From: Yonghong Song <yonghong.song@linux.dev>
To: bpf@vger.kernel.org
Cc: Alexei Starovoitov <ast@kernel.org>,
Andrii Nakryiko <andrii@kernel.org>,
Daniel Borkmann <daniel@iogearbox.net>,
kernel-team@fb.com, Martin KaFai Lau <martin.lau@kernel.org>
Subject: [PATCH bpf-next v2 0/2] selftests/bpf: Fix tests for llvm23 true signature
Date: Tue, 9 Jun 2026 16:34:02 -0700 [thread overview]
Message-ID: <20260609233402.2711071-1-yonghong.song@linux.dev> (raw)
LLVM23 ([1]) records the 'true' function signature in BTF, i.e. the
signature inferred after optimization rather than the one written in C.
This caused two kinds of selftest failures (see below).
Case 1: keep int return type for tailcall subprogs
The verifier requires any subprog that issues a bpf_tail_call to return
an 'int' (see check_btf_func() in kernel/bpf/check_btf.c, which rejects
it with "tail_call is only allowed in functions that return 'int'").
Several tailcall subprogs do 'return 0' (or another constant) whose
result no caller uses. With llvm23 the compiler folds the constant and,
since the return value is dead, optimizes the subprog to effectively
return 'void' and records 'void' in BTF, so the program fails to load.
Use barrier_var() and __sink() to prevent returned value from being
optimized.
Case 2: adjust tracing prog ctx layout for the true signature
test_pkt_access_subprog2() has an unused argument that llvm optimizes
away. Before llvm23 the BTF signature did not match the optimized
assembly, so the verifier fell back to MAX_BPF_FUNC_REG_ARGS (5) u64
arguments and the fexit return value sat after args[5]. With llvm23 the
true signature has a single argument, so the return value moves to the
slot after args[1]. Select the matching ctx struct based on __clang_major__
so the test works with both old and new llvm.
[1] https://github.com/llvm/llvm-project/pull/198426
Changelogs:
v1 -> v2:
- v1: https://lore.kernel.org/bpf/20260609163947.1717694-1-yonghong.song@linux.dev/
- Do not use bpf array map or bpf global var. Use __sink() instead.
Yonghong Song (2):
selftests/bpf: Keep int return type for tailcall subprogs
selftests/bpf: Adjust fexit_bpf2bpf ctx layout for llvm23 true
signature
.../selftests/bpf/progs/fexit_bpf2bpf.c | 13 ++++++++--
.../selftests/bpf/progs/tailcall_bpf2bpf2.c | 5 +++-
.../bpf/progs/tailcall_bpf2bpf_hierarchy1.c | 13 ++++++----
.../bpf/progs/tailcall_bpf2bpf_hierarchy2.c | 24 +++++++++++++------
.../bpf/progs/tailcall_bpf2bpf_hierarchy3.c | 13 +++++++---
.../progs/tailcall_bpf2bpf_hierarchy_fentry.c | 13 +++++++---
.../selftests/bpf/progs/verifier_sock.c | 9 +++++--
7 files changed, 68 insertions(+), 22 deletions(-)
--
2.53.0-Meta
next reply other threads:[~2026-06-09 23:34 UTC|newest]
Thread overview: 9+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-06-09 23:34 Yonghong Song [this message]
2026-06-09 23:34 ` [PATCH bpf-next v2 1/2] selftests/bpf: Keep int return type for tailcall subprogs Yonghong Song
2026-06-09 23:42 ` sashiko-bot
2026-06-10 3:41 ` Yonghong Song
2026-06-10 4:06 ` Yonghong Song
2026-06-10 0:07 ` bot+bpf-ci
2026-06-10 3:45 ` Yonghong Song
2026-06-09 23:34 ` [PATCH bpf-next v2 2/2] selftests/bpf: Adjust fexit_bpf2bpf ctx layout for llvm23 true signature Yonghong Song
2026-06-10 4:30 ` [PATCH bpf-next v2 0/2] selftests/bpf: Fix tests " patchwork-bot+netdevbpf
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260609233402.2711071-1-yonghong.song@linux.dev \
--to=yonghong.song@linux.dev \
--cc=andrii@kernel.org \
--cc=ast@kernel.org \
--cc=bpf@vger.kernel.org \
--cc=daniel@iogearbox.net \
--cc=kernel-team@fb.com \
--cc=martin.lau@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox