[PATCH v1 0/2] LoongArch: BPF: per-CPU addr MOV and timed may_goto

[PATCH v1 0/2] LoongArch: BPF: per-CPU addr MOV and timed may_goto

[George Guo]

From: George Guo <guodongtai@kylinos.cn>

This series enables two independent BPF JIT features on LoongArch, each
advertised to the verifier via the corresponding bpf_jit_supports_*()
hook:

Patch 1 implements the internal-only BPF_MOV that resolves a per-CPU
address from its per-CPU offset. LoongArch keeps the current CPU's
per-CPU offset in $r21 (__my_cpu_offset), so the resolution is a single
add of $r21 to the source register. This is used by verifier/JIT
inlining (e.g. bpf_get_smp_processor_id() and per-CPU map lookups) and
is not exposed to BPF users.

Patch 2 implements arch_bpf_timed_may_goto() (in a small assembly stub
with a custom calling convention passing the count/timestamp slot offset
in BPF_REG_AX) and advertises it, so the verifier lowers may_goto into
the timed, wall-clock-bounded variant instead of a fixed iteration
counter.

Tested on a LoongArch (Loongson-3A5000) QEMU/KVM guest with
CONFIG_PAGE_SIZE_16KB and CONFIG_UNWINDER_ORC:
 - patch 1: test_progs cpumask and percpu map cases pass;
 - patch 2: test_progs iters (incl. the cond_break / may_goto loop
   cases) all pass.

George Guo (2):
  LoongArch: BPF: Support internal-only MOV to resolve per-CPU addrs
  LoongArch: BPF: Add timed may_goto support

 arch/loongarch/include/asm/inst.h       |  1 +
 arch/loongarch/net/Makefile             |  2 +-
 arch/loongarch/net/bpf_jit.c            | 27 ++++++++++++++-
 arch/loongarch/net/bpf_timed_may_goto.S | 44 +++++++++++++++++++++++++
 4 files changed, 72 insertions(+), 2 deletions(-)
 create mode 100644 arch/loongarch/net/bpf_timed_may_goto.S

-- 
2.25.1

[PATCH v1 1/2] LoongArch: BPF: Support internal-only MOV to resolve per-CPU addrs

[George Guo]

From: George Guo <guodongtai@kylinos.cn>

Support the internal-only BPF_MOV instruction that resolves the absolute
address of per-CPU data from its per-CPU offset. This instruction is used
only for internal inlining optimizations between the BPF verifier and the
JITs (e.g. inlining bpf_get_smp_processor_id() and per-CPU map lookups),
and is not exposed to BPF users.

LoongArch keeps the per-CPU offset of the current CPU in $r21
(__my_cpu_offset), so resolving a per-CPU address only requires adding
$r21 to the source register holding the per-CPU offset. Advertise the
capability via bpf_jit_supports_percpu_insn().

Signed-off-by: George Guo <guodongtai@kylinos.cn>
---
 arch/loongarch/include/asm/inst.h |  1 +
 arch/loongarch/net/bpf_jit.c      | 14 ++++++++++++++
 2 files changed, 15 insertions(+)

diff --git a/arch/loongarch/include/asm/inst.h b/arch/loongarch/include/asm/inst.h
index 76b723590023..44fb5ad26d1a 100644
--- a/arch/loongarch/include/asm/inst.h
+++ b/arch/loongarch/include/asm/inst.h
@@ -404,6 +404,7 @@ enum loongarch_gpr {
 	LOONGARCH_GPR_T6,
 	LOONGARCH_GPR_T7,
 	LOONGARCH_GPR_T8,
+	LOONGARCH_GPR_U0 = 21,	/* Kernel per-CPU base register ($r21) */
 	LOONGARCH_GPR_FP = 22,
 	LOONGARCH_GPR_S0 = 23,
 	LOONGARCH_GPR_S1,
diff --git a/arch/loongarch/net/bpf_jit.c b/arch/loongarch/net/bpf_jit.c
index 24913dc7f4e8..20d5bf792108 100644
--- a/arch/loongarch/net/bpf_jit.c
+++ b/arch/loongarch/net/bpf_jit.c
@@ -728,6 +728,15 @@ static int build_insn(const struct bpf_insn *insn, struct jit_ctx *ctx, bool ext
 			move_reg(ctx, dst, t1);
 			break;
 		}
+		if (insn_is_mov_percpu_addr(insn)) {
+			if (dst != src)
+				move_reg(ctx, dst, src);
+#ifdef CONFIG_SMP
+			/* dst += __my_cpu_offset, held in $r21 */
+			emit_insn(ctx, addd, dst, dst, LOONGARCH_GPR_U0);
+#endif
+			break;
+		}
 		switch (off) {
 		case 0:
 			move_reg(ctx, dst, src);
@@ -2362,6 +2371,11 @@ bool bpf_jit_supports_fsession(void)
 	return true;
 }
 
+bool bpf_jit_supports_percpu_insn(void)
+{
+	return true;
+}
+
 /* Indicate the JIT backend supports mixing bpf2bpf and tailcalls. */
 bool bpf_jit_supports_subprog_tailcalls(void)
 {
-- 
2.25.1

[PATCH v1 2/2] LoongArch: BPF: Add timed may_goto support

[George Guo]

From: George Guo <guodongtai@kylinos.cn>

Implement arch_bpf_timed_may_goto() and advertise it through
bpf_jit_supports_timed_may_goto() so the verifier lowers may_goto into
the timed variant: instead of a fixed iteration counter, the loop is
bounded by a wall-clock timeout maintained in a per-loop stack slot.

arch_bpf_timed_may_goto() is called with a custom calling convention.
The verifier passes the stack offset of the count/timestamp pair in
BPF_REG_AX ($t0) and expects the updated count back in the same
register, so the stub adds the offset to BPF_REG_FP ($s4), calls
bpf_check_timed_may_goto(), and moves the result back into $t0 while
preserving the BPF caller-saved registers R0 - R5. The JIT call path is
updated to skip the usual 'BPF_REG_0 = C return value' move for this
helper since its result is delivered in BPF_REG_AX instead.

Signed-off-by: George Guo <guodongtai@kylinos.cn>
---
 arch/loongarch/net/Makefile             |  2 +-
 arch/loongarch/net/bpf_jit.c            | 13 ++++++-
 arch/loongarch/net/bpf_timed_may_goto.S | 47 +++++++++++++++++++++++++
 3 files changed, 60 insertions(+), 2 deletions(-)
 create mode 100644 arch/loongarch/net/bpf_timed_may_goto.S

diff --git a/arch/loongarch/net/Makefile b/arch/loongarch/net/Makefile
index 1ec12a0c324a..8d9ddb48f9ea 100644
--- a/arch/loongarch/net/Makefile
+++ b/arch/loongarch/net/Makefile
@@ -4,4 +4,4 @@
 #
 # Copyright (C) 2022 Loongson Technology Corporation Limited
 #
-obj-$(CONFIG_BPF_JIT) += bpf_jit.o
+obj-$(CONFIG_BPF_JIT) += bpf_jit.o bpf_timed_may_goto.o
diff --git a/arch/loongarch/net/bpf_jit.c b/arch/loongarch/net/bpf_jit.c
index 20d5bf792108..794c0c37fa9c 100644
--- a/arch/loongarch/net/bpf_jit.c
+++ b/arch/loongarch/net/bpf_jit.c
@@ -1185,7 +1185,13 @@ static int build_insn(const struct bpf_insn *insn, struct jit_ctx *ctx, bool ext
 		move_addr(ctx, t1, func_addr);
 		emit_insn(ctx, jirl, LOONGARCH_GPR_RA, t1, 0);
 
-		if (insn->src_reg != BPF_PSEUDO_CALL)
+		/*
+		 * Call to arch_bpf_timed_may_goto() uses a custom calling
+		 * convention with the argument and return value in BPF_REG_AX,
+		 * so skip moving the C return value into BPF_REG_0.
+		 */
+		if (insn->src_reg != BPF_PSEUDO_CALL &&
+		    func_addr != (u64)arch_bpf_timed_may_goto)
 			move_reg(ctx, regmap[BPF_REG_0], LOONGARCH_GPR_A0);
 
 		break;
@@ -2376,6 +2382,11 @@ bool bpf_jit_supports_percpu_insn(void)
 	return true;
 }
 
+bool bpf_jit_supports_timed_may_goto(void)
+{
+	return true;
+}
+
 /* Indicate the JIT backend supports mixing bpf2bpf and tailcalls. */
 bool bpf_jit_supports_subprog_tailcalls(void)
 {
diff --git a/arch/loongarch/net/bpf_timed_may_goto.S b/arch/loongarch/net/bpf_timed_may_goto.S
new file mode 100644
index 000000000000..aa86250a9c65
--- /dev/null
+++ b/arch/loongarch/net/bpf_timed_may_goto.S
@@ -0,0 +1,47 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+/*
+ * Author: George Guo <guodongtai@kylinos.cn>
+ * Copyright (C) 2026 KylinSoft Corporation.
+ */
+
+#include <asm/asmmacro.h>
+#include <asm/regdef.h>
+#include <linux/export.h>
+#include <linux/linkage.h>
+
+SYM_FUNC_START(arch_bpf_timed_may_goto)
+	addi.d		sp, sp, -64
+	st.d		ra, sp, 0
+
+	/* Save BPF registers R0 - R5 (a5, a0 - a4) */
+	st.d		a5, sp, 8
+	st.d		a0, sp, 16
+	st.d		a1, sp, 24
+	st.d		a2, sp, 32
+	st.d		a3, sp, 40
+	st.d		a4, sp, 48
+
+	/*
+	 * BPF_REG_AX (t0) holds the offset passed in by the verifier; add it
+	 * to BPF_REG_FP (s4) to get the pointer to the count and timestamp,
+	 * then pass it as the first argument in a0.
+	 *
+	 * The verifier emits a load using FP right before this call, so
+	 * BPF_REG_FP (s4) is always set up by the JIT in this case.
+	 */
+	add.d		a0, t0, s4
+	bl		bpf_check_timed_may_goto
+	/* BPF_REG_AX (t0) will be stored into count, so move the return value to it. */
+	move		t0, a0
+
+	ld.d		ra, sp, 0
+	ld.d		a5, sp, 8
+	ld.d		a0, sp, 16
+	ld.d		a1, sp, 24
+	ld.d		a2, sp, 32
+	ld.d		a3, sp, 40
+	ld.d		a4, sp, 48
+	addi.d		sp, sp, 64
+
+	jr		ra
+SYM_FUNC_END(arch_bpf_timed_may_goto)
-- 
2.25.1

Re: [PATCH v1 0/2] LoongArch: BPF: per-CPU addr MOV and timed may_goto

[Huacai Chen]

Hi, Tiezhu and Hengqi,

Any comments about this series?

Huacai

On Tue, Jun 9, 2026 at 12:14 PM George Guo <dongtai.guo@linux.dev> wrote:
>
> From: George Guo <guodongtai@kylinos.cn>
>
> This series enables two independent BPF JIT features on LoongArch, each
> advertised to the verifier via the corresponding bpf_jit_supports_*()
> hook:
>
> Patch 1 implements the internal-only BPF_MOV that resolves a per-CPU
> address from its per-CPU offset. LoongArch keeps the current CPU's
> per-CPU offset in $r21 (__my_cpu_offset), so the resolution is a single
> add of $r21 to the source register. This is used by verifier/JIT
> inlining (e.g. bpf_get_smp_processor_id() and per-CPU map lookups) and
> is not exposed to BPF users.
>
> Patch 2 implements arch_bpf_timed_may_goto() (in a small assembly stub
> with a custom calling convention passing the count/timestamp slot offset
> in BPF_REG_AX) and advertises it, so the verifier lowers may_goto into
> the timed, wall-clock-bounded variant instead of a fixed iteration
> counter.
>
> Tested on a LoongArch (Loongson-3A5000) QEMU/KVM guest with
> CONFIG_PAGE_SIZE_16KB and CONFIG_UNWINDER_ORC:
>  - patch 1: test_progs cpumask and percpu map cases pass;
>  - patch 2: test_progs iters (incl. the cond_break / may_goto loop
>    cases) all pass.
>
> George Guo (2):
>   LoongArch: BPF: Support internal-only MOV to resolve per-CPU addrs
>   LoongArch: BPF: Add timed may_goto support
>
>  arch/loongarch/include/asm/inst.h       |  1 +
>  arch/loongarch/net/Makefile             |  2 +-
>  arch/loongarch/net/bpf_jit.c            | 27 ++++++++++++++-
>  arch/loongarch/net/bpf_timed_may_goto.S | 44 +++++++++++++++++++++++++
>  4 files changed, 72 insertions(+), 2 deletions(-)
>  create mode 100644 arch/loongarch/net/bpf_timed_may_goto.S
>
> --
> 2.25.1
>

Re: [PATCH v1 0/2] LoongArch: BPF: per-CPU addr MOV and timed may_goto

[Tiezhu Yang]

On 2026/6/13 上午11:09, Huacai Chen wrote:
> Hi, Tiezhu and Hengqi,
> 
> Any comments about this series?

This is a preliminary review during the current merge window.

Based on the DWARF for the LoongArch Architecture specification,
GCC disassembly, the kernel's ORC definition (unwind_orc.c), and
the BPF JIT stack layout defined in build_prologue(), the saving
position of $ra in your trampoline is incorrect.

build_prologue() explicitly shows that LoongArch BPF JIT expects
$ra to be stored at the highest slot right below the original $sp.
Furthermore, the ORC unwinder strictly mandates .ra_offset = -8
(PREV_SP - 8). Storing $ra at 0($sp) (which is PREV_SP - 64)
breaks both JIT conventions and kernel stack unwinding.

Since we are currently in the Merge Window, please take your time
to rebase this patchset against the latest tree and send a v2 after
the merge window closes (post -rc1), and please wait for more time
to get more comments.

Thanks,
Tiezhu