Skip to content

Commit 2e94d8e

Browse files
committed
[BPF] handle unsigned icmp ops in BPFAdjustOpt pass
When investigating an issue with bcc tool inject.py, I found a verifier failure with latest clang. The portion of code can be illustrated as below: struct pid_struct { u64 curr_call; u64 conds_met; u64 stack[2]; }; struct pid_struct *bpf_map_lookup_elem(); int foo() { struct pid_struct *p = bpf_map_lookup_elem(); if (!p) return 0; p->curr_call--; if (p->conds_met < 1 || p->conds_met >= 3) return 0; if (p->stack[p->conds_met - 1] == p->curr_call) p->conds_met--; ... } The verifier failure looks like: ... 8: (79) r1 = *(u64 *)(r0 +0) R0_w=map_value(id=0,off=0,ks=4,vs=32,imm=0) R10=fp0 fp-8=mmmm???? 9: (07) r1 += -1 10: (7b) *(u64 *)(r0 +0) = r1 R0_w=map_value(id=0,off=0,ks=4,vs=32,imm=0) R1_w=inv(id=0) R10=fp0 fp-8=mmmm???? 11: (79) r2 = *(u64 *)(r0 +8) R0_w=map_value(id=0,off=0,ks=4,vs=32,imm=0) R1_w=inv(id=0) R10=fp0 fp-8=mmmm???? 12: (bf) r3 = r2 13: (07) r3 += -3 14: (b7) r4 = -2 15: (2d) if r4 > r3 goto pc+13 R0=map_value(id=0,off=0,ks=4,vs=32,imm=0) R1=inv(id=0) R2=inv(id=2) R3=inv(id=0,umin_value=18446744073709551614,var_off=(0xffffffff00000000; 0xffffffff)) R4=inv-2 R10=fp0 fp-8=mmmm???? 16: (07) r2 += -1 17: (bf) r3 = r2 18: (67) r3 <<= 3 19: (bf) r4 = r0 20: (0f) r4 += r3 math between map_value pointer and register with unbounded min value is not allowed Here the compiler optimized "p->conds_met < 1 || p->conds_met >= 3" to r2 = p->conds_met r3 = r2 r3 += -3 r4 = -2 if (r3 < r4) return 0 r2 += -1 r3 = r2 ... In the above, r3 is initially equal to r2, but is modified used by the comparison. But later on r2 is used again. This caused verification failure. BPF backend has a pass, AdjustOpt, to prevent such transformation, but only focused on signed integers since typical bpf helper returns signed integers. To fix this case, let us handle unsigned integers as well. Differential Revision: https://reviews.llvm.org/D121937
1 parent 6c4931e commit 2e94d8e

