Re: [RFC PATCH v3 7/9] bpf: Add kprobe link for attaching raw kprobes

[Masami Hiramatsu <mhiramat@kernel.org>]

On Thu, 20 Jan 2022 11:44:54 +0100
Jiri Olsa <jolsa@redhat.com> wrote:

> On Wed, Jan 19, 2022 at 11:57:50PM +0900, Masami Hiramatsu wrote:
> 
> SNIP
> 
> > +static int kprobe_link_prog_run(struct bpf_kprobe_link *kprobe_link,
> > +				struct pt_regs *regs)
> > +{
> > +	struct bpf_trace_run_ctx run_ctx;
> > +	struct bpf_run_ctx *old_run_ctx;
> > +	int err;
> > +
> > +	if (unlikely(__this_cpu_inc_return(bpf_prog_active) != 1)) {
> > +		err = 0;
> > +		goto out;
> > +	}
> > +
> > +	old_run_ctx = bpf_set_run_ctx(&run_ctx.run_ctx);
> > +	run_ctx.bpf_cookie = kprobe_link->bpf_cookie;
> > +
> > +	rcu_read_lock();
> > +	migrate_disable();
> > +	err = bpf_prog_run(kprobe_link->link.prog, regs);
> > +	migrate_enable();
> > +	rcu_read_unlock();
> > +
> > +	bpf_reset_run_ctx(old_run_ctx);
> > +
> > + out:
> > +	__this_cpu_dec(bpf_prog_active);
> > +	return err;
> > +}
> > +
> > +static void kprobe_link_entry_handler(struct fprobe *fp, unsigned long entry_ip,
> > +				      struct pt_regs *regs)
> > +{
> > +	struct bpf_kprobe_link *kprobe_link;
> > +
> > +	/*
> > +	 * Because fprobe's regs->ip is set to the next instruction of
> > +	 * dynamic-ftrace insturction, correct entry ip must be set, so
> > +	 * that the bpf program can access entry address via regs as same
> > +	 * as kprobes.
> > +	 */
> > +	instruction_pointer_set(regs, entry_ip);
> 
> ok, so this actually does the stall for me.. it changes
> the return address back to repeat the call again

Good catch! and don't mind, this change is introduced me :-P.
I thought that if I didn't add the FTRACE_FL_IPMODIFY, ftrace
ignores the updated regs->ip, but it doesn't.

> bu I think it's good idea to carry the original ip in regs
> (for bpf_get_func_ip helper) so I think we need to save it
> first and restore after the callback

Yes, btw, should I do that fix in fprobe?

> 
> I'll make the fix and add cookie change Andrii asked for
> on top of your ftrace changes and let you know

OK, thank you!

> 
> thanks,
> jirka
> 
> > +	kprobe_link = container_of(fp, struct bpf_kprobe_link, fp);
> > +	kprobe_link_prog_run(kprobe_link, regs);
> > +}
> > +
> 
> SNIP
> 


-- 
Masami Hiramatsu <mhiramat@kernel.org>