kernel/git/stable/linux.git/Documentation/bpf, branch master

bpf, arm64: Convert struct_ops arena arguments in the trampoline

2026-08-14T03:55:02+00:00

Implement the struct_ops arena argument conversion on arm64. save_args() receives the arena base from bpf_tramp_arena_base() and consults the btf_func_model argument flags as it copies each native argument into the BPF ctx, routing a marked argument through x10 with the low half of the base materialized once into x11: sub w10, wsrc, w11 /* truncate and clear the upper 32 bits */ str x10, [sp, #slot] A nullable argument tests the full 64-bit kernel pointer first: mov x10, xsrc cbz x10, 1f sub w10, w10, w11 1: str x10, [sp, #slot] The 32-bit subtraction is sufficient since (u32)(kaddr - base) == (u32)kaddr - (u32)base, and it clears the upper half as the JITs require of arena pointer registers. Stack-passed arguments already reload through x10, so only the subtraction (and the NULL test) is inserted there. The register loop now walks arguments rather than registers so that the per-argument flags line up with the slots a multi-slot argument occupies; the sequence of stores is otherwise unchanged. bpf_tramp_arena_base() returns a base only for a single-program struct_ops indirect trampoline, so a tracing trampoline emits exactly what it did before and never touches x11. The size probe reruns the same emission with the same model and nodes, so the image size matches by construction. Conversion must never reach the original function, which takes kernel addresses. That holds because BPF_TRAMP_F_INDIRECT is incompatible with BPF_TRAMP_F_CALL_ORIG, so pass 0 rather than the base to the call-origin save_args() and assert the flag combination the same way x86 does, rather than leaving the invariant to a comment. With both the kfunc and struct_ops directions implemented, flip bpf_jit_supports_arena_args() on for arm64 and drop the x86-64-only qualifier from the kfunc documentation. Signed-off-by: Puranjay Mohan Reviewed-by: Xu Kuohai Link: https://lore.kernel.org/bpf/20260813190356.335181-5-puranjay@kernel.org Signed-off-by: Kumar Kartikeya Dwivedi

resolve_btfids: Emit arena attributes from kfunc parameter suffixes

2026-08-13T01:28:49+00:00

Kfunc declarations can identify arena arguments through parameter name suffixes without repeating KF_ARENA_ARG flags in their BTF ID sets. resolve_btfids currently misses those arguments when synthesizing the address_space(1) attributes used by generated vmlinux.h files. Teach the arena prototype rewrite to recognize __arena and __arena__nullable directly on each parameter. Keep KF_ARENA_ARG1 and KF_ARENA_ARG2 handling for explicitly flagged kfuncs, while allowing suffixes on any argument without synthesizing kfunc flags. Signed-off-by: Kumar Kartikeya Dwivedi Link: https://patch.msgid.link/20260812193842.2879226-2-memxor@gmail.com Signed-off-by: Eduard Zingerman

bpf: Support arena and arena__nullable on struct_ops arguments

2026-08-08T10:03:26+00:00

A struct_ops callback cannot receive an arena pointer directly, so passing one takes two steps. The pointer arrives as a bare u64 that the callback casts, and because the two sides address the arena through different bases it also has to be rebased by hand on the way in. Add the __arena and __arena__nullable stub argument suffixes to make this convenient. The callback declares the parameter as an arena pointer, receives it as a PTR_TO_ARENA register, and dereferences it directly, while the kernel caller just passes the natural kernel arena address (kaddr). The trampoline converts the value while saving the arguments into the BPF ctx, ctx[slot] = (u32)(kaddr - kern_vm_start), so the program never sees a kernel address and nothing rewrites the ctx after the fact. The converted value keeps the upper 32 bits clear as the JITs require of arena pointer registers and behaves like any cast_kern'ed arena pointer, so cast_user recovers the full user-visible address. __arena converts unconditionally and the kernel caller must not pass NULL. __arena__nullable preserves NULL, tested on the full 64-bit kernel pointer, and surfaces to the verifier as PTR_TO_ARENA (but not as a PTR_TO_ARENA | PTR_MAYBE_NULL). The reason is that PTR_TO_ARENA in the program's type state already encompasses NULL-ness, so it is not meaningful to force a NULL check for the program. The composite suffix intentionally ends in __nullable. Classify __arena__nullable before the generic suffix so scalar arena pointees do not take the generic nullable BTF pointer path. This patch adds the generic side. prepare_arg_info() records arena and nullable argument flags in the struct_ops function model, and bpf_tramp_arena_base() returns the arena base for a single-program struct_ops indirect trampoline. Only that trampoline converts: its program's arena is fixed at generation time. Generic trampolines can mix programs with different arenas and reject arena context arguments defensively, which is unreachable today as only struct_ops programs carry them. Architectures that do not implement the conversion are gated out at verification time with bpf_jit_supports_arena_args(). Co-developed-by: Kumar Kartikeya Dwivedi Signed-off-by: Tejun Heo Signed-off-by: Kumar Kartikeya Dwivedi Acked-by: Eduard Zingerman Link: https://patch.msgid.link/20260808003938.3486067-6-memxor@gmail.com Signed-off-by: Eduard Zingerman

