Re: [PATCH bpf-next v2 1/2] bpf: Track aligned st store as imprecise spilled registers

[Yonghong Song <yonghong.song@linux.dev>]

On 1/4/24 8:37 AM, Eduard Zingerman wrote:
> On Wed, 2024-01-03 at 15:26 -0800, Yonghong Song wrote:
>> With patch set [1], precision backtracing supports register spill/fill
>> to/from the stack. The patch [2] allows initial imprecise register spill
>> with content 0. This is a common case for cpuv3 and lower for
>> initializing the stack variables with pattern
>>    r1 = 0
>>    *(u64 *)(r10 - 8) = r1
>> and the [2] has demonstrated good verification improvement.
>>
>> For cpuv4, the initialization could be
>>    *(u64 *)(r10 - 8) = 0
>> The current verifier marks the r10-8 contents with STACK_ZERO.
>> Similar to [2], let us permit the above insn to behave like
>> imprecise register spill which can reduce number of verified states.
>> The change is in function check_stack_write_fixed_off().
> Hi Yonghong,
>
> I agree with this change, but I don't understand under which conditions
> current STACK_ZERO logic is sub-optimal.
> I tried executing test case from patch #2 w/o applying patch #1 and it passes.
> Could you please elaborate / conjure a test case that would fail w/o patch #1?

The logic is similar to
   https://lore.kernel.org/all/20231205184248.1502704-9-andrii@kernel.org/

STACK_ZERO logic is sub-optimal in some cases only w.r.t. the number of
verifier states. So there is no correctness issue.

Patch 2 is added in response to Andrii's request in
   https://lore.kernel.org/all/CAEf4BzaWets3fHUGtctwCNWecR9ASRCO2kFagNy8jJZmPBWYDA@mail.gmail.com/
Since with patch 1 the original STACK_ZERO case is converted to STACK_SPILL,
Patch 2 is added to cover STACK_ZERO case. So with or with patch 1, patch 2
will succeed since it uses STACK_ZERO logic.


>
> Thanks,
> Eduard
>
> [...]