From: Mykyta Yatsenko <mykyta.yatsenko5@gmail.com>
To: Paul Chaignon <paul.chaignon@gmail.com>, bpf@vger.kernel.org
Cc: Alexei Starovoitov <ast@kernel.org>,
Daniel Borkmann <daniel@iogearbox.net>,
Andrii Nakryiko <andrii@kernel.org>,
Eduard Zingerman <eddyz87@gmail.com>,
Harishankar Vishwanathan <harishankar.vishwanathan@gmail.com>,
Shung-Hsi Yu <shung-hsi.yu@suse.com>,
Srinivas Narayana <srinivas.narayana@rutgers.edu>,
Santosh Nagarakatte <santosh.nagarakatte@rutgers.edu>
Subject: Re: [PATCH v2 bpf-next 6/6] selftests/bpf: Remove invariant violation flags
Date: Mon, 23 Mar 2026 18:04:42 +0000 [thread overview]
Message-ID: <87fr5qjubp.fsf@gmail.com> (raw)
In-Reply-To: <e6da1ecc47f206f9fb6dabcf735b34382dffd885.1774025082.git.paul.chaignon@gmail.com>
Paul Chaignon <paul.chaignon@gmail.com> writes:
> With the changes to the verifier in previous commits, we're not
> expecting any invariant violations anymore. We should therefore always
> enable BPF_F_TEST_REG_INVARIANTS to fail on invariant violations. Turns
> out that's already the case and we've been explicitly setting this flag
> in selftests when it wasn't necessary. This commit removes those flags
> from selftests, which should hopefully make clearer that it's always
> enabled.
>
> Signed-off-by: Paul Chaignon <paul.chaignon@gmail.com>
> ---
BPF_F_TEST_REG_INVARIANTS is included in testing_prog_flags() from
testing_helpers.c which is used for loading verifier test programs, the
change looks good.
Acked-by: Mykyta Yatsenko <yatsenko@meta.com>
> .../selftests/bpf/progs/verifier_bounds.c | 24 ++++++-------------
> 1 file changed, 7 insertions(+), 17 deletions(-)
>
> diff --git a/tools/testing/selftests/bpf/progs/verifier_bounds.c b/tools/testing/selftests/bpf/progs/verifier_bounds.c
> index 818efa08404d..1ebc99d75862 100644
> --- a/tools/testing/selftests/bpf/progs/verifier_bounds.c
> +++ b/tools/testing/selftests/bpf/progs/verifier_bounds.c
> @@ -1066,7 +1066,6 @@ l0_%=: r0 = 0; \
> SEC("xdp")
> __description("bound check with JMP_JSLT for crossing 64-bit signed boundary")
> __success __retval(0)
> -__flag(BPF_F_TEST_REG_INVARIANTS)
> __naked void crossing_64_bit_signed_boundary_2(void)
> {
> asm volatile (" \
> @@ -1148,7 +1147,6 @@ l0_%=: r0 = 0; \
> SEC("xdp")
> __description("bound check with JMP32_JSLT for crossing 32-bit signed boundary")
> __success __retval(0)
> -__flag(BPF_F_TEST_REG_INVARIANTS)
> __naked void crossing_32_bit_signed_boundary_2(void)
> {
> asm volatile (" \
> @@ -1536,7 +1534,7 @@ __naked void sub32_partial_overflow(void)
> SEC("socket")
> __description("dead branch on jset, does not result in invariants violation error")
> __success __log_level(2)
> -__retval(0) __flag(BPF_F_TEST_REG_INVARIANTS)
> +__retval(0)
> __naked void jset_range_analysis(void)
> {
> asm volatile (" \
> @@ -1572,7 +1570,7 @@ l0_%=: r0 = 0; \
> */
> SEC("socket")
> __description("bounds deduction cross sign boundary, negative overlap")
> -__success __log_level(2) __flag(BPF_F_TEST_REG_INVARIANTS)
> +__success __log_level(2)
> __msg("7: (1f) r0 -= r6 {{.*}} R0=scalar(smin=smin32=-655,smax=smax32=-146,umin=0xfffffffffffffd71,umax=0xffffffffffffff6e,umin32=0xfffffd71,umax32=0xffffff6e,var_off=(0xfffffffffffffc00; 0x3ff))")
> __retval(0)
> __naked void bounds_deduct_negative_overlap(void)
> @@ -1616,7 +1614,7 @@ l0_%=: r0 = 0; \
> */
> SEC("socket")
> __description("bounds deduction cross sign boundary, positive overlap")
> -__success __log_level(2) __flag(BPF_F_TEST_REG_INVARIANTS)
> +__success __log_level(2)
> __msg("3: (2d) if r0 > r1 {{.*}} R0=scalar(smin=smin32=0,smax=umax=smax32=umax32=127,var_off=(0x0; 0x7f))")
> __retval(0)
> __naked void bounds_deduct_positive_overlap(void)
> @@ -1649,7 +1647,7 @@ l0_%=: r0 = 0; \
> */
> SEC("socket")
> __description("bounds deduction cross sign boundary, two overlaps")
> -__failure __flag(BPF_F_TEST_REG_INVARIANTS)
> +__failure
> __msg("3: (2d) if r0 > r1 {{.*}} R0=scalar(smin=smin32=-128,smax=smax32=127,umax=0xffffffffffffff80)")
> __msg("frame pointer is read only")
> __naked void bounds_deduct_two_overlaps(void)
> @@ -1713,7 +1711,7 @@ SEC("socket")
> __description("conditional jump on same register, branch taken")
> __not_msg("20: (b7) r0 = 1 {{.*}} R0=1")
> __success __log_level(2)
> -__retval(0) __flag(BPF_F_TEST_REG_INVARIANTS)
> +__retval(0)
> __naked void condition_jump_on_same_register(void *ctx)
> {
> asm volatile(" \
> @@ -1748,7 +1746,7 @@ SEC("socket")
> __description("jset on same register, constant value branch taken")
> __not_msg("7: (b7) r0 = 1 {{.*}} R0=1")
> __success __log_level(2)
> -__retval(0) __flag(BPF_F_TEST_REG_INVARIANTS)
> +__retval(0)
> __naked void jset_on_same_register_1(void *ctx)
> {
> asm volatile(" \
> @@ -1770,7 +1768,7 @@ SEC("socket")
> __description("jset on same register, scalar value branch taken")
> __not_msg("12: (b7) r0 = 1 {{.*}} R0=1")
> __success __log_level(2)
> -__retval(0) __flag(BPF_F_TEST_REG_INVARIANTS)
> +__retval(0)
> __naked void jset_on_same_register_2(void *ctx)
> {
> asm volatile(" \
> @@ -1800,7 +1798,6 @@ __description("jset on same register, scalar value unknown branch 1")
> __msg("3: (b7) r0 = 0 {{.*}} R0=0")
> __msg("5: (b7) r0 = 1 {{.*}} R0=1")
> __success __log_level(2)
> -__flag(BPF_F_TEST_REG_INVARIANTS)
> __naked void jset_on_same_register_3(void *ctx)
> {
> asm volatile(" \
> @@ -1822,7 +1819,6 @@ __description("jset on same register, scalar value unknown branch 2")
> __msg("4: (b7) r0 = 0 {{.*}} R0=0")
> __msg("6: (b7) r0 = 1 {{.*}} R0=1")
> __success __log_level(2)
> -__flag(BPF_F_TEST_REG_INVARIANTS)
> __naked void jset_on_same_register_4(void *ctx)
> {
> asm volatile(" \
> @@ -1845,7 +1841,6 @@ __description("jset on same register, scalar value unknown branch 3")
> __msg("4: (b7) r0 = 0 {{.*}} R0=0")
> __msg("6: (b7) r0 = 1 {{.*}} R0=1")
> __success __log_level(2)
> -__flag(BPF_F_TEST_REG_INVARIANTS)
> __naked void jset_on_same_register_5(void *ctx)
> {
> asm volatile(" \
> @@ -1877,7 +1872,6 @@ SEC("socket")
> __description("bounds refinement with single-value tnum on umax")
> __msg("3: (15) if r0 == 0xe0 {{.*}} R0=240")
> __success __log_level(2)
> -__flag(BPF_F_TEST_REG_INVARIANTS)
> __naked void bounds_refinement_tnum_umax(void *ctx)
> {
> asm volatile(" \
> @@ -1907,7 +1901,6 @@ SEC("socket")
> __description("bounds refinement with single-value tnum on umin")
