Re: [PATCH bpf-next v5 05/14] bpf: Support __arena and __arena__nullable on struct_ops arguments

On Sat, 2026-08-08 at 02:39 +0200, Kumar Kartikeya Dwivedi wrote:
> From: Tejun Heo <[email protected]>
> 
> A struct_ops callback cannot receive an arena pointer directly, so
> passing one takes two steps. The pointer arrives as a bare u64 that the
> callback casts, and because the two sides address the arena through
> different bases it also has to be rebased by hand on the way in.
> 
> Add the __arena and __arena__nullable stub argument suffixes to make this
> convenient. The callback declares the parameter as an arena pointer,
> receives it as a PTR_TO_ARENA register, and dereferences it directly,
> while the kernel caller just passes the natural kernel arena address
> (kaddr). The trampoline converts the value while saving the arguments
> into the BPF ctx, ctx[slot] = (u32)(kaddr - kern_vm_start), so the
> program never sees a kernel address and nothing rewrites the ctx after
> the fact. The converted value keeps the upper 32 bits clear as the JITs
> require of arena pointer registers and behaves like any cast_kern'ed
> arena pointer, so cast_user recovers the full user-visible address.
> 
> __arena converts unconditionally and the kernel caller must not pass
> NULL. __arena__nullable preserves NULL, tested on the full 64-bit kernel
> pointer, and surfaces to the verifier as PTR_TO_ARENA (but not as a
> PTR_TO_ARENA | PTR_MAYBE_NULL). The reason is that PTR_TO_ARENA in the
> program's type state already encompasses NULL-ness, so it is not
> meaningful to force a NULL check for the program.
> 
> The composite suffix intentionally ends in __nullable. Classify
> __arena__nullable before the generic suffix so scalar arena pointees do
> not take the generic nullable BTF pointer path.
> 
> This patch adds the generic side. prepare_arg_info() records arena and
> nullable argument flags in the struct_ops function model, and
> bpf_tramp_arena_base() returns the arena base for a single-program
> struct_ops indirect trampoline. Only that trampoline converts: its
> program's arena is fixed at generation time. Generic trampolines can mix
> programs with different arenas and reject arena context arguments
> defensively, which is unreachable today as only struct_ops programs
> carry them. Architectures that do not implement the conversion are
> gated out at verification time with bpf_jit_supports_arena_args().
> 
> Signed-off-by: Tejun Heo <[email protected]>
> Co-developed-by: Kumar Kartikeya Dwivedi <[email protected]>
> Signed-off-by: Kumar Kartikeya Dwivedi <[email protected]>
> ---

Acked-by: Eduard Zingerman <[email protected]>

...