linux-kernel - Re: [PATCH] ppc: Fix BPF JIT for ABIv2

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <1466572690.19785.4.camel@ellerman.id.au>
Date:	Wed, 22 Jun 2016 15:18:10 +1000
From:	Michael Ellerman <mpe@...erman.id.au>
To:	Thadeu Lima de Souza Cascardo <cascardo@...hat.com>
Cc:	"Naveen N. Rao" <naveen.n.rao@...ux.vnet.ibm.com>,
	linux-kernel@...r.kernel.org, linuxppc-dev@...ts.ozlabs.org,
	netdev@...r.kernel.org, Matt Evans <matt@...abs.org>,
	Daniel Borkmann <daniel@...earbox.net>,
	Alexei Starovoitov <ast@...com>,
	Denis Kirjanov <kda@...ux-powerpc.org>,
	Paul Mackerras <paulus@...ba.org>,
	"David S. Miller" <davem@...emloft.net>,
	Ananth N Mavinakayanahalli <ananth@...ibm.com>
Subject: Re: [PATCH] ppc: Fix BPF JIT for ABIv2

On Fri, 2016-06-17 at 10:00 -0300, Thadeu Lima de Souza Cascardo wrote:
> From a984dc02b6317a1d3a3c2302385adba5227be5bd Mon Sep 17 00:00:00 2001
> From: Thadeu Lima de Souza Cascardo <cascardo@...hat.com>
> Date: Wed, 15 Jun 2016 13:22:12 -0300
> Subject: [PATCH] ppc: Fix BPF JIT for ABIv2
> 
> ABIv2 used for ppc64le does not use function descriptors. Without this patch,
> whenever BPF JIT is enabled, we get a crash as below.
> 
...

> diff --git a/arch/powerpc/net/bpf_jit.h b/arch/powerpc/net/bpf_jit.h
> index 889fd19..28b89ed 100644
> --- a/arch/powerpc/net/bpf_jit.h
> +++ b/arch/powerpc/net/bpf_jit.h
> @@ -70,7 +70,7 @@ DECLARE_LOAD_FUNC(sk_load_half);
>  DECLARE_LOAD_FUNC(sk_load_byte);
>  DECLARE_LOAD_FUNC(sk_load_byte_msh);
>  
> -#ifdef CONFIG_PPC64
> +#if defined(CONFIG_PPC64) && (!defined(_CALL_ELF) || _CALL_ELF != 2)
>  #define FUNCTION_DESCR_SIZE	24
>  #else
>  #define FUNCTION_DESCR_SIZE	0
> diff --git a/arch/powerpc/net/bpf_jit_comp.c b/arch/powerpc/net/bpf_jit_comp.c
> index 2d66a84..035b887 100644
> --- a/arch/powerpc/net/bpf_jit_comp.c
> +++ b/arch/powerpc/net/bpf_jit_comp.c
> @@ -664,7 +664,7 @@ void bpf_jit_compile(struct bpf_prog *fp)
>  
>  	if (image) {
>  		bpf_flush_icache(code_base, code_base + (proglen/4));
> -#ifdef CONFIG_PPC64
> +#if defined(CONFIG_PPC64) && (!defined(_CALL_ELF) || _CALL_ELF != 2)
>  		/* Function descriptor nastiness: Address + TOC */
>  		((u64 *)image)[0] = (u64)code_base;
>  		((u64 *)image)[1] = local_paca->kernel_toc;


Confirmed that even with this patch we still crash:

  # echo 1 > /proc/sys/net/core/bpf_jit_enable
  # modprobe test_bpf
  BPF filter opcode 0020 (@3) unsupported
  BPF filter opcode 0020 (@2) unsupported
  BPF filter opcode 0020 (@0) unsupported
  Unable to handle kernel paging request for data at address 0xd0000000054f65e8
  Faulting instruction address: 0xc0000000008765f8
  cpu 0x0: Vector: 300 (Data Access) at [c0000000034f3480]
      pc: c0000000008765f8: skb_copy_bits+0x158/0x330
      lr: c00000000008fb7c: bpf_slow_path_byte+0x28/0x54
      sp: c0000000034f3700
     msr: 800000010280b033
     dar: d0000000054f65e8
   dsisr: 40000000
    current = 0xc0000001f857d8d0
    paca    = 0xc000000007b80000	 softe: 0	 irq_happened: 0x01
      pid   = 2993, comm = modprobe
  Linux version 4.7.0-rc3-00055-g9497a1c1c5b4-dirty (michael@....ozlabs.ibm.com) () #30 SMP Wed Jun 22 15:06:58 AEST 2016
  enter ? for help
  [c0000000034f3770] c00000000008fb7c bpf_slow_path_byte+0x28/0x54
  [c0000000034f37e0] d000000007bb004c
  [c0000000034f3900] d000000005331668 test_bpf_init+0x5fc/0x7f8 [test_bpf]
  [c0000000034f3a30] c00000000000b628 do_one_initcall+0x68/0x1d0
  [c0000000034f3af0] c0000000009beb24 do_init_module+0x90/0x240
  [c0000000034f3b80] c0000000001642bc load_module+0x206c/0x22f0
  [c0000000034f3d30] c0000000001648b0 SyS_finit_module+0x120/0x180
  [c0000000034f3e30] c000000000009260 system_call+0x38/0x108
  --- Exception: c01 (System Call) at 00003fff7ffa2db4


cheers