[PATCHSET SLOP RFC 0/6] bpf: make arena pointers first-class kfunc and struct_ops arguments

[Tejun Heo <tj@kernel.org>]

RFC. I am not familiar with the BPF verifier code base and this series is
heavily AI-assisted. I reviewed and iterated on all of it but leaned on the
AI outright in places.

BPF arena memory is shared between a BPF program and the kernel, but the two
sides address it through different bases, so an arena pointer cannot be
passed across the kfunc or struct_ops boundary as a pointer. It crosses as a
bare scalar, and the receiving side then offsets it to the other address
space and casts it by hand. Every kfunc and struct_ops caller that touches
arena memory open-codes the same translation.

This series adds an __arena argument suffix that makes the translation
automatic. The callee declares the parameter by its real pointer type and
dereferences it directly, and the verifier rebases it at the boundary
(arena to kernel address into a kfunc, kernel address to arena into a
struct_ops callback), with NULL preserved. The pointer arrives ready to use
on both sides, with no scalar laundering and no hand-written offset or cast.

The approach comes out of rough discussions with Alexei and Kumar.

Patches 1-4 are the BPF core support plus selftests, the kfunc direction
then the struct_ops direction. Patches 5-6 convert two sched_ext consumers
to show the result. They are marked NOT_SIGNED_OFF and are not meant to be
applied. sched_ext has moved on since, notably the pending cap work, so once
the core lands the plan is to pull bpf-next into sched_ext and redo the
consumer side there.

Tested: the BPF selftests pass at bpf_jit_harden 0/1/2, the arena,
struct_ops and kfunc regression suites are clean, and scx_qmap schedules
correctly through the converted paths.

Tejun Heo (6):
  bpf: Support __arena suffix for kfunc arguments
  selftests/bpf: Add kfunc __arena argument tests
  bpf: Support __arena suffix on struct_ops stub arguments
  selftests/bpf: Add struct_ops __arena argument tests
  sched_ext: Pass a kernel arena pointer to ops_cid.set_cmask()
  sched_ext: Convert scx_bpf_cid_override() to take an arena pointer

 Documentation/bpf/kfuncs.rst                  |  27 ++++
 include/linux/bpf_verifier.h                  |   2 +
 kernel/bpf/bpf_struct_ops.c                   |  17 ++-
 kernel/bpf/btf.c                              |  10 +-
 kernel/bpf/fixups.c                           |  70 +++++++++
 kernel/bpf/verifier.c                         | 103 +++++++++++--
 kernel/sched/ext/cid.c                        |  24 +++-
 kernel/sched/ext/ext.c                        |  11 +-
 kernel/sched/ext/internal.h                   |  16 +--
 tools/sched_ext/include/scx/compat.bpf.h      |   8 +-
 tools/sched_ext/scx_qmap.bpf.c                |  13 +-
 tools/sched_ext/scx_qmap.c                    |  41 ++++--
 tools/sched_ext/scx_qmap.h                    |   3 +
 .../selftests/bpf/prog_tests/arena_kfunc.c    |  14 ++
 .../bpf/prog_tests/test_struct_ops_arena.c    |  61 ++++++++
 .../testing/selftests/bpf/progs/arena_kfunc.c | 135 ++++++++++++++++++
 .../selftests/bpf/progs/struct_ops_arena.c    |  67 +++++++++
 .../bpf/progs/struct_ops_arena_fail.c         |  20 +++
 .../selftests/bpf/test_kmods/bpf_testmod.c    |  45 ++++++
 .../selftests/bpf/test_kmods/bpf_testmod.h    |   2 +
 .../bpf/test_kmods/bpf_testmod_kfunc.h        |   5 +
 21 files changed, 622 insertions(+), 72 deletions(-)
 create mode 100644 tools/testing/selftests/bpf/prog_tests/arena_kfunc.c
 create mode 100644 tools/testing/selftests/bpf/prog_tests/test_struct_ops_arena.c
 create mode 100644 tools/testing/selftests/bpf/progs/arena_kfunc.c
 create mode 100644 tools/testing/selftests/bpf/progs/struct_ops_arena.c
 create mode 100644 tools/testing/selftests/bpf/progs/struct_ops_arena_fail.c

-- 
2.55.0