[PATCH dwarves v1 0/2] btf_encoder: KF_IMPLICIT_PROG_AUX_ARG support

[PATCH dwarves v1 0/2] btf_encoder: KF_IMPLICIT_PROG_AUX_ARG support

[Ihor Solodrai]

This series implements KF_IMPLICIT_PROG_AUX_ARG kfunc flag in pahole's
BTF encoding.

The kfunc flag indicates that the last argument of a BPF kfunc is a
pointer to struct bpf_prog_aux implicitly set by the verifier.

BTF function prototype of such a function must omit its last parameter
(expected to be of `struct bpf_prog_aux *` type), despite it being
present in the kernel declaration of the kfunc.

See also a the patch series for BPF:
"bpf: implicit bpf_prog_aux argument for kfuncs"

Ihor Solodrai (2):
  btf_encoder: refactor btf_encoder__add_func_proto
  btf_encoder: implement KF_IMPLICIT_PROG_AUX_ARG kfunc flag handling

 btf_encoder.c | 172 ++++++++++++++++++++++++++++++++++----------------
 1 file changed, 116 insertions(+), 56 deletions(-)

-- 
2.51.0

[PATCH dwarves v1 1/2] btf_encoder: refactor btf_encoder__add_func_proto

[Ihor Solodrai]

btf_encoder__add_func_proto() essentially implements two independent
code paths depending on input arguments: one for struct ftype and the
other for struct btf_encoder_func_state.

Split btf_encoder__add_func_proto() into two variants:
  * btf_encoder__add_func_proto_for_ftype()
  * btf_encoder__add_func_proto_for_state()

And factor out common btf_encoder__emit_func_proto() subroutine.

No functional changes.

Signed-off-by: Ihor Solodrai <ihor.solodrai@linux.dev>
---
 btf_encoder.c | 132 ++++++++++++++++++++++++++++----------------------
 1 file changed, 75 insertions(+), 57 deletions(-)

diff --git a/btf_encoder.c b/btf_encoder.c
index 03bc3c7..4906943 100644
--- a/btf_encoder.c
+++ b/btf_encoder.c
@@ -815,82 +815,100 @@ static inline bool is_kfunc_state(struct btf_encoder_func_state *state)
 	return state && state->elf && state->elf->kfunc;
 }
 
-static int32_t btf_encoder__add_func_proto(struct btf_encoder *encoder, struct ftype *ftype,
-					   struct btf_encoder_func_state *state)
-{
+static int32_t btf_encoder__emit_func_proto(struct btf_encoder *encoder, uint32_t type_id, uint16_t nr_params) {
 	const struct btf_type *t;
-	struct btf *btf;
-	struct parameter *param;
+	uint32_t ret;
+
+	ret = btf__add_func_proto(encoder->btf, type_id);
+	if (ret > 0) {
+		t = btf__type_by_id(encoder->btf, ret);
+		btf_encoder__log_type(encoder, t, false, false, "return=%u args=(%s", t->type, !nr_params ? "void)\n" : "");
+	} else {
+		btf__log_err(encoder->btf, BTF_KIND_FUNC_PROTO, NULL, true, ret,
+			     "return=%u vlen=%u Error emitting BTF type",
+			     type_id, nr_params);
+	}
+
+	return ret;
+}
+
+static int32_t btf_encoder__add_func_proto_for_ftype(struct btf_encoder *encoder, struct ftype *ftype)
+{
 	uint16_t nr_params, param_idx;
+	struct parameter *param;
 	int32_t id, type_id;
+	const char *name;
+
+	assert(ftype != NULL);
+
+	/* add btf_type for func_proto */
+	nr_params = ftype->nr_parms + (ftype->unspec_parms ? 1 : 0);
+	type_id = btf_encoder__tag_type(encoder, ftype->tag.type);
+
+	id = btf_encoder__emit_func_proto(encoder, type_id, nr_params);
+	if (id < 0)
+		return id;
+
+	/* add parameters */
+	param_idx = 0;
+
+	ftype__for_each_parameter(ftype, param) {
+		name = parameter__name(param);
+		type_id = param->tag.type == 0 ? 0 : encoder->type_id_off + param->tag.type;
+		++param_idx;
+		if (btf_encoder__add_func_param(encoder, name, type_id, param_idx == nr_params))
+			return -1;
+	}
+
+	++param_idx;
+	if (ftype->unspec_parms)
+		if (btf_encoder__add_func_param(encoder, NULL, 0, param_idx == nr_params))
+			return -1;
+
+	return id;
+}
+
+static int32_t btf_encoder__add_func_proto_for_state(struct btf_encoder *encoder, struct btf_encoder_func_state *state)
+{
+	uint16_t nr_params, param_idx;
 	char tmp_name[KSYM_NAME_LEN];
+	int32_t id, type_id;
 	const char *name;
+	struct btf *btf;
 
