[PATCH bpf-next v7 0/2] Introduce jit_required to prevent a kernel panic

[PATCH bpf-next v7 0/2] Introduce jit_required to prevent a kernel panic

[Tiezhu Yang]

This series introduces a 'jit_required' flag in struct bpf_prog
to track programs that strictly require JIT.

The aim is to reject loading programs with inlined helpers when
JIT is unavailable to prevent a kernel panic.

Tiezhu Yang (2):
  bpf: Introduce jit_required flag and refactor kfunc path
  bpf: Reject programs with inlined helpers if JIT is unavailable

 include/linux/bpf.h   | 3 ++-
 kernel/bpf/core.c     | 3 +--
 kernel/bpf/fixups.c   | 4 +++-
 kernel/bpf/verifier.c | 2 ++
 4 files changed, 8 insertions(+), 4 deletions(-)

-- 
2.42.0

[PATCH bpf-next v7 1/2] bpf: Introduce jit_required flag and refactor kfunc path

[Tiezhu Yang]

Introduce a 'jit_required' bitfield flag at the end of the
flags group in struct bpf_prog. This bit tracks whether a
program strictly requires the JIT compiler.

Set this flag to 1 when a kfunc call is added at the end of
bpf_add_kfunc_call().

In __bpf_prog_select_runtime(), check with fp->jit_required
rather than bpf_prog_has_kfunc_call() to unify the logic.

Suggested-by: Alexei Starovoitov <ast@kernel.org>
Suggested-by: KaFai Wan <kafai.wan@linux.dev>
Signed-off-by: Tiezhu Yang <yangtiezhu@loongson.cn>
---
 include/linux/bpf.h   | 3 ++-
 kernel/bpf/core.c     | 3 +--
 kernel/bpf/verifier.c | 2 ++
 3 files changed, 5 insertions(+), 3 deletions(-)

diff --git a/include/linux/bpf.h b/include/linux/bpf.h
index ba09795e0bfd..4e2b059d71f3 100644
--- a/include/linux/bpf.h
+++ b/include/linux/bpf.h
@@ -1880,7 +1880,8 @@ struct bpf_prog {
 				call_get_func_ip:1, /* Do we call get_func_ip() */
 				call_session_cookie:1, /* Do we call bpf_session_cookie() */
 				tstamp_type_access:1, /* Accessed __sk_buff->tstamp_type */
-				sleepable:1;	/* BPF program is sleepable */
+				sleepable:1,	/* BPF program is sleepable */
+				jit_required:1;	/* program strictly requires JIT compiler */
 	enum bpf_prog_type	type;		/* Type of BPF program */
 	enum bpf_attach_type	expected_attach_type; /* For some prog types */
 	u32			len;		/* Number of filter blocks */
diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c
index 649cce41e13f..5fcd19ccb41a 100644
--- a/kernel/bpf/core.c
+++ b/kernel/bpf/core.c
@@ -2619,8 +2619,7 @@ struct bpf_prog *__bpf_prog_select_runtime(struct bpf_verifier_env *env, struct
 	if (fp->bpf_func)
 		goto finalize;
 
-	if (IS_ENABLED(CONFIG_BPF_JIT_ALWAYS_ON) ||
-	    bpf_prog_has_kfunc_call(fp))
+	if (IS_ENABLED(CONFIG_BPF_JIT_ALWAYS_ON) || fp->jit_required)
 		jit_needed = true;
 
 	if (!bpf_prog_select_interpreter(fp))
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 25aea4271cd0..f496b45b9da4 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -2765,6 +2765,8 @@ int bpf_add_kfunc_call(struct bpf_verifier_env *env, u32 func_id, u16 offset)
 	desc->func_model = func_model;
 	sort(tab->descs, tab->nr_descs, sizeof(tab->descs[0]),
 	     kfunc_desc_cmp_by_id_off, NULL);
+
+	env->prog->jit_required = 1;
 	return 0;
 }
 
-- 
2.42.0

Re: [PATCH bpf-next v7 1/2] bpf: Introduce jit_required flag and refactor kfunc path

[KaFai Wan]

On Thu, 2026-07-02 at 22:36 +0800, Tiezhu Yang wrote:
> Introduce a 'jit_required' bitfield flag at the end of the
> flags group in struct bpf_prog. This bit tracks whether a
> program strictly requires the JIT compiler.
> 
> Set this flag to 1 when a kfunc call is added at the end of
> bpf_add_kfunc_call().
> 
> In __bpf_prog_select_runtime(), check with fp->jit_required
> rather than bpf_prog_has_kfunc_call() to unify the logic.
> 
> Suggested-by: Alexei Starovoitov <ast@kernel.org>
> Suggested-by: KaFai Wan <kafai.wan@linux.dev>
> Signed-off-by: Tiezhu Yang <yangtiezhu@loongson.cn>
> ---
>  include/linux/bpf.h   | 3 ++-
>  kernel/bpf/core.c     | 3 +--
>  kernel/bpf/verifier.c | 2 ++
>  3 files changed, 5 insertions(+), 3 deletions(-)
> 
> diff --git a/include/linux/bpf.h b/include/linux/bpf.h
> index ba09795e0bfd..4e2b059d71f3 100644
> --- a/include/linux/bpf.h
> +++ b/include/linux/bpf.h
> @@ -1880,7 +1880,8 @@ struct bpf_prog {
>  				call_get_func_ip:1, /* Do we call get_func_ip() */
>  				call_session_cookie:1, /* Do we call bpf_session_cookie() */
>  				tstamp_type_access:1, /* Accessed __sk_buff->tstamp_type */
> -				sleepable:1;	/* BPF program is sleepable */
> +				sleepable:1,	/* BPF program is sleepable */
> +				jit_required:1;	/* program strictly requires JIT compiler
> */

In v6 you're using 'u8 jit_required', I thought it would be 'u8 jit_required:1', so we use one byte
and left 3 byte hole for future use.

