bpf: get kernel symbol addresses via syscall

This adds new two new fields to struct bpf_prog_info. For
multi-function programs, these fields can be used to pass
a list of kernel symbol addresses for all functions in a
given program to userspace using the bpf system call with
the BPF_OBJ_GET_INFO_BY_FD command.

When bpf_jit_kallsyms is enabled, we can get the address
of the corresponding kernel symbol for a callee function
and resolve the symbol's name. The address is determined
by adding the value of the call instruction's imm field
to __bpf_call_base. This offset gets assigned to the imm
field by the verifier.

For some architectures, such as powerpc64, the imm field
is not large enough to hold this offset.

We resolve this by:

[1] Assigning the subprog id to the imm field of a call
    instruction in the verifier instead of the offset of
    the callee's symbol's address from __bpf_call_base.

[2] Determining the address of a callee's corresponding
    symbol by using the imm field as an index for the
    list of kernel symbol addresses now available from
    the program info.

Suggested-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: Sandipan Das <sandipan@linux.vnet.ibm.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>

diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h
index c3e502d06bc37f7ddfade3f34ef79c30a8e303a0..0be90965867ddf9ba0d62f48222a429b69363ce3 100644 (file)
--- a/include/uapi/linux/bpf.h
+++ b/include/uapi/linux/bpf.h
@@ -2205,6 +2205,8 @@ struct bpf_prog_info {
        __u32 gpl_compatible:1;
        __u64 netns_dev;
        __u64 netns_ino;
+       __u32 nr_jited_ksyms;
+       __aligned_u64 jited_ksyms;
 } __attribute__((aligned(8)));
 
 struct bpf_map_info {

diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
index 0b4c945510016af45ef2ac43783b80d6e4dc8a07..068a4fc79ddb5dcaad3473f0e8376095f05f3d31 100644 (file)
--- a/kernel/bpf/syscall.c
+++ b/kernel/bpf/syscall.c
@@ -1933,6 +1933,7 @@ static int bpf_prog_get_info_by_fd(struct bpf_prog *prog,
        if (!capable(CAP_SYS_ADMIN)) {
                info.jited_prog_len = 0;
                info.xlated_prog_len = 0;
+               info.nr_jited_ksyms = 0;
                goto done;
        }
 
@@ -1981,6 +1982,30 @@ static int bpf_prog_get_info_by_fd(struct bpf_prog *prog,
                }
        }
 
+       ulen = info.nr_jited_ksyms;
+       info.nr_jited_ksyms = prog->aux->func_cnt;
+       if (info.nr_jited_ksyms && ulen) {
+               if (bpf_dump_raw_ok()) {
+                       u64 __user *user_ksyms;
+                       ulong ksym_addr;
+                       u32 i;
+
+                       /* copy the address of the kernel symbol
+                        * corresponding to each function
+                        */
+                       ulen = min_t(u32, info.nr_jited_ksyms, ulen);
+                       user_ksyms = u64_to_user_ptr(info.jited_ksyms);
+                       for (i = 0; i < ulen; i++) {
+                               ksym_addr = (ulong) prog->aux->func[i]->bpf_func;
+                               ksym_addr &= PAGE_MASK;
+                               if (put_user((u64) ksym_addr, &user_ksyms[i]))
+                                       return -EFAULT;
+                       }
+               } else {
+                       info.jited_ksyms = 0;
+               }
+       }
+
 done:
        if (copy_to_user(uinfo, &info, info_len) ||
            put_user(info_len, &uattr->info.info_len))

diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 559cb74ba29eb40b684d04e0dc95d533bbc961b6..8c4d9d0fd3aba7e944b88be34c3fe612d63919f4 100644 (file)
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -5426,17 +5426,12 @@ static int jit_subprogs(struct bpf_verifier_env *env)
         * later look the same as if they were interpreted only.
         */
        for (i = 0, insn = prog->insnsi; i < prog->len; i++, insn++) {
-               unsigned long addr;
-
                if (insn->code != (BPF_JMP | BPF_CALL) ||
                    insn->src_reg != BPF_PSEUDO_CALL)
                        continue;
                insn->off = env->insn_aux_data[i].call_imm;
                subprog = find_subprog(env, i + insn->off + 1);
-               addr  = (unsigned long)func[subprog]->bpf_func;
-               addr &= PAGE_MASK;
-               insn->imm = (u64 (*)(u64, u64, u64, u64, u64))
-                           addr - __bpf_call_base;
+               insn->imm = subprog;
        }
 
        prog->jited = 1;