[PATCH bpf-next v3 0/3] bpf: fsession support for riscv

[PATCH bpf-next v3 0/3] bpf: fsession support for riscv

[Menglong Dong]

Implement bpf fsession for the riscv architecture.

Changes v3 -> v2:
* fix some comments.
* v2: https://lore.kernel.org/bpf/20260206115823.1070354-1-dongml2@chinatelecom.cn/T/#t

Changes v2 -> v1:
* use bpf_prog_calls_session_cookie() in invoke_bpf() in the 2nd patch.
* v1: https://lore.kernel.org/bpf/20260203055231.1088479-1-dongml2@chinatelecom.cn/

Menglong Dong (3):
  bpf, riscv: introduce emit_store_stack_imm64() for trampoline
  bpf, riscv: add fsession support for trampolines
  selftests/bpf: enable fsession_test on riscv64

 arch/riscv/net/bpf_jit_comp64.c               | 97 +++++++++++++++----
 .../selftests/bpf/progs/get_func_args_test.c  |  2 +-
 .../selftests/bpf/progs/get_func_ip_test.c    |  2 +-
 3 files changed, 79 insertions(+), 22 deletions(-)

-- 
2.53.0

[PATCH bpf-next v3 1/3] bpf, riscv: introduce emit_store_stack_imm64() for trampoline

[Menglong Dong]

Introduce a helper to store 64-bit immediate on the trampoline stack with
a help of a register.

Signed-off-by: Menglong Dong <dongml2@chinatelecom.cn>
Tested-by: Björn Töpel <bjorn@kernel.org>
Acked-by: Björn Töpel <bjorn@kernel.org>
---
 arch/riscv/net/bpf_jit_comp64.c | 25 ++++++++++++++-----------
 1 file changed, 14 insertions(+), 11 deletions(-)

diff --git a/arch/riscv/net/bpf_jit_comp64.c b/arch/riscv/net/bpf_jit_comp64.c
index 37888abee70c..e4f45e2e7e2f 100644
--- a/arch/riscv/net/bpf_jit_comp64.c
+++ b/arch/riscv/net/bpf_jit_comp64.c
@@ -926,6 +926,14 @@ static void restore_stack_args(int nr_stack_args, int args_off, int stk_arg_off,
 	}
 }
 
+static void emit_store_stack_imm64(u8 reg, int stack_off, u64 imm64,
+				   struct rv_jit_context *ctx)
+{
+	/* Load imm64 into reg and store it at [FP + stack_off]. */
+	emit_imm(reg, (s64)imm64, ctx);
+	emit_sd(RV_REG_FP, stack_off, reg, ctx);
+}
+
 static int invoke_bpf_prog(struct bpf_tramp_link *l, int args_off, int retval_off,
 			   int run_ctx_off, bool save_ret, struct rv_jit_context *ctx)
 {
@@ -933,12 +941,10 @@ static int invoke_bpf_prog(struct bpf_tramp_link *l, int args_off, int retval_of
 	struct bpf_prog *p = l->link.prog;
 	int cookie_off = offsetof(struct bpf_tramp_run_ctx, bpf_cookie);
 
-	if (l->cookie) {
-		emit_imm(RV_REG_T1, l->cookie, ctx);
-		emit_sd(RV_REG_FP, -run_ctx_off + cookie_off, RV_REG_T1, ctx);
-	} else {
+	if (l->cookie)
+		emit_store_stack_imm64(RV_REG_T1, -run_ctx_off + cookie_off, l->cookie, ctx);
+	else
 		emit_sd(RV_REG_FP, -run_ctx_off + cookie_off, RV_REG_ZERO, ctx);
-	}
 
 	/* arg1: prog */
 	emit_imm(RV_REG_A0, (const s64)p, ctx);
@@ -1123,13 +1129,10 @@ static int __arch_prepare_bpf_trampoline(struct bpf_tramp_image *im,
 	emit_sd(RV_REG_FP, -sreg_off, RV_REG_S1, ctx);
 
 	/* store ip address of the traced function */
-	if (flags & BPF_TRAMP_F_IP_ARG) {
-		emit_imm(RV_REG_T1, (const s64)func_addr, ctx);
-		emit_sd(RV_REG_FP, -ip_off, RV_REG_T1, ctx);
-	}
+	if (flags & BPF_TRAMP_F_IP_ARG)
+		emit_store_stack_imm64(RV_REG_T1, -ip_off, (u64)func_addr, ctx);
 
-	emit_li(RV_REG_T1, nr_arg_slots, ctx);
-	emit_sd(RV_REG_FP, -nregs_off, RV_REG_T1, ctx);
+	emit_store_stack_imm64(RV_REG_T1, -nregs_off, nr_arg_slots, ctx);
 
 	store_args(nr_arg_slots, args_off, ctx);
 
-- 
2.53.0

Re: [PATCH bpf-next v3 1/3] bpf, riscv: introduce emit_store_stack_imm64() for trampoline

[Pu Lehui]

