Re: [PATCH bpf-next v3 11/11] bpf: Fall back to nospec for sanitization-failures

Kumar Kartikeya Dwivedi writes: (including relevant part from other message) > On Thu, 1 May 2025 at 04:00, Luis Gerhorst wrote: > >> +static bool error_recoverable_with_nospec(int err) >> +{ >> + /* Should only return true for non-fatal errors that are allowe

Re: [PATCH bpf-next v3 02/11] bpf: Move insn if/else into do_check_insn()

Eduard Zingerman writes: > On Thu, 2025-05-01 at 09:35 +0200, Luis Gerhorst wrote: > >> +dst_reg_type = cur_regs(env)[insn->dst_reg].type; > > Implicitly relying on `insn == &env->prog->insnsi[env->cur_idx]` > is weird. Still think that `

Re: [PATCH bpf-next v3 08/11] bpf: Fall back to nospec for Spectre v1

Kumar Kartikeya Dwivedi writes: > Back when all of this surfaced, compiler folks came up with another > solution, to rely on Intel's guarantee that conditional moves are not > predicted. > > if (condition) { >mask = !condition ? 0UL : ~0UL; // CMOVcc >ptr &= mask; >x = *ptr; > } > > I

[PATCH bpf-next v3 07/11] bpf: Rename sanitize_stack_spill to nospec_result

This is made to clarify that this flag will cause a nospec to be added after this insn and can therefore be relied upon to reduce speculative path analysis. Signed-off-by: Luis Gerhorst Cc: Henriette Herzog Cc: Maximilian Ott Cc: Milan Stephan --- include/linux/bpf_verifier.h | 2 +- kernel

[PATCH bpf-next v3 10/11] bpf: Allow nospec-protected var-offset stack access

/overwrites pointers on the BPF stack, they are already a problem for fixed-offset stack accesses and should be subject to Spectre v4 sanitization. Signed-off-by: Luis Gerhorst Acked-by: Henriette Herzog Cc: Maximilian Ott Cc: Milan Stephan --- kernel/bpf/verifier.c | 24 1 file

[PATCH bpf-next v3 11/11] bpf: Fall back to nospec for sanitization-failures

alternative would be -EFAULT, which is also returned for some of the other cases where push_stack() fails, but this is more frequently used for verifier-internal bugs. Signed-off-by: Luis Gerhorst Acked-by: Henriette Herzog Cc: Maximilian Ott Cc: Milan Stephan --- kernel/bpf/verifier.c

[PATCH bpf-next v3 09/11] selftests/bpf: Add test for Spectre v1 mitigation

This is based on the gadget from the description of commit 9183671af6db ("bpf: Fix leakage under speculation on mispredicted branches"). Signed-off-by: Luis Gerhorst --- .../selftests/bpf/progs/verifier_unpriv.c | 57 +++ 1 file changed, 57 insertions(+) diff --g

[PATCH bpf-next v3 08/11] bpf: Fall back to nospec for Spectre v1

F") [2] https://arxiv.org/pdf/2405.00078 ("VeriFence: Lightweight and Precise Spectre Defenses for Untrusted Linux Kernel Extensions") [3] https://www.intel.com/content/www/us/en/developer/articles/technical/software-security-guidance/technical-documentation/runtime-speculative-

[PATCH bpf-next v3 06/11] bpf, arm64, powerpc: Change nospec to include v1 barrier

unexpected conflicts between the insns when combined like this. Individual v1/v4 barriers were already emitted elsewhere. [1] https://gcc.gnu.org/git/?p=gcc.git;a=commit;h=29b74545531f6afbee9fc38c267524326dbfbedf ("MIPS: Add speculation_barrier support") [2] https://githu

[PATCH bpf-next v3 05/11] bpf, arm64, powerpc: Add bpf_jit_bypass_spec_v1/v4()

ec_v1() and _v4() according to commit a6f6a95f2580 ("LoongArch, bpf: Fix jit to skip speculation barrier opcode"). This is omitted here as I am unable to do any testing for LoongArch. Signed-off-by: Luis Gerhorst Cc: Henriette Herzog Cc: Maximilian Ott Cc: Milan Stephan --- arch/arm64/ne

[PATCH bpf-next v3 04/11] bpf: Return -EFAULT on internal errors

This prevents us from trying to recover from these on speculative paths in the future. Signed-off-by: Luis Gerhorst Reviewed-by: Eduard Zingerman Acked-by: Henriette Herzog Cc: Maximilian Ott Cc: Milan Stephan --- kernel/bpf/verifier.c | 6 +++--- 1 file changed, 3 insertions(+), 3

[PATCH bpf-next v3 03/11] bpf: Return -EFAULT on misconfigurations

seems that this change does not interfere with libbpf. [1] https://lore.kernel.org/all/785b4531ce3b44a84059a4feb4ba458c68fce719.ca...@gmail.com/ Signed-off-by: Luis Gerhorst Reviewed-by: Eduard Zingerman Acked-by: Henriette Herzog Cc: Maximilian Ott Cc: Milan Stephan --- kernel/bpf/verifier.c

[PATCH bpf-next v3 02/11] bpf: Move insn if/else into do_check_insn()

do_print_state = " with "*do_print_state = " [1] https://lore.kernel.org/all/293dbe3950a782b8eb3b87b71d7a967e120191fd.ca...@gmail.com/ Signed-off-by: Luis Gerhorst Acked-by: Henriette Herzog Cc: Maximilian Ott Cc: Milan Stephan --- kernel/bpf/verifier.c | 426 +++

[PATCH bpf-next v3 01/11] selftests/bpf: Fix caps for __xlated/jited_unpriv

check whether a speculation barrier was inserted in the correct location. Signed-off-by: Luis Gerhorst Fixes: 9c9f73391310 ("selftests/bpf: allow checking xlated programs in verifier_* tests") Fixes: 7d743e4c759c ("selftests/bpf: __jited test tag to check disassembly after jit"

[PATCH bpf-next v3 00/11] bpf: Mitigate Spectre v1 using barriers

to include v1 barrier - discuss potential security (archs that do not impl. BPF nospec) and performance (only PowerPC) regressions - Link to RFC: https://lore.kernel.org/bpf/20250224203619.594724-1-luis.gerho...@fau.de/ Luis Gerhorst (11): selftests/bpf: Fix caps for __xlated/jited_

Re: [PATCH bpf-next v2 06/11] bpf, arm64, powerpc: Change nospec to include v1 barrier

kernel test robot writes: > All errors (new ones prefixed by >>): > >arch/powerpc/net/bpf_jit_comp64.c: In function 'bpf_jit_build_body': >>> arch/powerpc/net/bpf_jit_comp64.c:814:4: error: a label can only be part of >>> a statement and a declaration is not a statement > 814 |bool

Re: [PATCH bpf-next v2 05/11] bpf, arm64, powerpc: Add bpf_jit_bypass_spec_v1/v4()

kernel test robot writes: > All warnings (new ones prefixed by >>): > >>> kernel/bpf/core.c:3037:13: warning: no previous prototype for >>> 'bpf_jit_bypass_spec_v1' [-Wmissing-prototypes] > 3037 | bool __weak bpf_jit_bypass_spec_v1(void) > | ^~ >>> ke

[PATCH bpf-next v2 11/11] bpf: Fall back to nospec for sanitization-failures

alternative would be -EFAULT, which is also returned for some of the other cases where push_stack() fails, but this is more frequently used for verifier-internal bugs. Signed-off-by: Luis Gerhorst Acked-by: Henriette Herzog Cc: Maximilian Ott Cc: Milan Stephan --- kernel/bpf/verifier.c

[PATCH bpf-next v2 07/11] bpf: Rename sanitize_stack_spill to nospec_result

This is made to clarify that this flag will cause a nospec to be added after this insn and can therefore be relied upon to reduce speculative path analysis. Signed-off-by: Luis Gerhorst Cc: Henriette Herzog Cc: Maximilian Ott Cc: Milan Stephan --- include/linux/bpf_verifier.h | 2 +- kernel

[PATCH bpf-next v2 10/11] bpf: Allow nospec-protected var-offset stack access

/overwrites pointers on the BPF stack, they are already a problem for fixed-offset stack accesses and should be subject to Spectre v4 sanitization. Signed-off-by: Luis Gerhorst Acked-by: Henriette Herzog Cc: Maximilian Ott Cc: Milan Stephan --- kernel/bpf/verifier.c | 24 1 file

[PATCH bpf-next v2 09/11] selftests/bpf: Add test for Spectre v1 mitigation

This is based on the gadget from the description of commit 9183671af6db ("bpf: Fix leakage under speculation on mispredicted branches"). Signed-off-by: Luis Gerhorst --- .../selftests/bpf/progs/verifier_unpriv.c | 57 +++ 1 file changed, 57 insertions(+) diff --g

[PATCH bpf-next v2 08/11] bpf: Fall back to nospec for Spectre v1

F") [2] https://arxiv.org/pdf/2405.00078 ("VeriFence: Lightweight and Precise Spectre Defenses for Untrusted Linux Kernel Extensions") [3] https://www.intel.com/content/www/us/en/developer/articles/technical/software-security-guidance/technical-documentation/runtime-speculative-

