On Mon, Jan 27, 2020 at 06:11:45PM -0800, Palmer Dabbelt wrote: > > + /* Handle BPF_REG_0, which may be in the wrong place because the ARM64 > + * ABI doesn't match the BPF ABI for function calls. */ > + if (ctx->reg0_in_reg1) { > + /* If we're writing BPF_REG_0 then we don't need to do any > + * extra work to get the registers back in their correct > + * locations. */ > + if (insn->dst_reg == BPF_REG_0) > + ctx->reg0_in_reg1 = false; > + > + /* If we're writing to BPF_REG_1 then we need to save BPF_REG_0 > + * into the correct location if it's still alive, as otherwise > + * it will be clobbered. */ > + if (insn->dst_reg == BPF_REG_1) { > + if (!dead_register(ctx, off + 1, BPF_REG_0)) > + emit(A64_MOV(1, A64_R(7), A64_R(0)), ctx); > + ctx->reg0_in_reg1 = false; > + } > + } I'm not sure this is correct, since it processes insns as a linear code, but there could be jumps in the middle. The logic should be following the control flow of the program. The verifier is a better place to do such analysis. I don't see how JITs can do it on their own.