Unable to run cilium with clang-3.9

[cilium]

Unable to run cilium with clang-3.9

[tgraf]

The issue is that r1 gets pushed to the stack before the conditional jump. I think may recent upstream work should resolve this.

commit 57a09bf0a416700676e77102c28f9cfcb48267e0
Author: Thomas Graf <[email protected]>
Date:   Tue Oct 18 19:51:19 2016 +0200

    bpf: Detect identical PTR_TO_MAP_VALUE_OR_NULL registers

    A BPF program is required to check the return register of a
    map_elem_lookup() call before accessing memory. The verifier keeps
    track of this by converting the type of the result register from
    PTR_TO_MAP_VALUE_OR_NULL to PTR_TO_MAP_VALUE after a conditional
    jump ensures safety. This check is currently exclusively performed
    for the result register 0.

    In the event the compiler reorders instructions, BPF_MOV64_REG
    instructions may be moved before the conditional jump which causes
    them to keep their type PTR_TO_MAP_VALUE_OR_NULL to which the
    verifier objects when the register is accessed:

    0: (b7) r1 = 10
    1: (7b) *(u64 *)(r10 -8) = r1
    2: (bf) r2 = r10
    3: (07) r2 += -8
    4: (18) r1 = 0x59c00000
    6: (85) call 1
    7: (bf) r4 = r0
    8: (15) if r0 == 0x0 goto pc+1
     R0=map_value(ks=8,vs=8) R4=map_value_or_null(ks=8,vs=8) R10=fp
    9: (7a) *(u64 *)(r4 +0) = 0
    R4 invalid mem access 'map_value_or_null'

    This commit extends the verifier to keep track of all identical
    PTR_TO_MAP_VALUE_OR_NULL registers after a map_elem_lookup() by
    assigning them an ID and then marking them all when the conditional
    jump is observed.

    Signed-off-by: Thomas Graf <[email protected]>
    Reviewed-by: Josef Bacik <[email protected]>
    Acked-by: Daniel Borkmann <[email protected]>
    Acked-by: Alexei Starovoitov <[email protected]>
    Signed-off-by: David S. Miller <[email protected]>

[tgraf]

Fixed in kernel commit 57a09bf0a416700676e77102c28f9cfcb48267e0