linux-toradex.git/arch/mips/net, branch master Linux kernel for Apalis and Colibri modules bpf, mips: Add JIT support for JMP32_JA 2026-09-26T07:41:21+00:00 Johan Almbladh johan.almbladh@anyfinetworks.com 2026-09-25T23:19:32+00:00 f4f496decae188ab1621023fecb3d2c191e6e43a The JMP32_JA instruction from the eBPF v4 ISA was not implemented. This caused programs using the instruction to fall back to the interpreter. Implement the JMP32_JA instruction. Signed-off-by: Johan Almbladh <johan.almbladh@anyfinetworks.com> Signed-off-by: Alexei Starovoitov <ast@kernel.org> Link: https://patch.msgid.link/20260925231932.1063678-3-johan.almbladh@anyfinetworks.com 
The JMP32_JA instruction from the eBPF v4 ISA was not implemented.
This caused programs using the instruction to fall back to the
interpreter.

Implement the JMP32_JA instruction.

Signed-off-by: Johan Almbladh <johan.almbladh@anyfinetworks.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Link: https://patch.msgid.link/20260925231932.1063678-3-johan.almbladh@anyfinetworks.com
bpf, mips: Add JIT support for unconditional BSWAP 2026-09-26T07:41:21+00:00 Johan Almbladh johan.almbladh@anyfinetworks.com 2026-09-25T23:19:31+00:00 89d8e19811f2b18c273fe4056d193e82afaa6e1a The unconditional BSWAP instruction from the eBPF v4 ISA was not implemented. This caused programs using the instruction to fall back to the interpreter. Implement the unconditional BSWAP instruction. Signed-off-by: Johan Almbladh <johan.almbladh@anyfinetworks.com> Signed-off-by: Alexei Starovoitov <ast@kernel.org> Link: https://patch.msgid.link/20260925231932.1063678-2-johan.almbladh@anyfinetworks.com 
The unconditional BSWAP instruction from the eBPF v4 ISA was not
implemented. This caused programs using the instruction to fall
back to the interpreter.

Implement the unconditional BSWAP instruction.

Signed-off-by: Johan Almbladh <johan.almbladh@anyfinetworks.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Link: https://patch.msgid.link/20260925231932.1063678-2-johan.almbladh@anyfinetworks.com
Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf 7.3-rc4 2026-09-24T16:15:14+00:00 Alexei Starovoitov ast@kernel.org 2026-09-24T16:10:16+00:00 0e4cf80d0d4893d8227ba816d0559ab778af8125 Cross-merge BPF and other fixes after downstream PR. Conflicts: kernel/bpf/helpers.c tools/testing/selftests/bpf/prog_tests/cb_refs.c tools/testing/selftests/bpf/prog_tests/verifier.c Signed-off-by: Alexei Starovoitov <ast@kernel.org> 
Cross-merge BPF and other fixes after downstream PR.

Conflicts:
  kernel/bpf/helpers.c
  tools/testing/selftests/bpf/prog_tests/cb_refs.c
  tools/testing/selftests/bpf/prog_tests/verifier.c

Signed-off-by: Alexei Starovoitov <ast@kernel.org>
bpf: Fix BSWAP 32 and 16 on MIPS64 2026-09-24T01:57:52+00:00 Johan Almbladh johan.almbladh@anyfinetworks.com 2026-09-23T10:51:58+00:00 8110ba09777873443db286b3cbb89b0e6311c554 The 16/32-bit byteswap implementations for MIPS64r1 and earlier do not have an explicit zero extension afterwards. The input is first sign-extended to 64 bits, and the byteswap sequence can then leave the result sign-extended depending on the value of the low bits. Add the missing zero-extension. Found with test_bpf on MIPS64r1 emulated by QEMU. Fixes: fbc802de6b10 ("mips, bpf: Add new eBPF JIT for 64-bit MIPS") Signed-off-by: Johan Almbladh <johan.almbladh@anyfinetworks.com> Signed-off-by: Alexei Starovoitov <ast@kernel.org> Link: https://patch.msgid.link/20260923105158.3514342-2-johan.almbladh@anyfinetworks.com 
The 16/32-bit byteswap implementations for MIPS64r1 and earlier do
not have an explicit zero extension afterwards. The input is first
sign-extended to 64 bits, and the byteswap sequence can then leave
the result sign-extended depending on the value of the low bits.

Add the missing zero-extension.

Found with test_bpf on MIPS64r1 emulated by QEMU.

Fixes: fbc802de6b10 ("mips, bpf: Add new eBPF JIT for 64-bit MIPS")
Signed-off-by: Johan Almbladh <johan.almbladh@anyfinetworks.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Link: https://patch.msgid.link/20260923105158.3514342-2-johan.almbladh@anyfinetworks.com
bpf: Fix immediate JMP JEQ/JNE on MIPS32 2026-09-24T01:57:48+00:00 Johan Almbladh johan.almbladh@anyfinetworks.com 2026-09-23T10:51:57+00:00 db762fd96be225bd06161c9631160c755d891693 An addu instruction was emitted instead of addiu, causing the immediate value 1 to be interpreted as register $at. This made the comparison result invalid when the immediate operand was negative. Note that $at is mapped to BPF_REG_AX, which is used for constant blinding. Fix the instruction to use the immediate form. Found with test_bpf on MIPS32r1 emulated by QEMU. Fixes: eb63cfcd2ee8 ("mips, bpf: Add eBPF JIT for 32-bit MIPS") Signed-off-by: Johan Almbladh <johan.almbladh@anyfinetworks.com> Signed-off-by: Alexei Starovoitov <ast@kernel.org> Link: https://patch.msgid.link/20260923105158.3514342-1-johan.almbladh@anyfinetworks.com 
An addu instruction was emitted instead of addiu, causing the immediate
value 1 to be interpreted as register $at. This made the comparison
result invalid when the immediate operand was negative. Note that $at
is mapped to BPF_REG_AX, which is used for constant blinding.

Fix the instruction to use the immediate form.

Found with test_bpf on MIPS32r1 emulated by QEMU.

Fixes: eb63cfcd2ee8 ("mips, bpf: Add eBPF JIT for 32-bit MIPS")
Signed-off-by: Johan Almbladh <johan.almbladh@anyfinetworks.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Link: https://patch.msgid.link/20260923105158.3514342-1-johan.almbladh@anyfinetworks.com
bpf, mips: Add support for BPF_MOVSX in the JITs 2026-09-22T23:48:52+00:00 Nicholas Dudar main.kalliope@gmail.com 2026-09-12T04:12:20+00:00 07ebb8c386d384d69e6f2c17304f9cb381d4e55a Both MIPS JITs ignore insn->off when lowering register MOV instructions, so BPF_MOVSX is emitted as an ordinary move. Since build_insn() accepts it, affected programs are silently miscompiled instead of falling back to the interpreter. Decode the MOVSX width from insn->off in the register-move helpers. On MIPS32, propagate the sign into the high word for ALU64 while preserving the existing ALU32 zero-extension handling. Use seb/seh on MIPS32 R2-or-newer CPUs and shift pairs otherwise. On MIPS64, seb/seh require a sign-extended 32-bit source. Normalizing an arbitrary BPF register first would cost another instruction, so retain the doubleword shift pairs. Signed-off-by: Nicholas Dudar <main.kalliope@gmail.com> Signed-off-by: Alexei Starovoitov <ast@kernel.org> Link: https://patch.msgid.link/20260912041220.444715-3-main.kalliope@gmail.com 
Both MIPS JITs ignore insn->off when lowering register MOV
instructions, so BPF_MOVSX is emitted as an ordinary move. Since
build_insn() accepts it, affected programs are silently miscompiled
instead of falling back to the interpreter.

Decode the MOVSX width from insn->off in the register-move helpers.
On MIPS32, propagate the sign into the high word for ALU64 while
preserving the existing ALU32 zero-extension handling.

Use seb/seh on MIPS32 R2-or-newer CPUs and shift pairs otherwise.
On MIPS64, seb/seh require a sign-extended 32-bit source. Normalizing
an arbitrary BPF register first would cost another instruction, so
retain the doubleword shift pairs.

Signed-off-by: Nicholas Dudar <main.kalliope@gmail.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Link: https://patch.msgid.link/20260912041220.444715-3-main.kalliope@gmail.com
bpf, mips: Factor register moves into helpers 2026-09-22T23:48:52+00:00 Nicholas Dudar main.kalliope@gmail.com 2026-09-12T04:12:19+00:00 86187bd3cd5a15b3f5b8023ef7123abc919c9bfe Factor ALU32 and ALU64 register moves into backend-local helpers, keeping register-pair handling and zero extension with the move. This prepares for decoding the MOVSX width in those helpers. Keep the verifier-inserted zero-extension marker on its existing path. No functional change intended. Signed-off-by: Nicholas Dudar <main.kalliope@gmail.com> Signed-off-by: Alexei Starovoitov <ast@kernel.org> Link: https://patch.msgid.link/20260912041220.444715-2-main.kalliope@gmail.com 
Factor ALU32 and ALU64 register moves into backend-local helpers,
keeping register-pair handling and zero extension with the move.
This prepares for decoding the MOVSX width in those helpers.

Keep the verifier-inserted zero-extension marker on its existing path.
No functional change intended.

Signed-off-by: Nicholas Dudar <main.kalliope@gmail.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Link: https://patch.msgid.link/20260912041220.444715-2-main.kalliope@gmail.com
bpf, mips: Add support for BPF_SDIV and BPF_SMOD 2026-09-22T23:45:56+00:00 Nicholas Dudar main.kalliope@gmail.com 2026-09-11T21:33:40+00:00 47c26a8570d10d0de46aec3f311d38db653d3572 The MIPS JITs handle BPF_DIV and BPF_MOD without inspecting insn->off, which distinguishes BPF_SDIV and BPF_SMOD. Signed operations therefore use unsigned instructions, or unsigned helpers for ALU64 on 32-bit MIPS, and produce unsigned results for negative operands. Pass insn->off unchanged through immediate validation and register emission, and interpret it only in div/mod-specific paths. Use signed DIV/DDIV for pre-R6 and DIV/MOD/DDIV/DMOD for R6. On 32-bit MIPS, use div64_s64() and a signed remainder helper for ALU64. Keep the signed quotient signed while computing that remainder, and keep signed immediates out of the unsigned power-of-two shift/mask rewrite. check_alu_op() rejects immediate zero divisors. bpf_do_misc_fixups() rewrites signed immediate -1 and guards register divisors that are zero or, for signed operations, -1 before JIT compilation. The ALU32 paths continue to zero-extend their results. Found while auditing BPF JIT handling of signed div/mod. Signed-off-by: Nicholas Dudar <main.kalliope@gmail.com> Signed-off-by: Alexei Starovoitov <ast@kernel.org> Link: https://lore.kernel.org/bpf/CAM1=_QS79dDBfaaNQXnWd61AqHd1M4o9aDMMiftnoJveNr=FZg@mail.gmail.com/ Link: https://lore.kernel.org/bpf/CAM1=_QQ7XiJEozaetLt_+kVn91YAXWpJK_pyfT9=paXseW=wwA@mail.gmail.com/ Link: https://patch.msgid.link/20260911213340.3767930-4-main.kalliope@gmail.com 
The MIPS JITs handle BPF_DIV and BPF_MOD without inspecting insn->off,
which distinguishes BPF_SDIV and BPF_SMOD. Signed operations therefore
use unsigned instructions, or unsigned helpers for ALU64 on 32-bit
MIPS, and produce unsigned results for negative operands.

Pass insn->off unchanged through immediate validation and register
emission, and interpret it only in div/mod-specific paths. Use signed
DIV/DDIV for pre-R6 and DIV/MOD/DDIV/DMOD for R6. On 32-bit MIPS, use
div64_s64() and a signed remainder helper for ALU64. Keep the signed
quotient signed while computing that remainder, and keep signed
immediates out of the unsigned power-of-two shift/mask rewrite.

check_alu_op() rejects immediate zero divisors. bpf_do_misc_fixups()
rewrites signed immediate -1 and guards register divisors that are zero
or, for signed operations, -1 before JIT compilation. The ALU32 paths
continue to zero-extend their results.

Found while auditing BPF JIT handling of signed div/mod.

Signed-off-by: Nicholas Dudar <main.kalliope@gmail.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Link: https://lore.kernel.org/bpf/CAM1=_QS79dDBfaaNQXnWd61AqHd1M4o9aDMMiftnoJveNr=FZg@mail.gmail.com/
Link: https://lore.kernel.org/bpf/CAM1=_QQ7XiJEozaetLt_+kVn91YAXWpJK_pyfT9=paXseW=wwA@mail.gmail.com/
Link: https://patch.msgid.link/20260911213340.3767930-4-main.kalliope@gmail.com
bpf, mips: Factor out div/mod emission helpers 2026-09-22T23:45:56+00:00 Nicholas Dudar main.kalliope@gmail.com 2026-09-11T21:33:38+00:00 a2710072ddeca1b2e0962f946f36f0b2804c9aa4 Factor MIPS32 and MIPS64 division and modulo emission out of emit_alu_r() and emit_alu_r64(). This prepares the JITs to select signed or unsigned opcodes without duplicating the R6 and pre-R6 handling. No functional change intended. Suggested-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com> Signed-off-by: Nicholas Dudar <main.kalliope@gmail.com> Signed-off-by: Alexei Starovoitov <ast@kernel.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com> Link: https://patch.msgid.link/20260911213340.3767930-2-main.kalliope@gmail.com 
Factor MIPS32 and MIPS64 division and modulo emission out of
emit_alu_r() and emit_alu_r64(). This prepares the JITs to select signed
or unsigned opcodes without duplicating the R6 and pre-R6 handling.

No functional change intended.

Suggested-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Signed-off-by: Nicholas Dudar <main.kalliope@gmail.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Link: https://patch.msgid.link/20260911213340.3767930-2-main.kalliope@gmail.com
bpf: Pass bpf_verifier_env to JIT 2026-04-16T14:03:40+00:00 Xu Kuohai xukuohai@huawei.com 2026-04-16T06:43:38+00:00 d9ef13f72711f2dad64cd4445472ded98fb6c954 Pass bpf_verifier_env to bpf_int_jit_compile(). The follow-up patch will use env->insn_aux_data in the JIT stage to detect indirect jump targets. Since bpf_prog_select_runtime() can be called by cbpf and lib/test_bpf.c code without verifier, introduce helper __bpf_prog_select_runtime() to accept the env parameter. Remove the call to bpf_prog_select_runtime() in bpf_prog_load(), and switch to call __bpf_prog_select_runtime() in the verifier, with env variable passed. The original bpf_prog_select_runtime() is preserved for cbpf and lib/test_bpf.c, where env is NULL. Now all constants blinding calls are moved into the verifier, except the cbpf and lib/test_bpf.c cases. The instructions arrays are adjusted by bpf_patch_insn_data() function for normal cases, so there is no need to call adjust_insn_arrays() in bpf_jit_blind_constants(). Remove it. Reviewed-by: Anton Protopopov <a.s.protopopov@gmail.com> # v8 Reviewed-by: Emil Tsalapatis <emil@etsalapatis.com> # v12 Acked-by: Hengqi Chen <hengqi.chen@gmail.com> # v14 Signed-off-by: Xu Kuohai <xukuohai@huawei.com> Link: https://lore.kernel.org/r/20260416064341.151802-3-xukuohai@huaweicloud.com Signed-off-by: Alexei Starovoitov <ast@kernel.org> 
Pass bpf_verifier_env to bpf_int_jit_compile(). The follow-up patch will
use env->insn_aux_data in the JIT stage to detect indirect jump targets.

Since bpf_prog_select_runtime() can be called by cbpf and lib/test_bpf.c
code without verifier, introduce helper __bpf_prog_select_runtime()
to accept the env parameter.

Remove the call to bpf_prog_select_runtime() in bpf_prog_load(), and
switch to call __bpf_prog_select_runtime() in the verifier, with env
variable passed. The original bpf_prog_select_runtime() is preserved for
cbpf and lib/test_bpf.c, where env is NULL.

Now all constants blinding calls are moved into the verifier, except
the cbpf and lib/test_bpf.c cases. The instructions arrays are adjusted
by bpf_patch_insn_data() function for normal cases, so there is no need
to call adjust_insn_arrays() in bpf_jit_blind_constants(). Remove it.

Reviewed-by: Anton Protopopov <a.s.protopopov@gmail.com> # v8
Reviewed-by: Emil Tsalapatis <emil@etsalapatis.com> # v12
Acked-by: Hengqi Chen <hengqi.chen@gmail.com> # v14
Signed-off-by: Xu Kuohai <xukuohai@huawei.com>
Link: https://lore.kernel.org/r/20260416064341.151802-3-xukuohai@huaweicloud.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>