From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2DD79C433EF for ; Fri, 8 Jul 2022 09:08:15 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S237850AbiGHJIN (ORCPT ); Fri, 8 Jul 2022 05:08:13 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:33040 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S237847AbiGHJIK (ORCPT ); Fri, 8 Jul 2022 05:08:10 -0400 Received: from szxga01-in.huawei.com (szxga01-in.huawei.com [45.249.212.187]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id E664922BC6; Fri, 8 Jul 2022 02:08:08 -0700 (PDT) Received: from kwepemi500013.china.huawei.com (unknown [172.30.72.53]) by szxga01-in.huawei.com (SkyGuard) with ESMTP id 4LfS7w3r6BzhXYy; Fri, 8 Jul 2022 17:06:36 +0800 (CST) Received: from [10.67.111.192] (10.67.111.192) by kwepemi500013.china.huawei.com (7.221.188.120) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2375.24; Fri, 8 Jul 2022 17:08:05 +0800 Message-ID: Date: Fri, 8 Jul 2022 17:08:04 +0800 MIME-Version: 1.0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Thunderbird/91.9.0 Subject: Re: [PATCH bpf-next v6 4/4] bpf, arm64: bpf trampoline for arm64 Content-Language: en-US To: Jean-Philippe Brucker CC: , , , , Mark Rutland , Catalin Marinas , Will Deacon , Daniel Borkmann , Alexei Starovoitov , Zi Shen Lim , Andrii Nakryiko , Martin KaFai Lau , Song Liu , Yonghong Song , John Fastabend , KP Singh , "David S . Miller" , Hideaki YOSHIFUJI , David Ahern , Thomas Gleixner , Ingo Molnar , Borislav Petkov , Dave Hansen , , "H . Peter Anvin" , Jakub Kicinski , Jesper Dangaard Brouer , Russell King , James Morse , Hou Tao , Jason Wang References: <20220625161255.547944-1-xukuohai@huawei.com> <20220625161255.547944-5-xukuohai@huawei.com> From: Xu Kuohai In-Reply-To: Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: 7bit X-Originating-IP: [10.67.111.192] X-ClientProxiedBy: dggems704-chm.china.huawei.com (10.3.19.181) To kwepemi500013.china.huawei.com (7.221.188.120) X-CFilter-Loop: Reflected Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 7/8/2022 4:24 PM, Jean-Philippe Brucker wrote: > On Fri, Jul 08, 2022 at 12:35:33PM +0800, Xu Kuohai wrote: >>>> + >>>> + emit(A64_ADD_I(1, A64_R(0), A64_SP, args_off), ctx); >>>> + if (!p->jited) >>>> + emit_addr_mov_i64(A64_R(1), (const u64)p->insnsi, ctx); >>>> + >>>> + emit_call((const u64)p->bpf_func, ctx); >>>> + >>>> + /* store return value */ >>>> + if (save_ret) >>>> + emit(A64_STR64I(r0, A64_SP, retval_off), ctx); >>> >>> Here too I think it should be x0. I'm guessing r0 may work for jitted >>> functions but not interpreted ones >>> >> >> Yes, r0 is only correct for jitted code, will fix it to: >> >> if (save_ret) >> emit(A64_STR64I(p->jited ? r0 : A64_R(0), A64_SP, retval_off), >> ctx); > > I don't think we need this test because x0 should be correct in all cases. > x7 happens to equal x0 when jitted due to the way build_epilogue() builds > the function at the moment, but we shouldn't rely on that. > > >>>> + if (flags & BPF_TRAMP_F_CALL_ORIG) { >>>> + restore_args(ctx, args_off, nargs); >>>> + /* call original func */ >>>> + emit(A64_LDR64I(A64_R(10), A64_SP, retaddr_off), ctx); >>>> + emit(A64_BLR(A64_R(10)), ctx); >>> >>> I don't think we can do this when BTI is enabled because we're not jumping >>> to a BTI instruction. We could introduce one in a patched BPF function >>> (there currently is one if CONFIG_ARM64_PTR_AUTH_KERNEL), but probably not >>> in a kernel function. >>> >>> We could fo like FUNCTION_GRAPH_TRACER does and return to the patched >>> function after modifying its LR. Not sure whether that works with pointer >>> auth though. >>> >> >> Yes, the blr instruction should be replaced with ret instruction, thanks! >> >> The layout for bpf prog and regular kernel function is as follows, with >> bti always coming first and paciasp immediately after patchsite, so the >> ret instruction should work in all cases. >> >> bpf prog or kernel function: >> bti c // if BTI >> mov x9, lr >> bl ------> trampoline: >> ... >> mov lr, >> mov x10, >> ORIG_CALL_entry: <------- ret x10 >> return_entry: >> ... >> paciasp // if PA >> ... > > Actually I just noticed that CONFIG_ARM64_BTI_KERNEL depends on > CONFIG_ARM64_PTR_AUTH_KERNEL, so we should be able to rely on there always > being a PACIASP at ORIG_CALL_entry, and since it's a landing pad for BLR > we don't need to make this a RET > > 92e2294d870b ("arm64: bti: Support building kernel C code using BTI") > oh, yeah, thanks > Thanks, > Jean > > . From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id A5726C433EF for ; Fri, 8 Jul 2022 09:10:13 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:In-Reply-To:From:References:CC:To: Subject:MIME-Version:Date:Message-ID:Reply-To:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: List-Owner; bh=u+l1lC5OEEWqtnV8Ik5QQUmcddr9nhv2aLZIX6156Jo=; b=Y+jYFSvLiefAwp vM3A46LJo15o/nGvRmXPvk1kBRE+1BWYtGNWxLapeVnFdmmbsLiEOB/X725q1IsuSHRIw26Pkqi/8 CpBQRajlodQwoOrOEAmLOdT4Lx2Hyir9EYSKpKAkUL3E8oFxiVZv6WPGUs4iTQn28Xr6DWA+MRilv sKyO/+Mhf0HeiFwX+6eK7/r75Domvt9S02sr0QX/vfkRrFiEmoVlBsE58tGsXNcwNd+vexfb0HUwt dI1rw9r2+IrMKbW8sOuaUyaPwzufFOlRdVEVA24QRlIkHyscUhmnnCyKumcx4NS34aIO6tSJRZc4X 81oUSTMx5AauCEQErHFQ==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.94.2 #2 (Red Hat Linux)) id 1o9jyq-002mfF-HM; Fri, 08 Jul 2022 09:08:57 +0000 Received: from szxga01-in.huawei.com ([45.249.212.187]) by bombadil.infradead.org with esmtps (Exim 4.94.2 #2 (Red Hat Linux)) id 1o9jy4-002mS5-O5 for linux-arm-kernel@lists.infradead.org; Fri, 08 Jul 2022 09:08:10 +0000 Received: from kwepemi500013.china.huawei.com (unknown [172.30.72.53]) by szxga01-in.huawei.com (SkyGuard) with ESMTP id 4LfS7w3r6BzhXYy; Fri, 8 Jul 2022 17:06:36 +0800 (CST) Received: from [10.67.111.192] (10.67.111.192) by kwepemi500013.china.huawei.com (7.221.188.120) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2375.24; Fri, 8 Jul 2022 17:08:05 +0800 Message-ID: Date: Fri, 8 Jul 2022 17:08:04 +0800 MIME-Version: 1.0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Thunderbird/91.9.0 Subject: Re: [PATCH bpf-next v6 4/4] bpf, arm64: bpf trampoline for arm64 Content-Language: en-US To: Jean-Philippe Brucker CC: , , , , Mark Rutland , Catalin Marinas , Will Deacon , Daniel Borkmann , Alexei Starovoitov , Zi Shen Lim , Andrii Nakryiko , Martin KaFai Lau , Song Liu , Yonghong Song , John Fastabend , KP Singh , "David S . Miller" , Hideaki YOSHIFUJI , David Ahern , Thomas Gleixner , Ingo Molnar , Borislav Petkov , Dave Hansen , , "H . Peter Anvin" , Jakub Kicinski , Jesper Dangaard Brouer , Russell King , James Morse , Hou Tao , Jason Wang References: <20220625161255.547944-1-xukuohai@huawei.com> <20220625161255.547944-5-xukuohai@huawei.com> From: Xu Kuohai In-Reply-To: X-Originating-IP: [10.67.111.192] X-ClientProxiedBy: dggems704-chm.china.huawei.com (10.3.19.181) To kwepemi500013.china.huawei.com (7.221.188.120) X-CFilter-Loop: Reflected X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20220708_020809_239064_2AF26841 X-CRM114-Status: GOOD ( 20.62 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org On 7/8/2022 4:24 PM, Jean-Philippe Brucker wrote: > On Fri, Jul 08, 2022 at 12:35:33PM +0800, Xu Kuohai wrote: >>>> + >>>> + emit(A64_ADD_I(1, A64_R(0), A64_SP, args_off), ctx); >>>> + if (!p->jited) >>>> + emit_addr_mov_i64(A64_R(1), (const u64)p->insnsi, ctx); >>>> + >>>> + emit_call((const u64)p->bpf_func, ctx); >>>> + >>>> + /* store return value */ >>>> + if (save_ret) >>>> + emit(A64_STR64I(r0, A64_SP, retval_off), ctx); >>> >>> Here too I think it should be x0. I'm guessing r0 may work for jitted >>> functions but not interpreted ones >>> >> >> Yes, r0 is only correct for jitted code, will fix it to: >> >> if (save_ret) >> emit(A64_STR64I(p->jited ? r0 : A64_R(0), A64_SP, retval_off), >> ctx); > > I don't think we need this test because x0 should be correct in all cases. > x7 happens to equal x0 when jitted due to the way build_epilogue() builds > the function at the moment, but we shouldn't rely on that. > > >>>> + if (flags & BPF_TRAMP_F_CALL_ORIG) { >>>> + restore_args(ctx, args_off, nargs); >>>> + /* call original func */ >>>> + emit(A64_LDR64I(A64_R(10), A64_SP, retaddr_off), ctx); >>>> + emit(A64_BLR(A64_R(10)), ctx); >>> >>> I don't think we can do this when BTI is enabled because we're not jumping >>> to a BTI instruction. We could introduce one in a patched BPF function >>> (there currently is one if CONFIG_ARM64_PTR_AUTH_KERNEL), but probably not >>> in a kernel function. >>> >>> We could fo like FUNCTION_GRAPH_TRACER does and return to the patched >>> function after modifying its LR. Not sure whether that works with pointer >>> auth though. >>> >> >> Yes, the blr instruction should be replaced with ret instruction, thanks! >> >> The layout for bpf prog and regular kernel function is as follows, with >> bti always coming first and paciasp immediately after patchsite, so the >> ret instruction should work in all cases. >> >> bpf prog or kernel function: >> bti c // if BTI >> mov x9, lr >> bl ------> trampoline: >> ... >> mov lr, >> mov x10, >> ORIG_CALL_entry: <------- ret x10 >> return_entry: >> ... >> paciasp // if PA >> ... > > Actually I just noticed that CONFIG_ARM64_BTI_KERNEL depends on > CONFIG_ARM64_PTR_AUTH_KERNEL, so we should be able to rely on there always > being a PACIASP at ORIG_CALL_entry, and since it's a landing pad for BLR > we don't need to make this a RET > > 92e2294d870b ("arm64: bti: Support building kernel C code using BTI") > oh, yeah, thanks > Thanks, > Jean > > . _______________________________________________ linux-arm-kernel mailing list linux-arm-kernel@lists.infradead.org http://lists.infradead.org/mailman/listinfo/linux-arm-kernel