316 				 * as precise=true in this verifier state.  in backtrack_insn()
368 		 * by 'precise' mark in corresponding register of this state.  in backtrack_insn()
442 				 * precise, r0 and r6-r10 or any stack slot in  in backtrack_insn()
569 			 * this insn. If only sreg was marked precise  in backtrack_insn()
597 	 * registers marked as precise in this function.  in backtrack_insn()
604  * . at the start all registers have precise=false.
606  * . once precise value of the scalar register is used in:
612  *   should be precise.
614  *   are equivalent if both are not precise.
618  * used to compute single precise scalar.
620  * The approach of starting with precise=true for all registers and then
621  * backtrack to mark a register as not precise when the verifier detects
663 		verbose(env, "mark_precise: frame%d: falling back to forcing all scalars precise\n",  in bpf_mark_all_scalars_precise()
667 	/* big hammer: mark all scalars precise in this path.  in bpf_mark_all_scalars_precise()
668 	 * pop_stack may still get !precise scalars.  in bpf_mark_all_scalars_precise()
678 				if (reg->type != SCALAR_VALUE || reg->precise)  in bpf_mark_all_scalars_precise()
680 				reg->precise = true;  in bpf_mark_all_scalars_precise()
682 					verbose(env, "force_precise: frame%d: forcing r%d to be precise\n",  in bpf_mark_all_scalars_precise()
690 				if (reg->type != SCALAR_VALUE || reg->precise)  in bpf_mark_all_scalars_precise()
692 				reg->precise = true;  in bpf_mark_all_scalars_precise()
694 					verbose(env, "force_precise: frame%d: forcing fp%d to be precise\n",  in bpf_mark_all_scalars_precise()
712  * precise.
714  * One important and subtle aspect is that precise marks *do not matter* in
725  * In the former case, precise markings in current state are completely
727  * checkpointed ("old") state precise markings are important, and if old
728  * state's register/slot is precise, regsafe() assumes current state's
729  * register/slot as precise and checks value ranges exactly and precisely. If
730  * states turn out to be compatible, current state's necessary precise
731  * markings and any required parent states' precise markings are enforced
734  * registers/slots as precise, we immediately discard current state. So what
735  * actually matters is any of the precise markings propagated into current
737  * As such, for scenario a) it doesn't matter if current state has precise
742  * processed instruction always assumes precise SCALAR register/slot
743  * knowledge: if precise value or range is useful to prune jump branch, BPF
747  * what we mentioned above about state comparison ignoring precise markings
748  * during state comparison, BPF verifier ignores and also assumes precise
755  * is_state_visited() would enforce strict and precise SCALAR ranges, if
770  * This also means that even if we needed precise SCALAR range to get to
772  * never used in a precise context (i.e., it's precise value is not needed for
774  * (i.e., precise marking set to false). This is what we rely on when we do
775  * not set precise marking in current state. If no child state requires
777  * be imprecise. If any child state does require this register to be precise,
778  * we'll mark it precise later retroactively during precise markings
781  * Skipping precise marking setting in current state is a mild version of
783  * more aggressively by proactively forgetting any precise marking in the
812 	 * slot, but don't set precise flag in current state, as precision  in bpf_mark_chain_precision()
841 			 * requested precise registers are R1-R5  in bpf_mark_chain_precision()
854 						reg->precise = true;  in bpf_mark_chain_precision()
915 				if (reg->precise) {  in bpf_mark_chain_precision()
918 					reg->precise = true;  in bpf_mark_chain_precision()
935 				if (reg->precise) {  in bpf_mark_chain_precision()
938 					reg->precise = true;  in bpf_mark_chain_precision()
946 				if (reg->type != SCALAR_VALUE || reg->precise) {  in bpf_mark_chain_precision()
949 					reg->precise = true;  in bpf_mark_chain_precision()
973 	/* if we still have requested precise regs or slots, we missed  in bpf_mark_chain_precision()
975 	 * fallback to marking all precise  in bpf_mark_chain_precision()