AI Trajectory

null

{
  "EnableConfigs": [
    "BPF_JIT"
  ],
  "FocusSymbols": [
    "bpf_jit_supports_timed_may_goto",
    "bpf_jit_emit_insn"
  ],
  "Reasoning": "The patch implements BPF timed may_goto support for the RISC-V architecture by adding the `arch_bpf_timed_may_goto` assembly trampoline and updating the JIT compiler (`bpf_jit_emit_insn`) to handle its custom calling convention. This is functional core kernel code that can be reached when loading BPF programs on RISC-V with JIT enabled.",
  "WorthFuzzing": true
}

null

{
  "PatchDiff": "commit c2e9a774d7cca310a5bb3407ef655961a17d6230\nAuthor: syz-cluster \u003ctriage@syzkaller.com\u003e\nDate:   Thu Jul 23 03:02:07 2026 +0000\n\n    syz-cluster: applied patch under review\n\ndiff --git a/arch/riscv/net/Makefile b/arch/riscv/net/Makefile\nindex 9a1e5f0a94e559..6458d4d51990a7 100644\n--- a/arch/riscv/net/Makefile\n+++ b/arch/riscv/net/Makefile\n@@ -3,7 +3,7 @@\n obj-$(CONFIG_BPF_JIT) += bpf_jit_core.o\n \n ifeq ($(CONFIG_ARCH_RV64I),y)\n-\tobj-$(CONFIG_BPF_JIT) += bpf_jit_comp64.o\n+\tobj-$(CONFIG_BPF_JIT) += bpf_jit_comp64.o bpf_timed_may_goto.o\n else\n \tobj-$(CONFIG_BPF_JIT) += bpf_jit_comp32.o\n endif\ndiff --git a/arch/riscv/net/bpf_jit_comp64.c b/arch/riscv/net/bpf_jit_comp64.c\nindex ad089a9a4ea9ac..8fe8969fb8a0f8 100644\n--- a/arch/riscv/net/bpf_jit_comp64.c\n+++ b/arch/riscv/net/bpf_jit_comp64.c\n@@ -1841,7 +1841,12 @@ int bpf_jit_emit_insn(const struct bpf_insn *insn, struct rv_jit_context *ctx,\n \t\tif (aux-\u003etail_call_reachable \u0026\u0026 insn-\u003esrc_reg == BPF_PSEUDO_CALL)\n \t\t\temit_sd(RV_REG_SP, ctx-\u003etcc_offset, RV_REG_TCC, ctx);\n \n-\t\tif (insn-\u003esrc_reg != BPF_PSEUDO_CALL)\n+\t\t/*\n+\t\t * arch_bpf_timed_may_goto() is emitted by the verifier and\n+\t\t * returns its result in BPF_REG_AX instead of BPF_REG_0, so\n+\t\t * skip the normal \"move return register into R0\".\n+\t\t */\n+\t\tif (insn-\u003esrc_reg != BPF_PSEUDO_CALL \u0026\u0026 addr != (u64)arch_bpf_timed_may_goto)\n \t\t\temit_mv(bpf_to_rv_reg(BPF_REG_0, ctx), RV_REG_A0, ctx);\n \t\tbreak;\n \t}\n@@ -2161,3 +2166,8 @@ bool bpf_jit_supports_subprog_tailcalls(void)\n {\n \treturn true;\n }\n+\n+bool bpf_jit_supports_timed_may_goto(void)\n+{\n+\treturn true;\n+}\ndiff --git a/arch/riscv/net/bpf_timed_may_goto.S b/arch/riscv/net/bpf_timed_may_goto.S\nnew file mode 100644\nindex 00000000000000..f4bf2cd105866b\n--- /dev/null\n+++ b/arch/riscv/net/bpf_timed_may_goto.S\n@@ -0,0 +1,47 @@\n+/* SPDX-License-Identifier: GPL-2.0 */\n+/* Copyright (c) 2026 Feng Jiang \u003cjiangfeng@kylinos.cn\u003e */\n+\n+#include \u003clinux/linkage.h\u003e\n+#include \u003casm/asm.h\u003e\n+\n+/*\n+ * Trampoline for the BPF timed may_goto loop bound. Custom calling convention:\n+ *\t- input:  stack offset in BPF_REG_AX (t0)\n+ *\t- output: updated count in BPF_REG_AX (t0)\n+ *\n+ * Calls bpf_check_timed_may_goto(ptr) with the standard RISC-V ABI, where\n+ * ptr = BPF_REG_FP (s5) + BPF_REG_AX (t0). BPF R0-R5 (a5, a0-a4) are saved\n+ * across the call; BPF_REG_FP (s5) is callee-saved and needs no saving.\n+ */\n+\n+SYM_FUNC_START(arch_bpf_timed_may_goto)\n+\taddi\tsp, sp, -64\n+\tsd\tra, 56(sp)\n+\tsd\ts0, 48(sp)\n+\taddi\ts0, sp, 64\n+\n+\t/* Save BPF registers R0-R5 (a5, a0-a4) */\n+\tsd\ta5, 40(sp)\n+\tsd\ta0, 32(sp)\n+\tsd\ta1, 24(sp)\n+\tsd\ta2, 16(sp)\n+\tsd\ta3, 8(sp)\n+\tsd\ta4, 0(sp)\n+\n+\tadd\ta0, t0, s5\n+\tcall\tbpf_check_timed_may_goto\n+\tmv\tt0, a0\n+\n+\t/* Restore BPF registers R0-R5 */\n+\tld\ta4, 0(sp)\n+\tld\ta3, 8(sp)\n+\tld\ta2, 16(sp)\n+\tld\ta1, 24(sp)\n+\tld\ta0, 32(sp)\n+\tld\ta5, 40(sp)\n+\n+\tld\ts0, 48(sp)\n+\tld\tra, 56(sp)\n+\taddi\tsp, sp, 64\n+\tret\n+SYM_FUNC_END(arch_bpf_timed_may_goto)\ndiff --git a/tools/testing/selftests/bpf/progs/stream.c b/tools/testing/selftests/bpf/progs/stream.c\nindex 92ba1d72e0ece4..8d8e53d37266cd 100644\n--- a/tools/testing/selftests/bpf/progs/stream.c\n+++ b/tools/testing/selftests/bpf/progs/stream.c\n@@ -64,6 +64,7 @@ SEC(\"syscall\")\n __arch_x86_64\n __arch_arm64\n __arch_s390x\n+__arch_riscv64\n __success __retval(0)\n __stderr(\"ERROR: Timeout detected for may_goto instruction\")\n __stderr(\"CPU: {{[0-9]+}} UID: 0 PID: {{[0-9]+}} Comm: {{.*}}\")\ndiff --git a/tools/testing/selftests/bpf/progs/verifier_bpf_fastcall.c b/tools/testing/selftests/bpf/progs/verifier_bpf_fastcall.c\nindex 8d7ff38e4c0697..83707faea04994 100644\n--- a/tools/testing/selftests/bpf/progs/verifier_bpf_fastcall.c\n+++ b/tools/testing/selftests/bpf/progs/verifier_bpf_fastcall.c\n@@ -660,6 +660,7 @@ __naked void may_goto_interaction_x86_64(void)\n \n SEC(\"raw_tp\")\n __arch_arm64\n+__arch_riscv64\n __log_level(4) __msg(\"stack depth 24\")\n /* may_goto counter at -24 */\n __xlated(\"0: *(u64 *)(r10 -24) =\")\n@@ -679,7 +680,7 @@ __xlated(\"10: *(u64 *)(r10 -24) = r12\")\n __xlated(\"11: *(u64 *)(r10 -8) = r1\")\n __xlated(\"12: exit\")\n __success\n-__naked void may_goto_interaction_arm64(void)\n+__naked void may_goto_interaction(void)\n {\n \tasm volatile (\n \t\"r1 = 1;\"\ndiff --git a/tools/testing/selftests/bpf/progs/verifier_may_goto_1.c b/tools/testing/selftests/bpf/progs/verifier_may_goto_1.c\nindex 4bdf4256a41e51..97129d2730a053 100644\n--- a/tools/testing/selftests/bpf/progs/verifier_may_goto_1.c\n+++ b/tools/testing/selftests/bpf/progs/verifier_may_goto_1.c\n@@ -11,6 +11,7 @@ __description(\"may_goto 0\")\n __arch_x86_64\n __arch_s390x\n __arch_arm64\n+__arch_riscv64\n __xlated(\"0: r0 = 1\")\n __xlated(\"1: exit\")\n __success\n@@ -31,6 +32,7 @@ __description(\"batch 2 of may_goto 0\")\n __arch_x86_64\n __arch_s390x\n __arch_arm64\n+__arch_riscv64\n __xlated(\"0: r0 = 1\")\n __xlated(\"1: exit\")\n __success\n@@ -53,6 +55,7 @@ __description(\"may_goto batch with offsets 2/1/0\")\n __arch_x86_64\n __arch_s390x\n __arch_arm64\n+__arch_riscv64\n __xlated(\"0: r0 = 1\")\n __xlated(\"1: exit\")\n __success\n@@ -79,6 +82,7 @@ __description(\"may_goto batch with offsets 2/0\")\n __arch_x86_64\n __arch_s390x\n __arch_arm64\n+__arch_riscv64\n __xlated(\"0: *(u64 *)(r10 -16) = 65535\")\n __xlated(\"1: *(u64 *)(r10 -8) = 0\")\n __xlated(\"2: r12 = *(u64 *)(r10 -16)\")\n@@ -106,4 +110,61 @@ __naked void may_goto_batch_2(void)\n \t: __clobber_all);\n }\n \n+/*\n+ * Use bpf_get_prandom_u32() to prevent DCE from removing the checks.\n+ * retval: 0=all ok, 1-6=R0-R5 clobbered.\n+ */\n+SEC(\"raw_tp\")\n+__description(\"timed may_goto preserves R0-R5\")\n+__arch_x86_64\n+__arch_arm64\n+__arch_riscv64\n+__success\n+__retval(0)\n+__naked void timed_may_goto_preserves_regs(void)\n+{\n+\tasm volatile (\n+\t\"call %[bpf_get_prandom_u32];\"\n+\t\"r6 = r0;\"\n+\t\"r0 = 0x1111;\"\n+\t\"r0 += r6;\"\n+\t\"r1 = 0x2222;\"\n+\t\"r1 += r6;\"\n+\t\"r2 = 0x3333;\"\n+\t\"r2 += r6;\"\n+\t\"r3 = 0x4444;\"\n+\t\"r3 += r6;\"\n+\t\"r4 = 0x5555;\"\n+\t\"r4 += r6;\"\n+\t\"r5 = 0x6666;\"\n+\t\"r5 += r6;\"\n+\t\".8byte %[may_goto];\"\n+\t\".8byte %[loop];\"\n+\t\"r0 -= r6;\"\n+\t\"r1 -= r6;\"\n+\t\"r2 -= r6;\"\n+\t\"r3 -= r6;\"\n+\t\"r4 -= r6;\"\n+\t\"r5 -= r6;\"\n+\t\"if r0 != 0x1111 goto 1f;\"\n+\t\"if r1 != 0x2222 goto 2f;\"\n+\t\"if r2 != 0x3333 goto 3f;\"\n+\t\"if r3 != 0x4444 goto 4f;\"\n+\t\"if r4 != 0x5555 goto 5f;\"\n+\t\"if r5 != 0x6666 goto 6f;\"\n+\t\"r0 = 0;\"\n+\t\"exit;\"\n+\t\"1: r0 = 1; exit;\"\n+\t\"2: r0 = 2; exit;\"\n+\t\"3: r0 = 3; exit;\"\n+\t\"4: r0 = 4; exit;\"\n+\t\"5: r0 = 5; exit;\"\n+\t\"6: r0 = 6; exit;\"\n+\t:\n+\t: __imm(bpf_get_prandom_u32),\n+\t  __imm_insn(may_goto, BPF_RAW_INSN(BPF_JMP | BPF_JCOND, 0, 0, 1, 0)),\n+\t  __imm_insn(loop, BPF_RAW_INSN(BPF_JMP | BPF_JA, 0, 0, -2, 0))\n+\t: __clobber_all);\n+}\n+\n char _license[] SEC(\"license\") = \"GPL\";\n"
}

