Re: [PATCH bpf-next v6 02/10] bpf: Add helpers to describe the R0:R2 return register pair

[Eduard Zingerman <eddyz87@gmail.com>]

On Sun, 2026-08-16 at 21:21 -0700, Yonghong Song wrote:

...

> diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> index b3c474ba7140..f1f1268d29c6 100644
> --- a/kernel/bpf/verifier.c
> +++ b/kernel/bpf/verifier.c
> @@ -385,27 +385,70 @@ bool bpf_subprog_is_global(const struct bpf_verifier_env *env, int subprog)

...

> +static int bpf_compute_subprog_ret_regs(struct bpf_verifier_env *env)
> +{
> +	const struct btf *btf = env->prog->aux->btf;
> +	const struct btf_type *type;
> +	int subprog;
> +	u32 size;
> +
> +	if (!env->prog->jit_requested || bpf_prog_is_offloaded(env->prog->aux))
> +		return 0;
> +
> +	/*
> +	 * Skip the main program: its return value is the program's exit code,
> +	 * read out of R0, so it never uses the register pair. An extension does
> +	 * have a real prototype for subprog 0, but bpf_check_attach_target()
> +	 * refuses to replace a function returning more than 8 bytes.
> +	 */
> +	for (subprog = 1; subprog < env->subprog_cnt; subprog++) {
> +		type = subprog_ret_type(env, subprog);
> +		/*
> +		 * This runs before btf_validate_return_type(), so apply the same
> +		 * type filter here.
> +		 */
> +		if (!type || !(btf_type_is_struct(type) || btf_type_is_scalar(type)))
                             ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
I still think that only !type check is necessary here:
- btf_resolve_size can handle any type
- BTF validation should guarantee that return type is not e.g. BTF_KIND_VAR
  that would trigger -EINVAL
- for local subprograms verifier checks if r0/r2 bear compatible types anyway
- for global subprograms BTF compliance is enforced.

Could you please explain why would you want to keep it here?

> +			continue;
> +		if (verifier_bug_if(IS_ERR(btf_resolve_size(btf, type, &size)), env,
> +				    "cannot size return type of subprog %d", subprog))
> +			return -EFAULT;
> +		if (ret_regs_cnt(size) > 1) {
> +			subprog_info(env, subprog)->ret_reg_pair = true;
> +			env->prog->jit_required = 1;
> +		}
> +	}
> +
> +	return 0;
>  }
>  
>  const char *bpf_subprog_name(const struct bpf_verifier_env *env, int subprog)