BPF List
 help / color / mirror / Atom feed
* [PATCH bpf-next v4 00/12] bpf: Allow arena pointers in by-value returns
@ 2026-08-29  6:15 Yonghong Song
  2026-08-29  6:15 ` [PATCH bpf-next v4 01/12] bpf: Record each half of a paired return value in verifier diagnostics Yonghong Song
                   ` (12 more replies)
  0 siblings, 13 replies; 18+ messages in thread
From: Yonghong Song @ 2026-08-29  6:15 UTC (permalink / raw)
  To: bpf
  Cc: Alexei Starovoitov, Andrii Nakryiko, Daniel Borkmann,
	Eduard Zingerman, kernel-team

A function returning a struct by value may only return one whose members
are all scalars. That is stricter than it needs to be: an arena pointer
is safe to hand over as raw register bits, and both a global function
and a kfunc can already return one on its own.

This patch set allows returning arena pointer(s) (as member(s) of a
struct) for global functions and kfuncs. Any other pointer member stays
rejected, as it would be laundered into a scalar and escape provenance
and reference tracking.

Patch 1 fixes a diagnostics bug. Patches 2-4 are refactoring with no
functional change. Patch 5 checked (nested) arrays until non-array type
to be checked by struct or other types. Patch 6 improves the diagnostics
for an unsupported return type, and patches 7-8 allow arena pointer members.
Patches 9-11 are selftests. Patch 12 updates the kfunc's doc.

Changelog:
  v3 -> v4:
    - v3: https://lore.kernel.org/bpf/20260827061114.2514603-1-yonghong.song@linux.dev/
    - Generate type string(s) for those verifier rejected kfunc's.
    - For global function, disable returning arena pointer if main prog.
    - Add additional tests for rejected kfunc type string(s).
  v2 -> v3:
    - v2: https://lore.kernel.org/bpf/20260825205412.1320099-1-yonghong.song@linux.dev/
    - Fix two more verifier diagnostics.
    - Fix btf_member_path_str() by detecting anonymous union/struct.
    - Fix a few arena tests with non-zero arena pointers.
    - Update kfuncs doc for supporting return value with arena pointers.
  v1 -> v2:
    - v1: https://lore.kernel.org/bpf/20260824144943.991316-1-yonghong.song@linux.dev/
    - Add nested struct field names for diagnostics, and report the
      nesting depth for a type nested past the walk limit.
    - Allow to return arena pointers for global functions and kfuncs.
    - Necessary selftests for newly supported arena pointers.

Yonghong Song (12):
  bpf: Record each half of a paired return value in verifier diagnostics
  bpf: Drop the recursion depth argument of btf_type_is_scalar_struct()
  bpf: Add btf_type_is_arena_ptr()
  bpf: Let the by-value struct walk take the kinds of member it accepts
  bpf: Let a by-value struct nest arrays and structs freely
  bpf: Report which member makes a kfunc return type unsupported
  bpf: Allow a global function to return arena pointers by value
  bpf: Allow arena pointers in a by-value kfunc return
  selftests/bpf: Check the member named for an unsupported kfunc return
    type
  selftests/bpf: Test global functions returning arena pointers by value
  selftests/bpf: Test kfuncs returning arena pointers by value
  docs/bpf: Document arena pointers in a by-value return

 Documentation/bpf/kfuncs.rst                  |  39 +--
 include/linux/bpf_verifier.h                  |  11 +-
 include/linux/btf.h                           |   1 +
 kernel/bpf/btf.c                              |  90 ++++---
 kernel/bpf/verifier.c                         | 228 ++++++++++++++----
 .../selftests/bpf/prog_tests/aggregate_ret.c  |  42 ++++
 .../selftests/bpf/progs/aggregate_ret_func.c  | 146 +++++++++++
 .../selftests/bpf/progs/aggregate_ret_kfunc.c |  84 ++++++-
 .../bpf/progs/aggregate_ret_kfunc_arena.c     | 121 ++++++++++
 .../selftests/bpf/progs/exceptions_fail.c     |   2 +-
 .../selftests/bpf/progs/verifier_arena.c      |  48 ++++
 .../selftests/bpf/test_kmods/bpf_testmod.c    |  72 ++++++
 .../bpf/test_kmods/bpf_testmod_kfunc.h        |  72 ++++++
 13 files changed, 850 insertions(+), 106 deletions(-)
 create mode 100644 tools/testing/selftests/bpf/progs/aggregate_ret_kfunc_arena.c

-- 
2.53.0-Meta


^ permalink raw reply	[flat|nested] 18+ messages in thread
end of thread, other threads:[~2026-08-31  2:42 UTC | newest]

Thread overview: 18+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-08-29  6:15 [PATCH bpf-next v4 00/12] bpf: Allow arena pointers in by-value returns Yonghong Song
2026-08-29  6:15 ` [PATCH bpf-next v4 01/12] bpf: Record each half of a paired return value in verifier diagnostics Yonghong Song
2026-08-29  6:15 ` [PATCH bpf-next v4 02/12] bpf: Drop the recursion depth argument of btf_type_is_scalar_struct() Yonghong Song
2026-08-29  6:15 ` [PATCH bpf-next v4 03/12] bpf: Add btf_type_is_arena_ptr() Yonghong Song
2026-08-29  6:15 ` [PATCH bpf-next v4 04/12] bpf: Let the by-value struct walk take the kinds of member it accepts Yonghong Song
2026-08-29  6:15 ` [PATCH bpf-next v4 05/12] bpf: Let a by-value struct nest arrays and structs freely Yonghong Song
2026-08-29  7:11   ` bot+bpf-ci
2026-08-29  6:15 ` [PATCH bpf-next v4 06/12] bpf: Report which member makes a kfunc return type unsupported Yonghong Song
2026-08-29  7:11   ` bot+bpf-ci
2026-08-29  6:15 ` [PATCH bpf-next v4 07/12] bpf: Allow a global function to return arena pointers by value Yonghong Song
2026-08-29  6:15 ` [PATCH bpf-next v4 08/12] bpf: Allow arena pointers in a by-value kfunc return Yonghong Song
2026-08-29  6:16 ` [PATCH bpf-next v4 09/12] selftests/bpf: Check the member named for an unsupported kfunc return type Yonghong Song
2026-08-29  6:16 ` [PATCH bpf-next v4 10/12] selftests/bpf: Test global functions returning arena pointers by value Yonghong Song
2026-08-29  6:16 ` [PATCH bpf-next v4 11/12] selftests/bpf: Test kfuncs " Yonghong Song
2026-08-29  6:16 ` [PATCH bpf-next v4 12/12] docs/bpf: Document arena pointers in a by-value return Yonghong Song
2026-08-30  1:33   ` Kumar Kartikeya Dwivedi
2026-08-31  2:42     ` Yonghong Song
2026-08-30  1:20 ` [PATCH bpf-next v4 00/12] bpf: Allow arena pointers in by-value returns patchwork-bot+netdevbpf

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox