From: "Shi, Yang" <yang.shi@linaro.org>
To: Z Lim <zlim.lnx@gmail.com>,
Alexei Starovoitov <alexei.starovoitov@gmail.com>,
Catalin Marinas <catalin.marinas@arm.com>,
Will Deacon <will.deacon@arm.com>
Cc: Alexei Starovoitov <ast@kernel.org>,
daniel@iogearbox.net, Xi Wang <xi.wang@gmail.com>,
LKML <linux-kernel@vger.kernel.org>,
Network Development <netdev@vger.kernel.org>,
"linux-arm-kernel@lists.infradead.org"
<linux-arm-kernel@lists.infradead.org>,
linaro-kernel@lists.linaro.org
Subject: Re: [PATCH] arm64: bpf: fix JIT stack setup
Date: Mon, 09 Nov 2015 10:08:53 -0800 [thread overview]
Message-ID: <5640E135.2020007@linaro.org> (raw)
In-Reply-To: <CABg9mcv8W4_pvkEQKtjBPi5ycMgLPksYoPtYnGr6tdcb5ER8YQ@mail.gmail.com>
On 11/8/2015 2:29 PM, Z Lim wrote:
> On Sat, Nov 7, 2015 at 6:27 PM, Alexei Starovoitov
> <alexei.starovoitov@gmail.com> wrote:
>> On Fri, Nov 06, 2015 at 09:36:17PM -0800, Yang Shi wrote:
>>> ARM64 JIT used FP (x29) as eBPF fp register, but FP is subjected to
>>> change during function call so it may cause the BPF prog stack base address
>>> change too. Whenever, it pointed to the bottom of BPF prog stack instead of
>>> the top.
>>>
>>> So, when copying data via bpf_probe_read, it will be copied to (SP - offset),
>>> then it may overwrite the saved FP/LR.
>>>
>>> Use x25 to replace FP as BPF stack base register (fp). Since x25 is callee
>>> saved register, so it will keep intact during function call.
>>> It is initialized in BPF prog prologue when BPF prog is started to run
>>> everytime. When BPF prog exits, it could be just tossed.
>>>
>>> Other than this the BPf prog stack base need to be setup before function
>>> call stack.
>>>
>>> So, the BPF stack layout looks like:
>>>
>>> high
>>> original A64_SP => 0:+-----+ BPF prologue
>>> | | FP/LR and callee saved registers
>>> BPF fp register => +64:+-----+
>>> | |
>>> | ... | BPF prog stack
>>> | |
>>> | |
>>> current A64_SP => +-----+
>>> | |
>>> | ... | Function call stack
>>> | |
>>> +-----+
>>> low
>>>
>>> Signed-off-by: Yang Shi <yang.shi@linaro.org>
>>> CC: Zi Shen Lim <zlim.lnx@gmail.com>
>>> CC: Xi Wang <xi.wang@gmail.com>
>>
>> Thanks for tracking it down.
>> That looks like fundamental bug in arm64 jit. I'm surprised function calls worked at all.
>> Zi please review.
>>
>
> For function calls (BPF_JMP | BPF_CALL), we are compliant with AAPCS64
> [1]. That part is okay.
>
>
> bpf_probe_read accesses the BPF program stack, which is based on BPF_REG_FP.
>
> This exposes an issue with how BPF_REG_FP was setup, as Yang pointed out.
> Instead of having BPF_REG_FP point to top of stack, we erroneously
> point it to the bottom of stack. When there are function calls, we run
> the risk of clobbering of BPF stack. Bad idea.
Yes, exactly.
>
> Otherwise, since BPF_REG_FP is read-only, and is setup exactly once in
> prologue, it remains consistent throughout lifetime of the BPF
> program.
>
>
> Yang, can you please try the following?
It should work without the below change:
+ emit(A64_MOV(1, A64_FP, A64_SP), ctx);
I added it to stay align with ARMv8 AAPCS to maintain the correct FP
during function call. It makes us get correct stack backtrace.
I think we'd better to keep compliant with ARMv8 AAPCS in BPF JIT
prologue too.
If nobody thinks it is necessary, we definitely could remove that change.
Thanks,
Yang
>
> 8<-----
> --- a/arch/arm64/net/bpf_jit_comp.c
> +++ b/arch/arm64/net/bpf_jit_comp.c
> @@ -161,12 +161,12 @@ static void build_prologue(struct jit_ctx *ctx)
> if (ctx->tmp_used)
> emit(A64_PUSH(tmp1, tmp2, A64_SP), ctx);
>
> - /* Set up BPF stack */
> - emit(A64_SUB_I(1, A64_SP, A64_SP, stack_size), ctx);
> -
> /* Set up frame pointer */
> emit(A64_MOV(1, fp, A64_SP), ctx);
>
> + /* Set up BPF stack */
> + emit(A64_SUB_I(1, A64_SP, A64_SP, stack_size), ctx);
> +
> /* Clear registers A and X */
> emit_a64_mov_i64(ra, 0, ctx);
> emit_a64_mov_i64(rx, 0, ctx);
> ----->8
>
> [1] http://infocenter.arm.com/help/topic/com.arm.doc.ihi0055b/IHI0055B_aapcs64.pdf
>
next prev parent reply other threads:[~2015-11-09 18:08 UTC|newest]
Thread overview: 9+ messages / expand[flat|nested] mbox.gz Atom feed top
2015-11-07 5:36 [PATCH] arm64: bpf: fix JIT stack setup Yang Shi
2015-11-08 2:27 ` Alexei Starovoitov
2015-11-08 22:29 ` Z Lim
2015-11-09 18:08 ` Shi, Yang [this message]
2015-11-09 20:00 ` Z Lim
2015-11-10 19:46 ` Shi, Yang
2015-11-11 3:11 ` Z Lim
-- strict thread matches above, loose matches on Subject: below --
2015-11-07 5:34 Yang Shi
2015-11-07 5:55 ` Shi, Yang
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=5640E135.2020007@linaro.org \
--to=yang.shi@linaro.org \
--cc=alexei.starovoitov@gmail.com \
--cc=ast@kernel.org \
--cc=catalin.marinas@arm.com \
--cc=daniel@iogearbox.net \
--cc=linaro-kernel@lists.linaro.org \
--cc=linux-arm-kernel@lists.infradead.org \
--cc=linux-kernel@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=will.deacon@arm.com \
--cc=xi.wang@gmail.com \
--cc=zlim.lnx@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).