Re: [PATCH bpf-next v5 11/16] bpf: Support stack arguments for kfunc calls

[Yonghong Song <yonghong.song@linux.dev>]

On 4/16/26 9:43 PM, bot+bpf-ci@kernel.org wrote:
>> diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
>> --- a/kernel/bpf/verifier.c
>> +++ b/kernel/bpf/verifier.c
> [ ... ]
>
>> @@ -20145,6 +20209,16 @@ int bpf_fixup_kfunc_call(struct bpf_verifier_env *env, struct bpf_insn *insn,
>>   	if (!bpf_jit_supports_far_kfunc_call())
>>   		insn->imm = BPF_CALL_IMM(desc->addr);
>>
>> +	/*
>> +	 * After resolving the kfunc address, insn->off is no longer needed
>> +	 * for BTF fd index. Repurpose it to store the number of stack args
>> +	 * so the JIT can marshal them.
>> +	 */
>> +	if (desc->func_model.nr_args > MAX_BPF_FUNC_REG_ARGS)
>> +		insn->off = desc->func_model.nr_args - MAX_BPF_FUNC_REG_ARGS;
>> +	else
>> +		insn->off = 0;
>> +
> Is insn->off really "no longer needed for BTF fd index" after this
> point? Looking at bpf_jit_find_kfunc_model() in kernel/bpf/fixups.c,
> the function is called during JIT compilation from every BPF JIT backend
> that supports kfunc calls (x86_32, s390, riscv64, ppc64, loongarch).
>
> It performs a bsearch on the kfunc_tab keyed by (insn->imm, insn->off)
> using kfunc_desc_cmp_by_imm_off:
>
> kernel/bpf/fixups.c:kfunc_desc_cmp_by_imm_off() {
>      ...
>      if (a->imm != b->imm)
>          return a->imm < b->imm ? -1 : 1;
>      if (a->offset != b->offset)
>          return a->offset < b->offset ? -1 : 1;
>      return 0;
> }
>
> The desc->offset was populated from the original insn->off during
> bpf_add_kfunc_call(), where for module kfuncs it is a non-zero BTF fd
> index.
>
> The call order is:
>
> bpf_check()
>    -> bpf_do_misc_fixups()
>       -> bpf_fixup_kfunc_call()  (overwrites insn->off to 0 or stack_arg_count)
>    -> bpf_prog_select_runtime()
>       -> bpf_int_jit_compile()
>          -> arch JIT
>             -> bpf_jit_find_kfunc_model()  (reads insn->off for bsearch key)
>
> After this patch, for a kfunc with 5 or fewer args that lives in a
> module (non-zero btf_fd_idx), insn->off is zeroed, and the bsearch will
> fail to find the entry that was stored with offset=btf_fd_idx.
>
> For kfuncs with more than 5 args, the new value of insn->off (stack arg
> count) also will not match desc->offset (btf_fd_idx or 0), so module
> kfuncs with stack args are also broken, and vmlinux kfuncs with more
> than 5 args get a nonzero insn->off that no longer matches
> desc->offset=0.
>
> Can the stack arg count be communicated to the JIT without clobbering
> the btf_fd_idx that bsearch still keys on?

The above code is dead code. Will remove.

>
>
> ---
> AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
> See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md
>
> CI run summary: https://github.com/kernel-patches/bpf/actions/runs/24546989054