diff mbox series

[v5,bpf-next,15/23] bpf: unify 32-bit and 64-bit is_branch_taken logic

Message ID 20231027181346.4019398-16-andrii@kernel.org (mailing list archive)
State Superseded
Delegated to: BPF
Headers show
Series BPF register bounds logic and testing improvements | expand

Checks

Context Check Description
bpf/vmtest-bpf-next-VM_Test-30 success Logs for x86_64-llvm-16 / test (test_progs_no_alu32_parallel, true, 30) / test_progs_no_alu32_parallel on x86_64 with llvm-16
bpf/vmtest-bpf-next-VM_Test-31 success Logs for x86_64-llvm-16 / test (test_progs_parallel, true, 30) / test_progs_parallel on x86_64 with llvm-16
bpf/vmtest-bpf-next-VM_Test-32 success Logs for x86_64-llvm-16 / test (test_verifier, false, 360) / test_verifier on x86_64 with llvm-16
bpf/vmtest-bpf-next-VM_Test-33 success Logs for x86_64-llvm-16 / veristat
netdev/series_format fail Series longer than 15 patches (and no cover letter)
netdev/tree_selection success Clearly marked for bpf-next, async
netdev/fixes_present success Fixes tag not required for -next series
netdev/header_inline success No static functions without inline keyword in header files
netdev/build_32bit success Errors and warnings before: 1374 this patch: 1374
netdev/cc_maintainers warning 8 maintainers not CCed: john.fastabend@gmail.com kpsingh@kernel.org song@kernel.org sdf@google.com jolsa@kernel.org martin.lau@linux.dev yonghong.song@linux.dev haoluo@google.com
netdev/build_clang fail Errors and warnings before: 15 this patch: 15
netdev/verify_signedoff success Signed-off-by tag matches author and committer
netdev/deprecated_api success None detected
netdev/check_selftest success No net selftest shell script
netdev/verify_fixes success No Fixes tag
netdev/build_allmodconfig_warn success Errors and warnings before: 1399 this patch: 1399
netdev/checkpatch fail ERROR: space prohibited before that close parenthesis ')' WARNING: line length of 89 exceeds 80 columns
netdev/build_clang_rust success Link
netdev/kdoc success Errors and warnings before: 0 this patch: 0
netdev/source_inline success Was 0 now: 0
bpf/vmtest-bpf-next-VM_Test-0 success Logs for Lint
bpf/vmtest-bpf-next-VM_Test-1 success Logs for ShellCheck
bpf/vmtest-bpf-next-VM_Test-2 success Logs for Validate matrix.py
bpf/vmtest-bpf-next-VM_Test-3 success Logs for aarch64-gcc / build / build for aarch64 with gcc
bpf/vmtest-bpf-next-VM_Test-8 success Logs for aarch64-gcc / veristat
bpf/vmtest-bpf-next-VM_Test-4 success Logs for aarch64-gcc / test (test_maps, false, 360) / test_maps on aarch64 with gcc
bpf/vmtest-bpf-next-VM_Test-5 success Logs for aarch64-gcc / test (test_progs, false, 360) / test_progs on aarch64 with gcc
bpf/vmtest-bpf-next-VM_Test-6 success Logs for aarch64-gcc / test (test_progs_no_alu32, false, 360) / test_progs_no_alu32 on aarch64 with gcc
bpf/vmtest-bpf-next-VM_Test-7 success Logs for aarch64-gcc / test (test_verifier, false, 360) / test_verifier on aarch64 with gcc
bpf/vmtest-bpf-next-VM_Test-9 success Logs for s390x-gcc / build / build for s390x with gcc
bpf/vmtest-bpf-next-VM_Test-14 success Logs for s390x-gcc / veristat
bpf/vmtest-bpf-next-VM_Test-15 success Logs for set-matrix
bpf/vmtest-bpf-next-VM_Test-16 success Logs for x86_64-gcc / build / build for x86_64 with gcc
bpf/vmtest-bpf-next-VM_Test-17 success Logs for x86_64-gcc / test (test_maps, false, 360) / test_maps on x86_64 with gcc
bpf/vmtest-bpf-next-VM_Test-18 success Logs for x86_64-gcc / test (test_progs, false, 360) / test_progs on x86_64 with gcc
bpf/vmtest-bpf-next-VM_Test-19 success Logs for x86_64-gcc / test (test_progs_no_alu32, false, 360) / test_progs_no_alu32 on x86_64 with gcc
bpf/vmtest-bpf-next-VM_Test-20 success Logs for x86_64-gcc / test (test_progs_no_alu32_parallel, true, 30) / test_progs_no_alu32_parallel on x86_64 with gcc
bpf/vmtest-bpf-next-VM_Test-21 success Logs for x86_64-gcc / test (test_progs_parallel, true, 30) / test_progs_parallel on x86_64 with gcc
bpf/vmtest-bpf-next-VM_Test-22 success Logs for x86_64-gcc / test (test_verifier, false, 360) / test_verifier on x86_64 with gcc
bpf/vmtest-bpf-next-VM_Test-23 success Logs for x86_64-gcc / veristat / veristat on x86_64 with gcc
bpf/vmtest-bpf-next-VM_Test-24 success Logs for x86_64-llvm-16 / build / build for x86_64 with llvm-16
bpf/vmtest-bpf-next-VM_Test-25 success Logs for x86_64-llvm-16 / test (test_maps, false, 360) / test_maps on x86_64 with llvm-16
bpf/vmtest-bpf-next-VM_Test-26 success Logs for x86_64-llvm-16 / test (test_progs, false, 360) / test_progs on x86_64 with llvm-16
bpf/vmtest-bpf-next-VM_Test-27 success Logs for x86_64-llvm-16 / test (test_progs_no_alu32, false, 360) / test_progs_no_alu32 on x86_64 with llvm-16
bpf/vmtest-bpf-next-VM_Test-28 success Logs for x86_64-llvm-16 / test (test_verifier, false, 360) / test_verifier on x86_64 with llvm-16
bpf/vmtest-bpf-next-VM_Test-29 success Logs for x86_64-llvm-16 / veristat
bpf/vmtest-bpf-next-VM_Test-13 success Logs for s390x-gcc / test (test_verifier, false, 360) / test_verifier on s390x with gcc
bpf/vmtest-bpf-next-VM_Test-12 success Logs for s390x-gcc / test (test_progs_no_alu32, false, 360) / test_progs_no_alu32 on s390x with gcc
bpf/vmtest-bpf-next-PR success PR summary
bpf/vmtest-bpf-next-VM_Test-10 success Logs for s390x-gcc / test (test_maps, false, 360) / test_maps on s390x with gcc
bpf/vmtest-bpf-next-VM_Test-11 success Logs for s390x-gcc / test (test_progs, false, 360) / test_progs on s390x with gcc

