diff mbox series

[bpf,v3,10/11] bpf: keep track of max number of bpf_loop callback iterations

Message ID 20231120225945.11741-11-eddyz87@gmail.com (mailing list archive)
State Superseded
Delegated to: BPF
Headers show
Series verify callbacks as if they are called unknown number of times | expand

Checks

Context Check Description
bpf/vmtest-bpf-PR fail PR summary
bpf/vmtest-bpf-VM_Test-30 fail Logs for x86_64-llvm-16 / test (test_progs, false, 360) / test_progs on x86_64 with llvm-16
bpf/vmtest-bpf-VM_Test-31 fail Logs for x86_64-llvm-16 / test (test_progs_no_alu32, false, 360) / test_progs_no_alu32 on x86_64 with llvm-16
bpf/vmtest-bpf-VM_Test-32 success Logs for x86_64-llvm-16 / test (test_verifier, false, 360) / test_verifier on x86_64 with llvm-16
bpf/vmtest-bpf-VM_Test-33 success Logs for x86_64-llvm-16 / veristat
bpf/vmtest-bpf-VM_Test-1 success Logs for ShellCheck
bpf/vmtest-bpf-VM_Test-0 success Logs for Lint
bpf/vmtest-bpf-VM_Test-2 success Logs for Validate matrix.py
bpf/vmtest-bpf-VM_Test-8 success Logs for aarch64-gcc / veristat
bpf/vmtest-bpf-VM_Test-3 success Logs for aarch64-gcc / build / build for aarch64 with gcc
bpf/vmtest-bpf-VM_Test-7 success Logs for aarch64-gcc / test (test_verifier, false, 360) / test_verifier on aarch64 with gcc
bpf/vmtest-bpf-VM_Test-6 success Logs for aarch64-gcc / test (test_progs_no_alu32, false, 360) / test_progs_no_alu32 on aarch64 with gcc
bpf/vmtest-bpf-VM_Test-4 success Logs for aarch64-gcc / test (test_maps, false, 360) / test_maps on aarch64 with gcc
bpf/vmtest-bpf-VM_Test-5 success Logs for aarch64-gcc / test (test_progs, false, 360) / test_progs on aarch64 with gcc
bpf/vmtest-bpf-VM_Test-9 success Logs for s390x-gcc / build / build for s390x with gcc
bpf/vmtest-bpf-VM_Test-14 success Logs for s390x-gcc / veristat
bpf/vmtest-bpf-VM_Test-15 success Logs for set-matrix
bpf/vmtest-bpf-VM_Test-16 success Logs for x86_64-gcc / build / build for x86_64 with gcc
bpf/vmtest-bpf-VM_Test-17 success Logs for x86_64-gcc / test (test_maps, false, 360) / test_maps on x86_64 with gcc
bpf/vmtest-bpf-VM_Test-18 fail Logs for x86_64-gcc / test (test_progs, false, 360) / test_progs on x86_64 with gcc
bpf/vmtest-bpf-VM_Test-19 success Logs for x86_64-gcc / test (test_progs_no_alu32, false, 360) / test_progs_no_alu32 on x86_64 with gcc
bpf/vmtest-bpf-VM_Test-20 success Logs for x86_64-gcc / test (test_progs_no_alu32_parallel, true, 30) / test_progs_no_alu32_parallel on x86_64 with gcc
bpf/vmtest-bpf-VM_Test-21 success Logs for x86_64-gcc / test (test_progs_parallel, true, 30) / test_progs_parallel on x86_64 with gcc
bpf/vmtest-bpf-VM_Test-22 success Logs for x86_64-gcc / test (test_verifier, false, 360) / test_verifier on x86_64 with gcc
