From: Eduard Zingerman <eddyz87@gmail.com>
To: Yiyang Chen <chenyy23@mails.tsinghua.edu.cn>,
Alexei Starovoitov <ast@kernel.org>,
Daniel Borkmann <daniel@iogearbox.net>,
John Fastabend <john.fastabend@gmail.com>,
Andrii Nakryiko <andrii@kernel.org>,
Kumar Kartikeya Dwivedi <memxor@gmail.com>,
Martin KaFai Lau <martin.lau@linux.dev>,
Song Liu <song@kernel.org>,
Yonghong Song <yonghong.song@linux.dev>,
Jiri Olsa <jolsa@kernel.org>,
Emil Tsalapatis <emil@etsalapatis.com>,
Ihor Solodrai <ihor.solodrai@linux.dev>,
Shuah Khan <shuah@kernel.org>
Cc: bpf@vger.kernel.org, linux-kernel@vger.kernel.org,
linux-kselftest@vger.kernel.org
Subject: Re: [PATCH bpf-next 2/2] selftests/bpf: Cover mixed arena and map-value atomics
Date: Thu, 13 Aug 2026 15:20:56 -0700 [thread overview]
Message-ID: <7d608380ec448046a6783c96583cd493ca639a15.camel@gmail.com> (raw)
In-Reply-To: <20260813-bpf-next-038-mixed-atomic-v1-v1-2-e79aadb46a8a@mails.tsinghua.edu.cn>
On Thu, 2026-08-13 at 12:01 +0000, Yiyang Chen wrote:
> Add a verifier test with one atomic RMW instruction reached through
> PTR_TO_ARENA and PTR_TO_MAP_VALUE paths. The verifier must reject the
> shared instruction with the existing incompatible-pointer diagnostic.
>
> Signed-off-by: Yiyang Chen <chenyy23@mails.tsinghua.edu.cn>
> ---
> tools/testing/selftests/bpf/progs/verifier_arena.c | 44 ++++++++++++++++++++++
> 1 file changed, 44 insertions(+)
>
> diff --git a/tools/testing/selftests/bpf/progs/verifier_arena.c b/tools/testing/selftests/bpf/progs/verifier_arena.c
> index b241bbcf54a8a..2e43da188194b 100644
> --- a/tools/testing/selftests/bpf/progs/verifier_arena.c
> +++ b/tools/testing/selftests/bpf/progs/verifier_arena.c
> @@ -25,6 +25,15 @@ struct {
> __ulong(map_extra, ARENA_VM_START); /* start of mmap() region */
> } arena SEC(".maps");
>
> +struct {
> + __uint(type, BPF_MAP_TYPE_ARRAY);
> + __uint(max_entries, 1);
> + __type(key, __u32);
> + __type(value, __u64);
> +} atomic_map SEC(".maps");
Please use existing arena map.
> +
> +static __u64 arena_atomic_target SEC(".addr_space.1");
The bot is right, verifier_arena tests are failing.
Did you test this patch before sending?
> SEC("socket")
> __success __retval(0)
> int basic_alloc1_nosleep(void *ctx)
> @@ -637,6 +646,41 @@ int non_arena_ptr_add_to_arena_ptr(void *ctx)
>
> #endif
>
> +SEC("socket")
> +__description("arena and map value atomic at the same instruction")
> +__failure __msg("same insn cannot be used with different pointers")
> +__arch_x86_64
> +__load_if_JITed()
> +__naked void mixed_arena_map_value_atomic(void)
> +{
> + asm volatile (" \
> + r1 = 0; \
> + *(u32 *)(r10 - 4) = r1; \
> + r2 = r10; \
> + r2 += -4; \
> + r1 = %[atomic_map] ll; \
> + call %[bpf_map_lookup_elem]; \
> + if r0 == 0 goto 1f; \
> + r6 = r0; \
> + r7 = %[arena_atomic_target] ll; \
> + .byte 0xbf; .byte 0x77; .short 1; .long 1; \
Please use __imm_insn, see examples in the test suite.
> + call %[bpf_get_prandom_u32]; \
> + if w0 != 0 goto 2f; \
> + r8 = r6; \
> + goto 3f; \
> +2: r8 = r7; \
> +3: r9 = 1; \
> + lock *(u64 *)(r8 + 0) += r9; \
> +1: r0 = 0; \
> + exit; \
> +" :
> + : __imm_addr(atomic_map),
> + __imm_addr(arena_atomic_target),
You can conjure an arena pointer as in non_arena_ptr_add_to_arena_ptr()
w/o the need for the variable.
> + __imm(bpf_map_lookup_elem),
> + __imm(bpf_get_prandom_u32)
> + : __clobber_all);
> +}
> +
> static __noinline
> u32 __arena *check_arena_arg_nonglobal(u32 __arena *arg)
> {
pw-bot: cr.
prev parent reply other threads:[~2026-08-13 22:21 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-08-13 12:01 [PATCH bpf-next 0/2] bpf: Reject mixed arena and ordinary atomic paths Yiyang Chen
2026-08-13 12:01 ` [PATCH bpf-next 1/2] bpf: Check pointer type for all atomic RMW paths Yiyang Chen
2026-08-13 22:12 ` Eduard Zingerman
2026-08-13 12:01 ` [PATCH bpf-next 2/2] selftests/bpf: Cover mixed arena and map-value atomics Yiyang Chen
2026-08-13 13:03 ` bot+bpf-ci
2026-08-13 22:20 ` Eduard Zingerman [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=7d608380ec448046a6783c96583cd493ca639a15.camel@gmail.com \
--to=eddyz87@gmail.com \
--cc=andrii@kernel.org \
--cc=ast@kernel.org \
--cc=bpf@vger.kernel.org \
--cc=chenyy23@mails.tsinghua.edu.cn \
--cc=daniel@iogearbox.net \
--cc=emil@etsalapatis.com \
--cc=ihor.solodrai@linux.dev \
--cc=john.fastabend@gmail.com \
--cc=jolsa@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-kselftest@vger.kernel.org \
--cc=martin.lau@linux.dev \
--cc=memxor@gmail.com \
--cc=shuah@kernel.org \
--cc=song@kernel.org \
--cc=yonghong.song@linux.dev \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®