[PATCH 1/3] drivers/fbtft: Remove newline after else in else-if

This removes the following warning issued by checkpatch WARNING: suspect code indent for conditional statements (8, 8) + } else + if (display->regwidth == 8 && display->buswidth == 9 && par->spi) { Signed-off-by: Luis Gerhorst Acked-by: Jonny Schaefer Acked

[PATCH 2/3] drivers/fbtft: Remove unnecessary braces from if/else

The Linux kernel coding style states that braces should only be used when necessary. This fixes the checkpatch warning WARNING: line over 80 characters + } else if (display->regwidth == 8 && display->buswidth == 9 && par->spi) { introduced by patch #1. Sig

[PATCH 3/3] drivers/fbtft: Fix indentation

Signed-off-by: Luis Gerhorst Acked-by: Jonny Schaefer Acked-by: Alexander Wuerstlein --- drivers/staging/fbtft/fbtft-core.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/staging/fbtft/fbtft-core.c b/drivers/staging/fbtft/fbtft-core.c index 34b1c81..566f89c

Re: [PATCH bpf-next 00/11] bpf: Mitigate Spectre v1 using barriers

Eduard Zingerman writes: > I think it would be good to have some tests checking that nospec > instructions are inserted in expected locations. > Could you please take look at use of __xlated tag in e.g. > tools/testing/selftests/bpf/progs/verifier_sdiv.c ? That looks very promising, I will look i

Re: [PATCH bpf-next 09/11] bpf: Return PTR_ERR from push_stack()

Eduard Zingerman writes: > Could you please point me to a location, where exact error code > returned by updated push_stack() matters? > I checked push_stack() callgraph (in the attachment), but can't find > anything. Only with the final patch 11 ("bpf: Fall back to nospec for spec path verifica

Re: [PATCH bpf-next 11/11] bpf: Fall back to nospec for spec path verification

Alexei Starovoitov writes: > On Thu, Mar 13, 2025 at 10:57 AM Luis Gerhorst wrote: >> With increased limits this allows applying mitigations to large BPF >> progs such as the Parca Continuous Profiler's prog. However, this >> requires a jump-seq limit of 256k. In an

Re: [PATCH bpf-next 01/11] bpf: Move insn if/else into do_check_insn()

Eduard Zingerman writes: > On Thu, 2025-03-13 at 18:21 +0100, Luis Gerhorst wrote: >> +err = do_check_insn(env, insn, pop_log, &do_print_state, regs, >> state, >> +&prev_insn_idx); > > - `regs` remains declared in

Re: [PATCH bpf-next v3 08/11] bpf: Fall back to nospec for Spectre v1

Kumar Kartikeya Dwivedi writes: > Back when all of this surfaced, compiler folks came up with another > solution, to rely on Intel's guarantee that conditional moves are not > predicted. > > if (condition) { >mask = !condition ? 0UL : ~0UL; // CMOVcc >ptr &= mask; >x = *ptr; > } > > I

[PATCH bpf-next v3 11/11] bpf: Fall back to nospec for sanitization-failures

alternative would be -EFAULT, which is also returned for some of the other cases where push_stack() fails, but this is more frequently used for verifier-internal bugs. Signed-off-by: Luis Gerhorst Acked-by: Henriette Herzog Cc: Maximilian Ott Cc: Milan Stephan --- kernel/bpf/verifier.c

[PATCH bpf-next v3 00/11] bpf: Mitigate Spectre v1 using barriers

to include v1 barrier - discuss potential security (archs that do not impl. BPF nospec) and performance (only PowerPC) regressions - Link to RFC: https://lore.kernel.org/bpf/20250224203619.594724-1-luis.gerho...@fau.de/ Luis Gerhorst (11): selftests/bpf: Fix caps for __xlated/jited_

[PATCH bpf-next v3 03/11] bpf: Return -EFAULT on misconfigurations

seems that this change does not interfere with libbpf. [1] https://lore.kernel.org/all/785b4531ce3b44a84059a4feb4ba458c68fce719.ca...@gmail.com/ Signed-off-by: Luis Gerhorst Reviewed-by: Eduard Zingerman Acked-by: Henriette Herzog Cc: Maximilian Ott Cc: Milan Stephan --- kernel/bpf/verifier.c

