On Tue, 2026-08-18 at 12:35 -0700, Vineet Gupta wrote:
> On 8/16/26 4:36 PM, Eduard Zingerman wrote:
> > On Sun, 2026-08-16 at 16:17 -0700, Eduard Zingerman wrote:
> > > On Sun, 2026-08-16 at 10:56 +0000, Yiyang Chen wrote:
> > > > Add a verifier test with one atomic RMW instruction reached through
> > > > PTR_TO_ARENA and PTR_TO_STACK paths. The verifier must reject the
> > > > shared instruction with the existing incompatible-pointer diagnostic.
> > > >
> > > > Signed-off-by: Yiyang Chen <[email protected]>
> > > > ---
> > > > tools/testing/selftests/bpf/progs/verifier_arena.c | 39
> > > > ++++++++++++++++++++++
> > > > 1 file changed, 39 insertions(+)
> > > >
> > > > diff --git a/tools/testing/selftests/bpf/progs/verifier_arena.c
> > > > b/tools/testing/selftests/bpf/progs/verifier_arena.c
> > > > index b241bbcf54a8a..b22bab33301ab 100644
> > > > --- a/tools/testing/selftests/bpf/progs/verifier_arena.c
> > > > +++ b/tools/testing/selftests/bpf/progs/verifier_arena.c
> > > > @@ -637,6 +637,45 @@ int non_arena_ptr_add_to_arena_ptr(void *ctx)
> > > >
> > > > #endif
> > > >
> > > > +static const struct bpf_insn addr_space_cast_insn = {
> > > > + .code = 0xbf,
> > > > + .dst_reg = BPF_REG_7,
> > > > + .src_reg = BPF_REG_7,
> > > > + .off = 1,
> > > > + .imm = 1,
> > > > +};
> > > > +
> > > > +SEC("socket")
> > > > +__description("arena and stack atomic at the same instruction")
> > > > +__failure __msg("same insn cannot be used with different pointers")
> > > > +__arch_x86_64
> > > > +__load_if_JITed()
> > > > +__naked void mixed_arena_stack_atomic(void)
> > > > +{
> > > > + asm volatile (" \
> > > > + r1 = %[arena] ll; \
> > > > + r6 = r10; \
> > > > + r6 += -8; \
> > > > + r9 = 0; \
> > > > + *(u64 *)(r6 + 0) = r9; \
> > > > + r7 = 8192; \
> > > > + .8byte %[addr_space_cast]; \
> > > I'm going to fix this to:
> > >
> > > r7 = addr_space_cast(r7, 0, 1); \
> > >
> > > as in the test case above.
> > > Waiting for CI [1].
> > >
> > > [1] https://github.com/kernel-patches/bpf/pull/13325
> >
> > A...and it requires another exception for GCC-BPF:
> > https://github.com/kernel-patches/bpf/blob/bpf-next_base/ci/vmtest/configs/DENYLIST.test_progs-bpf_gcc
> >
> > Ihor, it's a third time GCC-BPF strikes this weekend.
> > What do people think about downgrading it to may-fail until the
> > DENYLIST decreases to something reasonable?
>
> While bpf-gcc is improving, slowly, we can in parallel do alittle better
> on test hygiene as well. In this case by correctly bracketing the tests
> with _BPF_FEATURE_XXX.
Yes, that's what I ended up doing. Should have paid attention to the
#if .. #endif bracket used by the textually preceding test.
Sorry for lashing out.
> Co-incidently I have a series in works from an accidental discovery of
> llvm-only testing coverage (rely solely on __clang_version macro) which
> I'll follow up on the list shortly.
>
> Thx,
> -Vineet
>
>
> >
> > Anyway, I'll wrap-up with this patch-set in the evening.
> >
> > > > + call %[bpf_get_prandom_u32]; \
> > > > + if w0 != 0 goto 1f; \
> > > > + r8 = r6; \
> > > > + goto 2f; \
> > > > +1: r8 = r7; \
> > > > +2: r9 = 1; \
> > > > + lock *(u64 *)(r8 + 0) += r9; \
> > > > + r0 = 0; \
> > > > + exit; \
> > > > +" :
> > > > + : __imm_addr(arena),
> > > > + __imm_insn(addr_space_cast, addr_space_cast_insn),
> > > > + __imm(bpf_get_prandom_u32)
> > > > + : __clobber_all);
> > > > +}
> > > > +
> > > > static __noinline
> > > > u32 __arena *check_arena_arg_nonglobal(u32 __arena *arg)
> > > > {
