[PATCH bpf-next v6] bpf: Reject programs with inlined helpers if JIT is unavailable

[PATCH bpf-next v6] bpf: Reject programs with inlined helpers if JIT is unavailable

[Tiezhu Yang]

When an architecture implements bpf_jit_inlines_helper_call(), such as
LoongArch, ARM64, PowerPC, and RISC-V, the verifier skips rewriting the
helper call offset (insn->imm) during the bpf_do_misc_fixups() phase,
because the helper is expected to be inlined by the JIT compiler. As a
result, insn->imm remains as the raw helper enum ID.

However, if JIT is disabled at runtime (net.core.bpf_jit_enable=0) or
if the JIT compilation later dynamically fails (e.g., due to OOM), the
core BPF subsystem falls back to the BPF interpreter.

When the interpreter executes (__bpf_call_base + insn->imm) with the
unpatched raw helper ID, it jumps into an unaligned invalid address
space, triggering an instruction alignment fault or a memory access
panic.

To avoid modifying the BPF interpreter's complexity for JIT-specific
paths, just introduce a 'jit_required' flag in struct bpf_prog. When
a program contains helper calls that skip rewriting for JIT inlining,
set this flag to 1. During runtime selection, if JIT compilation is
not available, explicitly reject loading with -ENOTSUPP instead of
falling back to the interpreter, safely preventing the kernel panic.

Fixes: 2ddec2c80b44 ("riscv, bpf: inline bpf_get_smp_processor_id()")
Suggested-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Tiezhu Yang <yangtiezhu@loongson.cn>
---
v6:
  - Place 'jit_required' as a standalone u8 field right before 'stats'
    to reuse the existing 4-byte struct hole (offset 52) based on pahole
    analysis, avoiding the u16->u32 bitfield conversion in v5 which 
    unintentionally changed the layout/alignment of subsequent fields.

v5:
  - Drop the fallback interpreter fixups as per maintainer's feedback.
  - Introduce 'jit_required' member in struct bpf_prog to flag programs
    that strictly rely on JIT.
  - Reject loading with -ENOTSUPP in __bpf_prog_select_runtime() if JIT
    fails or is disabled for these programs.
  - Upgrade 'jited' bitfield group type from u16 to u32 in struct bpf_prog
    to prevent 17-bit overflow warning.

 include/linux/bpf.h | 1 +
 kernel/bpf/core.c   | 2 +-
 kernel/bpf/fixups.c | 4 +++-
 3 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/include/linux/bpf.h b/include/linux/bpf.h
index ba09795e0bfd..f5c283af3cf7 100644
--- a/include/linux/bpf.h
+++ b/include/linux/bpf.h
@@ -1889,6 +1889,7 @@ struct bpf_prog {
 		u8 digest[SHA256_DIGEST_SIZE];
 		u8 tag[BPF_TAG_SIZE];
 	};
+	u8			jit_required;	/* program strictly requires JIT compiler */
 	struct bpf_prog_stats __percpu *stats;
 	u8 __percpu		*active;	/* u8[BPF_NR_CONTEXTS] for recursion protection */
 	unsigned int		(*bpf_func)(const void *ctx,
diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c
index 649cce41e13f..a55754bcc593 100644
--- a/kernel/bpf/core.c
+++ b/kernel/bpf/core.c
@@ -2639,7 +2639,7 @@ struct bpf_prog *__bpf_prog_select_runtime(struct bpf_verifier_env *env, struct
 
 		fp = bpf_prog_jit_compile(env, fp);
 		bpf_prog_jit_attempt_done(fp);
-		if (!fp->jited && jit_needed) {
+		if (!fp->jited && (jit_needed || fp->jit_required)) {
 			*err = -ENOTSUPP;
 			return fp;
 		}
diff --git a/kernel/bpf/fixups.c b/kernel/bpf/fixups.c
index 12a8a4eb757f..94e0457a0aa3 100644
--- a/kernel/bpf/fixups.c
+++ b/kernel/bpf/fixups.c
@@ -1841,8 +1841,10 @@ int bpf_do_misc_fixups(struct bpf_verifier_env *env)
 		}
 
 		/* Skip inlining the helper call if the JIT does it. */
-		if (bpf_jit_inlines_helper_call(insn->imm))
+		if (bpf_jit_inlines_helper_call(insn->imm)) {
+			prog->jit_required = 1;
 			goto next_insn;
+		}
 
 		if (insn->imm == BPF_FUNC_get_route_realm)
 			prog->dst_needed = 1;
-- 
2.42.0

Re: [PATCH bpf-next v6] bpf: Reject programs with inlined helpers if JIT is unavailable

[Alexei Starovoitov]

On Wed, Jul 1, 2026 at 10:31 PM Tiezhu Yang <yangtiezhu@loongson.cn> wrote:
>
> When an architecture implements bpf_jit_inlines_helper_call(), such as
> LoongArch, ARM64, PowerPC, and RISC-V, the verifier skips rewriting the
> helper call offset (insn->imm) during the bpf_do_misc_fixups() phase,
> because the helper is expected to be inlined by the JIT compiler. As a
> result, insn->imm remains as the raw helper enum ID.
>
> However, if JIT is disabled at runtime (net.core.bpf_jit_enable=0) or
> if the JIT compilation later dynamically fails (e.g., due to OOM), the
> core BPF subsystem falls back to the BPF interpreter.
>
> When the interpreter executes (__bpf_call_base + insn->imm) with the
> unpatched raw helper ID, it jumps into an unaligned invalid address
> space, triggering an instruction alignment fault or a memory access
> panic.
>
> To avoid modifying the BPF interpreter's complexity for JIT-specific
> paths, just introduce a 'jit_required' flag in struct bpf_prog. When
> a program contains helper calls that skip rewriting for JIT inlining,
> set this flag to 1. During runtime selection, if JIT compilation is
> not available, explicitly reject loading with -ENOTSUPP instead of
> falling back to the interpreter, safely preventing the kernel panic.
>
> Fixes: 2ddec2c80b44 ("riscv, bpf: inline bpf_get_smp_processor_id()")
> Suggested-by: Alexei Starovoitov <ast@kernel.org>
> Signed-off-by: Tiezhu Yang <yangtiezhu@loongson.cn>
> ---
> v6:
>   - Place 'jit_required' as a standalone u8 field right before 'stats'
>     to reuse the existing 4-byte struct hole (offset 52) based on pahole
>     analysis, avoiding the u16->u32 bitfield conversion in v5 which
>     unintentionally changed the layout/alignment of subsequent fields.

v5 had AI written all over it. v6 is not any better.
Please ask AI whether your v6 is any better than v5 ?
Then analyze replies as a human.

pw-bot: cr

Re: [PATCH bpf-next v6] bpf: Reject programs with inlined helpers if JIT is unavailable

[Tiezhu Yang]

On 2026/7/2 下午1:45, Alexei Starovoitov wrote:
> On Wed, Jul 1, 2026 at 10:31 PM Tiezhu Yang <yangtiezhu@loongson.cn> wrote:
>>
>> When an architecture implements bpf_jit_inlines_helper_call(), such as
>> LoongArch, ARM64, PowerPC, and RISC-V, the verifier skips rewriting the
>> helper call offset (insn->imm) during the bpf_do_misc_fixups() phase,
>> because the helper is expected to be inlined by the JIT compiler. As a
>> result, insn->imm remains as the raw helper enum ID.
>>
>> However, if JIT is disabled at runtime (net.core.bpf_jit_enable=0) or
>> if the JIT compilation later dynamically fails (e.g., due to OOM), the
>> core BPF subsystem falls back to the BPF interpreter.
>>
>> When the interpreter executes (__bpf_call_base + insn->imm) with the
>> unpatched raw helper ID, it jumps into an unaligned invalid address
>> space, triggering an instruction alignment fault or a memory access
>> panic.
>>
>> To avoid modifying the BPF interpreter's complexity for JIT-specific
>> paths, just introduce a 'jit_required' flag in struct bpf_prog. When
>> a program contains helper calls that skip rewriting for JIT inlining,
>> set this flag to 1. During runtime selection, if JIT compilation is
>> not available, explicitly reject loading with -ENOTSUPP instead of
>> falling back to the interpreter, safely preventing the kernel panic.
>>
>> Fixes: 2ddec2c80b44 ("riscv, bpf: inline bpf_get_smp_processor_id()")
>> Suggested-by: Alexei Starovoitov <ast@kernel.org>
>> Signed-off-by: Tiezhu Yang <yangtiezhu@loongson.cn>
>> ---
>> v6:
>>    - Place 'jit_required' as a standalone u8 field right before 'stats'
>>      to reuse the existing 4-byte struct hole (offset 52) based on pahole
>>      analysis, avoiding the u16->u32 bitfield conversion in v5 which
>>      unintentionally changed the layout/alignment of subsequent fields.
> 
> v5 had AI written all over it. v6 is not any better.
> Please ask AI whether your v6 is any better than v5 ?
> Then analyze replies as a human.

Hi Alexei,

Sorry for the AI text. I used it to translate my replies.

- v5 code: Placed jit_required under u16 group, but u32 broke layout.
- v6 code: Moved it to offset 52 hole to fix the alignment.

Here is the local test log for v6 when JIT is disabled:

fedora@linux:~$ cat test_panic.c
   #include <linux/bpf.h>
   #include <bpf/bpf_helpers.h>

   SEC("kprobe/sys_getpid")
   int test_panic(void *ctx)
   {
   	struct task_struct *task;

   	task = (struct task_struct *)bpf_get_current_task();
   	if (task)
   		bpf_printk("Task address: %p\n", task);

   	return 0;
   }

   char LICENSE[] SEC("license") = "GPL";
fedora@linux:~$ clang -target bpf -O2 -g -c test_panic.c -o test_panic.o
fedora@linux:~$ sudo sysctl -w net.core.bpf_jit_enable=0
net.core.bpf_jit_enable = 0
fedora@linux:~$ sudo bpftool prog load test_panic.o 
/sys/fs/bpf/test_panic autoattach
libbpf: prog 'test_panic': BPF program load failed: unknown error (-524)
libbpf: prog 'test_panic': -- BEGIN PROG LOAD LOG --
processed 10 insns (limit 1000000) max_states_per_insn 0 total_states 1 
peak_states 1 mark_read 0
-- END PROG LOAD LOG --
libbpf: prog 'test_panic': failed to load: -524
libbpf: failed to load object 'test_panic.o'
Error: failed to load object file

It correctly rejects loading with -ENOTSUPP (-524) and prevents the panic.

Thanks,
Tiezhu

Re: [PATCH bpf-next v6] bpf: Reject programs with inlined helpers if JIT is unavailable

[Tiezhu Yang]

On 2026/7/2 下午1:45, Alexei Starovoitov wrote:
> On Wed, Jul 1, 2026 at 10:31 PM Tiezhu Yang <yangtiezhu@loongson.cn> wrote:
>>
>> When an architecture implements bpf_jit_inlines_helper_call(), such as
>> LoongArch, ARM64, PowerPC, and RISC-V, the verifier skips rewriting the
>> helper call offset (insn->imm) during the bpf_do_misc_fixups() phase,
>> because the helper is expected to be inlined by the JIT compiler. As a
>> result, insn->imm remains as the raw helper enum ID.
>>
>> However, if JIT is disabled at runtime (net.core.bpf_jit_enable=0) or
>> if the JIT compilation later dynamically fails (e.g., due to OOM), the
>> core BPF subsystem falls back to the BPF interpreter.
>>
>> When the interpreter executes (__bpf_call_base + insn->imm) with the
>> unpatched raw helper ID, it jumps into an unaligned invalid address
>> space, triggering an instruction alignment fault or a memory access
>> panic.
>>
>> To avoid modifying the BPF interpreter's complexity for JIT-specific
>> paths, just introduce a 'jit_required' flag in struct bpf_prog. When
>> a program contains helper calls that skip rewriting for JIT inlining,
>> set this flag to 1. During runtime selection, if JIT compilation is
>> not available, explicitly reject loading with -ENOTSUPP instead of
>> falling back to the interpreter, safely preventing the kernel panic.
>>
>> Fixes: 2ddec2c80b44 ("riscv, bpf: inline bpf_get_smp_processor_id()")
>> Suggested-by: Alexei Starovoitov <ast@kernel.org>
>> Signed-off-by: Tiezhu Yang <yangtiezhu@loongson.cn>
>> ---
>> v6:
>>    - Place 'jit_required' as a standalone u8 field right before 'stats'
>>      to reuse the existing 4-byte struct hole (offset 52) based on pahole
>>      analysis, avoiding the u16->u32 bitfield conversion in v5 which
>>      unintentionally changed the layout/alignment of subsequent fields.
> 
> v5 had AI written all over it. v6 is not any better.
> Please ask AI whether your v6 is any better than v5 ?
> Then analyze replies as a human.

The v6 code is a significant layout improvement over v5.

v5 broke natural 4-byte alignment, while v6 rolls back the bitfield
and utilizes a 4-byte hole at offset 52 for 'jit_required'.

Here is the partial pahole output for v6:

struct bpf_prog {
     ...
	u8                         jit_required;         /*    52     1 */
	/* XXX 3 bytes hole, try to pack */
     ...
	/* size: 96, cachelines: 2, members: 29 */
};

The layout preserves 16-bit packing, alignment, and 96-byte size.

Here is the full pahole output for v6:

fedora@linux:~/702jit.git$ pahole -C bpf_prog ./vmlinux
struct bpf_prog {
	u16                        pages;                /*     0     2 */
	u16                        jited:1;              /*     2: 0  2 */
	u16                        jit_requested:1;      /*     2: 1  2 */
	u16                        gpl_compatible:1;     /*     2: 2  2 */
	u16                        cb_access:1;          /*     2: 3  2 */
	u16                        dst_needed:1;         /*     2: 4  2 */
	u16                        blinding_requested:1; /*     2: 5  2 */
	u16                        blinded:1;            /*     2: 6  2 */
	u16                        is_func:1;            /*     2: 7  2 */
	u16                        kprobe_override:1;    /*     2: 8  2 */
	u16                        has_callchain_buf:1;  /*     2: 9  2 */
	u16                        enforce_expected_attach_type:1; /*     2:10 
2 */
	u16                        call_get_stack:1;     /*     2:11  2 */
	u16                        call_get_func_ip:1;   /*     2:12  2 */
	u16                        call_session_cookie:1; /*     2:13  2 */
	u16                        tstamp_type_access:1; /*     2:14  2 */
	u16                        sleepable:1;          /*     2:15  2 */
	enum bpf_prog_type         type;                 /*     4     4 */
	enum bpf_attach_type       expected_attach_type; /*     8     4 */
	u32                        len;                  /*    12     4 */
	u32                        jited_len;            /*    16     4 */
	union {
		u8                 digest[32];           /*    20    32 */
		u8                 tag[8];               /*    20     8 */
	};                                               /*    20    32 */
	u8                         jit_required;         /*    52     1 */

	/* XXX 3 bytes hole, try to pack */

	struct bpf_prog_stats *    stats;                /*    56     8 */
	/* --- cacheline 1 boundary (64 bytes) --- */
	u8 *                       active;               /*    64     8 */
	unsigned int               (*bpf_func)(const void  *, const struct 
bpf_insn  *); /*    72     8 */
	struct bpf_prog_aux *      aux;                  /*    80     8 */
	struct sock_fprog_kern *   orig_prog;            /*    88     8 */
	union {
		struct {
			struct {
			} __empty_insns;                 /*    96     0 */
			struct sock_filter insns[0];     /*    96     0 */
		};                                       /*    96     0 */
		struct {
			struct {
			} __empty_insnsi;                /*    96     0 */
			struct bpf_insn insnsi[0];       /*    96     0 */
		};                                       /*    96     0 */
	};                                               /*    96     0 */

	/* size: 96, cachelines: 2, members: 29 */
	/* sum members: 91, holes: 1, sum holes: 3 */
	/* sum bitfield members: 16 bits (2 bytes) */
	/* last cacheline: 32 bytes */
};

Thanks,
Tiezhu

Re: [PATCH bpf-next v6] bpf: Reject programs with inlined helpers if JIT is unavailable

[bot+bpf-ci]

[-- Attachment #1: Type: text/plain, Size: 2157 bytes --]

> diff --git a/include/linux/bpf.h b/include/linux/bpf.h
> index ba09795e0bfd..f5c283af3cf7 100644
> --- a/include/linux/bpf.h
> +++ b/include/linux/bpf.h
> @@ -1889,6 +1889,7 @@ struct bpf_prog {
>  		u8 digest[SHA256_DIGEST_SIZE];
>  		u8 tag[BPF_TAG_SIZE];
>  	};
> +	u8			jit_required;	/* program strictly requires JIT compiler */
>  	struct bpf_prog_stats __percpu *stats;
>  	u8 __percpu		*active;	/* u8[BPF_NR_CONTEXTS] for recursion protection */
>  	unsigned int		(*bpf_func)(const void *ctx,

The placement and overall design of this jit_required field does not look
settled yet in the upstream discussion.

Changes were requested on this version, with the note that it is not an
improvement over the previous version, so is the standalone u8 field here
the approach that has been agreed on?

  https://lore.kernel.org/bpf/CAADnVQJodzDppDUjSYXra-jCo3J32t7=h32bHm4tQei-+5P72w@mail.gmail.com/

> diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c
> index 649cce41e13f..a55754bcc593 100644
> --- a/kernel/bpf/core.c
> +++ b/kernel/bpf/core.c
> @@ -2639,7 +2639,7 @@ struct bpf_prog *__bpf_prog_select_runtime(struct bpf_verifier_env *env, struct
>
>  		fp = bpf_prog_jit_compile(env, fp);
>  		bpf_prog_jit_attempt_done(fp);
> -		if (!fp->jited && jit_needed) {
> +		if (!fp->jited && (jit_needed || fp->jit_required)) {
>  			*err = -ENOTSUPP;
>  			return fp;
>  		}
> diff --git a/kernel/bpf/fixups.c b/kernel/bpf/fixups.c
> index 12a8a4eb757f..94e0457a0aa3 100644
> --- a/kernel/bpf/fixups.c
> +++ b/kernel/bpf/fixups.c
> @@ -1841,8 +1841,10 @@ int bpf_do_misc_fixups(struct bpf_verifier_env *env)
>  		}
>
>  		/* Skip inlining the helper call if the JIT does it. */
> -		if (bpf_jit_inlines_helper_call(insn->imm))
> +		if (bpf_jit_inlines_helper_call(insn->imm)) {
> +			prog->jit_required = 1;
>  			goto next_insn;
> +		}
>
>  		if (insn->imm == BPF_FUNC_get_route_realm)
>  			prog->dst_needed = 1;


---
AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md

CI run summary: https://github.com/kernel-patches/bpf/actions/runs/28568041313

Re: [PATCH bpf-next v6] bpf: Reject programs with inlined helpers if JIT is unavailable

[KaFai Wan]

On Thu, 2026-07-02 at 13:31 +0800, Tiezhu Yang wrote:
> When an architecture implements bpf_jit_inlines_helper_call(), such as
> LoongArch, ARM64, PowerPC, and RISC-V, the verifier skips rewriting the
> helper call offset (insn->imm) during the bpf_do_misc_fixups() phase,
> because the helper is expected to be inlined by the JIT compiler. As a
> result, insn->imm remains as the raw helper enum ID.
> 
> However, if JIT is disabled at runtime (net.core.bpf_jit_enable=0) or
> if the JIT compilation later dynamically fails (e.g., due to OOM), the
> core BPF subsystem falls back to the BPF interpreter.
> 
> When the interpreter executes (__bpf_call_base + insn->imm) with the
> unpatched raw helper ID, it jumps into an unaligned invalid address
> space, triggering an instruction alignment fault or a memory access
> panic.
> 
> To avoid modifying the BPF interpreter's complexity for JIT-specific
> paths, just introduce a 'jit_required' flag in struct bpf_prog. When
> a program contains helper calls that skip rewriting for JIT inlining,
> set this flag to 1. During runtime selection, if JIT compilation is
> not available, explicitly reject loading with -ENOTSUPP instead of
> falling back to the interpreter, safely preventing the kernel panic.
> 
> Fixes: 2ddec2c80b44 ("riscv, bpf: inline bpf_get_smp_processor_id()")
> Suggested-by: Alexei Starovoitov <ast@kernel.org>
> Signed-off-by: Tiezhu Yang <yangtiezhu@loongson.cn>
> ---
> v6:
>   - Place 'jit_required' as a standalone u8 field right before 'stats'
>     to reuse the existing 4-byte struct hole (offset 52) based on pahole
>     analysis, avoiding the u16->u32 bitfield conversion in v5 which 
>     unintentionally changed the layout/alignment of subsequent fields.
> 
> v5:
>   - Drop the fallback interpreter fixups as per maintainer's feedback.
>   - Introduce 'jit_required' member in struct bpf_prog to flag programs
>     that strictly rely on JIT.
>   - Reject loading with -ENOTSUPP in __bpf_prog_select_runtime() if JIT
>     fails or is disabled for these programs.
>   - Upgrade 'jited' bitfield group type from u16 to u32 in struct bpf_prog
>     to prevent 17-bit overflow warning.
> 
>  include/linux/bpf.h | 1 +
>  kernel/bpf/core.c   | 2 +-
>  kernel/bpf/fixups.c | 4 +++-
>  3 files changed, 5 insertions(+), 2 deletions(-)
> 
> diff --git a/include/linux/bpf.h b/include/linux/bpf.h
> index ba09795e0bfd..f5c283af3cf7 100644
> --- a/include/linux/bpf.h
> +++ b/include/linux/bpf.h
> @@ -1889,6 +1889,7 @@ struct bpf_prog {
>  		u8 digest[SHA256_DIGEST_SIZE];
>  		u8 tag[BPF_TAG_SIZE];
>  	};
> +	u8			jit_required;	/* program strictly requires JIT compiler */

maybe 1 bit is enough. I'm not sure the layout matters, if not we can put behind sleepable:1.

>  	struct bpf_prog_stats __percpu *stats;
>  	u8 __percpu		*active;	/* u8[BPF_NR_CONTEXTS] for recursion protection
> */
>  	unsigned int		(*bpf_func)(const void *ctx,
> diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c
> index 649cce41e13f..a55754bcc593 100644
> --- a/kernel/bpf/core.c
> +++ b/kernel/bpf/core.c
> @@ -2639,7 +2639,7 @@ struct bpf_prog *__bpf_prog_select_runtime(struct bpf_verifier_env *env,
> struct
>  
>  		fp = bpf_prog_jit_compile(env, fp);
>  		bpf_prog_jit_attempt_done(fp);
> -		if (!fp->jited && jit_needed) {
> +		if (!fp->jited && (jit_needed || fp->jit_required)) {

