[PATCH bpf-next v1 0/2] Add resolve_btfids support for __arena kfunc suffix

[PATCH bpf-next v1 0/2] Add resolve_btfids support for __arena kfunc suffix

[Kumar Kartikeya Dwivedi]

Use __arena/__arena__nullable suffixes to emit address_space(1)
annotations on kfunc definitions in vmlinux.h. See commits for details.

Kumar Kartikeya Dwivedi (2):
  resolve_btfids: Emit arena attributes from kfunc parameter suffixes
  selftests/bpf: Test resolve_btfids arena argument suffixes

 tools/bpf/resolve_btfids/main.c               | 62 ++++++++++++++++---
 .../selftests/bpf/prog_tests/resolve_btfids.c | 35 ++++++-----
 tools/testing/selftests/bpf/progs/btf_data.c  |  9 +++
 3 files changed, 82 insertions(+), 24 deletions(-)


base-commit: d114bb98936770c501c958bf2bc5fb6b7c0bad7b
-- 
2.53.0-Meta

[PATCH bpf-next v1 1/2] resolve_btfids: Emit arena attributes from kfunc parameter suffixes

[Kumar Kartikeya Dwivedi]

Kfunc declarations can identify arena arguments through parameter name
suffixes without repeating KF_ARENA_ARG flags in their BTF ID sets.
resolve_btfids currently misses those arguments when synthesizing the
address_space(1) attributes used by generated vmlinux.h files.

Teach the arena prototype rewrite to recognize __arena and
__arena__nullable directly on each parameter. Keep KF_ARENA_ARG1 and
KF_ARENA_ARG2 handling for explicitly flagged kfuncs, while allowing
suffixes on any argument without synthesizing kfunc flags.

Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
---
 tools/bpf/resolve_btfids/main.c | 62 ++++++++++++++++++++++++++++-----
 1 file changed, 54 insertions(+), 8 deletions(-)

diff --git a/tools/bpf/resolve_btfids/main.c b/tools/bpf/resolve_btfids/main.c
index d2e4176339da..3c88ea192f7b 100644
--- a/tools/bpf/resolve_btfids/main.c
+++ b/tools/bpf/resolve_btfids/main.c
@@ -65,7 +65,8 @@
  *
  *   - emits a "bpf_kfunc" decl tag, and "bpf_fastcall" when KF_FASTCALL is set;
  *   - wraps the return value and/or arguments flagged KF_ARENA_RET,
- *     KF_ARENA_ARG1 or KF_ARENA_ARG2 with the "address_space(1)" type attribute;
+ *     KF_ARENA_ARG1 or KF_ARENA_ARG2, or identified by an arena parameter
+ *     suffix, with the "address_space(1)" type attribute;
  *   - rewrites the prototype of KF_IMPLICIT_ARGS kfuncs.
  *
  * These kfunc annotations were historically produced by pahole.
@@ -182,6 +183,8 @@ struct object {
 #define KF_IMPLICIT_ARGS (1 << 16)
 #define KF_IMPL_SUFFIX "_impl"
 #define TYPE_ATTR_ARENA "address_space(1)"
+#define PARAM_SUFFIX_ARENA "__arena"
+#define PARAM_SUFFIX_ARENA_NULLABLE "__arena__nullable"
 
 struct kfunc {
 	struct rb_node rb_node;
@@ -1067,6 +1070,22 @@ static int collect_decl_tags(struct btf2btf_context *ctx)
 	return 0;
 }
 
+static bool param_name_has_suffix(const char *name, const char *suffix)
+{
+	size_t name_len = strlen(name);
+	size_t suffix_len = strlen(suffix);
+
+	return name_len >= suffix_len && !strcmp(name + name_len - suffix_len, suffix);
+}
+
+static bool is_arena_param(const struct btf *btf, const struct btf_param *param)
+{
+	const char *name = btf__name_by_offset(btf, param->name_off);
+
+	return param_name_has_suffix(name, PARAM_SUFFIX_ARENA) ||
+	       param_name_has_suffix(name, PARAM_SUFFIX_ARENA_NULLABLE);
+}
+
 static int collect_kfuncs(struct object *obj, struct btf2btf_context *ctx)
 {
 	Elf_Data *idlist = obj->efile.idlist;
@@ -1299,8 +1318,12 @@ static int process_kfunc_with_implicit_args(struct btf2btf_context *ctx, struct
 	return 0;
 }
 
-static bool is_arena_arg(struct kfunc *kfunc, u32 idx)
+static bool is_arena_arg(const struct btf *btf, const struct kfunc *kfunc,
+			 const struct btf_param *param, u32 idx)
 {
+	if (is_arena_param(btf, param))
+		return true;
+
 	switch (idx) {
 	case 0:
 		return kfunc->flags & KF_ARENA_ARG1;
@@ -1311,6 +1334,30 @@ static bool is_arena_arg(struct kfunc *kfunc, u32 idx)
 	}
 }
 
