Re: [PATCH v7] m68k, bpf: Add initial BPF JIT compiler support

[Kuan-Wei Chiu <visitorckw@gmail.com>]

On Sat, Oct 10, 2026 at 03:16:04PM +0000, Alexei Starovoitov wrote:
> On Mon, Oct 05, 2026 at 06:52 PM Kuan-Wei Chiu <visitorckw@gmail.com> wrote:
> > Tested with the test_bpf.ko:
> > test_bpf: Summary: 1061 PASSED, 0 FAILED, [1049/1049 JIT'ed]
> > test_bpf: test_tail_calls: Summary: 10 PASSED, 0 FAILED, [10/10 JIT'ed]
> 
> test_bpf.ko doesn't go through the verifier.
> It has no bpf-to-bpf calls and no callbacks.
> 
> > Changes in v7:
> > - Size subprog stack frames from stack_depth instead of MAX_BPF_STACK.
> > - Preserve callee's r2 across BPF_PSEUDO_CALL for aggregate returns.
> > - Clean up state on extra_pass failure in bpf_int_jit_compile().
> 
> So these are fixes for bot findings in the code that was never run.
> It doesn't work. See below.
> 
> [...]
> 
> > +	emit_16(ctx, 0x4ee8);					/* jmp d16(%a0) */
> > +	emit_16(ctx, CPU_IS_COLDFIRE ? 48 : 44);
> 
> When the target prog has subprogs its prologue is the is_func flavor.
> It's 110 bytes, and 44 is in the middle of
> move.l %d0, BPF_R2_LO(%fp). The cpu executes 0xfff0.
> 
> > +static void build_prologue(struct jit_ctx *ctx)
> > +{
> > +	int bpf_stack = ctx->prog->is_func ?
> > +			round_up(ctx->prog->aux->stack_depth, 4) : MAX_BPF_STACK;
> 
> stack_depth can be more than MAX_BPF_STACK.
> may_goto adds 8 bytes on top of what the prog uses.
> See stack_depth_extra in bpf_do_misc_fixups().
> When the prog uses 512 bytes the counter is at r10 - 520.
> That's where movem.l saved %d4 and %d5, so the C caller of the prog
> gets them back corrupted.
> The target of a tail call reuses the frame, so every frame needs
> that extra space.
> 
> > +	if (ctx->prog->is_func) {
> > +		const s8 arg_regs[] = { BPF_REG_1, BPF_REG_2, BPF_REG_3, BPF_REG_4, BPF_REG_5 };
> > +
> > +		for (i = 0; i < 5; i++) {
> > +			int offset = 8 + i * 8;
> 
> jit_subprogs() sets is_func for func[0] too, which is the main prog.
> It's called from C as bpf_func(ctx, insnsi), so 8(%fp) is ctx and
> 12(%fp) is insnsi. This loop makes R1 = (u64)ctx << 32 | insnsi.
> Every prog that has a subprog or a callback reads its ctx
> out of prog->insnsi.
> 
> arm32 and x86-32 JITs don't support bpf-to-bpf calls.
> Drop them from this patch.
> Add them in a follow up when you can run test_progs.

Thanks for the review and the detailed explaination.

My initial patch didn't include subprog support, but I endedd up trying
to deal with it after the bots complained about it.

I'll reject BPF_PSEUDO_CALL, and reserve the extra 8 bytes on the
stack.

Regards,
Kuan-Wei