[PATCH bpf-next v3 0/2] bpf, mips: Add BPF_MOVSX support to the JITs

[PATCH bpf-next v3 0/2] bpf, mips: Add BPF_MOVSX support to the JITs

[Nicholas Dudar]

Add the five MOVSX forms to the MIPS32 and MIPS64 JITs, which currently
emit them as ordinary moves. Patch 1 factors register moves into helpers;
patch 2 adds sign extension.

Use seb/seh on MIPS32 R2+ and doubleword shift pairs on MIPS64, where
normalizing the source for seb/seh would eliminate the instruction saving.
The MIPS64 sequence also matches GCC's generic lowering [1].

This series depends on SDIV/SMOD v4, whose uasm patch adds seb/seh.
This is missing JIT support rather than a regression, hence bpf-next
and no Fixes tag.

Tested the SDIV/SMOD v4 prerequisite and this series with test_bpf under
QEMU Malta on little-endian MIPS32 R1/R2/R6 and MIPS64 R2/R6. All five
MOVSX cases went from failure to JIT pass; all 16 signed DIV/MOD cases
passed on both revisions. Patched pass/fail totals were:

  MIPS32 R2/R6: 1050/12
  MIPS64 R2/R6: 1049/12
  MIPS32 R1:    1045/17

The 12 failures are 8 BSWAP, 3 MEMSX and 1 JMP32_JA. R1's 5 additional
failures also occurred on the prerequisite-only baseline. No other test
outcome changed between the two revisions.

Earlier v2 tests covered both endians and verifier zero-extension
handling. No physical hardware was tested.

Changes in v3:
- Use seb/seh on MIPS32 R2+; retain shift pairs on MIPS64.
- Share the 8/16-bit sign-extension sequence within each backend.
- Apply on top of SDIV/SMOD v4 for the new uasm emitters.

SDIV/SMOD v4: https://lore.kernel.org/bpf/20260911213340.3767930-1-main.kalliope@gmail.com/
v2: https://lore.kernel.org/bpf/20260904111731.673341-1-main.kalliope@gmail.com/
Review: https://lore.kernel.org/bpf/CAM1=_QTN3JJ6jtckf32F8wxBzLDbHSrzUttyMBWNqZKmRe=2rg@mail.gmail.com/
[1] https://github.com/gcc-mirror/gcc/blob/releases/gcc-15.2.0/gcc/config/mips/mips.md#L3921

Nicholas Dudar (2):
  bpf, mips: Factor register moves into helpers
  bpf, mips: Add support for BPF_MOVSX in the JITs

 arch/mips/net/bpf_jit_comp32.c | 69 ++++++++++++++++++++++++++++++++--
 arch/mips/net/bpf_jit_comp64.c | 57 ++++++++++++++++++++++++++--
 2 files changed, 119 insertions(+), 7 deletions(-)


base-commit: c1ff425d625eb2a4d2967e9889b85f202f24eb5d
prerequisite-patch-id: aa8ca3f50fc4b0160c5fdba43a92e4b7ec3f2e07
prerequisite-patch-id: 9f324d79755bae54c56ce6c90769acc8595c9ad6
prerequisite-patch-id: 35236f563c0536859077709d52b345b696e5c26e

[PATCH bpf-next v3 1/2] bpf, mips: Factor register moves into helpers

[Nicholas Dudar]

Factor ALU32 and ALU64 register moves into backend-local helpers,
keeping register-pair handling and zero extension with the move.
This prepares for decoding the MOVSX width in those helpers.

Keep the verifier-inserted zero-extension marker on its existing path.
No functional change intended.

Assisted-by: Codex:gpt-6
Signed-off-by: Nicholas Dudar <main.kalliope@gmail.com>
---
 arch/mips/net/bpf_jit_comp32.c | 22 ++++++++++++++++++----
 arch/mips/net/bpf_jit_comp64.c | 18 +++++++++++++++---
 2 files changed, 33 insertions(+), 7 deletions(-)

diff --git a/arch/mips/net/bpf_jit_comp32.c b/arch/mips/net/bpf_jit_comp32.c
index 6619182b5ef..6d603d9eeb1 100644
--- a/arch/mips/net/bpf_jit_comp32.c
+++ b/arch/mips/net/bpf_jit_comp32.c
@@ -190,6 +190,22 @@ static void emit_zext_ver(struct jit_context *ctx, const u8 dst[])
 	}
 }
 
+/* Register move operation (32-bit) */
+static void emit_mov_r32(struct jit_context *ctx, const u8 dst[],
+			 const u8 src[])
+{
+	emit_mov_r(ctx, lo(dst), lo(src));
+	emit_zext_ver(ctx, dst);
+}
+
+/* Register move operation (64-bit) */
+static void emit_mov_r64(struct jit_context *ctx, const u8 dst[],
+			 const u8 src[])
+{
+	emit_mov_r(ctx, lo(dst), lo(src));
+	emit_mov_r(ctx, hi(dst), hi(src));
+}
+
 /* Load delay slot, if ISA mandates it */
 static void emit_load_delay(struct jit_context *ctx)
 {
@@ -1494,8 +1510,7 @@ int build_insn(const struct bpf_insn *insn, struct jit_context *ctx)
 			/* Special mov32 for zext */
 			emit_mov_i(ctx, hi(dst), 0);
 		} else {
-			emit_mov_r(ctx, lo(dst), lo(src));
-			emit_zext_ver(ctx, dst);
+			emit_mov_r32(ctx, dst, src);
 		}
 		break;
 	/* dst = -dst */
@@ -1564,8 +1579,7 @@ int build_insn(const struct bpf_insn *insn, struct jit_context *ctx)
 		break;
 	/* dst = src (64-bit) */
 	case BPF_ALU64 | BPF_MOV | BPF_X:
-		emit_mov_r(ctx, lo(dst), lo(src));
-		emit_mov_r(ctx, hi(dst), hi(src));
+		emit_mov_r64(ctx, dst, src);
 		break;
 	/* dst = -dst (64-bit) */
 	case BPF_ALU64 | BPF_NEG:
diff --git a/arch/mips/net/bpf_jit_comp64.c b/arch/mips/net/bpf_jit_comp64.c
index db027c2d922..92df2eba139 100644
--- a/arch/mips/net/bpf_jit_comp64.c
+++ b/arch/mips/net/bpf_jit_comp64.c
@@ -120,6 +120,19 @@ static void emit_zext_ver(struct jit_context *ctx, u8 dst)
 		emit_zext(ctx, dst);
 }
 
+/* Register move operation (32-bit) */
+static void emit_mov_r32(struct jit_context *ctx, u8 dst, u8 src)
+{
+	emit_mov_r(ctx, dst, src);
+	emit_zext_ver(ctx, dst);
+}
+
+/* Register move operation (64-bit) */
+static void emit_mov_r64(struct jit_context *ctx, u8 dst, u8 src)
+{
+	emit_mov_r(ctx, dst, src);
+}
+
 /* dst = imm (64-bit) */
 static void emit_mov_i64(struct jit_context *ctx, u8 dst, u64 imm64)
 {
@@ -681,8 +694,7 @@ int build_insn(const struct bpf_insn *insn, struct jit_context *ctx)
 			/* Special mov32 for zext */
 			emit_zext(ctx, dst);
 		} else {
-			emit_mov_r(ctx, dst, src);
-			emit_zext_ver(ctx, dst);
+			emit_mov_r32(ctx, dst, src);
 		}
 		break;
 	/* dst = -dst */
@@ -767,7 +779,7 @@ int build_insn(const struct bpf_insn *insn, struct jit_context *ctx)
 		break;
 	/* dst = src (64-bit) */
 	case BPF_ALU64 | BPF_MOV | BPF_X:
-		emit_mov_r(ctx, dst, src);
+		emit_mov_r64(ctx, dst, src);
 		break;
 	/* dst = -dst (64-bit) */
 	case BPF_ALU64 | BPF_NEG:

[PATCH bpf-next v3 2/2] bpf, mips: Add support for BPF_MOVSX in the JITs

[Nicholas Dudar]

Both MIPS JITs ignore insn->off when lowering register MOV
instructions, so BPF_MOVSX is emitted as an ordinary move. Since
build_insn() accepts it, affected programs are silently miscompiled
instead of falling back to the interpreter.

Decode the MOVSX width from insn->off in the register-move helpers.
On MIPS32, propagate the sign into the high word for ALU64 while
preserving the existing ALU32 zero-extension handling.

Use seb/seh on MIPS32 R2-or-newer CPUs and shift pairs otherwise.
On MIPS64, seb/seh require a sign-extended 32-bit source. Normalizing
an arbitrary BPF register first would cost another instruction, so
retain the doubleword shift pairs.

Assisted-by: Codex:gpt-6
Signed-off-by: Nicholas Dudar <main.kalliope@gmail.com>
---
 arch/mips/net/bpf_jit_comp32.c | 65 +++++++++++++++++++++++++++++-----
 arch/mips/net/bpf_jit_comp64.c | 55 +++++++++++++++++++++++-----
 2 files changed, 103 insertions(+), 17 deletions(-)

diff --git a/arch/mips/net/bpf_jit_comp32.c b/arch/mips/net/bpf_jit_comp32.c
index 6d603d9eeb1..8f1ab851863 100644
--- a/arch/mips/net/bpf_jit_comp32.c
+++ b/arch/mips/net/bpf_jit_comp32.c
@@ -190,20 +190,67 @@ static void emit_zext_ver(struct jit_context *ctx, const u8 dst[])
 	}
 }
 
-/* Register move operation (32-bit) */
+/* Sign-extend an 8- or 16-bit field into a native register. */
+static void emit_movsx_r(struct jit_context *ctx, u8 dst, u8 src, s16 off)
+{
+	int shift;
+
+	if (cpu_has_mips32r2 || cpu_has_mips32r6) {
+		if (off == 8)
+			emit(ctx, seb, dst, src);
+		else
+			emit(ctx, seh, dst, src);
+	} else {
+		shift = 32 - off;
+		emit(ctx, sll, dst, src, shift);
+		emit(ctx, sra, dst, dst, shift);
+	}
+}
+
+/* Register move operation (32-bit), optionally with sign extension */
 static void emit_mov_r32(struct jit_context *ctx, const u8 dst[],
-			 const u8 src[])
+			 const u8 src[], s16 off)
 {
-	emit_mov_r(ctx, lo(dst), lo(src));
+	switch (off) {
+	case 8:
+	case 16:
+		emit_movsx_r(ctx, lo(dst), lo(src), off);
+		break;
+	default:
+		/* off == 0 is MOV; the verifier rejects other offsets. */
+		emit_mov_r(ctx, lo(dst), lo(src));
+		break;
+	}
+	clobber_reg(ctx, lo(dst));
 	emit_zext_ver(ctx, dst);
 }
 
-/* Register move operation (64-bit) */
+/* Register move operation (64-bit), optionally with sign extension */
 static void emit_mov_r64(struct jit_context *ctx, const u8 dst[],
-			 const u8 src[])
+			 const u8 src[], s16 off)
 {
-	emit_mov_r(ctx, lo(dst), lo(src));
-	emit_mov_r(ctx, hi(dst), hi(src));
+	switch (off) {
+	case 8:
+	case 16:
+		emit_movsx_r(ctx, lo(dst), lo(src), off);
+		emit(ctx, sra, hi(dst), lo(dst), 31);
+		break;
+	case 32:
+		emit(ctx, move, lo(dst), lo(src));
+		emit(ctx, sra, hi(dst), lo(dst), 31);
+		break;
+	default:
+		/*
+		 * off == 0 is ordinary MOV. The verifier rejects other
+		 * offsets; defined exceptions require
+		 * bpf_jit_supports_percpu_insn() or bpf_jit_supports_arena(),
+		 * neither implemented by MIPS.
+		 */
+		emit_mov_r(ctx, lo(dst), lo(src));
+		emit_mov_r(ctx, hi(dst), hi(src));
+		break;
+	}
+	clobber_reg64(ctx, dst);
 }
 
