From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6CD69C43334 for ; Fri, 8 Jul 2022 09:08:13 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S237493AbiGHJIM (ORCPT ); Fri, 8 Jul 2022 05:08:12 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:33040 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S237847AbiGHJIK (ORCPT ); Fri, 8 Jul 2022 05:08:10 -0400 Received: from szxga01-in.huawei.com (szxga01-in.huawei.com [45.249.212.187]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id E664922BC6; Fri, 8 Jul 2022 02:08:08 -0700 (PDT) Received: from kwepemi500013.china.huawei.com (unknown [172.30.72.53]) by szxga01-in.huawei.com (SkyGuard) with ESMTP id 4LfS7w3r6BzhXYy; Fri, 8 Jul 2022 17:06:36 +0800 (CST) Received: from [10.67.111.192] (10.67.111.192) by kwepemi500013.china.huawei.com (7.221.188.120) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2375.24; Fri, 8 Jul 2022 17:08:05 +0800 Message-ID: Date: Fri, 8 Jul 2022 17:08:04 +0800 MIME-Version: 1.0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Thunderbird/91.9.0 Subject: Re: [PATCH bpf-next v6 4/4] bpf, arm64: bpf trampoline for arm64 Content-Language: en-US To: Jean-Philippe Brucker CC: , , , , Mark Rutland , Catalin Marinas , Will Deacon , Daniel Borkmann , Alexei Starovoitov , Zi Shen Lim , Andrii Nakryiko , Martin KaFai Lau , Song Liu , Yonghong Song , John Fastabend , KP Singh , "David S . Miller" , Hideaki YOSHIFUJI , David Ahern , Thomas Gleixner , Ingo Molnar , Borislav Petkov , Dave Hansen , , "H . Peter Anvin" , Jakub Kicinski , Jesper Dangaard Brouer , Russell King , James Morse , Hou Tao , Jason Wang References: <20220625161255.547944-1-xukuohai@huawei.com> <20220625161255.547944-5-xukuohai@huawei.com> From: Xu Kuohai In-Reply-To: Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: 7bit X-Originating-IP: [10.67.111.192] X-ClientProxiedBy: dggems704-chm.china.huawei.com (10.3.19.181) To kwepemi500013.china.huawei.com (7.221.188.120) X-CFilter-Loop: Reflected Precedence: bulk List-ID: X-Mailing-List: bpf@vger.kernel.org On 7/8/2022 4:24 PM, Jean-Philippe Brucker wrote: > On Fri, Jul 08, 2022 at 12:35:33PM +0800, Xu Kuohai wrote: >>>> + >>>> + emit(A64_ADD_I(1, A64_R(0), A64_SP, args_off), ctx); >>>> + if (!p->jited) >>>> + emit_addr_mov_i64(A64_R(1), (const u64)p->insnsi, ctx); >>>> + >>>> + emit_call((const u64)p->bpf_func, ctx); >>>> + >>>> + /* store return value */ >>>> + if (save_ret) >>>> + emit(A64_STR64I(r0, A64_SP, retval_off), ctx); >>> >>> Here too I think it should be x0. I'm guessing r0 may work for jitted >>> functions but not interpreted ones >>> >> >> Yes, r0 is only correct for jitted code, will fix it to: >> >> if (save_ret) >> emit(A64_STR64I(p->jited ? r0 : A64_R(0), A64_SP, retval_off), >> ctx); > > I don't think we need this test because x0 should be correct in all cases. > x7 happens to equal x0 when jitted due to the way build_epilogue() builds > the function at the moment, but we shouldn't rely on that. > > >>>> + if (flags & BPF_TRAMP_F_CALL_ORIG) { >>>> + restore_args(ctx, args_off, nargs); >>>> + /* call original func */ >>>> + emit(A64_LDR64I(A64_R(10), A64_SP, retaddr_off), ctx); >>>> + emit(A64_BLR(A64_R(10)), ctx); >>> >>> I don't think we can do this when BTI is enabled because we're not jumping >>> to a BTI instruction. We could introduce one in a patched BPF function >>> (there currently is one if CONFIG_ARM64_PTR_AUTH_KERNEL), but probably not >>> in a kernel function. >>> >>> We could fo like FUNCTION_GRAPH_TRACER does and return to the patched >>> function after modifying its LR. Not sure whether that works with pointer >>> auth though. >>> >> >> Yes, the blr instruction should be replaced with ret instruction, thanks! >> >> The layout for bpf prog and regular kernel function is as follows, with >> bti always coming first and paciasp immediately after patchsite, so the >> ret instruction should work in all cases. >> >> bpf prog or kernel function: >> bti c // if BTI >> mov x9, lr >> bl ------> trampoline: >> ... >> mov lr, >> mov x10, >> ORIG_CALL_entry: <------- ret x10 >> return_entry: >> ... >> paciasp // if PA >> ... > > Actually I just noticed that CONFIG_ARM64_BTI_KERNEL depends on > CONFIG_ARM64_PTR_AUTH_KERNEL, so we should be able to rely on there always > being a PACIASP at ORIG_CALL_entry, and since it's a landing pad for BLR > we don't need to make this a RET > > 92e2294d870b ("arm64: bti: Support building kernel C code using BTI") > oh, yeah, thanks > Thanks, > Jean > > .