| Message ID | 20181213034110.24361-3-jakub.kicinski@netronome.com |
|---|---|
| State | Changes Requested, archived |
| Delegated to: | BPF Maintainers |
| Headers | show |
| Series | bpf: improve BPF_JSET test coverage and verifier handling | expand |
On 13/12/18 03:41, Jakub Kicinski wrote: > Some JITs (nfp) try to optimize code on their own. It could make > sense in case of BPF_JSET instruction which is currently not interpreted > by the verifier, meaning for instance that dead could would not be > detected if it was under BPF_JSET branch. > > Teach the verifier basics of BPF_JSET, JIT optimizations will be > removed shortly. > > Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com> > Reviewed-by: Jiong Wang <jiong.wang@netronome.com> > --- Acked-by: Edward Cree <ecree@solarflare.com> > kernel/bpf/verifier.c | 20 ++++++++++++++++++++ > 1 file changed, 20 insertions(+) > > diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c > index 8b511a4fe84a..50bb45aa4f26 100644 > --- a/kernel/bpf/verifier.c > +++ b/kernel/bpf/verifier.c > @@ -3788,6 +3788,12 @@ static int is_branch_taken(struct bpf_reg_state *reg, u64 val, u8 opcode) > if (tnum_is_const(reg->var_off)) > return !tnum_equals_const(reg->var_off, val); > break; > + case BPF_JSET: > + if ((~reg->var_off.mask & reg->var_off.value) & val) > + return 1; > + if (!((reg->var_off.mask | reg->var_off.value) & val)) > + return 0; > + break; > case BPF_JGT: > if (reg->umin_value > val) > return 1; > @@ -3872,6 +3878,13 @@ static void reg_set_min_max(struct bpf_reg_state *true_reg, > */ > __mark_reg_known(false_reg, val); > break; > + case BPF_JSET: > + false_reg->var_off = tnum_and(false_reg->var_off, > + tnum_const(~val)); > + if (is_power_of_2(val)) > + true_reg->var_off = tnum_or(true_reg->var_off, > + tnum_const(val)); > + break; > case BPF_JGT: > false_reg->umax_value = min(false_reg->umax_value, val); > true_reg->umin_value = max(true_reg->umin_value, val + 1); > @@ -3944,6 +3957,13 @@ static void reg_set_min_max_inv(struct bpf_reg_state *true_reg, > */ > __mark_reg_known(false_reg, val); > break; > + case BPF_JSET: > + false_reg->var_off = tnum_and(false_reg->var_off, > + tnum_const(~val)); > + if (is_power_of_2(val)) > + true_reg->var_off = tnum_or(true_reg->var_off, > + tnum_const(val)); > + break; > case BPF_JGT: > true_reg->umax_value = min(true_reg->umax_value, val - 1); > false_reg->umin_value = max(false_reg->umin_value, val);
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c index 8b511a4fe84a..50bb45aa4f26 100644 --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -3788,6 +3788,12 @@ static int is_branch_taken(struct bpf_reg_state *reg, u64 val, u8 opcode) if (tnum_is_const(reg->var_off)) return !tnum_equals_const(reg->var_off, val); break; + case BPF_JSET: + if ((~reg->var_off.mask & reg->var_off.value) & val) + return 1; + if (!((reg->var_off.mask | reg->var_off.value) & val)) + return 0; + break; case BPF_JGT: if (reg->umin_value > val) return 1; @@ -3872,6 +3878,13 @@ static void reg_set_min_max(struct bpf_reg_state *true_reg, */ __mark_reg_known(false_reg, val); break; + case BPF_JSET: + false_reg->var_off = tnum_and(false_reg->var_off, + tnum_const(~val)); + if (is_power_of_2(val)) + true_reg->var_off = tnum_or(true_reg->var_off, + tnum_const(val)); + break; case BPF_JGT: false_reg->umax_value = min(false_reg->umax_value, val); true_reg->umin_value = max(true_reg->umin_value, val + 1); @@ -3944,6 +3957,13 @@ static void reg_set_min_max_inv(struct bpf_reg_state *true_reg, */ __mark_reg_known(false_reg, val); break; + case BPF_JSET: + false_reg->var_off = tnum_and(false_reg->var_off, + tnum_const(~val)); + if (is_power_of_2(val)) + true_reg->var_off = tnum_or(true_reg->var_off, + tnum_const(val)); + break; case BPF_JGT: true_reg->umax_value = min(true_reg->umax_value, val - 1); false_reg->umin_value = max(false_reg->umin_value, val);