> __msg("3: (15) if r0 == 0xf0 {{.*}} R0=224")
> __success __log_level(2)
> -__flag(BPF_F_TEST_REG_INVARIANTS)
> __naked void bounds_refinement_tnum_umin(void *ctx)
> {
> asm volatile(" \
> @@ -2002,7 +1995,6 @@ __naked void bounds_refinement_multiple_overlaps(void *ctx)
>
> SEC("socket")
> __success
> -__flag(BPF_F_TEST_REG_INVARIANTS)
> __naked void signed_unsigned_intersection32_case1(void *ctx)
> {
> asm volatile(" \
> @@ -2020,7 +2012,6 @@ __naked void signed_unsigned_intersection32_case1(void *ctx)
>
> SEC("socket")
> __success
> -__flag(BPF_F_TEST_REG_INVARIANTS)
> __naked void signed_unsigned_intersection32_case2(void *ctx)
> {
> asm volatile(" \
> @@ -2076,7 +2067,6 @@ __naked void refinement_32bounds_not_overwriting_64bounds(void *ctx)
> SEC("socket")
> __description("dead branch: tnums give impossible constant if equal")
> __success
> -__flag(BPF_F_TEST_REG_INVARIANTS)
> __naked void tnums_equal_impossible_constant(void *ctx)
> {
> asm volatile(" \
> --
> 2.43.0
prev parent reply other threads:[~2026-03-23 18:04 UTC|newest]
Thread overview: 30+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-03-20 16:45 [PATCH v2 bpf-next 0/6] Fix invariant violations and improve branch detection Paul Chaignon
2026-03-20 16:47 ` [PATCH v2 bpf-next 1/6] bpf: Refactor reg_bounds_sanity_check Paul Chaignon
2026-03-23 8:01 ` Shung-Hsi Yu
2026-03-23 14:16 ` Mykyta Yatsenko
2026-03-24 16:56 ` Harishankar Vishwanathan
2026-03-24 18:16 ` Mykyta Yatsenko
2026-03-20 16:49 ` [PATCH v2 bpf-next 2/6] bpf: Use bpf_verifier_env buffers for reg_set_min_max Paul Chaignon
2026-03-23 8:15 ` Shung-Hsi Yu
2026-03-23 15:33 ` Mykyta Yatsenko
2026-03-23 18:42 ` Eduard Zingerman
2026-03-20 16:49 ` [PATCH v2 bpf-next 3/6] bpf: Exit early if reg_bounds_sync gets invalid inputs Paul Chaignon
2026-03-23 12:12 ` Shung-Hsi Yu
2026-03-24 17:46 ` Harishankar Vishwanathan
2026-03-23 18:47 ` Eduard Zingerman
2026-03-24 19:28 ` Harishankar Vishwanathan
2026-03-24 19:33 ` Eduard Zingerman
2026-03-20 16:49 ` [PATCH v2 bpf-next 4/6] bpf: Simulate branches to prune based on range violations Paul Chaignon
2026-03-23 12:23 ` Shung-Hsi Yu
2026-03-23 16:19 ` Mykyta Yatsenko
2026-03-24 20:36 ` Harishankar Vishwanathan
2026-03-25 13:52 ` Mykyta Yatsenko
2026-03-23 19:05 ` Eduard Zingerman
2026-03-24 23:59 ` Harishankar Vishwanathan
2026-03-25 0:08 ` Eduard Zingerman
2026-03-20 16:50 ` [PATCH v2 bpf-next 5/6] selftests/bpf: Cover invariant violation cases from syzbot Paul Chaignon
2026-03-23 17:46 ` Mykyta Yatsenko
2026-03-28 16:20 ` Paul Chaignon
2026-03-28 17:31 ` Alexei Starovoitov
2026-03-20 16:50 ` [PATCH v2 bpf-next 6/6] selftests/bpf: Remove invariant violation flags Paul Chaignon
2026-03-23 18:04 ` Mykyta Yatsenko [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=87fr5qjubp.fsf@gmail.com \
--to=mykyta.yatsenko5@gmail.com \
--cc=andrii@kernel.org \
--cc=ast@kernel.org \
--cc=bpf@vger.kernel.org \
--cc=daniel@iogearbox.net \
--cc=eddyz87@gmail.com \
--cc=harishankar.vishwanathan@gmail.com \
--cc=paul.chaignon@gmail.com \
--cc=santosh.nagarakatte@rutgers.edu \
--cc=shung-hsi.yu@suse.com \
--cc=srinivas.narayana@rutgers.edu \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox