From: menglong8.dong@gmail.com
To: andrii.nakryiko@gmail.com, alan.maguire@oracle.com
Cc: ast@kernel.org, daniel@iogearbox.net, andrii@kernel.org,
martin.lau@linux.dev, song@kernel.org, yhs@fb.com,
john.fastabend@gmail.com, kpsingh@kernel.org, sdf@google.com,
haoluo@google.com, jolsa@kernel.org, bpf@vger.kernel.org,
linux-kernel@vger.kernel.org,
Menglong Dong <imagedong@tencent.com>
Subject: [PATCH bpf-next v4 2/3] bpf, x86: clean garbage value in the stack of trampoline
Date: Fri, 9 Jun 2023 17:56:52 +0800 [thread overview]
Message-ID: <20230609095653.1406173-3-imagedong@tencent.com> (raw)
In-Reply-To: <20230609095653.1406173-1-imagedong@tencent.com>
From: Menglong Dong <imagedong@tencent.com>
There are garbage values in upper bytes when we store the arguments
into stack in save_regs() if the size of the argument less then 8.
As we already reserve 8 byte for the arguments in regs and stack,
it is ok to store/restore the regs in BPF_DW size. Then, the garbage
values in upper bytes will be cleaned.
Signed-off-by: Menglong Dong <imagedong@tencent.com>
---
v4:
- clean grabage value when argument count is 7
---
arch/x86/net/bpf_jit_comp.c | 45 ++++++++++++++++++++++++++-----------
1 file changed, 32 insertions(+), 13 deletions(-)
diff --git a/arch/x86/net/bpf_jit_comp.c b/arch/x86/net/bpf_jit_comp.c
index a767e13c8c85..f6f51a5d14db 100644
--- a/arch/x86/net/bpf_jit_comp.c
+++ b/arch/x86/net/bpf_jit_comp.c
@@ -1857,6 +1857,28 @@ st: if (is_imm8(insn->off))
return proglen;
}
+static inline void clean_garbage(u8 **pprog, int nr_regs, int stack_size,
+ int arg_size)
+{
+ u8 *prog;
+
+ /* clean potential garbage values in upper 32-bit. 'stack_size'
+ * here is the offset of the 7th argument on-stack.
+ */
+ if (nr_regs == 7 && arg_size <= 4) {
+ int off = -(stack_size - 4);
+
+ prog = *pprog;
+ /* mov DWORD PTR [rbp + off], 0 */
+ if (!is_imm8(off))
+ EMIT2_off32(0xC7, 0x85, off);
+ else
+ EMIT3(0xC7, 0x45, off);
+ EMIT(0, 4);
+ *pprog = prog;
+ }
+}
+
static void save_regs(const struct btf_func_model *m, u8 **prog, int nr_regs,
int stack_size)
{
@@ -1878,8 +1900,7 @@ static void save_regs(const struct btf_func_model *m, u8 **prog, int nr_regs,
if (i <= 5) {
/* copy function arguments from regs into stack */
- emit_stx(prog, bytes_to_bpf_size(arg_size),
- BPF_REG_FP,
+ emit_stx(prog, BPF_DW, BPF_REG_FP,
i == 5 ? X86_REG_R9 : BPF_REG_1 + i,
-(stack_size - i * 8));
} else {
@@ -1893,17 +1914,16 @@ static void save_regs(const struct btf_func_model *m, u8 **prog, int nr_regs,
* 8(return addr of the caller)
* which means: rbp + 24
*/
- emit_ldx(prog, bytes_to_bpf_size(arg_size),
- BPF_REG_0, BPF_REG_FP,
+ emit_ldx(prog, BPF_DW, BPF_REG_0, BPF_REG_FP,
(i - 6) * 8 + 0x18);
- emit_stx(prog, bytes_to_bpf_size(arg_size),
- BPF_REG_FP,
- BPF_REG_0,
+ emit_stx(prog, BPF_DW, BPF_REG_FP, BPF_REG_0,
-(stack_size - i * 8));
}
j = next_same_struct ? j : j + 1;
}
+
+ clean_garbage(prog, nr_regs, stack_size - 6 * 8, arg_size);
}
static void restore_regs(const struct btf_func_model *m, u8 **prog, int nr_regs,
@@ -1925,7 +1945,7 @@ static void restore_regs(const struct btf_func_model *m, u8 **prog, int nr_regs,
next_same_struct = !next_same_struct;
}
- emit_ldx(prog, bytes_to_bpf_size(arg_size),
+ emit_ldx(prog, BPF_DW,
i == 5 ? X86_REG_R9 : BPF_REG_1 + i,
BPF_REG_FP,
-(stack_size - i * 8));
@@ -1956,17 +1976,16 @@ static void prepare_origin_stack(const struct btf_func_model *m, u8 **prog,
}
if (i > 5) {
- emit_ldx(prog, bytes_to_bpf_size(arg_size),
- BPF_REG_0, BPF_REG_FP,
+ emit_ldx(prog, BPF_DW, BPF_REG_0, BPF_REG_FP,
(i - 6) * 8 + 0x18);
- emit_stx(prog, bytes_to_bpf_size(arg_size),
- BPF_REG_FP,
- BPF_REG_0,
+ emit_stx(prog, BPF_DW, BPF_REG_FP, BPF_REG_0,
-(stack_size - (i - 6) * 8));
}
j = next_same_struct ? j : j + 1;
}
+
+ clean_garbage(prog, nr_regs, stack_size, arg_size);
}
static int invoke_bpf_prog(const struct btf_func_model *m, u8 **pprog,
--
2.40.1
next prev parent reply other threads:[~2023-06-09 9:57 UTC|newest]
Thread overview: 12+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-06-09 9:56 [PATCH bpf-next v4 0/3] bpf, x86: allow function arguments up to 12 for TRACING menglong8.dong
2023-06-09 9:56 ` [PATCH bpf-next v4 1/3] " menglong8.dong
2023-06-10 3:05 ` Yonghong Song
2023-06-10 6:59 ` Menglong Dong
2023-06-09 9:56 ` menglong8.dong [this message]
2023-06-10 3:20 ` [PATCH bpf-next v4 2/3] bpf, x86: clean garbage value in the stack of trampoline Yonghong Song
2023-06-10 6:33 ` Menglong Dong
2023-06-09 9:56 ` [PATCH bpf-next v4 3/3] selftests/bpf: add testcase for FENTRY/FEXIT with 6+ arguments menglong8.dong
2023-06-10 3:29 ` Yonghong Song
2023-06-10 7:01 ` Menglong Dong
2023-06-10 3:51 ` [PATCH bpf-next v4 0/3] bpf, x86: allow function arguments up to 12 for TRACING Yonghong Song
2023-06-10 6:59 ` Menglong Dong
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20230609095653.1406173-3-imagedong@tencent.com \
--to=menglong8.dong@gmail.com \
--cc=alan.maguire@oracle.com \
--cc=andrii.nakryiko@gmail.com \
--cc=andrii@kernel.org \
--cc=ast@kernel.org \
--cc=bpf@vger.kernel.org \
--cc=daniel@iogearbox.net \
--cc=haoluo@google.com \
--cc=imagedong@tencent.com \
--cc=john.fastabend@gmail.com \
--cc=jolsa@kernel.org \
--cc=kpsingh@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=martin.lau@linux.dev \
--cc=sdf@google.com \
--cc=song@kernel.org \
--cc=yhs@fb.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).