Re: [RFC bpf-next 0/6] bpf: track scalar equality across the low 32 bits
From: Vineet Gupta
Date: Thu Sep 10 2026 - 04:31:45 EST
On 8/19/26 10:05 AM, Eduard Zingerman wrote:
On Fri, 2026-08-14 at 16:19 -0700, Vineet Gupta wrote:To scope this, there are two items related to ldx
The verifier's linked-scalar machinery tracks register equality only for theNote that ldx instructions have similar structure: one can either zero
full 64 bits (optionally with a constant delta). There is no way to record
"these two registers share just their low 32 bits", so a 32-bit mov from a
source with unknown high bits has to drop the relationship entirely, and a
later narrowing of the source never reaches the destination:
r6 = ... /* full 64-bit unknown */The same gap exists for the 32-bit sign extension and was the
w7 = w6 /* 32-bit zero-extending mov */
if w6 != 0 goto .Lxx /* not taken: r6's low 32 bits are 0 */
if w7 == 0 goto .Lok <-- not deduced today
motivation for this patchset.
0: (61) r2 = *(u32 *)(r1 +24)
1: (bf) r0 = (s32)r2
2: (56) if w2 != 0x0 goto pc+10 ; R2=0 (branch taken)
...
12: (95) exit
or sign extend on 32-bit load. I think this series should be expanded
to cover these cases.
- Narrowing fill off a wide spilled scalar
- sign extending loads
There's also a case of narrowing spills to handle.
Also, please drop RFC tag when submitting v2.
Will do, thx.
v2 modulo ldx is ready (and the selftest runs are at par with RFC) but I'd still like yay/nay on some of the queries before submitting.
Thx,
-Vineet