[PATCH bpf-next v3 04/11] bpf: Return -EFAULT on internal errors

This prevents us from trying to recover from these on speculative paths in the future. Signed-off-by: Luis Gerhorst Reviewed-by: Eduard Zingerman Acked-by: Henriette Herzog Cc: Maximilian Ott Cc: Milan Stephan --- kernel/bpf/verifier.c | 6 +++--- 1 file changed, 3 insertions(+), 3

[PATCH bpf-next v3 06/11] bpf, arm64, powerpc: Change nospec to include v1 barrier

unexpected conflicts between the insns when combined like this. Individual v1/v4 barriers were already emitted elsewhere. [1] https://gcc.gnu.org/git/?p=gcc.git;a=commit;h=29b74545531f6afbee9fc38c267524326dbfbedf ("MIPS: Add speculation_barrier support") [2] https://githu

[PATCH bpf-next v3 05/11] bpf, arm64, powerpc: Add bpf_jit_bypass_spec_v1/v4()

ec_v1() and _v4() according to commit a6f6a95f2580 ("LoongArch, bpf: Fix jit to skip speculation barrier opcode"). This is omitted here as I am unable to do any testing for LoongArch. Signed-off-by: Luis Gerhorst Cc: Henriette Herzog Cc: Maximilian Ott Cc: Milan Stephan --- arch/arm64/ne

[PATCH bpf-next v3 01/11] selftests/bpf: Fix caps for __xlated/jited_unpriv

check whether a speculation barrier was inserted in the correct location. Signed-off-by: Luis Gerhorst Fixes: 9c9f73391310 ("selftests/bpf: allow checking xlated programs in verifier_* tests") Fixes: 7d743e4c759c ("selftests/bpf: __jited test tag to check disassembly after jit"

[PATCH bpf-next v3 02/11] bpf: Move insn if/else into do_check_insn()

do_print_state = " with "*do_print_state = " [1] https://lore.kernel.org/all/293dbe3950a782b8eb3b87b71d7a967e120191fd.ca...@gmail.com/ Signed-off-by: Luis Gerhorst Acked-by: Henriette Herzog Cc: Maximilian Ott Cc: Milan Stephan --- kernel/bpf/verifier.c | 426 +++

[PATCH bpf-next v3 10/11] bpf: Allow nospec-protected var-offset stack access

/overwrites pointers on the BPF stack, they are already a problem for fixed-offset stack accesses and should be subject to Spectre v4 sanitization. Signed-off-by: Luis Gerhorst Acked-by: Henriette Herzog Cc: Maximilian Ott Cc: Milan Stephan --- kernel/bpf/verifier.c | 24 1 file

[PATCH bpf-next v3 07/11] bpf: Rename sanitize_stack_spill to nospec_result

This is made to clarify that this flag will cause a nospec to be added after this insn and can therefore be relied upon to reduce speculative path analysis. Signed-off-by: Luis Gerhorst Cc: Henriette Herzog Cc: Maximilian Ott Cc: Milan Stephan --- include/linux/bpf_verifier.h | 2 +- kernel

[PATCH bpf-next v3 08/11] bpf: Fall back to nospec for Spectre v1

F") [2] https://arxiv.org/pdf/2405.00078 ("VeriFence: Lightweight and Precise Spectre Defenses for Untrusted Linux Kernel Extensions") [3] https://www.intel.com/content/www/us/en/developer/articles/technical/software-security-guidance/technical-documentation/runtime-speculative-

[PATCH bpf-next v3 09/11] selftests/bpf: Add test for Spectre v1 mitigation

This is based on the gadget from the description of commit 9183671af6db ("bpf: Fix leakage under speculation on mispredicted branches"). Signed-off-by: Luis Gerhorst --- .../selftests/bpf/progs/verifier_unpriv.c | 57 +++ 1 file changed, 57 insertions(+) diff --g

Re: [PATCH bpf-next v3 02/11] bpf: Move insn if/else into do_check_insn()

Eduard Zingerman writes: > On Thu, 2025-05-01 at 09:35 +0200, Luis Gerhorst wrote: > >> +dst_reg_type = cur_regs(env)[insn->dst_reg].type; > > Implicitly relying on `insn == &env->prog->insnsi[env->cur_idx]` > is weird. Still think that `

Re: [PATCH bpf-next v2 06/11] bpf, arm64, powerpc: Change nospec to include v1 barrier

kernel test robot writes: > All errors (new ones prefixed by >>): > >arch/powerpc/net/bpf_jit_comp64.c: In function 'bpf_jit_build_body': >>> arch/powerpc/net/bpf_jit_comp64.c:814:4: error: a label can only be part of >>> a statement and a declaration is not a statement > 814 |bool

[PATCH bpf-next v2 06/11] bpf, arm64, powerpc: Change nospec to include v1 barrier

unexpected conflicts between the insns when combined like this. Individual v1/v4 barriers were already emitted elsewhere. [1] https://gcc.gnu.org/git/?p=gcc.git;a=commit;h=29b74545531f6afbee9fc38c267524326dbfbedf ("MIPS: Add speculation_barrier support") [2] https://githu

[PATCH bpf-next v2 03/11] bpf: Return -EFAULT on misconfigurations

seems that this change does not interfere with libbpf. [1] https://lore.kernel.org/all/785b4531ce3b44a84059a4feb4ba458c68fce719.ca...@gmail.com/ Signed-off-by: Luis Gerhorst Reviewed-by: Eduard Zingerman Acked-by: Henriette Herzog Cc: Maximilian Ott Cc: Milan Stephan --- kernel/bpf/verifier.c

[PATCH bpf-next v2 01/11] selftests/bpf: Fix caps for __xlated/jited_unpriv

check whether a speculation barrier was inserted in the correct location. Signed-off-by: Luis Gerhorst Fixes: 9c9f73391310 ("selftests/bpf: allow checking xlated programs in verifier_* tests") Fixes: 7d743e4c759c ("selftests/bpf: __jited test tag to check disassembly after jit"

[PATCH bpf-next v2 04/11] bpf: Return -EFAULT on internal errors

This prevents us from trying to recover from these on speculative paths in the future. Signed-off-by: Luis Gerhorst Reviewed-by: Eduard Zingerman Acked-by: Henriette Herzog Cc: Maximilian Ott Cc: Milan Stephan --- kernel/bpf/verifier.c | 6 +++--- 1 file changed, 3 insertions(+), 3

[PATCH bpf-next v2 10/11] bpf: Allow nospec-protected var-offset stack access

/overwrites pointers on the BPF stack, they are already a problem for fixed-offset stack accesses and should be subject to Spectre v4 sanitization. Signed-off-by: Luis Gerhorst Acked-by: Henriette Herzog Cc: Maximilian Ott Cc: Milan Stephan --- kernel/bpf/verifier.c | 24 1 file

[PATCH bpf-next v2 11/11] bpf: Fall back to nospec for sanitization-failures

alternative would be -EFAULT, which is also returned for some of the other cases where push_stack() fails, but this is more frequently used for verifier-internal bugs. Signed-off-by: Luis Gerhorst Acked-by: Henriette Herzog Cc: Maximilian Ott Cc: Milan Stephan --- kernel/bpf/verifier.c

[PATCH bpf-next v2 07/11] bpf: Rename sanitize_stack_spill to nospec_result

This is made to clarify that this flag will cause a nospec to be added after this insn and can therefore be relied upon to reduce speculative path analysis. Signed-off-by: Luis Gerhorst Cc: Henriette Herzog Cc: Maximilian Ott Cc: Milan Stephan --- include/linux/bpf_verifier.h | 2 +- kernel

[PATCH bpf-next v2 08/11] bpf: Fall back to nospec for Spectre v1

F") [2] https://arxiv.org/pdf/2405.00078 ("VeriFence: Lightweight and Precise Spectre Defenses for Untrusted Linux Kernel Extensions") [3] https://www.intel.com/content/www/us/en/developer/articles/technical/software-security-guidance/technical-documentation/runtime-speculative-

[PATCH bpf-next v2 09/11] selftests/bpf: Add test for Spectre v1 mitigation

This is based on the gadget from the description of commit 9183671af6db ("bpf: Fix leakage under speculation on mispredicted branches"). Signed-off-by: Luis Gerhorst --- .../selftests/bpf/progs/verifier_unpriv.c | 57 +++ 1 file changed, 57 insertions(+) diff --g

Re: [PATCH bpf-next v2 05/11] bpf, arm64, powerpc: Add bpf_jit_bypass_spec_v1/v4()

kernel test robot writes: > All warnings (new ones prefixed by >>): > >>> kernel/bpf/core.c:3037:13: warning: no previous prototype for >>> 'bpf_jit_bypass_spec_v1' [-Wmissing-prototypes] > 3037 | bool __weak bpf_jit_bypass_spec_v1(void) > | ^~ >>> ke

[PATCH bpf-next v2 00/11] bpf: Mitigate Spectre v1 using barriers

l security (archs that do not impl. BPF nospec) and performance (only PowerPC) regressions - Linkt to RFC: https://lore.kernel.org/bpf/20250224203619.594724-1-luis.gerho...@fau.de/ Luis Gerhorst (11): selftests/bpf: Fix caps for __xlated/jited_unpriv bpf: Move insn if/else into do_check_insn() bpf: Ret

[PATCH bpf-next v2 05/11] bpf, arm64, powerpc: Add bpf_jit_bypass_spec_v1/v4()

ec_v1() and _v4() according to commit a6f6a95f2580 ("LoongArch, bpf: Fix jit to skip speculation barrier opcode"). This is omitted here as I am unable to do any testing for LoongArch. Signed-off-by: Luis Gerhorst Cc: Henriette Herzog Cc: Maximilian Ott Cc: Milan Stephan --- arch/arm64/ne

[PATCH bpf-next v2 02/11] bpf: Move insn if/else into do_check_insn()

do_print_state = " with "*do_print_state = " [1] https://lore.kernel.org/all/293dbe3950a782b8eb3b87b71d7a967e120191fd.ca...@gmail.com/ Signed-off-by: Luis Gerhorst Acked-by: Henriette Herzog Cc: Maximilian Ott Cc: Milan Stephan --- kernel/bpf/verifier.c | 425 +++

Re: [RFC PATCH 5/9] bpf: Fall back to nospec if v1 verification fails

On 24/02/2025 21:47, Luis Gerhorst wrote: > + } else if (error_recoverable_with_nospec(err) && > state->speculative) > { > + WARN_ON_ONCE(env->bypass_spec_v1); > + WARN_ON_ONCE(env->cur_state != state); > +

[PATCH bpf-next 10/11] bpf: Fall back to nospec for sanitization-failures

back to nospec directly for the remaining sanitization errs even if we are not on a speculative path. Signed-off-by: Luis Gerhorst Acked-by: Henriette Herzog Cc: Maximilian Ott Cc: Milan Stephan --- kernel/bpf/verifier.c | 85 ++- .../selftests/bpf/progs

[PATCH bpf-next 01/11] bpf: Move insn if/else into do_check_insn()

ate = " with "*do_print_state = " Signed-off-by: Luis Gerhorst Acked-by: Henriette Herzog Cc: Maximilian Ott Cc: Milan Stephan --- kernel/bpf/verifier.c | 426 ++ 1 file changed, 224 insertions(+), 202 deletions(-) diff --git a/kern

[PATCH bpf-next 02/11] bpf: Return -EFAULT on misconfigurations

Mark these cases as non-recoverable to later prevent them from being cought when they occur during speculative path verification. Signed-off-by: Luis Gerhorst Acked-by: Henriette Herzog Cc: Maximilian Ott Cc: Milan Stephan --- kernel/bpf/verifier.c | 36

[PATCH bpf-next 04/11] bpf, arm64, powerpc: Add bpf_jit_bypass_spec_v1/v4()

ec_v1() and _v4() according to commit a6f6a95f2580 ("LoongArch, bpf: Fix jit to skip speculation barrier opcode"). This is omitted here as I am unable to do any testing for LoongArch. Signed-off-by: Luis Gerhorst Cc: Henriette Herzog Cc: Maximilian Ott Cc: Milan Stephan --- arch/arm64/ne

[PATCH bpf-next 03/11] bpf: Return -EFAULT on internal errors

This prevents us from trying to recover from these on speculative paths in the future. Signed-off-by: Luis Gerhorst Acked-by: Henriette Herzog Cc: Maximilian Ott Cc: Milan Stephan --- kernel/bpf/verifier.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/kernel/bpf

[PATCH bpf-next 06/11] bpf: Rename sanitize_stack_spill to nospec_result

This is made to clarify that this flag will cause a nospec to be added after this insn and can therefore be relied upon to reduce speculative path analysis. Signed-off-by: Luis Gerhorst Cc: Henriette Herzog Cc: Maximilian Ott Cc: Milan Stephan --- include/linux/bpf_verifier.h | 2 +- kernel

[PATCH bpf-next 00/11] bpf: Mitigate Spectre v1 using barriers

F nospec) and performance (only PowerPC) regressions RFC: https://lore.kernel.org/bpf/20250224203619.594724-1-luis.gerho...@fau.de/ Luis Gerhorst (11): bpf: Move insn if/else into do_check_insn() bpf: Return -EFAULT on misconfigurations bpf: Return -EFAULT on internal errors bpf, arm64, pow

[PATCH bpf-next 05/11] bpf, arm64, powerpc: Change nospec to include v1 barrier

unexpected conflicts between the insns when combined like this. Individual v1/v4 barriers were already emitted elsewhere. [1] https://gcc.gnu.org/git/?p=gcc.git;a=commit;h=29b74545531f6afbee9fc38c267524326dbfbedf ("MIPS: Add speculation_barrier support") [2] https://github.com/kerne

[PATCH bpf-next 07/11] bpf: Fall back to nospec for Spectre v1

efenses for Untrusted Linux Kernel Extensions") Signed-off-by: Luis Gerhorst Acked-by: Henriette Herzog Cc: Maximilian Ott Cc: Milan Stephan --- include/linux/bpf_verifier.h | 1 + kernel/bpf/verifier.c | 68 +-- .../selftests/bpf/prog

[PATCH bpf-next 08/11] bpf: Allow nospec-protected var-offset stack access

Insert a nospec before the access to prevent it from ever using an index that is subject to speculative scalar-confusion. Signed-off-by: Luis Gerhorst Acked-by: Henriette Herzog Cc: Maximilian Ott Cc: Milan Stephan --- kernel/bpf/verifier.c | 24 1 file changed, 12

[PATCH bpf-next 09/11] bpf: Return PTR_ERR from push_stack()

Main reason is, that it will later allow us to fall back to a nospec for certain errors in push_stack(). This changes the sanitization-case to returning -ENOMEM. However, this is more fitting as -EFAULT would indicate a verifier-internal bug. Signed-off-by: Luis Gerhorst Acked-by: Henriette

[PATCH bpf-next 11/11] bpf: Fall back to nospec for spec path verification

") Signed-off-by: Luis Gerhorst Acked-by: Henriette Herzog Cc: Maximilian Ott Cc: Milan Stephan --- kernel/bpf/verifier.c | 14 ++ 1 file changed, 14 insertions(+) diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c index 03af82f52a02..49c7e2608ccd 100644 --- a/kernel

[RFC PATCH 7/9] bpf: Refactor push_stack to return error code

, that it requires us to introduce an output parameter for the state. Signed-off-by: Luis Gerhorst Acked-by: Henriette Herzog Cc: Maximilian Ott Cc: Milan Stephan --- kernel/bpf/verifier.c | 71 +-- 1 file changed, 42 insertions(+), 29 deletions(-) diff

[RFC PATCH 9/9] bpf: Cut speculative path verification short

, the same principle should apply to smaller programs therefore include it even if the limit stays at 8k for now. Most programs in "VeriFence: Lightweight and Precise Spectre Defenses for Untrusted Linux Kernel Extensions" (https://arxiv.org/pdf/2405.00078) only require a limit of 32k. Sign

[RFC PATCH 8/9] bpf: Fall back to nospec for sanitization-failures

-access from using the result of the alu op speculatively. Therefore, insert a nospec after the alu insn. The latter requires us to modify the nospec_result patching code to work not only for write-type insns. Signed-off-by: Luis Gerhorst Acked-by: Henriette Herzog Cc: Maximilian Ott Cc: Milan

[RFC PATCH 5/9] bpf: Fall back to nospec if v1 verification fails

nospec should be inserted (as comment) and modify the error message if the nospec is able to mitigate a problem that previously shadowed another problem. Briefly went through all the occurrences of EPERM, EINVAL, and EACCESS in the verifier in order to validate that catching them like this makes sense.

