From patchwork Sat Nov 7 05:34:54 2015 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yang Shi X-Patchwork-Id: 56144 Delivered-To: patch@linaro.org Received: by 10.112.61.134 with SMTP id p6csp82258lbr; Fri, 6 Nov 2015 21:54:01 -0800 (PST) X-Received: by 10.68.194.4 with SMTP id hs4mr23320483pbc.116.1446875641708; Fri, 06 Nov 2015 21:54:01 -0800 (PST) Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id tg4si5399421pab.100.2015.11.06.21.54.01; Fri, 06 Nov 2015 21:54:01 -0800 (PST) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dkim=neutral (body hash did not verify) header.i=@linaro_org.20150623.gappssmtp.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751071AbbKGFxS (ORCPT + 28 others); Sat, 7 Nov 2015 00:53:18 -0500 Received: from mail-pa0-f42.google.com ([209.85.220.42]:33284 "EHLO mail-pa0-f42.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750770AbbKGFxP (ORCPT ); Sat, 7 Nov 2015 00:53:15 -0500 Received: by pabfh17 with SMTP id fh17so143553050pab.0 for ; Fri, 06 Nov 2015 21:53:15 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro_org.20150623.gappssmtp.com; s=20150623; h=from:to:cc:subject:date:message-id; bh=m7oZ07+YjmqeUpNb/f4RYFzvAJUDpfK0KLPkxw0KSh4=; b=1Vukdc8G6SX446ODeG6/G2bKWUhcZjTw9QwTj42oAA0t6mcjniyxMBgezfycfeAB+P wE03sIO1kE7geDqMn7sExGafoJrPCbYhE0b1HPrVtIp71+P4+TKcybDgR5v3e/AeGkk5 mA3kGEnDKFYrXsvTgRBbxeeD/ayJQSAVjOoKLRwHaLVaoq4RsH9gY+mmGdooYWshYHQc G9swEccXUrA/rkpoVAoz4q+rEiogoT3cjIvscL6Et+eQgZVq457AfI0HLiT2LObyhah/ SU/v+An2eIHNEfyHAhVRyRfu2Kz7BXf64U5suHhjF5sQjuS6s8OIwzXhPDy/uuakrt4W dHng== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:from:to:cc:subject:date:message-id; bh=m7oZ07+YjmqeUpNb/f4RYFzvAJUDpfK0KLPkxw0KSh4=; b=VF4WBWNpvTY+3YIPJ33TTYZ1paJDXprINcUWkJvSkHafJYqeWhXMfupwGHrcnFWkug wYcYWx7Xqn+XcLj7QnpRfM4RQcFscfe12mG9MK7vMA4wID3ZyUAtCjolxuPtdZG9/jiE RlbNBmaGSoXtXYV0vVd1f3h67uegkwROoyLpxRZGcZB6xCt919iq3OIVKv06QmZ4HG9s AAi/ueDHwiIDUW+Us2S4TrHEHXZC15QoUqmLstk0RZUAeBcfSjQBzmpuwdFUhgM8GrDq khtINzkOdym4ZtryM/JVyP4zmo1AqZpOXyRTYt9IQfNOaEg+fJKaKp8Q9xNfil2C2Xot t+0w== X-Gm-Message-State: ALoCoQmbIHa9aKJWHnOws1jDjAvXAYm50+15iS4hTpzAyacksb/RiFmBcCsM0XiNKbgt7mrur+hw X-Received: by 10.67.8.40 with SMTP id dh8mr23082752pad.121.1446875595324; Fri, 06 Nov 2015 21:53:15 -0800 (PST) Received: from yshi-Precision-T5600.corp.ad.wrs.com (unknown-216-82.windriver.com. [147.11.216.82]) by smtp.gmail.com with ESMTPSA id bs3sm3315082pbd.89.2015.11.06.21.53.14 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Fri, 06 Nov 2015 21:53:14 -0800 (PST) From: Yang Shi To: ast@kernel.org, daniel@iogearbox.net, catalin.marinas@arm.com, will.deacon@arm.com Cc: zlim.lnx@gmail.com, xi.wang@gmail.com, linux-kernel@vger.kernel.org, netdev@vger.kernel.org, linaro-kernel@lists.linaro.org, yang.shi@linaro.org Subject: [PATCH] arm64: bpf: fix JIT stack setup Date: Fri, 6 Nov 2015 21:34:54 -0800 Message-Id: <1446874494-14500-1-git-send-email-yang.shi@linaro.org> X-Mailer: git-send-email 2.0.2 Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org ARM64 JIT used FP (x29) as eBPF fp register, but FP is subjected to change during function