Re: [PATCH] perf/kprobe: maxactive for fd-based kprobe

[Masami Hiramatsu (Google) <mhiramat@kernel.org>]

On Wed, 15 Jun 2022 22:00:29 +0200
Dmitry Dolgov <9erthalion6@gmail.com> wrote:

> > On Sun, Jun 12, 2022 at 09:12:32PM +0900, Masami Hiramatsu wrote:
> > On Sat, 11 Jun 2022 11:28:36 -0700
> > Alexei Starovoitov <alexei.starovoitov@gmail.com> wrote:
> >
> > > On Thu, Jun 9, 2022 at 1:14 PM Dmitry Dolgov <9erthalion6@gmail.com> wrote:
> > > >
> > > > > On Thu, Jun 09, 2022 at 09:29:36PM +0200, Dmitrii Dolgov wrote:
> > > > >
> > > > > Enable specifying maxactive for fd based kretprobe. This will be useful
> > > > > for tracing tools like bcc and bpftrace (see for example discussion [1]).
> > > > > Use highest 12 bit (bit 52-63) to allow maximal maxactive of 4095.
> > > > >
> > > > > The original patch [2] seems to be fallen through the cracks and wasn't
> > > > > applied. I've merely rebased the work done by Song Liu and verififed it
> > > > > still works.
> > > > >
> > > > > [1]: https://github.com/iovisor/bpftrace/issues/835
> > > > > [2]: https://lore.kernel.org/all/20191007223111.1142454-1-songliubraving@fb.com/
> > > >
> > > > I've recently stumbled upon this seemingly lost topic, and wanted to raise it
> > > > again. Please let me know if there is a more appropriate way to do so.
> > >
> > > With kretprobe using rethook the maxactive limit is no longer used.
> > > So we probably don't need this patch.
> > >
> > > Masami, wdyt?
> >
> > No, rethook is just a library version of kretprobe return hook,
> > so the maxactive is still alive. I would like to make the rethook
> > to use(share with) function graph's per-task shadow stack. When
> > that is done, the maxactive will be removed.
> 
> Thanks for clarification! Does it mean that the possibility of setting
> maxactive still makes sense, until the rethook changes you've mentioned
> will land?

Yes, unfortunatelly, there is no magic. We need a shadow stack without
runtime allocation for this purpose. Thus what we can do is to use
a per-task pre-allocated shadow stack page or make a common pool of nodes
for variable-length shadow-stack. Both has pros and cons (depends on the
system configuration).

> 
> On a side note, is it possible to somehow follow/review/test the work
> about rethook and function graph's shadow stack?

Hmm, good question. It should work theoletically, but it is easy to be
tested by ftrace tracefs interface on x86. Just enable function-graph
tracer and add a kretprobe event on some fucntion. E.g.

echo function-graph > current_tracer
echo r:test vfs_read >> kprobe_events
echo 1 > events/kprobes/enable

Thank you,


-- 
Masami Hiramatsu (Google) <mhiramat@kernel.org>