[RFC PATCH 6/9] bpf: Allow nospec-protected var-offset stack access

Insert a nospec before the access to prevent it from ever using a index that is subject to speculative scalar-confusion. Signed-off-by: Luis Gerhorst Acked-by: Henriette Herzog Cc: Maximilian Ott Cc: Milan Stephan --- kernel/bpf/verifier.c | 15 --- 1 file changed, 8 insertions

[RFC PATCH 1/9] bpf/arm64: Unset bypass_spec_v4() instead of ignoring BPF_NOSPEC

complexity of Spectre v1 verification. Signed-off-by: Luis Gerhorst Acked-by: Henriette Herzog Cc: Maximilian Ott Cc: Milan Stephan --- arch/arm64/net/bpf_jit_comp.c | 10 +- include/linux/bpf.h | 14 +- include/linux/bpf_verifier.h | 2 +- kernel/bpf/verifier.c

[RFC PATCH 2/9] bpf: Refactor do_check() if/else into do_check_insn()

h "*do_print_state = ", and "goto process_bpf_exit" / fallthrough with "return process_bpf_exit()". Signed-off-by: Luis Gerhorst Acked-by: Henriette Herzog Cc: Maximilian Ott Cc: Milan Stephan --- kernel/bpf/verifier.c | 528 +++-

[RFC PATCH 4/9] bpf: Return EFAULT on internal errors

This prevents us from trying to recover from these on speculative paths in the future. Signed-off-by: Luis Gerhorst Acked-by: Henriette Herzog Cc: Maximilian Ott Cc: Milan Stephan --- kernel/bpf/verifier.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/kernel/bpf

[RFC PATCH 3/9] bpf: Return EFAULT on misconfigurations

Mark these cases as non-recoverable, even when they only occur during speculative path verification. Signed-off-by: Luis Gerhorst Acked-by: Henriette Herzog Cc: Maximilian Ott Cc: Milan Stephan --- kernel/bpf/verifier.c | 37 +++-- 1 file changed, 19

[RFC PATCH 0/9] bpf: Mitigate Spectre v1 using speculation barriers

ually emit arm64 barrier * fix unexpected_load_success from test_progs for "bpf: Fall back to nospec for sanitization-failures" * use bpf-next as base commit Luis Gerhorst (9): bpf/arm64: Unset bypass_spec_v4() instead of ignoring BPF_NOSPEC bpf: Refactor do_check() if/else into do_check_insn()

Re: [PATCH bpf-next v3 11/11] bpf: Fall back to nospec for sanitization-failures

Kumar Kartikeya Dwivedi writes: (including relevant part from other message) > On Thu, 1 May 2025 at 04:00, Luis Gerhorst wrote: > >> +static bool error_recoverable_with_nospec(int err) >> +{ >> + /* Should only return true for non-fatal errors that are allowe

[PATCH bpf-next] selftests/bpf: Support ppc64el in vmtest

noble-ppc64el.tar.zst \ -- ./test_progs -t verifier_array_access Does not include a DENYLIST or support for KVM for now. [1] https://github.com/libbpf/ci Signed-off-by: Luis Gerhorst --- tools/testing/selftests/bpf/config.ppc64el | 93 ++ tools/testing/selftests/bpf/vmte

[PATCH bpf-next v4 0/9] bpf: Mitigate Spectre v1 using barriers

64: emit speculation barrier - powerpc: change nospec to include v1 barrier - discuss potential security (archs that do not impl. BPF nospec) and performance (only PowerPC) regressions - Link to RFC: https://lore.kernel.org/bpf/20250224203619.594724-1-luis.gerho...@fau.de/ Luis Gerhor

[PATCH bpf-next v4 2/9] bpf: Return -EFAULT on misconfigurations

seems that this change does not interfere with libbpf. [1] https://lore.kernel.org/all/785b4531ce3b44a84059a4feb4ba458c68fce719.ca...@gmail.com/ Signed-off-by: Luis Gerhorst Reviewed-by: Eduard Zingerman Acked-by: Kumar Kartikeya Dwivedi Acked-by: Henriette Herzog Cc: Maximilian Ott Cc: Milan St

[PATCH bpf-next v4 3/9] bpf: Return -EFAULT on internal errors

This prevents us from trying to recover from these on speculative paths in the future. Signed-off-by: Luis Gerhorst Reviewed-by: Eduard Zingerman Acked-by: Kumar Kartikeya Dwivedi Acked-by: Henriette Herzog Cc: Maximilian Ott Cc: Milan Stephan --- kernel/bpf/verifier.c | 6 +++--- 1 file

Re: [PATCH bpf-next v3 10/11] bpf: Allow nospec-protected var-offset stack access

Kumar Kartikeya Dwivedi writes: > Hmm, while reading related code, I noticed that sanitize_check_bounds > returns 0 in case the type is not map_value or stack. > It seems like it should be returning an error, cannot check right now > but I'm pretty sure these are not the two pointer types unprivi

[PATCH bpf-next v4 1/9] bpf: Move insn if/else into do_check_insn()

* "goto process_bpf_exit_full" with "return process_bpf_exit_full()" * "do_print_state = " with "*do_print_state = " [1] https://lore.kernel.org/all/293dbe3950a782b8eb3b87b71d7a967e120191fd.ca...@gmail.com/ Signed-off-by: Luis Gerhorst Acked-by: Kumar Kartikeya Dwivedi

[PATCH bpf-next v4 4/9] bpf, arm64, powerpc: Add bpf_jit_bypass_spec_v1/v4()

ec_v1() and _v4() according to commit a6f6a95f2580 ("LoongArch, bpf: Fix jit to skip speculation barrier opcode"). This is omitted here as I am unable to do any testing for LoongArch. Hari's ack concerns the PowerPC part only. Signed-off-by: Luis Gerhorst Acked-by: Hari Bathini Cc: Henrie

[PATCH bpf-next v4 5/9] bpf, arm64, powerpc: Change nospec to include v1 barrier

e are no unexpected conflicts between the insns when combined like this. Individual v1/v4 barriers were already emitted elsewhere. Hari's ack is for the PowerPC changes only. [1] https://gcc.gnu.org/git/?p=gcc.git;a=commit;h=29b74545531f6afbee9fc38c267524326dbfbedf ("MIPS: Add sp

[PATCH bpf-next v4 6/9] bpf: Rename sanitize_stack_spill to nospec_result

This is made to clarify that this flag will cause a nospec to be added after this insn and can therefore be relied upon to reduce speculative path analysis. Signed-off-by: Luis Gerhorst Acked-by: Kumar Kartikeya Dwivedi Cc: Henriette Herzog Cc: Maximilian Ott Cc: Milan Stephan --- include

[PATCH bpf-next v4 7/9] bpf: Fall back to nospec for Spectre v1

9.2.1 of Book III") [8] https://www.amd.com/content/dam/amd/en/documents/processor-tech-docs/programmer-references/40332.pdf ("AMD64 Architecture Programmer’s Manual Volumes 1–5 - Revision 4.08 - April 2024 - 7.6.4 Serializing Instructions") Signe

[PATCH bpf-next v4 8/9] selftests/bpf: Add test for Spectre v1 mitigation

This is based on the gadget from the description of commit 9183671af6db ("bpf: Fix leakage under speculation on mispredicted branches"). Signed-off-by: Luis Gerhorst Acked-by: Kumar Kartikeya Dwivedi --- .../selftests/bpf/progs/verifier_unpriv.c | 57 +++ 1 file c

[PATCH bpf-next v4 9/9] bpf: Fall back to nospec for sanitization-failures

alternative would be -EFAULT, which is also returned for some of the other cases where push_stack() fails, but this is more frequently used for verifier-internal bugs. Signed-off-by: Luis Gerhorst Acked-by: Kumar Kartikeya Dwivedi Acked-by: Henriette Herzog Cc: Maximilian Ott Cc: Milan Stephan

[PATCH bpf-next v3 0/2] bpf: Fix and test aux usage after do_check_insn()

to check instruction is BPF_JMP[32] as suggested by Eduard - RFC: https://lore.kernel.org/bpf/8734bmoemx....@fau.de/ Luis Gerhorst (2): bpf: Fix aux usage after do_check_insn() selftests/bpf: Add Spectre v4 tests kernel/bpf/verifier.c | 19 ++- tools/testing/selfte

[PATCH bpf-next v3 1/2] bpf: Fix aux usage after do_check_insn()

+dc27c5fb8388e38d2...@syzkaller.appspotmail.com Link: https://lore.kernel.org/bpf/685b3c1b.050a0220.2303ee.0010@google.com/ Link: https://lore.kernel.org/bpf/4266fd5de04092aa4971cbef14f1b4b96961f432.ca...@gmail.com/ Suggested-by: Eduard Zingerman Signed-off-by: Luis Gerhorst --- kernel/b

