Making Sense of Tristate Numbers (tnum)

Presented at Linux Plumbers Conference (LPC) 2024 in Vienna

Transcript

1. Making Sense of Tristate Numbers (tnum) Shung-Hsi Yu SUSE
2. What is tnum? 2
3. Tristate Tracked Number 3
4. struct bpf_reg_state { enum bpf_reg_type type; struct tnum { u64 value; u64 mask; } var_off; ... }; 4
5. Number of bugs in kernel/bpf/tnum.c 5
6. Number of bugs in kernel/bpf/tnum.c 6 since its introduction in 2017
7. 1 7
8. Number of lines in kernel/bpf/tnum.c 8 remains unchanged since 2017
9. 168 9 out of 213
10. 75% 10
11. Good code Good API 11
12. In practice… 12
13. 13 ¯\_(ツ)_/¯
14. Backgrounds 14
15. Why tnum? 15
16. BPF Verifier & Safety 16
17. BPF Verifier & Safety Out-of-bound read? Address leakage? Infinite loop? Termination? Division-by-0? Out-of-bound write? Is pointer aligned? Invalid return value? Uninit stack? 17
18. What’s the values being used? Out-of-bound read? Invalid return value? Infinite loop? Termination? Division-by-0? Uninit stack? Out-of-bound write? Is pointer aligned? 18
19. /* i is some random number */ int i = bpf_get_prandom_u32(); /* mask must be 3 */ int mask = 3; /* i & mask can be 0, 1, 2, or 3 */ return i & mask; 19
20. What the verifier actually sees 20
21. /* random number given as the * return value (register r0) */ call bpf_get_prandom_u32; /* mask stored in register r1*/ r1 = 3; r0 &= r1; /* (i & mask) kept in r0 */ ret; 21
22. What’s the values being used? Out-of-bound read? Invalid return value? Infinite loop? Termination? Division-by-0? Uninit stack? Out-of-bound write? Is pointer aligned? 22
23. What’s the value within registers? Out-of-bound read? Invalid return value? Infinite loop? Termination? Division-by-0? Uninit stack? Out-of-bound write? Is pointer aligned? 23
24. Value Tracking Out-of-bound read? Invalid return value? Infinite loop? Termination? Division-by-0? Uninit stack? Out-of-bound write? Is pointer aligned? 24
25. Value Tracking
26. Attempt #1 - Naïve Approach /* Takes 2^31 GiB just to track a * single register */ struct values { char possibly_0 :1; char possibly_1 :1; char possibly_2 :1; ... } 26
27. Attempt #1 - Naïve Approach /* Takes 2^31 GiB just to track a * single register */ struct values { char possibly_0 :1; char possibly_1 :1; char possibly_2 :1; ... } 27
28. Attempt #1 - Naïve Approach struct values add_values(struct values *a, struct values *b) { if (a->possibly_0 && b->possibly_0) ret->possibly_0 = 1; if (a->possibly_0 && b->possibly_1) ret->possibly_1 = 1; if (a->possibly_1 && b->possibly_0) ret->possibly_1 = 1; /* Some bit-tricks would help, but ... */ 28
29. struct values add_values(struct values *a, struct values *b) { if (a->possibly_0 && b->possibly_0) ret->possibly_0 = 1; if (a->possibly_0 && b->possibly_1) ret->possibly_1 = 1; if (a->possibly_1 && b->possibly_0) ret->possibly_1 = 1; /* Some bit-tricks would help, but ... */ Attempt #1 - Naïve Approach 29
30. Just track min & max 30