Commit Message

Andrii Nakryiko Oct. 27, 2023, 6:13 p.m. UTC 
Combine 32-bit and 64-bit is_branch_taken logic for SCALAR_VALUE
registers. It makes it easier to see parallels between two domains
(32-bit and 64-bit), and makes subsequent refactoring more
straightforward.

No functional changes.

Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
---
 kernel/bpf/verifier.c | 154 ++++++++++--------------------------------
 1 file changed, 36 insertions(+), 118 deletions(-)

Comments

Alexei Starovoitov Oct. 30, 2023, 7:52 p.m. UTC | #1 
On Fri, Oct 27, 2023 at 11:13:38AM -0700, Andrii Nakryiko wrote:
> Combine 32-bit and 64-bit is_branch_taken logic for SCALAR_VALUE
> registers. It makes it easier to see parallels between two domains
> (32-bit and 64-bit), and makes subsequent refactoring more
> straightforward.
> 
> No functional changes.
> 
> Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
> ---
>  kernel/bpf/verifier.c | 154 ++++++++++--------------------------------
>  1 file changed, 36 insertions(+), 118 deletions(-)
> 
> diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> index fedd6d0e76e5..b911d1111fad 100644
> --- a/kernel/bpf/verifier.c
> +++ b/kernel/bpf/verifier.c
> @@ -14185,166 +14185,86 @@ static u64 reg_const_value(struct bpf_reg_state *reg, bool subreg32)
>  /*
>   * <reg1> <op> <reg2>, currently assuming reg2 is a constant
>   */
> -static int is_branch32_taken(struct bpf_reg_state *reg1, struct bpf_reg_state *reg2, u8 opcode)
> +static int is_scalar_branch_taken(struct bpf_reg_state *reg1, struct bpf_reg_state *reg2,
> +				  u8 opcode, bool is_jmp32)
>  {
> -	struct tnum subreg = tnum_subreg(reg1->var_off);
> -	u32 val = (u32)tnum_subreg(reg2->var_off).value;
> -	s32 sval = (s32)val;
> +	struct tnum t1 = is_jmp32 ? tnum_subreg(reg1->var_off) : reg1->var_off;
> +	u64 umin1 = is_jmp32 ? (u64)reg1->u32_min_value : reg1->umin_value;
> +	u64 umax1 = is_jmp32 ? (u64)reg1->u32_max_value : reg1->umax_value;
> +	s64 smin1 = is_jmp32 ? (s64)reg1->s32_min_value : reg1->smin_value;
> +	s64 smax1 = is_jmp32 ? (s64)reg1->s32_max_value : reg1->smax_value;
> +	u64 val = is_jmp32 ? (u32)tnum_subreg(reg2->var_off).value : reg2->var_off.value;
> +	s64 sval = is_jmp32 ? (s32)val : (s64)val;

