bpf: Support __uptr type tag in BTF

This patch introduces the "__uptr" type tag to BTF. It is to define
a pointer pointing to the user space memory. This patch adds BTF
logic to pass the "__uptr" type tag.

btf_find_kptr() is reused for the "__uptr" tag. The "__uptr" will only
be supported in the map_value of the task storage map. However,
btf_parse_struct_meta() also uses btf_find_kptr() but it is not
interested in "__uptr". This patch adds a "field_mask" argument
to btf_find_kptr() which will return BTF_FIELD_IGNORE if the
caller is not interested in a “__uptr” field.

btf_parse_kptr() is also reused to parse the uptr.
The btf_check_and_fixup_fields() is changed to do extra
checks on the uptr to ensure that its struct size is not larger
than PAGE_SIZE. It is not clear how a uptr pointing to a CO-RE
supported kernel struct will be used, so it is also not allowed now.

Signed-off-by: Kui-Feng Lee <thinker.li@gmail.com>
Signed-off-by: Martin KaFai Lau <martin.lau@kernel.org>
Link: https://lore.kernel.org/r/20241023234759.860539-2-martin.lau@linux.dev
Signed-off-by: Alexei Starovoitov <ast@kernel.org>

diff --git a/include/linux/bpf.h b/include/linux/bpf.h
index 0c216e7..bb31bc6 100644 (file)
--- a/include/linux/bpf.h
+++ b/include/linux/bpf.h
@@ -203,6 +203,7 @@ enum btf_field_type {
        BPF_GRAPH_ROOT = BPF_RB_ROOT | BPF_LIST_HEAD,
        BPF_REFCOUNT   = (1 << 9),
        BPF_WORKQUEUE  = (1 << 10),
+       BPF_UPTR       = (1 << 11),
 };
 
 typedef void (*btf_dtor_kfunc_t)(void *);
@@ -322,6 +323,8 @@ static inline const char *btf_field_type_name(enum btf_field_type type)
                return "kptr";
        case BPF_KPTR_PERCPU:
                return "percpu_kptr";
+       case BPF_UPTR:
+               return "uptr";
        case BPF_LIST_HEAD:
                return "bpf_list_head";
        case BPF_LIST_NODE:
@@ -350,6 +353,7 @@ static inline u32 btf_field_type_size(enum btf_field_type type)
        case BPF_KPTR_UNREF:
        case BPF_KPTR_REF:
        case BPF_KPTR_PERCPU:
+       case BPF_UPTR:
                return sizeof(u64);
        case BPF_LIST_HEAD:
                return sizeof(struct bpf_list_head);
@@ -379,6 +383,7 @@ static inline u32 btf_field_type_align(enum btf_field_type type)
        case BPF_KPTR_UNREF:
        case BPF_KPTR_REF:
        case BPF_KPTR_PERCPU:
+       case BPF_UPTR:
                return __alignof__(u64);
        case BPF_LIST_HEAD:
                return __alignof__(struct bpf_list_head);

diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c
index 13dd1fa..76cafff 100644 (file)
--- a/kernel/bpf/btf.c
+++ b/kernel/bpf/btf.c
@@ -3334,7 +3334,7 @@ static int btf_find_struct(const struct btf *btf, const struct btf_type *t,
 }
 
 static int btf_find_kptr(const struct btf *btf, const struct btf_type *t,
-                        u32 off, int sz, struct btf_field_info *info)
+                        u32 off, int sz, struct btf_field_info *info, u32 field_mask)
 {
        enum btf_field_type type;
        u32 res_id;
@@ -3358,9 +3358,14 @@ static int btf_find_kptr(const struct btf *btf, const struct btf_type *t,
                type = BPF_KPTR_REF;
        else if (!strcmp("percpu_kptr", __btf_name_by_offset(btf, t->name_off)))
                type = BPF_KPTR_PERCPU;
+       else if (!strcmp("uptr", __btf_name_by_offset(btf, t->name_off)))
+               type = BPF_UPTR;
        else
                return -EINVAL;
 
+       if (!(type & field_mask))
+               return BTF_FIELD_IGNORE;
+
        /* Get the base type */
        t = btf_type_skip_modifiers(btf, t->type, &res_id);
        /* Only pointer to struct is allowed */
@@ -3502,7 +3507,7 @@ static int btf_get_field_type(const struct btf *btf, const struct btf_type *var_
        field_mask_test_name(BPF_REFCOUNT,  "bpf_refcount");
 
        /* Only return BPF_KPTR when all other types with matchable names fail */
-       if (field_mask & BPF_KPTR && !__btf_type_is_struct(var_type)) {
+       if (field_mask & (BPF_KPTR | BPF_UPTR) && !__btf_type_is_struct(var_type)) {
                type = BPF_KPTR_REF;
                goto end;
        }
@@ -3535,6 +3540,7 @@ static int btf_repeat_fields(struct btf_field_info *info,
                case BPF_KPTR_UNREF:
                case BPF_KPTR_REF:
                case BPF_KPTR_PERCPU:
+               case BPF_UPTR:
                case BPF_LIST_HEAD:
                case BPF_RB_ROOT:
                        break;
@@ -3661,8 +3667,9 @@ static int btf_find_field_one(const struct btf *btf,
        case BPF_KPTR_UNREF:
        case BPF_KPTR_REF:
        case BPF_KPTR_PERCPU:
+       case BPF_UPTR:
                ret = btf_find_kptr(btf, var_type, off, sz,
-                                   info_cnt ? &info[0] : &tmp);
+                                   info_cnt ? &info[0] : &tmp, field_mask);
                if (ret < 0)
                        return ret;
                break;
@@ -3985,6 +3992,7 @@ struct btf_record *btf_parse_fields(const struct btf *btf, const struct btf_type
                case BPF_KPTR_UNREF:
                case BPF_KPTR_REF:
                case BPF_KPTR_PERCPU:
+               case BPF_UPTR:
                        ret = btf_parse_kptr(btf, &rec->fields[i], &info_arr[i]);
                        if (ret < 0)
                                goto end;
@@ -4044,12 +4052,28 @@ int btf_check_and_fixup_fields(const struct btf *btf, struct btf_record *rec)
         * Hence we only need to ensure that bpf_{list_head,rb_root} ownership
         * does not form cycles.
         */
-       if (IS_ERR_OR_NULL(rec) || !(rec->field_mask & BPF_GRAPH_ROOT))
+       if (IS_ERR_OR_NULL(rec) || !(rec->field_mask & (BPF_GRAPH_ROOT | BPF_UPTR)))
                return 0;
        for (i = 0; i < rec->cnt; i++) {
                struct btf_struct_meta *meta;
+               const struct btf_type *t;
                u32 btf_id;
 
+               if (rec->fields[i].type == BPF_UPTR) {
+                       /* The uptr only supports pinning one page and cannot
+                        * point to a kernel struct
+                        */
+                       if (btf_is_kernel(rec->fields[i].kptr.btf))
+                               return -EINVAL;
+                       t = btf_type_by_id(rec->fields[i].kptr.btf,
+                                          rec->fields[i].kptr.btf_id);
+                       if (!t->size)
+                               return -EINVAL;
+                       if (t->size > PAGE_SIZE)
+                               return -E2BIG;
+                       continue;
+               }
+
                if (!(rec->fields[i].type & BPF_GRAPH_ROOT))
                        continue;
                btf_id = rec->fields[i].graph_root.value_btf_id;
@@ -5560,7 +5584,7 @@ btf_parse_struct_metas(struct bpf_verifier_log *log, struct btf *btf)
                        goto free_aof;
                }
 
-               ret = btf_find_kptr(btf, t, 0, 0, &tmp);
+               ret = btf_find_kptr(btf, t, 0, 0, &tmp, BPF_KPTR);
                if (ret != BTF_FIELD_FOUND)
                        continue;
 

diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
index 4d04d4d..2d2935d 100644 (file)
--- a/kernel/bpf/syscall.c
+++ b/kernel/bpf/syscall.c
@@ -548,6 +548,7 @@ void btf_record_free(struct btf_record *rec)
                case BPF_KPTR_UNREF:
                case BPF_KPTR_REF:
                case BPF_KPTR_PERCPU:
+               case BPF_UPTR:
                        if (rec->fields[i].kptr.module)
                                module_put(rec->fields[i].kptr.module);
                        if (btf_is_kernel(rec->fields[i].kptr.btf))
@@ -597,6 +598,7 @@ struct btf_record *btf_record_dup(const struct btf_record *rec)
                case BPF_KPTR_UNREF:
                case BPF_KPTR_REF:
                case BPF_KPTR_PERCPU:
+               case BPF_UPTR:
                        if (btf_is_kernel(fields[i].kptr.btf))
                                btf_get(fields[i].kptr.btf);
                        if (fields[i].kptr.module && !try_module_get(fields[i].kptr.module)) {