Record material register and outgoing stack argument changes so diagnostics can explain how a value reached its current type, bounds, or unreadable state. Store old and new register types, scalar ranges, tnum value and mask, map and BTF type identity, and basic operand metadata in the environment-owned diagnostic event stream. Record invalidations when packet data moves, references are released, or borrowed references leave their protected region. Register-scoped history starts at the latest matching modification and then shows later branch outcomes. Also record fixed stack spills and overwrites, and tag register fills from stack so register-scoped history can follow value flow through spilled stack slots. The type_is_map_ptr() helper previously lived as a static function in kernel/bpf/log.c since commit 0c95c9fdb696 ("bpf: emit map name in register state if applicable and available"). Move it verbatim to include/linux/bpf_verifier.h as a static inline, next to the other type classifiers, so diagnostics.c can reuse it without duplicating the case list.
Showing the changes to include (1 of 5 files). Show all
Unified · Split
| @@ -354,6 +354,11 @@ struct bpf_func_state { · 353 unmodified lines | |||
| 354 | * 0 = main function, 1 = first callee. | 354 | * 0 = main function, 1 = first callee. |
| 355 | */ | 355 | */ |
| 356 | u32 frameno; | 356 | u32 frameno; |
| 357 | /* | ||
| 358 | * Unique diagnostic identity for this function invocation. Frame depth is | ||
| 359 | * reused after returns, while this ID is preserved across state clones. | ||
| 360 | */ | ||
| 361 | u32 diag_frame_id; | ||
| 357 | /* subprog number == index within subprog_info | 362 | /* subprog number == index within subprog_info |
| 358 | * zero == main subprog | 363 | * zero == main subprog |
| 359 | */ | 364 | */ |
| @@ -1351,6 +1356,18 @@ static inline bool type_is_non_owning_ref(u32 type) · 991 unmodified lines | |||
| 1351 | return type_is_ptr_alloc_obj(type) && type_flag(type) & NON_OWN_REF; | 1356 | return type_is_ptr_alloc_obj(type) && type_flag(type) & NON_OWN_REF; |
| 1352 | } | 1357 | } |
| 1353 | 1358 | ||
| 1359 | static inline bool type_is_map_ptr(enum bpf_reg_type type) | ||
| 1360 | { | ||
| 1361 | switch (base_type(type)) { | ||
| 1362 | case CONST_PTR_TO_MAP: | ||
| 1363 | case PTR_TO_MAP_KEY: | ||
| 1364 | case PTR_TO_MAP_VALUE: | ||
| 1365 | return true; | ||
| 1366 | default: | ||
| 1367 | return false; | ||
| 1368 | } | ||
| 1369 | } | ||
| 1370 | |||
| 1354 | static inline bool type_is_pkt_pointer(enum bpf_reg_type type) | 1371 | static inline bool type_is_pkt_pointer(enum bpf_reg_type type) |
| 1355 | { | 1372 | { |
| 1356 | type = base_type(type); | 1373 | type = base_type(type); |