netdev - Re: [PATCH 12/18] bpf: Add trampolines to kallsyms

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 26 Feb 2020 22:26:40 -0800
From:   Martin KaFai Lau <kafai@...com>
To:     Jiri Olsa <jolsa@...nel.org>
CC:     Alexei Starovoitov <ast@...nel.org>,
        Daniel Borkmann <daniel@...earbox.net>,
        <netdev@...r.kernel.org>, <bpf@...r.kernel.org>,
        Andrii Nakryiko <andriin@...com>, Yonghong Song <yhs@...com>,
        Song Liu <songliubraving@...com>,
        Jakub Kicinski <kuba@...nel.org>,
        David Miller <davem@...hat.com>,
        Björn Töpel <bjorn.topel@...el.com>,
        John Fastabend <john.fastabend@...il.com>,
        Jesper Dangaard Brouer <hawk@...nel.org>,
        Arnaldo Carvalho de Melo <acme@...hat.com>
Subject: Re: [PATCH 12/18] bpf: Add trampolines to kallsyms

On Wed, Feb 26, 2020 at 02:03:39PM +0100, Jiri Olsa wrote:
> Adding trampolines to kallsyms. It's displayed as
>   bpf_trampoline_<ID> [bpf]
> 
> where ID is the BTF id of the trampoline function.
> 
> Signed-off-by: Jiri Olsa <jolsa@...nel.org>
> ---
>  include/linux/bpf.h     |  3 +++
>  kernel/bpf/trampoline.c | 38 +++++++++++++++++++++++++++++++++++++-
>  2 files changed, 40 insertions(+), 1 deletion(-)
> 
> diff --git a/include/linux/bpf.h b/include/linux/bpf.h
> index 76934893bccf..c216af89254f 100644
> --- a/include/linux/bpf.h
> +++ b/include/linux/bpf.h
> @@ -502,6 +502,7 @@ struct bpf_trampoline {
>  	/* Executable image of trampoline */
>  	void *image;
>  	u64 selector;
> +	struct bpf_ksym ksym;
>  };
>  
>  #define BPF_DISPATCHER_MAX 48 /* Fits in 2048B */
> @@ -573,6 +574,8 @@ struct bpf_image {
>  #define BPF_IMAGE_SIZE (PAGE_SIZE - sizeof(struct bpf_image))
>  bool is_bpf_image_address(unsigned long address);
>  void *bpf_image_alloc(void);
> +void bpf_image_ksym_add(void *data, struct bpf_ksym *ksym);
> +void bpf_image_ksym_del(struct bpf_ksym *ksym);
>  /* Called only from code, so there's no need for stubs. */
>  void bpf_ksym_add(struct bpf_ksym *ksym);
>  void bpf_ksym_del(struct bpf_ksym *ksym);
> diff --git a/kernel/bpf/trampoline.c b/kernel/bpf/trampoline.c
> index 6b264a92064b..4b0ae976a6eb 100644
> --- a/kernel/bpf/trampoline.c
> +++ b/kernel/bpf/trampoline.c
> @@ -5,6 +5,7 @@
>  #include <linux/filter.h>
>  #include <linux/ftrace.h>
>  #include <linux/rbtree_latch.h>
> +#include <linux/perf_event.h>
>  
>  /* dummy _ops. The verifier will operate on target program's ops. */
>  const struct bpf_verifier_ops bpf_extension_verifier_ops = {
> @@ -96,6 +97,22 @@ bool is_bpf_image_address(unsigned long addr)
>  	return ret;
>  }
>  
> +void bpf_image_ksym_add(void *data, struct bpf_ksym *ksym)
> +{
> +	ksym->start = (unsigned long) data;
> +	ksym->end = ksym->start + BPF_IMAGE_SIZE;
> +	bpf_ksym_add(ksym);
> +	perf_event_ksymbol(PERF_RECORD_KSYMBOL_TYPE_BPF, ksym->start,
> +			   BPF_IMAGE_SIZE, false, ksym->name);
> +}
> +
> +void bpf_image_ksym_del(struct bpf_ksym *ksym)
> +{
> +	bpf_ksym_del(ksym);
> +	perf_event_ksymbol(PERF_RECORD_KSYMBOL_TYPE_BPF, ksym->start,
> +			   BPF_IMAGE_SIZE, true, ksym->name);
> +}
> +
>  struct bpf_trampoline *bpf_trampoline_lookup(u64 key)
>  {
>  	struct bpf_trampoline *tr;
> @@ -131,6 +148,7 @@ struct bpf_trampoline *bpf_trampoline_lookup(u64 key)
>  	for (i = 0; i < BPF_TRAMP_MAX; i++)
>  		INIT_HLIST_HEAD(&tr->progs_hlist[i]);
>  	tr->image = image;
> +	INIT_LIST_HEAD_RCU(&tr->ksym.lnode);
>  out:
>  	mutex_unlock(&trampoline_mutex);
>  	return tr;
> @@ -267,6 +285,14 @@ static enum bpf_tramp_prog_type bpf_attach_type_to_tramp(enum bpf_attach_type t)
>  	}
>  }
>  
> +static void bpf_trampoline_ksym_add(struct bpf_trampoline *tr)
> +{
> +	struct bpf_ksym *ksym = &tr->ksym;
> +
> +	snprintf(ksym->name, KSYM_NAME_LEN, "bpf_trampoline_%llu", tr->key);
Do you have plan to support struct_ops which is also using
trampoline (in bpf_struct_ops_map_update_elem())?
Any idea on the name? bpf_struct_ops_<map_id>? 

> +	bpf_image_ksym_add(tr->image, ksym);
> +}
> +