[PATCH bpf-next v2 06/11] bpf, arm64, powerpc: Change nospec to include v1 barrier

unexpected conflicts between the insns when combined like this. Individual v1/v4 barriers were already emitted elsewhere. [1] https://gcc.gnu.org/git/?p=gcc.git;a=commit;h=29b74545531f6afbee9fc38c267524326dbfbedf ("MIPS: Add speculation_barrier support") [2] https://githu

[PATCH bpf-next v2 05/11] bpf, arm64, powerpc: Add bpf_jit_bypass_spec_v1/v4()

ec_v1() and _v4() according to commit a6f6a95f2580 ("LoongArch, bpf: Fix jit to skip speculation barrier opcode"). This is omitted here as I am unable to do any testing for LoongArch. Signed-off-by: Luis Gerhorst Cc: Henriette Herzog Cc: Maximilian Ott Cc: Milan Stephan --- arch/arm64/ne

[PATCH bpf-next v2 04/11] bpf: Return -EFAULT on internal errors

This prevents us from trying to recover from these on speculative paths in the future. Signed-off-by: Luis Gerhorst Reviewed-by: Eduard Zingerman Acked-by: Henriette Herzog Cc: Maximilian Ott Cc: Milan Stephan --- kernel/bpf/verifier.c | 6 +++--- 1 file changed, 3 insertions(+), 3

[PATCH bpf-next v2 03/11] bpf: Return -EFAULT on misconfigurations

seems that this change does not interfere with libbpf. [1] https://lore.kernel.org/all/785b4531ce3b44a84059a4feb4ba458c68fce719.ca...@gmail.com/ Signed-off-by: Luis Gerhorst Reviewed-by: Eduard Zingerman Acked-by: Henriette Herzog Cc: Maximilian Ott Cc: Milan Stephan --- kernel/bpf/verifier.c

[PATCH bpf-next v2 00/11] bpf: Mitigate Spectre v1 using barriers

l security (archs that do not impl. BPF nospec) and performance (only PowerPC) regressions - Linkt to RFC: https://lore.kernel.org/bpf/20250224203619.594724-1-luis.gerho...@fau.de/ Luis Gerhorst (11): selftests/bpf: Fix caps for __xlated/jited_unpriv bpf: Move insn if/else into do_check_insn() bpf: Ret

[PATCH bpf-next v2 02/11] bpf: Move insn if/else into do_check_insn()

do_print_state = " with "*do_print_state = " [1] https://lore.kernel.org/all/293dbe3950a782b8eb3b87b71d7a967e120191fd.ca...@gmail.com/ Signed-off-by: Luis Gerhorst Acked-by: Henriette Herzog Cc: Maximilian Ott Cc: Milan Stephan --- kernel/bpf/verifier.c | 425 +++

[PATCH bpf-next v2 01/11] selftests/bpf: Fix caps for __xlated/jited_unpriv

check whether a speculation barrier was inserted in the correct location. Signed-off-by: Luis Gerhorst Fixes: 9c9f73391310 ("selftests/bpf: allow checking xlated programs in verifier_* tests") Fixes: 7d743e4c759c ("selftests/bpf: __jited test tag to check disassembly after jit"

Re: [PATCH bpf-next 11/11] bpf: Fall back to nospec for spec path verification

Alexei Starovoitov writes: > On Thu, Mar 13, 2025 at 10:57 AM Luis Gerhorst wrote: >> With increased limits this allows applying mitigations to large BPF >> progs such as the Parca Continuous Profiler's prog. However, this >> requires a jump-seq limit of 256k. In an

Re: [PATCH bpf-next 09/11] bpf: Return PTR_ERR from push_stack()

Eduard Zingerman writes: > Could you please point me to a location, where exact error code > returned by updated push_stack() matters? > I checked push_stack() callgraph (in the attachment), but can't find > anything. Only with the final patch 11 ("bpf: Fall back to nospec for spec path verifica

Re: [PATCH bpf-next 00/11] bpf: Mitigate Spectre v1 using barriers

Eduard Zingerman writes: > I think it would be good to have some tests checking that nospec > instructions are inserted in expected locations. > Could you please take look at use of __xlated tag in e.g. > tools/testing/selftests/bpf/progs/verifier_sdiv.c ? That looks very promising, I will look i

Re: [PATCH bpf-next 01/11] bpf: Move insn if/else into do_check_insn()

Eduard Zingerman writes: > On Thu, 2025-03-13 at 18:21 +0100, Luis Gerhorst wrote: >> +err = do_check_insn(env, insn, pop_log, &do_print_state, regs, >> state, >> +&prev_insn_idx); > > - `regs` remains declared in

