Implement BPF_TRACE_FSESSION support in the RISC-V trampoline JIT. The
logic here is similar to what we did in x86_64.
In order to simply the logic, we factor out the function invoke_bpf() for
fentry and fexit.
Signed-off-by: Menglong Dong <dongml2@chinatelecom.cn>
Tested-by: Björn Töpel <bjorn@kernel.org>
Acked-by: Björn Töpel <bjorn@kernel.org>
---
v3:
- remove the "always" from the comment
v2:
- use bpf_prog_calls_session_cookie() in invoke_bpf()
---
arch/riscv/net/bpf_jit_comp64.c | 74 ++++++++++++++++++++++++++++-----
1 file changed, 64 insertions(+), 10 deletions(-)
diff --git a/arch/riscv/net/bpf_jit_comp64.c b/arch/riscv/net/bpf_jit_comp64.c
index e4f45e2e7e2f..d45fa9c6a7dd 100644
--- a/arch/riscv/net/bpf_jit_comp64.c
+++ b/arch/riscv/net/bpf_jit_comp64.c
@@ -996,6 +996,29 @@ static int invoke_bpf_prog(struct bpf_tramp_link *l, int args_off, int retval_of
return ret;
}
+static int invoke_bpf(struct bpf_tramp_links *tl, int args_off, int retval_off,
+ int run_ctx_off, int func_meta_off, bool save_ret, u64 func_meta,
+ int cookie_off, struct rv_jit_context *ctx)
+{
+ int i, cur_cookie = (cookie_off - args_off) / 8;
+
+ for (i = 0; i < tl->nr_links; i++) {
+ int err;
+
+ if (bpf_prog_calls_session_cookie(&tl->links[i])) {
+ u64 meta = func_meta | ((u64)cur_cookie << BPF_TRAMP_COOKIE_INDEX_SHIFT);
+
+ emit_store_stack_imm64(RV_REG_T1, -func_meta_off, meta, ctx);
+ cur_cookie--;
+ }
+ err = invoke_bpf_prog(tl->links[i], args_off, retval_off, run_ctx_off,
+ save_ret, ctx);
+ if (err)
+ return err;
+ }
+ return 0;
+}
+
static int __arch_prepare_bpf_trampoline(struct bpf_tramp_image *im,
const struct btf_func_model *m,
struct bpf_tramp_links *tlinks,
@@ -1005,13 +1028,15 @@ static int __arch_prepare_bpf_trampoline(struct bpf_tramp_image *im,
int i, ret, offset;
int *branches_off = NULL;
int stack_size = 0, nr_arg_slots = 0;
- int retval_off, args_off, nregs_off, ip_off, run_ctx_off, sreg_off, stk_arg_off;
+ int retval_off, args_off, func_meta_off, ip_off, run_ctx_off, sreg_off, stk_arg_off;
+ int cookie_off, cookie_cnt;
struct bpf_tramp_links *fentry = &tlinks[BPF_TRAMP_FENTRY];
struct bpf_tramp_links *fexit = &tlinks[BPF_TRAMP_FEXIT];
struct bpf_tramp_links *fmod_ret = &tlinks[BPF_TRAMP_MODIFY_RETURN];
bool is_struct_ops = flags & BPF_TRAMP_F_INDIRECT;
void *orig_call = func_addr;
bool save_ret;
+ u64 func_meta;
u32 insn;
/* Two types of generated trampoline stack layout:
@@ -1042,10 +1067,14 @@ static int __arch_prepare_bpf_trampoline(struct bpf_tramp_image *im,
* [ ... ]
* FP - args_off [ arg1 ]
*
- * FP - nregs_off [ regs count ]
+ * FP - func_meta_off [ regs count, etc ]
*
* FP - ip_off [ traced func ] BPF_TRAMP_F_IP_ARG
*
+ * [ stack cookie N ]
+ * [ ... ]
+ * FP - cookie_off [ stack cookie 1 ]
+ *
* FP - run_ctx_off [ bpf_tramp_run_ctx ]
*
* FP - sreg_off [ callee saved reg ]
@@ -1077,14 +1106,20 @@ static int __arch_prepare_bpf_trampoline(struct bpf_tramp_image *im,
stack_size += nr_arg_slots * 8;
args_off = stack_size;
+ /* function metadata, such as regs count */
stack_size += 8;
- nregs_off = stack_size;
+ func_meta_off = stack_size;
if (flags & BPF_TRAMP_F_IP_ARG) {
stack_size += 8;
ip_off = stack_size;
}
+ cookie_cnt = bpf_fsession_cookie_cnt(tlinks);
+ /* room for session cookies */
+ stack_size += cookie_cnt * 8;
+ cookie_off = stack_size;
+
stack_size += round_up(sizeof(struct bpf_tramp_run_ctx), 8);
run_ctx_off = stack_size;
@@ -1132,10 +1167,19 @@ static int __arch_prepare_bpf_trampoline(struct bpf_tramp_image *im,
if (flags & BPF_TRAMP_F_IP_ARG)
emit_store_stack_imm64(RV_REG_T1, -ip_off, (u64)func_addr, ctx);
- emit_store_stack_imm64(RV_REG_T1, -nregs_off, nr_arg_slots, ctx);
+ func_meta = nr_arg_slots;
+ emit_store_stack_imm64(RV_REG_T1, -func_meta_off, func_meta, ctx);
store_args(nr_arg_slots, args_off, ctx);
+ if (bpf_fsession_cnt(tlinks)) {
+ /* clear all session cookies' value */
+ for (i = 0; i < cookie_cnt; i++)
+ emit_sd(RV_REG_FP, -cookie_off + 8 * i, RV_REG_ZERO, ctx);
+ /* clear return value to make sure fentry always get 0 */
+ emit_sd(RV_REG_FP, -retval_off, RV_REG_ZERO, ctx);
+ }
+
if (flags & BPF_TRAMP_F_CALL_ORIG) {
emit_imm(RV_REG_A0, ctx->insns ? (const s64)im : RV_MAX_COUNT_IMM, ctx);
ret = emit_call((const u64)__bpf_tramp_enter, true, ctx);
@@ -1143,9 +1187,9 @@ static int __arch_prepare_bpf_trampoline(struct bpf_tramp_image *im,
return ret;
}
- for (i = 0; i < fentry->nr_links; i++) {
- ret = invoke_bpf_prog(fentry->links[i], args_off, retval_off, run_ctx_off,
- flags & BPF_TRAMP_F_RET_FENTRY_RET, ctx);
+ if (fentry->nr_links) {
+ ret = invoke_bpf(fentry, args_off, retval_off, run_ctx_off, func_meta_off,
+ flags & BPF_TRAMP_F_RET_FENTRY_RET, func_meta, cookie_off, ctx);
if (ret)
return ret;
}
@@ -1192,9 +1236,14 @@ static int __arch_prepare_bpf_trampoline(struct bpf_tramp_image *im,
*(u32 *)(ctx->insns + branches_off[i]) = insn;
}
- for (i = 0; i < fexit->nr_links; i++) {
- ret = invoke_bpf_prog(fexit->links[i], args_off, retval_off,
- run_ctx_off, false, ctx);
+ /* set "is_return" flag for fsession */
+ func_meta |= (1ULL << BPF_TRAMP_IS_RETURN_SHIFT);
+ if (bpf_fsession_cnt(tlinks))
+ emit_store_stack_imm64(RV_REG_T1, -func_meta_off, func_meta, ctx);
+
+ if (fexit->nr_links) {
+ ret = invoke_bpf(fexit, args_off, retval_off, run_ctx_off, func_meta_off,
+ false, func_meta, cookie_off, ctx);
if (ret)
goto out;
}
@@ -2094,3 +2143,8 @@ bool bpf_jit_inlines_helper_call(s32 imm)
return false;
}
}
+
+bool bpf_jit_supports_fsession(void)
+{
+ return true;
+}
--
2.53.0
Hi Menglong,
kernel test robot noticed the following build errors:
[auto build test ERROR on bpf-next/master]
url: https://github.com/intel-lab-lkp/linux/commits/Menglong-Dong/bpf-riscv-introduce-emit_store_stack_imm64-for-trampoline/20260206-202356
base: https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next.git master
patch link: https://lore.kernel.org/r/20260206122002.1494125-3-dongml2%40chinatelecom.cn
patch subject: [PATCH bpf-next v3 2/3] bpf, riscv: add fsession support for trampolines
config: riscv-allyesconfig (https://download.01.org/0day-ci/archive/20260207/202602070533.NAsdK5m6-lkp@intel.com/config)
compiler: clang version 16.0.6 (https://github.com/llvm/llvm-project 7cbf1a2591520c2491aa35339f227775f4d3adf6)
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20260207/202602070533.NAsdK5m6-lkp@intel.com/reproduce)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202602070533.NAsdK5m6-lkp@intel.com/
All errors (new ones prefixed by >>):
>> arch/riscv/net/bpf_jit_comp64.c:1008:37: error: incompatible pointer types passing 'struct bpf_tramp_link **' to parameter of type 'struct bpf_tramp_link *'; remove & [-Werror,-Wincompatible-pointer-types]
if (bpf_prog_calls_session_cookie(&tl->links[i])) {
^~~~~~~~~~~~~
include/linux/bpf.h:2199:73: note: passing argument to parameter 'link' here
static inline bool bpf_prog_calls_session_cookie(struct bpf_tramp_link *link)
^
1 error generated.
vim +1008 arch/riscv/net/bpf_jit_comp64.c
998
999 static int invoke_bpf(struct bpf_tramp_links *tl, int args_off, int retval_off,
1000 int run_ctx_off, int func_meta_off, bool save_ret, u64 func_meta,
1001 int cookie_off, struct rv_jit_context *ctx)
1002 {
1003 int i, cur_cookie = (cookie_off - args_off) / 8;
1004
1005 for (i = 0; i < tl->nr_links; i++) {
1006 int err;
1007
> 1008 if (bpf_prog_calls_session_cookie(&tl->links[i])) {
1009 u64 meta = func_meta | ((u64)cur_cookie << BPF_TRAMP_COOKIE_INDEX_SHIFT);
1010
1011 emit_store_stack_imm64(RV_REG_T1, -func_meta_off, meta, ctx);
1012 cur_cookie--;
1013 }
1014 err = invoke_bpf_prog(tl->links[i], args_off, retval_off, run_ctx_off,
1015 save_ret, ctx);
1016 if (err)
1017 return err;
1018 }
1019 return 0;
1020 }
1021
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
Hi Menglong,
kernel test robot noticed the following build errors:
[auto build test ERROR on bpf-next/master]
url: https://github.com/intel-lab-lkp/linux/commits/Menglong-Dong/bpf-riscv-introduce-emit_store_stack_imm64-for-trampoline/20260206-202356
base: https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next.git master
patch link: https://lore.kernel.org/r/20260206122002.1494125-3-dongml2%40chinatelecom.cn
patch subject: [PATCH bpf-next v3 2/3] bpf, riscv: add fsession support for trampolines
config: riscv-randconfig-r112-20260206 (https://download.01.org/0day-ci/archive/20260207/202602070435.BuX0TvvF-lkp@intel.com/config)
compiler: riscv64-linux-gcc (GCC) 10.5.0
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20260207/202602070435.BuX0TvvF-lkp@intel.com/reproduce)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202602070435.BuX0TvvF-lkp@intel.com/
All errors (new ones prefixed by >>):
arch/riscv/net/bpf_jit_comp64.c: In function 'invoke_bpf':
>> arch/riscv/net/bpf_jit_comp64.c:1008:37: error: passing argument 1 of 'bpf_prog_calls_session_cookie' from incompatible pointer type [-Werror=incompatible-pointer-types]
1008 | if (bpf_prog_calls_session_cookie(&tl->links[i])) {
| ^~~~~~~~~~~~~
| |
| struct bpf_tramp_link **
In file included from arch/riscv/net/bpf_jit_comp64.c:9:
include/linux/bpf.h:2199:73: note: expected 'struct bpf_tramp_link *' but argument is of type 'struct bpf_tramp_link **'
2199 | static inline bool bpf_prog_calls_session_cookie(struct bpf_tramp_link *link)
| ~~~~~~~~~~~~~~~~~~~~~~~^~~~
cc1: some warnings being treated as errors
vim +/bpf_prog_calls_session_cookie +1008 arch/riscv/net/bpf_jit_comp64.c
998
999 static int invoke_bpf(struct bpf_tramp_links *tl, int args_off, int retval_off,
1000 int run_ctx_off, int func_meta_off, bool save_ret, u64 func_meta,
1001 int cookie_off, struct rv_jit_context *ctx)
1002 {
1003 int i, cur_cookie = (cookie_off - args_off) / 8;
1004
1005 for (i = 0; i < tl->nr_links; i++) {
1006 int err;
1007
> 1008 if (bpf_prog_calls_session_cookie(&tl->links[i])) {
1009 u64 meta = func_meta | ((u64)cur_cookie << BPF_TRAMP_COOKIE_INDEX_SHIFT);
1010
1011 emit_store_stack_imm64(RV_REG_T1, -func_meta_off, meta, ctx);
1012 cur_cookie--;
1013 }
1014 err = invoke_bpf_prog(tl->links[i], args_off, retval_off, run_ctx_off,
1015 save_ret, ctx);
1016 if (err)
1017 return err;
1018 }
1019 return 0;
1020 }
1021
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
> diff --git a/arch/riscv/net/bpf_jit_comp64.c b/arch/riscv/net/bpf_jit_comp64.c
> --- a/arch/riscv/net/bpf_jit_comp64.c
> +++ b/arch/riscv/net/bpf_jit_comp64.c
[ ... ]
> +static int invoke_bpf(struct bpf_tramp_links *tl, int args_off, int retval_off,
> + int run_ctx_off, int func_meta_off, bool save_ret, u64 func_meta,
> + int cookie_off, struct rv_jit_context *ctx)
> +{
> + int i, cur_cookie = (cookie_off - args_off) / 8;
> +
> + for (i = 0; i < tl->nr_links; i++) {
> + int err;
> +
> + if (bpf_prog_calls_session_cookie(&tl->links[i])) {
^^^^^^^^^^^^^^
Should this be tl->links[i] instead of &tl->links[i]?
The function bpf_prog_calls_session_cookie() expects a struct bpf_tramp_link
pointer, but tl->links is an array of pointers, so tl->links[i] is already
a struct bpf_tramp_link pointer. The extra & passes a pointer-to-pointer.
For comparison, arm64 uses:
if (bpf_prog_calls_session_cookie(fentry->links[i]))
And include/linux/bpf.h uses:
if (bpf_prog_calls_session_cookie(fentries.links[i]))
Both without the &.
> + u64 meta = func_meta | ((u64)cur_cookie << BPF_TRAMP_COOKIE_INDEX_SHIFT);
> +
> + emit_store_stack_imm64(RV_REG_T1, -func_meta_off, meta, ctx);
> + cur_cookie--;
> + }
> + err = invoke_bpf_prog(tl->links[i], args_off, retval_off, run_ctx_off,
> + save_ret, ctx);
Note that invoke_bpf_prog() correctly uses tl->links[i] without the &.
---
AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md
CI run summary: https://github.com/kernel-patches/bpf/actions/runs/21750727924
AI-authorship-score: low
AI-authorship-explanation: The code follows kernel conventions and has been reviewed by maintainers with acked-by tags, indicating human authorship.
issues-found: 1
issue-severity-score: high
issue-severity-explanation: Wrong pointer type passed to bpf_prog_calls_session_cookie() will cause undefined behavior when accessing session cookie state, breaking fsession functionality on RISC-V.
Menglong!
On Fri, 6 Feb 2026 at 13:51, <bot+bpf-ci@kernel.org> wrote:
>
> > diff --git a/arch/riscv/net/bpf_jit_comp64.c b/arch/riscv/net/bpf_jit_comp64.c
> > --- a/arch/riscv/net/bpf_jit_comp64.c
> > +++ b/arch/riscv/net/bpf_jit_comp64.c
>
> [ ... ]
>
> > +static int invoke_bpf(struct bpf_tramp_links *tl, int args_off, int retval_off,
> > + int run_ctx_off, int func_meta_off, bool save_ret, u64 func_meta,
> > + int cookie_off, struct rv_jit_context *ctx)
> > +{
> > + int i, cur_cookie = (cookie_off - args_off) / 8;
> > +
> > + for (i = 0; i < tl->nr_links; i++) {
> > + int err;
> > +
> > + if (bpf_prog_calls_session_cookie(&tl->links[i])) {
> ^^^^^^^^^^^^^^
>
> Should this be tl->links[i] instead of &tl->links[i]?
>
> The function bpf_prog_calls_session_cookie() expects a struct bpf_tramp_link
> pointer, but tl->links is an array of pointers, so tl->links[i] is already
> a struct bpf_tramp_link pointer. The extra & passes a pointer-to-pointer.
>
> For comparison, arm64 uses:
>
> if (bpf_prog_calls_session_cookie(fentry->links[i]))
>
> And include/linux/bpf.h uses:
>
> if (bpf_prog_calls_session_cookie(fentries.links[i]))
>
> Both without the &.
>
> > + u64 meta = func_meta | ((u64)cur_cookie << BPF_TRAMP_COOKIE_INDEX_SHIFT);
> > +
> > + emit_store_stack_imm64(RV_REG_T1, -func_meta_off, meta, ctx);
> > + cur_cookie--;
> > + }
> > + err = invoke_bpf_prog(tl->links[i], args_off, retval_off, run_ctx_off,
> > + save_ret, ctx);
>
> Note that invoke_bpf_prog() correctly uses tl->links[i] without the &.
Menglong, the v3 doesn't build. Please refrain from just stressing
versions out. For v4, make sure you properly build/test. On that note;
on what hardware/simulator did you perform the tests on?
© 2016 - 2026 Red Hat, Inc.