Re: [PATCH bpf-next v1 06/14] resolve_btfids: Discover kfuncs from BTF ID sets

[Ihor Solodrai <ihor.solodrai@linux.dev>]

On 6/2/26 1:36 PM, Jiri Olsa wrote:
> On Mon, Jun 01, 2026 at 03:17:57PM -0700, Ihor Solodrai wrote:
>> collect_kfuncs() currently uses bpf_kfunc decl tags to identify the
>> list of kfuncs. The decl tags are generated by pahole, which makes
>> current implementation implicitly rely on those tags being generated.
>>
>> The authoritative source, used by the the BPF verifier for kfunc
>> registration, of functions being BPF kfuncs are
>> BTF_KFUNCS_START()/END() declarations. These are BTF_ID_SET8 under the
>> hood. Currently resolve_btfids reads kfunc flags from these sets, and
>> populates them with BTF IDs.
>>
>> Implement kfunc discovery from BTF_ID_SET8 symbols in resolve_btfids,
>> removing the dependency on pahole's emmission of decl tags.
>>
>> Walk BTF_ID_KIND_SET8 sets, and use the address-to-symbol index to
>> look up set entry's BTF_ID symbol name (before .BTF_ids is patched),
>> recording the paired flags directly. This makes find_kfunc_flags()
>> helper unnecessary, so it's removed.
>>
>> Kernel functions can appear in more than one set, which is legitimate,
>> since kfunc sets are prog-type dependent in the kernel. So for btf2btf
>> processing deduplicate kfuncs by BTF ID, accumulate (OR) the flags,
>> and warn on flags mismatch to catch inconsistent declarations.
>>
>> Signed-off-by: Ihor Solodrai <ihor.solodrai@linux.dev>
>> ---
>>  tools/bpf/resolve_btfids/main.c | 122 ++++++++++++++------------------
>>  1 file changed, 55 insertions(+), 67 deletions(-)
>>
>> diff --git a/tools/bpf/resolve_btfids/main.c b/tools/bpf/resolve_btfids/main.c
>> index 43512af13148..d35a7b2460e8 100644
>> --- a/tools/bpf/resolve_btfids/main.c
>> +++ b/tools/bpf/resolve_btfids/main.c
>> @@ -970,6 +970,23 @@ static int push_kfunc(struct btf2btf_context *ctx, struct kfunc *kfunc)
>>  	struct kfunc *arr = ctx->kfuncs;
>>  	u32 cap = ctx->max_kfuncs;
>>  
>> +	/*
>> +	 * A kfunc can be listed in multiple BTF ID sets.
>> +	 * In this case, dedup by btf_id and accumulate kfunc flags.
>> +	 */
>> +	for (u32 i = 0; i < ctx->nr_kfuncs; i++) {
>> +		if (ctx->kfuncs[i].btf_id != kfunc->btf_id)
>> +			continue;
>> +
>> +		if (ctx->kfuncs[i].flags != kfunc->flags) {
>> +			pr_err("WARN: resolve_btfids: inconsistent flags for kfunc %s: 0x%x != 0x%x\n",
>> +			       kfunc->name, ctx->kfuncs[i].flags, kfunc->flags);
>> +			warnings++;
>> +		}
> 
> hit few of those
> 
> WARN: resolve_btfids: inconsistent flags for kfunc hid_bpf_allocate_context: 0x5 != 0x25
> WARN: resolve_btfids: inconsistent flags for kfunc hid_bpf_release_context: 0x2 != 0x22
> WARN: resolve_btfids: inconsistent flags for kfunc hid_bpf_hw_request: 0x0 != 0x20
> WARN: resolve_btfids: inconsistent flags for kfunc hid_bpf_hw_output_report: 0x0 != 0x20
> WARN: resolve_btfids: inconsistent flags for kfunc hid_bpf_input_report: 0x0 != 0x20
> 
> I'd think flags like KF_SLEEPABLE might vary in different sets for the same kfunc,
> IIUC you don't need to use KF_SLEEPABLE for syscall hook, because syscall programs
> are already sleepable.. not sure there are other examples

That's a good point.

I think from the PoV of resolve_btfids what matters is the mismatch of
flags that trigger BTF changes, like KF_IMPLICIT_ARGS. We could check for
the specific flags here, or filter out acceptable inconsistencies (KF_SLEEPABLE).

Any other ideas?

> 
> jirka