[PATCH bpf-next 0/2] s390/bpf: Replace ly instruction with llgf

[PATCH bpf-next 0/2] s390/bpf: Replace ly instruction with llgf

[Maxim Khmelevskii]

Sashiko found a bug [1] in 9012cf2491e3, where upper bits of a 64-bit
register are not zero-extended after ly instruction in used.

Tested:
  ./test_progs -v -t get_smp_processor_id

[1] https://sashiko.dev/#/patchset/20260414142930.528751-1-max%40linux.ibm.com

Maxim Khmelevskii (2):
  s390/bpf: Replace ly instruction with llgf
  selftests/bpf: Add test for bpf_get_smp_processor_id

 arch/s390/net/bpf_jit_comp.c                  |  4 +-
 .../bpf/prog_tests/get_smp_processor_id.c     | 45 +++++++++++++++++++
 .../bpf/progs/get_smp_processor_id.c          | 20 +++++++++
 3 files changed, 67 insertions(+), 2 deletions(-)
 create mode 100644 tools/testing/selftests/bpf/prog_tests/get_smp_processor_id.c
 create mode 100644 tools/testing/selftests/bpf/progs/get_smp_processor_id.c

-- 
2.54.0

[PATCH bpf-next 1/2] s390/bpf: Replace ly instruction with llgf

[Maxim Khmelevskii]

cpu_nr is a 32 bit value and BPF_REG_0 is a 64 bit register,
when ly loads the cpu_nr into BPF_REG_0 it does not zero the upper bits,
but llgf does.

Link: https://sashiko.dev/#/patchset/20260414142930.528751-1-max%40linux.ibm.com
Fixes: 9012cf2491e3 ("s390/bpf: Inline smp_processor_id and current_task")
Signed-off-by: Maxim Khmelevskii <max@linux.ibm.com>
Reviewed-by: Ilya Leoshkevich <iii@linux.ibm.com>
---
 arch/s390/net/bpf_jit_comp.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/arch/s390/net/bpf_jit_comp.c b/arch/s390/net/bpf_jit_comp.c
index 14eaaa5b2185..d62c5838c741 100644
--- a/arch/s390/net/bpf_jit_comp.c
+++ b/arch/s390/net/bpf_jit_comp.c
@@ -1783,8 +1783,8 @@ static noinline int bpf_jit_insn(struct bpf_jit *jit, struct bpf_prog *fp,
 		    insn->imm == BPF_FUNC_get_smp_processor_id) {
 			const u32 *cpu_nr = &get_lowcore()->cpu_nr;
 
-			/* ly %b0, cpu_nr */
-			EMIT6_DISP_LH(0xe3000000, 0x0058, BPF_REG_0, REG_0, REG_0,
+			/* llgf %b0, cpu_nr */
+			EMIT6_DISP_LH(0xe3000000, 0x0016, BPF_REG_0, REG_0, REG_0,
 				      (unsigned long)cpu_nr);
 			break;
 		}
-- 
2.54.0

[PATCH bpf-next 2/2] selftests/bpf: Add test for bpf_get_smp_processor_id

[Maxim Khmelevskii]

Add a test which checks on each CPU that the
bpf_get_smp_processor_id BPF helper is returning
the correct CPU number.

Signed-off-by: Maxim Khmelevskii <max@linux.ibm.com>
Reviewed-by: Ilya Leoshkevich <iii@linux.ibm.com>
---
 .../bpf/prog_tests/get_smp_processor_id.c     | 45 +++++++++++++++++++
 .../bpf/progs/get_smp_processor_id.c          | 20 +++++++++
 2 files changed, 65 insertions(+)
 create mode 100644 tools/testing/selftests/bpf/prog_tests/get_smp_processor_id.c
 create mode 100644 tools/testing/selftests/bpf/progs/get_smp_processor_id.c