File tree

2 files changed

+77
-0
lines changed

2 files changed

+77
-0
lines changed

llvm/lib/Target/BPF/BPFAdjustOpt.cpp

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -264,6 +264,12 @@ bool BPFAdjustOptImpl::serializeICMPCrossBB(BasicBlock &BB) {
264264
} else if (Cond1Op == ICmpInst::ICMP_SLT || Cond1Op == ICmpInst::ICMP_SLE) {
265265
if (Cond2Op != ICmpInst::ICMP_SGT && Cond2Op != ICmpInst::ICMP_SGE)
266266
return false;
267+
} else if (Cond1Op == ICmpInst::ICMP_ULT || Cond1Op == ICmpInst::ICMP_ULE) {
268+
if (Cond2Op != ICmpInst::ICMP_UGT && Cond2Op != ICmpInst::ICMP_UGE)
269+
return false;
270+
} else if (Cond1Op == ICmpInst::ICMP_UGT || Cond1Op == ICmpInst::ICMP_UGE) {
271+
if (Cond2Op != ICmpInst::ICMP_ULT && Cond2Op != ICmpInst::ICMP_ULE)
272+
return false;
267273
} else {
268274
return false;
269275
}
Lines changed: 71 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,71 @@
1+
; RUN: opt -O2 -S -mtriple=bpf-pc-linux %s -o %t1
2+
; RUN: llc %t1 -o - | FileCheck -check-prefixes=CHECK,CHECK-V1 %s
3+
; RUN: opt -O2 -S -mtriple=bpf-pc-linux %s -o %t1
4+
; RUN: llc %t1 -mcpu=v3 -o - | FileCheck -check-prefixes=CHECK,CHECK-V3 %s
5+
;
6+
; Source:
7+
; unsigned bar(unsigned);
8+
; unsigned int test(unsigned *p) {
9+
; if (*p <= 1 || *p >= 7)
10+
; return 0;
11+
; return bar(*p);
12+
; }
13+
; Compilation flag:
14+
; clang -target bpf -O2 -S -emit-llvm -Xclang -disable-llvm-passes test.c
15+
16+
; Function Attrs: nounwind
17+
define dso_local i32 @test(i32* noundef %p) #0 {
18+
entry:
19+
%retval = alloca i32, align 4
20+
%p.addr = alloca i32*, align 8
21+
store i32* %p, i32** %p.addr, align 8, !tbaa !3
22+
%0 = load i32*, i32** %p.addr, align 8, !tbaa !3
23+
%1 = load i32, i32* %0, align 4, !tbaa !7
24+
%cmp = icmp ule i32 %1, 1
25+
br i1 %cmp, label %if.then, label %lor.lhs.false
26+
27+
lor.lhs.false: ; preds = %entry
28+
%2 = load i32*, i32** %p.addr, align 8, !tbaa !3
29+
%3 = load i32, i32* %2, align 4, !tbaa !7
30+
%cmp1 = icmp uge i32 %3, 7
31+
br i1 %cmp1, label %if.then, label %if.end
32+
33+
if.then: ; preds = %lor.lhs.false, %entry
34+
store i32 0, i32* %retval, align 4
35+
br label %return
36+
37+
if.end: ; preds = %lor.lhs.false
38+
%4 = load i32*, i32** %p.addr, align 8, !tbaa !3
39+
%5 = load i32, i32* %4, align 4, !tbaa !7
40+
%call = call i32 @bar(i32 noundef %5)
41+
store i32 %call, i32* %retval, align 4
42+
br label %return
43+
44+
return: ; preds = %if.end, %if.then
45+
%6 = load i32, i32* %retval, align 4
46+
ret i32 %6
47+
}
48+
49+
; CHECK-LABEL: test
50+
; CHECK-V1: if r[[#]] > r[[#]] goto
51+
; CHECK-V1: if r[[#]] > 6 goto
52+
; CHECK-V3: if w[[#]] < 2 goto
53+
; CHECK-V3: if w[[#]] > 6 goto
54+
55+
declare dso_local i32 @bar(i32 noundef) #1
56+
57+
attributes #0 = { nounwind "frame-pointer"="all" "min-legal-vector-width"="0" "no-trapping-math"="true" "stack-protector-buffer-size"="8" }
58+
attributes #1 = { "frame-pointer"="all" "no-trapping-math"="true" "stack-protector-buffer-size"="8" }
59+
60+
!llvm.module.flags = !{!0, !1}
61+
!llvm.ident = !{!2}
62+
63+
!0 = !{i32 1, !"wchar_size", i32 4}
64+
!1 = !{i32 7, !"frame-pointer", i32 2}
65+
!2 = !{!"clang version 15.0.0 (https://github.com/llvm/llvm-project.git 2a25e1af85f3138f70888c4c3f359c6a09e3cfe5)"}
66+
!3 = !{!4, !4, i64 0}
67+
!4 = !{!"any pointer", !5, i64 0}
68+
!5 = !{!"omnipotent char", !6, i64 0}
69+
!6 = !{!"Simple C/C++ TBAA"}
70+
!7 = !{!8, !8, i64 0}
71+
!8 = !{!"int", !5, i64 0}

0 commit comments

Comments
 (0)