Re: [PATCH bpf-next 0/5] bpf: Unwinding via r3

["Alexei Starovoitov" <alexei.starovoitov@gmail.com>]

On Sat, Oct 17, 2026 at 06:31 PM Kumar Kartikeya Dwivedi <memxor@gmail.com> wrote:
> Overall this makes sense, I guess my one small nit is that since we've
> crossed the bridge on changing the compiler, we could just use a
> cleaner encoding of some new instruction

After a bit of back and forth... I think that's indeed a better path forward.
Especially, since three bugs that the bots found in patches 1-3 were there because r3 is
an ordinary register and JITs guess the meaning from the shape of the code.

>  - The verifier treats it exactly as JNE r3, 0, so no new verifier
>    semantics.

I suspect your bot was confused.
New jcond insn means that r3 is no longer used.
but we need new flavors of exit insn:

  exit          plain return
  unwind_exit   r0 = 0 and return to the pad of my return address

Otherwise plain 'exit' has to say something in some register for
the branch to look at, and a nounwind subprog called via callx has to
know about it.
The verifier needs one bit between exit of the callee and the next insn:

  cfg:
	unwind_goto has to follow a call or callx of a subprog
	and cannot be a jump target
  exit:
	unwound = false
  unwind_exit:
	reject in a callback and when insn after the call isn't unwind_goto
	unwound = true, r0 = 0
  call of a global subprog that has unwind_exit:
	explore the pad too
  unwind_goto: (probably most complex one...)
	goto unwound ? pad : next

JITs:

  unwind_goto:
	extable[n++] = { ret_addr -> pad }
  unwind_exit:
	my_ret_addr = bpf_unwind_target(my_ret_addr)
	epilogue

So patches 2 and 3 are no longer an optimization, but they are probably simpler (crunching...)
private stack has to be solved too... oh well.

> If we encode unwind exit as another jcond variant

hmm. cfg and liveness know JCOND as 'can jump, can fallthrough'.
unwind_exit is neither. BPF_EXIT with src_reg = 1 fits better
(more new insns... hmm)
unwind_goto is BPF_JCOND with src_reg = BPF_UNWIND_GOTO next to
BPF_MAY_GOTO.
3-ish new insns in total... progress?

> then you can get rid of the decl tag as well

Yes.

going to reject unwind_exit in async and exception callbacks.

patches tomorrow... bots are tired today ;)