[PATCH bpf-next 1/2] bpf, riscv: Add support for signed arena loads
Pu Lehui
pulehui at huawei.com
Tue Aug 18 20:41:21 PDT 2026
oops
need to revert this reviewed-by
On 2026/8/18 22:27, Pu Lehui wrote:
>
>
> On 2026/8/17 15:24, Chen Pei wrote:
>> Signed loads from arena memory are currently rejected on riscv64, as
>> bpf_jit_supports_insn() refuses BPF_MEMSX loads when in_arena is set,
>> while x86 and arm64 gained support for them in v6.18. Compilers such
>> as GCC-14 are free to generate signed loads into arena memory, which
>> breaks loading of otherwise valid BPF programs on riscv64.
>>
>> Implement BPF_PROBE_MEM32SX support in the RV64 JIT by reusing the
>> existing arena handling: the arena base (RV_REG_ARENA) is added to
>> the source register and the load is emitted with sign extension
>> (lb/lh/lw). Add BPF_PROBE_MEM32SX to the add_exception_handler()
>> mode gate so that faulting loads get an exception table entry which
>> clears the destination register and resumes execution.
>>
>> Verified by running the arena LDSX selftests (arena_ldsx_disasm,
>> arena_ldsx_exception, arena_ldsx_s8/s16/s32) on riscv64 QEMU, all
>> passing.
>>
>> Signed-off-by: Chen Pei <cp0613 at linux.alibaba.com>
>> ---
>> arch/riscv/net/bpf_jit_comp64.c | 15 +++++++++------
>> 1 file changed, 9 insertions(+), 6 deletions(-)
>>
>> diff --git a/arch/riscv/net/bpf_jit_comp64.c
>> b/arch/riscv/net/bpf_jit_comp64.c
>> index f9d5347ba966..5786f7dfc8a7 100644
>> --- a/arch/riscv/net/bpf_jit_comp64.c
>> +++ b/arch/riscv/net/bpf_jit_comp64.c
>> @@ -777,6 +777,7 @@ static int add_exception_handler(const struct
>> bpf_insn *insn, int dst_reg,
>> if (BPF_MODE(insn->code) != BPF_PROBE_MEM &&
>> BPF_MODE(insn->code) != BPF_PROBE_MEMSX &&
>> BPF_MODE(insn->code) != BPF_PROBE_MEM32 &&
>> + BPF_MODE(insn->code) != BPF_PROBE_MEM32SX &&
>> BPF_MODE(insn->code) != BPF_PROBE_ATOMIC)
>> return 0;
>> @@ -1902,13 +1903,19 @@ int bpf_jit_emit_insn(const struct bpf_insn
>> *insn, struct rv_jit_context *ctx,
>> case BPF_LDX | BPF_PROBE_MEM32 | BPF_H:
>> case BPF_LDX | BPF_PROBE_MEM32 | BPF_W:
>> case BPF_LDX | BPF_PROBE_MEM32 | BPF_DW:
>> + /* LDX | PROBE_MEM32SX: dst = *(signed size *)(src + RV_REG_ARENA
>> + off) */
>> + case BPF_LDX | BPF_PROBE_MEM32SX | BPF_B:
>> + case BPF_LDX | BPF_PROBE_MEM32SX | BPF_H:
>> + case BPF_LDX | BPF_PROBE_MEM32SX | BPF_W:
>> {
>> bool sign_ext;
>> sign_ext = BPF_MODE(insn->code) == BPF_MEMSX ||
>> - BPF_MODE(insn->code) == BPF_PROBE_MEMSX;
>> + BPF_MODE(insn->code) == BPF_PROBE_MEMSX ||
>> + BPF_MODE(insn->code) == BPF_PROBE_MEM32SX;
>> - if (BPF_MODE(insn->code) == BPF_PROBE_MEM32) {
>> + if (BPF_MODE(insn->code) == BPF_PROBE_MEM32 ||
>> + BPF_MODE(insn->code) == BPF_PROBE_MEM32SX) {
>> emit_add(RV_REG_T2, rs, RV_REG_ARENA, ctx);
>> rs = RV_REG_T2;
>> }
>> @@ -2126,10 +2133,6 @@ bool bpf_jit_supports_insn(struct bpf_insn
>> *insn, bool in_arena)
>> if (insn->imm == BPF_CMPXCHG)
>> return rv_ext_enabled(ZACAS);
>> break;
>> - case BPF_LDX | BPF_MEMSX | BPF_B:
>> - case BPF_LDX | BPF_MEMSX | BPF_H:
>> - case BPF_LDX | BPF_MEMSX | BPF_W:
>> - return false;
>> }
>> }
>
> Reviewed-by: Pu Lehui <pulehui at huawei.com>
>
Hi Chen Pei,
It's happy for the verifier_ldsx, but it not happy for the other test,
pls take a look.
[2026-08-19 11:33:11] root@(none):/mnt/bpf# ./test_progs -a arena_atomics
[2026-08-19 11:33:18]
[2026-08-19 11:33:20] [ 34.529770] bpf_testmod: loading out-of-tree
module taints kernel.
[2026-08-19 11:33:20] [ 34.530186] bpf_testmod: module verification
failed: signature and/or required key missing - tainting kernel
[2026-08-19 11:33:21] [ 35.541256] ------------[ cut here ]------------
[2026-08-19 11:33:21] [ 35.541573] WARNING:
arch/riscv/net/bpf_jit_comp64.c:915 at add_exception_handler+0xce/0xf0,
CPU#0: test_progs/122
[2026-08-19 11:33:21] [ 35.544546] Modules linked in: bpf_testmod(OE)
[2026-08-19 11:33:21] [ 35.545885] CPU: 0 UID: 0 PID: 122 Comm:
test_progs Tainted: G OE
7.2.0-next-20260818-00007-gc29447b2149d #8 PREEMPTLAZY
[2026-08-19 11:33:21] [ 35.546625] Tainted: [O]=OOT_MODULE,
[E]=UNSIGNED_MODULE
[2026-08-19 11:33:21] [ 35.546892] Hardware name: riscv-virtio,qemu (DT)
[2026-08-19 11:33:21] [ 35.547240] epc : add_exception_handler+0xce/0xf0
[2026-08-19 11:33:21] [ 35.547538] ra : bpf_jit_emit_insn+0x5a8/0x2d18
[2026-08-19 11:33:21] [ 35.547799] epc : ffffffff8002571e ra :
ffffffff8002b3c8 sp : ff20000000eeb700
[2026-08-19 11:33:21] [ 35.548128] gp : ffffffff81db8ed0 tp :
ff60000083130d40 t0 : ffffffff8001e650
[2026-08-19 11:33:21] [ 35.548454] t1 : 0000000000000007 t2 :
0000000000000040 s0 : ff20000000eeb710
[2026-08-19 11:33:21] [ 35.548785] s1 : 00000000000000fb a0 :
0000000000000007 a1 : 000000000000000a
[2026-08-19 11:33:21] [ 35.549114] a2 : ff600000809549a0 a3 :
ffffffff78000790 a4 : ff60000080a8bc24
[2026-08-19 11:33:21] [ 35.549439] a5 : 0000000000000087 a6 :
ffffffff78000664 a7 : 0000000000000089
[2026-08-19 11:33:21] [ 35.549765] s2 : ff600000809549a0 s3 :
ff2000000017d1e8 s4 : 0000000000000000
[2026-08-19 11:33:21] [ 35.550094] s5 : 0000000000000001 s6 :
0000000000000001 s7 : 0000000000000031
[2026-08-19 11:33:21] [ 35.550419] s8 : ff60000084994800 s9 :
0000000000000000 s10: 0000000000000000
[2026-08-19 11:33:21] [ 35.550737] s11: 000000084290e9f4 t3 :
0000000000000000 t4 : 000000000000000b
[2026-08-19 11:33:21] [ 35.551079] t5 : 0000000000000008 t6 :
ff600000808fc3a0 ssp : 0000000000000000
[2026-08-19 11:33:21] [ 35.551409] status: 0000000200000120 badaddr:
ffffffff8002571e cause: 0000000000000003
[2026-08-19 11:33:21] [ 35.551882] [<ffffffff8002571e>]
add_exception_handler+0xce/0xf0
[2026-08-19 11:33:21] [ 35.552318] [<ffffffff8002b3c8>]
bpf_jit_emit_insn+0x5a8/0x2d18
[2026-08-19 11:33:21] [ 35.552602] [<ffffffff80024f1a>]
