From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pl1-f177.google.com (mail-pl1-f177.google.com [209.85.214.177]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D38A61459F6 for ; Wed, 31 Dec 2025 22:35:39 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.177 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1767220541; cv=none; b=olWlsNGrPxkEBAU+4xoYUol9YQGiiRn04a6lgMWfmJsRceAMKgm4MYQZFUiQisYgrtWXlqHjxDIyGQVn7xh+A1hr9MGM3Q/lsDBiYXyXepkYMuWTzLcoP6KzG4wMglRi5h1M18qM2PN8eLcE3JMcflSVjrf26o2ncxUhLOt1QrE= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1767220541; c=relaxed/simple; bh=ZCQfxsEBShM0XeI4tQH2bY+UtMhszhhHCXclHMTGLBI=; h=Message-ID:Subject:From:To:Cc:Date:In-Reply-To:References: Content-Type:MIME-Version; b=HUzUXoF9HK3Xkkf8aPLy980c1tZTI2pbqVRA6vs4bRkA7N+nTQ0HS/edlBPMAWF5Rfbt1DX5vTZZnebGGly3goBVAYJ+iKo4LrIJP/X7fA1TJg84PKsjIXtd6aghy/Iaj5k95Z+W/E+TVqx0iS2GD8BSPJ99HjOEf1ngoHCQkW0= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=j/shwA/Q; arc=none smtp.client-ip=209.85.214.177 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="j/shwA/Q" Received: by mail-pl1-f177.google.com with SMTP id d9443c01a7336-2a0d52768ccso138581035ad.1 for ; Wed, 31 Dec 2025 14:35:39 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1767220539; x=1767825339; darn=vger.kernel.org; h=mime-version:user-agent:content-transfer-encoding:references :in-reply-to:date:cc:to:from:subject:message-id:from:to:cc:subject :date:message-id:reply-to; bh=zTKTbtqOTEllTF3v0EV6BgkP1Z02Vqn1tPDHs3fZSRA=; b=j/shwA/Q/qnl0mYST1qIjyKfDabXr1k3v5UlcKsBfK1v+wOx0GBgE+zjqSt3gnCWDI yANQ8Fh0xknJWQTI2hh2xjYIA2Z398My+LjyyxgWWWQ8NpuXY+Sh87/qk6rhIIRd9clk TV7c3p3UzbhLYbD5cSSq3J5RQIgyZL+YvptooRMIGal/+xJVOEYK9A7eIpGCQiKphDLB SUcWeNn+iOFXzrgBdPaXVaI4hUtJWSST+bQ6D496t8HoO4XqbmzFt3aHQcUvsdV4jjL/ /n4/jMyjsiBZgWQlsuLy2dxk3u55sMTE5fIKRyvrzSGxMJNT7bY+Qoj4HnrcAQOlRqYX umJw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1767220539; x=1767825339; h=mime-version:user-agent:content-transfer-encoding:references :in-reply-to:date:cc:to:from:subject:message-id:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=zTKTbtqOTEllTF3v0EV6BgkP1Z02Vqn1tPDHs3fZSRA=; b=vhqWHGZmKWpU1uxbTz/D0RE2dB7T0jriAM8o38vH/JvBUCCBOAzAGFzBEv0+ZPmy0s oG+VFHpdyNDlC4FwEmjY3CtpzDE8v4zbq57UtsexLkgHi1830N3x1Emtis6CmC5c/Jq/ qovhE6qzn1RM6mT5iGy700LgzaVp1pwhJHfGmsnzTskmbzqE5fD4/sOv7kU1zKzF8FXi taq8yQ6ZxVafT11w+zBMlU43M+bMgQj25G3ZZ1wIGWOo1l8/NTWpcfIS8ClMAk3z12pa YbfXfci2L3KkTcDDooQu+SI6jOoQ+XA1JH7Gz4KJqcs6ioCNOKHMK/PdylJ1RBXCTDN9 Gy9A== X-Forwarded-Encrypted: i=1; AJvYcCUoUscwOdbeQOspPv0vaV74iFuSfZwyXJIK8T215LUq0Y1Y8xK0hO0BZqP/eF4pk6+fLX0DeqFuN55L0pw=@vger.kernel.org X-Gm-Message-State: AOJu0YyCmuwkAUPOjH2MifBfIJpdpb7t8cTQaShRHQ0Vjwi+9ql3dHfm vj98+luERsgeCPGBsdu6avgZuYaYWDkcSaBkEgUgBQZZ1JQwVO+NqeOzi2loSFBv X-Gm-Gg: AY/fxX7Txg0r8qyz4ADFW3CpEJVvTsGYBkgdcYfX6NLX9hhkwrFnU/UIjaMobR238g+ 4Yp7bAunEAyzLZlS38oqHmxXATIlvt5ckoJfoPAZLfbOL4ehhrHPCKvjMwOAKsUsVu1LUKhOKLp agdm/FaPNeo4ey05gYdqTbLn2p1Nf5jib1jHgVfoGzi+hGXAL2MeCjuMGIbTEJVEmvKxDx59hqD N6SD9FzIJ8qP7IT8gCH7QfLqoNtYs8G4Icno2qxM4AiU45jddOZE1OIps3NyS6jymxCskyYkR4S 0lXzdReQy7fvWyePa5c+ldFwqdOs38JpjZmHbTKB0J86nWhPcSU6Ynf0bIBpyeIqtkxcs6FJRGy WgP5gVQ9zibgSjgwUjK68T5M6rIslSe2wbdpO/OsrX37e9avpwziBm88XLLP6od7VHdJjrFd6c+ RAesx/Nxpo X-Google-Smtp-Source: AGHT+IEFDkZpkh900p4HKOyqhuWUvqs/XJ/+NJs9ZlRzAktrZQXybj7xrdT61JVf8GcQHNU9M8G4ow== X-Received: by 2002:a17:902:e5ca:b0:29e:bf7b:7f36 with SMTP id d9443c01a7336-2a2f2a41a08mr303014955ad.58.1767220538986; Wed, 31 Dec 2025 14:35:38 -0800 (PST) Received: from [192.168.0.226] ([38.34.87.7]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2a2f3c66829sm339215465ad.10.2025.12.31.14.35.38 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 31 Dec 2025 14:35:38 -0800 (PST) Message-ID: Subject: Re: [PATCH bpf-next v3] bpf: arm64: Fix panic due to missing BTI at indirect jump targets From: Eduard Zingerman To: Xu Kuohai , bpf@vger.kernel.org, linux-kernel@vger.kernel.org Cc: Alexei Starovoitov , Daniel Borkmann , Andrii Nakryiko , Martin KaFai Lau , Yonghong Song , Puranjay Mohan , Anton Protopopov , Catalin Marinas , Will Deacon Date: Wed, 31 Dec 2025 14:35:35 -0800 In-Reply-To: <20251227081033.240336-1-xukuohai@huaweicloud.com> References: <20251227081033.240336-1-xukuohai@huaweicloud.com> Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable User-Agent: Evolution 3.58.2 (3.58.2-1.fc43) Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 On Sat, 2025-12-27 at 16:10 +0800, Xu Kuohai wrote: > From: Xu Kuohai >=20 > When BTI is enabled, the indirect jump selftest triggers BTI exception: >=20 > Internal error: Oops - BTI: 0000000036000003 [#1] SMP > ... > Call trace: > bpf_prog_2e5f1c71c13ac3e0_big_jump_table+0x54/0xf8 (P) > bpf_prog_run_pin_on_cpu+0x140/0x464 > bpf_prog_test_run_syscall+0x274/0x3ac > bpf_prog_test_run+0x224/0x2b0 > __sys_bpf+0x4cc/0x5c8 > __arm64_sys_bpf+0x7c/0x94 > invoke_syscall+0x78/0x20c > el0_svc_common+0x11c/0x1c0 > do_el0_svc+0x48/0x58 > el0_svc+0x54/0x19c > el0t_64_sync_handler+0x84/0x12c > el0t_64_sync+0x198/0x19c >=20 > This happens because no BTI instruction is generated by the JIT for > indirect jump targets. >=20 > Fix it by emitting BTI instruction for every possible indirect jump > targets when BTI is enabled. The targets are identified by traversing > all instruction arrays of jump table type used by the BPF program, > since indirect jump targets can only be read from instruction arrays > of jump table type. >=20 > Fixes: f4a66cf1cb14 ("bpf: arm64: Add support for indirect jumps") > Signed-off-by: Xu Kuohai > --- > v3: > - Get rid of unnecessary enum definition (Yonghong Song, Anton Protopopov= ) >=20 > v2: https://lore.kernel.org/bpf/20251223085447.139301-1-xukuohai@huaweicl= oud.com/ > - Exclude instruction arrays not used for indirect jumps (Anton Protopopo= v) >=20 > v1: https://lore.kernel.org/bpf/20251127140318.3944249-1-xukuohai@huaweic= loud.com/ > --- Hi Xu, Anton, Alexei, Sorry, I'm a bit late to the discussion, ignored this patch-set because of the "arm64" tag. What you are fixing here for arm64 will be an issue for x86 with CFI as well, right? If that is the case, I think that we should fix this in a "generic" way from the start. What do you think about the following: - add a field 'bool indirect_jmp_target' to 'struct bpf_insn_aux_data' - set this field to true for each jump target inspected by the verifier.c:check_indirect_jump() - use this field in the jit to decide if to emit BTI instruction. Seems a bit simpler than what is discussed in this patch-set. Wdyt? [...]