[PATCH bpf-next 0/2] bpf, riscv: Add support for signed arena loads

[PATCH bpf-next 0/2] bpf, riscv: Add support for signed arena loads

[Chen Pei]

Hi,

Signed loads from arena memory are currently unsupported on riscv64:
bpf_jit_supports_insn() rejects BPF_MEMSX loads when in_arena is set,
so the verifier fails such programs with "sign extending loads from
arena are not supported yet". The x86 and arm64 JITs gained support
for them in v6.18 (a91ae3c89311, eab2a71f3a6a). Since compilers are
free to generate signed loads into arena memory (e.g. GCC-14 was
reported to do so), otherwise valid BPF programs fail to load on
riscv64.

This series adds BPF_PROBE_MEM32SX support to the RV64 JIT and
enables the corresponding selftests on riscv64:

1 implements signed arena loads in the RV64 JIT. The verifier
  already converts MEMSX loads from PTR_TO_ARENA to
  BPF_PROBE_MEM32SX once bpf_jit_supports_insn() allows them, so
  the JIT reuses the existing arena handling: the arena base
  (RV_REG_ARENA) is added to the source register and the load is
  emitted with sign extension (lb/lh/lw). BPF_PROBE_MEM32SX is also
  added to the add_exception_handler() mode gate so faulting loads
  register an exception table entry that clears the destination
  register and resumes execution.

2 enables the arena LDSX tests on riscv64: JIT disassembly
  assertions are added to arena_ldsx_disasm, and
  arena_ldsx_exception/s8/s16/s32 are now run on riscv64.

The series was verified on riscv64 with QEMU (-M virt -cpu max): all
five arena_ldsx tests pass, including the exception path (load from
unallocated arena memory returns 0) and the sign-extension values
(s8/s16/s32 tests return -1 as expected).

Note: the __jited assertions in patch 2 were derived from the JIT
register allocation (R0->a5, R1->a0, R8->s3, R9->s4, arena base in
s7) and the emit_ldx() code paths; happy to adjust them if a
disassembler output detail differs.

Thanks,
Pei

Chen Pei (2):
  bpf, riscv: Add support for signed arena loads
  selftests/bpf: Enable arena LDSX tests for riscv64

 arch/riscv/net/bpf_jit_comp64.c                 | 15 +++++++++------
 .../testing/selftests/bpf/progs/verifier_ldsx.c | 17 +++++++++++++++++
 2 files changed, 26 insertions(+), 6 deletions(-)

-- 
2.50.1

[PATCH bpf-next 0/2] bpf, riscv: Add support for signed arena loads

[Chen Pei]

Hi,

Signed loads from arena memory are currently unsupported on riscv64:
bpf_jit_supports_insn() rejects BPF_MEMSX loads when in_arena is set,
so the verifier fails such programs with "sign extending loads from
arena are not supported yet". The x86 and arm64 JITs gained support
for them in v6.18 (a91ae3c89311, eab2a71f3a6a). Since compilers are
free to generate signed loads into arena memory (e.g. GCC-14 was
reported to do so), otherwise valid BPF programs fail to load on
riscv64.

This series adds BPF_PROBE_MEM32SX support to the RV64 JIT and
enables the corresponding selftests on riscv64:

1 implements signed arena loads in the RV64 JIT. The verifier
  already converts MEMSX loads from PTR_TO_ARENA to
  BPF_PROBE_MEM32SX once bpf_jit_supports_insn() allows them, so
  the JIT reuses the existing arena handling: the arena base
  (RV_REG_ARENA) is added to the source register and the load is
  emitted with sign extension (lb/lh/lw). BPF_PROBE_MEM32SX is also
  added to the add_exception_handler() mode gate so faulting loads
  register an exception table entry that clears the destination
  register and resumes execution.

2 enables the arena LDSX tests on riscv64: JIT disassembly
  assertions are added to arena_ldsx_disasm, and
  arena_ldsx_exception/s8/s16/s32 are now run on riscv64.

The series was verified on riscv64 with QEMU (-M virt -cpu max): all
five arena_ldsx tests pass, including the exception path (load from
unallocated arena memory returns 0) and the sign-extension values
(s8/s16/s32 tests return -1 as expected).

Note: the __jited assertions in patch 2 were derived from the JIT
register allocation (R0->a5, R1->a0, R8->s3, R9->s4, arena base in
s7) and the emit_ldx() code paths; happy to adjust them if a
disassembler output detail differs.

Thanks,
Pei

Chen Pei (2):
  bpf, riscv: Add support for signed arena loads
  selftests/bpf: Enable arena LDSX tests for riscv64

 arch/riscv/net/bpf_jit_comp64.c                 | 15 +++++++++------
 .../testing/selftests/bpf/progs/verifier_ldsx.c | 17 +++++++++++++++++
 2 files changed, 26 insertions(+), 6 deletions(-)

-- 
2.50.1


_______________________________________________
linux-riscv mailing list
linux-riscv@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-riscv

[PATCH bpf-next 1/2] bpf, riscv: Add support for signed arena loads

[Chen Pei]

Signed loads from arena memory are currently rejected on riscv64, as
bpf_jit_supports_insn() refuses BPF_MEMSX loads when in_arena is set,
while x86 and arm64 gained support for them in v6.18. Compilers such
as GCC-14 are free to generate signed loads into arena memory, which
breaks loading of otherwise valid BPF programs on riscv64.

Implement BPF_PROBE_MEM32SX support in the RV64 JIT by reusing the
existing arena handling: the arena base (RV_REG_ARENA) is added to
the source register and the load is emitted with sign extension
(lb/lh/lw). Add BPF_PROBE_MEM32SX to the add_exception_handler()
mode gate so that faulting loads get an exception table entry which
clears the destination register and resumes execution.

Verified by running the arena LDSX selftests (arena_ldsx_disasm,
arena_ldsx_exception, arena_ldsx_s8/s16/s32) on riscv64 QEMU, all
passing.

Signed-off-by: Chen Pei <cp0613@linux.alibaba.com>
---
 arch/riscv/net/bpf_jit_comp64.c | 15 +++++++++------
 1 file changed, 9 insertions(+), 6 deletions(-)

diff --git a/arch/riscv/net/bpf_jit_comp64.c b/arch/riscv/net/bpf_jit_comp64.c
index f9d5347ba966..5786f7dfc8a7 100644
--- a/arch/riscv/net/bpf_jit_comp64.c
+++ b/arch/riscv/net/bpf_jit_comp64.c
@@ -777,6 +777,7 @@ static int add_exception_handler(const struct bpf_insn *insn, int dst_reg,
 	if (BPF_MODE(insn->code) != BPF_PROBE_MEM &&
 	    BPF_MODE(insn->code) != BPF_PROBE_MEMSX &&
 	    BPF_MODE(insn->code) != BPF_PROBE_MEM32 &&
+	    BPF_MODE(insn->code) != BPF_PROBE_MEM32SX &&
 	    BPF_MODE(insn->code) != BPF_PROBE_ATOMIC)
 		return 0;
 
@@ -1902,13 +1903,19 @@ int bpf_jit_emit_insn(const struct bpf_insn *insn, struct rv_jit_context *ctx,
 	case BPF_LDX | BPF_PROBE_MEM32 | BPF_H:
 	case BPF_LDX | BPF_PROBE_MEM32 | BPF_W:
 	case BPF_LDX | BPF_PROBE_MEM32 | BPF_DW:
+	/* LDX | PROBE_MEM32SX: dst = *(signed size *)(src + RV_REG_ARENA + off) */
+	case BPF_LDX | BPF_PROBE_MEM32SX | BPF_B:
+	case BPF_LDX | BPF_PROBE_MEM32SX | BPF_H:
+	case BPF_LDX | BPF_PROBE_MEM32SX | BPF_W:
 	{
 		bool sign_ext;
 
 		sign_ext = BPF_MODE(insn->code) == BPF_MEMSX ||
-			   BPF_MODE(insn->code) == BPF_PROBE_MEMSX;
+			   BPF_MODE(insn->code) == BPF_PROBE_MEMSX ||
+			   BPF_MODE(insn->code) == BPF_PROBE_MEM32SX;
 
-		if (BPF_MODE(insn->code) == BPF_PROBE_MEM32) {
+		if (BPF_MODE(insn->code) == BPF_PROBE_MEM32 ||
+		    BPF_MODE(insn->code) == BPF_PROBE_MEM32SX) {
 			emit_add(RV_REG_T2, rs, RV_REG_ARENA, ctx);
 			rs = RV_REG_T2;
 		}
@@ -2126,10 +2133,6 @@ bool bpf_jit_supports_insn(struct bpf_insn *insn, bool in_arena)
 			if (insn->imm == BPF_CMPXCHG)
 				return rv_ext_enabled(ZACAS);
 			break;
-		case BPF_LDX | BPF_MEMSX | BPF_B:
-		case BPF_LDX | BPF_MEMSX | BPF_H:
-		case BPF_LDX | BPF_MEMSX | BPF_W:
-			return false;
 		}
 	}
 
-- 
2.50.1

[PATCH bpf-next 1/2] bpf, riscv: Add support for signed arena loads

[Chen Pei]

Signed loads from arena memory are currently rejected on riscv64, as
bpf_jit_supports_insn() refuses BPF_MEMSX loads when in_arena is set,
while x86 and arm64 gained support for them in v6.18. Compilers such
as GCC-14 are free to generate signed loads into arena memory, which
breaks loading of otherwise valid BPF programs on riscv64.

Implement BPF_PROBE_MEM32SX support in the RV64 JIT by reusing the
existing arena handling: the arena base (RV_REG_ARENA) is added to
the source register and the load is emitted with sign extension
(lb/lh/lw). Add BPF_PROBE_MEM32SX to the add_exception_handler()
mode gate so that faulting loads get an exception table entry which
clears the destination register and resumes execution.

Verified by running the arena LDSX selftests (arena_ldsx_disasm,
arena_ldsx_exception, arena_ldsx_s8/s16/s32) on riscv64 QEMU, all
passing.

Signed-off-by: Chen Pei <cp0613@linux.alibaba.com>
---
 arch/riscv/net/bpf_jit_comp64.c | 15 +++++++++------
 1 file changed, 9 insertions(+), 6 deletions(-)

diff --git a/arch/riscv/net/bpf_jit_comp64.c b/arch/riscv/net/bpf_jit_comp64.c
index f9d5347ba966..5786f7dfc8a7 100644
--- a/arch/riscv/net/bpf_jit_comp64.c
+++ b/arch/riscv/net/bpf_jit_comp64.c
@@ -777,6 +777,7 @@ static int add_exception_handler(const struct bpf_insn *insn, int dst_reg,
 	if (BPF_MODE(insn->code) != BPF_PROBE_MEM &&
 	    BPF_MODE(insn->code) != BPF_PROBE_MEMSX &&
 	    BPF_MODE(insn->code) != BPF_PROBE_MEM32 &&
+	    BPF_MODE(insn->code) != BPF_PROBE_MEM32SX &&
 	    BPF_MODE(insn->code) != BPF_PROBE_ATOMIC)
 		return 0;
 
@@ -1902,13 +1903,19 @@ int bpf_jit_emit_insn(const struct bpf_insn *insn, struct rv_jit_context *ctx,
 	case BPF_LDX | BPF_PROBE_MEM32 | BPF_H:
 	case BPF_LDX | BPF_PROBE_MEM32 | BPF_W:
 	case BPF_LDX | BPF_PROBE_MEM32 | BPF_DW:
+	/* LDX | PROBE_MEM32SX: dst = *(signed size *)(src + RV_REG_ARENA + off) */
+	case BPF_LDX | BPF_PROBE_MEM32SX | BPF_B:
+	case BPF_LDX | BPF_PROBE_MEM32SX | BPF_H:
+	case BPF_LDX | BPF_PROBE_MEM32SX | BPF_W:
 	{
 		bool sign_ext;
 
 		sign_ext = BPF_MODE(insn->code) == BPF_MEMSX ||
-			   BPF_MODE(insn->code) == BPF_PROBE_MEMSX;
+			   BPF_MODE(insn->code) == BPF_PROBE_MEMSX ||
+			   BPF_MODE(insn->code) == BPF_PROBE_MEM32SX;
 
-		if (BPF_MODE(insn->code) == BPF_PROBE_MEM32) {
+		if (BPF_MODE(insn->code) == BPF_PROBE_MEM32 ||
+		    BPF_MODE(insn->code) == BPF_PROBE_MEM32SX) {
 			emit_add(RV_REG_T2, rs, RV_REG_ARENA, ctx);
 			rs = RV_REG_T2;
 		}
@@ -2126,10 +2133,6 @@ bool bpf_jit_supports_insn(struct bpf_insn *insn, bool in_arena)
 			if (insn->imm == BPF_CMPXCHG)
 				return rv_ext_enabled(ZACAS);
 			break;
-		case BPF_LDX | BPF_MEMSX | BPF_B:
-		case BPF_LDX | BPF_MEMSX | BPF_H:
-		case BPF_LDX | BPF_MEMSX | BPF_W:
-			return false;
 		}
 	}
 
-- 
2.50.1


_______________________________________________
linux-riscv mailing list
linux-riscv@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-riscv

[PATCH bpf-next 2/2] selftests/bpf: Enable arena LDSX tests for riscv64

[Chen Pei]

Now that the riscv64 JIT supports signed arena loads
(BPF_PROBE_MEM32SX), enable the arena LDSX tests on riscv64:
add JIT disassembly assertions for arena_ldsx_disasm (arena base in
s7, add into t2, sign-extending lw/lh/lb loads) and run
arena_ldsx_exception and arena_ldsx_s8/s16/s32 on riscv64.

Signed-off-by: Chen Pei <cp0613@linux.alibaba.com>
---
 .../testing/selftests/bpf/progs/verifier_ldsx.c | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/tools/testing/selftests/bpf/progs/verifier_ldsx.c b/tools/testing/selftests/bpf/progs/verifier_ldsx.c
index 41340877dc9d..ed0a0f159bc1 100644
--- a/tools/testing/selftests/bpf/progs/verifier_ldsx.c
+++ b/tools/testing/selftests/bpf/progs/verifier_ldsx.c
@@ -286,6 +286,19 @@ __jited("add	x11, x0, x28")
 __jited("ldrsh	x22, [x11, #0x18]")
 __jited("add	x11, x0, x28")
 __jited("ldrsb	x22, [x11, #0x20]")
+__arch_riscv64
+__jited("add	t2, a5, s7")
+__jited("lw	s3, 0x10(t2)")
+__jited("add	t2, a5, s7")
+__jited("lh	s3, 0x18(t2)")
+__jited("add	t2, a5, s7")
+__jited("lb	s3, 0x20(t2)")
+__jited("add	t2, a0, s7")
+__jited("lw	s4, 0x10(t2)")
+__jited("add	t2, a0, s7")
+__jited("lh	s4, 0x18(t2)")
+__jited("add	t2, a0, s7")
+__jited("lb	s4, 0x20(t2)")
 __naked void arena_ldsx_disasm(void *ctx)
 {
 	asm volatile (
@@ -317,6 +330,7 @@ __description("Arena LDSX Exception")
 __success __retval(0)
 __arch_x86_64
 __arch_arm64
+__arch_riscv64
 __naked void arena_ldsx_exception(void *ctx)
 {
 	asm volatile (
@@ -338,6 +352,7 @@ __description("Arena LDSX, S8")
 __success __retval(-1)
 __arch_x86_64
 __arch_arm64
+__arch_riscv64
 __naked void arena_ldsx_s8(void *ctx)
 {
 	asm volatile (
@@ -369,6 +384,7 @@ __description("Arena LDSX, S16")
 __success __retval(-1)
 __arch_x86_64
 __arch_arm64
+__arch_riscv64
 __naked void arena_ldsx_s16(void *ctx)
 {
 	asm volatile (
@@ -400,6 +416,7 @@ __description("Arena LDSX, S32")
 __success __retval(-1)
 __arch_x86_64
 __arch_arm64
+__arch_riscv64
 __naked void arena_ldsx_s32(void *ctx)
 {
 	asm volatile (
-- 
2.50.1

[PATCH bpf-next 2/2] selftests/bpf: Enable arena LDSX tests for riscv64

[Chen Pei]

Now that the riscv64 JIT supports signed arena loads
(BPF_PROBE_MEM32SX), enable the arena LDSX tests on riscv64:
add JIT disassembly assertions for arena_ldsx_disasm (arena base in
s7, add into t2, sign-extending lw/lh/lb loads) and run
arena_ldsx_exception and arena_ldsx_s8/s16/s32 on riscv64.

Signed-off-by: Chen Pei <cp0613@linux.alibaba.com>
---
 .../testing/selftests/bpf/progs/verifier_ldsx.c | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/tools/testing/selftests/bpf/progs/verifier_ldsx.c b/tools/testing/selftests/bpf/progs/verifier_ldsx.c
index 41340877dc9d..ed0a0f159bc1 100644
--- a/tools/testing/selftests/bpf/progs/verifier_ldsx.c
+++ b/tools/testing/selftests/bpf/progs/verifier_ldsx.c
@@ -286,6 +286,19 @@ __jited("add	x11, x0, x28")
 __jited("ldrsh	x22, [x11, #0x18]")
 __jited("add	x11, x0, x28")
 __jited("ldrsb	x22, [x11, #0x20]")
+__arch_riscv64
+__jited("add	t2, a5, s7")
+__jited("lw	s3, 0x10(t2)")
+__jited("add	t2, a5, s7")
+__jited("lh	s3, 0x18(t2)")
+__jited("add	t2, a5, s7")
+__jited("lb	s3, 0x20(t2)")
+__jited("add	t2, a0, s7")
+__jited("lw	s4, 0x10(t2)")
+__jited("add	t2, a0, s7")
+__jited("lh	s4, 0x18(t2)")
+__jited("add	t2, a0, s7")
+__jited("lb	s4, 0x20(t2)")
 __naked void arena_ldsx_disasm(void *ctx)
 {
 	asm volatile (
@@ -317,6 +330,7 @@ __description("Arena LDSX Exception")
 __success __retval(0)
 __arch_x86_64
 __arch_arm64
+__arch_riscv64
 __naked void arena_ldsx_exception(void *ctx)
 {
 	asm volatile (
@@ -338,6 +352,7 @@ __description("Arena LDSX, S8")
 __success __retval(-1)
 __arch_x86_64
 __arch_arm64
+__arch_riscv64
 __naked void arena_ldsx_s8(void *ctx)
 {
 	asm volatile (
@@ -369,6 +384,7 @@ __description("Arena LDSX, S16")
 __success __retval(-1)
 __arch_x86_64
 __arch_arm64
+__arch_riscv64
 __naked void arena_ldsx_s16(void *ctx)
 {
 	asm volatile (
@@ -400,6 +416,7 @@ __description("Arena LDSX, S32")
 __success __retval(-1)
 __arch_x86_64
 __arch_arm64
+__arch_riscv64
 __naked void arena_ldsx_s32(void *ctx)
 {
 	asm volatile (
-- 
2.50.1


_______________________________________________
linux-riscv mailing list
linux-riscv@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-riscv

Re: [PATCH bpf-next 1/2] bpf, riscv: Add support for signed arena loads

[bot+bpf-ci]

[-- Attachment #1: Type: text/plain, Size: 1486 bytes --]

>     bpf, riscv: Add support for signed arena loads
>
>     Signed loads from arena memory are currently rejected on riscv64, as
>     bpf_jit_supports_insn() refuses BPF_MEMSX loads when in_arena is set,
>     while x86 and arm64 gained support for them in v6.18. Compilers such
>     as GCC-14 are free to generate signed loads into arena memory, which
>     breaks loading of otherwise valid BPF programs on riscv64.
>
>     Implement BPF_PROBE_MEM32SX support in the RV64 JIT by reusing the
>     existing arena handling: the arena base (RV_REG_ARENA) is added to
>     the source register and the load is emitted with sign extension
>     (lb/lh/lw). Add BPF_PROBE_MEM32SX to the add_exception_handler()
>     mode gate so that faulting loads get an exception table entry which
>     clears the destination register and resumes execution.
>
>     Verified by running the arena LDSX selftests (arena_ldsx_disasm,
>     arena_ldsx_exception, arena_ldsx_s8/s16/s32) on riscv64 QEMU, all
>     passing.
>
>     Signed-off-by: Chen Pei <cp0613@linux.alibaba.com>

This looks like a bug fix for incomplete arena support added by commit
fb7cefabae81. Should this include:

  Fixes: fb7cefabae81 ("riscv, bpf: Add support arena atomics for RV64")


---
AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md

CI run summary: https://github.com/kernel-patches/bpf/actions/runs/32007452800

Re: [PATCH bpf-next 1/2] bpf, riscv: Add support for signed arena loads

[bot+bpf-ci]

[-- Attachment #1: Type: text/plain, Size: 1486 bytes --]

>     bpf, riscv: Add support for signed arena loads
>
>     Signed loads from arena memory are currently rejected on riscv64, as
>     bpf_jit_supports_insn() refuses BPF_MEMSX loads when in_arena is set,
>     while x86 and arm64 gained support for them in v6.18. Compilers such
>     as GCC-14 are free to generate signed loads into arena memory, which
>     breaks loading of otherwise valid BPF programs on riscv64.
>
>     Implement BPF_PROBE_MEM32SX support in the RV64 JIT by reusing the
>     existing arena handling: the arena base (RV_REG_ARENA) is added to
>     the source register and the load is emitted with sign extension
>     (lb/lh/lw). Add BPF_PROBE_MEM32SX to the add_exception_handler()
>     mode gate so that faulting loads get an exception table entry which
>     clears the destination register and resumes execution.
>
>     Verified by running the arena LDSX selftests (arena_ldsx_disasm,
>     arena_ldsx_exception, arena_ldsx_s8/s16/s32) on riscv64 QEMU, all
>     passing.
>
>     Signed-off-by: Chen Pei <cp0613@linux.alibaba.com>

This looks like a bug fix for incomplete arena support added by commit
fb7cefabae81. Should this include:

  Fixes: fb7cefabae81 ("riscv, bpf: Add support arena atomics for RV64")


---
AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md

CI run summary: https://github.com/kernel-patches/bpf/actions/runs/32007452800

[-- Attachment #2: Type: text/plain, Size: 161 bytes --]

_______________________________________________
linux-riscv mailing list
linux-riscv@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-riscv

Re: [PATCH bpf-next 1/2] bpf, riscv: Add support for signed arena loads

[Pu Lehui]

On 2026/8/17 15:24, Chen Pei wrote:
> Signed loads from arena memory are currently rejected on riscv64, as
> bpf_jit_supports_insn() refuses BPF_MEMSX loads when in_arena is set,
> while x86 and arm64 gained support for them in v6.18. Compilers such
> as GCC-14 are free to generate signed loads into arena memory, which
> breaks loading of otherwise valid BPF programs on riscv64.
> 
> Implement BPF_PROBE_MEM32SX support in the RV64 JIT by reusing the
> existing arena handling: the arena base (RV_REG_ARENA) is added to
> the source register and the load is emitted with sign extension
> (lb/lh/lw). Add BPF_PROBE_MEM32SX to the add_exception_handler()
> mode gate so that faulting loads get an exception table entry which
> clears the destination register and resumes execution.
> 
> Verified by running the arena LDSX selftests (arena_ldsx_disasm,
> arena_ldsx_exception, arena_ldsx_s8/s16/s32) on riscv64 QEMU, all
> passing.
> 
> Signed-off-by: Chen Pei <cp0613@linux.alibaba.com>
> ---
>   arch/riscv/net/bpf_jit_comp64.c | 15 +++++++++------
>   1 file changed, 9 insertions(+), 6 deletions(-)
> 
> diff --git a/arch/riscv/net/bpf_jit_comp64.c b/arch/riscv/net/bpf_jit_comp64.c
> index f9d5347ba966..5786f7dfc8a7 100644
> --- a/arch/riscv/net/bpf_jit_comp64.c
> +++ b/arch/riscv/net/bpf_jit_comp64.c
> @@ -777,6 +777,7 @@ static int add_exception_handler(const struct bpf_insn *insn, int dst_reg,
>   	if (BPF_MODE(insn->code) != BPF_PROBE_MEM &&
>   	    BPF_MODE(insn->code) != BPF_PROBE_MEMSX &&
>   	    BPF_MODE(insn->code) != BPF_PROBE_MEM32 &&
> +	    BPF_MODE(insn->code) != BPF_PROBE_MEM32SX &&
>   	    BPF_MODE(insn->code) != BPF_PROBE_ATOMIC)
>   		return 0;
>   
> @@ -1902,13 +1903,19 @@ int bpf_jit_emit_insn(const struct bpf_insn *insn, struct rv_jit_context *ctx,
>   	case BPF_LDX | BPF_PROBE_MEM32 | BPF_H:
>   	case BPF_LDX | BPF_PROBE_MEM32 | BPF_W:
>   	case BPF_LDX | BPF_PROBE_MEM32 | BPF_DW:
> +	/* LDX | PROBE_MEM32SX: dst = *(signed size *)(src + RV_REG_ARENA + off) */
> +	case BPF_LDX | BPF_PROBE_MEM32SX | BPF_B:
> +	case BPF_LDX | BPF_PROBE_MEM32SX | BPF_H:
> +	case BPF_LDX | BPF_PROBE_MEM32SX | BPF_W:
>   	{
>   		bool sign_ext;
>   
>   		sign_ext = BPF_MODE(insn->code) == BPF_MEMSX ||
> -			   BPF_MODE(insn->code) == BPF_PROBE_MEMSX;
> +			   BPF_MODE(insn->code) == BPF_PROBE_MEMSX ||
> +			   BPF_MODE(insn->code) == BPF_PROBE_MEM32SX;
>   
> -		if (BPF_MODE(insn->code) == BPF_PROBE_MEM32) {
> +		if (BPF_MODE(insn->code) == BPF_PROBE_MEM32 ||
> +		    BPF_MODE(insn->code) == BPF_PROBE_MEM32SX) {
>   			emit_add(RV_REG_T2, rs, RV_REG_ARENA, ctx);
>   			rs = RV_REG_T2;
>   		}
> @@ -2126,10 +2133,6 @@ bool bpf_jit_supports_insn(struct bpf_insn *insn, bool in_arena)
>   			if (insn->imm == BPF_CMPXCHG)
>   				return rv_ext_enabled(ZACAS);
>   			break;
> -		case BPF_LDX | BPF_MEMSX | BPF_B:
> -		case BPF_LDX | BPF_MEMSX | BPF_H:
> -		case BPF_LDX | BPF_MEMSX | BPF_W:
> -			return false;
>   		}
>   	}
>   

