quoted

-static int bpf_core_apply_relo(struct bpf_program *prog,
-                              const struct bpf_core_relo *relo,
-                              int relo_idx,
-                              const struct btf *local_btf,
-                              struct hashmap *cand_cache)
+static int bpf_core_calc_relo_res(struct bpf_program *prog,

bpf_core_calc_relo_res is almost indistinguishable from
bpf_core_calc_relo... Let's call this one bpf_core_resolve_relo()?

That's a much better name! Deciding the name of that function was
probably the most complicated part of this patch.

quoted

@@ -5636,12 +5627,31 @@ bpf_object__relocate_core(struct bpf_object *obj, const char *targ_btf_path)
                        if (!prog->load)
                                continue;

-                       err = bpf_core_apply_relo(prog, rec, i, obj->btf, cand_cache);
+                       err = bpf_core_calc_relo_res(prog, rec, i, obj->btf, cand_cache, &targ_res);
                        if (err) {
                                pr_warn("prog '%s': relo #%d: failed to relocate: %d\n",
                                        prog->name, i, err);
                                goto out;
                        }
+
+                       if (rec->insn_off % BPF_INSN_SZ)
+                               return -EINVAL;
+                       insn_idx = rec->insn_off / BPF_INSN_SZ;
+                       /* adjust insn_idx from section frame of reference to the local
+                        * program's frame of reference; (sub-)program code is not yet
+                        * relocated, so it's enough to just subtract in-section offset
+                        */
+                       insn_idx = insn_idx - prog->sec_insn_off;
+                       if (insn_idx >= prog->insns_cnt)
+                               return -EINVAL;
+                       insn = &prog->insns[insn_idx];

this is sort of like sanity checks, let's do them before the core_calc
step, so after that it's a clean sequence of calc_relo + pathc_insn?

Makes sense.

quoted

@@ -1177,18 +1152,18 @@ static void bpf_core_dump_spec(const char *prog_name, int level, const struct bp
  *    between multiple relocations for the same type ID and is updated as some
  *    of the candidates are pruned due to structural incompatibility.
  */
-int bpf_core_apply_relo_insn(const char *prog_name, struct bpf_insn *insn,
-                            int insn_idx,
-                            const struct bpf_core_relo *relo,
-                            int relo_idx,
-                            const struct btf *local_btf,
-                            struct bpf_core_cand_list *cands,
-                            struct bpf_core_spec *specs_scratch)
+int bpf_core_calc_relo_insn(const char *prog_name,

please update the comment for this function, it's not "CO-RE relocate
single instruction" anymore, it's more like "Calculate CO-RE
relocation target result" or something along those lines.

Updated with your suggestion.

quoted

@@ -1223,12 +1198,12 @@ int bpf_core_apply_relo_insn(const char *prog_name, struct bpf_insn *insn,
        /* TYPE_ID_LOCAL relo is special and doesn't need candidate search */
        if (relo->kind == BPF_CORE_TYPE_ID_LOCAL) {
                /* bpf_insn's imm value could get out of sync during linking */
-               memset(&targ_res, 0, sizeof(targ_res));
-               targ_res.validate = false;
-               targ_res.poison = false;
-               targ_res.orig_val = local_spec->root_type_id;
-               targ_res.new_val = local_spec->root_type_id;
-               goto patch_insn;
+               memset(targ_res, 0, sizeof(*targ_res));
+               targ_res->validate = true;

hm.. original code sets it to false here, please don't regress the logic

ops, I introduced this by mistake while rebasing.