bpf, riscv: clear target register high 32-bits for and/or/xor on ALU32 [Linux 5.2]

bpf, riscv: clear target register high 32-bits for and/or/xor on ALU32 [Linux 5.2]

This Linux kernel change "bpf, riscv: clear target register high 32-bits for and/or/xor on ALU32" is included in the Linux 5.2 release. This change is authored by Björn Töpel <bjorn.topel [at] gmail.com> on Tue May 21 15:46:22 2019 +0200. The commit for this change in Linux stable tree is fe121ee (patch).

bpf, riscv: clear target register high 32-bits for and/or/xor on ALU32

When using 32-bit subregisters (ALU32), the RISC-V JIT would not clear
the high 32-bits of the target register and therefore generate
incorrect code.

E.g., in the following code:

  $ cat test.c
  unsigned int f(unsigned long long a,
           unsigned int b)
  {
    return (unsigned int)a & b;
  }

  $ clang-9 -target bpf -O2 -emit-llvm -S test.c -o - | \
    llc-9 -mattr=+alu32 -mcpu=v3
    .text
    .file   "test.c"
    .globl  f
    .p2align    3
    .type   f,@function
  f:
    r0 = r1
    w0 &= w2
    exit
  .Lfunc_end0:
    .size   f, .Lfunc_end0-f

The JIT would not clear the high 32-bits of r0 after the
and-operation, which in this case might give an incorrect return
value.

After this patch, that is not the case, and the upper 32-bits are
cleared.

Reported-by: Jiong Wang <[email protected]>
Fixes: 2353ecc6f91f ("bpf, riscv: add BPF JIT for RV64G")
Signed-off-by: Björn Töpel <[email protected]>
Signed-off-by: Daniel Borkmann <[email protected]>

There are 6 lines of Linux source code added/deleted in this change. Code changes to Linux kernel are as follows.

 arch/riscv/net/bpf_jit_comp.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/arch/riscv/net/bpf_jit_comp.c b/arch/riscv/net/bpf_jit_comp.c
index 80b12aa..e5c8d67 100644
--- a/arch/riscv/net/bpf_jit_comp.c
+++ b/arch/riscv/net/bpf_jit_comp.c
@@ -759,14 +759,20 @@ static int emit_insn(const struct bpf_insn *insn, struct rv_jit_context *ctx,
    case BPF_ALU | BPF_AND | BPF_X:
    case BPF_ALU64 | BPF_AND | BPF_X:
        emit(rv_and(rd, rd, rs), ctx);
+       if (!is64)
+           emit_zext_32(rd, ctx);
        break;
    case BPF_ALU | BPF_OR | BPF_X:
    case BPF_ALU64 | BPF_OR | BPF_X:
        emit(rv_or(rd, rd, rs), ctx);
+       if (!is64)
+           emit_zext_32(rd, ctx);
        break;
    case BPF_ALU | BPF_XOR | BPF_X:
    case BPF_ALU64 | BPF_XOR | BPF_X:
        emit(rv_xor(rd, rd, rs), ctx);
+       if (!is64)
+           emit_zext_32(rd, ctx);
        break;
    case BPF_ALU | BPF_MUL | BPF_X:
    case BPF_ALU64 | BPF_MUL | BPF_X:

Leave a Reply

Your email address will not be published. Required fields are marked *