From: Maciej Fijalkowski <maciejromanfijalkowski@gmail.com>
To: Daniel Borkmann <daniel@iogearbox.net>
Cc: Maciej Fijalkowski <maciej.fijalkowski@intel.com>,
ast@kernel.org, bpf@vger.kernel.org, netdev@vger.kernel.org,
bjorn.topel@intel.com, magnus.karlsson@intel.com
Subject: Re: [PATCH bpf-next 1/5] bpf, x64: use %rcx instead of %rax for tail call retpolines
Date: Fri, 17 Jul 2020 11:29:51 +0200 [thread overview]
Message-ID: <CAOuyyO4B3V-TzzJLneEqXcPZWhhpPSe7kiY1G5g6NDMDVGazTQ@mail.gmail.com> (raw)
In-Reply-To: <d631a16d-2cf0-cf12-2ddc-82ac64e51f6e@iogearbox.net>
On Thu, Jul 16, 2020 at 10:37 PM Daniel Borkmann <daniel@iogearbox.net> wrote:
>
> On 7/16/20 1:36 AM, Maciej Fijalkowski wrote:
> > Currently, %rax is used to store the jump target when BPF program is
> > emitting the retpoline instructions that are handling the indirect
> > tailcall.
> >
> > There is a plan to use %rax for different purpose, which is storing the
> > tail call counter. In order to preserve this value across the tailcalls,
> > use %rcx instead for jump target storage in retpoline instructions.
> >
> > Signed-off-by: Maciej Fijalkowski <maciej.fijalkowski@intel.com>
> > ---
> > arch/x86/include/asm/nospec-branch.h | 16 ++++++++--------
> > 1 file changed, 8 insertions(+), 8 deletions(-)
> >
> > diff --git a/arch/x86/include/asm/nospec-branch.h b/arch/x86/include/asm/nospec-branch.h
> > index e7752b4038ff..e491c3d9f227 100644
> > --- a/arch/x86/include/asm/nospec-branch.h
> > +++ b/arch/x86/include/asm/nospec-branch.h
> > @@ -314,19 +314,19 @@ static inline void mds_idle_clear_cpu_buffers(void)
> > * lfence
> > * jmp spec_trap
> > * do_rop:
> > - * mov %rax,(%rsp) for x86_64
> > + * mov %rcx,(%rsp) for x86_64
> > * mov %edx,(%esp) for x86_32
> > * retq
> > *
> > * Without retpolines configured:
> > *
> > - * jmp *%rax for x86_64
> > + * jmp *%rcx for x86_64
> > * jmp *%edx for x86_32
> > */
> > #ifdef CONFIG_RETPOLINE
> > # ifdef CONFIG_X86_64
> > -# define RETPOLINE_RAX_BPF_JIT_SIZE 17
> > -# define RETPOLINE_RAX_BPF_JIT() \
> > +# define RETPOLINE_RCX_BPF_JIT_SIZE 17
> > +# define RETPOLINE_RCX_BPF_JIT() \
> > do { \
> > EMIT1_off32(0xE8, 7); /* callq do_rop */ \
> > /* spec_trap: */ \
> > @@ -334,7 +334,7 @@ do { \
> > EMIT3(0x0F, 0xAE, 0xE8); /* lfence */ \
> > EMIT2(0xEB, 0xF9); /* jmp spec_trap */ \
> > /* do_rop: */ \
> > - EMIT4(0x48, 0x89, 0x04, 0x24); /* mov %rax,(%rsp) */ \
> > + EMIT4(0x48, 0x89, 0x0C, 0x24); /* mov %rcx,(%rsp) */ \
> > EMIT1(0xC3); /* retq */ \
> > } while (0)
> > # else /* !CONFIG_X86_64 */
> > @@ -352,9 +352,9 @@ do { \
> > # endif
> > #else /* !CONFIG_RETPOLINE */
> > # ifdef CONFIG_X86_64
> > -# define RETPOLINE_RAX_BPF_JIT_SIZE 2
> > -# define RETPOLINE_RAX_BPF_JIT() \
> > - EMIT2(0xFF, 0xE0); /* jmp *%rax */
> > +# define RETPOLINE_RCX_BPF_JIT_SIZE 2
> > +# define RETPOLINE_RCX_BPF_JIT() \
> > + EMIT2(0xFF, 0xE1); /* jmp *%rcx */
>
> Hmm, so the target prog gets loaded into rax in emit_bpf_tail_call_indirect()
> but then you jump into rcx? What am I missing? This still needs to be bisectable.
Somehow your comments on patches 1, 2 and 3 didn't arrive to my work mail.
I'm responding from web-gmail as my client seems to be broken and I am
in a bit of hurry, so apologize for any inconveniences...
You are right of course, I will include the JIT change in this patch on v2.
>
> > # else /* !CONFIG_X86_64 */
> > # define RETPOLINE_EDX_BPF_JIT() \
> > EMIT2(0xFF, 0xE2) /* jmp *%edx */
> >
>
next prev parent reply other threads:[~2020-07-17 9:30 UTC|newest]
Thread overview: 19+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-07-15 23:36 [PATCH bpf-next 0/5] bpf: tailcalls in BPF subprograms Maciej Fijalkowski
2020-07-15 23:36 ` [PATCH bpf-next 1/5] bpf, x64: use %rcx instead of %rax for tail call retpolines Maciej Fijalkowski
2020-07-16 20:36 ` Daniel Borkmann
2020-07-17 9:29 ` Maciej Fijalkowski [this message]
2020-07-15 23:36 ` [PATCH bpf-next 2/5] bpf: allow for tailcalls in BPF subprograms Maciej Fijalkowski
2020-07-16 21:10 ` Daniel Borkmann
2020-07-16 21:29 ` Daniel Borkmann
2020-07-16 22:46 ` Daniel Borkmann
2020-07-17 11:39 ` Maciej Fijalkowski
2020-07-15 23:36 ` [PATCH bpf-next 3/5] bpf: propagate poke descriptors to subprograms Maciej Fijalkowski
2020-07-16 21:16 ` Daniel Borkmann
2020-07-17 9:36 ` Maciej Fijalkowski
2020-07-15 23:36 ` [PATCH bpf-next 4/5] bpf, x64: rework pro/epilogue and tailcall handling in JIT Maciej Fijalkowski
2020-07-16 23:06 ` Daniel Borkmann
2020-07-17 2:16 ` Alexei Starovoitov
2020-07-17 10:57 ` Maciej Fijalkowski
2020-07-17 16:16 ` Alexei Starovoitov
2020-07-17 10:52 ` Maciej Fijalkowski
2020-07-15 23:36 ` [PATCH bpf-next 5/5] selftests: bpf: add dummy prog for bpf2bpf with tailcall Maciej Fijalkowski
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=CAOuyyO4B3V-TzzJLneEqXcPZWhhpPSe7kiY1G5g6NDMDVGazTQ@mail.gmail.com \
--to=maciejromanfijalkowski@gmail.com \
--cc=ast@kernel.org \
--cc=bjorn.topel@intel.com \
--cc=bpf@vger.kernel.org \
--cc=daniel@iogearbox.net \
--cc=maciej.fijalkowski@intel.com \
--cc=magnus.karlsson@intel.com \
--cc=netdev@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).