AI Trajectory

null

{
  "EnableConfigs": [
    "BPF_JIT",
    "BPF_SYSCALL"
  ],
  "FocusSymbols": [
    "emit_alu_r",
    "emit_alu_r64",
    "emit_divmod_r64",
    "jit_smod64"
  ],
  "Reasoning": "The patch introduces support for signed division and modulo operations in the MIPS BPF JIT compiler. This modifies the core JIT translation logic for BPF programs on MIPS. Fuzzing is necessary to ensure the JIT compiler correctly handles these new signed operations and does not introduce vulnerabilities or crashes during BPF program execution.",
  "WorthFuzzing": true
}

null

{
  "PatchDiff": "commit de42ca67c719276352cb7932b8fa6263d8f9719d\nAuthor: syz-cluster \u003ctriage@syzkaller.com\u003e\nDate:   Fri Jul 17 01:54:02 2026 +0000\n\n    syz-cluster: applied patch under review\n\ndiff --git a/arch/mips/include/asm/uasm.h b/arch/mips/include/asm/uasm.h\nindex b43bfd44525213..9d3edb59efc098 100644\n--- a/arch/mips/include/asm/uasm.h\n+++ b/arch/mips/include/asm/uasm.h\n@@ -85,15 +85,20 @@ Ip_u1u2(_ctc1);\n Ip_u2u1(_ctcmsa);\n Ip_u2u1s3(_daddiu);\n Ip_u3u1u2(_daddu);\n+Ip_u1u2(_ddiv);\n+Ip_u3u1u2(_ddiv_r6);\n Ip_u1u2(_ddivu);\n Ip_u3u1u2(_ddivu_r6);\n Ip_u1(_di);\n Ip_u2u1msbu3(_dins);\n Ip_u2u1msbu3(_dinsm);\n Ip_u2u1msbu3(_dinsu);\n+Ip_u1u2(_div);\n+Ip_u3u1u2(_div_r6);\n Ip_u1u2(_divu);\n Ip_u3u1u2(_divu_r6);\n Ip_u1u2u3(_dmfc0);\n+Ip_u3u1u2(_dmod);\n Ip_u3u1u2(_dmodu);\n Ip_u1u2u3(_dmtc0);\n Ip_u1u2(_dmultu);\n@@ -135,6 +140,7 @@ Ip_u1u2u3(_mfc0);\n Ip_u1u2u3(_mfhc0);\n Ip_u1(_mfhi);\n Ip_u1(_mflo);\n+Ip_u3u1u2(_mod);\n Ip_u3u1u2(_modu);\n Ip_u3u1u2(_movn);\n Ip_u3u1u2(_movz);\ndiff --git a/arch/mips/mm/uasm-mips.c b/arch/mips/mm/uasm-mips.c\nindex e15c6700cd0884..ef1a2b04007007 100644\n--- a/arch/mips/mm/uasm-mips.c\n+++ b/arch/mips/mm/uasm-mips.c\n@@ -75,6 +75,9 @@ static const struct insn insn_table[insn_invalid] = {\n \t[insn_ctcmsa]\t= {M(msa_op, 0, msa_ctc_op, 0, 0, msa_elm_op), RD | RE},\n \t[insn_daddiu]\t= {M(daddiu_op, 0, 0, 0, 0, 0), RS | RT | SIMM},\n \t[insn_daddu]\t= {M(spec_op, 0, 0, 0, 0, daddu_op), RS | RT | RD},\n+\t[insn_ddiv]\t= {M(spec_op, 0, 0, 0, 0, ddiv_op), RS | RT},\n+\t[insn_ddiv_r6]\t= {M(spec_op, 0, 0, 0, ddiv_ddiv6_op, ddiv_op),\n+\t\t\t\tRS | RT | RD},\n \t[insn_ddivu]\t= {M(spec_op, 0, 0, 0, 0, ddivu_op), RS | RT},\n \t[insn_ddivu_r6]\t= {M(spec_op, 0, 0, 0, ddivu_ddivu6_op, ddivu_op),\n \t\t\t\tRS | RT | RD},\n@@ -82,10 +85,15 @@ static const struct insn insn_table[insn_invalid] = {\n \t[insn_dins]\t= {M(spec3_op, 0, 0, 0, 0, dins_op), RS | RT | RD | RE},\n \t[insn_dinsm]\t= {M(spec3_op, 0, 0, 0, 0, dinsm_op), RS | RT | RD | RE},\n \t[insn_dinsu]\t= {M(spec3_op, 0, 0, 0, 0, dinsu_op), RS | RT | RD | RE},\n+\t[insn_div]\t= {M(spec_op, 0, 0, 0, 0, div_op), RS | RT},\n+\t[insn_div_r6]\t= {M(spec_op, 0, 0, 0, div_div6_op, div_op),\n+\t\t\t\tRS | RT | RD},\n \t[insn_divu]\t= {M(spec_op, 0, 0, 0, 0, divu_op), RS | RT},\n \t[insn_divu_r6]\t= {M(spec_op, 0, 0, 0, divu_divu6_op, divu_op),\n \t\t\t\tRS | RT | RD},\n \t[insn_dmfc0]\t= {M(cop0_op, dmfc_op, 0, 0, 0, 0), RT | RD | SET},\n+\t[insn_dmod]\t= {M(spec_op, 0, 0, 0, ddiv_dmod_op, ddiv_op),\n+\t\t\t\tRS | RT | RD},\n \t[insn_dmodu]\t= {M(spec_op, 0, 0, 0, ddivu_dmodu_op, ddivu_op),\n \t\t\t\tRS | RT | RD},\n \t[insn_dmtc0]\t= {M(cop0_op, dmtc_op, 0, 0, 0, 0), RT | RD | SET},\n@@ -140,6 +148,8 @@ static const struct insn insn_table[insn_invalid] = {\n \t[insn_mfhc0]\t= {M(cop0_op, mfhc0_op, 0, 0, 0, 0),  RT | RD | SET},\n \t[insn_mfhi]\t= {M(spec_op, 0, 0, 0, 0, mfhi_op), RD},\n \t[insn_mflo]\t= {M(spec_op, 0, 0, 0, 0, mflo_op), RD},\n+\t[insn_mod]\t= {M(spec_op, 0, 0, 0, div_mod_op, div_op),\n+\t\t\t\tRS | RT | RD},\n \t[insn_modu]\t= {M(spec_op, 0, 0, 0, divu_modu_op, divu_op),\n \t\t\t\tRS | RT | RD},\n \t[insn_movn]\t= {M(spec_op, 0, 0, 0, 0, movn_op), RS | RT | RD},\ndiff --git a/arch/mips/mm/uasm.c b/arch/mips/mm/uasm.c\nindex 125140979d62c5..9d87d57164d798 100644\n--- a/arch/mips/mm/uasm.c\n+++ b/arch/mips/mm/uasm.c\n@@ -49,16 +49,17 @@ enum opcode {\n \tinsn_addiu, insn_addu, insn_and, insn_andi, insn_bbit0, insn_bbit1,\n \tinsn_beq, insn_beql, insn_bgez, insn_bgezl, insn_bgtz, insn_blez,\n \tinsn_bltz, insn_bltzl, insn_bne, insn_break, insn_cache, insn_cfc1,\n-\tinsn_cfcmsa, insn_ctc1, insn_ctcmsa, insn_daddiu, insn_daddu, insn_ddivu,\n-\tinsn_ddivu_r6, insn_di, insn_dins, insn_dinsm, insn_dinsu, insn_divu,\n-\tinsn_divu_r6, insn_dmfc0, insn_dmodu, insn_dmtc0, insn_dmultu,\n+\tinsn_cfcmsa, insn_ctc1, insn_ctcmsa, insn_daddiu, insn_daddu, insn_ddiv,\n+\tinsn_ddiv_r6, insn_ddivu, insn_ddivu_r6, insn_di, insn_dins, insn_dinsm,\n+\tinsn_dinsu, insn_div, insn_div_r6, insn_divu, insn_divu_r6, insn_dmfc0,\n+\tinsn_dmod, insn_dmodu, insn_dmtc0, insn_dmultu,\n \tinsn_dmulu, insn_drotr, insn_drotr32, insn_dsbh, insn_dshd, insn_dsll,\n \tinsn_dsll32, insn_dsllv, insn_dsra, insn_dsra32, insn_dsrav, insn_dsrl,\n \tinsn_dsrl32, insn_dsrlv, insn_dsubu, insn_eret, insn_ext, insn_ins,\n \tinsn_j, insn_jal, insn_jalr, insn_jr, insn_lb, insn_lbu, insn_ld,\n \tinsn_lddir, insn_ldpte, insn_ldx, insn_lh, insn_lhu, insn_ll, insn_lld,\n \tinsn_lui, insn_lw, insn_lwu, insn_lwx, insn_mfc0, insn_mfhc0, insn_mfhi,\n-\tinsn_mflo, insn_modu, insn_movn, insn_movz, insn_mtc0, insn_mthc0,\n+\tinsn_mflo, insn_mod, insn_modu, insn_movn, insn_movz, insn_mtc0, insn_mthc0,\n \tinsn_mthi, insn_mtlo, insn_mul, insn_multu, insn_mulu, insn_muhu, insn_nor,\n \tinsn_or, insn_ori, insn_pref, insn_rfe, insn_rotr, insn_sb, insn_sc,\n \tinsn_scd, insn_seleqz, insn_selnez, insn_sd, insn_sh, insn_sll,\n@@ -287,9 +288,12 @@ I_u1u2(_cfc1)\n I_u2u1(_cfcmsa)\n I_u1u2(_ctc1)\n I_u2u1(_ctcmsa)\n+I_u1u2(_ddiv)\n+I_u3u1u2(_ddiv_r6)\n I_u1u2(_ddivu)\n I_u3u1u2(_ddivu_r6)\n I_u1u2u3(_dmfc0)\n+I_u3u1u2(_dmod)\n I_u3u1u2(_dmodu)\n I_u1u2u3(_dmtc0)\n I_u1u2(_dmultu)\n@@ -297,6 +301,8 @@ I_u3u1u2(_dmulu)\n I_u2u1s3(_daddiu)\n I_u3u1u2(_daddu)\n I_u1(_di);\n+I_u1u2(_div)\n+I_u3u1u2(_div_r6)\n I_u1u2(_divu)\n I_u3u1u2(_divu_r6)\n I_u2u1(_dsbh);\n@@ -332,6 +338,7 @@ I_u2s3u1(_lw)\n I_u2s3u1(_lwu)\n I_u1u2u3(_mfc0)\n I_u1u2u3(_mfhc0)\n+I_u3u1u2(_mod)\n I_u3u1u2(_modu)\n I_u3u1u2(_movn)\n I_u3u1u2(_movz)\ndiff --git a/arch/mips/net/bpf_jit_comp.c b/arch/mips/net/bpf_jit_comp.c\nindex 6ee4abe6a1f705..504daea4aac2e9 100644\n--- a/arch/mips/net/bpf_jit_comp.c\n+++ b/arch/mips/net/bpf_jit_comp.c\n@@ -208,7 +208,7 @@ void emit_mov_r(struct jit_context *ctx, u8 dst, u8 src)\n }\n \n /* Validate ALU immediate range */\n-bool valid_alu_i(u8 op, s32 imm)\n+bool valid_alu_i(u8 op, s32 imm, bool is_signed)\n {\n \tswitch (BPF_OP(op)) {\n \tcase BPF_NEG:\n@@ -237,6 +237,15 @@ bool valid_alu_i(u8 op, s32 imm)\n \t\treturn imm == 0 || (imm \u003e 0 \u0026\u0026 is_power_of_2(imm));\n \tcase BPF_DIV:\n \tcase BPF_MOD:\n+\t\t/*\n+\t\t * The rewrite to a shift/mask below is an unsigned-only\n+\t\t * optimization: arithmetic right shift rounds toward\n+\t\t * negative infinity rather than zero, and masking does not\n+\t\t * reproduce a negative dividend's sign. Force the signed\n+\t\t * case through the general register path instead.\n+\t\t */\n+\t\tif (is_signed)\n+\t\t\treturn false;\n \t\t/* imm must be an 17-bit power of two */\n \t\treturn (u32)imm \u003c= 0x10000 \u0026\u0026 is_power_of_2((u32)imm);\n \t}\n@@ -339,7 +348,7 @@ void emit_alu_i(struct jit_context *ctx, u8 dst, s32 imm, u8 op)\n }\n \n /* ALU register operation (32-bit) */\n-void emit_alu_r(struct jit_context *ctx, u8 dst, u8 src, u8 op)\n+void emit_alu_r(struct jit_context *ctx, u8 dst, u8 src, u8 op, bool is_signed)\n {\n \tswitch (BPF_OP(op)) {\n \t/* dst = dst \u0026 src */\n@@ -385,20 +394,38 @@ void emit_alu_r(struct jit_context *ctx, u8 dst, u8 src, u8 op)\n \t\tbreak;\n \t/* dst = dst / src */\n \tcase BPF_DIV:\n-\t\tif (cpu_has_mips32r6) {\n-\t\t\temit(ctx, divu_r6, dst, dst, src);\n+\t\tif (is_signed) {\n+\t\t\tif (cpu_has_mips32r6) {\n+\t\t\t\temit(ctx, div_r6, dst, dst, src);\n+\t\t\t} else {\n+\t\t\t\temit(ctx, div, dst, src);\n+\t\t\t\temit(ctx, mflo, dst);\n+\t\t\t}\n \t\t} else {\n-\t\t\temit(ctx, divu, dst, src);\n-\t\t\temit(ctx, mflo, dst);\n+\t\t\tif (cpu_has_mips32r6) {\n+\t\t\t\temit(ctx, divu_r6, dst, dst, src);\n+\t\t\t} else {\n+\t\t\t\temit(ctx, divu, dst, src);\n+\t\t\t\temit(ctx, mflo, dst);\n+\t\t\t}\n \t\t}\n \t\tbreak;\n \t/* dst = dst % src */\n \tcase BPF_MOD:\n-\t\tif (cpu_has_mips32r6) {\n-\t\t\temit(ctx, modu, dst, dst, src);\n+\t\tif (is_signed) {\n+\t\t\tif (cpu_has_mips32r6) {\n+\t\t\t\temit(ctx, mod, dst, dst, src);\n+\t\t\t} else {\n+\t\t\t\temit(ctx, div, dst, src);\n+\t\t\t\temit(ctx, mfhi, dst);\n+\t\t\t}\n \t\t} else {\n-\t\t\temit(ctx, divu, dst, src);\n-\t\t\temit(ctx, mfhi, dst);\n+\t\t\tif (cpu_has_mips32r6) {\n+\t\t\t\temit(ctx, modu, dst, dst, src);\n+\t\t\t} else {\n+\t\t\t\temit(ctx, divu, dst, src);\n+\t\t\t\temit(ctx, mfhi, dst);\n+\t\t\t}\n \t\t}\n \t\tbreak;\n \t}\ndiff --git a/arch/mips/net/bpf_jit_comp.h b/arch/mips/net/bpf_jit_comp.h\nindex a37fe20818eb9c..6367b936b67e70 100644\n--- a/arch/mips/net/bpf_jit_comp.h\n+++ b/arch/mips/net/bpf_jit_comp.h\n@@ -163,7 +163,7 @@ void emit_mov_i(struct jit_context *ctx, u8 dst, s32 imm);\n void emit_mov_r(struct jit_context *ctx, u8 dst, u8 src);\n \n /* Validate ALU/ALU64 immediate range */\n-bool valid_alu_i(u8 op, s32 imm);\n+bool valid_alu_i(u8 op, s32 imm, bool is_signed);\n \n /* Rewrite ALU/ALU64 immediate operation */\n bool rewrite_alu_i(u8 op, s32 imm, u8 *alu, s32 *val);\n@@ -172,7 +172,7 @@ bool rewrite_alu_i(u8 op, s32 imm, u8 *alu, s32 *val);\n void emit_alu_i(struct jit_context *ctx, u8 dst, s32 imm, u8 op);\n \n /* ALU register operation (32-bit) */\n-void emit_alu_r(struct jit_context *ctx, u8 dst, u8 src, u8 op);\n+void emit_alu_r(struct jit_context *ctx, u8 dst, u8 src, u8 op, bool is_signed);\n \n /* Atomic read-modify-write (32-bit) */\n void emit_atomic_r(struct jit_context *ctx, u8 dst, u8 src, s16 off, u8 code);\ndiff --git a/arch/mips/net/bpf_jit_comp32.c b/arch/mips/net/bpf_jit_comp32.c\nindex 40a878b672f5d3..5d7624f0e30163 100644\n--- a/arch/mips/net/bpf_jit_comp32.c\n+++ b/arch/mips/net/bpf_jit_comp32.c\n@@ -512,7 +512,7 @@ static void emit_mul_r64(struct jit_context *ctx,\n \tclobber_reg64(ctx, dst);\n }\n \n-/* Helper function for 64-bit modulo */\n+/* Helper function for unsigned 64-bit modulo */\n static u64 jit_mod64(u64 a, u64 b)\n {\n \tu64 rem;\n@@ -521,9 +521,17 @@ static u64 jit_mod64(u64 a, u64 b)\n \treturn rem;\n }\n \n+/* Helper function for signed 64-bit modulo */\n+static s64 jit_smod64(s64 a, s64 b)\n+{\n+\ts64 quot = div64_s64(a, b);\n+\n+\treturn a - quot * b;\n+}\n+\n /* ALU div/mod register (64-bit) */\n-static void emit_divmod_r64(struct jit_context *ctx,\n-\t\t\t    const u8 dst[], const u8 src[], u8 op)\n+static void emit_divmod_r64(struct jit_context *ctx, const u8 dst[],\n+\t\t\t    const u8 src[], u8 op, bool is_signed)\n {\n \tconst u8 *r0 = bpf2mips32[BPF_REG_0]; /* Mapped to v0-v1 */\n \tconst u8 *r1 = bpf2mips32[BPF_REG_1]; /* Mapped to a0-a1 */\n@@ -546,11 +554,11 @@ static void emit_divmod_r64(struct jit_context *ctx,\n \tswitch (BPF_OP(op)) {\n \t/* dst = dst / src */\n \tcase BPF_DIV:\n-\t\taddr = (u32)\u0026div64_u64;\n+\t\taddr = is_signed ? (u32)\u0026div64_s64 : (u32)\u0026div64_u64;\n \t\tbreak;\n \t/* dst = dst % src */\n \tcase BPF_MOD:\n-\t\taddr = (u32)\u0026jit_mod64;\n+\t\taddr = is_signed ? (u32)\u0026jit_smod64 : (u32)\u0026jit_mod64;\n \t\tbreak;\n \t}\n \temit_mov_i(ctx, MIPS_R_T9, addr);\n@@ -1516,9 +1524,9 @@ int build_insn(const struct bpf_insn *insn, struct jit_context *ctx)\n \tcase BPF_ALU | BPF_MUL | BPF_K:\n \tcase BPF_ALU | BPF_DIV | BPF_K:\n \tcase BPF_ALU | BPF_MOD | BPF_K:\n-\t\tif (!valid_alu_i(BPF_OP(code), imm)) {\n+\t\tif (!valid_alu_i(BPF_OP(code), imm, off == 1)) {\n \t\t\temit_mov_i(ctx, MIPS_R_T6, imm);\n-\t\t\temit_alu_r(ctx, lo(dst), MIPS_R_T6, BPF_OP(code));\n+\t\t\temit_alu_r(ctx, lo(dst), MIPS_R_T6, BPF_OP(code), off == 1);\n \t\t} else if (rewrite_alu_i(BPF_OP(code), imm, \u0026alu, \u0026val)) {\n \t\t\temit_alu_i(ctx, lo(dst), val, alu);\n \t\t}\n@@ -1546,7 +1554,7 @@ int build_insn(const struct bpf_insn *insn, struct jit_context *ctx)\n \tcase BPF_ALU | BPF_MUL | BPF_X:\n \tcase BPF_ALU | BPF_DIV | BPF_X:\n \tcase BPF_ALU | BPF_MOD | BPF_X:\n-\t\temit_alu_r(ctx, lo(dst), lo(src), BPF_OP(code));\n+\t\temit_alu_r(ctx, lo(dst), lo(src), BPF_OP(code), off == 1);\n \t\temit_zext_ver(ctx, dst);\n \t\tbreak;\n \t/* dst = imm (64-bit) */\n@@ -1599,7 +1607,7 @@ int build_insn(const struct bpf_insn *insn, struct jit_context *ctx)\n \t\t * and then do the operation on this register.\n \t\t */\n \t\temit_mov_se_i64(ctx, tmp, imm);\n-\t\temit_divmod_r64(ctx, dst, tmp, BPF_OP(code));\n+\t\temit_divmod_r64(ctx, dst, tmp, BPF_OP(code), off == 1);\n \t\tbreak;\n \t/* dst = dst \u0026 src (64-bit) */\n \t/* dst = dst | src (64-bit) */\n@@ -1629,7 +1637,7 @@ int build_insn(const struct bpf_insn *insn, struct jit_context *ctx)\n \t/* dst = dst % src (64-bit) */\n \tcase BPF_ALU64 | BPF_DIV | BPF_X:\n \tcase BPF_ALU64 | BPF_MOD | BPF_X:\n-\t\temit_divmod_r64(ctx, dst, src, BPF_OP(code));\n+\t\temit_divmod_r64(ctx, dst, src, BPF_OP(code), off == 1);\n \t\tbreak;\n \t/* dst = htole(dst) */\n \t/* dst = htobe(dst) */\ndiff --git a/arch/mips/net/bpf_jit_comp64.c b/arch/mips/net/bpf_jit_comp64.c\nindex fa7e9aa37f498d..d0a8fb792c9be1 100644\n--- a/arch/mips/net/bpf_jit_comp64.c\n+++ b/arch/mips/net/bpf_jit_comp64.c\n@@ -198,7 +198,8 @@ static void emit_alu_i64(struct jit_context *ctx, u8 dst, s32 imm, u8 op)\n }\n \n /* ALU register operation (64-bit) */\n-static void emit_alu_r64(struct jit_context *ctx, u8 dst, u8 src, u8 op)\n+static void emit_alu_r64(struct jit_context *ctx, u8 dst, u8 src, u8 op,\n+\t\t\t bool is_signed)\n {\n \tswitch (BPF_OP(op)) {\n \t/* dst = dst \u003c\u003c src */\n@@ -235,25 +236,43 @@ static void emit_alu_r64(struct jit_context *ctx, u8 dst, u8 src, u8 op)\n \t\tbreak;\n \t/* dst = dst / src */\n \tcase BPF_DIV:\n-\t\tif (cpu_has_mips64r6) {\n-\t\t\temit(ctx, ddivu_r6, dst, dst, src);\n+\t\tif (is_signed) {\n+\t\t\tif (cpu_has_mips64r6) {\n+\t\t\t\temit(ctx, ddiv_r6, dst, dst, src);\n+\t\t\t} else {\n+\t\t\t\temit(ctx, ddiv, dst, src);\n+\t\t\t\temit(ctx, mflo, dst);\n+\t\t\t}\n \t\t} else {\n-\t\t\temit(ctx, ddivu, dst, src);\n-\t\t\temit(ctx, mflo, dst);\n+\t\t\tif (cpu_has_mips64r6) {\n+\t\t\t\temit(ctx, ddivu_r6, dst, dst, src);\n+\t\t\t} else {\n+\t\t\t\temit(ctx, ddivu, dst, src);\n+\t\t\t\temit(ctx, mflo, dst);\n+\t\t\t}\n \t\t}\n \t\tbreak;\n \t/* dst = dst % src */\n \tcase BPF_MOD:\n-\t\tif (cpu_has_mips64r6) {\n-\t\t\temit(ctx, dmodu, dst, dst, src);\n+\t\tif (is_signed) {\n+\t\t\tif (cpu_has_mips64r6) {\n+\t\t\t\temit(ctx, dmod, dst, dst, src);\n+\t\t\t} else {\n+\t\t\t\temit(ctx, ddiv, dst, src);\n+\t\t\t\temit(ctx, mfhi, dst);\n+\t\t\t}\n \t\t} else {\n-\t\t\temit(ctx, ddivu, dst, src);\n-\t\t\temit(ctx, mfhi, dst);\n+\t\t\tif (cpu_has_mips64r6) {\n+\t\t\t\temit(ctx, dmodu, dst, dst, src);\n+\t\t\t} else {\n+\t\t\t\temit(ctx, ddivu, dst, src);\n+\t\t\t\temit(ctx, mfhi, dst);\n+\t\t\t}\n \t\t}\n \t\tbreak;\n \tdefault:\n \t\t/* Width-generic operations */\n-\t\temit_alu_r(ctx, dst, src, op);\n+\t\temit_alu_r(ctx, dst, src, op, false);\n \t}\n \tclobber_reg(ctx, dst);\n }\n@@ -674,9 +693,9 @@ int build_insn(const struct bpf_insn *insn, struct jit_context *ctx)\n \tcase BPF_ALU | BPF_AND | BPF_K:\n \tcase BPF_ALU | BPF_XOR | BPF_K:\n \tcase BPF_ALU | BPF_LSH | BPF_K:\n-\t\tif (!valid_alu_i(BPF_OP(code), imm)) {\n+\t\tif (!valid_alu_i(BPF_OP(code), imm, false)) {\n \t\t\temit_mov_i(ctx, MIPS_R_T4, imm);\n-\t\t\temit_alu_r(ctx, dst, MIPS_R_T4, BPF_OP(code));\n+\t\t\temit_alu_r(ctx, dst, MIPS_R_T4, BPF_OP(code), false);\n \t\t} else if (rewrite_alu_i(BPF_OP(code), imm, \u0026alu, \u0026val)) {\n \t\t\temit_alu_i(ctx, dst, val, alu);\n \t\t}\n@@ -696,10 +715,10 @@ int build_insn(const struct bpf_insn *insn, struct jit_context *ctx)\n \tcase BPF_ALU | BPF_MUL | BPF_K:\n \tcase BPF_ALU | BPF_DIV | BPF_K:\n \tcase BPF_ALU | BPF_MOD | BPF_K:\n-\t\tif (!valid_alu_i(BPF_OP(code), imm)) {\n+\t\tif (!valid_alu_i(BPF_OP(code), imm, off == 1)) {\n \t\t\temit_sext(ctx, dst, dst);\n \t\t\temit_mov_i(ctx, MIPS_R_T4, imm);\n-\t\t\temit_alu_r(ctx, dst, MIPS_R_T4, BPF_OP(code));\n+\t\t\temit_alu_r(ctx, dst, MIPS_R_T4, BPF_OP(code), off == 1);\n \t\t} else if (rewrite_alu_i(BPF_OP(code), imm, \u0026alu, \u0026val)) {\n \t\t\temit_sext(ctx, dst, dst);\n \t\t\temit_alu_i(ctx, dst, val, alu);\n@@ -714,7 +733,7 @@ int build_insn(const struct bpf_insn *insn, struct jit_context *ctx)\n \tcase BPF_ALU | BPF_OR | BPF_X:\n \tcase BPF_ALU | BPF_XOR | BPF_X:\n \tcase BPF_ALU | BPF_LSH | BPF_X:\n-\t\temit_alu_r(ctx, dst, src, BPF_OP(code));\n+\t\temit_alu_r(ctx, dst, src, BPF_OP(code), false);\n \t\temit_zext_ver(ctx, dst);\n \t\tbreak;\n \t/* dst = dst \u003e\u003e src */\n@@ -733,7 +752,7 @@ int build_insn(const struct bpf_insn *insn, struct jit_context *ctx)\n \tcase BPF_ALU | BPF_MOD | BPF_X:\n \t\temit_sext(ctx, dst, dst);\n \t\temit_sext(ctx, MIPS_R_T4, src);\n-\t\temit_alu_r(ctx, dst, MIPS_R_T4, BPF_OP(code));\n+\t\temit_alu_r(ctx, dst, MIPS_R_T4, BPF_OP(code), off == 1);\n \t\temit_zext_ver(ctx, dst);\n \t\tbreak;\n \t/* dst = imm (64-bit) */\n@@ -770,9 +789,9 @@ int build_insn(const struct bpf_insn *insn, struct jit_context *ctx)\n \tcase BPF_ALU64 | BPF_MUL | BPF_K:\n \tcase BPF_ALU64 | BPF_DIV | BPF_K:\n \tcase BPF_ALU64 | BPF_MOD | BPF_K:\n-\t\tif (!valid_alu_i(BPF_OP(code), imm)) {\n+\t\tif (!valid_alu_i(BPF_OP(code), imm, off == 1)) {\n \t\t\temit_mov_i(ctx, MIPS_R_T4, imm);\n-\t\t\temit_alu_r64(ctx, dst, MIPS_R_T4, BPF_OP(code));\n+\t\t\temit_alu_r64(ctx, dst, MIPS_R_T4, BPF_OP(code), off == 1);\n \t\t} else if (rewrite_alu_i(BPF_OP(code), imm, \u0026alu, \u0026val)) {\n \t\t\temit_alu_i64(ctx, dst, val, alu);\n \t\t}\n@@ -799,7 +818,7 @@ int build_insn(const struct bpf_insn *insn, struct jit_context *ctx)\n \tcase BPF_ALU64 | BPF_MUL | BPF_X:\n \tcase BPF_ALU64 | BPF_DIV | BPF_X:\n \tcase BPF_ALU64 | BPF_MOD | BPF_X:\n-\t\temit_alu_r64(ctx, dst, src, BPF_OP(code));\n+\t\temit_alu_r64(ctx, dst, src, BPF_OP(code), off == 1);\n \t\tbreak;\n \t/* dst = htole(dst) */\n \t/* dst = htobe(dst) */\n"
}

gemini-3.1-pro-preview

null

{
  "EnableConfigs": [
    "BPF_JIT",
    "BPF_SYSCALL"
  ],
  "FocusSymbols": [
    "emit_alu_r",
    "emit_alu_r64",
    "emit_divmod_r64",
    "jit_smod64"
  ],
  "Reasoning": "The patch introduces support for signed division and modulo operations in the MIPS BPF JIT compiler. This modifies the core JIT translation logic for BPF programs on MIPS. Fuzzing is necessary to ensure the JIT compiler correctly handles these new signed operations and does not introduce vulnerabilities or crashes during BPF program execution.",
  "WorthFuzzing": true
}

You are an expert Linux kernel maintainer.
Your job is to review a provided patch series and determine
if it makes functional changes to the kernel that should be fuzzed.

IMPORTANT: The changes have ALREADY been applied and committed as the HEAD commit in
your workspace. Do NOT rely on your internal knowledge of the kernel. You must actively
use your code access tools to examine the actual source code and confirm any assumptions.

Return WorthFuzzing=false if the patch only contains:
- Modifications to Documentation/, Kconfig files, or code comments.
- Purely decorative changes, such as logging (e.g., pr_err, printk) or tracepoints.
- Changes to numeric constants or macros that do not functionally alter execution flow.
- Code paths that are impossible to reach in virtualized environments like GCE or QEMU,
even when utilizing software-emulated hardware (e.g., usb gadget, mac80211_hwsim).

If it modifies reachable core kernel logic, drivers, or architectures, use your code search
tools to verify the code can be executed, then return WorthFuzzing=true.

When returning WorthFuzzing=true, you MUST ALSO:
1. Extract any specific kernel functions that should be heavily fuzzed into FocusSymbols.
   Avoid listing generic hot-path functions to prevent skewed test distributions.
2. Identify any specific CONFIG_ options required to properly test this new/modified feature.
   Go and look into the Kconfig files and check for ifdefs around the code, do not make assumptions.
   Do not list too generic configs (we already have them enabled). Only list those that
   specifically cover the modified code. List them in the EnableConfigs output array,
   and DO NOT add a 'CONFIG_' prefix (e.g., return "NET_IPV4" instead of "CONFIG_NET_IPV4").
Prefer calling several tools at the same time to save round-trips.


Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.

For your convenience, here is the diff of the changes:
commit de42ca67c719276352cb7932b8fa6263d8f9719d
Author: syz-cluster <triage@syzkaller.com>
Date:   Fri Jul 17 01:54:02 2026 +0000

    syz-cluster: applied patch under review

diff --git a/arch/mips/include/asm/uasm.h b/arch/mips/include/asm/uasm.h
index b43bfd44525213..9d3edb59efc098 100644
--- a/arch/mips/include/asm/uasm.h
+++ b/arch/mips/include/asm/uasm.h
@@ -85,15 +85,20 @@ Ip_u1u2(_ctc1);
 Ip_u2u1(_ctcmsa);
 Ip_u2u1s3(_daddiu);
 Ip_u3u1u2(_daddu);
+Ip_u1u2(_ddiv);
+Ip_u3u1u2(_ddiv_r6);
 Ip_u1u2(_ddivu);
 Ip_u3u1u2(_ddivu_r6);
 Ip_u1(_di);
 Ip_u2u1msbu3(_dins);
 Ip_u2u1msbu3(_dinsm);
 Ip_u2u1msbu3(_dinsu);
+Ip_u1u2(_div);
+Ip_u3u1u2(_div_r6);
 Ip_u1u2(_divu);
 Ip_u3u1u2(_divu_r6);
 Ip_u1u2u3(_dmfc0);
+Ip_u3u1u2(_dmod);
 Ip_u3u1u2(_dmodu);
 Ip_u1u2u3(_dmtc0);
 Ip_u1u2(_dmultu);
@@ -135,6 +140,7 @@ Ip_u1u2u3(_mfc0);
 Ip_u1u2u3(_mfhc0);
 Ip_u1(_mfhi);
 Ip_u1(_mflo);
+Ip_u3u1u2(_mod);
 Ip_u3u1u2(_modu);
 Ip_u3u1u2(_movn);
 Ip_u3u1u2(_movz);
diff --git a/arch/mips/mm/uasm-mips.c b/arch/mips/mm/uasm-mips.c
index e15c6700cd0884..ef1a2b04007007 100644
--- a/arch/mips/mm/uasm-mips.c
+++ b/arch/mips/mm/uasm-mips.c
@@ -75,6 +75,9 @@ static const struct insn insn_table[insn_invalid] = {
 	[insn_ctcmsa]	= {M(msa_op, 0, msa_ctc_op, 0, 0, msa_elm_op), RD | RE},
 	[insn_daddiu]	= {M(daddiu_op, 0, 0, 0, 0, 0), RS | RT | SIMM},
 	[insn_daddu]	= {M(spec_op, 0, 0, 0, 0, daddu_op), RS | RT | RD},
+	[insn_ddiv]	= {M(spec_op, 0, 0, 0, 0, ddiv_op), RS | RT},
+	[insn_ddiv_r6]	= {M(spec_op, 0, 0, 0, ddiv_ddiv6_op, ddiv_op),
+				RS | RT | RD},
 	[insn_ddivu]	= {M(spec_op, 0, 0, 0, 0, ddivu_op), RS | RT},
 	[insn_ddivu_r6]	= {M(spec_op, 0, 0, 0, ddivu_ddivu6_op, ddivu_op),
 				RS | RT | RD},
@@ -82,10 +85,15 @@ static const struct insn insn_table[insn_invalid] = {
 	[insn_dins]	= {M(spec3_op, 0, 0, 0, 0, dins_op), RS | RT | RD | RE},
 	[insn_dinsm]	= {M(spec3_op, 0, 0, 0, 0, dinsm_op), RS | RT | RD | RE},
 	[insn_dinsu]	= {M(spec3_op, 0, 0, 0, 0, dinsu_op), RS | RT | RD | RE},
+	[insn_div]	= {M(spec_op, 0, 0, 0, 0, div_op), RS | RT},
+	[insn_div_r6]	= {M(spec_op, 0, 0, 0, div_div6_op, div_op),
+				RS | RT | RD},
 	[insn_divu]	= {M(spec_op, 0, 0, 0, 0, divu_op), RS | RT},
 	[insn_divu_r6]	= {M(spec_op, 0, 0, 0, divu_divu6_op, divu_op),
 				RS | RT | RD},
 	[insn_dmfc0]	= {M(cop0_op, dmfc_op, 0, 0, 0, 0), RT | RD | SET},
+	[insn_dmod]	= {M(spec_op, 0, 0, 0, ddiv_dmod_op, ddiv_op),
+				RS | RT | RD},
 	[insn_dmodu]	= {M(spec_op, 0, 0, 0, ddivu_dmodu_op, ddivu_op),
 				RS | RT | RD},
 	[insn_dmtc0]	= {M(cop0_op, dmtc_op, 0, 0, 0, 0), RT | RD | SET},
@@ -140,6 +148,8 @@ static const struct insn insn_table[insn_invalid] = {
 	[insn_mfhc0]	= {M(cop0_op, mfhc0_op, 0, 0, 0, 0),  RT | RD | SET},
 	[insn_mfhi]	= {M(spec_op, 0, 0, 0, 0, mfhi_op), RD},
 	[insn_mflo]	= {M(spec_op, 0, 0, 0, 0, mflo_op), RD},
+	[insn_mod]	= {M(spec_op, 0, 0, 0, div_mod_op, div_op),
+				RS | RT | RD},
 	[insn_modu]	= {M(spec_op, 0, 0, 0, divu_modu_op, divu_op),
 				RS | RT | RD},
 	[insn_movn]	= {M(spec_op, 0, 0, 0, 0, movn_op), RS | RT | RD},
diff --git a/arch/mips/mm/uasm.c b/arch/mips/mm/uasm.c
index 125140979d62c5..9d87d57164d798 100644
--- a/arch/mips/mm/uasm.c
+++ b/arch/mips/mm/uasm.c
@@ -49,16 +49,17 @@ enum opcode {
 	insn_addiu, insn_addu, insn_and, insn_andi, insn_bbit0, insn_bbit1,
 	insn_beq, insn_beql, insn_bgez, insn_bgezl, insn_bgtz, insn_blez,
 	insn_bltz, insn_bltzl, insn_bne, insn_break, insn_cache, insn_cfc1,
-	insn_cfcmsa, insn_ctc1, insn_ctcmsa, insn_daddiu, insn_daddu, insn_ddivu,
-	insn_ddivu_r6, insn_di, insn_dins, insn_dinsm, insn_dinsu, insn_divu,
-	insn_divu_r6, insn_dmfc0, insn_dmodu, insn_dmtc0, insn_dmultu,
+	insn_cfcmsa, insn_ctc1, insn_ctcmsa, insn_daddiu, insn_daddu, insn_ddiv,
+	insn_ddiv_r6, insn_ddivu, insn_ddivu_r6, insn_di, insn_dins, insn_dinsm,
+	insn_dinsu, insn_div, insn_div_r6, insn_divu, insn_divu_r6, insn_dmfc0,
+	insn_dmod, insn_dmodu, insn_dmtc0, insn_dmultu,
 	insn_dmulu, insn_drotr, insn_drotr32, insn_dsbh, insn_dshd, insn_dsll,
 	insn_dsll32, insn_dsllv, insn_dsra, insn_dsra32, insn_dsrav, insn_dsrl,
 	insn_dsrl32, insn_dsrlv, insn_dsubu, insn_eret, insn_ext, insn_ins,
 	insn_j, insn_jal, insn_jalr, insn_jr, insn_lb, insn_lbu, insn_ld,
 	insn_lddir, insn_ldpte, insn_ldx, insn_lh, insn_lhu, insn_ll, insn_lld,
 	insn_lui, insn_lw, insn_lwu, insn_lwx, insn_mfc0, insn_mfhc0, insn_mfhi,
-	insn_mflo, insn_modu, insn_movn, insn_movz, insn_mtc0, insn_mthc0,
+	insn_mflo, insn_mod, insn_modu, insn_movn, insn_movz, insn_mtc0, insn_mthc0,
 	insn_mthi, insn_mtlo, insn_mul, insn_multu, insn_mulu, insn_muhu, insn_nor,
 	insn_or, insn_ori, insn_pref, insn_rfe, insn_rotr, insn_sb, insn_sc,
 	insn_scd, insn_seleqz, insn_selnez, insn_sd, insn_sh, insn_sll,
@@ -287,9 +288,12 @@ I_u1u2(_cfc1)
 I_u2u1(_cfcmsa)
 I_u1u2(_ctc1)
 I_u2u1(_ctcmsa)
+I_u1u2(_ddiv)
+I_u3u1u2(_ddiv_r6)
 I_u1u2(_ddivu)
 I_u3u1u2(_ddivu_r6)
 I_u1u2u3(_dmfc0)
+I_u3u1u2(_dmod)
 I_u3u1u2(_dmodu)
 I_u1u2u3(_dmtc0)
 I_u1u2(_dmultu)
@@ -297,6 +301,8 @@ I_u3u1u2(_dmulu)
 I_u2u1s3(_daddiu)
 I_u3u1u2(_daddu)
 I_u1(_di);
+I_u1u2(_div)
+I_u3u1u2(_div_r6)
 I_u1u2(_divu)
 I_u3u1u2(_divu_r6)
 I_u2u1(_dsbh);
@@ -332,6 +338,7 @@ I_u2s3u1(_lw)
 I_u2s3u1(_lwu)
 I_u1u2u3(_mfc0)
 I_u1u2u3(_mfhc0)
+I_u3u1u2(_mod)
 I_u3u1u2(_modu)
 I_u3u1u2(_movn)
 I_u3u1u2(_movz)
diff --git a/arch/mips/net/bpf_jit_comp.c b/arch/mips/net/bpf_jit_comp.c
index 6ee4abe6a1f705..504daea4aac2e9 100644
--- a/arch/mips/net/bpf_jit_comp.c
+++ b/arch/mips/net/bpf_jit_comp.c
@@ -208,7 +208,7 @@ void emit_mov_r(struct jit_context *ctx, u8 dst, u8 src)
 }
 
 /* Validate ALU immediate range */
-bool valid_alu_i(u8 op, s32 imm)
+bool valid_alu_i(u8 op, s32 imm, bool is_signed)
 {
 	switch (BPF_OP(op)) {
 	case BPF_NEG:
@@ -237,6 +237,15 @@ bool valid_alu_i(u8 op, s32 imm)
 		return imm == 0 || (imm > 0 && is_power_of_2(imm));
 	case BPF_DIV:
 	case BPF_MOD:
+		/*
+		 * The rewrite to a shift/mask below is an unsigned-only
+		 * optimization: arithmetic right shift rounds toward
+		 * negative infinity rather than zero, and masking does not
+		 * reproduce a negative dividend's sign. Force the signed
+		 * case through the general register path instead.
+		 */
+		if (is_signed)
+			return false;
 		/* imm must be an 17-bit power of two */
 		return (u32)imm <= 0x10000 && is_power_of_2((u32)imm);
 	}
@@ -339,7 +348,7 @@ void emit_alu_i(struct jit_context *ctx, u8 dst, s32 imm, u8 op)
 }
 
 /* ALU register operation (32-bit) */
-void emit_alu_r(struct jit_context *ctx, u8 dst, u8 src, u8 op)
+void emit_alu_r(struct jit_context *ctx, u8 dst, u8 src, u8 op, bool is_signed)
 {
 	switch (BPF_OP(op)) {
 	/* dst = dst & src */
@@ -385,20 +394,38 @@ void emit_alu_r(struct jit_context *ctx, u8 dst, u8 src, u8 op)
 		break;
 	/* dst = dst / src */
 	case BPF_DIV:
-		if (cpu_has_mips32r6) {
-			emit(ctx, divu_r6, dst, dst, src);
+		if (is_signed) {
+			if (cpu_has_mips32r6) {
+				emit(ctx, div_r6, dst, dst, src);
+			} else {
+				emit(ctx, div, dst, src);
+				emit(ctx, mflo, dst);
+			}
 		} else {
-			emit(ctx, divu, dst, src);
-			emit(ctx, mflo, dst);
+			if (cpu_has_mips32r6) {
+				emit(ctx, divu_r6, dst, dst, src);
+			} else {
+				emit(ctx, divu, dst, src);
+				emit(ctx, mflo, dst);
+			}
 		}
 		break;
 	/* dst = dst % src */
 	case BPF_MOD:
-		if (cpu_has_mips32r6) {
-			emit(ctx, modu, dst, dst, src);
+		if (is_signed) {
+			if (cpu_has_mips32r6) {
+				emit(ctx, mod, dst, dst, src);
+			} else {
+				emit(ctx, div, dst, src);
+				emit(ctx, mfhi, dst);
+			}
 		} else {
-			emit(ctx, divu, dst, src);
-			emit(ctx, mfhi, dst);
+			if (cpu_has_mips32r6) {
+				emit(ctx, modu, dst, dst, src);
+			} else {
+				emit(ctx, divu, dst, src);
+				emit(ctx, mfhi, dst);
+			}
 		}
 		break;
 	}
diff --git a/arch/mips/net/bpf_jit_comp.h b/arch/mips/net/bpf_jit_comp.h
index a37fe20818eb9c..6367b936b67e70 100644
--- a/arch/mips/net/bpf_jit_comp.h
+++ b/arch/mips/net/bpf_jit_comp.h
@@ -163,7 +163,7 @@ void emit_mov_i(struct jit_context *ctx, u8 dst, s32 imm);
 void emit_mov_r(struct jit_context *ctx, u8 dst, u8 src);
 
 /* Validate ALU/ALU64 immediate range */
-bool valid_alu_i(u8 op, s32 imm);
+bool valid_alu_i(u8 op, s32 imm, bool is_signed);
 
 /* Rewrite ALU/ALU64 immediate operation */
 bool rewrite_alu_i(u8 op, s32 imm, u8 *alu, s32 *val);
@@ -172,7 +172,7 @@ bool rewrite_alu_i(u8 op, s32 imm, u8 *alu, s32 *val);
 void emit_alu_i(struct jit_context *ctx, u8 dst, s32 imm, u8 op);
 
 /* ALU register operation (32-bit) */
-void emit_alu_r(struct jit_context *ctx, u8 dst, u8 src, u8 op);
+void emit_alu_r(struct jit_context *ctx, u8 dst, u8 src, u8 op, bool is_signed);
 
 /* Atomic read-modify-write (32-bit) */
 void emit_atomic_r(struct jit_context *ctx, u8 dst, u8 src, s16 off, u8 code);
diff --git a/arch/mips/net/bpf_jit_comp32.c b/arch/mips/net/bpf_jit_comp32.c
index 40a878b672f5d3..5d7624f0e30163 100644
--- a/arch/mips/net/bpf_jit_comp32.c
+++ b/arch/mips/net/bpf_jit_comp32.c
@@ -512,7 +512,7 @@ static void emit_mul_r64(struct jit_context *ctx,
 	clobber_reg64(ctx, dst);
 }
 
-/* Helper function for 64-bit modulo */
+/* Helper function for unsigned 64-bit modulo */
 static u64 jit_mod64(u64 a, u64 b)
 {
 	u64 rem;
@@ -521,9 +521,17 @@ static u64 jit_mod64(u64 a, u64 b)
 	return rem;
 }
 
+/* Helper function for signed 64-bit modulo */
+static s64 jit_smod64(s64 a, s64 b)
+{
+	s64 quot = div64_s64(a, b);
+
+	return a - quot * b;
+}
+
 /* ALU div/mod register (64-bit) */
-static void emit_divmod_r64(struct jit_context *ctx,
-			    const u8 dst[], const u8 src[], u8 op)
+static void emit_divmod_r64(struct jit_context *ctx, const u8 dst[],
+			    const u8 src[], u8 op, bool is_signed)
 {
 	const u8 *r0 = bpf2mips32[BPF_REG_0]; /* Mapped to v0-v1 */
 	const u8 *r1 = bpf2mips32[BPF_REG_1]; /* Mapped to a0-a1 */
@@ -546,11 +554,11 @@ static void emit_divmod_r64(struct jit_context *ctx,
 	switch (BPF_OP(op)) {
 	/* dst = dst / src */
 	case BPF_DIV:
-		addr = (u32)&div64_u64;
+		addr = is_signed ? (u32)&div64_s64 : (u32)&div64_u64;
 		break;
 	/* dst = dst % src */
 	case BPF_MOD:
-		addr = (u32)&jit_mod64;
+		addr = is_signed ? (u32)&jit_smod64 : (u32)&jit_mod64;
 		break;
 	}
 	emit_mov_i(ctx, MIPS_R_T9, addr);
@@ -1516,9 +1524,9 @@ int build_insn(const struct bpf_insn *insn, struct jit_context *ctx)
 	case BPF_ALU | BPF_MUL | BPF_K:
 	case BPF_ALU | BPF_DIV | BPF_K:
 	case BPF_ALU | BPF_MOD | BPF_K:
-		if (!valid_alu_i(BPF_OP(code), imm)) {
+		if (!valid_alu_i(BPF_OP(code), imm, off == 1)) {
 			emit_mov_i(ctx, MIPS_R_T6, imm);
-			emit_alu_r(ctx, lo(dst), MIPS_R_T6, BPF_OP(code));
+			emit_alu_r(ctx, lo(dst), MIPS_R_T6, BPF_OP(code), off == 1);
 		} else if (rewrite_alu_i(BPF_OP(code), imm, &alu, &val)) {
 			emit_alu_i(ctx, lo(dst), val, alu);
 		}
@@ -1546,7 +1554,7 @@ int build_insn(const struct bpf_insn *insn, struct jit_context *ctx)
 	case BPF_ALU | BPF_MUL | BPF_X:
 	case BPF_ALU | BPF_DIV | BPF_X:
 	case BPF_ALU | BPF_MOD | BPF_X:
-		emit_alu_r(ctx, lo(dst), lo(src), BPF_OP(code));
+		emit_alu_r(ctx, lo(dst), lo(src), BPF_OP(code), off == 1);
 		emit_zext_ver(ctx, dst);
 		break;
 	/* dst = imm (64-bit) */
@@ -1599,7 +1607,7 @@ int build_insn(const struct bpf_insn *insn, struct jit_context *ctx)
 		 * and then do the operation on this register.
 		 */
 		emit_mov_se_i64(ctx, tmp, imm);
-		emit_divmod_r64(ctx, dst, tmp, BPF_OP(code));
+		emit_divmod_r64(ctx, dst, tmp, BPF_OP(code), off == 1);
 		break;
 	/* dst = dst & src (64-bit) */
 	/* dst = dst | src (64-bit) */
@@ -1629,7 +1637,7 @@ int build_insn(const struct bpf_insn *insn, struct jit_context *ctx)
 	/* dst = dst % src (64-bit) */
 	case BPF_ALU64 | BPF_DIV | BPF_X:
 	case BPF_ALU64 | BPF_MOD | BPF_X:
-		emit_divmod_r64(ctx, dst, src, BPF_OP(code));
+		emit_divmod_r64(ctx, dst, src, BPF_OP(code), off == 1);
 		break;
 	/* dst = htole(dst) */
 	/* dst = htobe(dst) */
diff --git a/arch/mips/net/bpf_jit_comp64.c b/arch/mips/net/bpf_jit_comp64.c
index fa7e9aa37f498d..d0a8fb792c9be1 100644
--- a/arch/mips/net/bpf_jit_comp64.c
+++ b/arch/mips/net/bpf_jit_comp64.c
@@ -198,7 +198,8 @@ static void emit_alu_i64(struct jit_context *ctx, u8 dst, s32 imm, u8 op)
 }
 
 /* ALU register operation (64-bit) */
-static void emit_alu_r64(struct jit_context *ctx, u8 dst, u8 src, u8 op)
+static void emit_alu_r64(struct jit_context *ctx, u8 dst, u8 src, u8 op,
+			 bool is_signed)
 {
 	switch (BPF_OP(op)) {
 	/* dst = dst << src */
@@ -235,25 +236,43 @@ static void emit_alu_r64(struct jit_context *ctx, u8 dst, u8 src, u8 op)
 		break;
 	/* dst = dst / src */
 	case BPF_DIV:
-		if (cpu_has_mips64r6) {
-			emit(ctx, ddivu_r6, dst, dst, src);
+		if (is_signed) {
+			if (cpu_has_mips64r6) {
+				emit(ctx, ddiv_r6, dst, dst, src);
+			} else {
+				emit(ctx, ddiv, dst, src);
+				emit(ctx, mflo, dst);
+			}
 		} else {
-			emit(ctx, ddivu, dst, src);
-			emit(ctx, mflo, dst);
+			if (cpu_has_mips64r6) {
+				emit(ctx, ddivu_r6, dst, dst, src);
+			} else {
+				emit(ctx, ddivu, dst, src);
+				emit(ctx, mflo, dst);
+			}
 		}
 		break;
 	/* dst = dst % src */
 	case BPF_MOD:
-		if (cpu_has_mips64r6) {
-			emit(ctx, dmodu, dst, dst, src);
+		if (is_signed) {
+			if (cpu_has_mips64r6) {
+				emit(ctx, dmod, dst, dst, src);
+			} else {
+				emit(ctx, ddiv, dst, src);
+				emit(ctx, mfhi, dst);
+			}
 		} else {
-			emit(ctx, ddivu, dst, src);
-			emit(ctx, mfhi, dst);
+			if (cpu_has_mips64r6) {
+				emit(ctx, dmodu, dst, dst, src);
+			} else {
+				emit(ctx, ddivu, dst, src);
+				emit(ctx, mfhi, dst);
+			}
 		}
 		break;
 	default:
 		/* Width-generic operations */
-		emit_alu_r(ctx, dst, src, op);
+		emit_alu_r(ctx, dst, src, op, false);
 	}
 	clobber_reg(ctx, dst);
 }
@@ -674,9 +693,9 @@ int build_insn(const struct bpf_insn *insn, struct jit_context *ctx)
 	case BPF_ALU | BPF_AND | BPF_K:
 	case BPF_ALU | BPF_XOR | BPF_K:
 	case BPF_ALU | BPF_LSH | BPF_K:
-		if (!valid_alu_i(BPF_OP(code), imm)) {
+		if (!valid_alu_i(BPF_OP(code), imm, false)) {
 			emit_mov_i(ctx, MIPS_R_T4, imm);
-			emit_alu_r(ctx, dst, MIPS_R_T4, BPF_OP(code));
+			emit_alu_r(ctx, dst, MIPS_R_T4, BPF_OP(code), false);
 		} else if (rewrite_alu_i(BPF_OP(code), imm, &alu, &val)) {
 			emit_alu_i(ctx, dst, val, alu);
 		}
@@ -696,10 +715,10 @@ int build_insn(const struct bpf_insn *insn, struct jit_context *ctx)
 	case BPF_ALU | BPF_MUL | BPF_K:
 	case BPF_ALU | BPF_DIV | BPF_K:
 	case BPF_ALU | BPF_MOD | BPF_K:
-		if (!valid_alu_i(BPF_OP(code), imm)) {
+		if (!valid_alu_i(BPF_OP(code), imm, off == 1)) {
 			emit_sext(ctx, dst, dst);
 			emit_mov_i(ctx, MIPS_R_T4, imm);
-			emit_alu_r(ctx, dst, MIPS_R_T4, BPF_OP(code));
+			emit_alu_r(ctx, dst, MIPS_R_T4, BPF_OP(code), off == 1);
 		} else if (rewrite_alu_i(BPF_OP(code), imm, &alu, &val)) {
 			emit_sext(ctx, dst, dst);
 			emit_alu_i(ctx, dst, val, alu);
@@ -714,7 +733,7 @@ int build_insn(const struct bpf_insn *insn, struct jit_context *ctx)
 	case BPF_ALU | BPF_OR | BPF_X:
 	case BPF_ALU | BPF_XOR | BPF_X:
 	case BPF_ALU | BPF_LSH | BPF_X:
-		emit_alu_r(ctx, dst, src, BPF_OP(code));
+		emit_alu_r(ctx, dst, src, BPF_OP(code), false);
 		emit_zext_ver(ctx, dst);
 		break;
 	/* dst = dst >> src */
@@ -733,7 +752,7 @@ int build_insn(const struct bpf_insn *insn, struct jit_context *ctx)
 	case BPF_ALU | BPF_MOD | BPF_X:
 		emit_sext(ctx, dst, dst);
 		emit_sext(ctx, MIPS_R_T4, src);
-		emit_alu_r(ctx, dst, MIPS_R_T4, BPF_OP(code));
+		emit_alu_r(ctx, dst, MIPS_R_T4, BPF_OP(code), off == 1);
 		emit_zext_ver(ctx, dst);
 		break;
 	/* dst = imm (64-bit) */
@@ -770,9 +789,9 @@ int build_insn(const struct bpf_insn *insn, struct jit_context *ctx)
 	case BPF_ALU64 | BPF_MUL | BPF_K:
 	case BPF_ALU64 | BPF_DIV | BPF_K:
 	case BPF_ALU64 | BPF_MOD | BPF_K:
-		if (!valid_alu_i(BPF_OP(code), imm)) {
+		if (!valid_alu_i(BPF_OP(code), imm, off == 1)) {
 			emit_mov_i(ctx, MIPS_R_T4, imm);
-			emit_alu_r64(ctx, dst, MIPS_R_T4, BPF_OP(code));
+			emit_alu_r64(ctx, dst, MIPS_R_T4, BPF_OP(code), off == 1);
 		} else if (rewrite_alu_i(BPF_OP(code), imm, &alu, &val)) {
 			emit_alu_i64(ctx, dst, val, alu);
 		}
@@ -799,7 +818,7 @@ int build_insn(const struct bpf_insn *insn, struct jit_context *ctx)
 	case BPF_ALU64 | BPF_MUL | BPF_X:
 	case BPF_ALU64 | BPF_DIV | BPF_X:
 	case BPF_ALU64 | BPF_MOD | BPF_X:
-		emit_alu_r64(ctx, dst, src, BPF_OP(code));
+		emit_alu_r64(ctx, dst, src, BPF_OP(code), off == 1);
 		break;
 	/* dst = htole(dst) */
 	/* dst = htobe(dst) */

gemini-3.1-pro-preview

null

null

							input: 10331
							output: 33
							thoughts: 497
						

**Analyzing the MIPS BPF JIT Compiler Patch**

Okay, so I'm looking at a patch that adds support for signed division and modulo operations within the MIPS BPF JIT compiler. The changes are spread across several files in the `arch/mips` directory: `include/asm/uasm.h`, `mm/uasm-mips.c`, `mm/uasm.c`, and the BPF JIT compilation files in the `net` directory (`bpf_jit_comp.c`, `.h`, `bpf_jit_comp32.c`, `bpf_jit_comp64.c`). This is a functional change, specifically enabling signed division and modulo within the BPF framework on MIPS.

I need to quickly recall how BPF handles signed division/modulo. Right, it's not using dedicated instructions like `BPF_SDIV` or `BPF_SMOD`; instead, it leverages `BPF_DIV` and `BPF_MOD` but indicates signedness, if `off == 1`.

Now, the important question: is this code reachable? I know BPF JIT is active when `CONFIG_BPF_JIT` is enabled, and we're dealing with the MIPS architecture. Since this is a functional change to the JIT compiler, it's definitely worth fuzzing. Even though syzkaller doesn't focus on MIPS by default, I can still flag it as `WorthFuzzing=true` and specify the necessary configurations. Good, syzkaller does support MIPS.

The prompt states I should verify if the code can be executed, so I need to check `arch/mips/net/bpf_jit_comp.c` and the other files. The required configurations are `CONFIG_BPF_JIT` and `CONFIG_MIPS` (which is implied by the architecture, so I won't worry too much about it). I'll focus on these symbols: `emit_alu_r`, `emit_divmod_r64`, `emit_alu_r64`, and `build_insn`. I need to verify that these configurations are set in the kernel config for this to be valid.

no matches

{
  "Expression": "config BPF_JIT",
  "PathPrefix": "arch/mips/Kconfig"
}

{
  "error": "no matches"
}

gemini-3.1-pro-preview

null

null

							input: 11354
							output: 30
							thoughts: 16
						

Here's my thought process, summarized as you requested:

**Investigating BPF_JIT Support on MIPS Architecture**

Okay, so I need to figure out the status of BPF JIT (Just-In-Time compilation) support on the MIPS architecture. The first logical step is to dive into the kernel source tree and specifically target the MIPS-related code. My hunch is that the `arch/mips` directory is the place to start. That's where architecture-specific code would reside, and any BPF JIT implementation or related configuration would likely be found there. I'll need to use my searching skills to track down where this is located. Time to start the search!

{
  "Expression": "BPF_JIT",
  "PathPrefix": "arch/mips/"
}

{
  "Output": "arch/mips/Kconfig=2=config MIPS\n--\narch/mips/Kconfig-70-\tselect HAVE_DYNAMIC_FTRACE\narch/mips/Kconfig:71:\tselect HAVE_EBPF_JIT if !CPU_MICROMIPS\narch/mips/Kconfig-72-\tselect HAVE_EXIT_THREAD\n--\narch/mips/configs/loongson3_defconfig=8=CONFIG_BPF_SYSCALL=y\narch/mips/configs/loongson3_defconfig:9:CONFIG_BPF_JIT=y\narch/mips/configs/loongson3_defconfig-10-CONFIG_PREEMPT=y\n--\narch/mips/net/Makefile-3-\narch/mips/net/Makefile:4:obj-$(CONFIG_BPF_JIT) += bpf_jit_comp.o\narch/mips/net/Makefile-5-\narch/mips/net/Makefile=6=ifeq ($(CONFIG_32BIT),y)\narch/mips/net/Makefile:7:        obj-$(CONFIG_BPF_JIT) += bpf_jit_comp32.o\narch/mips/net/Makefile-8-else\narch/mips/net/Makefile:9:        obj-$(CONFIG_BPF_JIT) += bpf_jit_comp64.o\narch/mips/net/Makefile-10-endif\n--\narch/mips/net/bpf_jit_comp.h-13-\narch/mips/net/bpf_jit_comp.h:14:#ifndef _BPF_JIT_COMP_H\narch/mips/net/bpf_jit_comp.h:15:#define _BPF_JIT_COMP_H\narch/mips/net/bpf_jit_comp.h-16-\n--\narch/mips/net/bpf_jit_comp.h=233=int build_insn(const struct bpf_insn *insn, struct jit_context *ctx);\narch/mips/net/bpf_jit_comp.h-234-\narch/mips/net/bpf_jit_comp.h:235:#endif /* _BPF_JIT_COMP_H */\n--\narch/mips/net/bpf_jit_comp32.c-40-/* Temporary 64-bit register used by JIT */\narch/mips/net/bpf_jit_comp32.c:41:#define JIT_REG_TMP MAX_BPF_JIT_REG\narch/mips/net/bpf_jit_comp32.c-42-\n--\narch/mips/net/bpf_jit_comp64.c-33-/* Extra 64-bit eBPF registers used by JIT */\narch/mips/net/bpf_jit_comp64.c:34:#define JIT_REG_TC (MAX_BPF_JIT_REG + 0)\narch/mips/net/bpf_jit_comp64.c:35:#define JIT_REG_ZX (MAX_BPF_JIT_REG + 1)\narch/mips/net/bpf_jit_comp64.c-36-\n"
}

gemini-3.1-pro-preview

null

null

							input: 12356
							output: 43
							thoughts: 370
						

**Analyzing MIPS BPF JIT Compilation for syzkaller**

Okay, so I'm looking at a BPF JIT configuration (`BPF_JIT`) on a MIPS architecture. The first thing that jumps out is that syzkaller doesn't have a MIPS instance pre-configured, but that's something that can be set up. Now, I need to figure out what else is involved in the configuration. It's usually the case that I also need `BPF_SYSCALL` enabled for BPF to work correctly.

Next, I need to drill down into the kernel code. I need to understand what has been modified to support MIPS with BPF JIT. I'm going to focus on the functions in `bpf_jit_comp.c` that have likely been changed. Based on my experience, `valid_alu_i`, `emit_alu_r`, `emit_divmod_r64`, `build_insn`, and `emit_alu_r64` are all good candidates to review.

I need to focus on the architecture-specific implementations. I'll need to examine `arch/mips/net/bpf_jit_comp.c`, `arch/mips/net/bpf_jit_comp32.c` and `arch/mips/net/bpf_jit_comp64.c` to see how MIPS handles these functions. My primary focus is on `build_insn`, `emit_alu_r`, `emit_divmod_r64`, `emit_alu_r64`, and `valid_alu_i`.

Wait, `build_insn` is probably too generic to be useful. I think `emit_alu_r`, `emit_divmod_r64`, and `emit_alu_r64` are more architecture-specific and thus, more insightful. Oh, and I see that a `jit_smod64` function has been added.

Now I need to confirm that `jit_smod64` is declared `static`, as it most likely is. Yep, it is. Wait, looks like `bpf_jit_comp32.c` defines it too. I'll need to check `arch/mips/net/bpf_jit_comp32.c` for this, just to make sure I understand it.

{
  "Expression": "jit_smod64",
  "PathPrefix": "arch/mips/net/bpf_jit_comp32.c"
}

{
  "Output": "arch/mips/net/bpf_jit_comp32.c=516=static u64 jit_mod64(u64 a, u64 b)\n--\narch/mips/net/bpf_jit_comp32.c-524-/* Helper function for signed 64-bit modulo */\narch/mips/net/bpf_jit_comp32.c:525:static s64 jit_smod64(s64 a, s64 b)\narch/mips/net/bpf_jit_comp32.c-526-{\n--\narch/mips/net/bpf_jit_comp32.c=533=static void emit_divmod_r64(struct jit_context *ctx, const u8 dst[],\n--\narch/mips/net/bpf_jit_comp32.c-560-\tcase BPF_MOD:\narch/mips/net/bpf_jit_comp32.c:561:\t\taddr = is_signed ? (u32)\u0026jit_smod64 : (u32)\u0026jit_mod64;\narch/mips/net/bpf_jit_comp32.c-562-\t\tbreak;\n"
}

gemini-3.1-pro-preview

null

null

							input: 13606
							output: 32
							thoughts: 273
						

**My Analysis of the MIPS BPF JIT Patch**

Okay, so `jit_smod64` is definitely static, good to confirm that. Now, let's nail down the critical symbols we need to focus on. Looks like we're dealing primarily with these: `emit_alu_r`, `emit_divmod_r64`, `emit_alu_r64`, and of course, `jit_smod64` itself.

The gist of this patch is signed division and modulo support within the MIPS BPF JIT compiler. A clear functional change. Given that, we *absolutely* need to fuzz this. Any bugs here could lead to crashes or, worse, vulnerabilities during BPF program execution. Correctness is paramount, especially when dealing with arithmetic operations within a JIT.

Let me just double-check, are there any other relevant config flags? Ah, yes, `CONFIG_MIPS` is the architecture, but no need to explicitly specify that since it's an architecture config. The important ones for this are `BPF_JIT` and `BPF_SYSCALL`, right? Yes, those are the ones.

Right, back to the symbols. Let's make sure we're good with `emit_alu_r` and `emit_alu_r64`. I need to verify how these interact with the new division and modulo logic.

{
  "Expression": "emit_alu_r",
  "PathPrefix": "arch/mips/net/"
}

{
  "Output": "arch/mips/net/bpf_jit_comp.c=307=void emit_alu_i(struct jit_context *ctx, u8 dst, s32 imm, u8 op)\n--\narch/mips/net/bpf_jit_comp.c-350-/* ALU register operation (32-bit) */\narch/mips/net/bpf_jit_comp.c:351:void emit_alu_r(struct jit_context *ctx, u8 dst, u8 src, u8 op, bool is_signed)\narch/mips/net/bpf_jit_comp.c-352-{\n--\narch/mips/net/bpf_jit_comp.h=172=void emit_alu_i(struct jit_context *ctx, u8 dst, s32 imm, u8 op);\n--\narch/mips/net/bpf_jit_comp.h-174-/* ALU register operation (32-bit) */\narch/mips/net/bpf_jit_comp.h:175:void emit_alu_r(struct jit_context *ctx, u8 dst, u8 src, u8 op, bool is_signed);\narch/mips/net/bpf_jit_comp.h-176-\n--\narch/mips/net/bpf_jit_comp32.c=201=static void emit_alu_i64(struct jit_context *ctx,\n--\narch/mips/net/bpf_jit_comp32.c-266-/* ALU register operation (64-bit) */\narch/mips/net/bpf_jit_comp32.c:267:static void emit_alu_r64(struct jit_context *ctx,\narch/mips/net/bpf_jit_comp32.c-268-\t\t\t const u8 dst[], const u8 src[], u8 op)\n--\narch/mips/net/bpf_jit_comp32.c=1471=int build_insn(const struct bpf_insn *insn, struct jit_context *ctx)\n--\narch/mips/net/bpf_jit_comp32.c-1528-\t\t\temit_mov_i(ctx, MIPS_R_T6, imm);\narch/mips/net/bpf_jit_comp32.c:1529:\t\t\temit_alu_r(ctx, lo(dst), MIPS_R_T6, BPF_OP(code), off == 1);\narch/mips/net/bpf_jit_comp32.c-1530-\t\t} else if (rewrite_alu_i(BPF_OP(code), imm, \u0026alu, \u0026val)) {\n--\narch/mips/net/bpf_jit_comp32.c-1556-\tcase BPF_ALU | BPF_MOD | BPF_X:\narch/mips/net/bpf_jit_comp32.c:1557:\t\temit_alu_r(ctx, lo(dst), lo(src), BPF_OP(code), off == 1);\narch/mips/net/bpf_jit_comp32.c-1558-\t\temit_zext_ver(ctx, dst);\n--\narch/mips/net/bpf_jit_comp32.c-1621-\tcase BPF_ALU64 | BPF_SUB | BPF_X:\narch/mips/net/bpf_jit_comp32.c:1622:\t\temit_alu_r64(ctx, dst, src, BPF_OP(code));\narch/mips/net/bpf_jit_comp32.c-1623-\t\tbreak;\n--\narch/mips/net/bpf_jit_comp64.c=158=static void emit_alu_i64(struct jit_context *ctx, u8 dst, s32 imm, u8 op)\n--\narch/mips/net/bpf_jit_comp64.c-200-/* ALU register operation (64-bit) */\narch/mips/net/bpf_jit_comp64.c:201:static void emit_alu_r64(struct jit_context *ctx, u8 dst, u8 src, u8 op,\narch/mips/net/bpf_jit_comp64.c-202-\t\t\t bool is_signed)\n--\narch/mips/net/bpf_jit_comp64.c-274-\t\t/* Width-generic operations */\narch/mips/net/bpf_jit_comp64.c:275:\t\temit_alu_r(ctx, dst, src, op, false);\narch/mips/net/bpf_jit_comp64.c-276-\t}\n--\narch/mips/net/bpf_jit_comp64.c=654=int build_insn(const struct bpf_insn *insn, struct jit_context *ctx)\n--\narch/mips/net/bpf_jit_comp64.c-697-\t\t\temit_mov_i(ctx, MIPS_R_T4, imm);\narch/mips/net/bpf_jit_comp64.c:698:\t\t\temit_alu_r(ctx, dst, MIPS_R_T4, BPF_OP(code), false);\narch/mips/net/bpf_jit_comp64.c-699-\t\t} else if (rewrite_alu_i(BPF_OP(code), imm, \u0026alu, \u0026val)) {\n--\narch/mips/net/bpf_jit_comp64.c-720-\t\t\temit_mov_i(ctx, MIPS_R_T4, imm);\narch/mips/net/bpf_jit_comp64.c:721:\t\t\temit_alu_r(ctx, dst, MIPS_R_T4, BPF_OP(code), off == 1);\narch/mips/net/bpf_jit_comp64.c-722-\t\t} else if (rewrite_alu_i(BPF_OP(code), imm, \u0026alu, \u0026val)) {\n--\narch/mips/net/bpf_jit_comp64.c-735-\tcase BPF_ALU | BPF_LSH | BPF_X:\narch/mips/net/bpf_jit_comp64.c:736:\t\temit_alu_r(ctx, dst, src, BPF_OP(code), false);\narch/mips/net/bpf_jit_comp64.c-737-\t\temit_zext_ver(ctx, dst);\n--\narch/mips/net/bpf_jit_comp64.c-754-\t\temit_sext(ctx, MIPS_R_T4, src);\narch/mips/net/bpf_jit_comp64.c:755:\t\temit_alu_r(ctx, dst, MIPS_R_T4, BPF_OP(code), off == 1);\narch/mips/net/bpf_jit_comp64.c-756-\t\temit_zext_ver(ctx, dst);\n--\narch/mips/net/bpf_jit_comp64.c-793-\t\t\temit_mov_i(ctx, MIPS_R_T4, imm);\narch/mips/net/bpf_jit_comp64.c:794:\t\t\temit_alu_r64(ctx, dst, MIPS_R_T4, BPF_OP(code), off == 1);\narch/mips/net/bpf_jit_comp64.c-795-\t\t} else if (rewrite_alu_i(BPF_OP(code), imm, \u0026alu, \u0026val)) {\n--\narch/mips/net/bpf_jit_comp64.c-820-\tcase BPF_ALU64 | BPF_MOD | BPF_X:\narch/mips/net/bpf_jit_comp64.c:821:\t\temit_alu_r64(ctx, dst, src, BPF_OP(code), off == 1);\narch/mips/net/bpf_jit_comp64.c-822-\t\tbreak;\n"
}

gemini-3.1-pro-preview

null

null

							input: 16283
							output: 150
							thoughts: 456
						

**Analyzing the MIPS BPF JIT Compiler Patch**

Alright, my immediate focus is on the core functions touched by this patch: `emit_alu_r`, `emit_alu_r64`, `emit_divmod_r64`, and `jit_smod64`. I need to understand how these are affected by the changes for signed division and modulo operations.

A minor detail jumped out – the `emit_alu_r64` function's signature differs between `bpf_jit_comp32.c` and `bpf_jit_comp64.c`. Specifically, the 32-bit version *lacks* the `is_signed` argument, unlike its 64-bit counterpart. This difference is worth noting; it could indicate variations in the signedness handling. However, I am satisfied that `emit_alu_r64` is relevant as a focus symbol.

`jit_smod64` is also interesting because while it's declared static, it's called through a function pointer from within `emit_divmod_r64`, so it's directly relevant to the signed modulo implementation. The scope of each function is understood in the context of the compilation.

The context of this patch is implementing signed division and modulo in the MIPS BPF JIT compiler. I need to make sure the JIT translation logic correctly handles these operations to avoid any potential security issues or runtime crashes during BPF program execution.

To ensure proper functionality, I need to confirm that `CONFIG_BPF_JIT` is the critical configuration option and that `CONFIG_BPF_SYSCALL` is also needed for loading and executing BPF programs.

With this understanding, let's proceed with setting the results and testing.

{
  "EnableConfigs": [
    "BPF_JIT",
    "BPF_SYSCALL"
  ],
  "FocusSymbols": [
    "emit_alu_r",
    "emit_alu_r64",
    "emit_divmod_r64",
    "jit_smod64"
  ],
  "Reasoning": "The patch introduces support for signed division and modulo operations in the MIPS BPF JIT compiler. This modifies the core JIT translation logic for BPF programs on MIPS. Fuzzing is necessary to ensure the JIT compiler correctly handles these new signed operations and does not introduce vulnerabilities or crashes during BPF program execution.",
  "WorthFuzzing": true
}

{
  "EnableConfigs": [
    "BPF_JIT",
    "BPF_SYSCALL"
  ],
  "FocusSymbols": [
    "emit_alu_r",
    "emit_alu_r64",
    "emit_divmod_r64",
    "jit_smod64"
  ],
  "Reasoning": "The patch introduces support for signed division and modulo operations in the MIPS BPF JIT compiler. This modifies the core JIT translation logic for BPF programs on MIPS. Fuzzing is necessary to ensure the JIT compiler correctly handles these new signed operations and does not introduce vulnerabilities or crashes during BPF program execution.",
  "WorthFuzzing": true
}