[PATCH bpf-next v1 0/2] Add resolve_btfids support for __arena kfunc suffix

[PATCH bpf-next v1 0/2] Add resolve_btfids support for __arena kfunc suffix

[Kumar Kartikeya Dwivedi]

Use __arena/__arena__nullable suffixes to emit address_space(1)
annotations on kfunc definitions in vmlinux.h. See commits for details.

Kumar Kartikeya Dwivedi (2):
  resolve_btfids: Emit arena attributes from kfunc parameter suffixes
  selftests/bpf: Test resolve_btfids arena argument suffixes

 tools/bpf/resolve_btfids/main.c               | 62 ++++++++++++++++---
 .../selftests/bpf/prog_tests/resolve_btfids.c | 35 ++++++-----
 tools/testing/selftests/bpf/progs/btf_data.c  |  9 +++
 3 files changed, 82 insertions(+), 24 deletions(-)


base-commit: d114bb98936770c501c958bf2bc5fb6b7c0bad7b
-- 
2.53.0-Meta

[PATCH bpf-next v1 1/2] resolve_btfids: Emit arena attributes from kfunc parameter suffixes

[Kumar Kartikeya Dwivedi]

Kfunc declarations can identify arena arguments through parameter name
suffixes without repeating KF_ARENA_ARG flags in their BTF ID sets.
resolve_btfids currently misses those arguments when synthesizing the
address_space(1) attributes used by generated vmlinux.h files.

Teach the arena prototype rewrite to recognize __arena and
__arena__nullable directly on each parameter. Keep KF_ARENA_ARG1 and
KF_ARENA_ARG2 handling for explicitly flagged kfuncs, while allowing
suffixes on any argument without synthesizing kfunc flags.

Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
---
 tools/bpf/resolve_btfids/main.c | 62 ++++++++++++++++++++++++++++-----
 1 file changed, 54 insertions(+), 8 deletions(-)

diff --git a/tools/bpf/resolve_btfids/main.c b/tools/bpf/resolve_btfids/main.c
index d2e4176339da..3c88ea192f7b 100644
--- a/tools/bpf/resolve_btfids/main.c
+++ b/tools/bpf/resolve_btfids/main.c
@@ -65,7 +65,8 @@
  *
  *   - emits a "bpf_kfunc" decl tag, and "bpf_fastcall" when KF_FASTCALL is set;
  *   - wraps the return value and/or arguments flagged KF_ARENA_RET,
- *     KF_ARENA_ARG1 or KF_ARENA_ARG2 with the "address_space(1)" type attribute;
+ *     KF_ARENA_ARG1 or KF_ARENA_ARG2, or identified by an arena parameter
+ *     suffix, with the "address_space(1)" type attribute;
  *   - rewrites the prototype of KF_IMPLICIT_ARGS kfuncs.
  *
  * These kfunc annotations were historically produced by pahole.
@@ -182,6 +183,8 @@ struct object {
 #define KF_IMPLICIT_ARGS (1 << 16)
 #define KF_IMPL_SUFFIX "_impl"
 #define TYPE_ATTR_ARENA "address_space(1)"
+#define PARAM_SUFFIX_ARENA "__arena"
+#define PARAM_SUFFIX_ARENA_NULLABLE "__arena__nullable"
 
 struct kfunc {
 	struct rb_node rb_node;
@@ -1067,6 +1070,22 @@ static int collect_decl_tags(struct btf2btf_context *ctx)
 	return 0;
 }
 
+static bool param_name_has_suffix(const char *name, const char *suffix)
+{
+	size_t name_len = strlen(name);
+	size_t suffix_len = strlen(suffix);
+
+	return name_len >= suffix_len && !strcmp(name + name_len - suffix_len, suffix);
+}
+
+static bool is_arena_param(const struct btf *btf, const struct btf_param *param)
+{
+	const char *name = btf__name_by_offset(btf, param->name_off);
+
+	return param_name_has_suffix(name, PARAM_SUFFIX_ARENA) ||
+	       param_name_has_suffix(name, PARAM_SUFFIX_ARENA_NULLABLE);
+}
+
 static int collect_kfuncs(struct object *obj, struct btf2btf_context *ctx)
 {
 	Elf_Data *idlist = obj->efile.idlist;
@@ -1299,8 +1318,12 @@ static int process_kfunc_with_implicit_args(struct btf2btf_context *ctx, struct
 	return 0;
 }
 
-static bool is_arena_arg(struct kfunc *kfunc, u32 idx)
+static bool is_arena_arg(const struct btf *btf, const struct kfunc *kfunc,
+			 const struct btf_param *param, u32 idx)
 {
+	if (is_arena_param(btf, param))
+		return true;
+
 	switch (idx) {
 	case 0:
 		return kfunc->flags & KF_ARENA_ARG1;
@@ -1311,6 +1334,30 @@ static bool is_arena_arg(struct kfunc *kfunc, u32 idx)
 	}
 }
 
+static bool kfunc_has_arena_arg(const struct btf *btf, const struct kfunc *kfunc)
+{
+	const struct btf_type *func, *proto;
+	const struct btf_param *params;
+	u32 nr_params;
+
+	func = btf__type_by_id(btf, kfunc->btf_id);
+	if (!func || !btf_is_func(func))
+		return false;
+
+	proto = btf__type_by_id(btf, func->type);
+	if (!proto || !btf_is_func_proto(proto))
+		return false;
+
+	params = btf_params(proto);
+	nr_params = btf_vlen(proto);
+	for (u32 i = 0; i < nr_params; i++) {
+		if (is_arena_arg(btf, kfunc, &params[i], i))
+			return true;
+	}
+
+	return false;
+}
+
 static s32 arena_tag_ptr(struct btf *btf, u32 ptr_id, struct kfunc *kfunc)
 {
 	const struct btf_type *ptr = btf__type_by_id(btf, ptr_id);
@@ -1383,11 +1430,10 @@ static s32 add_arena_tagged_proto(struct btf *btf, struct kfunc *kfunc)
 	}
 
 	for (i = 0; i < nr_params; i++) {
-		if (!is_arena_arg(kfunc, i))
-			continue;
-
 		t = btf__type_by_id(btf, new_proto_id);
 		params = btf_params(t);
+		if (!is_arena_arg(btf, kfunc, &params[i], i))
+			continue;
 
 		id = arena_tag_ptr(btf, params[i].type, kfunc);
 		if (id < 0)
@@ -1403,7 +1449,7 @@ static s32 add_arena_tagged_proto(struct btf *btf, struct kfunc *kfunc)
 	return new_proto_id;
 }
 
-static int process_kfunc_with_arena_flags(struct btf2btf_context *ctx,
+static int process_kfunc_with_arena_attrs(struct btf2btf_context *ctx,
 					  struct kfunc *kfunc)
 {
 	struct btf_type *t;
@@ -1463,8 +1509,8 @@ static int btf2btf(struct object *obj)
 				goto out;
 		}
 
-		if (kfunc->flags & (KF_ARENA_RET | KF_ARENA_ARG1 | KF_ARENA_ARG2)) {
-			err = process_kfunc_with_arena_flags(&ctx, kfunc);
+		if ((kfunc->flags & KF_ARENA_RET) || kfunc_has_arena_arg(ctx.btf, kfunc)) {
+			err = process_kfunc_with_arena_attrs(&ctx, kfunc);
 			if (err)
 				goto out;
 		}
-- 
2.53.0-Meta

Re: [PATCH bpf-next v1 1/2] resolve_btfids: Emit arena attributes from kfunc parameter suffixes

[bot+bpf-ci]

[-- Attachment #1: Type: text/plain, Size: 2373 bytes --]

> diff --git a/tools/bpf/resolve_btfids/main.c b/tools/bpf/resolve_btfids/main.c
> index d2e4176339da..3c88ea192f7b 100644
> --- a/tools/bpf/resolve_btfids/main.c
> +++ b/tools/bpf/resolve_btfids/main.c

[ ... ]

> @@ -1067,6 +1070,22 @@ static int collect_decl_tags(struct btf2btf_context *ctx)
>  	return 0;
>  }
>
> +static bool param_name_has_suffix(const char *name, const char *suffix)
> +{
> +	size_t name_len = strlen(name);
> +	size_t suffix_len = strlen(suffix);
> +
> +	return name_len >= suffix_len && !strcmp(name + name_len - suffix_len, suffix);
> +}

Should this be `name_len > suffix_len` instead of `name_len >= suffix_len`?

The kernel's btf_param_match_suffix() in kernel/bpf/btf.c rejects a parameter
whose name is exactly equal to the suffix:

kernel/bpf/btf.c:btf_param_match_suffix() {
    ...
    len = strlen(param_name);
    if (len <= suffix_len)
        return false;
    param_name += len - suffix_len;
    return !strncmp(param_name, suffix, suffix_len);
}

That `len <= suffix_len` early return is what both is_kfunc_arg_arena() in
kernel/bpf/verifier.c and btf_func_model_flags() in kernel/bpf/btf.c rely on.
The same helper is also used by kernel/bpf/bpf_struct_ops.c for arena suffix
matching.

With the current implementation, a parameter named exactly "__arena" would be
treated as an arena pointer by resolve_btfids (causing address_space(1) to be
emitted in vmlinux.h), but would be treated as an ordinary kernel pointer by
the verifier's is_kfunc_arg_arena().

No in-tree kfunc currently uses a parameter named exactly "__arena" or
"__arena__nullable" (checked kernel/bpf/arena.c, test_kmods/bpf_testmod.c,
and btf_data.c), and the selftests added by commit 52b915d08490 only use
names like "a__arena", so this would be a latent inconsistency rather than a
currently-firing failure.

> +
> +static bool is_arena_param(const struct btf *btf, const struct btf_param *param)
> +{
> +	const char *name = btf__name_by_offset(btf, param->name_off);
> +
> +	return param_name_has_suffix(name, PARAM_SUFFIX_ARENA) ||
> +	       param_name_has_suffix(name, PARAM_SUFFIX_ARENA_NULLABLE);
> +}

[ ... ]


---
AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md

CI run summary: https://github.com/kernel-patches/bpf/actions/runs/31305217088

Re: [PATCH bpf-next v1 1/2] resolve_btfids: Emit arena attributes from kfunc parameter suffixes

[Kumar Kartikeya Dwivedi]

On Sun Aug 9, 2026 at 12:10 PM CEST, bot+bpf-ci wrote:
>> diff --git a/tools/bpf/resolve_btfids/main.c b/tools/bpf/resolve_btfids/main.c
>> index d2e4176339da..3c88ea192f7b 100644
>> --- a/tools/bpf/resolve_btfids/main.c
>> +++ b/tools/bpf/resolve_btfids/main.c
>
> [ ... ]
>
>> @@ -1067,6 +1070,22 @@ static int collect_decl_tags(struct btf2btf_context *ctx)
>>  	return 0;
>>  }
>>
>> +static bool param_name_has_suffix(const char *name, const char *suffix)
>> +{
>> +	size_t name_len = strlen(name);
>> +	size_t suffix_len = strlen(suffix);
>> +
>> +	return name_len >= suffix_len && !strcmp(name + name_len - suffix_len, suffix);
>> +}
>
> Should this be `name_len > suffix_len` instead of `name_len >= suffix_len`?
>
> The kernel's btf_param_match_suffix() in kernel/bpf/btf.c rejects a parameter
> whose name is exactly equal to the suffix:
>
> kernel/bpf/btf.c:btf_param_match_suffix() {
>     ...
>     len = strlen(param_name);
>     if (len <= suffix_len)
>         return false;
>     param_name += len - suffix_len;
>     return !strncmp(param_name, suffix, suffix_len);
> }
>
> That `len <= suffix_len` early return is what both is_kfunc_arg_arena() in
> kernel/bpf/verifier.c and btf_func_model_flags() in kernel/bpf/btf.c rely on.
> The same helper is also used by kernel/bpf/bpf_struct_ops.c for arena suffix
> matching.
>
> With the current implementation, a parameter named exactly "__arena" would be
> treated as an arena pointer by resolve_btfids (causing address_space(1) to be
> emitted in vmlinux.h), but would be treated as an ordinary kernel pointer by
> the verifier's is_kfunc_arg_arena().
>
> No in-tree kfunc currently uses a parameter named exactly "__arena" or
> "__arena__nullable" (checked kernel/bpf/arena.c, test_kmods/bpf_testmod.c,
> and btf_data.c), and the selftests added by commit 52b915d08490 only use
> names like "a__arena", so this would be a latent inconsistency rather than a
> currently-firing failure.
>

I think it's fine, won't matter in practice.

>> +
>> +static bool is_arena_param(const struct btf *btf, const struct btf_param *param)
>> +{
>> +	const char *name = btf__name_by_offset(btf, param->name_off);
>> +
>> +	return param_name_has_suffix(name, PARAM_SUFFIX_ARENA) ||
>> +	       param_name_has_suffix(name, PARAM_SUFFIX_ARENA_NULLABLE);
>> +}
>
> [ ... ]
>
>
> ---
> AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
> See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md
>
> CI run summary: https://github.com/kernel-patches/bpf/actions/runs/31305217088

[PATCH bpf-next v1 2/2] selftests/bpf: Test resolve_btfids arena argument suffixes

[Kumar Kartikeya Dwivedi]

Add a suffix-only kfunc declaration with arena annotations on all five
arguments. Verify that resolve_btfids emits address_space(1) type tags
for every position without KF_ARENA_ARG flags in the BTF ID sets.

Represent expected arena arguments as a per-parameter bitmap so the
test covers suffixes beyond the two positions expressible by flags.

Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
---
 .../selftests/bpf/prog_tests/resolve_btfids.c | 35 ++++++++++---------
 tools/testing/selftests/bpf/progs/btf_data.c  |  9 +++++
 2 files changed, 28 insertions(+), 16 deletions(-)

diff --git a/tools/testing/selftests/bpf/prog_tests/resolve_btfids.c b/tools/testing/selftests/bpf/prog_tests/resolve_btfids.c
index 732cfed35e1c..9bd84fe32b89 100644
--- a/tools/testing/selftests/bpf/prog_tests/resolve_btfids.c
+++ b/tools/testing/selftests/bpf/prog_tests/resolve_btfids.c
@@ -15,6 +15,7 @@
 #define DECL_TAG_FASTCALL "bpf_fastcall"
 #define DECL_TAG_KFUNC "bpf_kfunc"
 #define TYPE_ATTR_ARENA "address_space(1)"
+#define ARENA_ARG(n) (1U << (n))
 
 #ifndef KF_FASTCALL
 #define KF_FASTCALL (1 << 12)
@@ -49,13 +50,18 @@ struct kfunc_symbol {
 	const char	*name;
 	s32		 id;
 	u32		 flags;
+	u32		 arena_args;
+	bool		 arena_ret;
 };
 
 static struct kfunc_symbol kfunc_symbols[] = {
-	{ "kfunc_a", -1, 0 },
-	{ "kfunc_b", -1, KF_FASTCALL },
-	{ "kfunc_c", -1, KF_ARENA_RET | KF_ARENA_ARG1 | KF_ARENA_ARG2 },
-	{ "kfunc_d", -1, KF_ARENA_ARG2 },
+	{ "kfunc_a", -1, 0, 0, false },
+	{ "kfunc_b", -1, KF_FASTCALL, 0, false },
+	{ "kfunc_c", -1, KF_ARENA_RET | KF_ARENA_ARG1 | KF_ARENA_ARG2,
+	  ARENA_ARG(0) | ARENA_ARG(1), true },
+	{ "kfunc_d", -1, KF_ARENA_ARG2, ARENA_ARG(1), false },
+	{ "kfunc_e", -1, 0, ARENA_ARG(0) | ARENA_ARG(1) | ARENA_ARG(2) |
+	  ARENA_ARG(3) | ARENA_ARG(4), false },
 };
 
 /* Align the .BTF_ids section to 4 bytes */
@@ -105,6 +111,7 @@ BTF_ID_FLAGS(func, kfunc_a)
 BTF_ID_FLAGS(func, kfunc_b, KF_FASTCALL)
 BTF_ID_FLAGS(func, kfunc_c, KF_ARENA_RET | KF_ARENA_ARG1 | KF_ARENA_ARG2)
 BTF_ID_FLAGS(func, kfunc_d, KF_ARENA_ARG2)
+BTF_ID_FLAGS(func, kfunc_e)
 BTF_KFUNCS_END(test_kfunc_set)
 
 /*
@@ -112,6 +119,7 @@ BTF_KFUNCS_END(test_kfunc_set)
  * actually sort at least one of the two sets.
  */
 BTF_KFUNCS_START(test_kfunc_set_rev)
+BTF_ID_FLAGS(func, kfunc_e)
 BTF_ID_FLAGS(func, kfunc_d, KF_ARENA_ARG2)
 BTF_ID_FLAGS(func, kfunc_c, KF_ARENA_RET | KF_ARENA_ARG1 | KF_ARENA_ARG2)
 BTF_ID_FLAGS(func, kfunc_b, KF_FASTCALL)
@@ -301,15 +309,15 @@ void test_resolve_btfids(void)
 	}
 
 	/*
-	 * Check resolve_btfids wrapped exactly the arena-flagged return/args
-	 * with the address_space(1) type attribute, and left other
+	 * Check resolve_btfids wrapped exactly the arena-flagged or suffixed
+	 * return/args with the address_space(1) type attribute, and left other
 	 * pointers/returns untouched.
 	 */
 	for (i = 0; i < ARRAY_SIZE(kfunc_symbols); i++) {
 		const struct btf_type *fn, *proto;
 		const struct btf_param *params;
 		const char *name = kfunc_symbols[i].name;
-		u32 fl = kfunc_symbols[i].flags;
+		u32 arena_args = kfunc_symbols[i].arena_args;
 		__u32 nr;
 
 		fn = btf__type_by_id(btf, kfunc_symbols[i].id);
@@ -322,15 +330,10 @@ void test_resolve_btfids(void)
 		nr = btf_vlen(proto);
 
 		ASSERT_EQ(is_arena_tagged_ptr(btf, proto->type),
-			  !!(fl & KF_ARENA_RET), name);
-		if (nr > 0) {
-			ASSERT_EQ(is_arena_tagged_ptr(btf, params[0].type),
-				  !!(fl & KF_ARENA_ARG1), name);
-		}
-		if (nr > 1) {
-			ASSERT_EQ(is_arena_tagged_ptr(btf, params[1].type),
-				  !!(fl & KF_ARENA_ARG2), name);
-		}
+			  kfunc_symbols[i].arena_ret, name);
+		for (j = 0; j < nr; j++)
+			ASSERT_EQ(is_arena_tagged_ptr(btf, params[j].type),
+				  !!(arena_args & ARENA_ARG(j)), name);
 	}
 
 out:
diff --git a/tools/testing/selftests/bpf/progs/btf_data.c b/tools/testing/selftests/bpf/progs/btf_data.c
index ec34f7a6e038..ea41c9801432 100644
--- a/tools/testing/selftests/bpf/progs/btf_data.c
+++ b/tools/testing/selftests/bpf/progs/btf_data.c
@@ -68,3 +68,12 @@ int kfunc_d(struct root_struct *a, struct root_struct *b)
 {
 	return 0;
 }
+
+int kfunc_e(struct root_struct *a__arena,
+	    struct root_struct *b__arena__nullable,
+	    struct root_struct *c__arena,
+	    struct root_struct *d__arena__nullable,
+	    struct root_struct *e__arena)
+{
+	return 0;
+}
-- 
2.53.0-Meta

Re: [PATCH bpf-next v1 2/2] selftests/bpf: Test resolve_btfids arena argument suffixes

[bot+bpf-ci]

[-- Attachment #1: Type: text/plain, Size: 2599 bytes --]

> diff --git a/tools/testing/selftests/bpf/prog_tests/resolve_btfids.c b/tools/testing/selftests/bpf/prog_tests/resolve_btfids.c
> index 732cfed35e1c..9bd84fe32b89 100644
> --- a/tools/testing/selftests/bpf/prog_tests/resolve_btfids.c
> +++ b/tools/testing/selftests/bpf/prog_tests/resolve_btfids.c
> @@ -15,6 +15,7 @@
>  #define DECL_TAG_FASTCALL "bpf_fastcall"
>  #define DECL_TAG_KFUNC "bpf_kfunc"
>  #define TYPE_ATTR_ARENA "address_space(1)"
> +#define ARENA_ARG(n) (1U << (n))

This isn't a bug, but ARENA_ARG(n) is zero-based while the KF_ARENA_ARGn
flags it sits next to are one-based, so the same argument is spelled two
different ways inside a single table row.

For example, '{ "kfunc_d", -1, KF_ARENA_ARG2, ARENA_ARG(1), false }'
means KF_ARENA_ARG2 and ARENA_ARG(1) refer to the same parameter.

Would a name like ARENA_ARG_IDX(n), or a short comment noting that
ARENA_ARG(0) corresponds to KF_ARENA_ARG1, help keep the two columns
from drifting?

[ ... ]

> @@ -49,13 +50,18 @@ struct kfunc_symbol {
>  	const char	*name;
>  	s32		 id;
>  	u32		 flags;
> +	u32		 arena_args;
> +	bool		 arena_ret;
>  };
>
>  static struct kfunc_symbol kfunc_symbols[] = {
> -	{ "kfunc_a", -1, 0 },
> -	{ "kfunc_b", -1, KF_FASTCALL },
> -	{ "kfunc_c", -1, KF_ARENA_RET | KF_ARENA_ARG1 | KF_ARENA_ARG2 },
> -	{ "kfunc_d", -1, KF_ARENA_ARG2 },
> +	{ "kfunc_a", -1, 0, 0, false },
> +	{ "kfunc_b", -1, KF_FASTCALL, 0, false },
> +	{ "kfunc_c", -1, KF_ARENA_RET | KF_ARENA_ARG1 | KF_ARENA_ARG2,
> +	  ARENA_ARG(0) | ARENA_ARG(1), true },
> +	{ "kfunc_d", -1, KF_ARENA_ARG2, ARENA_ARG(1), false },
> +	{ "kfunc_e", -1, 0, ARENA_ARG(0) | ARENA_ARG(1) | ARENA_ARG(2) |
> +	  ARENA_ARG(3) | ARENA_ARG(4), false },
>  };

This isn't a bug, but the new arena_ret field duplicates information
that the existing flags field already carries.

resolve_btfids only ever arena-tags a return value from KF_ARENA_RET:

tools/bpf/resolve_btfids/main.c:add_arena_tagged_proto() {
    ...
    if (kfunc->flags & KF_ARENA_RET)
        /* tag return */
    ...
}

There is no return-position suffix mechanism, so arena_ret is exactly
!!(flags & KF_ARENA_RET) for every row and the old expression it
replaced was already correct.

Since only KF_ARENA_RET drives return tagging, could the return
assertion keep using !!(flags & KF_ARENA_RET) instead of the new
arena_ret field?

[ ... ]


---
AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md

CI run summary: https://github.com/kernel-patches/bpf/actions/runs/31305217088

Re: [PATCH bpf-next v1 2/2] selftests/bpf: Test resolve_btfids arena argument suffixes

[Kumar Kartikeya Dwivedi]

On Sun Aug 9, 2026 at 11:57 AM CEST, bot+bpf-ci wrote:
>> diff --git a/tools/testing/selftests/bpf/prog_tests/resolve_btfids.c b/tools/testing/selftests/bpf/prog_tests/resolve_btfids.c
>> index 732cfed35e1c..9bd84fe32b89 100644
>> --- a/tools/testing/selftests/bpf/prog_tests/resolve_btfids.c
>> +++ b/tools/testing/selftests/bpf/prog_tests/resolve_btfids.c
>> @@ -15,6 +15,7 @@
>>  #define DECL_TAG_FASTCALL "bpf_fastcall"
>>  #define DECL_TAG_KFUNC "bpf_kfunc"
>>  #define TYPE_ATTR_ARENA "address_space(1)"
>> +#define ARENA_ARG(n) (1U << (n))
>
> This isn't a bug, but ARENA_ARG(n) is zero-based while the KF_ARENA_ARGn
> flags it sits next to are one-based, so the same argument is spelled two
> different ways inside a single table row.
>
> For example, '{ "kfunc_d", -1, KF_ARENA_ARG2, ARENA_ARG(1), false }'
> means KF_ARENA_ARG2 and ARENA_ARG(1) refer to the same parameter.
>
> Would a name like ARENA_ARG_IDX(n), or a short comment noting that
> ARENA_ARG(0) corresponds to KF_ARENA_ARG1, help keep the two columns
> from drifting?
>

I think it's ok, we might drop the other flag soon anyhow.

> [ ... ]
>
>> @@ -49,13 +50,18 @@ struct kfunc_symbol {
>>  	const char	*name;
>>  	s32		 id;
>>  	u32		 flags;
>> +	u32		 arena_args;
>> +	bool		 arena_ret;
>>  };
>>
>>  static struct kfunc_symbol kfunc_symbols[] = {
>> -	{ "kfunc_a", -1, 0 },
>> -	{ "kfunc_b", -1, KF_FASTCALL },
>> -	{ "kfunc_c", -1, KF_ARENA_RET | KF_ARENA_ARG1 | KF_ARENA_ARG2 },
>> -	{ "kfunc_d", -1, KF_ARENA_ARG2 },
>> +	{ "kfunc_a", -1, 0, 0, false },
>> +	{ "kfunc_b", -1, KF_FASTCALL, 0, false },
>> +	{ "kfunc_c", -1, KF_ARENA_RET | KF_ARENA_ARG1 | KF_ARENA_ARG2,
>> +	  ARENA_ARG(0) | ARENA_ARG(1), true },
>> +	{ "kfunc_d", -1, KF_ARENA_ARG2, ARENA_ARG(1), false },
>> +	{ "kfunc_e", -1, 0, ARENA_ARG(0) | ARENA_ARG(1) | ARENA_ARG(2) |
>> +	  ARENA_ARG(3) | ARENA_ARG(4), false },
>>  };
>
> This isn't a bug, but the new arena_ret field duplicates information
> that the existing flags field already carries.
>
> resolve_btfids only ever arena-tags a return value from KF_ARENA_RET:
>
> tools/bpf/resolve_btfids/main.c:add_arena_tagged_proto() {
>     ...
>     if (kfunc->flags & KF_ARENA_RET)
>         /* tag return */
>     ...
> }
>
> There is no return-position suffix mechanism, so arena_ret is exactly
> !!(flags & KF_ARENA_RET) for every row and the old expression it
> replaced was already correct.
>
> Since only KF_ARENA_RET drives return tagging, could the return
> assertion keep using !!(flags & KF_ARENA_RET) instead of the new
> arena_ret field?
>

I found this more clear, but am fine with reworking in any direction.

> [ ... ]
>
>
> ---
> AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
> See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md
>
> CI run summary: https://github.com/kernel-patches/bpf/actions/runs/31305217088