mirror of
https://github.com/Fishwaldo/Star64_linux.git
synced 2025-03-16 04:04:06 +00:00
riscv, bpf: Emit fixed-length instructions for BPF_PSEUDO_FUNC
[ Upstream commitb54b600361
] For BPF_PSEUDO_FUNC instruction, verifier will refill imm with correct addresses of bpf_calls and then run last pass of JIT. Since the emit_imm of RV64 is variable-length, which will emit appropriate length instructions accorroding to the imm, it may broke ctx->offset, and lead to unpredictable problem, such as inaccurate jump. So let's fix it with fixed-length instructions. Fixes:69c087ba62
("bpf: Add bpf_for_each_map_elem() helper") Suggested-by: Björn Töpel <bjorn@rivosinc.com> Signed-off-by: Pu Lehui <pulehui@huawei.com> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Reviewed-by: Björn Töpel <bjorn@kernel.org> Acked-by: Björn Töpel <bjorn@kernel.org> Link: https://lore.kernel.org/bpf/20221206091410.1584784-1-pulehui@huaweicloud.com Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
parent
b4865252c8
commit
65083aa1b3
1 changed files with 28 additions and 1 deletions
|
@ -120,6 +120,25 @@ static bool in_auipc_jalr_range(s64 val)
|
|||
val < ((1L << 31) - (1L << 11));
|
||||
}
|
||||
|
||||
/* Emit fixed-length instructions for address */
|
||||
static int emit_addr(u8 rd, u64 addr, bool extra_pass, struct rv_jit_context *ctx)
|
||||
{
|
||||
u64 ip = (u64)(ctx->insns + ctx->ninsns);
|
||||
s64 off = addr - ip;
|
||||
s64 upper = (off + (1 << 11)) >> 12;
|
||||
s64 lower = off & 0xfff;
|
||||
|
||||
if (extra_pass && !in_auipc_jalr_range(off)) {
|
||||
pr_err("bpf-jit: target offset 0x%llx is out of range\n", off);
|
||||
return -ERANGE;
|
||||
}
|
||||
|
||||
emit(rv_auipc(rd, upper), ctx);
|
||||
emit(rv_addi(rd, rd, lower), ctx);
|
||||
return 0;
|
||||
}
|
||||
|
||||
/* Emit variable-length instructions for 32-bit and 64-bit imm */
|
||||
static void emit_imm(u8 rd, s64 val, struct rv_jit_context *ctx)
|
||||
{
|
||||
/* Note that the immediate from the add is sign-extended,
|
||||
|
@ -887,7 +906,15 @@ out_be:
|
|||
u64 imm64;
|
||||
|
||||
imm64 = (u64)insn1.imm << 32 | (u32)imm;
|
||||
emit_imm(rd, imm64, ctx);
|
||||
if (bpf_pseudo_func(insn)) {
|
||||
/* fixed-length insns for extra jit pass */
|
||||
ret = emit_addr(rd, imm64, extra_pass, ctx);
|
||||
if (ret)
|
||||
return ret;
|
||||
} else {
|
||||
emit_imm(rd, imm64, ctx);
|
||||
}
|
||||
|
||||
return 1;
|
||||
}
|
||||
|
||||
|
|
Loading…
Add table
Reference in a new issue