Re: [PATCH bpf-next v4 08/13] selftests/bpf: Add kfunc __arena and __arena__nullable argument tests

[Eduard Zingerman <eddyz87@gmail.com>]

On Wed, 2026-08-05 at 23:04 +0200, Kumar Kartikeya Dwivedi wrote:
> From: Tejun Heo <tj@kernel.org>
> 
> Add arena-argument kfuncs to bpf_testmod, which also exercises the
> argument rebasing on module kfuncs, and tests covering the accepted
> argument forms (arena pointer, low 32 bits as a scalar, full user
> address as a scalar), the exact rebase semantics via capture kfuncs
> returning the raw argument (zero low 32 bits arrive as the arena kernel
> base under __arena and as NULL under __arena__nullable), a NULL round
> trip through a nullable deref kfunc, five arena arguments in one call, a
> mixed __arena plus __arena__nullable call exercising both bitmasks on one
> call site, a kernel-side dereference of an unpopulated page recovering
> through the scratch page, and the rejections (no arena in the program,
> incompatible register type).
> 
> The tests run on x86-64 and skip elsewhere, as programs with
> arena-tagged kfunc args fail verification where the JIT lacks support.
> 
> Signed-off-by: Tejun Heo <tj@kernel.org>
> Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
> ---

Acked-by: Eduard Zingerman <eddyz87@gmail.com>

...

> diff --git a/tools/testing/selftests/bpf/prog_tests/verifier.c b/tools/testing/selftests/bpf/prog_tests/verifier.c
> index b79bafca68f7..7eaee71783b6 100644
> --- a/tools/testing/selftests/bpf/prog_tests/verifier.c
> +++ b/tools/testing/selftests/bpf/prog_tests/verifier.c
> @@ -2,6 +2,7 @@
>  
>  #include <test_progs.h>
>  
> +#include "arena_kfunc.skel.h"
>  #include "cap_helpers.h"
>  #include "verifier_align.skel.h"
>  #include "verifier_and.skel.h"
> @@ -161,6 +162,13 @@ static void run_tests_aux(const char *skel_name,
>  
>  #define RUN(skel) run_tests_aux(#skel, skel##__elf_bytes, NULL)
>  
> +/*
> + * The test kfuncs live in bpf_testmod. Resolving kfuncs against module
> + * BTFs needs CAP_SYS_ADMIN, so run with full capabilities instead of
> + * through the verifier tests' capability-restricted runner.
> + */

Nit: useless comment.

> +void test_arena_kfunc(void)                   { RUN_TESTS(arena_kfunc); }
> +
>  void test_verifier_align(void)                { RUN(verifier_align); }
>  void test_verifier_and(void)                  { RUN(verifier_and); }
>  void test_verifier_arena(void)                { RUN(verifier_arena); }
> diff --git a/tools/testing/selftests/bpf/progs/arena_kfunc.c b/tools/testing/selftests/bpf/progs/arena_kfunc.c
> new file mode 100644
> index 000000000000..d6c382ce81af
> --- /dev/null
> +++ b/tools/testing/selftests/bpf/progs/arena_kfunc.c

...

> +SEC("syscall")
> +__arch_x86_64
> +__success __retval(0)
> +int arena_arg_rebase(void *ctx)
> +{
> +#if defined(__BPF_FEATURE_ADDR_SPACE_CAST)
> +	u64 __arena *val;
> +	u64 base, off;
> +
> +	val = bpf_arena_alloc_pages(&arena, NULL, 1, NUMA_NO_NODE, 0);
> +	if (!val)
> +		return 1;
> +
> +	base = bpf_kfunc_arena_cap_test(NULL);
> +	if (!base)
> +		return 2;
> +
> +	/* only the low 32 bits contribute */
> +	stash = 0xbadc0ffe00000000;
> +	if (bpf_kfunc_arena_cap_test((u64 *)stash) != base)
> +		return 3;
> +
> +	off = (u32)(u64)val;
> +	if (bpf_kfunc_arena_cap_test((u64 *)val) != base + off)
> +		return 4;
> +
> +	if (bpf_kfunc_arena_cap_nullable_test(NULL) != 0)
> +		return 5;
> +
> +	stash = 0xbadc0ffe00000000;
> +	if (bpf_kfunc_arena_cap_nullable_test((u64 *)stash) != 0)
> +		return 6;
> +
> +	if (bpf_kfunc_arena_cap_nullable_test((u64 *)val) != base + off)
> +		return 7;
> +
> +	bpf_arena_free_pages(&arena, (void __arena *)val, 1);
> +#endif
> +	return 0;
> +}
> +
> +SEC("syscall")
> +__arch_x86_64
> +__success __retval(0)
> +int arena_arg_nullable(void *ctx)

Nit: This test seem to test the same thing as the group of
     bpf_kfunc_arena_cap_nullable_test() in the previous test.
     I'd drop the one or the other.

> +{
> +#if defined(__BPF_FEATURE_ADDR_SPACE_CAST)
> +	u64 __arena *val;
> +	u64 ret;
> +
> +	val = bpf_arena_alloc_pages(&arena, NULL, 1, NUMA_NO_NODE, 0);
> +	if (!val)
> +		return 1;
> +
> +	*val = 41;
> +	ret = bpf_kfunc_arena_nullable_arg_test((u64 *)val);
> +	if (ret != 41 || *val != 42)
> +		return 2;
> +
> +	if (bpf_kfunc_arena_nullable_arg_test(NULL) != 0xdeadbeef)
> +		return 3;
> +
> +	bpf_arena_free_pages(&arena, (void __arena *)val, 1);
> +#endif
> +	return 0;
> +}

...