* [PATCH bpf-next v2 1/2] bpf: allow terminal gotox instructions
@ 2026-08-31 22:33 Siddharth Chintamaneni
2026-08-31 22:33 ` [PATCH bpf-next v2 2/2] selftests/bpf: Test " Siddharth Chintamaneni
2026-08-31 23:26 ` [PATCH bpf-next v2 1/2] bpf: allow " bot+bpf-ci
0 siblings, 2 replies; 7+ messages in thread
From: Siddharth Chintamaneni @ 2026-08-31 22:33 UTC (permalink / raw)
To: bpf
Cc: Siddharth Chintamaneni, Anton Protopopov, Alexei Starovoitov,
Daniel Borkmann, John Fastabend, Andrii Nakryiko,
Eduard Zingerman, Kumar Kartikeya Dwivedi, Martin KaFai Lau,
Song Liu, Yonghong Song, Jiri Olsa, Emil Tsalapatis,
Ihor Solodrai, Puranjay Mohan, rlmenge, hargar, apais
check_subprogs() treats gotox as a direct jump and validates its reserved
zero offset. When gotox is the final instruction, this produces a
synthetic successor one instruction past the end of the subprogram and
rejects an otherwise valid program.
Skip direct-offset validation for gotox and accept it as a
non-fallthrough terminal instruction. Its actual targets remain validated
from the instruction-array jump table during CFG construction.
Fixes: 493d9e0d6083 ("bpf, x86: add support for indirect jumps")
Signed-off-by: Siddharth Chintamaneni <sidchintamaneni@gmail.com>
Reviewed-by: Anton Protopopov <a.s.protopopov@gmail.com>
---
kernel/bpf/verifier.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index e036ae20bf6b..44195ec1445d 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -3087,6 +3087,8 @@ static int check_subprogs(struct bpf_verifier_env *env)
subprog[cur_subprog].exit_idx = i;
goto next;
}
+ if (insn_is_gotox(&insn[i]))
+ goto next;
off = i + bpf_jmp_offset(&insn[i]) + 1;
if (off < subprog_start || off >= subprog_end) {
verbose(env, "jump out of range from insn %d to %d\n", i, off);
@@ -3106,7 +3108,8 @@ static int check_subprogs(struct bpf_verifier_env *env)
*/
if (code != (BPF_JMP | BPF_EXIT) &&
code != (BPF_JMP32 | BPF_JA) &&
- code != (BPF_JMP | BPF_JA)) {
+ code != (BPF_JMP | BPF_JA) &&
+ !insn_is_gotox(&insn[i])) {
verbose(env, "last insn is not an exit or jmp\n");
bpf_diag_program_structure(
env, i, "subprogram can fall through",
base-commit: cd35e1b10182c42b4ae31ee49119463b17d8ba7f
--
2.43.0
^ permalink raw reply related [flat|nested] 7+ messages in thread
* [PATCH bpf-next v2 2/2] selftests/bpf: Test terminal gotox instructions
2026-08-31 22:33 [PATCH bpf-next v2 1/2] bpf: allow terminal gotox instructions Siddharth Chintamaneni
@ 2026-08-31 22:33 ` Siddharth Chintamaneni
2026-08-31 23:26 ` bot+bpf-ci
2026-08-31 23:26 ` [PATCH bpf-next v2 1/2] bpf: allow " bot+bpf-ci
1 sibling, 1 reply; 7+ messages in thread
From: Siddharth Chintamaneni @ 2026-08-31 22:33 UTC (permalink / raw)
To: bpf
Cc: Siddharth Chintamaneni, Alexei Starovoitov, Daniel Borkmann,
John Fastabend, Andrii Nakryiko, Eduard Zingerman,
Kumar Kartikeya Dwivedi, Martin KaFai Lau, Song Liu,
Yonghong Song, Jiri Olsa, Emil Tsalapatis, Ihor Solodrai,
Anton Protopopov, Puranjay Mohan, rlmenge, hargar, apais
Add tests that place gotox at the end of the main program and a
subprogram, with each jump-table target preceding the gotox instruction.
