fix(loader): patch kfunc calls in .text subroutines, not just xdp section

Alpha.18 emits verify_ping_token and verify_session_header as #[inline(never)]
BPF subroutines, placing them in the .text section with their kfunc calls
relocated via .rel.text. The previous loader only walked .relxdp and patched
the xdp section, so kfunc calls inside .text retained src_reg=1 (BPF_PSEUDO_CALL)
with imm=-1. aya-obj's relocate_calls() then treated them as BPF-to-BPF calls
with self-referential pc-relative targets, causing:
    error relocating verify_ping_token
    function 0x18 not found while relocating ...
(0x18 = 24 = byte offset of the first call instruction in the function.)
Fix:
- code_relocation_tables(): new helper enumerating every code section (xdp,
  .text, .text.*) and its sibling .rel<section> table. patch_elf_skip_kfuncs,
  patch_elf_bpf_helpers, and patch_elf_map_fds now iterate all of them.
- patch_elf_skip_kfuncs: in addition to flipping src_reg 1->2, encodes the
  kfunc index (position in RELAY_MODULE_KFUNCS) into the imm field.
- patch_kfunc_instructions: identifies each src_reg=2 call by reading imm
  back as the kfunc index, instead of zipping by ELF byte offset against
  positional ordering. Robust against aya inlining .text subroutines after
  the xdp program (which invalidates the previous offset-sorted assumption).
- collect_kfunc_offsets: returns Vec<(section_name, offset, name)> across
  all code sections for diagnostic logging.
Verified against relay_xdp_rust.o: .rel.text contains 3 bpf_relay_sha256
relocations (0x18 + 0xb0 in verify_ping_token, 0x128 in verify_session_header),
all of which are now patched. Binary builds and clippy clean for relay-xdp.
Pre-existing relay-backend warnings unrelated.

Author: brianph

relay-xdp/src/bpf.rs

@@ -105,16 +105,18 @@ impl BpfContext {
         let elf_bytes = std::fs::read(xdp_obj_path)
             .with_context(|| format!("failed to read BPF ELF from {}", xdp_obj_path.display()))?;
 
-        // --- Step 2: Collect kfunc offsets and patch ELF (src_reg 1->2) ---
-        let kfunc_offsets = collect_kfunc_offsets(&elf_bytes, RELAY_MODULE_KFUNCS)
+        // --- Step 2: Patch kfunc call sites in all code sections (xdp + .text*) ---
+        // src_reg 1 -> 2 and encode kfunc index in imm. Walks .relxdp + .rel.text*
+        // because BPF subroutines marked #[inline(never)] (e.g. verify_ping_token)
+        // live in .text and contain kfunc calls of their own.
+        let kfunc_sites = collect_kfunc_offsets(&elf_bytes, RELAY_MODULE_KFUNCS)
             .context("failed to collect kfunc offsets from ELF")?;
         info!(
             "Found {} kfunc call sites in ELF for {:?}",
-            kfunc_offsets.len(),
+            kfunc_sites.len(),
             RELAY_MODULE_KFUNCS
         );
-
-        let patched_v1 = patch_elf_skip_kfuncs(&elf_bytes, &kfunc_offsets)
+        let patched_v1 = patch_elf_skip_kfuncs(&elf_bytes, RELAY_MODULE_KFUNCS)
             .context("failed to patch kfunc src_reg in ELF")?;
 
         // --- Step 2b: Patch standard BPF helper calls (src_reg 1->0, imm -> helper ID) ---
@@ -154,11 +156,13 @@ impl BpfContext {
         info!("BTF type IDs: {:?}", btf_ids);
 
         // --- Step 8: Patch kfunc instructions with BTF IDs ---
+        // Identifies each src_reg=2 call by reading the kfunc index encoded in
+        // imm during step 2 - robust against aya's relocation reordering.
         patch_kfunc_instructions(
             &mut insns,
-            &kfunc_offsets,
+            RELAY_MODULE_KFUNCS,
             &btf_ids,
-            1, // fd_array index 1: kernel uses fd_array[off-1] = fd_array[0] = btf_fd
+            1, // fd_array index 1: kernel reads fd_array[off] = fd_array[1] = btf_fd
         )
         .context("failed to patch kfunc instructions")?;