bpf/vmtest-bpf-VM_Test-23 success Logs for x86_64-gcc / veristat / veristat on x86_64 with gcc
bpf/vmtest-bpf-VM_Test-24 success Logs for x86_64-llvm-16 / build / build for x86_64 with llvm-16
bpf/vmtest-bpf-VM_Test-25 success Logs for x86_64-llvm-16 / test (test_maps, false, 360) / test_maps on x86_64 with llvm-16
bpf/vmtest-bpf-VM_Test-26 success Logs for x86_64-llvm-16 / test (test_progs, false, 360) / test_progs on x86_64 with llvm-16
bpf/vmtest-bpf-VM_Test-27 success Logs for x86_64-llvm-16 / test (test_progs_no_alu32, false, 360) / test_progs_no_alu32 on x86_64 with llvm-16
bpf/vmtest-bpf-VM_Test-28 success Logs for x86_64-llvm-16 / test (test_verifier, false, 360) / test_verifier on x86_64 with llvm-16
bpf/vmtest-bpf-VM_Test-29 success Logs for x86_64-llvm-16 / veristat
bpf/vmtest-bpf-VM_Test-13 success Logs for s390x-gcc / test (test_verifier, false, 360) / test_verifier on s390x with gcc
bpf/vmtest-bpf-VM_Test-11 success Logs for s390x-gcc / test (test_progs, false, 360) / test_progs on s390x with gcc
bpf/vmtest-bpf-VM_Test-12 success Logs for s390x-gcc / test (test_progs_no_alu32, false, 360) / test_progs_no_alu32 on s390x with gcc
bpf/vmtest-bpf-VM_Test-10 success Logs for s390x-gcc / test (test_maps, false, 360) / test_maps on s390x with gcc
netdev/series_format success Posting correctly formatted
netdev/codegen success Generated files up to date
netdev/tree_selection success Clearly marked for bpf, async
netdev/fixes_present fail Series targets non-next tree, but doesn't contain any Fixes tags
netdev/header_inline success No static functions without inline keyword in header files
netdev/build_32bit success Errors and warnings before: 1190 this patch: 1190
netdev/cc_maintainers warning 9 maintainers not CCed: mykolal@fb.com song@kernel.org haoluo@google.com linux-kselftest@vger.kernel.org jolsa@kernel.org kpsingh@kernel.org john.fastabend@gmail.com shuah@kernel.org sdf@google.com
netdev/build_clang success Errors and warnings before: 1155 this patch: 1155
netdev/verify_signedoff success Signed-off-by tag matches author and committer
netdev/deprecated_api success None detected
netdev/check_selftest success No net selftest shell script
netdev/verify_fixes success No Fixes tag
netdev/build_allmodconfig_warn success Errors and warnings before: 1217 this patch: 1217
netdev/checkpatch warning WARNING: line length of 81 exceeds 80 columns WARNING: line length of 82 exceeds 80 columns WARNING: line length of 83 exceeds 80 columns WARNING: line length of 85 exceeds 80 columns WARNING: line length of 90 exceeds 80 columns
netdev/build_clang_rust success No Rust files in patch. Skipping build
netdev/kdoc success Errors and warnings before: 0 this patch: 0
netdev/source_inline success Was 0 now: 0

