Re: [PATCH bpf-next v4 04/13] bpf: Support __arena and __arena__nullable kfunc argument suffixes

On Thu Aug 6, 2026 at 7:22 PM CEST, Amery Hung wrote:
> On Wed, Aug 5, 2026 at 2:05 PM Kumar Kartikeya Dwivedi <[email protected]> wrote:
>>
>> From: Tejun Heo <[email protected]>
>>
>> Passing an arena pointer to a kfunc takes two steps today. There is no
>> arena pointer argument type, so the pointer crosses the boundary as a
>> bare scalar, and the kfunc then offsets it by the arena base and casts
>> it before it can touch the memory. Every such kfunc open-codes the same
>> translation.
>>
>> Add the __arena and __arena__nullable argument suffixes to make this more
>> convenient. The kfunc declares the parameter by its real pointer type
>> and dereferences it directly, with the JIT rebasing the value at the
>> call site, rN = kern_vm_start + (u32)rN. No bounds check is needed: the
>> u32 offset stays within the guard-padded arena kernel mapping, and a
>> fault on an unpopulated page recovers through the per-arena scratch
>> page. A suffixed argument accepts a PTR_TO_ARENA or scalar register,
>> matching global subprog arena arguments.
>>
>> __arena rebases unconditionally, so the kfunc never sees NULL and a
>> value with zero in the low 32 bits arrives as the arena base.
>> __arena__nullable preserves NULL for optional arguments by skipping the
>> rebase when the truncated value, arena offset 0, is zero. Keeping the
>> plain form NULL-free saves the NULL test on every call.
>>
>> The double separator makes the annotations composable:
>> __arena__nullable also ends in __nullable. Match the composite suffix
>> first when classifying kfunc arguments and function-model flags so it
>> retains arena semantics while carrying the nullable flag.
>
> Since __arena__nullable will match is_kfunc_arg_arena() case and go
> through JIT + regno check, and get its PTR_MAYBE_NULL anyway. How
> about just keep it as __arena_nullable to simplify the patch?
>
> 1. No need to introudce is_kfunc_arg_arena_nullable() and changes in
> is_kfunc_arg_nullable()

For consistency, would you prefer that I don't manually set | PTR_MAYBE_NULL and
let is_kfunc_arg_nullable() handle that? That would be another way to address
this.

In some sense, __arena includes __nullable for the purposes of type checking, so
it might make sense to add it to the predicate that determines NULL-ness, then
it will acquire PTR_MAYBE_NULL automatically.

We will still drop is_kfunc_arg_arena_nullable() though.

Anyhow, I don't have any strong preference one way or the other, but thought I'd
float this as an alternative since it appears to fit better, and details are
hidden the predicates.

> 2. is_kfunc_arg_arena() returns btf_param_match_suffix(btf, arg,
> "__arena_nullable") || btf_param_match_suffix(btf, arg, "__arena");
>

Yeah, makes sense.

> [...]
>
>> diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
>> index b62e77949542..2b7f6f6bbe76 100644
>> --- a/kernel/bpf/verifier.c
>> +++ b/kernel/bpf/verifier.c
>> @@ -10909,9 +10909,16 @@ static bool is_kfunc_arg_refcounted_kptr(const struct btf *btf, const struct btf
>>         return btf_param_match_suffix(btf, arg, "__refcounted_kptr");
>>  }
>>
>> +static bool is_kfunc_arg_arena_nullable(const struct btf *btf,
>> +                                       const struct btf_param *arg)
>> +{
>> +       return btf_param_match_suffix(btf, arg, "__arena__nullable");
>> +}
>> +
>>  static bool is_kfunc_arg_nullable(const struct btf *btf, const struct btf_param *arg)
>>  {
>> -       return btf_param_match_suffix(btf, arg, "__nullable");
>> +       return !is_kfunc_arg_arena_nullable(btf, arg) &&
>> +              btf_param_match_suffix(btf, arg, "__nullable");
>>  }
>
> No need for the changes above.
>
>>
>>  static bool is_kfunc_arg_nonown_allowed(const struct btf *btf, const struct btf_param *arg)
>> @@ -10929,6 +10936,12 @@ static bool is_kfunc_arg_irq_flag(const struct btf *btf, const struct btf_param
>>         return btf_param_match_suffix(btf, arg, "__irq_flag");
>>  }
>>
>> +static bool is_kfunc_arg_arena(const struct btf *btf, const struct btf_param *arg)
>> +{
>> +       return is_kfunc_arg_arena_nullable(btf, arg) ||
>> +              btf_param_match_suffix(btf, arg, "__arena");
>
> return btf_param_match_suffix(btf, arg, "__arena_nullable") ||
>         btf_param_match_suffix(btf, arg, "__arena");
>

Ack, I'll adjust this bit.

> [...]