From: Nicholas Dudar <main.kalliope@gmail.com>
To: ast@kernel.org, daniel@iogearbox.net, andrii@kernel.org,
eddyz87@gmail.com, memxor@gmail.com,
johan.almbladh@anyfinetworks.com, paulburton@kernel.org,
tsbogend@alpha.franken.de
Cc: martin.lau@linux.dev, song@kernel.org, yonghong.song@linux.dev,
jolsa@kernel.org, emil@etsalapatis.com, ihor.solodrai@linux.dev,
bpf@vger.kernel.org, linux-mips@vger.kernel.org,
linux-kernel@vger.kernel.org
Subject: [PATCH bpf-next v2 2/2] bpf, mips: Add support for BPF_MOVSX in the JITs
Date: Fri, 4 Sep 2026 07:17:31 -0400 [thread overview]
Message-ID: <20260904111731.673341-3-main.kalliope@gmail.com> (raw)
In-Reply-To: <20260904111731.673341-1-main.kalliope@gmail.com>
Both MIPS JITs ignore insn->off when lowering register MOV
instructions, so BPF_MOVSX is emitted as an ordinary move. Since
build_insn() accepts it, affected programs are silently miscompiled
instead of falling back to the interpreter.
Decode insn->off in the register-move helpers and sign-extend 8- and
16-bit ALU32 operands and 8-, 16-, and 32-bit ALU64 operands. On
MIPS32, propagate the sign into the high word for ALU64 while
preserving the existing ALU32 zero-extension handling.
Use shift pairs rather than seb/seh so the lowering works on every CPU
supported by these JITs. seb/seh would save one instruction on
R2-or-newer CPUs but would require adding those opcodes to uasm.
Assisted-by: Codex:gpt-5.6-sol
Signed-off-by: Nicholas Dudar <main.kalliope@gmail.com>
---
arch/mips/net/bpf_jit_comp32.c | 56 ++++++++++++++++++++++++++++------
arch/mips/net/bpf_jit_comp64.c | 54 +++++++++++++++++++++++++++-----
2 files changed, 93 insertions(+), 17 deletions(-)
diff --git a/arch/mips/net/bpf_jit_comp32.c b/arch/mips/net/bpf_jit_comp32.c
index bfe73b023983..885da0d0d74b 100644
--- a/arch/mips/net/bpf_jit_comp32.c
+++ b/arch/mips/net/bpf_jit_comp32.c
@@ -190,20 +190,58 @@ static void emit_zext_ver(struct jit_context *ctx, const u8 dst[])
}
}
-/* Register move operation (32-bit) */
+/* Register move operation (32-bit), optionally with sign extension */
static void emit_mov_r32(struct jit_context *ctx, const u8 dst[],
- const u8 src[])
+ const u8 src[], s16 off)
{
- emit_mov_r(ctx, lo(dst), lo(src));
+ int shift;
+
+ switch (off) {
+ case 8:
+ case 16:
+ shift = 32 - off;
+ emit(ctx, sll, lo(dst), lo(src), shift);
+ emit(ctx, sra, lo(dst), lo(dst), shift);
+ break;
+ default:
+ /* off == 0 is MOV; the verifier rejects other offsets. */
+ emit_mov_r(ctx, lo(dst), lo(src));
+ break;
+ }
+ clobber_reg(ctx, lo(dst));
emit_zext_ver(ctx, dst);
}
-/* Register move operation (64-bit) */
+/* Register move operation (64-bit), optionally with sign extension */
static void emit_mov_r64(struct jit_context *ctx, const u8 dst[],
- const u8 src[])
+ const u8 src[], s16 off)
{
- emit_mov_r(ctx, lo(dst), lo(src));
- emit_mov_r(ctx, hi(dst), hi(src));
+ int shift;
+
+ switch (off) {
+ case 8:
+ case 16:
+ shift = 32 - off;
+ emit(ctx, sll, lo(dst), lo(src), shift);
+ emit(ctx, sra, lo(dst), lo(dst), shift);
+ emit(ctx, sra, hi(dst), lo(dst), 31);
+ break;
+ case 32:
+ emit(ctx, move, lo(dst), lo(src));
+ emit(ctx, sra, hi(dst), lo(dst), 31);
+ break;
+ default:
+ /*
+ * off == 0 is ordinary MOV. The verifier rejects other
+ * offsets; defined exceptions require
+ * bpf_jit_supports_percpu_insn() or bpf_jit_supports_arena(),
+ * neither implemented by MIPS.
+ */
+ emit_mov_r(ctx, lo(dst), lo(src));
+ emit_mov_r(ctx, hi(dst), hi(src));
+ break;
+ }
+ clobber_reg64(ctx, dst);
}
/* Load delay slot, if ISA mandates it */
@@ -1501,7 +1539,7 @@ int build_insn(const struct bpf_insn *insn, struct jit_context *ctx)
/* Special mov32 for zext */
emit_mov_i(ctx, hi(dst), 0);
} else {
- emit_mov_r32(ctx, dst, src);
+ emit_mov_r32(ctx, dst, src, off);
}
break;
/* dst = -dst */
@@ -1570,7 +1608,7 @@ int build_insn(const struct bpf_insn *insn, struct jit_context *ctx)
break;
/* dst = src (64-bit) */
case BPF_ALU64 | BPF_MOV | BPF_X:
- emit_mov_r64(ctx, dst, src);
+ emit_mov_r64(ctx, dst, src, off);
break;
/* dst = -dst (64-bit) */
case BPF_ALU64 | BPF_NEG:
diff --git a/arch/mips/net/bpf_jit_comp64.c b/arch/mips/net/bpf_jit_comp64.c
index 45fee6f6b87e..a1dfb7492a9c 100644
--- a/arch/mips/net/bpf_jit_comp64.c
+++ b/arch/mips/net/bpf_jit_comp64.c
@@ -120,17 +120,55 @@ static void emit_zext_ver(struct jit_context *ctx, u8 dst)
emit_zext(ctx, dst);
}
-/* Register move operation (32-bit) */
-static void emit_mov_r32(struct jit_context *ctx, u8 dst, u8 src)
+/* Register move operation (32-bit), optionally with sign extension */
+static void emit_mov_r32(struct jit_context *ctx, u8 dst, u8 src, s16 off)
{
- emit_mov_r(ctx, dst, src);
+ int shift;
+
+ switch (off) {
+ case 8:
+ case 16:
+ shift = 32 - off;
+ /* dsll32 and dsra32 add 32 to the shift argument. */
+ emit(ctx, dsll32, dst, src, shift);
+ emit(ctx, dsra32, dst, dst, shift);
+ break;
+ default:
+ /* off == 0 is MOV; the verifier rejects other offsets. */
+ emit_mov_r(ctx, dst, src);
+ break;
+ }
+ clobber_reg(ctx, dst);
emit_zext_ver(ctx, dst);
}
-/* Register move operation (64-bit) */
-static void emit_mov_r64(struct jit_context *ctx, u8 dst, u8 src)
+/* Register move operation (64-bit), optionally with sign extension */
+static void emit_mov_r64(struct jit_context *ctx, u8 dst, u8 src, s16 off)
{
- emit_mov_r(ctx, dst, src);
+ int shift;
+
+ switch (off) {
+ case 8:
+ case 16:
+ shift = 32 - off;
+ /* dsll32 and dsra32 add 32 to the shift argument. */
+ emit(ctx, dsll32, dst, src, shift);
+ emit(ctx, dsra32, dst, dst, shift);
+ break;
+ case 32:
+ emit_sext(ctx, dst, src);
+ break;
+ default:
+ /*
+ * off == 0 is ordinary MOV. The verifier rejects other
+ * offsets; defined exceptions require
+ * bpf_jit_supports_percpu_insn() or bpf_jit_supports_arena(),
+ * neither implemented by MIPS.
+ */
+ emit_mov_r(ctx, dst, src);
+ break;
+ }
+ clobber_reg(ctx, dst);
}
/* dst = imm (64-bit) */
@@ -669,7 +707,7 @@ int build_insn(const struct bpf_insn *insn, struct jit_context *ctx)
/* Special mov32 for zext */
emit_zext(ctx, dst);
} else {
- emit_mov_r32(ctx, dst, src);
+ emit_mov_r32(ctx, dst, src, off);
}
break;
/* dst = -dst */
@@ -754,7 +792,7 @@ int build_insn(const struct bpf_insn *insn, struct jit_context *ctx)
break;
/* dst = src (64-bit) */
case BPF_ALU64 | BPF_MOV | BPF_X:
- emit_mov_r64(ctx, dst, src);
+ emit_mov_r64(ctx, dst, src, off);
break;
/* dst = -dst (64-bit) */
case BPF_ALU64 | BPF_NEG:
next prev parent reply other threads:[~2026-09-04 11:17 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-09-04 11:17 [PATCH bpf-next v2 0/2] bpf, mips: Add BPF_MOVSX support to the JITs Nicholas Dudar
2026-09-04 11:17 ` [PATCH bpf-next v2 1/2] bpf, mips: Factor register moves into helpers Nicholas Dudar
2026-09-04 12:29 ` bot+bpf-ci
2026-09-04 12:45 ` Nicholas Dudar
2026-09-04 11:17 ` Nicholas Dudar [this message]
2026-09-11 16:13 ` [PATCH bpf-next v2 2/2] bpf, mips: Add support for BPF_MOVSX in the JITs Johan Almbladh
2026-09-11 16:37 ` Nicholas Dudar
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260904111731.673341-3-main.kalliope@gmail.com \
--to=main.kalliope@gmail.com \
--cc=andrii@kernel.org \
--cc=ast@kernel.org \
--cc=bpf@vger.kernel.org \
--cc=daniel@iogearbox.net \
--cc=eddyz87@gmail.com \
--cc=emil@etsalapatis.com \
--cc=ihor.solodrai@linux.dev \
--cc=johan.almbladh@anyfinetworks.com \
--cc=jolsa@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mips@vger.kernel.org \
--cc=martin.lau@linux.dev \
--cc=memxor@gmail.com \
--cc=paulburton@kernel.org \
--cc=song@kernel.org \
--cc=tsbogend@alpha.franken.de \
--cc=yonghong.song@linux.dev \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.