[PATCH bpf-next v3 2/2] selftests/bpf: Add Spectre v4 tests

nospec_result is only used after insns that increment insn_idx by 1 (i.e., stack writes). [1] https://lore.kernel.org/bpf/4266fd5de04092aa4971cbef14f1b4b96961f432.ca...@gmail.com/ [2] https://lore.kernel.org/bpf/685b3c1b.050a0220.2303ee.0010@google.com/ Signed-off-by: Luis Gerhorst

Re: [PATCH bpf-next v2 2/3] bpf: Fix aux usage after do_check_insn()

Eduard Zingerman writes: > On Sat, 2025-06-28 at 16:50 +0200, Luis Gerhorst wrote: > > [...] > >> @@ -19955,11 +19960,11 @@ static int do_check(struct bpf_verifier_env *env) >> /* Prevent this speculative path from ever reaching the >>

[PATCH bpf-next v2 1/3] bpf: Update env->prev_insn_idx after do_check_insn()

o be seen from the -O0 call graph for push_jmp_history() [1]. [1] https://sys.cs.fau.de/extern/person/gerhorst/25-06_d69baf_push_jmp_history_O0_callgraph.png Signed-off-by: Luis Gerhorst --- kernel/bpf/verifier.c | 12 ++-- 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/k

[PATCH bpf-next v2 0/3] bpf: Fix and test aux usage after do_check_insn()

Change WARN_ON_ONCE() to verifier_bug_if() as suggested by Alexei - Change assertion to check instruction is BPF_JMP[32] as suggested by Eduard - RFC: https://lore.kernel.org/bpf/8734bmoemx....@fau.de/ Luis Gerhorst (3): bpf: Update env->prev_insn_idx after do_check_insn() bpf: Fix au

[PATCH bpf-next v2 2/3] bpf: Fix aux usage after do_check_insn()

Paul Chaignon Reported-by: Eduard Zingerman Reported-by: syzbot+dc27c5fb8388e38d2...@syzkaller.appspotmail.com Link: https://lore.kernel.org/bpf/685b3c1b.050a0220.2303ee.0010@google.com/ Link: https://lore.kernel.org/bpf/4266fd5de04092aa4971cbef14f1b4b96961f432.ca...@gmail.com/ Signed-off-by:

[PATCH bpf-next v2 3/3] selftests/bpf: Add Spectre v4 tests

nospec_result is only used after insns that increment insn_idx by 1 (i.e., stack writes). [1] https://lore.kernel.org/bpf/4266fd5de04092aa4971cbef14f1b4b96961f432.ca...@gmail.com/ [2] https://lore.kernel.org/bpf/685b3c1b.050a0220.2303ee.0010@google.com/ Signed-off-by: Luis Gerhorst

[PATCH bpf-next 0/3] bpf: Fix and test aux usage after do_check_insn()

ernel.org/bpf/8734bmoemx....@fau.de/ Luis Gerhorst (3): bpf: Update env->prev_insn_idx after do_check_insn() bpf: Fix aux usage after do_check_insn() selftests/bpf: Add Spectre v4 tests kernel/bpf/verifier.c | 30 ++-- tools/testing/selftests/bpf/progs/bpf_misc.h | 4

[PATCH bpf-next 1/3] bpf: Update env->prev_insn_idx after do_check_insn()

o be seen from the -O0 call graph for push_jmp_history() [1]. [1] https://sys.cs.fau.de/extern/person/gerhorst/25-06_d69baf_push_jmp_history_O0_callgraph.png Signed-off-by: Luis Gerhorst --- kernel/bpf/verifier.c | 10 +- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/k

[PATCH bpf-next 2/3] bpf: Fix aux usage after do_check_insn()

Paul Chaignon Reported-by: Eduard Zingerman Reported-by: syzbot+dc27c5fb8388e38d2...@syzkaller.appspotmail.com Link: https://lore.kernel.org/bpf/685b3c1b.050a0220.2303ee.0010@google.com/ Link: https://lore.kernel.org/bpf/4266fd5de04092aa4971cbef14f1b4b96961f432.ca...@gmail.com/ Signed-off-by:

[PATCH bpf-next 3/3] selftests/bpf: Add Spectre v4 tests

nospec_result is only used after insns that increment insn_idx by 1 (i.e., stack writes). [1] https://lore.kernel.org/bpf/4266fd5de04092aa4971cbef14f1b4b96961f432.ca...@gmail.com/ [2] https://lore.kernel.org/bpf/685b3c1b.050a0220.2303ee.0010@google.com/ Signed-off-by: Luis Gerhorst