bpf: support 'arg:xxx' btf_decl_tag-based hints for global subprog args

Add support for annotating global BPF subprog arguments to provide more
information about expected semantics of the argument. Currently,
verifier relies purely on argument's BTF type information, and supports
three general use cases: scalar, pointer-to-context, and
pointer-to-fixed-size-memory.

Scalar and pointer-to-fixed-mem work well in practice and are quite
natural to use. But pointer-to-context is a bit problematic, as typical
BPF users don't realize that they need to use a special type name to
signal to verifier that argument is not just some pointer, but actually
a PTR_TO_CTX. Further, even if users do know which type to use, it is
limiting in situations where the same BPF program logic is used across
few different program types. Common case is kprobes, tracepoints, and
perf_event programs having a helper to send some data over BPF perf
buffer. bpf_perf_event_output() requires `ctx` argument, and so it's
quite cumbersome to share such global subprog across few BPF programs of
different types, necessitating extra static subprog that is context
type-agnostic.

Long story short, there is a need to go beyond types and allow users to
add hints to global subprog arguments to define expectations.

This patch adds such support for two initial special tags:
  - pointer to context;
  - non-null qualifier for generic pointer arguments.

All of the above came up in practice already and seem generally useful
additions. Non-null qualifier is an often requested feature, which
currently has to be worked around by having unnecessary NULL checks
inside subprogs even if we know that arguments are never NULL. Pointer
to context was discussed earlier.

As for implementation, we utilize btf_decl_tag attribute and set up an
"arg:xxx" convention to specify argument hint. As such:
  - btf_decl_tag("arg:ctx") is a PTR_TO_CTX hint;
  - btf_decl_tag("arg:nonnull") marks pointer argument as not allowed to
    be NULL, making NULL check inside global subprog unnecessary.

Acked-by: Eduard Zingerman <eddyz87@gmail.com>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Link: https://lore.kernel.org/r/20231215011334.2307144-7-andrii@kernel.org
Signed-off-by: Alexei Starovoitov <ast@kernel.org>

diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c
index 341811bcca538df75aeb4f7c0b4a2808648bf04e..c0fc8977be977271fe205ca2342df4e855356df5 100644 (file)
--- a/kernel/bpf/btf.c
+++ b/kernel/bpf/btf.c
@@ -6782,7 +6782,7 @@ int btf_prepare_func_args(struct bpf_verifier_env *env, int subprog)
        enum bpf_prog_type prog_type = prog->type;
        struct btf *btf = prog->aux->btf;
        const struct btf_param *args;
-       const struct btf_type *t, *ref_t;
+       const struct btf_type *t, *ref_t, *fn_t;
        u32 i, nargs, btf_id;
        const char *tname;
 
@@ -6802,8 +6802,8 @@ int btf_prepare_func_args(struct bpf_verifier_env *env, int subprog)
                return -EFAULT;
        }
 
-       t = btf_type_by_id(btf, btf_id);
-       if (!t || !btf_type_is_func(t)) {
+       fn_t = btf_type_by_id(btf, btf_id);
+       if (!fn_t || !btf_type_is_func(fn_t)) {
                /* These checks were already done by the verifier while loading
                 * struct bpf_func_info
                 */
@@ -6811,7 +6811,7 @@ int btf_prepare_func_args(struct bpf_verifier_env *env, int subprog)
                        subprog);
                return -EFAULT;
        }
-       tname = btf_name_by_offset(btf, t->name_off);
+       tname = btf_name_by_offset(btf, fn_t->name_off);
 
        if (prog->aux->func_info_aux[subprog].unreliable) {
                bpf_log(log, "Verifier bug in function %s()\n", tname);
@@ -6820,7 +6820,7 @@ int btf_prepare_func_args(struct bpf_verifier_env *env, int subprog)
        if (prog_type == BPF_PROG_TYPE_EXT)
                prog_type = prog->aux->dst_prog->type;
 
-       t = btf_type_by_id(btf, t->type);
+       t = btf_type_by_id(btf, fn_t->type);
        if (!t || !btf_type_is_func_proto(t)) {
                bpf_log(log, "Invalid type of function %s()\n", tname);
                return -EFAULT;
@@ -6846,7 +6846,35 @@ int btf_prepare_func_args(struct bpf_verifier_env *env, int subprog)
         * Only PTR_TO_CTX and SCALAR are supported atm.
         */
        for (i = 0; i < nargs; i++) {
+               bool is_nonnull = false;
+               const char *tag;
+
                t = btf_type_by_id(btf, args[i].type);
+
+               tag = btf_find_decl_tag_value(btf, fn_t, i, "arg:");
+               if (IS_ERR(tag) && PTR_ERR(tag) == -ENOENT) {
+                       tag = NULL;
+               } else if (IS_ERR(tag)) {
+                       bpf_log(log, "arg#%d type's tag fetching failure: %ld\n", i, PTR_ERR(tag));
+                       return PTR_ERR(tag);
+               }
+               /* 'arg:<tag>' decl_tag takes precedence over derivation of
+                * register type from BTF type itself
+                */
+               if (tag) {
+                       /* disallow arg tags in static subprogs */
+                       if (!is_global) {
+                               bpf_log(log, "arg#%d type tag is not supported in static functions\n", i);
+                               return -EOPNOTSUPP;
+                       }
+                       if (strcmp(tag, "ctx") == 0) {
+                               sub->args[i].arg_type = ARG_PTR_TO_CTX;
+                               continue;
+                       }
+                       if (strcmp(tag, "nonnull") == 0)
+                               is_nonnull = true;
+               }
+
                while (btf_type_is_modifier(t))
                        t = btf_type_by_id(btf, t->type);
                if (btf_type_is_int(t) || btf_is_any_enum(t)) {
@@ -6870,10 +6898,14 @@ int btf_prepare_func_args(struct bpf_verifier_env *env, int subprog)
                                return -EINVAL;
                        }
 
-                       sub->args[i].arg_type = ARG_PTR_TO_MEM_OR_NULL;
+                       sub->args[i].arg_type = is_nonnull ? ARG_PTR_TO_MEM : ARG_PTR_TO_MEM_OR_NULL;
                        sub->args[i].mem_size = mem_size;
                        continue;
                }
+               if (is_nonnull) {
+                       bpf_log(log, "arg#%d marked as non-null, but is not a pointer type\n", i);
+                       return -EINVAL;
+               }
                bpf_log(log, "Arg#%d type %s in %s() is not supported yet.\n",
                        i, btf_type_str(t), tname);
                return -EINVAL;

diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 3c9e6d0d77d6cb3311c9fdcd05dd32d8c9a542a7..4caabfdc15aa890194a0dc77ec216f447b0f5cf2 100644 (file)
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -9290,9 +9290,12 @@ static int btf_check_func_arg_match(struct bpf_verifier_env *env, int subprog,
                        ret = check_func_arg_reg_off(env, reg, regno, ARG_DONTCARE);
                        if (ret < 0)
                                return ret;
-
                        if (check_mem_reg(env, reg, regno, arg->mem_size))
                                return -EINVAL;
+                       if (!(arg->arg_type & PTR_MAYBE_NULL) && (reg->type & PTR_MAYBE_NULL)) {
+                               bpf_log(log, "arg#%d is expected to be non-NULL\n", i);
+                               return -EINVAL;
+                       }
                } else {
                        bpf_log(log, "verifier bug: unrecognized arg#%d type %d\n",
                                i, arg->arg_type);