linux-kernel - Re: [PATCH bpf-next 1/2] bpf: Add arm64 JIT support for PROBE

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <CANk7y0g0i=9U89kdpZARKgf5MnKy4dM1m5zDjo=3LSAwaDEcYg@mail.gmail.com>
Date: Fri, 15 Mar 2024 11:31:44 +0100
From: Puranjay Mohan <puranjay12@...il.com>
To: Alexei Starovoitov <alexei.starovoitov@...il.com>
Cc: Kumar Kartikeya Dwivedi <memxor@...il.com>, Alexei Starovoitov <ast@...nel.org>, 
	Eduard Zingerman <eddyz87@...il.com>, Daniel Borkmann <daniel@...earbox.net>, 
	John Fastabend <john.fastabend@...il.com>, Andrii Nakryiko <andrii@...nel.org>, 
	Martin KaFai Lau <martin.lau@...ux.dev>, Song Liu <song@...nel.org>, 
	Yonghong Song <yonghong.song@...ux.dev>, KP Singh <kpsingh@...nel.org>, 
	Stanislav Fomichev <sdf@...gle.com>, Hao Luo <haoluo@...gle.com>, Jiri Olsa <jolsa@...nel.org>, 
	bpf <bpf@...r.kernel.org>, LKML <linux-kernel@...r.kernel.org>, 
	Catalin Marinas <catalin.marinas@....com>, Will Deacon <will@...nel.org>, 
	Zi Shen Lim <zlim.lnx@...il.com>, Xu Kuohai <xukuohai@...wei.com>
Subject: Re: [PATCH bpf-next 1/2] bpf: Add arm64 JIT support for PROBE_MEM32
 pseudo instructions.

On Thu, Mar 14, 2024 at 6:21 PM Alexei Starovoitov
<alexei.starovoitov@...il.com> wrote:
>
> On Thu, Mar 14, 2024 at 10:13 AM Puranjay Mohan <puranjay12@...ilcom> wrote:
> >
> > Kumar Kartikeya Dwivedi <memxor@...il.com> writes:
> >
> > > On Thu, 14 Mar 2024 at 16:00, Puranjay Mohan <puranjay12@...il.com> wrote:
> > >>
> > >> Add support for [LDX | STX | ST], PROBE_MEM32, [B | H | W | DW]
> > >> instructions.  They are similar to PROBE_MEM instructions with the
> > >> following differences:
> > >> - PROBE_MEM32 supports store.
> > >> - PROBE_MEM32 relies on the verifier to clear upper 32-bit of the
> > >>   src/dst register
> > >> - PROBE_MEM32 adds 64-bit kern_vm_start address (which is stored in R28
> > >>   in the prologue). Due to bpf_arena constructions such R28 + reg +
> > >>   off16 access is guaranteed to be within arena virtual range, so no
> > >>   address check at run-time.
> > >> - PROBE_MEM32 allows STX and ST. If they fault the store is a nop. When
> > >>   LDX faults the destination register is zeroed.
> > >>
> > >> To support these on arm64, we do tmp2 = R28 + src/dst reg and then use
> > >> tmp2 as the new src/dst register. This allows us to reuse most of the
> > >> code for normal [LDX | STX | ST].
> > >>
> > >> Signed-off-by: Puranjay Mohan <puranjay12@...il.com>
> > >> ---
> > >
> > > Hi Alexei,
> > > Puranjay and I were discussing this stuff off list and noticed that
> > > atomic instructions are not handled.
> > > It turns out that will cause a kernel crash right now because the
> > > 32-bit offset into arena will be dereferenced directly.
> > >
> > > e.g. something like this:
> > >
> > > @@ -55,6 +56,7 @@ int arena_list_add(void *ctx)
> > >                 test_val++;
> > >                 n->value = i;
> > >                 arena_sum += i;
> > > +               __sync_fetch_and_add(&arena_sum, 0);
> > >                 list_add_head(&n->node, list_head);
> > >         }
> > >  #else
> > >
> > > I will try to prepare a fix for the x86 JIT. Puranjay will do the same
> > > for his set.
> >
> > Yes, testing the change mentioned by Kumar on ARM64 causes a crashes as well:
> >
> > bpf_testmod: loading out-of-tree module taints kernel.
> >  bpf_testmod: module verification failed: signature and/or required key missing - tainting kernel
> >  Unable to handle kernel NULL pointer dereference at virtual address 0000000000000010
> >  Mem abort info:
> >    ESR = 0x0000000096000006
> >    EC = 0x25: DABT (current EL), IL = 32 bits
> >    SET = 0, FnV = 0
> >    EA = 0, S1PTW = 0
> >    FSC = 0x06: level 2 translation fault
> >  Data abort info:
> >    ISV = 0, ISS = 0x00000006, ISS2 = 0x00000000
> >    CM = 0, WnR = 0, TnD = 0, TagAccess = 0
> >    GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
> >  user pgtable: 4k pages, 48-bit VAs, pgdp=00000004043cc000
> >  [0000000000000010] pgd=0800000410d8f003, p4d=0800000410d8f003, pud=0800000405972003, pmd=0000000000000000
> >  Internal error: Oops: 0000000096000006 [#1] SMP
> >  Modules linked in: bpf_testmod(OE) nls_ascii nls_cp437 sunrpc vfat fat aes_ce_blk aes_ce_cipher ghash_ce sha1_ce button sch_fq_codel dm_mod dax configfs dmi_sysfs sha2_ce sha256_arm64 efivarfs
> >  CPU: 8 PID: 5631 Comm: test_progs Tainted: G           OE      6.8.0+ #2
> >  Hardware name: Amazon EC2 c6g.16xlarge/, BIOS 1.0 11/1/2018
> >  pstate: 20400005 (nzCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
> >  pc : bpf_prog_8771c336cb6a18eb_arena_list_add+0x204/0x2b8
> >  lr : bpf_prog_8771c336cb6a18eb_arena_list_add+0x144/0x2b8
> >  sp : ffff80008b84bc30
> >  x29: ffff80008b84bca0 x28: ffff8000a5008000 x27: ffff80008b84bc38
> >  x26: 0000000000000000 x25: ffff80008b84bc60 x24: 0000000000000000
> >  x23: 0000000000000000 x22: 0000000000000058 x21: 0000000000000838
> >  x20: 0000000000000000 x19: 0000000100001fe0 x18: 0000000000000000
> >  x17: 0000000000000000 x16: 0000000000000000 x15: 0000ffffcc66d2c8
> >  x14: 0000000000000000 x13: 0000000000000000 x12: 000000000004058c
> >  x11: ffff8000a5008010 x10: 00000000ffffffff x9 : 00000000000002cf
> >  x8 : ffff800082ff4ab8 x7 : 0000000100001000 x6 : 0000000000000001
> >  x5 : 0000000010e5e3fd x4 : 000000003619b978 x3 : 0000000000000010
> >  x2 : 0000000000000000 x1 : 0000000000000000 x0 : 0000000000001fe0
> >  Call trace:
> >   bpf_prog_8771c336cb6a18eb_arena_list_add+0x204/0x2b8
> >   bpf_prog_test_run_syscall+0x100/0x340
> >   __sys_bpf+0x8e8/0xa20
> >   __arm64_sys_bpf+0x2c/0x48
> >   invoke_syscall+0x50/0x128
> >   el0_svc_common.constprop.0+0x48/0xf8
> >   do_el0_svc+0x28/0x40
> >   el0_svc+0x58/0x190
> >   el0t_64_sync_handler+0x13c/0x158
> >   el0t_64_sync+0x1a8/0x1b0
> >  Code: 8b010042 8b1c006b f9000162 d2800001 (f821307f)
> >  ---[ end trace 0000000000000000 ]---
> >  Kernel panic - not syncing: Oops: Fatal exception
> >  SMP: stopping secondary CPUs
> >  Kernel Offset: disabled
> >  CPU features: 0x0,00000120,7002014a,21407a0b
> >  Memory Limit: none
> >  Rebooting in 5 seconds..
> >
> > I will send v2 with the arm64 JIT fix, but I guess verifier has to be modified
> > as well to add BPF_PROBE_MEM32 to atomic instructions.
>
> The JIT and the verifier changes for atomics might be too big.
> Let's disable atomics in arena in the verifier for now.
> Pls send a patch.

As atomics are disabled in the Arena now, this series will not require
any changes.
Looking forward to the reviews.

Thanks,
Puranjay