This tests gotox as a valid non-fallthrough terminal instruction.
Signed-off-by: Siddharth Chintamaneni <sidchintamaneni@gmail.com>
---
.../selftests/bpf/progs/verifier_gotox.c | 61 +++++++++++++++++++
1 file changed, 61 insertions(+)
diff --git a/tools/testing/selftests/bpf/progs/verifier_gotox.c b/tools/testing/selftests/bpf/progs/verifier_gotox.c
index 5b18c9a27717..89067ab7baaa 100644
--- a/tools/testing/selftests/bpf/progs/verifier_gotox.c
+++ b/tools/testing/selftests/bpf/progs/verifier_gotox.c
@@ -47,6 +47,67 @@ DEFINE_SIMPLE_JUMP_TABLE_PROG(reserved_field_src_reg, BPF_REG_1, 0, 0, __fa
DEFINE_SIMPLE_JUMP_TABLE_PROG(reserved_field_non_zero_off, BPF_REG_0, 1, 0, __failure __msg("BPF_JA|BPF_X uses reserved fields"))
DEFINE_SIMPLE_JUMP_TABLE_PROG(reserved_field_non_zero_imm, BPF_REG_0, 0, 1, __failure __msg("BPF_JA|BPF_X uses reserved fields"))
+SEC("socket")
+__success __retval(0)
+__naked void jump_table_terminal_gotox(void)
+{
+ asm volatile (" \
+ .pushsection .jumptables,\"\",@progbits; \
+jt0_%=: \
+ .quad ret0_%= - socket; \
+ .size jt0_%=, 8; \
+ .global jt0_%=; \
+ .popsection; \
+ \
+ r0 = jt0_%= ll; \
+ r0 = *(u64 *)(r0 + 0); \
+ goto end_%=; \
+ret0_%=: \
+ r0 = 0; \
+ exit; \
+end_%=: \
+ .8byte %[gotox_r0]; \
+" :
+ : __imm_insn(gotox_r0, BPF_RAW_INSN(BPF_JMP | BPF_JA | BPF_X,
+ BPF_REG_0, 0, 0, 0))
+ : __clobber_all);
+}
+
+static __naked __noinline __used
+void terminal_gotox_subprog(void)
+{
+ asm volatile (" \
+ .pushsection .jumptables,\"\",@progbits; \
+jt0_%=: \
+ .quad ret0_%= - .text; \
+ .size jt0_%=, 8; \
+ .global jt0_%=; \
+ .popsection; \
+ \
+ r0 = jt0_%= ll; \
+ r0 = *(u64 *)(r0 + 0); \
+ goto end_%=; \
+ret0_%=: \
+ r0 = 0; \
+ exit; \
+end_%=: \
+ .8byte %[gotox_r0]; \
+" :
+ : __imm_insn(gotox_r0, BPF_RAW_INSN(BPF_JMP | BPF_JA | BPF_X,
+ BPF_REG_0, 0, 0, 0))
+ : __clobber_all);
+}
+
+SEC("socket")
+__success __retval(0)
+__naked void jump_table_terminal_gotox_subprog(void)
+{
+ asm volatile (" \
+ call terminal_gotox_subprog; \
+ exit; \
+" ::: __clobber_all);
+}
+
/*
* Gotox is forbidden when there is no jump table loaded
* which points to the sub-function where the gotox is used
--
2.43.0
^ permalink raw reply related [flat|nested] 7+ messages in thread
* Re: [PATCH bpf-next v2 2/2] selftests/bpf: Test terminal gotox instructions
2026-08-31 22:33 ` [PATCH bpf-next v2 2/2] selftests/bpf: Test " Siddharth Chintamaneni
@ 2026-08-31 23:26 ` bot+bpf-ci
2026-09-01 13:58 ` Anton Protopopov
0 siblings, 1 reply; 7+ messages in thread
From: bot+bpf-ci @ 2026-08-31 23:26 UTC (permalink / raw)
To: sidchintamaneni, bpf
Cc: sidchintamaneni, ast, daniel, john.fastabend, andrii, eddyz87,
memxor, martin.lau, song, yonghong.song, jolsa, emil,
ihor.solodrai, a.s.protopopov, puranjay, rlmenge, hargar, apais,
ast, andrii, daniel, martin.lau, eddyz87, yonghong.song, mason,
ihor.solodrai
[-- Attachment #1: Type: text/plain, Size: 3043 bytes --]
> diff --git a/tools/testing/selftests/bpf/progs/verifier_gotox.c b/tools/testing/selftests/bpf/progs/verifier_gotox.c
> index 5b18c9a27717b..89067ab7baaa4 100644
> --- a/tools/testing/selftests/bpf/progs/verifier_gotox.c
> +++ b/tools/testing/selftests/bpf/progs/verifier_gotox.c
> @@ -47,6 +47,67 @@ DEFINE_SIMPLE_JUMP_TABLE_PROG(reserved_field_src_reg, BPF_REG_1, 0, 0, __fa
> DEFINE_SIMPLE_JUMP_TABLE_PROG(reserved_field_non_zero_off, BPF_REG_0, 1, 0, __failure __msg("BPF_JA|BPF_X uses reserved fields"))
> DEFINE_SIMPLE_JUMP_TABLE_PROG(reserved_field_non_zero_imm, BPF_REG_0, 0, 1, __failure __msg("BPF_JA|BPF_X uses reserved fields"))
>
> +SEC("socket")
> +__success __retval(0)
> +__naked void jump_table_terminal_gotox(void)
> +{
> + asm volatile (" \
> + .pushsection .jumptables,\"\",@progbits; \
> +jt0_%=: \
> + .quad ret0_%= - socket; \
> + .size jt0_%=, 8; \
> + .global jt0_%=; \
> + .popsection; \
> + \
> + r0 = jt0_%= ll; \
> + r0 = *(u64 *)(r0 + 0); \
> + goto end_%=; \
> +ret0_%=: \
> + r0 = 0; \
> + exit; \
> +end_%=: \
> + .8byte %[gotox_r0]; \
> +" :
> + : __imm_insn(gotox_r0, BPF_RAW_INSN(BPF_JMP | BPF_JA | BPF_X,
> + BPF_REG_0, 0, 0, 0))
> + : __clobber_all);
> +}
> +
> +static __naked __noinline __used
> +void terminal_gotox_subprog(void)
> +{
> + asm volatile (" \
> + .pushsection .jumptables,\"\",@progbits; \
> +jt0_%=: \
> + .quad ret0_%= - .text; \
> + .size jt0_%=, 8; \
> + .global jt0_%=; \
> + .popsection; \
> + \
> + r0 = jt0_%= ll; \
> + r0 = *(u64 *)(r0 + 0); \
> + goto end_%=; \
> +ret0_%=: \
> + r0 = 0; \
> + exit; \
> +end_%=: \
> + .8byte %[gotox_r0]; \
> +" :
> + : __imm_insn(gotox_r0, BPF_RAW_INSN(BPF_JMP | BPF_JA | BPF_X,
> + BPF_REG_0, 0, 0, 0))
> + : __clobber_all);
> +}
This isn't a bug, but terminal_gotox_subprog() differs from
jump_table_terminal_gotox() above only in the jump-table base symbol
(- .text vs - socket). The file elsewhere factors similar shapes into
macros (DEFINE_SIMPLE_JUMP_TABLE_PROG, DEFINE_INVALID_SIZE_PROG,
DEFINE_JUMP_TABLE_USE_REG). Would a small macro parameterised on the
base read better here?
Also, since libbpf appends the only called subprogram last, this
subprogram's gotox ends up as the final instruction of the whole loaded
program. Would adding a further subprogram after it give coverage of the
fall-through-into-the-next-subprog case that the relaxed check in
check_subprogs() guards?
> +
> +SEC("socket")
> +__success __retval(0)
> +__naked void jump_table_terminal_gotox_subprog(void)
> +{
> + asm volatile (" \
> + call terminal_gotox_subprog; \
> + exit; \
> +" ::: __clobber_all);
> +}
[ ... ]
---
AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md
CI run summary: https://github.com/kernel-patches/bpf/actions/runs/33447655511
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PATCH bpf-next v2 1/2] bpf: allow terminal gotox instructions
2026-08-31 22:33 [PATCH bpf-next v2 1/2] bpf: allow terminal gotox instructions Siddharth Chintamaneni
2026-08-31 22:33 ` [PATCH bpf-next v2 2/2] selftests/bpf: Test " Siddharth Chintamaneni
@ 2026-08-31 23:26 ` bot+bpf-ci
2026-09-01 13:51 ` Anton Protopopov
1 sibling, 1 reply; 7+ messages in thread
From: bot+bpf-ci @ 2026-08-31 23:26 UTC (permalink / raw)
To: sidchintamaneni, bpf
Cc: sidchintamaneni, a.s.protopopov, ast, daniel, john.fastabend,
andrii, eddyz87, memxor, martin.lau, song, yonghong.song, jolsa,
emil, ihor.solodrai, puranjay, rlmenge, hargar, apais, ast,
andrii, daniel, martin.lau, eddyz87, yonghong.song, mason,
ihor.solodrai
[-- Attachment #1: Type: text/plain, Size: 1320 bytes --]
> bpf: allow terminal gotox instructions
This isn't a bug, but Anton Protopopov requested capitalizing "allow" in
the commit title when he provided his Reviewed-by tag. Should this be
"bpf: Allow terminal gotox instructions"?
> diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> index 8f585ceb2cd51..483473df7746c 100644
> --- a/kernel/bpf/verifier.c
> +++ b/kernel/bpf/verifier.c
[ ... ]
> @@ -3107,7 +3109,8 @@ static int check_subprogs(struct bpf_verifier_env *env)
> if (i == subprog_end - 1) {
> /* to avoid fall-through from one subprog into another
> * the last insn of the subprog should be either exit
> * or unconditional jump back or bpf_throw call
> */
> if (code != (BPF_JMP | BPF_EXIT) &&
> code != (BPF_JMP32 | BPF_JA) &&
> - code != (BPF_JMP | BPF_JA)) {
> + code != (BPF_JMP | BPF_JA) &&
> + !insn_is_gotox(&insn[i])) {
This isn't a bug, but would it be worth extending the comment above this
condition to mention gotox, since the accepted-terminator list right
below it now has a fourth entry?
---
AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md
CI run summary: https://github.com/kernel-patches/bpf/actions/runs/33447655511
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PATCH bpf-next v2 1/2] bpf: allow terminal gotox instructions
2026-08-31 23:26 ` [PATCH bpf-next v2 1/2] bpf: allow " bot+bpf-ci
@ 2026-09-01 13:51 ` Anton Protopopov
0 siblings, 0 replies; 7+ messages in thread
From: Anton Protopopov @ 2026-09-01 13:51 UTC (permalink / raw)
To: bot+bpf-ci
Cc: sidchintamaneni, bpf, ast, daniel, john.fastabend, andrii,
eddyz87, memxor, martin.lau, song, yonghong.song, jolsa, emil,
ihor.solodrai, puranjay, rlmenge, hargar, apais, martin.lau,
mason
On 26/08/31 11:26PM, bot+bpf-ci@kernel.org wrote:
> > bpf: allow terminal gotox instructions
>
> This isn't a bug, but Anton Protopopov requested capitalizing "allow" in
> the commit title when he provided his Reviewed-by tag. Should this be
> "bpf: Allow terminal gotox instructions"?
