[PATCH bpf v2 0/2] bpf, x86: Fix i386 JIT signed ALU32 DIV/MOD and MOVSX

[Nicholas Dudar <main.kalliope@gmail.com>]

The i386 JIT accepts signed ALU32 DIV/MOD and register MOVSX, but
ignores the offset that selects them and emits an unsigned div and a
plain move. The results differ from RFC9669 and the interpreter, and a
verifier-accepted program can use values outside the range proved by
the verifier. In i386 VM tests, three verifier-accepted programs
supplied helper lengths beyond the verifier's bounds before these
fixes, and the helper wrote that many bytes. With the fixes the lengths
stayed within the bounds. The test programs are not included here and
are available to maintainers on request.

The series is meant as a minimal fix that closes this gap between the
verifier and the JIT. It makes the two instructions the JIT already
accepts produce the values the verifier assumes and adds no new
instruction support.

Tested on i386 under KVM. vmtest.sh has no i386 target and test_progs
does not build in full as a 32-bit binary, so it was built with
jit_insns, verifier_sdiv and verifier_movsx only, with a strtol() to
strtoll() change in test_loader.c. The commands and output are in the
patches. The six jit_insns subtests that still fail (arena_zero_off,
cast_to_user, staggered_jumps, acq_rel, probe_mem, shift_counts) fail
without the series as well.

On the unpatched kernel the unprivileged subtest "MOV32SX, S8,
range_check" hangs in the kernel: the wrong value takes a branch the
verifier proved dead, which for unprivileged programs is a jump to
itself. The unprivileged verifier_movsx subtests were therefore run
with both patches only. There it passes, and two others differ from the
expected xlated text by an additional zero extension on i386.

Claude Mythos 5.2 assisted with this patch series.

v1 -> v2:
  - Dropped MEMSX, 32-bit-offset unconditional jumps, unconditional
    byte swaps and the load-emitter refactor
  - Added the signed DIV/MOD change, which was posted on its own [1]
    and is superseded by this series; the code is unchanged
  - Sent as fixes for bpf with Fixes tags instead of new support for
    bpf-next, since the JIT already accepts both instructions and
    miscompiles them
  - Tested with jit_insns and the verifier tests of test_progs

[1] https://lore.kernel.org/bpf/20260731002950.179573-1-main.kalliope@gmail.com/

v1: https://lore.kernel.org/bpf/20260915021338.1520964-1-main.kalliope@gmail.com/
---
Nicholas Dudar (2):
      bpf, x86: Fix signed division and modulo in the i386 JIT
      bpf, x86: Fix sign-extension moves in the i386 JIT

 arch/x86/net/bpf_jit_comp32.c | 76 ++++++++++++++++++++++++++++++++++++++-----
 1 file changed, 68 insertions(+), 8 deletions(-)
---
base-commit: b7cc45994c3f9c5f24397fcc0251f6c23bff9bd8
change-id: 20261112-i386_bpf_jit_wrong_code_20261028-7246b0231fce

Best regards,
--  
Nicholas Dudar <main.kalliope@gmail.com>