Parse value expressions printed on separate lines

Verifier in some cases may print information about known values
separately from the relevant instruciton, for example:

    100: (85) call bpf_ringbuf_reserve#131
    101: frame1: R0=ringbuf_mem_or_null(id=5,ref_obj_id=5,sz=196) refs=5
    101: (bf) r7 = r0                     ; frame1: R0=ringbuf_mem_or_null(id=5,ref_obj_id=5,sz=196) R7_w=ringbuf_mem_or_null(id=5,ref_obj_id=5,sz=196) refs=5

Note that second line contains state produced by instrcution at 100.

Implement parsing these messages and incorporating the information
from them in the computed array of BpfState objects.

Author: theihor

src/analyzer.test.ts

@@ -563,4 +563,42 @@ Func#123 ('my_global_func') is global and assumed valid.
       });
     });
   });
+
+  describe("takes into accout BPF_STATE_EXPRS messages", () => {
+    const rawLog = `
+96: (18) r1 = 0xffff888370cf0a00      ; frame1: R1_w=map_ptr(map=bpfj_log_map,ks=0,vs=0)
+98: (b7) r2 = 196                     ; frame1: R2_w=196
+99: (b7) r3 = 0                       ; frame1: R3_w=0
+100: (85) call bpf_ringbuf_reserve#131
+101: frame1: R0=ringbuf_mem_or_null(id=5,ref_obj_id=5,sz=196) refs=5
+101: (bf) r7 = r0                     ; frame1: R0=ringbuf_mem_or_null(id=5,ref_obj_id=5,sz=196) R7_w=ringbuf_mem_or_null(id=5,ref_obj_id=5,sz=196) refs=5
+`;
+    const { bpfStates } = getVerifierLogState(rawLog);
+    const val = "ringbuf_mem_or_null(id=5,ref_obj_id=5,sz=196)";
+    it("call bpf_ringbuf_reserve#131 contains state from the next log line", () => {
+      const s = bpfStates[3];
+      expect(s.idx).toBe(3);
+      expect(s.pc).toBe(100);
+      expect(s.values.get("r0")).toMatchObject({
+        value: val,
+        effect: Effect.WRITE,
+      });
+    });
+
+    it("101: (bf) r7 = r0 depends on the call", () => {
+      const s = bpfStates[5];
+      expect(s.idx).toBe(5);
+      expect(s.pc).toBe(101);
+      expect(s.values.get("r0")).toMatchObject({
+        value: val,
+        effect: Effect.READ,
+      });
+      expect(s.values.get("r7")).toMatchObject({
+        value: val,
+        effect: Effect.WRITE,
+      });
+      expect(s.lastKnownWrites.get("r0")).toBe(3);
+      expect(s.lastKnownWrites.get("r7")).toBe(5);
+    });
+  });
 });

src/analyzer.ts

@@ -11,7 +11,10 @@ import {
   getCLineId,
   KnownMessageInfoType,
   GlobalFuncValidInfo,
+  InstructionLine,
+  BpfStateExprsInfo,
 } from "./parser";
+import { siblingInsLine } from "./utils";
 
 export type BpfValue = {
   value: string;
@@ -293,6 +296,20 @@ function updateGlobalFuncCall(callLine: ParsedLine, info: GlobalFuncValidInfo) {
   ins.writes = ["r0", ...BPF_SCRATCH_REGS];
 }
 
+function updatePrevInsBpfState(
+  lines: ParsedLine[],
+  info: BpfStateExprsInfo,
+  idx: number,
+) {
+  // the heuristic for BPF_STATE_EXPRS messages is to append
+  // the exprs to the state of the _previous_ instruction
+  const prevIdx = siblingInsLine(lines, idx, -1);
+  if (prevIdx < idx) {
+    const prevLine = <InstructionLine>lines[prevIdx];
+    prevLine.bpfStateExprs.push(...info.bpfStateExprs);
+  }
+}
+
 export function processRawLines(rawLines: string[]): VerifierLogState {
   let bpfStates: BpfState[] = [];
   let lines: ParsedLine[] = [];
@@ -322,12 +339,12 @@ export function processRawLines(rawLines: string[]): VerifierLogState {
   // Process known messages and fixup parsed lines
   knownMessageIdxs.forEach((idx) => {
     const parsedLine = lines[idx];
-    if (
-      idx > 0 &&
-      parsedLine.type === ParsedLineType.KNOWN_MESSAGE &&
-      parsedLine.info.type == KnownMessageInfoType.GLOBAL_FUNC_VALID
-    ) {
-      updateGlobalFuncCall(lines[idx - 1], parsedLine.info);
+    if (parsedLine.type !== ParsedLineType.KNOWN_MESSAGE) return;
+    const info = parsedLine.info;
+    if (info.type === KnownMessageInfoType.GLOBAL_FUNC_VALID && idx > 0) {
+      updateGlobalFuncCall(lines[idx - 1], info);
+    } else if (info.type === KnownMessageInfoType.BPF_STATE_EXPRS) {
+      updatePrevInsBpfState(lines, info, idx);
     }
   });
 