31. Attempt #2 - Ranges 31 struct values { s64 min; s64 max; };
32. Attempt #2 - Ranges 32 struct values add_values(struct values *a, struct values *b) { /* Ignoring overflow for now */ ret->min = a->min + b->min; ret->max = a->max + b->max; }
33. Attempt #2 - Ranges struct bpf_reg_state { struct tnum var_off; s64 smin_value; s64 smax_value; ... 33
34. Attempt #2 - Ranges struct bpf_reg_state { struct tnum var_off; s64 smin_value; /* minimum possible (s64)value */ s64 smax_value; /* maximum possible (s64)value */ u64 umin_value; /* minimum possible (u64)value */ u64 umax_value; /* maximum possible (u64)value */ s32 s32_min_value; /* minimum possible (s32)value */ s32 s32_max_value; /* maximum possible (s32)value */ u32 u32_min_value; /* minimum possible (u32)value */ u32 u32_max_value; /* maximum possible (u32)value */ 34
35. What about bitwise operations? 35
36. Attempt #2 - Ranges 36 struct values xor_values(struct values *a, struct values *b) { }
37. Attempt #2 - Ranges struct values xor_values(struct values *a, struct values *b) { } ain't nobody got time for that1 1: Okay, slightly mis-quoting here as the original actually refers to calculating signed-bounds in mul/and/or 37
38. Track individual bits 38
39. 39 Each bit in the register can have three possible states: - Unknown 🠂 x - Known to be set 🠂 1 - Known to be unset 🠂 0 Attempt #3 - Bitwise Pattern
40. 40 Each bit in the register can have three possible states: - Unknown 🠂 x 🠂 {0, 1} - Known to be set 🠂 1 - Known to be unset 🠂 0 Attempt #3 - Bitwise Pattern
41. 41 { 1, 3 }
42. 42 { 0b01, 0b11 }
43. 43 { 0b01, 0b11 } 0tx1
44. 44 { 0b01, 0b11 } 0tx1
45. 45 { 0b01, 0b11 } 0tx1
46. 46 { 0b01, 0b11 } 0tx1
47. 47 { 0b01, 0b11 } 0tx1
48. 48 Abstract Concrete { 0b01, 0b11 } 0tx1
49. 49 Abstract (how we represent such set of values) Concrete (actual values used in register) { 0b01, 0b11 } 0tx1
50. 50 { 0b0…01, 0b0…11 } 0t0…x1 Abstract Concrete
51. 51 Abstract Concrete { 0b01, 0b11 } 0tx1
52. 52 Abstract Concrete { 1, 3 } 0tx1
53. 53 Abstract Concrete { 1, 3 } 0tx1 non-consecutive values (e.g. pointer alignment)
54. Limitation
55. Fuzzy 55
56. 56 Abstract Concrete { 1, 3 } 0tx1
57. 57 Abstract Concrete { 1, 3 } 0tx1
58. 58 Abstract Concrete { 1, 2 }
59. 59 Abstract Concrete { 0b01, 0b10 }
60. 60 Abstract Concrete 0txx { 0b01, 0b10 }
61. 61 Abstract Concrete 0txx { 0b01, 0b10 }
62. 62 Abstract Concrete 0txx { 0b01, 0b10 }
63. 63 Abstract Concrete 0txx { 0b01, 0b10 }
64. 64 Abstract Concrete 0txx { 0b01, 0b10 }
65. 65 Abstract Concrete 0txx { 0b01, 0b10 }
66. 66 Abstract Concrete 0txx { 0b00, 0b01, 0b10, 0b11 }
67. 67 Abstract Concrete 0txx { 0b00, 0b01, 0b10, 0b11 }
68. 68 Abstract Concrete 0txx { 0b00, 0b01, 0b10, 0b11 }
69. 69 Abstract Concrete 0txx { 0b00, 0b01, 0b10, 0b11 }
70. 70 Abstract Concrete 0txx { 0b00, 0b01, 0b10, 0b11 }
71. 71 Abstract Concrete (ideal)
72. 72 Abstract Concrete (ideal) { 1, 2 }
73. 73 Abstract Concrete (ideal) { 1, 2 } 0txx
