Re: [PATCH bpf-next v6 02/10] bpf: Add helpers to describe the R0:R2 return register pair

[Yonghong Song <yonghong.song@linux.dev>]

On 8/18/26 12:53 PM, Eduard Zingerman wrote:
> On Tue, 2026-08-18 at 12:51 -0700, Eduard Zingerman wrote:
>> On Sun, 2026-08-16 at 21:21 -0700, Yonghong Song wrote:
>>
>> ...
>>
>>> diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
>>> index b3c474ba7140..f1f1268d29c6 100644
>>> --- a/kernel/bpf/verifier.c
>>> +++ b/kernel/bpf/verifier.c
>>> @@ -385,27 +385,70 @@ bool bpf_subprog_is_global(const struct bpf_verifier_env *env, int subprog)
>> ...
>>
>>> +static int bpf_compute_subprog_ret_regs(struct bpf_verifier_env *env)
>>> +{
>>> +	const struct btf *btf = env->prog->aux->btf;
>>> +	const struct btf_type *type;
>>> +	int subprog;
>>> +	u32 size;
>>> +
>>> +	if (!env->prog->jit_requested || bpf_prog_is_offloaded(env->prog->aux))
>>> +		return 0;
>>> +
>>> +	/*
>>> +	 * Skip the main program: its return value is the program's exit code,
>>> +	 * read out of R0, so it never uses the register pair. An extension does
>>> +	 * have a real prototype for subprog 0, but bpf_check_attach_target()
>>> +	 * refuses to replace a function returning more than 8 bytes.
>>> +	 */
>>> +	for (subprog = 1; subprog < env->subprog_cnt; subprog++) {
>>> +		type = subprog_ret_type(env, subprog);
>>> +		/*
>>> +		 * This runs before btf_validate_return_type(), so apply the same
>>> +		 * type filter here.
>>> +		 */
>>> +		if (!type || !(btf_type_is_struct(type) || btf_type_is_scalar(type)))
>>                               ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
>> I still think that only !type check is necessary here:
> Actually: if (!type || !btf_type_is_void(type)) ...
> since btf_resolve_size() does not like void.

Thinking through. I think your above suggestion is correct.
In later patch "bpf: Enable aggregate return types up to 16 bytes", we have

btf_validate_return_type():
	...
  	if (btf_type_is_void(t) || btf_type_is_int(t) || btf_is_any_enum(t))
  		return 0;
  
+	if (btf_type_is_struct(t) && t->size <= 16) {
+		/*
+		 * A global function's caller models the return as an opaque
+		 * scalar pair, so it may only return scalars by value. A local
+		 * function is verified inline, so a pointer field stays tracked
+		 * and needs no such restriction.
+		 */
+		bool local_func = subprog && !is_global;
+
+		if (local_func || btf_type_is_scalar_struct(env, btf, t, 0))
+			return 0;
+	}

	return -EOPNOTSUPP;

So only the above 'return 0' types are supported (void, int, enum, struct etc.).
In bpf_compute_subprog_ret_regs(), we only need valid type and type won't be void.
The 'void' type is for btf_resolve_size(). For other types, btf_validate_return_type()
will reject earlier.

>
>> - btf_resolve_size can handle any type
>> - BTF validation should guarantee that return type is not e.g. BTF_KIND_VAR
>>    that would trigger -EINVAL
>> - for local subprograms verifier checks if r0/r2 bear compatible types anyway
>> - for global subprograms BTF compliance is enforced.
>>
>> Could you please explain why would you want to keep it here?
>>
>>> +			continue;
>>> +		if (verifier_bug_if(IS_ERR(btf_resolve_size(btf, type, &size)), env,
>>> +				    "cannot size return type of subprog %d", subprog))
>>> +			return -EFAULT;
>>> +		if (ret_regs_cnt(size) > 1) {
>>> +			subprog_info(env, subprog)->ret_reg_pair = true;
>>> +			env->prog->jit_required = 1;
>>> +		}
>>> +	}
>>> +
>>> +	return 0;
>>>   }
>>>   
>>>   const char *bpf_subprog_name(const struct bpf_verifier_env *env, int subprog)