netdev - Re: [PATCH bpf-next v2] bpf, x86, arm64: enable jit by default when not built as always-on

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Wed, 11 Dec 2019 16:49:30 -0800
From:   Alexei Starovoitov <alexei.starovoitov@...il.com>
To:     Martin Lau <kafai@...com>
Cc:     Daniel Borkmann <daniel@...earbox.net>,
        "ast@...nel.org" <ast@...nel.org>,
        "netdev@...r.kernel.org" <netdev@...r.kernel.org>,
        "bpf@...r.kernel.org" <bpf@...r.kernel.org>,
        "will@...nel.org" <will@...nel.org>
Subject: Re: [PATCH bpf-next v2] bpf, x86, arm64: enable jit by default when
 not built as always-on

On Mon, Dec 9, 2019 at 9:07 AM Martin Lau <kafai@...com> wrote:
>
> On Mon, Dec 09, 2019 at 04:08:03PM +0100, Daniel Borkmann wrote:
> > After Spectre 2 fix via 290af86629b2 ("bpf: introduce BPF_JIT_ALWAYS_ON
> > config") most major distros use BPF_JIT_ALWAYS_ON configuration these days
> > which compiles out the BPF interpreter entirely and always enables the
> > JIT. Also given recent fix in e1608f3fa857 ("bpf: Avoid setting bpf insns
> > pages read-only when prog is jited"), we additionally avoid fragmenting
> > the direct map for the BPF insns pages sitting in the general data heap
> > since they are not used during execution. Latter is only needed when run
> > through the interpreter.
> >
> > Since both x86 and arm64 JITs have seen a lot of exposure over the years,
> > are generally most up to date and maintained, there is more downside in
> > !BPF_JIT_ALWAYS_ON configurations to have the interpreter enabled by default
> > rather than the JIT. Add a ARCH_WANT_DEFAULT_BPF_JIT config which archs can
> > use to set the bpf_jit_{enable,kallsyms} to 1. Back in the days the
> > bpf_jit_kallsyms knob was set to 0 by default since major distros still
> > had /proc/kallsyms addresses exposed to unprivileged user space which is
> > not the case anymore. Hence both knobs are set via BPF_JIT_DEFAULT_ON which
> > is set to 'y' in case of BPF_JIT_ALWAYS_ON or ARCH_WANT_DEFAULT_BPF_JIT.
> Acked-by: Martin KaFai Lau <kafai@...com>

Applied. Thanks