bpf: Support arena and arena__nullable kfunc argument suffixes

2026-08-08T10:03:26+00:00

Passing an arena pointer to a kfunc takes two steps today. There is no arena pointer argument type, so the pointer crosses the boundary as a bare scalar, and the kfunc then offsets it by the arena base and casts it before it can touch the memory. Every such kfunc open-codes the same translation. Add the __arena and __arena__nullable argument suffixes to make this more convenient. The kfunc declares the parameter by its real pointer type and dereferences it directly, with the JIT rebasing the value at the call site, rN = kern_vm_start + (u32)rN. No bounds check is needed: the u32 offset stays within the guard-padded arena kernel mapping, and a fault on an unpopulated page recovers through the per-arena scratch page. A suffixed argument accepts a PTR_TO_ARENA or scalar register, matching global subprog arena arguments. __arena rebases unconditionally, so the kfunc never sees NULL and a value with zero in the low 32 bits arrives as the arena base. __arena__nullable preserves NULL for optional arguments by skipping the rebase when the truncated value, arena offset 0, is zero. Keeping the plain form NULL-free saves the NULL test on every call. The double separator makes the annotations composable: __arena__nullable also ends in __nullable and naturally follows the common nullable argument path. Plain __arena follows that path too for verifier type checking because both forms accept a constant zero; the function-model flag still determines whether the JIT preserves NULL or rebases it to the arena base. This patch adds the verifier side: the suffixes are recognized in check_kfunc_args() and distilled into argument flags in the function model stored in the kfunc descriptor. JITs retrieve the model while emitting the call, avoiding per-call state in insn_aux_data. JITs declare support with bpf_jit_supports_arena_args() and verification fails with -ENOTSUPP elsewhere. Co-developed-by: Kumar Kartikeya Dwivedi Signed-off-by: Tejun Heo Signed-off-by: Kumar Kartikeya Dwivedi Acked-by: Eduard Zingerman Link: https://patch.msgid.link/20260808003938.3486067-5-memxor@gmail.com Signed-off-by: Eduard Zingerman

docs, resolve_btfids: Document kfunc BTF annotation emission

2026-08-07T05:01:28+00:00

resolve_btfids now emits the bpf_kfunc and bpf_fastcall BTF decl tags and the arena address_space(1) type attribute for kfuncs, which were previously produced by pahole. Reflect this in the in-tree comments and documentation. Signed-off-by: Ihor Solodrai Reviewed-by: Emil Tsalapatis Link: https://patch.msgid.link/20260807032029.78092-7-ihor.solodrai@linux.dev Signed-off-by: Eduard Zingerman

bpf: Split kfunc map argument into __const_map and __map

2026-08-02T22:29:11+00:00

Kfuncs used a single '__map' suffix (KF_ARG_PTR_TO_MAP) for two different things: a verifier-known map matched by map_uid against a bound timer/wq/task_work object (bpf_wq_init, bpf_task_work_schedule*), and an opaque 'struct bpf_map *' used only at runtime (bpf_arena_*), which may be a map fd or a PTR_TO_BTF_ID struct bpf_map (e.g. a bpf_map iterator's ctx->map). That combined path only accepted the btf map form due to type confusion. The 'if (!reg->map_ptr)' check reads reg->map_ptr, which aliases reg->btf in the bpf_reg_state union. A PTR_TO_BTF_ID register always has a non-NULL reg->btf, so the guard silently passed and validation fell through to process_kf_arg_ptr_to_btf_id(). It also recorded PTR_TO_BTF_ID info in meta->map, which would be meaningless. Split the annotation to avoid such type confusion and to align with helper: - '__const_map' -> KF_ARG_CONST_MAP_PTR: verifier-known map, handled by process_map_ptr_arg() like helper ARG_CONST_MAP_PTR. - '__map' -> KF_ARG_PTR_TO_BTF_ID: opaque struct bpf_map, validated by process_kf_arg_ptr_to_btf_id(). A map fd still matches via reg2btf_ids[CONST_PTR_TO_MAP], so bpf_arena_alloc_pages(&map) keeps working. Signed-off-by: Amery Hung Reviewed-by: Eduard Zingerman Link: https://lore.kernel.org/bpf/20260801074633.1595644-4-ameryhung@gmail.com Signed-off-by: Kumar Kartikeya Dwivedi