74. 74 Abstract Concrete (ideal) { 1, 2 } 0txx Concrete (actual)
75. 75 Abstract Concrete (ideal) { 1, 2 } 0txx { 1, 2, 3, 4 } Concrete (actual)
76. 76 Abstract Concrete (ideal) { 1, 2 } 0txx { 1, 2, 3, 4 } Concrete (actual)
77. 77 Abstract Concrete (ideal) { 1, 2 } 0txx { 1, 2, 3, 4 } Concrete (actual) Fine
78. 78 Abstract Concrete (ideal) { 1, 2 } 0txx { 1, 2, 3, 4 } Concrete (actual)
79. 79 Abstract Concrete (ideal) { 1, 2 } 0txx { 1, 2, 3, 4 } Concrete (actual) Over-approximation (Static Analysis)
80. 80 Abstract Concrete (ideal) { 1, 2 } 0txx { 1, 2, 3, 4 } Concrete (actual) Fine
81. Attempt #2 - Ranges struct bpf_reg_state { struct tnum var_off; s64 smin_value; /* minimum possible (s64)value */ s64 smax_value; /* maximum possible (s64)value */ u64 umin_value; /* minimum possible (u64)value */ u64 umax_value; /* maximum possible (u64)value */ s32 s32_min_value; /* minimum possible (s32)value */ s32 s32_max_value; /* maximum possible (s32)value */ u32 u32_min_value; /* minimum possible (u32)value */ u32 u32_max_value; /* maximum possible (u32)value */ 81
82. Signess 82
83. crossing sign boundary 83
84. 84 Abstract Concrete (ideal) { -1, 0 } 0tx…xx { 0, 1, 2 .. 264-1 } Concrete (actual)
85. 85 Abstract Concrete (ideal) { -1, 0 } 0tx…xx { 0, 1, 2 .. 264-1 } Concrete (actual) Fine
86. Attempt #2 - Ranges struct bpf_reg_state { struct tnum var_off; s64 smin_value; /* minimum possible (s64)value */ s64 smax_value; /* maximum possible (s64)value */ u64 umin_value; /* minimum possible (u64)value */ u64 umax_value; /* maximum possible (u64)value */ s32 s32_min_value; /* minimum possible (s32)value */ s32 s32_max_value; /* maximum possible (s32)value */ u32 u32_min_value; /* minimum possible (u32)value */ u32 u32_max_value; /* maximum possible (u32)value */ 86
87. Can’t track nothing1 87 ∅ 1: We could make a currently unused and invalid representation of tnum (e.g. val = -1 && mask = -1) to mean an empty set, but might not be a good idea.
88. /* assume this isn’t optimized out */ if (i < 0 && i > 0) { /* never ever */ } 88
89. /* assume this isn’t optimized out */ if (i < 0 && i > 0) { /* */ } IMPOSSIBLE(*) to represent i 89
90. Just don’t follow such branch 90
91. /* compute branch direction of the expression "if * (<reg1> opcode <reg2>) goto target;" and return: * 1 - branch will be taken * 0 - branch will not be taken * -1 - unknown. Example: "if (reg1 < 5)" is unknown * when register value range [0,10] */ static int is_branch_taken(struct bpf_reg_state *reg1, struct bpf_reg_state *reg2, u8 opcode, bool is_jmp32); 91
92. static int is_scalar_branch_taken(...) { switch (opcode) { case BPF_JEQ: if (tnum_is_const(t1) && tnum_is_const(t2)) return t1.value == t2.value; ... return -1; ... 92
93. Can’t track relation 93
94. int j = i - 1; /* int i is unknown */ if (i < 1 || i > 3) return; /* From here on 1 ≤ i ≤ 3 /* with j == i - 1 we know 0 ≤ j ≤ 2 */ if (j == 4) /* never ever */ 94
95. Track relationship separately 95
