Re: [PATCH v2 1/2] bpf, riscv: add support for timed may_goto

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] The assembly trampoline `arch_bpf_timed_may_goto` does not set up a frame pointer (`s0`), which breaks stack unwinding when `CONFIG_FRAME_POINTER` is enabled and omits the BPF program from stack traces.
--

--- Patch [1]: [PATCH v2 1/2] bpf, riscv: add support for timed may_goto ---
commit 08fb72c94674edd23d2e12eda1b3dd76cb372fdc
Author: Feng Jiang <jiangfeng@kylinos.cn>

bpf, riscv: add support for timed may_goto

Implement arch_bpf_timed_may_goto() for the RV64 JIT. The argument and
return value are carried in BPF_REG_AX, and BPF R0-R5 are preserved
across the call to the generic bpf_check_timed_may_goto(). Enable
bpf_jit_supports_timed_may_goto() so the verifier uses the timed
expansion path.

> diff --git a/arch/riscv/net/bpf_timed_may_goto.S b/arch/riscv/net/bpf_timed_may_goto.S
> new file mode 100644
> index 0000000000000..f54f389d921e0
> --- /dev/null
> +++ b/arch/riscv/net/bpf_timed_may_goto.S
> @@ -0,0 +1,44 @@
> +/* SPDX-License-Identifier: GPL-2.0 */
> +/* Copyright (c) 2026 Feng Jiang <jiangfeng@kylinos.cn> */
> +
> +#include <linux/linkage.h>
> +#include <asm/asm.h>
> +
> +/*
> + * Trampoline for the BPF timed may_goto loop bound. Custom calling convention:
> + *	- input:  stack offset in BPF_REG_AX (t0)
> + *	- output: updated count in BPF_REG_AX (t0)
> + *
> + * Calls bpf_check_timed_may_goto(ptr) with the standard RISC-V ABI, where
> + * ptr = BPF_REG_FP (s5) + BPF_REG_AX (t0). BPF R0-R5 (a5, a0-a4) are saved
> + * across the call; BPF_REG_FP (s5) is callee-saved and needs no saving.
> + */
> +
> +SYM_FUNC_START(arch_bpf_timed_may_goto)
> +	addi	sp, sp, -64
> +	sd	ra, 56(sp)

[Severity: Medium]
Does this code need to set up a frame pointer (s0)?

When CONFIG_FRAME_POINTER is enabled on RISC-V, the unwinder relies on
the frame pointer to chain frames. Because arch_bpf_timed_may_goto() allocates
stack space and saves ra but fails to save the caller's s0 or update s0 to
point to its own stack frame, stack traces triggered from within
bpf_check_timed_may_goto() (or functions it calls) might omit the JITed BPF
program.

> +
> +	/* Save BPF registers R0-R5 (a5, a0-a4) */
> +	sd	a5, 48(sp)

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260714-riscv-bpf-timed-may-goto-v2-0-eeb6201aedcc@kylinos.cn?part=1