netdev - Re: [PATCH v4 5/8] bpf ppc64: Add BPF_PROBE

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 30 Sep 2021 14:18:38 +1000
From:   Jordan Niethe <jniethe5@...il.com>
To:     Christophe Leroy <christophe.leroy@...roup.eu>
Cc:     Hari Bathini <hbathini@...ux.ibm.com>, naveen.n.rao@...ux.ibm.com,
        Michael Ellerman <mpe@...erman.id.au>, ast@...nel.org,
        daniel@...earbox.net, Ravi Bangoria <ravi.bangoria@...ux.ibm.com>,
        songliubraving@...com, netdev@...r.kernel.org,
        john.fastabend@...il.com, andrii@...nel.org, kpsingh@...nel.org,
        Paul Mackerras <paulus@...ba.org>, yhs@...com,
        bpf@...r.kernel.org, linuxppc-dev <linuxppc-dev@...ts.ozlabs.org>,
        kafai@...com
Subject: Re: [PATCH v4 5/8] bpf ppc64: Add BPF_PROBE_MEM support for JIT

On Wed, Sep 29, 2021 at 9:50 PM Christophe Leroy
<christophe.leroy@...roup.eu> wrote:
>
>
>
> Le 29/09/2021 à 13:18, Hari Bathini a écrit :
> > From: Ravi Bangoria <ravi.bangoria@...ux.ibm.com>
> >
> > BPF load instruction with BPF_PROBE_MEM mode can cause a fault
> > inside kernel. Append exception table for such instructions
> > within BPF program.
> >
> > Unlike other archs which uses extable 'fixup' field to pass dest_reg
> > and nip, BPF exception table on PowerPC follows the generic PowerPC
>
>
> For my curiosity, can you explain why we don't want and can't do the
> same on powerpc as on other archs ?

The main thing is on x86, the extable has another field , handler:
struct exception_table_entry { int insn, fixup, handler; };
handler can be used to perform other things before continuing on to fixup.
So for bpf the handler is used to clear the dest register (which is
encoded in the low byte of fixup).
More detail in 3dec541b2e63 ("bpf: Add support for BTF pointers to x86 JIT").

arm64 is an example of an arch that doesn't have a handler field in the extable.
They did something along the lines of this rather than adding a
handler field to the extable.
See 800834285361 ("bpf, arm64: Add BPF exception tables")

>
>
> > exception table design, where it populates both fixup and extable
> > sections within BPF program. fixup section contains two instructions,
> > first instruction clears dest_reg and 2nd jumps to next instruction
> > in the BPF code. extable 'insn' field contains relative offset of
> > the instruction and 'fixup' field contains relative offset of the
> > fixup entry. Example layout of BPF program with extable present:
> >
> >               +------------------+
> >               |                  |
> >               |                  |
> >     0x4020 -->| ld   r27,4(r3)   |
> >               |                  |
> >               |                  |
> >     0x40ac -->| lwz  r3,0(r4)    |
> >               |                  |
> >               |                  |
> >               |------------------|
> >     0x4280 -->| li  r27,0        |  \ fixup entry
> >               | b   0x4024       |  /
> >     0x4288 -->| li  r3,0         |
> >               | b   0x40b0       |
> >               |------------------|
> >     0x4290 -->| insn=0xfffffd90  |  \ extable entry
> >               | fixup=0xffffffec |  /
> >     0x4298 -->| insn=0xfffffe14  |
> >               | fixup=0xffffffec |
> >               +------------------+
> >
> >     (Addresses shown here are chosen random, not real)
> >