log.c

  1// SPDX-License-Identifier: GPL-2.0-only
  2/* Copyright (c) 2011-2014 PLUMgrid, http://plumgrid.com
  3 * Copyright (c) 2016 Facebook
  4 * Copyright (c) 2018 Covalent IO, Inc. http://covalent.io
  5 */
  6#include <uapi/linux/btf.h>
  7#include <linux/kernel.h>
  8#include <linux/types.h>
  9#include <linux/bpf.h>
 10#include <linux/bpf_verifier.h>
 11#include <linux/math64.h>
 12#include <linux/string.h>
 13
 14#define verbose(env, fmt, args...) bpf_verifier_log_write(env, fmt, ##args)
 15
 16static bool bpf_verifier_log_attr_valid(const struct bpf_verifier_log *log)
 17{
 18	/* ubuf and len_total should both be specified (or not) together */
 19	if (!!log->ubuf != !!log->len_total)
 20		return false;
 21	/* log buf without log_level is meaningless */
 22	if (log->ubuf && log->level == 0)
 23		return false;
 24	if (log->level & ~BPF_LOG_MASK)
 25		return false;
 26	if (log->len_total > UINT_MAX >> 2)
 27		return false;
 28	return true;
 29}
 30
 31int bpf_vlog_init(struct bpf_verifier_log *log, u32 log_level,
 32		  char __user *log_buf, u32 log_size)
 33{
 34	log->level = log_level;
 35	log->ubuf = log_buf;
 36	log->len_total = log_size;
 37
 38	/* log attributes have to be sane */
 39	if (!bpf_verifier_log_attr_valid(log))
 40		return -EINVAL;
 41
 42	return 0;
 43}
 44
 45static void bpf_vlog_update_len_max(struct bpf_verifier_log *log, u32 add_len)
 46{
 47	/* add_len includes terminal \0, so no need for +1. */
 48	u64 len = log->end_pos + add_len;
 49
 50	/* log->len_max could be larger than our current len due to
 51	 * bpf_vlog_reset() calls, so we maintain the max of any length at any
 52	 * previous point
 53	 */
 54	if (len > UINT_MAX)
 55		log->len_max = UINT_MAX;
 56	else if (len > log->len_max)
 57		log->len_max = len;
 58}
 59
 60void bpf_verifier_vlog(struct bpf_verifier_log *log, const char *fmt,
 61		       va_list args)
 62{
 63	u64 cur_pos;
 64	u32 new_n, n;
 65
 66	n = vscnprintf(log->kbuf, BPF_VERIFIER_TMP_LOG_SIZE, fmt, args);
 67
 68	if (log->level == BPF_LOG_KERNEL) {
 69		bool newline = n > 0 && log->kbuf[n - 1] == '\n';
 70
 71		pr_err("BPF: %s%s", log->kbuf, newline ? "" : "\n");
 72		return;
 73	}
 74
 75	n += 1; /* include terminating zero */
 76	bpf_vlog_update_len_max(log, n);
 77
 78	if (log->level & BPF_LOG_FIXED) {
 79		/* check if we have at least something to put into user buf */
 80		new_n = 0;
 81		if (log->end_pos < log->len_total) {
 82			new_n = min_t(u32, log->len_total - log->end_pos, n);
 83			log->kbuf[new_n - 1] = '\0';
 84		}
 85
 86		cur_pos = log->end_pos;
 87		log->end_pos += n - 1; /* don't count terminating '\0' */
 88
 89		if (log->ubuf && new_n &&
 90		    copy_to_user(log->ubuf + cur_pos, log->kbuf, new_n))
 91			goto fail;
 92	} else {
 93		u64 new_end, new_start;
 94		u32 buf_start, buf_end;
 95
 96		new_end = log->end_pos + n;
 97		if (new_end - log->start_pos >= log->len_total)
 98			new_start = new_end - log->len_total;
 99		else
100			new_start = log->start_pos;
101
102		log->start_pos = new_start;
103		log->end_pos = new_end - 1; /* don't count terminating '\0' */
104
105		if (!log->ubuf)
106			return;
107
108		new_n = min(n, log->len_total);
109		cur_pos = new_end - new_n;
110		div_u64_rem(cur_pos, log->len_total, &buf_start);
111		div_u64_rem(new_end, log->len_total, &buf_end);
112		/* new_end and buf_end are exclusive indices, so if buf_end is
113		 * exactly zero, then it actually points right to the end of
114		 * ubuf and there is no wrap around
115		 */
116		if (buf_end == 0)
117			buf_end = log->len_total;
118
119		/* if buf_start > buf_end, we wrapped around;
120		 * if buf_start == buf_end, then we fill ubuf completely; we
121		 * can't have buf_start == buf_end to mean that there is
122		 * nothing to write, because we always write at least
123		 * something, even if terminal '\0'
124		 */
125		if (buf_start < buf_end) {
126			/* message fits within contiguous chunk of ubuf */
127			if (copy_to_user(log->ubuf + buf_start,
128					 log->kbuf + n - new_n,
129					 buf_end - buf_start))
130				goto fail;
131		} else {
132			/* message wraps around the end of ubuf, copy in two chunks */
133			if (copy_to_user(log->ubuf + buf_start,
134					 log->kbuf + n - new_n,
135					 log->len_total - buf_start))
136				goto fail;
137			if (copy_to_user(log->ubuf,
138					 log->kbuf + n - buf_end,
139					 buf_end))
140				goto fail;
141		}
142	}
143
144	return;
145fail:
146	log->ubuf = NULL;
147}
148
149void bpf_vlog_reset(struct bpf_verifier_log *log, u64 new_pos)
150{
151	char zero = 0;
152	u32 pos;
153
154	if (WARN_ON_ONCE(new_pos > log->end_pos))
155		return;
156
157	if (!bpf_verifier_log_needed(log) || log->level == BPF_LOG_KERNEL)
158		return;
159
160	/* if position to which we reset is beyond current log window,
161	 * then we didn't preserve any useful content and should adjust
162	 * start_pos to end up with an empty log (start_pos == end_pos)
163	 */
164	log->end_pos = new_pos;
165	if (log->end_pos < log->start_pos)
166		log->start_pos = log->end_pos;
167
168	if (!log->ubuf)
169		return;
170
171	if (log->level & BPF_LOG_FIXED)
172		pos = log->end_pos + 1;
173	else
174		div_u64_rem(new_pos, log->len_total, &pos);
175
176	if (pos < log->len_total && put_user(zero, log->ubuf + pos))
177		log->ubuf = NULL;
178}
179
180static void bpf_vlog_reverse_kbuf(char *buf, int len)
181{
182	int i, j;
183
184	for (i = 0, j = len - 1; i < j; i++, j--)
185		swap(buf[i], buf[j]);
186}
187
188static int bpf_vlog_reverse_ubuf(struct bpf_verifier_log *log, int start, int end)
189{
190	/* we split log->kbuf into two equal parts for both ends of array */
191	int n = sizeof(log->kbuf) / 2, nn;
192	char *lbuf = log->kbuf, *rbuf = log->kbuf + n;
193
194	/* Read ubuf's section [start, end) two chunks at a time, from left
195	 * and right side; within each chunk, swap all the bytes; after that
196	 * reverse the order of lbuf and rbuf and write result back to ubuf.
197	 * This way we'll end up with swapped contents of specified
198	 * [start, end) ubuf segment.
199	 */
200	while (end - start > 1) {
201		nn = min(n, (end - start ) / 2);
202
203		if (copy_from_user(lbuf, log->ubuf + start, nn))
204			return -EFAULT;
205		if (copy_from_user(rbuf, log->ubuf + end - nn, nn))
206			return -EFAULT;
207
208		bpf_vlog_reverse_kbuf(lbuf, nn);
209		bpf_vlog_reverse_kbuf(rbuf, nn);
210
211		/* we write lbuf to the right end of ubuf, while rbuf to the
212		 * left one to end up with properly reversed overall ubuf
213		 */
214		if (copy_to_user(log->ubuf + start, rbuf, nn))
215			return -EFAULT;
216		if (copy_to_user(log->ubuf + end - nn, lbuf, nn))
217			return -EFAULT;
218
219		start += nn;
220		end -= nn;
221	}
222
223	return 0;
224}
225
226int bpf_vlog_finalize(struct bpf_verifier_log *log, u32 *log_size_actual)
227{
228	u32 sublen;
229	int err;
230
231	*log_size_actual = 0;
232	if (!log || log->level == 0 || log->level == BPF_LOG_KERNEL)
233		return 0;
234
235	if (!log->ubuf)
236		goto skip_log_rotate;
237	/* If we never truncated log, there is nothing to move around. */
238	if (log->start_pos == 0)
239		goto skip_log_rotate;
240
241	/* Otherwise we need to rotate log contents to make it start from the
242	 * buffer beginning and be a continuous zero-terminated string. Note
243	 * that if log->start_pos != 0 then we definitely filled up entire log
244	 * buffer with no gaps, and we just need to shift buffer contents to
245	 * the left by (log->start_pos % log->len_total) bytes.
