Re: pull-request: bpf-next 2022-03-21

[Masami Hiramatsu <mhiramat@kernel.org>]

On Mon, 21 Mar 2022 22:18:04 -0700
Alexei Starovoitov <alexei.starovoitov@gmail.com> wrote:

> On Mon, Mar 21, 2022 at 10:05 PM Masami Hiramatsu <mhiramat@kernel.org> wrote:
> >
> > On Mon, 21 Mar 2022 21:35:55 -0700
> > Alexei Starovoitov <alexei.starovoitov@gmail.com> wrote:
> >
> > > On Mon, Mar 21, 2022 at 7:36 PM Masami Hiramatsu <mhiramat@kernel.org> wrote:
> > > >
> > > > Hi Linus and Alexei,
> > > >
> > > > At first, sorry about this issue. I missed to Cc'ed to arch maintainers.
> > > >
> > > > On Mon, 21 Mar 2022 17:31:28 -0700
> > > > Alexei Starovoitov <alexei.starovoitov@gmail.com> wrote:
> > > >
> > > > > On Mon, Mar 21, 2022 at 4:59 PM Linus Torvalds
> > > > > <torvalds@linux-foundation.org> wrote:
> > > > > >
> > > > > > On Mon, Mar 21, 2022 at 4:11 PM Alexei Starovoitov
> > > > > > <alexei.starovoitov@gmail.com> wrote:
> > > > > > >
> > > > > > > Did you look at the code?
> > > > > > > In particular:
> > > > > > > https://lore.kernel.org/bpf/164735286243.1084943.7477055110527046644.stgit@devnote2/
> > > > > > >
> > > > > > > it's a copy paste of arch/x86/kernel/kprobes/core.c
> > > > > > >
> > > > > > > How is it "bad architecture code" ?
> > > > > >
> > > > > > It's "bad architecture code" because the architecture maintainers have
> > > > > > made changes to check ENDBR in the meantime.
> > > > > >
> > > > > > So it used to be perfectly fine. It's not any longer - and the
> > > > > > architecture maintainers were clearly never actually cc'd on the
> > > > > > changes, so they didn't find out until much too late.
> > > >
> > > > Let me retry porting fprobe on top of ENDBR things and confirm with
> > > > arch maintainers.
> > >
> > > Just look at linux-next.
> > > objtool warning is the only issue.
> >
> > Actually, there are conflicts with arm tree and Rust tree too.
> > I found I missed the objtool annotation patch on IBT series and fixed it.
> 
> 4 arch patches were reverted.
> 
> > >
> > > > >
> > > > > Not denying that missing cc was an issue.
> > > > >
> > > > > We can drop just arch patches:
> > > > >       rethook: x86: Add rethook x86 implementation
> > > > >       arm64: rethook: Add arm64 rethook implementation
> > > > >       powerpc: Add rethook support
> > > > >       ARM: rethook: Add rethook arm implementation
> > > > >
> > > > > or everything including Jiri's work on top of it.
> > > > > Which would be a massive 27 patches.
> > > > >
> > > > > We'd prefer the former, of course.
> > > > > Later during the merge window we can add a single
> > > > > 'rethook: x86' patch that takes endbr into account,
> > > > > so that multi-kprobe feature will work on x86.
> > > > > For the next merge window we can add other archs.
> > > > > Would that work?
> > > >
> > > > BTW, As far as I can see the ENDBR things, the major issue on fprobe
> > > > is that the ftrace'ed ip address will be different from the symbol
> > > > address (even) on x86. That must be ensured to work before merge.
> > > > Let me check it on Linus's tree at first.
> > >
> > > That's not an issue. Peter tweaked ftrace logic and fprobe plugs
> > > into that.
> > > The fprobe/multi-kprobe works fine in linux-next.
> >
> > Yeah, I think fprobe should work because it uses
> > ftrace_location_range(func-entry, func-end) for non-x86 arch.
> >
> > >
> > > bpf selftest for multi kprobe needs this hack:
> > > diff --git a/tools/testing/selftests/bpf/progs/kprobe_multi.c
> > > b/tools/testing/selftests/bpf/progs/kprobe_multi.c
> > > index af27d2c6fce8..530a64e2996a 100644
> > > --- a/tools/testing/selftests/bpf/progs/kprobe_multi.c
> > > +++ b/tools/testing/selftests/bpf/progs/kprobe_multi.c
> > > @@ -45,7 +45,7 @@ static void kprobe_multi_check(void *ctx, bool is_return)
> > >         __u64 addr = bpf_get_func_ip(ctx);
> > >
> > >  #define SET(__var, __addr, __cookie) ({                        \
> > > -       if (((const void *) addr == __addr) &&          \
> > > +       if (((const void *) addr == __addr + 4) &&              \
> > >              (!test_cookie || (cookie == __cookie)))    \
> >
> > Hmm, this is an ugly hack... You need to use actual ftrace addr, instead of
> > symbol addr. With IBT series, you can use ftrace_location(symbol-addr) to
> > get the ftrace-addr. (e.g. addr == ftrace_location(__addr) should work)
> 
> It's a temporary hack.
> bpf prog cannot call an arbitrary function like ftrace_location.

Ah, OK. Then you may need to check the addr in some range.


> > > to pass when both CONFIG_FPROBE=y and CONFIG_X86_KERNEL_IBT=y.
> > > The test is too strict. It didn't account for the possibility of endbr.
> > >
> > > So I'm inclined to drop only 4 arch patches instead of the whole thing.
> >
> > OK, but it is hard to understand how it works without knowing rethook itself.
> > I would like to send whole v13 patch series to arch maintainers.
> 
> fprobe is a glorified kprobe and pretty simple code by itself.
> It's too late for v13. Please send 'rethook: x86' patch only
> with endbr annotations and get it acked.
> The other archs will wait until the next merge window.

OK. I'll send the patch.

Thank you,

-- 
Masami Hiramatsu <mhiramat@kernel.org>