tetragon icon indicating copy to clipboard operation
tetragon copied to clipboard

build/bpf: fix bpf_execve_event_v53.o under clang-14

Open willfindlay opened this issue 3 years ago • 0 comments

Currently, upstream clang-13 works fine for compiling our BPF programs. However when I attempted to upgrade to clang-14 I found that the event_execve program in bpf_execve_event_v53.o spikes its instruction count to over 1M and this fails the verifier.

Logs:

; probe_read(&dentry, sizeof(dentry),
2391: (b7) r2 = 8                     ; R2_w=8
2392: (bf) r3 = r6                    ; R3_w=scalar(id=69319) R6_w=scalar(id=69319)
2393: (85) call bpf_probe_read#4      ; R0_w=scalar() fp-8=mmmmmmmm
; mnt = parent;
2394: (79) r6 = *(u64 *)(r10 -112)    ; R6_w=scalar() R10=fp0
2395: (bf) r3 = r6                    ; R3_w=scalar(id=69320) R6_w=scalar(id=69320)
2396: (b7) r1 = 32                    ; R1_w=32
2397: (0f) r3 += r1                   ; R1_w=32 R3_w=scalar()
2398: (bf) r1 = r10                   ; R1_w=fp0 R10=fp0
;
2399: (07) r1 += -88                  ; R1_w=fp-88
; probe_read(&vfsmnt, sizeof(vfsmnt),
2400: (b7) r2 = 8
BPF program is too large. Processed 1000001 insn
processed 1000001 insns (limit 1000000) max_states_per_insn 22 total_states 38642 peak_states 2336 mark_read 177

Full verifier logs available here.

willfindlay avatar Jun 14 '22 22:06 willfindlay