Re: [PATCH bpf-next v3 1/2] bpf, riscv: Add support for signed arena loads

[Pu Lehui <pulehui@huawei.com>]

On 2026/8/19 20:09, Chen Pei wrote:
> Signed loads from arena memory are currently rejected on riscv64, as
> bpf_jit_supports_insn() refuses BPF_MEMSX loads when in_arena is set,
> while x86 and arm64 gained support for them in v6.18. Compilers such
> as GCC-14 are free to generate signed loads into arena memory, which
> breaks loading of otherwise valid BPF programs on riscv64.
> 
> Implement BPF_PROBE_MEM32SX support in the RV64 JIT by reusing the
> existing arena handling: the arena base (RV_REG_ARENA) is added to
> the source register and the load is emitted with sign extension
> (lb/lh/lw). Add BPF_PROBE_MEM32SX to the add_exception_handler()
> mode gate so that faulting loads get an exception table entry which
> clears the destination register and resumes execution. Since
> BPF_PROBE_MEM32SX shares its mode value (0xc0) with BPF_ATOMIC, the
> gate accepts it only for LDX class instructions so that plain atomic
> instructions do not register exception table entries.
> 
> Verified by running the arena LDSX selftests (arena_ldsx_disasm,
> arena_ldsx_exception, arena_ldsx_s8/s16/s32) and the full
> arena_atomics test suite on riscv64 QEMU, all passing.
> 
> Signed-off-by: Chen Pei <cp0613@linux.alibaba.com>
> ---
> 
> Changes in v3:
> - Restore the pseudo-code form of the PROBE_MEM32SX case comment.
> 
> Changes in v2:
> - Fix extable entry overflow breaking arena_atomics load
> 
>   arch/riscv/net/bpf_jit_comp64.c | 16 ++++++++++------
>   1 file changed, 10 insertions(+), 6 deletions(-)
> 
> diff --git a/arch/riscv/net/bpf_jit_comp64.c b/arch/riscv/net/bpf_jit_comp64.c
> index f9d5347ba966..64ebd262c498 100644
> --- a/arch/riscv/net/bpf_jit_comp64.c
> +++ b/arch/riscv/net/bpf_jit_comp64.c
> @@ -777,6 +777,8 @@ static int add_exception_handler(const struct bpf_insn *insn, int dst_reg,
>   	if (BPF_MODE(insn->code) != BPF_PROBE_MEM &&
>   	    BPF_MODE(insn->code) != BPF_PROBE_MEMSX &&
>   	    BPF_MODE(insn->code) != BPF_PROBE_MEM32 &&
> +	    !(BPF_MODE(insn->code) == BPF_PROBE_MEM32SX &&
> +	      BPF_CLASS(insn->code) == BPF_LDX) &&
>   	    BPF_MODE(insn->code) != BPF_PROBE_ATOMIC)
>   		return 0;
>   
> @@ -1902,13 +1904,19 @@ int bpf_jit_emit_insn(const struct bpf_insn *insn, struct rv_jit_context *ctx,
>   	case BPF_LDX | BPF_PROBE_MEM32 | BPF_H:
>   	case BPF_LDX | BPF_PROBE_MEM32 | BPF_W:
>   	case BPF_LDX | BPF_PROBE_MEM32 | BPF_DW:
> +	/* LDX | PROBE_MEM32SX: dst = *(signed size *)(src + RV_REG_ARENA + off) */
> +	case BPF_LDX | BPF_PROBE_MEM32SX | BPF_B:
> +	case BPF_LDX | BPF_PROBE_MEM32SX | BPF_H:
> +	case BPF_LDX | BPF_PROBE_MEM32SX | BPF_W:
>   	{
>   		bool sign_ext;
>   
>   		sign_ext = BPF_MODE(insn->code) == BPF_MEMSX ||
> -			   BPF_MODE(insn->code) == BPF_PROBE_MEMSX;
> +			   BPF_MODE(insn->code) == BPF_PROBE_MEMSX ||
> +			   BPF_MODE(insn->code) == BPF_PROBE_MEM32SX;
>   
> -		if (BPF_MODE(insn->code) == BPF_PROBE_MEM32) {
> +		if (BPF_MODE(insn->code) == BPF_PROBE_MEM32 ||
> +		    BPF_MODE(insn->code) == BPF_PROBE_MEM32SX) {
>   			emit_add(RV_REG_T2, rs, RV_REG_ARENA, ctx);
>   			rs = RV_REG_T2;
>   		}
> @@ -2126,10 +2134,6 @@ bool bpf_jit_supports_insn(struct bpf_insn *insn, bool in_arena)
>   			if (insn->imm == BPF_CMPXCHG)
>   				return rv_ext_enabled(ZACAS);
>   			break;
> -		case BPF_LDX | BPF_MEMSX | BPF_B:
> -		case BPF_LDX | BPF_MEMSX | BPF_H:
> -		case BPF_LDX | BPF_MEMSX | BPF_W:
> -			return false;
>   		}
>   	}
>   

Reviewed-by: Pu Lehui <pulehui@huawei.com>
Tested-by: Pu Lehui <pulehui@huawei.com>