From: Alexander Duyck <[email protected]>
When running an freplace attached bpf program on an arm64 system w were
seeing the following issue:
Unhandled 64-bit el1h sync exception on CPU47, ESR 0x0000000036000003 -- BTI
After a bit of work to track it down I determined that what appeared to be
happening is that the 'bti c' at the start of the program was somehow being
reached after a 'br' instruction. Further digging pointed me toward the
fact that the function was attached via freplace. This in turn led me to
build_plt which I believe is invoking the long jump which is triggering
this error.
To resolve it we can replace the 'bti c' with 'bti jc' and add a comment
explaining why this has to be modified as such.
Fixes: b2ad54e1533e ("bpf, arm64: Implement bpf_arch_text_poke() for arm64")
Signed-off-by: Alexander Duyck <[email protected]>
---
arch/arm64/net/bpf_jit_comp.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
diff --git a/arch/arm64/net/bpf_jit_comp.c b/arch/arm64/net/bpf_jit_comp.c
index 145b540ec34f..ec2174838f2a 100644
--- a/arch/arm64/net/bpf_jit_comp.c
+++ b/arch/arm64/net/bpf_jit_comp.c
@@ -322,7 +322,13 @@ static int build_prologue(struct jit_ctx *ctx, bool ebpf_from_cbpf)
*
*/
- emit_bti(A64_BTI_C, ctx);
+ /* bpf function may be invoked by 3 instruction types:
+ * 1. bl, attached via freplace to bpf prog via short jump
+ * 2. br, attached via freplace to bpf prog via long jump
+ * 3. blr, working as a function pointer, used by emit_call.
+ * So BTI_JC should used here to support both br and blr.
+ */
+ emit_bti(A64_BTI_JC, ctx);
emit(A64_MOV(1, A64_R(9), A64_LR), ctx);
emit(A64_NOP, ctx);
On 7/14/2023 12:49 AM, Alexander Duyck wrote:
> From: Alexander Duyck <[email protected]>
>
> When running an freplace attached bpf program on an arm64 system w were
> seeing the following issue:
> Unhandled 64-bit el1h sync exception on CPU47, ESR 0x0000000036000003 -- BTI
>
> After a bit of work to track it down I determined that what appeared to be
> happening is that the 'bti c' at the start of the program was somehow being
> reached after a 'br' instruction. Further digging pointed me toward the
> fact that the function was attached via freplace. This in turn led me to
> build_plt which I believe is invoking the long jump which is triggering
> this error.
>
> To resolve it we can replace the 'bti c' with 'bti jc' and add a comment
> explaining why this has to be modified as such.
>
> Fixes: b2ad54e1533e ("bpf, arm64: Implement bpf_arch_text_poke() for arm64")
> Signed-off-by: Alexander Duyck <[email protected]>
> ---
> arch/arm64/net/bpf_jit_comp.c | 8 +++++++-
> 1 file changed, 7 insertions(+), 1 deletion(-)
>
> diff --git a/arch/arm64/net/bpf_jit_comp.c b/arch/arm64/net/bpf_jit_comp.c
> index 145b540ec34f..ec2174838f2a 100644
> --- a/arch/arm64/net/bpf_jit_comp.c
> +++ b/arch/arm64/net/bpf_jit_comp.c
> @@ -322,7 +322,13 @@ static int build_prologue(struct jit_ctx *ctx, bool ebpf_from_cbpf)
> *
> */
>
> - emit_bti(A64_BTI_C, ctx);
> + /* bpf function may be invoked by 3 instruction types:
> + * 1. bl, attached via freplace to bpf prog via short jump
> + * 2. br, attached via freplace to bpf prog via long jump
> + * 3. blr, working as a function pointer, used by emit_call.
> + * So BTI_JC should used here to support both br and blr.
> + */
> + emit_bti(A64_BTI_JC, ctx);
LGTM. Thanks for the fixes.
Acked-by: Xu Kuohai <[email protected]>
>
> emit(A64_MOV(1, A64_R(9), A64_LR), ctx);
> emit(A64_NOP, ctx);
>
>
On Sat, Jul 15, 2023 at 2:03 AM Xu Kuohai <[email protected]> wrote:
>
> On 7/14/2023 12:49 AM, Alexander Duyck wrote:
> > From: Alexander Duyck <[email protected]>
> >
> > When running an freplace attached bpf program on an arm64 system w were
> > seeing the following issue:
> > Unhandled 64-bit el1h sync exception on CPU47, ESR 0x0000000036000003 -- BTI
> >
> > After a bit of work to track it down I determined that what appeared to be
> > happening is that the 'bti c' at the start of the program was somehow being
> > reached after a 'br' instruction. Further digging pointed me toward the
> > fact that the function was attached via freplace. This in turn led me to
> > build_plt which I believe is invoking the long jump which is triggering
> > this error.
> >
> > To resolve it we can replace the 'bti c' with 'bti jc' and add a comment
> > explaining why this has to be modified as such.
> >
> > Fixes: b2ad54e1533e ("bpf, arm64: Implement bpf_arch_text_poke() for arm64")
> > Signed-off-by: Alexander Duyck <[email protected]>
> > ---
> > arch/arm64/net/bpf_jit_comp.c | 8 +++++++-
> > 1 file changed, 7 insertions(+), 1 deletion(-)
> >
> > diff --git a/arch/arm64/net/bpf_jit_comp.c b/arch/arm64/net/bpf_jit_comp.c
> > index 145b540ec34f..ec2174838f2a 100644
> > --- a/arch/arm64/net/bpf_jit_comp.c
> > +++ b/arch/arm64/net/bpf_jit_comp.c
> > @@ -322,7 +322,13 @@ static int build_prologue(struct jit_ctx *ctx, bool ebpf_from_cbpf)
> > *
> > */
> >
> > - emit_bti(A64_BTI_C, ctx);
> > + /* bpf function may be invoked by 3 instruction types:
> > + * 1. bl, attached via freplace to bpf prog via short jump
> > + * 2. br, attached via freplace to bpf prog via long jump
> > + * 3. blr, working as a function pointer, used by emit_call.
> > + * So BTI_JC should used here to support both br and blr.
> > + */
> > + emit_bti(A64_BTI_JC, ctx);
>
> LGTM. Thanks for the fixes.
>
> Acked-by: Xu Kuohai <[email protected]>
Applied. Thanks