netdev - Re: How to extract BTF object ID from kernel module?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date:   Wed, 31 Aug 2022 19:22:52 +0200
From:   Jesper Dangaard Brouer <jbrouer@...hat.com>
To:     Andrii Nakryiko <andrii@...nel.org>,
        "andrii.nakryiko@...il.com" <andrii.nakryiko@...il.com>
Cc:     brouer@...hat.com, Zaremba Larysa <larysa.zaremba@...el.com>,
        Alexei Starovoitov <ast@...nel.org>, bpf <bpf@...r.kernel.org>,
        "xdp-hints@...-project.net" <xdp-hints@...-project.net>,
        Netdev <netdev@...r.kernel.org>
Subject: Re: How to extract BTF object ID from kernel module?


On 30/08/2022 15.17, Jesper Dangaard Brouer wrote:
> Hi Andrii,
> 
> When opening a modules BTF file (e.g. /sys/kernel/btf/i40e), can I
> somehow get the kernels BTF object ID value (via that FD)?

I had hoped I could simply open /sys/kernel/btf/module [1]
and use bpf_obj_get_info_by_fd(), but that fails

  [1] 
https://github.com/xdp-project/bpf-examples/blob/BTF-playground01/BTF-playground/btf_module_read.c#L84
  [2] 
https://github.com/xdp-project/bpf-examples/blob/BTF-playground01/BTF-playground/btf_module_read.c#L48

> I think I want the BTF object IDs as displayed by 'btftool btf'.
> That code walks all IDs via bpf_btf_get_next_id() and then gets the FD
> via bpf_btf_get_fd_by_id().  I'm looking for a more direct way than
> having to walk all IDs...
> 
> (p.s. Cc. Larysa, I also looked at your code, which like bpftool end-up
> walking all BTF IDs and extends libbpf with internal btf_obj_id to keep
> track).

My current approach I end-up walking [3] all the BTF IDs via 
bpf_btf_get_next_id() and then use bpf_obj_get_info_by_fd().
And then searching for the module name like this[4].

  [3] 
https://github.com/xdp-project/bpf-examples/blob/BTF-playground01/BTF-playground/btf_module_ids.c#L144
  [4] 
https://github.com/xdp-project/bpf-examples/blob/BTF-playground01/BTF-playground/btf_module_ids.c#L187-L256

Is this the only approach?

It seems wasteful that I have to walk all the IDs, when I already knows 
what BTF file in /sys/kernel/btf/ I'm interested in...

--Jesper