+1
>
> > diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> > index 8f585ceb2cd51..483473df7746c 100644
> > --- a/kernel/bpf/verifier.c
> > +++ b/kernel/bpf/verifier.c
>
> [ ... ]
>
> > @@ -3107,7 +3109,8 @@ static int check_subprogs(struct bpf_verifier_env *env)
> > if (i == subprog_end - 1) {
> > /* to avoid fall-through from one subprog into another
> > * the last insn of the subprog should be either exit
> > * or unconditional jump back or bpf_throw call
> > */
> > if (code != (BPF_JMP | BPF_EXIT) &&
> > code != (BPF_JMP32 | BPF_JA) &&
> > - code != (BPF_JMP | BPF_JA)) {
> > + code != (BPF_JMP | BPF_JA) &&
> > + !insn_is_gotox(&insn[i])) {
>
> This isn't a bug, but would it be worth extending the comment above this
> condition to mention gotox, since the accepted-terminator list right
> below it now has a fourth entry?
I would ignore this, indirect jumps are unconditional as well
>
> ---
> AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
> See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md
>
> CI run summary: https://github.com/kernel-patches/bpf/actions/runs/33447655511
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PATCH bpf-next v2 2/2] selftests/bpf: Test terminal gotox instructions
2026-08-31 23:26 ` bot+bpf-ci
@ 2026-09-01 13:58 ` Anton Protopopov
2026-09-01 16:21 ` Siddharth Chintamaneni
0 siblings, 1 reply; 7+ messages in thread
From: Anton Protopopov @ 2026-09-01 13:58 UTC (permalink / raw)
To: bot+bpf-ci
Cc: sidchintamaneni, bpf, ast, daniel, john.fastabend, andrii,
eddyz87, memxor, martin.lau, song, yonghong.song, jolsa, emil,
ihor.solodrai, puranjay, rlmenge, hargar, apais, martin.lau,
mason
On 26/08/31 11:26PM, bot+bpf-ci@kernel.org wrote:
> > diff --git a/tools/testing/selftests/bpf/progs/verifier_gotox.c b/tools/testing/selftests/bpf/progs/verifier_gotox.c
> > index 5b18c9a27717b..89067ab7baaa4 100644
> > --- a/tools/testing/selftests/bpf/progs/verifier_gotox.c
> > +++ b/tools/testing/selftests/bpf/progs/verifier_gotox.c
> > @@ -47,6 +47,67 @@ DEFINE_SIMPLE_JUMP_TABLE_PROG(reserved_field_src_reg, BPF_REG_1, 0, 0, __fa
> > DEFINE_SIMPLE_JUMP_TABLE_PROG(reserved_field_non_zero_off, BPF_REG_0, 1, 0, __failure __msg("BPF_JA|BPF_X uses reserved fields"))
> > DEFINE_SIMPLE_JUMP_TABLE_PROG(reserved_field_non_zero_imm, BPF_REG_0, 0, 1, __failure __msg("BPF_JA|BPF_X uses reserved fields"))
> >
> > +SEC("socket")
> > +__success __retval(0)
> > +__naked void jump_table_terminal_gotox(void)
> > +{
> > + asm volatile (" \
> > + .pushsection .jumptables,\"\",@progbits; \
> > +jt0_%=: \
> > + .quad ret0_%= - socket; \
> > + .size jt0_%=, 8; \
> > + .global jt0_%=; \
> > + .popsection; \
> > + \
> > + r0 = jt0_%= ll; \
> > + r0 = *(u64 *)(r0 + 0); \
> > + goto end_%=; \
> > +ret0_%=: \
> > + r0 = 0; \
> > + exit; \
> > +end_%=: \
> > + .8byte %[gotox_r0]; \
> > +" :
> > + : __imm_insn(gotox_r0, BPF_RAW_INSN(BPF_JMP | BPF_JA | BPF_X,
> > + BPF_REG_0, 0, 0, 0))
> > + : __clobber_all);
> > +}
> > +
> > +static __naked __noinline __used
> > +void terminal_gotox_subprog(void)
> > +{
> > + asm volatile (" \
> > + .pushsection .jumptables,\"\",@progbits; \
> > +jt0_%=: \
> > + .quad ret0_%= - .text; \
> > + .size jt0_%=, 8; \
> > + .global jt0_%=; \
> > + .popsection; \
> > + \
> > + r0 = jt0_%= ll; \
> > + r0 = *(u64 *)(r0 + 0); \
> > + goto end_%=; \
> > +ret0_%=: \
> > + r0 = 0; \
> > + exit; \
> > +end_%=: \
> > + .8byte %[gotox_r0]; \
> > +" :
> > + : __imm_insn(gotox_r0, BPF_RAW_INSN(BPF_JMP | BPF_JA | BPF_X,
> > + BPF_REG_0, 0, 0, 0))
> > + : __clobber_all);
> > +}
>
> This isn't a bug, but terminal_gotox_subprog() differs from
> jump_table_terminal_gotox() above only in the jump-table base symbol
> (- .text vs - socket). The file elsewhere factors similar shapes into
> macros (DEFINE_SIMPLE_JUMP_TABLE_PROG, DEFINE_INVALID_SIZE_PROG,
> DEFINE_JUMP_TABLE_USE_REG). Would a small macro parameterised on the
> base read better here?
>
> Also, since libbpf appends the only called subprogram last, this
> subprogram's gotox ends up as the final instruction of the whole loaded
> program. Would adding a further subprogram after it give coverage of the
> fall-through-into-the-next-subprog case that the relaxed check in
> check_subprogs() guards?
If you add a macro as robot suggested, then the
jump_table_terminal_gotox_subprog() below can call two subprogs
(same, with different names).
Otherwise, looks good to me!
> > +
> > +SEC("socket")
> > +__success __retval(0)
> > +__naked void jump_table_terminal_gotox_subprog(void)
> > +{
> > + asm volatile (" \
> > + call terminal_gotox_subprog; \
> > + exit; \
> > +" ::: __clobber_all);
> > +}
>
> [ ... ]
>
>
> ---
> AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
> See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md
>
> CI run summary: https://github.com/kernel-patches/bpf/actions/runs/33447655511
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PATCH bpf-next v2 2/2] selftests/bpf: Test terminal gotox instructions
2026-09-01 13:58 ` Anton Protopopov
@ 2026-09-01 16:21 ` Siddharth Chintamaneni
0 siblings, 0 replies; 7+ messages in thread
From: Siddharth Chintamaneni @ 2026-09-01 16:21 UTC (permalink / raw)
To: Anton Protopopov
Cc: bot+bpf-ci, bpf, ast, daniel, john.fastabend, andrii, eddyz87,
memxor, martin.lau, song, yonghong.song, jolsa, emil,
ihor.solodrai, puranjay, rlmenge, hargar, apais, martin.lau,
mason
On Tue, 1 Sept 2026 at 06:47, Anton Protopopov <a.s.protopopov@gmail.com> wrote:
>
> On 26/08/31 11:26PM, bot+bpf-ci@kernel.org wrote:
> > > diff --git a/tools/testing/selftests/bpf/progs/verifier_gotox.c b/tools/testing/selftests/bpf/progs/verifier_gotox.c
> > > index 5b18c9a27717b..89067ab7baaa4 100644
> > > --- a/tools/testing/selftests/bpf/progs/verifier_gotox.c
> > > +++ b/tools/testing/selftests/bpf/progs/verifier_gotox.c
> > > @@ -47,6 +47,67 @@ DEFINE_SIMPLE_JUMP_TABLE_PROG(reserved_field_src_reg, BPF_REG_1, 0, 0, __fa
> > > DEFINE_SIMPLE_JUMP_TABLE_PROG(reserved_field_non_zero_off, BPF_REG_0, 1, 0, __failure __msg("BPF_JA|BPF_X uses reserved fields"))
> > > DEFINE_SIMPLE_JUMP_TABLE_PROG(reserved_field_non_zero_imm, BPF_REG_0, 0, 1, __failure __msg("BPF_JA|BPF_X uses reserved fields"))
> > >
> > > +SEC("socket")
> > > +__success __retval(0)
> > > +__naked void jump_table_terminal_gotox(void)
> > > +{
> > > + asm volatile (" \
> > > + .pushsection .jumptables,\"\",@progbits; \
> > > +jt0_%=: \
> > > + .quad ret0_%= - socket; \
> > > + .size jt0_%=, 8; \
> > > + .global jt0_%=; \
> > > + .popsection; \
> > > + \
> > > + r0 = jt0_%= ll; \
> > > + r0 = *(u64 *)(r0 + 0); \
> > > + goto end_%=; \
> > > +ret0_%=: \
> > > + r0 = 0; \
> > > + exit; \
> > > +end_%=: \
> > > + .8byte %[gotox_r0]; \
> > > +" :
> > > + : __imm_insn(gotox_r0, BPF_RAW_INSN(BPF_JMP | BPF_JA | BPF_X,
> > > + BPF_REG_0, 0, 0, 0))
> > > + : __clobber_all);
> > > +}
> > > +
> > > +static __naked __noinline __used
> > > +void terminal_gotox_subprog(void)
> > > +{
> > > + asm volatile (" \
> > > + .pushsection .jumptables,\"\",@progbits; \
> > > +jt0_%=: \
> > > + .quad ret0_%= - .text; \
> > > + .size jt0_%=, 8; \
> > > + .global jt0_%=; \
> > > + .popsection; \
> > > + \
> > > + r0 = jt0_%= ll; \
> > > + r0 = *(u64 *)(r0 + 0); \
> > > + goto end_%=; \
> > > +ret0_%=: \
> > > + r0 = 0; \
> > > + exit; \
> > > +end_%=: \
> > > + .8byte %[gotox_r0]; \
> > > +" :
> > > + : __imm_insn(gotox_r0, BPF_RAW_INSN(BPF_JMP | BPF_JA | BPF_X,
> > > + BPF_REG_0, 0, 0, 0))
> > > + : __clobber_all);
> > > +}
> >
> > This isn't a bug, but terminal_gotox_subprog() differs from
> > jump_table_terminal_gotox() above only in the jump-table base symbol
> > (- .text vs - socket). The file elsewhere factors similar shapes into
> > macros (DEFINE_SIMPLE_JUMP_TABLE_PROG, DEFINE_INVALID_SIZE_PROG,
> > DEFINE_JUMP_TABLE_USE_REG). Would a small macro parameterised on the
> > base read better here?
> >
> > Also, since libbpf appends the only called subprogram last, this
> > subprogram's gotox ends up as the final instruction of the whole loaded
> > program. Would adding a further subprogram after it give coverage of the
> > fall-through-into-the-next-subprog case that the relaxed check in
> > check_subprogs() guards?
>
> If you add a macro as robot suggested, then the
> jump_table_terminal_gotox_subprog() below can call two subprogs
> (same, with different names).
>
> Otherwise, looks good to me!
>
Yes, makesense. I will respin it!
<SNIP>
^ permalink raw reply [flat|nested] 7+ messages in thread
end of thread, other threads:[~2026-09-01 16:21 UTC | newest]
Thread overview: 7+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-08-31 22:33 [PATCH bpf-next v2 1/2] bpf: allow terminal gotox instructions Siddharth Chintamaneni
2026-08-31 22:33 ` [PATCH bpf-next v2 2/2] selftests/bpf: Test " Siddharth Chintamaneni
2026-08-31 23:26 ` bot+bpf-ci
2026-09-01 13:58 ` Anton Protopopov
2026-09-01 16:21 ` Siddharth Chintamaneni
2026-08-31 23:26 ` [PATCH bpf-next v2 1/2] bpf: allow " bot+bpf-ci
2026-09-01 13:51 ` Anton Protopopov
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox