From: Luis Gerhorst <luis.gerhorst@fau.de>
To: Daniel Borkmann <daniel@iogearbox.net>
Cc: puranjay@kernel.org, memxor@gmail.com, ast@kernel.org,
bpf@vger.kernel.org
Subject: Re: [PATCH bpf-next 03/21] bpf, arm64: Emit ISB SY in the speculation barriers
Date: Wed, 28 Oct 2026 14:29:32 +0100 [thread overview]
Message-ID: <87h5i6uf5v.fsf@fau.de> (raw)
In-Reply-To: <20261027182445.1156335-4-daniel@iogearbox.net> (Daniel Borkmann's message of "Tue, 27 Oct 2026 19:24:27 +0100")
Daniel Borkmann <daniel@iogearbox.net> writes:
> The Spectre-BHB loop of the epilogue and BPF_NOSPEC on cores without
> FEAT_SB end in an ISB, which the JIT took from
> aarch64_insn_get_isb_value(), the template of the instruction matcher
> with CRm 0. The Arm ARM lists every CRm other than 0b1111 as reserved:
> those encodings execute as a full system barrier, but must not be relied
> upon by software. Emit ISB SY with CRm 0b1111, as the assembler does for
> the isb of the kernel's own barriers.
>
> Before/after:
>
> d50330df isb #0
> d5033fdf isb
>
> Fixes: 0dfefc2ea2f2 ("arm64: bpf: Add BHB mitigation to the epilogue for cBPF programs")
> Fixes: dff883d9e93a ("bpf, arm64, powerpc: Change nospec to include v1 barrier")
> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Tested on ThunderX2-99xx in KVM (BHB loop forced on).
Tested-by: Luis Gerhorst <luis.gerhorst@fau.de>
> ---
> arch/arm64/net/bpf_jit.h | 2 +-
> arch/arm64/net/bpf_jit_comp.c | 2 +-
> 2 files changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/arch/arm64/net/bpf_jit.h b/arch/arm64/net/bpf_jit.h
> index b2fe6e6dcf44..af570c34a96d 100644
> --- a/arch/arm64/net/bpf_jit.h
> +++ b/arch/arm64/net/bpf_jit.h
> @@ -341,6 +341,6 @@
> /* Barriers */
> #define A64_SB aarch64_insn_get_sb_value()
> #define A64_DSB_NSH (aarch64_insn_get_dsb_base_value() | 0x7 << 8)
> -#define A64_ISB aarch64_insn_get_isb_value()
> +#define A64_ISB (aarch64_insn_get_isb_value() | 0xf << 8)
>
> #endif /* _BPF_JIT_H */
> diff --git a/arch/arm64/net/bpf_jit_comp.c b/arch/arm64/net/bpf_jit_comp.c
> index febe072a8af2..7d5eb949cdf4 100644
> --- a/arch/arm64/net/bpf_jit_comp.c
> +++ b/arch/arm64/net/bpf_jit_comp.c
> @@ -1026,7 +1026,7 @@ static void __maybe_unused build_bhb_mitigation(struct jit_ctx *ctx)
> emit(A64_SUBS_I(true, r1, r1, 1), ctx);
> emit(A64_B_(A64_COND_NE, -2), ctx);
> emit(aarch64_insn_gen_dsb(AARCH64_INSN_MB_ISH), ctx);
> - emit(aarch64_insn_get_isb_value(), ctx);
> + emit(A64_ISB, ctx);
> }
>
> if (is_spectre_bhb_fw_mitigated()) {
next prev parent reply other threads:[~2026-10-28 13:29 UTC|newest]
Thread overview: 30+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-10-27 18:24 [PATCH bpf-next 00/21] bpf: Various arm64 BPF JIT improvements Daniel Borkmann
2026-10-27 18:24 ` [PATCH bpf-next 01/21] bpf, arm64: Free the offset table of a subprog in bpf_jit_free Daniel Borkmann
2026-10-27 18:24 ` [PATCH bpf-next 02/21] bpf, arm64: Free the private stack when a pass over the image fails Daniel Borkmann
