From: pengdonglin <pengdonglin@xiaomi.com>
Currently, vmlinux and kernel module BTFs are unconditionally
sorted during the build phase, with named types placed at the
end. Thus, anonymous types should be skipped when starting the
search. In my vmlinux BTF, the number of anonymous types is
61,747, which means the loop count can be reduced by 61,747.
Cc: Eduard Zingerman <eddyz87@gmail.com>
Cc: Alexei Starovoitov <ast@kernel.org>
Cc: Andrii Nakryiko <andrii.nakryiko@gmail.com>
Cc: Alan Maguire <alan.maguire@oracle.com>
Cc: Ihor Solodrai <ihor.solodrai@linux.dev>
Cc: Xiaoqin Zhang <zhangxiaoqin@xiaomi.com>
Signed-off-by: pengdonglin <pengdonglin@xiaomi.com>
---
include/linux/btf.h | 1 +
kernel/bpf/btf.c | 15 ++++++++++-----
kernel/bpf/verifier.c | 7 +------
3 files changed, 12 insertions(+), 11 deletions(-)
diff --git a/include/linux/btf.h b/include/linux/btf.h
index f06976ffb63f..2d28f2b22ae5 100644
--- a/include/linux/btf.h
+++ b/include/linux/btf.h
@@ -220,6 +220,7 @@ bool btf_is_module(const struct btf *btf);
bool btf_is_vmlinux(const struct btf *btf);
struct module *btf_try_get_module(const struct btf *btf);
u32 btf_nr_types(const struct btf *btf);
+u32 btf_sorted_start_id(const struct btf *btf);
struct btf *btf_base_btf(const struct btf *btf);
bool btf_type_is_i32(const struct btf_type *t);
bool btf_type_is_i64(const struct btf_type *t);
diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c
index 925cb524f3a8..5f4f51b0acf4 100644
--- a/kernel/bpf/btf.c
+++ b/kernel/bpf/btf.c
@@ -550,6 +550,11 @@ u32 btf_nr_types(const struct btf *btf)
return total;
}
+u32 btf_sorted_start_id(const struct btf *btf)
+{
+ return btf->sorted_start_id ?: (btf->start_id ?: 1);
+}
+
/*
* Assuming that types are sorted by name in ascending order.
*/
@@ -3540,9 +3545,9 @@ const char *btf_find_decl_tag_value(const struct btf *btf, const struct btf_type
{
const char *value = NULL;
const struct btf_type *t;
- int len, id;
+ int len, id = btf->sorted_start_id > 0 ? btf->sorted_start_id - 1 : 0;
- id = btf_find_next_decl_tag(btf, pt, comp_idx, tag_key, 0);
+ id = btf_find_next_decl_tag(btf, pt, comp_idx, tag_key, id);
if (id < 0)
return ERR_PTR(id);
@@ -7859,7 +7864,7 @@ int btf_prepare_func_args(struct bpf_verifier_env *env, int subprog)
*/
for (i = 0; i < nargs; i++) {
u32 tags = 0;
- int id = 0;
+ int id = btf->sorted_start_id > 0 ? btf->sorted_start_id - 1 : 0;
/* 'arg:<tag>' decl_tag takes precedence over derivation of
* register type from BTF type itself
@@ -9340,7 +9345,7 @@ bpf_core_find_cands(struct bpf_core_ctx *ctx, u32 local_type_id)
}
/* Attempt to find target candidates in vmlinux BTF first */
- cands = bpf_core_add_cands(cands, main_btf, 1);
+ cands = bpf_core_add_cands(cands, main_btf, main_btf->sorted_start_id);
if (IS_ERR(cands))
return ERR_CAST(cands);
@@ -9372,7 +9377,7 @@ bpf_core_find_cands(struct bpf_core_ctx *ctx, u32 local_type_id)
*/
btf_get(mod_btf);
spin_unlock_bh(&btf_idr_lock);
- cands = bpf_core_add_cands(cands, mod_btf, btf_nr_types(main_btf));
+ cands = bpf_core_add_cands(cands, mod_btf, mod_btf->sorted_start_id);
btf_put(mod_btf);
if (IS_ERR(cands))
return ERR_CAST(cands);
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index f0ca69f888fa..2ae87075db6a 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -20655,12 +20655,7 @@ static int find_btf_percpu_datasec(struct btf *btf)
* types to look at only module's own BTF types.
*/
n = btf_nr_types(btf);
- if (btf_is_module(btf))
- i = btf_nr_types(btf_vmlinux);
- else
- i = 1;
-
- for(; i < n; i++) {
+ for (i = btf_sorted_start_id(btf); i < n; i++) {
t = btf_type_by_id(btf, i);
if (BTF_INFO_KIND(t->info) != BTF_KIND_DATASEC)
continue;
--
2.34.1On Mon, 2025-12-08 at 14:23 +0800, Donglin Peng wrote:
[...]
> @@ -550,6 +550,11 @@ u32 btf_nr_types(const struct btf *btf)
> return total;
> }
>
> +u32 btf_sorted_start_id(const struct btf *btf)
> +{
> + return btf->sorted_start_id ?: (btf->start_id ?: 1);
> +}
> +
I think that changes in this patch are correct. However, it seems
error prone to remember that sorted_start_id is always set for
vmlinux/module BTF and might not be set for program BTF.
Wdyt about using the above function everywhere instead of directly
reading the field?
> /*
> * Assuming that types are sorted by name in ascending order.
> */
[...]
On Wed, Dec 17, 2025 at 2:55 PM Eduard Zingerman <eddyz87@gmail.com> wrote:
>
> On Mon, 2025-12-08 at 14:23 +0800, Donglin Peng wrote:
>
> [...]
>
> > @@ -550,6 +550,11 @@ u32 btf_nr_types(const struct btf *btf)
> > return total;
> > }
> >
> > +u32 btf_sorted_start_id(const struct btf *btf)
> > +{
> > + return btf->sorted_start_id ?: (btf->start_id ?: 1);
> > +}
> > +
>
> I think that changes in this patch are correct. However, it seems
Thanks, I think the changes to btf_find_decl_tag_value and
btf_prepare_func_args will cause issues if the input btf is a
split BTF. We should search from its base BTF. Like this:
const struct btf *base_btf = btf;
while (btf_base_btf(base_btf))
base_btf = btf_base_btf(base_btf);
id = base_btf->sorted_start_id > 0 ? base_btf->sorted_start_id - 1 : 0;
> error prone to remember that sorted_start_id is always set for
> vmlinux/module BTF and might not be set for program BTF.
> Wdyt about using the above function everywhere instead of directly
> reading the field?
Agreed. If so, I think we need to add another helper function to check
whether the input BTF is sorted to improve code clarity.
bool btf_is_sorted(const struct btf *btf)
{
return btf->sorted_start_id > 0;
}
Besides, do you think we should reject loading a kernel module that is
not sorted?
Thanks,
Donglin
>
> > /*
> > * Assuming that types are sorted by name in ascending order.
> > */
>
> [...]
On Wed, 2025-12-17 at 17:21 +0800, Donglin Peng wrote:
> On Wed, Dec 17, 2025 at 2:55 PM Eduard Zingerman <eddyz87@gmail.com> wrote:
> >
> > On Mon, 2025-12-08 at 14:23 +0800, Donglin Peng wrote:
> >
> > [...]
> >
> > > @@ -550,6 +550,11 @@ u32 btf_nr_types(const struct btf *btf)
> > > return total;
> > > }
> > >
> > > +u32 btf_sorted_start_id(const struct btf *btf)
> > > +{
> > > + return btf->sorted_start_id ?: (btf->start_id ?: 1);
> > > +}
> > > +
> >
> > I think that changes in this patch are correct. However, it seems
>
> Thanks, I think the changes to btf_find_decl_tag_value and
> btf_prepare_func_args will cause issues if the input btf is a
> split BTF. We should search from its base BTF. Like this:
>
> const struct btf *base_btf = btf;
> while (btf_base_btf(base_btf))
> base_btf = btf_base_btf(base_btf);
> id = base_btf->sorted_start_id > 0 ? base_btf->sorted_start_id - 1 : 0;
Missed that, makes sense.
> > error prone to remember that sorted_start_id is always set for
> > vmlinux/module BTF and might not be set for program BTF.
> > Wdyt about using the above function everywhere instead of directly
> > reading the field?
>
> Agreed. If so, I think we need to add another helper function to check
> whether the input BTF is sorted to improve code clarity.
>
> bool btf_is_sorted(const struct btf *btf)
> {
> return btf->sorted_start_id > 0;
> }
Sure, as you see fit.
> Besides, do you think we should reject loading a kernel module that is
> not sorted?
Not my strong side. As far as I understand, when external modules are
built for production use-cases DKMS is used. DKMS will use same
resolve_btfids as the kernel module is built for. Hence reject the
modules with not sorted BTFs should be fine. Are there other use-cases
when mismatch between resolve_btfids versions is allowed?
On Thu, Dec 18, 2025 at 1:29 AM Eduard Zingerman <eddyz87@gmail.com> wrote:
>
> On Wed, 2025-12-17 at 17:21 +0800, Donglin Peng wrote:
> > On Wed, Dec 17, 2025 at 2:55 PM Eduard Zingerman <eddyz87@gmail.com> wrote:
> > >
> > > On Mon, 2025-12-08 at 14:23 +0800, Donglin Peng wrote:
> > >
> > > [...]
> > >
> > > > @@ -550,6 +550,11 @@ u32 btf_nr_types(const struct btf *btf)
> > > > return total;
> > > > }
> > > >
> > > > +u32 btf_sorted_start_id(const struct btf *btf)
> > > > +{
> > > > + return btf->sorted_start_id ?: (btf->start_id ?: 1);
> > > > +}
> > > > +
> > >
> > > I think that changes in this patch are correct. However, it seems
> >
> > Thanks, I think the changes to btf_find_decl_tag_value and
> > btf_prepare_func_args will cause issues if the input btf is a
> > split BTF. We should search from its base BTF. Like this:
> >
> > const struct btf *base_btf = btf;
> > while (btf_base_btf(base_btf))
> > base_btf = btf_base_btf(base_btf);
> > id = base_btf->sorted_start_id > 0 ? base_btf->sorted_start_id - 1 : 0;
>
> Missed that, makes sense.
>
> > > error prone to remember that sorted_start_id is always set for
> > > vmlinux/module BTF and might not be set for program BTF.
> > > Wdyt about using the above function everywhere instead of directly
> > > reading the field?
> >
> > Agreed. If so, I think we need to add another helper function to check
> > whether the input BTF is sorted to improve code clarity.
> >
> > bool btf_is_sorted(const struct btf *btf)
> > {
> > return btf->sorted_start_id > 0;
> > }
>
> Sure, as you see fit.
>
> > Besides, do you think we should reject loading a kernel module that is
> > not sorted?
>
> Not my strong side. As far as I understand, when external modules are
> built for production use-cases DKMS is used. DKMS will use same
> resolve_btfids as the kernel module is built for. Hence reject the
> modules with not sorted BTFs should be fine. Are there other use-cases
> when mismatch between resolve_btfids versions is allowed?
Thanks. I found that RHEL supports loading a kernel module between
different kernel versions with stable KABI. So I think we should not reject
loading modules with unsorted BTFs.
On Mon, Dec 8, 2025 at 2:24 PM Donglin Peng <dolinux.peng@gmail.com> wrote:
>
> From: pengdonglin <pengdonglin@xiaomi.com>
>
> Currently, vmlinux and kernel module BTFs are unconditionally
> sorted during the build phase, with named types placed at the
> end. Thus, anonymous types should be skipped when starting the
> search. In my vmlinux BTF, the number of anonymous types is
> 61,747, which means the loop count can be reduced by 61,747.
>
> Cc: Eduard Zingerman <eddyz87@gmail.com>
> Cc: Alexei Starovoitov <ast@kernel.org>
> Cc: Andrii Nakryiko <andrii.nakryiko@gmail.com>
> Cc: Alan Maguire <alan.maguire@oracle.com>
> Cc: Ihor Solodrai <ihor.solodrai@linux.dev>
> Cc: Xiaoqin Zhang <zhangxiaoqin@xiaomi.com>
> Signed-off-by: pengdonglin <pengdonglin@xiaomi.com>
> ---
> include/linux/btf.h | 1 +
> kernel/bpf/btf.c | 15 ++++++++++-----
> kernel/bpf/verifier.c | 7 +------
> 3 files changed, 12 insertions(+), 11 deletions(-)
>
> diff --git a/include/linux/btf.h b/include/linux/btf.h
> index f06976ffb63f..2d28f2b22ae5 100644
> --- a/include/linux/btf.h
> +++ b/include/linux/btf.h
> @@ -220,6 +220,7 @@ bool btf_is_module(const struct btf *btf);
> bool btf_is_vmlinux(const struct btf *btf);
> struct module *btf_try_get_module(const struct btf *btf);
> u32 btf_nr_types(const struct btf *btf);
> +u32 btf_sorted_start_id(const struct btf *btf);
> struct btf *btf_base_btf(const struct btf *btf);
> bool btf_type_is_i32(const struct btf_type *t);
> bool btf_type_is_i64(const struct btf_type *t);
> diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c
> index 925cb524f3a8..5f4f51b0acf4 100644
> --- a/kernel/bpf/btf.c
> +++ b/kernel/bpf/btf.c
> @@ -550,6 +550,11 @@ u32 btf_nr_types(const struct btf *btf)
> return total;
> }
>
> +u32 btf_sorted_start_id(const struct btf *btf)
> +{
> + return btf->sorted_start_id ?: (btf->start_id ?: 1);
> +}
> +
> /*
> * Assuming that types are sorted by name in ascending order.
> */
> @@ -3540,9 +3545,9 @@ const char *btf_find_decl_tag_value(const struct btf *btf, const struct btf_type
> {
> const char *value = NULL;
> const struct btf_type *t;
> - int len, id;
> + int len, id = btf->sorted_start_id > 0 ? btf->sorted_start_id - 1 : 0;
>
> - id = btf_find_next_decl_tag(btf, pt, comp_idx, tag_key, 0);
> + id = btf_find_next_decl_tag(btf, pt, comp_idx, tag_key, id);
Sorry, we should pass the sorted_start_id of the base BTF.
> if (id < 0)
> return ERR_PTR(id);
>
> @@ -7859,7 +7864,7 @@ int btf_prepare_func_args(struct bpf_verifier_env *env, int subprog)
> */
> for (i = 0; i < nargs; i++) {
> u32 tags = 0;
> - int id = 0;
> + int id = btf->sorted_start_id > 0 ? btf->sorted_start_id - 1 : 0;
Ditto.
>
> /* 'arg:<tag>' decl_tag takes precedence over derivation of
> * register type from BTF type itself
> @@ -9340,7 +9345,7 @@ bpf_core_find_cands(struct bpf_core_ctx *ctx, u32 local_type_id)
> }
>
> /* Attempt to find target candidates in vmlinux BTF first */
> - cands = bpf_core_add_cands(cands, main_btf, 1);
> + cands = bpf_core_add_cands(cands, main_btf, main_btf->sorted_start_id);
Invoke btf_sorted_start_id.
> if (IS_ERR(cands))
> return ERR_CAST(cands);
>
> @@ -9372,7 +9377,7 @@ bpf_core_find_cands(struct bpf_core_ctx *ctx, u32 local_type_id)
> */
> btf_get(mod_btf);
> spin_unlock_bh(&btf_idr_lock);
> - cands = bpf_core_add_cands(cands, mod_btf, btf_nr_types(main_btf));
> + cands = bpf_core_add_cands(cands, mod_btf, mod_btf->sorted_start_id);
> btf_put(mod_btf);
> if (IS_ERR(cands))
> return ERR_CAST(cands);
> diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> index f0ca69f888fa..2ae87075db6a 100644
> --- a/kernel/bpf/verifier.c
> +++ b/kernel/bpf/verifier.c
> @@ -20655,12 +20655,7 @@ static int find_btf_percpu_datasec(struct btf *btf)
> * types to look at only module's own BTF types.
> */
> n = btf_nr_types(btf);
> - if (btf_is_module(btf))
> - i = btf_nr_types(btf_vmlinux);
> - else
> - i = 1;
> -
> - for(; i < n; i++) {
> + for (i = btf_sorted_start_id(btf); i < n; i++) {
> t = btf_type_by_id(btf, i);
> if (BTF_INFO_KIND(t->info) != BTF_KIND_DATASEC)
> continue;
> --
> 2.34.1
>
© 2016 - 2026 Red Hat, Inc.