Re: [PATCH bpf-next 06/12] bpf: Force JIT for programs using the R0:R2 register pair

[Yonghong Song <yonghong.song@linux.dev>]

On 7/8/26 8:15 PM, Leon Hwang wrote:
> On 9/7/26 04:10, Yonghong Song wrote:
>> The R0:R2 return convention introduced in this series is only implemented
>> in the JIT. The BPF interpreter has no notion of a second return register,
>> so a program relying on the R0:R2 convention would compute wrong results
>> under the interpreter. Force the JIT when bpf_prog_aux->ret_reg_pair is
>> set.
>>
>> Signed-off-by: Yonghong Song <yonghong.song@linux.dev>
>> ---
>>   include/linux/bpf.h   |  1 +
>>   kernel/bpf/core.c     |  2 +-
>>   kernel/bpf/verifier.c | 13 +++++++++++--
>>   3 files changed, 13 insertions(+), 3 deletions(-)
>>
>> diff --git a/include/linux/bpf.h b/include/linux/bpf.h
>> index c1a98fa36738..10966aba69a2 100644
>> --- a/include/linux/bpf.h
>> +++ b/include/linux/bpf.h
>> @@ -1780,6 +1780,7 @@ struct bpf_prog_aux {
>>   	bool changes_pkt_data;
>>   	bool might_sleep;
>>   	bool kprobe_write_ctx;
>> +	bool ret_reg_pair;
>>   	struct {
>>   		s32 keyring_serial;
>>   		u8 keyring_type;
>> diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c
>> index 73dc3ee879de..819a97d25173 100644
>> --- a/kernel/bpf/core.c
>> +++ b/kernel/bpf/core.c
>> @@ -2676,7 +2676,7 @@ struct bpf_prog *__bpf_prog_select_runtime(struct bpf_verifier_env *env, struct
>>   		goto finalize;
>>   
>>   	if (IS_ENABLED(CONFIG_BPF_JIT_ALWAYS_ON) ||
>> -	    bpf_prog_has_kfunc_call(fp))
>> +	    bpf_prog_has_kfunc_call(fp) || fp->aux->ret_reg_pair)
>>   		jit_needed = true;
>>   
>>   	if (!bpf_prog_select_interpreter(fp))
>> diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
>> index fcbf532159a5..ca8b2f436c20 100644
>> --- a/kernel/bpf/verifier.c
>> +++ b/kernel/bpf/verifier.c
>> @@ -453,6 +453,15 @@ bool bpf_ret_reg_pair(struct bpf_verifier_env *env, int subprog)
>>   	return false;
>>   }
>>   
>> +static bool bpf_ret_reg_pair_mark(struct bpf_verifier_env *env, int subprog)
>> +{
>> +	if (!bpf_ret_reg_pair(env, subprog))
>> +		return false;
>> +
>> +	env->prog->aux->ret_reg_pair = true;
>
> With 'jit_required' introduction [1], it has no need to introduce
> 'ret_reg_pair'. 'env->prog->jit_required = true;' is enough.
>
> [1]
> https://lore.kernel.org/bpf/20260708101806.18885-1-yangtiezhu@loongson.cn/

Thanks! I will use jit_required in the next revision. I guess this will
be useful for many other cases who do not want to support interpreter.

>
> Thanks,
> Leon
>> +	return true;
>> +}
>> +
>>   static const char *subprog_name(const struct bpf_verifier_env *env, int subprog)
>>   {
>>   	struct bpf_func_info *info;
>> @@ -9877,7 +9886,7 @@ static int prepare_func_exit(struct bpf_verifier_env *env, int *insn_idx)
>>   	} else {
>>   		/* return to the caller whatever r0 had in the callee */
>>   		caller->regs[BPF_REG_0] = *r0;
>> -		if (bpf_ret_reg_pair(env, callee->subprogno)) {
>> +		if (bpf_ret_reg_pair_mark(env, callee->subprogno)) {
>>   			if (callee->regs[BPF_REG_2].type == PTR_TO_STACK) {
>>   				verbose(env, "cannot return stack pointer to the caller\n");
>>   				return -EINVAL;
>> @@ -16806,7 +16815,7 @@ static int check_global_subprog_return_code(struct bpf_verifier_env *env)
>>   	if (err)
>>   		return err;
>>   
>> -	if (!bpf_ret_reg_pair(env, subprog))
>> +	if (!bpf_ret_reg_pair_mark(env, subprog))
>>   		return 0;
>>   
>>   	return check_global_ret_scalar_reg(env, BPF_REG_2);