On Thu, Mar 14, 2024 at 6:21 PM Alexei Starovoitov <alexei.starovoitov@xxxxxxxxx> wrote: > > On Thu, Mar 14, 2024 at 10:13 AM Puranjay Mohan <puranjay12@xxxxxxxxx> wrote: > > > > Kumar Kartikeya Dwivedi <memxor@xxxxxxxxx> writes: > > > > > On Thu, 14 Mar 2024 at 16:00, Puranjay Mohan <puranjay12@xxxxxxxxx> wrote: > > >> > > >> Add support for [LDX | STX | ST], PROBE_MEM32, [B | H | W | DW] > > >> instructions. They are similar to PROBE_MEM instructions with the > > >> following differences: > > >> - PROBE_MEM32 supports store. > > >> - PROBE_MEM32 relies on the verifier to clear upper 32-bit of the > > >> src/dst register > > >> - PROBE_MEM32 adds 64-bit kern_vm_start address (which is stored in R28 > > >> in the prologue). Due to bpf_arena constructions such R28 + reg + > > >> off16 access is guaranteed to be within arena virtual range, so no > > >> address check at run-time. > > >> - PROBE_MEM32 allows STX and ST. If they fault the store is a nop. When > > >> LDX faults the destination register is zeroed. > > >> > > >> To support these on arm64, we do tmp2 = R28 + src/dst reg and then use > > >> tmp2 as the new src/dst register. This allows us to reuse most of the > > >> code for normal [LDX | STX | ST]. > > >> > > >> Signed-off-by: Puranjay Mohan <puranjay12@xxxxxxxxx> > > >> --- > > > > > > Hi Alexei, > > > Puranjay and I were discussing this stuff off list and noticed that > > > atomic instructions are not handled. > > > It turns out that will cause a kernel crash right now because the > > > 32-bit offset into arena will be dereferenced directly. > > > > > > e.g. something like this: > > > > > > @@ -55,6 +56,7 @@ int arena_list_add(void *ctx) > > > test_val++; > > > n->value = i; > > > arena_sum += i; > > > + __sync_fetch_and_add(&arena_sum, 0); > > > list_add_head(&n->node, list_head); > > > } > > > #else > > > > > > I will try to prepare a fix for the x86 JIT. Puranjay will do the same > > > for his set. > > > > Yes, testing the change mentioned by Kumar on ARM64 causes a crashes as well: > > > > bpf_testmod: loading out-of-tree module taints kernel. > > bpf_testmod: module verification failed: signature and/or required key missing - tainting kernel > > Unable to handle kernel NULL pointer dereference at virtual address 0000000000000010 > > Mem abort info: > > ESR = 0x0000000096000006 > > EC = 0x25: DABT (current EL), IL = 32 bits > > SET = 0, FnV = 0 > > EA = 0, S1PTW = 0 > > FSC = 0x06: level 2 translation fault > > Data abort info: > > ISV = 0, ISS = 0x00000006, ISS2 = 0x00000000 > > CM = 0, WnR = 0, TnD = 0, TagAccess = 0 > > GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 > > user pgtable: 4k pages, 48-bit VAs, pgdp=00000004043cc000 > > [0000000000000010] pgd=0800000410d8f003, p4d=0800000410d8f003, pud=0800000405972003, pmd=0000000000000000 > > Internal error: Oops: 0000000096000006 [#1] SMP > > Modules linked in: bpf_testmod(OE) nls_ascii nls_cp437 sunrpc vfat fat aes_ce_blk aes_ce_cipher ghash_ce sha1_ce button sch_fq_codel dm_mod dax configfs dmi_sysfs sha2_ce sha256_arm64 efivarfs > > CPU: 8 PID: 5631 Comm: test_progs Tainted: G OE 6.8.0+ #2 > > Hardware name: Amazon EC2 c6g.16xlarge/, BIOS 1.0 11/1/2018 > > pstate: 20400005 (nzCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) > > pc : bpf_prog_8771c336cb6a18eb_arena_list_add+0x204/0x2b8 > > lr : bpf_prog_8771c336cb6a18eb_arena_list_add+0x144/0x2b8 > > sp : ffff80008b84bc30 > > x29: ffff80008b84bca0 x28: ffff8000a5008000 x27: ffff80008b84bc38 > > x26: 0000000000000000 x25: ffff80008b84bc60 x24: 0000000000000000 > > x23: 0000000000000000 x22: 0000000000000058 x21: 0000000000000838 > > x20: 0000000000000000 x19: 0000000100001fe0 x18: 0000000000000000 > > x17: 0000000000000000 x16: 0000000000000000 x15: 0000ffffcc66d2c8 > > x14: 0000000000000000 x13: 0000000000000000 x12: 000000000004058c > > x11: ffff8000a5008010 x10: 00000000ffffffff x9 : 00000000000002cf > > x8 : ffff800082ff4ab8 x7 : 0000000100001000 x6 : 0000000000000001 > > x5 : 0000000010e5e3fd x4 : 000000003619b978 x3 : 0000000000000010 > > x2 : 0000000000000000 x1 : 0000000000000000 x0 : 0000000000001fe0 > > Call trace: > > bpf_prog_8771c336cb6a18eb_arena_list_add+0x204/0x2b8 > > bpf_prog_test_run_syscall+0x100/0x340 > > __sys_bpf+0x8e8/0xa20 > > __arm64_sys_bpf+0x2c/0x48 > > invoke_syscall+0x50/0x128 > > el0_svc_common.constprop.0+0x48/0xf8 > > do_el0_svc+0x28/0x40 > > el0_svc+0x58/0x190 > > el0t_64_sync_handler+0x13c/0x158 > > el0t_64_sync+0x1a8/0x1b0 > > Code: 8b010042 8b1c006b f9000162 d2800001 (f821307f) > > ---[ end trace 0000000000000000 ]--- > > Kernel panic - not syncing: Oops: Fatal exception > > SMP: stopping secondary CPUs > > Kernel Offset: disabled > > CPU features: 0x0,00000120,7002014a,21407a0b > > Memory Limit: none > > Rebooting in 5 seconds.. > > > > I will send v2 with the arm64 JIT fix, but I guess verifier has to be modified > > as well to add BPF_PROBE_MEM32 to atomic instructions. > > The JIT and the verifier changes for atomics might be too big. > Let's disable atomics in arena in the verifier for now. > Pls send a patch. As atomics are disabled in the Arena now, this series will not require any changes. Looking forward to the reviews. Thanks, Puranjay
