Re: [PATCH bpf-next v3 1/9] bpf: Support __arena and __arena_nullable kfunc argument suffixes

"Kumar Kartikeya Dwivedi" <[email protected]> Wed, 05 Aug 2026 19:16:28 +0200
Newsgroups org.kernel.vger.bpf
Message-ID <[email protected]>
On Wed Aug 5, 2026 at 7:07 PM CEST, Amery Hung wrote:
> On Wed, Aug 5, 2026 at 8:53 AM Kumar Kartikeya Dwivedi <[email protected]> wrote:
>>
>> On Tue Aug 4, 2026 at 7:42 PM CEST, Amery Hung wrote:
>> > On Mon, Aug 3, 2026 at 6:12 AM Kumar Kartikeya Dwivedi <[email protected]> wrote:
>> >>
>> >> From: Tejun Heo <[email protected]>
>> >>
>> >> Passing an arena pointer to a kfunc takes two steps today. There is no
>> >> arena pointer argument type, so the pointer crosses the boundary as a
>> >> bare scalar, and the kfunc then offsets it by the arena base and casts
>> >> it before it can touch the memory. Every such kfunc open-codes the same
>> >> translation.
>> >>
>> >> Add the __arena and __arena_nullable argument suffixes to make this more
>> >> convenient. The kfunc declares the parameter by its real pointer type
>> >> and dereferences it directly, with the JIT rebasing the value at the
>> >> call site, rN = kern_vm_start + (u32)rN. No bounds check is needed: the
>> >> u32 offset stays within the guard-padded arena kernel mapping, and a
>> >> fault on an unpopulated page recovers through the per-arena scratch
>> >> page. A suffixed argument accepts a PTR_TO_ARENA or scalar register,
>> >> matching global subprog arena arguments.
>> >>
>> >> __arena rebases unconditionally, so the kfunc never sees NULL and a
>> >> value with zero in the low 32 bits arrives as the arena base.
>> >> __arena_nullable preserves NULL for optional arguments by skipping the
>> >> rebase when the truncated value, arena offset 0, is zero. Keeping the
>> >> plain form NULL-free saves the NULL test on every call.
>> >>
>> >> This patch adds the verifier side: the suffixes are recognized in
>> >> check_kfunc_args() and distilled into argument flags in the function
>> >> model stored in the kfunc descriptor. JITs retrieve the model while
>> >> emitting the call, avoiding per-call state in insn_aux_data.
>> >>
>> >> JITs declare support with bpf_jit_supports_arena_args() and verification
>> >> fails with -ENOTSUPP elsewhere.
>> >>
>> >> Signed-off-by: Tejun Heo <[email protected]>
>> >> Co-developed-by: Kumar Kartikeya Dwivedi <[email protected]>
>> >> Signed-off-by: Kumar Kartikeya Dwivedi <[email protected]>
>> >> ---
>> >>  Documentation/bpf/kfuncs.rst | 29 ++++++++++++++++++++++++++
>> >>  include/linux/bpf.h          |  6 ++++++
>> >>  include/linux/filter.h       |  1 +
>> >>  kernel/bpf/btf.c             | 18 +++++++++++++++-
>> >>  kernel/bpf/core.c            |  5 +++++
>> >>  kernel/bpf/verifier.c        | 40 +++++++++++++++++++++++++++++++++++-
>> >>  6 files changed, 97 insertions(+), 2 deletions(-)
>> >>
>> >> diff --git a/Documentation/bpf/kfuncs.rst b/Documentation/bpf/kfuncs.rst
>> >> index cbde86d082cc..8e84484636c5 100644
>> >> --- a/Documentation/bpf/kfuncs.rst
>> >> +++ b/Documentation/bpf/kfuncs.rst
>> >> @@ -278,6 +278,33 @@ An example is given below::
>> >>                  ...
>> >>          }
>> >>
>> >> +2.3.8 __arena and __arena_nullable Annotations
>> >> +----------------------------------------------
>> >> +
>> >> +Both annotations indicate that the pointer argument points into the
>> >> +calling program's arena. The JIT rebases the value at the call site so
>> >> +the kfunc receives a directly dereferenceable kernel address, subject to
>> >> +the access rules described in :ref:`BPF_kfunc_arena_access` (at most
>> >> +``GUARD_SZ / 2``, 32 KiB, past the pointer in a single unchecked access).
>> >> +
>> >> +With ``__arena`` the rebase is unconditional and the argument is never
>> >> +NULL: a value whose lower 32 bits are zero arrives as the arena base
>> >> +address (arena offset 0). The kfunc must not check the argument for NULL.
>> >> +With ``__arena_nullable`` such a value arrives as NULL instead and the
>> >> +kfunc must check before dereferencing.
>> >> +
>> >> +An example is given below::
>> >> +
>> >> +        __bpf_kfunc int bpf_process_item(struct item *item__arena)
>> >> +        {
>> >> +        ...
>> >> +        }
>> >> +
>> >> +Calling such a kfunc requires the program to use an arena map and a JIT with
>> >> +arena argument support (currently x86-64); verification fails otherwise. The
>> >> +program can pass any value without compromising the kernel. A value that does
>> >> +not point into the arena is a program bug.
>> >> +
>> >>  .. _BPF_kfunc_nodef:
>> >>
>> >>  2.4 Using an existing kernel function
>> >> @@ -515,6 +542,8 @@ In order to accommodate such requirements, the verifier will enforce strict
>> >>  PTR_TO_BTF_ID type matching if two types have the exact same name, with one
>> >>  being suffixed with ``___init``.
>> >>
>> >> +.. _BPF_kfunc_arena_access:
>> >> +
>> >>  2.8 Accessing arena memory through kfunc arguments
>> >>  --------------------------------------------------
>> >>
>> >> diff --git a/include/linux/bpf.h b/include/linux/bpf.h
>> >> index 356884587ae1..6da8a6be930c 100644
>> >> --- a/include/linux/bpf.h
>> >> +++ b/include/linux/bpf.h
>> >> @@ -1213,6 +1213,12 @@ struct bpf_prog_offload {
>> >>  /* The argument is signed. */
>> >>  #define BTF_FMODEL_SIGNED_ARG          BIT(1)
>> >>
>> >> +/* The argument is an arena pointer. */
>> >> +#define BTF_FMODEL_ARENA_ARG           BIT(2)
>> >> +
>> >> +/* The argument is nullable. */
>> >> +#define BTF_FMODEL_NULLABLE_ARG                BIT(3)
>> >> +
>> >>  struct btf_func_model {
>> >>         u8 ret_size;
>> >>         u8 ret_flags;
>> >> diff --git a/include/linux/filter.h b/include/linux/filter.h
>> >> index 32d5297c557e..36ce3403fe59 100644
>> >> --- a/include/linux/filter.h
>> >> +++ b/include/linux/filter.h
>> >> @@ -1183,6 +1183,7 @@ bool bpf_jit_supports_subprog_tailcalls(void);
>> >>  bool bpf_jit_supports_percpu_insn(void);
>> >>  bool bpf_jit_supports_kfunc_call(void);
>> >>  bool bpf_jit_supports_stack_args(void);
>> >> +bool bpf_jit_supports_arena_args(void);
>> >>  bool bpf_jit_supports_far_kfunc_call(void);
>> >>  bool bpf_jit_supports_exceptions(void);
>> >>  bool bpf_jit_supports_ptr_xchg(void);
>> >> diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c
>> >> index 5e8ac45ce56a..bf86df91a70b 100644
>> >> --- a/kernel/bpf/btf.c
>> >> +++ b/kernel/bpf/btf.c
>> >> @@ -7541,6 +7541,22 @@ static u8 __get_type_fmodel_flags(const struct btf_type *t)
>> >>         return flags;
>> >>  }
>> >>
>> >> +static u8 __get_arg_fmodel_flags(const struct btf *btf,
>> >> +                                const struct btf_param *arg,
>> >> +                                const struct btf_type *t)
>> >> +{
>> >> +       u8 flags = __get_type_fmodel_flags(t);
>> >> +
>> >> +       if (btf_param_match_suffix(btf, arg, "__arena") ||
>> >> +           btf_param_match_suffix(btf, arg, "__arena_nullable"))
>> >> +               flags |= BTF_FMODEL_ARENA_ARG;
>> >> +       if (btf_param_match_suffix(btf, arg, "__nullable") ||
>> >> +           btf_param_match_suffix(btf, arg, "__arena_nullable"))
>> >> +               flags |= BTF_FMODEL_NULLABLE_ARG;
>> >> +
>> >> +       return flags;
>> >> +}
>> >> +
>> >>  int btf_distill_func_proto(struct bpf_verifier_log *log,
>> >>                            struct btf *btf,
>> >>                            const struct btf_type *func,
>> >> @@ -7606,7 +7622,7 @@ int btf_distill_func_proto(struct bpf_verifier_log *log,
>> >>                         return -EINVAL;
>> >>                 }
>> >>                 m->arg_size[i] = ret;
>> >> -               m->arg_flags[i] = __get_type_fmodel_flags(t);
>> >> +               m->arg_flags[i] = __get_arg_fmodel_flags(btf, &args[i], t);
>> >>         }
>> >>         m->nr_args = nargs;
>> >>         return 0;
>> >> diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c
>> >> index e2076667b245..a3e1fae32eac 100644
>> >> --- a/kernel/bpf/core.c
>> >> +++ b/kernel/bpf/core.c
>> >> @@ -3308,6 +3308,11 @@ bool __weak bpf_jit_supports_stack_args(void)
>> >>         return false;
>> >>  }
>> >>
>> >> +bool __weak bpf_jit_supports_arena_args(void)
>> >> +{
>> >> +       return false;
>> >> +}
>> >> +
>> >>  bool __weak bpf_jit_supports_far_kfunc_call(void)
>> >>  {
>> >>         return false;
>> >> diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
>> >> index b274004fccfd..4c50237f49f1 100644
>> >> --- a/kernel/bpf/verifier.c
>> >> +++ b/kernel/bpf/verifier.c
>> >> @@ -10907,6 +10907,16 @@ static bool is_kfunc_arg_irq_flag(const struct btf *btf, const struct btf_param
>> >>         return btf_param_match_suffix(btf, arg, "__irq_flag");
>> >>  }
>> >>
>> >> +static bool is_kfunc_arg_arena(const struct btf *btf, const struct btf_param *arg)
>> >> +{
>> >> +       return btf_param_match_suffix(btf, arg, "__arena");
>> >> +}
>> >> +
>> >> +static bool is_kfunc_arg_arena_nullable(const struct btf *btf, const struct btf_param *arg)
>> >> +{
>> >> +       return btf_param_match_suffix(btf, arg, "__arena_nullable");
>> >> +}
>> >> +
>> >
>> > From the verifier's point of view, __arena and __arena_nullable all
>> > maps to KF_ARG_PTR_TO_ARENA and require the same check so maybe
>> > is_kfunc_arg_arena() alone with two suffix matching is good enough,
>> > but it also doesn't hurt to have two separated functions.
>> >
>> >>  static bool is_kfunc_arg_scalar_with_name(const struct btf *btf,
>> >>                                           const struct btf_param *arg,
>> >>                                           const char *name)
>> >> @@ -11127,6 +11137,7 @@ enum kfunc_ptr_arg_type {
>> >>         KF_ARG_PTR_TO_IRQ_FLAG,
>> >>         KF_ARG_PTR_TO_RES_SPIN_LOCK,
>> >>         KF_ARG_PTR_TO_TASK_WORK,
>> >> +       KF_ARG_PTR_TO_ARENA,
>> >>  };
>> >>
>> >>  enum special_kfunc_type {
>> >> @@ -11412,7 +11423,6 @@ get_kfunc_arg_type(struct bpf_verifier_env *env, struct bpf_call_arg_meta *meta,
>> >>                         reg_arg_name(env, argno), btf_type_str(t));
>> >>                 return -EINVAL;
>> >>         }
>> >> -
>> >>         ref_t = btf_type_skip_modifiers(meta->btf, t->type, NULL);
>> >>         ref_tname = btf_name_by_offset(meta->btf, ref_t->name_off);
>> >>
>> >> @@ -11461,6 +11471,9 @@ get_kfunc_arg_type(struct bpf_verifier_env *env, struct bpf_call_arg_meta *meta,
>> >>                 arg_type = KF_ARG_PTR_TO_RES_SPIN_LOCK;
>> >>         else if (is_kfunc_arg_callback(env, meta->btf, &args[arg]))
>> >>                 arg_type = KF_ARG_PTR_TO_CALLBACK;
>> >> +       else if (is_kfunc_arg_arena(meta->btf, &args[arg]) ||
>> >> +                is_kfunc_arg_arena_nullable(meta->btf, &args[arg]))
>> >> +               arg_type = KF_ARG_PTR_TO_ARENA;
>> >>         else if (arg + 1 < nargs &&
>> >>                  (is_kfunc_arg_mem_size(meta->btf, &args[arg + 1]) ||
>> >>                   is_kfunc_arg_const_mem_size(meta->btf, &args[arg + 1]))) {
>> >> @@ -12154,6 +12167,31 @@ static int check_kfunc_args(struct bpf_verifier_env *env, struct bpf_call_arg_me
>> >>
