BPF programs currently consume a page each on ARM64. For systems with many BPF
programs, this adds significant pressure to instruction TLB. High iTLB pressure
usually causes slow down for the whole system.
Song Liu introduced the BPF prog pack allocator[1] to mitigate the above issue.
It packs multiple BPF programs into a single huge page. It is currently only
enabled for the x86_64 BPF JIT.
This patch series enables the BPF prog pack allocator for the ARM64 BPF JIT.
====================================================
Performance Analysis of prog pack allocator on ARM64
====================================================
To test the performance of the BPF prog pack allocator on ARM64, a stresser
tool[2] was built. This tool loads 8 BPF programs on the system and triggers
5 of them in an infinite loop by doing system calls.
The runner script starts 20 instances of the above which loads 8*20=160 BPF
programs on the system, 5*20=100 of which are being constantly triggered.
In the above environment we try to build Python-3.8.4 and try to find different
iTLB metrics for the compilation done by gcc-12.2.0.
The source code[3] is configured with the following command:
./configure --enable-optimizations --with-ensurepip=install
Then the runner script is executed with the following command:
./run.sh "perf stat -e ITLB_WALK,L1I_TLB,INST_RETIRED,iTLB-load-misses -a make -j32"
This builds Python while 160 BPF programs are loaded and 100 are being constantly
triggered and measures iTLB related metrics.
The output of the above command is discussed below before and after enabling the
BPF prog pack allocator.
The tests were run on qemu-system-aarch64 with 32 cpus, 4G memory, -machine virt,
-cpu host, and -enable-kvm.
Results
-------
Before enabling prog pack allocator:
------------------------------------
Performance counter stats for 'system wide':
333278635 ITLB_WALK
6762692976558 L1I_TLB
25359571423901 INST_RETIRED
15824054789 iTLB-load-misses
189.029769053 seconds time elapsed
After enabling prog pack allocator:
-----------------------------------
Performance counter stats for 'system wide':
190333544 ITLB_WALK
6712712386528 L1I_TLB
25278233304411 INST_RETIRED
5716757866 iTLB-load-misses
185.392650561 seconds time elapsed
Improvements in metrics
-----------------------
Compilation time ---> 1.92% faster
iTLB-load-misses/Sec (Less is better) ---> 63.16% decrease
ITLB_WALK/1000 INST_RETIRED (Less is better) ---> 42.71% decrease
ITLB_Walk/L1I_TLB (Less is better) ---> 42.47% decrease
[1] https://lore.kernel.org/bpf/[email protected]/
[2] https://github.com/puranjaymohan/BPF-Allocator-Bench
[3] https://www.python.org/ftp/python/3.8.4/Python-3.8.4.tgz
Puranjay Mohan (3):
bpf: make bpf_prog_pack allocator portable
arm64: patching: Add aarch64_insn_copy()
bpf, arm64: use bpf_jit_binary_pack_alloc
arch/arm64/include/asm/patching.h | 1 +
arch/arm64/kernel/patching.c | 39 ++++++++++
arch/arm64/net/bpf_jit_comp.c | 119 +++++++++++++++++++++++++-----
kernel/bpf/core.c | 8 +-
4 files changed, 146 insertions(+), 21 deletions(-)
--
2.39.2
The bpf_prog_pack allocator currently uses module_alloc() and
module_memfree() to allocate and free memory. This is not portable
because different architectures use different methods for allocating
memory for BPF programs. Like ARM64 uses vmalloc()/vfree().
Use bpf_jit_alloc_exec() and bpf_jit_free_exec() for memory management
in bpf_prog_pack allocator. Other architectures can override these with
their implementation and will be able to use bpf_prog_pack directly.
Signed-off-by: Puranjay Mohan <[email protected]>
---
kernel/bpf/core.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c
index 7421487422d4..2bc9092bf9be 100644
--- a/kernel/bpf/core.c
+++ b/kernel/bpf/core.c
@@ -860,7 +860,7 @@ static struct bpf_prog_pack *alloc_new_pack(bpf_jit_fill_hole_t bpf_fill_ill_ins
GFP_KERNEL);
if (!pack)
return NULL;
- pack->ptr = module_alloc(BPF_PROG_PACK_SIZE);
+ pack->ptr = bpf_jit_alloc_exec(BPF_PROG_PACK_SIZE);
if (!pack->ptr) {
kfree(pack);
return NULL;
@@ -884,7 +884,7 @@ void *bpf_prog_pack_alloc(u32 size, bpf_jit_fill_hole_t bpf_fill_ill_insns)
mutex_lock(&pack_mutex);
if (size > BPF_PROG_PACK_SIZE) {
size = round_up(size, PAGE_SIZE);
- ptr = module_alloc(size);
+ ptr = bpf_jit_alloc_exec(size);
if (ptr) {
bpf_fill_ill_insns(ptr, size);
set_vm_flush_reset_perms(ptr);
@@ -922,7 +922,7 @@ void bpf_prog_pack_free(struct bpf_binary_header *hdr)
mutex_lock(&pack_mutex);
if (hdr->size > BPF_PROG_PACK_SIZE) {
- module_memfree(hdr);
+ bpf_jit_free_exec(hdr);
goto out;
}
@@ -946,7 +946,7 @@ void bpf_prog_pack_free(struct bpf_binary_header *hdr)
if (bitmap_find_next_zero_area(pack->bitmap, BPF_PROG_CHUNK_COUNT, 0,
BPF_PROG_CHUNK_COUNT, 0) == 0) {
list_del(&pack->list);
- module_memfree(pack->ptr);
+ bpf_jit_free_exec(pack->ptr);
kfree(pack);
}
out:
--
2.39.2
This will be used by BPF JIT compiler to dump JITed binary to a RX huge
page, and thus allow multiple BPF programs sharing the a huge (2MB)
page.
