Re: [PATCH bpf-next 06/12] bpf: Force JIT for programs using the R0:R2 register pair

[Leon Hwang <leon.hwang@linux.dev>]

On 9/7/26 04:10, Yonghong Song wrote:
> The R0:R2 return convention introduced in this series is only implemented
> in the JIT. The BPF interpreter has no notion of a second return register,
> so a program relying on the R0:R2 convention would compute wrong results
> under the interpreter. Force the JIT when bpf_prog_aux->ret_reg_pair is
> set.
> 
> Signed-off-by: Yonghong Song <yonghong.song@linux.dev>
> ---
>  include/linux/bpf.h   |  1 +
>  kernel/bpf/core.c     |  2 +-
>  kernel/bpf/verifier.c | 13 +++++++++++--
>  3 files changed, 13 insertions(+), 3 deletions(-)
> 
> diff --git a/include/linux/bpf.h b/include/linux/bpf.h
> index c1a98fa36738..10966aba69a2 100644
> --- a/include/linux/bpf.h
> +++ b/include/linux/bpf.h
> @@ -1780,6 +1780,7 @@ struct bpf_prog_aux {
>  	bool changes_pkt_data;
>  	bool might_sleep;
>  	bool kprobe_write_ctx;
> +	bool ret_reg_pair;
>  	struct {
>  		s32 keyring_serial;
>  		u8 keyring_type;
> diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c
> index 73dc3ee879de..819a97d25173 100644
> --- a/kernel/bpf/core.c
> +++ b/kernel/bpf/core.c
> @@ -2676,7 +2676,7 @@ struct bpf_prog *__bpf_prog_select_runtime(struct bpf_verifier_env *env, struct
>  		goto finalize;
>  
>  	if (IS_ENABLED(CONFIG_BPF_JIT_ALWAYS_ON) ||
> -	    bpf_prog_has_kfunc_call(fp))
> +	    bpf_prog_has_kfunc_call(fp) || fp->aux->ret_reg_pair)
>  		jit_needed = true;
>  
>  	if (!bpf_prog_select_interpreter(fp))
> diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> index fcbf532159a5..ca8b2f436c20 100644
> --- a/kernel/bpf/verifier.c
> +++ b/kernel/bpf/verifier.c
> @@ -453,6 +453,15 @@ bool bpf_ret_reg_pair(struct bpf_verifier_env *env, int subprog)
>  	return false;
>  }
>  
> +static bool bpf_ret_reg_pair_mark(struct bpf_verifier_env *env, int subprog)
> +{
> +	if (!bpf_ret_reg_pair(env, subprog))
> +		return false;
> +
> +	env->prog->aux->ret_reg_pair = true;


With 'jit_required' introduction [1], it has no need to introduce
'ret_reg_pair'. 'env->prog->jit_required = true;' is enough.

[1]
https://lore.kernel.org/bpf/20260708101806.18885-1-yangtiezhu@loongson.cn/

Thanks,
Leon
> +	return true;
> +}
> +
>  static const char *subprog_name(const struct bpf_verifier_env *env, int subprog)
>  {
>  	struct bpf_func_info *info;
> @@ -9877,7 +9886,7 @@ static int prepare_func_exit(struct bpf_verifier_env *env, int *insn_idx)
>  	} else {
>  		/* return to the caller whatever r0 had in the callee */
>  		caller->regs[BPF_REG_0] = *r0;
> -		if (bpf_ret_reg_pair(env, callee->subprogno)) {
> +		if (bpf_ret_reg_pair_mark(env, callee->subprogno)) {
>  			if (callee->regs[BPF_REG_2].type == PTR_TO_STACK) {
>  				verbose(env, "cannot return stack pointer to the caller\n");
>  				return -EINVAL;
> @@ -16806,7 +16815,7 @@ static int check_global_subprog_return_code(struct bpf_verifier_env *env)
>  	if (err)
>  		return err;
>  
> -	if (!bpf_ret_reg_pair(env, subprog))
> +	if (!bpf_ret_reg_pair_mark(env, subprog))
>  		return 0;
>  
>  	return check_global_ret_scalar_reg(env, BPF_REG_2);