Re: [RFC bpf-next 0/6] bpf: track scalar equality across the low 32 bits

From: Vineet Gupta

Date: Thu Sep 10 2026 - 04:31:45 EST


On 8/19/26 10:05 AM, Eduard Zingerman wrote:
On Fri, 2026-08-14 at 16:19 -0700, Vineet Gupta wrote:
The verifier's linked-scalar machinery tracks register equality only for the
full 64 bits (optionally with a constant delta). There is no way to record
"these two registers share just their low 32 bits", so a 32-bit mov from a
source with unknown high bits has to drop the relationship entirely, and a
later narrowing of the source never reaches the destination:

 r6 = ...                    /* full 64-bit unknown */
 w7 = w6                     /* 32-bit zero-extending mov          */
 if w6 != 0 goto .Lxx        /* not taken: r6's low 32 bits are 0  */
 if w7 == 0 goto .Lok   <-- not deduced today
The same gap exists for the 32-bit sign extension and was the
motivation for this patchset.

 0: (61) r2 = *(u32 *)(r1 +24)
 1: (bf) r0 = (s32)r2
 2: (56) if w2 != 0x0 goto pc+10       ; R2=0 (branch taken)
    ...
12: (95) exit
Note that ldx instructions have similar structure: one can either zero
or sign extend on 32-bit load. I think this series should be expanded
to cover these cases.
To scope this, there are two items related to ldx
 - Narrowing fill off a wide spilled scalar
 - sign extending loads

There's also a case of narrowing spills to handle.

Also, please drop RFC tag when submitting v2.

Will do, thx.
v2 modulo ldx is ready (and the selftest runs are at par with RFC) but I'd still like yay/nay on some of the queries before submitting.

Thx,
-Vineet