call so it may cause the BPF prog stack base address change too. Whenever, it pointed to the bottom of BPF prog stack instead of the top. So, when copying data via bpf_probe_read, it will be copied to (SP - offset), then it may overwrite the saved FP/LR. Use x25 to replace FP as BPF stack base register (fp). Since x25 is callee saved register, so it will keep intact during function call. It is initialized in BPF prog prologue when BPF prog is started to run everytime. When BPF prog exits, it could be just tossed. Other than this the BPf prog stack base need to be setup before function call stack. So, the BPF stack layout looks like: high original A64_SP => 0:+-----+ BPF prologue | | FP/LR and callee saved registers BPF fp register => +64:+-----+ | | | ... | BPF prog stack | | | | current A64_SP => +-----+ | | | ... | Function call stack | | +-----+ low Signed-off-by: Yang Shi CC: Zi Shen Lim CC: Xi Wang --- arch/arm64/net/bpf_jit_comp.c | 38 +++++++++++++++++++++++++++++++------- 1 file changed, 31 insertions(+), 7 deletions(-) -- 2.0.2 -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/ diff --git a/arch/arm64/net/bpf_jit_comp.c b/arch/arm64/net/bpf_jit_comp.c index a44e529..6809647 100644 --- a/arch/arm64/net/bpf_jit_comp.c +++ b/arch/arm64/net/bpf_jit_comp.c @@ -50,7 +50,7 @@ static const int bpf2a64[] = { [BPF_REG_8] = A64_R(21), [BPF_REG_9] = A64_R(22), /* read-only frame pointer to access stack */ - [BPF_REG_FP] = A64_FP, + [BPF_REG_FP] = A64_R(25), /* temporary register for internal BPF JIT */ [TMP_REG_1] = A64_R(23), [TMP_REG_2] = A64_R(24), @@ -155,18 +155,42 @@ static void build_prologue(struct jit_ctx *ctx) stack_size += 4; /* extra for skb_copy_bits buffer */ stack_size = STACK_ALIGN(stack_size); + /* + * BPF prog stack layout + * + * high + * original A64_SP => 0:+-----+ BPF prologue + * | | FP/LR and callee saved registers + * BPF fp register => +64:+-----+ + * | | + * | ... | BPF prog stack + * | | + * | | + * current A64_SP => +-----+ + * | | + * | ... | Function call stack + * | | + * +-----+ + * low + * + */ + + /* Save FP and LR registers to stay align with ARM64 AAPCS */ + emit(A64_PUSH(A64_FP, A64_LR, A64_SP), ctx); + /* Save callee-saved register */ emit(A64_PUSH(r6, r7, A64_SP), ctx); emit(A64_PUSH(r8, r9, A64_SP), ctx); if (ctx->tmp_used) emit(A64_PUSH(tmp1, tmp2, A64_SP), ctx); - /* Set up BPF stack */ - emit(A64_SUB_I(1, A64_SP, A64_SP, stack_size), ctx); - - /* Set up frame pointer */ + /* Set up BPF prog stack base register (x25) */ emit(A64_MOV(1, fp, A64_SP), ctx); + /* Set up function call stack */ + emit(A64_SUB_I(1, A64_SP, A64_SP, stack_size), ctx); + emit(A64_MOV(1, A64_FP, A64_SP), ctx); + /* Clear registers A and X */ emit_a64_mov_i64(ra, 0, ctx); emit_a64_mov_i64(rx, 0, ctx); @@ -196,8 +220,8 @@ static void build_epilogue(struct jit_ctx *ctx) emit(A64_POP(r8, r9, A64_SP), ctx); emit(A64_POP(r6, r7, A64_SP), ctx); - /* Restore frame pointer */ - emit(A64_MOV(1, fp, A64_SP), ctx); + /* Restore FP/LR registers */ + emit(A64_POP(A64_FP, A64_LR, A64_SP), ctx); /* Set return value */ emit(A64_MOV(1, A64_R(0), r0), ctx);