Maybe use uval and sval to be consisten with umin/smin ?
Andrii Nakryiko Oct. 31, 2023, 5:28 a.m. UTC | #2 
On Mon, Oct 30, 2023 at 12:52 PM Alexei Starovoitov
<alexei.starovoitov@gmail.com> wrote:
>
> On Fri, Oct 27, 2023 at 11:13:38AM -0700, Andrii Nakryiko wrote:
> > Combine 32-bit and 64-bit is_branch_taken logic for SCALAR_VALUE
> > registers. It makes it easier to see parallels between two domains
> > (32-bit and 64-bit), and makes subsequent refactoring more
> > straightforward.
> >
> > No functional changes.
> >
> > Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
> > ---
> >  kernel/bpf/verifier.c | 154 ++++++++++--------------------------------
> >  1 file changed, 36 insertions(+), 118 deletions(-)
> >
> > diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> > index fedd6d0e76e5..b911d1111fad 100644
> > --- a/kernel/bpf/verifier.c
> > +++ b/kernel/bpf/verifier.c
> > @@ -14185,166 +14185,86 @@ static u64 reg_const_value(struct bpf_reg_state *reg, bool subreg32)
> >  /*
> >   * <reg1> <op> <reg2>, currently assuming reg2 is a constant
> >   */
> > -static int is_branch32_taken(struct bpf_reg_state *reg1, struct bpf_reg_state *reg2, u8 opcode)
> > +static int is_scalar_branch_taken(struct bpf_reg_state *reg1, struct bpf_reg_state *reg2,
> > +                               u8 opcode, bool is_jmp32)
> >  {
> > -     struct tnum subreg = tnum_subreg(reg1->var_off);
> > -     u32 val = (u32)tnum_subreg(reg2->var_off).value;
> > -     s32 sval = (s32)val;
> > +     struct tnum t1 = is_jmp32 ? tnum_subreg(reg1->var_off) : reg1->var_off;
> > +     u64 umin1 = is_jmp32 ? (u64)reg1->u32_min_value : reg1->umin_value;
> > +     u64 umax1 = is_jmp32 ? (u64)reg1->u32_max_value : reg1->umax_value;
> > +     s64 smin1 = is_jmp32 ? (s64)reg1->s32_min_value : reg1->smin_value;
> > +     s64 smax1 = is_jmp32 ? (s64)reg1->s32_max_value : reg1->smax_value;
> > +     u64 val = is_jmp32 ? (u32)tnum_subreg(reg2->var_off).value : reg2->var_off.value;
> > +     s64 sval = is_jmp32 ? (s32)val : (s64)val;
>
> Maybe use uval and sval to be consisten with umin/smin ?