The bpf_prog_pack allocator that implements the above feature allocates
a RX/RW buffer pair. The JITed code is written to the RW buffer and then
this function will be used to copy the code from RW to RX buffer.
Signed-off-by: Puranjay Mohan <[email protected]>
---
arch/arm64/include/asm/patching.h | 1 +
arch/arm64/kernel/patching.c | 39 +++++++++++++++++++++++++++++++
2 files changed, 40 insertions(+)
diff --git a/arch/arm64/include/asm/patching.h b/arch/arm64/include/asm/patching.h
index 68908b82b168..dba9eb392bf1 100644
--- a/arch/arm64/include/asm/patching.h
+++ b/arch/arm64/include/asm/patching.h
@@ -8,6 +8,7 @@ int aarch64_insn_read(void *addr, u32 *insnp);
int aarch64_insn_write(void *addr, u32 insn);
int aarch64_insn_write_literal_u64(void *addr, u64 val);
+void *aarch64_insn_copy(void *addr, const void *opcode, size_t len);
int aarch64_insn_patch_text_nosync(void *addr, u32 insn);
int aarch64_insn_patch_text(void *addrs[], u32 insns[], int cnt);
diff --git a/arch/arm64/kernel/patching.c b/arch/arm64/kernel/patching.c
index b4835f6d594b..48c710f6a1ff 100644
--- a/arch/arm64/kernel/patching.c
+++ b/arch/arm64/kernel/patching.c
@@ -105,6 +105,45 @@ noinstr int aarch64_insn_write_literal_u64(void *addr, u64 val)
return ret;
}
+/**
+ * aarch64_insn_copy - Copy instructions into (an unused part of) RX memory
+ * @addr: address to modify
+ * @opcode: source of the copy
+ * @len: length to copy
+ *
+ * Useful for JITs to dump new code blocks into unused regions of RX memory.
+ */
+noinstr void *aarch64_insn_copy(void *addr, const void *opcode, size_t len)
+{
+ unsigned long flags;
+ size_t patched = 0;
+ size_t size;
+ void *waddr;
+ void *dst;
+ int ret;
+
+ raw_spin_lock_irqsave(&patch_lock, flags);
+
+ while (patched < len) {
+ dst = addr + patched;
+ size = min_t(size_t, PAGE_SIZE - offset_in_page(dst),
+ len - patched);
+
+ waddr = patch_map(dst, FIX_TEXT_POKE0);
+ ret = copy_to_kernel_nofault(waddr, opcode + patched, size);
+ patch_unmap(FIX_TEXT_POKE0);
+
+ if (ret < 0) {
+ raw_spin_unlock_irqrestore(&patch_lock, flags);
+ return NULL;
+ }
+ patched += size;
+ }
+ raw_spin_unlock_irqrestore(&patch_lock, flags);
+
+ return addr;
+}
+
int __kprobes aarch64_insn_patch_text_nosync(void *addr, u32 insn)
{
u32 *tp = addr;
--
2.39.2
Use bpf_jit_binary_pack_alloc for memory management of JIT binaries in
ARM64 BPF JIT. The bpf_jit_binary_pack_alloc creates a pair of RW and RX
buffers. The JIT writes the program into the RW buffer. When the JIT is
done, the program is copied to the final ROX buffer
with bpf_jit_binary_pack_finalize.
Implement bpf_arch_text_copy() and bpf_arch_text_invalidate() for ARM64
JIT as these functions are required by bpf_jit_binary_pack allocator.
Signed-off-by: Puranjay Mohan <[email protected]>
---
arch/arm64/net/bpf_jit_comp.c | 119 +++++++++++++++++++++++++++++-----
1 file changed, 102 insertions(+), 17 deletions(-)
diff --git a/arch/arm64/net/bpf_jit_comp.c b/arch/arm64/net/bpf_jit_comp.c
index 145b540ec34f..ee9414cadea8 100644
--- a/arch/arm64/net/bpf_jit_comp.c
+++ b/arch/arm64/net/bpf_jit_comp.c
@@ -76,6 +76,7 @@ struct jit_ctx {
int *offset;
int exentry_idx;
__le32 *image;
+ __le32 *ro_image;
u32 stack_size;
int fpb_offset;
};
@@ -205,6 +206,20 @@ static void jit_fill_hole(void *area, unsigned int size)
*ptr++ = cpu_to_le32(AARCH64_BREAK_FAULT);
}
+int bpf_arch_text_invalidate(void *dst, size_t len)
+{
+ __le32 *ptr;
+ int ret;
+
+ for (ptr = dst; len >= sizeof(u32); len -= sizeof(u32)) {
+ ret = aarch64_insn_patch_text_nosync(ptr++, AARCH64_BREAK_FAULT);
+ if (ret)
+ return ret;
+ }
+
+ return 0;
+}
+
static inline int epilogue_offset(const struct jit_ctx *ctx)
{
int to = ctx->epilogue_offset;
@@ -701,7 +716,8 @@ static int add_exception_handler(const struct bpf_insn *insn,
struct jit_ctx *ctx,
int dst_reg)
{
- off_t offset;
+ off_t ins_offset;
+ off_t fixup_offset;
unsigned long pc;
struct exception_table_entry *ex;
@@ -717,12 +733,11 @@ static int add_exception_handler(const struct bpf_insn *insn,
return -EINVAL;
ex = &ctx->prog->aux->extable[ctx->exentry_idx];
- pc = (unsigned long)&ctx->image[ctx->idx - 1];
+ pc = (unsigned long)&ctx->ro_image[ctx->idx - 1];
- offset = pc - (long)&ex->insn;
- if (WARN_ON_ONCE(offset >= 0 || offset < INT_MIN))
+ ins_offset = pc - (long)&ex->insn;
+ if (WARN_ON_ONCE(ins_offset >= 0 || ins_offset < INT_MIN))
return -ERANGE;
- ex->insn = offset;
/*
* Since the extable follows the program, the fixup offset is always
@@ -732,11 +747,20 @@ static int add_exception_handler(const struct bpf_insn *insn,
* modifying the upper bits because the table is already sorted, and
* isn't part of the main exception table.
*/
- offset = (long)&ex->fixup - (pc + AARCH64_INSN_SIZE);
- if (!FIELD_FIT(BPF_FIXUP_OFFSET_MASK, offset))
+ fixup_offset = (long)&ex->fixup - (pc + AARCH64_INSN_SIZE);
+ if (!FIELD_FIT(BPF_FIXUP_OFFSET_MASK, fixup_offset))
return -ERANGE;
- ex->fixup = FIELD_PREP(BPF_FIXUP_OFFSET_MASK, offset) |
+ /*
+ * The offsets above have been calculated using the RO+X buffer but we
+ * need to use the R/W buffer for writes.
+ * switch ex to rw buffer for writing.
+ */
+ ex = (void *)ctx->image + ((void *)ex - (void *)ctx->ro_image);
+
+ ex->insn = ins_offset;
+
+ ex->fixup = FIELD_PREP(BPF_FIXUP_OFFSET_MASK, fixup_offset) |
FIELD_PREP(BPF_FIXUP_REG_MASK, dst_reg);
ex->type = EX_TYPE_BPF;
@@ -1446,6 +1470,7 @@ static inline void bpf_flush_icache(void *start, void *end)
struct arm64_jit_data {
struct bpf_binary_header *header;
+ struct bpf_binary_header *rw_header;
u8 *image;
struct jit_ctx ctx;
};
@@ -1454,6 +1479,7 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog)
{
int image_size, prog_size, extable_size, extable_align, extable_offset;
struct bpf_prog *tmp, *orig_prog = prog;
+ struct bpf_binary_header *rw_header;
struct bpf_binary_header *header;
struct arm64_jit_data *jit_data;
bool was_classic = bpf_prog_was_classic(prog);
@@ -1461,6 +1487,7 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog)
bool extra_pass = false;
struct jit_ctx ctx;
u8 *image_ptr;
+ u8 *rw_image_ptr;
if (!prog->jit_requested)
return orig_prog;
@@ -1489,6 +1516,9 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog)
ctx = jit_data->ctx;
image_ptr = jit_data->image;
header = jit_data->header;
+ rw_header = jit_data->rw_header;
+ rw_image_ptr = (void *)rw_header + ((void *)image_ptr
+ - (void *)header);
extra_pass = true;
prog_size = sizeof(u32) * ctx.idx;
goto skip_init_ctx;
@@ -1533,8 +1563,9 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog)
/* also allocate space for plt target */
extable_offset = round_up(prog_size + PLT_TARGET_SIZE, extable_align);
image_size = extable_offset + extable_size;
- header = bpf_jit_binary_alloc(image_size, &image_ptr,
- sizeof(u32), jit_fill_hole);
+ header = bpf_jit_binary_pack_alloc(image_size, &image_ptr, sizeof(u32),
+ &rw_header, &rw_image_ptr,
+ jit_fill_hole);
if (header == NULL) {
prog = orig_prog;
goto out_off;
@@ -1542,19 +1573,24 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog)
/* 2. Now, the actual pass. */
- ctx.image = (__le32 *)image_ptr;
if (extable_size)
prog->aux->extable = (void *)image_ptr + extable_offset;
skip_init_ctx:
+ /*
+ * Use the rw_image_ptr for writing the JITed instructions.
+ * Save the read only image_ptr in ctx because it will be used to
+ * calculate offsets for filling out the exception table later.