-	assert(ftype != NULL || state != NULL);
+	assert(state != NULL);
 
 	if (is_kfunc_state(state) && encoder->tag_kfuncs && encoder->encode_attributes)
 		if (btf__add_bpf_arena_type_tags(encoder->btf, state) < 0)
 			return -1;
 
-	/* add btf_type for func_proto */
-	if (ftype) {
-		btf = encoder->btf;
-		nr_params = ftype->nr_parms + (ftype->unspec_parms ? 1 : 0);
-		type_id = btf_encoder__tag_type(encoder, ftype->tag.type);
-	} else if (state) {
-		encoder = state->encoder;
-		btf = state->encoder->btf;
-		nr_params = state->nr_parms;
-		type_id = state->ret_type_id;
-	} else {
-		return 0;
-	}
+	encoder = state->encoder;
+	btf = state->encoder->btf;
+	nr_params = state->nr_parms;
+	type_id = state->ret_type_id;
 
-	id = btf__add_func_proto(btf, type_id);
-	if (id > 0) {
-		t = btf__type_by_id(btf, id);
-		btf_encoder__log_type(encoder, t, false, false, "return=%u args=(%s", t->type, !nr_params ? "void)\n" : "");
-	} else {
-		btf__log_err(btf, BTF_KIND_FUNC_PROTO, NULL, true, id,
-			     "return=%u vlen=%u Error emitting BTF type",
-			     type_id, nr_params);
+	id = btf_encoder__emit_func_proto(encoder, type_id, nr_params);
+	if (id < 0)
 		return id;
-	}
 
 	/* add parameters */
 	param_idx = 0;
-	if (ftype) {
-		ftype__for_each_parameter(ftype, param) {
-			const char *name = parameter__name(param);
-
-			type_id = param->tag.type == 0 ? 0 : encoder->type_id_off + param->tag.type;
-			++param_idx;
-			if (btf_encoder__add_func_param(encoder, name, type_id,
-							param_idx == nr_params))
-				return -1;
-		}
 
-		++param_idx;
-		if (ftype->unspec_parms)
-			if (btf_encoder__add_func_param(encoder, NULL, 0,
-							param_idx == nr_params))
-				return -1;
-	} else {
-		for (param_idx = 0; param_idx < nr_params; param_idx++) {
-			struct btf_encoder_func_parm *p = &state->parms[param_idx];
+	for (param_idx = 0; param_idx < nr_params; param_idx++) {
+		struct btf_encoder_func_parm *p = &state->parms[param_idx];
 
-			name = btf__name_by_offset(btf, p->name_off);
+		name = btf__name_by_offset(btf, p->name_off);
 
-			/* adding BTF data may result in a move of the
-			 * name string memory, so make a temporary copy.
-			 */
-			strncpy(tmp_name, name, sizeof(tmp_name) - 1);
+		/* adding BTF data may result in a move of the
+		 * name string memory, so make a temporary copy.
+		 */
+		strncpy(tmp_name, name, sizeof(tmp_name) - 1);
 
-			if (btf_encoder__add_func_param(encoder, tmp_name, p->type_id,
-							param_idx == nr_params))
-				return -1;
-		}
+		if (btf_encoder__add_func_param(encoder, tmp_name, p->type_id,
+						param_idx == nr_params))
+			return -1;
 	}
+
 	return id;
 }
 
@@ -1349,7 +1367,7 @@ static int32_t btf_encoder__add_func(struct btf_encoder *encoder,
 	uint16_t idx;
 	int err;
 
-	btf_fnproto_id = btf_encoder__add_func_proto(encoder, NULL, state);
+	btf_fnproto_id = btf_encoder__add_func_proto_for_state(encoder, state);
 	name = func->name;
 	if (btf_fnproto_id >= 0)
 		btf_fn_id = btf_encoder__add_ref_type(encoder, BTF_KIND_FUNC, btf_fnproto_id,
@@ -1686,7 +1704,7 @@ static int btf_encoder__encode_tag(struct btf_encoder *encoder, struct tag *tag,
 	case DW_TAG_enumeration_type:
 		return btf_encoder__add_enum_type(encoder, tag, conf_load);
 	case DW_TAG_subroutine_type:
-		return btf_encoder__add_func_proto(encoder, tag__ftype(tag), NULL);
+		return btf_encoder__add_func_proto_for_ftype(encoder, tag__ftype(tag));
         case DW_TAG_unspecified_type:
 		/* Just don't encode this for now, converting anything with this type to void (0) instead.
 		 *
-- 
2.51.0

[PATCH dwarves v1 2/2] btf_encoder: implement KF_IMPLICIT_PROG_AUX_ARG kfunc flag handling

[Ihor Solodrai]

When a kfunc is marked with KF_IMPLICIT_PROG_AUX_ARG, do not emit the
last parameter of this function to BTF.

Validate that the ommitted parameter has a type of `struct
bpf_prog_aux *`, otherwise report an error and fail BTF encoding.

Signed-off-by: Ihor Solodrai <ihor.solodrai@linux.dev>
---
 btf_encoder.c | 42 ++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 42 insertions(+)

diff --git a/btf_encoder.c b/btf_encoder.c
index 4906943..eb669f9 100644
--- a/btf_encoder.c
+++ b/btf_encoder.c
@@ -48,6 +48,7 @@
 #define KF_ARENA_RET  (1 << 13)
 #define KF_ARENA_ARG1 (1 << 14)
 #define KF_ARENA_ARG2 (1 << 15)
+#define KF_IMPLICIT_PROG_AUX_ARG (1 << 16)
 
 struct btf_id_and_flag {
 	uint32_t id;
@@ -868,6 +869,41 @@ static int32_t btf_encoder__add_func_proto_for_ftype(struct btf_encoder *encoder
 	return id;
 }
 
+static const struct btf_type *btf__unqualified_type_by_id(const struct btf *btf, int32_t type_id)
+{
+	const struct btf_type *t = btf__type_by_id(btf, type_id);
+	while (btf_is_const(t) || btf_is_volatile(t) || btf_is_restrict(t)) {
+		t = btf__type_by_id(btf, t->type);
+	}
+	return t;
+}
+
+static int validate_kfunc_with_implicit_prog_aux_arg(struct btf_encoder_func_state *state)
+{
+	/* The last argument must be a pointer to 'struct bpf_prog_aux' */
+	const struct btf_encoder_func_parm *p = &state->parms[state->nr_parms - 1];
+	const struct btf *btf = state->encoder->btf;
+	const struct btf_type *t = btf__unqualified_type_by_id(btf, p->type_id);
+	if (!btf_is_ptr(t))
+		goto out_err;
+
+	const uint32_t struct_type_id = t->type;
+	t = btf__unqualified_type_by_id(btf, struct_type_id);
+	if (!btf_is_struct(t))
+		goto out_err;
+
+	const char *name = btf__name_by_offset(btf, t->name_off);
+	if (strcmp(name, "bpf_prog_aux") != 0)
+		goto out_err;
+
+	return 0;
+out_err:
+	btf__log_err(btf, BTF_KIND_FUNC_PROTO, state->elf->name, true, 0,
+		"return=%u Error emitting BTF func proto for kfunc with implicit bpf_prog_aux: the last parameter is not 'struct bpf_prog_aux*'",
+		p->type_id);
+	return -1;
+}
+
 static int32_t btf_encoder__add_func_proto_for_state(struct btf_encoder *encoder, struct btf_encoder_func_state *state)
 {
 	uint16_t nr_params, param_idx;
@@ -887,6 +923,12 @@ static int32_t btf_encoder__add_func_proto_for_state(struct btf_encoder *encoder
 	nr_params = state->nr_parms;
 	type_id = state->ret_type_id;
 