best-expensive

null

{
  "EnableConfigs": [
    "BPF_JIT"
  ],
  "FocusSymbols": [
    "bpf_jit_supports_timed_may_goto",
    "bpf_jit_emit_insn"
  ],
  "Reasoning": "The patch implements BPF timed may_goto support for the RISC-V architecture by adding the `arch_bpf_timed_may_goto` assembly trampoline and updating the JIT compiler (`bpf_jit_emit_insn`) to handle its custom calling convention. This is functional core kernel code that can be reached when loading BPF programs on RISC-V with JIT enabled.",
  "WorthFuzzing": true
}

You are an expert Linux kernel maintainer.
Your job is to review a provided patch series and determine
if it makes functional changes to the kernel that should be fuzzed.

IMPORTANT: The changes have ALREADY been applied and committed as the HEAD commit in
your workspace. Do NOT rely on your internal knowledge of the kernel. You must actively
use your code access tools to examine the actual source code and confirm any assumptions.

Return WorthFuzzing=false if the patch only contains:
- Modifications to Documentation/, Kconfig files, or code comments.
- Purely decorative changes, such as logging (e.g., pr_err, printk) or tracepoints.
- Changes to numeric constants or macros that do not functionally alter execution flow.
- Code paths that are impossible to reach in virtualized environments like GCE or QEMU,
even when utilizing software-emulated hardware (e.g., usb gadget, mac80211_hwsim).

If it modifies reachable core kernel logic, drivers, or architectures, use your code search
tools to verify the code can be executed, then return WorthFuzzing=true.

When returning WorthFuzzing=true, you MUST ALSO:
1. Extract any specific kernel functions that should be heavily fuzzed into FocusSymbols.
   Avoid listing generic hot-path functions to prevent skewed test distributions.
2. Identify any specific CONFIG_ options required to properly test this new/modified feature.
   Go and look into the Kconfig files and check for ifdefs around the code, do not make assumptions.
   Do not list too generic configs (we already have them enabled). Only list those that
   specifically cover the modified code. List them in the EnableConfigs output array,
   and DO NOT add a 'CONFIG_' prefix (e.g., return "NET_IPV4" instead of "CONFIG_NET_IPV4").
Prefer calling several tools at the same time to save round-trips.


Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.

For your convenience, here is the diff of the changes:
commit c2e9a774d7cca310a5bb3407ef655961a17d6230
Author: syz-cluster <triage@syzkaller.com>
Date:   Thu Jul 23 03:02:07 2026 +0000

    syz-cluster: applied patch under review

diff --git a/arch/riscv/net/Makefile b/arch/riscv/net/Makefile
index 9a1e5f0a94e559..6458d4d51990a7 100644
--- a/arch/riscv/net/Makefile
+++ b/arch/riscv/net/Makefile
@@ -3,7 +3,7 @@
 obj-$(CONFIG_BPF_JIT) += bpf_jit_core.o
 
 ifeq ($(CONFIG_ARCH_RV64I),y)
-	obj-$(CONFIG_BPF_JIT) += bpf_jit_comp64.o
+	obj-$(CONFIG_BPF_JIT) += bpf_jit_comp64.o bpf_timed_may_goto.o
 else
 	obj-$(CONFIG_BPF_JIT) += bpf_jit_comp32.o
 endif
diff --git a/arch/riscv/net/bpf_jit_comp64.c b/arch/riscv/net/bpf_jit_comp64.c
index ad089a9a4ea9ac..8fe8969fb8a0f8 100644
--- a/arch/riscv/net/bpf_jit_comp64.c
+++ b/arch/riscv/net/bpf_jit_comp64.c
@@ -1841,7 +1841,12 @@ int bpf_jit_emit_insn(const struct bpf_insn *insn, struct rv_jit_context *ctx,
 		if (aux->tail_call_reachable && insn->src_reg == BPF_PSEUDO_CALL)
 			emit_sd(RV_REG_SP, ctx->tcc_offset, RV_REG_TCC, ctx);
 
