BPF List
 help / color / mirror / Atom feed
From: Yonghong Song <yonghong.song@linux.dev>
To: bpf@vger.kernel.org
Cc: Alexei Starovoitov <ast@kernel.org>,
	Andrii Nakryiko <andrii@kernel.org>,
	Daniel Borkmann <daniel@iogearbox.net>,
	kernel-team@fb.com, Martin KaFai Lau <martin.lau@kernel.org>
Subject: [PATCH bpf-next v2 0/2] selftests/bpf: Fix tests for llvm23 true signature
Date: Tue,  9 Jun 2026 16:34:02 -0700	[thread overview]
Message-ID: <20260609233402.2711071-1-yonghong.song@linux.dev> (raw)

LLVM23 ([1]) records the 'true' function signature in BTF, i.e. the
signature inferred after optimization rather than the one written in C.
This caused two kinds of selftest failures (see below).

Case 1: keep int return type for tailcall subprogs

The verifier requires any subprog that issues a bpf_tail_call to return
an 'int' (see check_btf_func() in kernel/bpf/check_btf.c, which rejects
it with "tail_call is only allowed in functions that return 'int'").

Several tailcall subprogs do 'return 0' (or another constant) whose
result no caller uses. With llvm23 the compiler folds the constant and,
since the return value is dead, optimizes the subprog to effectively
return 'void' and records 'void' in BTF, so the program fails to load.

Use barrier_var() and __sink() to prevent returned value from being
optimized.

Case 2: adjust tracing prog ctx layout for the true signature

test_pkt_access_subprog2() has an unused argument that llvm optimizes
away. Before llvm23 the BTF signature did not match the optimized
assembly, so the verifier fell back to MAX_BPF_FUNC_REG_ARGS (5) u64
arguments and the fexit return value sat after args[5]. With llvm23 the
true signature has a single argument, so the return value moves to the
slot after args[1]. Select the matching ctx struct based on __clang_major__
so the test works with both old and new llvm.

  [1] https://github.com/llvm/llvm-project/pull/198426

Changelogs:
  v1 -> v2:
    - v1: https://lore.kernel.org/bpf/20260609163947.1717694-1-yonghong.song@linux.dev/
    - Do not use bpf array map or bpf global var. Use __sink() instead.

Yonghong Song (2):
  selftests/bpf: Keep int return type for tailcall subprogs
  selftests/bpf: Adjust fexit_bpf2bpf ctx layout for llvm23 true
    signature

 .../selftests/bpf/progs/fexit_bpf2bpf.c       | 13 ++++++++--
 .../selftests/bpf/progs/tailcall_bpf2bpf2.c   |  5 +++-
 .../bpf/progs/tailcall_bpf2bpf_hierarchy1.c   | 13 ++++++----
 .../bpf/progs/tailcall_bpf2bpf_hierarchy2.c   | 24 +++++++++++++------
 .../bpf/progs/tailcall_bpf2bpf_hierarchy3.c   | 13 +++++++---
 .../progs/tailcall_bpf2bpf_hierarchy_fentry.c | 13 +++++++---
 .../selftests/bpf/progs/verifier_sock.c       |  9 +++++--
 7 files changed, 68 insertions(+), 22 deletions(-)

-- 
2.53.0-Meta


             reply	other threads:[~2026-06-09 23:34 UTC|newest]

Thread overview: 9+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-06-09 23:34 Yonghong Song [this message]
2026-06-09 23:34 ` [PATCH bpf-next v2 1/2] selftests/bpf: Keep int return type for tailcall subprogs Yonghong Song
2026-06-09 23:42   ` sashiko-bot
2026-06-10  3:41     ` Yonghong Song
2026-06-10  4:06     ` Yonghong Song
2026-06-10  0:07   ` bot+bpf-ci
2026-06-10  3:45     ` Yonghong Song
2026-06-09 23:34 ` [PATCH bpf-next v2 2/2] selftests/bpf: Adjust fexit_bpf2bpf ctx layout for llvm23 true signature Yonghong Song
2026-06-10  4:30 ` [PATCH bpf-next v2 0/2] selftests/bpf: Fix tests " patchwork-bot+netdevbpf

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20260609233402.2711071-1-yonghong.song@linux.dev \
    --to=yonghong.song@linux.dev \
    --cc=andrii@kernel.org \
    --cc=ast@kernel.org \
    --cc=bpf@vger.kernel.org \
    --cc=daniel@iogearbox.net \
    --cc=kernel-team@fb.com \
    --cc=martin.lau@kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox