From: Luis Gerhorst <luis.gerhorst@fau.de>
To: Daniel Borkmann <daniel@iogearbox.net>
Cc: puranjay@kernel.org, memxor@gmail.com, ast@kernel.org,
bpf@vger.kernel.org
Subject: Re: [PATCH bpf-next 03/21] bpf, arm64: Emit ISB SY in the speculation barriers
Date: Wed, 28 Oct 2026 14:29:32 +0100 [thread overview]
Message-ID: <87h5i6uf5v.fsf@fau.de> (raw)
In-Reply-To: <20261027182445.1156335-4-daniel@iogearbox.net> (Daniel Borkmann's message of "Tue, 27 Oct 2026 19:24:27 +0100")
Daniel Borkmann <daniel@iogearbox.net> writes:
> The Spectre-BHB loop of the epilogue and BPF_NOSPEC on cores without
> FEAT_SB end in an ISB, which the JIT took from
> aarch64_insn_get_isb_value(), the template of the instruction matcher
> with CRm 0. The Arm ARM lists every CRm other than 0b1111 as reserved:
> those encodings execute as a full system barrier, but must not be relied
> upon by software. Emit ISB SY with CRm 0b1111, as the assembler does for
> the isb of the kernel's own barriers.
>
> Before/after:
>
> d50330df isb #0
> d5033fdf isb
>
> Fixes: 0dfefc2ea2f2 ("arm64: bpf: Add BHB mitigation to the epilogue for cBPF programs")
> Fixes: dff883d9e93a ("bpf, arm64, powerpc: Change nospec to include v1 barrier")
> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Tested on ThunderX2-99xx in KVM (BHB loop forced on).
Tested-by: Luis Gerhorst <luis.gerhorst@fau.de>
> ---
> arch/arm64/net/bpf_jit.h | 2 +-
> arch/arm64/net/bpf_jit_comp.c | 2 +-
> 2 files changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/arch/arm64/net/bpf_jit.h b/arch/arm64/net/bpf_jit.h
> index b2fe6e6dcf44..af570c34a96d 100644
> --- a/arch/arm64/net/bpf_jit.h
> +++ b/arch/arm64/net/bpf_jit.h
> @@ -341,6 +341,6 @@
> /* Barriers */
> #define A64_SB aarch64_insn_get_sb_value()
> #define A64_DSB_NSH (aarch64_insn_get_dsb_base_value() | 0x7 << 8)
> -#define A64_ISB aarch64_insn_get_isb_value()
> +#define A64_ISB (aarch64_insn_get_isb_value() | 0xf << 8)
>
> #endif /* _BPF_JIT_H */
> diff --git a/arch/arm64/net/bpf_jit_comp.c b/arch/arm64/net/bpf_jit_comp.c
> index febe072a8af2..7d5eb949cdf4 100644
> --- a/arch/arm64/net/bpf_jit_comp.c
> +++ b/arch/arm64/net/bpf_jit_comp.c
> @@ -1026,7 +1026,7 @@ static void __maybe_unused build_bhb_mitigation(struct jit_ctx *ctx)
> emit(A64_SUBS_I(true, r1, r1, 1), ctx);
> emit(A64_B_(A64_COND_NE, -2), ctx);
> emit(aarch64_insn_gen_dsb(AARCH64_INSN_MB_ISH), ctx);
> - emit(aarch64_insn_get_isb_value(), ctx);
> + emit(A64_ISB, ctx);
> }
>
> if (is_spectre_bhb_fw_mitigated()) {
next prev parent reply other threads:[~2026-10-28 13:29 UTC|newest]
Thread overview: 31+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-10-27 18:24 [PATCH bpf-next 00/21] bpf: Various arm64 BPF JIT improvements Daniel Borkmann
2026-10-27 18:24 ` [PATCH bpf-next 01/21] bpf, arm64: Free the offset table of a subprog in bpf_jit_free Daniel Borkmann
2026-10-27 18:24 ` [PATCH bpf-next 02/21] bpf, arm64: Free the private stack when a pass over the image fails Daniel Borkmann
