2020-03-19 13:51:04

by Cheng Jian

[permalink] [raw]
Subject: Why is text_mutex used in jump_label_transform for x86_64

Hi,everyone

I'm sorry to disturb you. I have a problem about jump_label, and a bit
confused about the code

I noticed that text_mutex is used in this function under x86_64
architecture,
but other architectures do not.

in arch/x86/kernel/jump_label.c
        static void __ref jump_label_transform(struct jump_entry *entry,
             enum jump_label_type type,
             int init)
        {
         mutex_lock(&text_mutex);
         __jump_label_transform(entry, type, init);
         mutex_unlock(&text_mutex);

in arch/arm64/kernel/jump_label.c

        void arch_jump_label_transform(struct jump_entry *entry,
                                       enum jump_label_type type)
        {
                void *addr = (void *)jump_entry_code(entry);
                u32 insn;

                if (type == JUMP_LABEL_JMP) {
                        insn =
aarch64_insn_gen_branch_imm(jump_entry_code(entry),
jump_entry_target(entry),
AARCH64_INSN_BRANCH_NOLINK);
                } else {
                        insn = aarch64_insn_gen_nop();
                }

                aarch64_insn_patch_text_nosync(addr, insn);
        }


Is there anything wrong with x86

or

is this missing for other architectures?


Thanks

---- Cheng Jian






2020-03-20 10:29:08

by Peter Zijlstra

[permalink] [raw]
Subject: Re: Why is text_mutex used in jump_label_transform for x86_64

On Thu, Mar 19, 2020 at 09:49:04PM +0800, chengjian (D) wrote:
> Hi,everyone
>
> I'm sorry to disturb you. I have a problem about jump_label, and a bit
> confused about the code
>
> I noticed that text_mutex is used in this function under x86_64
> architecture,
> but other architectures do not.
>
> in arch/x86/kernel/jump_label.c
>         static void __ref jump_label_transform(struct jump_entry *entry,
>              enum jump_label_type type,
>              int init)
>         {
>          mutex_lock(&text_mutex);
>          __jump_label_transform(entry, type, init);
>          mutex_unlock(&text_mutex);
>
> in arch/arm64/kernel/jump_label.c
>
>         void arch_jump_label_transform(struct jump_entry *entry,
>                                        enum jump_label_type type)
>         {
>                 void *addr = (void *)jump_entry_code(entry);
>                 u32 insn;
>
>                 if (type == JUMP_LABEL_JMP) {
>                         insn =
> aarch64_insn_gen_branch_imm(jump_entry_code(entry),
> jump_entry_target(entry),
> AARCH64_INSN_BRANCH_NOLINK);
>                 } else {
>                         insn = aarch64_insn_gen_nop();
>                 }
>
>                 aarch64_insn_patch_text_nosync(addr, insn);
>         }
>
>
> Is there anything wrong with x86
>
> or
>
> is this missing for other architectures?

It depends on the architecture details of how self-modifying code works.
In particular, x86 is a variable instruction length architecture and
needs extreme care -- it's implementation requires there only be a
single text modifier at any one time, hence the use of text_mutex.

ARM64 OTOH is, like most RISC based architectures, a fixed width
instruction architecture. And in particular it can re-write certain
(branch) instructions with impunity (see their
aarch64_insn_patch_text_nosync()). Which is why they don't need
additional serialization.

2020-04-06 08:40:16

by Cheng Jian

[permalink] [raw]
Subject: Re: Why is text_mutex used in jump_label_transform for x86_64


On 2020/3/20 18:27, Peter Zijlstra wrote:
> It depends on the architecture details of how self-modifying code works.
> In particular, x86 is a variable instruction length architecture and
> needs extreme care -- it's implementation requires there only be a
> single text modifier at any one time, hence the use of text_mutex.
>
> ARM64 OTOH is, like most RISC based architectures, a fixed width
> instruction architecture. And in particular it can re-write certain
> (branch) instructions with impunity (see their
> aarch64_insn_patch_text_nosync()). Which is why they don't need
> additional serialization.

Hi, Peter

Thank you very much for your reply.

X86 is a variable-length instruction, only one byte modification of the
instruction
can be regarded as atomic. so we must be very careful when modifying
instructions
concurrently.

For other architectures such as ARM64, the modification of some
instructions can be
considered atomic, (Eg. nop -> jmp/b). The set of instructions that can
be executed
by one thread of execution as they are being modified by another thread
of execution
without requiring explicit synchronization.

In ARM64 Architecture Reference Manual, I find that:
    Concurrent modification and execution of instructions can lead to
the resulting instruction performing any behavior
    that can be achieved by executing any sequence of instructions that
can be executed from the same Exception level,
    except where each of the instruction before modification and the
instruction after modification is one of a B, BL, BRK,
    HVC, ISB, NOP, SMC, or SVC instruction.
    For the B, BL, BRK, HVC, ISB, NOP, SMC, and SVC instructions the
architecture guarantees that, after modification of the
    instruction, behavior is consistent with execution of either:
    • The instruction originally fetched.
    • A fetch of the modified instruction

So we can safely modify jump_label for ARM64(from NOP to b or form b to
NOP).

Is my understanding correct?



Thank You

    -- Cheng Jian


2020-04-06 09:16:52

by Peter Zijlstra

[permalink] [raw]
Subject: Re: Why is text_mutex used in jump_label_transform for x86_64

On Mon, Apr 06, 2020 at 04:39:11PM +0800, chengjian (D) wrote:
>
> On 2020/3/20 18:27, Peter Zijlstra wrote:
> > It depends on the architecture details of how self-modifying code works.
> > In particular, x86 is a variable instruction length architecture and
> > needs extreme care -- it's implementation requires there only be a
> > single text modifier at any one time, hence the use of text_mutex.
> >
> > ARM64 OTOH is, like most RISC based architectures, a fixed width
> > instruction architecture. And in particular it can re-write certain
> > (branch) instructions with impunity (see their
> > aarch64_insn_patch_text_nosync()). Which is why they don't need
> > additional serialization.
>
> Hi, Peter
>
> Thank you very much for your reply.
>
> X86 is a variable-length instruction, only one byte modification of the
> instruction
> can be regarded as atomic. so we must be very careful when modifying
> instructions
> concurrently.

Close enough.

> For other architectures such as ARM64, the modification of some instructions
> can be
> considered atomic, (Eg. nop -> jmp/b). The set of instructions that can be
> executed
> by one thread of execution as they are being modified by another thread of
> execution
> without requiring explicit synchronization.
>
> In ARM64 Architecture Reference Manual, I find that:
>     Concurrent modification and execution of instructions can lead to the
> resulting instruction performing any behavior
>     that can be achieved by executing any sequence of instructions that can
> be executed from the same Exception level,
>     except where each of the instruction before modification and the
> instruction after modification is one of a B, BL, BRK,
>     HVC, ISB, NOP, SMC, or SVC instruction.
>     For the B, BL, BRK, HVC, ISB, NOP, SMC, and SVC instructions the
> architecture guarantees that, after modification of the
>     instruction, behavior is consistent with execution of either:
>     • The instruction originally fetched.
>     • A fetch of the modified instruction
>
> So we can safely modify jump_label for ARM64(from NOP to b or form b to
> NOP).
>
> Is my understanding correct?

I think so; but I'm really not much of an ARM64 person. FWIW I think I
remember Will saying the same is true of ARM (32bit) and they could
implement the same optimization, but so far nobody has bothered doing
so. But please, ask an ARM64 maintainer and don't take my word for this.

2020-04-06 14:12:13

by Will Deacon

[permalink] [raw]
Subject: Re: Why is text_mutex used in jump_label_transform for x86_64

On Mon, Apr 06, 2020 at 11:15:51AM +0200, Peter Zijlstra wrote:
> On Mon, Apr 06, 2020 at 04:39:11PM +0800, chengjian (D) wrote:
> >
> > On 2020/3/20 18:27, Peter Zijlstra wrote:
> > > It depends on the architecture details of how self-modifying code works.
> > > In particular, x86 is a variable instruction length architecture and
> > > needs extreme care -- it's implementation requires there only be a
> > > single text modifier at any one time, hence the use of text_mutex.
> > >
> > > ARM64 OTOH is, like most RISC based architectures, a fixed width
> > > instruction architecture. And in particular it can re-write certain
> > > (branch) instructions with impunity (see their
> > > aarch64_insn_patch_text_nosync()). Which is why they don't need
> > > additional serialization.
> >
> > Hi, Peter
> >
> > Thank you very much for your reply.
> >
> > X86 is a variable-length instruction, only one byte modification of the
> > instruction
> > can be regarded as atomic. so we must be very careful when modifying
> > instructions
> > concurrently.
>
> Close enough.
>
> > For other architectures such as ARM64, the modification of some instructions
> > can be
> > considered atomic, (Eg. nop -> jmp/b). The set of instructions that can be
> > executed
> > by one thread of execution as they are being modified by another thread of
> > execution
> > without requiring explicit synchronization.
> >
> > In ARM64 Architecture Reference Manual, I find that:
> >     Concurrent modification and execution of instructions can lead to the
> > resulting instruction performing any behavior
> >     that can be achieved by executing any sequence of instructions that can
> > be executed from the same Exception level,
> >     except where each of the instruction before modification and the
> > instruction after modification is one of a B, BL, BRK,
> >     HVC, ISB, NOP, SMC, or SVC instruction.
> >     For the B, BL, BRK, HVC, ISB, NOP, SMC, and SVC instructions the
> > architecture guarantees that, after modification of the
> >     instruction, behavior is consistent with execution of either:
> >     • The instruction originally fetched.
> >     • A fetch of the modified instruction
> >
> > So we can safely modify jump_label for ARM64(from NOP to b or form b to
> > NOP).
> >
> > Is my understanding correct?
>
> I think so; but I'm really not much of an ARM64 person. FWIW I think I
> remember Will saying the same is true of ARM (32bit) and they could
> implement the same optimization, but so far nobody has bothered doing
> so. But please, ask an ARM64 maintainer and don't take my word for this.

