Re: [PATCH bpf-next v2 2/2] selftests/bpf: Cover mixed arena and stack atomics

On 8/16/26 4:36 PM, Eduard Zingerman wrote:
> On Sun, 2026-08-16 at 16:17 -0700, Eduard Zingerman wrote:
>> On Sun, 2026-08-16 at 10:56 +0000, Yiyang Chen wrote:
>>> Add a verifier test with one atomic RMW instruction reached through
>>> PTR_TO_ARENA and PTR_TO_STACK paths. The verifier must reject the
>>> shared instruction with the existing incompatible-pointer diagnostic.
>>>
>>> Signed-off-by: Yiyang Chen <[email protected]>
>>> ---
>>>   tools/testing/selftests/bpf/progs/verifier_arena.c | 39 ++++++++++++++++++++++
>>>   1 file changed, 39 insertions(+)
>>>
>>> diff --git a/tools/testing/selftests/bpf/progs/verifier_arena.c b/tools/testing/selftests/bpf/progs/verifier_arena.c
>>> index b241bbcf54a8a..b22bab33301ab 100644
>>> --- a/tools/testing/selftests/bpf/progs/verifier_arena.c
>>> +++ b/tools/testing/selftests/bpf/progs/verifier_arena.c
>>> @@ -637,6 +637,45 @@ int non_arena_ptr_add_to_arena_ptr(void *ctx)
>>>   
>>>   #endif
>>>   
>>> +static const struct bpf_insn addr_space_cast_insn = {
>>> +	.code = 0xbf,
>>> +	.dst_reg = BPF_REG_7,
>>> +	.src_reg = BPF_REG_7,
>>> +	.off = 1,
>>> +	.imm = 1,
>>> +};
>>> +
>>> +SEC("socket")
>>> +__description("arena and stack atomic at the same instruction")
>>> +__failure __msg("same insn cannot be used with different pointers")
>>> +__arch_x86_64
>>> +__load_if_JITed()
>>> +__naked void mixed_arena_stack_atomic(void)
>>> +{
>>> +	asm volatile ("					\
>>> +	r1 = %[arena] ll;				\
>>> +	r6 = r10;					\
>>> +	r6 += -8;					\
>>> +	r9 = 0;					\
>>> +	*(u64 *)(r6 + 0) = r9;			\
>>> +	r7 = 8192;					\
>>> +	.8byte %[addr_space_cast];			\
>> I'm going to fix this to:
>>
>> 	r7 = addr_space_cast(r7, 0, 1);			\
>>
>> as in the test case above.
>> Waiting for CI [1].
>>
>> [1] https://github.com/kernel-patches/bpf/pull/13325
>
> A...and it requires another exception for GCC-BPF:
> https://github.com/kernel-patches/bpf/blob/bpf-next_base/ci/vmtest/configs/DENYLIST.test_progs-bpf_gcc
>
> Ihor, it's a third time GCC-BPF strikes this weekend.
> What do people think about downgrading it to may-fail until the
> DENYLIST decreases to something reasonable?

While bpf-gcc is improving, slowly, we can in parallel do alittle better 
on test hygiene as well. In this case by correctly bracketing the tests 
with _BPF_FEATURE_XXX.

Co-incidently I have a series in works from an accidental discovery of 
llvm-only testing coverage (rely solely on __clang_version macro) which 
I'll follow up on the list shortly.

Thx,
-Vineet


>
> Anyway, I'll wrap-up with this patch-set in the evening.
>
>>> +	call %[bpf_get_prandom_u32];			\
>>> +	if w0 != 0 goto 1f;				\
>>> +	r8 = r6;					\
>>> +	goto 2f;					\
>>> +1:	r8 = r7;					\
>>> +2:	r9 = 1;					\
>>> +	lock *(u64 *)(r8 + 0) += r9;			\
>>> +	r0 = 0;					\
>>> +	exit;						\
>>> +"	:
>>> +	: __imm_addr(arena),
>>> +	  __imm_insn(addr_space_cast, addr_space_cast_insn),
>>> +	  __imm(bpf_get_prandom_u32)
>>> +	: __clobber_all);
>>> +}
>>> +
>>>   static __noinline
>>>   u32 __arena *check_arena_arg_nonglobal(u32 __arena *arg)
>>>   {