Sure, I will update val to uval for consistency.
Eduard Zingerman Oct. 31, 2023, 5:35 p.m. UTC | #3 
On Fri, 2023-10-27 at 11:13 -0700, Andrii Nakryiko wrote:
> Combine 32-bit and 64-bit is_branch_taken logic for SCALAR_VALUE
> registers. It makes it easier to see parallels between two domains
> (32-bit and 64-bit), and makes subsequent refactoring more
> straightforward.
> 
> No functional changes.
> 
> Signed-off-by: Andrii Nakryiko <andrii@kernel.org>

Acked-by: Eduard Zingerman <eddyz87@gmail.com>

> ---
>  kernel/bpf/verifier.c | 154 ++++++++++--------------------------------
>  1 file changed, 36 insertions(+), 118 deletions(-)
> 
> diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> index fedd6d0e76e5..b911d1111fad 100644
> --- a/kernel/bpf/verifier.c
> +++ b/kernel/bpf/verifier.c
> @@ -14185,166 +14185,86 @@ static u64 reg_const_value(struct bpf_reg_state *reg, bool subreg32)
>  /*
>   * <reg1> <op> <reg2>, currently assuming reg2 is a constant
>   */
> -static int is_branch32_taken(struct bpf_reg_state *reg1, struct bpf_reg_state *reg2, u8 opcode)
> +static int is_scalar_branch_taken(struct bpf_reg_state *reg1, struct bpf_reg_state *reg2,
> +				  u8 opcode, bool is_jmp32)
>  {
> -	struct tnum subreg = tnum_subreg(reg1->var_off);
> -	u32 val = (u32)tnum_subreg(reg2->var_off).value;
> -	s32 sval = (s32)val;
> +	struct tnum t1 = is_jmp32 ? tnum_subreg(reg1->var_off) : reg1->var_off;
> +	u64 umin1 = is_jmp32 ? (u64)reg1->u32_min_value : reg1->umin_value;
> +	u64 umax1 = is_jmp32 ? (u64)reg1->u32_max_value : reg1->umax_value;
> +	s64 smin1 = is_jmp32 ? (s64)reg1->s32_min_value : reg1->smin_value;
> +	s64 smax1 = is_jmp32 ? (s64)reg1->s32_max_value : reg1->smax_value;
> +	u64 val = is_jmp32 ? (u32)tnum_subreg(reg2->var_off).value : reg2->var_off.value;
> +	s64 sval = is_jmp32 ? (s32)val : (s64)val;
>  
>  	switch (opcode) {
>  	case BPF_JEQ:
> -		if (tnum_is_const(subreg))
> -			return !!tnum_equals_const(subreg, val);
> -		else if (val < reg1->u32_min_value || val > reg1->u32_max_value)
> +		if (tnum_is_const(t1))
> +			return !!tnum_equals_const(t1, val);
> +		else if (val < umin1 || val > umax1)
>  			return 0;
> -		else if (sval < reg1->s32_min_value || sval > reg1->s32_max_value)
> +		else if (sval < smin1 || sval > smax1)
>  			return 0;
>  		break;
>  	case BPF_JNE:
> -		if (tnum_is_const(subreg))
> -			return !tnum_equals_const(subreg, val);
> -		else if (val < reg1->u32_min_value || val > reg1->u32_max_value)
> +		if (tnum_is_const(t1))
> +			return !tnum_equals_const(t1, val);
> +		else if (val < umin1 || val > umax1)
>  			return 1;
> -		else if (sval < reg1->s32_min_value || sval > reg1->s32_max_value)
> +		else if (sval < smin1 || sval > smax1)
>  			return 1;
>  		break;
>  	case BPF_JSET:
> -		if ((~subreg.mask & subreg.value) & val)
> +		if ((~t1.mask & t1.value) & val)
>  			return 1;
> -		if (!((subreg.mask | subreg.value) & val))
> +		if (!((t1.mask | t1.value) & val))
>  			return 0;
>  		break;
>  	case BPF_JGT:
> -		if (reg1->u32_min_value > val)
> +		if (umin1 > val )
>  			return 1;
> -		else if (reg1->u32_max_value <= val)
> +		else if (umax1 <= val)
>  			return 0;
>  		break;
>  	case BPF_JSGT:
> -		if (reg1->s32_min_value > sval)
> +		if (smin1 > sval)
>  			return 1;
> -		else if (reg1->s32_max_value <= sval)
> +		else if (smax1 <= sval)
>  			return 0;
>  		break;
>  	case BPF_JLT:
> -		if (reg1->u32_max_value < val)
> +		if (umax1 < val)
>  			return 1;
> -		else if (reg1->u32_min_value >= val)
> +		else if (umin1 >= val)
>  			return 0;
