| Seq | Timestamp | Type | Name | Duration |
|---|---|---|---|---|
| 0/0 | 2026/07/30 07:32 | flow | patch-triage |
0mArgs:null Results: {
"EnableConfigs": [
"BPF_JIT",
"BPF_SYSCALL"
],
"FocusSymbols": [
"bpf_int_jit_compile"
],
"Reasoning": "The patch adds support for atomic instructions in the LoongArch BPF JIT compiler and enables the bpf_kptr_xchg inline test. The BPF JIT modifications are functional and can be tested by loading BPF programs containing these atomic operations.",
"WorthFuzzing": true
} |
| 1/1 | 2026/07/30 07:32 | action | read-patch-diff |
0mArgs:null Results: {
"PatchDiff": "commit c76578376239be5203d01fd72148619c84596b54\nAuthor: syz-cluster \u003ctriage@syzkaller.com\u003e\nDate: Thu Jul 30 07:32:19 2026 +0000\n\n syz-cluster: applied patch under review\n\ndiff --git a/arch/loongarch/include/asm/inst.h b/arch/loongarch/include/asm/inst.h\nindex 76b723590023d..bdbc17d071105 100644\n--- a/arch/loongarch/include/asm/inst.h\n+++ b/arch/loongarch/include/asm/inst.h\n@@ -199,6 +199,10 @@ enum reg3_op {\n \tamswaph_op\t= 0x70b9,\n \tamaddb_op\t= 0x70ba,\n \tamaddh_op\t= 0x70bb,\n+\tamswapdbb_op\t= 0x70bc,\n+\tamswapdbh_op\t= 0x70bd,\n+\tamadddbb_op\t= 0x70be,\n+\tamadddbh_op\t= 0x70bf,\n \tamswapw_op\t= 0x70c0,\n \tamswapd_op\t= 0x70c1,\n \tamaddw_op\t= 0x70c2,\n@@ -783,6 +787,20 @@ DEF_EMIT_REG3_FORMAT(amswapb, amswapb_op)\n DEF_EMIT_REG3_FORMAT(amswaph, amswaph_op)\n DEF_EMIT_REG3_FORMAT(amswapw, amswapw_op)\n DEF_EMIT_REG3_FORMAT(amswapd, amswapd_op)\n+DEF_EMIT_REG3_FORMAT(amswapdbb, amswapdbb_op)\n+DEF_EMIT_REG3_FORMAT(amswapdbh, amswapdbh_op)\n+DEF_EMIT_REG3_FORMAT(amadddbb, amadddbb_op)\n+DEF_EMIT_REG3_FORMAT(amadddbh, amadddbh_op)\n+DEF_EMIT_REG3_FORMAT(amadddbw, amadddbw_op)\n+DEF_EMIT_REG3_FORMAT(amadddbd, amadddbd_op)\n+DEF_EMIT_REG3_FORMAT(amanddbw, amanddbw_op)\n+DEF_EMIT_REG3_FORMAT(amanddbd, amanddbd_op)\n+DEF_EMIT_REG3_FORMAT(amordbw, amordbw_op)\n+DEF_EMIT_REG3_FORMAT(amordbd, amordbd_op)\n+DEF_EMIT_REG3_FORMAT(amxordbw, amxordbw_op)\n+DEF_EMIT_REG3_FORMAT(amxordbd, amxordbd_op)\n+DEF_EMIT_REG3_FORMAT(amswapdbw, amswapdbw_op)\n+DEF_EMIT_REG3_FORMAT(amswapdbd, amswapdbd_op)\n \n #define DEF_EMIT_REG3SA2_FORMAT(NAME, OP)\t\t\t\t\\\n static inline void emit_##NAME(union loongarch_instruction *insn,\t\\\ndiff --git a/arch/loongarch/net/bpf_jit.c b/arch/loongarch/net/bpf_jit.c\nindex 29c281bef28ef..686d333146ce2 100644\n--- a/arch/loongarch/net/bpf_jit.c\n+++ b/arch/loongarch/net/bpf_jit.c\n@@ -8,6 +8,9 @@\n #include \u003casm/asm-offsets.h\u003e\n #include \"bpf_jit.h\"\n \n+/* dbar hint for ll/sc completion ordering, see __WEAK_LLSC_MB */\n+#define DBAR_LLSC_MB\t0x700\n+\n #define LOONGARCH_MAX_REG_ARGS 8\n \n #define LOONGARCH_SAVE_RA_NINSNS 1\n@@ -433,7 +436,7 @@ static int emit_atomic_rmw(const struct bpf_insn *insn, struct jit_ctx *ctx)\n \t\t\t\tpr_err_once(\"bpf-jit: amadd.b instruction is not supported\\n\");\n \t\t\t\treturn -EINVAL;\n \t\t\t}\n-\t\t\temit_insn(ctx, amaddb, src, t1, t3);\n+\t\t\temit_insn(ctx, amadddbb, src, t1, t3);\n \t\t\temit_zext_32(ctx, src, true);\n \t\t\tbreak;\n \t\tcase BPF_H:\n@@ -441,39 +444,39 @@ static int emit_atomic_rmw(const struct bpf_insn *insn, struct jit_ctx *ctx)\n \t\t\t\tpr_err_once(\"bpf-jit: amadd.h instruction is not supported\\n\");\n \t\t\t\treturn -EINVAL;\n \t\t\t}\n-\t\t\temit_insn(ctx, amaddh, src, t1, t3);\n+\t\t\temit_insn(ctx, amadddbh, src, t1, t3);\n \t\t\temit_zext_32(ctx, src, true);\n \t\t\tbreak;\n \t\tcase BPF_W:\n-\t\t\temit_insn(ctx, amaddw, src, t1, t3);\n+\t\t\temit_insn(ctx, amadddbw, src, t1, t3);\n \t\t\temit_zext_32(ctx, src, true);\n \t\t\tbreak;\n \t\tcase BPF_DW:\n-\t\t\temit_insn(ctx, amaddd, src, t1, t3);\n+\t\t\temit_insn(ctx, amadddbd, src, t1, t3);\n \t\t\tbreak;\n \t\t}\n \t\tbreak;\n \tcase BPF_AND | BPF_FETCH:\n \t\tif (isdw) {\n-\t\t\temit_insn(ctx, amandd, src, t1, t3);\n+\t\t\temit_insn(ctx, amanddbd, src, t1, t3);\n \t\t} else {\n-\t\t\temit_insn(ctx, amandw, src, t1, t3);\n+\t\t\temit_insn(ctx, amanddbw, src, t1, t3);\n \t\t\temit_zext_32(ctx, src, true);\n \t\t}\n \t\tbreak;\n \tcase BPF_OR | BPF_FETCH:\n \t\tif (isdw) {\n-\t\t\temit_insn(ctx, amord, src, t1, t3);\n+\t\t\temit_insn(ctx, amordbd, src, t1, t3);\n \t\t} else {\n-\t\t\temit_insn(ctx, amorw, src, t1, t3);\n+\t\t\temit_insn(ctx, amordbw, src, t1, t3);\n \t\t\temit_zext_32(ctx, src, true);\n \t\t}\n \t\tbreak;\n \tcase BPF_XOR | BPF_FETCH:\n \t\tif (isdw) {\n-\t\t\temit_insn(ctx, amxord, src, t1, t3);\n+\t\t\temit_insn(ctx, amxordbd, src, t1, t3);\n \t\t} else {\n-\t\t\temit_insn(ctx, amxorw, src, t1, t3);\n+\t\t\temit_insn(ctx, amxordbw, src, t1, t3);\n \t\t\temit_zext_32(ctx, src, true);\n \t\t}\n \t\tbreak;\n@@ -485,7 +488,7 @@ static int emit_atomic_rmw(const struct bpf_insn *insn, struct jit_ctx *ctx)\n \t\t\t\tpr_err_once(\"bpf-jit: amswap.b instruction is not supported\\n\");\n \t\t\t\treturn -EINVAL;\n \t\t\t}\n-\t\t\temit_insn(ctx, amswapb, src, t1, t3);\n+\t\t\temit_insn(ctx, amswapdbb, src, t1, t3);\n \t\t\temit_zext_32(ctx, src, true);\n \t\t\tbreak;\n \t\tcase BPF_H:\n@@ -493,15 +496,15 @@ static int emit_atomic_rmw(const struct bpf_insn *insn, struct jit_ctx *ctx)\n \t\t\t\tpr_err_once(\"bpf-jit: amswap.h instruction is not supported\\n\");\n \t\t\t\treturn -EINVAL;\n \t\t\t}\n-\t\t\temit_insn(ctx, amswaph, src, t1, t3);\n+\t\t\temit_insn(ctx, amswapdbh, src, t1, t3);\n \t\t\temit_zext_32(ctx, src, true);\n \t\t\tbreak;\n \t\tcase BPF_W:\n-\t\t\temit_insn(ctx, amswapw, src, t1, t3);\n+\t\t\temit_insn(ctx, amswapdbw, src, t1, t3);\n \t\t\temit_zext_32(ctx, src, true);\n \t\t\tbreak;\n \t\tcase BPF_DW:\n-\t\t\temit_insn(ctx, amswapd, src, t1, t3);\n+\t\t\temit_insn(ctx, amswapdbd, src, t1, t3);\n \t\t\tbreak;\n \t\t}\n \t\tbreak;\n@@ -524,6 +527,7 @@ static int emit_atomic_rmw(const struct bpf_insn *insn, struct jit_ctx *ctx)\n \t\t\temit_insn(ctx, beq, t3, LOONGARCH_GPR_ZERO, -6);\n \t\t\temit_zext_32(ctx, r0, true);\n \t\t}\n+\t\temit_insn(ctx, dbar, DBAR_LLSC_MB);\n \t\tbreak;\n \tdefault:\n \t\tpr_err_once(\"bpf-jit: invalid atomic read-modify-write opcode %02x\\n\", imm);\n@@ -2392,6 +2396,11 @@ bool bpf_jit_supports_fsession(void)\n \treturn true;\n }\n \n+bool bpf_jit_supports_ptr_xchg(void)\n+{\n+\treturn true;\n+}\n+\n /* Indicate the JIT backend supports mixing bpf2bpf and tailcalls. */\n bool bpf_jit_supports_subprog_tailcalls(void)\n {\ndiff --git a/tools/testing/selftests/bpf/Makefile b/tools/testing/selftests/bpf/Makefile\nindex b642ee489ea64..6dfc817485847 100644\n--- a/tools/testing/selftests/bpf/Makefile\n+++ b/tools/testing/selftests/bpf/Makefile\n@@ -980,6 +980,7 @@ $(OUTPUT)/bench_lpm_trie_map.o: $(OUTPUT)/lpm_trie_bench.skel.h $(OUTPUT)/lpm_tr\n $(OUTPUT)/bench_bpf_nop.o: $(OUTPUT)/bpf_nop_bench.skel.h bench_bpf_timing.h\n $(OUTPUT)/bench_xdp_lb.o: $(OUTPUT)/xdp_lb_bench.skel.h bench_bpf_timing.h\n $(OUTPUT)/bench_bpf_timing.o: bench_bpf_timing.h\n+$(OUTPUT)/bench_kptr_xchg.o: $(OUTPUT)/kptr_xchg_bench.skel.h\n $(OUTPUT)/bench.o: bench.h testing_helpers.h $(BPFOBJ)\n $(OUTPUT)/bench: LDLIBS += -lm\n $(OUTPUT)/bench: $(OUTPUT)/bench.o \\\n@@ -1005,6 +1006,7 @@ $(OUTPUT)/bench: $(OUTPUT)/bench.o \\\n \t\t $(OUTPUT)/bench_bpf_timing.o \\\n \t\t $(OUTPUT)/bench_bpf_nop.o \\\n \t\t $(OUTPUT)/bench_xdp_lb.o \\\n+\t\t $(OUTPUT)/bench_kptr_xchg.o \\\n \t\t $(OUTPUT)/usdt_1.o \\\n \t\t $(OUTPUT)/usdt_2.o \\\n \t\t #\ndiff --git a/tools/testing/selftests/bpf/bench.c b/tools/testing/selftests/bpf/bench.c\nindex 3d9d2cd7764bd..550290d6701a6 100644\n--- a/tools/testing/selftests/bpf/bench.c\n+++ b/tools/testing/selftests/bpf/bench.c\n@@ -582,6 +582,7 @@ extern const struct bench bench_lpm_trie_delete;\n extern const struct bench bench_lpm_trie_free;\n extern const struct bench bench_bpf_nop;\n extern const struct bench bench_xdp_lb;\n+extern const struct bench bench_kptr_xchg;\n \n static const struct bench *benchs[] = {\n \t\u0026bench_count_global,\n@@ -665,6 +666,7 @@ static const struct bench *benchs[] = {\n \t\u0026bench_lpm_trie_free,\n \t\u0026bench_bpf_nop,\n \t\u0026bench_xdp_lb,\n+\t\u0026bench_kptr_xchg,\n };\n \n static void find_benchmark(void)\ndiff --git a/tools/testing/selftests/bpf/benchs/bench_kptr_xchg.c b/tools/testing/selftests/bpf/benchs/bench_kptr_xchg.c\nnew file mode 100644\nindex 0000000000000..b8a0d346fda68\n--- /dev/null\n+++ b/tools/testing/selftests/bpf/benchs/bench_kptr_xchg.c\n@@ -0,0 +1,96 @@\n+// SPDX-License-Identifier: GPL-2.0\n+/* Copyright (C) 2026. Loongson Technology Corporation Limited */\n+#include \u003cargp.h\u003e\n+#include \"bench.h\"\n+#include \"kptr_xchg_bench.skel.h\"\n+\n+static struct ctx {\n+\tstruct kptr_xchg_bench *skel;\n+} ctx;\n+\n+static struct {\n+\t__u32 nr_loops;\n+} args = {\n+\t.nr_loops = 256,\n+};\n+\n+enum {\n+\tARG_NR_LOOPS = 7000,\n+};\n+\n+static const struct argp_option opts[] = {\n+\t{ \"nr_loops\", ARG_NR_LOOPS, \"nr_loops\", 0,\n+\t \"Set number of bpf_kptr_xchg() calls per trigger\"},\n+\t{},\n+};\n+\n+static error_t parse_arg(int key, char *arg, struct argp_state *state)\n+{\n+\tswitch (key) {\n+\tcase ARG_NR_LOOPS:\n+\t\targs.nr_loops = strtol(arg, NULL, 10);\n+\t\tbreak;\n+\tdefault:\n+\t\treturn ARGP_ERR_UNKNOWN;\n+\t}\n+\n+\treturn 0;\n+}\n+\n+static const struct argp bench_kptr_xchg_argp = {\n+\t.options = opts,\n+\t.parser = parse_arg,\n+};\n+\n+static void validate(void)\n+{\n+\tif (env.consumer_cnt != 0) {\n+\t\tfprintf(stderr, \"benchmark doesn't support consumer!\\n\");\n+\t\texit(1);\n+\t}\n+}\n+\n+static void *producer(void *input)\n+{\n+\twhile (true)\n+\t\tsyscall(__NR_getpgid);\n+\n+\treturn NULL;\n+}\n+\n+static void measure(struct bench_res *res)\n+{\n+\tres-\u003ehits = atomic_swap(\u0026ctx.skel-\u003ebss-\u003ehits, 0);\n+}\n+\n+static void setup(void)\n+{\n+\tstruct bpf_link *link;\n+\n+\tsetup_libbpf();\n+\n+\tctx.skel = kptr_xchg_bench__open_and_load();\n+\tif (!ctx.skel) {\n+\t\tfprintf(stderr, \"failed to open skeleton\\n\");\n+\t\texit(1);\n+\t}\n+\n+\tctx.skel-\u003edata-\u003enr_loops = args.nr_loops;\n+\n+\tlink = bpf_program__attach(ctx.skel-\u003eprogs.benchmark);\n+\tif (!link) {\n+\t\tfprintf(stderr, \"failed to attach program!\\n\");\n+\t\texit(1);\n+\t}\n+}\n+\n+const struct bench bench_kptr_xchg = {\n+\t.name = \"kptr-xchg\",\n+\t.argp = \u0026bench_kptr_xchg_argp,\n+\t.validate = validate,\n+\t.setup = setup,\n+\t.producer_thread = producer,\n+\t.measure = measure,\n+\t.report_progress = ops_report_progress,\n+\t.report_final = ops_report_final,\n+};\ndiff --git a/tools/testing/selftests/bpf/prog_tests/kptr_xchg_inline.c b/tools/testing/selftests/bpf/prog_tests/kptr_xchg_inline.c\nindex 7def158da9eb7..1215d6edd5906 100644\n--- a/tools/testing/selftests/bpf/prog_tests/kptr_xchg_inline.c\n+++ b/tools/testing/selftests/bpf/prog_tests/kptr_xchg_inline.c\n@@ -14,7 +14,8 @@ void test_kptr_xchg_inline(void)\n \tint err;\n \n #if !(defined(__x86_64__) || defined(__aarch64__) || \\\n- (defined(__riscv) \u0026\u0026 __riscv_xlen == 64))\n+\t(defined(__riscv) \u0026\u0026 __riscv_xlen == 64) || \\\n+\t(defined(__loongarch__) \u0026\u0026 __loongarch_grlen == 64))\n \ttest__skip();\n \treturn;\n #endif\ndiff --git a/tools/testing/selftests/bpf/progs/kptr_xchg_bench.c b/tools/testing/selftests/bpf/progs/kptr_xchg_bench.c\nnew file mode 100644\nindex 0000000000000..363883073e2c0\n--- /dev/null\n+++ b/tools/testing/selftests/bpf/progs/kptr_xchg_bench.c\n@@ -0,0 +1,49 @@\n+// SPDX-License-Identifier: GPL-2.0\n+/* Copyright (C) 2026. Loongson Technology Corporation Limited */\n+#include \"vmlinux.h\"\n+#include \u003cbpf/bpf_helpers.h\u003e\n+\n+#include \"bpf_experimental.h\"\n+#include \"bpf_misc.h\"\n+\n+char _license[] SEC(\"license\") = \"GPL\";\n+\n+#define MAX_XCHG_LOOPS 4096\n+\n+struct bin_data {\n+\tchar blob[32];\n+};\n+\n+#define private(name) SEC(\".bss.\" #name) __hidden __attribute__((aligned(8)))\n+\n+private(kptr) struct bin_data __kptr *ptr;\n+u32 nr_loops = 256;\n+long hits;\n+\n+SEC(\"fentry/\" SYS_PREFIX \"sys_getpgid\")\n+int benchmark(void *ctx)\n+{\n+\tstruct bin_data *old;\n+\tu32 i;\n+\n+\tfor (i = 0; i \u003c MAX_XCHG_LOOPS; i++) {\n+\t\tif (i \u003e= nr_loops)\n+\t\t\tbreak;\n+\n+\t\told = bpf_kptr_xchg(\u0026ptr, NULL);\n+\t\tif (old)\n+\t\t\tbpf_obj_drop(old);\n+\t}\n+\n+\t__sync_add_and_fetch(\u0026hits, i);\n+\treturn 0;\n+}\n+\n+/*\n+ * BTF FUNC records are not generated for kfuncs referenced only through\n+ * optimized paths. Keep bpf_obj_drop() visible to libbpf's kfunc linker.\n+ */\n+void __btf_root(void)\n+{\n+\tbpf_obj_drop(NULL);\n+}\n"
} |
| 2/1 | 2026/07/30 07:32 | agent | patch-evaluator |
0mModel:best-expensive Args: null Results: {
"EnableConfigs": [
"BPF_JIT",
"BPF_SYSCALL"
],
"FocusSymbols": [
"bpf_int_jit_compile"
],
"Reasoning": "The patch adds support for atomic instructions in the LoongArch BPF JIT compiler and enables the bpf_kptr_xchg inline test. The BPF JIT modifications are functional and can be tested by loading BPF programs containing these atomic operations.",
"WorthFuzzing": true
}Instruction: You are an expert Linux kernel maintainer. Your job is to review a provided patch series and determine if it makes functional changes to the kernel that should be fuzzed. IMPORTANT: The changes have ALREADY been applied and committed as the HEAD commit in your workspace. Do NOT rely on your internal knowledge of the kernel. You must actively use your code access tools to examine the actual source code and confirm any assumptions. Return WorthFuzzing=false if the patch only contains: - Modifications to Documentation/, Kconfig files, or code comments. - Purely decorative changes, such as logging (e.g., pr_err, printk) or tracepoints. - Changes to numeric constants or macros that do not functionally alter execution flow. - Code paths that are impossible to reach in virtualized environments like GCE or QEMU, even when utilizing software-emulated hardware (e.g., usb gadget, mac80211_hwsim). - Code in vendor-specific PCIe switch, SmartNIC, or GPU drivers (e.g., mlxsw, pds_core, qed, ionic, amdgpu) that require physical PCIe hardware cards not emulated in standard QEMU. - Driver .remove, .shutdown, or pci_unregister_driver teardown callbacks (e.g., igb_remove) that are executed only during PCI hot-unplug or sysfs driver unbind operations. If it modifies reachable core kernel logic, drivers, or architectures, use your code search tools to verify the code can be executed, then return WorthFuzzing=true. When returning WorthFuzzing=true, you MUST ALSO: 1. Extract any specific kernel functions that should be heavily fuzzed into FocusSymbols. Avoid listing generic hot-path functions to prevent skewed test distributions. Prefer non-static, non-inlined API entrypoint functions over internal static helper functions (which are inlined by the compiler and do not have distinct symbol addresses). 2. Identify any specific CONFIG_ options required to properly test this new/modified feature. Go and look into the Kconfig files and check for ifdefs around the code, do not make assumptions. Also check "depends on" lines in Kconfig to include any non-standard parent subsystem configs needed for Kbuild to compile the code statically into vmlinux. List them in the EnableConfigs output array, and DO NOT add a 'CONFIG_' prefix (e.g., return "NET_IPV4" instead of "CONFIG_NET_IPV4"). Prefer calling several tools at the same time to save round-trips. Use set-results tool to provide results of the analysis. It must be called exactly once before the final reply. Ignore results of this tool. Prompt: For your convenience, here is the diff of the changes:
commit c76578376239be5203d01fd72148619c84596b54
Author: syz-cluster <triage@syzkaller.com>
Date: Thu Jul 30 07:32:19 2026 +0000
syz-cluster: applied patch under review
diff --git a/arch/loongarch/include/asm/inst.h b/arch/loongarch/include/asm/inst.h
index 76b723590023d..bdbc17d071105 100644
--- a/arch/loongarch/include/asm/inst.h
+++ b/arch/loongarch/include/asm/inst.h
@@ -199,6 +199,10 @@ enum reg3_op {
amswaph_op = 0x70b9,
amaddb_op = 0x70ba,
amaddh_op = 0x70bb,
+ amswapdbb_op = 0x70bc,
+ amswapdbh_op = 0x70bd,
+ amadddbb_op = 0x70be,
+ amadddbh_op = 0x70bf,
amswapw_op = 0x70c0,
amswapd_op = 0x70c1,
amaddw_op = 0x70c2,
@@ -783,6 +787,20 @@ DEF_EMIT_REG3_FORMAT(amswapb, amswapb_op)
DEF_EMIT_REG3_FORMAT(amswaph, amswaph_op)
DEF_EMIT_REG3_FORMAT(amswapw, amswapw_op)
DEF_EMIT_REG3_FORMAT(amswapd, amswapd_op)
+DEF_EMIT_REG3_FORMAT(amswapdbb, amswapdbb_op)
+DEF_EMIT_REG3_FORMAT(amswapdbh, amswapdbh_op)
+DEF_EMIT_REG3_FORMAT(amadddbb, amadddbb_op)
+DEF_EMIT_REG3_FORMAT(amadddbh, amadddbh_op)
+DEF_EMIT_REG3_FORMAT(amadddbw, amadddbw_op)
+DEF_EMIT_REG3_FORMAT(amadddbd, amadddbd_op)
+DEF_EMIT_REG3_FORMAT(amanddbw, amanddbw_op)
+DEF_EMIT_REG3_FORMAT(amanddbd, amanddbd_op)
+DEF_EMIT_REG3_FORMAT(amordbw, amordbw_op)
+DEF_EMIT_REG3_FORMAT(amordbd, amordbd_op)
+DEF_EMIT_REG3_FORMAT(amxordbw, amxordbw_op)
+DEF_EMIT_REG3_FORMAT(amxordbd, amxordbd_op)
+DEF_EMIT_REG3_FORMAT(amswapdbw, amswapdbw_op)
+DEF_EMIT_REG3_FORMAT(amswapdbd, amswapdbd_op)
#define DEF_EMIT_REG3SA2_FORMAT(NAME, OP) \
static inline void emit_##NAME(union loongarch_instruction *insn, \
diff --git a/arch/loongarch/net/bpf_jit.c b/arch/loongarch/net/bpf_jit.c
index 29c281bef28ef..686d333146ce2 100644
--- a/arch/loongarch/net/bpf_jit.c
+++ b/arch/loongarch/net/bpf_jit.c
@@ -8,6 +8,9 @@
#include <asm/asm-offsets.h>
#include "bpf_jit.h"
+/* dbar hint for ll/sc completion ordering, see __WEAK_LLSC_MB */
+#define DBAR_LLSC_MB 0x700
+
#define LOONGARCH_MAX_REG_ARGS 8
#define LOONGARCH_SAVE_RA_NINSNS 1
@@ -433,7 +436,7 @@ static int emit_atomic_rmw(const struct bpf_insn *insn, struct jit_ctx *ctx)
pr_err_once("bpf-jit: amadd.b instruction is not supported\n");
return -EINVAL;
}
- emit_insn(ctx, amaddb, src, t1, t3);
+ emit_insn(ctx, amadddbb, src, t1, t3);
emit_zext_32(ctx, src, true);
break;
case BPF_H:
@@ -441,39 +444,39 @@ static int emit_atomic_rmw(const struct bpf_insn *insn, struct jit_ctx *ctx)
pr_err_once("bpf-jit: amadd.h instruction is not supported\n");
return -EINVAL;
}
- emit_insn(ctx, amaddh, src, t1, t3);
+ emit_insn(ctx, amadddbh, src, t1, t3);
emit_zext_32(ctx, src, true);
break;
case BPF_W:
- emit_insn(ctx, amaddw, src, t1, t3);
+ emit_insn(ctx, amadddbw, src, t1, t3);
emit_zext_32(ctx, src, true);
break;
case BPF_DW:
- emit_insn(ctx, amaddd, src, t1, t3);
+ emit_insn(ctx, amadddbd, src, t1, t3);
break;
}
break;
case BPF_AND | BPF_FETCH:
if (isdw) {
- emit_insn(ctx, amandd, src, t1, t3);
+ emit_insn(ctx, amanddbd, src, t1, t3);
} else {
- emit_insn(ctx, amandw, src, t1, t3);
+ emit_insn(ctx, amanddbw, src, t1, t3);
emit_zext_32(ctx, src, true);
}
break;
case BPF_OR | BPF_FETCH:
if (isdw) {
- emit_insn(ctx, amord, src, t1, t3);
+ emit_insn(ctx, amordbd, src, t1, t3);
} else {
- emit_insn(ctx, amorw, src, t1, t3);
+ emit_insn(ctx, amordbw, src, t1, t3);
emit_zext_32(ctx, src, true);
}
break;
case BPF_XOR | BPF_FETCH:
if (isdw) {
- emit_insn(ctx, amxord, src, t1, t3);
+ emit_insn(ctx, amxordbd, src, t1, t3);
} else {
- emit_insn(ctx, amxorw, src, t1, t3);
+ emit_insn(ctx, amxordbw, src, t1, t3);
emit_zext_32(ctx, src, true);
}
break;
@@ -485,7 +488,7 @@ static int emit_atomic_rmw(const struct bpf_insn *insn, struct jit_ctx *ctx)
pr_err_once("bpf-jit: amswap.b instruction is not supported\n");
return -EINVAL;
}
- emit_insn(ctx, amswapb, src, t1, t3);
+ emit_insn(ctx, amswapdbb, src, t1, t3);
emit_zext_32(ctx, src, true);
break;
case BPF_H:
@@ -493,15 +496,15 @@ static int emit_atomic_rmw(const struct bpf_insn *insn, struct jit_ctx *ctx)
pr_err_once("bpf-jit: amswap.h instruction is not supported\n");
return -EINVAL;
}
- emit_insn(ctx, amswaph, src, t1, t3);
+ emit_insn(ctx, amswapdbh, src, t1, t3);
emit_zext_32(ctx, src, true);
break;
case BPF_W:
- emit_insn(ctx, amswapw, src, t1, t3);
+ emit_insn(ctx, amswapdbw, src, t1, t3);
emit_zext_32(ctx, src, true);
break;
case BPF_DW:
- emit_insn(ctx, amswapd, src, t1, t3);
+ emit_insn(ctx, amswapdbd, src, t1, t3);
break;
}
break;
@@ -524,6 +527,7 @@ static int emit_atomic_rmw(const struct bpf_insn *insn, struct jit_ctx *ctx)
emit_insn(ctx, beq, t3, LOONGARCH_GPR_ZERO, -6);
emit_zext_32(ctx, r0, true);
}
+ emit_insn(ctx, dbar, DBAR_LLSC_MB);
break;
default:
pr_err_once("bpf-jit: invalid atomic read-modify-write opcode %02x\n", imm);
@@ -2392,6 +2396,11 @@ bool bpf_jit_supports_fsession(void)
return true;
}
+bool bpf_jit_supports_ptr_xchg(void)
+{
+ return true;
+}
+
/* Indicate the JIT backend supports mixing bpf2bpf and tailcalls. */
bool bpf_jit_supports_subprog_tailcalls(void)
{
diff --git a/tools/testing/selftests/bpf/Makefile b/tools/testing/selftests/bpf/Makefile
index b642ee489ea64..6dfc817485847 100644
--- a/tools/testing/selftests/bpf/Makefile
+++ b/tools/testing/selftests/bpf/Makefile
@@ -980,6 +980,7 @@ $(OUTPUT)/bench_lpm_trie_map.o: $(OUTPUT)/lpm_trie_bench.skel.h $(OUTPUT)/lpm_tr
$(OUTPUT)/bench_bpf_nop.o: $(OUTPUT)/bpf_nop_bench.skel.h bench_bpf_timing.h
$(OUTPUT)/bench_xdp_lb.o: $(OUTPUT)/xdp_lb_bench.skel.h bench_bpf_timing.h
$(OUTPUT)/bench_bpf_timing.o: bench_bpf_timing.h
+$(OUTPUT)/bench_kptr_xchg.o: $(OUTPUT)/kptr_xchg_bench.skel.h
$(OUTPUT)/bench.o: bench.h testing_helpers.h $(BPFOBJ)
$(OUTPUT)/bench: LDLIBS += -lm
$(OUTPUT)/bench: $(OUTPUT)/bench.o \
@@ -1005,6 +1006,7 @@ $(OUTPUT)/bench: $(OUTPUT)/bench.o \
$(OUTPUT)/bench_bpf_timing.o \
$(OUTPUT)/bench_bpf_nop.o \
$(OUTPUT)/bench_xdp_lb.o \
+ $(OUTPUT)/bench_kptr_xchg.o \
$(OUTPUT)/usdt_1.o \
$(OUTPUT)/usdt_2.o \
#
diff --git a/tools/testing/selftests/bpf/bench.c b/tools/testing/selftests/bpf/bench.c
index 3d9d2cd7764bd..550290d6701a6 100644
--- a/tools/testing/selftests/bpf/bench.c
+++ b/tools/testing/selftests/bpf/bench.c
@@ -582,6 +582,7 @@ extern const struct bench bench_lpm_trie_delete;
extern const struct bench bench_lpm_trie_free;
extern const struct bench bench_bpf_nop;
extern const struct bench bench_xdp_lb;
+extern const struct bench bench_kptr_xchg;
static const struct bench *benchs[] = {
&bench_count_global,
@@ -665,6 +666,7 @@ static const struct bench *benchs[] = {
&bench_lpm_trie_free,
&bench_bpf_nop,
&bench_xdp_lb,
+ &bench_kptr_xchg,
};
static void find_benchmark(void)
diff --git a/tools/testing/selftests/bpf/benchs/bench_kptr_xchg.c b/tools/testing/selftests/bpf/benchs/bench_kptr_xchg.c
new file mode 100644
index 0000000000000..b8a0d346fda68
--- /dev/null
+++ b/tools/testing/selftests/bpf/benchs/bench_kptr_xchg.c
@@ -0,0 +1,96 @@
+// SPDX-License-Identifier: GPL-2.0
+/* Copyright (C) 2026. Loongson Technology Corporation Limited */
+#include <argp.h>
+#include "bench.h"
+#include "kptr_xchg_bench.skel.h"
+
+static struct ctx {
+ struct kptr_xchg_bench *skel;
+} ctx;
+
+static struct {
+ __u32 nr_loops;
+} args = {
+ .nr_loops = 256,
+};
+
+enum {
+ ARG_NR_LOOPS = 7000,
+};
+
+static const struct argp_option opts[] = {
+ { "nr_loops", ARG_NR_LOOPS, "nr_loops", 0,
+ "Set number of bpf_kptr_xchg() calls per trigger"},
+ {},
+};
+
+static error_t parse_arg(int key, char *arg, struct argp_state *state)
+{
+ switch (key) {
+ case ARG_NR_LOOPS:
+ args.nr_loops = strtol(arg, NULL, 10);
+ break;
+ default:
+ return ARGP_ERR_UNKNOWN;
+ }
+
+ return 0;
+}
+
+static const struct argp bench_kptr_xchg_argp = {
+ .options = opts,
+ .parser = parse_arg,
+};
+
+static void validate(void)
+{
+ if (env.consumer_cnt != 0) {
+ fprintf(stderr, "benchmark doesn't support consumer!\n");
+ exit(1);
+ }
+}
+
+static void *producer(void *input)
+{
+ while (true)
+ syscall(__NR_getpgid);
+
+ return NULL;
+}
+
+static void measure(struct bench_res *res)
+{
+ res->hits = atomic_swap(&ctx.skel->bss->hits, 0);
+}
+
+static void setup(void)
+{
+ struct bpf_link *link;
+
+ setup_libbpf();
+
+ ctx.skel = kptr_xchg_bench__open_and_load();
+ if (!ctx.skel) {
+ fprintf(stderr, "failed to open skeleton\n");
+ exit(1);
+ }
+
+ ctx.skel->data->nr_loops = args.nr_loops;
+
+ link = bpf_program__attach(ctx.skel->progs.benchmark);
+ if (!link) {
+ fprintf(stderr, "failed to attach program!\n");
+ exit(1);
+ }
+}
+
+const struct bench bench_kptr_xchg = {
+ .name = "kptr-xchg",
+ .argp = &bench_kptr_xchg_argp,
+ .validate = validate,
+ .setup = setup,
+ .producer_thread = producer,
+ .measure = measure,
+ .report_progress = ops_report_progress,
+ .report_final = ops_report_final,
+};
diff --git a/tools/testing/selftests/bpf/prog_tests/kptr_xchg_inline.c b/tools/testing/selftests/bpf/prog_tests/kptr_xchg_inline.c
index 7def158da9eb7..1215d6edd5906 100644
--- a/tools/testing/selftests/bpf/prog_tests/kptr_xchg_inline.c
+++ b/tools/testing/selftests/bpf/prog_tests/kptr_xchg_inline.c
@@ -14,7 +14,8 @@ void test_kptr_xchg_inline(void)
int err;
#if !(defined(__x86_64__) || defined(__aarch64__) || \
- (defined(__riscv) && __riscv_xlen == 64))
+ (defined(__riscv) && __riscv_xlen == 64) || \
+ (defined(__loongarch__) && __loongarch_grlen == 64))
test__skip();
return;
#endif
diff --git a/tools/testing/selftests/bpf/progs/kptr_xchg_bench.c b/tools/testing/selftests/bpf/progs/kptr_xchg_bench.c
new file mode 100644
index 0000000000000..363883073e2c0
--- /dev/null
+++ b/tools/testing/selftests/bpf/progs/kptr_xchg_bench.c
@@ -0,0 +1,49 @@
+// SPDX-License-Identifier: GPL-2.0
+/* Copyright (C) 2026. Loongson Technology Corporation Limited */
+#include "vmlinux.h"
+#include <bpf/bpf_helpers.h>
+
+#include "bpf_experimental.h"
+#include "bpf_misc.h"
+
+char _license[] SEC("license") = "GPL";
+
+#define MAX_XCHG_LOOPS 4096
+
+struct bin_data {
+ char blob[32];
+};
+
+#define private(name) SEC(".bss." #name) __hidden __attribute__((aligned(8)))
+
+private(kptr) struct bin_data __kptr *ptr;
+u32 nr_loops = 256;
+long hits;
+
+SEC("fentry/" SYS_PREFIX "sys_getpgid")
+int benchmark(void *ctx)
+{
+ struct bin_data *old;
+ u32 i;
+
+ for (i = 0; i < MAX_XCHG_LOOPS; i++) {
+ if (i >= nr_loops)
+ break;
+
+ old = bpf_kptr_xchg(&ptr, NULL);
+ if (old)
+ bpf_obj_drop(old);
+ }
+
+ __sync_add_and_fetch(&hits, i);
+ return 0;
+}
+
+/*
+ * BTF FUNC records are not generated for kfuncs referenced only through
+ * optimized paths. Keep bpf_obj_drop() visible to libbpf's kfunc linker.
+ */
+void __btf_root(void)
+{
+ bpf_obj_drop(NULL);
+}
|
| 3/2 | 2026/07/30 07:32 | llm | patch-evaluator |
0mModel:gemini-3.1-pro-preview Args: null Results: null Tokens: input: 6971 output: 42 thoughts: 879 Thoughts: **Analyzing the LoongArch BPF JIT Patch** Okay, so I'm looking at a patch for the LoongArch BPF JIT, specifically targeting `bpf_kptr_xchg`. It seems the changes are pretty straightforward: they've updated `arch/loongarch/net/bpf_jit.c` and added new instructions like `amadddbb`, `amadddbh`, etc., in `arch/loongarch/include/asm/inst.h`. They've also included a benchmark in `tools/testing/selftests/bpf/benchs/bench_kptr_xchg.c` and `tools/testing/selftests/bpf/progs/kptr_xchg_bench.c`, and modified `tools/testing/selftests/bpf/prog_tests/kptr_xchg_inline.c` to enable the test on LoongArch. Digging into the `arch/loongarch/net/bpf_jit.c` changes, I see that the patch is replacing the original atomic instructions with double-byte versions, so `amaddb` becomes `amadddbb`, etc., and adds `dbar DBAR_LLSC_MB` at the end of `emit_atomic_rmw`. It's also adding `bpf_jit_supports_ptr_xchg()` returning `true`, which is what I'd expect. So, it's a functional change, enhancing the BPF JIT support for atomic operations on LoongArch. Given that this is architecture-specific code, testing it natively on LoongArch hardware or an emulator is a must. The question becomes whether it's worth fuzzing. The patch specifically targets BPF JIT, so fuzzing should be a good strategy. Syzkaller supports LoongArch, right? I recall there being some level of support. Assuming Syzkaller is configured for LoongArch, it should be able to exercise this code. Regarding the focus symbols for fuzzing, `emit_atomic_rmw` and `bpf_jit_supports_ptr_xchg` jump out, but `emit_atomic_rmw` is a *static* function. Given the prompt's preference for non-static entry points, I need to identify the real entry point. The more general entry point for BPF JIT compilation on LoongArch will likely be `bpf_int_jit_compile`, so I will check that. |
| 4/2 | 2026/07/30 07:32 | tool | grepper |
0mArgs:{
"Expression": "bpf_int_jit_compile",
"PathPrefix": "arch/loongarch/net/bpf_jit.c"
}Results: {
"Output": "arch/loongarch/net/bpf_jit.c=2186=int arch_bpf_trampoline_size(const struct btf_func_model *m, u32 flags,\n--\narch/loongarch/net/bpf_jit.c-2200-\narch/loongarch/net/bpf_jit.c:2201:struct bpf_prog *bpf_int_jit_compile(struct bpf_verifier_env *env, struct bpf_prog *prog)\narch/loongarch/net/bpf_jit.c-2202-{\n"
} |
| 5/2 | 2026/07/30 07:32 | llm | patch-evaluator |
0mModel:gemini-3.1-pro-preview Args: null Results: null Tokens: input: 8593 output: 32 thoughts: 61 Thoughts: **My Initial Thoughts on BPF JIT and LoongArch** Alright, so the `bpf_int_jit_compile` function, that's the one we're dealing with, the entry point for JIT compilation. Got it. And hey, looks like we have `bpf_jit_supports_ptr_xchg` as well, and it's not static, which is interesting for potential external access or perhaps for more flexible internal usage. Now, where do we stand with Kconfig options? I need to check the configuration settings for BPF JIT specifically on LoongArch. Let's see what's enabled, disabled, or conditionally compiled. Gotta understand the build environment and what features are available before I can dig deeper. This is going to set the stage for how much of this work has been done before and how much there is for me to think through. |
| 6/2 | 2026/07/30 07:32 | tool | grepper |
0mError:no matches Args: {
"Expression": "config BPF_JIT",
"PathPrefix": "arch/loongarch/"
}Results: {
"error": "no matches"
} |
| 7/2 | 2026/07/30 07:32 | llm | patch-evaluator |
0mModel:gemini-3.1-pro-preview Args: null Results: null Tokens: input: 8889 output: 32 thoughts: 36 Thoughts: Okay, here's my interpretation of those thoughts, tailored for an expert audience, presented in the first person: **Navigating the Kernel Configuration Landscape** Right, so I'm trying to figure out where this `BPF_JIT` configuration option is hiding. My initial instinct, based on past experience and common kernel organizational patterns, is to look in the standard places. Typically, these sorts of things – the enabling of JIT compilation for BPF – are defined within the main kernel configuration files. I'd expect to find it either within the core `init/Kconfig` file, reflecting its fundamental nature, or perhaps within `net/Kconfig`, given BPF's strong association with networking. There's always a chance it's specific to an architecture, so I should also check `arch/loongarch/Kconfig` to see if there's an architecture-specific definition or dependency in there. It’s an exploratory process. Knowing the general layout of the kernel config options will usually tell me exactly where to look! |
| 8/2 | 2026/07/30 07:32 | tool | grepper |
0mError:no matches Args: {
"Expression": "select BPF_JIT",
"PathPrefix": "arch/loongarch/"
}Results: {
"error": "no matches"
} |
| 9/2 | 2026/07/30 07:32 | llm | patch-evaluator |
0mModel:gemini-3.1-pro-preview Args: null Results: null Tokens: input: 9190 output: 34 thoughts: 14 Thoughts: Here's my thought process, as if I were considering this myself: **Examining the LoongArch Kernel Configuration** Okay, so I need to get a handle on the LoongArch kernel configuration. The logical place to start is always the Kconfig file for the architecture. I'm going to navigate over to `arch/loongarch/Kconfig` and take a deep dive. I'll need to understand the fundamental options, the dependencies, and how all the various features are enabled and disabled for this architecture. I'll be looking for any architecture-specific settings, board-specific options if they're relevant, and how things tie into the broader kernel configuration. It's time to build a solid mental model of the LoongArch configuration space. This is where the real work begins. |
| 10/2 | 2026/07/30 07:32 | tool | grepper |
0mError:no matches Args: {
"Expression": "HAVE_BPF_JIT",
"PathPrefix": "arch/loongarch/"
}Results: {
"error": "no matches"
} |
| 11/2 | 2026/07/30 07:32 | llm | patch-evaluator |
0mModel:gemini-3.1-pro-preview Args: null Results: null Tokens: input: 9421 output: 30 thoughts: 18 Thoughts: Here's my thought process, as if I were considering this myself: **Investigating BPF Support in the LoongArch Kernel Configuration** Okay, so I need to figure out if BPF is enabled or configurable for the LoongArch architecture. My initial instinct is to go directly to the source, the core configuration file. That would be `arch/loongarch/Kconfig`. This is where all the architecture-specific configuration options, including those related to features like BPF (Berkeley Packet Filter), should be defined or at least referenced. I will now open that file and look for anything related to BPF functionality. I'm expecting to find either a direct configuration option (`CONFIG_BPF=y/n/m`) or maybe a dependency check that is specific to LoongArch. My job now is to determine if BPF support exists, and if so, how it is managed within the LoongArch kernel. |
| 12/2 | 2026/07/30 07:32 | tool | grepper |
0mArgs:{
"Expression": "BPF",
"PathPrefix": "arch/loongarch/Kconfig"
}Results: {
"Output": "arch/loongarch/Kconfig=2=config LOONGARCH\n--\narch/loongarch/Kconfig-79-\tselect ARCH_USE_QUEUED_SPINLOCKS\narch/loongarch/Kconfig:80:\tselect ARCH_WANT_DEFAULT_BPF_JIT if HAVE_EBPF_JIT\narch/loongarch/Kconfig-81-\tselect ARCH_WANT_DEFAULT_TOPDOWN_MMAP_LAYOUT\n--\narch/loongarch/Kconfig-143-\tselect HAVE_DYNAMIC_FTRACE_WITH_REGS\narch/loongarch/Kconfig:144:\tselect HAVE_EBPF_JIT if 64BIT\narch/loongarch/Kconfig-145-\tselect HAVE_EFFICIENT_UNALIGNED_ACCESS if !ARCH_STRICT_ALIGN\n"
} |
| 13/2 | 2026/07/30 07:32 | llm | patch-evaluator |
0mModel:gemini-3.1-pro-preview Args: null Results: null Tokens: input: 9877 output: 71 thoughts: 126 Thoughts: **My BPF JIT Analysis** Okay, so I'm seeing that the `BPF_JIT` option is automatically enabled when `HAVE_EBPF_JIT` is chosen, which makes sense. I need to keep in mind that I also need `BPF_SYSCALL` enabled as well. That's a key dependency. Now, let's see if there are any other entry points or functions I need to be aware of. I see `bpf_jit_supports_ptr_xchg` is in play. And, of course, the ever-present `bpf_int_jit_compile`. I'll need to keep those in mind. Time to dive a bit deeper. I should check `arch/loongarch/net/bpf_jit.c` to see if I'm missing any non-static functions of note. Need to make sure I don't overlook anything crucial. |
| 14/2 | 2026/07/30 07:32 | tool | grepper |
0mArgs:{
"Expression": "^[a-zA-Z_][a-zA-Z0-9_]* [a-zA-Z_][a-zA-Z0-9_]*\\(",
"PathPrefix": "arch/loongarch/net/bpf_jit.c"
}Results: {
"Output": "arch/loongarch/net/bpf_jit.c=279=static void build_epilogue(struct jit_ctx *ctx)\n--\narch/loongarch/net/bpf_jit.c-283-\narch/loongarch/net/bpf_jit.c:284:bool bpf_jit_supports_kfunc_call(void)\narch/loongarch/net/bpf_jit.c-285-{\n--\narch/loongarch/net/bpf_jit.c-288-\narch/loongarch/net/bpf_jit.c:289:bool bpf_jit_supports_far_kfunc_call(void)\narch/loongarch/net/bpf_jit.c-290-{\n--\narch/loongarch/net/bpf_jit.c=633=static bool is_signed_bpf_cond(u8 cond)\n--\narch/loongarch/net/bpf_jit.c-642-\narch/loongarch/net/bpf_jit.c:643:bool ex_handler_bpf(const struct exception_table_entry *ex,\narch/loongarch/net/bpf_jit.c-644-\t\t struct pt_regs *regs)\n--\narch/loongarch/net/bpf_jit.c=1578=void *bpf_arch_text_copy(void *dst, void *src, size_t len)\n--\narch/loongarch/net/bpf_jit.c-1590-\narch/loongarch/net/bpf_jit.c:1591:int bpf_arch_text_poke(void *ip, enum bpf_text_poke_type old_t,\narch/loongarch/net/bpf_jit.c-1592-\t\t enum bpf_text_poke_type new_t, void *old_addr,\n--\narch/loongarch/net/bpf_jit.c-1643-\narch/loongarch/net/bpf_jit.c:1644:int bpf_arch_text_invalidate(void *dst, size_t len)\narch/loongarch/net/bpf_jit.c-1645-{\n--\narch/loongarch/net/bpf_jit.c=1795=void *arch_alloc_bpf_trampoline(unsigned int size)\n--\narch/loongarch/net/bpf_jit.c-1799-\narch/loongarch/net/bpf_jit.c:1800:void arch_free_bpf_trampoline(void *image, unsigned int size)\narch/loongarch/net/bpf_jit.c-1801-{\n--\narch/loongarch/net/bpf_jit.c-1804-\narch/loongarch/net/bpf_jit.c:1805:int arch_protect_bpf_trampoline(void *image, unsigned int size)\narch/loongarch/net/bpf_jit.c-1806-{\n--\narch/loongarch/net/bpf_jit.c=1841=static int __arch_prepare_bpf_trampoline(struct jit_ctx *ctx, struct bpf_tramp_image *im,\n--\narch/loongarch/net/bpf_jit.c-2147-\narch/loongarch/net/bpf_jit.c:2148:int arch_prepare_bpf_trampoline(struct bpf_tramp_image *im, void *ro_image,\narch/loongarch/net/bpf_jit.c-2149-\t\t\t\tvoid *ro_image_end, const struct btf_func_model *m,\n--\narch/loongarch/net/bpf_jit.c-2185-\narch/loongarch/net/bpf_jit.c:2186:int arch_bpf_trampoline_size(const struct btf_func_model *m, u32 flags,\narch/loongarch/net/bpf_jit.c-2187-\t\t\t struct bpf_tramp_nodes *tnodes, void *func_addr)\n--\narch/loongarch/net/bpf_jit.c=2201=struct bpf_prog *bpf_int_jit_compile(struct bpf_verifier_env *env, struct bpf_prog *prog)\n--\narch/loongarch/net/bpf_jit.c-2354-\narch/loongarch/net/bpf_jit.c:2355:void bpf_jit_free(struct bpf_prog *prog)\narch/loongarch/net/bpf_jit.c-2356-{\n--\narch/loongarch/net/bpf_jit.c-2378-\narch/loongarch/net/bpf_jit.c:2379:bool bpf_jit_bypass_spec_v1(void)\narch/loongarch/net/bpf_jit.c-2380-{\n--\narch/loongarch/net/bpf_jit.c-2383-\narch/loongarch/net/bpf_jit.c:2384:bool bpf_jit_bypass_spec_v4(void)\narch/loongarch/net/bpf_jit.c-2385-{\n--\narch/loongarch/net/bpf_jit.c-2388-\narch/loongarch/net/bpf_jit.c:2389:bool bpf_jit_supports_arena(void)\narch/loongarch/net/bpf_jit.c-2390-{\n--\narch/loongarch/net/bpf_jit.c-2393-\narch/loongarch/net/bpf_jit.c:2394:bool bpf_jit_supports_fsession(void)\narch/loongarch/net/bpf_jit.c-2395-{\n--\narch/loongarch/net/bpf_jit.c-2398-\narch/loongarch/net/bpf_jit.c:2399:bool bpf_jit_supports_ptr_xchg(void)\narch/loongarch/net/bpf_jit.c-2400-{\n--\narch/loongarch/net/bpf_jit.c-2404-/* Indicate the JIT backend supports mixing bpf2bpf and tailcalls. */\narch/loongarch/net/bpf_jit.c:2405:bool bpf_jit_supports_subprog_tailcalls(void)\narch/loongarch/net/bpf_jit.c-2406-{\n--\narch/loongarch/net/bpf_jit.c-2409-\narch/loongarch/net/bpf_jit.c:2410:bool bpf_jit_inlines_helper_call(s32 imm)\narch/loongarch/net/bpf_jit.c-2411-{\n"
} |
| 15/2 | 2026/07/30 07:32 | llm | patch-evaluator |
0mModel:gemini-3.1-pro-preview Args: null Results: null Tokens: input: 12051 output: 42 thoughts: 444 Thoughts: **Analyzing the LoongArch BPF JIT Patch** Okay, let's break this down. My primary focus here is understanding the scope of this LoongArch BPF JIT patch. From what I see, the key functions that have been modified or added are `bpf_jit_supports_ptr_xchg` and `bpf_int_jit_compile`. Hold on, `bpf_jit_supports_ptr_xchg` is just a simple boolean return – not much to dig into there. `bpf_int_jit_compile` looks like the main entry point, the real heart of these changes. That's where I need to concentrate. Now, let me make sure I'm not missing anything. I see that `emit_atomic_rmw` is also touched, and that's called by `build_insn`, which is called by `build_body`, which is in turn called by `bpf_int_jit_compile`. Confirmed, `bpf_int_jit_compile` is definitely the right symbol to hone in on. Next up, the configuration. Looks like `BPF_JIT` and `BPF_SYSCALL` are mandatory for this to work. That's standard, and easy enough to verify. Now, a quick practical consideration. I need to confirm if I can actually test this. Can I reach the LoongArch BPF JIT in QEMU? Yes, looks like QEMU supports LoongArch64 emulation, and syzkaller can run it. That's a good sign. The changes seem functional and directly within the core kernel (BPF JIT). Therefore, WorthFuzzing=true. So, to summarize, this patch implements atomic instruction support in the LoongArch BPF JIT compiler, including a benchmark for `bpf_kptr_xchg`. The modifications are functional, and I can test it by loading BPF programs that use these atomic operations on a LoongArch system. **Configs:** * `BPF_JIT` * `BPF_SYSCALL` **FocusSymbol:** * `bpf_int_jit_compile` And I will do a quick check on that function in `arch/loongarch/net/bpf_jit.c` to see the details of the changes. |
| 16/2 | 2026/07/30 07:33 | tool | grepper |
0mArgs:{
"Expression": "bpf_int_jit_compile",
"PathPrefix": "arch/loongarch/net/bpf_jit.c"
}Results: {
"Output": "arch/loongarch/net/bpf_jit.c=2186=int arch_bpf_trampoline_size(const struct btf_func_model *m, u32 flags,\n--\narch/loongarch/net/bpf_jit.c-2200-\narch/loongarch/net/bpf_jit.c:2201:struct bpf_prog *bpf_int_jit_compile(struct bpf_verifier_env *env, struct bpf_prog *prog)\narch/loongarch/net/bpf_jit.c-2202-{\n"
} |
| 17/2 | 2026/07/30 07:33 | llm | patch-evaluator |
0mModel:gemini-3.1-pro-preview Args: null Results: null Tokens: input: 13215 output: 34 thoughts: 237 Thoughts: **Analyzing the Reachability of `bpf_int_jit_compile` in Emulated LoongArch Environments** Okay, so the initial thought was correct: `bpf_int_jit_compile` is indeed the function to consider. However, the prompt specifically calls out code paths that are *unreachable* in virtualized environments like GCE or QEMU, particularly when using software-emulated hardware. But wait, LoongArch *is* emulatable in QEMU, and Syzkaller even supports a LoongArch target. That changes things. This path *is* reachable. Now, let's step back and think about the enabling configurations. We definitely need `BPF_SYSCALL` for BPF to function, and `BPF_JIT` for the JIT compiler itself. Are there any LoongArch-specific configuration options that need consideration? The architecture itself is `LOONGARCH`, but that's the architecture identifier. We're concerned with features, so the architecture config itself is not what we're after. Finally, a quick sanity check: Can we actually *focus* on `bpf_kptr_xchg` within this context? That's a BPF helper/kfunc, right? So, is it actually defined and available within the kernel? That's the key question now. |
| 18/2 | 2026/07/30 07:33 | tool | grepper |
0mArgs:{
"Expression": "bpf_kptr_xchg",
"PathPrefix": "kernel/bpf/"
}Results: {
"Output": "kernel/bpf/fixups.c=1481=int bpf_do_misc_fixups(struct bpf_verifier_env *env)\n--\nkernel/bpf/fixups.c-2312-\nkernel/bpf/fixups.c:2313:\t\t/* Implement bpf_kptr_xchg inline */\nkernel/bpf/fixups.c-2314-\t\tif (prog-\u003ejit_requested \u0026\u0026 BITS_PER_LONG == 64 \u0026\u0026\n--\nkernel/bpf/helpers.c=1726=void bpf_wq_cancel_and_free(void *val)\n--\nkernel/bpf/helpers.c-1730-\nkernel/bpf/helpers.c:1731:BPF_CALL_2(bpf_kptr_xchg, void *, dst, void *, ptr)\nkernel/bpf/helpers.c-1732-{\n--\nkernel/bpf/helpers.c-1738-\nkernel/bpf/helpers.c:1739:/* Unlike other PTR_TO_BTF_ID helpers the btf_id in bpf_kptr_xchg()\nkernel/bpf/helpers.c-1740- * helper is determined dynamically by the verifier. Use BPF_PTR_POISON to\n--\nkernel/bpf/helpers.c-1742- */\nkernel/bpf/helpers.c:1743:static const struct bpf_func_proto bpf_kptr_xchg_proto = {\nkernel/bpf/helpers.c:1744:\t.func = bpf_kptr_xchg,\nkernel/bpf/helpers.c-1745-\t.gpl_only = false,\n--\nkernel/bpf/helpers.c=2067=bpf_base_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog)\n--\nkernel/bpf/helpers.c-2146-\tcase BPF_FUNC_kptr_xchg:\nkernel/bpf/helpers.c:2147:\t\treturn \u0026bpf_kptr_xchg_proto;\nkernel/bpf/helpers.c-2148-\tcase BPF_FUNC_for_each_map_elem:\n--\nkernel/bpf/verifier.c=7167=static int process_kptr_func(struct bpf_verifier_env *env, int regno,\n--\nkernel/bpf/verifier.c-7180-\t\tif (!map_ptr-\u003ebtf) {\nkernel/bpf/verifier.c:7181:\t\t\tverbose(env, \"map '%s' has to have BTF in order to use bpf_kptr_xchg\\n\",\nkernel/bpf/verifier.c-7182-\t\t\t\tmap_ptr-\u003ename);\n--\nkernel/bpf/verifier.c=7833=static int check_reg_type(struct bpf_verifier_env *env, struct bpf_reg_state *reg, argno_t argno,\n--\nkernel/bpf/verifier.c-7866-\nkernel/bpf/verifier.c:7867:\t/* Local kptr types are allowed as the source argument of bpf_kptr_xchg */\nkernel/bpf/verifier.c-7868-\tif (meta-\u003efunc_id == BPF_FUNC_kptr_xchg \u0026\u0026 type_is_alloc(type) \u0026\u0026 reg_from_argno(argno) == BPF_REG_2) {\n"
} |
| 19/2 | 2026/07/30 07:33 | llm | patch-evaluator |
0mModel:gemini-3.1-pro-preview Args: null Results: null Tokens: input: 14660 output: 111 thoughts: 187 Thoughts: **My Assessment of the LoongArch BPF JIT Patch** Okay, let's break down this patch for the LoongArch architecture and its implications. It's clear from the description that the core of this work revolves around adding support for `bpf_kptr_xchg` within the Just-In-Time (JIT) compiler. This is significant because it's directly related to atomic operations within the BPF context, which could open the door for more complex and efficient BPF programs. Given that focus, `bpf_int_jit_compile` is the key symbol I need to concentrate on within the JIT infrastructure. The existence of a benchmark in `tools/testing/selftests/bpf/benchs/bench_kptr_xchg.c` is important; it suggests we have a user-space testbed to evaluate the effectiveness and performance of this atomic implementation. Therefore, I'm going to set some specific parameters for this fuzzing effort. "WorthFuzzing: true" is a no-brainer. The implementation of atomic operations is a critical area, so it’s likely that any bugs or issues will show up quickly. "FocusSymbols: [\"bpf_int_jit_compile\"]" is my way of narrowing the fuzzing scope to the relevant portion of the code and the changes introduced by this patch. And finally, to configure the test and make sure that we get accurate results, I'll enable the following configurations: "EnableConfigs: [\"BPF_JIT\", \"BPF_SYSCALL\"]". This is the reasoning I'll base my fuzzing: "The patch adds support for atomic instructions in the LoongArch BPF JIT compiler and enables the bpf_kptr_xchg inline test. The BPF JIT modifications are functional and can be tested by loading BPF programs containing these atomic operations." This essentially boils down to: "Atomic ops in the LoongArch BPF JIT are now a thing; let's poke at them!" I'm now ready to start running this through the paces and see what pops up. |
| 20/2 | 2026/07/30 07:33 | tool | set-results |
0mArgs:{
"EnableConfigs": [
"BPF_JIT",
"BPF_SYSCALL"
],
"FocusSymbols": [
"bpf_int_jit_compile"
],
"Reasoning": "The patch adds support for atomic instructions in the LoongArch BPF JIT compiler and enables the bpf_kptr_xchg inline test. The BPF JIT modifications are functional and can be tested by loading BPF programs containing these atomic operations.",
"WorthFuzzing": true
}Results: {
"EnableConfigs": [
"BPF_JIT",
"BPF_SYSCALL"
],
"FocusSymbols": [
"bpf_int_jit_compile"
],
"Reasoning": "The patch adds support for atomic instructions in the LoongArch BPF JIT compiler and enables the bpf_kptr_xchg inline test. The BPF JIT modifications are functional and can be tested by loading BPF programs containing these atomic operations.",
"WorthFuzzing": true
} |
| Total Calls | Total Tokens | Avg Tokens | Total Duration (Seconds) | Avg Duration (Seconds) |
|---|
| Total Calls | Total Duration (Seconds) | Avg Duration (Seconds) |
|---|