| Message ID | 168926677665.316237.9953845318337455525.stgit@ahduyck-xeon-server.home.arpa (mailing list archive) |
|---|---|
| State | Accepted |
| Delegated to: | BPF |
| Headers | show |
| Series | [bpf] bpf, arm64: Fix BTI type used for freplace attached functions | expand |
On 7/14/2023 12:49 AM, Alexander Duyck wrote: > From: Alexander Duyck <alexanderduyck@fb.com> > > When running an freplace attached bpf program on an arm64 system w were > seeing the following issue: > Unhandled 64-bit el1h sync exception on CPU47, ESR 0x0000000036000003 -- BTI > > After a bit of work to track it down I determined that what appeared to be > happening is that the 'bti c' at the start of the program was somehow being > reached after a 'br' instruction. Further digging pointed me toward the > fact that the function was attached via freplace. This in turn led me to > build_plt which I believe is invoking the long jump which is triggering > this error. > > To resolve it we can replace the 'bti c' with 'bti jc' and add a comment > explaining why this has to be modified as such. > > Fixes: b2ad54e1533e ("bpf, arm64: Implement bpf_arch_text_poke() for arm64") > Signed-off-by: Alexander Duyck <alexanderduyck@fb.com> > --- > arch/arm64/net/bpf_jit_comp.c | 8 +++++++- > 1 file changed, 7 insertions(+), 1 deletion(-) > > diff --git a/arch/arm64/net/bpf_jit_comp.c b/arch/arm64/net/bpf_jit_comp.c > index 145b540ec34f..ec2174838f2a 100644 > --- a/arch/arm64/net/bpf_jit_comp.c > +++ b/arch/arm64/net/bpf_jit_comp.c > @@ -322,7 +322,13 @@ static int build_prologue(struct jit_ctx *ctx, bool ebpf_from_cbpf) > * > */ > > - emit_bti(A64_BTI_C, ctx); > + /* bpf function may be invoked by 3 instruction types: > + * 1. bl, attached via freplace to bpf prog via short jump > + * 2. br, attached via freplace to bpf prog via long jump > + * 3. blr, working as a function pointer, used by emit_call. > + * So BTI_JC should used here to support both br and blr. > + */ > + emit_bti(A64_BTI_JC, ctx); LGTM. Thanks for the fixes. Acked-by: Xu Kuohai <xukuohai@huawei.com> > > emit(A64_MOV(1, A64_R(9), A64_LR), ctx); > emit(A64_NOP, ctx); > >
On Sat, Jul 15, 2023 at 2:03 AM Xu Kuohai <xukuohai@huaweicloud.com> wrote: > > On 7/14/2023 12:49 AM, Alexander Duyck wrote: > > From: Alexander Duyck <alexanderduyck@fb.com> > > > > When running an freplace attached bpf program on an arm64 system w were > > seeing the following issue: > > Unhandled 64-bit el1h sync exception on CPU47, ESR 0x0000000036000003 -- BTI > > > > After a bit of work to track it down I determined that what appeared to be > > happening is that the 'bti c' at the start of the program was somehow being > > reached after a 'br' instruction. Further digging pointed me toward the > > fact that the function was attached via freplace. This in turn led me to > > build_plt which I believe is invoking the long jump which is triggering > > this error. > > > > To resolve it we can replace the 'bti c' with 'bti jc' and add a comment > > explaining why this has to be modified as such. > > > > Fixes: b2ad54e1533e ("bpf, arm64: Implement bpf_arch_text_poke() for arm64") > > Signed-off-by: Alexander Duyck <alexanderduyck@fb.com> > > --- > > arch/arm64/net/bpf_jit_comp.c | 8 +++++++- > > 1 file changed, 7 insertions(+), 1 deletion(-) > > > > diff --git a/arch/arm64/net/bpf_jit_comp.c b/arch/arm64/net/bpf_jit_comp.c > > index 145b540ec34f..ec2174838f2a 100644 > > --- a/arch/arm64/net/bpf_jit_comp.c > > +++ b/arch/arm64/net/bpf_jit_comp.c > > @@ -322,7 +322,13 @@ static int build_prologue(struct jit_ctx *ctx, bool ebpf_from_cbpf) > > * > > */ > > > > - emit_bti(A64_BTI_C, ctx); > > + /* bpf function may be invoked by 3 instruction types: > > + * 1. bl, attached via freplace to bpf prog via short jump > > + * 2. br, attached via freplace to bpf prog via long jump > > + * 3. blr, working as a function pointer, used by emit_call. > > + * So BTI_JC should used here to support both br and blr. > > + */ > > + emit_bti(A64_BTI_JC, ctx); > > LGTM. Thanks for the fixes. > > Acked-by: Xu Kuohai <xukuohai@huawei.com> Applied. Thanks
diff --git a/arch/arm64/net/bpf_jit_comp.c b/arch/arm64/net/bpf_jit_comp.c index 145b540ec34f..ec2174838f2a 100644 --- a/arch/arm64/net/bpf_jit_comp.c +++ b/arch/arm64/net/bpf_jit_comp.c @@ -322,7 +322,13 @@ static int build_prologue(struct jit_ctx *ctx, bool ebpf_from_cbpf) * */ - emit_bti(A64_BTI_C, ctx); + /* bpf function may be invoked by 3 instruction types: + * 1. bl, attached via freplace to bpf prog via short jump + * 2. br, attached via freplace to bpf prog via long jump + * 3. blr, working as a function pointer, used by emit_call. + * So BTI_JC should used here to support both br and blr. + */ + emit_bti(A64_BTI_JC, ctx); emit(A64_MOV(1, A64_R(9), A64_LR), ctx); emit(A64_NOP, ctx);