+static bool kfunc_has_arena_arg(const struct btf *btf, const struct kfunc *kfunc)
+{
+	const struct btf_type *func, *proto;
+	const struct btf_param *params;
+	u32 nr_params;
+
+	func = btf__type_by_id(btf, kfunc->btf_id);
+	if (!func || !btf_is_func(func))
+		return false;
+
+	proto = btf__type_by_id(btf, func->type);
+	if (!proto || !btf_is_func_proto(proto))
+		return false;
+
+	params = btf_params(proto);
+	nr_params = btf_vlen(proto);
+	for (u32 i = 0; i < nr_params; i++) {
+		if (is_arena_arg(btf, kfunc, &params[i], i))
+			return true;
+	}
+
+	return false;
+}
+
 static s32 arena_tag_ptr(struct btf *btf, u32 ptr_id, struct kfunc *kfunc)
 {
 	const struct btf_type *ptr = btf__type_by_id(btf, ptr_id);
@@ -1383,11 +1430,10 @@ static s32 add_arena_tagged_proto(struct btf *btf, struct kfunc *kfunc)
 	}
 
 	for (i = 0; i < nr_params; i++) {
-		if (!is_arena_arg(kfunc, i))
-			continue;
-
 		t = btf__type_by_id(btf, new_proto_id);
 		params = btf_params(t);
+		if (!is_arena_arg(btf, kfunc, &params[i], i))
+			continue;
 
 		id = arena_tag_ptr(btf, params[i].type, kfunc);
 		if (id < 0)
@@ -1403,7 +1449,7 @@ static s32 add_arena_tagged_proto(struct btf *btf, struct kfunc *kfunc)
 	return new_proto_id;
 }
 
-static int process_kfunc_with_arena_flags(struct btf2btf_context *ctx,
+static int process_kfunc_with_arena_attrs(struct btf2btf_context *ctx,
 					  struct kfunc *kfunc)
 {
 	struct btf_type *t;
@@ -1463,8 +1509,8 @@ static int btf2btf(struct object *obj)
 				goto out;
 		}
 
-		if (kfunc->flags & (KF_ARENA_RET | KF_ARENA_ARG1 | KF_ARENA_ARG2)) {
-			err = process_kfunc_with_arena_flags(&ctx, kfunc);
+		if ((kfunc->flags & KF_ARENA_RET) || kfunc_has_arena_arg(ctx.btf, kfunc)) {
+			err = process_kfunc_with_arena_attrs(&ctx, kfunc);
 			if (err)
 				goto out;
 		}
-- 
2.53.0-Meta

Re: [PATCH bpf-next v1 1/2] resolve_btfids: Emit arena attributes from kfunc parameter suffixes

[bot+bpf-ci]

[-- Attachment #1: Type: text/plain, Size: 2373 bytes --]

> diff --git a/tools/bpf/resolve_btfids/main.c b/tools/bpf/resolve_btfids/main.c
> index d2e4176339da..3c88ea192f7b 100644
> --- a/tools/bpf/resolve_btfids/main.c
> +++ b/tools/bpf/resolve_btfids/main.c

[ ... ]

> @@ -1067,6 +1070,22 @@ static int collect_decl_tags(struct btf2btf_context *ctx)
>  	return 0;
>  }
>
> +static bool param_name_has_suffix(const char *name, const char *suffix)
> +{
> +	size_t name_len = strlen(name);
> +	size_t suffix_len = strlen(suffix);
> +
> +	return name_len >= suffix_len && !strcmp(name + name_len - suffix_len, suffix);
> +}

Should this be `name_len > suffix_len` instead of `name_len >= suffix_len`?

The kernel's btf_param_match_suffix() in kernel/bpf/btf.c rejects a parameter
whose name is exactly equal to the suffix:

kernel/bpf/btf.c:btf_param_match_suffix() {
    ...
    len = strlen(param_name);
    if (len <= suffix_len)
        return false;
    param_name += len - suffix_len;
    return !strncmp(param_name, suffix, suffix_len);
}

That `len <= suffix_len` early return is what both is_kfunc_arg_arena() in
kernel/bpf/verifier.c and btf_func_model_flags() in kernel/bpf/btf.c rely on.
The same helper is also used by kernel/bpf/bpf_struct_ops.c for arena suffix
matching.

With the current implementation, a parameter named exactly "__arena" would be
treated as an arena pointer by resolve_btfids (causing address_space(1) to be
emitted in vmlinux.h), but would be treated as an ordinary kernel pointer by
the verifier's is_kfunc_arg_arena().

No in-tree kfunc currently uses a parameter named exactly "__arena" or
"__arena__nullable" (checked kernel/bpf/arena.c, test_kmods/bpf_testmod.c,
and btf_data.c), and the selftests added by commit 52b915d08490 only use
names like "a__arena", so this would be a latent inconsistency rather than a
currently-firing failure.

> +
> +static bool is_arena_param(const struct btf *btf, const struct btf_param *param)
> +{
> +	const char *name = btf__name_by_offset(btf, param->name_off);
> +
> +	return param_name_has_suffix(name, PARAM_SUFFIX_ARENA) ||
> +	       param_name_has_suffix(name, PARAM_SUFFIX_ARENA_NULLABLE);
> +}

[ ... ]


---
AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md

CI run summary: https://github.com/kernel-patches/bpf/actions/runs/31305217088

Re: [PATCH bpf-next v1 1/2] resolve_btfids: Emit arena attributes from kfunc parameter suffixes

[Kumar Kartikeya Dwivedi]

On Sun Aug 9, 2026 at 12:10 PM CEST, bot+bpf-ci wrote:
>> diff --git a/tools/bpf/resolve_btfids/main.c b/tools/bpf/resolve_btfids/main.c
>> index d2e4176339da..3c88ea192f7b 100644
>> --- a/tools/bpf/resolve_btfids/main.c
>> +++ b/tools/bpf/resolve_btfids/main.c
>
> [ ... ]
>
>> @@ -1067,6 +1070,22 @@ static int collect_decl_tags(struct btf2btf_context *ctx)
>>  	return 0;
>>  }
>>
>> +static bool param_name_has_suffix(const char *name, const char *suffix)
>> +{
>> +	size_t name_len = strlen(name);
>> +	size_t suffix_len = strlen(suffix);
>> +
>> +	return name_len >= suffix_len && !strcmp(name + name_len - suffix_len, suffix);
>> +}
>
> Should this be `name_len > suffix_len` instead of `name_len >= suffix_len`?
>
> The kernel's btf_param_match_suffix() in kernel/bpf/btf.c rejects a parameter
> whose name is exactly equal to the suffix:
>
> kernel/bpf/btf.c:btf_param_match_suffix() {
>     ...
>     len = strlen(param_name);
>     if (len <= suffix_len)
>         return false;
>     param_name += len - suffix_len;
>     return !strncmp(param_name, suffix, suffix_len);
> }
>
> That `len <= suffix_len` early return is what both is_kfunc_arg_arena() in
> kernel/bpf/verifier.c and btf_func_model_flags() in kernel/bpf/btf.c rely on.
> The same helper is also used by kernel/bpf/bpf_struct_ops.c for arena suffix
> matching.
>
> With the current implementation, a parameter named exactly "__arena" would be
> treated as an arena pointer by resolve_btfids (causing address_space(1) to be
> emitted in vmlinux.h), but would be treated as an ordinary kernel pointer by
> the verifier's is_kfunc_arg_arena().
>
> No in-tree kfunc currently uses a parameter named exactly "__arena" or
> "__arena__nullable" (checked kernel/bpf/arena.c, test_kmods/bpf_testmod.c,
> and btf_data.c), and the selftests added by commit 52b915d08490 only use
> names like "a__arena", so this would be a latent inconsistency rather than a
> currently-firing failure.
>

I think it's fine, won't matter in practice.

>> +
>> +static bool is_arena_param(const struct btf *btf, const struct btf_param *param)
>> +{
>> +	const char *name = btf__name_by_offset(btf, param->name_off);
>> +
>> +	return param_name_has_suffix(name, PARAM_SUFFIX_ARENA) ||
>> +	       param_name_has_suffix(name, PARAM_SUFFIX_ARENA_NULLABLE);
>> +}
>
> [ ... ]
>
>
> ---
> AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
> See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md
>
> CI run summary: https://github.com/kernel-patches/bpf/actions/runs/31305217088

Re: [PATCH bpf-next v1 1/2] resolve_btfids: Emit arena attributes from kfunc parameter suffixes

[Ihor Solodrai]

On 2026-08-09 1:51 a.m., Kumar Kartikeya Dwivedi wrote:
> Kfunc declarations can identify arena arguments through parameter name
> suffixes without repeating KF_ARENA_ARG flags in their BTF ID sets.
> resolve_btfids currently misses those arguments when synthesizing the
> address_space(1) attributes used by generated vmlinux.h files.

Continuing the previous thread [1] (progs/arena_kfunc.c:42):

     ret = bpf_kfunc_arena_arg_test((u64 *)val);

I'm thinking it would be useful to have selftests that generate a
vmlinux.h-equivalent header for a test kernel module with bpftool, and
then use it in BPF progs that depend on that module. This would give
us nice additional coverage for module BTF generation.

With this patch resolve_btfids adds attrs to BTF, but nothing consumes
them, as we don't have such kfuncs in the kernel yet. So the only test
is the super-custom resolve_btfids.test.o

This is not a blocker. Just putting it out there, maybe one of the new
eager contributors will pick this up.

[1] 
https://lore.kernel.org/bpf/4d3b9137362fd9151ecdaf29d863a6cc0b0799d1.camel@gmail.com/

> 
> Teach the arena prototype rewrite to recognize __arena and
> __arena__nullable directly on each parameter. Keep KF_ARENA_ARG1 and
> KF_ARENA_ARG2 handling for explicitly flagged kfuncs, while allowing
> suffixes on any argument without synthesizing kfunc flags.
> 
> Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
> ---
>   tools/bpf/resolve_btfids/main.c | 62 ++++++++++++++++++++++++++++-----
>   1 file changed, 54 insertions(+), 8 deletions(-)
> 
> diff --git a/tools/bpf/resolve_btfids/main.c b/tools/bpf/resolve_btfids/main.c
> index d2e4176339da..3c88ea192f7b 100644
> --- a/tools/bpf/resolve_btfids/main.c
> +++ b/tools/bpf/resolve_btfids/main.c
> @@ -65,7 +65,8 @@
>    *
>    *   - emits a "bpf_kfunc" decl tag, and "bpf_fastcall" when KF_FASTCALL is set;
>    *   - wraps the return value and/or arguments flagged KF_ARENA_RET,
> - *     KF_ARENA_ARG1 or KF_ARENA_ARG2 with the "address_space(1)" type attribute;
> + *     KF_ARENA_ARG1 or KF_ARENA_ARG2, or identified by an arena parameter
> + *     suffix, with the "address_space(1)" type attribute;

nit: Documentation/bpf/kfuncs.rst:512-517 says the same thing and
still lists only the flags. I don't know if it's useful to enumerate
all the ways address_space(1) can be emitted. Maybe just say
"resolve_btfids also handles arena BTF tags" or smth.

