powerpc64/bpf: Fix PCREL build breaks

PATCH Superseded Saket Kumar Bhaskar 4 participants 7 messages Jul 29 – Jul 30

Subsystems (3)

PowerPC BPF BPF JIT for PowerPC (32-bit and 64-bit)

lore

Share & tools

lore

Saket Kumar Bhaskar

author

2026-07-29 16:04 UTC #0 lore raw

cover powerpc64/bpf: Fix PCREL build breaks

This series fixes two build failures that occur when CONFIG_PPC_KERNEL_PCREL is enabled on powerpc64.

Patch 1 fixes an unused variable warning in bpf_jit_emit_func_call_rel() by marking the variable as __maybe_unused, since it's only used in the non-PCREL code path.

Patch 2 fixes a linker error in arch_bpf_timed_may_goto() by using the CFUNC() macro for external C function calls. The macro properly handles the @notoc annotation required for PCREL builds, informing the linker that TOC restoration is not needed.

Both issues were introduced by commit b55b6b9ad76c ("powerpc64/bpf: Add powerpc64 JIT support for timed may_goto").

Madhavan Srinivasan (1):
powerpc64/bpf: Fix build break in bpf_jit_emit_func_call_rel()

Saket Kumar Bhaskar (1):
powerpc64/bpf: Fix build break for arch_bpf_timed_may_goto

 arch/powerpc/net/bpf_jit_comp64.c     | 2 +-
 arch/powerpc/net/bpf_timed_may_goto.S | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

Signature · 1 line

2.54.0

Saket Kumar Bhaskar

author

2026-07-29 16:04 UTC #1 lore raw

PATCH 1/2 powerpc64/bpf: Fix build break in bpf_jit_emit_func_call_rel()

From: Madhavan Srinivasan <[email protected]>

With CONFIG_PPC_KERNEL_PCREL enabled, build breaks with below error:

CC mm/dmapool.o
CC fs/readdir.o
arch/powerpc/net/bpf_jit_comp64.c: In function 'bpf_jit_emit_func_call_rel':
arch/powerpc/net/bpf_jit_comp64.c:475:13: error: unused variable 'ret' [-Werror=unused-variable]
475 | int ret;
| ^~~

commit b55b6b9ad76c ("powerpc64/bpf: Add powerpc64 JIT support for timed may_goto") introduced "ret" variable to bpf_jit_emit_func_call_rel() and it is used only in else block of CONFIG_PPC_KERNEL_PCREL, fix by adding a "__maybe_unused"

Fixes b55b6b9ad76c ("powerpc64/bpf: Add powerpc64 JIT support for timed may_goto")

Signed-off-by Madhavan Srinivasan <[email protected]>

Signed-off-by Saket Kumar Bhaskar <[email protected]>

---
 arch/powerpc/net/bpf_jit_comp64.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

arch/powerpc/net/bpf_jit_comp64.c +1 -1

index dab106cae22b..63952ef19256 100644
@@ -472,7 +472,7 @@ int bpf_jit_emit_func_call_rel(u32 *image, u32 *fimage, struct codegen_context *
 {
 	unsigned long func_addr = func ? ppc_function_entry((void *)func) : 0;
 	long __maybe_unused reladdr;
-	int ret;
+	int __maybe_unused ret;
 
 	/* bpf to bpf call, func is not known in the initial pass. Emit 5 nops as a placeholder */
 	if (!func) {

Signature · 1 line

2.54.0

Christophe Leroy (CS GROUP)

maintainer

2026-07-29 16:45 UTC #2 lore raw

Re: [PATCH 1/2] powerpc64/bpf: Fix build break in bpf_jit_emit_func_call_rel()

Le 29/07/2026 à 18:03, Saket Kumar Bhaskar a écrit :

Quoted 11 lines

From: Madhavan Srinivasan <[email protected]>
With CONFIG_PPC_KERNEL_PCREL enabled, build breaks with below error:
CC mm/dmapool.o
CC fs/readdir.o
arch/powerpc/net/bpf_jit_comp64.c: In function 'bpf_jit_emit_func_call_rel':
arch/powerpc/net/bpf_jit_comp64.c:475:13: error: unused variable 'ret' [-Werror=unused-variable]
475 | int ret;
| ^~~

Quoted 3 lines

commit b55b6b9ad76c ("powerpc64/bpf: Add powerpc64 JIT support for timed may_goto") introduced "ret" variable to bpf_jit_emit_func_call_rel() and it is used only in else block of CONFIG_PPC_KERNEL_PCREL, fix by adding a "__maybe_unused"

__maybe_unused doesn't fix the problem, it just hides it under the carpet.

ret is used at only one place, move it's declaration their:

#else
	if (core_kernel_text(func_addr)) {
		int ret = bpf_jit_emit_func_call(image, ctx, func_addr, _R12);
		if (ret)
			return ret;
	} else {

Quoted 21 lines

Fixes b55b6b9ad76c ("powerpc64/bpf: Add powerpc64 JIT support for timed may_goto")