You ignore Alexei's feedback. Should be  

--- a/kernel/bpf/core.c
+++ b/kernel/bpf/core.c
@@ -2619,8 +2619,7 @@ struct bpf_prog *__bpf_prog_select_runtime(struct bpf_verifier_env *env,
struct
 	if (fp->bpf_func)
 		goto finalize;
 
-	if (IS_ENABLED(CONFIG_BPF_JIT_ALWAYS_ON) ||
-	    bpf_prog_has_kfunc_call(fp))
+	if (IS_ENABLED(CONFIG_BPF_JIT_ALWAYS_ON) || fp->jit_required)
 		jit_needed = true;

so we can set fp->jit_required when need, without change the rest.

diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 25aea4271cd0..3b2fb0163db7 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -2712,6 +2712,7 @@ int bpf_add_kfunc_call(struct bpf_verifier_env *env, u32 func_id, u16 offset)
 		if (!tab)
 			return -ENOMEM;
 		prog_aux->kfunc_tab = tab;
+		env->prog->jit_required = true;
 	}

So the patch#1 is a refactor, some sort of this, I'm not sure it's right.

>  			*err = -ENOTSUPP;
>  			return fp;
>  		}
> diff --git a/kernel/bpf/fixups.c b/kernel/bpf/fixups.c
> index 12a8a4eb757f..94e0457a0aa3 100644
> --- a/kernel/bpf/fixups.c
> +++ b/kernel/bpf/fixups.c
> @@ -1841,8 +1841,10 @@ int bpf_do_misc_fixups(struct bpf_verifier_env *env)
>  		}
>  
>  		/* Skip inlining the helper call if the JIT does it. */
> -		if (bpf_jit_inlines_helper_call(insn->imm))
> +		if (bpf_jit_inlines_helper_call(insn->imm)) {
> +			prog->jit_required = 1;

This's the patch#2.

>  			goto next_insn;
> +		}
>  
>  		if (insn->imm == BPF_FUNC_get_route_realm)
>  			prog->dst_needed = 1;

and the rest.

-- 
Thanks,
KaFai

Re: [PATCH bpf-next v6] bpf: Reject programs with inlined helpers if JIT is unavailable

[Tiezhu Yang]

On 2026/7/2 下午8:16, KaFai Wan wrote:
> On Thu, 2026-07-02 at 13:31 +0800, Tiezhu Yang wrote:
>> When an architecture implements bpf_jit_inlines_helper_call(), such as
>> LoongArch, ARM64, PowerPC, and RISC-V, the verifier skips rewriting the
>> helper call offset (insn->imm) during the bpf_do_misc_fixups() phase,
>> because the helper is expected to be inlined by the JIT compiler. As a
>> result, insn->imm remains as the raw helper enum ID.

...

>> diff --git a/include/linux/bpf.h b/include/linux/bpf.h
>> index ba09795e0bfd..f5c283af3cf7 100644
>> --- a/include/linux/bpf.h
>> +++ b/include/linux/bpf.h
>> @@ -1889,6 +1889,7 @@ struct bpf_prog {
>>   		u8 digest[SHA256_DIGEST_SIZE];
>>   		u8 tag[BPF_TAG_SIZE];
>>   	};
>> +	u8			jit_required;	/* program strictly requires JIT compiler */
> 
> maybe 1 bit is enough. I'm not sure the layout matters, if not we can put behind sleepable:1.

Hi KaFai,

Thanks for the guidance.

I have placed jit_required:1 right behind sleepable:1
to keep the layout clean, and refactored the kfunc path.

I have just sent out the formal v7 patch series with
Suggested-by tags.

Here is the full pahole output for v7:

```
fedora@linux:~/703jit.git$ pahole -C bpf_prog ./vmlinux
struct bpf_prog {
	u16                        pages;                /*     0     2 */
	u16                        jited:1;              /*     2: 0  2 */
	u16                        jit_requested:1;      /*     2: 1  2 */
	u16                        gpl_compatible:1;     /*     2: 2  2 */
	u16                        cb_access:1;          /*     2: 3  2 */
	u16                        dst_needed:1;         /*     2: 4  2 */
	u16                        blinding_requested:1; /*     2: 5  2 */
	u16                        blinded:1;            /*     2: 6  2 */
	u16                        is_func:1;            /*     2: 7  2 */
	u16                        kprobe_override:1;    /*     2: 8  2 */
	u16                        has_callchain_buf:1;  /*     2: 9  2 */
	u16                        enforce_expected_attach_type:1; /*     2:10 
2 */
	u16                        call_get_stack:1;     /*     2:11  2 */
	u16                        call_get_func_ip:1;   /*     2:12  2 */
	u16                        call_session_cookie:1; /*     2:13  2 */
	u16                        tstamp_type_access:1; /*     2:14  2 */
	u16                        sleepable:1;          /*     2:15  2 */
	u16                        jit_required:1;       /*     4: 0  2 */

	/* XXX 15 bits hole, try to pack */
	/* XXX 2 bytes hole, try to pack */

	enum bpf_prog_type         type;                 /*     8     4 */
	enum bpf_attach_type       expected_attach_type; /*    12     4 */
	u32                        len;                  /*    16     4 */
	u32                        jited_len;            /*    20     4 */
	union {
		u8                 digest[32];           /*    24    32 */
		u8                 tag[8];               /*    24     8 */
	};                                               /*    24    32 */
	struct bpf_prog_stats *    stats;                /*    56     8 */
	/* --- cacheline 1 boundary (64 bytes) --- */
	u8 *                       active;               /*    64     8 */
	unsigned int               (*bpf_func)(const void  *, const struct 
bpf_insn  *); /*    72     8 */
	struct bpf_prog_aux *      aux;                  /*    80     8 */
	struct sock_fprog_kern *   orig_prog;            /*    88     8 */
	union {
		struct {
			struct {
			} __empty_insns;                 /*    96     0 */
			struct sock_filter insns[0];     /*    96     0 */
		};                                       /*    96     0 */
		struct {
			struct {
			} __empty_insnsi;                /*    96     0 */
			struct bpf_insn insnsi[0];       /*    96     0 */
		};                                       /*    96     0 */
	};                                               /*    96     0 */

	/* size: 96, cachelines: 2, members: 29 */
	/* sum members: 90, holes: 1, sum holes: 2 */
	/* sum bitfield members: 17 bits, bit holes: 1, sum bit holes: 15 bits */
	/* last cacheline: 32 bytes */
};
```

Here is the local test log for v7 when JIT is disabled,
it correctly rejects loading with -ENOTSUPP (-524) and
prevents the panic.

```
fedora@linux:~$ cat test_panic.c
   #include <linux/bpf.h>
   #include <bpf/bpf_helpers.h>

   SEC("kprobe/sys_getpid")
   int test_panic(void *ctx)
   {
   	struct task_struct *task;

   	task = (struct task_struct *)bpf_get_current_task();
   	if (task)
   		bpf_printk("Task address: %p\n", task);

   	return 0;
   }

   char LICENSE[] SEC("license") = "GPL";
fedora@linux:~$ clang -target bpf -O2 -g -c test_panic.c -o test_panic.o
fedora@linux:~$ sudo sysctl -w net.core.bpf_jit_enable=0
[sudo] password for fedora:
net.core.bpf_jit_enable = 0
fedora@linux:~$ sudo bpftool prog load test_panic.o 
/sys/fs/bpf/test_panic autoattach
libbpf: prog 'test_panic': BPF program load failed: unknown error (-524)
libbpf: prog 'test_panic': -- BEGIN PROG LOAD LOG --
processed 10 insns (limit 1000000) max_states_per_insn 0 total_states 1 
peak_states 1 mark_read 0
-- END PROG LOAD LOG --
libbpf: prog 'test_panic': failed to load: -524
libbpf: failed to load object 'test_panic.o'
Error: failed to load object file
```

Thanks,
Tiezhu