+	if (is_kfunc_state(state) && KF_IMPLICIT_PROG_AUX_ARG & state->elf->kfunc_flags) {
+		if (validate_kfunc_with_implicit_prog_aux_arg(state))
+			return -1;
+		nr_params--;
+	}
+
 	id = btf_encoder__emit_func_proto(encoder, type_id, nr_params);
 	if (id < 0)
 		return id;
-- 
2.51.0

Re: [PATCH dwarves v1 2/2] btf_encoder: implement KF_IMPLICIT_PROG_AUX_ARG kfunc flag handling

[Eduard Zingerman]

On Wed, 2025-09-24 at 14:15 -0700, Ihor Solodrai wrote:
> When a kfunc is marked with KF_IMPLICIT_PROG_AUX_ARG, do not emit the
> last parameter of this function to BTF.

[...]

> @@ -887,6 +923,12 @@ static int32_t btf_encoder__add_func_proto_for_state(struct btf_encoder *encoder
>  	nr_params = state->nr_parms;
>  	type_id = state->ret_type_id;
>  
> +	if (is_kfunc_state(state) && KF_IMPLICIT_PROG_AUX_ARG & state->elf->kfunc_flags) {
> +		if (validate_kfunc_with_implicit_prog_aux_arg(state))
> +			return -1;
> +		nr_params--;
> +	}
> +
>  	id = btf_encoder__emit_func_proto(encoder, type_id, nr_params);
>  	if (id < 0)
>  		return id;

This change hides the fact that function accepts one more parameter
both from kernel BTF and from program BTF (via vmlinux.h).
Do we anticipate other implicit parameter types?
Because if we do, it seems like having some generic KF_IMPLICIT_ARG
and hiding it only from vmlinux.h seem more flexible.

Re: [PATCH dwarves v1 2/2] btf_encoder: implement KF_IMPLICIT_PROG_AUX_ARG kfunc flag handling

[Ihor Solodrai]

On 9/24/25 6:22 PM, Eduard Zingerman wrote:
> On Wed, 2025-09-24 at 14:15 -0700, Ihor Solodrai wrote:
>> When a kfunc is marked with KF_IMPLICIT_PROG_AUX_ARG, do not emit the
>> last parameter of this function to BTF.
> 
> [...]
> 
>> @@ -887,6 +923,12 @@ static int32_t btf_encoder__add_func_proto_for_state(struct btf_encoder *encoder
>>  	nr_params = state->nr_parms;
>>  	type_id = state->ret_type_id;
>>  
>> +	if (is_kfunc_state(state) && KF_IMPLICIT_PROG_AUX_ARG & state->elf->kfunc_flags) {
>> +		if (validate_kfunc_with_implicit_prog_aux_arg(state))
>> +			return -1;
>> +		nr_params--;
>> +	}
>> +
>>  	id = btf_encoder__emit_func_proto(encoder, type_id, nr_params);
>>  	if (id < 0)
>>  		return id;
> 
> This change hides the fact that function accepts one more parameter
> both from kernel BTF and from program BTF (via vmlinux.h).

Right, this is intentional.

> Do we anticipate other implicit parameter types?

It's very plausible, but I don't know of specific examples.

> Because if we do, it seems like having some generic KF_IMPLICIT_ARG
> and hiding it only from vmlinux.h seem more flexible.

I'm not sure how generic KF_IMPLICIT_ARG would even work.

Any *implicit* parameter requires a very concrete implementation in
the verifier: an actual pointer of a particular type is injected after
the verification. So we have to do a type check on pahole side to
catch invalid kfunc declarations. And the verifier of course must be
very strict about where it can pass pointers to kernel objects.

From a couple of discussions with Andrii, my impression is that it
would be beneficial to have some kind of generic "execution context"
available to BPF programs and/or kfuncs to cover all potential
implicit arguments. But that's a separate big discussion.

Supporting bpf_prog_aux specifically is a pragmatic improvement to the
current inconvenience that sched_ext has to deal with [1].

[1] https://lore.kernel.org/bpf/20250920005931.2753828-42-tj@kernel.org/

Re: [PATCH dwarves v1 2/2] btf_encoder: implement KF_IMPLICIT_PROG_AUX_ARG kfunc flag handling

[Eduard Zingerman]

On Wed, 2025-09-24 at 20:59 -0700, Ihor Solodrai wrote:

[...]

