[v2] bpf, riscv: fix missing extable entry for arena load_acquire

[PATCH v2] bpf, riscv: fix missing extable entry for arena load_acquire

Posted by Feng Jiang 1 week, 2 days ago

emit_atomic_ld_st() returns 1 to have build_body() skip the zext after
a sub-word load_acquire. The caller does "ret = ret ?:
add_exception_handler(...)", which skips add_exception_handler() on any
non-zero ret, so the extable entry is missing and a faulting
PROBE_ATOMIC load_acquire oopses.

Check ret >= 0 before calling add_exception_handler(), and return ret
unchanged so build_body() still skips the zext.

Fixes: fb7cefabae81 ("riscv, bpf: Add support arena atomics for RV64")
Suggested-by: Pu Lehui <pulehui@huawei.com>
Signed-off-by: Feng Jiang <jiangfeng@kylinos.cn>
---
Changes in v2:
- Drop extra variable as suggested by Pu Lehui.
- Link to v1: https://lore.kernel.org/r/20260716-bpf-riscv-fix-extable-v1-1-af023cc17af4@kylinos.cn
---
 arch/riscv/net/bpf_jit_comp64.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/arch/riscv/net/bpf_jit_comp64.c b/arch/riscv/net/bpf_jit_comp64.c
index f9d5347ba966..0db89093ff89 100644
--- a/arch/riscv/net/bpf_jit_comp64.c
+++ b/arch/riscv/net/bpf_jit_comp64.c
@@ -1986,7 +1986,10 @@ int bpf_jit_emit_insn(const struct bpf_insn *insn, struct rv_jit_context *ctx,
 		else
 			ret = emit_atomic_rmw(rd, rs, insn, ctx);
 
-		ret = ret ?: add_exception_handler(insn, REG_DONT_CLEAR_MARKER, ctx);
+		/* ret can be 1 (skip-zext); extable entry still needs to be added */
+		if (ret >= 0)
+			ret = add_exception_handler(insn, REG_DONT_CLEAR_MARKER, ctx) ?: ret;
+
 		if (ret)
 			return ret;
 		break;

---
base-commit: a13c140cc289c0b7b3770bce5b3ad42ab35074aa
change-id: 20260716-bpf-riscv-fix-extable-399947ca778d

Best regards,
-- 
Feng Jiang <jiangfeng@kylinos.cn>

Re: [PATCH v2] bpf, riscv: fix missing extable entry for arena load_acquire

Posted by Björn Töpel 1 week, 2 days ago

Feng Jiang <jiangfeng@kylinos.cn> writes:

> emit_atomic_ld_st() returns 1 to have build_body() skip the zext after
> a sub-word load_acquire. The caller does "ret = ret ?:
> add_exception_handler(...)", which skips add_exception_handler() on any
> non-zero ret, so the extable entry is missing and a faulting
> PROBE_ATOMIC load_acquire oopses.
>
> Check ret >= 0 before calling add_exception_handler(), and return ret
> unchanged so build_body() still skips the zext.
>
> Fixes: fb7cefabae81 ("riscv, bpf: Add support arena atomics for RV64")
> Suggested-by: Pu Lehui <pulehui@huawei.com>
> Signed-off-by: Feng Jiang <jiangfeng@kylinos.cn>
> ---
> Changes in v2:
> - Drop extra variable as suggested by Pu Lehui.
> - Link to v1: https://lore.kernel.org/r/20260716-bpf-riscv-fix-extable-v1-1-af023cc17af4@kylinos.cn
> ---
>  arch/riscv/net/bpf_jit_comp64.c | 5 ++++-
>  1 file changed, 4 insertions(+), 1 deletion(-)
>
> diff --git a/arch/riscv/net/bpf_jit_comp64.c b/arch/riscv/net/bpf_jit_comp64.c
> index f9d5347ba966..0db89093ff89 100644
> --- a/arch/riscv/net/bpf_jit_comp64.c
> +++ b/arch/riscv/net/bpf_jit_comp64.c
> @@ -1986,7 +1986,10 @@ int bpf_jit_emit_insn(const struct bpf_insn *insn, struct rv_jit_context *ctx,
>  		else
>  			ret = emit_atomic_rmw(rd, rs, insn, ctx);
>  
> -		ret = ret ?: add_exception_handler(insn, REG_DONT_CLEAR_MARKER, ctx);
> +		/* ret can be 1 (skip-zext); extable entry still needs to be added */
> +		if (ret >= 0)
> +			ret = add_exception_handler(insn, REG_DONT_CLEAR_MARKER, ctx) ?: ret;

I don't agree with Sashiko that this was fully pre-existing. This fix
changes the existing behaviour of BPF_DW | BPF_LOAD_ACQ. We can now end
up with stale register data.

I'd like to see a v3 that addresses REG_DONT_CLEAR_MARKER for atomic
loads (zext included).


Björn

Re: [PATCH v2] bpf, riscv: fix missing extable entry for arena load_acquire

Posted by Feng Jiang 1 week, 1 day ago

On 2026/7/16 16:40, Björn Töpel wrote:
> Feng Jiang <jiangfeng@kylinos.cn> writes:
> 
>> emit_atomic_ld_st() returns 1 to have build_body() skip the zext after
>> a sub-word load_acquire. The caller does "ret = ret ?:
>> add_exception_handler(...)", which skips add_exception_handler() on any
>> non-zero ret, so the extable entry is missing and a faulting
>> PROBE_ATOMIC load_acquire oopses.
>>
>> Check ret >= 0 before calling add_exception_handler(), and return ret
>> unchanged so build_body() still skips the zext.
>>
>> Fixes: fb7cefabae81 ("riscv, bpf: Add support arena atomics for RV64")
>> Suggested-by: Pu Lehui <pulehui@huawei.com>
>> Signed-off-by: Feng Jiang <jiangfeng@kylinos.cn>
>> ---
>> Changes in v2:
>> - Drop extra variable as suggested by Pu Lehui.
>> - Link to v1: https://lore.kernel.org/r/20260716-bpf-riscv-fix-extable-v1-1-af023cc17af4@kylinos.cn
>> ---
>>  arch/riscv/net/bpf_jit_comp64.c | 5 ++++-
>>  1 file changed, 4 insertions(+), 1 deletion(-)
>>
>> diff --git a/arch/riscv/net/bpf_jit_comp64.c b/arch/riscv/net/bpf_jit_comp64.c
>> index f9d5347ba966..0db89093ff89 100644
>> --- a/arch/riscv/net/bpf_jit_comp64.c
>> +++ b/arch/riscv/net/bpf_jit_comp64.c
>> @@ -1986,7 +1986,10 @@ int bpf_jit_emit_insn(const struct bpf_insn *insn, struct rv_jit_context *ctx,
>>  		else
>>  			ret = emit_atomic_rmw(rd, rs, insn, ctx);
>>  
>> -		ret = ret ?: add_exception_handler(insn, REG_DONT_CLEAR_MARKER, ctx);
>> +		/* ret can be 1 (skip-zext); extable entry still needs to be added */
>> +		if (ret >= 0)
>> +			ret = add_exception_handler(insn, REG_DONT_CLEAR_MARKER, ctx) ?: ret;
> 
> I don't agree with Sashiko that this was fully pre-existing. This fix
> changes the existing behaviour of BPF_DW | BPF_LOAD_ACQ. We can now end
> up with stale register data.
> 
> I'd like to see a v3 that addresses REG_DONT_CLEAR_MARKER for atomic
> loads (zext included).
> 
> 
> Björn

Thanks Björn, makes sense. LOAD_ACQ is just a load into rd, so on a
fault it should zero rd like PROBE_MEM does. I'll do a v3 that passes
rd for LOAD_ACQ, the other atomic ops keep REG_DONT_CLEAR_MARKER.

-- 
With Best Regards,
Feng Jiang

Re: [PATCH v2] bpf, riscv: fix missing extable entry for arena load_acquire

Posted by Pu Lehui 1 week, 2 days ago

On 2026/7/16 15:38, Feng Jiang wrote:
> emit_atomic_ld_st() returns 1 to have build_body() skip the zext after
> a sub-word load_acquire. The caller does "ret = ret ?:
> add_exception_handler(...)", which skips add_exception_handler() on any
> non-zero ret, so the extable entry is missing and a faulting
> PROBE_ATOMIC load_acquire oopses.
> 
> Check ret >= 0 before calling add_exception_handler(), and return ret
> unchanged so build_body() still skips the zext.
> 
> Fixes: fb7cefabae81 ("riscv, bpf: Add support arena atomics for RV64")
> Suggested-by: Pu Lehui <pulehui@huawei.com>

A small matter.

Feel free to add:

Reviewed-by: Pu Lehui <pulehui@huawei.com>

> Signed-off-by: Feng Jiang <jiangfeng@kylinos.cn>
> ---
> Changes in v2:
> - Drop extra variable as suggested by Pu Lehui.
> - Link to v1: https://lore.kernel.org/r/20260716-bpf-riscv-fix-extable-v1-1-af023cc17af4@kylinos.cn
> ---
>   arch/riscv/net/bpf_jit_comp64.c | 5 ++++-
>   1 file changed, 4 insertions(+), 1 deletion(-)
> 
> diff --git a/arch/riscv/net/bpf_jit_comp64.c b/arch/riscv/net/bpf_jit_comp64.c
> index f9d5347ba966..0db89093ff89 100644
> --- a/arch/riscv/net/bpf_jit_comp64.c
> +++ b/arch/riscv/net/bpf_jit_comp64.c
> @@ -1986,7 +1986,10 @@ int bpf_jit_emit_insn(const struct bpf_insn *insn, struct rv_jit_context *ctx,
>   		else
>   			ret = emit_atomic_rmw(rd, rs, insn, ctx);
>   
> -		ret = ret ?: add_exception_handler(insn, REG_DONT_CLEAR_MARKER, ctx);
> +		/* ret can be 1 (skip-zext); extable entry still needs to be added */
> +		if (ret >= 0)
> +			ret = add_exception_handler(insn, REG_DONT_CLEAR_MARKER, ctx) ?: ret;
> +
>   		if (ret)
>   			return ret;
>   		break;
> 
> ---
> base-commit: a13c140cc289c0b7b3770bce5b3ad42ab35074aa
> change-id: 20260716-bpf-riscv-fix-extable-399947ca778d
> 
> Best regards,