[PATCH v1 0/2] LoongArch: BPF: Fix arena and trampoline

[PATCH v1 0/2] LoongArch: BPF: Fix arena and trampoline

[Tiezhu Yang]

This version is based on 7.4-rc1, tested on Loongson-3A5000 and
Loongson-3A6000 physical machines.

Tiezhu Yang (2):
  LoongArch: BPF: Make arena support depend on SCQ extension
  LoongArch: BPF: Use beqz and bnez instructions for trampoline

 arch/loongarch/include/asm/inst.h | 21 +++++++++++++++++++++
 arch/loongarch/kernel/inst.c      | 28 ++++++++++++++++++++++++++++
 arch/loongarch/net/bpf_jit.c      | 15 ++++++++++++---
 3 files changed, 61 insertions(+), 3 deletions(-)

-- 
2.42.0

[PATCH v1 1/2] LoongArch: BPF: Make arena support depend on SCQ extension

[Tiezhu Yang]

When testing bpf selftest "jit_insns/cast_to_user", there are different
behaviors on different Loongson machines.

(1) Loongson-3A6000
  $ sudo ./test_progs -a jit_insns/cast_to_user
  #193/2   jit_insns/cast_to_user:OK
  #193     jit_insns:OK
  Summary: 1/1 PASSED, 0 SKIPPED, 0/0 FAILED

(2) Loongson-3A5000
  $ sudo ./test_progs -a jit_insns/cast_to_user
  ...
  libbpf: map 'arena': failed to create: -ENOMEM
  run_subtest:FAIL:unexpected_load_failure unexpected error: -12 (errno 12)
  ...
  #193/2   jit_insns/cast_to_user:FAIL
  #193     jit_insns:FAIL
  Summary: 0/0 PASSED, 0 SKIPPED, 1/1 FAILED

This is because the arena range tree uses kmalloc_nolock(), which requires
128-bit atomic cmpxchg support, provided by SCQ extension on LoongArch. On
CPUs without the SCQ extension, arena map creation fails with a misleading
-ENOMEM error.

Make bpf_jit_supports_arena() return system_has_cmpxchg128() where it is
defined, so arena map creation fails with -EOPNOTSUPP on CPUs without SCQ
extension.

Furthermore, given that the macro system_has_cmpxchg128() is only defined
when CONFIG_AS_HAS_SCQ_EXTENSION is enabled, guard it with an #ifdef to
preserve compile-time robustness and reject arena otherwise.

With this patch, here is the test result on Loongson-3A5000 without SCQ
extension:

  $ sudo ./test_progs -a jit_insns/cast_to_user
  ...
  libbpf: map 'arena': failed to create: -EOPNOTSUPP
  run_subtest:FAIL:unexpected_load_failure unexpected error: -95 (errno 95)
  ...
  #193/2   jit_insns/cast_to_user:FAIL
  #193     jit_insns:FAIL
  Summary: 0/0 PASSED, 0 SKIPPED, 1/1 FAILED

It is better to mark the test status as SKIPPED rather than logging a
false-alarm failure if the feature is not supported, but this belongs
to a separate bpf selftest patch.

This is similar to commit 536b523b4073 ("bpf, riscv: Make arena support
depend on ZACAS").

Fixes: 4fdb5dd8aeba ("LoongArch: BPF: Implement bpf_addr_space_cast instruction")
Cc: stable@vger.kernel.org
Signed-off-by: Tiezhu Yang <yangtiezhu@loongson.cn>
---
 arch/loongarch/net/bpf_jit.c | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/arch/loongarch/net/bpf_jit.c b/arch/loongarch/net/bpf_jit.c
index 3ab039d0afb6..01c12da168ee 100644
--- a/arch/loongarch/net/bpf_jit.c
+++ b/arch/loongarch/net/bpf_jit.c
@@ -2489,7 +2489,15 @@ bool bpf_jit_bypass_spec_v4(void)
 
 bool bpf_jit_supports_arena(void)
 {
-	return true;
+	/*
+	 * The arena range tree uses kmalloc_nolock(), which requires 128-bit
+	 * atomic cmpxchg support, provided by SCQ extension on LoongArch.
+	 */
+#ifdef system_has_cmpxchg128
+	return system_has_cmpxchg128();
+#else
+	return false;
+#endif
 }
 
 bool bpf_jit_supports_fsession(void)
-- 
2.42.0

Re: [PATCH v1 1/2] LoongArch: BPF: Make arena support depend on SCQ extension

[Huacai Chen]

Hi, Tiezhu,

On Mon, Nov 2, 2026 at 3:28 PM Tiezhu Yang <yangtiezhu@loongson.cn> wrote:
>
> When testing bpf selftest "jit_insns/cast_to_user", there are different
> behaviors on different Loongson machines.
>
> (1) Loongson-3A6000
>   $ sudo ./test_progs -a jit_insns/cast_to_user
>   #193/2   jit_insns/cast_to_user:OK
>   #193     jit_insns:OK
>   Summary: 1/1 PASSED, 0 SKIPPED, 0/0 FAILED
>
> (2) Loongson-3A5000
>   $ sudo ./test_progs -a jit_insns/cast_to_user
>   ...
>   libbpf: map 'arena': failed to create: -ENOMEM
>   run_subtest:FAIL:unexpected_load_failure unexpected error: -12 (errno 12)
>   ...
>   #193/2   jit_insns/cast_to_user:FAIL
>   #193     jit_insns:FAIL
>   Summary: 0/0 PASSED, 0 SKIPPED, 1/1 FAILED
>
> This is because the arena range tree uses kmalloc_nolock(), which requires
> 128-bit atomic cmpxchg support, provided by SCQ extension on LoongArch. On
> CPUs without the SCQ extension, arena map creation fails with a misleading
> -ENOMEM error.
>
> Make bpf_jit_supports_arena() return system_has_cmpxchg128() where it is
> defined, so arena map creation fails with -EOPNOTSUPP on CPUs without SCQ
> extension.
>
> Furthermore, given that the macro system_has_cmpxchg128() is only defined
> when CONFIG_AS_HAS_SCQ_EXTENSION is enabled, guard it with an #ifdef to
> preserve compile-time robustness and reject arena otherwise.
>
> With this patch, here is the test result on Loongson-3A5000 without SCQ
> extension:
>
>   $ sudo ./test_progs -a jit_insns/cast_to_user
>   ...
>   libbpf: map 'arena': failed to create: -EOPNOTSUPP
>   run_subtest:FAIL:unexpected_load_failure unexpected error: -95 (errno 95)
>   ...
>   #193/2   jit_insns/cast_to_user:FAIL
>   #193     jit_insns:FAIL
>   Summary: 0/0 PASSED, 0 SKIPPED, 1/1 FAILED
>
> It is better to mark the test status as SKIPPED rather than logging a
> false-alarm failure if the feature is not supported, but this belongs
> to a separate bpf selftest patch.
>
> This is similar to commit 536b523b4073 ("bpf, riscv: Make arena support
> depend on ZACAS").
>
> Fixes: 4fdb5dd8aeba ("LoongArch: BPF: Implement bpf_addr_space_cast instruction")
> Cc: stable@vger.kernel.org
> Signed-off-by: Tiezhu Yang <yangtiezhu@loongson.cn>
> ---
>  arch/loongarch/net/bpf_jit.c | 10 +++++++++-
>  1 file changed, 9 insertions(+), 1 deletion(-)
>
> diff --git a/arch/loongarch/net/bpf_jit.c b/arch/loongarch/net/bpf_jit.c
> index 3ab039d0afb6..01c12da168ee 100644
> --- a/arch/loongarch/net/bpf_jit.c
> +++ b/arch/loongarch/net/bpf_jit.c
> @@ -2489,7 +2489,15 @@ bool bpf_jit_bypass_spec_v4(void)
>
>  bool bpf_jit_supports_arena(void)
>  {
> -       return true;
> +       /*
> +        * The arena range tree uses kmalloc_nolock(), which requires 128-bit
> +        * atomic cmpxchg support, provided by SCQ extension on LoongArch.
> +        */
> +#ifdef system_has_cmpxchg128
> +       return system_has_cmpxchg128();
> +#else
> +       return false;
> +#endif
You can "return cpu_has_scq" directly.

Huacai

>  }
>
>  bool bpf_jit_supports_fsession(void)
> --
> 2.42.0
>

Re: [PATCH v1 1/2] LoongArch: BPF: Make arena support depend on SCQ extension

[Tiezhu Yang]

On 2026/11/2 下午10:20, Huacai Chen wrote:
> Hi, Tiezhu,
> 
> On Mon, Nov 2, 2026 at 3:28 PM Tiezhu Yang <yangtiezhu@loongson.cn> wrote:
>>
>> When testing bpf selftest "jit_insns/cast_to_user", there are different
>> behaviors on different Loongson machines.

...

>> diff --git a/arch/loongarch/net/bpf_jit.c b/arch/loongarch/net/bpf_jit.c
>> index 3ab039d0afb6..01c12da168ee 100644
>> --- a/arch/loongarch/net/bpf_jit.c
>> +++ b/arch/loongarch/net/bpf_jit.c
>> @@ -2489,7 +2489,15 @@ bool bpf_jit_bypass_spec_v4(void)
>>
>>   bool bpf_jit_supports_arena(void)
>>   {
>> -       return true;
>> +       /*
>> +        * The arena range tree uses kmalloc_nolock(), which requires 128-bit
>> +        * atomic cmpxchg support, provided by SCQ extension on LoongArch.
>> +        */
>> +#ifdef system_has_cmpxchg128
>> +       return system_has_cmpxchg128();
>> +#else
>> +       return false;
>> +#endif
> You can "return cpu_has_scq" directly.

This was my initial thought too; it is simpler, but unfortunately
not enough here.

The 128-bit atomic cmpxchg arch_cmpxchg128() not only depends on
the hardware SCQ extension, but also requires assembler support,
which was addressed in commit c8b8f3c50f48 ("LoongArch: Only use
SC.Q when supported by the assembler").

Therefore, using #ifdef system_has_cmpxchg128 as in the current
patch is necessary to handle toolchain compatibility properly.

Here is a simple diff to verify this scenario. On a 3A6000 machine
with hardware SCQ extension, if we hack bpf_jit_supports_arena() to
return cpu_has_scq directly, but force AS_HAS_SCQ_EXTENSION to 'n'
to simulate an environment without assembler support, the original
test error "libbpf: map 'arena': failed to create: -ENOMEM" still
shows up because the underlying slab allocator lacks the flag
__CMPXCHG_DOUBLE.

```
diff --git a/arch/loongarch/Kconfig b/arch/loongarch/Kconfig
index b5ed4881d3c0..6f572d24d2c3 100644
--- a/arch/loongarch/Kconfig
+++ b/arch/loongarch/Kconfig
@@ -336,7 +336,7 @@ config AS_HAS_LVZ_EXTENSION
         def_bool $(as-instr,hvcl 0)

  config AS_HAS_SCQ_EXTENSION
-       def_bool $(as-instr,sc.q \$t0$(comma)\$t1$(comma)\$t2)
+       def_bool n

  config CC_HAS_ANNOTATE_TABLEJUMP
         def_bool $(cc-option,-mannotate-tablejump)
diff --git a/arch/loongarch/net/bpf_jit.c b/arch/loongarch/net/bpf_jit.c
index 8cc78efe722d..1e8049937851 100644
--- a/arch/loongarch/net/bpf_jit.c
+++ b/arch/loongarch/net/bpf_jit.c
@@ -2490,15 +2490,7 @@ bool bpf_jit_bypass_spec_v4(void)

  bool bpf_jit_supports_arena(void)
  {
-       /*
-        * The arena range tree uses kmalloc_nolock(), which requires 
128-bit
-        * atomic cmpxchg support, provided by SCQ extension on LoongArch.
-        */
-#ifdef system_has_cmpxchg128
-       return system_has_cmpxchg128();
-#else
-       return false;
-#endif
+       return cpu_has_scq;
  }

  bool bpf_jit_supports_fsession(void)
```

So, the current patch has no problem IMO.

Thanks,
Tiezhu

Re: [PATCH v1 1/2] LoongArch: BPF: Make arena support depend on SCQ extension

[Huacai Chen]

On Tue, Nov 3, 2026 at 10:24 AM Tiezhu Yang <yangtiezhu@loongson.cn> wrote:
>
> On 2026/11/2 下午10:20, Huacai Chen wrote:
> > Hi, Tiezhu,
> >
> > On Mon, Nov 2, 2026 at 3:28 PM Tiezhu Yang <yangtiezhu@loongson.cn> wrote:
> >>
> >> When testing bpf selftest "jit_insns/cast_to_user", there are different
> >> behaviors on different Loongson machines.
>
> ...
>
> >> diff --git a/arch/loongarch/net/bpf_jit.c b/arch/loongarch/net/bpf_jit.c
> >> index 3ab039d0afb6..01c12da168ee 100644
> >> --- a/arch/loongarch/net/bpf_jit.c
> >> +++ b/arch/loongarch/net/bpf_jit.c
> >> @@ -2489,7 +2489,15 @@ bool bpf_jit_bypass_spec_v4(void)
> >>
> >>   bool bpf_jit_supports_arena(void)
> >>   {
> >> -       return true;
> >> +       /*
> >> +        * The arena range tree uses kmalloc_nolock(), which requires 128-bit
> >> +        * atomic cmpxchg support, provided by SCQ extension on LoongArch.
> >> +        */
> >> +#ifdef system_has_cmpxchg128
> >> +       return system_has_cmpxchg128();
> >> +#else
> >> +       return false;
> >> +#endif
> > You can "return cpu_has_scq" directly.
>
> This was my initial thought too; it is simpler, but unfortunately
> not enough here.
>
> The 128-bit atomic cmpxchg arch_cmpxchg128() not only depends on
> the hardware SCQ extension, but also requires assembler support,
> which was addressed in commit c8b8f3c50f48 ("LoongArch: Only use
> SC.Q when supported by the assembler").
>
> Therefore, using #ifdef system_has_cmpxchg128 as in the current
> patch is necessary to handle toolchain compatibility properly.
>
> Here is a simple diff to verify this scenario. On a 3A6000 machine
> with hardware SCQ extension, if we hack bpf_jit_supports_arena() to
> return cpu_has_scq directly, but force AS_HAS_SCQ_EXTENSION to 'n'
> to simulate an environment without assembler support, the original
> test error "libbpf: map 'arena': failed to create: -ENOMEM" still
> shows up because the underlying slab allocator lacks the flag
> __CMPXCHG_DOUBLE.
>
> ```
> diff --git a/arch/loongarch/Kconfig b/arch/loongarch/Kconfig
> index b5ed4881d3c0..6f572d24d2c3 100644
> --- a/arch/loongarch/Kconfig
> +++ b/arch/loongarch/Kconfig
> @@ -336,7 +336,7 @@ config AS_HAS_LVZ_EXTENSION
>          def_bool $(as-instr,hvcl 0)
>
>   config AS_HAS_SCQ_EXTENSION
> -       def_bool $(as-instr,sc.q \$t0$(comma)\$t1$(comma)\$t2)
> +       def_bool n
>
>   config CC_HAS_ANNOTATE_TABLEJUMP
>          def_bool $(cc-option,-mannotate-tablejump)
> diff --git a/arch/loongarch/net/bpf_jit.c b/arch/loongarch/net/bpf_jit.c
> index 8cc78efe722d..1e8049937851 100644
> --- a/arch/loongarch/net/bpf_jit.c
> +++ b/arch/loongarch/net/bpf_jit.c
> @@ -2490,15 +2490,7 @@ bool bpf_jit_bypass_spec_v4(void)
>
>   bool bpf_jit_supports_arena(void)
>   {
> -       /*
> -        * The arena range tree uses kmalloc_nolock(), which requires
> 128-bit
> -        * atomic cmpxchg support, provided by SCQ extension on LoongArch.
> -        */
> -#ifdef system_has_cmpxchg128
> -       return system_has_cmpxchg128();
> -#else
> -       return false;
> -#endif
> +       return cpu_has_scq;
>   }
>
>   bool bpf_jit_supports_fsession(void)
> ```
>
> So, the current patch has no problem IMO.
OK, then I think we can use:

return __is_defined(system_has_cmpxchg128) && system_has_cmpxchg128();

Huacai

>
> Thanks,
> Tiezhu
>
>

Re: [PATCH v1 1/2] LoongArch: BPF: Make arena support depend on SCQ extension

[Tiezhu Yang]

On 11/4/26 12:29 PM, Huacai Chen wrote:
> On Tue, Nov 3, 2026 at 10:24 AM Tiezhu Yang <yangtiezhu@loongson.cn> wrote:

...