On 32-bit there are complications with Thumb-2 instructions where you can
have a mixture of 16-bit and 32-bit encodings, so you have to be pretty
careful there.

For arm64, we have aarch64_insn_patch_text_nosync() which we use to toggle
jump labels.

Will

2020-04-08 01:19:09

by Cheng Jian

[permalink] [raw]
Subject: Re: Why is text_mutex used in jump_label_transform for x86_64


On 2020/4/6 22:10, Will Deacon wrote:
> On Mon, Apr 06, 2020 at 11:15:51AM +0200, Peter Zijlstra wrote:
>> On Mon, Apr 06, 2020 at 04:39:11PM +0800, chengjian (D) wrote:
>>> On 2020/3/20 18:27, Peter Zijlstra wrote:
>>>> It depends on the architecture details of how self-modifying code works.
>>>> In particular, x86 is a variable instruction length architecture and
>>>> needs extreme care -- it's implementation requires there only be a
>>>> single text modifier at any one time, hence the use of text_mutex.
>>>>
>>>> ARM64 OTOH is, like most RISC based architectures, a fixed width
>>>> instruction architecture. And in particular it can re-write certain
>>>> (branch) instructions with impunity (see their
>>>> aarch64_insn_patch_text_nosync()). Which is why they don't need
>>>> additional serialization.
>>> Hi, Peter
>>>
>>> Thank you very much for your reply.
>>>
>>> X86 is a variable-length instruction, only one byte modification of the
>>> instruction
>>> can be regarded as atomic. so we must be very careful when modifying
>>> instructions
>>> concurrently.
>> Close enough.
>>
>>> For other architectures such as ARM64, the modification of some instructions
>>> can be
>>> considered atomic, (Eg. nop -> jmp/b). The set of instructions that can be
>>> executed
>>> by one thread of execution as they are being modified by another thread of
>>> execution
>>> without requiring explicit synchronization.
>>>
>>> In ARM64 Architecture Reference Manual, I find that:
>>>     Concurrent modification and execution of instructions can lead to the
>>> resulting instruction performing any behavior
>>>     that can be achieved by executing any sequence of instructions that can
>>> be executed from the same Exception level,
>>>     except where each of the instruction before modification and the
>>> instruction after modification is one of a B, BL, BRK,
>>>     HVC, ISB, NOP, SMC, or SVC instruction.
>>>     For the B, BL, BRK, HVC, ISB, NOP, SMC, and SVC instructions the
>>> architecture guarantees that, after modification of the
>>>     instruction, behavior is consistent with execution of either:
>>>     • The instruction originally fetched.
>>>     • A fetch of the modified instruction
>>>
>>> So we can safely modify jump_label for ARM64(from NOP to b or form b to
>>> NOP).
>>>
>>> Is my understanding correct?
>> I think so; but I'm really not much of an ARM64 person. FWIW I think I
>> remember Will saying the same is true of ARM (32bit) and they could
>> implement the same optimization, but so far nobody has bothered doing
>> so. But please, ask an ARM64 maintainer and don't take my word for this.
> On 32-bit there are complications with Thumb-2 instructions where you can
> have a mixture of 16-bit and 32-bit encodings, so you have to be pretty
> careful there.
>
> For arm64, we have aarch64_insn_patch_text_nosync() which we use to toggle
> jump labels.
>
> Will
>
> .


Hi, Peter and Will

    I have learned.

    I truly appreciate your timely help.


    Thanks a lot.

    -- Cheng Jian