>  		break;
>  	case BPF_JSLT:
> -		if (reg1->s32_max_value < sval)
> +		if (smax1 < sval)
>  			return 1;
> -		else if (reg1->s32_min_value >= sval)
> +		else if (smin1 >= sval)
>  			return 0;
>  		break;
>  	case BPF_JGE:
> -		if (reg1->u32_min_value >= val)
> +		if (umin1 >= val)
>  			return 1;
> -		else if (reg1->u32_max_value < val)
> +		else if (umax1 < val)
>  			return 0;
>  		break;
>  	case BPF_JSGE:
> -		if (reg1->s32_min_value >= sval)
> +		if (smin1 >= sval)
>  			return 1;
> -		else if (reg1->s32_max_value < sval)
> +		else if (smax1 < sval)
>  			return 0;
>  		break;
>  	case BPF_JLE:
> -		if (reg1->u32_max_value <= val)
> +		if (umax1 <= val)
>  			return 1;
> -		else if (reg1->u32_min_value > val)
> +		else if (umin1 > val)
>  			return 0;
>  		break;
>  	case BPF_JSLE:
> -		if (reg1->s32_max_value <= sval)
> +		if (smax1 <= sval)
>  			return 1;
> -		else if (reg1->s32_min_value > sval)
> -			return 0;
> -		break;
> -	}
> -
> -	return -1;
> -}
> -
> -
> -/*
> - * <reg1> <op> <reg2>, currently assuming reg2 is a constant
> - */
> -static int is_branch64_taken(struct bpf_reg_state *reg1, struct bpf_reg_state *reg2, u8 opcode)
> -{
> -	u64 val = reg2->var_off.value;
> -	s64 sval = (s64)val;
> -
> -	switch (opcode) {
> -	case BPF_JEQ:
> -		if (tnum_is_const(reg1->var_off))
> -			return !!tnum_equals_const(reg1->var_off, val);
> -		else if (val < reg1->umin_value || val > reg1->umax_value)
> -			return 0;
> -		else if (sval < reg1->smin_value || sval > reg1->smax_value)
> -			return 0;
> -		break;
> -	case BPF_JNE:
> -		if (tnum_is_const(reg1->var_off))
> -			return !tnum_equals_const(reg1->var_off, val);
> -		else if (val < reg1->umin_value || val > reg1->umax_value)
> -			return 1;
> -		else if (sval < reg1->smin_value || sval > reg1->smax_value)
> -			return 1;
> -		break;
> -	case BPF_JSET:
> -		if ((~reg1->var_off.mask & reg1->var_off.value) & val)
> -			return 1;
> -		if (!((reg1->var_off.mask | reg1->var_off.value) & val))
> -			return 0;
> -		break;
> -	case BPF_JGT:
> -		if (reg1->umin_value > val)
> -			return 1;
> -		else if (reg1->umax_value <= val)
> -			return 0;
> -		break;
> -	case BPF_JSGT:
> -		if (reg1->smin_value > sval)
> -			return 1;
> -		else if (reg1->smax_value <= sval)
> -			return 0;
> -		break;
> -	case BPF_JLT:
> -		if (reg1->umax_value < val)
> -			return 1;
> -		else if (reg1->umin_value >= val)
> -			return 0;
> -		break;
> -	case BPF_JSLT:
> -		if (reg1->smax_value < sval)
> -			return 1;
> -		else if (reg1->smin_value >= sval)
> -			return 0;
> -		break;
> -	case BPF_JGE:
> -		if (reg1->umin_value >= val)
> -			return 1;
> -		else if (reg1->umax_value < val)
> -			return 0;
> -		break;
> -	case BPF_JSGE:
> -		if (reg1->smin_value >= sval)
> -			return 1;
> -		else if (reg1->smax_value < sval)
> -			return 0;
> -		break;
> -	case BPF_JLE:
> -		if (reg1->umax_value <= val)
> -			return 1;
> -		else if (reg1->umin_value > val)
> -			return 0;
> -		break;
> -	case BPF_JSLE:
> -		if (reg1->smax_value <= sval)
> -			return 1;
> -		else if (reg1->smin_value > sval)
> +		else if (smin1 > sval)
>  			return 0;
>  		break;
>  	}
> @@ -14458,9 +14378,7 @@ static int is_branch_taken(struct bpf_reg_state *reg1, struct bpf_reg_state *reg
>  		}
>  	}
>  
> -	if (is_jmp32)
> -		return is_branch32_taken(reg1, reg2, opcode);
> -	return is_branch64_taken(reg1, reg2, opcode);
> +	return is_scalar_branch_taken(reg1, reg2, opcode, is_jmp32);
>  }
>  
>  /* Adjusts the register min/max values in the case that the dst_reg is the
diff mbox series