This version left 2 bytes hole, same as v5, but it can easily be misleading because of the u16 type,
since we used 17 bits. I prefer v5, it has better readability.

>  	enum bpf_prog_type	type;		/* Type of BPF program */
>  	enum bpf_attach_type	expected_attach_type; /* For some prog types */
>  	u32			len;		/* Number of filter blocks */
> diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c
> index 649cce41e13f..5fcd19ccb41a 100644
> --- a/kernel/bpf/core.c
> +++ b/kernel/bpf/core.c
> @@ -2619,8 +2619,7 @@ struct bpf_prog *__bpf_prog_select_runtime(struct bpf_verifier_env *env,
> struct
>  	if (fp->bpf_func)
>  		goto finalize;
>  
> -	if (IS_ENABLED(CONFIG_BPF_JIT_ALWAYS_ON) ||
> -	    bpf_prog_has_kfunc_call(fp))
> +	if (IS_ENABLED(CONFIG_BPF_JIT_ALWAYS_ON) || fp->jit_required)
>  		jit_needed = true;
>  
>  	if (!bpf_prog_select_interpreter(fp))
> diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> index 25aea4271cd0..f496b45b9da4 100644
> --- a/kernel/bpf/verifier.c
> +++ b/kernel/bpf/verifier.c
> @@ -2765,6 +2765,8 @@ int bpf_add_kfunc_call(struct bpf_verifier_env *env, u32 func_id, u16
> offset)
>  	desc->func_model = func_model;
>  	sort(tab->descs, tab->nr_descs, sizeof(tab->descs[0]),
>  	     kfunc_desc_cmp_by_id_off, NULL);
> +
> +	env->prog->jit_required = 1;

That's ok, and I think Sashiko is right about this patch.

>  	return 0;
>  }
>  

-- 
Thanks,
KaFai

Re: [PATCH bpf-next v7 1/2] bpf: Introduce jit_required flag and refactor kfunc path

[Tiezhu Yang]

On 7/3/26 21:55, KaFai Wan wrote:
> On Thu, 2026-07-02 at 22:36 +0800, Tiezhu Yang wrote:
>> Introduce a 'jit_required' bitfield flag at the end of the
>> flags group in struct bpf_prog. This bit tracks whether a
>> program strictly requires the JIT compiler.
>>
>> Set this flag to 1 when a kfunc call is added at the end of
>> bpf_add_kfunc_call().
>>
>> In __bpf_prog_select_runtime(), check with fp->jit_required
>> rather than bpf_prog_has_kfunc_call() to unify the logic.
>>
>> Suggested-by: Alexei Starovoitov <ast@kernel.org>
>> Suggested-by: KaFai Wan <kafai.wan@linux.dev>
>> Signed-off-by: Tiezhu Yang <yangtiezhu@loongson.cn>
>> ---
>>   include/linux/bpf.h   | 3 ++-
>>   kernel/bpf/core.c     | 3 +--
>>   kernel/bpf/verifier.c | 2 ++
>>   3 files changed, 5 insertions(+), 3 deletions(-)
>>
>> diff --git a/include/linux/bpf.h b/include/linux/bpf.h
>> index ba09795e0bfd..4e2b059d71f3 100644
>> --- a/include/linux/bpf.h
>> +++ b/include/linux/bpf.h
>> @@ -1880,7 +1880,8 @@ struct bpf_prog {
>>   				call_get_func_ip:1, /* Do we call get_func_ip() */
>>   				call_session_cookie:1, /* Do we call bpf_session_cookie() */
>>   				tstamp_type_access:1, /* Accessed __sk_buff->tstamp_type */
>> -				sleepable:1;	/* BPF program is sleepable */
>> +				sleepable:1,	/* BPF program is sleepable */
>> +				jit_required:1;	/* program strictly requires JIT compiler
>> */
> 
> In v6 you're using 'u8 jit_required', I thought it would be 'u8 jit_required:1', so we use one byte
> and left 3 byte hole for future use.
> 
> This version left 2 bytes hole, same as v5, but it can easily be misleading because of the u16 type,
> since we used 17 bits. I prefer v5, it has better readability.

OK, I will use the previous layout in v8, like this:

```
diff --git a/include/linux/bpf.h b/include/linux/bpf.h
index ba09795e0bfd..463fae6a5c33 100644
--- a/include/linux/bpf.h
+++ b/include/linux/bpf.h
@@ -1865,8 +1865,9 @@ struct bpf_prog_aux {

  struct bpf_prog {
  	u16			pages;		/* Number of allocated pages */
-	u16			jited:1,	/* Is our filter JIT'ed? */
+	u32			jited:1,	/* Is our filter JIT'ed? */
  				jit_requested:1,/* archs need to JIT the prog */
+				jit_required:1, /* program strictly requires JIT compiler */
  				gpl_compatible:1, /* Is filter GPL compatible? */
  				cb_access:1,	/* Is control block accessed? */
  				dst_needed:1,	/* Do we need dst entry? */
```

> 
>>   	enum bpf_prog_type	type;		/* Type of BPF program */
>>   	enum bpf_attach_type	expected_attach_type; /* For some prog types */
>>   	u32			len;		/* Number of filter blocks */
>> diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c
>> index 649cce41e13f..5fcd19ccb41a 100644
>> --- a/kernel/bpf/core.c
>> +++ b/kernel/bpf/core.c
>> @@ -2619,8 +2619,7 @@ struct bpf_prog *__bpf_prog_select_runtime(struct bpf_verifier_env *env,
>> struct
>>   	if (fp->bpf_func)
>>   		goto finalize;
>>   
>> -	if (IS_ENABLED(CONFIG_BPF_JIT_ALWAYS_ON) ||
>> -	    bpf_prog_has_kfunc_call(fp))
>> +	if (IS_ENABLED(CONFIG_BPF_JIT_ALWAYS_ON) || fp->jit_required)
>>   		jit_needed = true;
>>   
>>   	if (!bpf_prog_select_interpreter(fp))
>> diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
>> index 25aea4271cd0..f496b45b9da4 100644
>> --- a/kernel/bpf/verifier.c
>> +++ b/kernel/bpf/verifier.c
>> @@ -2765,6 +2765,8 @@ int bpf_add_kfunc_call(struct bpf_verifier_env *env, u32 func_id, u16
>> offset)
>>   	desc->func_model = func_model;
>>   	sort(tab->descs, tab->nr_descs, sizeof(tab->descs[0]),
>>   	     kfunc_desc_cmp_by_id_off, NULL);
>> +
>> +	env->prog->jit_required = 1;
> 
> That's ok, and I think Sashiko is right about this patch.
> 
>>   	return 0;
>>   }

As discussed in another thread, I will update bpf_prog_has_kfunc_call()
in v8, like this:

```
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 25aea4271cd0..c34cc524651a 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -2770,7 +2770,7 @@ int bpf_add_kfunc_call(struct bpf_verifier_env
*env, u32 func_id, u16 offset)

   bool bpf_prog_has_kfunc_call(const struct bpf_prog *prog)
   {
-       return !!prog->aux->kfunc_tab;
+       return prog->aux->kfunc_tab && prog->aux->kfunc_tab->nr_descs;
   }

   static int add_subprog_and_kfunc(struct bpf_verifier_env *env)
```

IIUC, there are two places to modify so far:
(1) struct bpf_prog
(2) bpf_prog_has_kfunc_call()

If you have any more comments, please let me know.

Thanks,
Tiezhu

Re: [PATCH bpf-next v7 1/2] bpf: Introduce jit_required flag and refactor kfunc path

[KaFai Wan]

On Sat, 2026-07-04 at 00:14 +0800, Tiezhu Yang wrote:
> On 7/3/26 21:55, KaFai Wan wrote:
> > On Thu, 2026-07-02 at 22:36 +0800, Tiezhu Yang wrote:
> > > Introduce a 'jit_required' bitfield flag at the end of the
> > > flags group in struct bpf_prog. This bit tracks whether a
> > > program strictly requires the JIT compiler.
> > > 
> > > Set this flag to 1 when a kfunc call is added at the end of
> > > bpf_add_kfunc_call().
> > > 
> > > In __bpf_prog_select_runtime(), check with fp->jit_required
> > > rather than bpf_prog_has_kfunc_call() to unify the logic.
> > > 
> > > Suggested-by: Alexei Starovoitov <ast@kernel.org>
> > > Suggested-by: KaFai Wan <kafai.wan@linux.dev>
> > > Signed-off-by: Tiezhu Yang <yangtiezhu@loongson.cn>
> > > ---
> > >   include/linux/bpf.h   | 3 ++-
> > >   kernel/bpf/core.c     | 3 +--
> > >   kernel/bpf/verifier.c | 2 ++
> > >   3 files changed, 5 insertions(+), 3 deletions(-)
> > > 
> > > diff --git a/include/linux/bpf.h b/include/linux/bpf.h
> > > index ba09795e0bfd..4e2b059d71f3 100644
> > > --- a/include/linux/bpf.h
> > > +++ b/include/linux/bpf.h
> > > @@ -1880,7 +1880,8 @@ struct bpf_prog {
> > >   				call_get_func_ip:1, /* Do we call get_func_ip() */
> > >   				call_session_cookie:1, /* Do we call bpf_session_cookie() */
> > >   				tstamp_type_access:1, /* Accessed __sk_buff->tstamp_type */
> > > -				sleepable:1;	/* BPF program is sleepable */
> > > +				sleepable:1,	/* BPF program is sleepable */
> > > +				jit_required:1;	/* program strictly requires JIT
> > > compiler
> > > */
> > 
> > In v6 you're using 'u8 jit_required', I thought it would be 'u8 jit_required:1', so we use one
> > byte
> > and left 3 byte hole for future use.
> > 
> > This version left 2 bytes hole, same as v5, but it can easily be misleading because of the u16
> > type,
> > since we used 17 bits. I prefer v5, it has better readability.
> 
> OK, I will use the previous layout in v8, like this:
> 
> ```
> diff --git a/include/linux/bpf.h b/include/linux/bpf.h
> index ba09795e0bfd..463fae6a5c33 100644
> --- a/include/linux/bpf.h
> +++ b/include/linux/bpf.h
> @@ -1865,8 +1865,9 @@ struct bpf_prog_aux {
> 
>   struct bpf_prog {
>   	u16			pages;		/* Number of allocated pages */
> -	u16			jited:1,	/* Is our filter JIT'ed? */
> +	u32			jited:1,	/* Is our filter JIT'ed? */
>   				jit_requested:1,/* archs need to JIT the prog */
> +				jit_required:1, /* program strictly requires JIT compiler */
>   				gpl_compatible:1, /* Is filter GPL compatible? */
>   				cb_access:1,	/* Is control block accessed? */
>   				dst_needed:1,	/* Do we need dst entry? */
> ```
> 
> > 
> > >   	enum bpf_prog_type	type;		/* Type of BPF program */
> > >   	enum bpf_attach_type	expected_attach_type; /* For some prog types */
> > >   	u32			len;		/* Number of filter blocks */
> > > diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c
> > > index 649cce41e13f..5fcd19ccb41a 100644
> > > --- a/kernel/bpf/core.c
> > > +++ b/kernel/bpf/core.c
> > > @@ -2619,8 +2619,7 @@ struct bpf_prog *__bpf_prog_select_runtime(struct bpf_verifier_env *env,
> > > struct
> > >   	if (fp->bpf_func)
> > >   		goto finalize;
> > >   
> > > -	if (IS_ENABLED(CONFIG_BPF_JIT_ALWAYS_ON) ||
> > > -	    bpf_prog_has_kfunc_call(fp))
> > > +	if (IS_ENABLED(CONFIG_BPF_JIT_ALWAYS_ON) || fp->jit_required)
> > >   		jit_needed = true;
> > >   
> > >   	if (!bpf_prog_select_interpreter(fp))
> > > diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> > > index 25aea4271cd0..f496b45b9da4 100644
> > > --- a/kernel/bpf/verifier.c
> > > +++ b/kernel/bpf/verifier.c
> > > @@ -2765,6 +2765,8 @@ int bpf_add_kfunc_call(struct bpf_verifier_env *env, u32 func_id, u16
> > > offset)
> > >   	desc->func_model = func_model;
> > >   	sort(tab->descs, tab->nr_descs, sizeof(tab->descs[0]),
> > >   	     kfunc_desc_cmp_by_id_off, NULL);
> > > +
> > > +	env->prog->jit_required = 1;
> > 
> > That's ok, and I think Sashiko is right about this patch.
> > 
> > >   	return 0;
> > >   }
> 
> As discussed in another thread, I will update bpf_prog_has_kfunc_call()
> in v8, like this:
> 
> ```
> diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> index 25aea4271cd0..c34cc524651a 100644
> --- a/kernel/bpf/verifier.c
> +++ b/kernel/bpf/verifier.c
> @@ -2770,7 +2770,7 @@ int bpf_add_kfunc_call(struct bpf_verifier_env
> *env, u32 func_id, u16 offset)
> 
>    bool bpf_prog_has_kfunc_call(const struct bpf_prog *prog)
>    {
> -       return !!prog->aux->kfunc_tab;
> +       return prog->aux->kfunc_tab && prog->aux->kfunc_tab->nr_descs;
>    }
> 
>    static int add_subprog_and_kfunc(struct bpf_verifier_env *env)
> ```
> 
> IIUC, there are two places to modify so far:
> (1) struct bpf_prog

yes

> (2) bpf_prog_has_kfunc_call()

I think we can remove this func.

actually, I feed your patch to dsv4-pro and gpt-5.4 yesterday, both point out the we should do this
and change the log message.

diff --git a/kernel/bpf/fixups.c b/kernel/bpf/fixups.c
index 12a8a4eb757f..7fb92b5fa415 100644
--- a/kernel/bpf/fixups.c
+++ b/kernel/bpf/fixups.c
@@ -1378,7 +1378,6 @@ int bpf_fixup_call_args(struct bpf_verifier_env *env)
 #ifndef CONFIG_BPF_JIT_ALWAYS_ON
 	struct bpf_prog *prog = env->prog;
 	struct bpf_insn *insn = prog->insnsi;
-	bool has_kfunc_call = bpf_prog_has_kfunc_call(prog);
 	int depth;
 #endif
 	int i, err = 0;
@@ -1404,7 +1403,7 @@ int bpf_fixup_call_args(struct bpf_verifier_env *env)
 			return err;
 	}
 #ifndef CONFIG_BPF_JIT_ALWAYS_ON
-	if (has_kfunc_call) {
+	if (prog->jit_required) {
 		verbose(env, "calling kernel functions are not allowed in non-JITed programs\n");
 		return -EINVAL;
 	}

I think we can change the log message for general purpose no just for kunc, so we can know why prog
failed in patch#2 as you test yesterday.

> 
> If you have any more comments, please let me know.
> 
> Thanks,
> Tiezhu
> 

-- 
Thanks,
KaFai

Re: [PATCH bpf-next v7 1/2] bpf: Introduce jit_required flag and refactor kfunc path

[Tiezhu Yang]

On 2026/7/4 上午9:57, KaFai Wan wrote:
> On Sat, 2026-07-04 at 00:14 +0800, Tiezhu Yang wrote:
>> On 7/3/26 21:55, KaFai Wan wrote:
>>> On Thu, 2026-07-02 at 22:36 +0800, Tiezhu Yang wrote:

...

>>
>> IIUC, there are two places to modify so far:
>> (1) struct bpf_prog
> 
> yes
> 
>> (2) bpf_prog_has_kfunc_call()
> 
> I think we can remove this func.
> 
> actually, I feed your patch to dsv4-pro and gpt-5.4 yesterday, both point out the we should do this
> and change the log message.
> 
> diff --git a/kernel/bpf/fixups.c b/kernel/bpf/fixups.c
> index 12a8a4eb757f..7fb92b5fa415 100644
> --- a/kernel/bpf/fixups.c
> +++ b/kernel/bpf/fixups.c
> @@ -1378,7 +1378,6 @@ int bpf_fixup_call_args(struct bpf_verifier_env *env)
>   #ifndef CONFIG_BPF_JIT_ALWAYS_ON
>   	struct bpf_prog *prog = env->prog;
>   	struct bpf_insn *insn = prog->insnsi;
> -	bool has_kfunc_call = bpf_prog_has_kfunc_call(prog);
>   	int depth;
>   #endif
>   	int i, err = 0;
> @@ -1404,7 +1403,7 @@ int bpf_fixup_call_args(struct bpf_verifier_env *env)
>   			return err;
>   	}
>   #ifndef CONFIG_BPF_JIT_ALWAYS_ON
> -	if (has_kfunc_call) {
> +	if (prog->jit_required) {
>   		verbose(env, "calling kernel functions are not allowed in non-JITed programs\n");
>   		return -EINVAL;
>   	}
> 
> I think we can change the log message for general purpose no just for kunc, so we can know why prog
> failed in patch#2 as you test yesterday.

Hi KaFai,

Thanks a lot for the explanations and suggestions,
I really appreciate it.

I will do the following changes in the next version v8:

1. Completely remove bpf_prog_has_kfunc_call().
2. Set jit_required at the entry of bpf_add_kfunc_call().
3. Generalize the error message to:
    "program requires BPF JIT compiler but it is not available"

I have tested the updated v8 patch on LoongArch.
Here are the test results:

1. net.core.bpf_jit_enable = 1 and JIT compilation succeeded:
=> test PASS

2. net.core.bpf_jit_enable = 0 and JIT compilation succeeded:
=> returns -EINVAL (-22) and prints:
"program requires BPF JIT compiler but it is not available"

3. net.core.bpf_jit_enable = 1 and JIT compilation failed:
=> returns -ENOTSUPP (-524)

4. net.core.bpf_jit_enable = 0 and JIT compilation failed:
=> returns -EINVAL (-22) and prints:
"program requires BPF JIT compiler but it is not available"

As long as net.core.bpf_jit_enable = 0, it always returns early
in bpf_fixup_call_args() with -EINVAL and prints the error log.

Only when net.core.bpf_jit_enable = 1 and the runtime JIT compilation
dynamically fails, it safely falls back to the -ENOTSUPP runtime check.

I think it works exactly as expected.

Thanks,
Tiezhu

Re: [PATCH bpf-next v7 1/2] bpf: Introduce jit_required flag and refactor kfunc path

[Leon Hwang]

On 6/7/26 08:56, Tiezhu Yang wrote:
> On 2026/7/4 上午9:57, KaFai Wan wrote:
>> On Sat, 2026-07-04 at 00:14 +0800, Tiezhu Yang wrote:
>>> On 7/3/26 21:55, KaFai Wan wrote:
>>>> On Thu, 2026-07-02 at 22:36 +0800, Tiezhu Yang wrote:
> 
> ...
> 
>>>
>>> IIUC, there are two places to modify so far:
>>> (1) struct bpf_prog
>>
>> yes
>>
>>> (2) bpf_prog_has_kfunc_call()
>>
>> I think we can remove this func.
>>
>> actually, I feed your patch to dsv4-pro and gpt-5.4 yesterday, both
>> point out the we should do this
>> and change the log message.
>>
>> diff --git a/kernel/bpf/fixups.c b/kernel/bpf/fixups.c
>> index 12a8a4eb757f..7fb92b5fa415 100644
>> --- a/kernel/bpf/fixups.c
>> +++ b/kernel/bpf/fixups.c
>> @@ -1378,7 +1378,6 @@ int bpf_fixup_call_args(struct bpf_verifier_env
>> *env)
>>   #ifndef CONFIG_BPF_JIT_ALWAYS_ON
>>       struct bpf_prog *prog = env->prog;
>>       struct bpf_insn *insn = prog->insnsi;
>> -    bool has_kfunc_call = bpf_prog_has_kfunc_call(prog);
>>       int depth;
>>   #endif
>>       int i, err = 0;
>> @@ -1404,7 +1403,7 @@ int bpf_fixup_call_args(struct bpf_verifier_env
>> *env)
>>               return err;
>>       }
>>   #ifndef CONFIG_BPF_JIT_ALWAYS_ON
>> -    if (has_kfunc_call) {
>> +    if (prog->jit_required) {


Agreed with this change.

Then, think it harder, pls.

Can we clean some code of __bpf_prog_select_runtime() btw?

diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c
index 649cce41e13f..bad55e119cb5 100644
--- a/kernel/bpf/core.c
+++ b/kernel/bpf/core.c
@@ -120,6 +120,9 @@ struct bpf_prog *bpf_prog_alloc_no_stats(unsigned
int size, gfp_t gfp_extra_flag
 		return NULL;
 	}

+#ifdef CONFIG_BPF_JIT_ALWAYS_ON
+	fp->jit_required = true;
+#endif
 	fp->pages = size / PAGE_SIZE;
 	fp->aux = aux;
 	fp->aux->main_prog_aux = aux;
@@ -2614,15 +2617,11 @@ struct bpf_prog
*__bpf_prog_select_runtime(struct bpf_verifier_env *env, struct
 	/* In case of BPF to BPF calls, verifier did all the prep
 	 * work with regards to JITing, etc.
 	 */
-	bool jit_needed = false;
+	bool jit_needed = fp->jit_required;

 	if (fp->bpf_func)
 		goto finalize;

-	if (IS_ENABLED(CONFIG_BPF_JIT_ALWAYS_ON) ||
-	    bpf_prog_has_kfunc_call(fp))
-		jit_needed = true;
-
 	if (!bpf_prog_select_interpreter(fp))
 		jit_needed = true;

WDYT?

Thanks,
Leon

>>           verbose(env, "calling kernel functions are not allowed in
>> non-JITed programs\n");
>>           return -EINVAL;
>> [...]

Re: [PATCH bpf-next v7 1/2] bpf: Introduce jit_required flag and refactor kfunc path

[Tiezhu Yang]

On 2026/7/6 上午11:59, Leon Hwang wrote:
> On 6/7/26 08:56, Tiezhu Yang wrote:
>> On 2026/7/4 上午9:57, KaFai Wan wrote:
>>> On Sat, 2026-07-04 at 00:14 +0800, Tiezhu Yang wrote:
>>>> On 7/3/26 21:55, KaFai Wan wrote:
>>>>> On Thu, 2026-07-02 at 22:36 +0800, Tiezhu Yang wrote:
>>
>> ...
>>
>>>>
>>>> IIUC, there are two places to modify so far:
>>>> (1) struct bpf_prog
>>>
>>> yes
>>>
>>>> (2) bpf_prog_has_kfunc_call()
>>>
>>> I think we can remove this func.
>>>
>>> actually, I feed your patch to dsv4-pro and gpt-5.4 yesterday, both
>>> point out the we should do this
>>> and change the log message.
>>>
>>> diff --git a/kernel/bpf/fixups.c b/kernel/bpf/fixups.c
>>> index 12a8a4eb757f..7fb92b5fa415 100644
>>> --- a/kernel/bpf/fixups.c
>>> +++ b/kernel/bpf/fixups.c
>>> @@ -1378,7 +1378,6 @@ int bpf_fixup_call_args(struct bpf_verifier_env
>>> *env)
>>>    #ifndef CONFIG_BPF_JIT_ALWAYS_ON
>>>        struct bpf_prog *prog = env->prog;
>>>        struct bpf_insn *insn = prog->insnsi;
>>> -    bool has_kfunc_call = bpf_prog_has_kfunc_call(prog);
>>>        int depth;
>>>    #endif
>>>        int i, err = 0;
>>> @@ -1404,7 +1403,7 @@ int bpf_fixup_call_args(struct bpf_verifier_env
>>> *env)
>>>                return err;
>>>        }
>>>    #ifndef CONFIG_BPF_JIT_ALWAYS_ON
>>> -    if (has_kfunc_call) {
>>> +    if (prog->jit_required) {
> 
> 
> Agreed with this change.
> 
> Then, think it harder, pls.
> 
> Can we clean some code of __bpf_prog_select_runtime() btw?
> 
> diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c
> index 649cce41e13f..bad55e119cb5 100644
> --- a/kernel/bpf/core.c
> +++ b/kernel/bpf/core.c
> @@ -120,6 +120,9 @@ struct bpf_prog *bpf_prog_alloc_no_stats(unsigned
> int size, gfp_t gfp_extra_flag
>   		return NULL;
>   	}
> 
> +#ifdef CONFIG_BPF_JIT_ALWAYS_ON
> +	fp->jit_required = true;
> +#endif
>   	fp->pages = size / PAGE_SIZE;
>   	fp->aux = aux;
>   	fp->aux->main_prog_aux = aux;
> @@ -2614,15 +2617,11 @@ struct bpf_prog
> *__bpf_prog_select_runtime(struct bpf_verifier_env *env, struct
>   	/* In case of BPF to BPF calls, verifier did all the prep
>   	 * work with regards to JITing, etc.
>   	 */
> -	bool jit_needed = false;
> +	bool jit_needed = fp->jit_required;
> 
>   	if (fp->bpf_func)
>   		goto finalize;
> 
> -	if (IS_ENABLED(CONFIG_BPF_JIT_ALWAYS_ON) ||
> -	    bpf_prog_has_kfunc_call(fp))
> -		jit_needed = true;
> -
>   	if (!bpf_prog_select_interpreter(fp))
>   		jit_needed = true;
> 
> WDYT?

Sorry, just saw your reply.
I have already sent out v8.

I think it is better to keep
the patch changes simple and focused.

The clean-up can be done as a follow-up
separate patch if necessary.

Thanks,
Tiezhu

Re: [PATCH bpf-next v7 1/2] bpf: Introduce jit_required flag and refactor kfunc path

[KaFai Wan]

On Mon, 2026-07-06 at 11:59 +0800, Leon Hwang wrote:
> On 6/7/26 08:56, Tiezhu Yang wrote:
> > On 2026/7/4 上午9:57, KaFai Wan wrote:
> > > On Sat, 2026-07-04 at 00:14 +0800, Tiezhu Yang wrote:
> > > > On 7/3/26 21:55, KaFai Wan wrote:
> > > > > On Thu, 2026-07-02 at 22:36 +0800, Tiezhu Yang wrote:
> > 
> > ...
> > 
> > > > 
> > > > IIUC, there are two places to modify so far:
> > > > (1) struct bpf_prog
> > > 
> > > yes
> > > 
> > > > (2) bpf_prog_has_kfunc_call()
> > > 
> > > I think we can remove this func.
> > > 
> > > actually, I feed your patch to dsv4-pro and gpt-5.4 yesterday, both
> > > point out the we should do this
> > > and change the log message.
> > > 
> > > diff --git a/kernel/bpf/fixups.c b/kernel/bpf/fixups.c
> > > index 12a8a4eb757f..7fb92b5fa415 100644
> > > --- a/kernel/bpf/fixups.c
> > > +++ b/kernel/bpf/fixups.c
> > > @@ -1378,7 +1378,6 @@ int bpf_fixup_call_args(struct bpf_verifier_env
> > > *env)
> > >   #ifndef CONFIG_BPF_JIT_ALWAYS_ON
> > >       struct bpf_prog *prog = env->prog;
> > >       struct bpf_insn *insn = prog->insnsi;
> > > -    bool has_kfunc_call = bpf_prog_has_kfunc_call(prog);
> > >       int depth;
> > >   #endif
> > >       int i, err = 0;
> > > @@ -1404,7 +1403,7 @@ int bpf_fixup_call_args(struct bpf_verifier_env
> > > *env)
> > >               return err;
> > >       }
> > >   #ifndef CONFIG_BPF_JIT_ALWAYS_ON
> > > -    if (has_kfunc_call) {
> > > +    if (prog->jit_required) {
> 
> 
> Agreed with this change.
> 
> Then, think it harder, pls.
> 
> Can we clean some code of __bpf_prog_select_runtime() btw?
> 
> diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c
> index 649cce41e13f..bad55e119cb5 100644
> --- a/kernel/bpf/core.c
> +++ b/kernel/bpf/core.c
> @@ -120,6 +120,9 @@ struct bpf_prog *bpf_prog_alloc_no_stats(unsigned
> int size, gfp_t gfp_extra_flag
>  		return NULL;
>  	}
> 
> +#ifdef CONFIG_BPF_JIT_ALWAYS_ON
> +	fp->jit_required = true;
> +#endif

Don't need #ifdef, fp->jit_required = IS_ENABLED(CONFIG_BPF_JIT_ALWAYS_ON) is fine. :)

>  	fp->pages = size / PAGE_SIZE;
>  	fp->aux = aux;
>  	fp->aux->main_prog_aux = aux;
> @@ -2614,15 +2617,11 @@ struct bpf_prog
> *__bpf_prog_select_runtime(struct bpf_verifier_env *env, struct
>  	/* In case of BPF to BPF calls, verifier did all the prep
>  	 * work with regards to JITing, etc.
>  	 */
> -	bool jit_needed = false;
> +	bool jit_needed = fp->jit_required;
> 
>  	if (fp->bpf_func)
>  		goto finalize;
> 
> -	if (IS_ENABLED(CONFIG_BPF_JIT_ALWAYS_ON) ||
> -	    bpf_prog_has_kfunc_call(fp))
> -		jit_needed = true;
> -
>  	if (!bpf_prog_select_interpreter(fp))
>  		jit_needed = true;
> 
> WDYT?
> 
> Thanks,
> Leon
> 
> > >           verbose(env, "calling kernel functions are not allowed in
> > > non-JITed programs\n");
> > >           return -EINVAL;
> > > [...]

-- 
Thanks,
KaFai

Re: [PATCH bpf-next v7 1/2] bpf: Introduce jit_required flag and refactor kfunc path

[KaFai Wan]

On Sat, 2026-07-04 at 00:14 +0800, Tiezhu Yang wrote:
> On 7/3/26 21:55, KaFai Wan wrote:
> > On Thu, 2026-07-02 at 22:36 +0800, Tiezhu Yang wrote:
> > > Introduce a 'jit_required' bitfield flag at the end of the
> > > flags group in struct bpf_prog. This bit tracks whether a
> > > program strictly requires the JIT compiler.
> > > 
> > > Set this flag to 1 when a kfunc call is added at the end of
> > > bpf_add_kfunc_call().
> > > 
> > > In __bpf_prog_select_runtime(), check with fp->jit_required
> > > rather than bpf_prog_has_kfunc_call() to unify the logic.
> > > 
> > > Suggested-by: Alexei Starovoitov <ast@kernel.org>
> > > Suggested-by: KaFai Wan <kafai.wan@linux.dev>
> > > Signed-off-by: Tiezhu Yang <yangtiezhu@loongson.cn>
> > > ---
> > >   include/linux/bpf.h   | 3 ++-
> > >   kernel/bpf/core.c     | 3 +--
> > >   kernel/bpf/verifier.c | 2 ++
> > >   3 files changed, 5 insertions(+), 3 deletions(-)
> > > 
> > > diff --git a/include/linux/bpf.h b/include/linux/bpf.h
> > > index ba09795e0bfd..4e2b059d71f3 100644
> > > --- a/include/linux/bpf.h
> > > +++ b/include/linux/bpf.h
> > > @@ -1880,7 +1880,8 @@ struct bpf_prog {
> > >   				call_get_func_ip:1, /* Do we call get_func_ip() */
> > >   				call_session_cookie:1, /* Do we call bpf_session_cookie() */
> > >   				tstamp_type_access:1, /* Accessed __sk_buff->tstamp_type */
> > > -				sleepable:1;	/* BPF program is sleepable */
> > > +				sleepable:1,	/* BPF program is sleepable */
> > > +				jit_required:1;	/* program strictly requires JIT
> > > compiler
> > > */
> > 
> > In v6 you're using 'u8 jit_required', I thought it would be 'u8 jit_required:1', so we use one
> > byte
> > and left 3 byte hole for future use.
> > 
> > This version left 2 bytes hole, same as v5, but it can easily be misleading because of the u16
> > type,
> > since we used 17 bits. I prefer v5, it has better readability.
> 
> OK, I will use the previous layout in v8, like this:
> 
> ```
> diff --git a/include/linux/bpf.h b/include/linux/bpf.h
> index ba09795e0bfd..463fae6a5c33 100644
> --- a/include/linux/bpf.h
> +++ b/include/linux/bpf.h
> @@ -1865,8 +1865,9 @@ struct bpf_prog_aux {
> 
>   struct bpf_prog {
>   	u16			pages;		/* Number of allocated pages */
> -	u16			jited:1,	/* Is our filter JIT'ed? */
> +	u32			jited:1,	/* Is our filter JIT'ed? */
>   				jit_requested:1,/* archs need to JIT the prog */
> +				jit_required:1, /* program strictly requires JIT compiler */
>   				gpl_compatible:1, /* Is filter GPL compatible? */
>   				cb_access:1,	/* Is control block accessed? */
>   				dst_needed:1,	/* Do we need dst entry? */
> ```
> 
> > 
> > >   	enum bpf_prog_type	type;		/* Type of BPF program */
> > >   	enum bpf_attach_type	expected_attach_type; /* For some prog types */
> > >   	u32			len;		/* Number of filter blocks */
> > > diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c
> > > index 649cce41e13f..5fcd19ccb41a 100644
> > > --- a/kernel/bpf/core.c
> > > +++ b/kernel/bpf/core.c
> > > @@ -2619,8 +2619,7 @@ struct bpf_prog *__bpf_prog_select_runtime(struct bpf_verifier_env *env,
> > > struct
> > >   	if (fp->bpf_func)
> > >   		goto finalize;
> > >   
> > > -	if (IS_ENABLED(CONFIG_BPF_JIT_ALWAYS_ON) ||
> > > -	    bpf_prog_has_kfunc_call(fp))
> > > +	if (IS_ENABLED(CONFIG_BPF_JIT_ALWAYS_ON) || fp->jit_required)
> > >   		jit_needed = true;
> > >   
> > >   	if (!bpf_prog_select_interpreter(fp))
> > > diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> > > index 25aea4271cd0..f496b45b9da4 100644
> > > --- a/kernel/bpf/verifier.c
> > > +++ b/kernel/bpf/verifier.c
> > > @@ -2765,6 +2765,8 @@ int bpf_add_kfunc_call(struct bpf_verifier_env *env, u32 func_id, u16
> > > offset)
> > >   	desc->func_model = func_model;
> > >   	sort(tab->descs, tab->nr_descs, sizeof(tab->descs[0]),
> > >   	     kfunc_desc_cmp_by_id_off, NULL);
> > > +
> > > +	env->prog->jit_required = 1;
> > 
> > That's ok, and I think Sashiko is right about this patch.
> > 
> > >   	return 0;
> > >   }
> 
> As discussed in another thread, I will update bpf_prog_has_kfunc_call()
> in v8, like this:
> 
> ```
> diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> index 25aea4271cd0..c34cc524651a 100644
> --- a/kernel/bpf/verifier.c
> +++ b/kernel/bpf/verifier.c
> @@ -2770,7 +2770,7 @@ int bpf_add_kfunc_call(struct bpf_verifier_env
> *env, u32 func_id, u16 offset)
> 
>    bool bpf_prog_has_kfunc_call(const struct bpf_prog *prog)
>    {
> -       return !!prog->aux->kfunc_tab;
> +       return prog->aux->kfunc_tab && prog->aux->kfunc_tab->nr_descs;

!!prog->aux->kfunc_tab works fine when bpf_prog_has_kfunc_call() called currently, no need to check 
prog->aux->kfunc_tab->nr_descs, see other thread.

>    }
> 
>    static int add_subprog_and_kfunc(struct bpf_verifier_env *env)
> ```
> 
> IIUC, there are two places to modify so far:
> (1) struct bpf_prog
> (2) bpf_prog_has_kfunc_call()
> 
> If you have any more comments, please let me know.
> 
> Thanks,
> Tiezhu
> 

-- 
Thanks,
KaFai

[PATCH bpf-next v7 2/2] bpf: Reject programs with inlined helpers if JIT is unavailable

[Tiezhu Yang]

When an architecture implements bpf_jit_inlines_helper_call() (such as
LoongArch, ARM64, PowerPC, and RISC-V), the verifier skips rewriting the
helper call offset (insn->imm) during the bpf_do_misc_fixups() phase,
because the helper is expected to be inlined by the JIT compiler. As a
result, insn->imm remains as the raw helper enum ID.

However, if JIT is disabled at runtime (net.core.bpf_jit_enable=0) or
if the JIT compilation later dynamically fails (e.g., due to OOM), the
core BPF subsystem falls back to the BPF interpreter.

When the interpreter executes (__bpf_call_base + insn->imm) with the
unpatched raw helper ID, it jumps into an unaligned invalid address
space, triggering an instruction alignment fault or a memory access
panic.

Fix this by setting 'jit_required' to 1 when helper call rewriting is
skipped for JIT inlining. During runtime selection, if JIT compilation
is not available, explicitly reject loading with -ENOTSUPP based on
this flag to safely prevent the kernel panic.

Fixes: 2ddec2c80b44 ("riscv, bpf: inline bpf_get_smp_processor_id()")
Suggested-by: Alexei Starovoitov <ast@kernel.org>
Suggested-by: KaFai Wan <kafai.wan@linux.dev>
Signed-off-by: Tiezhu Yang <yangtiezhu@loongson.cn>
---
 kernel/bpf/fixups.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/kernel/bpf/fixups.c b/kernel/bpf/fixups.c
index 12a8a4eb757f..94e0457a0aa3 100644
--- a/kernel/bpf/fixups.c
+++ b/kernel/bpf/fixups.c
@@ -1841,8 +1841,10 @@ int bpf_do_misc_fixups(struct bpf_verifier_env *env)
 		}
 
 		/* Skip inlining the helper call if the JIT does it. */
-		if (bpf_jit_inlines_helper_call(insn->imm))
+		if (bpf_jit_inlines_helper_call(insn->imm)) {
+			prog->jit_required = 1;
 			goto next_insn;
+		}
 
 		if (insn->imm == BPF_FUNC_get_route_realm)
 			prog->dst_needed = 1;
-- 
2.42.0