Re: [PATCH bpf-next 4/7] bpf, arm64: Convert struct_ops arena arguments in the trampoline

On 8/14/2026 11:27 AM, Kumar Kartikeya Dwivedi wrote:
> On Fri Aug 14, 2026 at 4:10 AM CEST, Xu Kuohai wrote:
>> On 8/14/2026 3:20 AM, Puranjay Mohan wrote:
>>
>> [...]
>>
>>>>> +static void emit_arena_arg_conv(struct jit_ctx *ctx, u8 dst, u8 src, bool nullable, u8 base_lo)
>>>>> +{
>>>>> +	if (nullable) {
>>>>> +		if (dst != src)
>>>>> +			emit(A64_MOV(1, dst, src), ctx);
>>>>> +		/* skip the subtraction so that NULL stays NULL */
>>>>> +		emit(A64_CBZ(1, dst, 2), ctx);
>>>>> +		src = dst;
>>>>> +	}
>>>>> +	emit(A64_SUB(0, dst, src, base_lo), ctx);
>>>> Maybe I'm missing something, do we need to validate whether the
>>>> address in the src register is really inside the current bpf
>>>> prog's arena?
>>> The JIT can assume that it is a kernel address into the arena as it
>>> comes from struct ops.
>>
>> Thanks for the clarification, but I'm still confused. What makes the
>> assumption hold? How does struct_ops ensure the address passed is
>> inside the arena used by the current prog?
>>
> 
> I think we would expect the kernel caller passing the address to the struct_ops
> callback to have something that points into the arena region. If that
> expectation is broken it should be treated as a kernel bug and be dealt with
> accordingly.
> 
> Does that clarify your concern, or did I miss what confused you here?
>

Fair enough, I'm fine not checking the address in the JIT.

>> [...]