On 2026/2/6 20:20, Menglong Dong wrote:
> Introduce a helper to store 64-bit immediate on the trampoline stack with
> a help of a register.
> 
> Signed-off-by: Menglong Dong <dongml2@chinatelecom.cn>
> Tested-by: Björn Töpel <bjorn@kernel.org>
> Acked-by: Björn Töpel <bjorn@kernel.org>
> ---
>   arch/riscv/net/bpf_jit_comp64.c | 25 ++++++++++++++-----------
>   1 file changed, 14 insertions(+), 11 deletions(-)
> 
> diff --git a/arch/riscv/net/bpf_jit_comp64.c b/arch/riscv/net/bpf_jit_comp64.c
> index 37888abee70c..e4f45e2e7e2f 100644
> --- a/arch/riscv/net/bpf_jit_comp64.c
> +++ b/arch/riscv/net/bpf_jit_comp64.c
> @@ -926,6 +926,14 @@ static void restore_stack_args(int nr_stack_args, int args_off, int stk_arg_off,
>   	}
>   }
>   
> +static void emit_store_stack_imm64(u8 reg, int stack_off, u64 imm64,
> +				   struct rv_jit_context *ctx)

Some nit. The first parameter can be removed by using a fixed RV_REG_T1. 
Also, placing imm64 before stack_off might looks better.

> +{
> +	/* Load imm64 into reg and store it at [FP + stack_off]. */
> +	emit_imm(reg, (s64)imm64, ctx);
> +	emit_sd(RV_REG_FP, stack_off, reg, ctx);
> +}
> +
>   static int invoke_bpf_prog(struct bpf_tramp_link *l, int args_off, int retval_off,
>   			   int run_ctx_off, bool save_ret, struct rv_jit_context *ctx)
>   {
> @@ -933,12 +941,10 @@ static int invoke_bpf_prog(struct bpf_tramp_link *l, int args_off, int retval_of
>   	struct bpf_prog *p = l->link.prog;
>   	int cookie_off = offsetof(struct bpf_tramp_run_ctx, bpf_cookie);
>   
> -	if (l->cookie) {
> -		emit_imm(RV_REG_T1, l->cookie, ctx);
> -		emit_sd(RV_REG_FP, -run_ctx_off + cookie_off, RV_REG_T1, ctx);
> -	} else {
> +	if (l->cookie)
> +		emit_store_stack_imm64(RV_REG_T1, -run_ctx_off + cookie_off, l->cookie, ctx);
> +	else
>   		emit_sd(RV_REG_FP, -run_ctx_off + cookie_off, RV_REG_ZERO, ctx);
> -	}
>   
>   	/* arg1: prog */
>   	emit_imm(RV_REG_A0, (const s64)p, ctx);
> @@ -1123,13 +1129,10 @@ static int __arch_prepare_bpf_trampoline(struct bpf_tramp_image *im,
>   	emit_sd(RV_REG_FP, -sreg_off, RV_REG_S1, ctx);
>   
>   	/* store ip address of the traced function */
> -	if (flags & BPF_TRAMP_F_IP_ARG) {
> -		emit_imm(RV_REG_T1, (const s64)func_addr, ctx);
> -		emit_sd(RV_REG_FP, -ip_off, RV_REG_T1, ctx);
> -	}
> +	if (flags & BPF_TRAMP_F_IP_ARG)
> +		emit_store_stack_imm64(RV_REG_T1, -ip_off, (u64)func_addr, ctx); >
> -	emit_li(RV_REG_T1, nr_arg_slots, ctx);
> -	emit_sd(RV_REG_FP, -nregs_off, RV_REG_T1, ctx);
> +	emit_store_stack_imm64(RV_REG_T1, -nregs_off, nr_arg_slots, ctx);
>   
>   	store_args(nr_arg_slots, args_off, ctx);
>   

Re: [PATCH bpf-next v3 1/3] bpf, riscv: introduce emit_store_stack_imm64() for trampoline

[Menglong Dong]

On 2026/2/7 09:13, Pu Lehui wrote:
> 
> On 2026/2/6 20:20, Menglong Dong wrote:
> > Introduce a helper to store 64-bit immediate on the trampoline stack with
> > a help of a register.
> > 
> > Signed-off-by: Menglong Dong <dongml2@chinatelecom.cn>
> > Tested-by: Björn Töpel <bjorn@kernel.org>
> > Acked-by: Björn Töpel <bjorn@kernel.org>
> > ---
> >   arch/riscv/net/bpf_jit_comp64.c | 25 ++++++++++++++-----------
> >   1 file changed, 14 insertions(+), 11 deletions(-)
> > 
> > diff --git a/arch/riscv/net/bpf_jit_comp64.c b/arch/riscv/net/bpf_jit_comp64.c
> > index 37888abee70c..e4f45e2e7e2f 100644
> > --- a/arch/riscv/net/bpf_jit_comp64.c
> > +++ b/arch/riscv/net/bpf_jit_comp64.c
> > @@ -926,6 +926,14 @@ static void restore_stack_args(int nr_stack_args, int args_off, int stk_arg_off,
> >   	}
> >   }
> >   
> > +static void emit_store_stack_imm64(u8 reg, int stack_off, u64 imm64,
> > +				   struct rv_jit_context *ctx)
> 
> Some nit. The first parameter can be removed by using a fixed RV_REG_T1. 
> Also, placing imm64 before stack_off might looks better.

Hi, Lehui. When I implement the emit_store_stack_imm64() in x86,
Andrii suggested that we'd better use the register explicitly to indicate
the register is used. So maybe it's better to keep this part still?

I can place the imm64 before stack_off.

Thanks!
Menglong Dong

> 
> > +{
> > +	/* Load imm64 into reg and store it at [FP + stack_off]. */
> > +	emit_imm(reg, (s64)imm64, ctx);
> > +	emit_sd(RV_REG_FP, stack_off, reg, ctx);
> > +}
> > +
> >   static int invoke_bpf_prog(struct bpf_tramp_link *l, int args_off, int retval_off,
> >   			   int run_ctx_off, bool save_ret, struct rv_jit_context *ctx)
> >   {
> > @@ -933,12 +941,10 @@ static int invoke_bpf_prog(struct bpf_tramp_link *l, int args_off, int retval_of
> >   	struct bpf_prog *p = l->link.prog;
> >   	int cookie_off = offsetof(struct bpf_tramp_run_ctx, bpf_cookie);
> >   
> > -	if (l->cookie) {
> > -		emit_imm(RV_REG_T1, l->cookie, ctx);
> > -		emit_sd(RV_REG_FP, -run_ctx_off + cookie_off, RV_REG_T1, ctx);
> > -	} else {
> > +	if (l->cookie)
> > +		emit_store_stack_imm64(RV_REG_T1, -run_ctx_off + cookie_off, l->cookie, ctx);
> > +	else
> >   		emit_sd(RV_REG_FP, -run_ctx_off + cookie_off, RV_REG_ZERO, ctx);
> > -	}
> >   
> >   	/* arg1: prog */
> >   	emit_imm(RV_REG_A0, (const s64)p, ctx);
> > @@ -1123,13 +1129,10 @@ static int __arch_prepare_bpf_trampoline(struct bpf_tramp_image *im,
> >   	emit_sd(RV_REG_FP, -sreg_off, RV_REG_S1, ctx);
> >   
> >   	/* store ip address of the traced function */
> > -	if (flags & BPF_TRAMP_F_IP_ARG) {
> > -		emit_imm(RV_REG_T1, (const s64)func_addr, ctx);
> > -		emit_sd(RV_REG_FP, -ip_off, RV_REG_T1, ctx);
> > -	}
> > +	if (flags & BPF_TRAMP_F_IP_ARG)
> > +		emit_store_stack_imm64(RV_REG_T1, -ip_off, (u64)func_addr, ctx); >
> > -	emit_li(RV_REG_T1, nr_arg_slots, ctx);
> > -	emit_sd(RV_REG_FP, -nregs_off, RV_REG_T1, ctx);
> > +	emit_store_stack_imm64(RV_REG_T1, -nregs_off, nr_arg_slots, ctx);
> >   
> >   	store_args(nr_arg_slots, args_off, ctx);
> >   
> 
> 

Re: [PATCH bpf-next v3 1/3] bpf, riscv: introduce emit_store_stack_imm64() for trampoline

[Pu Lehui]

On 2026/2/7 18:53, Menglong Dong wrote:
> On 2026/2/7 09:13, Pu Lehui wrote:
>>
>> On 2026/2/6 20:20, Menglong Dong wrote:
>>> Introduce a helper to store 64-bit immediate on the trampoline stack with
>>> a help of a register.
>>>
>>> Signed-off-by: Menglong Dong <dongml2@chinatelecom.cn>
>>> Tested-by: Björn Töpel <bjorn@kernel.org>
>>> Acked-by: Björn Töpel <bjorn@kernel.org>
>>> ---
>>>    arch/riscv/net/bpf_jit_comp64.c | 25 ++++++++++++++-----------
>>>    1 file changed, 14 insertions(+), 11 deletions(-)
>>>
>>> diff --git a/arch/riscv/net/bpf_jit_comp64.c b/arch/riscv/net/bpf_jit_comp64.c
>>> index 37888abee70c..e4f45e2e7e2f 100644
>>> --- a/arch/riscv/net/bpf_jit_comp64.c
>>> +++ b/arch/riscv/net/bpf_jit_comp64.c
>>> @@ -926,6 +926,14 @@ static void restore_stack_args(int nr_stack_args, int args_off, int stk_arg_off,
>>>    	}
>>>    }
>>>    
>>> +static void emit_store_stack_imm64(u8 reg, int stack_off, u64 imm64,
>>> +				   struct rv_jit_context *ctx)
>>
>> Some nit. The first parameter can be removed by using a fixed RV_REG_T1.
>> Also, placing imm64 before stack_off might looks better.
> 
> Hi, Lehui. When I implement the emit_store_stack_imm64() in x86,
> Andrii suggested that we'd better use the register explicitly to indicate
> the register is used. So maybe it's better to keep this part still?

No problem, the impact is minimal. And in that case, just leave imm64 
and stack_off as they are. :)

> 
> I can place the imm64 before stack_off.
> 
> Thanks!
> Menglong Dong
> 
>>
>>> +{
>>> +	/* Load imm64 into reg and store it at [FP + stack_off]. */
>>> +	emit_imm(reg, (s64)imm64, ctx);
>>> +	emit_sd(RV_REG_FP, stack_off, reg, ctx);
>>> +}
>>> +
>>>    static int invoke_bpf_prog(struct bpf_tramp_link *l, int args_off, int retval_off,
>>>    			   int run_ctx_off, bool save_ret, struct rv_jit_context *ctx)
>>>    {
>>> @@ -933,12 +941,10 @@ static int invoke_bpf_prog(struct bpf_tramp_link *l, int args_off, int retval_of
>>>    	struct bpf_prog *p = l->link.prog;
>>>    	int cookie_off = offsetof(struct bpf_tramp_run_ctx, bpf_cookie);
>>>    
>>> -	if (l->cookie) {
>>> -		emit_imm(RV_REG_T1, l->cookie, ctx);
>>> -		emit_sd(RV_REG_FP, -run_ctx_off + cookie_off, RV_REG_T1, ctx);
>>> -	} else {
>>> +	if (l->cookie)
>>> +		emit_store_stack_imm64(RV_REG_T1, -run_ctx_off + cookie_off, l->cookie, ctx);
>>> +	else
>>>    		emit_sd(RV_REG_FP, -run_ctx_off + cookie_off, RV_REG_ZERO, ctx);
>>> -	}
>>>    
>>>    	/* arg1: prog */
>>>    	emit_imm(RV_REG_A0, (const s64)p, ctx);
>>> @@ -1123,13 +1129,10 @@ static int __arch_prepare_bpf_trampoline(struct bpf_tramp_image *im,
>>>    	emit_sd(RV_REG_FP, -sreg_off, RV_REG_S1, ctx);
>>>    
>>>    	/* store ip address of the traced function */
>>> -	if (flags & BPF_TRAMP_F_IP_ARG) {
>>> -		emit_imm(RV_REG_T1, (const s64)func_addr, ctx);
>>> -		emit_sd(RV_REG_FP, -ip_off, RV_REG_T1, ctx);
>>> -	}
>>> +	if (flags & BPF_TRAMP_F_IP_ARG)
>>> +		emit_store_stack_imm64(RV_REG_T1, -ip_off, (u64)func_addr, ctx); >
>>> -	emit_li(RV_REG_T1, nr_arg_slots, ctx);
>>> -	emit_sd(RV_REG_FP, -nregs_off, RV_REG_T1, ctx);
>>> +	emit_store_stack_imm64(RV_REG_T1, -nregs_off, nr_arg_slots, ctx);
>>>    
>>>    	store_args(nr_arg_slots, args_off, ctx);
>>>    
>>
>>
> 
> 
> 
> 
> 
> 

[PATCH bpf-next v3 2/3] bpf, riscv: add fsession support for trampolines

[Menglong Dong]

Implement BPF_TRACE_FSESSION support in the RISC-V trampoline JIT. The
logic here is similar to what we did in x86_64.

In order to simply the logic, we factor out the function invoke_bpf() for
fentry and fexit.

Signed-off-by: Menglong Dong <dongml2@chinatelecom.cn>
Tested-by: Björn Töpel <bjorn@kernel.org>
Acked-by: Björn Töpel <bjorn@kernel.org>
---
v3:
- remove the "always" from the comment

v2:
- use bpf_prog_calls_session_cookie() in invoke_bpf()
---
 arch/riscv/net/bpf_jit_comp64.c | 74 ++++++++++++++++++++++++++++-----
 1 file changed, 64 insertions(+), 10 deletions(-)

diff --git a/arch/riscv/net/bpf_jit_comp64.c b/arch/riscv/net/bpf_jit_comp64.c
index e4f45e2e7e2f..d45fa9c6a7dd 100644
--- a/arch/riscv/net/bpf_jit_comp64.c
+++ b/arch/riscv/net/bpf_jit_comp64.c
@@ -996,6 +996,29 @@ static int invoke_bpf_prog(struct bpf_tramp_link *l, int args_off, int retval_of
 	return ret;
 }
 
+static int invoke_bpf(struct bpf_tramp_links *tl, int args_off, int retval_off,
+		      int run_ctx_off, int func_meta_off, bool save_ret, u64 func_meta,
+		      int cookie_off, struct rv_jit_context *ctx)
+{
+	int i, cur_cookie = (cookie_off - args_off) / 8;
+
+	for (i = 0; i < tl->nr_links; i++) {
+		int err;
+
+		if (bpf_prog_calls_session_cookie(&tl->links[i])) {
+			u64 meta = func_meta | ((u64)cur_cookie << BPF_TRAMP_COOKIE_INDEX_SHIFT);
+
+			emit_store_stack_imm64(RV_REG_T1, -func_meta_off, meta, ctx);
+			cur_cookie--;
+		}
+		err = invoke_bpf_prog(tl->links[i], args_off, retval_off, run_ctx_off,
+				      save_ret, ctx);
+		if (err)
+			return err;
+	}
+	return 0;
+}
+
 static int __arch_prepare_bpf_trampoline(struct bpf_tramp_image *im,
 					 const struct btf_func_model *m,
 					 struct bpf_tramp_links *tlinks,
@@ -1005,13 +1028,15 @@ static int __arch_prepare_bpf_trampoline(struct bpf_tramp_image *im,
 	int i, ret, offset;
 	int *branches_off = NULL;
 	int stack_size = 0, nr_arg_slots = 0;
-	int retval_off, args_off, nregs_off, ip_off, run_ctx_off, sreg_off, stk_arg_off;
+	int retval_off, args_off, func_meta_off, ip_off, run_ctx_off, sreg_off, stk_arg_off;
+	int cookie_off, cookie_cnt;
 	struct bpf_tramp_links *fentry = &tlinks[BPF_TRAMP_FENTRY];
 	struct bpf_tramp_links *fexit = &tlinks[BPF_TRAMP_FEXIT];
 	struct bpf_tramp_links *fmod_ret = &tlinks[BPF_TRAMP_MODIFY_RETURN];
 	bool is_struct_ops = flags & BPF_TRAMP_F_INDIRECT;
 	void *orig_call = func_addr;
 	bool save_ret;
+	u64 func_meta;
 	u32 insn;
 