src/parser.test.ts

@@ -16,7 +16,7 @@ import {
 } from "./parser";
 
 const AluInstructionSample = "0: (b7) r2 = 1                        ; R2_w=1";
-const BPFStateExprSample = "; R2_w=1 R10=fp0 fp-24_w=1";
+const BPFStateExprSample = "R2_w=1 R10=fp0 fp-24_w=1";
 const MemoryWriteSample = "1: (7b) *(u64 *)(r10 -24) = r2" + BPFStateExprSample;
 const CallInstructionSample = "7: (85) call bpf_probe_read_user#112";
 const AddrSpaceCastSample1 =

src/parser.ts

@@ -221,6 +221,7 @@ export type CSourceLine = {
 
 export enum KnownMessageInfoType {
   GLOBAL_FUNC_VALID = "GLOBAL_FUNC_VALID",
+  BPF_STATE_EXPRS = "BPF_STATE_EXPRS",
 }
 
 export type GlobalFuncValidInfo = {
@@ -229,7 +230,13 @@ export type GlobalFuncValidInfo = {
   funcName: string;
 };
 
-export type KnownMessageInfo = GlobalFuncValidInfo;
+export type BpfStateExprsInfo = {
+  type: KnownMessageInfoType.BPF_STATE_EXPRS;
+  pc: number;
+  bpfStateExprs: BpfStateExpr[];
+};
+
+export type KnownMessageInfo = BpfStateExprsInfo | GlobalFuncValidInfo;
 
 export type KnownMessageLine = {
   type: ParsedLineType.KNOWN_MESSAGE;
@@ -247,11 +254,67 @@ type BpfStateExpr = {
   value: string;
   rawKey: string;
   frame?: number;
+  pc?: number;
 };
 
 export const BPF_SCRATCH_REGS = ["r1", "r2", "r3", "r4", "r5"];
 export const BPF_CALLEE_SAVED_REGS = ["r6", "r7", "r8", "r9"];
 
+const RE_WHITESPACE = /^\s+/;
+const RE_PROGRAM_COUNTER = /^([0-9]+):/;
+const RE_BPF_OPCODE = /^\(([0-9a-f][0-9a-f])\)/;
+const RE_REGISTER = /^(r10|r[0-9]|w[0-9])/;
+const RE_MEMORY_REF = /^\*\((u8|u16|u32|u64) \*\)\((r10|r[0-9]) ([+-][0-9]+)\)/;
+const RE_IMM_VALUE = /^(0x[0-9a-f]+|[+-]?[0-9]+)/;
+const RE_CALL_TARGET = /^call ([0-9a-z_#+-]+)/;
+const RE_GOTO_OP = /^((?:may_)?goto|goto_or_nop) (pc[+-][0-9]+)/;
+const RE_FRAME_ID = /^frame([0-9]+): /;
+const RE_ADDR_SPACE_CAST =
+  /^(r[0-9]) = addr_space_cast\((r[0-9]), ([0-9]+, [0-9]+)\)/;
+const RE_C_SOURCE_LINE = /^;\s*(.*) @ ([a-zA-Z0-9_\-.]+):([0-9]+)/;
+
+const BPF_ALU_OPERATORS = [
+  "s>>=",
+  "s<<=",
+  "<<=",
+  ">>=",
+  "+=",
+  "-=",
+  "*=",
+  "/=",
+  "%=",
+  "&=",
+  "|=",
+  "^=",
+  "=",
+];
+const BPF_COND_OPERATORS = [
+  "s>=",
+  "s<=",
+  "==",
+  "!=",
+  "<=",
+  ">=",
+  "s<",
+  "s>",
+  "<",
+  ">",
+];
+
+function parseProgramCounter(str: string): { pc: number | null; rest: string } {
+  const { match, rest } = consumeRegex(RE_PROGRAM_COUNTER, str);
+  if (match)
+    return {
+      pc: parseInt(match[1], 10),
+      rest,
+    };
+  else
+    return {
+      pc: null,
+      rest: str,
+    };
+}
+
 const parseBpfStateExpr = (
   str: string,
 ): { expr: BpfStateExpr; rest: string } | undefined => {
@@ -285,10 +348,9 @@ const parseBpfStateExpr = (
 export const parseBpfStateExprs = (
   str: string,
 ): { exprs: BpfStateExpr[]; rest: string } => {
-  let { match, rest } = consumeString("; ", str);
-  if (!match) return { exprs: [], rest: str };
+  let { pc, rest } = parseProgramCounter(str);
 
-  let frame = consumeRegex(RE_FRAME_ID, rest);
+  let frame = consumeRegex(RE_FRAME_ID, consumeSpaces(rest));
   let frameId = 0;
   if (frame.match) {
     frameId = parseInt(frame.match[1], 10);
@@ -301,52 +363,12 @@ export const parseBpfStateExprs = (
     if (!parsed) break;
     rest = consumeSpaces(parsed.rest);
     parsed.expr.frame = frameId;
+    if (pc) parsed.expr.pc = pc;
     exprs.push(parsed.expr);
   }
   return { exprs, rest };
 };
 
-const RE_WHITESPACE = /^\s+/;
-const RE_PROGRAM_COUNTER = /^([0-9]+):/;
-const RE_BPF_OPCODE = /^\(([0-9a-f][0-9a-f])\)/;
-const RE_REGISTER = /^(r10|r[0-9]|w[0-9])/;
-const RE_MEMORY_REF = /^\*\((u8|u16|u32|u64) \*\)\((r10|r[0-9]) ([+-][0-9]+)\)/;
-const RE_IMM_VALUE = /^(0x[0-9a-f]+|[+-]?[0-9]+)/;
-const RE_CALL_TARGET = /^call ([0-9a-z_#+-]+)/;
-const RE_GOTO_OP = /^((?:may_)?goto|goto_or_nop) (pc[+-][0-9]+)/;
-const RE_FRAME_ID = /^frame([0-9]+): /;
-const RE_ADDR_SPACE_CAST =
-  /^(r[0-9]) = addr_space_cast\((r[0-9]), ([0-9]+, [0-9]+)\)/;
-const RE_C_SOURCE_LINE = /^;\s*(.*) @ ([a-zA-Z0-9_\-.]+):([0-9]+)/;
-
-const BPF_ALU_OPERATORS = [
-  "s>>=",
-  "s<<=",
-  "<<=",
-  ">>=",
-  "+=",
-  "-=",
-  "*=",
-  "/=",
-  "%=",
-  "&=",
-  "|=",
-  "^=",
-  "=",
-];
-const BPF_COND_OPERATORS = [
-  "s>=",
-  "s<=",
-  "==",
-  "!=",
-  "<=",
-  ">=",
-  "s<",
-  "s>",
-  "<",
-  ">",
-];
-
 function consumeRegex(
   regex: RegExp,
   str: string,
@@ -820,18 +842,15 @@ function parseBpfInstruction(
   rawLine: string,
   idx: number,
 ): InstructionLine | null {
-  let { match, rest } = consumeRegex(
-    RE_PROGRAM_COUNTER,
-    consumeSpaces(rawLine),
-  );
-  if (!match) return null;
+  let { pc, rest } = parseProgramCounter(consumeSpaces(rawLine));
+  if (pc === null) return null;
 
-  const pc = parseInt(match[1], 10);
   const parsedIns = parseOpcodeIns(consumeSpaces(rest), pc);
   if (!parsedIns.ins) return null;
 
   const ins = parsedIns.ins;
   rest = consumeSpaces(parsedIns.rest);
+  rest = consumeString("; ", rest).rest;
   const { exprs } = parseBpfStateExprs(rest);
   return {
     type: ParsedLineType.INSTRUCTION,
@@ -845,21 +864,41 @@ function parseBpfInstruction(
 const RE_MSG_GLOBAL_FUNC_VALID =
   /^Func#([-0-9]+) \('(.+)'\) is global and assumed valid\./;
 
+function parseGlobalFuncValidMessage(str: string): GlobalFuncValidInfo | null {
+  let { match } = consumeRegex(RE_MSG_GLOBAL_FUNC_VALID, str);
+  if (!match) return null;
+  return {
+    type: KnownMessageInfoType.GLOBAL_FUNC_VALID,
+    funcId: parseInt(match[1], 10),
+    funcName: match[2],
+  };
+}
+
+function parseExprsOnly(str: string): BpfStateExprsInfo | null {
+  let { pc, rest } = parseProgramCounter(consumeSpaces(str));
+  if (pc === null) return null;
+  rest = consumeSpaces(rest);
+  const { exprs } = parseBpfStateExprs(rest);
+  return {
+    type: KnownMessageInfoType.BPF_STATE_EXPRS,
+    bpfStateExprs: exprs,
+    pc,
+  };
+}
+
 function parseKnownMessage(
   rawLine: string,
   idx: number,
 ): KnownMessageLine | null {
-  let { match } = consumeRegex(RE_MSG_GLOBAL_FUNC_VALID, rawLine);
-  if (!match) return null;
+  let info: KnownMessageInfo | null;
+  info = parseGlobalFuncValidMessage(rawLine);
+  if (!info) info = parseExprsOnly(rawLine);
+  if (!info) return null;
   return {
     type: ParsedLineType.KNOWN_MESSAGE,
     idx,
     raw: rawLine,
-    info: {
-      type: KnownMessageInfoType.GLOBAL_FUNC_VALID,
-      funcId: parseInt(match[1], 10),
-      funcName: match[2],
-    },
+    info,
   };
 }