Re: [PATCH v2] bpf, riscv: fix missing extable entry for arena load_acquire

[Feng Jiang]

On 2026/7/16 16:40, Björn Töpel wrote:
> Feng Jiang <jiangfeng@xxxxxxxxxx> writes:
> 
>> emit_atomic_ld_st() returns 1 to have build_body() skip the zext after
>> a sub-word load_acquire. The caller does "ret = ret ?:
>> add_exception_handler(...)", which skips add_exception_handler() on any
>> non-zero ret, so the extable entry is missing and a faulting
>> PROBE_ATOMIC load_acquire oopses.
>>
>> Check ret >= 0 before calling add_exception_handler(), and return ret
>> unchanged so build_body() still skips the zext.
>>
>> Fixes: fb7cefabae81 ("riscv, bpf: Add support arena atomics for RV64")
>> Suggested-by: Pu Lehui <pulehui@xxxxxxxxxx>
>> Signed-off-by: Feng Jiang <jiangfeng@xxxxxxxxxx>
>> ---
>> Changes in v2:
>> - Drop extra variable as suggested by Pu Lehui.
>> - Link to v1: https://lore.kernel.org/r/20260716-bpf-riscv-fix-extable-v1-1-af023cc17af4@xxxxxxxxxx
>> ---
>>  arch/riscv/net/bpf_jit_comp64.c | 5 ++++-
>>  1 file changed, 4 insertions(+), 1 deletion(-)
>>
>> diff --git a/arch/riscv/net/bpf_jit_comp64.c b/arch/riscv/net/bpf_jit_comp64.c
>> index f9d5347ba966..0db89093ff89 100644
>> --- a/arch/riscv/net/bpf_jit_comp64.c
>> +++ b/arch/riscv/net/bpf_jit_comp64.c
>> @@ -1986,7 +1986,10 @@ int bpf_jit_emit_insn(const struct bpf_insn *insn, struct rv_jit_context *ctx,
>>  		else
>>  			ret = emit_atomic_rmw(rd, rs, insn, ctx);
>>  
>> -		ret = ret ?: add_exception_handler(insn, REG_DONT_CLEAR_MARKER, ctx);
>> +		/* ret can be 1 (skip-zext); extable entry still needs to be added */
>> +		if (ret >= 0)
>> +			ret = add_exception_handler(insn, REG_DONT_CLEAR_MARKER, ctx) ?: ret;
> 
> I don't agree with Sashiko that this was fully pre-existing. This fix
> changes the existing behaviour of BPF_DW | BPF_LOAD_ACQ. We can now end
> up with stale register data.
> 
> I'd like to see a v3 that addresses REG_DONT_CLEAR_MARKER for atomic
> loads (zext included).
> 
> 
> Björn

Thanks Björn, makes sense. LOAD_ACQ is just a load into rd, so on a
fault it should zero rd like PROBE_MEM does. I'll do a v3 that passes
rd for LOAD_ACQ, the other atomic ops keep REG_DONT_CLEAR_MARKER.

-- 
With Best Regards,
Feng Jiang