Hi, I encountered another BPF verifier issue related to my previous one https://lists.iovisor.org/pipermail/iovisor-dev/2017-January/000603.html
My guess is that when register spills to stack and restore, the state of imm upper zero bits does not get restore? Any comments are appreciated! This time the verifier shows: --- R0=imm0,min_value=0,max_value=0 R1=imm58,min_value=58,max_value=58 R3=pkt(id=0,off=58,r=58) R4=inv61 R5=pkt_end R6=imm144,min_value=144,max_value=144 R7=imm0,min_value=0,max_value=0 R8=ctx R9=pkt(id=0,off=0,r=58) R10=fp 260: (bf) r5 = r6 261: (47) r5 |= 12 262: (bf) r1 = r5 263: (07) r1 += 44 264: (77) r1 >>= 3 265: (7b) *(u64 *)(r10 -64) = r1 266: (bf) r7 = r5 267: (07) r7 += 36 268: (77) r7 >>= 3 269: (bf) r0 = r5 270: (07) r0 += 20 271: (77) r0 >>= 3 272: (bf) r1 = r5 273: (07) r1 += 52 274: (77) r1 >>= 3 275: (77) r6 >>= 3 276: (79) r2 = *(u64 *)(r10 -24) 277: (bf) r2 = r5 278: (77) r2 >>= 3 279: (7b) *(u64 *)(r10 -184) = r2 280: (07) r5 += 180 281: (77) r5 >>= 3 282: (bf) r4 = r9 283: (0f) r4 += r5 284: (47) r5 |= 1 285: (bf) r3 = r9 286: (0f) r3 += r6 287: (bf) r6 = r9 288: (0f) r6 += r1 289: (47) r1 |= 1 290: (bf) r2 = r9 291: (0f) r2 += r0 292: (7b) *(u64 *)(r10 -312) = r2 293: (bf) r2 = r9 294: (79) r0 = *(u64 *)(r10 -184) 295: (0f) r2 += r0 cannot add integer value with 0 upper zero bits to ptr_to_packet --- some analysis: r0 comes from stack r10 -184 294: (79) r0 = *(u64 *)(r10 -184) r2 stores into r10 - 184 279: (7b) *(u64 *)(r10 -184) = r2 r2 should be an imm14 277: (bf) r2 = r5 260: (bf) r5 = r6 R6=imm144,min_value=144,max_value=144 --- complete log --- https://gist.github.com/williamtu/97fcfe025ada712d91881fac53a9d1e3#file-xdp12-verifier https://gist.github.com/williamtu/97fcfe025ada712d91881fac53a9d1e3#file-xdp12-objdump Thank you~ William _______________________________________________ iovisor-dev mailing list [email protected] https://lists.iovisor.org/mailman/listinfo/iovisor-dev