Commit Message

Eduard Zingerman Nov. 20, 2023, 10:59 p.m. UTC 
In some cases verifier can't infer convergence of the bpf_loop()
iteration. E.g. for the following program:

    static int cb(__u32 idx, struct num_context* ctx)
    {
        ctx->i++;
        return 0;
    }

    SEC("?raw_tp")
    int prog(void *_)
    {
        struct num_context ctx = { .i = 0 };
        __u8 choice_arr[2] = { 0, 1 };

        bpf_loop(2, cb, &ctx, 0);
        return choice_arr[ctx.i];
    }

Each 'cb' simulation would eventually return to 'prog' and reach
'return choice_arr[ctx.i]' statement. At which point ctx.i would be
marked precise, thus forcing verifier to track multitude of separate
states with {.i=0}, {.i=1}, ... at bpf_loop() callback entry.

This commit allows "brute force" handling for such cases by limiting
number of callback body simulations using 'umax' value of the first
bpf_loop() parameter.

For this, extend bpf_func_state with 'callback_depth' field.
Increment this field when callback visiting state is pushed to states
traversal stack. For frame #N it's 'callback_depth' field counts how
many times callback with frame depth N+1 had been executed.
Use bpf_func_state specifically to allow independent tracking of
callback depths when multiple nested bpf_loop() calls are present.

Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
---
 include/linux/bpf_verifier.h                  | 11 ++++++
 kernel/bpf/verifier.c                         | 17 +++++++--
 .../bpf/progs/verifier_subprog_precision.c    | 35 +++++++++++++------
 3 files changed, 51 insertions(+), 12 deletions(-)

Comments

Andrii Nakryiko Nov. 21, 2023, 1:04 a.m. UTC | #1 
On Mon, Nov 20, 2023 at 3:00 PM Eduard Zingerman <eddyz87@gmail.com> wrote:
>
> In some cases verifier can't infer convergence of the bpf_loop()
> iteration. E.g. for the following program:
>
>     static int cb(__u32 idx, struct num_context* ctx)
>     {
>         ctx->i++;
>         return 0;
>     }
>
>     SEC("?raw_tp")
>     int prog(void *_)
>     {
>         struct num_context ctx = { .i = 0 };
>         __u8 choice_arr[2] = { 0, 1 };
>
>         bpf_loop(2, cb, &ctx, 0);
>         return choice_arr[ctx.i];
>     }
>
> Each 'cb' simulation would eventually return to 'prog' and reach
> 'return choice_arr[ctx.i]' statement. At which point ctx.i would be
> marked precise, thus forcing verifier to track multitude of separate
> states with {.i=0}, {.i=1}, ... at bpf_loop() callback entry.
>
> This commit allows "brute force" handling for such cases by limiting
> number of callback body simulations using 'umax' value of the first
> bpf_loop() parameter.
>
> For this, extend bpf_func_state with 'callback_depth' field.
> Increment this field when callback visiting state is pushed to states
> traversal stack. For frame #N it's 'callback_depth' field counts how
> many times callback with frame depth N+1 had been executed.
> Use bpf_func_state specifically to allow independent tracking of
> callback depths when multiple nested bpf_loop() calls are present.
>
> Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
> ---
>  include/linux/bpf_verifier.h                  | 11 ++++++
>  kernel/bpf/verifier.c                         | 17 +++++++--
>  .../bpf/progs/verifier_subprog_precision.c    | 35 +++++++++++++------
>  3 files changed, 51 insertions(+), 12 deletions(-)
>
> diff --git a/include/linux/bpf_verifier.h b/include/linux/bpf_verifier.h
> index 6e21d74a64e7..9ed6672534c7 100644
> --- a/include/linux/bpf_verifier.h
> +++ b/include/linux/bpf_verifier.h
> @@ -301,6 +301,17 @@ struct bpf_func_state {
>         struct tnum callback_ret_range;
>         bool in_async_callback_fn;
>         bool in_exception_callback_fn;
> +       /* For callback calling functions that limit number of possible
> +        * callback executions (e.g. bpf_loop) keeps track of current
> +        * simulated iteration number.
> +        * Value in frame N refers to number of times callback with frame
> +        * N+1 was simulated, e.g. for the following call:
> +        *
> +        *   bpf_loop(..., fn, ...); | suppose current frame is N
> +        *                           | fn would be simulated in frame N+1
> +        *                           | number of simulations is tracked in frame N
> +        */
> +       u32 callback_depth;
>
>         /* The following fields should be last. See copy_func_state() */
>         int acquired_refs;
> diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> index 004de7c32bae..37d8c22c292a 100644
> --- a/kernel/bpf/verifier.c
> +++ b/kernel/bpf/verifier.c
> @@ -9505,6 +9505,8 @@ static int push_callback_call(struct bpf_verifier_env *env, struct bpf_insn *ins
>                 return err;
>
>         callback_state->cumulative_callback_depth++;
> +       callback_state->frame[callback_state->curframe - 1]->callback_depth++;
> +       caller->callback_depth = 0;
>         return 0;
>  }
>
> @@ -10309,8 +10311,19 @@ static int check_helper_call(struct bpf_verifier_env *env, struct bpf_insn *insn
>                 break;
>         case BPF_FUNC_loop:
>                 update_loop_inline_state(env, meta.subprogno);
> -               err = push_callback_call(env, insn, insn_idx, meta.subprogno,
> -                                        set_loop_callback_state);
> +               /* Verifier relies on R1 value to determine if bpf_loop() iteration
> +                * is finished, thus mark it precise.
> +                */
> +               mark_chain_precision(env, BPF_REG_1);

huh? What about error handling?

> +               if (cur_func(env)->callback_depth < regs[BPF_REG_1].umax_value) {
> +                       err = push_callback_call(env, insn, insn_idx, meta.subprogno,
> +                                                set_loop_callback_state);
> +               } else {
> +                       cur_func(env)->callback_depth = 0;
> +                       if (env->log.level & BPF_LOG_LEVEL2)
> +                               verbose(env, "frame%d bpf_loop iteration limit reached\n",
> +                                       env->cur_state->curframe);
> +               }
>                 break;
>         case BPF_FUNC_dynptr_from_mem:
>                 if (regs[BPF_REG_1].type != PTR_TO_MAP_VALUE) {
> diff --git a/tools/testing/selftests/bpf/progs/verifier_subprog_precision.c b/tools/testing/selftests/bpf/progs/verifier_subprog_precision.c
> index da803cffb5ef..f61d623b1ce8 100644
> --- a/tools/testing/selftests/bpf/progs/verifier_subprog_precision.c
> +++ b/tools/testing/selftests/bpf/progs/verifier_subprog_precision.c
> @@ -119,7 +119,23 @@ __naked int global_subprog_result_precise(void)
>
>  SEC("?raw_tp")
>  __success __log_level(2)
> -/* First simulated path does not include callback body */
> +/* First simulated path does not include callback body,
> + * r1 and r4 are always precise for bpf_loop() calls.
> + */
> +__msg("9: (85) call bpf_loop#181")
> +__msg("mark_precise: frame0: last_idx 9 first_idx 9 subseq_idx -1")
> +__msg("mark_precise: frame0: parent state regs=r4 stack=:")
> +__msg("mark_precise: frame0: last_idx 8 first_idx 0 subseq_idx 9")
> +__msg("mark_precise: frame0: regs=r4 stack= before 8: (b7) r4 = 0")
> +__msg("mark_precise: frame0: last_idx 9 first_idx 9 subseq_idx -1")
> +__msg("mark_precise: frame0: parent state regs=r1 stack=:")
> +__msg("mark_precise: frame0: last_idx 8 first_idx 0 subseq_idx 9")
> +__msg("mark_precise: frame0: regs=r1 stack= before 8: (b7) r4 = 0")
> +__msg("mark_precise: frame0: regs=r1 stack= before 7: (b7) r3 = 0")
> +__msg("mark_precise: frame0: regs=r1 stack= before 6: (bf) r2 = r8")
> +__msg("mark_precise: frame0: regs=r1 stack= before 5: (bf) r1 = r6")
> +__msg("mark_precise: frame0: regs=r6 stack= before 4: (b7) r6 = 3")
> +/* r6 precision propagation */
>  __msg("14: (0f) r1 += r6")
>  __msg("mark_precise: frame0: last_idx 14 first_idx 9")
>  __msg("mark_precise: frame0: regs=r6 stack= before 13: (bf) r1 = r7")
> @@ -134,10 +150,9 @@ __msg("17: (b7) r0 = 0")
>  __msg("18: (95) exit")
>  __msg("returning from callee:")
>  __msg("to caller at 9:")
> -/* r4 (flags) is always precise for bpf_loop() */
> -__msg("frame 0: propagating r4")
> +__msg("frame 0: propagating r1,r4")
>  __msg("mark_precise: frame0: last_idx 9 first_idx 9 subseq_idx -1")
> -__msg("mark_precise: frame0: regs=r4 stack= before 18: (95) exit")
> +__msg("mark_precise: frame0: regs=r1,r4 stack= before 18: (95) exit")
>  __msg("from 18 to 9: safe")
>  __naked int callback_result_precise(void)
>  {
> @@ -264,12 +279,12 @@ __msg("15: (b7) r0 = 0")
>  __msg("16: (95) exit")
>  __msg("returning from callee:")
>  __msg("to caller at 9:")
> -/* r4 (flags) is always precise for bpf_loop(),
> +/* r1, r4 are always precise for bpf_loop(),
>   * r6 was marked before backtracking to callback body.
>   */
> -__msg("frame 0: propagating r4,r6")
> +__msg("frame 0: propagating r1,r4,r6")
>  __msg("mark_precise: frame0: last_idx 9 first_idx 9 subseq_idx -1")
> -__msg("mark_precise: frame0: regs=r4,r6 stack= before 16: (95) exit")
> +__msg("mark_precise: frame0: regs=r1,r4,r6 stack= before 16: (95) exit")
>  __msg("mark_precise: frame1: regs= stack= before 15: (b7) r0 = 0")
>  __msg("mark_precise: frame1: regs= stack= before 9: (85) call bpf_loop")
>  __msg("mark_precise: frame0: parent state regs= stack=:")
> @@ -422,12 +437,12 @@ __msg("17: (b7) r0 = 0")
>  __msg("18: (95) exit")
>  __msg("returning from callee:")
>  __msg("to caller at 10:")
> -/* r4 (flags) is always precise for bpf_loop(),
> +/* r1, r4 are always precise for bpf_loop(),
>   * fp-8 was marked before backtracking to callback body.
>   */
> -__msg("frame 0: propagating r4,fp-8")
> +__msg("frame 0: propagating r1,r4,fp-8")
>  __msg("mark_precise: frame0: last_idx 10 first_idx 10 subseq_idx -1")
> -__msg("mark_precise: frame0: regs=r4 stack=-8 before 18: (95) exit")
> +__msg("mark_precise: frame0: regs=r1,r4 stack=-8 before 18: (95) exit")
>  __msg("mark_precise: frame1: regs= stack= before 17: (b7) r0 = 0")
>  __msg("mark_precise: frame1: regs= stack= before 10: (85) call bpf_loop#181")
>  __msg("mark_precise: frame0: parent state regs= stack=:")
> --
> 2.42.1
>
Eduard Zingerman Nov. 21, 2023, 1:09 a.m. UTC | #2 
On Mon, 2023-11-20 at 17:04 -0800, Andrii Nakryiko wrote:
[...]
> > @@ -10309,8 +10311,19 @@ static int check_helper_call(struct bpf_verifier_env *env, struct bpf_insn *insn
> >                 break;
> >         case BPF_FUNC_loop:
> >                 update_loop_inline_state(env, meta.subprogno);
> > -               err = push_callback_call(env, insn, insn_idx, meta.subprogno,
> > -                                        set_loop_callback_state);
> > +               /* Verifier relies on R1 value to determine if bpf_loop() iteration
> > +                * is finished, thus mark it precise.
> > +                */
> > +               mark_chain_precision(env, BPF_REG_1);
> 
> huh? What about error handling?

My bad.
Should I fix and re-send as V4 immediately or wait till tomorrow?
Andrii Nakryiko Nov. 21, 2023, 1:14 a.m. UTC | #3 
On Mon, Nov 20, 2023 at 5:09 PM Eduard Zingerman <eddyz87@gmail.com> wrote:
>
> On Mon, 2023-11-20 at 17:04 -0800, Andrii Nakryiko wrote:
> [...]
> > > @@ -10309,8 +10311,19 @@ static int check_helper_call(struct bpf_verifier_env *env, struct bpf_insn *insn
> > >                 break;
> > >         case BPF_FUNC_loop:
> > >                 update_loop_inline_state(env, meta.subprogno);
> > > -               err = push_callback_call(env, insn, insn_idx, meta.subprogno,
> > > -                                        set_loop_callback_state);
> > > +               /* Verifier relies on R1 value to determine if bpf_loop() iteration
> > > +                * is finished, thus mark it precise.
> > > +                */
> > > +               mark_chain_precision(env, BPF_REG_1);
> >
> > huh? What about error handling?
>
> My bad.
> Should I fix and re-send as V4 immediately or wait till tomorrow?

Other than this issue everything looks good to me, but perhaps give
Alexei a bit of time to take a look over latest version, just in case?
Alexei Starovoitov Nov. 21, 2023, 1:26 a.m. UTC | #4 
On Mon, Nov 20, 2023 at 5:14 PM Andrii Nakryiko
<andrii.nakryiko@gmail.com> wrote:
>
> >
> > My bad.
> > Should I fix and re-send as V4 immediately or wait till tomorrow?
>
> Other than this issue everything looks good to me, but perhaps give
> Alexei a bit of time to take a look over latest version, just in case?

yes. Pls resend. Everything else looks good.
imo patches 6 and 11 look much cleaner now.
Eduard Zingerman Nov. 21, 2023, 1:35 a.m. UTC | #5 
On Mon, 2023-11-20 at 17:26 -0800, Alexei Starovoitov wrote:
> On Mon, Nov 20, 2023 at 5:14 PM Andrii Nakryiko
> <andrii.nakryiko@gmail.com> wrote:
> > 
> > > 
> > > My bad.
> > > Should I fix and re-send as V4 immediately or wait till tomorrow?
> > 
> > Other than this issue everything looks good to me, but perhaps give
> > Alexei a bit of time to take a look over latest version, just in case?
> 
> yes. Pls resend. Everything else looks good.
> imo patches 6 and 11 look much cleaner now.

Ok, need 15-30 minutes.
diff mbox series

Patch

diff --git a/include/linux/bpf_verifier.h b/include/linux/bpf_verifier.h
index 6e21d74a64e7..9ed6672534c7 100644
--- a/include/linux/bpf_verifier.h
+++ b/include/linux/bpf_verifier.h
@@ -301,6 +301,17 @@  struct bpf_func_state {
 	struct tnum callback_ret_range;
 	bool in_async_callback_fn;
 	bool in_exception_callback_fn;
+	/* For callback calling functions that limit number of possible
+	 * callback executions (e.g. bpf_loop) keeps track of current
+	 * simulated iteration number.
+	 * Value in frame N refers to number of times callback with frame
+	 * N+1 was simulated, e.g. for the following call:
+	 *
+	 *   bpf_loop(..., fn, ...); | suppose current frame is N
+	 *                           | fn would be simulated in frame N+1
+	 *                           | number of simulations is tracked in frame N
+	 */
+	u32 callback_depth;
 
 	/* The following fields should be last. See copy_func_state() */
 	int acquired_refs;
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 004de7c32bae..37d8c22c292a 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -9505,6 +9505,8 @@  static int push_callback_call(struct bpf_verifier_env *env, struct bpf_insn *ins
 		return err;
 
 	callback_state->cumulative_callback_depth++;
+	callback_state->frame[callback_state->curframe - 1]->callback_depth++;
+	caller->callback_depth = 0;
 	return 0;
 }
 
@@ -10309,8 +10311,19 @@  static int check_helper_call(struct bpf_verifier_env *env, struct bpf_insn *insn
 		break;
 	case BPF_FUNC_loop:
 		update_loop_inline_state(env, meta.subprogno);
-		err = push_callback_call(env, insn, insn_idx, meta.subprogno,
-					 set_loop_callback_state);
+		/* Verifier relies on R1 value to determine if bpf_loop() iteration
+		 * is finished, thus mark it precise.
+		 */
+		mark_chain_precision(env, BPF_REG_1);
+		if (cur_func(env)->callback_depth < regs[BPF_REG_1].umax_value) {
+			err = push_callback_call(env, insn, insn_idx, meta.subprogno,
+						 set_loop_callback_state);
+		} else {
+			cur_func(env)->callback_depth = 0;
+			if (env->log.level & BPF_LOG_LEVEL2)
+				verbose(env, "frame%d bpf_loop iteration limit reached\n",
+					env->cur_state->curframe);
+		}
 		break;
 	case BPF_FUNC_dynptr_from_mem:
 		if (regs[BPF_REG_1].type != PTR_TO_MAP_VALUE) {
diff --git a/tools/testing/selftests/bpf/progs/verifier_subprog_precision.c b/tools/testing/selftests/bpf/progs/verifier_subprog_precision.c
index da803cffb5ef..f61d623b1ce8 100644
--- a/tools/testing/selftests/bpf/progs/verifier_subprog_precision.c
+++ b/tools/testing/selftests/bpf/progs/verifier_subprog_precision.c
@@ -119,7 +119,23 @@  __naked int global_subprog_result_precise(void)
 