 /* Load delay slot, if ISA mandates it */
@@ -1510,7 +1557,7 @@ int build_insn(const struct bpf_insn *insn, struct jit_context *ctx)
 			/* Special mov32 for zext */
 			emit_mov_i(ctx, hi(dst), 0);
 		} else {
-			emit_mov_r32(ctx, dst, src);
+			emit_mov_r32(ctx, dst, src, off);
 		}
 		break;
 	/* dst = -dst */
@@ -1579,7 +1626,7 @@ int build_insn(const struct bpf_insn *insn, struct jit_context *ctx)
 		break;
 	/* dst = src (64-bit) */
 	case BPF_ALU64 | BPF_MOV | BPF_X:
-		emit_mov_r64(ctx, dst, src);
+		emit_mov_r64(ctx, dst, src, off);
 		break;
 	/* dst = -dst (64-bit) */
 	case BPF_ALU64 | BPF_NEG:
diff --git a/arch/mips/net/bpf_jit_comp64.c b/arch/mips/net/bpf_jit_comp64.c
index 92df2eba139..4507841a922 100644
--- a/arch/mips/net/bpf_jit_comp64.c
+++ b/arch/mips/net/bpf_jit_comp64.c
@@ -120,17 +120,56 @@ static void emit_zext_ver(struct jit_context *ctx, u8 dst)
 		emit_zext(ctx, dst);
 }
 
-/* Register move operation (32-bit) */
-static void emit_mov_r32(struct jit_context *ctx, u8 dst, u8 src)
+/* Sign-extend an 8- or 16-bit field into a native register. */
+static void emit_movsx_r(struct jit_context *ctx, u8 dst, u8 src, s16 off)
 {
-	emit_mov_r(ctx, dst, src);
+	/* seb/seh would need a sign-extended 32-bit source first. */
+	int shift = 32 - off;
+
+	/* dsll32 and dsra32 add 32 to the shift argument. */
+	emit(ctx, dsll32, dst, src, shift);
+	emit(ctx, dsra32, dst, dst, shift);
+}
+
+/* Register move operation (32-bit), optionally with sign extension */
+static void emit_mov_r32(struct jit_context *ctx, u8 dst, u8 src, s16 off)
+{
+	switch (off) {
+	case 8:
+	case 16:
+		emit_movsx_r(ctx, dst, src, off);
+		break;
+	default:
+		/* off == 0 is MOV; the verifier rejects other offsets. */
+		emit_mov_r(ctx, dst, src);
+		break;
+	}
+	clobber_reg(ctx, dst);
 	emit_zext_ver(ctx, dst);
 }
 
-/* Register move operation (64-bit) */
-static void emit_mov_r64(struct jit_context *ctx, u8 dst, u8 src)
+/* Register move operation (64-bit), optionally with sign extension */
+static void emit_mov_r64(struct jit_context *ctx, u8 dst, u8 src, s16 off)
 {
-	emit_mov_r(ctx, dst, src);
+	switch (off) {
+	case 8:
+	case 16:
+		emit_movsx_r(ctx, dst, src, off);
+		break;
+	case 32:
+		emit_sext(ctx, dst, src);
+		break;
+	default:
+		/*
+		 * off == 0 is ordinary MOV. The verifier rejects other
+		 * offsets; defined exceptions require
+		 * bpf_jit_supports_percpu_insn() or bpf_jit_supports_arena(),
+		 * neither implemented by MIPS.
+		 */
+		emit_mov_r(ctx, dst, src);
+		break;
+	}
+	clobber_reg(ctx, dst);
 }
 
 /* dst = imm (64-bit) */
@@ -694,7 +733,7 @@ int build_insn(const struct bpf_insn *insn, struct jit_context *ctx)
 			/* Special mov32 for zext */
 			emit_zext(ctx, dst);
 		} else {
-			emit_mov_r32(ctx, dst, src);
+			emit_mov_r32(ctx, dst, src, off);
 		}
 		break;
 	/* dst = -dst */
@@ -779,7 +818,7 @@ int build_insn(const struct bpf_insn *insn, struct jit_context *ctx)
 		break;
 	/* dst = src (64-bit) */
 	case BPF_ALU64 | BPF_MOV | BPF_X:
-		emit_mov_r64(ctx, dst, src);
+		emit_mov_r64(ctx, dst, src, off);
 		break;
 	/* dst = -dst (64-bit) */
 	case BPF_ALU64 | BPF_NEG:

Re: [PATCH bpf-next v3 2/2] bpf, mips: Add support for BPF_MOVSX in the JITs

[bot+bpf-ci]

[-- Attachment #1: Type: text/plain, Size: 4355 bytes --]

> commit f3f0abd62d699a78db3e8f185879a2fede98c6f7
> Author: Nicholas Dudar <main.kalliope@gmail.com>
> Date:   Sat Sep 12 00:12:20 2026 -0400
>
>     bpf, mips: Add support for BPF_MOVSX in the JITs
>
>     Both MIPS JITs ignore insn->off when lowering register MOV
>     instructions, so BPF_MOVSX is emitted as an ordinary move. Since
>     build_insn() accepts it, affected programs are silently miscompiled
>     instead of falling back to the interpreter.
>
>     Decode the MOVSX width from insn->off in the register-move helpers.
>     On MIPS32, propagate the sign into the high word for ALU64 while
>     preserving the existing ALU32 zero-extension handling.
>
>     Use seb/seh on MIPS32 R2-or-newer CPUs and shift pairs otherwise.
>     On MIPS64, seb/seh require a sign-extended 32-bit source. Normalizing
>     an arbitrary BPF register first would cost another instruction, so
>     retain the doubleword shift pairs.
>
>     Assisted-by: Codex:gpt-6
>     Signed-off-by: Nicholas Dudar <main.kalliope@gmail.com>

The changelog describes a silent miscompilation of already-loadable BPF
programs, which indicates this is a bug fix. Should this include a Fixes:
tag pointing to the commit that introduced BPF_MOVSX to the instruction
set?

    Fixes: 8100928c8814 ("bpf: Support new sign-extension mov insns")

That commit added BPF_MOVSX by reusing BPF_ALU|BPF_MOV|BPF_X with insn->off
in {8,16,32}. Because the MIPS build_insn() cases match on insn->code only,
every MOVSX became a plain move from that point on.

> diff --git a/arch/mips/net/bpf_jit_comp32.c b/arch/mips/net/bpf_jit_comp32.c
> index bfe73b023983..11b080a99b9f 100644
> --- a/arch/mips/net/bpf_jit_comp32.c
> +++ b/arch/mips/net/bpf_jit_comp32.c
> @@ -190,20 +190,67 @@ static void emit_zext_ver(struct jit_context *ctx, const u8 dst[])
>  	}
>  }
>
> -/* Register move operation (32-bit) */
> +/* Sign-extend an 8- or 16-bit field into a native register. */
> +static void emit_movsx_r(struct jit_context *ctx, u8 dst, u8 src, s16 off)
> +{
> +	int shift;
> +
> +	if (cpu_has_mips32r2 || cpu_has_mips32r6) {
> +		if (off == 8)
> +			emit(ctx, seb, dst, src);
> +		else
> +			emit(ctx, seh, dst, src);

Does this compile? The MIPS uasm assembler appears to have no seb/seh
emitter. The emit() macro (arch/mips/net/bpf_jit_comp.h:88-96) expands to
uasm_i_##func(), so these lines become uasm_i_seb() and uasm_i_seh().

Looking at arch/mips/include/asm/uasm.h, the instruction list goes:

    Ip_u2s3u1(_sb);
    Ip_u2s3u1(_sc);
    Ip_u2s3u1(_scd);
    Ip_u2s3u1(_sd);
    Ip_u3u1u2(_seleqz);
    Ip_u3u1u2(_selnez);
    Ip_u2s3u1(_sh);
    Ip_u2u1u3(_sll);

There is no Ip_u2u1(_seb) or Ip_u2u1(_seh) declaration (compare
Ip_u2u1(_wsbh), which is the same 2-operand form needed here).

Also, arch/mips/mm/uasm-mips.c, uasm-micromips.c and uasm.c contain no
insn_seb or insn_seh table entries. The patch touches only the two JIT
files, so no uasm support is added.

With CONFIG_32BIT=y + CONFIG_BPF_JIT, the build of bpf_jit_comp32.o would
fail with:

    error: implicit function declaration of 'uasm_i_seb'
    error: implicit function declaration of 'uasm_i_seh'

The else arm below (shift = 32 - off; sll; sra) is correct for both
off==8 and off==16, so it could be used unconditionally. Or seb/seh could
be added to uasm in a preparatory patch (they are part of special3/bshfl
with opcode seb_op/seh_op, alongside the existing wsbh instruction).

> +	} else {
> +		shift = 32 - off;
> +		emit(ctx, sll, dst, src, shift);
> +		emit(ctx, sra, dst, dst, shift);
> +	}
> +}
> +
> +/* Register move operation (32-bit), optionally with sign extension */
>  static void emit_mov_r32(struct jit_context *ctx, const u8 dst[],
> -			 const u8 src[])
> +			 const u8 src[], s16 off)
>  {
> -	emit_mov_r(ctx, lo(dst), lo(src));
> +	switch (off) {
> +	case 8:
> +	case 16:
> +		emit_movsx_r(ctx, lo(dst), lo(src), off);
> +		break;
> +	default:
> +		/* off == 0 is MOV; the verifier rejects other offsets. */
> +		emit_mov_r(ctx, lo(dst), lo(src));
> +		break;
> +	}
> +	clobber_reg(ctx, lo(dst));
>  	emit_zext_ver(ctx, dst);
>  }

[ ... ]


---
AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md

CI run summary: https://github.com/kernel-patches/bpf/actions/runs/34672810925

Re: [PATCH bpf-next v3 2/2] bpf, mips: Add support for BPF_MOVSX in the JITs

[Nicholas Dudar]

> The changelog describes a silent miscompilation of already-loadable BPF
> programs, which indicates this is a bug fix. Should this include a Fixes:
> tag pointing to the commit that introduced BPF_MOVSX to the instruction
> set?

This adds MOVSX support that the MIPS JITs have not previously
implemented. I classified it as architecture enablement and targeted
bpf-next on that basis. The incorrect ordinary-MOV lowering described
in the changelog is real.

This distinction was discussed during the RV32 MOVSX review. Pu Lehui
explicitly requested an "Add support" title and removal of the same
Fixes: 8100928c8814 tag, treating the change as added JIT support:

https://lore.kernel.org/bpf/2ca2a85a-d4a9-4459-a534-6159de6e5890@huawei.com/

> Does this compile? The MIPS uasm assembler appears to have no seb/seh
> emitter.

Yes, with the prerequisite declared in the cover letter. Patch 2/3 of
SDIV/SMOD v4 adds the uasm declarations, encodings and emitters for
seb/seh:

https://lore.kernel.org/bpf/20260911213340.3767930-3-main.kalliope@gmail.com/

The MOVSX cover letter links that series and includes its prerequisite
patch IDs. Applying MOVSX without it leaves those emitters undefined.

I built the combined stack and ran test_bpf under QEMU Malta on
little-endian MIPS32 R1/R2/R6 and MIPS64 R2/R6. All five MOVSX cases
passed with the JIT on each profile and all 16 signed DIV/MOD cases also
passed.

Nicholas