• Andrii Nakryiko's avatar
    libbpf: Add support for extracting kernel symbol addresses · 1c0c7074
    Andrii Nakryiko authored
    Add support for another (in addition to existing Kconfig) special kind of
    externs in BPF code, kernel symbol externs. Such externs allow BPF code to
    "know" kernel symbol address and either use it for comparisons with kernel
    data structures (e.g., struct file's f_op pointer, to distinguish different
    kinds of file), or, with the help of bpf_probe_user_kernel(), to follow
    pointers and read data from global variables. Kernel symbol addresses are
    found through /proc/kallsyms, which should be present in the system.
    
    Currently, such kernel symbol variables are typeless: they have to be defined
    as `extern const void <symbol>` and the only operation you can do (in C code)
    with them is to take its address. Such extern should reside in a special
    section '.ksyms'. bpf_helpers.h header provides __ksym macro for this. Strong
    vs weak semantics stays the same as with Kconfig externs. If symbol is not
    found in /proc/kallsyms, this will be a failure for strong (non-weak) extern,
    but will be defaulted to 0 for weak externs.
    
    If the same symbol is defined multiple times in /proc/kallsyms, then it will
    be error if any of the associated addresses differs. In that case, address is
    ambiguous, so libbpf falls on the side of caution, rather than confusing user
    with randomly chosen address.
    
    In the future, once kernel is extended with variables BTF information, such
    ksym externs will be supported in a typed version, which will allow BPF
    program to read variable's contents directly, similarly to how it's done for
    fentry/fexit input arguments.
    Signed-off-by: default avatarAndrii Nakryiko <andriin@fb.com>
    Signed-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
    Reviewed-by: default avatarHao Luo <haoluo@google.com>
    Link: https://lore.kernel.org/bpf/20200619231703.738941-3-andriin@fb.com
    1c0c7074
bpf_helpers.h 1.83 KB