-		if (insn->src_reg != BPF_PSEUDO_CALL)
+		/*
+		 * arch_bpf_timed_may_goto() is emitted by the verifier and
+		 * returns its result in BPF_REG_AX instead of BPF_REG_0, so
+		 * skip the normal "move return register into R0".
+		 */
+		if (insn->src_reg != BPF_PSEUDO_CALL && addr != (u64)arch_bpf_timed_may_goto)
 			emit_mv(bpf_to_rv_reg(BPF_REG_0, ctx), RV_REG_A0, ctx);
 		break;
 	}
@@ -2161,3 +2166,8 @@ bool bpf_jit_supports_subprog_tailcalls(void)
 {
 	return true;
 }
+
+bool bpf_jit_supports_timed_may_goto(void)
+{
+	return true;
+}
diff --git a/arch/riscv/net/bpf_timed_may_goto.S b/arch/riscv/net/bpf_timed_may_goto.S
new file mode 100644
index 00000000000000..f4bf2cd105866b
--- /dev/null
+++ b/arch/riscv/net/bpf_timed_may_goto.S
@@ -0,0 +1,47 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+/* Copyright (c) 2026 Feng Jiang <jiangfeng@kylinos.cn> */
+
+#include <linux/linkage.h>
+#include <asm/asm.h>
+
+/*
+ * Trampoline for the BPF timed may_goto loop bound. Custom calling convention:
+ *	- input:  stack offset in BPF_REG_AX (t0)
+ *	- output: updated count in BPF_REG_AX (t0)
+ *
+ * Calls bpf_check_timed_may_goto(ptr) with the standard RISC-V ABI, where
+ * ptr = BPF_REG_FP (s5) + BPF_REG_AX (t0). BPF R0-R5 (a5, a0-a4) are saved
+ * across the call; BPF_REG_FP (s5) is callee-saved and needs no saving.
+ */
+
+SYM_FUNC_START(arch_bpf_timed_may_goto)
+	addi	sp, sp, -64
+	sd	ra, 56(sp)
+	sd	s0, 48(sp)
+	addi	s0, sp, 64
+
+	/* Save BPF registers R0-R5 (a5, a0-a4) */
+	sd	a5, 40(sp)
+	sd	a0, 32(sp)
+	sd	a1, 24(sp)
+	sd	a2, 16(sp)
+	sd	a3, 8(sp)
+	sd	a4, 0(sp)
+
+	add	a0, t0, s5
+	call	bpf_check_timed_may_goto
+	mv	t0, a0
+
+	/* Restore BPF registers R0-R5 */
+	ld	a4, 0(sp)
+	ld	a3, 8(sp)
+	ld	a2, 16(sp)
+	ld	a1, 24(sp)
+	ld	a0, 32(sp)
+	ld	a5, 40(sp)
+
+	ld	s0, 48(sp)
+	ld	ra, 56(sp)
+	addi	sp, sp, 64
+	ret
+SYM_FUNC_END(arch_bpf_timed_may_goto)
diff --git a/tools/testing/selftests/bpf/progs/stream.c b/tools/testing/selftests/bpf/progs/stream.c
index 92ba1d72e0ece4..8d8e53d37266cd 100644
--- a/tools/testing/selftests/bpf/progs/stream.c
+++ b/tools/testing/selftests/bpf/progs/stream.c
@@ -64,6 +64,7 @@ SEC("syscall")
 __arch_x86_64
 __arch_arm64
 __arch_s390x
+__arch_riscv64
 __success __retval(0)
 __stderr("ERROR: Timeout detected for may_goto instruction")
 __stderr("CPU: {{[0-9]+}} UID: 0 PID: {{[0-9]+}} Comm: {{.*}}")
diff --git a/tools/testing/selftests/bpf/progs/verifier_bpf_fastcall.c b/tools/testing/selftests/bpf/progs/verifier_bpf_fastcall.c
index 8d7ff38e4c0697..83707faea04994 100644
--- a/tools/testing/selftests/bpf/progs/verifier_bpf_fastcall.c
+++ b/tools/testing/selftests/bpf/progs/verifier_bpf_fastcall.c
@@ -660,6 +660,7 @@ __naked void may_goto_interaction_x86_64(void)
 
 SEC("raw_tp")
 __arch_arm64
+__arch_riscv64
 __log_level(4) __msg("stack depth 24")
 /* may_goto counter at -24 */
 __xlated("0: *(u64 *)(r10 -24) =")
@@ -679,7 +680,7 @@ __xlated("10: *(u64 *)(r10 -24) = r12")
 __xlated("11: *(u64 *)(r10 -8) = r1")
 __xlated("12: exit")
 __success
-__naked void may_goto_interaction_arm64(void)
+__naked void may_goto_interaction(void)
 {
 	asm volatile (
 	"r1 = 1;"
diff --git a/tools/testing/selftests/bpf/progs/verifier_may_goto_1.c b/tools/testing/selftests/bpf/progs/verifier_may_goto_1.c
index 4bdf4256a41e51..97129d2730a053 100644
--- a/tools/testing/selftests/bpf/progs/verifier_may_goto_1.c
+++ b/tools/testing/selftests/bpf/progs/verifier_may_goto_1.c
@@ -11,6 +11,7 @@ __description("may_goto 0")
 __arch_x86_64
 __arch_s390x
 __arch_arm64
+__arch_riscv64
 __xlated("0: r0 = 1")
 __xlated("1: exit")
 __success
@@ -31,6 +32,7 @@ __description("batch 2 of may_goto 0")
 __arch_x86_64
 __arch_s390x
 __arch_arm64
+__arch_riscv64
 __xlated("0: r0 = 1")
 __xlated("1: exit")
 __success
@@ -53,6 +55,7 @@ __description("may_goto batch with offsets 2/1/0")
 __arch_x86_64
 __arch_s390x
 __arch_arm64
+__arch_riscv64
 __xlated("0: r0 = 1")
 __xlated("1: exit")
 __success
@@ -79,6 +82,7 @@ __description("may_goto batch with offsets 2/0")
 __arch_x86_64
 __arch_s390x
 __arch_arm64
+__arch_riscv64
 __xlated("0: *(u64 *)(r10 -16) = 65535")
 __xlated("1: *(u64 *)(r10 -8) = 0")
 __xlated("2: r12 = *(u64 *)(r10 -16)")
@@ -106,4 +110,61 @@ __naked void may_goto_batch_2(void)
 	: __clobber_all);
 }
 
+/*
+ * Use bpf_get_prandom_u32() to prevent DCE from removing the checks.
+ * retval: 0=all ok, 1-6=R0-R5 clobbered.
+ */
+SEC("raw_tp")
+__description("timed may_goto preserves R0-R5")
+__arch_x86_64
+__arch_arm64
+__arch_riscv64
+__success
+__retval(0)
+__naked void timed_may_goto_preserves_regs(void)
+{
+	asm volatile (
+	"call %[bpf_get_prandom_u32];"
+	"r6 = r0;"
+	"r0 = 0x1111;"
+	"r0 += r6;"
+	"r1 = 0x2222;"
+	"r1 += r6;"
+	"r2 = 0x3333;"
+	"r2 += r6;"
+	"r3 = 0x4444;"
+	"r3 += r6;"
+	"r4 = 0x5555;"
+	"r4 += r6;"
+	"r5 = 0x6666;"
+	"r5 += r6;"
+	".8byte %[may_goto];"
+	".8byte %[loop];"
+	"r0 -= r6;"
+	"r1 -= r6;"
+	"r2 -= r6;"
+	"r3 -= r6;"
+	"r4 -= r6;"
+	"r5 -= r6;"
+	"if r0 != 0x1111 goto 1f;"
+	"if r1 != 0x2222 goto 2f;"
+	"if r2 != 0x3333 goto 3f;"
+	"if r3 != 0x4444 goto 4f;"
+	"if r4 != 0x5555 goto 5f;"
+	"if r5 != 0x6666 goto 6f;"
+	"r0 = 0;"
+	"exit;"
+	"1: r0 = 1; exit;"
+	"2: r0 = 2; exit;"
+	"3: r0 = 3; exit;"
+	"4: r0 = 4; exit;"
+	"5: r0 = 5; exit;"
+	"6: r0 = 6; exit;"
+	:
+	: __imm(bpf_get_prandom_u32),
+	  __imm_insn(may_goto, BPF_RAW_INSN(BPF_JMP | BPF_JCOND, 0, 0, 1, 0)),
+	  __imm_insn(loop, BPF_RAW_INSN(BPF_JMP | BPF_JA, 0, 0, -2, 0))
+	: __clobber_all);
+}
+
 char _license[] SEC("license") = "GPL";

gemini-3.1-pro-preview

null

null

							input: 5065
							output: 26
							thoughts: 574
						

**My Assessment of the RISC-V BPF Timed May-Goto Patch**

Alright, let's break this down. We've got a patch here that's bringing `bpf_timed_may_goto` support into the RISC-V BPF JIT, which is a good step. I see the modifications are spread across the expected areas: `arch/riscv/net/Makefile`, the JIT compiler itself (`arch/riscv/net/bpf_jit_comp64.c`), a new assembly file for the timed may-goto logic (`arch/riscv/net/bpf_timed_may_goto.S`), and some updated selftests. Seems like a comprehensive approach, which is what I would expect.

Looking specifically at `arch/riscv/net/bpf_jit_comp64.c`, the key change is within `bpf_jit_emit_insn`. The conditional logic preventing the move from A0 to R0 after a function call has been augmented. It looks like it handles the special case of `arch_bpf_timed_may_goto`. This makes sense, because I know that `arch_bpf_timed_may_goto` returns its result in a different register than the standard BPF calls. The code explicitly identifies this, which is good. We don't want to corrupt our return values.

Beyond the register handling, the function `bpf_jit_supports_timed_may_goto()` has been added, and it simply returns `true`. This makes sure this capability is exposed to the BPF verifier and ensures the JIT code can function correctly. This is exactly what I would expect to see in a patch like this.

Functionally, I can see that this patch is doing what it needs to do: enabling BPF timed may-goto support on RISC-V. The JIT code is reachable, and the support is enabled if the BPF JIT is enabled on RISC-V, which depends on `CONFIG_BPF_JIT` and `CONFIG_RISCV` (or `CONFIG_ARCH_RV64I`). So, there isn't anything strange there. Now I need to check the configs to see if this functionality is properly exposed to the user. I'll search for `bpf_jit_supports_timed_may_goto` to confirm the code will function correctly. So far, the patch seems to address the core problem and integrate correctly into the existing architecture.

