From: Alexei Starovoitov <alexei.starovoitov@gmail.com>
To: Daniel Borkmann <daniel@iogearbox.net>
Cc: ast@kernel.org, eric.dumazet@gmail.com,
torvalds@linux-foundation.org, netdev@vger.kernel.org
Subject: Re: [PATCH bpf v2] bpf, x64: implement retpoline for tail call
Date: Thu, 22 Feb 2018 15:33:46 -0800 [thread overview]
Message-ID: <20180222233344.3o7vzkojymsngqgz@ast-mbp> (raw)
In-Reply-To: <20180222141253.3639-1-daniel@iogearbox.net>
On Thu, Feb 22, 2018 at 03:12:53PM +0100, Daniel Borkmann wrote:
> Implement a retpoline [0] for the BPF tail call JIT'ing that converts
> the indirect jump via jmp %rax that is used to make the long jump into
> another JITed BPF image. Since this is subject to speculative execution,
> we need to control the transient instruction sequence here as well
> when CONFIG_RETPOLINE is set, and direct it into a pause + lfence loop.
> The latter aligns also with what gcc / clang emits (e.g. [1]).
>
> JIT dump after patch:
>
> # bpftool p d x i 1
> 0: (18) r2 = map[id:1]
> 2: (b7) r3 = 0
> 3: (85) call bpf_tail_call#12
> 4: (b7) r0 = 2
> 5: (95) exit
>
> With CONFIG_RETPOLINE:
>
> # bpftool p d j i 1
> [...]
> 33: cmp %edx,0x24(%rsi)
> 36: jbe 0x0000000000000072 |*
> 38: mov 0x24(%rbp),%eax
> 3e: cmp $0x20,%eax
> 41: ja 0x0000000000000072 |
> 43: add $0x1,%eax
> 46: mov %eax,0x24(%rbp)
> 4c: mov 0x90(%rsi,%rdx,8),%rax
> 54: test %rax,%rax
> 57: je 0x0000000000000072 |
> 59: mov 0x28(%rax),%rax
> 5d: add $0x25,%rax
> 61: callq 0x000000000000006d |+
> 66: pause |
> 68: lfence |
> 6b: jmp 0x0000000000000066 |
> 6d: mov %rax,(%rsp) |
> 71: retq |
> 72: mov $0x2,%eax
> [...]
>
> * relative fall-through jumps in error case
> + retpoline for indirect jump
>
> Without CONFIG_RETPOLINE:
>
> # bpftool p d j i 1
> [...]
> 33: cmp %edx,0x24(%rsi)
> 36: jbe 0x0000000000000063 |*
> 38: mov 0x24(%rbp),%eax
> 3e: cmp $0x20,%eax
> 41: ja 0x0000000000000063 |
> 43: add $0x1,%eax
> 46: mov %eax,0x24(%rbp)
> 4c: mov 0x90(%rsi,%rdx,8),%rax
> 54: test %rax,%rax
> 57: je 0x0000000000000063 |
> 59: mov 0x28(%rax),%rax
> 5d: add $0x25,%rax
> 61: jmpq *%rax |-
> 63: mov $0x2,%eax
> [...]
>
> * relative fall-through jumps in error case
> - plain indirect jump as before
>
> [0] https://support.google.com/faqs/answer/7625886
> [1] https://github.com/gcc-mirror/gcc/commit/a31e654fa107be968b802786d747e962c2fcdb2b
>
> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
> ---
> v1 -> v2:
> - Moved into nospec-branch.h as suggested by Eric, thanks!
Applied to bpf tree, Thanks Daniel.
prev parent reply other threads:[~2018-02-22 23:34 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-02-22 14:12 [PATCH bpf v2] bpf, x64: implement retpoline for tail call Daniel Borkmann
2018-02-22 23:33 ` Alexei Starovoitov [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20180222233344.3o7vzkojymsngqgz@ast-mbp \
--to=alexei.starovoitov@gmail.com \
--cc=ast@kernel.org \
--cc=daniel@iogearbox.net \
--cc=eric.dumazet@gmail.com \
--cc=netdev@vger.kernel.org \
--cc=torvalds@linux-foundation.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).