> I'm not sure how generic KF_IMPLICIT_ARG would even work.
> Any *implicit* parameter requires a very concrete implementation in
> the verifier: an actual pointer of a particular type is injected after
> the verification.

Does not seem complicated:

- In pahole generate a special decl_tag for bpftool.
- In bpftool, don't emit last argument to vmlinux.h, if that flag is present.
- on kernel side, when checking kfunc args, also check for the flag
  and switch over types recorded for last function parameter in BTF.
  If kernel knows how to handle it, great, if it does not, emit
  verifier error.
- Not sure, but likely, the change on the libbpf side will be needed,
  as it compares function prototypes between program and kernel BTFs.

E.g., for bpf_wq_set_callback keep the definition as is:

__bpf_kfunc int bpf_wq_set_callback(struct bpf_wq *wq,
				    int (callback_fn)(void *map, int *key, void *value),
				    unsigned int flags,
				    struct bpf_prog_aux *aux)
                    
Kernel BTF will have it with full set of parameters.
But because of the flag, it will be printed w/o last parameter in
vmlinux.h:

extern int bpf_wq_set_callback(struct bpf_wq *wq,
				    int (callback_fn)(void *map, int *key, void *value),
				    unsigned int flags) __weak __ksym

On kernel side check_kfunc_args() will have access to complete BTF
declaration, so it can:
- check presence of the flag
- lookup bpf_prog_aux from the kernel side BTF
- call set_kfunc_arg_prog_regno.

> So we have to do a type check on pahole side to catch invalid kfunc
> declarations. And the verifier of course must be very strict about
> where it can pass pointers to kernel objects.

Type checks on pahole side will require upgrades to both kernel and
pahole, when new implicit parameter types are added. I'd try to avoid
that.

Also, do we plan to have several implicit parameters passed to a same
function?

Re: [PATCH dwarves v1 2/2] btf_encoder: implement KF_IMPLICIT_PROG_AUX_ARG kfunc flag handling

[Andrii Nakryiko]

On Thu, Sep 25, 2025 at 6:28 AM Eduard Zingerman <eddyz87@gmail.com> wrote:
>
> On Wed, 2025-09-24 at 20:59 -0700, Ihor Solodrai wrote:
>
> [...]
>
> > I'm not sure how generic KF_IMPLICIT_ARG would even work.
> > Any *implicit* parameter requires a very concrete implementation in
> > the verifier: an actual pointer of a particular type is injected after
> > the verification.
>
> Does not seem complicated:
>
> - In pahole generate a special decl_tag for bpftool.
> - In bpftool, don't emit last argument to vmlinux.h, if that flag is present.
> - on kernel side, when checking kfunc args, also check for the flag
>   and switch over types recorded for last function parameter in BTF.
>   If kernel knows how to handle it, great, if it does not, emit
>   verifier error.
> - Not sure, but likely, the change on the libbpf side will be needed,
>   as it compares function prototypes between program and kernel BTFs.

this is exactly the thing I'd like to avoid: setting up special CO-RE
matching rules for these few special kfuncs

>
> E.g., for bpf_wq_set_callback keep the definition as is:
>
> __bpf_kfunc int bpf_wq_set_callback(struct bpf_wq *wq,
>                                     int (callback_fn)(void *map, int *key, void *value),
>                                     unsigned int flags,
>                                     struct bpf_prog_aux *aux)
>
> Kernel BTF will have it with full set of parameters.
> But because of the flag, it will be printed w/o last parameter in
> vmlinux.h:
>
> extern int bpf_wq_set_callback(struct bpf_wq *wq,
>                                     int (callback_fn)(void *map, int *key, void *value),
>                                     unsigned int flags) __weak __ksym
>
> On kernel side check_kfunc_args() will have access to complete BTF
> declaration, so it can:
> - check presence of the flag
> - lookup bpf_prog_aux from the kernel side BTF
> - call set_kfunc_arg_prog_regno.
>
> > So we have to do a type check on pahole side to catch invalid kfunc
> > declarations. And the verifier of course must be very strict about
> > where it can pass pointers to kernel objects.
>
> Type checks on pahole side will require upgrades to both kernel and
> pahole, when new implicit parameter types are added. I'd try to avoid
> that.
>
> Also, do we plan to have several implicit parameters passed to a same
> function?