From: Nicholas Dudar <main.kalliope@gmail.com>
To: bpf@vger.kernel.org, udknight@gmail.com, x86@kernel.org
Cc: ast@kernel.org, daniel@iogearbox.net, andrii@kernel.org,
eddyz87@gmail.com, memxor@gmail.com, martin.lau@linux.dev,
song@kernel.org, yonghong.song@linux.dev, jolsa@kernel.org,
emil@etsalapatis.com, ihor.solodrai@linux.dev, tglx@kernel.org,
mingo@redhat.com, bp@alien8.de, dave.hansen@linux.intel.com,
hpa@zytor.com, linux-kernel@vger.kernel.org,
visitorckw@gmail.com
Subject: [PATCH bpf-next v3] bpf, x86: Add support for BPF_SDIV and BPF_SMOD in the i386 JIT
Date: Thu, 30 Jul 2026 20:29:50 -0400 [thread overview]
Message-ID: <20260731002950.179573-1-main.kalliope@gmail.com> (raw)
emit_ia32_div_mod_r() emits an unsigned divide (xor edx,edx + div ecx)
for BPF_DIV and BPF_MOD regardless of the instruction's signedness, so
the i386 JIT does not implement signed BPF_SDIV and BPF_SMOD (off == 1),
which get an unsigned quotient and remainder rather than the verifier's
and the interpreter's signed result for negative operands.
Add signed support. Pass the instruction to emit_ia32_div_mod_r() and,
on the signed path (off == 1), emit cdq + idiv ecx instead of
xor edx,edx + div ecx, mirroring the cdq/idiv-vs-xor/div split the
x86_64 JIT uses. bpf_do_misc_fixups() rewrites the zero-divisor and
INT_MIN/-1 cases out of the instruction stream before the JIT runs.
The RV32 JIT has the same gap.
Signed-off-by: Nicholas Dudar <main.kalliope@gmail.com>
Assisted-by: Claude:claude-opus-4-8
---
v3:
- Correct the incomplete recipient list.
v2:
- Frame as adding support and drop the Fixes tag, per Pu Lehui [1].
- Pass struct bpf_insn * to emit_ia32_div_mod_r() rather than separate
op and is_signed parameters, per Kuan-Wei Chiu.
v2: https://lore.kernel.org/bpf/20260714023939.616686-1-main.kalliope@gmail.com/
v1: https://lore.kernel.org/bpf/20260713185848.120137-1-main.kalliope@gmail.com/
[1]: https://lore.kernel.org/bpf/fa8a040f-64c4-484f-9538-fb0ec287639f@huawei.com/
arch/x86/net/bpf_jit_comp32.c | 25 +++++++++++++++++--------
1 file changed, 17 insertions(+), 8 deletions(-)
diff --git a/arch/x86/net/bpf_jit_comp32.c b/arch/x86/net/bpf_jit_comp32.c
index 852baf2e4db4..012161da3e82 100644
--- a/arch/x86/net/bpf_jit_comp32.c
+++ b/arch/x86/net/bpf_jit_comp32.c
@@ -432,11 +432,13 @@ static inline void emit_ia32_to_be_r64(const u8 dst[], s32 val,
* ALU operation (32 bit)
* dst = dst (div|mod) src
*/
-static inline void emit_ia32_div_mod_r(const u8 op, const u8 dst, const u8 src,
- bool dstk, bool sstk, u8 **pprog)
+static inline void emit_ia32_div_mod_r(const struct bpf_insn *insn, const u8 dst,
+ const u8 src, bool dstk, bool sstk, u8 **pprog)
{
u8 *prog = *pprog;
int cnt = 0;
+ const u8 op = BPF_OP(insn->code);
+ const bool is_signed = (insn->off == 1);
if (sstk)
/* mov ecx,dword ptr [ebp+off] */
@@ -454,10 +456,17 @@ static inline void emit_ia32_div_mod_r(const u8 op, const u8 dst, const u8 src,
/* mov eax,dst */
EMIT2(0x8B, add_2reg(0xC0, dst, IA32_EAX));
- /* xor edx,edx */
- EMIT2(0x31, add_2reg(0xC0, IA32_EDX, IA32_EDX));
- /* div ecx */
- EMIT2(0xF7, add_1reg(0xF0, IA32_ECX));
+ if (is_signed) {
+ /* cdq */
+ EMIT1(0x99);
+ /* idiv ecx */
+ EMIT2(0xF7, add_1reg(0xF8, IA32_ECX));
+ } else {
+ /* xor edx,edx */
+ EMIT2(0x31, add_2reg(0xC0, IA32_EDX, IA32_EDX));
+ /* div ecx */
+ EMIT2(0xF7, add_1reg(0xF0, IA32_ECX));
+ }
if (op == BPF_MOD) {
if (dstk)
@@ -1795,14 +1804,14 @@ static int do_jit(struct bpf_prog *bpf_prog, int *addrs, u8 *image,
case BPF_ALU | BPF_MOD | BPF_X:
switch (BPF_SRC(code)) {
case BPF_X:
- emit_ia32_div_mod_r(BPF_OP(code), dst_lo,
+ emit_ia32_div_mod_r(insn, dst_lo,
src_lo, dstk, sstk, &prog);
break;
case BPF_K:
/* mov ecx,imm32*/
EMIT2_off32(0xC7, add_1reg(0xC0, IA32_ECX),
imm32);
- emit_ia32_div_mod_r(BPF_OP(code), dst_lo,
+ emit_ia32_div_mod_r(insn, dst_lo,
IA32_ECX, dstk, false,
&prog);
break;
base-commit: 863f3ddd0b8ac65abfb50d3be0869268ac0e277b
reply other threads:[~2026-07-31 0:30 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260731002950.179573-1-main.kalliope@gmail.com \
--to=main.kalliope@gmail.com \
--cc=andrii@kernel.org \
--cc=ast@kernel.org \
--cc=bp@alien8.de \
--cc=bpf@vger.kernel.org \
--cc=daniel@iogearbox.net \
--cc=dave.hansen@linux.intel.com \
--cc=eddyz87@gmail.com \
--cc=emil@etsalapatis.com \
--cc=hpa@zytor.com \
--cc=ihor.solodrai@linux.dev \
--cc=jolsa@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=martin.lau@linux.dev \
--cc=memxor@gmail.com \
--cc=mingo@redhat.com \
--cc=song@kernel.org \
--cc=tglx@kernel.org \
--cc=udknight@gmail.com \
--cc=visitorckw@gmail.com \
--cc=x86@kernel.org \
--cc=yonghong.song@linux.dev \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox