A kernel struct member tagged __arena reaches a program built against vmlinux.h as a pointer in the kernel address space with the tag as an attribute, struct scx_cmask __attribute__((btf_type_tag("arena"))) *cmask, so the program casts it to the arena address space before dereferencing it, although the verifier already hands it an arena pointer. The tag denotes a pointer into the BPF arena, address_space(1) to the compiler, so render it as such: __attribute__((address_space(1))) followed by the tag attribute as before, which keeps the dump faithful to the BTF. A program then reads the member as an arena pointer and hands it to anything declared with its own __arena without a cast. Nothing else changes for consumers of the C dump. Skeletons strip the modifiers of variable types and never carried the tag. Clang without casts between address spaces still accepts the declaration and only a program touching such a member would need a cast there, as it did for every arena pointer before. GCC has no address spaces for BPF and warns, under -Wattributes, that it ignores the attribute, which the selftests build already silences. Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com> Signed-off-by: Alexei Starovoitov <ast@kernel.org> Link: https://patch.msgid.link/20261019132203.3034698-15-memxor@gmail.com