Re: [RFC PATCH -next v2 3/4] arm64/ftrace: support dynamically allocated trampolines

Masami Hiramatsu
2022-05-11T14:36:52Z

On Tue, 10 May 2022 10:44:46 -0400
Steven Rostedt <rostedt@goodmis.org> wrote:

> On Tue, 10 May 2022 18:10:12 +0900
> Masami Hiramatsu <mhiramat@kernel.org> wrote:
>
> > >
> > > This was suggested by both Peter Zijlstra and Thomas Gleixner when I
> > > introduced FTRACE_WITH_ARGS, where all functions can now get the arguments
> > > from fregs, but not the full pt_regs.
> >
> > Hmm, I thought the ftrace_get_regs() is the all-or-nothing interface, or
> > is there any way to get the arguments from fregs?
>
> Not yet generically. But that can easily be added. If you look at x86 live
> patching, since it is arch specific, it just took the regs parameter
> directly, knowing that the args were already set up. That is, ftrace_regs is
> just a wrapper around pt_regs with just the regs for the arguments and stack
> initialized. If you get regs from ftrace_get_regs(fregs) it will return
> NULL if it wasn't full set of regs. But we can add generic functions to get
> the parameters.
>
> That is, we can create a ftrace_get_kernel_argument() function that takes
> fregs instead of pt_regs, and produce the same thing as
> regs_get_kernel_argument().
>
> x86 live kernel patching has this:
>
> arch/x86/include/asm/ftrace.h:
>
> #define ftrace_instruction_pointer_set(fregs, _ip) \
> do { (fregs)->regs.ip = (_ip); } while (0)
>
>
> arch/x86/include/asm/livepatch.h:
>
> static inline void klp_arch_set_pc(struct ftrace_regs *fregs, unsigned long ip)
> {
> ftrace_instruction_pointer_set(fregs, ip);
> }
>
> Where fregs is not a full set of regs.

OK, so fregs::regs will have a subset of pt_regs, and accessibility of
the registers depends on the architecture. If we can have a checker like

ftrace_regs_exist(fregs, reg_offset)

kprobe on ftrace or fprobe user (BPF) can filter user's requests.
I think I can introduce a flag for kprobes so that user can make a
kprobe handler only using a subset of registers.
Maybe similar filter code is also needed for BPF 'user space' library
because this check must be done when compiling BPF.

Thank you,

> >
> > > If a ftrace_ops has the REGS flag set
> > > (using ftrace_regs_caller), the ftrace_get_regs(fregs) will return the
> > > pt_regs, or it will return NULL if ftrace_regs_caller was not used.
> > >
> > > This way the same parameter can provide full pt_regs or a subset, and have
> > > an generic interface to tell the difference.
> >
> > If it can provide a partial (subset of) pt_regs, that could be good for me
> > too, since at least kprobe-events on ftrace can check the traced register
> > is in the subset or not and reject it if it doesn't saved.
>
> That's exactly the use case for ftrace_regs.
>
> -- Steve

--
Masami Hiramatsu <mhiramat@kernel.org>