* [PATCH bpf] LoongArch: bpf: zero-extend signed ALU32 div/mod results
@ 2026-07-09 13:53 Nicholas Dudar
2026-07-10 10:14 ` Tiezhu Yang
0 siblings, 1 reply; 3+ messages in thread
From: Nicholas Dudar @ 2026-07-09 13:53 UTC (permalink / raw)
To: bpf; +Cc: yangtiezhu, hengqi.chen
ALU32 operations write a 32-bit result and leave the upper 32 bits of
the BPF register zero. The LoongArch JIT sign-extends the result of
signed ALU32 BPF_DIV and BPF_MOD (off=1), so a negative 32-bit quotient
or remainder leaves bits 63:32 set in JITted code while the verifier
and interpreter model those bits as zero.
Keep sign-extension on the operands, which signed divide needs, and
zero-extend the ALU32 result after the divide or modulo instruction,
matching the unsigned ALU32 div/mod paths and every other ALU32
operation in this JIT.
Fixes: 2425c9e002d2 ("LoongArch: BPF: Support signed div instructions")
Fixes: 7b6b13d32965 ("LoongArch: BPF: Support signed mod instructions")
Signed-off-by: Nicholas Dudar <main.kalliope@gmail.com>
Assisted-by: Claude:claude-opus-4-8
---
Reported privately to security@kernel.org first; posting to the list
at the maintainer's request. The patch is the same.
arch/loongarch/net/bpf_jit.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/arch/loongarch/net/bpf_jit.c b/arch/loongarch/net/bpf_jit.c
index 2738b4db1165..c91d474faba7 100644
--- a/arch/loongarch/net/bpf_jit.c
+++ b/arch/loongarch/net/bpf_jit.c
@@ -835,7 +835,7 @@ static int build_insn(const struct bpf_insn *insn, struct jit_ctx *ctx, bool ext
move_reg(ctx, t1, src);
emit_sext_32(ctx, t1, is32);
emit_insn(ctx, divd, dst, dst, t1);
- emit_sext_32(ctx, dst, is32);
+ emit_zext_32(ctx, dst, is32);
}
break;
@@ -852,7 +852,7 @@ static int build_insn(const struct bpf_insn *insn, struct jit_ctx *ctx, bool ext
emit_sext_32(ctx, t1, is32);
emit_sext_32(ctx, dst, is32);
emit_insn(ctx, divd, dst, dst, t1);
- emit_sext_32(ctx, dst, is32);
+ emit_zext_32(ctx, dst, is32);
}
break;
@@ -870,7 +870,7 @@ static int build_insn(const struct bpf_insn *insn, struct jit_ctx *ctx, bool ext
move_reg(ctx, t1, src);
emit_sext_32(ctx, t1, is32);
emit_insn(ctx, modd, dst, dst, t1);
- emit_sext_32(ctx, dst, is32);
+ emit_zext_32(ctx, dst, is32);
}
break;
@@ -887,7 +887,7 @@ static int build_insn(const struct bpf_insn *insn, struct jit_ctx *ctx, bool ext
emit_sext_32(ctx, t1, is32);
emit_sext_32(ctx, dst, is32);
emit_insn(ctx, modd, dst, dst, t1);
- emit_sext_32(ctx, dst, is32);
+ emit_zext_32(ctx, dst, is32);
}
break;
base-commit: 0e35b9b6ec0ffcc5e23cbdec09f5c622ad532b53
--
2.34.1
^ permalink raw reply related [flat|nested] 3+ messages in thread* Re: [PATCH bpf] LoongArch: bpf: zero-extend signed ALU32 div/mod results
2026-07-09 13:53 [PATCH bpf] LoongArch: bpf: zero-extend signed ALU32 div/mod results Nicholas Dudar
@ 2026-07-10 10:14 ` Tiezhu Yang
2026-07-11 2:51 ` Huacai Chen
0 siblings, 1 reply; 3+ messages in thread
From: Tiezhu Yang @ 2026-07-10 10:14 UTC (permalink / raw)
To: Nicholas Dudar, bpf; +Cc: hengqi.chen, loongarch, Huacai Chen
Cc: Huacai Chen <chenhuacai@kernel.org> loongarch@lists.linux.dev
On 2026/7/9 下午9:53, Nicholas Dudar wrote:
> ALU32 operations write a 32-bit result and leave the upper 32 bits of
> the BPF register zero. The LoongArch JIT sign-extends the result of
> signed ALU32 BPF_DIV and BPF_MOD (off=1), so a negative 32-bit quotient
> or remainder leaves bits 63:32 set in JITted code while the verifier
> and interpreter model those bits as zero.
>
> Keep sign-extension on the operands, which signed divide needs, and
> zero-extend the ALU32 result after the divide or modulo instruction,
> matching the unsigned ALU32 div/mod paths and every other ALU32
> operation in this JIT.
