[PATCH bpf-next v4 0/3] bpf, riscv: add timed may_goto support

[PATCH bpf-next v4 0/3] bpf, riscv: add timed may_goto support

[Feng Jiang]

This series adds RISC-V JIT support for the timed may_goto loop bound.

Patch 1 implements arch_bpf_timed_may_goto() and enables
bpf_jit_supports_timed_may_goto() so the verifier uses the timed
expansion path.

Patch 2 adds a test that checks R0-R5 are preserved across
arch_bpf_timed_may_goto() calls.

Patch 3 enables the verifier_may_goto_1, stream_cond_break, and
may_goto_interaction fastcall tests on riscv64.

Tested on riscv64 QEMU (rva23s64): may_goto programs load and JIT
correctly, and the 250ms timeout path works as expected.

Signed-off-by: Feng Jiang <jiangfeng@kylinos.cn>
---
Changes in v4:
- Add 'bpf-next' prefix to match the BPF kernel tree workflow.
- Add a test checking that R0-R5 are preserved across
  arch_bpf_timed_may_goto() calls. Use bpf_get_prandom_u32() to
  prevent the verifier from removing the checks via DCE.
- Rename may_goto_interaction_arm64() to may_goto_interaction().
- Wrap the arch_bpf_timed_may_goto address check to a single line.
- Link to v3: https://lore.kernel.org/r/20260715-riscv-bpf-timed-may-goto-v3-0-cf2a9c3d843f@kylinos.cn

Changes in v3:
- Set up the frame pointer in arch_bpf_timed_may_goto() so the function
  does not break stack unwinding under CONFIG_FRAME_POINTER.

Changes in v2:
- Fix BPF_REG_0 being clobbered after arch_bpf_timed_may_goto() calls.
- Enable the may_goto_interaction fastcall test on riscv64.

---
Feng Jiang (3):
      bpf, riscv: add support for timed may_goto
      selftests/bpf: test timed may_goto preserves R0-R5
      selftests/bpf: enable timed may_goto tests for riscv64

 arch/riscv/net/Makefile                            |  2 +-
 arch/riscv/net/bpf_jit_comp64.c                    | 12 ++++-
 arch/riscv/net/bpf_timed_may_goto.S                | 47 +++++++++++++++++
 tools/testing/selftests/bpf/progs/stream.c         |  1 +
 .../selftests/bpf/progs/verifier_bpf_fastcall.c    |  3 +-
 .../selftests/bpf/progs/verifier_may_goto_1.c      | 61 ++++++++++++++++++++++
 6 files changed, 123 insertions(+), 3 deletions(-)
---
base-commit: a23a71823352e2d792dcaae25f1ebb744acbfc0b
change-id: 20260710-riscv-bpf-timed-may-goto-0dce564985af

Best regards,
-- 
Feng Jiang <jiangfeng@kylinos.cn>

[PATCH bpf-next v4 1/3] bpf, riscv: add support for timed may_goto

[Feng Jiang]

Implement arch_bpf_timed_may_goto() for the RV64 JIT. The argument and
return value are carried in BPF_REG_AX, and BPF R0-R5 are preserved
across the call to the generic bpf_check_timed_may_goto().

Enable bpf_jit_supports_timed_may_goto() so the verifier uses the timed
expansion path.

Signed-off-by: Feng Jiang <jiangfeng@kylinos.cn>
---
 arch/riscv/net/Makefile             |  2 +-
 arch/riscv/net/bpf_jit_comp64.c     | 12 +++++++++-
 arch/riscv/net/bpf_timed_may_goto.S | 47 +++++++++++++++++++++++++++++++++++++
 3 files changed, 59 insertions(+), 2 deletions(-)

diff --git a/arch/riscv/net/Makefile b/arch/riscv/net/Makefile
index 9a1e5f0a94e5..6458d4d51990 100644
--- a/arch/riscv/net/Makefile
+++ b/arch/riscv/net/Makefile
@@ -3,7 +3,7 @@
 obj-$(CONFIG_BPF_JIT) += bpf_jit_core.o
 
 ifeq ($(CONFIG_ARCH_RV64I),y)
-	obj-$(CONFIG_BPF_JIT) += bpf_jit_comp64.o
+	obj-$(CONFIG_BPF_JIT) += bpf_jit_comp64.o bpf_timed_may_goto.o
 else
 	obj-$(CONFIG_BPF_JIT) += bpf_jit_comp32.o
 endif
diff --git a/arch/riscv/net/bpf_jit_comp64.c b/arch/riscv/net/bpf_jit_comp64.c
index ad089a9a4ea9..8fe8969fb8a0 100644
--- a/arch/riscv/net/bpf_jit_comp64.c
+++ b/arch/riscv/net/bpf_jit_comp64.c
@@ -1841,7 +1841,12 @@ int bpf_jit_emit_insn(const struct bpf_insn *insn, struct rv_jit_context *ctx,
 		if (aux->tail_call_reachable && insn->src_reg == BPF_PSEUDO_CALL)
 			emit_sd(RV_REG_SP, ctx->tcc_offset, RV_REG_TCC, ctx);
 
-		if (insn->src_reg != BPF_PSEUDO_CALL)
+		/*
+		 * arch_bpf_timed_may_goto() is emitted by the verifier and
+		 * returns its result in BPF_REG_AX instead of BPF_REG_0, so
+		 * skip the normal "move return register into R0".
+		 */
+		if (insn->src_reg != BPF_PSEUDO_CALL && addr != (u64)arch_bpf_timed_may_goto)
 			emit_mv(bpf_to_rv_reg(BPF_REG_0, ctx), RV_REG_A0, ctx);
 		break;
 	}
@@ -2161,3 +2166,8 @@ bool bpf_jit_supports_subprog_tailcalls(void)
 {
 	return true;
 }
+
+bool bpf_jit_supports_timed_may_goto(void)
+{
+	return true;
+}
diff --git a/arch/riscv/net/bpf_timed_may_goto.S b/arch/riscv/net/bpf_timed_may_goto.S
new file mode 100644
index 000000000000..f4bf2cd10586
--- /dev/null
+++ b/arch/riscv/net/bpf_timed_may_goto.S
@@ -0,0 +1,47 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+/* Copyright (c) 2026 Feng Jiang <jiangfeng@kylinos.cn> */
+
+#include <linux/linkage.h>
+#include <asm/asm.h>
+
+/*
+ * Trampoline for the BPF timed may_goto loop bound. Custom calling convention:
+ *	- input:  stack offset in BPF_REG_AX (t0)
+ *	- output: updated count in BPF_REG_AX (t0)
+ *
+ * Calls bpf_check_timed_may_goto(ptr) with the standard RISC-V ABI, where
+ * ptr = BPF_REG_FP (s5) + BPF_REG_AX (t0). BPF R0-R5 (a5, a0-a4) are saved
+ * across the call; BPF_REG_FP (s5) is callee-saved and needs no saving.
+ */
+
+SYM_FUNC_START(arch_bpf_timed_may_goto)
+	addi	sp, sp, -64
+	sd	ra, 56(sp)
+	sd	s0, 48(sp)
+	addi	s0, sp, 64
+
+	/* Save BPF registers R0-R5 (a5, a0-a4) */
+	sd	a5, 40(sp)
+	sd	a0, 32(sp)
+	sd	a1, 24(sp)
+	sd	a2, 16(sp)
+	sd	a3, 8(sp)
+	sd	a4, 0(sp)
+
+	add	a0, t0, s5
+	call	bpf_check_timed_may_goto
+	mv	t0, a0
+
+	/* Restore BPF registers R0-R5 */
+	ld	a4, 0(sp)
+	ld	a3, 8(sp)
+	ld	a2, 16(sp)
+	ld	a1, 24(sp)
+	ld	a0, 32(sp)
+	ld	a5, 40(sp)
+
+	ld	s0, 48(sp)
+	ld	ra, 56(sp)
+	addi	sp, sp, 64
+	ret
+SYM_FUNC_END(arch_bpf_timed_may_goto)

-- 
2.53.0

[PATCH bpf-next v4 2/3] selftests/bpf: test timed may_goto preserves R0-R5

[Feng Jiang]

Add a test that checks R0-R5 are preserved across
arch_bpf_timed_may_goto() calls.

Use bpf_get_prandom_u32() to avoid the verifier removing the checks
via DCE.

Suggested-by: Björn Töpel <bjorn@kernel.org>
Signed-off-by: Feng Jiang <jiangfeng@kylinos.cn>
---
 .../selftests/bpf/progs/verifier_may_goto_1.c      | 57 ++++++++++++++++++++++
 1 file changed, 57 insertions(+)

diff --git a/tools/testing/selftests/bpf/progs/verifier_may_goto_1.c b/tools/testing/selftests/bpf/progs/verifier_may_goto_1.c
index 4bdf4256a41e..98d59108d097 100644
--- a/tools/testing/selftests/bpf/progs/verifier_may_goto_1.c
+++ b/tools/testing/selftests/bpf/progs/verifier_may_goto_1.c
@@ -106,4 +106,61 @@ __naked void may_goto_batch_2(void)
 	: __clobber_all);
 }
 
+/*
+ * Use bpf_get_prandom_u32() to prevent DCE from removing the checks.
+ * retval: 0=all ok, 1-6=R0-R5 clobbered.
+ */
+SEC("raw_tp")
+__description("timed may_goto preserves R0-R5")
+__arch_x86_64
+__arch_arm64
+__arch_riscv64
+__success
+__retval(0)
+__naked void timed_may_goto_preserves_regs(void)
+{
+	asm volatile (
+	"call %[bpf_get_prandom_u32];"
+	"r6 = r0;"
+	"r0 = 0x1111;"
+	"r0 += r6;"
+	"r1 = 0x2222;"
+	"r1 += r6;"
+	"r2 = 0x3333;"
+	"r2 += r6;"
+	"r3 = 0x4444;"
+	"r3 += r6;"
+	"r4 = 0x5555;"
+	"r4 += r6;"
+	"r5 = 0x6666;"
+	"r5 += r6;"
+	".8byte %[may_goto];"
+	".8byte %[loop];"
+	"r0 -= r6;"
+	"r1 -= r6;"
+	"r2 -= r6;"
+	"r3 -= r6;"
+	"r4 -= r6;"
+	"r5 -= r6;"
+	"if r0 != 0x1111 goto 1f;"
+	"if r1 != 0x2222 goto 2f;"
+	"if r2 != 0x3333 goto 3f;"
+	"if r3 != 0x4444 goto 4f;"
+	"if r4 != 0x5555 goto 5f;"
+	"if r5 != 0x6666 goto 6f;"
+	"r0 = 0;"
+	"exit;"
+	"1: r0 = 1; exit;"
+	"2: r0 = 2; exit;"
+	"3: r0 = 3; exit;"
+	"4: r0 = 4; exit;"
+	"5: r0 = 5; exit;"
+	"6: r0 = 6; exit;"
+	:
+	: __imm(bpf_get_prandom_u32),
+	  __imm_insn(may_goto, BPF_RAW_INSN(BPF_JMP | BPF_JCOND, 0, 0, 1, 0)),
+	  __imm_insn(loop, BPF_RAW_INSN(BPF_JMP | BPF_JA, 0, 0, -2, 0))
+	: __clobber_all);
+}
+
 char _license[] SEC("license") = "GPL";

-- 
2.53.0

[PATCH bpf-next v4 3/3] selftests/bpf: enable timed may_goto tests for riscv64

[Feng Jiang]

Enable verifier_may_goto_1 (raw instruction tests), stream_cond_break
(250ms timeout path), and the may_goto_interaction fastcall test on
riscv64 now that the JIT supports timed may_goto.

Signed-off-by: Feng Jiang <jiangfeng@kylinos.cn>
---
 tools/testing/selftests/bpf/progs/stream.c                | 1 +
 tools/testing/selftests/bpf/progs/verifier_bpf_fastcall.c | 3 ++-
 tools/testing/selftests/bpf/progs/verifier_may_goto_1.c   | 4 ++++
 3 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/tools/testing/selftests/bpf/progs/stream.c b/tools/testing/selftests/bpf/progs/stream.c
index 92ba1d72e0ec..8d8e53d37266 100644
--- a/tools/testing/selftests/bpf/progs/stream.c
+++ b/tools/testing/selftests/bpf/progs/stream.c
@@ -64,6 +64,7 @@ SEC("syscall")
 __arch_x86_64
 __arch_arm64
 __arch_s390x
+__arch_riscv64
 __success __retval(0)
 __stderr("ERROR: Timeout detected for may_goto instruction")
 __stderr("CPU: {{[0-9]+}} UID: 0 PID: {{[0-9]+}} Comm: {{.*}}")
diff --git a/tools/testing/selftests/bpf/progs/verifier_bpf_fastcall.c b/tools/testing/selftests/bpf/progs/verifier_bpf_fastcall.c
index 8d7ff38e4c06..83707faea049 100644
--- a/tools/testing/selftests/bpf/progs/verifier_bpf_fastcall.c
+++ b/tools/testing/selftests/bpf/progs/verifier_bpf_fastcall.c
@@ -660,6 +660,7 @@ __naked void may_goto_interaction_x86_64(void)
 
 SEC("raw_tp")
 __arch_arm64
+__arch_riscv64
 __log_level(4) __msg("stack depth 24")
 /* may_goto counter at -24 */
 __xlated("0: *(u64 *)(r10 -24) =")
@@ -679,7 +680,7 @@ __xlated("10: *(u64 *)(r10 -24) = r12")
 __xlated("11: *(u64 *)(r10 -8) = r1")
 __xlated("12: exit")
 __success
-__naked void may_goto_interaction_arm64(void)
+__naked void may_goto_interaction(void)
 {
 	asm volatile (
 	"r1 = 1;"
diff --git a/tools/testing/selftests/bpf/progs/verifier_may_goto_1.c b/tools/testing/selftests/bpf/progs/verifier_may_goto_1.c
index 98d59108d097..97129d2730a0 100644
--- a/tools/testing/selftests/bpf/progs/verifier_may_goto_1.c
+++ b/tools/testing/selftests/bpf/progs/verifier_may_goto_1.c
@@ -11,6 +11,7 @@ __description("may_goto 0")
 __arch_x86_64
 __arch_s390x
 __arch_arm64
+__arch_riscv64
 __xlated("0: r0 = 1")
 __xlated("1: exit")
 __success
@@ -31,6 +32,7 @@ __description("batch 2 of may_goto 0")
 __arch_x86_64
 __arch_s390x
 __arch_arm64
+__arch_riscv64
 __xlated("0: r0 = 1")
 __xlated("1: exit")
 __success
@@ -53,6 +55,7 @@ __description("may_goto batch with offsets 2/1/0")
 __arch_x86_64
 __arch_s390x
 __arch_arm64
+__arch_riscv64
 __xlated("0: r0 = 1")
 __xlated("1: exit")
 __success
@@ -79,6 +82,7 @@ __description("may_goto batch with offsets 2/0")
 __arch_x86_64
 __arch_s390x
 __arch_arm64
+__arch_riscv64
 __xlated("0: *(u64 *)(r10 -16) = 65535")
 __xlated("1: *(u64 *)(r10 -8) = 0")
 __xlated("2: r12 = *(u64 *)(r10 -16)")

-- 
2.53.0

Re: [PATCH bpf-next v4 1/3] bpf, riscv: add support for timed may_goto

[Pu Lehui]

On 2026/7/22 12:21, Feng Jiang wrote:
> Implement arch_bpf_timed_may_goto() for the RV64 JIT. The argument and
> return value are carried in BPF_REG_AX, and BPF R0-R5 are preserved
> across the call to the generic bpf_check_timed_may_goto().
> 
> Enable bpf_jit_supports_timed_may_goto() so the verifier uses the timed
> expansion path.
> 
> Signed-off-by: Feng Jiang <jiangfeng@kylinos.cn>
> ---
>   arch/riscv/net/Makefile             |  2 +-
>   arch/riscv/net/bpf_jit_comp64.c     | 12 +++++++++-
>   arch/riscv/net/bpf_timed_may_goto.S | 47 +++++++++++++++++++++++++++++++++++++
>   3 files changed, 59 insertions(+), 2 deletions(-)
> 
> diff --git a/arch/riscv/net/Makefile b/arch/riscv/net/Makefile
> index 9a1e5f0a94e5..6458d4d51990 100644
> --- a/arch/riscv/net/Makefile
> +++ b/arch/riscv/net/Makefile
> @@ -3,7 +3,7 @@
>   obj-$(CONFIG_BPF_JIT) += bpf_jit_core.o
>   
>   ifeq ($(CONFIG_ARCH_RV64I),y)
> -	obj-$(CONFIG_BPF_JIT) += bpf_jit_comp64.o
> +	obj-$(CONFIG_BPF_JIT) += bpf_jit_comp64.o bpf_timed_may_goto.o
>   else
>   	obj-$(CONFIG_BPF_JIT) += bpf_jit_comp32.o
>   endif
> diff --git a/arch/riscv/net/bpf_jit_comp64.c b/arch/riscv/net/bpf_jit_comp64.c
> index ad089a9a4ea9..8fe8969fb8a0 100644
> --- a/arch/riscv/net/bpf_jit_comp64.c
> +++ b/arch/riscv/net/bpf_jit_comp64.c
> @@ -1841,7 +1841,12 @@ int bpf_jit_emit_insn(const struct bpf_insn *insn, struct rv_jit_context *ctx,
>   		if (aux->tail_call_reachable && insn->src_reg == BPF_PSEUDO_CALL)
>   			emit_sd(RV_REG_SP, ctx->tcc_offset, RV_REG_TCC, ctx);
>   
> -		if (insn->src_reg != BPF_PSEUDO_CALL)
> +		/*
> +		 * arch_bpf_timed_may_goto() is emitted by the verifier and
> +		 * returns its result in BPF_REG_AX instead of BPF_REG_0, so
> +		 * skip the normal "move return register into R0".
> +		 */
> +		if (insn->src_reg != BPF_PSEUDO_CALL && addr != (u64)arch_bpf_timed_may_goto)
>   			emit_mv(bpf_to_rv_reg(BPF_REG_0, ctx), RV_REG_A0, ctx);
>   		break;
>   	}
> @@ -2161,3 +2166,8 @@ bool bpf_jit_supports_subprog_tailcalls(void)
>   {
>   	return true;
>   }
> +
> +bool bpf_jit_supports_timed_may_goto(void)
> +{
> +	return true;
> +}
> diff --git a/arch/riscv/net/bpf_timed_may_goto.S b/arch/riscv/net/bpf_timed_may_goto.S
> new file mode 100644
> index 000000000000..f4bf2cd10586
> --- /dev/null
> +++ b/arch/riscv/net/bpf_timed_may_goto.S
> @@ -0,0 +1,47 @@
> +/* SPDX-License-Identifier: GPL-2.0 */
> +/* Copyright (c) 2026 Feng Jiang <jiangfeng@kylinos.cn> */
> +
> +#include <linux/linkage.h>
> +#include <asm/asm.h>
> +
> +/*
> + * Trampoline for the BPF timed may_goto loop bound. Custom calling convention:
> + *	- input:  stack offset in BPF_REG_AX (t0)
> + *	- output: updated count in BPF_REG_AX (t0)
> + *
> + * Calls bpf_check_timed_may_goto(ptr) with the standard RISC-V ABI, where
> + * ptr = BPF_REG_FP (s5) + BPF_REG_AX (t0). BPF R0-R5 (a5, a0-a4) are saved
> + * across the call; BPF_REG_FP (s5) is callee-saved and needs no saving.
> + */
> +
> +SYM_FUNC_START(arch_bpf_timed_may_goto)
> +	addi	sp, sp, -64
> +	sd	ra, 56(sp)
> +	sd	s0, 48(sp)
> +	addi	s0, sp, 64
> +
> +	/* Save BPF registers R0-R5 (a5, a0-a4) */
> +	sd	a5, 40(sp)
> +	sd	a0, 32(sp)
> +	sd	a1, 24(sp)
> +	sd	a2, 16(sp)
> +	sd	a3, 8(sp)
> +	sd	a4, 0(sp)
> +
> +	add	a0, t0, s5
> +	call	bpf_check_timed_may_goto
> +	mv	t0, a0
> +
> +	/* Restore BPF registers R0-R5 */
> +	ld	a4, 0(sp)
> +	ld	a3, 8(sp)
> +	ld	a2, 16(sp)
> +	ld	a1, 24(sp)
> +	ld	a0, 32(sp)
> +	ld	a5, 40(sp)
> +
> +	ld	s0, 48(sp)
> +	ld	ra, 56(sp)
> +	addi	sp, sp, 64
> +	ret
> +SYM_FUNC_END(arch_bpf_timed_may_goto)

I think we should use REG_S/REG_L/SZREG like in arch/riscv ([0]) – it 
keeps us in sync with upstream and will make it easier if we may later 
port timed_may_goto to RV32.

[0] arch/riscv/kernel/mcount.S

Re: [PATCH bpf-next v4 3/3] selftests/bpf: enable timed may_goto tests for riscv64

[Pu Lehui]

On 2026/7/22 12:21, Feng Jiang wrote:
> Enable verifier_may_goto_1 (raw instruction tests), stream_cond_break
> (250ms timeout path), and the may_goto_interaction fastcall test on
> riscv64 now that the JIT supports timed may_goto.
> 
> Signed-off-by: Feng Jiang <jiangfeng@kylinos.cn>
> ---
>   tools/testing/selftests/bpf/progs/stream.c                | 1 +
>   tools/testing/selftests/bpf/progs/verifier_bpf_fastcall.c | 3 ++-
>   tools/testing/selftests/bpf/progs/verifier_may_goto_1.c   | 4 ++++
>   3 files changed, 7 insertions(+), 1 deletion(-)
> 
> diff --git a/tools/testing/selftests/bpf/progs/stream.c b/tools/testing/selftests/bpf/progs/stream.c
> index 92ba1d72e0ec..8d8e53d37266 100644
> --- a/tools/testing/selftests/bpf/progs/stream.c
> +++ b/tools/testing/selftests/bpf/progs/stream.c
> @@ -64,6 +64,7 @@ SEC("syscall")
>   __arch_x86_64
>   __arch_arm64
>   __arch_s390x
> +__arch_riscv64
>   __success __retval(0)
>   __stderr("ERROR: Timeout detected for may_goto instruction")
>   __stderr("CPU: {{[0-9]+}} UID: 0 PID: {{[0-9]+}} Comm: {{.*}}")
> diff --git a/tools/testing/selftests/bpf/progs/verifier_bpf_fastcall.c b/tools/testing/selftests/bpf/progs/verifier_bpf_fastcall.c
> index 8d7ff38e4c06..83707faea049 100644
> --- a/tools/testing/selftests/bpf/progs/verifier_bpf_fastcall.c
> +++ b/tools/testing/selftests/bpf/progs/verifier_bpf_fastcall.c
> @@ -660,6 +660,7 @@ __naked void may_goto_interaction_x86_64(void)
>   
>   SEC("raw_tp")
>   __arch_arm64
> +__arch_riscv64
>   __log_level(4) __msg("stack depth 24")
>   /* may_goto counter at -24 */
>   __xlated("0: *(u64 *)(r10 -24) =")
> @@ -679,7 +680,7 @@ __xlated("10: *(u64 *)(r10 -24) = r12")
>   __xlated("11: *(u64 *)(r10 -8) = r1")
>   __xlated("12: exit")
>   __success
> -__naked void may_goto_interaction_arm64(void)
> +__naked void may_goto_interaction(void)
>   {
>   	asm volatile (
>   	"r1 = 1;"
> diff --git a/tools/testing/selftests/bpf/progs/verifier_may_goto_1.c b/tools/testing/selftests/bpf/progs/verifier_may_goto_1.c
> index 98d59108d097..97129d2730a0 100644
> --- a/tools/testing/selftests/bpf/progs/verifier_may_goto_1.c
> +++ b/tools/testing/selftests/bpf/progs/verifier_may_goto_1.c
> @@ -11,6 +11,7 @@ __description("may_goto 0")
>   __arch_x86_64
>   __arch_s390x
>   __arch_arm64
> +__arch_riscv64
>   __xlated("0: r0 = 1")
>   __xlated("1: exit")
>   __success
> @@ -31,6 +32,7 @@ __description("batch 2 of may_goto 0")
>   __arch_x86_64
>   __arch_s390x
>   __arch_arm64
> +__arch_riscv64
>   __xlated("0: r0 = 1")
>   __xlated("1: exit")
>   __success
> @@ -53,6 +55,7 @@ __description("may_goto batch with offsets 2/1/0")
>   __arch_x86_64
>   __arch_s390x
>   __arch_arm64
> +__arch_riscv64
>   __xlated("0: r0 = 1")
>   __xlated("1: exit")
>   __success
> @@ -79,6 +82,7 @@ __description("may_goto batch with offsets 2/0")
>   __arch_x86_64
>   __arch_s390x
>   __arch_arm64
> +__arch_riscv64
>   __xlated("0: *(u64 *)(r10 -16) = 65535")
>   __xlated("1: *(u64 *)(r10 -8) = 0")
>   __xlated("2: r12 = *(u64 *)(r10 -16)")
> 

Reviewed-by: Pu Lehui <pulehui@huawei.com>

Re: [PATCH bpf-next v4 2/3] selftests/bpf: test timed may_goto preserves R0-R5

[Pu Lehui]

On 2026/7/22 12:21, Feng Jiang wrote:
> Add a test that checks R0-R5 are preserved across
> arch_bpf_timed_may_goto() calls.
> 
> Use bpf_get_prandom_u32() to avoid the verifier removing the checks
> via DCE.
> 
> Suggested-by: Björn Töpel <bjorn@kernel.org>
> Signed-off-by: Feng Jiang <jiangfeng@kylinos.cn>
> ---
>   .../selftests/bpf/progs/verifier_may_goto_1.c      | 57 ++++++++++++++++++++++
>   1 file changed, 57 insertions(+)
> 
> diff --git a/tools/testing/selftests/bpf/progs/verifier_may_goto_1.c b/tools/testing/selftests/bpf/progs/verifier_may_goto_1.c
> index 4bdf4256a41e..98d59108d097 100644
> --- a/tools/testing/selftests/bpf/progs/verifier_may_goto_1.c
> +++ b/tools/testing/selftests/bpf/progs/verifier_may_goto_1.c
> @@ -106,4 +106,61 @@ __naked void may_goto_batch_2(void)
>   	: __clobber_all);
>   }
>   
> +/*
> + * Use bpf_get_prandom_u32() to prevent DCE from removing the checks.
> + * retval: 0=all ok, 1-6=R0-R5 clobbered.
> + */
> +SEC("raw_tp")
> +__description("timed may_goto preserves R0-R5")
> +__arch_x86_64
> +__arch_arm64
> +__arch_riscv64
> +__success
> +__retval(0)

__arch_s390x is also supported timed_may_goto

> +__naked void timed_may_goto_preserves_regs(void)
> +{
> +	asm volatile (
> +	"call %[bpf_get_prandom_u32];"
> +	"r6 = r0;"
> +	"r0 = 0x1111;"
> +	"r0 += r6;"
> +	"r1 = 0x2222;"
> +	"r1 += r6;"
> +	"r2 = 0x3333;"
> +	"r2 += r6;"
> +	"r3 = 0x4444;"
> +	"r3 += r6;"
> +	"r4 = 0x5555;"
> +	"r4 += r6;"
> +	"r5 = 0x6666;"
> +	"r5 += r6;"
> +	".8byte %[may_goto];"
> +	".8byte %[loop];"
> +	"r0 -= r6;"
> +	"r1 -= r6;"
> +	"r2 -= r6;"
> +	"r3 -= r6;"
> +	"r4 -= r6;"
> +	"r5 -= r6;"
> +	"if r0 != 0x1111 goto 1f;"
> +	"if r1 != 0x2222 goto 2f;"
> +	"if r2 != 0x3333 goto 3f;"
> +	"if r3 != 0x4444 goto 4f;"
> +	"if r4 != 0x5555 goto 5f;"
> +	"if r5 != 0x6666 goto 6f;"
> +	"r0 = 0;"
> +	"exit;"
> +	"1: r0 = 1; exit;"
> +	"2: r0 = 2; exit;"
> +	"3: r0 = 3; exit;"
> +	"4: r0 = 4; exit;"
> +	"5: r0 = 5; exit;"
> +	"6: r0 = 6; exit;"
> +	:
> +	: __imm(bpf_get_prandom_u32),
> +	  __imm_insn(may_goto, BPF_RAW_INSN(BPF_JMP | BPF_JCOND, 0, 0, 1, 0)),
> +	  __imm_insn(loop, BPF_RAW_INSN(BPF_JMP | BPF_JA, 0, 0, -2, 0))
> +	: __clobber_all);
> +}
> +
>   char _license[] SEC("license") = "GPL";
> 

not work, pls take a look

root@(none):/mnt/bpf# ./test_progs -v -a verifier_may_goto_1
bpf_testmod.ko is already unloaded.
Loading bpf_testmod.ko...
[   26.123549] bpf_testmod: loading out-of-tree module taints kernel.
[   26.127885] bpf_testmod: module verification failed: signature and/or 
required key missing - tainting kernel
Successfully loaded bpf_testmod.ko.
tester_init:PASS:tester_log_buf 0 nsec
process_subtest:PASS:obj_open_mem 0 nsec
process_subtest:PASS:specs_alloc 0 nsec
run_subtest:PASS:obj_open_mem 0 nsec
run_subtest:PASS:unexpected_load_failure 0 nsec
VERIFIER LOG:
=============
processed 43 insns (limit 1000000) max_states_per_insn 0 total_states 4 
peak_states 5 mark_read 0
=============
do_prog_test_run:FAIL:1114 FAIL: Unexpected bpf_prog_test_run error: 22 
(Invalid argument) #660/1   verifier_may_goto_1/timed may_goto preserves 
R0-R5:FAIL
#660     verifier_may_goto_1:FAIL
Summary: 0/0 PASSED, 0 SKIPPED, 1 FAILED
Successfully unloaded bpf_testmod.ko.

Re: [PATCH bpf-next v4 1/3] bpf, riscv: add support for timed may_goto

[Feng Jiang]

On 2026/7/22 18:18, Pu Lehui wrote:
> 
> On 2026/7/22 12:21, Feng Jiang wrote:
>> Implement arch_bpf_timed_may_goto() for the RV64 JIT. The argument and
>> return value are carried in BPF_REG_AX, and BPF R0-R5 are preserved
>> across the call to the generic bpf_check_timed_may_goto().
>>
>> Enable bpf_jit_supports_timed_may_goto() so the verifier uses the timed
>> expansion path.
>>
>> Signed-off-by: Feng Jiang <jiangfeng@kylinos.cn>

[ ...] 

>> diff --git a/arch/riscv/net/bpf_timed_may_goto.S b/arch/riscv/net/bpf_timed_may_goto.S
>> new file mode 100644
>> index 000000000000..f4bf2cd10586
>> --- /dev/null
>> +++ b/arch/riscv/net/bpf_timed_may_goto.S
>> @@ -0,0 +1,47 @@
>> +/* SPDX-License-Identifier: GPL-2.0 */
>> +/* Copyright (c) 2026 Feng Jiang <jiangfeng@kylinos.cn> */
>> +
>> +#include <linux/linkage.h>
>> +#include <asm/asm.h>
>> +
>> +/*
>> + * Trampoline for the BPF timed may_goto loop bound. Custom calling convention:
>> + *    - input:  stack offset in BPF_REG_AX (t0)
>> + *    - output: updated count in BPF_REG_AX (t0)
>> + *
>> + * Calls bpf_check_timed_may_goto(ptr) with the standard RISC-V ABI, where
>> + * ptr = BPF_REG_FP (s5) + BPF_REG_AX (t0). BPF R0-R5 (a5, a0-a4) are saved
>> + * across the call; BPF_REG_FP (s5) is callee-saved and needs no saving.
>> + */
>> +
>> +SYM_FUNC_START(arch_bpf_timed_may_goto)
>> +    addi    sp, sp, -64
>> +    sd    ra, 56(sp)
>> +    sd    s0, 48(sp)
>> +    addi    s0, sp, 64
>> +
>> +    /* Save BPF registers R0-R5 (a5, a0-a4) */
>> +    sd    a5, 40(sp)
>> +    sd    a0, 32(sp)
>> +    sd    a1, 24(sp)
>> +    sd    a2, 16(sp)
>> +    sd    a3, 8(sp)
>> +    sd    a4, 0(sp)
>> +
>> +    add    a0, t0, s5
>> +    call    bpf_check_timed_may_goto
>> +    mv    t0, a0
>> +
>> +    /* Restore BPF registers R0-R5 */
>> +    ld    a4, 0(sp)
>> +    ld    a3, 8(sp)
>> +    ld    a2, 16(sp)
>> +    ld    a1, 24(sp)
>> +    ld    a0, 32(sp)
>> +    ld    a5, 40(sp)
>> +
>> +    ld    s0, 48(sp)
>> +    ld    ra, 56(sp)
>> +    addi    sp, sp, 64
>> +    ret
>> +SYM_FUNC_END(arch_bpf_timed_may_goto)
> 
> I think we should use REG_S/REG_L/SZREG like in arch/riscv ([0]) – it keeps us in sync with upstream and will make it easier if we may later port timed_may_goto to RV32.
> 
> [0] arch/riscv/kernel/mcount.S

Agreed, will switch to REG_S/REG_L/SZREG in v5.

-- 
With Best Regards,
Feng Jiang

Re: [PATCH bpf-next v4 2/3] selftests/bpf: test timed may_goto preserves R0-R5

[Feng Jiang]

On 2026/7/22 19:10, Pu Lehui wrote:
> 
> 
> On 2026/7/22 12:21, Feng Jiang wrote:
>> Add a test that checks R0-R5 are preserved across
>> arch_bpf_timed_may_goto() calls.
>>
>> Use bpf_get_prandom_u32() to avoid the verifier removing the checks
>> via DCE.
>>
>> Suggested-by: Björn Töpel <bjorn@kernel.org>
>> Signed-off-by: Feng Jiang <jiangfeng@kylinos.cn>
>> ---
>>   .../selftests/bpf/progs/verifier_may_goto_1.c      | 57 ++++++++++++++++++++++
>>   1 file changed, 57 insertions(+)
>>
>> diff --git a/tools/testing/selftests/bpf/progs/verifier_may_goto_1.c b/tools/testing/selftests/bpf/progs/verifier_may_goto_1.c
>> index 4bdf4256a41e..98d59108d097 100644
>> --- a/tools/testing/selftests/bpf/progs/verifier_may_goto_1.c
>> +++ b/tools/testing/selftests/bpf/progs/verifier_may_goto_1.c
>> @@ -106,4 +106,61 @@ __naked void may_goto_batch_2(void)
>>       : __clobber_all);
>>   }
>>   +/*
>> + * Use bpf_get_prandom_u32() to prevent DCE from removing the checks.
>> + * retval: 0=all ok, 1-6=R0-R5 clobbered.
>> + */
>> +SEC("raw_tp")
>> +__description("timed may_goto preserves R0-R5")
>> +__arch_x86_64
>> +__arch_arm64
>> +__arch_riscv64
>> +__success
>> +__retval(0)
> 
> __arch_s390x is also supported timed_may_goto

Will add it in v5.

> 
>> +__naked void timed_may_goto_preserves_regs(void)
>> +{
>> +    asm volatile (
>> +    "call %[bpf_get_prandom_u32];"
>> +    "r6 = r0;"
>> +    "r0 = 0x1111;"
>> +    "r0 += r6;"
>> +    "r1 = 0x2222;"
>> +    "r1 += r6;"
>> +    "r2 = 0x3333;"
>> +    "r2 += r6;"
>> +    "r3 = 0x4444;"
>> +    "r3 += r6;"
>> +    "r4 = 0x5555;"
>> +    "r4 += r6;"
>> +    "r5 = 0x6666;"
>> +    "r5 += r6;"
>> +    ".8byte %[may_goto];"
>> +    ".8byte %[loop];"
>> +    "r0 -= r6;"
>> +    "r1 -= r6;"
>> +    "r2 -= r6;"
>> +    "r3 -= r6;"
>> +    "r4 -= r6;"
>> +    "r5 -= r6;"
>> +    "if r0 != 0x1111 goto 1f;"
>> +    "if r1 != 0x2222 goto 2f;"
>> +    "if r2 != 0x3333 goto 3f;"
>> +    "if r3 != 0x4444 goto 4f;"
>> +    "if r4 != 0x5555 goto 5f;"
>> +    "if r5 != 0x6666 goto 6f;"
>> +    "r0 = 0;"
>> +    "exit;"
>> +    "1: r0 = 1; exit;"
>> +    "2: r0 = 2; exit;"
>> +    "3: r0 = 3; exit;"
>> +    "4: r0 = 4; exit;"
>> +    "5: r0 = 5; exit;"
>> +    "6: r0 = 6; exit;"
>> +    :
>> +    : __imm(bpf_get_prandom_u32),
>> +      __imm_insn(may_goto, BPF_RAW_INSN(BPF_JMP | BPF_JCOND, 0, 0, 1, 0)),
>> +      __imm_insn(loop, BPF_RAW_INSN(BPF_JMP | BPF_JA, 0, 0, -2, 0))
>> +    : __clobber_all);
>> +}
>> +
>>   char _license[] SEC("license") = "GPL";
>>
> 
> not work, pls take a look

The __retval(0) annotation enables the test_run path in test_laoder.
do_prog_test_run() sets data_in/data_out/repeat by default,
which bpf_prog_test_run_raw_tp() rejects with EINVAL. Switching to
SEC("syscall") makes test_loader use empty opts. Will fix it in v5.

> 
> root@(none):/mnt/bpf# ./test_progs -v -a verifier_may_goto_1
> bpf_testmod.ko is already unloaded.
> Loading bpf_testmod.ko...
> [   26.123549] bpf_testmod: loading out-of-tree module taints kernel.
> [   26.127885] bpf_testmod: module verification failed: signature and/or required key missing - tainting kernel
> Successfully loaded bpf_testmod.ko.
> tester_init:PASS:tester_log_buf 0 nsec
> process_subtest:PASS:obj_open_mem 0 nsec
> process_subtest:PASS:specs_alloc 0 nsec
> run_subtest:PASS:obj_open_mem 0 nsec
> run_subtest:PASS:unexpected_load_failure 0 nsec
> VERIFIER LOG:
> =============
> processed 43 insns (limit 1000000) max_states_per_insn 0 total_states 4 peak_states 5 mark_read 0
> =============
> do_prog_test_run:FAIL:1114 FAIL: Unexpected bpf_prog_test_run error: 22 (Invalid argument) #660/1   verifier_may_goto_1/timed may_goto preserves R0-R5:FAIL
> #660     verifier_may_goto_1:FAIL
> Summary: 0/0 PASSED, 0 SKIPPED, 1 FAILED
> Successfully unloaded bpf_testmod.ko.

-- 
With Best Regards,
Feng Jiang