Re: [PATCH bpf-next v2 00/17] bpf: Indirect calls of bpf subprogs (callx)

[Ihor Solodrai <ihor.solodrai@linux.dev>]

On 2026-09-23 10:50 p.m., patchwork-bot+netdevbpf@kernel.org wrote:
> Hello:
> 
> This series was applied to bpf/bpf-next.git (master)
> by Alexei Starovoitov <ast@kernel.org>:

Alexei,

We're testing clang 21->22 bump on BPF CI, and something is broken
when compiling callx selftests:

2026-09-28T22:12:12.4226025Z error: Undefined temporary symbol 
.Lswitch.table.call_by_switch
2026-09-28T22:12:12.4229909Z 1 error generated.
2026-09-28T22:12:12.4265848Z make[1]: *** [Makefile.skel:93: 
/home/runner/work/ci/ci/tools/testing/selftests/bpf/cpuv4/verifier_callx_rodata.bpf.o] 
Error 1
2026-09-28T22:12:12.4275948Z make: *** [Makefile:533: 
/home/runner/work/ci/ci/tools/testing/selftests/bpf/test_progs-cpuv4] 
Error 2
2026-09-28T22:12:12.4291571Z   CLNG-BPF [test_progs-no_alu32] 
verifier_gotol.bpf.o
2026-09-28T22:12:12.4292514Z make: *** Waiting for unfinished jobs....

See: https://github.com/libbpf/ci/actions/runs/36487754699/job/109148996137

What's the requirements for callx? Does it need bleeding edge clang?
If so, let's explicitly skip relevant selftests for clang < N?

Currently CI runs with clang-21.

> 
> On Thu, 24 Sep 2026 03:10:25 +0000 you wrote:
>> From: Alexei Starovoitov <ast@kernel.org>
>>
>> v1->v2:
>> - Dropped "bpf: Don't fold loads from insn_array maps into constants".
>>    bpf_map_direct_read() rejects insn_array already.
>> - patch 1: emit the same diag as sort_subprogs_topo() (bpf-ci).
>> - patch 3 is new: taking the address of a function that is never called
>>    hit verifier_bug() in jit_subprogs(). Not related to callx, but callx
>>    makes it likely.
>> - patch 4: BPF_OP() == BPF_CALL in liveness like in const_fold, explained
>>    in the comment why slots are live before callx callsite (Eduard).
>> - patch 5: moved !bpf_is_callx() into nested 'if' (Eduard). JIT support
>>    is checked before the type of the register.
>> - patch 6: sync callbacks are in the call graph too. Stack depth of
>>    a callback whose address is read from .rodata or taken in another
>>    subprog was not accounted.
>> - patch 10:
>>    . check_cfg() explores functions of a table one at a time. It was
>>      losing changes_pkt_data and other effects of the functions in
>>      a table that call each other.
>>    . no cmpxchg64(), it's not available on all 32-bit archs.
>>    . don't reject the prog that reads a pointer to a function that was
>>      removed as dead code (sashiko).
>>    . load of the pointer sets jit_required, so the prog that passes it to
>>      a helper as a callback can't run in the interpreter (bpf-ci).
>>    . tbl[i].data at variable offset is a regular load when none of
>>      the possible offsets overlaps with a pointer (bpf-ci).
>> - patch 12: append the functions and copy the map only for progs that
>>    have callx. The rest use .rodata as-is (bpf-ci). Pass token_fd to map
>>    create. Dropped dead bpf_map_lookup_elem() fallback.
>> - patch 14: light skeleton reserves fd_array slots only when the object
>>    has callx.
>> - selftests: anchored callx_retval_is_tracked to the caller, the tests
>>    of global func in a table and of const folding of the pointer test what
>>    they claim now, skip without JIT, fixed ASSERT_GT() of u32 and
>>    the comment, added tests for the above (bpf-ci). The table in
>>    callx_rodata_lskel test is volatile. clang was turning it into
>>    direct calls, so the test didn't test light skeleton.
>> - Added acks.
>> v1: https://lore.kernel.org/bpf/20260922011323.1298619-1-alexei.starovoitov@gmail.com/
>>
>> [...]
> 
> Here is the summary with links:
>    - [bpf-next,v2,01/17] bpf: Fix infinite loop in check_max_stack_depth()
>      https://git.kernel.org/bpf/bpf-next/c/f2c33a159190
>    - [bpf-next,v2,02/17] selftests/bpf: Test recursion through a global function and a callback
>      https://git.kernel.org/bpf/bpf-next/c/6cec7366b5ce
>    - [bpf-next,v2,03/17] bpf: Keep functions with address taken when removing dead code
>      https://git.kernel.org/bpf/bpf-next/c/fb1f5ac185b7
>    - [bpf-next,v2,04/17] bpf: Prepare static analysis passes for callx instruction
>      https://git.kernel.org/bpf/bpf-next/c/373e3fd0bff0
>    - [bpf-next,v2,05/17] bpf: Add callx instruction to call bpf subprogs indirectly
>      https://git.kernel.org/bpf/bpf-next/c/7f0f66c069ae
>    - [bpf-next,v2,06/17] bpf: Add callx calls to the call graph
>      https://git.kernel.org/bpf/bpf-next/c/b7151a69bc6e
>    - [bpf-next,v2,07/17] bpf, x86: Add JIT support for callx
>      https://git.kernel.org/bpf/bpf-next/c/69a30e5fe5a8
>    - [bpf-next,v2,08/17] bpf, arm64: Add JIT support for callx
>      https://git.kernel.org/bpf/bpf-next/c/11a516144d9a
>    - [bpf-next,v2,09/17] bpf: Discover subprogs described by func_info
>      https://git.kernel.org/bpf/bpf-next/c/3a03595510dc
>    - [bpf-next,v2,10/17] bpf: Recognize pointers to functions in read-only maps
>      https://git.kernel.org/bpf/bpf-next/c/a04286f6d828
>    - [bpf-next,v2,11/17] libbpf: Support pointers to static functions in data when linking
>      https://git.kernel.org/bpf/bpf-next/c/296fd4782754
>    - [bpf-next,v2,12/17] libbpf: Resolve pointers to functions in read-only data
>      https://git.kernel.org/bpf/bpf-next/c/b223044a68d5
>    - [bpf-next,v2,13/17] libbpf: Treat .data.rel.ro as read-only data
>      https://git.kernel.org/bpf/bpf-next/c/6ec77f0a7697
>    - [bpf-next,v2,14/17] libbpf: Support pointers to functions in read-only data in light skeleton
>      https://git.kernel.org/bpf/bpf-next/c/9f99fc05fc92
>    - [bpf-next,v2,15/17] selftests/bpf: Add tests for callx
>      https://git.kernel.org/bpf/bpf-next/c/e9b22d50796d
>    - [bpf-next,v2,16/17] selftests/bpf: Add tests for callx through pointers in read-only data
>      https://git.kernel.org/bpf/bpf-next/c/b018e998e645
>    - [bpf-next,v2,17/17] bpf, docs: Document callx instruction
>      https://git.kernel.org/bpf/bpf-next/c/fd318eab4b09
> 
> You are awesome, thank you!