 	/* Two types of generated trampoline stack layout:
@@ -1042,10 +1067,14 @@ static int __arch_prepare_bpf_trampoline(struct bpf_tramp_image *im,
 	 *                  [ ...               ]
 	 * FP - args_off    [ arg1              ]
 	 *
-	 * FP - nregs_off   [ regs count        ]
+	 * FP - func_meta_off [ regs count, etc ]
 	 *
 	 * FP - ip_off      [ traced func	] BPF_TRAMP_F_IP_ARG
 	 *
+	 *                  [ stack cookie N    ]
+	 *                  [ ...               ]
+	 * FP - cookie_off  [ stack cookie 1    ]
+	 *
 	 * FP - run_ctx_off [ bpf_tramp_run_ctx ]
 	 *
 	 * FP - sreg_off    [ callee saved reg	]
@@ -1077,14 +1106,20 @@ static int __arch_prepare_bpf_trampoline(struct bpf_tramp_image *im,
 	stack_size += nr_arg_slots * 8;
 	args_off = stack_size;
 
+	/* function metadata, such as regs count */
 	stack_size += 8;
-	nregs_off = stack_size;
+	func_meta_off = stack_size;
 
 	if (flags & BPF_TRAMP_F_IP_ARG) {
 		stack_size += 8;
 		ip_off = stack_size;
 	}
 
+	cookie_cnt = bpf_fsession_cookie_cnt(tlinks);
+	/* room for session cookies */
+	stack_size += cookie_cnt * 8;
+	cookie_off = stack_size;
+
 	stack_size += round_up(sizeof(struct bpf_tramp_run_ctx), 8);
 	run_ctx_off = stack_size;
 
@@ -1132,10 +1167,19 @@ static int __arch_prepare_bpf_trampoline(struct bpf_tramp_image *im,
 	if (flags & BPF_TRAMP_F_IP_ARG)
 		emit_store_stack_imm64(RV_REG_T1, -ip_off, (u64)func_addr, ctx);
 
-	emit_store_stack_imm64(RV_REG_T1, -nregs_off, nr_arg_slots, ctx);
+	func_meta = nr_arg_slots;
+	emit_store_stack_imm64(RV_REG_T1, -func_meta_off, func_meta, ctx);
 
 	store_args(nr_arg_slots, args_off, ctx);
 
+	if (bpf_fsession_cnt(tlinks)) {
+		/* clear all session cookies' value */
+		for (i = 0; i < cookie_cnt; i++)
+			emit_sd(RV_REG_FP, -cookie_off + 8 * i, RV_REG_ZERO, ctx);
+		/* clear return value to make sure fentry always get 0 */
+		emit_sd(RV_REG_FP, -retval_off, RV_REG_ZERO, ctx);
+	}
+
 	if (flags & BPF_TRAMP_F_CALL_ORIG) {
 		emit_imm(RV_REG_A0, ctx->insns ? (const s64)im : RV_MAX_COUNT_IMM, ctx);
 		ret = emit_call((const u64)__bpf_tramp_enter, true, ctx);
@@ -1143,9 +1187,9 @@ static int __arch_prepare_bpf_trampoline(struct bpf_tramp_image *im,
 			return ret;
 	}
 
-	for (i = 0; i < fentry->nr_links; i++) {
-		ret = invoke_bpf_prog(fentry->links[i], args_off, retval_off, run_ctx_off,
-				      flags & BPF_TRAMP_F_RET_FENTRY_RET, ctx);
+	if (fentry->nr_links) {
+		ret = invoke_bpf(fentry, args_off, retval_off, run_ctx_off, func_meta_off,
+				 flags & BPF_TRAMP_F_RET_FENTRY_RET, func_meta, cookie_off, ctx);
 		if (ret)
 			return ret;
 	}
@@ -1192,9 +1236,14 @@ static int __arch_prepare_bpf_trampoline(struct bpf_tramp_image *im,
 		*(u32 *)(ctx->insns + branches_off[i]) = insn;
 	}
 
-	for (i = 0; i < fexit->nr_links; i++) {
-		ret = invoke_bpf_prog(fexit->links[i], args_off, retval_off,
-				      run_ctx_off, false, ctx);
+	/* set "is_return" flag for fsession */
+	func_meta |= (1ULL << BPF_TRAMP_IS_RETURN_SHIFT);
+	if (bpf_fsession_cnt(tlinks))
+		emit_store_stack_imm64(RV_REG_T1, -func_meta_off, func_meta, ctx);
+
+	if (fexit->nr_links) {
+		ret = invoke_bpf(fexit, args_off, retval_off, run_ctx_off, func_meta_off,
+				 false, func_meta, cookie_off, ctx);
 		if (ret)
 			goto out;
 	}
@@ -2094,3 +2143,8 @@ bool bpf_jit_inlines_helper_call(s32 imm)
 		return false;
 	}
 }
+
+bool bpf_jit_supports_fsession(void)
+{
+	return true;
+}
-- 
2.53.0

Re: [PATCH bpf-next v3 2/3] bpf, riscv: add fsession support for trampolines

[bot+bpf-ci]

[-- Attachment #1: Type: text/plain, Size: 2123 bytes --]

> diff --git a/arch/riscv/net/bpf_jit_comp64.c b/arch/riscv/net/bpf_jit_comp64.c
> --- a/arch/riscv/net/bpf_jit_comp64.c
> +++ b/arch/riscv/net/bpf_jit_comp64.c

[ ... ]

> +static int invoke_bpf(struct bpf_tramp_links *tl, int args_off, int retval_off,
> +		      int run_ctx_off, int func_meta_off, bool save_ret, u64 func_meta,
> +		      int cookie_off, struct rv_jit_context *ctx)
> +{
> +	int i, cur_cookie = (cookie_off - args_off) / 8;
> +
> +	for (i = 0; i < tl->nr_links; i++) {
> +		int err;
> +
> +		if (bpf_prog_calls_session_cookie(&tl->links[i])) {
                                                ^^^^^^^^^^^^^^

Should this be tl->links[i] instead of &tl->links[i]?

The function bpf_prog_calls_session_cookie() expects a struct bpf_tramp_link
pointer, but tl->links is an array of pointers, so tl->links[i] is already
a struct bpf_tramp_link pointer. The extra & passes a pointer-to-pointer.

For comparison, arm64 uses:

    if (bpf_prog_calls_session_cookie(fentry->links[i]))

And include/linux/bpf.h uses:

    if (bpf_prog_calls_session_cookie(fentries.links[i]))

Both without the &.

> +			u64 meta = func_meta | ((u64)cur_cookie << BPF_TRAMP_COOKIE_INDEX_SHIFT);
> +
> +			emit_store_stack_imm64(RV_REG_T1, -func_meta_off, meta, ctx);
> +			cur_cookie--;
> +		}
> +		err = invoke_bpf_prog(tl->links[i], args_off, retval_off, run_ctx_off,
> +				      save_ret, ctx);

Note that invoke_bpf_prog() correctly uses tl->links[i] without the &.


---
AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md

CI run summary: https://github.com/kernel-patches/bpf/actions/runs/21750727924

AI-authorship-score: low
AI-authorship-explanation: The code follows kernel conventions and has been reviewed by maintainers with acked-by tags, indicating human authorship.
issues-found: 1
issue-severity-score: high
issue-severity-explanation: Wrong pointer type passed to bpf_prog_calls_session_cookie() will cause undefined behavior when accessing session cookie state, breaking fsession functionality on RISC-V.

Re: [PATCH bpf-next v3 2/3] bpf, riscv: add fsession support for trampolines

[Björn Töpel]

Menglong!

On Fri, 6 Feb 2026 at 13:51, <bot+bpf-ci@kernel.org> wrote:
>
> > diff --git a/arch/riscv/net/bpf_jit_comp64.c b/arch/riscv/net/bpf_jit_comp64.c
> > --- a/arch/riscv/net/bpf_jit_comp64.c
> > +++ b/arch/riscv/net/bpf_jit_comp64.c
>
> [ ... ]
>
> > +static int invoke_bpf(struct bpf_tramp_links *tl, int args_off, int retval_off,
> > +                   int run_ctx_off, int func_meta_off, bool save_ret, u64 func_meta,
> > +                   int cookie_off, struct rv_jit_context *ctx)
> > +{
> > +     int i, cur_cookie = (cookie_off - args_off) / 8;
> > +
> > +     for (i = 0; i < tl->nr_links; i++) {
> > +             int err;
> > +
> > +             if (bpf_prog_calls_session_cookie(&tl->links[i])) {
>                                                 ^^^^^^^^^^^^^^
>
> Should this be tl->links[i] instead of &tl->links[i]?
>
> The function bpf_prog_calls_session_cookie() expects a struct bpf_tramp_link
> pointer, but tl->links is an array of pointers, so tl->links[i] is already
> a struct bpf_tramp_link pointer. The extra & passes a pointer-to-pointer.
>
> For comparison, arm64 uses:
>
>     if (bpf_prog_calls_session_cookie(fentry->links[i]))
>
> And include/linux/bpf.h uses:
>
>     if (bpf_prog_calls_session_cookie(fentries.links[i]))
>
> Both without the &.
>
> > +                     u64 meta = func_meta | ((u64)cur_cookie << BPF_TRAMP_COOKIE_INDEX_SHIFT);
> > +
> > +                     emit_store_stack_imm64(RV_REG_T1, -func_meta_off, meta, ctx);
> > +                     cur_cookie--;
> > +             }
> > +             err = invoke_bpf_prog(tl->links[i], args_off, retval_off, run_ctx_off,
> > +                                   save_ret, ctx);
>
> Note that invoke_bpf_prog() correctly uses tl->links[i] without the &.

Menglong, the v3 doesn't build. Please refrain from just stressing
versions out. For v4, make sure you properly build/test. On that note;
on what hardware/simulator did you perform the tests on?

Re: [PATCH bpf-next v3 2/3] bpf, riscv: add fsession support for trampolines

[Menglong Dong]

On 2026/2/6 21:42, Björn Töpel wrote:
> Menglong!
> 
> On Fri, 6 Feb 2026 at 13:51, <bot+bpf-ci@kernel.org> wrote:
> >
> > > diff --git a/arch/riscv/net/bpf_jit_comp64.c b/arch/riscv/net/bpf_jit_comp64.c
> > > --- a/arch/riscv/net/bpf_jit_comp64.c
> > > +++ b/arch/riscv/net/bpf_jit_comp64.c
> >
> > [ ... ]
> >
> > > +static int invoke_bpf(struct bpf_tramp_links *tl, int args_off, int retval_off,
> > > +                   int run_ctx_off, int func_meta_off, bool save_ret, u64 func_meta,
> > > +                   int cookie_off, struct rv_jit_context *ctx)
> > > +{
> > > +     int i, cur_cookie = (cookie_off - args_off) / 8;
> > > +
> > > +     for (i = 0; i < tl->nr_links; i++) {
> > > +             int err;
> > > +
> > > +             if (bpf_prog_calls_session_cookie(&tl->links[i])) {
> >                                                 ^^^^^^^^^^^^^^
> >
> > Should this be tl->links[i] instead of &tl->links[i]?
> >
> > The function bpf_prog_calls_session_cookie() expects a struct bpf_tramp_link
> > pointer, but tl->links is an array of pointers, so tl->links[i] is already
> > a struct bpf_tramp_link pointer. The extra & passes a pointer-to-pointer.
> >
> > For comparison, arm64 uses:
> >
> >     if (bpf_prog_calls_session_cookie(fentry->links[i]))
> >
> > And include/linux/bpf.h uses:
> >
> >     if (bpf_prog_calls_session_cookie(fentries.links[i]))
> >
> > Both without the &.
> >
> > > +                     u64 meta = func_meta | ((u64)cur_cookie << BPF_TRAMP_COOKIE_INDEX_SHIFT);
> > > +
> > > +                     emit_store_stack_imm64(RV_REG_T1, -func_meta_off, meta, ctx);
> > > +                     cur_cookie--;
> > > +             }
> > > +             err = invoke_bpf_prog(tl->links[i], args_off, retval_off, run_ctx_off,
> > > +                                   save_ret, ctx);
> >
> > Note that invoke_bpf_prog() correctly uses tl->links[i] without the &.
> 
> Menglong, the v3 doesn't build. Please refrain from just stressing
> versions out. For v4, make sure you properly build/test. On that note;
> on what hardware/simulator did you perform the tests on?

Ah, sorry that the CONFIG_BPF_JIT is not enabled in my config, which
makes me didn't find this compile error.

I used to test it in qemu. As this is a tiny change, so I didn't run the
test again :/

I'll make sure the build and test pass in the V4.

Thanks!
Menglong Dong

> 
> 

Re: [PATCH bpf-next v3 2/3] bpf, riscv: add fsession support for trampolines

[kernel test robot]

Hi Menglong,

kernel test robot noticed the following build errors:

[auto build test ERROR on bpf-next/master]

url:    https://github.com/intel-lab-lkp/linux/commits/Menglong-Dong/bpf-riscv-introduce-emit_store_stack_imm64-for-trampoline/20260206-202356
base:   https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next.git master
patch link:    https://lore.kernel.org/r/20260206122002.1494125-3-dongml2%40chinatelecom.cn
patch subject: [PATCH bpf-next v3 2/3] bpf, riscv: add fsession support for trampolines
config: riscv-randconfig-r112-20260206 (https://download.01.org/0day-ci/archive/20260207/202602070435.BuX0TvvF-lkp@intel.com/config)
compiler: riscv64-linux-gcc (GCC) 10.5.0
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20260207/202602070435.BuX0TvvF-lkp@intel.com/reproduce)

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202602070435.BuX0TvvF-lkp@intel.com/

All errors (new ones prefixed by >>):

   arch/riscv/net/bpf_jit_comp64.c: In function 'invoke_bpf':
>> arch/riscv/net/bpf_jit_comp64.c:1008:37: error: passing argument 1 of 'bpf_prog_calls_session_cookie' from incompatible pointer type [-Werror=incompatible-pointer-types]
    1008 |   if (bpf_prog_calls_session_cookie(&tl->links[i])) {
         |                                     ^~~~~~~~~~~~~
         |                                     |
         |                                     struct bpf_tramp_link **
   In file included from arch/riscv/net/bpf_jit_comp64.c:9:
   include/linux/bpf.h:2199:73: note: expected 'struct bpf_tramp_link *' but argument is of type 'struct bpf_tramp_link **'
    2199 | static inline bool bpf_prog_calls_session_cookie(struct bpf_tramp_link *link)
         |                                                  ~~~~~~~~~~~~~~~~~~~~~~~^~~~
   cc1: some warnings being treated as errors


vim +/bpf_prog_calls_session_cookie +1008 arch/riscv/net/bpf_jit_comp64.c

   998	
   999	static int invoke_bpf(struct bpf_tramp_links *tl, int args_off, int retval_off,
  1000			      int run_ctx_off, int func_meta_off, bool save_ret, u64 func_meta,
  1001			      int cookie_off, struct rv_jit_context *ctx)
  1002	{
  1003		int i, cur_cookie = (cookie_off - args_off) / 8;
  1004	
  1005		for (i = 0; i < tl->nr_links; i++) {
  1006			int err;
  1007	
> 1008			if (bpf_prog_calls_session_cookie(&tl->links[i])) {
  1009				u64 meta = func_meta | ((u64)cur_cookie << BPF_TRAMP_COOKIE_INDEX_SHIFT);
  1010	
  1011				emit_store_stack_imm64(RV_REG_T1, -func_meta_off, meta, ctx);
  1012				cur_cookie--;
  1013			}
  1014			err = invoke_bpf_prog(tl->links[i], args_off, retval_off, run_ctx_off,
  1015					      save_ret, ctx);
  1016			if (err)
  1017				return err;
  1018		}
  1019		return 0;
  1020	}
  1021	