Reviewed-by: Pu Lehui <pulehui@huawei.com>

Re: [PATCH bpf-next 1/2] bpf, riscv: Add support for signed arena loads

[Pu Lehui]

On 2026/8/17 15:24, Chen Pei wrote:
> Signed loads from arena memory are currently rejected on riscv64, as
> bpf_jit_supports_insn() refuses BPF_MEMSX loads when in_arena is set,
> while x86 and arm64 gained support for them in v6.18. Compilers such
> as GCC-14 are free to generate signed loads into arena memory, which
> breaks loading of otherwise valid BPF programs on riscv64.
> 
> Implement BPF_PROBE_MEM32SX support in the RV64 JIT by reusing the
> existing arena handling: the arena base (RV_REG_ARENA) is added to
> the source register and the load is emitted with sign extension
> (lb/lh/lw). Add BPF_PROBE_MEM32SX to the add_exception_handler()
> mode gate so that faulting loads get an exception table entry which
> clears the destination register and resumes execution.
> 
> Verified by running the arena LDSX selftests (arena_ldsx_disasm,
> arena_ldsx_exception, arena_ldsx_s8/s16/s32) on riscv64 QEMU, all
> passing.
> 
> Signed-off-by: Chen Pei <cp0613@linux.alibaba.com>
> ---
>   arch/riscv/net/bpf_jit_comp64.c | 15 +++++++++------
>   1 file changed, 9 insertions(+), 6 deletions(-)
> 
> diff --git a/arch/riscv/net/bpf_jit_comp64.c b/arch/riscv/net/bpf_jit_comp64.c
> index f9d5347ba966..5786f7dfc8a7 100644
> --- a/arch/riscv/net/bpf_jit_comp64.c
> +++ b/arch/riscv/net/bpf_jit_comp64.c
> @@ -777,6 +777,7 @@ static int add_exception_handler(const struct bpf_insn *insn, int dst_reg,
>   	if (BPF_MODE(insn->code) != BPF_PROBE_MEM &&
>   	    BPF_MODE(insn->code) != BPF_PROBE_MEMSX &&
>   	    BPF_MODE(insn->code) != BPF_PROBE_MEM32 &&
> +	    BPF_MODE(insn->code) != BPF_PROBE_MEM32SX &&
>   	    BPF_MODE(insn->code) != BPF_PROBE_ATOMIC)
>   		return 0;
>   
> @@ -1902,13 +1903,19 @@ int bpf_jit_emit_insn(const struct bpf_insn *insn, struct rv_jit_context *ctx,
>   	case BPF_LDX | BPF_PROBE_MEM32 | BPF_H:
>   	case BPF_LDX | BPF_PROBE_MEM32 | BPF_W:
>   	case BPF_LDX | BPF_PROBE_MEM32 | BPF_DW:
> +	/* LDX | PROBE_MEM32SX: dst = *(signed size *)(src + RV_REG_ARENA + off) */
> +	case BPF_LDX | BPF_PROBE_MEM32SX | BPF_B:
> +	case BPF_LDX | BPF_PROBE_MEM32SX | BPF_H:
> +	case BPF_LDX | BPF_PROBE_MEM32SX | BPF_W:
>   	{
>   		bool sign_ext;
>   
>   		sign_ext = BPF_MODE(insn->code) == BPF_MEMSX ||
> -			   BPF_MODE(insn->code) == BPF_PROBE_MEMSX;
> +			   BPF_MODE(insn->code) == BPF_PROBE_MEMSX ||
> +			   BPF_MODE(insn->code) == BPF_PROBE_MEM32SX;
>   
> -		if (BPF_MODE(insn->code) == BPF_PROBE_MEM32) {
> +		if (BPF_MODE(insn->code) == BPF_PROBE_MEM32 ||
> +		    BPF_MODE(insn->code) == BPF_PROBE_MEM32SX) {
>   			emit_add(RV_REG_T2, rs, RV_REG_ARENA, ctx);
>   			rs = RV_REG_T2;
>   		}
> @@ -2126,10 +2133,6 @@ bool bpf_jit_supports_insn(struct bpf_insn *insn, bool in_arena)
>   			if (insn->imm == BPF_CMPXCHG)
>   				return rv_ext_enabled(ZACAS);
>   			break;
> -		case BPF_LDX | BPF_MEMSX | BPF_B:
> -		case BPF_LDX | BPF_MEMSX | BPF_H:
> -		case BPF_LDX | BPF_MEMSX | BPF_W:
> -			return false;
>   		}
>   	}
>   

Reviewed-by: Pu Lehui <pulehui@huawei.com>

_______________________________________________
linux-riscv mailing list
linux-riscv@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-riscv

Re: [PATCH bpf-next 2/2] selftests/bpf: Enable arena LDSX tests for riscv64

[Pu Lehui]

On 2026/8/17 15:24, Chen Pei wrote:
> Now that the riscv64 JIT supports signed arena loads
> (BPF_PROBE_MEM32SX), enable the arena LDSX tests on riscv64:
> add JIT disassembly assertions for arena_ldsx_disasm (arena base in
> s7, add into t2, sign-extending lw/lh/lb loads) and run
> arena_ldsx_exception and arena_ldsx_s8/s16/s32 on riscv64.
> 
> Signed-off-by: Chen Pei <cp0613@linux.alibaba.com>
> ---
>   .../testing/selftests/bpf/progs/verifier_ldsx.c | 17 +++++++++++++++++
>   1 file changed, 17 insertions(+)
> 
> diff --git a/tools/testing/selftests/bpf/progs/verifier_ldsx.c b/tools/testing/selftests/bpf/progs/verifier_ldsx.c
> index 41340877dc9d..ed0a0f159bc1 100644
> --- a/tools/testing/selftests/bpf/progs/verifier_ldsx.c
> +++ b/tools/testing/selftests/bpf/progs/verifier_ldsx.c
> @@ -286,6 +286,19 @@ __jited("add	x11, x0, x28")
>   __jited("ldrsh	x22, [x11, #0x18]")
>   __jited("add	x11, x0, x28")
>   __jited("ldrsb	x22, [x11, #0x20]")
> +__arch_riscv64
> +__jited("add	t2, a5, s7")
> +__jited("lw	s3, 0x10(t2)")
> +__jited("add	t2, a5, s7")
> +__jited("lh	s3, 0x18(t2)")
> +__jited("add	t2, a5, s7")
> +__jited("lb	s3, 0x20(t2)")
> +__jited("add	t2, a0, s7")
> +__jited("lw	s4, 0x10(t2)")
> +__jited("add	t2, a0, s7")
> +__jited("lh	s4, 0x18(t2)")
> +__jited("add	t2, a0, s7")
> +__jited("lb	s4, 0x20(t2)")
>   __naked void arena_ldsx_disasm(void *ctx)
>   {
>   	asm volatile (
> @@ -317,6 +330,7 @@ __description("Arena LDSX Exception")
>   __success __retval(0)
>   __arch_x86_64
>   __arch_arm64
> +__arch_riscv64
>   __naked void arena_ldsx_exception(void *ctx)
>   {
>   	asm volatile (
> @@ -338,6 +352,7 @@ __description("Arena LDSX, S8")
>   __success __retval(-1)
>   __arch_x86_64
>   __arch_arm64
> +__arch_riscv64
>   __naked void arena_ldsx_s8(void *ctx)
>   {
>   	asm volatile (
> @@ -369,6 +384,7 @@ __description("Arena LDSX, S16")
>   __success __retval(-1)
>   __arch_x86_64
>   __arch_arm64
> +__arch_riscv64
>   __naked void arena_ldsx_s16(void *ctx)
>   {
>   	asm volatile (
> @@ -400,6 +416,7 @@ __description("Arena LDSX, S32")
>   __success __retval(-1)
>   __arch_x86_64
>   __arch_arm64
> +__arch_riscv64
>   __naked void arena_ldsx_s32(void *ctx)
>   {
>   	asm volatile (

Reviewed-by: Pu Lehui <pulehui@huawei.com>

Re: [PATCH bpf-next 2/2] selftests/bpf: Enable arena LDSX tests for riscv64

[Pu Lehui]

On 2026/8/17 15:24, Chen Pei wrote:
> Now that the riscv64 JIT supports signed arena loads
> (BPF_PROBE_MEM32SX), enable the arena LDSX tests on riscv64:
> add JIT disassembly assertions for arena_ldsx_disasm (arena base in
> s7, add into t2, sign-extending lw/lh/lb loads) and run
> arena_ldsx_exception and arena_ldsx_s8/s16/s32 on riscv64.
> 
> Signed-off-by: Chen Pei <cp0613@linux.alibaba.com>
> ---
>   .../testing/selftests/bpf/progs/verifier_ldsx.c | 17 +++++++++++++++++
>   1 file changed, 17 insertions(+)
> 
> diff --git a/tools/testing/selftests/bpf/progs/verifier_ldsx.c b/tools/testing/selftests/bpf/progs/verifier_ldsx.c
> index 41340877dc9d..ed0a0f159bc1 100644
> --- a/tools/testing/selftests/bpf/progs/verifier_ldsx.c
> +++ b/tools/testing/selftests/bpf/progs/verifier_ldsx.c
> @@ -286,6 +286,19 @@ __jited("add	x11, x0, x28")
>   __jited("ldrsh	x22, [x11, #0x18]")
>   __jited("add	x11, x0, x28")
>   __jited("ldrsb	x22, [x11, #0x20]")
> +__arch_riscv64
> +__jited("add	t2, a5, s7")
> +__jited("lw	s3, 0x10(t2)")
> +__jited("add	t2, a5, s7")
> +__jited("lh	s3, 0x18(t2)")
> +__jited("add	t2, a5, s7")
> +__jited("lb	s3, 0x20(t2)")
> +__jited("add	t2, a0, s7")
> +__jited("lw	s4, 0x10(t2)")
> +__jited("add	t2, a0, s7")
> +__jited("lh	s4, 0x18(t2)")
> +__jited("add	t2, a0, s7")
> +__jited("lb	s4, 0x20(t2)")
>   __naked void arena_ldsx_disasm(void *ctx)
>   {
>   	asm volatile (
> @@ -317,6 +330,7 @@ __description("Arena LDSX Exception")
>   __success __retval(0)
>   __arch_x86_64
>   __arch_arm64
> +__arch_riscv64
>   __naked void arena_ldsx_exception(void *ctx)
>   {
>   	asm volatile (
> @@ -338,6 +352,7 @@ __description("Arena LDSX, S8")
>   __success __retval(-1)
>   __arch_x86_64
>   __arch_arm64
> +__arch_riscv64
>   __naked void arena_ldsx_s8(void *ctx)
>   {
>   	asm volatile (
> @@ -369,6 +384,7 @@ __description("Arena LDSX, S16")
>   __success __retval(-1)
>   __arch_x86_64
>   __arch_arm64
> +__arch_riscv64
>   __naked void arena_ldsx_s16(void *ctx)
>   {
>   	asm volatile (
> @@ -400,6 +416,7 @@ __description("Arena LDSX, S32")
>   __success __retval(-1)
>   __arch_x86_64
>   __arch_arm64
> +__arch_riscv64
>   __naked void arena_ldsx_s32(void *ctx)
>   {
>   	asm volatile (

Reviewed-by: Pu Lehui <pulehui@huawei.com>

_______________________________________________
linux-riscv mailing list
linux-riscv@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-riscv

Re: [PATCH bpf-next 0/2] bpf, riscv: Add support for signed arena loads

[Pu Lehui]

On 2026/8/17 15:24, Chen Pei wrote:
> Hi,
> 
> Signed loads from arena memory are currently unsupported on riscv64:
> bpf_jit_supports_insn() rejects BPF_MEMSX loads when in_arena is set,
> so the verifier fails such programs with "sign extending loads from
> arena are not supported yet". The x86 and arm64 JITs gained support
> for them in v6.18 (a91ae3c89311, eab2a71f3a6a). Since compilers are
> free to generate signed loads into arena memory (e.g. GCC-14 was
> reported to do so), otherwise valid BPF programs fail to load on
> riscv64.
> 
> This series adds BPF_PROBE_MEM32SX support to the RV64 JIT and
> enables the corresponding selftests on riscv64:
> 
> 1 implements signed arena loads in the RV64 JIT. The verifier
>    already converts MEMSX loads from PTR_TO_ARENA to
>    BPF_PROBE_MEM32SX once bpf_jit_supports_insn() allows them, so
>    the JIT reuses the existing arena handling: the arena base
>    (RV_REG_ARENA) is added to the source register and the load is
>    emitted with sign extension (lb/lh/lw). BPF_PROBE_MEM32SX is also
>    added to the add_exception_handler() mode gate so faulting loads
>    register an exception table entry that clears the destination
>    register and resumes execution.
> 
> 2 enables the arena LDSX tests on riscv64: JIT disassembly
>    assertions are added to arena_ldsx_disasm, and
>    arena_ldsx_exception/s8/s16/s32 are now run on riscv64.
> 
> The series was verified on riscv64 with QEMU (-M virt -cpu max): all
> five arena_ldsx tests pass, including the exception path (load from
> unallocated arena memory returns 0) and the sign-extension values
> (s8/s16/s32 tests return -1 as expected).
> 
> Note: the __jited assertions in patch 2 were derived from the JIT
> register allocation (R0->a5, R1->a0, R8->s3, R9->s4, arena base in
> s7) and the emit_ldx() code paths; happy to adjust them if a
> disassembler output detail differs.

Test meets happy.

For this series:

Tested-by: Pu Lehui <pulehui@huawei.com>

> 
> Thanks,
> Pei
> 
> Chen Pei (2):
>    bpf, riscv: Add support for signed arena loads
>    selftests/bpf: Enable arena LDSX tests for riscv64
> 
>   arch/riscv/net/bpf_jit_comp64.c                 | 15 +++++++++------
>   .../testing/selftests/bpf/progs/verifier_ldsx.c | 17 +++++++++++++++++
>   2 files changed, 26 insertions(+), 6 deletions(-)
> 

Re: [PATCH bpf-next 0/2] bpf, riscv: Add support for signed arena loads

[Pu Lehui]

On 2026/8/17 15:24, Chen Pei wrote:
> Hi,
> 
> Signed loads from arena memory are currently unsupported on riscv64:
> bpf_jit_supports_insn() rejects BPF_MEMSX loads when in_arena is set,
> so the verifier fails such programs with "sign extending loads from
> arena are not supported yet". The x86 and arm64 JITs gained support
> for them in v6.18 (a91ae3c89311, eab2a71f3a6a). Since compilers are
> free to generate signed loads into arena memory (e.g. GCC-14 was
> reported to do so), otherwise valid BPF programs fail to load on
> riscv64.
> 
> This series adds BPF_PROBE_MEM32SX support to the RV64 JIT and
> enables the corresponding selftests on riscv64:
> 
> 1 implements signed arena loads in the RV64 JIT. The verifier
>    already converts MEMSX loads from PTR_TO_ARENA to
>    BPF_PROBE_MEM32SX once bpf_jit_supports_insn() allows them, so
>    the JIT reuses the existing arena handling: the arena base
>    (RV_REG_ARENA) is added to the source register and the load is
>    emitted with sign extension (lb/lh/lw). BPF_PROBE_MEM32SX is also
>    added to the add_exception_handler() mode gate so faulting loads
>    register an exception table entry that clears the destination
>    register and resumes execution.
> 
> 2 enables the arena LDSX tests on riscv64: JIT disassembly
>    assertions are added to arena_ldsx_disasm, and
>    arena_ldsx_exception/s8/s16/s32 are now run on riscv64.
> 
> The series was verified on riscv64 with QEMU (-M virt -cpu max): all
> five arena_ldsx tests pass, including the exception path (load from
> unallocated arena memory returns 0) and the sign-extension values
> (s8/s16/s32 tests return -1 as expected).
> 
> Note: the __jited assertions in patch 2 were derived from the JIT
> register allocation (R0->a5, R1->a0, R8->s3, R9->s4, arena base in
> s7) and the emit_ldx() code paths; happy to adjust them if a
> disassembler output detail differs.

Test meets happy.

For this series:

Tested-by: Pu Lehui <pulehui@huawei.com>

> 
> Thanks,
> Pei
> 
> Chen Pei (2):
>    bpf, riscv: Add support for signed arena loads
>    selftests/bpf: Enable arena LDSX tests for riscv64
> 
>   arch/riscv/net/bpf_jit_comp64.c                 | 15 +++++++++------
>   .../testing/selftests/bpf/progs/verifier_ldsx.c | 17 +++++++++++++++++
>   2 files changed, 26 insertions(+), 6 deletions(-)
> 

_______________________________________________
linux-riscv mailing list
linux-riscv@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-riscv

Re: [PATCH bpf-next 1/2] bpf, riscv: Add support for signed arena loads

[Pu Lehui]

oops

need to revert this reviewed-by

On 2026/8/18 22:27, Pu Lehui wrote:
> 
> 
> On 2026/8/17 15:24, Chen Pei wrote:
>> Signed loads from arena memory are currently rejected on riscv64, as
>> bpf_jit_supports_insn() refuses BPF_MEMSX loads when in_arena is set,
>> while x86 and arm64 gained support for them in v6.18. Compilers such
>> as GCC-14 are free to generate signed loads into arena memory, which
>> breaks loading of otherwise valid BPF programs on riscv64.
>>
>> Implement BPF_PROBE_MEM32SX support in the RV64 JIT by reusing the
>> existing arena handling: the arena base (RV_REG_ARENA) is added to
>> the source register and the load is emitted with sign extension
>> (lb/lh/lw). Add BPF_PROBE_MEM32SX to the add_exception_handler()
>> mode gate so that faulting loads get an exception table entry which
>> clears the destination register and resumes execution.
>>
>> Verified by running the arena LDSX selftests (arena_ldsx_disasm,
>> arena_ldsx_exception, arena_ldsx_s8/s16/s32) on riscv64 QEMU, all
>> passing.
>>
>> Signed-off-by: Chen Pei <cp0613@linux.alibaba.com>
>> ---
>>   arch/riscv/net/bpf_jit_comp64.c | 15 +++++++++------
>>   1 file changed, 9 insertions(+), 6 deletions(-)
>>
>> diff --git a/arch/riscv/net/bpf_jit_comp64.c 
>> b/arch/riscv/net/bpf_jit_comp64.c
>> index f9d5347ba966..5786f7dfc8a7 100644
>> --- a/arch/riscv/net/bpf_jit_comp64.c
>> +++ b/arch/riscv/net/bpf_jit_comp64.c
>> @@ -777,6 +777,7 @@ static int add_exception_handler(const struct 
>> bpf_insn *insn, int dst_reg,
>>       if (BPF_MODE(insn->code) != BPF_PROBE_MEM &&
>>           BPF_MODE(insn->code) != BPF_PROBE_MEMSX &&
>>           BPF_MODE(insn->code) != BPF_PROBE_MEM32 &&
>> +        BPF_MODE(insn->code) != BPF_PROBE_MEM32SX &&
>>           BPF_MODE(insn->code) != BPF_PROBE_ATOMIC)
>>           return 0;
>> @@ -1902,13 +1903,19 @@ int bpf_jit_emit_insn(const struct bpf_insn 
>> *insn, struct rv_jit_context *ctx,
>>       case BPF_LDX | BPF_PROBE_MEM32 | BPF_H:
>>       case BPF_LDX | BPF_PROBE_MEM32 | BPF_W:
>>       case BPF_LDX | BPF_PROBE_MEM32 | BPF_DW:
>> +    /* LDX | PROBE_MEM32SX: dst = *(signed size *)(src + RV_REG_ARENA 
>> + off) */
>> +    case BPF_LDX | BPF_PROBE_MEM32SX | BPF_B:
>> +    case BPF_LDX | BPF_PROBE_MEM32SX | BPF_H:
>> +    case BPF_LDX | BPF_PROBE_MEM32SX | BPF_W:
>>       {
>>           bool sign_ext;
>>           sign_ext = BPF_MODE(insn->code) == BPF_MEMSX ||
>> -               BPF_MODE(insn->code) == BPF_PROBE_MEMSX;
>> +               BPF_MODE(insn->code) == BPF_PROBE_MEMSX ||
>> +               BPF_MODE(insn->code) == BPF_PROBE_MEM32SX;
>> -        if (BPF_MODE(insn->code) == BPF_PROBE_MEM32) {
>> +        if (BPF_MODE(insn->code) == BPF_PROBE_MEM32 ||
>> +            BPF_MODE(insn->code) == BPF_PROBE_MEM32SX) {
>>               emit_add(RV_REG_T2, rs, RV_REG_ARENA, ctx);
>>               rs = RV_REG_T2;
>>           }
>> @@ -2126,10 +2133,6 @@ bool bpf_jit_supports_insn(struct bpf_insn 
>> *insn, bool in_arena)
>>               if (insn->imm == BPF_CMPXCHG)
>>                   return rv_ext_enabled(ZACAS);
>>               break;
>> -        case BPF_LDX | BPF_MEMSX | BPF_B:
>> -        case BPF_LDX | BPF_MEMSX | BPF_H:
>> -        case BPF_LDX | BPF_MEMSX | BPF_W:
>> -            return false;
>>           }
>>       }
> 
> Reviewed-by: Pu Lehui <pulehui@huawei.com>
> 

Hi Chen Pei,

It's happy for the verifier_ldsx, but it not happy for the other test, 
pls take a look.

[2026-08-19 11:33:11]  root@(none):/mnt/bpf# ./test_progs -a arena_atomics
[2026-08-19 11:33:18]
[2026-08-19 11:33:20]  [   34.529770] bpf_testmod: loading out-of-tree 
module taints kernel.
[2026-08-19 11:33:20]  [   34.530186] bpf_testmod: module verification 
failed: signature and/or required key missing - tainting kernel
[2026-08-19 11:33:21]  [   35.541256] ------------[ cut here ]------------
[2026-08-19 11:33:21]  [   35.541573] WARNING: 
arch/riscv/net/bpf_jit_comp64.c:915 at add_exception_handler+0xce/0xf0, 
CPU#0: test_progs/122
[2026-08-19 11:33:21]  [   35.544546] Modules linked in: bpf_testmod(OE)
[2026-08-19 11:33:21]  [   35.545885] CPU: 0 UID: 0 PID: 122 Comm: 
test_progs Tainted: G           OE 
7.2.0-next-20260818-00007-gc29447b2149d #8 PREEMPTLAZY
[2026-08-19 11:33:21]  [   35.546625] Tainted: [O]=OOT_MODULE, 
[E]=UNSIGNED_MODULE
[2026-08-19 11:33:21]  [   35.546892] Hardware name: riscv-virtio,qemu (DT)
[2026-08-19 11:33:21]  [   35.547240] epc : add_exception_handler+0xce/0xf0
[2026-08-19 11:33:21]  [   35.547538]  ra : bpf_jit_emit_insn+0x5a8/0x2d18
[2026-08-19 11:33:21]  [   35.547799] epc : ffffffff8002571e ra : 
ffffffff8002b3c8 sp : ff20000000eeb700
[2026-08-19 11:33:21]  [   35.548128]  gp : ffffffff81db8ed0 tp : 
ff60000083130d40 t0 : ffffffff8001e650
[2026-08-19 11:33:21]  [   35.548454]  t1 : 0000000000000007 t2 : 
0000000000000040 s0 : ff20000000eeb710
[2026-08-19 11:33:21]  [   35.548785]  s1 : 00000000000000fb a0 : 
0000000000000007 a1 : 000000000000000a
[2026-08-19 11:33:21]  [   35.549114]  a2 : ff600000809549a0 a3 : 
ffffffff78000790 a4 : ff60000080a8bc24
[2026-08-19 11:33:21]  [   35.549439]  a5 : 0000000000000087 a6 : 
ffffffff78000664 a7 : 0000000000000089
[2026-08-19 11:33:21]  [   35.549765]  s2 : ff600000809549a0 s3 : 
ff2000000017d1e8 s4 : 0000000000000000
[2026-08-19 11:33:21]  [   35.550094]  s5 : 0000000000000001 s6 : 
0000000000000001 s7 : 0000000000000031
[2026-08-19 11:33:21]  [   35.550419]  s8 : ff60000084994800 s9 : 
0000000000000000 s10: 0000000000000000
[2026-08-19 11:33:21]  [   35.550737]  s11: 000000084290e9f4 t3 : 
0000000000000000 t4 : 000000000000000b
[2026-08-19 11:33:21]  [   35.551079]  t5 : 0000000000000008 t6 : 
ff600000808fc3a0 ssp : 0000000000000000
[2026-08-19 11:33:21]  [   35.551409] status: 0000000200000120 badaddr: 
ffffffff8002571e cause: 0000000000000003
[2026-08-19 11:33:21]  [   35.551882] [<ffffffff8002571e>] 
add_exception_handler+0xce/0xf0
[2026-08-19 11:33:21]  [   35.552318] [<ffffffff8002b3c8>] 
bpf_jit_emit_insn+0x5a8/0x2d18
[2026-08-19 11:33:21]  [   35.552602] [<ffffffff80024f1a>] 
bpf_int_jit_compile+0x9a/0x480
[2026-08-19 11:33:21]  [   35.552888] [<ffffffff801a3d0c>] 
__bpf_prog_select_runtime+0x10c/0x1d8
[2026-08-19 11:33:21]  [   35.553197] [<ffffffff801d54fa>] 
bpf_check+0xaca/0x31b8
[2026-08-19 11:33:21]  [   35.553459] [<ffffffff801a8436>] 
bpf_prog_load+0x546/0xad0
[2026-08-19 11:33:21]  [   35.553720] [<ffffffff801af850>] 
__sys_bpf+0x1948/0x2c38
[2026-08-19 11:33:21]  [   35.553974] [<ffffffff801b0b6a>] 
__riscv_sys_bpf+0x2a/0x40
[2026-08-19 11:33:21]  [   35.554238] [<ffffffff80a91872>] 
do_trap_ecall_u+0x1ea/0x398
[2026-08-19 11:33:21]  [   35.554528] [<ffffffff80aa088c>] 
handle_exception+0x16c/0x178
[2026-08-19 11:33:21]  [   35.555320] ---[ end trace 0000000000000000 ]---
[2026-08-19 11:33:21]  serial_test_arena_atomics:PASS:arena atomics 
skeleton open 0 nsec
[2026-08-19 11:33:21]  libbpf: prog 'add': BPF program load failed: 
-ENOTSUPP
[2026-08-19 11:33:21]  libbpf: prog 'add': -- BEGIN PROG LOAD LOG --
[2026-08-19 11:33:21]  processed 37 insns (limit 1000000) 
max_states_per_insn 0 total_states 1 peak_states 1 mark_read 0
[2026-08-19 11:33:21]  -- END PROG LOAD LOG --
[2026-08-19 11:33:21]  libbpf: prog 'add': failed to load: -ENOTSUPP
[2026-08-19 11:33:21]  libbpf: failed to load object 'arena_atomics'
[2026-08-19 11:33:21]  libbpf: failed to load BPF skeleton 
'arena_atomics': -ENOTSUPP
[2026-08-19 11:33:21]  serial_test_arena_atomics:FAIL:arena atomics 
skeleton load unexpected error: -524 (errno 524)
[2026-08-19 11:33:21]  #1       arena_atomics:FAIL
[2026-08-19 11:33:21]
[2026-08-19 11:33:21]  All error logs:
[2026-08-19 11:33:21]  serial_test_arena_atomics:PASS:arena atomics 
skeleton open 0 nsec
[2026-08-19 11:33:21]  libbpf: prog 'add': BPF program load failed: 
-ENOTSUPP
[2026-08-19 11:33:21]  libbpf: prog 'add': -- BEGIN PROG LOAD LOG --
[2026-08-19 11:33:21]  processed 37 insns (limit 1000000) 
max_states_per_insn 0 total_states 1 peak_states 1 mark_read 0
[2026-08-19 11:33:21]  -- END PROG LOAD LOG --
[2026-08-19 11:33:21]  libbpf: prog 'add': failed to load: -ENOTSUPP
[2026-08-19 11:33:21]  libbpf: failed to load object 'arena_atomics'
[2026-08-19 11:33:21]  libbpf: failed to load BPF skeleton 
'arena_atomics': -ENOTSUPP
[2026-08-19 11:33:21]  serial_test_arena_atomics:FAIL:arena atomics 
skeleton load unexpected error: -524 (errno 524)
[2026-08-19 11:33:21]  #1       arena_atomics:FAIL
[2026-08-19 11:33:21]  Summary: 0/0 PASSED, 0 SKIPPED, 1/0 FAILED
[2026-08-19 11:33:21]  root@(none):/mnt/bpf#