>> So, the current patch has no problem IMO.
> OK, then I think we can use:
> 
> return __is_defined(system_has_cmpxchg128) && system_has_cmpxchg128();

If CONFIG_AS_HAS_SCQ_EXTENSION is not enabled, system_has_cmpxchg128()
is not defined at all. If we change the code to follow your suggestion,
something like this:

```
diff --git a/arch/loongarch/Kconfig b/arch/loongarch/Kconfig
index b5ed4881d3c0..6f572d24d2c3 100644
--- a/arch/loongarch/Kconfig
+++ b/arch/loongarch/Kconfig
@@ -336,7 +336,7 @@ config AS_HAS_LVZ_EXTENSION
         def_bool $(as-instr,hvcl 0)

  config AS_HAS_SCQ_EXTENSION
-       def_bool $(as-instr,sc.q \$t0$(comma)\$t1$(comma)\$t2)
+       def_bool n

  config CC_HAS_ANNOTATE_TABLEJUMP
         def_bool $(cc-option,-mannotate-tablejump)
diff --git a/arch/loongarch/net/bpf_jit.c b/arch/loongarch/net/bpf_jit.c
index d7ea515045ec..d124632b0fa9 100644
--- a/arch/loongarch/net/bpf_jit.c
+++ b/arch/loongarch/net/bpf_jit.c
@@ -2495,11 +2495,7 @@ bool bpf_jit_supports_arena(void)
          * atomic cmpxchg; this is provided by not only hardware SCQ 
extension
          * but also assembler support on LoongArch.
          */
-#ifdef system_has_cmpxchg128
-       return system_has_cmpxchg128();
-#else
-       return false;
-#endif
+       return __is_defined(system_has_cmpxchg128) && 
system_has_cmpxchg128();
  }

  bool bpf_jit_supports_fsession(void)
```

We will encounter a fatal build error:

   CC      arch/loongarch/net/bpf_jit.o
arch/loongarch/net/bpf_jit.c: In function ‘bpf_jit_supports_arena’:
arch/loongarch/net/bpf_jit.c:2498:55: error: implicit declaration of 
function ‘system_has_cmpxchg128’ [-Wimplicit-function-declaration]
  2498 |         return __is_defined(system_has_cmpxchg128) && 
system_has_cmpxchg128();
       | 
^~~~~~~~~~~~~~~~~~~~~
make[5]: *** [scripts/Makefile.build:290: arch/loongarch/net/bpf_jit.o] 
Error 1

Even if we change it to use IS_ENABLED(CONFIG_AS_HAS_SCQ_EXTENSION),
something like this:

```
diff --git a/arch/loongarch/Kconfig b/arch/loongarch/Kconfig
index b5ed4881d3c0..6f572d24d2c3 100644
--- a/arch/loongarch/Kconfig
+++ b/arch/loongarch/Kconfig
@@ -336,7 +336,7 @@ config AS_HAS_LVZ_EXTENSION
         def_bool $(as-instr,hvcl 0)

  config AS_HAS_SCQ_EXTENSION
-       def_bool $(as-instr,sc.q \$t0$(comma)\$t1$(comma)\$t2)
+       def_bool n

  config CC_HAS_ANNOTATE_TABLEJUMP
         def_bool $(cc-option,-mannotate-tablejump)
diff --git a/arch/loongarch/net/bpf_jit.c b/arch/loongarch/net/bpf_jit.c
index d7ea515045ec..1b87b1e4262e 100644
--- a/arch/loongarch/net/bpf_jit.c
+++ b/arch/loongarch/net/bpf_jit.c
@@ -2495,11 +2495,7 @@ bool bpf_jit_supports_arena(void)
          * atomic cmpxchg; this is provided by not only hardware SCQ 
extension
          * but also assembler support on LoongArch.
          */
-#ifdef system_has_cmpxchg128
-       return system_has_cmpxchg128();
-#else
-       return false;
-#endif
+       return IS_ENABLED(CONFIG_AS_HAS_SCQ_EXTENSION) && 
system_has_cmpxchg128();
  }

  bool bpf_jit_supports_fsession(void)
```

It still fails with the same error due to the macro visibility:

   CC      arch/loongarch/net/bpf_jit.o
arch/loongarch/net/bpf_jit.c: In function ‘bpf_jit_supports_arena’:
arch/loongarch/net/bpf_jit.c:2498:59: error: implicit declaration of 
function ‘system_has_cmpxchg128’ [-Wimplicit-function-declaration]
  2498 |         return IS_ENABLED(CONFIG_AS_HAS_SCQ_EXTENSION) && 
system_has_cmpxchg128();
       | 
^~~~~~~~~~~~~~~~~~~~~
make[5]: *** [scripts/Makefile.build:290: arch/loongarch/net/bpf_jit.o] 
Error 1

Therefore, using the explicit #ifdef block in the original patch is the
only way to ensure toolchain compatibility and compile-time robustness
here IMO.

Anyway, I will modify the patch subject, update the commit message
and code comment to make it more clear.

Thanks,
Tiezhu

Re: [PATCH v1 1/2] LoongArch: BPF: Make arena support depend on SCQ extension

[Huacai Chen]

On Wed, Nov 4, 2026 at 2:58 PM Tiezhu Yang <yangtiezhu@loongson.cn> wrote:
>
> On 11/4/26 12:29 PM, Huacai Chen wrote:
> > On Tue, Nov 3, 2026 at 10:24 AM Tiezhu Yang <yangtiezhu@loongson.cn> wrote:
>
> ...
>
> >> So, the current patch has no problem IMO.
> > OK, then I think we can use:
> >
> > return __is_defined(system_has_cmpxchg128) && system_has_cmpxchg128();
>
> If CONFIG_AS_HAS_SCQ_EXTENSION is not enabled, system_has_cmpxchg128()
> is not defined at all. If we change the code to follow your suggestion,
> something like this:
>
> ```
> diff --git a/arch/loongarch/Kconfig b/arch/loongarch/Kconfig
> index b5ed4881d3c0..6f572d24d2c3 100644
> --- a/arch/loongarch/Kconfig
> +++ b/arch/loongarch/Kconfig
> @@ -336,7 +336,7 @@ config AS_HAS_LVZ_EXTENSION
>          def_bool $(as-instr,hvcl 0)
>
>   config AS_HAS_SCQ_EXTENSION
> -       def_bool $(as-instr,sc.q \$t0$(comma)\$t1$(comma)\$t2)
> +       def_bool n
>
>   config CC_HAS_ANNOTATE_TABLEJUMP
>          def_bool $(cc-option,-mannotate-tablejump)
> diff --git a/arch/loongarch/net/bpf_jit.c b/arch/loongarch/net/bpf_jit.c
> index d7ea515045ec..d124632b0fa9 100644
> --- a/arch/loongarch/net/bpf_jit.c
> +++ b/arch/loongarch/net/bpf_jit.c
> @@ -2495,11 +2495,7 @@ bool bpf_jit_supports_arena(void)
>           * atomic cmpxchg; this is provided by not only hardware SCQ
> extension
>           * but also assembler support on LoongArch.
>           */
> -#ifdef system_has_cmpxchg128
> -       return system_has_cmpxchg128();
> -#else
> -       return false;
> -#endif
> +       return __is_defined(system_has_cmpxchg128) &&
> system_has_cmpxchg128();
>   }
>
>   bool bpf_jit_supports_fsession(void)
> ```
>
> We will encounter a fatal build error:
>
>    CC      arch/loongarch/net/bpf_jit.o
> arch/loongarch/net/bpf_jit.c: In function ‘bpf_jit_supports_arena’:
> arch/loongarch/net/bpf_jit.c:2498:55: error: implicit declaration of
> function ‘system_has_cmpxchg128’ [-Wimplicit-function-declaration]
>   2498 |         return __is_defined(system_has_cmpxchg128) &&
> system_has_cmpxchg128();
>        |
> ^~~~~~~~~~~~~~~~~~~~~
> make[5]: *** [scripts/Makefile.build:290: arch/loongarch/net/bpf_jit.o]
> Error 1
>
> Even if we change it to use IS_ENABLED(CONFIG_AS_HAS_SCQ_EXTENSION),
> something like this:
>
> ```
> diff --git a/arch/loongarch/Kconfig b/arch/loongarch/Kconfig
> index b5ed4881d3c0..6f572d24d2c3 100644
> --- a/arch/loongarch/Kconfig
> +++ b/arch/loongarch/Kconfig
> @@ -336,7 +336,7 @@ config AS_HAS_LVZ_EXTENSION
>          def_bool $(as-instr,hvcl 0)
>
>   config AS_HAS_SCQ_EXTENSION
> -       def_bool $(as-instr,sc.q \$t0$(comma)\$t1$(comma)\$t2)
> +       def_bool n
>
>   config CC_HAS_ANNOTATE_TABLEJUMP
>          def_bool $(cc-option,-mannotate-tablejump)
> diff --git a/arch/loongarch/net/bpf_jit.c b/arch/loongarch/net/bpf_jit.c
> index d7ea515045ec..1b87b1e4262e 100644
> --- a/arch/loongarch/net/bpf_jit.c
> +++ b/arch/loongarch/net/bpf_jit.c
> @@ -2495,11 +2495,7 @@ bool bpf_jit_supports_arena(void)
>           * atomic cmpxchg; this is provided by not only hardware SCQ
> extension
>           * but also assembler support on LoongArch.
>           */
> -#ifdef system_has_cmpxchg128
> -       return system_has_cmpxchg128();
> -#else
> -       return false;
> -#endif
> +       return IS_ENABLED(CONFIG_AS_HAS_SCQ_EXTENSION) &&
> system_has_cmpxchg128();
>   }
>
>   bool bpf_jit_supports_fsession(void)
> ```
>
> It still fails with the same error due to the macro visibility:
>
>    CC      arch/loongarch/net/bpf_jit.o
> arch/loongarch/net/bpf_jit.c: In function ‘bpf_jit_supports_arena’:
> arch/loongarch/net/bpf_jit.c:2498:59: error: implicit declaration of
> function ‘system_has_cmpxchg128’ [-Wimplicit-function-declaration]
>   2498 |         return IS_ENABLED(CONFIG_AS_HAS_SCQ_EXTENSION) &&
> system_has_cmpxchg128();
>        |
> ^~~~~~~~~~~~~~~~~~~~~
> make[5]: *** [scripts/Makefile.build:290: arch/loongarch/net/bpf_jit.o]
> Error 1
>
> Therefore, using the explicit #ifdef block in the original patch is the
> only way to ensure toolchain compatibility and compile-time robustness
> here IMO.
This is OK:

return cpu_has_scq && __is_defined(system_has_cmpxchg128);

It means two things:
1. CPU supports SC.Q;
2. Kernel defines system_has_cmpxchg128.

Very clear.

Huacai

>
> Anyway, I will modify the patch subject, update the commit message
> and code comment to make it more clear.
>
> Thanks,
> Tiezhu
>

Re: [PATCH v1 1/2] LoongArch: BPF: Make arena support depend on SCQ extension

[Tiezhu Yang]

On 11/4/26 5:54 PM, Huacai Chen wrote:
> On Wed, Nov 4, 2026 at 2:58 PM Tiezhu Yang <yangtiezhu@loongson.cn> wrote:

...

>> Therefore, using the explicit #ifdef block in the original patch is the
>> only way to ensure toolchain compatibility and compile-time robustness
>> here IMO.
> This is OK:
> 
> return cpu_has_scq && __is_defined(system_has_cmpxchg128);
> 
> It means two things:
> 1. CPU supports SC.Q;
> 2. Kernel defines system_has_cmpxchg128.
> 
> Very clear.

I tested your suggestion:
return cpu_has_scq && __is_defined(system_has_cmpxchg128);

There is no build error. However, this introduces a fatal functional
bug because __is_defined(system_has_cmpxchg128) is blindly evaluated
to 0 as a text string token. As a result, the expression is always
translated into "return cpu_has_scq && 0;", which disables BPF Arena
support permanently even on the Loongson-3A6000 system with hardware
SCQ extension and assembler sc.q support.

I did the following changes:

```
diff --git a/arch/loongarch/net/bpf_jit.c b/arch/loongarch/net/bpf_jit.c
index 3ab039d0afb6..b61cca6a8947 100644
--- a/arch/loongarch/net/bpf_jit.c
+++ b/arch/loongarch/net/bpf_jit.c
@@ -2489,7 +2489,13 @@ bool bpf_jit_bypass_spec_v4(void)

  bool bpf_jit_supports_arena(void)
  {
-       return true;
+       /*
+        * The arena range tree uses kmalloc_nolock(), which requires 
128-bit
+        * atomic cmpxchg; this is provided by not only hardware SCQ 
extension
+        * but also assembler support on LoongArch.
+        */
+       pr_info("__is_defined(system_has_cmpxchg128)=%d\n", 
__is_defined(system_has_cmpxchg128));
+       return cpu_has_scq && __is_defined(system_has_cmpxchg128);
  }

  bool bpf_jit_supports_fsession(void)
```

Here is the test result on the Loongson-3A6000 system with hardware
SCQ extension and assembler sc.q support:

   $ sudo ./test_progs -a jit_insns/cast_to_user
   ...
   libbpf: map 'arena': failed to create: -EOPNOTSUPP
   run_subtest:FAIL:unexpected_load_failure unexpected error: -95 (errno 95)
   ...
   #197/2   jit_insns/cast_to_user:FAIL
   #197     jit_insns:FAIL
   Summary: 0/0 PASSED, 0 SKIPPED, 1/1 FAILED

   $ dmesg -t | grep system_has_cmpxchg128
   __is_defined(system_has_cmpxchg128)=0

This is not expected.

AFAICT, there are two viable ways to handle both assembler and runtime
constraints:

(1)Use system_has_cmpxchg128 at compile-time and run-time. This is
more aligned with semantic intent, as BPF relies on the generic
128-bit cmpxchg interface.

```
bool bpf_jit_supports_arena(void)
{
         /*
          * The arena range tree uses kmalloc_nolock(), which requires 
128-bit
          * atomic cmpxchg; this is provided by not only hardware SCQ 
extension
          * but also assembler support on LoongArch.
          */
#ifdef system_has_cmpxchg128
         return system_has_cmpxchg128();
#else
         return false;
#endif
}
```

(2) Use CONFIG_AS_HAS_SCQ_EXTENSION at compile-time and cpu_has_scq
at run-time. This is more aligned with kernel coding aesthetics by
avoiding #ifdef blocks.

```
bool bpf_jit_supports_arena(void)
{
         /*
          * The arena range tree uses kmalloc_nolock(), which requires 
128-bit
          * atomic cmpxchg; this is provided by not only hardware SCQ 
extension
          * but also assembler support on LoongArch.
          */
         return IS_ENABLED(CONFIG_AS_HAS_SCQ_EXTENSION) && cpu_has_scq;
}
```

Since cpu_has_scq and system_has_cmpxchg128() share the exact same
runtime expansion (cpu_opt(LOONGARCH_CPU_SCQ)), both approaches are
functionally equivalent and produce identical machine code.

Personally, I feel Approach 1 represents the pure semantic intent
better, whereas Approach 2 looks more aesthetically pleasing.

Which one do you prefer for the v2 patch?

Thanks,
Tiezhu

Re: [PATCH v1 1/2] LoongArch: BPF: Make arena support depend on SCQ extension

[George Guo]

Hi Tiezhu,

On 2026/11/2 15:28, Tiezhu Yang wrote:
> This is because the arena range tree uses kmalloc_nolock(), which requires
> 128-bit atomic cmpxchg support, provided by SCQ extension on LoongArch.

There is an existing SLUB debug fallback worth checking before making
arena support depend on SCQ.

In __kmalloc_nolock_noprof(), the rejection condition is:

        if (!(s->flags & __CMPXCHG_DOUBLE) && !kmem_cache_debug(s))
                return NULL;

Debug caches do not require cmpxchg128 for this path. They use
kmem_cache_node->list_lock with spin_trylock_irqsave() instead.
With CONFIG_SLUB_DEBUG=y, booting with slab_debug enables this path;
CONFIG_SLUB_DEBUG_ON=y enables debugging by default as well.

The proposed bpf_jit_supports_arena() check would reject arena maps on
CPUs without SCQ, even when the SLUB debug fallback is available.
This would prevent us from running arena tests on those machines
with slab_debug enabled.

Could you rerun jit_insns/cast_to_user on the 3A5000 with slab_debug
enabled, before and after this patch? The claim that kmalloc_nolock()
requires 128-bit cmpxchg should account for debug caches, and it would
be useful to preserve that fallback when addressing the error reporting.

Thanks,
George

[PATCH v1 2/2] LoongArch: BPF: Use beqz and bnez instructions for trampoline

[Tiezhu Yang]

Currently, the implementation for BPF trampoline branches does not match
the existing technical comments. The code uses larch_insn_gen_beq, where
the comment indicates beqz should be used.

Moreover, the beq instruction belongs to the reg2i16 format which limits
the jump offset to 16 bits (+/-128KB). After using the beqz instruction
which belongs to the reg1i21 format, the jump range will be extended to
21 bits (+/-4MB). This mitigates potential branch overflow risks in the
complex BPF trampolines.

While at it, also apply the same optimization to the bne instruction by
replacing it with bnez and adding a corresponding comment.

Fixes: f9b6b41f0cf3 ("LoongArch: BPF: Add basic bpf trampoline support")
Cc: stable@vger.kernel.org
Signed-off-by: Tiezhu Yang <yangtiezhu@loongson.cn>
---
 arch/loongarch/include/asm/inst.h | 21 +++++++++++++++++++++
 arch/loongarch/kernel/inst.c      | 28 ++++++++++++++++++++++++++++
 arch/loongarch/net/bpf_jit.c      |  5 +++--
 3 files changed, 52 insertions(+), 2 deletions(-)

diff --git a/arch/loongarch/include/asm/inst.h b/arch/loongarch/include/asm/inst.h
index b55aae325300..e061f966f7d1 100644
--- a/arch/loongarch/include/asm/inst.h
+++ b/arch/loongarch/include/asm/inst.h
@@ -535,6 +535,8 @@ u32 larch_insn_gen_lu32id(enum loongarch_gpr rd, int imm);
 u32 larch_insn_gen_lu52id(enum loongarch_gpr rd, enum loongarch_gpr rj, int imm);
 u32 larch_insn_gen_beq(enum loongarch_gpr rd, enum loongarch_gpr rj, int imm);
 u32 larch_insn_gen_bne(enum loongarch_gpr rd, enum loongarch_gpr rj, int imm);
+u32 larch_insn_gen_beqz(enum loongarch_gpr rj, int imm);
+u32 larch_insn_gen_bnez(enum loongarch_gpr rj, int imm);
 u32 larch_insn_gen_jirl(enum loongarch_gpr rd, enum loongarch_gpr rj, int imm);
 
 static inline bool signed_imm_check(long val, unsigned int bit)
@@ -592,6 +594,25 @@ DEF_EMIT_REG1I20_FORMAT(lu12iw, lu12iw_op)
 DEF_EMIT_REG1I20_FORMAT(lu32id, lu32id_op)
 DEF_EMIT_REG1I20_FORMAT(pcaddu18i, pcaddu18i_op)
 
+#define DEF_EMIT_REG1I21_FORMAT(NAME, OP)				\
+static inline void emit_##NAME(union loongarch_instruction *insn,	\
+			       enum loongarch_gpr rj, int offset)	\
+{									\
+	unsigned int immediate_l, immediate_h;				\
+									\
+	immediate_l = offset & 0xffff;					\
+	offset >>= 16;							\
+	immediate_h = offset & 0x1f;					\
+									\
+	insn->reg1i21_format.opcode = OP;				\
+	insn->reg1i21_format.immediate_l = immediate_l;			\
+	insn->reg1i21_format.rj = rj;					\
+	insn->reg1i21_format.immediate_h = immediate_h;			\
+}
+
+DEF_EMIT_REG1I21_FORMAT(beqz, beqz_op)
+DEF_EMIT_REG1I21_FORMAT(bnez, bnez_op)
+
 #define DEF_EMIT_REG2_FORMAT(NAME, OP)					\
 static inline void emit_##NAME(union loongarch_instruction *insn,	\
 			       enum loongarch_gpr rd,			\
diff --git a/arch/loongarch/kernel/inst.c b/arch/loongarch/kernel/inst.c
index 0b9228b7c13a..0d5076cfd7d1 100644
--- a/arch/loongarch/kernel/inst.c
+++ b/arch/loongarch/kernel/inst.c
@@ -428,6 +428,34 @@ u32 larch_insn_gen_bne(enum loongarch_gpr rd, enum loongarch_gpr rj, int imm)
 	return insn.word;
 }
 
+u32 larch_insn_gen_beqz(enum loongarch_gpr rj, int imm)
+{
+	union loongarch_instruction insn;
+
+	if ((imm & 3) || imm < -SZ_4M || imm >= SZ_4M) {
+		pr_warn("The generated beqz instruction is out of range.\n");
+		return INSN_BREAK;
+	}
+
+	emit_beqz(&insn, rj, imm >> 2);
+
+	return insn.word;
+}
+
+u32 larch_insn_gen_bnez(enum loongarch_gpr rj, int imm)
+{
+	union loongarch_instruction insn;
+
+	if ((imm & 3) || imm < -SZ_4M || imm >= SZ_4M) {
+		pr_warn("The generated bnez instruction is out of range.\n");
+		return INSN_BREAK;
+	}
+
+	emit_bnez(&insn, rj, imm >> 2);
+
+	return insn.word;
+}
+
 u32 larch_insn_gen_jirl(enum loongarch_gpr rd, enum loongarch_gpr rj, int imm)
 {
 	union loongarch_instruction insn;
diff --git a/arch/loongarch/net/bpf_jit.c b/arch/loongarch/net/bpf_jit.c
index 01c12da168ee..8cc78efe722d 100644
--- a/arch/loongarch/net/bpf_jit.c
+++ b/arch/loongarch/net/bpf_jit.c
@@ -1819,7 +1819,7 @@ static int invoke_bpf_prog(struct jit_ctx *ctx, struct bpf_tramp_image *im,
 	/* update branch with beqz */
 	if (ctx->image) {
 		int offset = (void *)(&ctx->image[ctx->idx]) - (void *)branch;
-		*branch = larch_insn_gen_beq(LOONGARCH_GPR_A0, LOONGARCH_GPR_ZERO, offset);
+		*branch = larch_insn_gen_beqz(LOONGARCH_GPR_A0, offset);
 	}
 
 	/* arg1: prog */
@@ -2132,9 +2132,10 @@ static int __arch_prepare_bpf_trampoline(struct jit_ctx *ctx, struct bpf_tramp_i
 		emit_insn(ctx, std, regmap[BPF_REG_0], LOONGARCH_GPR_FP, -(retval_off - 8));
 	}
 
+	/* update branches with bnez */
 	for (i = 0; ctx->image && i < fmod_ret->nr_nodes; i++) {
 		int offset = (void *)(&ctx->image[ctx->idx]) - (void *)branches[i];
-		*branches[i] = larch_insn_gen_bne(LOONGARCH_GPR_T1, LOONGARCH_GPR_ZERO, offset);
+		*branches[i] = larch_insn_gen_bnez(LOONGARCH_GPR_T1, offset);
 	}
 
 	/* Set "is_return" flag for fsession */
-- 
2.42.0

Re: [PATCH v1 2/2] LoongArch: BPF: Use beqz and bnez instructions for trampoline

[bot+bpf-ci]

[-- Attachment #1: Type: text/plain, Size: 3200 bytes --]

> LoongArch: BPF: Use beqz and bnez instructions for trampoline

TL;DR: Commit message only: the claimed branch-overflow risk looks impossible,
since trampolines fit in one page and the old code behaved identically, so the
Fixes: and Cc: stable tags may not be justified.

> LoongArch: BPF: Use beqz and bnez instructions for trampoline
>
> Currently, the implementation for BPF trampoline branches does not match
> the existing technical comments. The code uses larch_insn_gen_beq, where
> the comment indicates beqz should be used.
>
> Moreover, the beq instruction belongs to the reg2i16 format which limits
> the jump offset to 16 bits (+/-128KB). After using the beqz instruction
> which belongs to the reg1i21 format, the jump range will be extended to
> 21 bits (+/-4MB). This mitigates potential branch overflow risks in the
> complex BPF trampolines.
>
> While at it, also apply the same optimization to the bne instruction by
> replacing it with bnez and adding a corresponding comment.
>
> Fixes: f9b6b41f0cf3 ("LoongArch: BPF: Add basic bpf trampoline support")
> Cc: stable@vger.kernel.org
> Signed-off-by: Tiezhu Yang <yangtiezhu@loongson.cn>

The commit message says the new instructions "mitigate potential branch
overflow risks in the complex BPF trampolines", and the patch carries a
Fixes: tag and Cc: stable.  Can a beq/bne inside a LoongArch BPF trampoline
actually go out of range?

bpf_trampoline_update() in kernel/bpf/trampoline.c rejects any trampoline
larger than one page:

    size = arch_bpf_trampoline_size(&tr->func.model, tr->flags, tnodes,
                                    tr->func.addr);
    ...
    if (size > PAGE_SIZE) {
        err = -E2BIG;
        goto out;
    }

On LoongArch PAGE_SIZE is at most 64KB (the 64KB_2LEVEL and 64KB_3LEVEL
configs), while the beq/bne reg2i16 range is +/-128KB.  So no branch inside
a trampoline can get near that limit.

bpf_struct_ops_prepare_trampoline() puts a single node in
tnodes[BPF_TRAMP_FENTRY] and has no fmod_ret branches, so its only
conditional branch skips one call sequence.

Even if the range were exceeded, larch_insn_gen_beq() and
larch_insn_gen_bne() return INSN_BREAK, and validate_code() in
arch_prepare_bpf_trampoline() would then fail the trampoline with -EINVAL.
The old code could not silently emit a wrong branch.

The old and new instructions also test the same condition:

    larch_insn_gen_beq(LOONGARCH_GPR_A0, LOONGARCH_GPR_ZERO, offset)
        -> beq $zero, $a0
    larch_insn_gen_beqz(LOONGARCH_GPR_A0, offset)
        -> beqz $a0

and likewise bne $zero, $t1 versus bnez $t1, each replacing the same single
nop slot.  So the patch appears to change no behavior and only makes the
code match the existing "update branch with beqz" comment.

Could the changelog drop the overflow-risk wording, or describe the change
as a cleanup, and could the Fixes: and Cc: stable tags be reconsidered given
that stable-kernel-rules requires a fix for a real bug?


---
AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md

CI run summary: https://github.com/kernel-patches/bpf/actions/runs/41407991756

Re: [PATCH v1 2/2] LoongArch: BPF: Use beqz and bnez instructions for trampoline

[Tiezhu Yang]

On 2026/11/2 下午3:53, bot+bpf-ci@kernel.org wrote:
>> LoongArch: BPF: Use beqz and bnez instructions for trampoline
> 
> TL;DR: Commit message only: the claimed branch-overflow risk looks impossible,
> since trampolines fit in one page and the old code behaved identically, so the
> Fixes: and Cc: stable tags may not be justified.

...

> Could the changelog drop the overflow-risk wording, or describe the change
> as a cleanup, and could the Fixes: and Cc: stable tags be reconsidered given
> that stable-kernel-rules requires a fix for a real bug?

Will update the commit message and remove the 'Fixes' and 'Cc: stable'
tags. If no more comments, I will send out v2 next week.

Thanks,
Tiezhu