Signed-off-by Madhavan Srinivasan <[email protected]>

Signed-off-by Saket Kumar Bhaskar <[email protected]>

---
  arch/powerpc/net/bpf_jit_comp64.c | 2 +-
  1 file changed, 1 insertion(+), 1 deletion(-)

arch/powerpc/net/bpf_jit_comp64.c +1 -1

index dab106cae22b..63952ef19256 100644
@@ -472,7 +472,7 @@ int bpf_jit_emit_func_call_rel(u32 *image, u32 *fimage, struct codegen_context *
  {
  	unsigned long func_addr = func ? ppc_function_entry((void *)func) : 0;
  	long __maybe_unused reladdr;
-	int ret;
+	int __maybe_unused ret;
 
  	/* bpf to bpf call, func is not known in the initial pass. Emit 5 nops as a placeholder */
  	if (!func) {

Madhavan Srinivasan

maintainer

2026-07-30 02:36 UTC #3 lore raw

Re: [PATCH 1/2] powerpc64/bpf: Fix build break in bpf_jit_emit_func_call_rel()

Quoted 14 lines · Christophe Leroy (CS GROUP)

Le 29/07/2026 à 18:03, Saket Kumar Bhaskar a écrit :
Quoted 11 lines
From: Madhavan Srinivasan <[email protected]>
With CONFIG_PPC_KERNEL_PCREL enabled, build breaks with below error:
   CC      mm/dmapool.o
   CC      fs/readdir.o
arch/powerpc/net/bpf_jit_comp64.c: In function 'bpf_jit_emit_func_call_rel':
arch/powerpc/net/bpf_jit_comp64.c:475:13: error: unused variable 'ret' [-Werror=unused-variable] 475 |         int ret;
       |             ^~~

Quoted 6 lines

Quoted 3 lines
commit b55b6b9ad76c ("powerpc64/bpf: Add powerpc64 JIT support for timed may_goto") introduced "ret" variable to bpf_jit_emit_func_call_rel() and it is used only in else block of CONFIG_PPC_KERNEL_PCREL, fix by adding a "__maybe_unused"
__maybe_unused doesn't fix the problem, it just hides it under the carpet.

My bad, took the precedence from reladdr, may be it is better to change that too then

Maddy

Quoted 31 lines

ret is used at only one place, move it's declaration their:
#else
    if (core_kernel_text(func_addr)) {
        int ret = bpf_jit_emit_func_call(image, ctx, func_addr, _R12); if (ret)
            return ret;
    } else {
Quoted 21 lines
Fixes b55b6b9ad76c ("powerpc64/bpf: Add powerpc64 JIT support for timed may_goto")
Signed-off-by Madhavan Srinivasan <[email protected]>
Signed-off-by Saket Kumar Bhaskar <[email protected]>
---
arch/powerpc/net/bpf_jit_comp64.c | 2 +-
  1 file changed, 1 insertion(+), 1 deletion(-)
arch/powerpc/net/bpf_jit_comp64.c +1 -1
index dab106cae22b..63952ef19256 100644
@@ -472,7 +472,7 @@ int bpf_jit_emit_func_call_rel(u32 *image, u32 
 *fimage, struct codegen_context *
   {
       unsigned long func_addr = func ? ppc_function_entry((void *)func) : 0;
       long __maybe_unused reladdr;
-    int ret;
+    int __maybe_unused ret;
         /* bpf to bpf call, func is not known in the initial pass. Emit 5 nops as a placeholder */
       if (!func) {

Saket Kumar Bhaskar

author

2026-07-29 16:04 UTC #4 lore raw

PATCH 2/2 powerpc64/bpf: Fix build break for arch_bpf_timed_may_goto

In reply to Saket Kumar Bhaskar

With CONFIG_PPC_KERNEL_PCREL enabled, calling bpf_check_timed_may_goto() using a bl instruction results in a link-time failure:

arch/powerpc/net/bpf_timed_may_goto.o: in function `arch_bpf_timed_may_goto':
(.text+0x28): call to `bpf_check_timed_may_goto' lacks nop, can't restore toc

Use CFUNC() macro instead of direct 'bl' to properly annotate the call to bpf_check_timed_may_goto(). On PCREL builds, CFUNC() expands to 'bl name@notoc', informing the linker that TOC restoration is not needed, avoiding the "lacks nop, can't restore toc" linker error.

Fixes b55b6b9ad76c ("powerpc64/bpf: Add powerpc64 JIT support for timed may_goto")

Signed-off-by Saket Kumar Bhaskar <[email protected]>

---
 arch/powerpc/net/bpf_timed_may_goto.S | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

arch/powerpc/net/bpf_timed_may_goto.S +1 -1

index 6fd8b1c9f4ac..84ecf6fa7f5d 100644
@@ -36,7 +36,7 @@ SYM_FUNC_START(arch_bpf_timed_may_goto)
 	 * BPF_REG_FP is r31; BPF_REG_AX is r12 (stack offset in bytes).
 	 */
 	add     r3, r31, r12
-	bl      bpf_check_timed_may_goto
+	bl      CFUNC(bpf_check_timed_may_goto)
 
 	/* Put return value back into AX */
 	mr      r12, r3

Signature · 1 line

2.54.0

[email protected]

AI review

2026-07-29 16:18 UTC #5 lore raw

Re: [PATCH 2/2] powerpc64/bpf: Fix build break for arch_bpf_timed_may_goto

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [Critical] The assembly trampoline arch_bpf_timed_may_goto saves BPF registers in the callee's parameter save area, exposing them to silent corruption by the C function bpf_check_timed_may_goto. --

--- Patch [2]: [PATCH 2/2] powerpc64/bpf: Fix build break for arch_bpf_timed_may_goto --- commit 991cd0fd25b432c448bce574ccb7dc7d8af6d3a2
Author: Saket Kumar Bhaskar <[email protected]>

powerpc64/bpf: Fix build break for arch_bpf_timed_may_goto

With CONFIG_PPC_KERNEL_PCREL enabled, calling bpf_check_timed_may_goto() using a bl instruction results in a link-time failure. This commit replaces the direct 'bl' call with the CFUNC() macro to properly annotate the call, avoiding the TOC restoration linker error.

arch/powerpc/net/bpf_timed_may_goto.S SYM_FUNC_START(arch_bpf_timed_may_goto) · line 39

Quoted 10 lines

arch/powerpc/net/bpf_timed_may_goto.S +1 -1

index 6fd8b1c9f4ac8..84ecf6fa7f5dc 100644
@@ -36,7 +36,7 @@ SYM_FUNC_START(arch_bpf_timed_may_goto)
 	 * BPF_REG_FP is r31; BPF_REG_AX is r12 (stack offset in bytes).
 	 */
 	add     r3, r31, r12
-	bl      bpf_check_timed_may_goto
+	bl      CFUNC(bpf_check_timed_may_goto)

[Severity: Critical]
This is a pre-existing issue, but does this function corrupt the saved BPF registers by placing them in the callee's parameter save area?

In arch_bpf_timed_may_goto, the stack frame is allocated with 112 bytes, and the BPF registers are saved from offsets 32(r1) to 72(r1):

    stdu    r1, -112(r1)
    ...
    std     r3, 32(r1)
    ...
    std     r8, 72(r1)

According to the PowerPC64 ELF ABI, offsets 32(r1) to 95(r1) in the caller's frame are the parameter save area reserved for the callee.

When we call the C function bpf_check_timed_may_goto(), the compiler is allowed to use this parameter save area (e.g., to spill the 'p' argument when it calls ktime_get_mono_fast_ns()). If it does, it will silently overwrite the saved BPF registers.

Upon return from bpf_check_timed_may_goto(), arch_bpf_timed_may_goto restores these registers, which could now hold corrupted values:

    ld      r3, 32(r1)
    ...
    ld      r8, 72(r1)

Could this lead to silent data corruption or panics during BPF program execution?

Quoted 3 lines

arch/powerpc/net/bpf_timed_may_goto.S +0 -0
 	/* Put return value back into AX */
 	mr      r12, r3

Signature · 1 line

Sashiko AI review · https://sashiko.dev/#/patchset/[email protected]?part=2

Christophe Leroy (CS GROUP)

maintainer Reviewed-by on v1 2/2

2026-07-29 16:47 UTC #6 lore raw

Re: [PATCH 2/2] powerpc64/bpf: Fix build break for arch_bpf_timed_may_goto

In reply to Saket Kumar Bhaskar

Le 29/07/2026 à 18:03, Saket Kumar Bhaskar a écrit :

Quoted 6 lines

With CONFIG_PPC_KERNEL_PCREL enabled, calling bpf_check_timed_may_goto() using a bl instruction results in a link-time failure:
arch/powerpc/net/bpf_timed_may_goto.o: in function `arch_bpf_timed_may_goto':
(.text+0x28): call to `bpf_check_timed_may_goto' lacks nop, can't restore toc

Quoted 7 lines

Use CFUNC() macro instead of direct 'bl' to properly annotate the call to bpf_check_timed_may_goto(). On PCREL builds, CFUNC() expands to 'bl name@notoc', informing the linker that TOC restoration is not needed, avoiding the "lacks nop, can't restore toc" linker error.
Fixes b55b6b9ad76c ("powerpc64/bpf: Add powerpc64 JIT support for timed may_goto")
Signed-off-by Saket Kumar Bhaskar <[email protected]>

Reviewed-by Christophe Leroy (CS GROUP) <[email protected]>

Quoted 17 lines

---
  arch/powerpc/net/bpf_timed_may_goto.S | 2 +-
  1 file changed, 1 insertion(+), 1 deletion(-)

arch/powerpc/net/bpf_timed_may_goto.S +1 -1

index 6fd8b1c9f4ac..84ecf6fa7f5d 100644
@@ -36,7 +36,7 @@ SYM_FUNC_START(arch_bpf_timed_may_goto)
  	 * BPF_REG_FP is r31; BPF_REG_AX is r12 (stack offset in bytes).
  	 */
  	add     r3, r31, r12
-	bl      bpf_check_timed_may_goto
+	bl      CFUNC(bpf_check_timed_may_goto)
 
  	/* Put return value back into AX */
  	mr      r12, r3