246	 *
247	 * Unfortunately, user buffer could be huge and we don't want to
248	 * allocate temporary kernel memory of the same size just to shift
249	 * contents in a straightforward fashion. Instead, we'll be clever and
250	 * do in-place array rotation. This is a leetcode-style problem, which
251	 * could be solved by three rotations.
252	 *
253	 * Let's say we have log buffer that has to be shifted left by 7 bytes
254	 * (spaces and vertical bar is just for demonstrative purposes):
255	 *   E F G H I J K | A B C D
256	 *
257	 * First, we reverse entire array:
258	 *   D C B A | K J I H G F E
259	 *
260	 * Then we rotate first 4 bytes (DCBA) and separately last 7 bytes
261	 * (KJIHGFE), resulting in a properly rotated array:
262	 *   A B C D | E F G H I J K
263	 *
264	 * We'll utilize log->kbuf to read user memory chunk by chunk, swap
265	 * bytes, and write them back. Doing it byte-by-byte would be
266	 * unnecessarily inefficient. Altogether we are going to read and
267	 * write each byte twice, for total 4 memory copies between kernel and
268	 * user space.
269	 */
270
271	/* length of the chopped off part that will be the beginning;
272	 * len(ABCD) in the example above
273	 */
274	div_u64_rem(log->start_pos, log->len_total, &sublen);
275	sublen = log->len_total - sublen;
276
277	err = bpf_vlog_reverse_ubuf(log, 0, log->len_total);
278	err = err ?: bpf_vlog_reverse_ubuf(log, 0, sublen);
279	err = err ?: bpf_vlog_reverse_ubuf(log, sublen, log->len_total);
280	if (err)
281		log->ubuf = NULL;
282
283skip_log_rotate:
284	*log_size_actual = log->len_max;
285
286	/* properly initialized log has either both ubuf!=NULL and len_total>0
287	 * or ubuf==NULL and len_total==0, so if this condition doesn't hold,
288	 * we got a fault somewhere along the way, so report it back
289	 */
290	if (!!log->ubuf != !!log->len_total)
291		return -EFAULT;
292
293	/* did truncation actually happen? */
294	if (log->ubuf && log->len_max > log->len_total)
295		return -ENOSPC;
296
297	return 0;
298}
299
300/* log_level controls verbosity level of eBPF verifier.
301 * bpf_verifier_log_write() is used to dump the verification trace to the log,
302 * so the user can figure out what's wrong with the program
303 */
304__printf(2, 3) void bpf_verifier_log_write(struct bpf_verifier_env *env,
305					   const char *fmt, ...)
306{
307	va_list args;
308
309	if (!bpf_verifier_log_needed(&env->log))
310		return;
311
312	va_start(args, fmt);
313	bpf_verifier_vlog(&env->log, fmt, args);
314	va_end(args);
315}
316EXPORT_SYMBOL_GPL(bpf_verifier_log_write);
317
318__printf(2, 3) void bpf_log(struct bpf_verifier_log *log,
319			    const char *fmt, ...)
320{
321	va_list args;
322
323	if (!bpf_verifier_log_needed(log))
324		return;
325
326	va_start(args, fmt);
327	bpf_verifier_vlog(log, fmt, args);
328	va_end(args);
329}
330EXPORT_SYMBOL_GPL(bpf_log);
331
332static const struct bpf_line_info *
333find_linfo(const struct bpf_verifier_env *env, u32 insn_off)
334{
335	const struct bpf_line_info *linfo;
336	const struct bpf_prog *prog;
337	u32 nr_linfo;
338	int l, r, m;
339
340	prog = env->prog;
341	nr_linfo = prog->aux->nr_linfo;
342
343	if (!nr_linfo || insn_off >= prog->len)
344		return NULL;
345
346	linfo = prog->aux->linfo;
347	/* Loop invariant: linfo[l].insn_off <= insns_off.