+ */
+ ctx.image = (__le32 *)rw_image_ptr;
+ ctx.ro_image = (__le32 *)image_ptr;
ctx.idx = 0;
ctx.exentry_idx = 0;
build_prologue(&ctx, was_classic);
if (build_body(&ctx, extra_pass)) {
- bpf_jit_binary_free(header);
prog = orig_prog;
- goto out_off;
+ goto out_free_hdr;
}
build_epilogue(&ctx);
@@ -1562,32 +1598,42 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog)
/* 3. Extra pass to validate JITed code. */
if (validate_ctx(&ctx)) {
- bpf_jit_binary_free(header);
prog = orig_prog;
- goto out_off;
+ goto out_free_hdr;
}
/* And we're done. */
if (bpf_jit_enable > 1)
bpf_jit_dump(prog->len, prog_size, 2, ctx.image);
+ /*
+ * As the JITed instructions have been written to the R/W buffer, we can
+ * move ctx.image back to the RO+X buffer from where the BPF program
+ * will run. bpf_jit_binary_pack_finalize() will copy the instructions
+ * from the R/W buffer to the RO+X buffer.
+ */
+ ctx.image = (__le32 *)image_ptr;
bpf_flush_icache(header, ctx.image + ctx.idx);
if (!prog->is_func || extra_pass) {
if (extra_pass && ctx.idx != jit_data->ctx.idx) {
pr_err_once("multi-func JIT bug %d != %d\n",
ctx.idx, jit_data->ctx.idx);
- bpf_jit_binary_free(header);
prog->bpf_func = NULL;
prog->jited = 0;
prog->jited_len = 0;
+ goto out_free_hdr;
+ }
+ if (WARN_ON(bpf_jit_binary_pack_finalize(prog, header,
+ rw_header))) {
+ header = NULL;
goto out_off;
}
- bpf_jit_binary_lock_ro(header);
} else {
jit_data->ctx = ctx;
jit_data->image = image_ptr;
jit_data->header = header;
+ jit_data->rw_header = rw_header;
}
prog->bpf_func = (void *)ctx.image;
prog->jited = 1;
@@ -1610,6 +1656,14 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog)
bpf_jit_prog_release_other(prog, prog == orig_prog ?
tmp : orig_prog);
return prog;
+
+out_free_hdr:
+ if (header) {
+ bpf_arch_text_copy(&header->size, &rw_header->size,
+ sizeof(rw_header->size));
+ bpf_jit_binary_pack_free(header, rw_header);
+ }
+ goto out_off;
}
bool bpf_jit_supports_kfunc_call(void)
@@ -1617,6 +1671,13 @@ bool bpf_jit_supports_kfunc_call(void)
return true;
}
+void *bpf_arch_text_copy(void *dst, void *src, size_t len)
+{
+ if (aarch64_insn_copy(dst, src, len) == NULL)
+ return ERR_PTR(-EINVAL);
+ return dst;
+}
+
u64 bpf_jit_alloc_exec_limit(void)
{
return VMALLOC_END - VMALLOC_START;
@@ -2221,3 +2282,27 @@ int bpf_arch_text_poke(void *ip, enum bpf_text_poke_type poke_type,
return ret;
}
+
+void bpf_jit_free(struct bpf_prog *prog)
+{
+ if (prog->jited) {
+ struct arm64_jit_data *jit_data = prog->aux->jit_data;
+ struct bpf_binary_header *hdr;
+
+ /*
+ * If we fail the final pass of JIT (from jit_subprogs),
+ * the program may not be finalized yet. Call finalize here
+ * before freeing it.
+ */
+ if (jit_data) {
+ bpf_jit_binary_pack_finalize(prog, jit_data->header,
+ jit_data->rw_header);
+ kfree(jit_data);
+ }
+ hdr = bpf_jit_binary_pack_hdr(prog);
+ bpf_jit_binary_pack_free(hdr, NULL);
+ WARN_ON_ONCE(!bpf_prog_kallsyms_verify_off(prog));
+ }
+
+ bpf_prog_unlock_free(prog);
+}
--
2.39.2
On Mon, Jun 5, 2023 at 12:40 AM Puranjay Mohan <[email protected]> wrote:
>
> The bpf_prog_pack allocator currently uses module_alloc() and
> module_memfree() to allocate and free memory. This is not portable
> because different architectures use different methods for allocating
> memory for BPF programs. Like ARM64 uses vmalloc()/vfree().
>
> Use bpf_jit_alloc_exec() and bpf_jit_free_exec() for memory management
> in bpf_prog_pack allocator. Other architectures can override these with
> their implementation and will be able to use bpf_prog_pack directly.