diff --git a/tools/testing/selftests/bpf/prog_tests/get_smp_processor_id.c b/tools/testing/selftests/bpf/prog_tests/get_smp_processor_id.c
new file mode 100644
index 000000000000..1b5c738ab81f
--- /dev/null
+++ b/tools/testing/selftests/bpf/prog_tests/get_smp_processor_id.c
@@ -0,0 +1,45 @@
+// SPDX-License-Identifier: GPL-2.0
+
+#include <test_progs.h>
+#include "bpf/libbpf_internal.h"
+#include "get_smp_processor_id.skel.h"
+
+void test_get_smp_processor_id(void)
+{
+	LIBBPF_OPTS(bpf_test_run_opts, opts,
+		    .flags = BPF_F_TEST_RUN_ON_CPU,
+		    .cpu = 0,
+	);
+	struct get_smp_processor_id *skel;
+	int prog_fd, err, online_cpu_nr, i;
+	bool *online = NULL;
+
+	err = parse_cpu_mask_file("/sys/devices/system/cpu/online",
+				  &online, &online_cpu_nr);
+	if (!ASSERT_OK(err, "parse_cpu_mask_file"))
+		return;
+
+	skel = get_smp_processor_id__open_and_load();
+	if (!ASSERT_OK_PTR(skel, "get_smp_processor_id__open_and_load"))
+		goto cleanup;
+
+	prog_fd = bpf_program__fd(skel->progs.call_bpf_get_smp_processor_id);
+
+	for (i = 0; i < online_cpu_nr; i++) {
+		if (!online[i])
+			continue;
+
+		opts.cpu = i;
+		skel->bss->cpu_nr_result = -1;
+
+		err = bpf_prog_test_run_opts(prog_fd, &opts);
+		if (!ASSERT_OK(err, "bpf_prog_test_run_opts"))
+			goto cleanup;
+
+		ASSERT_EQ(skel->bss->cpu_nr_result, opts.cpu, "cpu_nr_result");
+	}
+
+cleanup:
+	free(online);
+	get_smp_processor_id__destroy(skel);
+}
diff --git a/tools/testing/selftests/bpf/progs/get_smp_processor_id.c b/tools/testing/selftests/bpf/progs/get_smp_processor_id.c
new file mode 100644
index 000000000000..cf4791a5cf07
--- /dev/null
+++ b/tools/testing/selftests/bpf/progs/get_smp_processor_id.c
@@ -0,0 +1,20 @@
+// SPDX-License-Identifier: GPL-2.0
+
+#include <linux/bpf.h>
+#include <bpf/bpf_helpers.h>
+#include "bpf_misc.h"
+
+__u64 cpu_nr_result;
+
+SEC("raw_tp")
+void call_bpf_get_smp_processor_id(void)
+{
+	register __u64 r0 asm("r0") = -1;
+	asm volatile ("call %[bpf_get_smp_processor_id];"
+		      : "+r"(r0)
+		      : __imm(bpf_get_smp_processor_id)
+		      : "r1", "r2", "r3", "r4", "r5", "memory");
+	cpu_nr_result = r0;
+}
+
+char _license[] SEC("license") = "GPL";
-- 
2.54.0

Re: [PATCH bpf-next 0/2] s390/bpf: Replace ly instruction with llgf

[patchwork-bot+netdevbpf]

Hello:

This series was applied to bpf/bpf-next.git (master)
by Daniel Borkmann <daniel@iogearbox.net>:

On Fri,  3 Jul 2026 14:51:34 +0200 you wrote:
> Sashiko found a bug [1] in 9012cf2491e3, where upper bits of a 64-bit
> register are not zero-extended after ly instruction in used.
> 
> Tested:
>   ./test_progs -v -t get_smp_processor_id
> 
> [1] https://sashiko.dev/#/patchset/20260414142930.528751-1-max%40linux.ibm.com
> 
> [...]

Here is the summary with links:
  - [bpf-next,1/2] s390/bpf: Replace ly instruction with llgf
    https://git.kernel.org/bpf/bpf-next/c/4abb1bdb600b
  - [bpf-next,2/2] selftests/bpf: Add test for bpf_get_smp_processor_id
    https://git.kernel.org/bpf/bpf-next/c/f71f6c98d1fe

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html