{
  "Expression": "bpf_jit_supports_timed_may_goto"
}

{
  "Output": "arch/arm64/net/bpf_jit_comp.c=3197=bool bpf_jit_bypass_spec_v4(void)\n--\narch/arm64/net/bpf_jit_comp.c-3207-\narch/arm64/net/bpf_jit_comp.c:3208:bool bpf_jit_supports_timed_may_goto(void)\narch/arm64/net/bpf_jit_comp.c-3209-{\n--\narch/powerpc/net/bpf_jit_comp.c=515=bool bpf_jit_supports_subprog_tailcalls(void)\n--\narch/powerpc/net/bpf_jit_comp.c-519-\narch/powerpc/net/bpf_jit_comp.c:520:bool bpf_jit_supports_timed_may_goto(void)\narch/powerpc/net/bpf_jit_comp.c-521-{\n--\narch/riscv/net/bpf_jit_comp64.c=2165=bool bpf_jit_supports_subprog_tailcalls(void)\n--\narch/riscv/net/bpf_jit_comp64.c-2169-\narch/riscv/net/bpf_jit_comp64.c:2170:bool bpf_jit_supports_timed_may_goto(void)\narch/riscv/net/bpf_jit_comp64.c-2171-{\n--\narch/s390/net/bpf_jit_comp.c=3055=void arch_bpf_stack_walk(bool (*consume_fn)(void *, u64, u64, u64),\n--\narch/s390/net/bpf_jit_comp.c-3080-\narch/s390/net/bpf_jit_comp.c:3081:bool bpf_jit_supports_timed_may_goto(void)\narch/s390/net/bpf_jit_comp.c-3082-{\n--\narch/x86/net/bpf_jit_comp.c=4210=u64 bpf_arch_uaddress_limit(void)\n--\narch/x86/net/bpf_jit_comp.c-4214-\narch/x86/net/bpf_jit_comp.c:4215:bool bpf_jit_supports_timed_may_goto(void)\narch/x86/net/bpf_jit_comp.c-4216-{\n--\ninclude/linux/filter.h=1191=bool bpf_jit_supports_private_stack(void);\ninclude/linux/filter.h:1192:bool bpf_jit_supports_timed_may_goto(void);\ninclude/linux/filter.h-1193-bool bpf_jit_supports_fsession(void);\n--\nkernel/bpf/core.c=3374=void __weak arch_bpf_stack_walk(bool (*consume_fn)(void *cookie, u64 ip, u64 sp, u64 bp), void *cookie)\n--\nkernel/bpf/core.c-3377-\nkernel/bpf/core.c:3378:bool __weak bpf_jit_supports_timed_may_goto(void)\nkernel/bpf/core.c-3379-{\n--\nkernel/bpf/fixups.c=1480=int bpf_do_misc_fixups(struct bpf_verifier_env *env)\n--\nkernel/bpf/fixups.c-1754-\nkernel/bpf/fixups.c:1755:\t\tif (bpf_is_may_goto_insn(insn) \u0026\u0026 bpf_jit_supports_timed_may_goto()) {\nkernel/bpf/fixups.c-1756-\t\t\tint stack_off_cnt = -stack_depth - 16;\n--\nkernel/bpf/fixups.c-2368-\tfor (i = 0; i \u003c env-\u003esubprog_cnt; i++) {\nkernel/bpf/fixups.c:2369:\t\tint delta = bpf_jit_supports_timed_may_goto() ? 2 : 1;\nkernel/bpf/fixups.c-2370-\t\tint subprog_start = subprogs[i].start;\n--\nkernel/bpf/fixups.c-2382-\t\tstack_depth = subprogs[i].stack_depth;\nkernel/bpf/fixups.c:2383:\t\tif (bpf_jit_supports_timed_may_goto()) {\nkernel/bpf/fixups.c-2384-\t\t\tinsn_buf[cnt++] = BPF_ST_MEM(BPF_DW, BPF_REG_FP, -stack_depth,\n"
}

gemini-3.1-pro-preview

null

null

							input: 7433
							output: 35
							thoughts: 152
						

**RISC-V BPF JIT Bug Hunt: A Testable Opportunity**

Okay, so this patch introduces `arch_bpf_timed_may_goto` and tweaks `bpf_jit_emit_insn` in the RISC-V BPF JIT compilation code. My first instinct is, "Yes, this is definitely something we can trip up if we throw fuzzing at it." Thinking practically, if we're fuzzing BPF on RISC-V, this code path *will* get exercised. Wait a minute... doesn't syzkaller *already* fuzz the RISC-V BPF JIT when running on a RISC-V target? Bingo!

This is excellent news. It means we have a simple way to test this! We just need to ensure the right configurations are enabled. Let me see... `BPF_JIT` and either `RISCV` or `ARCH_RV64I` should do the trick. Now, to double-check that everything is in place, I should probably glance at `arch/riscv/net/Makefile` to make sure all the pieces are linked together correctly. Time to verify.

{
  "Expression": "CONFIG_BPF_JIT",
  "PathPrefix": "arch/riscv/net/Makefile"
}

{
  "Output": "arch/riscv/net/Makefile-2-\narch/riscv/net/Makefile:3:obj-$(CONFIG_BPF_JIT) += bpf_jit_core.o\narch/riscv/net/Makefile-4-\narch/riscv/net/Makefile=5=ifeq ($(CONFIG_ARCH_RV64I),y)\narch/riscv/net/Makefile:6:\tobj-$(CONFIG_BPF_JIT) += bpf_jit_comp64.o bpf_timed_may_goto.o\narch/riscv/net/Makefile-7-else\narch/riscv/net/Makefile:8:\tobj-$(CONFIG_BPF_JIT) += bpf_jit_comp32.o\narch/riscv/net/Makefile-9-endif\n"
}

gemini-3.1-pro-preview

null

null

							input: 8069
							output: 24
							thoughts: 178
						

**My Initial Assessment of the BPF JIT Patch**

Okay, so the `CONFIG_BPF_JIT` configuration option is definitely essential here. But hang on, this patch is targeting RISC-V specifically, and I need to keep in mind that Syzkaller, which is what I'm likely using, runs on a much broader range of architectures like x86_64, arm64, and riscv64, etc. If I flag this with `WorthFuzzing=true`, it'll get attention from the fuzzer.

Right, time to focus on some symbols. `bpf_jit_emit_insn` looks like a key function since it's the core JIT instruction emitter, but it might be too generic. It's the core of the JIT, so it might be. `arch_bpf_timed_may_goto` is an assembly function, so KCOV instrumentation is out for that one, which is unfortunate. `bpf_jit_supports_timed_may_goto` is just a boolean, so that's not going to tell us a lot.

Aha! `bpf_jit_emit_insn` *is* being modified, so that's a good place to start digging deeper. It looks like that is the main workhorse here, so it is the correct place to focus on. Okay, let's see if there are any other related functions that might be involved.

