linux-kernel - Re: [PATCH v3 6/7] riscv: Add KPROBES_ON

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAJF2gTSMUnHfv3GLj_TGT2dJkKq2zbEsnbPKREiq5i6PPjyTBg@mail.gmail.com>
Date:   Wed, 15 Jul 2020 00:24:54 +0800
From:   Guo Ren <guoren@...nel.org>
To:     Masami Hiramatsu <mhiramat@...nel.org>
Cc:     Palmer Dabbelt <palmerdabbelt@...gle.com>,
        Paul Walmsley <paul.walmsley@...ive.com>,
        Oleg Nesterov <oleg@...hat.com>,
        linux-riscv <linux-riscv@...ts.infradead.org>,
        Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
        Anup Patel <anup@...infault.org>, linux-csky@...r.kernel.org,
        Greentime Hu <greentime.hu@...ive.com>,
        Zong Li <zong.li@...ive.com>,
        Patrick Stählin <me@...ki.ch>,
        Björn Töpel <bjorn.topel@...il.com>,
        Guo Ren <guoren@...ux.alibaba.com>,
        Pekka Enberg <penberg@...nel.org>
Subject: Re: [PATCH v3 6/7] riscv: Add KPROBES_ON_FTRACE supported

Thx Masami,

On Tue, Jul 14, 2020 at 7:38 PM Masami Hiramatsu <mhiramat@...nel.org> wrote:
>
> On Mon, 13 Jul 2020 23:39:21 +0000
> guoren@...nel.org wrote:
>
> > From: Guo Ren <guoren@...ux.alibaba.com>
> >
> > This patch adds support for kprobes on ftrace call sites to avoids
> > much of the overhead with regular kprobes. Try it with simple
> > steps:
> >
> > 1. Get _do_fork ftrace call site.
> > Dump of assembler code for function _do_fork:
> >    0xffffffe00020af64 <+0>:     addi    sp,sp,-128
> >    0xffffffe00020af66 <+2>:     sd      s0,112(sp)
> >    0xffffffe00020af68 <+4>:     sd      ra,120(sp)
> >    0xffffffe00020af6a <+6>:     addi    s0,sp,128
> >    0xffffffe00020af6c <+8>:     sd      s1,104(sp)
> >    0xffffffe00020af6e <+10>:    sd      s2,96(sp)
> >    0xffffffe00020af70 <+12>:    sd      s3,88(sp)
> >    0xffffffe00020af72 <+14>:    sd      s4,80(sp)
> >    0xffffffe00020af74 <+16>:    sd      s5,72(sp)
> >    0xffffffe00020af76 <+18>:    sd      s6,64(sp)
> >    0xffffffe00020af78 <+20>:    sd      s7,56(sp)
> >    0xffffffe00020af7a <+22>:    mv      s4,a0
> >    0xffffffe00020af7c <+24>:    mv      a0,ra
> >    0xffffffe00020af7e <+26>:    nop   <<<<<<<< here!
> >    0xffffffe00020af82 <+30>:    nop
> >    0xffffffe00020af86 <+34>:    ld      s3,0(s4)
> >
> > 2. Set _do_fork+26 as the kprobe.
> >   echo 'p:myprobe _do_fork+26 dfd=%a0 filename=%a1 flags=%a2 mode=+4($stack)' > /sys/kernel/debug/tracing/kprobe_events
> >   echo 1 > /sys/kernel/debug/tracing/events/kprobes/enable
> >   cat /sys/kernel/debug/tracing/trace
> >   tracer: nop
> >
> >   entries-in-buffer/entries-written: 3/3   #P:1
> >
> >                                _-----=> irqs-off
> >                               / _----=> need-resched
> >                              | / _---=> hardirq/softirq
> >                              || / _--=> preempt-depth
> >                              ||| /     delay
> >             TASK-PID   CPU#  ||||    TIMESTAMP  FUNCTION
> >                | |       |   ||||       |         |
> >               sh-87    [000] ....   551.557031: myprobe: (_do_fork+0x1a/0x2e6) dfd=0xffffffe00020af7e filename=0xffffffe00020b34e flags=0xffffffe00101e7c0 mode=0x20af86ffffffe0
> >
> >   cat /sys/kernel/debug/kprobes/list
> > ffffffe00020af7e  k  _do_fork+0x1a    [FTRACE]
> >                                        ^^^^^^
>
> Hmm, this seems fentry is not supported on RISC-V yet. But anyway,
> it will be useful for users (if they can find the offset).

Seems only x86 & ⬆️90 use fentry，can you elaborate more about fentry's
benefit and how the user could set kprobe on ftrace call site without
disassemble?

--
Best Regards
 Guo Ren

ML: https://lore.kernel.org/linux-csky/