linux-kernel - Re: [PATCH bpf-next v4 0/3] bpf, x86: allow function arguments up to 12 for TRACING

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CADxym3bm6tva6e6ahD-pGT=JF=0Ng6051fDcKs0-TZuu4CK-cA@mail.gmail.com>
Date:   Sat, 10 Jun 2023 14:59:39 +0800
From:   Menglong Dong <menglong8.dong@...il.com>
To:     Yonghong Song <yhs@...a.com>
Cc:     andrii.nakryiko@...il.com, alan.maguire@...cle.com, ast@...nel.org,
        daniel@...earbox.net, andrii@...nel.org, martin.lau@...ux.dev,
        song@...nel.org, yhs@...com, john.fastabend@...il.com,
        kpsingh@...nel.org, sdf@...gle.com, haoluo@...gle.com,
        jolsa@...nel.org, bpf@...r.kernel.org,
        linux-kernel@...r.kernel.org, Menglong Dong <imagedong@...cent.com>
Subject: Re: [PATCH bpf-next v4 0/3] bpf, x86: allow function arguments up to
 12 for TRACING

On Sat, Jun 10, 2023 at 11:51 AM Yonghong Song <yhs@...a.com> wrote:
>
>
>
> On 6/9/23 2:56 AM, menglong8.dong@...il.com wrote:
> > From: Menglong Dong <imagedong@...cent.com>
> >
> > For now, the BPF program of type BPF_PROG_TYPE_TRACING can only be used
> > on the kernel functions whose arguments count less than 6. This is not
> > friendly at all, as too many functions have arguments count more than 6.
> > According to the current kernel version, below is a statistics of the
> > function arguments count:
> >
> > argument count | function count
> > 7              | 704
> > 8              | 270
> > 9              | 84
> > 10             | 47
> > 11             | 47
> > 12             | 27
> > 13             | 22
> > 14             | 5
> > 15             | 0
> > 16             | 1
> >
> > Therefore, let's enhance it by increasing the function arguments count
> > allowed in arch_prepare_bpf_trampoline(), for now, only x86_64.
> >
> > In the 1st patch, we make arch_prepare_bpf_trampoline() support to copy
> > function arguments in stack for x86 arch. Therefore, the maximum
> > arguments can be up to MAX_BPF_FUNC_ARGS for FENTRY and FEXIT.
> >
> > In the 2nd patch, we clean garbage value in upper bytes of the trampoline
> > when we store the arguments from regs or on-stack into stack.
> >
> > And the 3rd patches are for the testcases of the 1st patch.
> >
> > Changes since v3:
> > - try make the stack pointer 16-byte aligned. Not sure if I'm right :)
> > - introduce clean_garbage() to clean the grabage when argument count is 7
> > - use different data type in bpf_testmod_fentry_test{7,12}
> > - add testcase for grabage values in ctx
> >
> > Changes since v2:
> > - keep MAX_BPF_FUNC_ARGS still
> > - clean garbage value in upper bytes in the 2nd patch
> > - move bpf_fentry_test{7,12} to bpf_testmod.c and rename them to
> >    bpf_testmod_fentry_test{7,12} meanwhile in the 3rd patch
> >
> > Changes since v1:
> > - change the maximun function arguments to 14 from 12
> > - add testcases (Jiri Olsa)
> > - instead EMIT4 with EMIT3_off32 for "lea" to prevent overflow
> >
> > Menglong Dong (3):
> >    bpf, x86: allow function arguments up to 12 for TRACING
> >    bpf, x86: clean garbage value in the stack of trampoline
> >    selftests/bpf: add testcase for FENTRY/FEXIT with 6+ arguments
> >
> >   arch/x86/net/bpf_jit_comp.c                   | 145 ++++++++++++++++--
> >   .../selftests/bpf/bpf_testmod/bpf_testmod.c   |  19 ++-
> >   .../selftests/bpf/prog_tests/fentry_fexit.c   |   4 +-
> >   .../selftests/bpf/prog_tests/fentry_test.c    |   2 +
> >   .../selftests/bpf/prog_tests/fexit_test.c     |   2 +
> >   .../testing/selftests/bpf/progs/fentry_test.c |  33 ++++
> >   .../testing/selftests/bpf/progs/fexit_test.c  |  57 +++++++
> >   7 files changed, 245 insertions(+), 17 deletions(-)
>
> Also replace rebase on top of bpf-next. Patch 3 cannot be applied.

Okay!