348	 * linfo[0].insn_off == 0 which always satisfies above condition.
349	 * Binary search is searching for rightmost linfo entry that satisfies
350	 * the above invariant, giving us the desired record that covers given
351	 * instruction offset.
352	 */
353	l = 0;
354	r = nr_linfo - 1;
355	while (l < r) {
356		/* (r - l + 1) / 2 means we break a tie to the right, so if:
357		 * l=1, r=2, linfo[l].insn_off <= insn_off, linfo[r].insn_off > insn_off,
358		 * then m=2, we see that linfo[m].insn_off > insn_off, and so
359		 * r becomes 1 and we exit the loop with correct l==1.
360		 * If the tie was broken to the left, m=1 would end us up in
361		 * an endless loop where l and m stay at 1 and r stays at 2.
362		 */
363		m = l + (r - l + 1) / 2;
364		if (linfo[m].insn_off <= insn_off)
365			l = m;
366		else
367			r = m - 1;
368	}
369
370	return &linfo[l];
371}
372
373static const char *ltrim(const char *s)
374{
375	while (isspace(*s))
376		s++;
377
378	return s;
379}
380
381__printf(3, 4) void verbose_linfo(struct bpf_verifier_env *env,
382				  u32 insn_off,
383				  const char *prefix_fmt, ...)
384{
385	const struct bpf_line_info *linfo, *prev_linfo;
386	const struct btf *btf;
387	const char *s, *fname;
388
389	if (!bpf_verifier_log_needed(&env->log))
390		return;
391
392	prev_linfo = env->prev_linfo;
393	linfo = find_linfo(env, insn_off);
394	if (!linfo || linfo == prev_linfo)
395		return;
396
397	/* It often happens that two separate linfo records point to the same
398	 * source code line, but have differing column numbers. Given verifier
399	 * log doesn't emit column information, from user perspective we just
400	 * end up emitting the same source code line twice unnecessarily.
401	 * So instead check that previous and current linfo record point to
402	 * the same file (file_name_offs match) and the same line number, and
403	 * avoid emitting duplicated source code line in such case.
404	 */
405	if (prev_linfo && linfo->file_name_off == prev_linfo->file_name_off &&
406	    BPF_LINE_INFO_LINE_NUM(linfo->line_col) == BPF_LINE_INFO_LINE_NUM(prev_linfo->line_col))
407		return;
408
409	if (prefix_fmt) {
410		va_list args;
411
412		va_start(args, prefix_fmt);
413		bpf_verifier_vlog(&env->log, prefix_fmt, args);
414		va_end(args);
415	}
416
417	btf = env->prog->aux->btf;
418	s = ltrim(btf_name_by_offset(btf, linfo->line_off));
419	verbose(env, "%s", s); /* source code line */
420
421	s = btf_name_by_offset(btf, linfo->file_name_off);
422	/* leave only file name */
423	fname = strrchr(s, '/');
424	fname = fname ? fname + 1 : s;
425	verbose(env, " @ %s:%u\n", fname, BPF_LINE_INFO_LINE_NUM(linfo->line_col));
426
427	env->prev_linfo = linfo;
428}
429
430static const char *btf_type_name(const struct btf *btf, u32 id)
431{
432	return btf_name_by_offset(btf, btf_type_by_id(btf, id)->name_off);
433}
434
435/* string representation of 'enum bpf_reg_type'
436 *
437 * Note that reg_type_str() can not appear more than once in a single verbose()
438 * statement.
439 */
440const char *reg_type_str(struct bpf_verifier_env *env, enum bpf_reg_type type)
441{
442	char postfix[16] = {0}, prefix[64] = {0};
443	static const char * const str[] = {
444		[NOT_INIT]		= "?",
445		[SCALAR_VALUE]		= "scalar",
446		[PTR_TO_CTX]		= "ctx",
447		[CONST_PTR_TO_MAP]	= "map_ptr",
448		[PTR_TO_MAP_VALUE]	= "map_value",
449		[PTR_TO_STACK]		= "fp",
450		[PTR_TO_PACKET]		= "pkt",
451		[PTR_TO_PACKET_META]	= "pkt_meta",
452		[PTR_TO_PACKET_END]	= "pkt_end",
453		[PTR_TO_FLOW_KEYS]	= "flow_keys",
454		[PTR_TO_SOCKET]		= "sock",
455		[PTR_TO_SOCK_COMMON]	= "sock_common",
456		[PTR_TO_TCP_SOCK]	= "tcp_sock",
457		[PTR_TO_TP_BUFFER]	= "tp_buffer",
458		[PTR_TO_XDP_SOCK]	= "xdp_sock",
459		[PTR_TO_BTF_ID]		= "ptr_",
460		[PTR_TO_MEM]		= "mem",
461		[PTR_TO_ARENA]		= "arena",
462		[PTR_TO_BUF]		= "buf",
463		[PTR_TO_FUNC]		= "func",
464		[PTR_TO_INSN]		= "insn",
465		[PTR_TO_MAP_KEY]	= "map_key",
466		[CONST_PTR_TO_DYNPTR]	= "dynptr_ptr",
467	};
468
469	if (type & PTR_MAYBE_NULL) {
470		if (base_type(type) == PTR_TO_BTF_ID)
471			strscpy(postfix, "or_null_");
472		else
473			strscpy(postfix, "_or_null");
474	}
475
476	snprintf(prefix, sizeof(prefix), "%s%s%s%s%s%s%s",
477		 type & MEM_RDONLY ? "rdonly_" : "",
478		 type & MEM_RINGBUF ? "ringbuf_" : "",
479		 type & MEM_USER ? "user_" : "",
480		 type & MEM_PERCPU ? "percpu_" : "",
481		 type & MEM_RCU ? "rcu_" : "",
482		 type & PTR_UNTRUSTED ? "untrusted_" : "",
483		 type & PTR_TRUSTED ? "trusted_" : ""
484	);
485
486	snprintf(env->tmp_str_buf, TMP_STR_BUF_LEN, "%s%s%s",
487		 prefix, str[base_type(type)], postfix);
488	return env->tmp_str_buf;
489}
490
491const char *dynptr_type_str(enum bpf_dynptr_type type)
492{
493	switch (type) {
494	case BPF_DYNPTR_TYPE_LOCAL:
495		return "local";
496	case BPF_DYNPTR_TYPE_RINGBUF:
497		return "ringbuf";
498	case BPF_DYNPTR_TYPE_SKB:
499		return "skb";
500	case BPF_DYNPTR_TYPE_XDP:
501		return "xdp";
502	case BPF_DYNPTR_TYPE_SKB_META:
503		return "skb_meta";
504	case BPF_DYNPTR_TYPE_FILE:
505		return "file";
506	case BPF_DYNPTR_TYPE_INVALID:
507		return "<invalid>";
508	default:
509		WARN_ONCE(1, "unknown dynptr type %d\n", type);
510		return "<unknown>";
511	}
512}
513
514const char *iter_type_str(const struct btf *btf, u32 btf_id)
515{
516	if (!btf || btf_id == 0)
517		return "<invalid>";
518
519	/* we already validated that type is valid and has conforming name */
520	return btf_type_name(btf, btf_id) + sizeof(ITER_PREFIX) - 1;
521}
522
523const char *iter_state_str(enum bpf_iter_state state)
524{
525	switch (state) {
526	case BPF_ITER_STATE_ACTIVE:
527		return "active";
528	case BPF_ITER_STATE_DRAINED:
529		return "drained";
530	case BPF_ITER_STATE_INVALID:
531		return "<invalid>";
532	default:
533		WARN_ONCE(1, "unknown iter state %d\n", state);
534		return "<unknown>";
535	}
536}
537
538static char slot_type_char[] = {
539	[STACK_INVALID]	= '?',
540	[STACK_SPILL]	= 'r',
541	[STACK_MISC]	= 'm',
542	[STACK_ZERO]	= '0',
543	[STACK_DYNPTR]	= 'd',
544	[STACK_ITER]	= 'i',
545	[STACK_IRQ_FLAG] = 'f'
546};
547
548#define UNUM_MAX_DECIMAL U16_MAX
549#define SNUM_MAX_DECIMAL S16_MAX
550#define SNUM_MIN_DECIMAL S16_MIN
551
552static bool is_unum_decimal(u64 num)
553{
554	return num <= UNUM_MAX_DECIMAL;
555}
556
557static bool is_snum_decimal(s64 num)
558{
559	return num >= SNUM_MIN_DECIMAL && num <= SNUM_MAX_DECIMAL;
560}
561
562static void verbose_unum(struct bpf_verifier_env *env, u64 num)
563{
564	if (is_unum_decimal(num))
565		verbose(env, "%llu", num);
566	else
567		verbose(env, "%#llx", num);
568}
569
570static void verbose_snum(struct bpf_verifier_env *env, s64 num)
571{
572	if (is_snum_decimal(num))
573		verbose(env, "%lld", num);
574	else
575		verbose(env, "%#llx", num);
576}
577
578int tnum_strn(char *str, size_t size, struct tnum a)
579{
580	/* print as a constant, if tnum is fully known */
581	if (a.mask == 0) {
582		if (is_unum_decimal(a.value))
583			return snprintf(str, size, "%llu", a.value);
584		else
585			return snprintf(str, size, "%#llx", a.value);
586	}
587	return snprintf(str, size, "(%#llx; %#llx)", a.value, a.mask);
588}
589EXPORT_SYMBOL_GPL(tnum_strn);
590
591static void print_scalar_ranges(struct bpf_verifier_env *env,
592				const struct bpf_reg_state *reg,
593				const char **sep)
594{
595	/* For signed ranges, we want to unify 64-bit and 32-bit values in the
596	 * output as much as possible, but there is a bit of a complication.
597	 * If we choose to print values as decimals, this is natural to do,
598	 * because negative 64-bit and 32-bit values >= -S32_MIN have the same
599	 * representation due to sign extension. But if we choose to print
600	 * them in hex format (see is_snum_decimal()), then sign extension is
601	 * misleading.
602	 * E.g., smin=-2 and smin32=-2 are exactly the same in decimal, but in
603	 * hex they will be smin=0xfffffffffffffffe and smin32=0xfffffffe, two
604	 * very different numbers.
605	 * So we avoid sign extension if we choose to print values in hex.
606	 */
607	struct {
608		const char *name;
609		u64 val;
610		bool omit;
611	} minmaxs[] = {
612		{"smin",   reg->smin_value,         reg->smin_value == S64_MIN},
613		{"smax",   reg->smax_value,         reg->smax_value == S64_MAX},
614		{"umin",   reg->umin_value,         reg->umin_value == 0},
615		{"umax",   reg->umax_value,         reg->umax_value == U64_MAX},
616		{"smin32",
617		 is_snum_decimal((s64)reg->s32_min_value)
618			 ? (s64)reg->s32_min_value
619			 : (u32)reg->s32_min_value, reg->s32_min_value == S32_MIN},
620		{"smax32",
621		 is_snum_decimal((s64)reg->s32_max_value)
622			 ? (s64)reg->s32_max_value
623			 : (u32)reg->s32_max_value, reg->s32_max_value == S32_MAX},
624		{"umin32", reg->u32_min_value,      reg->u32_min_value == 0},
625		{"umax32", reg->u32_max_value,      reg->u32_max_value == U32_MAX},
626	}, *m1, *m2, *mend = &minmaxs[ARRAY_SIZE(minmaxs)];
627	bool neg1, neg2;
628
629	for (m1 = &minmaxs[0]; m1 < mend; m1++) {
630		if (m1->omit)
631			continue;
632
633		neg1 = m1->name[0] == 's' && (s64)m1->val < 0;
634
635		verbose(env, "%s%s=", *sep, m1->name);
636		*sep = ",";
637
638		for (m2 = m1 + 2; m2 < mend; m2 += 2) {
639			if (m2->omit || m2->val != m1->val)
640				continue;
641			/* don't mix negatives with positives */
642			neg2 = m2->name[0] == 's' && (s64)m2->val < 0;
643			if (neg2 != neg1)
644				continue;
645			m2->omit = true;
646			verbose(env, "%s=", m2->name);
647		}
648
649		if (m1->name[0] == 's')
650			verbose_snum(env, m1->val);
651		else
652			verbose_unum(env, m1->val);
653	}
654}
655
656static bool type_is_map_ptr(enum bpf_reg_type t) {
657	switch (base_type(t)) {
658	case CONST_PTR_TO_MAP:
659	case PTR_TO_MAP_KEY:
660	case PTR_TO_MAP_VALUE:
661		return true;
662	default:
663		return false;
664	}
665}
666
667/*
668 * _a stands for append, was shortened to avoid multiline statements below.
669 * This macro is used to output a comma separated list of attributes.
670 */
671#define verbose_a(fmt, ...) ({ verbose(env, "%s" fmt, sep, ##__VA_ARGS__); sep = ","; })
672
673static void print_reg_state(struct bpf_verifier_env *env,
674			    const struct bpf_func_state *state,
675			    const struct bpf_reg_state *reg)
676{
677	enum bpf_reg_type t;
678	const char *sep = "";
679
680	t = reg->type;
681	if (t == SCALAR_VALUE && reg->precise)
682		verbose(env, "P");
683	if (t == SCALAR_VALUE && tnum_is_const(reg->var_off)) {
684		verbose_snum(env, reg->var_off.value);
685		return;
686	}
687
688	verbose(env, "%s", reg_type_str(env, t));
689	if (t == PTR_TO_ARENA)
690		return;
691	if (t == PTR_TO_STACK) {
692		if (state->frameno != reg->frameno)
693			verbose(env, "[%d]", reg->frameno);
694		if (tnum_is_const(reg->var_off)) {
695			verbose_snum(env, reg->var_off.value + reg->off);
696			return;
697		}
698	}
699	if (base_type(t) == PTR_TO_BTF_ID)
700		verbose(env, "%s", btf_type_name(reg->btf, reg->btf_id));
701	verbose(env, "(");
702	if (reg->id)
703		verbose_a("id=%d", reg->id & ~BPF_ADD_CONST);
704	if (reg->id & BPF_ADD_CONST)
705		verbose(env, "%+d", reg->off);
706	if (reg->ref_obj_id)
707		verbose_a("ref_obj_id=%d", reg->ref_obj_id);
708	if (type_is_non_owning_ref(reg->type))
709		verbose_a("%s", "non_own_ref");
710	if (type_is_map_ptr(t)) {
711		if (reg->map_ptr->name[0])
712			verbose_a("map=%s", reg->map_ptr->name);
713		verbose_a("ks=%d,vs=%d",
714			  reg->map_ptr->key_size,
715			  reg->map_ptr->value_size);
716	}
717	if (t != SCALAR_VALUE && reg->off) {
718		verbose_a("off=");
719		verbose_snum(env, reg->off);
720	}
721	if (type_is_pkt_pointer(t)) {
722		verbose_a("r=");
723		verbose_unum(env, reg->range);
724	}
725	if (base_type(t) == PTR_TO_MEM) {
726		verbose_a("sz=");
727		verbose_unum(env, reg->mem_size);
728	}
729	if (t == CONST_PTR_TO_DYNPTR)
730		verbose_a("type=%s",  dynptr_type_str(reg->dynptr.type));
731	if (tnum_is_const(reg->var_off)) {
732		/* a pointer register with fixed offset */
733		if (reg->var_off.value) {
734			verbose_a("imm=");
735			verbose_snum(env, reg->var_off.value);
736		}
737	} else {
738		print_scalar_ranges(env, reg, &sep);
739		if (!tnum_is_unknown(reg->var_off)) {
740			char tn_buf[48];
741
742			tnum_strn(tn_buf, sizeof(tn_buf), reg->var_off);
743			verbose_a("var_off=%s", tn_buf);
744		}
745	}
746	verbose(env, ")");
747}
748
749void print_verifier_state(struct bpf_verifier_env *env, const struct bpf_verifier_state *vstate,
750			  u32 frameno, bool print_all)
751{
752	const struct bpf_func_state *state = vstate->frame[frameno];
753	const struct bpf_reg_state *reg;
754	int i;
755
756	if (state->frameno)
757		verbose(env, " frame%d:", state->frameno);
758	for (i = 0; i < MAX_BPF_REG; i++) {
759		reg = &state->regs[i];
760		if (reg->type == NOT_INIT)
761			continue;
762		if (!print_all && !reg_scratched(env, i))
763			continue;
764		verbose(env, " R%d", i);
765		verbose(env, "=");
766		print_reg_state(env, state, reg);
767	}
768	for (i = 0; i < state->allocated_stack / BPF_REG_SIZE; i++) {
769		char types_buf[BPF_REG_SIZE + 1];
770		const char *sep = "";
771		bool valid = false;
772		u8 slot_type;
773		int j;
774
775		if (!print_all && !stack_slot_scratched(env, i))
776			continue;
777
778		for (j = 0; j < BPF_REG_SIZE; j++) {
779			slot_type = state->stack[i].slot_type[j];
780			if (slot_type != STACK_INVALID)
781				valid = true;
782			types_buf[j] = slot_type_char[slot_type];
783		}
784		types_buf[BPF_REG_SIZE] = 0;
785		if (!valid)
786			continue;
787
788		reg = &state->stack[i].spilled_ptr;
789		switch (state->stack[i].slot_type[BPF_REG_SIZE - 1]) {
790		case STACK_SPILL:
791			/* print MISC/ZERO/INVALID slots above subreg spill */
792			for (j = 0; j < BPF_REG_SIZE; j++)
793				if (state->stack[i].slot_type[j] == STACK_SPILL)
794					break;
795			types_buf[j] = '\0';
796
797			verbose(env, " fp%d=%s", (-i - 1) * BPF_REG_SIZE, types_buf);
798			print_reg_state(env, state, reg);
799			break;
800		case STACK_DYNPTR:
801			/* skip to main dynptr slot */
802			i += BPF_DYNPTR_NR_SLOTS - 1;
803			reg = &state->stack[i].spilled_ptr;
804
805			verbose(env, " fp%d", (-i - 1) * BPF_REG_SIZE);
806			verbose(env, "=dynptr_%s(", dynptr_type_str(reg->dynptr.type));
807			if (reg->id)
808				verbose_a("id=%d", reg->id);
809			if (reg->ref_obj_id)
810				verbose_a("ref_id=%d", reg->ref_obj_id);
811			if (reg->dynptr_id)
812				verbose_a("dynptr_id=%d", reg->dynptr_id);
813			verbose(env, ")");
814			break;
815		case STACK_ITER:
816			/* only main slot has ref_obj_id set; skip others */
817			if (!reg->ref_obj_id)
818				continue;
819
820			verbose(env, " fp%d=iter_%s(ref_id=%d,state=%s,depth=%u)",
821				(-i - 1) * BPF_REG_SIZE,
822				iter_type_str(reg->iter.btf, reg->iter.btf_id),
823				reg->ref_obj_id, iter_state_str(reg->iter.state),
824				reg->iter.depth);
825			break;
826		case STACK_MISC:
827		case STACK_ZERO:
828		default:
829			verbose(env, " fp%d=%s", (-i - 1) * BPF_REG_SIZE, types_buf);
830			break;
831		}
832	}
833	if (vstate->acquired_refs && vstate->refs[0].id) {
834		verbose(env, " refs=%d", vstate->refs[0].id);
835		for (i = 1; i < vstate->acquired_refs; i++)
836			if (vstate->refs[i].id)
837				verbose(env, ",%d", vstate->refs[i].id);
838	}
839	if (state->in_callback_fn)
840		verbose(env, " cb");
841	if (state->in_async_callback_fn)
842		verbose(env, " async_cb");
843	verbose(env, "\n");
844	if (!print_all)
845		mark_verifier_state_clean(env);
846}
847
848static inline u32 vlog_alignment(u32 pos)
849{
850	return round_up(max(pos + BPF_LOG_MIN_ALIGNMENT / 2, BPF_LOG_ALIGNMENT),
851			BPF_LOG_MIN_ALIGNMENT) - pos - 1;
852}
853
854void print_insn_state(struct bpf_verifier_env *env, const struct bpf_verifier_state *vstate,
855		      u32 frameno)
856{
857	if (env->prev_log_pos && env->prev_log_pos == env->log.end_pos) {
858		/* remove new line character */
859		bpf_vlog_reset(&env->log, env->prev_log_pos - 1);
860		verbose(env, "%*c;", vlog_alignment(env->prev_insn_print_pos), ' ');
861	} else {
862		verbose(env, "%d:", env->insn_idx);
863	}
864	print_verifier_state(env, vstate, frameno, false);
865}