>
> Fixes: 2425c9e002d2 ("LoongArch: BPF: Support signed div instructions")
> Fixes: 7b6b13d32965 ("LoongArch: BPF: Support signed mod instructions")
> Signed-off-by: Nicholas Dudar <main.kalliope@gmail.com>
> Assisted-by: Claude:claude-opus-4-8
> ---
> Reported privately to security@kernel.org first; posting to the list
> at the maintainer's request. The patch is the same.
>
> arch/loongarch/net/bpf_jit.c | 8 ++++----
> 1 file changed, 4 insertions(+), 4 deletions(-)
>
> diff --git a/arch/loongarch/net/bpf_jit.c b/arch/loongarch/net/bpf_jit.c
> index 2738b4db1165..c91d474faba7 100644
> --- a/arch/loongarch/net/bpf_jit.c
> +++ b/arch/loongarch/net/bpf_jit.c
> @@ -835,7 +835,7 @@ static int build_insn(const struct bpf_insn *insn, struct jit_ctx *ctx, bool ext
> move_reg(ctx, t1, src);
> emit_sext_32(ctx, t1, is32);
> emit_insn(ctx, divd, dst, dst, t1);
> - emit_sext_32(ctx, dst, is32);
> + emit_zext_32(ctx, dst, is32);
> }
> break;
>
> @@ -852,7 +852,7 @@ static int build_insn(const struct bpf_insn *insn, struct jit_ctx *ctx, bool ext
> emit_sext_32(ctx, t1, is32);
> emit_sext_32(ctx, dst, is32);
> emit_insn(ctx, divd, dst, dst, t1);
> - emit_sext_32(ctx, dst, is32);
> + emit_zext_32(ctx, dst, is32);
> }
> break;
>
> @@ -870,7 +870,7 @@ static int build_insn(const struct bpf_insn *insn, struct jit_ctx *ctx, bool ext
> move_reg(ctx, t1, src);
> emit_sext_32(ctx, t1, is32);
> emit_insn(ctx, modd, dst, dst, t1);
> - emit_sext_32(ctx, dst, is32);
> + emit_zext_32(ctx, dst, is32);
> }
> break;
>
> @@ -887,7 +887,7 @@ static int build_insn(const struct bpf_insn *insn, struct jit_ctx *ctx, bool ext
> emit_sext_32(ctx, t1, is32);
> emit_sext_32(ctx, dst, is32);
> emit_insn(ctx, modd, dst, dst, t1);
> - emit_sext_32(ctx, dst, is32);
> + emit_zext_32(ctx, dst, is32);
> }
> break;
>
>
> base-commit: 0e35b9b6ec0ffcc5e23cbdec09f5c622ad532b53
Here is the link:
https://lore.kernel.org/bpf/20260709135344.1744677-1-main.kalliope@gmail.com/
When executing "sudo modprobe test_bpf" on LoongArch with v7.2-rc1,
there are 4 failed testcases without this patch:
test_bpf: #811 ALU32_SDIV_K: registers jited:1 ret 1354 != 1 (0x54a !=
0x1)FAIL (1 times)
test_bpf: #812 ALU32_SMOD_K: registers jited:1 ret 1354 != 1 (0x54a !=
0x1)FAIL (1 times)
test_bpf: #875 ALU32_SDIV_K: all immediate value magnitudes jited:1 ret
0 != 1 (0x0 != 0x1)FAIL (1 times)
test_bpf: #876 ALU32_SMOD_K: all immediate value magnitudes jited:1 ret
0 != 1 (0x0 != 0x1)FAIL (1 times)
But the failures were not present in v7.1, these regressions were
exposed by commit c8f0ee969f76 ("bpf: Exhaustive test coverage for
signed division and modulo"), which added these cases in v7.2-rc1.
With the provided patch, all tests pass as expected.
Acked-by: Tiezhu Yang <yangtiezhu@loongson.cn>
Tested-by: Tiezhu Yang <yangtiezhu@loongson.cn>
Thanks,
Tiezhu
^ permalink raw reply [flat|nested] 3+ messages in thread* Re: [PATCH bpf] LoongArch: bpf: zero-extend signed ALU32 div/mod results
2026-07-10 10:14 ` Tiezhu Yang
@ 2026-07-11 2:51 ` Huacai Chen
0 siblings, 0 replies; 3+ messages in thread
From: Huacai Chen @ 2026-07-11 2:51 UTC (permalink / raw)
To: Tiezhu Yang; +Cc: Nicholas Dudar, bpf, hengqi.chen, loongarch
On Fri, Jul 10, 2026 at 6:14 PM Tiezhu Yang <yangtiezhu@loongson.cn> wrote:
>
> Cc: Huacai Chen <chenhuacai@kernel.org> loongarch@lists.linux.dev
>
> On 2026/7/9 下午9:53, Nicholas Dudar wrote:
> > ALU32 operations write a 32-bit result and leave the upper 32 bits of
> > the BPF register zero. The LoongArch JIT sign-extends the result of
> > signed ALU32 BPF_DIV and BPF_MOD (off=1), so a negative 32-bit quotient
> > or remainder leaves bits 63:32 set in JITted code while the verifier
> > and interpreter model those bits as zero.
> >
> > Keep sign-extension on the operands, which signed divide needs, and
> > zero-extend the ALU32 result after the divide or modulo instruction,
> > matching the unsigned ALU32 div/mod paths and every other ALU32
> > operation in this JIT.
> >
> > Fixes: 2425c9e002d2 ("LoongArch: BPF: Support signed div instructions")
> > Fixes: 7b6b13d32965 ("LoongArch: BPF: Support signed mod instructions")
> > Signed-off-by: Nicholas Dudar <main.kalliope@gmail.com>
> > Assisted-by: Claude:claude-opus-4-8
> > ---
> > Reported privately to security@kernel.org first; posting to the list
> > at the maintainer's request. The patch is the same.
> >
> > arch/loongarch/net/bpf_jit.c | 8 ++++----
> > 1 file changed, 4 insertions(+), 4 deletions(-)
> >
> > diff --git a/arch/loongarch/net/bpf_jit.c b/arch/loongarch/net/bpf_jit.c
> > index 2738b4db1165..c91d474faba7 100644
> > --- a/arch/loongarch/net/bpf_jit.c
> > +++ b/arch/loongarch/net/bpf_jit.c
> > @@ -835,7 +835,7 @@ static int build_insn(const struct bpf_insn *insn, struct jit_ctx *ctx, bool ext
> > move_reg(ctx, t1, src);
> > emit_sext_32(ctx, t1, is32);
> > emit_insn(ctx, divd, dst, dst, t1);
> > - emit_sext_32(ctx, dst, is32);
> > + emit_zext_32(ctx, dst, is32);
> > }
> > break;
> >
> > @@ -852,7 +852,7 @@ static int build_insn(const struct bpf_insn *insn, struct jit_ctx *ctx, bool ext
> > emit_sext_32(ctx, t1, is32);
> > emit_sext_32(ctx, dst, is32);
> > emit_insn(ctx, divd, dst, dst, t1);
> > - emit_sext_32(ctx, dst, is32);
> > + emit_zext_32(ctx, dst, is32);
> > }
> > break;
> >
> > @@ -870,7 +870,7 @@ static int build_insn(const struct bpf_insn *insn, struct jit_ctx *ctx, bool ext
> > move_reg(ctx, t1, src);
> > emit_sext_32(ctx, t1, is32);
> > emit_insn(ctx, modd, dst, dst, t1);
> > - emit_sext_32(ctx, dst, is32);
> > + emit_zext_32(ctx, dst, is32);
> > }
> > break;
> >
> > @@ -887,7 +887,7 @@ static int build_insn(const struct bpf_insn *insn, struct jit_ctx *ctx, bool ext
> > emit_sext_32(ctx, t1, is32);
> > emit_sext_32(ctx, dst, is32);
> > emit_insn(ctx, modd, dst, dst, t1);
> > - emit_sext_32(ctx, dst, is32);
> > + emit_zext_32(ctx, dst, is32);
> > }
> > break;
> >
> >
> > base-commit: 0e35b9b6ec0ffcc5e23cbdec09f5c622ad532b53
>
> Here is the link:
> https://lore.kernel.org/bpf/20260709135344.1744677-1-main.kalliope@gmail.com/
>
> When executing "sudo modprobe test_bpf" on LoongArch with v7.2-rc1,
> there are 4 failed testcases without this patch:
>
> test_bpf: #811 ALU32_SDIV_K: registers jited:1 ret 1354 != 1 (0x54a !=
> 0x1)FAIL (1 times)
> test_bpf: #812 ALU32_SMOD_K: registers jited:1 ret 1354 != 1 (0x54a !=
> 0x1)FAIL (1 times)
> test_bpf: #875 ALU32_SDIV_K: all immediate value magnitudes jited:1 ret
> 0 != 1 (0x0 != 0x1)FAIL (1 times)
> test_bpf: #876 ALU32_SMOD_K: all immediate value magnitudes jited:1 ret
> 0 != 1 (0x0 != 0x1)FAIL (1 times)
>
> But the failures were not present in v7.1, these regressions were
> exposed by commit c8f0ee969f76 ("bpf: Exhaustive test coverage for
> signed division and modulo"), which added these cases in v7.2-rc1.
>
> With the provided patch, all tests pass as expected.
>
> Acked-by: Tiezhu Yang <yangtiezhu@loongson.cn>
> Tested-by: Tiezhu Yang <yangtiezhu@loongson.cn>
I have queued this patch for loongarch-fixes, thanks.
Huacai
>
> Thanks,
> Tiezhu
>
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2026-07-11 2:51 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-07-09 13:53 [PATCH bpf] LoongArch: bpf: zero-extend signed ALU32 div/mod results Nicholas Dudar
2026-07-10 10:14 ` Tiezhu Yang
2026-07-11 2:51 ` Huacai Chen
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox