powerpc/bpf: address missing verifier selftest coverage

From: Abhishek Dubey <[email protected]>

The tail_call_info field can contain either a scalar counter value or a 64-bit pointer to the counter, using a 32-bit compare (cmplwi) only checks the lower 32 bits, which can lead to incorrect comparisions when location of counter is near 4GB boundary. Use instruction cmpldi/cmplwi for accurate comparision in corresponding cases.

Reported-by [email protected]

Closes https://lore.kernel.org/bpf/[email protected]/ open here

Fixes 2ed2d8f6fb38 ("powerpc64/bpf: Support tailcalls with subprogs")

Signed-off-by Abhishek Dubey <[email protected]>

Signed-off-by Saket Kumar Bhaskar <[email protected]>

Tested-by Yeswanth Krishna Tellakula <[email protected]>

Acked-by Hari Bathini <[email protected]>

---
  arch/powerpc/net/bpf_jit.h        | 6 ++++++
  arch/powerpc/net/bpf_jit_comp.c   | 2 +-
  arch/powerpc/net/bpf_jit_comp64.c | 8 ++++----
  3 files changed, 11 insertions(+), 5 deletions(-)

arch/powerpc/net/bpf_jit.h +6 -0

index f32de8704d4d..35015d7ecb76 100644
@@ -188,6 +188,12 @@ struct codegen_context {
 
  #define bpf_to_ppc(r)	(ctx->b2p[r])
 
+#ifdef CONFIG_PPC64
+#define PPC_RAW_CMPLLI(a, i)    PPC_RAW_CMPLDI(a, i)
+#else
+#define PPC_RAW_CMPLLI(a, i)    PPC_RAW_CMPLWI(a, i)
+#endif
+
  #ifdef CONFIG_PPC32
  #define BPF_FIXUP_LEN	3 /* Three instructions => 12 bytes */
  #else

arch/powerpc/net/bpf_jit_comp.c +1 -1

index 7b07b43575f1..a875521ff904 100644
@@ -739,7 +739,7 @@ static void bpf_trampoline_setup_tail_call_info(u32 *image, struct codegen_conte
  		 * Setting the tail_call_info in trampoline's frame
  		 * depending on if previous frame had value or reference.
  		 */
-		EMIT(PPC_RAW_CMPLWI(_R3, MAX_TAIL_CALL_CNT));
+		EMIT(PPC_RAW_CMPLLI(_R3, MAX_TAIL_CALL_CNT));
  		PPC_BCC_CONST_SHORT(COND_GT, 8);
  		EMIT(PPC_RAW_ADDI(_R3, _R4, -BPF_PPC_TAILCALL));
 

arch/powerpc/net/bpf_jit_comp64.c +4 -4

index dab106cae22b..59302cabc466 100644
@@ -276,7 +276,7 @@ void bpf_jit_build_prologue(u32 *image, struct codegen_context *ctx)
  		 */
  		EMIT(PPC_RAW_LD(bpf_to_ppc(TMP_REG_2), _R1, 0));
  		EMIT(PPC_RAW_LD(bpf_to_ppc(TMP_REG_1), bpf_to_ppc(TMP_REG_2), -(BPF_PPC_TAILCALL)));
-		EMIT(PPC_RAW_CMPLWI(bpf_to_ppc(TMP_REG_1), MAX_TAIL_CALL_CNT));
+		EMIT(PPC_RAW_CMPLDI(bpf_to_ppc(TMP_REG_1), MAX_TAIL_CALL_CNT));
  		PPC_BCC_CONST_SHORT(COND_GT, 8);
  		EMIT(PPC_RAW_ADDI(bpf_to_ppc(TMP_REG_1), bpf_to_ppc(TMP_REG_2),
  								-(BPF_PPC_TAILCALL)));

@@ -662,7 +662,7 @@ static int bpf_jit_emit_tail_call(u32 *image, struct codegen_context *ctx, u32 o
  	PPC_BCC_SHORT(COND_GE, out);
 
  	EMIT(PPC_RAW_LD(bpf_to_ppc(TMP_REG_1), _R1, bpf_jit_stack_tailcallinfo_offset(ctx)));
-	EMIT(PPC_RAW_CMPLWI(bpf_to_ppc(TMP_REG_1), MAX_TAIL_CALL_CNT));
+	EMIT(PPC_RAW_CMPLDI(bpf_to_ppc(TMP_REG_1), MAX_TAIL_CALL_CNT));
  	PPC_BCC_CONST_SHORT(COND_LE, 8);
 
  	/* dereference TMP_REG_1 */

@@ -672,7 +672,7 @@ static int bpf_jit_emit_tail_call(u32 *image, struct codegen_context *ctx, u32 o
  	 * if (tail_call_info == MAX_TAIL_CALL_CNT)
  	 *   goto out;
  	 */
-	EMIT(PPC_RAW_CMPLWI(bpf_to_ppc(TMP_REG_1), MAX_TAIL_CALL_CNT));
+	EMIT(PPC_RAW_CMPLDI(bpf_to_ppc(TMP_REG_1), MAX_TAIL_CALL_CNT));
  	PPC_BCC_SHORT(COND_EQ, out);
 
  	/*

@@ -707,7 +707,7 @@ static int bpf_jit_emit_tail_call(u32 *image, struct codegen_context *ctx, u32 o
  	 * tail_call_info.
  	 */
  	EMIT(PPC_RAW_LD(bpf_to_ppc(TMP_REG_2), _R1, bpf_jit_stack_tailcallinfo_offset(ctx)));
-	EMIT(PPC_RAW_CMPLWI(bpf_to_ppc(TMP_REG_2), MAX_TAIL_CALL_CNT));
+	EMIT(PPC_RAW_CMPLDI(bpf_to_ppc(TMP_REG_2), MAX_TAIL_CALL_CNT));
  	PPC_BCC_CONST_SHORT(COND_GT, 8);
 
  	/* First get address of tail_call_info */

From: Abhishek Dubey <[email protected]>

The existing conditional statement in bpf_int_jit_compile() frees the percpu private stack at out_addrs only when the image buffer was never allocated.

If bpf_jit_build_body() fails during a code-generation pass, the image buffer has already been allocated, so !image is false and the percpu stack is not freed.

Because JIT compilation failed, fp->jited remains at 0. The subsequent bpf_jit_free() path only frees priv_stack_ptr when fp->jited is set, so freeing is skipped here too, leaking the percpu allocation.

Fix implements freeing the private stack whenever fp->jited was not set, i.e. compilation did not succeed, instead of keying off !image. !fp->jited already covers the !image case, since image is only NULL on early-failure paths where fp->jited is likewise 0.

Reported-by [email protected]

Closes https://lore.kernel.org/bpf/[email protected] open here

Fixes 156d985123b6 ("powerpc64/bpf: Implement JIT support for private stack")

Cc [email protected]

Signed-off-by Abhishek Dubey <[email protected]>

Signed-off-by Saket Kumar Bhaskar <[email protected]>

Tested-by Yeswanth Krishna Tellakula <[email protected]>

Acked-by Hari Bathini <[email protected]>

---
  arch/powerpc/net/bpf_jit_comp.c | 2 +-
  1 file changed, 1 insertion(+), 1 deletion(-)

arch/powerpc/net/bpf_jit_comp.c +1 -1

index a875521ff904..8f7501954d9f 100644
@@ -357,7 +357,7 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_verifier_env *env, struct bpf_pr
  				(void *)fimage + FUNCTION_DESCR_SIZE);
 
  out_addrs:
-		if (!image && priv_stack_ptr) {
+		if (!fp->jited && priv_stack_ptr) {
  			fp->aux->priv_stack_ptr = NULL;
  			free_percpu(priv_stack_ptr);
  		}

Quoted 1 line

Fixes d243b62b7bd3 ("powerpc64/bpf: Add support for bpf trampolines")

Does the Fixes: tag name the correct commit?

With Cc: [email protected] this fix will only reach v6.13+ and will leave every stable tree from v5.18 to v6.12 carrying the same JIT buffer overflow.

The faulty logic predates d243b62b7bd3. Looking at the parent of that commit:

git show d243b62b7bd3^:arch/powerpc/net/bpf_jit_comp.c

already contains the exact code being fixed:

     if (!exit_addr || is_offset_in_branch_range(exit_addr - (ctx->idx * 4))) {
             PPC_JMP(exit_addr);
     } else if (ctx->alt_exit_addr) {
             if (WARN_ON(!is_offset_in_branch_range((long)ctx->alt_exit_addr - (ctx->idx * 4))))
                     return -1;
             PPC_JMP(ctx->alt_exit_addr);
     } else {
             ctx->alt_exit_addr = ctx->idx * 4;
             bpf_jit_build_epilogue(image, ctx);
     }

The real introducing commit is 0ffdbce6f4a89bb7c0002904d6438ec83cf05ce7 ("powerpc/bpf: Handle large branch ranges with BPF_EXIT"), merged in v5.18-rc1 (git describe --contains: v5.18-rc1~124^2~42). It created bpf_jit_emit_exit_insn() with the '!exit_addr' early-out and replaced the previous unconditional one-instruction emission:

- if (i != flen - 1)
- PPC_JMP(exit_addr);
+ if (i != flen - 1) {
+ ret = bpf_jit_emit_exit_insn(image, ctx, b2p[TMP_REG_1], exit_addr);

Before 0ffdbce6f4a8 a non-final BPF_EXIT always cost exactly one instruction in every pass, so the sizing pass could not under-count and no overflow was possible. After it, the sizing pass emits PPC_JMP(0) (1 instruction) while later passes may emit a full inline epilogue, which is precisely the under-count described in this commit message.

The commit d243b62b7bd3 only enlarged the epilogue (it added bpf_jit_build_fentry_stubs()), making an already-existing overflow bigger.

Citing the ppc64-trampoline commit also wrongly implies PPC32 is unaffected. The commit 0ffdbce6f4a8 made the identical change to arch/powerpc/net/bpf_jit_comp32.c, so 32-bit powerpc has the same bug over the same range.

A tag survey confirms the range: 'alt_exit_addr' has 0 occurrences in arch/powerpc/net/ at v5.16 and v5.17, and 5 occurrences at v5.18, v5.19, v6.0, v6.1 and v6.6.

Should the tag be:

Fixes 0ffdbce6f4a8 ("powerpc/bpf: Handle large branch ranges with BPF_EXIT")

Quoted 6 lines

arch/powerpc/net/bpf_jit_comp.c +0 -0

index 8f7501954d9f0..11981d2270a9d 100644
@@ -99,11 +99,10 @@ void bpf_jit_build_fentry_stubs(u32 *image, struct codegen_context *ctx)
 

arch/powerpc/net/bpf_jit_comp.c void bpf_jit_build_fentry_stubs(u32 *image, struct codegen_context *ctx) · line 105

Quoted 10 lines

arch/powerpc/net/bpf_jit_comp.c +3 -4

  int bpf_jit_emit_exit_insn(u32 *image, struct codegen_context *ctx, int tmp_reg, long exit_addr)
  {
-	if (!exit_addr || is_offset_in_branch_range(exit_addr - (ctx->idx * 4))) {
+	if (exit_addr && is_offset_in_branch_range(exit_addr - (long)(ctx->idx * 4))) {
  		PPC_JMP(exit_addr);
-	} else if (ctx->alt_exit_addr) {
-		if (WARN_ON(!is_offset_in_branch_range((long)ctx->alt_exit_addr - (ctx->idx * 4))))
-			return -1;
+	} else if (ctx->alt_exit_addr && is_offset_in_branch_range(
+			(long)(ctx->alt_exit_addr) - (long)(ctx->idx * 4))) {

               ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

arch/powerpc/net/bpf_jit_comp.c void bpf_jit_build_fentry_stubs(u32 *image, struct codegen_context *ctx) · line 106

Quoted 1 line

arch/powerpc/net/bpf_jit_comp.c +0 -0

  		PPC_JMP(ctx->alt_exit_addr);

With alt_exit_addr defined as unsigned int, does the expression (long)(ctx->alt_exit_addr) - (long)(ctx->idx * 4) produce a different result than (long)ctx->alt_exit_addr - (ctx->idx * 4) due to how integer promotion works?

In v7 review, Hari Bathini pointed out that the cast placement may affect integer promotion semantics and requested restoring the earlier syntax with the cast only on alt_exit_addr:

https://lore.kernel.org/bpf/[email protected]

While the current code has passed testing, the concern about integer promotion semantics was never explicitly addressed.

[ ... ]

arch/powerpc/net/bpf_jit_comp.c int bpf_add_extable_entry(struct bpf_prog *fp, u32 *image, u32 *fimage, int pass · line 421

Quoted 7 lines

arch/powerpc/net/bpf_jit_comp.c +1 -1

@@ -399,7 +417,7 @@ int bpf_add_extable_entry(struct bpf_prog *fp, u32 *image, u32 *fimage, int pass
  	u32 *fixup;
 
  	/* Populate extable entries only in the last pass */
-	if (pass != 2)
+	if (pass < CODEGEN_MIN_PASSES)
  		return 0;

Does the comment still match the code?

With the old 'if (pass != 2)' and a fixed two-pass loop, pass 2 was the last pass, so the comment was accurate. With the new loop and 'pass < CODEGEN_MIN_PASSES', both pass 2 and pass 3 can write extable entries, so entries are populated in every pass from 2 onwards, not only in the last one.

Also, CODEGEN_MIN_PASSES is being reused here with a different meaning. In arch/powerpc/net/bpf_jit.h it documents the minimum number of code-generation passes, but here it is used as 'the first pass in which extable entries are valid'. The two are logically independent - bumping CODEGEN_MIN_PASSES to 3 to force more settling iterations would silently stop extable entries being written in pass 2.

---
AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md

CI run summary: https://github.com/kernel-patches/bpf/actions/runs/33368376983

From: Abhishek Dubey <[email protected]>

During size calculation in pass-0, exit_addr is 0 since addrs[fp->len] is not yet populated. bpf_jit_emit_exit_insn() treats a zero exit_addr as in-range and skips bpf_jit_build_epilogue(), so the alternate inline epilogue instructions are not counted in alloclen.

In later passes, if the real exit_addr falls outside the 32MB branch range, the full inline epilogue is emitted into the already-allocated buffer, writing past its end and corrupting adjacent memory.

Fix by ensuring exit_addr is non-zero before treating it as in-range, so pass-0 always falls through to bpf_jit_build_epilogue() and conservatively accounts for all epilogue instructions in alloclen. Also range check alt_exit_addr directly in the else-if condition.

Since exit_addr handling now falls through to the epilogue, two related issues in bpf_int_jit_compile() must also be addressed:

1. Reset cgctx.alt_exit_addr before the second size-calculation pass. Without this, a stale alt_exit_addr from the first pass causes the second pass to emit a single jump instead of the full epilogue, undercounting alloclen and reintroducing the overflow.

2. Recompute addrs[fp->len] at the end of each code-generation pass. The larger pass-0 body can shrink in later passes as out-of-range exits settle into in-range jumps; a stale addrs[fp->len] would leave exit branches targeting past the real (shrunken) epilogue.

Because shrinkage in a later pass can move the epilogue offset, the fixed two-pass loop is no longer sufficient: an exit that was out of range in an earlier pass may fall in range once the epilogue offset shrinks, shrinking the body further and overwriting the start of the epilogue. Convert the code-generation loop to iterate until the program size converges, bounded by CODEGEN_MAX_PASSES, and fail the JIT if it does not converge.

Reported-by [email protected]

Closes https://lore.kernel.org/bpf/[email protected]/T/#mfcb23909d977b949727cca4f59ee56a13fd69b92 open here

Fixes d243b62b7bd3 ("powerpc64/bpf: Add support for bpf trampolines")

Cc [email protected]

Signed-off-by Hari Bathini <[email protected]>

Signed-off-by Abhishek Dubey <[email protected]>

Signed-off-by Saket Kumar Bhaskar <[email protected]>

Link https://lore.kernel.org/bpf/[email protected]/T/#mfcb23909d977b949727cca4f59ee56a13fd69b92 open here

Tested-by Yeswanth Krishna Tellakula <[email protected]>

---
  arch/powerpc/net/bpf_jit.h      |  7 +++++++
  arch/powerpc/net/bpf_jit_comp.c | 34 +++++++++++++++++++++++++--------
  2 files changed, 33 insertions(+), 8 deletions(-)

arch/powerpc/net/bpf_jit.h +7 -0

index 35015d7ecb76..6d58df361648 100644
@@ -14,6 +14,13 @@
  #include <asm/ppc-opcode.h>
  #include <linux/build_bug.h>
 
+/*
+ * We need at least 2 passes for proper code generation, and may need
+ * additional passes if code size changes between passes.
+ */
+#define CODEGEN_MIN_PASSES    2
+#define CODEGEN_MAX_PASSES    3
+
  #ifdef CONFIG_PPC64_ELF_ABI_V1
  #define FUNCTION_DESCR_SIZE	24
  #else

arch/powerpc/net/bpf_jit_comp.c +26 -8

index 8f7501954d9f..11981d2270a9 100644
@@ -99,11 +99,10 @@ void bpf_jit_build_fentry_stubs(u32 *image, struct codegen_context *ctx)
 
  int bpf_jit_emit_exit_insn(u32 *image, struct codegen_context *ctx, int tmp_reg, long exit_addr)
  {
-	if (!exit_addr || is_offset_in_branch_range(exit_addr - (ctx->idx * 4))) {
+	if (exit_addr && is_offset_in_branch_range(exit_addr - (long)(ctx->idx * 4))) {
  		PPC_JMP(exit_addr);
-	} else if (ctx->alt_exit_addr) {
-		if (WARN_ON(!is_offset_in_branch_range((long)ctx->alt_exit_addr - (ctx->idx * 4))))
-			return -1;
+	} else if (ctx->alt_exit_addr && is_offset_in_branch_range(
+			(long)(ctx->alt_exit_addr) - (long)(ctx->idx * 4))) {
  		PPC_JMP(ctx->alt_exit_addr);
  	} else {
  		ctx->alt_exit_addr = ctx->idx * 4;

@@ -274,6 +273,7 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_verifier_env *env, struct bpf_pr
  	 */
  	if (cgctx.seen & SEEN_TAILCALL || !is_offset_in_branch_range((long)cgctx.idx * 4)) {
  		cgctx.idx = 0;
+		cgctx.alt_exit_addr = 0;
  		if (bpf_jit_build_body(fp, NULL, NULL, &cgctx, addrs, 0, false))
  			goto out_err;
  	}

@@ -306,10 +306,13 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_verifier_env *env, struct bpf_pr
  	code_base = (u32 *)(image + FUNCTION_DESCR_SIZE);
  	fcode_base = (u32 *)(fimage + FUNCTION_DESCR_SIZE);
 
-	/* Code generation passes 1-2 */
-	for (pass = 1; pass < 3; pass++) {
+	/* Code generation passes 1-2+, loop until program size converges. */
+	for (pass = 1; pass <= CODEGEN_MAX_PASSES; pass++) {
+		u32 prev_proglen = proglen;
+
  		/* Now build the prologue, body code & epilogue for real. */
  		cgctx.idx = 0;
+		cgctx.exentry_idx = 0;
  		cgctx.alt_exit_addr = 0;
  		bpf_jit_build_prologue(code_base, &cgctx);
  		if (bpf_jit_build_body(fp, code_base, fcode_base, &cgctx, addrs, pass,

@@ -318,11 +321,26 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_verifier_env *env, struct bpf_pr
  			bpf_jit_binary_pack_free(fhdr, hdr);
  			goto out_err;
  		}
+		addrs[fp->len] = cgctx.idx * 4;
  		bpf_jit_build_epilogue(code_base, &cgctx);
 
+		proglen = cgctx.idx * 4;
+
  		if (bpf_jit_enable > 1)
  			pr_info("Pass %d: shrink = %d, seen = 0x%x\n", pass,
-				proglen - (cgctx.idx * 4), cgctx.seen);
+				prev_proglen - proglen, cgctx.seen);
+
+		/* Check if program size has converged, but ensure minimum passes */
+		if (pass >= CODEGEN_MIN_PASSES && proglen == prev_proglen)
+			break;
+
+		if (pass == CODEGEN_MAX_PASSES && proglen != prev_proglen) {
+			pr_err("BPF JIT: Program did not converge after %d passes\n",
+								CODEGEN_MAX_PASSES);
+			bpf_arch_text_copy(&fhdr->size, &hdr->size, sizeof(hdr->size));
+			bpf_jit_binary_pack_free(fhdr, hdr);
+			goto out_err;
+		}
  	}
 
  	if (bpf_jit_enable > 1)

@@ -399,7 +417,7 @@ int bpf_add_extable_entry(struct bpf_prog *fp, u32 *image, u32 *fimage, int pass
  	u32 *fixup;
 
  	/* Populate extable entries only in the last pass */
-	if (pass != 2)
+	if (pass < CODEGEN_MIN_PASSES)
  		return 0;
 
  	if (!fp->aux->extable ||

Quoted 4 lines

arch/powerpc/net/bpf_jit_comp.c +0 -0

index 11981d2270a9d..8ca36a933c7ae 100644

[ ... ]

Quoted 21 lines

arch/powerpc/net/bpf_jit_comp.c +12 -1

@@ -49,11 +49,35 @@ asm (
  "	.popsection				;"
  );
 
-void bpf_jit_build_fentry_stubs(u32 *image, struct codegen_context *ctx)
+void bpf_jit_build_fentry_stubs(u32 *image, u32 *fimage, struct codegen_context *ctx)
  {
  	int ool_stub_idx, long_branch_stub_idx;
+	int ool_stub_sz;
 
  	/*
+	 * Align the mis-aligned dummy_tramp_addr field in the fimage.
+	 * The alignment NOP must appear before OOL stub, to make
+	 * ool_stub_idx & long_branch_stub_idx constant from end.
+	 *
+	 * The fimage can be non 8-byte aligned, so final alignment depends
+	 * on start of fimage and the stub's instruction count offset. The
+	 * OOL stub size is 4 instructions (with CONFIG_PPC_FTRACE_OUT_OF_LINE)
+	 * or 3 instructions (without) before dummy_tramp_addr.
+	 *
+	 * Emit a NOP here if address is not SZL aligned.

arch/powerpc/net/bpf_jit_comp.c asm ( · line 77

Quoted 10 lines

arch/powerpc/net/bpf_jit_comp.c +10 -0

+	 *
+	 * In pass=0 when image==NULL, conservatively account for space
+	 * required to accommodate alignment NOP. In case final pass skips
+	 * emitting alignment NOP, the image buffer have 4 spare bytes and
+	 * jited_len signifies correct program size.
+	 */
+
+	ool_stub_sz = IS_ENABLED(CONFIG_PPC_FTRACE_OUT_OF_LINE) ? 16 : 12;
+	if (!image || !IS_ALIGNED((unsigned long)fimage + ctx->idx*4 + ool_stub_sz, SZL))
+		EMIT(PPC_RAW_NOP());

Can the conditional alignment NOP here mask program length convergence?

The preceding commit (5175364d6174 "powerpc/bpf: fix buffer overflow in JIT for large BPF programs") added a convergence check:

     if (pass >= CODEGEN_MIN_PASSES && proglen == prev_proglen)
         break;

to bpf_int_jit_compile(). But the alignment decision above forces the stub block to end at a fixed residue mod 8: the field address (fimage + ctx->idx*4 + ool_stub_sz) is aligned to SZL, and exactly SZL/4 + 7 instructions follow it. So fimage + proglen is congruent to a constant mod 8 every pass, meaning proglen can only change in multiples of 8.

When the body shrinks by an odd multiple of 4 bytes between passes, the NOP can absorb it and keep proglen unchanged. The body can shrink when an exit goes from out-of-range (emitting a full epilogue) to in-range (emitting a single branch):

arch/powerpc/net/bpf_jit_comp.c:bpf_jit_emit_exit_insn() {
     if (exit_addr && is_offset_in_branch_range(...)) {
         PPC_JMP(exit_addr);                    // 1 instruction
     } else {
         ...
         bpf_jit_build_epilogue(image, fimage, ctx);  // N instructions
     }
}

The shrink is (N-1)*4 bytes. When N-1 is odd, this is 4 mod 8. The NOP appearance or disappearance compensates, making proglen identical across passes even though addrs[] shifted.

Because forward branches use addrs[] from the previous pass (addrs[j] for target j > current i is computed in the prior pass), those branches would land (N-1)*4 bytes past the intended target.

The comment at arch/powerpc/net/bpf_jit.h:132-138 documents that the PowerPC JIT avoids pass-to-pass size changes by padding the short branch case with a NOP, specifically to prevent this scenario. Does reintroducing an address-dependent, pass-varying size risk incorrect branches?

(Note: commit 0cd8bd7da278 later in this series reworks the stub layout and is described as a layout improvement rather than a fix for this commit, which may provide additional context.)

Quoted 79 lines · On 31/08/26 1:42 pm, [email protected] wrote:

Quoted 4 lines

arch/powerpc/net/bpf_jit_comp.c +0 -0

index 11981d2270a9d..8ca36a933c7ae 100644

[ ... ]

Quoted 27 lines

arch/powerpc/net/bpf_jit_comp.c +0 -0

@@ -49,11 +49,35 @@ asm (

  "    .popsection                ;"
  );

-void bpf_jit_build_fentry_stubs(u32 *image, struct codegen_context *ctx)
+void bpf_jit_build_fentry_stubs(u32 *image, u32 *fimage, struct codegen_context *ctx)
  {
      int ool_stub_idx, long_branch_stub_idx;
+    int ool_stub_sz;

      /*
+     * Align the mis-aligned dummy_tramp_addr field in the fimage. +     * The alignment NOP must appear before OOL stub, to make +     * ool_stub_idx & long_branch_stub_idx constant from end. +     *
+     * The fimage can be non 8-byte aligned, so final alignment depends +     * on start of fimage and the stub's instruction count offset. The +     * OOL stub size is 4 instructions (with CONFIG_PPC_FTRACE_OUT_OF_LINE)
+     * or 3 instructions (without) before dummy_tramp_addr. +     *
+     * Emit a NOP here if address is not SZL aligned.
+     *
+     * In pass=0 when image==NULL, conservatively account for space +     * required to accommodate alignment NOP. In case final pass skips

Quoted 8 lines

+     * emitting alignment NOP, the image buffer have 4 spare bytes and +     * jited_len signifies correct program size.
+     */
+
+    ool_stub_sz = IS_ENABLED(CONFIG_PPC_FTRACE_OUT_OF_LINE) ? 16 : 12; +    if (!image || !IS_ALIGNED((unsigned long)fimage + ctx->idx*4 + ool_stub_sz, SZL))
+        EMIT(PPC_RAW_NOP());

Can the conditional alignment NOP here mask program length convergence?

The preceding commit (5175364d6174 "powerpc/bpf: fix buffer overflow in JIT for large BPF programs") added a convergence check:

     if (pass >= CODEGEN_MIN_PASSES && proglen == prev_proglen) break;

to bpf_int_jit_compile(). But the alignment decision above forces the stub block to end at a fixed residue mod 8: the field address (fimage + ctx->idx*4 + ool_stub_sz) is aligned to SZL, and exactly SZL/4 + 7 instructions follow it. So fimage + proglen is congruent to a constant mod 8 every pass, meaning proglen can only change in multiples of 8.

When the body shrinks by an odd multiple of 4 bytes between passes, the NOP can absorb it and keep proglen unchanged. The body can shrink when an exit goes from out-of-range (emitting a full epilogue) to in-range (emitting a single branch):

arch/powerpc/net/bpf_jit_comp.c:bpf_jit_emit_exit_insn() { if (exit_addr && is_offset_in_branch_range(...)) { PPC_JMP(exit_addr);                    // 1 instruction } else {
         ...
         bpf_jit_build_epilogue(image, fimage, ctx);  // N instructions }
}

The shrink is (N-1)*4 bytes. When N-1 is odd, this is 4 mod 8. The NOP appearance or disappearance compensates, making proglen identical across passes even though addrs[] shifted.

Because forward branches use addrs[] from the previous pass (addrs[j] for target j > current i is computed in the prior pass), those branches would land (N-1)*4 bytes past the intended target.

Quoted 9 lines

The comment at arch/powerpc/net/bpf_jit.h:132-138 documents that the PowerPC JIT avoids pass-to-pass size changes by padding the short branch case with a NOP, specifically to prevent this scenario. Does reintroducing an address-dependent, pass-varying size risk incorrect branches?

(Note: commit 0cd8bd7da278 later in this series reworks the stub layout and is described as a layout improvement rather than a fix for this commit, which may provide additional context.)

The review correctly identifies a potential mechanism by which a 4-byte alignment NOP could mask a size change. However, that mechanism only causes a convergence failure if the total code-size reduction between passes is exactly compensated by the NOP (i.e. effectively only 4 bytes). In this JIT, changing an exit from the inline epilogue to a branch removes the entire epilogue, so the size reduction is much larger than 4 bytes. The NOP can only compensate for 4 bytes; it cannot hide the remaining reduction. Therefore the proposed convergence failure does not apply to this code.

From: Abhishek Dubey <[email protected]>

Ensure the dummy trampoline address field present between the OOL stub and the long branch stub is 4/8-byte aligned, for memory compatibility when content loaded to a register.

Reported-by Hari Bathini <[email protected]>

Fixes d243b62b7bd3 ("powerpc64/bpf: Add support for bpf trampolines")

Cc [email protected]

Signed-off-by Abhishek Dubey <[email protected]>

Signed-off-by Saket Kumar Bhaskar <[email protected]>

Tested-by Yeswanth Krishna Tellakula <[email protected]>

---
  arch/powerpc/net/bpf_jit.h        |  7 +++---
  arch/powerpc/net/bpf_jit_comp.c   | 38 ++++++++++++++++++++++++++-----
  arch/powerpc/net/bpf_jit_comp32.c |  7 +++---
  arch/powerpc/net/bpf_jit_comp64.c |  7 +++---
  4 files changed, 44 insertions(+), 15 deletions(-)

arch/powerpc/net/bpf_jit.h +4 -3

index 6d58df361648..4da8bde92e1e 100644
@@ -227,10 +227,11 @@ int bpf_jit_emit_func_call_rel(u32 *image, u32 *fimage, struct codegen_context *
  int bpf_jit_build_body(struct bpf_prog *fp, u32 *image, u32 *fimage, struct codegen_context *ctx,
  		       u32 *addrs, int pass, bool extra_pass);
  void bpf_jit_build_prologue(u32 *image, struct codegen_context *ctx);
-void bpf_jit_build_epilogue(u32 *image, struct codegen_context *ctx);
-void bpf_jit_build_fentry_stubs(u32 *image, struct codegen_context *ctx);
+void bpf_jit_build_epilogue(u32 *image, u32 *fimage, struct codegen_context *ctx);
+void bpf_jit_build_fentry_stubs(u32 *image, u32 *fimage, struct codegen_context *ctx);
  void bpf_jit_realloc_regs(struct codegen_context *ctx);
-int bpf_jit_emit_exit_insn(u32 *image, struct codegen_context *ctx, int tmp_reg, long exit_addr);
+int bpf_jit_emit_exit_insn(u32 *image, u32 *fimage, struct codegen_context *ctx, int tmp_reg,
+										long exit_addr);
  void prepare_for_fsession_fentry(u32 *image, struct codegen_context *ctx, int cookie_cnt,
  								int cookie_off, int retval_off);
  void store_func_meta(u32 *image, struct codegen_context *ctx, u64 func_meta, int func_meta_off);

arch/powerpc/net/bpf_jit_comp.c +32 -6

index 11981d2270a9..8ca36a933c7a 100644
@@ -49,11 +49,35 @@ asm (
  "	.popsection				;"
  );
 
-void bpf_jit_build_fentry_stubs(u32 *image, struct codegen_context *ctx)
+void bpf_jit_build_fentry_stubs(u32 *image, u32 *fimage, struct codegen_context *ctx)
  {
  	int ool_stub_idx, long_branch_stub_idx;
+	int ool_stub_sz;
 
  	/*
+	 * Align the mis-aligned dummy_tramp_addr field in the fimage.
+	 * The alignment NOP must appear before OOL stub, to make
+	 * ool_stub_idx & long_branch_stub_idx constant from end.
+	 *
+	 * The fimage can be non 8-byte aligned, so final alignment depends
+	 * on start of fimage and the stub's instruction count offset. The
+	 * OOL stub size is 4 instructions (with CONFIG_PPC_FTRACE_OUT_OF_LINE)
+	 * or 3 instructions (without) before dummy_tramp_addr.
+	 *
+	 * Emit a NOP here if address is not SZL aligned.
+	 *
+	 * In pass=0 when image==NULL, conservatively account for space
+	 * required to accommodate alignment NOP. In case final pass skips
+	 * emitting alignment NOP, the image buffer have 4 spare bytes and
+	 * jited_len signifies correct program size.
+	 */
+
+	ool_stub_sz = IS_ENABLED(CONFIG_PPC_FTRACE_OUT_OF_LINE) ? 16 : 12;
+	if (!image || !IS_ALIGNED((unsigned long)fimage + ctx->idx*4 + ool_stub_sz, SZL))
+		EMIT(PPC_RAW_NOP());
+
+	/*
+	 *	nop     // optional, for alignment of dummy_tramp_addr
  	 * Out-of-line stub:
  	 *	mflr	r0
  	 *	[b|bl]	tramp

@@ -70,7 +94,7 @@ void bpf_jit_build_fentry_stubs(u32 *image, struct codegen_context *ctx)
 
  	/*
  	 * Long branch stub:
-	 *	.long	<dummy_tramp_addr>
+	 *	.long	<dummy_tramp_addr>  // 8-byte aligned
  	 *	mflr	r11
  	 *	bcl	20,31,$+4
  	 *	mflr	r12

@@ -81,6 +105,7 @@ void bpf_jit_build_fentry_stubs(u32 *image, struct codegen_context *ctx)
  	 */
  	if (image)
  		*((unsigned long *)&image[ctx->idx]) = (unsigned long)dummy_tramp;
+
  	ctx->idx += SZL / 4;
  	long_branch_stub_idx = ctx->idx;
  	EMIT(PPC_RAW_MFLR(_R11));

@@ -97,7 +122,8 @@ void bpf_jit_build_fentry_stubs(u32 *image, struct codegen_context *ctx)
  	}
  }
 
-int bpf_jit_emit_exit_insn(u32 *image, struct codegen_context *ctx, int tmp_reg, long exit_addr)
+int bpf_jit_emit_exit_insn(u32 *image, u32 *fimage, struct codegen_context *ctx,
+							int tmp_reg, long exit_addr)
  {
  	if (exit_addr && is_offset_in_branch_range(exit_addr - (long)(ctx->idx * 4))) {
  		PPC_JMP(exit_addr);

@@ -106,7 +132,7 @@ int bpf_jit_emit_exit_insn(u32 *image, struct codegen_context *ctx, int tmp_reg,
  		PPC_JMP(ctx->alt_exit_addr);
  	} else {
  		ctx->alt_exit_addr = ctx->idx * 4;
-		bpf_jit_build_epilogue(image, ctx);
+		bpf_jit_build_epilogue(image, fimage, ctx);
  	}
 
  	return 0;

@@ -286,7 +312,7 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_verifier_env *env, struct bpf_pr
  	 */
  	bpf_jit_build_prologue(NULL, &cgctx);
  	addrs[fp->len] = cgctx.idx * 4;
-	bpf_jit_build_epilogue(NULL, &cgctx);
+	bpf_jit_build_epilogue(NULL, NULL, &cgctx);
 
  	fixup_len = fp->aux->num_exentries * BPF_FIXUP_LEN * 4;
  	extable_len = fp->aux->num_exentries * sizeof(struct exception_table_entry);

@@ -322,7 +348,7 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_verifier_env *env, struct bpf_pr
  			goto out_err;
  		}
  		addrs[fp->len] = cgctx.idx * 4;
-		bpf_jit_build_epilogue(code_base, &cgctx);
+		bpf_jit_build_epilogue(code_base, fcode_base, &cgctx);
 
  		proglen = cgctx.idx * 4;
 

arch/powerpc/net/bpf_jit_comp32.c +4 -3

index bfdc50740da8..f5b9441cf46a 100644
@@ -229,7 +229,7 @@ static void bpf_jit_emit_common_epilogue(u32 *image, struct codegen_context *ctx
 
  }
 
-void bpf_jit_build_epilogue(u32 *image, struct codegen_context *ctx)
+void bpf_jit_build_epilogue(u32 *image, u32 *fimage, struct codegen_context *ctx)
  {
  	EMIT(PPC_RAW_MR(_R3, bpf_to_ppc(BPF_REG_0)));
 

@@ -237,7 +237,7 @@ void bpf_jit_build_epilogue(u32 *image, struct codegen_context *ctx)
 
  	EMIT(PPC_RAW_BLR());
 
-	bpf_jit_build_fentry_stubs(image, ctx);
+	bpf_jit_build_fentry_stubs(image, fimage, ctx);
  }
 
  /* Relative offset needs to be calculated based on final image location */

@@ -1149,7 +1149,8 @@ int bpf_jit_build_body(struct bpf_prog *fp, u32 *image, u32 *fimage, struct code
  			 * we'll just fall through to the epilogue.
  			 */
  			if (i != flen - 1) {
-				ret = bpf_jit_emit_exit_insn(image, ctx, _R0, exit_addr);
+				ret = bpf_jit_emit_exit_insn(image, fimage,
+								ctx, _R0, exit_addr);
  				if (ret)
  					return ret;
  			}

arch/powerpc/net/bpf_jit_comp64.c +4 -3

index 59302cabc466..e80312171aa7 100644
@@ -398,7 +398,7 @@ static void bpf_jit_emit_common_epilogue(u32 *image, struct codegen_context *ctx
  	}
  }
 
-void bpf_jit_build_epilogue(u32 *image, struct codegen_context *ctx)
+void bpf_jit_build_epilogue(u32 *image, u32 *fimage, struct codegen_context *ctx)
  {
  	bpf_jit_emit_common_epilogue(image, ctx);
 

@@ -407,7 +407,7 @@ void bpf_jit_build_epilogue(u32 *image, struct codegen_context *ctx)
 
  	EMIT(PPC_RAW_BLR());
 
-	bpf_jit_build_fentry_stubs(image, ctx);
+	bpf_jit_build_fentry_stubs(image, fimage, ctx);
  }
 
  /*

@@ -1737,7 +1737,8 @@ int bpf_jit_build_body(struct bpf_prog *fp, u32 *image, u32 *fimage, struct code
  			 * we'll just fall through to the epilogue.
  			 */
  			if (i != flen - 1) {
-				ret = bpf_jit_emit_exit_insn(image, ctx, tmp1_reg, exit_addr);
+				ret = bpf_jit_emit_exit_insn(image, fimage, ctx,
+								tmp1_reg, exit_addr);
  				if (ret)
  					return ret;
  			}

From: Abhishek Dubey <[email protected]>

Move the long branch address field to the bottom of the long branch stub. This allows uninterrupted disassembly until the last 4/8 bytes. The last bytes exclusion is logically necessary to prevent disassembly failure, otherwise the actual program layout is never altered. Hence no effect on overall program size. Also, align dummy_tramp_addr field with 8-byte boundary.

Following is disassembler output for test program with moved down dummy_tramp_addr field:
.....
.....

pc:68    left:44     a6 03 08 7c  :  mtlr 0
pc:72    left:40     bc ff ff 4b  :  b .-68
pc:76    left:36     a6 02 68 7d  :  mflr 11
pc:80    left:32     05 00 9f 42  :  bcl 20, 31, .+4
pc:84    left:28     a6 02 88 7d  :  mflr 12
pc:88    left:24     14 00 8c e9  :  ld 12, 20(12)
pc:92    left:20     a6 03 89 7d  :  mtctr 12
pc:96    left:16     a6 03 68 7d  :  mtlr 11
pc:100   left:12     20 04 80 4e  :  bctr
pc:104   left:8      c0 34 1d 00  :

Failure log:
Can't disasm instruction at offset 104: c0 34 1d 00 00 00 00 c0 Disassembly logic can truncate at 104, ignoring last 8 bytes.

Update the dummy_tramp_addr field offset calculation from the end of the program to reflect its new location, for bpf_arch_text_poke() to update the actual trampoline's address in this field.

All BPF trampoline selftests continue to pass with this patch applied.

Signed-off-by Abhishek Dubey <[email protected]>

Signed-off-by Saket Kumar Bhaskar <[email protected]>

Tested-by Yeswanth Krishna Tellakula <[email protected]>

---
  arch/powerpc/net/bpf_jit_comp.c | 44 ++++++++++++++++++---------------
  1 file changed, 24 insertions(+), 20 deletions(-)

arch/powerpc/net/bpf_jit_comp.c +24 -20

index 8ca36a933c7a..c2717f0d9cdd 100644
@@ -52,19 +52,19 @@ asm (
  void bpf_jit_build_fentry_stubs(u32 *image, u32 *fimage, struct codegen_context *ctx)
  {
  	int ool_stub_idx, long_branch_stub_idx;
-	int ool_stub_sz;
+	int stub_sz;
 
  	/*
+	 * The dummy_tramp_addr field is placed at bottom of Long branch stub.
  	 * Align the mis-aligned dummy_tramp_addr field in the fimage.
  	 * The alignment NOP must appear before OOL stub, to make
  	 * ool_stub_idx & long_branch_stub_idx constant from end.
  	 *
  	 * The fimage can be non 8-byte aligned, so final alignment depends
-	 * on start of fimage and the stub's instruction count offset. The
-	 * OOL stub size is 4 instructions (with CONFIG_PPC_FTRACE_OUT_OF_LINE)
-	 * or 3 instructions (without) before dummy_tramp_addr.
-	 *
-	 * Emit a NOP here if address is not SZL aligned.
+	 * on start of fimage and the stub's instruction count. The
+	 * stubs block has 11 instructions (with CONFIG_PPC_FTRACE_OUT_OF_LINE)
+	 * or 10 instructions (without) before dummy_tramp_addr field. Emit a
+	 * NOP if the address of dummy_tramp_addr is non aligned.
  	 *
  	 * In pass=0 when image==NULL, conservatively account for space
  	 * required to accommodate alignment NOP. In case final pass skips

@@ -72,8 +72,8 @@ void bpf_jit_build_fentry_stubs(u32 *image, u32 *fimage, struct codegen_context
  	 * jited_len signifies correct program size.
  	 */
 
-	ool_stub_sz = IS_ENABLED(CONFIG_PPC_FTRACE_OUT_OF_LINE) ? 16 : 12;
-	if (!image || !IS_ALIGNED((unsigned long)fimage + ctx->idx*4 + ool_stub_sz, SZL))
+	stub_sz = IS_ENABLED(CONFIG_PPC_FTRACE_OUT_OF_LINE) ? 44 : 40;
+	if (!image || !IS_ALIGNED((unsigned long)fimage + ctx->idx*4 + stub_sz, SZL))
  		EMIT(PPC_RAW_NOP());
 
  	/*

@@ -94,28 +94,29 @@ void bpf_jit_build_fentry_stubs(u32 *image, u32 *fimage, struct codegen_context
 
  	/*
  	 * Long branch stub:
-	 *	.long	<dummy_tramp_addr>  // 8-byte aligned
  	 *	mflr	r11
  	 *	bcl	20,31,$+4
-	 *	mflr	r12
-	 *	ld	r12, -8-SZL(r12)
+	 *	mflr	r12	// lr/r12 stores pc of current(this) inst.
+	 *	ld	r12, 20(r12) // offset(dummy_tramp_addr) from prev inst. is 20
  	 *	mtctr	r12
-	 *	mtlr	r11 // needed to retain ftrace ABI
+	 *	mtlr	r11	// needed to retain ftrace ABI
  	 *	bctr
+	 *	.long	<dummy_tramp_addr>  // SZL bytes aligned
  	 */
-	if (image)
-		*((unsigned long *)&image[ctx->idx]) = (unsigned long)dummy_tramp;
-
-	ctx->idx += SZL / 4;
  	long_branch_stub_idx = ctx->idx;
  	EMIT(PPC_RAW_MFLR(_R11));
  	EMIT(PPC_RAW_BCL4());
  	EMIT(PPC_RAW_MFLR(_R12));
-	EMIT(PPC_RAW_LL(_R12, _R12, -8-SZL));
+	EMIT(PPC_RAW_LL(_R12, _R12, 20));
  	EMIT(PPC_RAW_MTCTR(_R12));
  	EMIT(PPC_RAW_MTLR(_R11));
  	EMIT(PPC_RAW_BCTR());
 
+	if (image)
+		*((unsigned long *)&image[ctx->idx]) = (unsigned long)dummy_tramp;
+
+	ctx->idx += SZL / 4;
+
  	if (!bpf_jit_ool_stub) {
  		bpf_jit_ool_stub = (ctx->idx - ool_stub_idx) * 4;
  		bpf_jit_long_branch_stub = (ctx->idx - long_branch_stub_idx) * 4;

@@ -1309,6 +1310,7 @@ static void do_isync(void *info __maybe_unused)
   * bpf_func:
   *	[nop|b]	ool_stub
   * 2. Out-of-line stub:
+ *	nop	// optional nop for alignment
   * ool_stub:
   *	mflr	r0
   *	[b|bl]	<bpf_prog>/<long_branch_stub>

@@ -1316,14 +1318,14 @@ static void do_isync(void *info __maybe_unused)
   *	b	bpf_func + 4
   * 3. Long branch stub:
   * long_branch_stub:
- *	.long	<branch_addr>/<dummy_tramp>
   *	mflr	r11
   *	bcl	20,31,$+4
   *	mflr	r12
- *	ld	r12, -16(r12)
+ *	ld	r12, 20(r12)
   *	mtctr	r12
   *	mtlr	r11 // needed to retain ftrace ABI
   *	bctr
+ *	.long	<branch_addr>/<dummy_tramp>
   *
   * dummy_tramp is used to reduce synchronization requirements.
   *

@@ -1425,10 +1427,12 @@ int bpf_arch_text_poke(void *ip, enum bpf_text_poke_type old_t,
  	 * 1. Update the address in the long branch stub:
  	 * If new_addr is out of range, we will have to use the long branch stub, so patch new_addr
  	 * here. Otherwise, revert to dummy_tramp, but only if we had patched old_addr here.
+	 *
+	 * dummy_tramp_addr moved to bottom of long branch stub.
  	 */
  	if ((new_addr && !is_offset_in_branch_range(new_addr - ip)) ||
  	    (old_addr && !is_offset_in_branch_range(old_addr - ip)))
-		ret = patch_ulong((void *)(bpf_func_end - bpf_jit_long_branch_stub - SZL),
+		ret = patch_ulong((void *)(bpf_func_end - SZL), /* SZL: dummy_tramp_addr offset */
  				  (new_addr && !is_offset_in_branch_range(new_addr - ip)) ?
  				  (unsigned long)new_addr : (unsigned long)dummy_tramp);
  	if (ret)

From: Abhishek Dubey <[email protected]>

Move the long branch address field to the bottom of the long branch stub. This allows uninterrupted disassembly until the last 4/8 bytes. The last bytes exclusion is logically necessary to prevent disassembly failure, otherwise the actual program layout is never altered. Hence no effect on overall program size. Also, align dummy_tramp_addr field with 8-byte boundary.

Following is disassembler output for test program with moved down dummy_tramp_addr field:
.....
.....

pc:68    left:44     a6 03 08 7c  :  mtlr 0
pc:72    left:40     bc ff ff 4b  :  b .-68
pc:76    left:36     a6 02 68 7d  :  mflr 11
pc:80    left:32     05 00 9f 42  :  bcl 20, 31, .+4
pc:84    left:28     a6 02 88 7d  :  mflr 12
pc:88    left:24     14 00 8c e9  :  ld 12, 20(12)
pc:92    left:20     a6 03 89 7d  :  mtctr 12
pc:96    left:16     a6 03 68 7d  :  mtlr 11
pc:100   left:12     20 04 80 4e  :  bctr
pc:104   left:8      c0 34 1d 00  :

Failure log:
Can't disasm instruction at offset 104: c0 34 1d 00 00 00 00 c0 Disassembly logic can truncate at 104, ignoring last 8 bytes.

Update the dummy_tramp_addr field offset calculation from the end of the program to reflect its new location, for bpf_arch_text_poke() to update the actual trampoline's address in this field.

All BPF trampoline selftests continue to pass with this patch applied.

Signed-off-by Abhishek Dubey <[email protected]>

Signed-off-by Saket Kumar Bhaskar <[email protected]>

Tested-by Yeswanth Krishna Tellakula <[email protected]>

---
  arch/powerpc/net/bpf_jit_comp.c | 44 ++++++++++++++++++---------------
  1 file changed, 24 insertions(+), 20 deletions(-)

arch/powerpc/net/bpf_jit_comp.c +24 -20

index 8ca36a933c7a..c2717f0d9cdd 100644
@@ -52,19 +52,19 @@ asm (
  void bpf_jit_build_fentry_stubs(u32 *image, u32 *fimage, struct codegen_context *ctx)
  {
  	int ool_stub_idx, long_branch_stub_idx;
-	int ool_stub_sz;
+	int stub_sz;
 
  	/*
+	 * The dummy_tramp_addr field is placed at bottom of Long branch stub.
  	 * Align the mis-aligned dummy_tramp_addr field in the fimage.
  	 * The alignment NOP must appear before OOL stub, to make
  	 * ool_stub_idx & long_branch_stub_idx constant from end.
  	 *
  	 * The fimage can be non 8-byte aligned, so final alignment depends
-	 * on start of fimage and the stub's instruction count offset. The
-	 * OOL stub size is 4 instructions (with CONFIG_PPC_FTRACE_OUT_OF_LINE)
-	 * or 3 instructions (without) before dummy_tramp_addr.
-	 *
-	 * Emit a NOP here if address is not SZL aligned.
+	 * on start of fimage and the stub's instruction count. The
+	 * stubs block has 11 instructions (with CONFIG_PPC_FTRACE_OUT_OF_LINE)
+	 * or 10 instructions (without) before dummy_tramp_addr field. Emit a
+	 * NOP if the address of dummy_tramp_addr is non aligned.
  	 *
  	 * In pass=0 when image==NULL, conservatively account for space
  	 * required to accommodate alignment NOP. In case final pass skips

@@ -72,8 +72,8 @@ void bpf_jit_build_fentry_stubs(u32 *image, u32 *fimage, struct codegen_context
  	 * jited_len signifies correct program size.
  	 */
 
-	ool_stub_sz = IS_ENABLED(CONFIG_PPC_FTRACE_OUT_OF_LINE) ? 16 : 12;
-	if (!image || !IS_ALIGNED((unsigned long)fimage + ctx->idx*4 + ool_stub_sz, SZL))
+	stub_sz = IS_ENABLED(CONFIG_PPC_FTRACE_OUT_OF_LINE) ? 44 : 40;
+	if (!image || !IS_ALIGNED((unsigned long)fimage + ctx->idx*4 + stub_sz, SZL))
  		EMIT(PPC_RAW_NOP());
 
  	/*

@@ -94,28 +94,29 @@ void bpf_jit_build_fentry_stubs(u32 *image, u32 *fimage, struct codegen_context
 
  	/*
  	 * Long branch stub:
-	 *	.long	<dummy_tramp_addr>  // 8-byte aligned
  	 *	mflr	r11
  	 *	bcl	20,31,$+4
-	 *	mflr	r12
-	 *	ld	r12, -8-SZL(r12)
+	 *	mflr	r12	// lr/r12 stores pc of current(this) inst.
+	 *	ld	r12, 20(r12) // offset(dummy_tramp_addr) from prev inst. is 20
  	 *	mtctr	r12
-	 *	mtlr	r11 // needed to retain ftrace ABI
+	 *	mtlr	r11	// needed to retain ftrace ABI
  	 *	bctr
+	 *	.long	<dummy_tramp_addr>  // SZL bytes aligned
  	 */
-	if (image)
-		*((unsigned long *)&image[ctx->idx]) = (unsigned long)dummy_tramp;
-
-	ctx->idx += SZL / 4;
  	long_branch_stub_idx = ctx->idx;
  	EMIT(PPC_RAW_MFLR(_R11));
  	EMIT(PPC_RAW_BCL4());
  	EMIT(PPC_RAW_MFLR(_R12));
-	EMIT(PPC_RAW_LL(_R12, _R12, -8-SZL));
+	EMIT(PPC_RAW_LL(_R12, _R12, 20));
  	EMIT(PPC_RAW_MTCTR(_R12));
  	EMIT(PPC_RAW_MTLR(_R11));
  	EMIT(PPC_RAW_BCTR());
 
+	if (image)
+		*((unsigned long *)&image[ctx->idx]) = (unsigned long)dummy_tramp;
+
+	ctx->idx += SZL / 4;
+
  	if (!bpf_jit_ool_stub) {
  		bpf_jit_ool_stub = (ctx->idx - ool_stub_idx) * 4;
  		bpf_jit_long_branch_stub = (ctx->idx - long_branch_stub_idx) * 4;

@@ -1309,6 +1310,7 @@ static void do_isync(void *info __maybe_unused)
   * bpf_func:
   *	[nop|b]	ool_stub
   * 2. Out-of-line stub:
+ *	nop	// optional nop for alignment
   * ool_stub:
   *	mflr	r0
   *	[b|bl]	<bpf_prog>/<long_branch_stub>

@@ -1316,14 +1318,14 @@ static void do_isync(void *info __maybe_unused)
   *	b	bpf_func + 4
   * 3. Long branch stub:
   * long_branch_stub:
- *	.long	<branch_addr>/<dummy_tramp>
   *	mflr	r11
   *	bcl	20,31,$+4
   *	mflr	r12
- *	ld	r12, -16(r12)
+ *	ld	r12, 20(r12)
   *	mtctr	r12
   *	mtlr	r11 // needed to retain ftrace ABI
   *	bctr
+ *	.long	<branch_addr>/<dummy_tramp>
   *
   * dummy_tramp is used to reduce synchronization requirements.
   *

@@ -1425,10 +1427,12 @@ int bpf_arch_text_poke(void *ip, enum bpf_text_poke_type old_t,
  	 * 1. Update the address in the long branch stub:
  	 * If new_addr is out of range, we will have to use the long branch stub, so patch new_addr
  	 * here. Otherwise, revert to dummy_tramp, but only if we had patched old_addr here.
+	 *
+	 * dummy_tramp_addr moved to bottom of long branch stub.
  	 */
  	if ((new_addr && !is_offset_in_branch_range(new_addr - ip)) ||
  	    (old_addr && !is_offset_in_branch_range(old_addr - ip)))
-		ret = patch_ulong((void *)(bpf_func_end - bpf_jit_long_branch_stub - SZL),
+		ret = patch_ulong((void *)(bpf_func_end - SZL), /* SZL: dummy_tramp_addr offset */
  				  (new_addr && !is_offset_in_branch_range(new_addr - ip)) ?
  				  (unsigned long)new_addr : (unsigned long)dummy_tramp);
  	if (ret)

From: Abhishek Dubey <[email protected]>

Ensure that the trampoline stubs JITed at the tail of the epilogue do not expose the dummy trampoline address stored in the last 8 bytes(64-bit) and last 4 bytes(32-bit) to the disassembly flow. Prevent the disassembler from ingesting this memory address, as it may occasionally decode into a seemingly valid but incorrect instruction. Fix this issue by truncating the last 8/4 bytes from JITed buffers before supplying them for disassembly.

Signed-off-by Abhishek Dubey <[email protected]>

Signed-off-by Saket Kumar Bhaskar <[email protected]>

Tested-by Yeswanth Krishna Tellakula <[email protected]>

Reviewed-by Hari Bathini <[email protected]>

---
  .../selftests/bpf/jit_disasm_helpers.c        | 25 ++++++++++++++++++-
  1 file changed, 24 insertions(+), 1 deletion(-)

tools/testing/selftests/bpf/jit_disasm_helpers.c +24 -1

index 3558fe10e28c..b291d934dd1a 100644
@@ -179,9 +179,11 @@ int get_jited_program_text(int fd, char *text, size_t text_sz)
  	struct bpf_prog_info info = {};
  	__u32 info_len = sizeof(info);
  	__u32 jited_funcs, len, pc;
+	__u32 trunc_len = 0, disasm_len;
  	__u32 *func_lens = NULL;
  	FILE *text_out = NULL;
  	uint8_t *image = NULL;
+	char *triple = NULL;
  	int i, err = 0;
 
  	if (!llvm_initialized) {

@@ -225,9 +227,30 @@ int get_jited_program_text(int fd, char *text, size_t text_sz)
  	if (!ASSERT_OK(err, "bpf_prog_get_info_by_fd #2"))
  		goto out;
 
+	/*
+	 * last 8 bytes contains dummy_trampoline address in JIT
+	 * output on 64-bit and last 4 bytes on 32-bit powerpc,
+	 * which can't disassemble to a valid instruction.
+	 */
+	triple = LLVMGetDefaultTargetTriple();
+	if (triple) {
+		if (strstr(triple, "powerpc64") || strstr(triple, "ppc64"))
+			trunc_len = 8;
+		else if (strstr(triple, "powerpc") || strstr(triple, "ppc"))
+			trunc_len = 4;
+		LLVMDisposeMessage(triple);
+	}
+
  	for (pc = 0, i = 0; i < jited_funcs; ++i) {
  		fprintf(text_out, "func #%d:\n", i);
-		disasm_one_func(text_out, image + pc, func_lens[i]);
+
+		/*
+		 * Disabled JIT have zero func_lens, hence underflow
+		 */
+		disasm_len = func_lens[i] > trunc_len ?
+					func_lens[i] - trunc_len : 0;
+		disasm_one_func(text_out, image + pc, disasm_len);
+
  		fprintf(text_out, "\n");
  		pc += func_lens[i];
  	}

From: Abhishek Dubey <[email protected]>

Enable "__arch_powerpc64" specifier in verifier selftest for ppc64. Power 32-bit would require separate handling. Changes tested for 64-bit only.

Signed-off-by Abhishek Dubey <[email protected]>

Signed-off-by Saket Kumar Bhaskar <[email protected]>

Reviewed-by Hari Bathini <[email protected]>

Tested-by Yeswanth Krishna Tellakula <[email protected]>

---
  tools/testing/selftests/bpf/progs/bpf_misc.h | 1 +
  tools/testing/selftests/bpf/test_loader.c    | 5 +++++
  2 files changed, 6 insertions(+)

tools/testing/selftests/bpf/progs/bpf_misc.h +1 -0

index b0c441384f20..365008d1ed40 100644
@@ -159,6 +159,7 @@
  #define __arch_riscv64		__arch("RISCV64")
  #define __arch_s390x		__arch("s390x")
  #define __arch_loongarch	__arch("LOONGARCH")
+#define __arch_powerpc64	__arch("POWERPC64")
  #define __caps_unpriv(caps)	__test_tag("test_caps_unpriv=" EXPAND_QUOTE(caps))
  #define __load_if_JITed()	__test_tag("load_mode=jited")
  #define __load_if_no_JITed()	__test_tag("load_mode=no_jited")

tools/testing/selftests/bpf/test_loader.c +5 -0

index 3ce32d134e2c..01b1420097d2 100644
@@ -378,6 +378,7 @@ enum arch {
  	ARCH_RISCV64	= 0x8,
  	ARCH_S390X	= 0x10,
  	ARCH_LOONGARCH	= 0x20,
+	ARCH_POWERPC64	= 0x40,
  };
 
  static int get_current_arch(void)

@@ -392,6 +393,8 @@ static int get_current_arch(void)
  	return ARCH_S390X;
  #elif defined(__loongarch__)
  	return ARCH_LOONGARCH;
+#elif defined(__powerpc64__)
+	return ARCH_POWERPC64;
  #endif
  	return ARCH_UNKNOWN;
  }

@@ -585,6 +588,8 @@ static int parse_test_spec(struct test_loader *tester,
  				arch = ARCH_S390X;
  			} else if (strcmp(val, "LOONGARCH") == 0) {
  				arch = ARCH_LOONGARCH;
+			} else if (strcmp(val, "POWERPC64") == 0) {
+				arch = ARCH_POWERPC64;
  			} else {
  				PRINT_FAIL("bad arch spec: '%s'\n", val);
  				err = -EINVAL;

From: Abhishek Dubey <[email protected]>

Verifier testcase result for tailcalls:

# ./test_progs -t verifier_tailcall

#618/1 verifier_tailcall/invalid map type for tail call:OK

#618/2 verifier_tailcall/invalid map type for tail call @unpriv:OK

#618 verifier_tailcall:OK

#619/1 verifier_tailcall_jit/main:OK

#619 verifier_tailcall_jit:OK

Summary: 2/3 PASSED, 0 SKIPPED, 0 FAILED

Signed-off-by Abhishek Dubey <[email protected]>

Signed-off-by Saket Kumar Bhaskar <[email protected]>

Tested-by Yeswanth Krishna Tellakula <[email protected]>

---
  .../bpf/progs/verifier_tailcall_jit.c         | 78 +++++++++++++++++++
  1 file changed, 78 insertions(+)

tools/testing/selftests/bpf/progs/verifier_tailcall_jit.c +78 -0

index 48fa34d2959f..9880ce4f1931 100644
@@ -91,6 +91,84 @@ __jited("	popq	%rax")
  __jited("	jmp	{{.*}}")		/* jump to tail call tgt   */
  __jited("L0:	leave")
  __jited("	{{(retq|jmp	0x)}}")		/* return or jump to rethunk */
+__arch_powerpc64
+/* program entry for main(), regular function prologue */
+__jited("	nop")
+__jited("...")                          /* ld 2, 16(13) absent with CONFIG_PPC_KERNEL_PCREL */
+__jited("	li 9, 0")
+__jited("	std 9, -8(1)")
+__jited("	mflr 0")
+__jited("	std 0, 16(1)")
+__jited("	stdu 1, {{.*}}(1)")
+/*
+ * load address and call sub() via count register
+ *
+ * Address materialization differs between PCREL and non-PCREL kernels.
+ * Skip the address generation sequence and verify only that the call
+ * target is loaded into CTR before branching.
+ */
+__jited("...")
+__jited("...")
+__jited("...")
+__jited("...")
+__jited("...")
+__jited("...")
+__jited("	mtctr {{.*}}")
+__jited("...")
+__jited("	bctrl")
+__jited("	mr	8, 3")
+__jited("	li 8, 0")
+__jited("	addi 1, 1, {{.*}}")
+__jited("	ld 0, 16(1)")
+__jited("	mtlr 0")
+__jited("	mr	3, 8")
+__jited("	blr")
+__jited("...")
+__jited("func #1")
+/* subprogram entry for sub() */
+__jited("	nop")
+__jited("...")                          /* ld 2, 16(13) absent with CONFIG_PPC_KERNEL_PCREL */
+/* tail call prologue for subprogram */
+__jited("	ld 10, 0(1)")
+__jited("	ld 9, -8(10)")
+__jited("	cmpldi	9, 33")
+__jited("	bt	{{.*}}, {{.*}}")
+__jited("	addi 9, 10, -8")
+__jited("	std 9, -8(1)")
+__jited("	lis {{.*}}, {{.*}}")
+__jited("	sldi {{.*}}, {{.*}}, 32")
+__jited("	oris {{.*}}, {{.*}}, {{.*}}")
+__jited("	ori {{.*}}, {{.*}}, {{.*}}")
+__jited("	li {{.*}}, 0")
+__jited("	lwz 9, {{.*}}({{.*}})")
+__jited("	slwi {{.*}}, {{.*}}, 0")
+__jited("	cmplw	{{.*}}, 9")
+__jited("	bf	0, {{.*}}")
+/* bpf_tail_call implementation */
+__jited("	ld 9, -8(1)")
+__jited("	cmpldi	9, 33")
+__jited("	bf	{{.*}}, {{.*}}")
+__jited("	ld 9, 0(9)")
+__jited("	cmpldi	9, 33")
+__jited("	bt	{{.*}}, {{.*}}")
+__jited("	addi 9, 9, 1")
+__jited("	mulli 10, {{.*}}, 8")
+__jited("	add 10, 10, {{.*}}")
+__jited("	ld 10, {{.*}}(10)")
+__jited("	cmpldi	10, 0")
+__jited("	bt	{{.*}}, {{.*}}")
+__jited("	ld 10, {{.*}}(10)")
+__jited("	addi 10, 10, {{.*}}")    /* offset depends on CONFIG_PPC_KERNEL_PCREL */
+__jited("	mtctr 10")
+__jited("	ld 10, -8(1)")
+__jited("	cmpldi	10, 33")
+__jited("	bt	{{.*}}, {{.*}}")
+__jited("	addi 10, 1, -8")
+__jited("	std 9, 0(10)")
+__jited("	bctr")
+__jited("	mr	3, 8")
+__jited("	blr")
+
  SEC("tc")
  __naked int main(void)
  {