| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Sat, 9 Dec 2023 14:03:48 +0800
From: Hengqi Chen <hengqi.chen@...il.com>
To: Huacai Chen <chenhuacai@...nel.org>
Cc: Tiezhu Yang <yangtiezhu@...ngson.cn>, loongarch@...ts.linux.dev,
linux-kernel@...r.kernel.org
Subject: Re: [PATCH v1 1/2] LoongArch: BPF: Fix sign-extension mov instructions
On Thu, Dec 7, 2023 at 12:12 PM Huacai Chen <chenhuacai@...nel.org> wrote:
>
> On Thu, Dec 7, 2023 at 11:30 AM Tiezhu Yang <yangtiezhu@...ngson.cn> wrote:
> >
> > We can see that "Short form of movsx, dst_reg = (s8,s16,s32)src_reg"
> > in include/linux/filter.h, additionally, for BPF_ALU64 the value of
> > the destination register is unchanged whereas for BPF_ALU the upper
> > 32 bits of the destination register are zeroed, so it should clear
> > the upper 32 bits for BPF_ALU.
> >
> > [root@...ux fedora]# echo 1 > /proc/sys/net/core/bpf_jit_enable
> > [root@...ux fedora]# modprobe test_bpf
> >
> > Before:
> > test_bpf: #81 ALU_MOVSX | BPF_B jited:1 ret 2 != 1 (0x2 != 0x1)FAIL (1 times)
> > test_bpf: #82 ALU_MOVSX | BPF_H jited:1 ret 2 != 1 (0x2 != 0x1)FAIL (1 times)
> >
> > After:
> > test_bpf: #81 ALU_MOVSX | BPF_B jited:1 6 PASS
> > test_bpf: #82 ALU_MOVSX | BPF_H jited:1 6 PASS
> >
> > By the way, the bpf selftest case "./test_progs -t verifier_movsx" can
> > also be fixed with this patch.
> Hmmm, it is a little strange that privileged verifier_movsx has no problem.
>
I have found the differences between priv and unpriv mode.
The BPF verifier performs different optimizations for priv and upriv progs.
See the following commits:
https://github.com/torvalds/linux/commit/e2ae4ca266a1c
https://github.com/torvalds/linux/commit/52875a04f4b26
https://github.com/torvalds/linux/commit/a1b14abc009d9
As a result, with unprivileged_bpf_disabled on, we have:
# bpftool p d x i 55
void mov32sx_s16_range_2():
; asm volatile (" \
0: (b7) r1 = 65535
1: (bc) w2 = w1
2: (77) r2 >>= 1
3: (b7) r0 = 1
4: (95) exit
# bpftool p d j i 55
void mov32sx_s16_range_2():
0xffff800002416238:
; asm volatile (" \
0: addi.d $a6, $zero, 33(0x21)
4: addi.d $sp, $sp, -64(0xfc0)
8: st.d $ra, $sp, 56(0x38)
c: st.d $fp, $sp, 48(0x30)
10: st.d $s0, $sp, 40(0x28)
14: st.d $s1, $sp, 32(0x20)
18: st.d $s2, $sp, 24(0x18)
1c: st.d $s3, $sp, 16(0x10)
20: st.d $s4, $sp, 8(0x8)
24: st.d $s5, $sp, 0
28: addi.d $fp, $sp, 64(0x40)
2c: lu12i.w $a0, 15(0xf)
30: ori $a0, $a0, 0xfff
34: move $t1, $a0
38: ext.w.h $a1, $t1
3c: srli.d $a1, $a1, 0x1
40: addi.w $a5, $zero, 1(0x1)
44: ld.d $ra, $sp, 56(0x38)
48: ld.d $fp, $sp, 48(0x30)
4c: ld.d $s0, $sp, 40(0x28)
50: ld.d $s1, $sp, 32(0x20)
54: ld.d $s2, $sp, 24(0x18)
58: ld.d $s3, $sp, 16(0x10)
5c: ld.d $s4, $sp, 8(0x8)
60: ld.d $s5, $sp, 0
64: addi.d $sp, $sp, 64(0x40)
68: move $a0, $a5
6c: jirl $zero, $ra, 0
With unprivileged_bpf_disabled off, we have:
# bpftool p d x i 59
0: (b7) r1 = 65535
1: (bc) w2 = w1
2: (77) r2 >>= 1
3: (55) if r2 != 0x7fffffff goto pc+2
4: (b7) r0 = 1
5: (95) exit
6: (05) goto pc-1
7: (05) goto pc-1
# bpftool p d j i 59
0xffff8000024146a0:
0: addi.d $a6, $zero, 33(0x21)
4: addi.d $sp, $sp, -64(0xfc0)
8: st.d $ra, $sp, 56(0x38)
c: st.d $fp, $sp, 48(0x30)
10: st.d $s0, $sp, 40(0x28)
14: st.d $s1, $sp, 32(0x20)
18: st.d $s2, $sp, 24(0x18)
1c: st.d $s3, $sp, 16(0x10)
20: st.d $s4, $sp, 8(0x8)
24: st.d $s5, $sp, 0
28: addi.d $fp, $sp, 64(0x40)
2c: lu12i.w $a0, 15(0xf)
30: ori $a0, $a0, 0xfff
34: move $t1, $a0
38: ext.w.h $a1, $t1
3c: srli.d $a1, $a1, 0x1
40: lu12i.w $t1, 524287(0x7ffff)
44: ori $t1, $t1, 0xfff
48: move $t2, $a1
4c: beq $t2, $t1, 8(0x8) # 0x0000000000000054
50: b 12(0xc) # 0x000000000000005c
54: addi.w $a5, $zero, 1(0x1)
58: b 12(0xc) # 0x0000000000000064
5c: b 0 # 0x000000000000005c
60: b 0 # 0x0000000000000060
64: ld.d $ra, $sp, 56(0x38)
68: ld.d $fp, $sp, 48(0x30)
6c: ld.d $s0, $sp, 40(0x28)
70: ld.d $s1, $sp, 32(0x20)
74: ld.d $s2, $sp, 24(0x18)
78: ld.d $s3, $sp, 16(0x10)
7c: ld.d $s4, $sp, 8(0x8)
80: ld.d $s5, $sp, 0
84: addi.d $sp, $sp, 64(0x40)
88: move $a0, $a5
8c: jirl $zero, $ra, 0
Without this fix, it seems like the prog is trapped in an infinite loop.
This patch looks good to me, so I am going to offer:
Acked-by: Hengqi Chen <hengqi.chen@...il.com>
Cheers,
--
Hengqi
> Huacai
>
> >
> > Fixes: f48012f16150 ("LoongArch: BPF: Support sign-extension mov instructions")
> > Signed-off-by: Tiezhu Yang <yangtiezhu@...ngson.cn>
> > ---
> > arch/loongarch/net/bpf_jit.c | 2 ++
> > 1 file changed, 2 insertions(+)
> >
> > diff --git a/arch/loongarch/net/bpf_jit.c b/arch/loongarch/net/bpf_jit.c
> > index 169ff8b3915e..8c907c2c42f7 100644
> > --- a/arch/loongarch/net/bpf_jit.c
> > +++ b/arch/loongarch/net/bpf_jit.c
> > @@ -480,10 +480,12 @@ static int build_insn(const struct bpf_insn *insn, struct jit_ctx *ctx, bool ext
> > case 8:
> > move_reg(ctx, t1, src);
> > emit_insn(ctx, extwb, dst, t1);
> > + emit_zext_32(ctx, dst, is32);
> > break;
> > case 16:
> > move_reg(ctx, t1, src);
> > emit_insn(ctx, extwh, dst, t1);
> > + emit_zext_32(ctx, dst, is32);
> > break;
> > case 32:
> > emit_insn(ctx, addw, dst, src, LOONGARCH_GPR_ZERO);
> > --
> > 2.42.0
> >
> >
Powered by blists - more mailing lists