>    *   - rewrites the prototype of KF_IMPLICIT_ARGS kfuncs.
>    *
>    * These kfunc annotations were historically produced by pahole.
> @@ -182,6 +183,8 @@ struct object {
>   #define KF_IMPLICIT_ARGS (1 << 16)
>   #define KF_IMPL_SUFFIX "_impl"
>   #define TYPE_ATTR_ARENA "address_space(1)"
> +#define PARAM_SUFFIX_ARENA "__arena"
> +#define PARAM_SUFFIX_ARENA_NULLABLE "__arena__nullable"
>   
>   struct kfunc {
>   	struct rb_node rb_node;
> @@ -1067,6 +1070,22 @@ static int collect_decl_tags(struct btf2btf_context *ctx)
>   	return 0;
>   }
>   
> +static bool param_name_has_suffix(const char *name, const char *suffix)
> +{
> +	size_t name_len = strlen(name);
> +	size_t suffix_len = strlen(suffix);
> +
> +	return name_len >= suffix_len && !strcmp(name + name_len - suffix_len, suffix);
> +}
> +
> +static bool is_arena_param(const struct btf *btf, const struct btf_param *param)
> +{
> +	const char *name = btf__name_by_offset(btf, param->name_off);
> +
> +	return param_name_has_suffix(name, PARAM_SUFFIX_ARENA) ||
> +	       param_name_has_suffix(name, PARAM_SUFFIX_ARENA_NULLABLE);
> +}
> +
>   static int collect_kfuncs(struct object *obj, struct btf2btf_context *ctx)
>   {
>   	Elf_Data *idlist = obj->efile.idlist;
> @@ -1299,8 +1318,12 @@ static int process_kfunc_with_implicit_args(struct btf2btf_context *ctx, struct
>   	return 0;
>   }
>   
> -static bool is_arena_arg(struct kfunc *kfunc, u32 idx)
> +static bool is_arena_arg(const struct btf *btf, const struct kfunc *kfunc,
> +			 const struct btf_param *param, u32 idx)
>   {
> +	if (is_arena_param(btf, param))
> +		return true;
> +
>   	switch (idx) {
>   	case 0:
>   		return kfunc->flags & KF_ARENA_ARG1;
> @@ -1311,6 +1334,30 @@ static bool is_arena_arg(struct kfunc *kfunc, u32 idx)
>   	}
>   }
>   
> +static bool kfunc_has_arena_arg(const struct btf *btf, const struct kfunc *kfunc)
> +{
> +	const struct btf_type *func, *proto;
> +	const struct btf_param *params;
> +	u32 nr_params;
> +
> +	func = btf__type_by_id(btf, kfunc->btf_id);
> +	if (!func || !btf_is_func(func))
> +		return false;
> +
> +	proto = btf__type_by_id(btf, func->type);
> +	if (!proto || !btf_is_func_proto(proto))
> +		return false;

I don't like this helper: we walk the params only to decide whether to
walk them again.

What if we change add_arena_tagged_proto() to return original proto if
nothing was tagged? I think one of my early revisions worked like
that. Then the helper could be dropped.

And returning false on bad BTF seems to silently skip the tagging,
and so far we've been failing hard on errors like that.

> +
> +	params = btf_params(proto);
> +	nr_params = btf_vlen(proto);
> +	for (u32 i = 0; i < nr_params; i++) {
> +		if (is_arena_arg(btf, kfunc, &params[i], i))
> +			return true;
> +	}
> +
> +	return false;
> +}
> +
>   static s32 arena_tag_ptr(struct btf *btf, u32 ptr_id, struct kfunc *kfunc)
>   {
>   	const struct btf_type *ptr = btf__type_by_id(btf, ptr_id);
> @@ -1383,11 +1430,10 @@ static s32 add_arena_tagged_proto(struct btf *btf, struct kfunc *kfunc)
>   	}
>   
>   	for (i = 0; i < nr_params; i++) {
> -		if (!is_arena_arg(kfunc, i))
> -			continue;
> -
>   		t = btf__type_by_id(btf, new_proto_id);
>   		params = btf_params(t);
> +		if (!is_arena_arg(btf, kfunc, &params[i], i))
> +			continue;
>   
>   		id = arena_tag_ptr(btf, params[i].type, kfunc);
>   		if (id < 0)
> @@ -1403,7 +1449,7 @@ static s32 add_arena_tagged_proto(struct btf *btf, struct kfunc *kfunc)
>   	return new_proto_id;
>   }
>   
> -static int process_kfunc_with_arena_flags(struct btf2btf_context *ctx,
> +static int process_kfunc_with_arena_attrs(struct btf2btf_context *ctx,
>   					  struct kfunc *kfunc)
>   {
>   	struct btf_type *t;
> @@ -1463,8 +1509,8 @@ static int btf2btf(struct object *obj)
>   				goto out;
>   		}
>   
> -		if (kfunc->flags & (KF_ARENA_RET | KF_ARENA_ARG1 | KF_ARENA_ARG2)) {
> -			err = process_kfunc_with_arena_flags(&ctx, kfunc);
> +		if ((kfunc->flags & KF_ARENA_RET) || kfunc_has_arena_arg(ctx.btf, kfunc)) {

nit: KF_ARENA_RET case short-circuits the arena_arg check here.
Seems benign, but made me pause.