2026-10-27 18:24 ` [PATCH bpf-next 03/21] bpf, arm64: Emit ISB SY in the speculation barriers Daniel Borkmann
2026-10-28 13:29 ` Luis Gerhorst [this message]
2026-10-28 13:38 ` Daniel Borkmann
2026-10-27 18:24 ` [PATCH bpf-next 04/21] arm64, insn: Reject sign extending loads of 64 bits Daniel Borkmann
2026-10-27 18:24 ` [PATCH bpf-next 05/21] bpf, arm64: Keep the ll/sc atomics address apart from the old value Daniel Borkmann
2026-10-27 18:24 ` [PATCH bpf-next 06/21] arm64, insn: Add the LDUR/STUR, UMULH/SMULH and TBZ/TBNZ encodings Daniel Borkmann
2026-10-27 18:24 ` [PATCH bpf-next 07/21] bpf: Move the division magic number computation out of the x86 JIT Daniel Borkmann
2026-10-28 18:38 ` Alexei Starovoitov
2026-10-27 18:24 ` [PATCH bpf-next 08/21] bpf, arm64: Consolidate the load and store emission into a helper Daniel Borkmann
2026-10-27 18:24 ` [PATCH bpf-next 09/21] bpf, arm64: Use the unscaled forms for negative and unaligned offsets Daniel Borkmann
2026-10-27 18:24 ` [PATCH bpf-next 10/21] bpf, arm64: Store zero immediates from the zero register Daniel Borkmann
2026-10-27 18:24 ` [PATCH bpf-next 11/21] bpf, arm64: Zero extend the arena offset in register offset accesses Daniel Borkmann
2026-10-27 18:24 ` [PATCH bpf-next 12/21] bpf, arm64: Adjust compares with unencodable immediates by one Daniel Borkmann
2026-10-27 18:24 ` [PATCH bpf-next 13/21] bpf, arm64: Materialize immediates with fewer instructions Daniel Borkmann
2026-10-27 18:24 ` [PATCH bpf-next 14/21] bpf, arm64: Shorten the tail call sequence Daniel Borkmann
2026-10-27 18:24 ` [PATCH bpf-next 15/21] bpf, arm64: Divide by constants via multiplication with a magic number Daniel Borkmann
2026-10-27 19:08 ` bot+bpf-ci
2026-10-27 18:24 ` [PATCH bpf-next 16/21] bpf, arm64: Use a move or mvn for the and and xor with all ones Daniel Borkmann
2026-10-27 18:24 ` [PATCH bpf-next 17/21] bpf, arm64: Use cbz, cbnz, tbz and tbnz for zero, sign and bit tests Daniel Borkmann
2026-10-28 18:39 ` Alexei Starovoitov
2026-10-27 18:24 ` [PATCH bpf-next 18/21] bpf, arm64: Multiply by constants with shifts, adds and subs Daniel Borkmann
2026-10-27 18:24 ` [PATCH bpf-next 19/21] bpf, arm64: Split 24-bit immediates of add, sub and equality compares Daniel Borkmann
2026-10-28 18:41 ` Alexei Starovoitov
2026-10-27 18:24 ` [PATCH bpf-next 20/21] selftests/bpf: Let the arm64 private stack check skip the BTI pad Daniel Borkmann
2026-10-27 18:24 ` [PATCH bpf-next 21/21] selftests/bpf: Extend the JIT instruction tests for arm64 encodings Daniel Borkmann
2026-10-27 19:08 ` bot+bpf-ci
2026-10-28 12:38 ` Daniel Borkmann
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=87h5i6uf5v.fsf@fau.de \
--to=luis.gerhorst@fau.de \
--cc=ast@kernel.org \
--cc=bpf@vger.kernel.org \
--cc=daniel@iogearbox.net \
--cc=memxor@gmail.com \
--cc=puranjay@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox