Re: [PATCH bpf v4 2/3] bpf: Skip detached progs in trampoline images that are still in use

[Florent Revest]

On Sat Sep 26, 2026 at 8:44 AM UTC, Alexei Starovoitov wrote:
> On Fri, Sep 25, 2026 at 10:47 AM bot+bpf-ci@xxxxxxxxxx <bot+bpf-ci@xxxxxxxxxx> wrote:
> >> +	/* nops for move_imm+jirl, patched to skip this prog when it is detached */
> >> +	for (i = 0; i < LOONGARCH_LONG_JUMP_NINSNS; i++)
> >> +		emit_insn(ctx, nop);
> >
> > Can a task preempted inside the skip sled resume into half of the new jump
> > sequence and jump to a garbage address?
>
> [...]
>
> > Could the LoongArch skip site use a single instruction instead? For
> > example, a 'b' to the skip target, which is always within the +/-128MB
> > range of the same image, patched from nop to 'b'. The rest of the sled
> > would then be unnecessary.
>
> Seems like a real bug. Same issue on riscv.
>
> ip_after_call was patched in bpf_tramp_image_put() when the image was
> already unreachable. Now bpf_trampoline_remove_prog() patches cur_image
> before bpf_trampoline_update() replaces it, so every call of the traced
> function goes through the sled while it is rewritten. stop_machine
> doesn't help the task that it preempted in the middle of the sled.
>
> Pls fix and respin.
> Everything else looks good.

Ok. In v5, on riscv and loongarch, it will emit single nops at skip sites and
patch them with jal or b instructions. They can always reach their target since
they are in the same image. This requires a new arch_bpf_trampoline_skip() hook
that defaults to bpf_arch_text_poke() on other archs. I tested it in QEMU.