[DTrace-devel] curious backtrace

[Kris Van Hees]

On Mon, Nov 30, 2020 at 10:02:33PM -0800, david.mclean at oracle.com wrote:
> 
> Running my latest incarnation of dt_cg_agg_stddev_impl() yields a BPF 
> backtrace:
>    ...
> +BPF: 100: (77) r5 >>= 4
> +BPF: 101: frame1: R0_w=map_value(id=0,off=0,ks=4,vs=136,imm=0) R1=fp-40 
> R5_w=invP(id=0,umax_value=1152921504606846975,var_off=({ptr}; {ptr})) 
> R6_w=invP(id=0,umax_value=15,var_off=({ptr}; {ptr})) 
> R7_w=map_value(id=0,off=0,ks=4,vs=136,umin_value=8,umax_value=40,var_off=({ptr}; 
> {ptr})) R8_w=invP5000000000 
> R9_w=map_value(id=0,off=120,ks=4,vs=136,imm=0) R10=fp0 fp-40_w=fp
> +BPF: 101: (bf) r4 = r1
> +BPF: 102: frame1: R0_w=map_value(id=0,off=0,ks=4,vs=136,imm=0) R1=fp-40 
> R4_w=fp-40 R5_w=invP(id=0,umax_value=1152921504606846975,var_off=({ptr}; 
> {ptr})) R6_w=invP(id=0,umax_value=15,var_off=({ptr}; {ptr})) 
> R7_w=map_value(id=0,off=0,ks=4,vs=136,umin_value=8,umax_value=40,var_off=({ptr}; 
> {ptr})) R8_w=invP5000000000 
> R9_w=map_value(id=0,off=120,ks=4,vs=136,imm=0) R10=fp0 fp-40_w=fp
> +BPF: 102: (77) r4 >>= 60
> +BPF: R4 pointer arithmetic with >>= operator prohibited
> +BPF: verification time 518 usec
> +BPF: stack depth 56+40
> +BPF: processed 93 insns (limit 1000000) max_states_per_insn 0 
> total_states 4 peak_states 4 mark_read 3
> +dtrace: could not enable tracing: BPF program load for 'dtrace:::BEGIN' 
> failed: Permission denied
> 
> The offending line appears to be:
> BPFCODE(BPF_ALU64_IMM(BPF_RSH, nibreg, 60))
> 
> though I seem to run fine with
> BPFCODE(BPF_ALU64_IMM(BPF_RSH, accreg, 60))
> a handful of lines before.
> 
> I'll look at it with fresh eyes in the morning.

The error is: R4 pointer arithmetic with >>= operator prohibited

The instruction is: 102: (77) r4 >>= 60

You can see that r4 is R4_w=fp-40 and therefore a pointer into the stack.

You cannot perform pointer arithmetic using the >>= operator in BPF (and I
expect that you are not actually meaning to do that here anyway).