* [PATCH bpf-next v5 1/3] bpf, riscv: add support for timed may_goto
2026-07-23 5:41 [PATCH bpf-next v5 0/3] bpf, riscv: add timed may_goto support Feng Jiang
@ 2026-07-23 5:41 ` Feng Jiang
2026-07-23 5:41 ` [PATCH bpf-next v5 2/3] selftests/bpf: test timed may_goto preserves R0-R5 Feng Jiang
` (3 subsequent siblings)
4 siblings, 0 replies; 7+ messages in thread
From: Feng Jiang @ 2026-07-23 5:41 UTC (permalink / raw)
To: Alexei Starovoitov, Daniel Borkmann, Andrii Nakryiko,
Eduard Zingerman, Kumar Kartikeya Dwivedi, Martin KaFai Lau,
Song Liu, Yonghong Song, Jiri Olsa, Emil Tsalapatis, Luke Nelson,
Xi Wang, Björn Töpel, Pu Lehui, Puranjay Mohan,
Paul Walmsley, Palmer Dabbelt, Albert Ou, Alexandre Ghiti,
Shuah Khan, Ihor Solodrai
Cc: bpf, linux-riscv, linux-kernel, linux-kselftest, Feng Jiang
Implement arch_bpf_timed_may_goto() for the RV64 JIT. The argument and
return value are carried in BPF_REG_AX, and BPF R0-R5 are preserved
across the call to the generic bpf_check_timed_may_goto().
Enable bpf_jit_supports_timed_may_goto() so the verifier uses the timed
expansion path.
Signed-off-by: Feng Jiang <jiangfeng@kylinos.cn>
---
arch/riscv/net/Makefile | 2 +-
arch/riscv/net/bpf_jit_comp64.c | 12 +++++++++-
arch/riscv/net/bpf_timed_may_goto.S | 47 +++++++++++++++++++++++++++++++++++++
3 files changed, 59 insertions(+), 2 deletions(-)
diff --git a/arch/riscv/net/Makefile b/arch/riscv/net/Makefile
index 9a1e5f0a94e5..6458d4d51990 100644
--- a/arch/riscv/net/Makefile
+++ b/arch/riscv/net/Makefile
@@ -3,7 +3,7 @@
obj-$(CONFIG_BPF_JIT) += bpf_jit_core.o
ifeq ($(CONFIG_ARCH_RV64I),y)
- obj-$(CONFIG_BPF_JIT) += bpf_jit_comp64.o
+ obj-$(CONFIG_BPF_JIT) += bpf_jit_comp64.o bpf_timed_may_goto.o
else
obj-$(CONFIG_BPF_JIT) += bpf_jit_comp32.o
endif
diff --git a/arch/riscv/net/bpf_jit_comp64.c b/arch/riscv/net/bpf_jit_comp64.c
index ad089a9a4ea9..8fe8969fb8a0 100644
--- a/arch/riscv/net/bpf_jit_comp64.c
+++ b/arch/riscv/net/bpf_jit_comp64.c
@@ -1841,7 +1841,12 @@ int bpf_jit_emit_insn(const struct bpf_insn *insn, struct rv_jit_context *ctx,
if (aux->tail_call_reachable && insn->src_reg == BPF_PSEUDO_CALL)
emit_sd(RV_REG_SP, ctx->tcc_offset, RV_REG_TCC, ctx);
- if (insn->src_reg != BPF_PSEUDO_CALL)
+ /*
+ * arch_bpf_timed_may_goto() is emitted by the verifier and
+ * returns its result in BPF_REG_AX instead of BPF_REG_0, so
+ * skip the normal "move return register into R0".
+ */
+ if (insn->src_reg != BPF_PSEUDO_CALL && addr != (u64)arch_bpf_timed_may_goto)
emit_mv(bpf_to_rv_reg(BPF_REG_0, ctx), RV_REG_A0, ctx);
break;
}
@@ -2161,3 +2166,8 @@ bool bpf_jit_supports_subprog_tailcalls(void)
{
return true;
}
+
+bool bpf_jit_supports_timed_may_goto(void)
+{
+ return true;
+}
diff --git a/arch/riscv/net/bpf_timed_may_goto.S b/arch/riscv/net/bpf_timed_may_goto.S
new file mode 100644
index 000000000000..02c637d87420
--- /dev/null
+++ b/arch/riscv/net/bpf_timed_may_goto.S
@@ -0,0 +1,47 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+/* Copyright (c) 2026 Feng Jiang <jiangfeng@kylinos.cn> */
+
+#include <linux/linkage.h>
+#include <asm/asm.h>
+
+/*
+ * Trampoline for the BPF timed may_goto loop bound. Custom calling convention:
+ * - input: stack offset in BPF_REG_AX (t0)
+ * - output: updated count in BPF_REG_AX (t0)
+ *
+ * Calls bpf_check_timed_may_goto(ptr) with the standard RISC-V ABI, where
+ * ptr = BPF_REG_FP (s5) + BPF_REG_AX (t0). BPF R0-R5 (a5, a0-a4) are saved
+ * across the call; BPF_REG_FP (s5) is callee-saved and needs no saving.
+ */
+
+SYM_FUNC_START(arch_bpf_timed_may_goto)
+ addi sp, sp, -(8*SZREG)
+ REG_S ra, 7*SZREG(sp)
+ REG_S s0, 6*SZREG(sp)
+ addi s0, sp, 8*SZREG
+
+ /* Save BPF registers R0-R5 (a5, a0-a4) */
+ REG_S a5, 5*SZREG(sp)
+ REG_S a0, 4*SZREG(sp)
+ REG_S a1, 3*SZREG(sp)
+ REG_S a2, 2*SZREG(sp)
+ REG_S a3, 1*SZREG(sp)
+ REG_S a4, 0*SZREG(sp)
+
+ add a0, t0, s5
+ call bpf_check_timed_may_goto
+ mv t0, a0
+
+ /* Restore BPF registers R0-R5 */
+ REG_L a4, 0*SZREG(sp)
+ REG_L a3, 1*SZREG(sp)
+ REG_L a2, 2*SZREG(sp)
+ REG_L a1, 3*SZREG(sp)
+ REG_L a0, 4*SZREG(sp)
+ REG_L a5, 5*SZREG(sp)
+
+ REG_L s0, 6*SZREG(sp)
+ REG_L ra, 7*SZREG(sp)
+ addi sp, sp, 8*SZREG
+ ret
+SYM_FUNC_END(arch_bpf_timed_may_goto)
--
2.53.0
^ permalink raw reply related [flat|nested] 7+ messages in thread* [PATCH bpf-next v5 2/3] selftests/bpf: test timed may_goto preserves R0-R5
2026-07-23 5:41 [PATCH bpf-next v5 0/3] bpf, riscv: add timed may_goto support Feng Jiang
2026-07-23 5:41 ` [PATCH bpf-next v5 1/3] bpf, riscv: add support for timed may_goto Feng Jiang
@ 2026-07-23 5:41 ` Feng Jiang
2026-07-23 5:41 ` [PATCH bpf-next v5 3/3] selftests/bpf: enable timed may_goto tests for riscv64 Feng Jiang
` (2 subsequent siblings)
4 siblings, 0 replies; 7+ messages in thread
From: Feng Jiang @ 2026-07-23 5:41 UTC (permalink / raw)
To: Alexei Starovoitov, Daniel Borkmann, Andrii Nakryiko,
Eduard Zingerman, Kumar Kartikeya Dwivedi, Martin KaFai Lau,
Song Liu, Yonghong Song, Jiri Olsa, Emil Tsalapatis, Luke Nelson,
Xi Wang, Björn Töpel, Pu Lehui, Puranjay Mohan,
Paul Walmsley, Palmer Dabbelt, Albert Ou, Alexandre Ghiti,
Shuah Khan, Ihor Solodrai
Cc: bpf, linux-riscv, linux-kernel, linux-kselftest, Feng Jiang
Add a test that checks R0-R5 are preserved across
arch_bpf_timed_may_goto() calls.
Use bpf_get_prandom_u32() to avoid the verifier removing the checks
via DCE.
Suggested-by: Björn Töpel <bjorn@kernel.org>
Signed-off-by: Feng Jiang <jiangfeng@kylinos.cn>
---
.../selftests/bpf/progs/verifier_may_goto_1.c | 58 ++++++++++++++++++++++
1 file changed, 58 insertions(+)
diff --git a/tools/testing/selftests/bpf/progs/verifier_may_goto_1.c b/tools/testing/selftests/bpf/progs/verifier_may_goto_1.c
index 4bdf4256a41e..cb1ce4d13cfc 100644
--- a/tools/testing/selftests/bpf/progs/verifier_may_goto_1.c
+++ b/tools/testing/selftests/bpf/progs/verifier_may_goto_1.c
@@ -106,4 +106,62 @@ __naked void may_goto_batch_2(void)
: __clobber_all);
}
+/*
+ * Use bpf_get_prandom_u32() to prevent DCE from removing the checks.
+ * retval: 0=all ok, 1-6=R0-R5 clobbered.
+ */
+SEC("syscall")
+__description("timed may_goto preserves R0-R5")
+__arch_x86_64
+__arch_s390x
+__arch_arm64
+__arch_riscv64
+__success
+__retval(0)
+__naked void timed_may_goto_preserves_regs(void)
+{
+ asm volatile (
+ "call %[bpf_get_prandom_u32];"
+ "r6 = r0;"
+ "r0 = 0x1111;"
+ "r0 += r6;"
+ "r1 = 0x2222;"
+ "r1 += r6;"
+ "r2 = 0x3333;"
+ "r2 += r6;"
+ "r3 = 0x4444;"
+ "r3 += r6;"
+ "r4 = 0x5555;"
+ "r4 += r6;"
+ "r5 = 0x6666;"
+ "r5 += r6;"
+ ".8byte %[may_goto];"
+ ".8byte %[loop];"
+ "r0 -= r6;"
+ "r1 -= r6;"
+ "r2 -= r6;"
+ "r3 -= r6;"
+ "r4 -= r6;"
+ "r5 -= r6;"
+ "if r0 != 0x1111 goto 1f;"
+ "if r1 != 0x2222 goto 2f;"
+ "if r2 != 0x3333 goto 3f;"
+ "if r3 != 0x4444 goto 4f;"
+ "if r4 != 0x5555 goto 5f;"
+ "if r5 != 0x6666 goto 6f;"
+ "r0 = 0;"
+ "exit;"
+ "1: r0 = 1; exit;"
+ "2: r0 = 2; exit;"
+ "3: r0 = 3; exit;"
+ "4: r0 = 4; exit;"
+ "5: r0 = 5; exit;"
+ "6: r0 = 6; exit;"
+ :
+ : __imm(bpf_get_prandom_u32),
+ __imm_insn(may_goto, BPF_RAW_INSN(BPF_JMP | BPF_JCOND, 0, 0, 1, 0)),
+ __imm_insn(loop, BPF_RAW_INSN(BPF_JMP | BPF_JA, 0, 0, -2, 0))
+ : __clobber_all);
+}
+
char _license[] SEC("license") = "GPL";
--
2.53.0
^ permalink raw reply related [flat|nested] 7+ messages in thread* [PATCH bpf-next v5 3/3] selftests/bpf: enable timed may_goto tests for riscv64
2026-07-23 5:41 [PATCH bpf-next v5 0/3] bpf, riscv: add timed may_goto support Feng Jiang
2026-07-23 5:41 ` [PATCH bpf-next v5 1/3] bpf, riscv: add support for timed may_goto Feng Jiang
2026-07-23 5:41 ` [PATCH bpf-next v5 2/3] selftests/bpf: test timed may_goto preserves R0-R5 Feng Jiang
@ 2026-07-23 5:41 ` Feng Jiang
[not found] ` <15ceb481-ae3e-4c51-aeb7-513a3d213959@huawei.com>
2026-07-24 19:52 ` [PATCH bpf-next v5 0/3] bpf, riscv: add timed may_goto support Björn Töpel
2026-07-24 20:40 ` patchwork-bot+netdevbpf
4 siblings, 1 reply; 7+ messages in thread
From: Feng Jiang @ 2026-07-23 5:41 UTC (permalink / raw)
To: Alexei Starovoitov, Daniel Borkmann, Andrii Nakryiko,
Eduard Zingerman, Kumar Kartikeya Dwivedi, Martin KaFai Lau,
Song Liu, Yonghong Song, Jiri Olsa, Emil Tsalapatis, Luke Nelson,
Xi Wang, Björn Töpel, Pu Lehui, Puranjay Mohan,
Paul Walmsley, Palmer Dabbelt, Albert Ou, Alexandre Ghiti,
Shuah Khan, Ihor Solodrai
Cc: bpf, linux-riscv, linux-kernel, linux-kselftest, Feng Jiang
Enable verifier_may_goto_1 (raw instruction tests), stream_cond_break
(250ms timeout path), and the may_goto_interaction fastcall test on
riscv64 now that the JIT supports timed may_goto.
Reviewed-by: Pu Lehui <pulehui@huawei.com>
Signed-off-by: Feng Jiang <jiangfeng@kylinos.cn>
---
tools/testing/selftests/bpf/progs/stream.c | 1 +
tools/testing/selftests/bpf/progs/verifier_bpf_fastcall.c | 3 ++-
tools/testing/selftests/bpf/progs/verifier_may_goto_1.c | 4 ++++
3 files changed, 7 insertions(+), 1 deletion(-)
diff --git a/tools/testing/selftests/bpf/progs/stream.c b/tools/testing/selftests/bpf/progs/stream.c
index 92ba1d72e0ec..8d8e53d37266 100644
--- a/tools/testing/selftests/bpf/progs/stream.c
+++ b/tools/testing/selftests/bpf/progs/stream.c
@@ -64,6 +64,7 @@ SEC("syscall")
__arch_x86_64
__arch_arm64
__arch_s390x
+__arch_riscv64
__success __retval(0)
__stderr("ERROR: Timeout detected for may_goto instruction")
__stderr("CPU: {{[0-9]+}} UID: 0 PID: {{[0-9]+}} Comm: {{.*}}")
diff --git a/tools/testing/selftests/bpf/progs/verifier_bpf_fastcall.c b/tools/testing/selftests/bpf/progs/verifier_bpf_fastcall.c
index 8d7ff38e4c06..83707faea049 100644
--- a/tools/testing/selftests/bpf/progs/verifier_bpf_fastcall.c
+++ b/tools/testing/selftests/bpf/progs/verifier_bpf_fastcall.c
@@ -660,6 +660,7 @@ __naked void may_goto_interaction_x86_64(void)
SEC("raw_tp")
__arch_arm64
+__arch_riscv64
__log_level(4) __msg("stack depth 24")
/* may_goto counter at -24 */
__xlated("0: *(u64 *)(r10 -24) =")
@@ -679,7 +680,7 @@ __xlated("10: *(u64 *)(r10 -24) = r12")
__xlated("11: *(u64 *)(r10 -8) = r1")
__xlated("12: exit")
__success
-__naked void may_goto_interaction_arm64(void)
+__naked void may_goto_interaction(void)
{
asm volatile (
"r1 = 1;"
diff --git a/tools/testing/selftests/bpf/progs/verifier_may_goto_1.c b/tools/testing/selftests/bpf/progs/verifier_may_goto_1.c
index cb1ce4d13cfc..0e211f030d0d 100644
--- a/tools/testing/selftests/bpf/progs/verifier_may_goto_1.c
+++ b/tools/testing/selftests/bpf/progs/verifier_may_goto_1.c
@@ -11,6 +11,7 @@ __description("may_goto 0")
__arch_x86_64
__arch_s390x
__arch_arm64
+__arch_riscv64
__xlated("0: r0 = 1")
__xlated("1: exit")
__success
@@ -31,6 +32,7 @@ __description("batch 2 of may_goto 0")
__arch_x86_64
__arch_s390x
__arch_arm64
+__arch_riscv64
__xlated("0: r0 = 1")
__xlated("1: exit")
__success
@@ -53,6 +55,7 @@ __description("may_goto batch with offsets 2/1/0")
__arch_x86_64
__arch_s390x
__arch_arm64
+__arch_riscv64
__xlated("0: r0 = 1")
__xlated("1: exit")
__success
@@ -79,6 +82,7 @@ __description("may_goto batch with offsets 2/0")
__arch_x86_64
__arch_s390x
__arch_arm64
+__arch_riscv64
__xlated("0: *(u64 *)(r10 -16) = 65535")
__xlated("1: *(u64 *)(r10 -8) = 0")
__xlated("2: r12 = *(u64 *)(r10 -16)")
--
2.53.0
^ permalink raw reply related [flat|nested] 7+ messages in thread* Re: [PATCH bpf-next v5 0/3] bpf, riscv: add timed may_goto support
2026-07-23 5:41 [PATCH bpf-next v5 0/3] bpf, riscv: add timed may_goto support Feng Jiang
` (2 preceding siblings ...)
2026-07-23 5:41 ` [PATCH bpf-next v5 3/3] selftests/bpf: enable timed may_goto tests for riscv64 Feng Jiang
@ 2026-07-24 19:52 ` Björn Töpel
2026-07-24 20:40 ` patchwork-bot+netdevbpf
4 siblings, 0 replies; 7+ messages in thread
From: Björn Töpel @ 2026-07-24 19:52 UTC (permalink / raw)
To: Feng Jiang, Alexei Starovoitov, Daniel Borkmann, Andrii Nakryiko,
Eduard Zingerman, Kumar Kartikeya Dwivedi, Martin KaFai Lau,
Song Liu, Yonghong Song, Jiri Olsa, Emil Tsalapatis, Luke Nelson,
Xi Wang, Pu Lehui, Puranjay Mohan, Paul Walmsley, Palmer Dabbelt,
Albert Ou, Alexandre Ghiti, Shuah Khan, Ihor Solodrai
Cc: bpf, linux-riscv, linux-kernel, linux-kselftest, Feng Jiang
Feng Jiang <jiangfeng@kylinos.cn> writes:
> This series adds RISC-V JIT support for the timed may_goto loop bound.
>
> Patch 1 implements arch_bpf_timed_may_goto() and enables
> bpf_jit_supports_timed_may_goto() so the verifier uses the timed
> expansion path.
>
> Patch 2 adds a test that checks R0-R5 are preserved across
> arch_bpf_timed_may_goto() calls.
>
> Patch 3 enables the verifier_may_goto_1, stream_cond_break, and
> may_goto_interaction fastcall tests on riscv64.
>
> Tested on riscv64 QEMU (rva23s64): may_goto programs load and JIT
> correctly, and the 250ms timeout path works as expected.
>
> Signed-off-by: Feng Jiang <jiangfeng@kylinos.cn>
Nice!
Reviewed-by: Björn Töpel <bjorn@kernel.org>
Acked-by: Björn Töpel <bjorn@kernel.org>
^ permalink raw reply [flat|nested] 7+ messages in thread* Re: [PATCH bpf-next v5 0/3] bpf, riscv: add timed may_goto support
2026-07-23 5:41 [PATCH bpf-next v5 0/3] bpf, riscv: add timed may_goto support Feng Jiang
` (3 preceding siblings ...)
2026-07-24 19:52 ` [PATCH bpf-next v5 0/3] bpf, riscv: add timed may_goto support Björn Töpel
@ 2026-07-24 20:40 ` patchwork-bot+netdevbpf
4 siblings, 0 replies; 7+ messages in thread
From: patchwork-bot+netdevbpf @ 2026-07-24 20:40 UTC (permalink / raw)
To: Feng Jiang
Cc: ast, daniel, andrii, eddyz87, memxor, martin.lau, song,
yonghong.song, jolsa, emil, luke.r.nels, xi.wang, bjorn, pulehui,
puranjay, pjw, palmer, aou, alex, shuah, ihor.solodrai, bpf,
linux-riscv, linux-kernel, linux-kselftest
Hello:
This series was applied to bpf/bpf-next.git (master)
by Kumar Kartikeya Dwivedi <memxor@gmail.com>:
On Thu, 23 Jul 2026 05:41:31 +0000 you wrote:
> This series adds RISC-V JIT support for the timed may_goto loop bound.
>
> Patch 1 implements arch_bpf_timed_may_goto() and enables
> bpf_jit_supports_timed_may_goto() so the verifier uses the timed
> expansion path.
>
> Patch 2 adds a test that checks R0-R5 are preserved across
> arch_bpf_timed_may_goto() calls.
>
> [...]
Here is the summary with links:
- [bpf-next,v5,1/3] bpf, riscv: add support for timed may_goto
https://git.kernel.org/bpf/bpf-next/c/6ef8ff20c30b
- [bpf-next,v5,2/3] selftests/bpf: test timed may_goto preserves R0-R5
https://git.kernel.org/bpf/bpf-next/c/a0032241aa14
- [bpf-next,v5,3/3] selftests/bpf: enable timed may_goto tests for riscv64
https://git.kernel.org/bpf/bpf-next/c/3c2be3cbeb1b
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply [flat|nested] 7+ messages in thread