>> >>                 t = btf_type_skip_modifiers(btf, args[i].type, NULL);
>> >>
>> >> +               if (base_type(kf_arg_type) == KF_ARG_PTR_TO_ARENA) {
>> >> +                       if (!bpf_jit_supports_arena_args()) {
>> >> +                               verbose(env, "JIT does not support kfunc %s() with arena pointer arguments\n",
>> >> +                                       func_name);
>> >> +                               return -ENOTSUPP;
>> >> +                       }
>> >
>> > nit: JIT and register-based arg check can be done earlier in
>> > get_kfunc_arg_type(). We probably will want a consolidated pass
>> > validating bpf_func_proto.
>> >
>>
>> I moved it up there. We still have prog aux argument doing stack argument
>> rejection later, but I will let you figure out the right placement when you
>> rework these bits.
>
> Sounds good to me. The placement is not really a blocker.
>
>>
>> Only thing left here now is the register type check.
>>
>> >> +                       if (!env->prog->aux->arena) {
>> >> +                               verbose(env,
>> >> +                                       "%s arena pointer requires a program with an associated arena\n",
>> >> +                                       reg_arg_name(env, argno));
>> >> +                               return -EINVAL;
>> >> +                       }
>> >> +                       if (regno < 0) {
>> >> +                               verbose(env, "%s arena pointer cannot be a stack argument\n",
>> >> +                                       reg_arg_name(env, argno));
>> >> +                               return -EINVAL;
>> >> +                       }
>> >> +                       if (reg->type != PTR_TO_ARENA && reg->type != SCALAR_VALUE) {
>> >> +                               verbose(env, "%s is not a pointer to arena or scalar\n",
>> >> +                                       reg_arg_name(env, argno));
>> >> +                               return -EINVAL;
>> >> +                       }
>> >> +                       continue;
>> >> +               }
>> >> +
>> >
>> > Can we move arena argument checking to the second switch case below?
>> > It only takes adding one condition below.
>> >
>> > This help reduce churn in the future when check_kfunc_args() also
>> > receieve check_reg_type().
>> >
>> >>                 if (btf_type_is_ptr(t) && (bpf_register_is_null(reg) || type_may_be_null(reg->type)) &&
>> >>                     !is_kfunc_arg_nullable(meta->btf, &args[i])) {
>> >>                         verbose(env, "Possibly NULL pointer passed to trusted %s\n",
>> >
>> >   if (btf_type_is_ptr(t) && base_type(kf_arg_type) != KF_ARG_PTR_TO_ARENA &&
>> >       (bpf_register_is_null(reg) || type_may_be_null(reg->type)) &&
>> >       !type_may_be_null(kf_arg_type)) {
>> >           verbose(env, "Possibly NULL pointer passed to trusted %s\n",
>> >
>> >
>>
>> To simplify this and avoid special casing, I changed the kf_arg_type to
>> KF_ARG_PTR_TO_ARENA | PTR_MAYBE_NULL, since known NULL is kosher for both cases
>> and we place no static constraints on the precise value.
>
> Make sense. Thanks for tweaking it!

Actually, I realized env->prog->aux->arena is not resolved when
get_kfunc_arg_type() is called. In general, this feels like an accidental side
effect of the ordering of phases, so I decided to tweak it (move add_kfunc() in
add_subprogs_and_kfuncs() out and before check_and_resolve_insns()).

This should make assumptions inside that function much simpler, and avoid such
footguns.

It should be a noop functionally, and hopefully more clear ordering of various
checks. I prepended those NFC patches to the set, and we can discuss the details
in the next version.