> +			err = process_kfunc_with_arena_attrs(&ctx, kfunc);
>   			if (err)
>   				goto out;
>   		}

[PATCH bpf-next v1 2/2] selftests/bpf: Test resolve_btfids arena argument suffixes

[Kumar Kartikeya Dwivedi]

Add a suffix-only kfunc declaration with arena annotations on all five
arguments. Verify that resolve_btfids emits address_space(1) type tags
for every position without KF_ARENA_ARG flags in the BTF ID sets.

Represent expected arena arguments as a per-parameter bitmap so the
test covers suffixes beyond the two positions expressible by flags.

Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
---
 .../selftests/bpf/prog_tests/resolve_btfids.c | 35 ++++++++++---------
 tools/testing/selftests/bpf/progs/btf_data.c  |  9 +++++
 2 files changed, 28 insertions(+), 16 deletions(-)

diff --git a/tools/testing/selftests/bpf/prog_tests/resolve_btfids.c b/tools/testing/selftests/bpf/prog_tests/resolve_btfids.c
index 732cfed35e1c..9bd84fe32b89 100644
--- a/tools/testing/selftests/bpf/prog_tests/resolve_btfids.c
+++ b/tools/testing/selftests/bpf/prog_tests/resolve_btfids.c
@@ -15,6 +15,7 @@
 #define DECL_TAG_FASTCALL "bpf_fastcall"
 #define DECL_TAG_KFUNC "bpf_kfunc"
 #define TYPE_ATTR_ARENA "address_space(1)"
+#define ARENA_ARG(n) (1U << (n))
 
 #ifndef KF_FASTCALL
 #define KF_FASTCALL (1 << 12)
@@ -49,13 +50,18 @@ struct kfunc_symbol {
 	const char	*name;
 	s32		 id;
 	u32		 flags;
+	u32		 arena_args;
+	bool		 arena_ret;
 };
 
 static struct kfunc_symbol kfunc_symbols[] = {
-	{ "kfunc_a", -1, 0 },
-	{ "kfunc_b", -1, KF_FASTCALL },
-	{ "kfunc_c", -1, KF_ARENA_RET | KF_ARENA_ARG1 | KF_ARENA_ARG2 },
-	{ "kfunc_d", -1, KF_ARENA_ARG2 },
+	{ "kfunc_a", -1, 0, 0, false },
+	{ "kfunc_b", -1, KF_FASTCALL, 0, false },
+	{ "kfunc_c", -1, KF_ARENA_RET | KF_ARENA_ARG1 | KF_ARENA_ARG2,
+	  ARENA_ARG(0) | ARENA_ARG(1), true },
+	{ "kfunc_d", -1, KF_ARENA_ARG2, ARENA_ARG(1), false },
+	{ "kfunc_e", -1, 0, ARENA_ARG(0) | ARENA_ARG(1) | ARENA_ARG(2) |
+	  ARENA_ARG(3) | ARENA_ARG(4), false },
 };
 
 /* Align the .BTF_ids section to 4 bytes */
@@ -105,6 +111,7 @@ BTF_ID_FLAGS(func, kfunc_a)
 BTF_ID_FLAGS(func, kfunc_b, KF_FASTCALL)
 BTF_ID_FLAGS(func, kfunc_c, KF_ARENA_RET | KF_ARENA_ARG1 | KF_ARENA_ARG2)
 BTF_ID_FLAGS(func, kfunc_d, KF_ARENA_ARG2)
+BTF_ID_FLAGS(func, kfunc_e)
 BTF_KFUNCS_END(test_kfunc_set)
 
 /*
@@ -112,6 +119,7 @@ BTF_KFUNCS_END(test_kfunc_set)
  * actually sort at least one of the two sets.
  */
 BTF_KFUNCS_START(test_kfunc_set_rev)
+BTF_ID_FLAGS(func, kfunc_e)
 BTF_ID_FLAGS(func, kfunc_d, KF_ARENA_ARG2)
 BTF_ID_FLAGS(func, kfunc_c, KF_ARENA_RET | KF_ARENA_ARG1 | KF_ARENA_ARG2)
 BTF_ID_FLAGS(func, kfunc_b, KF_FASTCALL)
@@ -301,15 +309,15 @@ void test_resolve_btfids(void)
 	}
 
 	/*
-	 * Check resolve_btfids wrapped exactly the arena-flagged return/args
-	 * with the address_space(1) type attribute, and left other
+	 * Check resolve_btfids wrapped exactly the arena-flagged or suffixed
+	 * return/args with the address_space(1) type attribute, and left other
 	 * pointers/returns untouched.
 	 */
 	for (i = 0; i < ARRAY_SIZE(kfunc_symbols); i++) {
 		const struct btf_type *fn, *proto;
 		const struct btf_param *params;
 		const char *name = kfunc_symbols[i].name;
-		u32 fl = kfunc_symbols[i].flags;
+		u32 arena_args = kfunc_symbols[i].arena_args;
 		__u32 nr;
 
 		fn = btf__type_by_id(btf, kfunc_symbols[i].id);
@@ -322,15 +330,10 @@ void test_resolve_btfids(void)
 		nr = btf_vlen(proto);
 
 		ASSERT_EQ(is_arena_tagged_ptr(btf, proto->type),
-			  !!(fl & KF_ARENA_RET), name);
-		if (nr > 0) {
-			ASSERT_EQ(is_arena_tagged_ptr(btf, params[0].type),
-				  !!(fl & KF_ARENA_ARG1), name);
-		}
-		if (nr > 1) {
-			ASSERT_EQ(is_arena_tagged_ptr(btf, params[1].type),
-				  !!(fl & KF_ARENA_ARG2), name);
-		}
+			  kfunc_symbols[i].arena_ret, name);
+		for (j = 0; j < nr; j++)
+			ASSERT_EQ(is_arena_tagged_ptr(btf, params[j].type),
+				  !!(arena_args & ARENA_ARG(j)), name);
 	}
 
 out:
diff --git a/tools/testing/selftests/bpf/progs/btf_data.c b/tools/testing/selftests/bpf/progs/btf_data.c
index ec34f7a6e038..ea41c9801432 100644
--- a/tools/testing/selftests/bpf/progs/btf_data.c
+++ b/tools/testing/selftests/bpf/progs/btf_data.c
@@ -68,3 +68,12 @@ int kfunc_d(struct root_struct *a, struct root_struct *b)
 {
 	return 0;
 }
+
+int kfunc_e(struct root_struct *a__arena,
+	    struct root_struct *b__arena__nullable,
+	    struct root_struct *c__arena,
+	    struct root_struct *d__arena__nullable,
+	    struct root_struct *e__arena)
+{
+	return 0;
+}
-- 
2.53.0-Meta

Re: [PATCH bpf-next v1 2/2] selftests/bpf: Test resolve_btfids arena argument suffixes

[bot+bpf-ci]

[-- Attachment #1: Type: text/plain, Size: 2599 bytes --]

> diff --git a/tools/testing/selftests/bpf/prog_tests/resolve_btfids.c b/tools/testing/selftests/bpf/prog_tests/resolve_btfids.c
> index 732cfed35e1c..9bd84fe32b89 100644
> --- a/tools/testing/selftests/bpf/prog_tests/resolve_btfids.c
> +++ b/tools/testing/selftests/bpf/prog_tests/resolve_btfids.c
> @@ -15,6 +15,7 @@
>  #define DECL_TAG_FASTCALL "bpf_fastcall"
>  #define DECL_TAG_KFUNC "bpf_kfunc"
>  #define TYPE_ATTR_ARENA "address_space(1)"
> +#define ARENA_ARG(n) (1U << (n))

This isn't a bug, but ARENA_ARG(n) is zero-based while the KF_ARENA_ARGn
flags it sits next to are one-based, so the same argument is spelled two
different ways inside a single table row.

For example, '{ "kfunc_d", -1, KF_ARENA_ARG2, ARENA_ARG(1), false }'
means KF_ARENA_ARG2 and ARENA_ARG(1) refer to the same parameter.

Would a name like ARENA_ARG_IDX(n), or a short comment noting that
ARENA_ARG(0) corresponds to KF_ARENA_ARG1, help keep the two columns
from drifting?

[ ... ]

> @@ -49,13 +50,18 @@ struct kfunc_symbol {
>  	const char	*name;
>  	s32		 id;
>  	u32		 flags;
> +	u32		 arena_args;
> +	bool		 arena_ret;
>  };
>
>  static struct kfunc_symbol kfunc_symbols[] = {
> -	{ "kfunc_a", -1, 0 },
> -	{ "kfunc_b", -1, KF_FASTCALL },
> -	{ "kfunc_c", -1, KF_ARENA_RET | KF_ARENA_ARG1 | KF_ARENA_ARG2 },
> -	{ "kfunc_d", -1, KF_ARENA_ARG2 },
> +	{ "kfunc_a", -1, 0, 0, false },
> +	{ "kfunc_b", -1, KF_FASTCALL, 0, false },
> +	{ "kfunc_c", -1, KF_ARENA_RET | KF_ARENA_ARG1 | KF_ARENA_ARG2,
> +	  ARENA_ARG(0) | ARENA_ARG(1), true },
> +	{ "kfunc_d", -1, KF_ARENA_ARG2, ARENA_ARG(1), false },
> +	{ "kfunc_e", -1, 0, ARENA_ARG(0) | ARENA_ARG(1) | ARENA_ARG(2) |
> +	  ARENA_ARG(3) | ARENA_ARG(4), false },
>  };

This isn't a bug, but the new arena_ret field duplicates information
that the existing flags field already carries.

resolve_btfids only ever arena-tags a return value from KF_ARENA_RET:

tools/bpf/resolve_btfids/main.c:add_arena_tagged_proto() {
    ...
    if (kfunc->flags & KF_ARENA_RET)
        /* tag return */
    ...
}

There is no return-position suffix mechanism, so arena_ret is exactly
!!(flags & KF_ARENA_RET) for every row and the old expression it
replaced was already correct.

Since only KF_ARENA_RET drives return tagging, could the return
assertion keep using !!(flags & KF_ARENA_RET) instead of the new
arena_ret field?

[ ... ]


---
AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md

CI run summary: https://github.com/kernel-patches/bpf/actions/runs/31305217088

Re: [PATCH bpf-next v1 2/2] selftests/bpf: Test resolve_btfids arena argument suffixes

[Kumar Kartikeya Dwivedi]

On Sun Aug 9, 2026 at 11:57 AM CEST, bot+bpf-ci wrote:
>> diff --git a/tools/testing/selftests/bpf/prog_tests/resolve_btfids.c b/tools/testing/selftests/bpf/prog_tests/resolve_btfids.c
>> index 732cfed35e1c..9bd84fe32b89 100644
>> --- a/tools/testing/selftests/bpf/prog_tests/resolve_btfids.c
>> +++ b/tools/testing/selftests/bpf/prog_tests/resolve_btfids.c
>> @@ -15,6 +15,7 @@
>>  #define DECL_TAG_FASTCALL "bpf_fastcall"
>>  #define DECL_TAG_KFUNC "bpf_kfunc"
>>  #define TYPE_ATTR_ARENA "address_space(1)"
>> +#define ARENA_ARG(n) (1U << (n))
>
> This isn't a bug, but ARENA_ARG(n) is zero-based while the KF_ARENA_ARGn
> flags it sits next to are one-based, so the same argument is spelled two
> different ways inside a single table row.
>
> For example, '{ "kfunc_d", -1, KF_ARENA_ARG2, ARENA_ARG(1), false }'
> means KF_ARENA_ARG2 and ARENA_ARG(1) refer to the same parameter.
>
> Would a name like ARENA_ARG_IDX(n), or a short comment noting that
> ARENA_ARG(0) corresponds to KF_ARENA_ARG1, help keep the two columns
> from drifting?
>

I think it's ok, we might drop the other flag soon anyhow.

> [ ... ]
>
>> @@ -49,13 +50,18 @@ struct kfunc_symbol {
>>  	const char	*name;
>>  	s32		 id;
>>  	u32		 flags;
>> +	u32		 arena_args;
>> +	bool		 arena_ret;
>>  };
>>
>>  static struct kfunc_symbol kfunc_symbols[] = {
>> -	{ "kfunc_a", -1, 0 },
>> -	{ "kfunc_b", -1, KF_FASTCALL },
>> -	{ "kfunc_c", -1, KF_ARENA_RET | KF_ARENA_ARG1 | KF_ARENA_ARG2 },
>> -	{ "kfunc_d", -1, KF_ARENA_ARG2 },
>> +	{ "kfunc_a", -1, 0, 0, false },
>> +	{ "kfunc_b", -1, KF_FASTCALL, 0, false },
>> +	{ "kfunc_c", -1, KF_ARENA_RET | KF_ARENA_ARG1 | KF_ARENA_ARG2,
>> +	  ARENA_ARG(0) | ARENA_ARG(1), true },
>> +	{ "kfunc_d", -1, KF_ARENA_ARG2, ARENA_ARG(1), false },
>> +	{ "kfunc_e", -1, 0, ARENA_ARG(0) | ARENA_ARG(1) | ARENA_ARG(2) |
>> +	  ARENA_ARG(3) | ARENA_ARG(4), false },
>>  };
>
> This isn't a bug, but the new arena_ret field duplicates information
> that the existing flags field already carries.
>
> resolve_btfids only ever arena-tags a return value from KF_ARENA_RET:
>
> tools/bpf/resolve_btfids/main.c:add_arena_tagged_proto() {
>     ...
>     if (kfunc->flags & KF_ARENA_RET)
>         /* tag return */
>     ...
> }
>
> There is no return-position suffix mechanism, so arena_ret is exactly
> !!(flags & KF_ARENA_RET) for every row and the old expression it
> replaced was already correct.
>
> Since only KF_ARENA_RET drives return tagging, could the return
> assertion keep using !!(flags & KF_ARENA_RET) instead of the new
> arena_ret field?
>

I found this more clear, but am fine with reworking in any direction.

> [ ... ]
>
>
> ---
> AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
> See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md
>
> CI run summary: https://github.com/kernel-patches/bpf/actions/runs/31305217088

Re: [PATCH bpf-next v1 2/2] selftests/bpf: Test resolve_btfids arena argument suffixes

[Ihor Solodrai]

On 2026-08-09 1:51 a.m., Kumar Kartikeya Dwivedi wrote:
> Add a suffix-only kfunc declaration with arena annotations on all five
> arguments. Verify that resolve_btfids emits address_space(1) type tags
> for every position without KF_ARENA_ARG flags in the BTF ID sets.
> 
> Represent expected arena arguments as a per-parameter bitmap so the
> test covers suffixes beyond the two positions expressible by flags.
> 
> Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
> ---
>   .../selftests/bpf/prog_tests/resolve_btfids.c | 35 ++++++++++---------
>   tools/testing/selftests/bpf/progs/btf_data.c  |  9 +++++
>   2 files changed, 28 insertions(+), 16 deletions(-)
> 
> diff --git a/tools/testing/selftests/bpf/prog_tests/resolve_btfids.c b/tools/testing/selftests/bpf/prog_tests/resolve_btfids.c
> index 732cfed35e1c..9bd84fe32b89 100644
> --- a/tools/testing/selftests/bpf/prog_tests/resolve_btfids.c
> +++ b/tools/testing/selftests/bpf/prog_tests/resolve_btfids.c
> @@ -15,6 +15,7 @@
>   #define DECL_TAG_FASTCALL "bpf_fastcall"
>   #define DECL_TAG_KFUNC "bpf_kfunc"
>   #define TYPE_ATTR_ARENA "address_space(1)"
> +#define ARENA_ARG(n) (1U << (n))
>   
>   #ifndef KF_FASTCALL
>   #define KF_FASTCALL (1 << 12)
> @@ -49,13 +50,18 @@ struct kfunc_symbol {
>   	const char	*name;
>   	s32		 id;
>   	u32		 flags;
> +	u32		 arena_args;
> +	bool		 arena_ret;
>   };
>   
>   static struct kfunc_symbol kfunc_symbols[] = {
> -	{ "kfunc_a", -1, 0 },
> -	{ "kfunc_b", -1, KF_FASTCALL },
> -	{ "kfunc_c", -1, KF_ARENA_RET | KF_ARENA_ARG1 | KF_ARENA_ARG2 },
> -	{ "kfunc_d", -1, KF_ARENA_ARG2 },
> +	{ "kfunc_a", -1, 0, 0, false },
> +	{ "kfunc_b", -1, KF_FASTCALL, 0, false },
> +	{ "kfunc_c", -1, KF_ARENA_RET | KF_ARENA_ARG1 | KF_ARENA_ARG2,
> +	  ARENA_ARG(0) | ARENA_ARG(1), true },
> +	{ "kfunc_d", -1, KF_ARENA_ARG2, ARENA_ARG(1), false },
> +	{ "kfunc_e", -1, 0, ARENA_ARG(0) | ARENA_ARG(1) | ARENA_ARG(2) |
> +	  ARENA_ARG(3) | ARENA_ARG(4), false },
>   };
>   
>   /* Align the .BTF_ids section to 4 bytes */
> @@ -105,6 +111,7 @@ BTF_ID_FLAGS(func, kfunc_a)
>   BTF_ID_FLAGS(func, kfunc_b, KF_FASTCALL)
>   BTF_ID_FLAGS(func, kfunc_c, KF_ARENA_RET | KF_ARENA_ARG1 | KF_ARENA_ARG2)
>   BTF_ID_FLAGS(func, kfunc_d, KF_ARENA_ARG2)
> +BTF_ID_FLAGS(func, kfunc_e)