-- 
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki

Re: [PATCH bpf-next v3 2/3] bpf, riscv: add fsession support for trampolines

[kernel test robot]

Hi Menglong,

kernel test robot noticed the following build errors:

[auto build test ERROR on bpf-next/master]

url:    https://github.com/intel-lab-lkp/linux/commits/Menglong-Dong/bpf-riscv-introduce-emit_store_stack_imm64-for-trampoline/20260206-202356
base:   https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next.git master
patch link:    https://lore.kernel.org/r/20260206122002.1494125-3-dongml2%40chinatelecom.cn
patch subject: [PATCH bpf-next v3 2/3] bpf, riscv: add fsession support for trampolines
config: riscv-allyesconfig (https://download.01.org/0day-ci/archive/20260207/202602070533.NAsdK5m6-lkp@intel.com/config)
compiler: clang version 16.0.6 (https://github.com/llvm/llvm-project 7cbf1a2591520c2491aa35339f227775f4d3adf6)
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20260207/202602070533.NAsdK5m6-lkp@intel.com/reproduce)

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202602070533.NAsdK5m6-lkp@intel.com/

All errors (new ones prefixed by >>):

>> arch/riscv/net/bpf_jit_comp64.c:1008:37: error: incompatible pointer types passing 'struct bpf_tramp_link **' to parameter of type 'struct bpf_tramp_link *'; remove & [-Werror,-Wincompatible-pointer-types]
                   if (bpf_prog_calls_session_cookie(&tl->links[i])) {
                                                     ^~~~~~~~~~~~~
   include/linux/bpf.h:2199:73: note: passing argument to parameter 'link' here
   static inline bool bpf_prog_calls_session_cookie(struct bpf_tramp_link *link)
                                                                           ^
   1 error generated.


vim +1008 arch/riscv/net/bpf_jit_comp64.c

   998	
   999	static int invoke_bpf(struct bpf_tramp_links *tl, int args_off, int retval_off,
  1000			      int run_ctx_off, int func_meta_off, bool save_ret, u64 func_meta,
  1001			      int cookie_off, struct rv_jit_context *ctx)
  1002	{
  1003		int i, cur_cookie = (cookie_off - args_off) / 8;
  1004	
  1005		for (i = 0; i < tl->nr_links; i++) {
  1006			int err;
  1007	
> 1008			if (bpf_prog_calls_session_cookie(&tl->links[i])) {
  1009				u64 meta = func_meta | ((u64)cur_cookie << BPF_TRAMP_COOKIE_INDEX_SHIFT);
  1010	
  1011				emit_store_stack_imm64(RV_REG_T1, -func_meta_off, meta, ctx);
  1012				cur_cookie--;
  1013			}
  1014			err = invoke_bpf_prog(tl->links[i], args_off, retval_off, run_ctx_off,
  1015					      save_ret, ctx);
  1016			if (err)
  1017				return err;
  1018		}
  1019		return 0;
  1020	}
  1021	

-- 
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki

[PATCH bpf-next v3 3/3] selftests/bpf: enable fsession_test on riscv64

[Menglong Dong]

Now that the RISC-V trampoline JIT supports BPF_TRACE_FSESSION, run
the fsession selftest on riscv64 as well as x86_64.

Signed-off-by: Menglong Dong <dongml2@chinatelecom.cn>
Tested-by: Björn Töpel <bjorn@kernel.org>
Acked-by: Björn Töpel <bjorn@kernel.org>
---
 tools/testing/selftests/bpf/progs/get_func_args_test.c | 2 +-
 tools/testing/selftests/bpf/progs/get_func_ip_test.c   | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/tools/testing/selftests/bpf/progs/get_func_args_test.c b/tools/testing/selftests/bpf/progs/get_func_args_test.c
index 180ba5098ca1..075a1180ec26 100644
--- a/tools/testing/selftests/bpf/progs/get_func_args_test.c
+++ b/tools/testing/selftests/bpf/progs/get_func_args_test.c
@@ -167,7 +167,7 @@ int BPF_PROG(tp_test2)
 }
 
 __u64 test7_result = 0;
-#if defined(bpf_target_x86) || defined(bpf_target_arm64)
+#if defined(bpf_target_x86) || defined(bpf_target_arm64) || defined(bpf_target_riscv)
 SEC("fsession/bpf_fentry_test1")
 int BPF_PROG(test7)
 {
diff --git a/tools/testing/selftests/bpf/progs/get_func_ip_test.c b/tools/testing/selftests/bpf/progs/get_func_ip_test.c
index 43ff836a8ed8..45eaa54d1ac7 100644
--- a/tools/testing/selftests/bpf/progs/get_func_ip_test.c
+++ b/tools/testing/selftests/bpf/progs/get_func_ip_test.c
@@ -106,7 +106,7 @@ int BPF_URETPROBE(test8, int ret)
 
 __u64 test9_entry_result = 0;
 __u64 test9_exit_result = 0;
-#if defined(bpf_target_x86) || defined(bpf_target_arm64)
+#if defined(bpf_target_x86) || defined(bpf_target_arm64) || defined(bpf_target_riscv)
 SEC("fsession/bpf_fentry_test1")
 int BPF_PROG(test9, int a)
 {
-- 
2.53.0