Re: [PATCH bpf-next v7 1/2] bpf: Introduce jit_required flag and refactor kfunc path

[KaFai Wan <kafai.wan@linux.dev>]

On Fri, 2026-07-03 at 23:53 +0800, Tiezhu Yang wrote:
> On 7/3/26 22:14, Leon Hwang wrote:
> > On 2026/7/3 14:59, Tiezhu Yang wrote:
> > [...]
> > > > > ```
> > > > > diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> > > > > index f496b45b9da4..1f5824c1c691 100644
> > > > > --- a/kernel/bpf/verifier.c
> > > > > +++ b/kernel/bpf/verifier.c
> > > > > @@ -2772,7 +2772,7 @@ int bpf_add_kfunc_call(struct bpf_verifier_env
> > > > > *env, u32 func_id, u16 offset)
> > > > > 
> > > > >    bool bpf_prog_has_kfunc_call(const struct bpf_prog *prog)
> > > > >    {
> > > > > -       return !!prog->aux->kfunc_tab;
> > > > > +       return prog->jit_required && !!prog->aux->kfunc_tab;
> > > > 
> > > > 
> > > > When 'prog->jit_required' is used for JIT-inlineable helper call, this
> > > > change could also cause false positive for the above pruned kfunc case.
> > > > 
> > > > If you don't want bpf_fixup_call_args() rejects the program with -EINVAL
> > > > for the pruned kfunc case, suggest moving 'if (!func_id && !offset)'
> > > > before the tab allocation in bpf_add_kfunc_call().
> > > 
> > > How about this:
> > > 
> > > ```
> > > diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> > > index 25aea4271cd0..c34cc524651a 100644
> > > --- a/kernel/bpf/verifier.c
> > > +++ b/kernel/bpf/verifier.c
> > > @@ -2770,7 +2770,7 @@ int bpf_add_kfunc_call(struct bpf_verifier_env
> > > *env, u32 func_id, u16 offset)
> > > 
> > >   bool bpf_prog_has_kfunc_call(const struct bpf_prog *prog)
> > >   {
> > > -       return !!prog->aux->kfunc_tab;
> > > +       return prog->aux->kfunc_tab && prog->aux->kfunc_tab->nr_descs > 0;
> > 
> > 
> > NIT: drop '> 0'
> > 
> > Looks better.
> 
> OK, will do it in v8.
> 
> > 
> > >   }
> > > 
> > >   static int add_subprog_and_kfunc(struct bpf_verifier_env *env)
> > > ```
> > > IMO, there are no side effects for the following four cases:
> > > 
> > > 1. Pure JIT-inlined Helper
> > > 2. Pure Pruned kfunc
> > > 3. Pruned kfunc + Inlined Helper
> > > 4. Active (Unpruned) kfunc
> > > 
> > 
> > This change allows pruned kfunc + interpreter fallback and pruned kfunc
> > + bpf_fixup_call_args(), when CONFIG_BPF_JIT_ALWAYS_ON is off.
> > 
> > Does it look like a pre-existing issue?
> 
> I think so.

no, it's not. for kfunc insn, ->imm means btf_id and ->off leads to fd of btf file.
we replace ->imm to actual address and reject invalid kfunc in bpf_fixup_kfunc_call(). 

all pruned kfuncs allowed in bpf_add_kfunc_call() are rejected in bpf_fixup_kfunc_call(), before
call bpf_fixup_call_args(), no pruned kfuncs fall back to the interpreter.

I think we can set ->jit_required at the entry of bpf_add_kfunc_call() instead of end, make less
confusion of AI.

diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index d46f7db20d8f..4f7b43ab3729 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -2713,6 +2713,7 @@ int bpf_add_kfunc_call(struct bpf_verifier_env *env, u32 func_id, u16 offset)
 			return -ENOMEM;
 		prog_aux->kfunc_tab = tab;
 	}
+	env->prog->jit_required = 1;
 
 	/* func_id == 0 is always invalid, but instead of returning an error, be
 	 * conservative and wait until the code elimination pass before returning

> 
> > 
> > Pls read "Support kernel module function calls from eBPF" [1] to
> > understand the background of introducing func_id=0 kfunc.
> > 
> > [1] https://lore.kernel.org/bpf/20211002011757.311265-1-memxor@gmail.com/
> > 
> > Thanks,
> > Leon
> 
> Thanks,
> Tiezhu
> 

-- 
Thanks,
KaFai