Received-SPF: pass (google.com: domain of linux-kernel+bounces-103624-linux.lists.archive=gmail.com@vger.kernel.org designates 147.75.80.249 as permitted sender) client-ip=147.75.80.249;
Precedence: bulk
MIME-Version: 1.0
References: <20240314150003.123020-1-puranjay12@gmail.com> <20240314150003.123020-2-puranjay12@gmail.com>
 <CAP01T75tG5tXqRJsMn6iU1xvmEqeuTg=ja=LUPqqXkrJiYL2XQ@mail.gmail.com> <mb61pfrwsohx5.fsf@gmail.com>
In-Reply-To: <mb61pfrwsohx5.fsf@gmail.com>
From: Alexei Starovoitov <alexei.starovoitov@gmail.com>
Date: Thu, 14 Mar 2024 10:21:46 -0700
Message-ID: <CAADnVQ+vAuP1UuFf6tY64AmHBqk4FjRY7DwEjKXwWUaczubDcg@mail.gmail.com>
Subject: Re: [PATCH bpf-next 1/2] bpf: Add arm64 JIT support for PROBE_MEM32
 pseudo instructions.
To: Puranjay Mohan <puranjay12@gmail.com>
Cc: Kumar Kartikeya Dwivedi <memxor@gmail.com>, Alexei Starovoitov <ast@kernel.org>, 
	Eduard Zingerman <eddyz87@gmail.com>, Daniel Borkmann <daniel@iogearbox.net>, 
	John Fastabend <john.fastabend@gmail.com>, Andrii Nakryiko <andrii@kernel.org>, 
	Martin KaFai Lau <martin.lau@linux.dev>, Song Liu <song@kernel.org>, 
	Yonghong Song <yonghong.song@linux.dev>, KP Singh <kpsingh@kernel.org>, 
	Stanislav Fomichev <sdf@google.com>, Hao Luo <haoluo@google.com>, Jiri Olsa <jolsa@kernel.org>, 
	bpf <bpf@vger.kernel.org>, LKML <linux-kernel@vger.kernel.org>, 
	Catalin Marinas <catalin.marinas@arm.com>, Will Deacon <will@kernel.org>, 
	Zi Shen Lim <zlim.lnx@gmail.com>, Xu Kuohai <xukuohai@huawei.com>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

On Thu, Mar 14, 2024 at 10:13=E2=80=AFAM Puranjay Mohan <puranjay12@gmail.c=
om> wrote:
>
> Kumar Kartikeya Dwivedi <memxor@gmail.com> writes:
>
> > On Thu, 14 Mar 2024 at 16:00, Puranjay Mohan <puranjay12@gmail.com> wro=
te:
> >>
> >> Add support for [LDX | STX | ST], PROBE_MEM32, [B | H | W | DW]
> >> instructions.  They are similar to PROBE_MEM instructions with the
> >> following differences:
> >> - PROBE_MEM32 supports store.
> >> - PROBE_MEM32 relies on the verifier to clear upper 32-bit of the
> >>   src/dst register
> >> - PROBE_MEM32 adds 64-bit kern_vm_start address (which is stored in R2=
8
> >>   in the prologue). Due to bpf_arena constructions such R28 + reg +
> >>   off16 access is guaranteed to be within arena virtual range, so no
> >>   address check at run-time.
> >> - PROBE_MEM32 allows STX and ST. If they fault the store is a nop. Whe=
n
> >>   LDX faults the destination register is zeroed.
> >>
> >> To support these on arm64, we do tmp2 =3D R28 + src/dst reg and then u=
se
> >> tmp2 as the new src/dst register. This allows us to reuse most of the
> >> code for normal [LDX | STX | ST].
> >>
> >> Signed-off-by: Puranjay Mohan <puranjay12@gmail.com>
> >> ---
> >
> > Hi Alexei,
> > Puranjay and I were discussing this stuff off list and noticed that
> > atomic instructions are not handled.
> > It turns out that will cause a kernel crash right now because the
> > 32-bit offset into arena will be dereferenced directly.
> >
> > e.g. something like this:
> >
> > @@ -55,6 +56,7 @@ int arena_list_add(void *ctx)
> >                 test_val++;
> >                 n->value =3D i;
> >                 arena_sum +=3D i;
> > +               __sync_fetch_and_add(&arena_sum, 0);
> >                 list_add_head(&n->node, list_head);
> >         }
> >  #else
> >
> > I will try to prepare a fix for the x86 JIT. Puranjay will do the same
> > for his set.
