[PATCH 0/2] powerpc64/bpf: Fix PCREL build breaks

[PATCH 0/2] powerpc64/bpf: Fix PCREL build breaks

[Saket Kumar Bhaskar]

This series fixes two build failures that occur when
CONFIG_PPC_KERNEL_PCREL is enabled on powerpc64.

Patch 1 fixes an unused variable warning in bpf_jit_emit_func_call_rel()
by marking the variable as __maybe_unused, since it's only used in the
non-PCREL code path.

Patch 2 fixes a linker error in arch_bpf_timed_may_goto() by using the
CFUNC() macro for external C function calls. The macro properly handles
the @notoc annotation required for PCREL builds, informing the linker
that TOC restoration is not needed.

Both issues were introduced by commit b55b6b9ad76c ("powerpc64/bpf: Add
powerpc64 JIT support for timed may_goto").

Madhavan Srinivasan (1):
  powerpc64/bpf: Fix build break in bpf_jit_emit_func_call_rel()

Saket Kumar Bhaskar (1):
  powerpc64/bpf: Fix build break for arch_bpf_timed_may_goto

 arch/powerpc/net/bpf_jit_comp64.c     | 2 +-
 arch/powerpc/net/bpf_timed_may_goto.S | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

-- 
2.54.0

[PATCH 1/2] powerpc64/bpf: Fix build break in bpf_jit_emit_func_call_rel()

[Saket Kumar Bhaskar]

From: Madhavan Srinivasan <maddy@linux.ibm.com>

With CONFIG_PPC_KERNEL_PCREL enabled, build breaks with below error:

  CC      mm/dmapool.o
  CC      fs/readdir.o
arch/powerpc/net/bpf_jit_comp64.c: In function 'bpf_jit_emit_func_call_rel':
arch/powerpc/net/bpf_jit_comp64.c:475:13: error: unused variable 'ret' [-Werror=unused-variable]
  475 |         int ret;
      |             ^~~

commit b55b6b9ad76c ("powerpc64/bpf: Add powerpc64 JIT support for timed may_goto")
introduced "ret" variable to bpf_jit_emit_func_call_rel() and it is used only in
else block of CONFIG_PPC_KERNEL_PCREL, fix by adding a "__maybe_unused"

Fixes: b55b6b9ad76c ("powerpc64/bpf: Add powerpc64 JIT support for timed may_goto")
Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com>
Signed-off-by: Saket Kumar Bhaskar <skb99@linux.ibm.com>
---
 arch/powerpc/net/bpf_jit_comp64.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/powerpc/net/bpf_jit_comp64.c b/arch/powerpc/net/bpf_jit_comp64.c
index dab106cae22b..63952ef19256 100644
--- a/arch/powerpc/net/bpf_jit_comp64.c
+++ b/arch/powerpc/net/bpf_jit_comp64.c
@@ -472,7 +472,7 @@ int bpf_jit_emit_func_call_rel(u32 *image, u32 *fimage, struct codegen_context *
 {
 	unsigned long func_addr = func ? ppc_function_entry((void *)func) : 0;
 	long __maybe_unused reladdr;
-	int ret;
+	int __maybe_unused ret;
 
 	/* bpf to bpf call, func is not known in the initial pass. Emit 5 nops as a placeholder */
 	if (!func) {
-- 
2.54.0

Re: [PATCH 1/2] powerpc64/bpf: Fix build break in bpf_jit_emit_func_call_rel()

[Christophe Leroy (CS GROUP)]

Le 29/07/2026 à 18:03, Saket Kumar Bhaskar a écrit :
> From: Madhavan Srinivasan <maddy@linux.ibm.com>
> 
> With CONFIG_PPC_KERNEL_PCREL enabled, build breaks with below error:
> 
>    CC      mm/dmapool.o
>    CC      fs/readdir.o
> arch/powerpc/net/bpf_jit_comp64.c: In function 'bpf_jit_emit_func_call_rel':
> arch/powerpc/net/bpf_jit_comp64.c:475:13: error: unused variable 'ret' [-Werror=unused-variable]
>    475 |         int ret;
>        |             ^~~
> 
> commit b55b6b9ad76c ("powerpc64/bpf: Add powerpc64 JIT support for timed may_goto")
> introduced "ret" variable to bpf_jit_emit_func_call_rel() and it is used only in
> else block of CONFIG_PPC_KERNEL_PCREL, fix by adding a "__maybe_unused"

__maybe_unused doesn't fix the problem, it just hides it under the carpet.

ret is used at only one place, move it's declaration their:

#else
	if (core_kernel_text(func_addr)) {
		int ret = bpf_jit_emit_func_call(image, ctx, func_addr, _R12);
		if (ret)
			return ret;
	} else {

> 
> Fixes: b55b6b9ad76c ("powerpc64/bpf: Add powerpc64 JIT support for timed may_goto")
> Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com>
> Signed-off-by: Saket Kumar Bhaskar <skb99@linux.ibm.com>
> ---
>   arch/powerpc/net/bpf_jit_comp64.c | 2 +-
>   1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/arch/powerpc/net/bpf_jit_comp64.c b/arch/powerpc/net/bpf_jit_comp64.c
> index dab106cae22b..63952ef19256 100644
> --- a/arch/powerpc/net/bpf_jit_comp64.c
> +++ b/arch/powerpc/net/bpf_jit_comp64.c
> @@ -472,7 +472,7 @@ int bpf_jit_emit_func_call_rel(u32 *image, u32 *fimage, struct codegen_context *
>   {
>   	unsigned long func_addr = func ? ppc_function_entry((void *)func) : 0;
>   	long __maybe_unused reladdr;
> -	int ret;
> +	int __maybe_unused ret;
>   
>   	/* bpf to bpf call, func is not known in the initial pass. Emit 5 nops as a placeholder */
>   	if (!func) {

[PATCH 2/2] powerpc64/bpf: Fix build break for arch_bpf_timed_may_goto

[Saket Kumar Bhaskar]

With CONFIG_PPC_KERNEL_PCREL enabled, calling bpf_check_timed_may_goto()
using a bl instruction results in a link-time failure:

arch/powerpc/net/bpf_timed_may_goto.o: in function `arch_bpf_timed_may_goto':
(.text+0x28): call to `bpf_check_timed_may_goto' lacks nop, can't restore toc

Use CFUNC() macro instead of direct 'bl' to properly annotate the call
to bpf_check_timed_may_goto(). On PCREL builds, CFUNC() expands to
'bl name@notoc', informing the linker that TOC restoration is not
needed, avoiding the "lacks nop, can't restore toc" linker error.

Fixes: b55b6b9ad76c ("powerpc64/bpf: Add powerpc64 JIT support for timed may_goto")
Signed-off-by: Saket Kumar Bhaskar <skb99@linux.ibm.com>
---
 arch/powerpc/net/bpf_timed_may_goto.S | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/powerpc/net/bpf_timed_may_goto.S b/arch/powerpc/net/bpf_timed_may_goto.S
index 6fd8b1c9f4ac..84ecf6fa7f5d 100644
--- a/arch/powerpc/net/bpf_timed_may_goto.S
+++ b/arch/powerpc/net/bpf_timed_may_goto.S
@@ -36,7 +36,7 @@ SYM_FUNC_START(arch_bpf_timed_may_goto)
 	 * BPF_REG_FP is r31; BPF_REG_AX is r12 (stack offset in bytes).
 	 */
 	add     r3, r31, r12
-	bl      bpf_check_timed_may_goto
+	bl      CFUNC(bpf_check_timed_may_goto)
 
 	/* Put return value back into AX */
 	mr      r12, r3
-- 
2.54.0

Re: [PATCH 2/2] powerpc64/bpf: Fix build break for arch_bpf_timed_may_goto

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [Critical] The assembly trampoline `arch_bpf_timed_may_goto` saves BPF registers in the callee's parameter save area, exposing them to silent corruption by the C function `bpf_check_timed_may_goto`.
--

--- Patch [2]: [PATCH 2/2] powerpc64/bpf: Fix build break for arch_bpf_timed_may_goto ---
commit 991cd0fd25b432c448bce574ccb7dc7d8af6d3a2
Author: Saket Kumar Bhaskar <skb99@linux.ibm.com>

powerpc64/bpf: Fix build break for arch_bpf_timed_may_goto

With CONFIG_PPC_KERNEL_PCREL enabled, calling bpf_check_timed_may_goto()
using a bl instruction results in a link-time failure. This commit replaces
the direct 'bl' call with the CFUNC() macro to properly annotate the call,
avoiding the TOC restoration linker error.

> diff --git a/arch/powerpc/net/bpf_timed_may_goto.S b/arch/powerpc/net/bpf_timed_may_goto.S
> index 6fd8b1c9f4ac8..84ecf6fa7f5dc 100644
> --- a/arch/powerpc/net/bpf_timed_may_goto.S
> +++ b/arch/powerpc/net/bpf_timed_may_goto.S
> @@ -36,7 +36,7 @@ SYM_FUNC_START(arch_bpf_timed_may_goto)
>  	 * BPF_REG_FP is r31; BPF_REG_AX is r12 (stack offset in bytes).
>  	 */
>  	add     r3, r31, r12
> -	bl      bpf_check_timed_may_goto
> +	bl      CFUNC(bpf_check_timed_may_goto)

[Severity: Critical]
This is a pre-existing issue, but does this function corrupt the saved BPF
registers by placing them in the callee's parameter save area?

In arch_bpf_timed_may_goto, the stack frame is allocated with 112 bytes, and
the BPF registers are saved from offsets 32(r1) to 72(r1):

    stdu    r1, -112(r1)
    ...
    std     r3, 32(r1)
    ...
    std     r8, 72(r1)

According to the PowerPC64 ELF ABI, offsets 32(r1) to 95(r1) in the caller's
frame are the parameter save area reserved for the callee.

When we call the C function bpf_check_timed_may_goto(), the compiler is
allowed to use this parameter save area (e.g., to spill the 'p' argument
when it calls ktime_get_mono_fast_ns()). If it does, it will silently
overwrite the saved BPF registers.

Upon return from bpf_check_timed_may_goto(), arch_bpf_timed_may_goto
restores these registers, which could now hold corrupted values:

    ld      r3, 32(r1)
    ...
    ld      r8, 72(r1)

Could this lead to silent data corruption or panics during BPF program
execution?

>  
>  	/* Put return value back into AX */
>  	mr      r12, r3

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/cover.1785339155.git.skb99@linux.ibm.com?part=2

Re: [PATCH 2/2] powerpc64/bpf: Fix build break for arch_bpf_timed_may_goto

[Christophe Leroy (CS GROUP)]

Le 29/07/2026 à 18:03, Saket Kumar Bhaskar a écrit :
> With CONFIG_PPC_KERNEL_PCREL enabled, calling bpf_check_timed_may_goto()
> using a bl instruction results in a link-time failure:
> 
> arch/powerpc/net/bpf_timed_may_goto.o: in function `arch_bpf_timed_may_goto':
> (.text+0x28): call to `bpf_check_timed_may_goto' lacks nop, can't restore toc
> 
> Use CFUNC() macro instead of direct 'bl' to properly annotate the call
> to bpf_check_timed_may_goto(). On PCREL builds, CFUNC() expands to
> 'bl name@notoc', informing the linker that TOC restoration is not
> needed, avoiding the "lacks nop, can't restore toc" linker error.
> 
> Fixes: b55b6b9ad76c ("powerpc64/bpf: Add powerpc64 JIT support for timed may_goto")
> Signed-off-by: Saket Kumar Bhaskar <skb99@linux.ibm.com>

Reviewed-by: Christophe Leroy (CS GROUP) <chleroy@kernel.org>

> ---
>   arch/powerpc/net/bpf_timed_may_goto.S | 2 +-
>   1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/arch/powerpc/net/bpf_timed_may_goto.S b/arch/powerpc/net/bpf_timed_may_goto.S
> index 6fd8b1c9f4ac..84ecf6fa7f5d 100644
> --- a/arch/powerpc/net/bpf_timed_may_goto.S
> +++ b/arch/powerpc/net/bpf_timed_may_goto.S
> @@ -36,7 +36,7 @@ SYM_FUNC_START(arch_bpf_timed_may_goto)
>   	 * BPF_REG_FP is r31; BPF_REG_AX is r12 (stack offset in bytes).
>   	 */
>   	add     r3, r31, r12
> -	bl      bpf_check_timed_may_goto
> +	bl      CFUNC(bpf_check_timed_may_goto)
>   
>   	/* Put return value back into AX */
>   	mr      r12, r3