Re: [PATCH bpf-next 1/2] bpf, riscv: Add support for signed arena loads

[Pu Lehui]

oops

need to revert this reviewed-by

On 2026/8/18 22:27, Pu Lehui wrote:
> 
> 
> On 2026/8/17 15:24, Chen Pei wrote:
>> Signed loads from arena memory are currently rejected on riscv64, as
>> bpf_jit_supports_insn() refuses BPF_MEMSX loads when in_arena is set,
>> while x86 and arm64 gained support for them in v6.18. Compilers such
>> as GCC-14 are free to generate signed loads into arena memory, which
>> breaks loading of otherwise valid BPF programs on riscv64.
>>
>> Implement BPF_PROBE_MEM32SX support in the RV64 JIT by reusing the
>> existing arena handling: the arena base (RV_REG_ARENA) is added to
>> the source register and the load is emitted with sign extension
>> (lb/lh/lw). Add BPF_PROBE_MEM32SX to the add_exception_handler()
>> mode gate so that faulting loads get an exception table entry which
>> clears the destination register and resumes execution.
>>
>> Verified by running the arena LDSX selftests (arena_ldsx_disasm,
>> arena_ldsx_exception, arena_ldsx_s8/s16/s32) on riscv64 QEMU, all
>> passing.
>>
>> Signed-off-by: Chen Pei <cp0613@linux.alibaba.com>
>> ---
>>   arch/riscv/net/bpf_jit_comp64.c | 15 +++++++++------
>>   1 file changed, 9 insertions(+), 6 deletions(-)
>>
>> diff --git a/arch/riscv/net/bpf_jit_comp64.c 
>> b/arch/riscv/net/bpf_jit_comp64.c
>> index f9d5347ba966..5786f7dfc8a7 100644
>> --- a/arch/riscv/net/bpf_jit_comp64.c
>> +++ b/arch/riscv/net/bpf_jit_comp64.c
>> @@ -777,6 +777,7 @@ static int add_exception_handler(const struct 
>> bpf_insn *insn, int dst_reg,
>>       if (BPF_MODE(insn->code) != BPF_PROBE_MEM &&
>>           BPF_MODE(insn->code) != BPF_PROBE_MEMSX &&
>>           BPF_MODE(insn->code) != BPF_PROBE_MEM32 &&
>> +        BPF_MODE(insn->code) != BPF_PROBE_MEM32SX &&
>>           BPF_MODE(insn->code) != BPF_PROBE_ATOMIC)
>>           return 0;
>> @@ -1902,13 +1903,19 @@ int bpf_jit_emit_insn(const struct bpf_insn 
>> *insn, struct rv_jit_context *ctx,
>>       case BPF_LDX | BPF_PROBE_MEM32 | BPF_H:
>>       case BPF_LDX | BPF_PROBE_MEM32 | BPF_W:
>>       case BPF_LDX | BPF_PROBE_MEM32 | BPF_DW:
>> +    /* LDX | PROBE_MEM32SX: dst = *(signed size *)(src + RV_REG_ARENA 
>> + off) */
>> +    case BPF_LDX | BPF_PROBE_MEM32SX | BPF_B:
>> +    case BPF_LDX | BPF_PROBE_MEM32SX | BPF_H:
>> +    case BPF_LDX | BPF_PROBE_MEM32SX | BPF_W:
>>       {
>>           bool sign_ext;
>>           sign_ext = BPF_MODE(insn->code) == BPF_MEMSX ||
>> -               BPF_MODE(insn->code) == BPF_PROBE_MEMSX;
>> +               BPF_MODE(insn->code) == BPF_PROBE_MEMSX ||
>> +               BPF_MODE(insn->code) == BPF_PROBE_MEM32SX;
>> -        if (BPF_MODE(insn->code) == BPF_PROBE_MEM32) {
>> +        if (BPF_MODE(insn->code) == BPF_PROBE_MEM32 ||
>> +            BPF_MODE(insn->code) == BPF_PROBE_MEM32SX) {
>>               emit_add(RV_REG_T2, rs, RV_REG_ARENA, ctx);
>>               rs = RV_REG_T2;
>>           }
>> @@ -2126,10 +2133,6 @@ bool bpf_jit_supports_insn(struct bpf_insn 
>> *insn, bool in_arena)
>>               if (insn->imm == BPF_CMPXCHG)
>>                   return rv_ext_enabled(ZACAS);
>>               break;
>> -        case BPF_LDX | BPF_MEMSX | BPF_B:
>> -        case BPF_LDX | BPF_MEMSX | BPF_H:
>> -        case BPF_LDX | BPF_MEMSX | BPF_W:
>> -            return false;
>>           }
>>       }
> 
> Reviewed-by: Pu Lehui <pulehui@huawei.com>
> 

Hi Chen Pei,

It's happy for the verifier_ldsx, but it not happy for the other test, 
pls take a look.

[2026-08-19 11:33:11]  root@(none):/mnt/bpf# ./test_progs -a arena_atomics
[2026-08-19 11:33:18]
[2026-08-19 11:33:20]  [   34.529770] bpf_testmod: loading out-of-tree 
module taints kernel.
[2026-08-19 11:33:20]  [   34.530186] bpf_testmod: module verification 
failed: signature and/or required key missing - tainting kernel
[2026-08-19 11:33:21]  [   35.541256] ------------[ cut here ]------------
[2026-08-19 11:33:21]  [   35.541573] WARNING: 
arch/riscv/net/bpf_jit_comp64.c:915 at add_exception_handler+0xce/0xf0, 
CPU#0: test_progs/122
[2026-08-19 11:33:21]  [   35.544546] Modules linked in: bpf_testmod(OE)
[2026-08-19 11:33:21]  [   35.545885] CPU: 0 UID: 0 PID: 122 Comm: 
test_progs Tainted: G           OE 
7.2.0-next-20260818-00007-gc29447b2149d #8 PREEMPTLAZY
[2026-08-19 11:33:21]  [   35.546625] Tainted: [O]=OOT_MODULE, 
[E]=UNSIGNED_MODULE
[2026-08-19 11:33:21]  [   35.546892] Hardware name: riscv-virtio,qemu (DT)
[2026-08-19 11:33:21]  [   35.547240] epc : add_exception_handler+0xce/0xf0
[2026-08-19 11:33:21]  [   35.547538]  ra : bpf_jit_emit_insn+0x5a8/0x2d18
[2026-08-19 11:33:21]  [   35.547799] epc : ffffffff8002571e ra : 
ffffffff8002b3c8 sp : ff20000000eeb700
[2026-08-19 11:33:21]  [   35.548128]  gp : ffffffff81db8ed0 tp : 
ff60000083130d40 t0 : ffffffff8001e650
[2026-08-19 11:33:21]  [   35.548454]  t1 : 0000000000000007 t2 : 
0000000000000040 s0 : ff20000000eeb710
[2026-08-19 11:33:21]  [   35.548785]  s1 : 00000000000000fb a0 : 
0000000000000007 a1 : 000000000000000a
[2026-08-19 11:33:21]  [   35.549114]  a2 : ff600000809549a0 a3 : 
ffffffff78000790 a4 : ff60000080a8bc24
[2026-08-19 11:33:21]  [   35.549439]  a5 : 0000000000000087 a6 : 
ffffffff78000664 a7 : 0000000000000089
[2026-08-19 11:33:21]  [   35.549765]  s2 : ff600000809549a0 s3 : 
ff2000000017d1e8 s4 : 0000000000000000
[2026-08-19 11:33:21]  [   35.550094]  s5 : 0000000000000001 s6 : 
0000000000000001 s7 : 0000000000000031
[2026-08-19 11:33:21]  [   35.550419]  s8 : ff60000084994800 s9 : 
0000000000000000 s10: 0000000000000000
[2026-08-19 11:33:21]  [   35.550737]  s11: 000000084290e9f4 t3 : 
0000000000000000 t4 : 000000000000000b
[2026-08-19 11:33:21]  [   35.551079]  t5 : 0000000000000008 t6 : 
ff600000808fc3a0 ssp : 0000000000000000
[2026-08-19 11:33:21]  [   35.551409] status: 0000000200000120 badaddr: 
ffffffff8002571e cause: 0000000000000003
[2026-08-19 11:33:21]  [   35.551882] [<ffffffff8002571e>] 
add_exception_handler+0xce/0xf0
[2026-08-19 11:33:21]  [   35.552318] [<ffffffff8002b3c8>] 
bpf_jit_emit_insn+0x5a8/0x2d18
[2026-08-19 11:33:21]  [   35.552602] [<ffffffff80024f1a>] 
bpf_int_jit_compile+0x9a/0x480
[2026-08-19 11:33:21]  [   35.552888] [<ffffffff801a3d0c>] 
__bpf_prog_select_runtime+0x10c/0x1d8
[2026-08-19 11:33:21]  [   35.553197] [<ffffffff801d54fa>] 
bpf_check+0xaca/0x31b8
[2026-08-19 11:33:21]  [   35.553459] [<ffffffff801a8436>] 
bpf_prog_load+0x546/0xad0
[2026-08-19 11:33:21]  [   35.553720] [<ffffffff801af850>] 
__sys_bpf+0x1948/0x2c38
[2026-08-19 11:33:21]  [   35.553974] [<ffffffff801b0b6a>] 
__riscv_sys_bpf+0x2a/0x40
[2026-08-19 11:33:21]  [   35.554238] [<ffffffff80a91872>] 
do_trap_ecall_u+0x1ea/0x398
[2026-08-19 11:33:21]  [   35.554528] [<ffffffff80aa088c>] 
handle_exception+0x16c/0x178
[2026-08-19 11:33:21]  [   35.555320] ---[ end trace 0000000000000000 ]---
[2026-08-19 11:33:21]  serial_test_arena_atomics:PASS:arena atomics 
skeleton open 0 nsec
[2026-08-19 11:33:21]  libbpf: prog 'add': BPF program load failed: 
-ENOTSUPP
[2026-08-19 11:33:21]  libbpf: prog 'add': -- BEGIN PROG LOAD LOG --
[2026-08-19 11:33:21]  processed 37 insns (limit 1000000) 
max_states_per_insn 0 total_states 1 peak_states 1 mark_read 0
[2026-08-19 11:33:21]  -- END PROG LOAD LOG --
[2026-08-19 11:33:21]  libbpf: prog 'add': failed to load: -ENOTSUPP
[2026-08-19 11:33:21]  libbpf: failed to load object 'arena_atomics'
[2026-08-19 11:33:21]  libbpf: failed to load BPF skeleton 
'arena_atomics': -ENOTSUPP
[2026-08-19 11:33:21]  serial_test_arena_atomics:FAIL:arena atomics 
skeleton load unexpected error: -524 (errno 524)
[2026-08-19 11:33:21]  #1       arena_atomics:FAIL
[2026-08-19 11:33:21]
[2026-08-19 11:33:21]  All error logs:
[2026-08-19 11:33:21]  serial_test_arena_atomics:PASS:arena atomics 
skeleton open 0 nsec
[2026-08-19 11:33:21]  libbpf: prog 'add': BPF program load failed: 
-ENOTSUPP
[2026-08-19 11:33:21]  libbpf: prog 'add': -- BEGIN PROG LOAD LOG --
[2026-08-19 11:33:21]  processed 37 insns (limit 1000000) 
max_states_per_insn 0 total_states 1 peak_states 1 mark_read 0
[2026-08-19 11:33:21]  -- END PROG LOAD LOG --
[2026-08-19 11:33:21]  libbpf: prog 'add': failed to load: -ENOTSUPP
[2026-08-19 11:33:21]  libbpf: failed to load object 'arena_atomics'
[2026-08-19 11:33:21]  libbpf: failed to load BPF skeleton 
'arena_atomics': -ENOTSUPP
[2026-08-19 11:33:21]  serial_test_arena_atomics:FAIL:arena atomics 
skeleton load unexpected error: -524 (errno 524)
[2026-08-19 11:33:21]  #1       arena_atomics:FAIL
[2026-08-19 11:33:21]  Summary: 0/0 PASSED, 0 SKIPPED, 1/0 FAILED
[2026-08-19 11:33:21]  root@(none):/mnt/bpf#

_______________________________________________
linux-riscv mailing list
linux-riscv@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-riscv

Re: [PATCH bpf-next 1/2] bpf, riscv: Add support for signed arena loads

[Chen Pei]

Hi Lehui,

Thanks a lot for testing and catching this!

On 2026/8/19 11:41, Pu Lehui wrote:
> oops
> 
> need to revert this reviewed-by
> 
> [...]
> 
> Hi Chen Pei,
> 
> It's happy for the verifier_ldsx, but it not happy for the other test,
> pls take a look.
> 
> [2026-08-19 11:33:21]  [   35.541573] WARNING:
> arch/riscv/net/bpf_jit_comp64.c:915 at add_exception_handler+0xce/0xf0,
> CPU#0: test_progs/122

I reproduced it locally with arena_atomics on riscv64 QEMU and found the
root cause. It is indeed a bug introduced by this patch.

BPF_PROBE_MEM32SX is defined as 0xc0, which collides with the mode bits
of BPF_ATOMIC (also 0xc0). The riscv add_exception_handler() gates only
on BPF_MODE(), so adding BPF_PROBE_MEM32SX to that gate lets every plain
STX atomic insn (including on-stack atomics, whose JIT emit path also
sets ex_insn_off) pass the gate and register an exception table entry.
That overflows aux->num_exentries, triggers the WARN you saw and fails
the JIT pass with -ENOTSUPP.

Since BPF_PROBE_MEM32SX only exists for loads, the fix is to restrict
the PROBE_MEM32SX check in the gate to the LDX class, so that plain
atomic insns are filtered out again.

I have fixed and verified it locally on riscv64 QEMU: arena_atomics now
loads all ten programs cleanly with no warnings, and all five
arena_ldsx tests still pass. The fix will be included in v2, which I
will send shortly. Thanks again for the review and the report!

Best regards,
Pei

Re: [PATCH bpf-next 1/2] bpf, riscv: Add support for signed arena loads

[Chen Pei]

Hi Lehui,

Thanks a lot for testing and catching this!

On 2026/8/19 11:41, Pu Lehui wrote:
> oops
> 
> need to revert this reviewed-by
> 
> [...]
> 
> Hi Chen Pei,
> 
> It's happy for the verifier_ldsx, but it not happy for the other test,
> pls take a look.
> 
> [2026-08-19 11:33:21]  [   35.541573] WARNING:
> arch/riscv/net/bpf_jit_comp64.c:915 at add_exception_handler+0xce/0xf0,
> CPU#0: test_progs/122

I reproduced it locally with arena_atomics on riscv64 QEMU and found the
root cause. It is indeed a bug introduced by this patch.

BPF_PROBE_MEM32SX is defined as 0xc0, which collides with the mode bits
of BPF_ATOMIC (also 0xc0). The riscv add_exception_handler() gates only
on BPF_MODE(), so adding BPF_PROBE_MEM32SX to that gate lets every plain
STX atomic insn (including on-stack atomics, whose JIT emit path also
sets ex_insn_off) pass the gate and register an exception table entry.
That overflows aux->num_exentries, triggers the WARN you saw and fails
the JIT pass with -ENOTSUPP.

Since BPF_PROBE_MEM32SX only exists for loads, the fix is to restrict
the PROBE_MEM32SX check in the gate to the LDX class, so that plain
atomic insns are filtered out again.

I have fixed and verified it locally on riscv64 QEMU: arena_atomics now
loads all ten programs cleanly with no warnings, and all five
arena_ldsx tests still pass. The fix will be included in v2, which I
will send shortly. Thanks again for the review and the report!

Best regards,
Pei

_______________________________________________
linux-riscv mailing list
linux-riscv@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-riscv