Re: [PATCH v7] m68k, bpf: Add initial BPF JIT compiler support

[Alexei Starovoitov]

On Mon, Oct 05, 2026 at 06:52 PM Kuan-Wei Chiu <visitorckw@xxxxxxxxx> wrote:
> Tested with the test_bpf.ko:
> test_bpf: Summary: 1061 PASSED, 0 FAILED, [1049/1049 JIT'ed]
> test_bpf: test_tail_calls: Summary: 10 PASSED, 0 FAILED, [10/10 JIT'ed]

test_bpf.ko doesn't go through the verifier.
It has no bpf-to-bpf calls and no callbacks.

> Changes in v7:
> - Size subprog stack frames from stack_depth instead of MAX_BPF_STACK.
> - Preserve callee's r2 across BPF_PSEUDO_CALL for aggregate returns.
> - Clean up state on extra_pass failure in bpf_int_jit_compile().

So these are fixes for bot findings in the code that was never run.
It doesn't work. See below.

[...]

> +	emit_16(ctx, 0x4ee8);					/* jmp d16(%a0) */
> +	emit_16(ctx, CPU_IS_COLDFIRE ? 48 : 44);

When the target prog has subprogs its prologue is the is_func flavor.
It's 110 bytes, and 44 is in the middle of
move.l %d0, BPF_R2_LO(%fp). The cpu executes 0xfff0.

> +static void build_prologue(struct jit_ctx *ctx)
> +{
> +	int bpf_stack = ctx->prog->is_func ?
> +			round_up(ctx->prog->aux->stack_depth, 4) : MAX_BPF_STACK;

stack_depth can be more than MAX_BPF_STACK.
may_goto adds 8 bytes on top of what the prog uses.
See stack_depth_extra in bpf_do_misc_fixups().
When the prog uses 512 bytes the counter is at r10 - 520.
That's where movem.l saved %d4 and %d5, so the C caller of the prog
gets them back corrupted.
The target of a tail call reuses the frame, so every frame needs
that extra space.

> +	if (ctx->prog->is_func) {
> +		const s8 arg_regs[] = { BPF_REG_1, BPF_REG_2, BPF_REG_3, BPF_REG_4, BPF_REG_5 };
> +
> +		for (i = 0; i < 5; i++) {
> +			int offset = 8 + i * 8;

jit_subprogs() sets is_func for func[0] too, which is the main prog.
It's called from C as bpf_func(ctx, insnsi), so 8(%fp) is ctx and
12(%fp) is insnsi. This loop makes R1 = (u64)ctx << 32 | insnsi.
Every prog that has a subprog or a callback reads its ctx
out of prog->insnsi.

arm32 and x86-32 JITs don't support bpf-to-bpf calls.
Drop them from this patch.
Add them in a follow up when you can run test_progs.

pw-bot: cr