{
  "Expression": "arch_bpf_timed_may_goto"
}

{
  "Output": "arch/arm64/net/bpf_jit_comp.c=1253=static int build_insn(const struct bpf_verifier_env *env, const struct bpf_insn *insn,\n--\narch/arm64/net/bpf_jit_comp.c-1670-\t\t/*\narch/arm64/net/bpf_jit_comp.c:1671:\t\t * Call to arch_bpf_timed_may_goto() is emitted by the\narch/arm64/net/bpf_jit_comp.c-1672-\t\t * verifier and called with custom calling convention with\n--\narch/arm64/net/bpf_jit_comp.c-1674-\t\t */\narch/arm64/net/bpf_jit_comp.c:1675:\t\tif (func_addr != (u64)arch_bpf_timed_may_goto)\narch/arm64/net/bpf_jit_comp.c-1676-\t\t\temit(A64_MOV(1, r0, A64_R(0)), ctx);\n--\narch/arm64/net/bpf_timed_may_goto.S-5-\narch/arm64/net/bpf_timed_may_goto.S:6:SYM_FUNC_START(arch_bpf_timed_may_goto)\narch/arm64/net/bpf_timed_may_goto.S-7-\t/* Allocate stack space and emit frame record */\n--\narch/arm64/net/bpf_timed_may_goto.S-20-\t *\narch/arm64/net/bpf_timed_may_goto.S:21:\t * Before generating the call to arch_bpf_timed_may_goto, the verifier\narch/arm64/net/bpf_timed_may_goto.S-22-\t * generates a load instruction using FP, i.e. REG_AX = *(u64 *)(FP -\n--\narch/arm64/net/bpf_timed_may_goto.S-39-\tret\narch/arm64/net/bpf_timed_may_goto.S:40:SYM_FUNC_END(arch_bpf_timed_may_goto)\n--\narch/powerpc/net/bpf_jit_comp64.c=967=int bpf_jit_build_body(struct bpf_prog *fp, u32 *image, u32 *fimage, struct codegen_context *ctx,\n--\narch/powerpc/net/bpf_jit_comp64.c-1769-\t\t\t/*\narch/powerpc/net/bpf_jit_comp64.c:1770:\t\t\t * Call to arch_bpf_timed_may_goto() is emitted by the\narch/powerpc/net/bpf_jit_comp64.c-1771-\t\t\t * verifier and called with custom calling convention with\n--\narch/powerpc/net/bpf_jit_comp64.c-1782-\narch/powerpc/net/bpf_jit_comp64.c:1783:\t\t\tif (func_addr == (u64)arch_bpf_timed_may_goto) {\narch/powerpc/net/bpf_jit_comp64.c-1784-\t\t\t\tret = 0;\n--\narch/powerpc/net/bpf_timed_may_goto.S-7-/*\narch/powerpc/net/bpf_timed_may_goto.S:8: * arch_bpf_timed_may_goto() trampoline for powerpc64\narch/powerpc/net/bpf_timed_may_goto.S-9- *\n--\narch/powerpc/net/bpf_timed_may_goto.S-19-\narch/powerpc/net/bpf_timed_may_goto.S:20:SYM_FUNC_START(arch_bpf_timed_may_goto)\narch/powerpc/net/bpf_timed_may_goto.S-21-\t/* Prologue: save LR, allocate frame */\n--\narch/powerpc/net/bpf_timed_may_goto.S-56-\tblr\narch/powerpc/net/bpf_timed_may_goto.S:57:SYM_FUNC_END(arch_bpf_timed_may_goto)\n--\narch/riscv/net/bpf_jit_comp64.c=1361=int bpf_jit_emit_insn(const struct bpf_insn *insn, struct rv_jit_context *ctx,\n--\narch/riscv/net/bpf_jit_comp64.c-1844-\t\t/*\narch/riscv/net/bpf_jit_comp64.c:1845:\t\t * arch_bpf_timed_may_goto() is emitted by the verifier and\narch/riscv/net/bpf_jit_comp64.c-1846-\t\t * returns its result in BPF_REG_AX instead of BPF_REG_0, so\n--\narch/riscv/net/bpf_jit_comp64.c-1848-\t\t */\narch/riscv/net/bpf_jit_comp64.c:1849:\t\tif (insn-\u003esrc_reg != BPF_PSEUDO_CALL \u0026\u0026 addr != (u64)arch_bpf_timed_may_goto)\narch/riscv/net/bpf_jit_comp64.c-1850-\t\t\temit_mv(bpf_to_rv_reg(BPF_REG_0, ctx), RV_REG_A0, ctx);\n--\narch/riscv/net/bpf_timed_may_goto.S-16-\narch/riscv/net/bpf_timed_may_goto.S:17:SYM_FUNC_START(arch_bpf_timed_may_goto)\narch/riscv/net/bpf_timed_may_goto.S-18-\taddi\tsp, sp, -64\n--\narch/riscv/net/bpf_timed_may_goto.S-46-\tret\narch/riscv/net/bpf_timed_may_goto.S:47:SYM_FUNC_END(arch_bpf_timed_may_goto)\n--\narch/s390/net/bpf_jit_comp.c=876=static noinline int bpf_jit_insn(struct bpf_jit *jit, struct bpf_prog *fp,\n--\narch/s390/net/bpf_jit_comp.c-1841-\narch/s390/net/bpf_jit_comp.c:1842:\t\tif ((void *)func == arch_bpf_timed_may_goto) {\narch/s390/net/bpf_jit_comp.c-1843-\t\t\t/*\narch/s390/net/bpf_jit_comp.c:1844:\t\t\t * arch_bpf_timed_may_goto() has a special ABI: the\narch/s390/net/bpf_jit_comp.c-1845-\t\t\t * parameters are in BPF_REG_AX and BPF_REG_10; the\n--\narch/s390/net/bpf_timed_may_goto.S-21-\narch/s390/net/bpf_timed_may_goto.S:22:SYM_FUNC_START(arch_bpf_timed_may_goto)\narch/s390/net/bpf_timed_may_goto.S-23-\t/*\n--\narch/s390/net/bpf_timed_may_goto.S-44-\tBR_EX %r1\narch/s390/net/bpf_timed_may_goto.S:45:SYM_FUNC_END(arch_bpf_timed_may_goto)\n--\narch/x86/net/bpf_timed_may_goto.S-10-\narch/x86/net/bpf_timed_may_goto.S:11:SYM_FUNC_START(arch_bpf_timed_may_goto)\narch/x86/net/bpf_timed_may_goto.S-12-\tANNOTATE_NOENDBR\n--\narch/x86/net/bpf_timed_may_goto.S-54-\tRET\narch/x86/net/bpf_timed_may_goto.S:55:SYM_FUNC_END(arch_bpf_timed_may_goto)\n--\ninclude/linux/filter.h=1195=void arch_bpf_stack_walk(bool (*consume_fn)(void *cookie, u64 ip, u64 sp, u64 bp), void *cookie);\ninclude/linux/filter.h:1196:u64 arch_bpf_timed_may_goto(void);\ninclude/linux/filter.h-1197-u64 bpf_check_timed_may_goto(struct bpf_timed_may_goto *);\n--\nkernel/bpf/core.c=3378=bool __weak bpf_jit_supports_timed_may_goto(void)\n--\nkernel/bpf/core.c-3382-\nkernel/bpf/core.c:3383:u64 __weak arch_bpf_timed_may_goto(void)\nkernel/bpf/core.c-3384-{\n--\nkernel/bpf/fixups.c=1480=int bpf_do_misc_fixups(struct bpf_verifier_env *env)\n--\nkernel/bpf/fixups.c-1764-\t\t\t * until the value becomes 0 in AX (thus, 1 in stack),\nkernel/bpf/fixups.c:1765:\t\t\t * after which we call arch_bpf_timed_may_goto, which\nkernel/bpf/fixups.c-1766-\t\t\t * either sets AX to 0xffff to keep looping, or to 0\n--\nkernel/bpf/fixups.c-1782-\t\t\t * (to add to r10/fp), and also as the return value of\nkernel/bpf/fixups.c:1783:\t\t\t * the call to arch_bpf_timed_may_goto.\nkernel/bpf/fixups.c-1784-\t\t\t */\nkernel/bpf/fixups.c-1785-\t\t\tinsn_buf[4] = BPF_MOV64_IMM(BPF_REG_AX, stack_off_cnt);\nkernel/bpf/fixups.c:1786:\t\t\tinsn_buf[5] = BPF_EMIT_CALL(arch_bpf_timed_may_goto);\nkernel/bpf/fixups.c-1787-\t\t\tinsn_buf[6] = BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_AX, stack_off_cnt);\n"
}

