Skip to content

Commit 2217009

Browse files
davem330davem330
committed
Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf
Alexei Starovoitov says: ==================== pull-request: bpf 2018-02-22 The following pull-request contains BPF updates for your *net* tree. The main changes are: 1) two urgent fixes for bpf_tail_call logic for x64 and arm64 JITs, from Daniel. 2) cond_resched points in percpu array alloc/free paths, from Eric. 3) lockdep and other minor fixes, from Yonghong, Arnd, Anders, Li. ==================== Signed-off-by: David S. Miller <davem@davemloft.net>
2 parents d903ec7 + 16338a9 commit 2217009

File tree

10 files changed

+80
-15
lines changed

10 files changed

+80
-15
lines changed

‎arch/arm64/net/bpf_jit_comp.c

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -250,16 +250,17 @@ static int emit_bpf_tail_call(struct jit_ctx *ctx)
250250
off = offsetof(struct bpf_array, map.max_entries);
251251
emit_a64_mov_i64(tmp, off, ctx);
252252
emit(A64_LDR32(tmp, r2, tmp), ctx);
253+
emit(A64_MOV(0, r3, r3), ctx);
253254
emit(A64_CMP(0, r3, tmp), ctx);
254-
emit(A64_B_(A64_COND_GE, jmp_offset), ctx);
255+
emit(A64_B_(A64_COND_CS, jmp_offset), ctx);
255256

256257
/* if (tail_call_cnt > MAX_TAIL_CALL_CNT)
257258
* goto out;
258259
* tail_call_cnt++;
259260
*/
260261
emit_a64_mov_i64(tmp, MAX_TAIL_CALL_CNT, ctx);
261262
emit(A64_CMP(1, tcc, tmp), ctx);
262-
emit(A64_B_(A64_COND_GT, jmp_offset), ctx);
263+
emit(A64_B_(A64_COND_HI, jmp_offset), ctx);
263264
emit(A64_ADD_I(1, tcc, tcc, 1), ctx);
264265

265266
/* prog = array->ptrs[index];

‎arch/x86/include/asm/nospec-branch.h

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -177,4 +177,41 @@ static inline void indirect_branch_prediction_barrier(void)
177177
}
178178

179179
#endif /* __ASSEMBLY__ */
180+
181+
/*
182+
* Below is used in the eBPF JIT compiler and emits the byte sequence
183+
* for the following assembly:
184+
*
185+
* With retpolines configured:
186+
*
187+
* callq do_rop
188+
* spec_trap:
189+
* pause
190+
* lfence
191+
* jmp spec_trap
192+
* do_rop:
193+
* mov %rax,(%rsp)
194+
* retq
195+
*
196+
* Without retpolines configured:
197+
*
198+
* jmp *%rax
199+
*/
200+
#ifdef CONFIG_RETPOLINE
201+
# define RETPOLINE_RAX_BPF_JIT_SIZE 17
202+
# define RETPOLINE_RAX_BPF_JIT() \
203+
EMIT1_off32(0xE8, 7); /* callq do_rop */ \
204+
/* spec_trap: */ \
205+
EMIT2(0xF3, 0x90); /* pause */ \
206+
EMIT3(0x0F, 0xAE, 0xE8); /* lfence */ \
207+
EMIT2(0xEB, 0xF9); /* jmp spec_trap */ \
208+
/* do_rop: */ \
209+
EMIT4(0x48, 0x89, 0x04, 0x24); /* mov %rax,(%rsp) */ \
210+
EMIT1(0xC3); /* retq */
211+
#else
212+
# define RETPOLINE_RAX_BPF_JIT_SIZE 2
213+
# define RETPOLINE_RAX_BPF_JIT() \
214+
EMIT2(0xFF, 0xE0); /* jmp *%rax */
215+
#endif
216+
180217
#endif /* _ASM_X86_NOSPEC_BRANCH_H_ */

‎arch/x86/net/bpf_jit_comp.c

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,7 @@
1313
#include <linux/if_vlan.h>
1414
#include <asm/cacheflush.h>
1515
#include <asm/set_memory.h>
16+
#include <asm/nospec-branch.h>
1617
#include <linux/bpf.h>
1718

1819
/*
@@ -290,7 +291,7 @@ static void emit_bpf_tail_call(u8 **pprog)
290291
EMIT2(0x89, 0xD2); /* mov edx, edx */
291292
EMIT3(0x39, 0x56, /* cmp dword ptr [rsi + 16], edx */
292293
offsetof(struct bpf_array, map.max_entries));
293-
#define OFFSET1 43 /* number of bytes to jump */
294+
#define OFFSET1 (41 + RETPOLINE_RAX_BPF_JIT_SIZE) /* number of bytes to jump */
294295
EMIT2(X86_JBE, OFFSET1); /* jbe out */
295296
label1 = cnt;
296297

@@ -299,7 +300,7 @@ static void emit_bpf_tail_call(u8 **pprog)
299300
*/
300301
EMIT2_off32(0x8B, 0x85, 36); /* mov eax, dword ptr [rbp + 36] */
301302
EMIT3(0x83, 0xF8, MAX_TAIL_CALL_CNT); /* cmp eax, MAX_TAIL_CALL_CNT */
302-
#define OFFSET2 32
303+
#define OFFSET2 (30 + RETPOLINE_RAX_BPF_JIT_SIZE)
303304
EMIT2(X86_JA, OFFSET2); /* ja out */
304305
label2 = cnt;
305306
EMIT3(0x83, 0xC0, 0x01); /* add eax, 1 */
@@ -313,7 +314,7 @@ static void emit_bpf_tail_call(u8 **pprog)
313314
* goto out;
314315
*/
315316
EMIT3(0x48, 0x85, 0xC0); /* test rax,rax */
316-
#define OFFSET3 10
317+
#define OFFSET3 (8 + RETPOLINE_RAX_BPF_JIT_SIZE)
317318
EMIT2(X86_JE, OFFSET3); /* je out */
318319
label3 = cnt;
319320

@@ -326,7 +327,7 @@ static void emit_bpf_tail_call(u8 **pprog)
326327
* rdi == ctx (1st arg)
327328
* rax == prog->bpf_func + prologue_size
328329
*/
329-
EMIT2(0xFF, 0xE0); /* jmp rax */
330+
RETPOLINE_RAX_BPF_JIT();
330331

331332
/* out: */
332333
BUILD_BUG_ON(cnt - label1 != OFFSET1);

‎kernel/bpf/arraymap.c

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -26,8 +26,10 @@ static void bpf_array_free_percpu(struct bpf_array *array)
2626
{
2727
int i;
2828

29-
for (i = 0; i < array->map.max_entries; i++)
29+
for (i = 0; i < array->map.max_entries; i++) {
3030
free_percpu(array->pptrs[i]);
31+
cond_resched();
32+
}
3133
}
3234

3335
static int bpf_array_alloc_percpu(struct bpf_array *array)
@@ -43,6 +45,7 @@ static int bpf_array_alloc_percpu(struct bpf_array *array)
4345
return -ENOMEM;
4446
}
4547
array->pptrs[i] = ptr;
48+
cond_resched();
4649
}
4750

4851
return 0;

‎kernel/bpf/lpm_trie.c

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -569,8 +569,7 @@ static void trie_free(struct bpf_map *map)
569569
slot = &trie->root;
570570

571571
for (;;) {
572-
node = rcu_dereference_protected(*slot,
573-
lockdep_is_held(&trie->lock));
572+
node = rcu_dereference_protected(*slot, 1);
574573
if (!node)
575574
goto out;
576575

‎net/core/filter.c

Lines changed: 1 addition & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -3381,17 +3381,13 @@ BPF_CALL_2(bpf_sock_ops_cb_flags_set, struct bpf_sock_ops_kern *, bpf_sock,
33813381
struct sock *sk = bpf_sock->sk;
33823382
int val = argval & BPF_SOCK_OPS_ALL_CB_FLAGS;
33833383

3384-
if (!sk_fullsock(sk))
3384+
if (!IS_ENABLED(CONFIG_INET) || !sk_fullsock(sk))
33853385
return -EINVAL;
33863386

3387-
#ifdef CONFIG_INET
33883387
if (val)
33893388
tcp_sk(sk)->bpf_sock_ops_cb_flags = val;
33903389

33913390
return argval & (~BPF_SOCK_OPS_ALL_CB_FLAGS);
3392-
#else
3393-
return -EINVAL;
3394-
#endif
33953391
}
33963392

33973393
static const struct bpf_func_proto bpf_sock_ops_cb_flags_set_proto = {

‎tools/testing/selftests/bpf/.gitignore

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,3 +11,4 @@ test_progs
1111
test_tcpbpf_user
1212
test_verifier_log
1313
feature
14+
test_libbpf_open

‎tools/testing/selftests/bpf/test_maps.c

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -126,6 +126,8 @@ static void test_hashmap_sizes(int task, void *data)
126126
fd = bpf_create_map(BPF_MAP_TYPE_HASH, i, j,
127127
2, map_flags);
128128
if (fd < 0) {
129+
if (errno == ENOMEM)
130+
return;
129131
printf("Failed to create hashmap key=%d value=%d '%s'\n",
130132
i, j, strerror(errno));
131133
exit(1);

‎tools/testing/selftests/bpf/test_tcpbpf_kern.c

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,6 @@
55
#include <linux/if_ether.h>
66
#include <linux/if_packet.h>
77
#include <linux/ip.h>
8-
#include <linux/in6.h>
98
#include <linux/types.h>
109
#include <linux/socket.h>
1110
#include <linux/tcp.h>

‎tools/testing/selftests/bpf/test_verifier.c

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2586,6 +2586,32 @@ static struct bpf_test tests[] = {
25862586
.result_unpriv = REJECT,
25872587
.result = ACCEPT,
25882588
},
2589+
{
2590+
"runtime/jit: pass negative index to tail_call",
2591+
.insns = {
2592+
BPF_MOV64_IMM(BPF_REG_3, -1),
2593+
BPF_LD_MAP_FD(BPF_REG_2, 0),
2594+
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2595+
BPF_FUNC_tail_call),
2596+
BPF_MOV64_IMM(BPF_REG_0, 0),
2597+
BPF_EXIT_INSN(),
2598+
},
2599+
.fixup_prog = { 1 },
2600+
.result = ACCEPT,
2601+
},
2602+
{
2603+
"runtime/jit: pass > 32bit index to tail_call",
2604+
.insns = {
2605+
BPF_LD_IMM64(BPF_REG_3, 0x100000000ULL),
2606+
BPF_LD_MAP_FD(BPF_REG_2, 0),
2607+
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2608+
BPF_FUNC_tail_call),
2609+
BPF_MOV64_IMM(BPF_REG_0, 0),
2610+
BPF_EXIT_INSN(),
2611+
},
2612+
.fixup_prog = { 2 },
2613+
.result = ACCEPT,
2614+
},
25892615
{
25902616
"stack pointer arithmetic",
25912617
.insns = {

0 commit comments

Comments
 (0)