 SEC("?raw_tp")
 __success __log_level(2)
-/* First simulated path does not include callback body */
+/* First simulated path does not include callback body,
+ * r1 and r4 are always precise for bpf_loop() calls.
+ */
+__msg("9: (85) call bpf_loop#181")
+__msg("mark_precise: frame0: last_idx 9 first_idx 9 subseq_idx -1")
+__msg("mark_precise: frame0: parent state regs=r4 stack=:")
+__msg("mark_precise: frame0: last_idx 8 first_idx 0 subseq_idx 9")
+__msg("mark_precise: frame0: regs=r4 stack= before 8: (b7) r4 = 0")
+__msg("mark_precise: frame0: last_idx 9 first_idx 9 subseq_idx -1")
+__msg("mark_precise: frame0: parent state regs=r1 stack=:")
+__msg("mark_precise: frame0: last_idx 8 first_idx 0 subseq_idx 9")
+__msg("mark_precise: frame0: regs=r1 stack= before 8: (b7) r4 = 0")
+__msg("mark_precise: frame0: regs=r1 stack= before 7: (b7) r3 = 0")
+__msg("mark_precise: frame0: regs=r1 stack= before 6: (bf) r2 = r8")
+__msg("mark_precise: frame0: regs=r1 stack= before 5: (bf) r1 = r6")
+__msg("mark_precise: frame0: regs=r6 stack= before 4: (b7) r6 = 3")
+/* r6 precision propagation */
 __msg("14: (0f) r1 += r6")
 __msg("mark_precise: frame0: last_idx 14 first_idx 9")
 __msg("mark_precise: frame0: regs=r6 stack= before 13: (bf) r1 = r7")
@@ -134,10 +150,9 @@  __msg("17: (b7) r0 = 0")
 __msg("18: (95) exit")
 __msg("returning from callee:")
 __msg("to caller at 9:")
-/* r4 (flags) is always precise for bpf_loop() */
-__msg("frame 0: propagating r4")
+__msg("frame 0: propagating r1,r4")
 __msg("mark_precise: frame0: last_idx 9 first_idx 9 subseq_idx -1")
-__msg("mark_precise: frame0: regs=r4 stack= before 18: (95) exit")
+__msg("mark_precise: frame0: regs=r1,r4 stack= before 18: (95) exit")
 __msg("from 18 to 9: safe")
 __naked int callback_result_precise(void)
 {
@@ -264,12 +279,12 @@  __msg("15: (b7) r0 = 0")
 __msg("16: (95) exit")
 __msg("returning from callee:")
 __msg("to caller at 9:")
-/* r4 (flags) is always precise for bpf_loop(),
+/* r1, r4 are always precise for bpf_loop(),
  * r6 was marked before backtracking to callback body.
  */
-__msg("frame 0: propagating r4,r6")
+__msg("frame 0: propagating r1,r4,r6")
 __msg("mark_precise: frame0: last_idx 9 first_idx 9 subseq_idx -1")
-__msg("mark_precise: frame0: regs=r4,r6 stack= before 16: (95) exit")
+__msg("mark_precise: frame0: regs=r1,r4,r6 stack= before 16: (95) exit")
 __msg("mark_precise: frame1: regs= stack= before 15: (b7) r0 = 0")
 __msg("mark_precise: frame1: regs= stack= before 9: (85) call bpf_loop")
 __msg("mark_precise: frame0: parent state regs= stack=:")
@@ -422,12 +437,12 @@  __msg("17: (b7) r0 = 0")
 __msg("18: (95) exit")
 __msg("returning from callee:")
 __msg("to caller at 10:")
-/* r4 (flags) is always precise for bpf_loop(),
+/* r1, r4 are always precise for bpf_loop(),
  * fp-8 was marked before backtracking to callback body.
  */
-__msg("frame 0: propagating r4,fp-8")
+__msg("frame 0: propagating r1,r4,fp-8")
 __msg("mark_precise: frame0: last_idx 10 first_idx 10 subseq_idx -1")
-__msg("mark_precise: frame0: regs=r4 stack=-8 before 18: (95) exit")
+__msg("mark_precise: frame0: regs=r1,r4 stack=-8 before 18: (95) exit")
 __msg("mark_precise: frame1: regs= stack= before 17: (b7) r0 = 0")
 __msg("mark_precise: frame1: regs= stack= before 10: (85) call bpf_loop#181")
 __msg("mark_precise: frame0: parent state regs= stack=:")