[PATCH bpf-next 11/11] bpf: Fall back to nospec for spec path verification

") Signed-off-by: Luis Gerhorst Acked-by: Henriette Herzog Cc: Maximilian Ott Cc: Milan Stephan --- kernel/bpf/verifier.c | 14 ++ 1 file changed, 14 insertions(+) diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c index 03af82f52a02..49c7e2608ccd 100644 --- a/kernel

[PATCH bpf-next 10/11] bpf: Fall back to nospec for sanitization-failures

back to nospec directly for the remaining sanitization errs even if we are not on a speculative path. Signed-off-by: Luis Gerhorst Acked-by: Henriette Herzog Cc: Maximilian Ott Cc: Milan Stephan --- kernel/bpf/verifier.c | 85 ++- .../selftests/bpf/progs

[PATCH bpf-next 07/11] bpf: Fall back to nospec for Spectre v1

efenses for Untrusted Linux Kernel Extensions") Signed-off-by: Luis Gerhorst Acked-by: Henriette Herzog Cc: Maximilian Ott Cc: Milan Stephan --- include/linux/bpf_verifier.h | 1 + kernel/bpf/verifier.c | 68 +-- .../selftests/bpf/prog

[PATCH bpf-next 04/11] bpf, arm64, powerpc: Add bpf_jit_bypass_spec_v1/v4()

ec_v1() and _v4() according to commit a6f6a95f2580 ("LoongArch, bpf: Fix jit to skip speculation barrier opcode"). This is omitted here as I am unable to do any testing for LoongArch. Signed-off-by: Luis Gerhorst Cc: Henriette Herzog Cc: Maximilian Ott Cc: Milan Stephan --- arch/arm64/ne

[PATCH bpf-next 06/11] bpf: Rename sanitize_stack_spill to nospec_result

This is made to clarify that this flag will cause a nospec to be added after this insn and can therefore be relied upon to reduce speculative path analysis. Signed-off-by: Luis Gerhorst Cc: Henriette Herzog Cc: Maximilian Ott Cc: Milan Stephan --- include/linux/bpf_verifier.h | 2 +- kernel

[PATCH bpf-next 09/11] bpf: Return PTR_ERR from push_stack()

Main reason is, that it will later allow us to fall back to a nospec for certain errors in push_stack(). This changes the sanitization-case to returning -ENOMEM. However, this is more fitting as -EFAULT would indicate a verifier-internal bug. Signed-off-by: Luis Gerhorst Acked-by: Henriette

[PATCH bpf-next 05/11] bpf, arm64, powerpc: Change nospec to include v1 barrier

unexpected conflicts between the insns when combined like this. Individual v1/v4 barriers were already emitted elsewhere. [1] https://gcc.gnu.org/git/?p=gcc.git;a=commit;h=29b74545531f6afbee9fc38c267524326dbfbedf ("MIPS: Add speculation_barrier support") [2] https://github.com/kerne

[PATCH bpf-next 08/11] bpf: Allow nospec-protected var-offset stack access

Insert a nospec before the access to prevent it from ever using an index that is subject to speculative scalar-confusion. Signed-off-by: Luis Gerhorst Acked-by: Henriette Herzog Cc: Maximilian Ott Cc: Milan Stephan --- kernel/bpf/verifier.c | 24 1 file changed, 12

[PATCH bpf-next 03/11] bpf: Return -EFAULT on internal errors

This prevents us from trying to recover from these on speculative paths in the future. Signed-off-by: Luis Gerhorst Acked-by: Henriette Herzog Cc: Maximilian Ott Cc: Milan Stephan --- kernel/bpf/verifier.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/kernel/bpf

[PATCH bpf-next 01/11] bpf: Move insn if/else into do_check_insn()

ate = " with "*do_print_state = " Signed-off-by: Luis Gerhorst Acked-by: Henriette Herzog Cc: Maximilian Ott Cc: Milan Stephan --- kernel/bpf/verifier.c | 426 ++ 1 file changed, 224 insertions(+), 202 deletions(-) diff --git a/kern

[PATCH bpf-next 02/11] bpf: Return -EFAULT on misconfigurations

Mark these cases as non-recoverable to later prevent them from being cought when they occur during speculative path verification. Signed-off-by: Luis Gerhorst Acked-by: Henriette Herzog Cc: Maximilian Ott Cc: Milan Stephan --- kernel/bpf/verifier.c | 36

[PATCH bpf-next 00/11] bpf: Mitigate Spectre v1 using barriers

F nospec) and performance (only PowerPC) regressions RFC: https://lore.kernel.org/bpf/20250224203619.594724-1-luis.gerho...@fau.de/ Luis Gerhorst (11): bpf: Move insn if/else into do_check_insn() bpf: Return -EFAULT on misconfigurations bpf: Return -EFAULT on internal errors bpf, arm64, pow