Re: More BPF verifier questions

2017-06-06 Thread Edward Cree
On 05/06/17 08:06, Y Song wrote: > On Fri, Jun 2, 2017 at 7:42 AM, Edward Cree wrote: >> Test "helper access to variable memory: stack, bitwise AND + JMP, correct >> bounds" is listed as expected to pass, but it passes zero in the 'size' >> argument, an ARG_CONST_SIZE, to bpf_probe_read; I belie

Re: More BPF verifier questions

2017-06-06 Thread Edward Cree
On 05/06/17 19:47, Josef Bacik wrote: > On Mon, Jun 05, 2017 at 11:11:05AM -0700, Alexei Starovoitov wrote: >> Do you have an asm test case that demonstrates that? > From here we want to exploit the fact that false_reg->min_value is not > necessarily correct, but in order to do that we need to get

Re: More BPF verifier questions

2017-06-05 Thread Josef Bacik
On Mon, Jun 05, 2017 at 11:11:05AM -0700, Alexei Starovoitov wrote: > On 6/2/17 7:42 AM, Edward Cree wrote: > >Also, I feel I haven't fully understood the semantics of {min,max}_value and > > signed vs. unsigned comparisons. It seems that currently reg_set_min_max > > [_inv] assumes that any given

Re: More BPF verifier questions

2017-06-05 Thread Alexei Starovoitov
On 6/2/17 7:42 AM, Edward Cree wrote: Also, I feel I haven't fully understood the semantics of {min,max}_value and signed vs. unsigned comparisons. It seems that currently reg_set_min_max [_inv] assumes that any given register-value will either only be used as signed, or only be used as unsig

Re: More BPF verifier questions

2017-06-05 Thread Y Song
On Fri, Jun 2, 2017 at 7:42 AM, Edward Cree wrote: > A couple of the tests in tools/testing/selftests/bpf/test_verifier.c seem to > be bogus: Test "multiple registers share map_lookup_elem bad reg type" is > supposed to > error with "R3 invalid mem access 'inv'", but from my reading of it, R3 g

More BPF verifier questions

2017-06-02 Thread Edward Cree
A couple of the tests in tools/testing/selftests/bpf/test_verifier.c seem to be bogus: Test "multiple registers share map_lookup_elem bad reg type" is supposed to error with "R3 invalid mem access 'inv'", but from my reading of it, R3 gets loaded with a map_value_or_null, that later gets null-c