From: Alexei Starovoitov <alexei.starovoitov@gmail.com>
To: Yang Shi <yang.shi@linaro.org>
Cc: ast@kernel.org, daniel@iogearbox.net, catalin.marinas@arm.com,
will.deacon@arm.com, zlim.lnx@gmail.com, xi.wang@gmail.com,
linux-kernel@vger.kernel.org, netdev@vger.kernel.org,
linux-arm-kernel@lists.infradead.org,
linaro-kernel@lists.linaro.org
Subject: Re: [PATCH] arm64: bpf: fix JIT stack setup
Date: Sat, 7 Nov 2015 18:27:27 -0800 [thread overview]
Message-ID: <20151108022726.GB39441@ast-mbp.thefacebook.com> (raw)
In-Reply-To: <1446874577-14539-1-git-send-email-yang.shi@linaro.org>
On Fri, Nov 06, 2015 at 09:36:17PM -0800, Yang Shi wrote:
> ARM64 JIT used FP (x29) as eBPF fp register, but FP is subjected to
> change during function call so it may cause the BPF prog stack base address
> change too. Whenever, it pointed to the bottom of BPF prog stack instead of
> the top.
>
> So, when copying data via bpf_probe_read, it will be copied to (SP - offset),
> then it may overwrite the saved FP/LR.
>
> Use x25 to replace FP as BPF stack base register (fp). Since x25 is callee
> saved register, so it will keep intact during function call.
> It is initialized in BPF prog prologue when BPF prog is started to run
> everytime. When BPF prog exits, it could be just tossed.
>
> Other than this the BPf prog stack base need to be setup before function
> call stack.
>
> So, the BPF stack layout looks like:
>
> high
> original A64_SP => 0:+-----+ BPF prologue
> | | FP/LR and callee saved registers
> BPF fp register => +64:+-----+
> | |
> | ... | BPF prog stack
> | |
> | |
> current A64_SP => +-----+
> | |
> | ... | Function call stack
> | |
> +-----+
> low
>
> Signed-off-by: Yang Shi <yang.shi@linaro.org>
> CC: Zi Shen Lim <zlim.lnx@gmail.com>
> CC: Xi Wang <xi.wang@gmail.com>
Thanks for tracking it down.
That looks like fundamental bug in arm64 jit. I'm surprised function calls worked at all.
Zi please review.
next prev parent reply other threads:[~2015-11-08 2:27 UTC|newest]
Thread overview: 9+ messages / expand[flat|nested] mbox.gz Atom feed top
2015-11-07 5:36 [PATCH] arm64: bpf: fix JIT stack setup Yang Shi
2015-11-08 2:27 ` Alexei Starovoitov [this message]
2015-11-08 22:29 ` Z Lim
2015-11-09 18:08 ` Shi, Yang
2015-11-09 20:00 ` Z Lim
2015-11-10 19:46 ` Shi, Yang
2015-11-11 3:11 ` Z Lim
-- strict thread matches above, loose matches on Subject: below --
2015-11-07 5:34 Yang Shi
2015-11-07 5:55 ` Shi, Yang
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20151108022726.GB39441@ast-mbp.thefacebook.com \
--to=alexei.starovoitov@gmail.com \
--cc=ast@kernel.org \
--cc=catalin.marinas@arm.com \
--cc=daniel@iogearbox.net \
--cc=linaro-kernel@lists.linaro.org \
--cc=linux-arm-kernel@lists.infradead.org \
--cc=linux-kernel@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=will.deacon@arm.com \
--cc=xi.wang@gmail.com \
--cc=yang.shi@linaro.org \
--cc=zlim.lnx@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).