>
> Yes, testing the change mentioned by Kumar on ARM64 causes a crashes as w=
ell:
>
> bpf_testmod: loading out-of-tree module taints kernel.
>  bpf_testmod: module verification failed: signature and/or required key m=
issing - tainting kernel
>  Unable to handle kernel NULL pointer dereference at virtual address 0000=
000000000010
>  Mem abort info:
>    ESR =3D 0x0000000096000006
>    EC =3D 0x25: DABT (current EL), IL =3D 32 bits
>    SET =3D 0, FnV =3D 0
>    EA =3D 0, S1PTW =3D 0
>    FSC =3D 0x06: level 2 translation fault
>  Data abort info:
>    ISV =3D 0, ISS =3D 0x00000006, ISS2 =3D 0x00000000
>    CM =3D 0, WnR =3D 0, TnD =3D 0, TagAccess =3D 0
>    GCS =3D 0, Overlay =3D 0, DirtyBit =3D 0, Xs =3D 0
>  user pgtable: 4k pages, 48-bit VAs, pgdp=3D00000004043cc000
>  [0000000000000010] pgd=3D0800000410d8f003, p4d=3D0800000410d8f003, pud=
=3D0800000405972003, pmd=3D0000000000000000
>  Internal error: Oops: 0000000096000006 [#1] SMP
>  Modules linked in: bpf_testmod(OE) nls_ascii nls_cp437 sunrpc vfat fat a=
es_ce_blk aes_ce_cipher ghash_ce sha1_ce button sch_fq_codel dm_mod dax con=
figfs dmi_sysfs sha2_ce sha256_arm64 efivarfs
>  CPU: 8 PID: 5631 Comm: test_progs Tainted: G           OE      6.8.0+ #2
>  Hardware name: Amazon EC2 c6g.16xlarge/, BIOS 1.0 11/1/2018
>  pstate: 20400005 (nzCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=3D--)
>  pc : bpf_prog_8771c336cb6a18eb_arena_list_add+0x204/0x2b8
>  lr : bpf_prog_8771c336cb6a18eb_arena_list_add+0x144/0x2b8
>  sp : ffff80008b84bc30
>  x29: ffff80008b84bca0 x28: ffff8000a5008000 x27: ffff80008b84bc38
>  x26: 0000000000000000 x25: ffff80008b84bc60 x24: 0000000000000000
>  x23: 0000000000000000 x22: 0000000000000058 x21: 0000000000000838
>  x20: 0000000000000000 x19: 0000000100001fe0 x18: 0000000000000000
>  x17: 0000000000000000 x16: 0000000000000000 x15: 0000ffffcc66d2c8
>  x14: 0000000000000000 x13: 0000000000000000 x12: 000000000004058c
>  x11: ffff8000a5008010 x10: 00000000ffffffff x9 : 00000000000002cf
>  x8 : ffff800082ff4ab8 x7 : 0000000100001000 x6 : 0000000000000001
>  x5 : 0000000010e5e3fd x4 : 000000003619b978 x3 : 0000000000000010
>  x2 : 0000000000000000 x1 : 0000000000000000 x0 : 0000000000001fe0
>  Call trace:
>   bpf_prog_8771c336cb6a18eb_arena_list_add+0x204/0x2b8
>   bpf_prog_test_run_syscall+0x100/0x340
>   __sys_bpf+0x8e8/0xa20
>   __arm64_sys_bpf+0x2c/0x48
>   invoke_syscall+0x50/0x128
>   el0_svc_common.constprop.0+0x48/0xf8
>   do_el0_svc+0x28/0x40
>   el0_svc+0x58/0x190
>   el0t_64_sync_handler+0x13c/0x158
>   el0t_64_sync+0x1a8/0x1b0
>  Code: 8b010042 8b1c006b f9000162 d2800001 (f821307f)
>  ---[ end trace 0000000000000000 ]---
>  Kernel panic - not syncing: Oops: Fatal exception
>  SMP: stopping secondary CPUs
>  Kernel Offset: disabled
>  CPU features: 0x0,00000120,7002014a,21407a0b
>  Memory Limit: none
>  Rebooting in 5 seconds..
>
> I will send v2 with the arm64 JIT fix, but I guess verifier has to be mod=
ified
> as well to add BPF_PROBE_MEM32 to atomic instructions.

The JIT and the verifier changes for atomics might be too big.
Let's disable atomics in arena in the verifier for now.
Pls send a patch.