpf_get_prandom_u32)
|
||||
: __clobber_all);
|
||||
}
|
||||
|
||||
char _license[] SEC("license") = "GPL";
|
||||
|
|
|
|||
|
|
@ -558,7 +558,8 @@ __description("arsh32 imm sign negative extend check")
|
|||
__success __retval(0)
|
||||
__log_level(2)
|
||||
__msg("3: (17) r6 -= 4095 ; R6=scalar(smin=smin32=-4095,smax=smax32=0)")
|
||||
__msg("4: (67) r6 <<= 32 ; R6=scalar(smin=0xfffff00100000000,smax=smax32=umax32=0,umax=0xffffffff00000000,smin32=0,var_off=(0x0; 0xffffffff00000000))")
|
||||
__msg("4: (67) r6 <<= 32 ; R6=scalar(smin=0xfffff00100000000,smax=smax32=umax32=0,smin32=0,var_off=(0x0; 0xffffffff00000000))")
|
||||
/* represents shorter of signed / unsigned 64-bit ranges */
|
||||
__msg("5: (c7) r6 s>>= 32 ; R6=scalar(smin=smin32=-4095,smax=smax32=0)")
|
||||
__naked void arsh32_imm_sign_extend_negative_check(void)
|
||||
{
|
||||
|
|
@ -581,7 +582,8 @@ __description("arsh32 imm sign extend check")
|
|||
__success __retval(0)
|
||||
__log_level(2)
|
||||
__msg("3: (17) r6 -= 2047 ; R6=scalar(smin=smin32=-2047,smax=smax32=2048)")
|
||||
__msg("4: (67) r6 <<= 32 ; R6=scalar(smin=0xfffff80100000000,smax=0x80000000000,umax=0xffffffff00000000,smin32=0,smax32=umax32=0,var_off=(0x0; 0xffffffff00000000))")
|
||||
__msg("4: (67) r6 <<= 32 ; R6=scalar(smin=0xfffff80100000000,smax=0x80000000000,smin32=0,smax32=umax32=0,var_off=(0x0; 0xffffffff00000000))")
|
||||
/* represents shorter of signed / unsigned 64-bit ranges */
|
||||
__msg("5: (c7) r6 s>>= 32 ; R6=scalar(smin=smin32=-2047,smax=smax32=2048)")
|
||||
__naked void arsh32_imm_sign_extend_check(void)
|
||||
{
|
||||
|
|
|
|||
Loading…
Reference in New Issue
Block a user