>
> Signed-off-by: Puranjay Mohan <[email protected]>
Acked-by: Song Liu <[email protected]>
> ---
> kernel/bpf/core.c | 8 ++++----
> 1 file changed, 4 insertions(+), 4 deletions(-)
>
> diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c
> index 7421487422d4..2bc9092bf9be 100644
> --- a/kernel/bpf/core.c
> +++ b/kernel/bpf/core.c
> @@ -860,7 +860,7 @@ static struct bpf_prog_pack *alloc_new_pack(bpf_jit_fill_hole_t bpf_fill_ill_ins
> GFP_KERNEL);
> if (!pack)
> return NULL;
> - pack->ptr = module_alloc(BPF_PROG_PACK_SIZE);
> + pack->ptr = bpf_jit_alloc_exec(BPF_PROG_PACK_SIZE);
> if (!pack->ptr) {
> kfree(pack);
> return NULL;
> @@ -884,7 +884,7 @@ void *bpf_prog_pack_alloc(u32 size, bpf_jit_fill_hole_t bpf_fill_ill_insns)
> mutex_lock(&pack_mutex);
> if (size > BPF_PROG_PACK_SIZE) {
> size = round_up(size, PAGE_SIZE);
> - ptr = module_alloc(size);
> + ptr = bpf_jit_alloc_exec(size);
> if (ptr) {
> bpf_fill_ill_insns(ptr, size);
> set_vm_flush_reset_perms(ptr);
> @@ -922,7 +922,7 @@ void bpf_prog_pack_free(struct bpf_binary_header *hdr)
>
> mutex_lock(&pack_mutex);
> if (hdr->size > BPF_PROG_PACK_SIZE) {
> - module_memfree(hdr);
> + bpf_jit_free_exec(hdr);
> goto out;
> }
>
> @@ -946,7 +946,7 @@ void bpf_prog_pack_free(struct bpf_binary_header *hdr)
> if (bitmap_find_next_zero_area(pack->bitmap, BPF_PROG_CHUNK_COUNT, 0,
> BPF_PROG_CHUNK_COUNT, 0) == 0) {
> list_del(&pack->list);
> - module_memfree(pack->ptr);
> + bpf_jit_free_exec(pack->ptr);
> kfree(pack);
> }
> out:
> --
> 2.39.2
>
On Mon, Jun 5, 2023 at 12:40 AM Puranjay Mohan <[email protected]> wrote:
>
> This will be used by BPF JIT compiler to dump JITed binary to a RX huge
> page, and thus allow multiple BPF programs sharing the a huge (2MB)
> page.
>
> The bpf_prog_pack allocator that implements the above feature allocates
> a RX/RW buffer pair. The JITed code is written to the RW buffer and then
> this function will be used to copy the code from RW to RX buffer.
>
> Signed-off-by: Puranjay Mohan <[email protected]>
Acked-by: Song Liu <[email protected]>
With a nit below.
> ---
> arch/arm64/include/asm/patching.h | 1 +
> arch/arm64/kernel/patching.c | 39 +++++++++++++++++++++++++++++++
> 2 files changed, 40 insertions(+)
>
> diff --git a/arch/arm64/include/asm/patching.h b/arch/arm64/include/asm/patching.h
> index 68908b82b168..dba9eb392bf1 100644
> --- a/arch/arm64/include/asm/patching.h
> +++ b/arch/arm64/include/asm/patching.h
> @@ -8,6 +8,7 @@ int aarch64_insn_read(void *addr, u32 *insnp);
> int aarch64_insn_write(void *addr, u32 insn);
>
> int aarch64_insn_write_literal_u64(void *addr, u64 val);
> +void *aarch64_insn_copy(void *addr, const void *opcode, size_t len);
>
> int aarch64_insn_patch_text_nosync(void *addr, u32 insn);
> int aarch64_insn_patch_text(void *addrs[], u32 insns[], int cnt);
> diff --git a/arch/arm64/kernel/patching.c b/arch/arm64/kernel/patching.c
> index b4835f6d594b..48c710f6a1ff 100644
> --- a/arch/arm64/kernel/patching.c
> +++ b/arch/arm64/kernel/patching.c
> @@ -105,6 +105,45 @@ noinstr int aarch64_insn_write_literal_u64(void *addr, u64 val)
> return ret;
> }
>
> +/**
> + * aarch64_insn_copy - Copy instructions into (an unused part of) RX memory
> + * @addr: address to modify
> + * @opcode: source of the copy
> + * @len: length to copy
> + *
> + * Useful for JITs to dump new code blocks into unused regions of RX memory.
> + */
nit:
I understand "addr" and "opcode" are used by x86 text_poke_copy(). But maybe
we should call them "dst" and "src" or "to" and "from" or something similar?
Thanks,
Song
> +noinstr void *aarch64_insn_copy(void *addr, const void *opcode, size_t len)
> +{
> + unsigned long flags;
> + size_t patched = 0;
> + size_t size;
> + void *waddr;
> + void *dst;
> + int ret;
> +
> + raw_spin_lock_irqsave(&patch_lock, flags);
> +
> + while (patched < len) {
> + dst = addr + patched;
> + size = min_t(size_t, PAGE_SIZE - offset_in_page(dst),
> + len - patched);
> +
> + waddr = patch_map(dst, FIX_TEXT_POKE0);
> + ret = copy_to_kernel_nofault(waddr, opcode + patched, size);
> + patch_unmap(FIX_TEXT_POKE0);
> +
> + if (ret < 0) {
> + raw_spin_unlock_irqrestore(&patch_lock, flags);
> + return NULL;
> + }
> + patched += size;
> + }
> + raw_spin_unlock_irqrestore(&patch_lock, flags);
> +
> + return addr;
> +}
> +
> int __kprobes aarch64_insn_patch_text_nosync(void *addr, u32 insn)
> {
> u32 *tp = addr;
> --
> 2.39.2
>
On Mon, Jun 5, 2023 at 12:40 AM Puranjay Mohan <[email protected]> wrote:
>
> Use bpf_jit_binary_pack_alloc for memory management of JIT binaries in
> ARM64 BPF JIT. The bpf_jit_binary_pack_alloc creates a pair of RW and RX
> buffers. The JIT writes the program into the RW buffer. When the JIT is
> done, the program is copied to the final ROX buffer
> with bpf_jit_binary_pack_finalize.
>
> Implement bpf_arch_text_copy() and bpf_arch_text_invalidate() for ARM64
> JIT as these functions are required by bpf_jit_binary_pack allocator.
>
> Signed-off-by: Puranjay Mohan <[email protected]>
> ---
> arch/arm64/net/bpf_jit_comp.c | 119 +++++++++++++++++++++++++++++-----
> 1 file changed, 102 insertions(+), 17 deletions(-)
>
> diff --git a/arch/arm64/net/bpf_jit_comp.c b/arch/arm64/net/bpf_jit_comp.c
> index 145b540ec34f..ee9414cadea8 100644
> --- a/arch/arm64/net/bpf_jit_comp.c
> +++ b/arch/arm64/net/bpf_jit_comp.c
> @@ -76,6 +76,7 @@ struct jit_ctx {
> int *offset;
> int exentry_idx;
> __le32 *image;
> + __le32 *ro_image;
We are using:
image vs. ro_image
rw_header vs. header
rw_image_ptr vs. image_ptr
Shall we be more consistent with rw_ or ro_ prefix?
> u32 stack_size;
> int fpb_offset;
> };
> @@ -205,6 +206,20 @@ static void jit_fill_hole(void *area, unsigned int size)
> *ptr++ = cpu_to_le32(AARCH64_BREAK_FAULT);
> }
>
> +int bpf_arch_text_invalidate(void *dst, size_t len)
> +{
> + __le32 *ptr;
> + int ret;
> +
> + for (ptr = dst; len >= sizeof(u32); len -= sizeof(u32)) {
> + ret = aarch64_insn_patch_text_nosync(ptr++, AARCH64_BREAK_FAULT);
I think one aarch64_insn_patch_text_nosync() per 4 byte is too much overhead.
Shall we add a helper to do this in bigger patches?
Thanks,
Song
> + if (ret)
> + return ret;
> + }
> +
> + return 0;
> +}
> +
[...]
Hi,
On Mon, Jun 5, 2023 at 7:05 PM Song Liu <[email protected]> wrote:
>
> On Mon, Jun 5, 2023 at 12:40 AM Puranjay Mohan <[email protected]> wrote:
> >
> > Use bpf_jit_binary_pack_alloc for memory management of JIT binaries in
> > ARM64 BPF JIT. The bpf_jit_binary_pack_alloc creates a pair of RW and RX
> > buffers. The JIT writes the program into the RW buffer. When the JIT is
> > done, the program is copied to the final ROX buffer
> > with bpf_jit_binary_pack_finalize.
> >
> > Implement bpf_arch_text_copy() and bpf_arch_text_invalidate() for ARM64
> > JIT as these functions are required by bpf_jit_binary_pack allocator.
> >
> > Signed-off-by: Puranjay Mohan <[email protected]>
> > ---
> > arch/arm64/net/bpf_jit_comp.c | 119 +++++++++++++++++++++++++++++-----
> > 1 file changed, 102 insertions(+), 17 deletions(-)
> >
> > diff --git a/arch/arm64/net/bpf_jit_comp.c b/arch/arm64/net/bpf_jit_comp.c
> > index 145b540ec34f..ee9414cadea8 100644
> > --- a/arch/arm64/net/bpf_jit_comp.c
> > +++ b/arch/arm64/net/bpf_jit_comp.c
> > @@ -76,6 +76,7 @@ struct jit_ctx {
> > int *offset;
> > int exentry_idx;
> > __le32 *image;
> > + __le32 *ro_image;
>
> We are using:
> image vs. ro_image
> rw_header vs. header
> rw_image_ptr vs. image_ptr
Will use "rw_image" and "image" in the next version.
>
> Shall we be more consistent with rw_ or ro_ prefix?
>
> > u32 stack_size;
> > int fpb_offset;
> > };
> > @@ -205,6 +206,20 @@ static void jit_fill_hole(void *area, unsigned int size)
> > *ptr++ = cpu_to_le32(AARCH64_BREAK_FAULT);
> > }
> >
> > +int bpf_arch_text_invalidate(void *dst, size_t len)
> > +{
> > + __le32 *ptr;
> > + int ret;
> > +
> > + for (ptr = dst; len >= sizeof(u32); len -= sizeof(u32)) {
> > + ret = aarch64_insn_patch_text_nosync(ptr++, AARCH64_BREAK_FAULT);
>
> I think one aarch64_insn_patch_text_nosync() per 4 byte is too much overhead.
> Shall we add a helper to do this in bigger patches?
What would be the most efficient way to build this helper? As arm64 doesn't
have the __text_poke() API. Calling copy_to_kernel_nofault() in a loop might
not be the best way. One way would be to use __put_kernel_nofault() directly.
Also, what should we call this helper? aarch64_insn_memset() ?
Thanks,
Puranjay
On Mon, Jun 5, 2023 at 6:42 PM Song Liu <[email protected]> wrote:
>
> On Mon, Jun 5, 2023 at 12:40 AM Puranjay Mohan <[email protected]> wrote:
> >
> > This will be used by BPF JIT compiler to dump JITed binary to a RX huge
> > page, and thus allow multiple BPF programs sharing the a huge (2MB)
> > page.
> >
> > The bpf_prog_pack allocator that implements the above feature allocates
> > a RX/RW buffer pair. The JITed code is written to the RW buffer and then
> > this function will be used to copy the code from RW to RX buffer.
> >
> > Signed-off-by: Puranjay Mohan <[email protected]>
>
> Acked-by: Song Liu <[email protected]>
>
> With a nit below.
>
> > ---
> > arch/arm64/include/asm/patching.h | 1 +
> > arch/arm64/kernel/patching.c | 39 +++++++++++++++++++++++++++++++
> > 2 files changed, 40 insertions(+)
> >
> > diff --git a/arch/arm64/include/asm/patching.h b/arch/arm64/include/asm/patching.h
> > index 68908b82b168..dba9eb392bf1 100644
> > --- a/arch/arm64/include/asm/patching.h
> > +++ b/arch/arm64/include/asm/patching.h
> > @@ -8,6 +8,7 @@ int aarch64_insn_read(void *addr, u32 *insnp);
> > int aarch64_insn_write(void *addr, u32 insn);
> >
> > int aarch64_insn_write_literal_u64(void *addr, u64 val);
> > +void *aarch64_insn_copy(void *addr, const void *opcode, size_t len);
> >
> > int aarch64_insn_patch_text_nosync(void *addr, u32 insn);
> > int aarch64_insn_patch_text(void *addrs[], u32 insns[], int cnt);
> > diff --git a/arch/arm64/kernel/patching.c b/arch/arm64/kernel/patching.c
> > index b4835f6d594b..48c710f6a1ff 100644
> > --- a/arch/arm64/kernel/patching.c
> > +++ b/arch/arm64/kernel/patching.c
> > @@ -105,6 +105,45 @@ noinstr int aarch64_insn_write_literal_u64(void *addr, u64 val)
> > return ret;
> > }
> >
> > +/**
> > + * aarch64_insn_copy - Copy instructions into (an unused part of) RX memory
> > + * @addr: address to modify
> > + * @opcode: source of the copy
> > + * @len: length to copy
> > + *
> > + * Useful for JITs to dump new code blocks into unused regions of RX memory.
> > + */
>
> nit:
> I understand "addr" and "opcode" are used by x86 text_poke_copy(). But maybe
> we should call them "dst" and "src" or "to" and "from" or something similar?
Sure, I will call it "dst" and "src" in the next version.
Thanks,
Puranjay
On Mon, Jun 5, 2023 at 11:34 AM Puranjay Mohan <[email protected]> wrote:
>
> Hi,
>
> On Mon, Jun 5, 2023 at 7:05 PM Song Liu <[email protected]> wrote:
> >
> > On Mon, Jun 5, 2023 at 12:40 AM Puranjay Mohan <[email protected]> wrote:
> > >
> > > Use bpf_jit_binary_pack_alloc for memory management of JIT binaries in
> > > ARM64 BPF JIT. The bpf_jit_binary_pack_alloc creates a pair of RW and RX
> > > buffers. The JIT writes the program into the RW buffer. When the JIT is
> > > done, the program is copied to the final ROX buffer
> > > with bpf_jit_binary_pack_finalize.
> > >
> > > Implement bpf_arch_text_copy() and bpf_arch_text_invalidate() for ARM64
> > > JIT as these functions are required by bpf_jit_binary_pack allocator.
> > >
> > > Signed-off-by: Puranjay Mohan <[email protected]>
> > > ---
> > > arch/arm64/net/bpf_jit_comp.c | 119 +++++++++++++++++++++++++++++-----
> > > 1 file changed, 102 insertions(+), 17 deletions(-)
> > >
> > > diff --git a/arch/arm64/net/bpf_jit_comp.c b/arch/arm64/net/bpf_jit_comp.c
> > > index 145b540ec34f..ee9414cadea8 100644
> > > --- a/arch/arm64/net/bpf_jit_comp.c
> > > +++ b/arch/arm64/net/bpf_jit_comp.c
> > > @@ -76,6 +76,7 @@ struct jit_ctx {
> > > int *offset;
> > > int exentry_idx;
> > > __le32 *image;
> > > + __le32 *ro_image;
> >
> > We are using:
> > image vs. ro_image
> > rw_header vs. header
> > rw_image_ptr vs. image_ptr
>
> Will use "rw_image" and "image" in the next version.
>
> >
> > Shall we be more consistent with rw_ or ro_ prefix?
> >
> > > u32 stack_size;
> > > int fpb_offset;
> > > };
> > > @@ -205,6 +206,20 @@ static void jit_fill_hole(void *area, unsigned int size)
> > > *ptr++ = cpu_to_le32(AARCH64_BREAK_FAULT);
> > > }
> > >
> > > +int bpf_arch_text_invalidate(void *dst, size_t len)
> > > +{
> > > + __le32 *ptr;
> > > + int ret;
> > > +
> > > + for (ptr = dst; len >= sizeof(u32); len -= sizeof(u32)) {
> > > + ret = aarch64_insn_patch_text_nosync(ptr++, AARCH64_BREAK_FAULT);
> >
> > I think one aarch64_insn_patch_text_nosync() per 4 byte is too much overhead.
> > Shall we add a helper to do this in bigger patches?
>
> What would be the most efficient way to build this helper? As arm64 doesn't
> have the __text_poke() API. Calling copy_to_kernel_nofault() in a loop might
> not be the best way. One way would be to use __put_kernel_nofault() directly.
>
> Also, what should we call this helper? aarch64_insn_memset() ?
I just found aarch64_insn_patch_text_cb() also calls
aarch64_insn_patch_text_nosync() in a loop. So it is probably OK as-is?
Thanks,
Song
On Mon, Jun 5, 2023 at 10:13 PM Song Liu <[email protected]> wrote:
>
> On Mon, Jun 5, 2023 at 11:34 AM Puranjay Mohan <[email protected]> wrote:
> >
> > Hi,
> >
> > On Mon, Jun 5, 2023 at 7:05 PM Song Liu <[email protected]> wrote:
> > >
> > > On Mon, Jun 5, 2023 at 12:40 AM Puranjay Mohan <[email protected]> wrote:
> > > >
> > > > Use bpf_jit_binary_pack_alloc for memory management of JIT binaries in
> > > > ARM64 BPF JIT. The bpf_jit_binary_pack_alloc creates a pair of RW and RX
> > > > buffers. The JIT writes the program into the RW buffer. When the JIT is
> > > > done, the program is copied to the final ROX buffer
> > > > with bpf_jit_binary_pack_finalize.
> > > >
> > > > Implement bpf_arch_text_copy() and bpf_arch_text_invalidate() for ARM64
> > > > JIT as these functions are required by bpf_jit_binary_pack allocator.
> > > >
> > > > Signed-off-by: Puranjay Mohan <[email protected]>
> > > > ---
> > > > arch/arm64/net/bpf_jit_comp.c | 119 +++++++++++++++++++++++++++++-----
> > > > 1 file changed, 102 insertions(+), 17 deletions(-)
> > > >
> > > > diff --git a/arch/arm64/net/bpf_jit_comp.c b/arch/arm64/net/bpf_jit_comp.c
> > > > index 145b540ec34f..ee9414cadea8 100644
> > > > --- a/arch/arm64/net/bpf_jit_comp.c
> > > > +++ b/arch/arm64/net/bpf_jit_comp.c
> > > > @@ -76,6 +76,7 @@ struct jit_ctx {
> > > > int *offset;
> > > > int exentry_idx;
> > > > __le32 *image;
> > > > + __le32 *ro_image;
> > >
> > > We are using:
> > > image vs. ro_image
> > > rw_header vs. header
> > > rw_image_ptr vs. image_ptr
> >
> > Will use "rw_image" and "image" in the next version.
> >
> > >
> > > Shall we be more consistent with rw_ or ro_ prefix?
> > >
> > > > u32 stack_size;
> > > > int fpb_offset;
> > > > };
> > > > @@ -205,6 +206,20 @@ static void jit_fill_hole(void *area, unsigned int size)
> > > > *ptr++ = cpu_to_le32(AARCH64_BREAK_FAULT);
> > > > }
> > > >
> > > > +int bpf_arch_text_invalidate(void *dst, size_t len)
> > > > +{
> > > > + __le32 *ptr;
> > > > + int ret;
> > > > +
> > > > + for (ptr = dst; len >= sizeof(u32); len -= sizeof(u32)) {
> > > > + ret = aarch64_insn_patch_text_nosync(ptr++, AARCH64_BREAK_FAULT);
> > >
> > > I think one aarch64_insn_patch_text_nosync() per 4 byte is too much overhead.
> > > Shall we add a helper to do this in bigger patches?
> >
> > What would be the most efficient way to build this helper? As arm64 doesn't
> > have the __text_poke() API. Calling copy_to_kernel_nofault() in a loop might
> > not be the best way. One way would be to use __put_kernel_nofault() directly.
> >
> > Also, what should we call this helper? aarch64_insn_memset() ?
>
> I just found aarch64_insn_patch_text_cb() also calls
> aarch64_insn_patch_text_nosync() in a loop. So it is probably OK as-is?
Okay, then we can go ahead with this.
Another thing about the consistency of rw_ and ro_ prefix.
The ctx->image is used all over the place in the JIT, so changing it would
require a lot of changes. Therefore the naming convention that I will follow is
"image" and "ro_image". By this naming convention, ctx->image can be left
untouched and only ro_image would be used at some places like:
- prog->bpf_func = (void *)ctx.image;
+ prog->bpf_func = (void *)ctx.ro_image;
etc.
I will use this in the next version of the patch.
Thanks,
Puranjay