Patch

diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index fedd6d0e76e5..b911d1111fad 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -14185,166 +14185,86 @@  static u64 reg_const_value(struct bpf_reg_state *reg, bool subreg32)
 /*
  * <reg1> <op> <reg2>, currently assuming reg2 is a constant
  */
-static int is_branch32_taken(struct bpf_reg_state *reg1, struct bpf_reg_state *reg2, u8 opcode)
+static int is_scalar_branch_taken(struct bpf_reg_state *reg1, struct bpf_reg_state *reg2,
+				  u8 opcode, bool is_jmp32)
 {
-	struct tnum subreg = tnum_subreg(reg1->var_off);
-	u32 val = (u32)tnum_subreg(reg2->var_off).value;
-	s32 sval = (s32)val;
+	struct tnum t1 = is_jmp32 ? tnum_subreg(reg1->var_off) : reg1->var_off;
+	u64 umin1 = is_jmp32 ? (u64)reg1->u32_min_value : reg1->umin_value;
+	u64 umax1 = is_jmp32 ? (u64)reg1->u32_max_value : reg1->umax_value;
+	s64 smin1 = is_jmp32 ? (s64)reg1->s32_min_value : reg1->smin_value;
+	s64 smax1 = is_jmp32 ? (s64)reg1->s32_max_value : reg1->smax_value;
+	u64 val = is_jmp32 ? (u32)tnum_subreg(reg2->var_off).value : reg2->var_off.value;
+	s64 sval = is_jmp32 ? (s32)val : (s64)val;
 
 	switch (opcode) {
 	case BPF_JEQ:
-		if (tnum_is_const(subreg))
-			return !!tnum_equals_const(subreg, val);
-		else if (val < reg1->u32_min_value || val > reg1->u32_max_value)
+		if (tnum_is_const(t1))
+			return !!tnum_equals_const(t1, val);
+		else if (val < umin1 || val > umax1)
 			return 0;
-		else if (sval < reg1->s32_min_value || sval > reg1->s32_max_value)
+		else if (sval < smin1 || sval > smax1)
 			return 0;
 		break;
 	case BPF_JNE:
-		if (tnum_is_const(subreg))
-			return !tnum_equals_const(subreg, val);
-		else if (val < reg1->u32_min_value || val > reg1->u32_max_value)
+		if (tnum_is_const(t1))
+			return !tnum_equals_const(t1, val);
+		else if (val < umin1 || val > umax1)
 			return 1;
-		else if (sval < reg1->s32_min_value || sval > reg1->s32_max_value)
+		else if (sval < smin1 || sval > smax1)
 			return 1;
 		break;
 	case BPF_JSET:
-		if ((~subreg.mask & subreg.value) & val)
+		if ((~t1.mask & t1.value) & val)
 			return 1;
-		if (!((subreg.mask | subreg.value) & val))
+		if (!((t1.mask | t1.value) & val))
 			return 0;
 		break;
 	case BPF_JGT:
-		if (reg1->u32_min_value > val)
+		if (umin1 > val )
 			return 1;
-		else if (reg1->u32_max_value <= val)
+		else if (umax1 <= val)
 			return 0;
 		break;
 	case BPF_JSGT:
-		if (reg1->s32_min_value > sval)
+		if (smin1 > sval)
 			return 1;
-		else if (reg1->s32_max_value <= sval)
+		else if (smax1 <= sval)
 			return 0;
 		break;
 	case BPF_JLT:
-		if (reg1->u32_max_value < val)
+		if (umax1 < val)
 			return 1;
-		else if (reg1->u32_min_value >= val)
+		else if (umin1 >= val)
 			return 0;
 		break;
 	case BPF_JSLT:
-		if (reg1->s32_max_value < sval)
+		if (smax1 < sval)
 			return 1;
-		else if (reg1->s32_min_value >= sval)
+		else if (smin1 >= sval)
 			return 0;
 		break;
 	case BPF_JGE:
-		if (reg1->u32_min_value >= val)
+		if (umin1 >= val)
 			return 1;
-		else if (reg1->u32_max_value < val)
+		else if (umax1 < val)
 			return 0;
 		break;
 	case BPF_JSGE:
-		if (reg1->s32_min_value >= sval)
+		if (smin1 >= sval)
 			return 1;
-		else if (reg1->s32_max_value < sval)
+		else if (smax1 < sval)
 			return 0;
 		break;
 	case BPF_JLE:
-		if (reg1->u32_max_value <= val)
+		if (umax1 <= val)
 			return 1;
-		else if (reg1->u32_min_value > val)
+		else if (umin1 > val)
 			return 0;
 		break;
 	case BPF_JSLE:
-		if (reg1->s32_max_value <= sval)
+		if (smax1 <= sval)
 			return 1;
-		else if (reg1->s32_min_value > sval)
-			return 0;
-		break;
-	}
-
-	return -1;
-}
-
-
-/*
- * <reg1> <op> <reg2>, currently assuming reg2 is a constant
- */
-static int is_branch64_taken(struct bpf_reg_state *reg1, struct bpf_reg_state *reg2, u8 opcode)
-{
-	u64 val = reg2->var_off.value;
-	s64 sval = (s64)val;
-
-	switch (opcode) {
-	case BPF_JEQ:
-		if (tnum_is_const(reg1->var_off))
-			return !!tnum_equals_const(reg1->var_off, val);
-		else if (val < reg1->umin_value || val > reg1->umax_value)
-			return 0;
-		else if (sval < reg1->smin_value || sval > reg1->smax_value)
-			return 0;
-		break;
-	case BPF_JNE:
-		if (tnum_is_const(reg1->var_off))
-			return !tnum_equals_const(reg1->var_off, val);
-		else if (val < reg1->umin_value || val > reg1->umax_value)
-			return 1;
-		else if (sval < reg1->smin_value || sval > reg1->smax_value)
-			return 1;
-		break;
-	case BPF_JSET:
-		if ((~reg1->var_off.mask & reg1->var_off.value) & val)
-			return 1;
-		if (!((reg1->var_off.mask | reg1->var_off.value) & val))
-			return 0;
-		break;
-	case BPF_JGT:
-		if (reg1->umin_value > val)
-			return 1;
-		else if (reg1->umax_value <= val)
-			return 0;
-		break;
-	case BPF_JSGT:
-		if (reg1->smin_value > sval)
-			return 1;
-		else if (reg1->smax_value <= sval)
-			return 0;
-		break;
-	case BPF_JLT:
-		if (reg1->umax_value < val)
-			return 1;
-		else if (reg1->umin_value >= val)
-			return 0;
-		break;
-	case BPF_JSLT:
-		if (reg1->smax_value < sval)
-			return 1;
-		else if (reg1->smin_value >= sval)
-			return 0;
-		break;
-	case BPF_JGE:
-		if (reg1->umin_value >= val)
-			return 1;
-		else if (reg1->umax_value < val)
-			return 0;
-		break;
-	case BPF_JSGE:
-		if (reg1->smin_value >= sval)
-			return 1;
-		else if (reg1->smax_value < sval)
-			return 0;
-		break;
-	case BPF_JLE:
-		if (reg1->umax_value <= val)
-			return 1;
-		else if (reg1->umin_value > val)
-			return 0;
-		break;
-	case BPF_JSLE:
-		if (reg1->smax_value <= sval)
-			return 1;
-		else if (reg1->smin_value > sval)
+		else if (smin1 > sval)
 			return 0;
 		break;
 	}
@@ -14458,9 +14378,7 @@  static int is_branch_taken(struct bpf_reg_state *reg1, struct bpf_reg_state *reg
 		}
 	}
 
-	if (is_jmp32)
-		return is_branch32_taken(reg1, reg2, opcode);
-	return is_branch64_taken(reg1, reg2, opcode);
+	return is_scalar_branch_taken(reg1, reg2, opcode, is_jmp32);
 }
 
 /* Adjusts the register min/max values in the case that the dst_reg is the