96. struct bpf_reg_state { /* Upper bit of ID is used to remember relationship * between "linked" registers, e.g.: * r1 = r2; both will have r1->id == r2->id == N * r1 += 10; r1->id == N | BPF_ADD_CONST and * r1->off == 10 */ #define BPF_ADD_CONST (1U << 31) u32 id; ... 96
97. Implementation Data Structure
98. 98 Abstract Concrete { 0b01, 0b11 } 0tx1
99. 99 Abstract Concrete { 0b01, 0b11 } 0tx1 Conceptual Implementation
100. 100 struct tnum { u64 value; /* whether bits are * set/unset, if known */ u64 mask; /* which bits are * unknown */ };
101. 101 Each bit in the register can have three possible states: - Unknown 🠂 x - Known to be set 🠂 1 - Known to be unset 🠂 0
102. 102 Each bit in the register can have three possible states: - Unknown 🠂 x - Known to be set 🠂 1 (mask[] = 0, value[] = 1) - Known to be unset 🠂 0
103. 103 Each bit in the register can have three possible states: - Unknown 🠂 x - Known to be set 🠂 1 - Known to be unset 🠂 0 (mask[] = 0, value[] = 0)
104. 104 Each bit in the register can have three possible states: - Unknown 🠂 x (mask[] = 1) - Known to be set 🠂 1 - Known to be unset 🠂 0
105. 105 Each bit in the register can have three possible states: - Unknown 🠂 x (mask[] = 1, value[] = 0) - Known to be set 🠂 1 - Known to be unset 🠂 0
106. 106 Each bit in the register can have three possible states: - Unknown 🠂 x - Known to be set 🠂 1 - Known to be unset 🠂 0 - Invalid 🠂 (mask[] = 1, value[] = 1)
107. 107 Abstract Concrete { 0b01, 0b11 } 0tx1 Conceptual Implementation .mask = 0b01 .value = 0b00
108. 108 Abstract 0tx1 Conceptual Implementation .mask = 0b01 .value = 0b00 Concrete { 0b01, 0b11 }
109. 109 Abstract Conceptual Implementation .mask = 0b10 .value = 0b01 Concrete 0tx1 { 0b01, 0b11 }
110. 110 Abstract Conceptual Implementation .mask = 0b11 .value = 0b00 Concrete 0tx1 { 0b01, 0b11 }
111. 111 Abstract 0tx1 Conceptual Implementation .mask = 0b10 .value = 0b01 Concrete { 0b01, 0b11 }
112. 112 Abstract Conceptual Implementation .mask = 0b10 .value = 0b01 Concrete 0tx1 { 0b01, 0b11 }
113. 113 Abstract Conceptual Implementation .mask = 0b10 .value = 0b01 Concrete 0tx1 { 0b01, 0b11 }
114. 114 Abstract Concrete { 0b01, 0b11 } 0tx1 Conceptual Implementation .mask = 0b10 .value = 0b01
115. 115 Abstract Concrete { 1, 3 } 0tx1 Conceptual Implementation .mask = 0b10 .value = 0b01
116. Implementation Helper
117. u64 tnum_umin(struct tnum a) 117 minimum possible unsigned value in a tnum
118. a.value 118
119. 119 maximum possible unsigned value in a tnum u64 tnum_umax(struct tnum a)
120. a.value | a.mask 120
121. u64 tnum_and(struct tnum a, struct tnum b) 121 bitwise-and of two tnums
122. Crafting
123. How well do you need to know tnum? to craft an operator 123
124. Very little 124
125. u64 tnum_and(struct tnum a, struct tnum b) 125 bitwise-and of two tnums
126. 126 & 0 1 0 1 a b
127. 127 & 0 1 0 0 & 0 0 & 1 1 1 & 0 1 & 1
128. 128 & 0 1 0 0 0 1 0 1
129. 129 & 0 1 x 0 0 0 1 0 1 x
130. 130 & 0 1 x 0 0 0 1 0 1 x ?
131. 131 & 0 1 x 0 0 0 1 0 1 x
132. 132 & 0 1 x 0 0 0 1 0 1 x 0
133. 133 & 0 1 x 0 0 0 1 0 1 x 0
134. 134 & 0 1 x 0 0 0 1 0 1 x 0 {0, 1}
135. 135 & 0 1 x 0 0 0 1 0 1 x 0 x
136. 136 & 0 1 x 0 0 0 0 1 0 1 x 0 x
137. 137 & 0 1 x 0 0 0 0 1 0 1 x x 0 x
138. 138 & 0 1 x 0 0 0 0 1 0 1 x x 0 x ?
139. 139 & 0 1 x 0 0 0 0 1 0 1 x x 0 x
140. 140 & 0 1 x 0 0 0 0 1 0 1 x x 0 x {0, 1}
141. 141 & 0 1 x 0 0 0 0 1 0 1 x x 0 x x
142. 142 & 0 1 x 0 0 0 0 1 0 1 x x 0 x x
143. 143 & 0 1 x 0 0 0 0 1 0 1 x x 0 x x
144. 144 & m=0 v=0 1 x m=0 v=0 m=0 v=0 m=0 v=0 m=0 v=0 1 m=0 v=0 1 x x m=0 v=0 x x
145. 145 & m=0 v=0 1 x m=0 v=0 m=0 v=0 m=0 v=0 m=0 v=0 1 m=0 v=0 1 x x m=0 v=0 x x
146. 146 & m=0 v=0 m=0 v=1 x m=0 v=0 m=0 v=0 m=0 v=0 m=0 v=0 m=0 v=1 m=0 v=0 m=0 v=1 x x m=0 v=0 x x
147. 147 & m=0 v=0 m=0 v=1 x m=0 v=0 m=0 v=0 m=0 v=0 m=0 v=0 m=0 v=1 m=0 v=0 m=0 v=1 x x m=0 v=0 x x
148. 148 & m=0 v=0 m=0 v=1 m=1 v=0 m=0 v=0 m=0 v=0 m=0 v=0 m=0 v=0 m=0 v=1 m=0 v=0 m=0 v=1 m=1 v=0 m=1 v=0 m=0 v=0 m=1 v=0 m=1 v=0
149. 149 & m=0 v=0 m=0 v=1 m=1 v=0 m=0 v=0 v=0 v=0 v=0 m=0 v=1 v=0 v=1 v=0 m=1 v=0 v=0 v=0 v=0 & m=0 v=0 m=0 v=1 m=1 v=0 m=0 v=0 m=0 m=0 m=0 m=0 v=1 m=0 m=0 m=1 m=1 v=0 m=0 m=1 m=1
150. 150 &.v m=0 v=0 m=0 v=1 m=1 v=0 m=0 v=0 0 0 0 m=0 v=1 0 1 0 m=1 v=0 0 0 0 &.m m=0 v=0 m=0 v=1 m=1 v=0 m=0 v=0 0 0 0 m=0 v=1 0 0 1 m=1 v=0 0 1 1
151. 151 &.v m=0 v=0 m=0 v=1 m=1 v=0 m=0 v=0 0 0 0 m=0 v=1 0 1 0 m=1 v=0 0 0 0 &.m m=0 v=0 m=0 v=1 m=1 v=0 m=0 v=0 0 0 0 m=0 v=1 0 0 1 m=1 v=0 0 1 1
152. 152 &.v m=0 v=0 m=0 v=1 m=1 v=0 m=0 v=0 0 0 0 m=0 v=1 0 1 0 m=1 v=0 0 0 0
153. 153 &.v m=0 v=0 m=0 v=1 m=1 v=0 m=0 v=0 0 0 0 m=0 v=1 0 1 0 m=1 v=0 0 0 0
154. 154 &.v m=0 v=0 m=0 v=1 m=1 v=0 m=0 v=0 0 0 0 m=0 v=1 0 1 0 m=1 v=0 0 0 0 value = a.value & b.value
155. 155 &.v m=0 v=0 m=0 v=1 m=1 v=0 m=0 v=0 0 0 0 m=0 v=1 0 1 0 m=1 v=0 0 0 0 &.m m=0 v=0 m=0 v=1 m=1 v=0 m=0 v=0 0 0 0 m=0 v=1 0 0 1 m=1 v=0 0 1 1
156. 156 &.m m=0 v=0 m=0 v=1 m=1 v=0 m=0 v=0 0 0 0 m=0 v=1 0 0 1 m=1 v=0 0 1 1
157. 157 &.m m=0 v=0 m=0 v=1 m=1 v=0 m=0 v=0 0 0 0 m=0 v=1 0 0 1 m=1 v=0 0 1 1
158. 158 &.m m=0 v=0 m=0 v=1 m=1 v=0 m=0 v=0 0 0 0 m=0 v=1 0 0 1 m=1 v=0 0 1 1
159. 159 &.m m=0 v=0 m=0 v=1 m=1 v=0 m=0 v=0 0 0 0 m=0 v=1 0 0 1 m=1 v=0 0 1 1
160. 160 &.m m=0 v=0 m=0 v=1 m=1 v=0 m=0 v=0 0 0 0 m=0 v=1 0 0 1 m=1 v=0 0 1 1 mask = (a.value | a.mask) & (b.value | b.mask)
161. 161 &.m m=0 v=0 m=0 v=1 m=1 v=0 m=0 v=0 0 0 0 m=0 v=1 0 0 1 m=1 v=0 0 1 1
162. 162 &.m m=0 v=0 m=0 v=1 m=1 v=0 m=0 v=0 0 0 0 m=0 v=1 0 0 1 m=1 v=0 0 1 1 a.value & b.value
163. 163 &.m m=0 v=0 m=0 v=1 m=1 v=0 m=0 v=0 0 0 0 m=0 v=1 0 0 1 m=1 v=0 0 1 1 mask = (a.value | a.mask) & (b.value | b.mask) & ~(a.value & b.value)
164. struct tnum tnum_and(struct tnum a, struct tnum b) { u64 alpha, beta, v; alpha = a.value | a.mask; beta = b.value | b.mask; v = a.value & b.value; return TNUM(v, alpha & beta & ~v); } 164
165. struct tnum tnum_and(struct tnum a, struct tnum b) { u64 alpha, beta, v; alpha = a.value | a.mask; beta = b.value | b.mask; v = a.value & b.value; return TNUM(v, alpha & beta & ~v); } 165
166. 166 &.v m=0 v=0 m=0 v=1 m=1 v=0 m=0 v=0 0 0 0 m=0 v=1 0 1 0 m=1 v=0 0 0 0 value = a.value & b.value
167. struct tnum tnum_and(struct tnum a, struct tnum b) { u64 alpha, beta, v; alpha = a.value | a.mask; beta = b.value | b.mask; v = a.value & b.value; return TNUM(v, alpha & beta & ~v); } 167
168. struct tnum tnum_and(struct tnum a, struct tnum b) { u64 alpha, beta, v; alpha = a.value | a.mask; beta = b.value | b.mask; v = a.value & b.value; return TNUM(v, alpha & beta & ~v); } 168
169. 169 &.m m=0 v=0 m=0 v=1 m=1 v=0 m=0 v=0 0 0 0 m=0 v=1 0 0 1 m=1 v=0 0 1 1 mask = (a.value | a.mask) & (b.value | b.mask) & ~(a.value & b.value)
170. struct tnum tnum_and(struct tnum a, struct tnum b) { u64 alpha, beta, v; alpha = a.value | a.mask; beta = b.value | b.mask; v = a.value & b.value; return TNUM(v, alpha & beta & ~v); } 170
171. 171 &.m m=0 v=0 m=0 v=1 m=1 v=0 m=0 v=0 0 0 0 m=0 v=1 0 0 1 m=1 v=0 0 1 1 mask = (a.value | a.mask) & (b.value | b.mask) & ~(a.value & b.value)
172. struct tnum tnum_and(struct tnum a, struct tnum b) { u64 alpha, beta, v; alpha = a.value | a.mask; beta = b.value | b.mask; v = a.value & b.value; return TNUM(v, alpha & beta & ~v); } 172
173. 173 &.m m=0 v=0 m=0 v=1 m=1 v=0 m=0 v=0 0 0 0 m=0 v=1 0 0 1 m=1 v=0 0 1 1 mask = (a.value | a.mask) & (b.value | b.mask) & ~(a.value & b.value)
174. struct tnum tnum_and(struct tnum a, struct tnum b) { u64 alpha, beta, v; alpha = a.value | a.mask; beta = b.value | b.mask; v = a.value & b.value; return TNUM(v, alpha & beta & ~v); } 174
175. u64 tnum_and(struct tnum a, struct tnum b) 175 bitwise-and of two tnums
176. /* Return @a with lowest @size bytes * retained, and all other bits set * to equal the sign bit (which might * be unknown). */ struct tnum tnum_scast(struct tnum a, u8 size) 176
177. Usage
178. Bound-syncing 178
179. static void reg_bounds_sync(struct bpf_reg_state *reg) { /* tnum -> u64, s64, u32, s32 */ __update_reg_bounds(reg); /* u64 -> u32, s32; s64 -> u32, s32 * u64 -> s64; s64 -> u64 * u32 -> u64, s64; s32 -> u64, s64 */ __reg_deduce_bounds(reg); __reg_deduce_bounds(reg); /* 2nd time */ /* u64 -> tnum; u32 -> tnum */ __reg_bound_offset(reg); /* tnum -> u64, s64, u32, s32 */ __update_reg_bounds(reg); } 179
180. static void __update_reg64_bounds(struct bpf_reg_state *reg) { /* min signed is max(sign bit) | min(other bits) */ reg->smin_value = max_t(s64, reg->smin_value, reg->var_off.value | (reg->var_off.mask & S64_MIN)); /* max signed is min(sign bit) | max(other bits) */ reg->smax_value = min_t(s64, reg->smax_value, reg->var_off.value | (reg->var_off.mask & S64_MAX)); reg->umin_value = max(reg->umin_value, reg->var_off.value); reg->umax_value = min(reg->umax_value, reg->var_off.value | reg->var_off.mask); } 180
181. Testing
182. Does it work? 182
183. Is it correct? 183
184. Would it allow unsafe program to pass? 184
185. BPF selftests 185
186. Agni 186
187. Z3Py 187
188. Sound, Precise, and Fast Abstract Interpretation with Tristate Numbers Harishankar Vishwanathan, Matan Shachnai, Srinivas Narayana, and Santosh Nagarakatte 188
189. + + 189 Abstract Concrete { 1, 3 } 0t0x1 { 3, 5 } 0txx1 { 4, 6, 8 } 0txx0 { 2, 4, 6, 8 }
190. + + 190 Abstract Concrete { 1, 3 } 0t0x1 { 3, 5 } 0txx1 { 4, 6, 8 } 0txx0 { 2, 4, 6, 8 }
191. Would it allow unsafe program to pass? 191
192. struct tnum dont_know(struct tnum a, struct tnum b) { /* Jon Snow knows nothing */ return tnum_unknown; } 192
193. Would it reject safe program (too often)? 193
194. BPF selftests 194
195. Agni 195
196. Conclusion
197. Tracks bit pattern - Simple (maybe not intuitively easy to understand) - Can’t track min/max/sign-crossing precisely Correct operation should - Not left any possible values out (i.e. sound) - Tries to exclude as much impossible values (i.e. precise) - without introducing unnecessary complexity 197
198. Resources 198
199. • Sound, Precise, and Fast Abstract Interpretation with Tristate Numbers • Peeking into the BPF verifier • More than you want to know about BPF verifier • Value Tracking in BPF verifier • Model Checking (a very small part) of BPF Verifer 199