[PATCH v2] tools/sched_ext: Improve BPF verifier arena detection workaround

From: zhidao su

Date: Thu Feb 12 2026 - 03:01:29 EST


Replace bpf_printk() with inline assembly in scx_sdt scheduler's
BPF verifier workaround to eliminate console output while ensuring
the required LD.IMM instruction generation for arena detection.

The BPF verifier associates arenas with programs by checking LD.IMM
instruction operands for an arena map. The previous workaround using
bpf_printk() achieved this but polluted the kernel log.

A simple volatile access cast ((void)*(volatile void **)&arena) was
found to be unreliable, as some compiler versions (e.g., Clang 18)
optimized it away, resulting in missing LD.IMM instructions and
verifier failures.

This patch uses an empty inline assembly block with the arena address
as an input constraint. This forces the compiler to generate an
LD_IMM64 instruction for the arena address to satisfy the constraint,
guaranteeing detection by the verifier without any runtime side effects.

Signed-off-by: zhidao su <suzhidao@xxxxxxxxxx>
---

v2:
- Replaced volatile pointer cast with inline assembly to prevent compiler
optimization (Clang) from eliminating the arena reference.
- Updated commit message to reflect the change and the reason for it.
tools/sched_ext/scx_sdt.bpf.c | 18 +++++++++---------
1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/tools/sched_ext/scx_sdt.bpf.c b/tools/sched_ext/scx_sdt.bpf.c
index 31b09958e8d5..a8a611d1bc75 100644
--- a/tools/sched_ext/scx_sdt.bpf.c
+++ b/tools/sched_ext/scx_sdt.bpf.c
@@ -64,14 +64,10 @@ DEFINE_SDT_STAT(select_busy_cpu);
static __u64 zero = 0;

/*
- * XXX Hack to get the verifier to find the arena for sdt_exit_task.
- * As of 6.12-rc5, The verifier associates arenas with programs by
- * checking LD.IMM instruction operands for an arena and populating
- * the program state with the first instance it finds. This requires
- * accessing our global arena variable, but scx methods do not necessarily
- * do so while still using pointers from that arena. Insert a bpf_printk
- * statement that triggers at most once to generate an LD.IMM instruction
- * to access the arena and help the verifier.
+ * Workaround to help BPF verifier track arena usage.
+ * The verifier needs to see an explicit reference to the arena variable
+ * to properly track arena memory usage. This generates the required
+ * track arena usage. This is a robust alternative to bpf_printk producing unnecessary output.
*/
static volatile bool scx_arena_verify_once;

@@ -80,7 +76,11 @@ __hidden void scx_arena_subprog_init(void)
if (scx_arena_verify_once)
return;

- bpf_printk("%s: arena pointer %p", __func__, &arena);
+ /*
+ * Generate an LD.IMM instruction to the arena to help the verifier track arena usage. This is a robust alternative to bpf_printk
+ * that produces no output.
+ */
+ asm volatile ("" : : "r"(&arena));
scx_arena_verify_once = true;
}

--
2.43.0