From: Nicholas Dudar <main.kalliope@gmail.com>
To: ast@kernel.org, daniel@iogearbox.net, andrii@kernel.org,
eddyz87@gmail.com, memxor@gmail.com,
johan.almbladh@anyfinetworks.com, paulburton@kernel.org,
tsbogend@alpha.franken.de
Cc: martin.lau@linux.dev, song@kernel.org, yonghong.song@linux.dev,
jolsa@kernel.org, emil@etsalapatis.com, ihor.solodrai@linux.dev,
bpf@vger.kernel.org, linux-mips@vger.kernel.org,
linux-kernel@vger.kernel.org
Subject: [PATCH bpf-next v3 2/2] bpf, mips: Add support for BPF_MOVSX in the JITs
Date: Sat, 12 Sep 2026 00:12:20 -0400 [thread overview]
Message-ID: <20260912041220.444715-3-main.kalliope@gmail.com> (raw)
In-Reply-To: <20260912041220.444715-1-main.kalliope@gmail.com>
Both MIPS JITs ignore insn->off when lowering register MOV
instructions, so BPF_MOVSX is emitted as an ordinary move. Since
build_insn() accepts it, affected programs are silently miscompiled
instead of falling back to the interpreter.
Decode the MOVSX width from insn->off in the register-move helpers.
On MIPS32, propagate the sign into the high word for ALU64 while
preserving the existing ALU32 zero-extension handling.
Use seb/seh on MIPS32 R2-or-newer CPUs and shift pairs otherwise.
On MIPS64, seb/seh require a sign-extended 32-bit source. Normalizing
an arbitrary BPF register first would cost another instruction, so
retain the doubleword shift pairs.
Assisted-by: Codex:gpt-6
Signed-off-by: Nicholas Dudar <main.kalliope@gmail.com>
---
arch/mips/net/bpf_jit_comp32.c | 65 +++++++++++++++++++++++++++++-----
arch/mips/net/bpf_jit_comp64.c | 55 +++++++++++++++++++++++-----
2 files changed, 103 insertions(+), 17 deletions(-)
diff --git a/arch/mips/net/bpf_jit_comp32.c b/arch/mips/net/bpf_jit_comp32.c
index 6d603d9eeb1..8f1ab851863 100644
--- a/arch/mips/net/bpf_jit_comp32.c
+++ b/arch/mips/net/bpf_jit_comp32.c
@@ -190,20 +190,67 @@ static void emit_zext_ver(struct jit_context *ctx, const u8 dst[])
}
}
-/* Register move operation (32-bit) */
+/* Sign-extend an 8- or 16-bit field into a native register. */
+static void emit_movsx_r(struct jit_context *ctx, u8 dst, u8 src, s16 off)
+{
+ int shift;
+
+ if (cpu_has_mips32r2 || cpu_has_mips32r6) {
+ if (off == 8)
+ emit(ctx, seb, dst, src);
+ else
+ emit(ctx, seh, dst, src);
+ } else {
+ shift = 32 - off;
+ emit(ctx, sll, dst, src, shift);
+ emit(ctx, sra, dst, dst, shift);
+ }
+}
+
+/* Register move operation (32-bit), optionally with sign extension */
static void emit_mov_r32(struct jit_context *ctx, const u8 dst[],
- const u8 src[])
+ const u8 src[], s16 off)
{
- emit_mov_r(ctx, lo(dst), lo(src));
+ switch (off) {
+ case 8:
+ case 16:
+ emit_movsx_r(ctx, lo(dst), lo(src), off);
+ break;
+ default:
+ /* off == 0 is MOV; the verifier rejects other offsets. */
+ emit_mov_r(ctx, lo(dst), lo(src));
+ break;
+ }
+ clobber_reg(ctx, lo(dst));
emit_zext_ver(ctx, dst);
}
-/* Register move operation (64-bit) */
+/* Register move operation (64-bit), optionally with sign extension */
static void emit_mov_r64(struct jit_context *ctx, const u8 dst[],
- const u8 src[])
+ const u8 src[], s16 off)
{
- emit_mov_r(ctx, lo(dst), lo(src));
- emit_mov_r(ctx, hi(dst), hi(src));
+ switch (off) {
+ case 8:
+ case 16:
+ emit_movsx_r(ctx, lo(dst), lo(src), off);
+ emit(ctx, sra, hi(dst), lo(dst), 31);
+ break;
+ case 32:
+ emit(ctx, move, lo(dst), lo(src));
+ emit(ctx, sra, hi(dst), lo(dst), 31);
+ break;
+ default:
+ /*
+ * off == 0 is ordinary MOV. The verifier rejects other
+ * offsets; defined exceptions require
+ * bpf_jit_supports_percpu_insn() or bpf_jit_supports_arena(),
+ * neither implemented by MIPS.
+ */
+ emit_mov_r(ctx, lo(dst), lo(src));
+ emit_mov_r(ctx, hi(dst), hi(src));
+ break;
+ }
+ clobber_reg64(ctx, dst);
}
/* Load delay slot, if ISA mandates it */
@@ -1510,7 +1557,7 @@ int build_insn(const struct bpf_insn *insn, struct jit_context *ctx)
/* Special mov32 for zext */
emit_mov_i(ctx, hi(dst), 0);
} else {
- emit_mov_r32(ctx, dst, src);
+ emit_mov_r32(ctx, dst, src, off);
}
break;
/* dst = -dst */
@@ -1579,7 +1626,7 @@ int build_insn(const struct bpf_insn *insn, struct jit_context *ctx)
break;
/* dst = src (64-bit) */
case BPF_ALU64 | BPF_MOV | BPF_X:
- emit_mov_r64(ctx, dst, src);
+ emit_mov_r64(ctx, dst, src, off);
break;
/* dst = -dst (64-bit) */
case BPF_ALU64 | BPF_NEG:
diff --git a/arch/mips/net/bpf_jit_comp64.c b/arch/mips/net/bpf_jit_comp64.c
index 92df2eba139..4507841a922 100644
--- a/arch/mips/net/bpf_jit_comp64.c
+++ b/arch/mips/net/bpf_jit_comp64.c
@@ -120,17 +120,56 @@ static void emit_zext_ver(struct jit_context *ctx, u8 dst)
emit_zext(ctx, dst);
}
-/* Register move operation (32-bit) */
-static void emit_mov_r32(struct jit_context *ctx, u8 dst, u8 src)
+/* Sign-extend an 8- or 16-bit field into a native register. */
+static void emit_movsx_r(struct jit_context *ctx, u8 dst, u8 src, s16 off)
{
- emit_mov_r(ctx, dst, src);
+ /* seb/seh would need a sign-extended 32-bit source first. */
+ int shift = 32 - off;
+
+ /* dsll32 and dsra32 add 32 to the shift argument. */
+ emit(ctx, dsll32, dst, src, shift);
+ emit(ctx, dsra32, dst, dst, shift);
+}
+
+/* Register move operation (32-bit), optionally with sign extension */
+static void emit_mov_r32(struct jit_context *ctx, u8 dst, u8 src, s16 off)
+{
+ switch (off) {
+ case 8:
+ case 16:
+ emit_movsx_r(ctx, dst, src, off);
+ break;
+ default:
+ /* off == 0 is MOV; the verifier rejects other offsets. */
+ emit_mov_r(ctx, dst, src);
+ break;
+ }
+ clobber_reg(ctx, dst);
emit_zext_ver(ctx, dst);
}
-/* Register move operation (64-bit) */
-static void emit_mov_r64(struct jit_context *ctx, u8 dst, u8 src)
+/* Register move operation (64-bit), optionally with sign extension */
+static void emit_mov_r64(struct jit_context *ctx, u8 dst, u8 src, s16 off)
{
- emit_mov_r(ctx, dst, src);
+ switch (off) {
+ case 8:
+ case 16:
+ emit_movsx_r(ctx, dst, src, off);
+ break;
+ case 32:
+ emit_sext(ctx, dst, src);
+ break;
+ default:
+ /*
+ * off == 0 is ordinary MOV. The verifier rejects other
+ * offsets; defined exceptions require
+ * bpf_jit_supports_percpu_insn() or bpf_jit_supports_arena(),
+ * neither implemented by MIPS.
+ */
+ emit_mov_r(ctx, dst, src);
+ break;
+ }
+ clobber_reg(ctx, dst);
}
/* dst = imm (64-bit) */
@@ -694,7 +733,7 @@ int build_insn(const struct bpf_insn *insn, struct jit_context *ctx)
/* Special mov32 for zext */
emit_zext(ctx, dst);
} else {
- emit_mov_r32(ctx, dst, src);
+ emit_mov_r32(ctx, dst, src, off);
}
break;
/* dst = -dst */
@@ -779,7 +818,7 @@ int build_insn(const struct bpf_insn *insn, struct jit_context *ctx)
break;
/* dst = src (64-bit) */
case BPF_ALU64 | BPF_MOV | BPF_X:
- emit_mov_r64(ctx, dst, src);
+ emit_mov_r64(ctx, dst, src, off);
break;
/* dst = -dst (64-bit) */
case BPF_ALU64 | BPF_NEG:
next prev parent reply other threads:[~2026-09-12 4:12 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-09-12 4:12 [PATCH bpf-next v3 0/2] bpf, mips: Add BPF_MOVSX support to the JITs Nicholas Dudar
2026-09-12 4:12 ` [PATCH bpf-next v3 1/2] bpf, mips: Factor register moves into helpers Nicholas Dudar
2026-09-12 4:12 ` Nicholas Dudar [this message]
2026-09-12 5:03 ` [PATCH bpf-next v3 2/2] bpf, mips: Add support for BPF_MOVSX in the JITs bot+bpf-ci
2026-09-12 19:37 ` Nicholas Dudar
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260912041220.444715-3-main.kalliope@gmail.com \
--to=main.kalliope@gmail.com \
--cc=andrii@kernel.org \
--cc=ast@kernel.org \
--cc=bpf@vger.kernel.org \
--cc=daniel@iogearbox.net \
--cc=eddyz87@gmail.com \
--cc=emil@etsalapatis.com \
--cc=ihor.solodrai@linux.dev \
--cc=johan.almbladh@anyfinetworks.com \
--cc=jolsa@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mips@vger.kernel.org \
--cc=martin.lau@linux.dev \
--cc=memxor@gmail.com \
--cc=paulburton@kernel.org \
--cc=song@kernel.org \
--cc=tsbogend@alpha.franken.de \
--cc=yonghong.song@linux.dev \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox