Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Message-ID: <ce15b171-897f-bf2e-2897-c0b2b912e709@huaweicloud.com>
Date:   Sat, 15 Jul 2023 17:03:44 +0800
MIME-Version: 1.0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101
 Thunderbird/91.9.0
Subject: Re: [PATCH bpf] bpf, arm64: Fix BTI type used for freplace attached
 functions
Content-Language: en-US
To:     Alexander Duyck <alexander.duyck@gmail.com>, bpf@vger.kernel.org,
        linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org
References: <168926677665.316237.9953845318337455525.stgit@ahduyck-xeon-server.home.arpa>
From:   Xu Kuohai <xukuohai@huaweicloud.com>
In-Reply-To: <168926677665.316237.9953845318337455525.stgit@ahduyck-xeon-server.home.arpa>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
Precedence: bulk

On 7/14/2023 12:49 AM, Alexander Duyck wrote:
> From: Alexander Duyck <alexanderduyck@fb.com>
> 
> When running an freplace attached bpf program on an arm64 system w were
> seeing the following issue:
>    Unhandled 64-bit el1h sync exception on CPU47, ESR 0x0000000036000003 -- BTI
> 
> After a bit of work to track it down I determined that what appeared to be
> happening is that the 'bti c' at the start of the program was somehow being
> reached after a 'br' instruction. Further digging pointed me toward the
> fact that the function was attached via freplace. This in turn led me to
> build_plt which I believe is invoking the long jump which is triggering
> this error.
> 
> To resolve it we can replace the 'bti c' with 'bti jc' and add a comment
> explaining why this has to be modified as such.
> 
> Fixes: b2ad54e1533e ("bpf, arm64: Implement bpf_arch_text_poke() for arm64")
> Signed-off-by: Alexander Duyck <alexanderduyck@fb.com>
> ---
>   arch/arm64/net/bpf_jit_comp.c |    8 +++++++-
>   1 file changed, 7 insertions(+), 1 deletion(-)
> 
> diff --git a/arch/arm64/net/bpf_jit_comp.c b/arch/arm64/net/bpf_jit_comp.c
> index 145b540ec34f..ec2174838f2a 100644
> --- a/arch/arm64/net/bpf_jit_comp.c
> +++ b/arch/arm64/net/bpf_jit_comp.c
> @@ -322,7 +322,13 @@ static int build_prologue(struct jit_ctx *ctx, bool ebpf_from_cbpf)
>   	 *
>   	 */
>   
> -	emit_bti(A64_BTI_C, ctx);
> +	/* bpf function may be invoked by 3 instruction types:
> +	 * 1. bl, attached via freplace to bpf prog via short jump
> +	 * 2. br, attached via freplace to bpf prog via long jump
> +	 * 3. blr, working as a function pointer, used by emit_call.
> +	 * So BTI_JC should used here to support both br and blr.
> +	 */
> +	emit_bti(A64_BTI_JC, ctx);

LGTM. Thanks for the fixes.

Acked-by: Xu Kuohai <xukuohai@huawei.com>

>   
>   	emit(A64_MOV(1, A64_R(9), A64_LR), ctx);
>   	emit(A64_NOP, ctx);
> 
>