2026-10-27 18:24 ` [PATCH bpf-next 03/21] bpf, arm64: Emit ISB SY in the speculation barriers Daniel Borkmann
2026-10-28 13:29 ` Luis Gerhorst [this message]
2026-10-28 13:38 ` Daniel Borkmann
2026-10-27 18:24 ` [PATCH bpf-next 04/21] arm64, insn: Reject sign extending loads of 64 bits Daniel Borkmann
2026-10-27 18:24 ` [PATCH bpf-next 05/21] bpf, arm64: Keep the ll/sc atomics address apart from the old value Daniel Borkmann
2026-10-27 18:24 ` [PATCH bpf-next 06/21] arm64, insn: Add the LDUR/STUR, UMULH/SMULH and TBZ/TBNZ encodings Daniel Borkmann
2026-10-27 18:24 ` [PATCH bpf-next 07/21] bpf: Move the division magic number computation out of the x86 JIT Daniel Borkmann
2026-10-28 18:38 ` Alexei Starovoitov
2026-10-27 18:24 ` [PATCH bpf-next 08/21] bpf, arm64: Consolidate the load and store emission into a helper Daniel Borkmann
2026-10-27 18:24 ` [PATCH bpf-next 09/21] bpf, arm64: Use the unscaled forms for negative and unaligned offsets Daniel Borkmann
2026-10-27 18:24 ` [PATCH bpf-next 10/21] bpf, arm64: Store zero immediates from the zero register Daniel Borkmann
2026-10-27 18:24 ` [PATCH bpf-next 11/21] bpf, arm64: Zero extend the arena offset in register offset accesses Daniel Borkmann
2026-10-27 18:24 ` [PATCH bpf-next 12/21] bpf, arm64: Adjust compares with unencodable immediates by one Daniel Borkmann
2026-10-27 18:24 ` [PATCH bpf-next 13/21] bpf, arm64: Materialize immediates with fewer instructions Daniel Borkmann
2026-10-27 18:24 ` [PATCH bpf-next 14/21] bpf, arm64: Shorten the tail call sequence Daniel Borkmann
2026-10-29 11:43 ` Xu Kuohai
2026-10-27 18:24 ` [PATCH bpf-next 15/21] bpf, arm64: Divide by constants via multiplication with a magic number Daniel Borkmann
2026-10-27 19:08 ` bot+bpf-ci
2026-10-27 18:24 ` [PATCH bpf-next 16/21] bpf, arm64: Use a move or mvn for the and and xor with all ones Daniel Borkmann
2026-10-27 18:24 ` [PATCH bpf-next 17/21] bpf, arm64: Use cbz, cbnz, tbz and tbnz for zero, sign and bit tests Daniel Borkmann
2026-10-28 18:39 ` Alexei Starovoitov
2026-10-27 18:24 ` [PATCH bpf-next 18/21] bpf, arm64: Multiply by constants with shifts, adds and subs Daniel Borkmann
2026-10-27 18:24 ` [PATCH bpf-next 19/21] bpf, arm64: Split 24-bit immediates of add, sub and equality compares Daniel Borkmann
2026-10-28 18:41 ` Alexei Starovoitov
2026-10-27 18:24 ` [PATCH bpf-next 20/21] selftests/bpf: Let the arm64 private stack check skip the BTI pad Daniel Borkmann
2026-10-27 18:24 ` [PATCH bpf-next 21/21] selftests/bpf: Extend the JIT instruction tests for arm64 encodings Daniel Borkmann
2026-10-27 19:08 ` bot+bpf-ci
2026-10-28 12:38 ` Daniel Borkmann
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=87h5i6uf5v.fsf@fau.de \
--to=luis.gerhorst@fau.de \
--cc=ast@kernel.org \
--cc=bpf@vger.kernel.org \
--cc=daniel@iogearbox.net \
--cc=memxor@gmail.com \
--cc=puranjay@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.