From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-dl1-f47.google.com (mail-dl1-f47.google.com [74.125.82.47]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id EA14D33A9DA for ; Mon, 9 Mar 2026 21:25:12 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=74.125.82.47 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1773091514; cv=none; b=Rx1JuODYM3tk7q5ZuxvMmuJo8j+mRnnWsdE4EeOcLjNr3wqnrxim7ZQ9ABm+i2N3iAFOSm+SyjQL9WrosG0VUKj3ye7whO+bY9q4sRhLK5I9ioHWr0HCQe2Wd2qPhSroAfWCBPHISdEIOfWR1bVURPlQJ1Nwv3G+DePy2TaEol8= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1773091514; c=relaxed/simple; bh=7ZX6FNqeVcm8OfkTYxBGEd3xk8t8pcMQCgcQXoRql6s=; h=Message-ID:Subject:From:To:Cc:Date:In-Reply-To:References: Content-Type:MIME-Version; b=dXDO0dkEUTHGSOIGwIfY9CrMqGxl6J52cHgcTfkY1gFywgE7+G/VCsVzuwsCuuyUyBZBFsb/4BHUddhI6JJto8RBbZAeLOWcF3wq29HllFy8zkv1SZhtSfOuC4SmgwVR8qCXrFlWjhCKcY+8OPAMBcJ9fFIzo5P3iQrYEHlppDc= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=HCqRnivk; arc=none smtp.client-ip=74.125.82.47 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="HCqRnivk" Received: by mail-dl1-f47.google.com with SMTP id a92af1059eb24-12732e6a123so3757300c88.1 for ; Mon, 09 Mar 2026 14:25:12 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1773091512; x=1773696312; darn=vger.kernel.org; h=mime-version:user-agent:content-transfer-encoding:references :in-reply-to:date:cc:to:from:subject:message-id:from:to:cc:subject :date:message-id:reply-to; bh=FAHsQdzzN+FG3XbYUMM1my4gp2tn4lNHzdIDSZZfH4o=; b=HCqRnivkfexdBtqWT7LyDLXXENqEHJQGKFZNt6iTSkGbFdCgJeSN5DCYJ+dAlNo6v1 SrOBtE0PlWYbiV0Zg9XEF2mmJLNCY/hz+2HuMcwUjo88qGmHWgsdK1OufautM5xODsA5 sp2Wv1u/K3ARamEGbJZWwo89SJqd9DLGxpsUc4Liik8aBYUJ3D5KYnPdfXtq6FZKJB1Z /6BCfkWzF69uRKuSDVQfaXkNUv7l/DMb3wQFWOUOe+YYvj6DR7Yu7/t3+Gn5L5T+CEq9 9ieoXUaAjsBlzQpVbjSUtRuu1VGNw1kaHQPAia7n6c3ZoXrIHffOQ7j8YTWIVL/QicyL BaZA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1773091512; x=1773696312; h=mime-version:user-agent:content-transfer-encoding:references :in-reply-to:date:cc:to:from:subject:message-id:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=FAHsQdzzN+FG3XbYUMM1my4gp2tn4lNHzdIDSZZfH4o=; b=rYKnrkHDhkO9cDgmQmm6vsUyza7Z5vCu2FS7bzcfiIowW/AlkXZpTB8lIKpeA3Gkqk 62FFB6xbnZgyunqmb2Tx71JbOZjb46/AoR7GnVwnnWAxzJeQeE4UuyhuoAg/TgBrQQCA VBnNVkw56DNWaYsT2SaKtMCNCRB8Qa3ObYAkwZLhcanpkVPfnaC4nzkOnkqB7JZyDfbc GTfP6MQg1b+t6f1LkpDPNQ2YC/za6GWoIm9SXl8LwsBAq9gql2lOykMOX0KEeWb7X0RR rIbTtphe7D5IstGFSR1x1jrNRsioF5iON+bqvQiFbM/NNfkoSE/pBdZPOnx07ewE5I1N HX5A== X-Forwarded-Encrypted: i=1; AJvYcCX1vk8iWhMTfHqH/lVXk++ZkvY96kF2r41/jqHj9KVJXuOxfjEXrNp6VXTDFAi40NhExC+kvMNK/JBtAxA=@vger.kernel.org X-Gm-Message-State: AOJu0YyjiEtLETde6y+NnVZyQNJJE35BqY6MlhNsGKFgT5SJLmd9Vm6h gNkzCp/3J8NbMfp79B0VvovXVaN2jkuX1qb6qqLcNe8+bQSOlo67rXPZ X-Gm-Gg: ATEYQzzDnytWr5ws++EDYD+pBAkorbIbtPGDv7fqmsyP994SX0QiRMauEfvhUDKtrws weyBf+IAwD3eg3f6Es44atdGHEImGE8GbOr4BaKGvZjbtcjqUlrMwPl0rEjteJ+o3xnIaXcakG8 +1rFL8VL+MNTdsem4YTf4QbplXotEfJzOqQd2R3qB6LLU7FeWXcfSK/V0Tgc2QOqVvB7ThG49na oREgCQeWEdWtFD1wDbT+FjM+ejXWxJIQCNtuYXHXeRA3cKRwP55Y/V/UyPZyy3hhZmq/WDCE7tw O+an+qiYhzrNH9sz8XkcnBe7BP3IfzV8niiYDcZ/ZO/j8NyKmjH+FhccxnPPyLmaBZjF7WvmhHs AndP9LafAmCNvWZA41b6tHwXyrLBOnhhEKTS7W0NSWNmu5G1fUUrGUML+2Qn5Ns8AANaoVsSXfV 8Lkffc4oSUsK2uYDnL60YnxLSaoUDeNDDnn6wZYhY1WB3z2JxbbOoPTN0UR6VAiRPWb2yf5+3tX dd1uqk= X-Received: by 2002:a05:7022:6620:b0:127:345c:439c with SMTP id a92af1059eb24-128c2eeaf9fmr5484444c88.45.1773091511897; Mon, 09 Mar 2026 14:25:11 -0700 (PDT) Received: from ?IPv6:2a03:83e0:115c:1:9362:b19:e25f:7640? ([2620:10d:c090:500::2:405f]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-2be7cdfc6c9sm349706eec.23.2026.03.09.14.25.08 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 09 Mar 2026 14:25:11 -0700 (PDT) Message-ID: <7905ed2d99a46a2f7a4eb41d4cb9f1dec108ecd3.camel@gmail.com> Subject: Re: [bpf-next v8 1/5] bpf: Move constants blinding from JIT to verifier From: Eduard Zingerman To: Xu Kuohai , bpf@vger.kernel.org, linux-kernel@vger.kernel.org, linux-arm-kernel@lists.infradead.org Cc: Alexei Starovoitov , Daniel Borkmann , Andrii Nakryiko , Martin KaFai Lau , Yonghong Song , Puranjay Mohan , Anton Protopopov , Shahab Vahedi , Russell King , Tiezhu Yang , Hengqi Chen , Johan Almbladh , Paul Burton , Hari Bathini , Christophe Leroy , Naveen N Rao , Luke Nelson , Xi Wang , =?ISO-8859-1?Q?Bj=F6rn_T=F6pel?= , Pu Lehui , Ilya Leoshkevich , Heiko Carstens , Vasily Gorbik , "David S . Miller" , Wang YanQing Date: Mon, 09 Mar 2026 14:25:07 -0700 In-Reply-To: <20260309140044.2652538-2-xukuohai@huaweicloud.com> References: <20260309140044.2652538-1-xukuohai@huaweicloud.com> <20260309140044.2652538-2-xukuohai@huaweicloud.com> Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable User-Agent: Evolution 3.58.2 (3.58.2-1.fc43) Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 On Mon, 2026-03-09 at 22:00 +0800, Xu Kuohai wrote: This was discussed some time ago in [1]. In that message Daniel notes the following: > constant blinding needs to work from native bpf(2) as well as from > cbpf->ebpf (seccomp-bpf, filters, etc) It appears this patch does not address the cbpf->ebpf part, or did I miss something? [1] https://lore.kernel.org/bpf/284404c7-c6e0-4cf9-8ada-71ebfc681541@iogear= box.net/ [...] > diff --git a/arch/powerpc/net/bpf_jit_comp.c b/arch/powerpc/net/bpf_jit_c= omp.c > index 52162e4a7f84..7a7c49640a2f 100644 > --- a/arch/powerpc/net/bpf_jit_comp.c > +++ b/arch/powerpc/net/bpf_jit_comp.c [...] > @@ -272,7 +250,6 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog = *fp) > extra_pass)) { > bpf_arch_text_copy(&fhdr->size, &hdr->size, sizeof(hdr->size)); > bpf_jit_binary_pack_free(fhdr, hdr); > - fp =3D org_fp; Is it necessary to set `...; fp->jited =3D 0; ...` here? It seems it does if extra_pass is set. > goto out_addrs; > } > bpf_jit_build_epilogue(code_base, &cgctx); > @@ -301,7 +278,9 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog = *fp) > =20 > if (!fp->is_func || extra_pass) { > if (bpf_jit_binary_pack_finalize(fhdr, hdr)) { > - fp =3D org_fp; > + fp->bpf_func =3D NULL; > + fp->jited =3D 0; > + fp->jited_len =3D 0; > goto out_addrs; > } > bpf_prog_fill_jited_linfo(fp, addrs); [...] > diff --git a/arch/s390/net/bpf_jit_comp.c b/arch/s390/net/bpf_jit_comp.c > index 1f9a6b728beb..d6de2abfe4a7 100644 > --- a/arch/s390/net/bpf_jit_comp.c > +++ b/arch/s390/net/bpf_jit_comp.c [...] > @@ -2383,7 +2360,6 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_pro= g *fp) > if (!fp->is_func || extra_pass) { > if (bpf_jit_binary_lock_ro(header)) { > bpf_jit_binary_free(header); > - fp =3D orig_fp; In the similar condition for powerpc you reset `...; prog->jited =3D 0; ...= `, is this case different? > goto free_addrs; > } > } else { [...]