Modify ELF symbol table value in C

1
votes

similar to Dynamically modify symbol table at runtime (in C) but different requirements.

a blog post by cloudflare has the following c code to dynamically enable/disable features based on the ELF table.

unsigned long long enabled ;
asm("%0 = RULE_0_ENABLED ll"
: "=r" ( enabled ));

I was able to get this to work and pass through the ebpf verifier and it shows in llvm readelf.

$ llvm-readelf-6.0 -r test.o

Relocation section '.relprog' at offset 0xf0 contains 1 entries:
    Offset             Info             Type               Symbol's Value  Symbol's Name
0000000000000000  0000000200000001 R_BPF_64_64            0000000000000000 RULE_0_ENABLED

I can not seem to find out how to edit RULE_0_ENABLED before loading the .o file into the kernel. How do you edit this symbol table dynamically in C?

The usecase: I am looking to enable/disable specific pieces of code without recompiling. XDP can load this C code into your kernel but there is a huge performance gain if you can turn unneeded parts of code off. (as this code runs for every packet, the kernel will noop out these parts of the code)

celfebpfxdp-bpf
What are you trying to achieve? xyproblem.info – Employed Russian
Should've clarified. I am looking to enable/disable specific pieces of code without recompiling. XDP can load this C code into your kernel but there is a huge performance gain if you can turn unneeded parts of code off. (as this code runs for every packet) – Luc H
It doesn't look like you want to modify the symbol table (nor that you want to do that in C). It looks like you want to modify the instruction in a compiled test.o file, and change it from r1 = 0 to r1 = 1 (or vice versa). – Employed Russian
That would probably give the same effect although modifying the elf table would probably be simpler as this is BPF assembly. Cloudflare was using this ELF system as a solution to the issue so i figured that would be the best way to go. – Luc H