Documentation/bpf: Add BPF signing and enforcement doc

2026-07-08T18:05:16+00:00

Describe the BPF signing design end to end: why a trusted loader is needed, the signature(insns || metadata) contract, load-time verification via fd_array (exclusive + frozen maps), the binary BPF_SIG_{UNSIGNED,VERIFIED} verdict, and how [BPF] LSMs can enforce policy on it. This writes down the contract on the discussion points with the LSM / integrity folks [0][1]: by the time security_bpf_prog_load() is called, signature verification has fully completed and covers the instructions plus the frozen contents of every bound exclusive map; there is no intermediate "loader verified, payload pending" state to reason about; and what BPF_SIG_VERIFIED means at each hook is spelled out explicitly. Signed-off-by: Daniel Borkmann Link: https://lore.kernel.org/bpf/bc823ddbaf63e0e177eb46d1cc15076e4e2e689d.camel@HansenPartnership.com [0] Link: https://lore.kernel.org/bpf/CAHC9VhSDkwGgPfrBUh7EgBKEJj_JjnY68c0YAmuuLT_i--GskQ@mail.gmail.com [1] Link: https://lore.kernel.org/bpf/20260708075343.358712-9-daniel@iogearbox.net Signed-off-by: Kumar Kartikeya Dwivedi

docs/bpf: Document BPF_STRICT_BUILD=0 to tolerate test build failures

2026-07-07T16:09:39+00:00

When the kernel config does not fully match the BPF selftest config fragment, some tests may fail to compile. BPF_STRICT_BUILD (defaulting to 1) makes any such failure fatal. Mention the option so that developers are aware they can set it to 0 to skip broken tests and keep the build going, which is particularly useful during bringup or when testing on constrained (e.g. distribution) configurations. Signed-off-by: Ricardo B. Marlière Reviewed-by: Emil Tsalapatis Link: https://lore.kernel.org/bpf/20260706-b4-bpf_strict_build_docs-v1-1-5324d605c7b0@suse.com Signed-off-by: Kumar Kartikeya Dwivedi

Documentation/bpf: make it clear that kfuncs should be non-static

2026-07-01T23:53:17+00:00

The kfunc documentation mentions how the macro __bpf_kfunc prevents inlining for static functions. This makes it sound like static kfuncs are acceptable. Although static kfuncs may happen to work, it is by chance that the compiler chose not to rename these functions and BTF resolution still succeeds. Make it clear in the documentation why kfuncs should not be declared static. First, remove wording that makes it sound like static is ok. Then point out the external naming needed for BTF resolution. Finally point out that sparse may warn on unreferenced kfuncs and that this warning can be ignored. Signed-off-by: JP Kobryn Acked-by: Roman Gushchin Acked-by: Yonghong Song Link: https://lore.kernel.org/r/20260626172026.7327-1-jp.kobryn@linux.dev Signed-off-by: Alexei Starovoitov

Documentation/bpf: Refresh map_lru_hash_update.dot for rqspinlock

2026-06-08T01:46:13+00:00

Reflect the rqspinlock conversion and orphan-recovery paths added in the previous commit: - All LRU locks are rqspinlock_t; any acquire can fail (AA or timeout). A shared "rqspinlock acquire failed" terminal collapses to the existing -ENOMEM exit. Dashed arrows from each acquire site mark the failure paths. - The per-CPU local freelist is now lockless (free_llist). - Post-steal: re-acquiring loc_l->lock to insert the stolen node into the local pending list can fail; on failure the node is published to free_llist instead of being orphaned, and the call returns -ENOMEM. - Steal-loop victim lock failure is silent: skip the victim and try the next CPU. Signed-off-by: Mykyta Yatsenko Link: https://lore.kernel.org/r/20260607-lru_map_spin-v3-2-bcd9332e911b@meta.com Signed-off-by: Alexei Starovoitov