[PATCH 0/2] bpf, riscv: add timed may_goto support

[PATCH 0/2] bpf, riscv: add timed may_goto support

[Feng Jiang]

This series adds RISC-V JIT support for the timed may_goto loop bound.

Patch 1 implements arch_bpf_timed_may_goto() and enables
bpf_jit_supports_timed_may_goto() so the verifier uses the timed
expansion path.

Patch 2 enables verifier_may_goto_1 and stream_cond_break on riscv64.

Tested on riscv64 QEMU (rva23s64): may_goto programs load and JIT
correctly, and the 250ms timeout path works as expected.

Signed-off-by: Feng Jiang <jiangfeng@kylinos.cn>
---
Feng Jiang (2):
      bpf, riscv: add support for timed may_goto
      selftests/bpf: enable timed may_goto tests for riscv64

 arch/riscv/net/Makefile                            |  2 +-
 arch/riscv/net/bpf_jit_comp64.c                    |  5 +++
 arch/riscv/net/bpf_timed_may_goto.S                | 44 ++++++++++++++++++++++
 tools/testing/selftests/bpf/progs/stream.c         |  1 +
 .../selftests/bpf/progs/verifier_may_goto_1.c      |  4 ++
 5 files changed, 55 insertions(+), 1 deletion(-)
---
base-commit: dc59e4fea9d83f03bad6bddf3fa2e52491777482
change-id: 20260710-riscv-bpf-timed-may-goto-0dce564985af

Best regards,
-- 
Feng Jiang <jiangfeng@kylinos.cn>

[PATCH 1/2] bpf, riscv: add support for timed may_goto

[Feng Jiang]

Implement arch_bpf_timed_may_goto() for the RV64 JIT. The argument and
return value are carried in BPF_REG_AX, and BPF R0-R5 are preserved
across the call to the generic bpf_check_timed_may_goto().

Enable bpf_jit_supports_timed_may_goto() so the verifier uses the timed
expansion path.

Signed-off-by: Feng Jiang <jiangfeng@kylinos.cn>
---
 arch/riscv/net/Makefile             |  2 +-
 arch/riscv/net/bpf_jit_comp64.c     |  5 +++++
 arch/riscv/net/bpf_timed_may_goto.S | 44 +++++++++++++++++++++++++++++++++++++
 3 files changed, 50 insertions(+), 1 deletion(-)

diff --git a/arch/riscv/net/Makefile b/arch/riscv/net/Makefile
index 9a1e5f0a94e5..6458d4d51990 100644
--- a/arch/riscv/net/Makefile
+++ b/arch/riscv/net/Makefile
@@ -3,7 +3,7 @@
 obj-$(CONFIG_BPF_JIT) += bpf_jit_core.o
 
 ifeq ($(CONFIG_ARCH_RV64I),y)
-	obj-$(CONFIG_BPF_JIT) += bpf_jit_comp64.o
+	obj-$(CONFIG_BPF_JIT) += bpf_jit_comp64.o bpf_timed_may_goto.o
 else
 	obj-$(CONFIG_BPF_JIT) += bpf_jit_comp32.o
 endif
diff --git a/arch/riscv/net/bpf_jit_comp64.c b/arch/riscv/net/bpf_jit_comp64.c
index c03c1de16b79..9832a19200c7 100644
--- a/arch/riscv/net/bpf_jit_comp64.c
+++ b/arch/riscv/net/bpf_jit_comp64.c
@@ -2157,3 +2157,8 @@ bool bpf_jit_supports_fsession(void)
 {
 	return true;
 }
+
+bool bpf_jit_supports_timed_may_goto(void)
+{
+	return true;
+}
diff --git a/arch/riscv/net/bpf_timed_may_goto.S b/arch/riscv/net/bpf_timed_may_goto.S
new file mode 100644
index 000000000000..f54f389d921e
--- /dev/null
+++ b/arch/riscv/net/bpf_timed_may_goto.S
@@ -0,0 +1,44 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+/* Copyright (c) 2026 Feng Jiang <jiangfeng@kylinos.cn> */
+
+#include <linux/linkage.h>
+#include <asm/asm.h>
+
+/*
+ * Trampoline for the BPF timed may_goto loop bound. Custom calling convention:
+ *	- input:  stack offset in BPF_REG_AX (t0)
+ *	- output: updated count in BPF_REG_AX (t0)
+ *
+ * Calls bpf_check_timed_may_goto(ptr) with the standard RISC-V ABI, where
+ * ptr = BPF_REG_FP (s5) + BPF_REG_AX (t0). BPF R0-R5 (a5, a0-a4) are saved
+ * across the call; BPF_REG_FP (s5) is callee-saved and needs no saving.
+ */
+
+SYM_FUNC_START(arch_bpf_timed_may_goto)
+	addi	sp, sp, -64
+	sd	ra, 56(sp)
+
+	/* Save BPF registers R0-R5 (a5, a0-a4) */
+	sd	a5, 48(sp)
+	sd	a0, 40(sp)
+	sd	a1, 32(sp)
+	sd	a2, 24(sp)
+	sd	a3, 16(sp)
+	sd	a4, 8(sp)
+
+	add	a0, t0, s5
+	call	bpf_check_timed_may_goto
+	mv	t0, a0
+
+	/* Restore BPF registers R0-R5 */
+	ld	a4, 8(sp)
+	ld	a3, 16(sp)
+	ld	a2, 24(sp)
+	ld	a1, 32(sp)
+	ld	a0, 40(sp)
+	ld	a5, 48(sp)
+
+	ld	ra, 56(sp)
+	addi	sp, sp, 64
+	ret
+SYM_FUNC_END(arch_bpf_timed_may_goto)

-- 
2.25.1

[PATCH 2/2] selftests/bpf: enable timed may_goto tests for riscv64

[Feng Jiang]

Enable verifier_may_goto_1 (raw instruction tests) and stream_cond_break
(250ms timeout path) on riscv64 now that the JIT supports timed may_goto.

Signed-off-by: Feng Jiang <jiangfeng@kylinos.cn>
---
 tools/testing/selftests/bpf/progs/stream.c              | 1 +
 tools/testing/selftests/bpf/progs/verifier_may_goto_1.c | 4 ++++
 2 files changed, 5 insertions(+)

diff --git a/tools/testing/selftests/bpf/progs/stream.c b/tools/testing/selftests/bpf/progs/stream.c
index 92ba1d72e0ec..8d8e53d37266 100644
--- a/tools/testing/selftests/bpf/progs/stream.c
+++ b/tools/testing/selftests/bpf/progs/stream.c
@@ -64,6 +64,7 @@ SEC("syscall")
 __arch_x86_64
 __arch_arm64
 __arch_s390x
+__arch_riscv64
 __success __retval(0)
 __stderr("ERROR: Timeout detected for may_goto instruction")
 __stderr("CPU: {{[0-9]+}} UID: 0 PID: {{[0-9]+}} Comm: {{.*}}")
diff --git a/tools/testing/selftests/bpf/progs/verifier_may_goto_1.c b/tools/testing/selftests/bpf/progs/verifier_may_goto_1.c
index 4bdf4256a41e..f47b9d540a17 100644
--- a/tools/testing/selftests/bpf/progs/verifier_may_goto_1.c
+++ b/tools/testing/selftests/bpf/progs/verifier_may_goto_1.c
@@ -11,6 +11,7 @@ __description("may_goto 0")
 __arch_x86_64
 __arch_s390x
 __arch_arm64
+__arch_riscv64
 __xlated("0: r0 = 1")
 __xlated("1: exit")
 __success
@@ -31,6 +32,7 @@ __description("batch 2 of may_goto 0")
 __arch_x86_64
 __arch_s390x
 __arch_arm64
+__arch_riscv64
 __xlated("0: r0 = 1")
 __xlated("1: exit")
 __success
@@ -53,6 +55,7 @@ __description("may_goto batch with offsets 2/1/0")
 __arch_x86_64
 __arch_s390x
 __arch_arm64
+__arch_riscv64
 __xlated("0: r0 = 1")
 __xlated("1: exit")
 __success
@@ -79,6 +82,7 @@ __description("may_goto batch with offsets 2/0")
 __arch_x86_64
 __arch_s390x
 __arch_arm64
+__arch_riscv64
 __xlated("0: *(u64 *)(r10 -16) = 65535")
 __xlated("1: *(u64 *)(r10 -8) = 0")
 __xlated("2: r12 = *(u64 *)(r10 -16)")

-- 
2.25.1

Re: [PATCH 1/2] bpf, riscv: add support for timed may_goto

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Critical] The RISC-V BPF JIT unconditionally moves the native return value (a0) into BPF_REG_0 (a5) after calling arch_bpf_timed_may_goto, silently corrupting BPF_REG_0.
--

--- Patch [1]: [PATCH 1/2] bpf, riscv: add support for timed may_goto ---
commit ed55df1d87b981cbd59d17bd2c3b607f3fa418d9
Author: Feng Jiang <jiangfeng@kylinos.cn>

bpf, riscv: add support for timed may_goto

This patch implements arch_bpf_timed_may_goto() for the RV64 JIT. It also
enables bpf_jit_supports_timed_may_goto() to allow the verifier to use the
timed expansion path. The assembly trampoline is designed to preserve BPF
registers R0-R5 across the call to the generic bpf_check_timed_may_goto().

> diff --git a/arch/riscv/net/bpf_jit_comp64.c b/arch/riscv/net/bpf_jit_comp64.c
> index c03c1de16b79a..9832a19200c75 100644
> --- a/arch/riscv/net/bpf_jit_comp64.c
> +++ b/arch/riscv/net/bpf_jit_comp64.c
[ ... ]
> @@ -2157,3 +2157,8 @@ bool bpf_jit_supports_fsession(void)
>  {
>  	return true;
>  }
> +
> +bool bpf_jit_supports_timed_may_goto(void)
> +{
> +	return true;
> +}

[Severity: Critical]
Will enabling this feature cause the JIT to silently corrupt BPF_REG_0?

When the verifier emits a call to arch_bpf_timed_may_goto with src_reg == 0,
the RISC-V JIT's BPF_JMP | BPF_CALL case handles it. Because src_reg !=
BPF_PSEUDO_CALL, it appears the JIT will unconditionally emit:

arch/riscv/net/bpf_jit_comp64.c:bpf_jit_emit_insn() {
	...
		if (insn->src_reg != BPF_PSEUDO_CALL)
			emit_mv(bpf_to_rv_reg(BPF_REG_0, ctx), RV_REG_A0, ctx);
	...
}

Even though the new assembly trampoline properly restores BPF_REG_0 (a5) and
BPF_REG_1 (a0) before returning, won't this newly emitted mv a5, a0
instruction overwrite BPF_REG_0 with BPF_REG_1 immediately after the call
returns?

Since the verifier assumes BPF_REG_0 is untouched by may_goto, could this
allow unverified pointers in BPF_REG_1 to bypass the verifier and lead to
memory corruption?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260714-riscv-bpf-timed-may-goto-v1-0-3988601fe6ac@kylinos.cn?part=1

Re: [PATCH 2/2] selftests/bpf: enable timed may_goto tests for riscv64

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] Missing test enablement for riscv64 timed may_goto expansion and bpf_fastcall interaction.
--

--- Patch [2]: [PATCH 2/2] selftests/bpf: enable timed may_goto tests for riscv64 ---
commit c54da59713ded8c765c2c6ab6331451df77083c9
Author: Feng Jiang <jiangfeng@kylinos.cn>

selftests/bpf: enable timed may_goto tests for riscv64

This commit enables the verifier_may_goto_1 and stream_cond_break tests
on riscv64 now that the JIT supports timed may_goto.

> diff --git a/tools/testing/selftests/bpf/progs/stream.c b/tools/testing/selftests/bpf/progs/stream.c
> index 92ba1d72e0ece..8d8e53d37266c 100644
> --- a/tools/testing/selftests/bpf/progs/stream.c
> +++ b/tools/testing/selftests/bpf/progs/stream.c
> @@ -64,6 +64,7 @@ SEC("syscall")
>  __arch_x86_64
>  __arch_arm64
>  __arch_s390x
> +__arch_riscv64
>  __success __retval(0)
>  __stderr("ERROR: Timeout detected for may_goto instruction")

[ ... ]

[Severity: Medium]
Should tools/testing/selftests/bpf/progs/verifier_bpf_fastcall.c also be
updated to include __arch_riscv64 for the may_goto_interaction_arm64 test?

This test verifies the expansion of timed may_goto when interacting with
bpf_fastcall, but currently lacks the riscv64 architecture tag.

riscv64 shares the exact same verifier translation and fastcall behavior for
this path:

tools/testing/selftests/bpf/progs/verifier_bpf_fastcall.c:
    ...
    SEC("raw_tp")
    __arch_arm64
    __log_level(4) __msg("stack depth 24")
    /* may_goto counter at -24 */
    ...
    __success
    __naked void may_goto_interaction_arm64(void)
    ...

Without this tag, the test for this specific timed may_goto interaction is
silently skipped when running BPF selftests on riscv64.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260714-riscv-bpf-timed-may-goto-v1-0-3988601fe6ac@kylinos.cn?part=2