From: Mykyta Yatsenko <mykyta.yatsenko5@gmail.com>
To: Paul Chaignon <paul.chaignon@gmail.com>, bpf@vger.kernel.org
Cc: Alexei Starovoitov <ast@kernel.org>,
Daniel Borkmann <daniel@iogearbox.net>,
Andrii Nakryiko <andrii@kernel.org>,
Eduard Zingerman <eddyz87@gmail.com>,
Harishankar Vishwanathan <harishankar.vishwanathan@gmail.com>,
Shung-Hsi Yu <shung-hsi.yu@suse.com>,
Srinivas Narayana <srinivas.narayana@rutgers.edu>,
Santosh Nagarakatte <santosh.nagarakatte@rutgers.edu>
Subject: Re: [PATCH v2 bpf-next 6/6] selftests/bpf: Remove invariant violation flags
Date: Mon, 23 Mar 2026 18:04:42 +0000 [thread overview]
Message-ID: <87fr5qjubp.fsf@gmail.com> (raw)
In-Reply-To: <e6da1ecc47f206f9fb6dabcf735b34382dffd885.1774025082.git.paul.chaignon@gmail.com>
Paul Chaignon <paul.chaignon@gmail.com> writes:
> With the changes to the verifier in previous commits, we're not
> expecting any invariant violations anymore. We should therefore always
> enable BPF_F_TEST_REG_INVARIANTS to fail on invariant violations. Turns
> out that's already the case and we've been explicitly setting this flag
> in selftests when it wasn't necessary. This commit removes those flags
> from selftests, which should hopefully make clearer that it's always
> enabled.
>
> Signed-off-by: Paul Chaignon <paul.chaignon@gmail.com>
> ---
BPF_F_TEST_REG_INVARIANTS is included in testing_prog_flags() from
testing_helpers.c which is used for loading verifier test programs, the
change looks good.
Acked-by: Mykyta Yatsenko <yatsenko@meta.com>
> .../selftests/bpf/progs/verifier_bounds.c | 24 ++++++-------------
> 1 file changed, 7 insertions(+), 17 deletions(-)
>
> diff --git a/tools/testing/selftests/bpf/progs/verifier_bounds.c b/tools/testing/selftests/bpf/progs/verifier_bounds.c
> index 818efa08404d..1ebc99d75862 100644
> --- a/tools/testing/selftests/bpf/progs/verifier_bounds.c
> +++ b/tools/testing/selftests/bpf/progs/verifier_bounds.c
> @@ -1066,7 +1066,6 @@ l0_%=: r0 = 0; \
> SEC("xdp")
> __description("bound check with JMP_JSLT for crossing 64-bit signed boundary")
> __success __retval(0)
> -__flag(BPF_F_TEST_REG_INVARIANTS)
> __naked void crossing_64_bit_signed_boundary_2(void)
> {
> asm volatile (" \
> @@ -1148,7 +1147,6 @@ l0_%=: r0 = 0; \
> SEC("xdp")
> __description("bound check with JMP32_JSLT for crossing 32-bit signed boundary")
> __success __retval(0)
> -__flag(BPF_F_TEST_REG_INVARIANTS)
> __naked void crossing_32_bit_signed_boundary_2(void)
> {
> asm volatile (" \
> @@ -1536,7 +1534,7 @@ __naked void sub32_partial_overflow(void)
> SEC("socket")
> __description("dead branch on jset, does not result in invariants violation error")
> __success __log_level(2)
> -__retval(0) __flag(BPF_F_TEST_REG_INVARIANTS)
> +__retval(0)
> __naked void jset_range_analysis(void)
> {
> asm volatile (" \
> @@ -1572,7 +1570,7 @@ l0_%=: r0 = 0; \
> */
> SEC("socket")
> __description("bounds deduction cross sign boundary, negative overlap")
> -__success __log_level(2) __flag(BPF_F_TEST_REG_INVARIANTS)
> +__success __log_level(2)
> __msg("7: (1f) r0 -= r6 {{.*}} R0=scalar(smin=smin32=-655,smax=smax32=-146,umin=0xfffffffffffffd71,umax=0xffffffffffffff6e,umin32=0xfffffd71,umax32=0xffffff6e,var_off=(0xfffffffffffffc00; 0x3ff))")
> __retval(0)
> __naked void bounds_deduct_negative_overlap(void)
> @@ -1616,7 +1614,7 @@ l0_%=: r0 = 0; \
> */
> SEC("socket")
> __description("bounds deduction cross sign boundary, positive overlap")
> -__success __log_level(2) __flag(BPF_F_TEST_REG_INVARIANTS)
> +__success __log_level(2)
> __msg("3: (2d) if r0 > r1 {{.*}} R0=scalar(smin=smin32=0,smax=umax=smax32=umax32=127,var_off=(0x0; 0x7f))")
> __retval(0)
> __naked void bounds_deduct_positive_overlap(void)
> @@ -1649,7 +1647,7 @@ l0_%=: r0 = 0; \
> */
> SEC("socket")
> __description("bounds deduction cross sign boundary, two overlaps")
> -__failure __flag(BPF_F_TEST_REG_INVARIANTS)
> +__failure
> __msg("3: (2d) if r0 > r1 {{.*}} R0=scalar(smin=smin32=-128,smax=smax32=127,umax=0xffffffffffffff80)")
> __msg("frame pointer is read only")
> __naked void bounds_deduct_two_overlaps(void)
> @@ -1713,7 +1711,7 @@ SEC("socket")
> __description("conditional jump on same register, branch taken")
> __not_msg("20: (b7) r0 = 1 {{.*}} R0=1")
> __success __log_level(2)
> -__retval(0) __flag(BPF_F_TEST_REG_INVARIANTS)
> +__retval(0)
> __naked void condition_jump_on_same_register(void *ctx)
> {
> asm volatile(" \
> @@ -1748,7 +1746,7 @@ SEC("socket")
> __description("jset on same register, constant value branch taken")
> __not_msg("7: (b7) r0 = 1 {{.*}} R0=1")
> __success __log_level(2)
> -__retval(0) __flag(BPF_F_TEST_REG_INVARIANTS)
> +__retval(0)
> __naked void jset_on_same_register_1(void *ctx)
> {
> asm volatile(" \
> @@ -1770,7 +1768,7 @@ SEC("socket")
> __description("jset on same register, scalar value branch taken")
> __not_msg("12: (b7) r0 = 1 {{.*}} R0=1")
> __success __log_level(2)
> -__retval(0) __flag(BPF_F_TEST_REG_INVARIANTS)
> +__retval(0)
> __naked void jset_on_same_register_2(void *ctx)
> {
> asm volatile(" \
> @@ -1800,7 +1798,6 @@ __description("jset on same register, scalar value unknown branch 1")
> __msg("3: (b7) r0 = 0 {{.*}} R0=0")
> __msg("5: (b7) r0 = 1 {{.*}} R0=1")
> __success __log_level(2)
> -__flag(BPF_F_TEST_REG_INVARIANTS)
> __naked void jset_on_same_register_3(void *ctx)
> {
> asm volatile(" \
> @@ -1822,7 +1819,6 @@ __description("jset on same register, scalar value unknown branch 2")
> __msg("4: (b7) r0 = 0 {{.*}} R0=0")
> __msg("6: (b7) r0 = 1 {{.*}} R0=1")
> __success __log_level(2)
> -__flag(BPF_F_TEST_REG_INVARIANTS)
> __naked void jset_on_same_register_4(void *ctx)
> {
> asm volatile(" \
> @@ -1845,7 +1841,6 @@ __description("jset on same register, scalar value unknown branch 3")
> __msg("4: (b7) r0 = 0 {{.*}} R0=0")
> __msg("6: (b7) r0 = 1 {{.*}} R0=1")
> __success __log_level(2)
> -__flag(BPF_F_TEST_REG_INVARIANTS)
> __naked void jset_on_same_register_5(void *ctx)
> {
> asm volatile(" \
> @@ -1877,7 +1872,6 @@ SEC("socket")
> __description("bounds refinement with single-value tnum on umax")
> __msg("3: (15) if r0 == 0xe0 {{.*}} R0=240")
> __success __log_level(2)
> -__flag(BPF_F_TEST_REG_INVARIANTS)
> __naked void bounds_refinement_tnum_umax(void *ctx)
> {
> asm volatile(" \
> @@ -1907,7 +1901,6 @@ SEC("socket")
> __description("bounds refinement with single-value tnum on umin")
> __msg("3: (15) if r0 == 0xf0 {{.*}} R0=224")
> __success __log_level(2)
> -__flag(BPF_F_TEST_REG_INVARIANTS)
> __naked void bounds_refinement_tnum_umin(void *ctx)
> {
> asm volatile(" \
> @@ -2002,7 +1995,6 @@ __naked void bounds_refinement_multiple_overlaps(void *ctx)
>
> SEC("socket")
> __success
> -__flag(BPF_F_TEST_REG_INVARIANTS)
> __naked void signed_unsigned_intersection32_case1(void *ctx)
> {
> asm volatile(" \
> @@ -2020,7 +2012,6 @@ __naked void signed_unsigned_intersection32_case1(void *ctx)
>
> SEC("socket")
> __success
> -__flag(BPF_F_TEST_REG_INVARIANTS)
> __naked void signed_unsigned_intersection32_case2(void *ctx)
> {
> asm volatile(" \
> @@ -2076,7 +2067,6 @@ __naked void refinement_32bounds_not_overwriting_64bounds(void *ctx)
> SEC("socket")
> __description("dead branch: tnums give impossible constant if equal")
> __success
> -__flag(BPF_F_TEST_REG_INVARIANTS)
> __naked void tnums_equal_impossible_constant(void *ctx)
> {
> asm volatile(" \
> --
> 2.43.0
prev parent reply other threads:[~2026-03-23 18:04 UTC|newest]
Thread overview: 39+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-03-20 16:45 [PATCH v2 bpf-next 0/6] Fix invariant violations and improve branch detection Paul Chaignon
2026-03-20 16:47 ` [PATCH v2 bpf-next 1/6] bpf: Refactor reg_bounds_sanity_check Paul Chaignon
2026-03-23 8:01 ` Shung-Hsi Yu
2026-03-23 14:16 ` Mykyta Yatsenko
2026-03-24 16:56 ` Harishankar Vishwanathan
2026-03-24 18:16 ` Mykyta Yatsenko
2026-03-20 16:49 ` [PATCH v2 bpf-next 2/6] bpf: Use bpf_verifier_env buffers for reg_set_min_max Paul Chaignon
2026-03-23 8:15 ` Shung-Hsi Yu
2026-03-23 15:33 ` Mykyta Yatsenko
2026-03-23 18:42 ` Eduard Zingerman
2026-03-30 12:05 ` Paul Chaignon
2026-03-31 1:51 ` Eduard Zingerman
2026-03-31 14:56 ` Paul Chaignon
2026-03-31 14:28 ` KaFai Wan
2026-04-01 11:15 ` Paul Chaignon
2026-03-20 16:49 ` [PATCH v2 bpf-next 3/6] bpf: Exit early if reg_bounds_sync gets invalid inputs Paul Chaignon
2026-03-23 12:12 ` Shung-Hsi Yu
2026-03-24 17:46 ` Harishankar Vishwanathan
2026-03-23 18:47 ` Eduard Zingerman
2026-03-24 19:28 ` Harishankar Vishwanathan
2026-03-24 19:33 ` Eduard Zingerman
2026-04-01 12:21 ` Paul Chaignon
2026-04-01 19:36 ` Harishankar Vishwanathan
2026-04-01 20:21 ` Eduard Zingerman
2026-04-01 21:19 ` Paul Chaignon
2026-03-20 16:49 ` [PATCH v2 bpf-next 4/6] bpf: Simulate branches to prune based on range violations Paul Chaignon
2026-03-23 12:23 ` Shung-Hsi Yu
2026-03-23 16:19 ` Mykyta Yatsenko
2026-03-24 20:36 ` Harishankar Vishwanathan
2026-03-25 13:52 ` Mykyta Yatsenko
2026-03-23 19:05 ` Eduard Zingerman
2026-03-24 23:59 ` Harishankar Vishwanathan
2026-03-25 0:08 ` Eduard Zingerman
2026-03-20 16:50 ` [PATCH v2 bpf-next 5/6] selftests/bpf: Cover invariant violation cases from syzbot Paul Chaignon
2026-03-23 17:46 ` Mykyta Yatsenko
2026-03-28 16:20 ` Paul Chaignon
2026-03-28 17:31 ` Alexei Starovoitov
2026-03-20 16:50 ` [PATCH v2 bpf-next 6/6] selftests/bpf: Remove invariant violation flags Paul Chaignon
2026-03-23 18:04 ` Mykyta Yatsenko [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=87fr5qjubp.fsf@gmail.com \
--to=mykyta.yatsenko5@gmail.com \
--cc=andrii@kernel.org \
--cc=ast@kernel.org \
--cc=bpf@vger.kernel.org \
--cc=daniel@iogearbox.net \
--cc=eddyz87@gmail.com \
--cc=harishankar.vishwanathan@gmail.com \
--cc=paul.chaignon@gmail.com \
--cc=santosh.nagarakatte@rutgers.edu \
--cc=shung-hsi.yu@suse.com \
--cc=srinivas.narayana@rutgers.edu \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.