Re: [PATCH bpf-next v3 1/9] bpf: Support __arena and __arena_nullable kfunc argument suffixes
Amery Hung <[email protected]> Wed, 5 Aug 2026 10:07:03 -0700
| Newsgroups | org.kernel.vger.bpf |
|---|---|
| Message-ID | <CAMB2axNK=uzUQ9GYQo7gEGoyeet0pv4aJo4MKkjtO-FQjPBWDA@mail.gmail.com> |
On Wed, Aug 5, 2026 at 8:53 AM Kumar Kartikeya Dwivedi <[email protected]> wrote: > > On Tue Aug 4, 2026 at 7:42 PM CEST, Amery Hung wrote: > > On Mon, Aug 3, 2026 at 6:12 AM Kumar Kartikeya Dwivedi <[email protected]> wrote: > >> > >> From: Tejun Heo <[email protected]> > >> > >> Passing an arena pointer to a kfunc takes two steps today. There is no > >> arena pointer argument type, so the pointer crosses the boundary as a > >> bare scalar, and the kfunc then offsets it by the arena base and casts > >> it before it can touch the memory. Every such kfunc open-codes the same > >> translation. > >> > >> Add the __arena and __arena_nullable argument suffixes to make this more > >> convenient. The kfunc declares the parameter by its real pointer type > >> and dereferences it directly, with the JIT rebasing the value at the > >> call site, rN = kern_vm_start + (u32)rN. No bounds check is needed: the > >> u32 offset stays within the guard-padded arena kernel mapping, and a > >> fault on an unpopulated page recovers through the per-arena scratch > >> page. A suffixed argument accepts a PTR_TO_ARENA or scalar register, > >> matching global subprog arena arguments. > >> > >> __arena rebases unconditionally, so the kfunc never sees NULL and a > >> value with zero in the low 32 bits arrives as the arena base. > >> __arena_nullable preserves NULL for optional arguments by skipping the > >> rebase when the truncated value, arena offset 0, is zero. Keeping the > >> plain form NULL-free saves the NULL test on every call. > >> > >> This patch adds the verifier side: the suffixes are recognized in > >> check_kfunc_args() and distilled into argument flags in the function > >> model stored in the kfunc descriptor. JITs retrieve the model while > >> emitting the call, avoiding per-call state in insn_aux_data. > >> > >> JITs declare support with bpf_jit_supports_arena_args() and verification > >> fails with -ENOTSUPP elsewhere. > >> > >> Signed-off-by: Tejun Heo <[email protected]> > >> Co-developed-by: Kumar Kartikeya Dwivedi <[email protected]> > >> Signed-off-by: Kumar Kartikeya Dwivedi <[email protected]> > >> --- > >> Documentation/bpf/kfuncs.rst | 29 ++++++++++++++++++++++++++ > >> include/linux/bpf.h | 6 ++++++ > >> include/linux/filter.h | 1 + > >> kernel/bpf/btf.c | 18 +++++++++++++++- > >> kernel/bpf/core.c | 5 +++++ > >> kernel/bpf/verifier.c | 40 +++++++++++++++++++++++++++++++++++- > >> 6 files changed, 97 insertions(+), 2 deletions(-) > >> > >> diff --git a/Documentation/bpf/kfuncs.rst b/Documentation/bpf/kfuncs.rst > >> index cbde86d082cc..8e84484636c5 100644 > >> --- a/Documentation/bpf/kfuncs.rst > >> +++ b/Documentation/bpf/kfuncs.rst > >> @@ -278,6 +278,33 @@ An example is given below:: > >> ... > >> } > >> > >> +2.3.8 __arena and __arena_nullable Annotations > >> +---------------------------------------------- > >> + > >> +Both annotations indicate that the pointer argument points into the > >> +calling program's arena. The JIT rebases the value at the call site so > >> +the kfunc receives a directly dereferenceable kernel address, subject to > >> +the access rules described in :ref:`BPF_kfunc_arena_access` (at most > >> +``GUARD_SZ / 2``, 32 KiB, past the pointer in a single unchecked access). > >> + > >> +With ``__arena`` the rebase is unconditional and the argument is never > >> +NULL: a value whose lower 32 bits are zero arrives as the arena base > >> +address (arena offset 0). The kfunc must not check the argument for NULL. > >> +With ``__arena_nullable`` such a value arrives as NULL instead and the > >> +kfunc must check before dereferencing. > >> + > >> +An example is given below:: > >> + > >> + __bpf_kfunc int bpf_process_item(struct item *item__arena) > >> + { > >> + ... > >> + } > >> + > >> +Calling such a kfunc requires the program to use an arena map and a JIT with > >> +arena argument support (currently x86-64); verification fails otherwise. The > >> +program can pass any value without compromising the kernel. A value that does > >> +not point into the arena is a program bug. > >> + > >> .. _BPF_kfunc_nodef: > >> > >> 2.4 Using an existing kernel function > >> @@ -515,6 +542,8 @@ In order to accommodate such requirements, the verifier will enforce strict > >> PTR_TO_BTF_ID type matching if two types have the exact same name, with one > >> being suffixed with ``___init``. > >> > >> +.. _BPF_kfunc_arena_access: > >> + > >> 2.8 Accessing arena memory through kfunc arguments > >> -------------------------------------------------- > >> > >> diff --git a/include/linux/bpf.h b/include/linux/bpf.h > >> index 356884587ae1..6da8a6be930c 100644 > >> --- a/include/linux/bpf.h > >> +++ b/include/linux/bpf.h > >> @@ -1213,6 +1213,12 @@ struct bpf_prog_offload { > >> /* The argument is signed. */ > >> #define BTF_FMODEL_SIGNED_ARG BIT(1) > >> > >> +/* The argument is an arena pointer. */ > >> +#define BTF_FMODEL_ARENA_ARG BIT(2) > >> + > >> +/* The argument is nullable. */ > >> +#define BTF_FMODEL_NULLABLE_ARG BIT(3) > >> + > >> struct btf_func_model { > >> u8 ret_size; > >> u8 ret_flags; > >> diff --git a/include/linux/filter.h b/include/linux/filter.h > >> index 32d5297c557e..36ce3403fe59 100644 > >> --- a/include/linux/filter.h > >> +++ b/include/linux/filter.h > >> @@ -1183,6 +1183,7 @@ bool bpf_jit_supports_subprog_tailcalls(void); > >> bool bpf_jit_supports_percpu_insn(void); > >> bool bpf_jit_supports_kfunc_call(void); > >> bool bpf_jit_supports_stack_args(void); > >> +bool bpf_jit_supports_arena_args(void); > >> bool bpf_jit_supports_far_kfunc_call(void); > >> bool bpf_jit_supports_exceptions(void); > >> bool bpf_jit_supports_ptr_xchg(void); > >> diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c > >> index 5e8ac45ce56a..bf86df91a70b 100644 > >> --- a/kernel/bpf/btf.c > >> +++ b/kernel/bpf/btf.c > >> @@ -7541,6 +7541,22 @@ static u8 __get_type_fmodel_flags(const struct btf_type *t) > >> return flags; > >> } > >> > >> +static u8 __get_arg_fmodel_flags(const struct btf *btf, > >> + const struct btf_param *arg, > >> + const struct btf_type *t) > >> +{ > >> + u8 flags = __get_type_fmodel_flags(t); > >> + > >> + if (btf_param_match_suffix(btf, arg, "__arena") || > >> + btf_param_match_suffix(btf, arg, "__arena_nullable")) > >> + flags |= BTF_FMODEL_ARENA_ARG; > >> + if (btf_param_match_suffix(btf, arg, "__nullable") || > >> + btf_param_match_suffix(btf, arg, "__arena_nullable")) > >> + flags |= BTF_FMODEL_NULLABLE_ARG; > >> + > >> + return flags; > >> +} > >> + > >> int btf_distill_func_proto(struct bpf_verifier_log *log, > >> struct btf *btf, > >> const struct btf_type *func, > >> @@ -7606,7 +7622,7 @@ int btf_distill_func_proto(struct bpf_verifier_log *log, > >> return -EINVAL; > >> } > >> m->arg_size[i] = ret; > >> - m->arg_flags[i] = __get_type_fmodel_flags(t); > >> + m->arg_flags[i] = __get_arg_fmodel_flags(btf, &args[i], t); > >> } > >> m->nr_args = nargs; > >> return 0; > >> diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c > >> index e2076667b245..a3e1fae32eac 100644 > >> --- a/kernel/bpf/core.c > >> +++ b/kernel/bpf/core.c > >> @@ -3308,6 +3308,11 @@ bool __weak bpf_jit_supports_stack_args(void) > >> return false; > >> } > >> > >> +bool __weak bpf_jit_supports_arena_args(void) > >> +{ > >> + return false; > >> +} > >> + > >> bool __weak bpf_jit_supports_far_kfunc_call(void) > >> { > >> return false; > >> diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c > >> index b274004fccfd..4c50237f49f1 100644 > >> --- a/kernel/bpf/verifier.c > >> +++ b/kernel/bpf/verifier.c > >> @@ -10907,6 +10907,16 @@ static bool is_kfunc_arg_irq_flag(const struct btf *btf, const struct btf_param > >> return btf_param_match_suffix(btf, arg, "__irq_flag"); > >> } > >> > >> +static bool is_kfunc_arg_arena(const struct btf *btf, const struct btf_param *arg) > >> +{ > >> + return btf_param_match_suffix(btf, arg, "__arena"); > >> +} > >> + > >> +static bool is_kfunc_arg_arena_nullable(const struct btf *btf, const struct btf_param *arg) > >> +{ > >> + return btf_param_match_suffix(btf, arg, "__arena_nullable"); > >> +} > >> + > > > > From the verifier's point of view, __arena and __arena_nullable all > > maps to KF_ARG_PTR_TO_ARENA and require the same check so maybe > > is_kfunc_arg_arena() alone with two suffix matching is good enough, > > but it also doesn't hurt to have two separated functions. > > > >> static bool is_kfunc_arg_scalar_with_name(const struct btf *btf, > >> const struct btf_param *arg, > >> const char *name) > >> @@ -11127,6 +11137,7 @@ enum kfunc_ptr_arg_type { > >> KF_ARG_PTR_TO_IRQ_FLAG, > >> KF_ARG_PTR_TO_RES_SPIN_LOCK, > >> KF_ARG_PTR_TO_TASK_WORK, > >> + KF_ARG_PTR_TO_ARENA, > >> }; > >> > >> enum special_kfunc_type { > >> @@ -11412,7 +11423,6 @@ get_kfunc_arg_type(struct bpf_verifier_env *env, struct bpf_call_arg_meta *meta, > >> reg_arg_name(env, argno), btf_type_str(t)); > >> return -EINVAL; > >> } > >> - > >> ref_t = btf_type_skip_modifiers(meta->btf, t->type, NULL); > >> ref_tname = btf_name_by_offset(meta->btf, ref_t->name_off); > >> > >> @@ -11461,6 +11471,9 @@ get_kfunc_arg_type(struct bpf_verifier_env *env, struct bpf_call_arg_meta *meta, > >> arg_type = KF_ARG_PTR_TO_RES_SPIN_LOCK; > >> else if (is_kfunc_arg_callback(env, meta->btf, &args[arg])) > >> arg_type = KF_ARG_PTR_TO_CALLBACK; > >> + else if (is_kfunc_arg_arena(meta->btf, &args[arg]) || > >> + is_kfunc_arg_arena_nullable(meta->btf, &args[arg])) > >> + arg_type = KF_ARG_PTR_TO_ARENA; > >> else if (arg + 1 < nargs && > >> (is_kfunc_arg_mem_size(meta->btf, &args[arg + 1]) || > >> is_kfunc_arg_const_mem_size(meta->btf, &args[arg + 1]))) { > >> @@ -12154,6 +12167,31 @@ static int check_kfunc_args(struct bpf_verifier_env *env, struct bpf_call_arg_me > >> > >> t = btf_type_skip_modifiers(btf, args[i].type, NULL); > >> > >> + if (base_type(kf_arg_type) == KF_ARG_PTR_TO_ARENA) { > >> + if (!bpf_jit_supports_arena_args()) { > >> + verbose(env, "JIT does not support kfunc %s() with arena pointer arguments\n", > >> + func_name); > >> + return -ENOTSUPP; > >> + } > > > > nit: JIT and register-based arg check can be done earlier in > > get_kfunc_arg_type(). We probably will want a consolidated pass > > validating bpf_func_proto. > > > > I moved it up there. We still have prog aux argument doing stack argument > rejection later, but I will let you figure out the right placement when you > rework these bits. Sounds good to me. The placement is not really a blocker. > > Only thing left here now is the register type check. > > >> + if (!env->prog->aux->arena) { > >> + verbose(env, > >> + "%s arena pointer requires a program with an associated arena\n", > >> + reg_arg_name(env, argno)); > >> + return -EINVAL; > >> + } > >> + if (regno < 0) { > >> + verbose(env, "%s arena pointer cannot be a stack argument\n", > >> + reg_arg_name(env, argno)); > >> + return -EINVAL; > >> + } > >> + if (reg->type != PTR_TO_ARENA && reg->type != SCALAR_VALUE) { > >> + verbose(env, "%s is not a pointer to arena or scalar\n", > >> + reg_arg_name(env, argno)); > >> + return -EINVAL; > >> + } > >> + continue; > >> + } > >> + > > > > Can we move arena argument checking to the second switch case below? > > It only takes adding one condition below. > > > > This help reduce churn in the future when check_kfunc_args() also > > receieve check_reg_type(). > > > >> if (btf_type_is_ptr(t) && (bpf_register_is_null(reg) || type_may_be_null(reg->type)) && > >> !is_kfunc_arg_nullable(meta->btf, &args[i])) { > >> verbose(env, "Possibly NULL pointer passed to trusted %s\n", > > > > if (btf_type_is_ptr(t) && base_type(kf_arg_type) != KF_ARG_PTR_TO_ARENA && > > (bpf_register_is_null(reg) || type_may_be_null(reg->type)) && > > !type_may_be_null(kf_arg_type)) { > > verbose(env, "Possibly NULL pointer passed to trusted %s\n", > > > > > > To simplify this and avoid special casing, I changed the kf_arg_type to > KF_ARG_PTR_TO_ARENA | PTR_MAYBE_NULL, since known NULL is kosher for both cases > and we place no static constraints on the precise value. Make sense. Thanks for tweaking it!