bpf_int_jit_compile+0x9a/0x480
[2026-08-19 11:33:21] [ 35.552888] [<ffffffff801a3d0c>]
__bpf_prog_select_runtime+0x10c/0x1d8
[2026-08-19 11:33:21] [ 35.553197] [<ffffffff801d54fa>]
bpf_check+0xaca/0x31b8
[2026-08-19 11:33:21] [ 35.553459] [<ffffffff801a8436>]
bpf_prog_load+0x546/0xad0
[2026-08-19 11:33:21] [ 35.553720] [<ffffffff801af850>]
__sys_bpf+0x1948/0x2c38
[2026-08-19 11:33:21] [ 35.553974] [<ffffffff801b0b6a>]
__riscv_sys_bpf+0x2a/0x40
[2026-08-19 11:33:21] [ 35.554238] [<ffffffff80a91872>]
do_trap_ecall_u+0x1ea/0x398
[2026-08-19 11:33:21] [ 35.554528] [<ffffffff80aa088c>]
handle_exception+0x16c/0x178
[2026-08-19 11:33:21] [ 35.555320] ---[ end trace 0000000000000000 ]---
[2026-08-19 11:33:21] serial_test_arena_atomics:PASS:arena atomics
skeleton open 0 nsec
[2026-08-19 11:33:21] libbpf: prog 'add': BPF program load failed:
-ENOTSUPP
[2026-08-19 11:33:21] libbpf: prog 'add': -- BEGIN PROG LOAD LOG --
[2026-08-19 11:33:21] processed 37 insns (limit 1000000)
max_states_per_insn 0 total_states 1 peak_states 1 mark_read 0
[2026-08-19 11:33:21] -- END PROG LOAD LOG --
[2026-08-19 11:33:21] libbpf: prog 'add': failed to load: -ENOTSUPP
[2026-08-19 11:33:21] libbpf: failed to load object 'arena_atomics'
[2026-08-19 11:33:21] libbpf: failed to load BPF skeleton
'arena_atomics': -ENOTSUPP
[2026-08-19 11:33:21] serial_test_arena_atomics:FAIL:arena atomics
skeleton load unexpected error: -524 (errno 524)
[2026-08-19 11:33:21] #1 arena_atomics:FAIL
[2026-08-19 11:33:21]
[2026-08-19 11:33:21] All error logs:
[2026-08-19 11:33:21] serial_test_arena_atomics:PASS:arena atomics
skeleton open 0 nsec
[2026-08-19 11:33:21] libbpf: prog 'add': BPF program load failed:
-ENOTSUPP
[2026-08-19 11:33:21] libbpf: prog 'add': -- BEGIN PROG LOAD LOG --
[2026-08-19 11:33:21] processed 37 insns (limit 1000000)
max_states_per_insn 0 total_states 1 peak_states 1 mark_read 0
[2026-08-19 11:33:21] -- END PROG LOAD LOG --
[2026-08-19 11:33:21] libbpf: prog 'add': failed to load: -ENOTSUPP
[2026-08-19 11:33:21] libbpf: failed to load object 'arena_atomics'
[2026-08-19 11:33:21] libbpf: failed to load BPF skeleton
'arena_atomics': -ENOTSUPP
[2026-08-19 11:33:21] serial_test_arena_atomics:FAIL:arena atomics
skeleton load unexpected error: -524 (errno 524)
[2026-08-19 11:33:21] #1 arena_atomics:FAIL
[2026-08-19 11:33:21] Summary: 0/0 PASSED, 0 SKIPPED, 1/0 FAILED
[2026-08-19 11:33:21] root@(none):/mnt/bpf#
More information about the linux-riscv
mailing list