Re: [PATCH bpf-next v4 04/13] bpf: Support __arena and __arena__nullable kfunc argument suffixes

On Wed, Aug 5, 2026 at 2:05 PM Kumar Kartikeya Dwivedi <[email protected]> wrote:
>
> From: Tejun Heo <[email protected]>
>
> Passing an arena pointer to a kfunc takes two steps today. There is no
> arena pointer argument type, so the pointer crosses the boundary as a
> bare scalar, and the kfunc then offsets it by the arena base and casts
> it before it can touch the memory. Every such kfunc open-codes the same
> translation.
>
> Add the __arena and __arena__nullable argument suffixes to make this more
> convenient. The kfunc declares the parameter by its real pointer type
> and dereferences it directly, with the JIT rebasing the value at the
> call site, rN = kern_vm_start + (u32)rN. No bounds check is needed: the
> u32 offset stays within the guard-padded arena kernel mapping, and a
> fault on an unpopulated page recovers through the per-arena scratch
> page. A suffixed argument accepts a PTR_TO_ARENA or scalar register,
> matching global subprog arena arguments.
>
> __arena rebases unconditionally, so the kfunc never sees NULL and a
> value with zero in the low 32 bits arrives as the arena base.
> __arena__nullable preserves NULL for optional arguments by skipping the
> rebase when the truncated value, arena offset 0, is zero. Keeping the
> plain form NULL-free saves the NULL test on every call.
>
> The double separator makes the annotations composable:
> __arena__nullable also ends in __nullable. Match the composite suffix
> first when classifying kfunc arguments and function-model flags so it
> retains arena semantics while carrying the nullable flag.

Since __arena__nullable will match is_kfunc_arg_arena() case and go
through JIT + regno check, and get its PTR_MAYBE_NULL anyway. How
about just keep it as __arena_nullable to simplify the patch?

1. No need to introudce is_kfunc_arg_arena_nullable() and changes in
is_kfunc_arg_nullable()
2. is_kfunc_arg_arena() returns btf_param_match_suffix(btf, arg,
"__arena_nullable") || btf_param_match_suffix(btf, arg, "__arena");

[...]

> diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> index b62e77949542..2b7f6f6bbe76 100644
> --- a/kernel/bpf/verifier.c
> +++ b/kernel/bpf/verifier.c
> @@ -10909,9 +10909,16 @@ static bool is_kfunc_arg_refcounted_kptr(const struct btf *btf, const struct btf
>         return btf_param_match_suffix(btf, arg, "__refcounted_kptr");
>  }
>
> +static bool is_kfunc_arg_arena_nullable(const struct btf *btf,
> +                                       const struct btf_param *arg)
> +{
> +       return btf_param_match_suffix(btf, arg, "__arena__nullable");
> +}
> +
>  static bool is_kfunc_arg_nullable(const struct btf *btf, const struct btf_param *arg)
>  {
> -       return btf_param_match_suffix(btf, arg, "__nullable");
> +       return !is_kfunc_arg_arena_nullable(btf, arg) &&
> +              btf_param_match_suffix(btf, arg, "__nullable");
>  }

No need for the changes above.

>
>  static bool is_kfunc_arg_nonown_allowed(const struct btf *btf, const struct btf_param *arg)
> @@ -10929,6 +10936,12 @@ static bool is_kfunc_arg_irq_flag(const struct btf *btf, const struct btf_param
>         return btf_param_match_suffix(btf, arg, "__irq_flag");
>  }
>
> +static bool is_kfunc_arg_arena(const struct btf *btf, const struct btf_param *arg)
> +{
> +       return is_kfunc_arg_arena_nullable(btf, arg) ||
> +              btf_param_match_suffix(btf, arg, "__arena");

return btf_param_match_suffix(btf, arg, "__arena_nullable") ||
        btf_param_match_suffix(btf, arg, "__arena");

[...]