It really makes me uneasy that we now can have some kfuncs that are
flagged with ARENA flags, and others that are not, but still work with
arena pointers.

But I guess we decided to remove the flags soon(tm), oh well.

>   BTF_KFUNCS_END(test_kfunc_set)
>   
>   /*
> @@ -112,6 +119,7 @@ BTF_KFUNCS_END(test_kfunc_set)
>    * actually sort at least one of the two sets.
>    */
>   BTF_KFUNCS_START(test_kfunc_set_rev)
> +BTF_ID_FLAGS(func, kfunc_e)
>   BTF_ID_FLAGS(func, kfunc_d, KF_ARENA_ARG2)
>   BTF_ID_FLAGS(func, kfunc_c, KF_ARENA_RET | KF_ARENA_ARG1 | KF_ARENA_ARG2)
>   BTF_ID_FLAGS(func, kfunc_b, KF_FASTCALL)
> @@ -301,15 +309,15 @@ void test_resolve_btfids(void)
>   	}
>   
>   	/*
> -	 * Check resolve_btfids wrapped exactly the arena-flagged return/args
> -	 * with the address_space(1) type attribute, and left other
> +	 * Check resolve_btfids wrapped exactly the arena-flagged or suffixed
> +	 * return/args with the address_space(1) type attribute, and left other
>   	 * pointers/returns untouched.
>   	 */
>   	for (i = 0; i < ARRAY_SIZE(kfunc_symbols); i++) {
>   		const struct btf_type *fn, *proto;
>   		const struct btf_param *params;
>   		const char *name = kfunc_symbols[i].name;
> -		u32 fl = kfunc_symbols[i].flags;
> +		u32 arena_args = kfunc_symbols[i].arena_args;
>   		__u32 nr;
>   
>   		fn = btf__type_by_id(btf, kfunc_symbols[i].id);
> @@ -322,15 +330,10 @@ void test_resolve_btfids(void)
>   		nr = btf_vlen(proto);
>   
>   		ASSERT_EQ(is_arena_tagged_ptr(btf, proto->type),
> -			  !!(fl & KF_ARENA_RET), name);
> -		if (nr > 0) {
> -			ASSERT_EQ(is_arena_tagged_ptr(btf, params[0].type),
> -				  !!(fl & KF_ARENA_ARG1), name);
> -		}
> -		if (nr > 1) {
> -			ASSERT_EQ(is_arena_tagged_ptr(btf, params[1].type),
> -				  !!(fl & KF_ARENA_ARG2), name);
> -		}
> +			  kfunc_symbols[i].arena_ret, name);
> +		for (j = 0; j < nr; j++)
> +			ASSERT_EQ(is_arena_tagged_ptr(btf, params[j].type),
> +				  !!(arena_args & ARENA_ARG(j)), name);
>   	}
>   
>   out:
> diff --git a/tools/testing/selftests/bpf/progs/btf_data.c b/tools/testing/selftests/bpf/progs/btf_data.c
> index ec34f7a6e038..ea41c9801432 100644
> --- a/tools/testing/selftests/bpf/progs/btf_data.c
> +++ b/tools/testing/selftests/bpf/progs/btf_data.c
> @@ -68,3 +68,12 @@ int kfunc_d(struct root_struct *a, struct root_struct *b)
>   {
>   	return 0;
>   }
> +
> +int kfunc_e(struct root_struct *a__arena,
> +	    struct root_struct *b__arena__nullable,
> +	    struct root_struct *c__arena,
> +	    struct root_struct *d__arena__nullable,
> +	    struct root_struct *e__arena)

Can we have test cases with mixed args too?

   int kfunc_f(struct foo *a, struct bar *b__arena, int flags)

And also one with both KF_ARENA_RET flag and __arena suffixed args?

> +{
> +	return 0;
> +}