gemini-3.1-pro-preview

null

null

							input: 11321
							output: 147
							thoughts: 687
						

**My Analysis of this BPF Timed May_Goto Patch**

Okay, let's break this down. From what I see, the primary modification here centers around implementing BPF's timed may_goto support specifically for the RISC-V architecture. It looks like the core work involves adding the `arch_bpf_timed_may_goto` assembly trampoline, which makes sense, given the target architecture. The main C function touched is `bpf_jit_emit_insn`, and I also see a new function, `bpf_jit_supports_timed_may_goto`, added.

Initially, I thought of including both `bpf_jit_emit_insn` and `bpf_jit_supports_timed_may_goto` in the `FocusSymbols` list. However, `bpf_jit_emit_insn` is a sizeable function, especially given its role in the JIT process. It is the primary JIT function, after all. But given that it's the only modified C function, and this patch doesn't appear to be drastically changing the hot-path processing of packets, I'll go with it.

I will add both `bpf_jit_supports_timed_may_goto` and `bpf_jit_emit_insn` to the `FocusSymbols` list, since `bpf_jit_supports_timed_may_goto` is a tiny function, and `bpf_jit_emit_insn` is not called during packet processing.

Now, on to the configurations. It looks like `CONFIG_BPF_JIT` is the only one explicitly mentioned. Considering the instructions, I need to focus on configs that specifically enable *this* code. While `BPF_JIT` is often enabled, it's definitely the relevant config for enabling this specific JIT functionality.

There's a note about not listing generic configs, which made me pause on whether to include `ARCH_RV64I` since this is for RISC-V, but it seems to be the architecture itself, which is too generic. I'll stick with listing `BPF_JIT` under `EnableConfigs`.

Just to be sure, I double-checked the makefiles and didn't find any other *specific* configs tied to this modification.

The reasoning is pretty clear: This patch adds timed may_goto support on RISC-V by modifying the JIT compiler. We're talking about core kernel code accessible when loading BPF programs, which is crucial for BPF's functionality on the target architecture.

So, here's what I've got:

*   **FocusSymbols:**
    *   `bpf_jit_supports_timed_may_goto`
    *   `bpf_jit_emit_insn`
*   **EnableConfigs:**
    *   `BPF_JIT`

Let's call set-results.

{
  "EnableConfigs": [
    "BPF_JIT"
  ],
  "FocusSymbols": [
    "bpf_jit_supports_timed_may_goto",
    "bpf_jit_emit_insn"
  ],
  "Reasoning": "The patch implements BPF timed may_goto support for the RISC-V architecture by adding the `arch_bpf_timed_may_goto` assembly trampoline and updating the JIT compiler (`bpf_jit_emit_insn`) to handle its custom calling convention. This is functional core kernel code that can be reached when loading BPF programs on RISC-V with JIT enabled.",
  "WorthFuzzing": true
}

{
  "EnableConfigs": [
    "BPF_JIT"
  ],
  "FocusSymbols": [
    "bpf_jit_supports_timed_may_goto",
    "bpf_jit_emit_insn"
  ],
  "Reasoning": "The patch implements BPF timed may_goto support for the RISC-V architecture by adding the `arch_bpf_timed_may_goto` assembly trampoline and updating the JIT compiler (`bpf_jit_emit_insn`) to handle its custom calling convention. This is functional core kernel code that can be reached when loading BPF programs on RISC-V with JIT enabled.",
  "WorthFuzzing": true
}