linux-kernel - Re: [PATCH] selftests/ftrace: update kprobe syntax error test for ppc64le

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20241104102704.7c20dc0b@gandalf.local.home>
Date: Mon, 4 Nov 2024 10:27:04 -0500
From: Steven Rostedt <rostedt@...dmis.org>
To: Segher Boessenkool <segher@...nel.crashing.org>
Cc: Hari Bathini <hbathini@...ux.ibm.com>, Shuah Khan <shuah@...nel.org>,
 linux-kselftest@...r.kernel.org, Masami Hiramatsu <mhiramat@...nel.org>,
 Michael Ellerman <mpe@...erman.id.au>, Madhavan Srinivasan
 <maddy@...ux.ibm.com>, "Naveen N. Rao" <naveen@...nel.org>, lkml
 <linux-kernel@...r.kernel.org>, linux-trace-kernel@...r.kernel.org,
 linuxppc-dev <linuxppc-dev@...ts.ozlabs.org>
Subject: Re: [PATCH] selftests/ftrace: update kprobe syntax error test for
 ppc64le

On Mon, 4 Nov 2024 04:36:15 -0600
Segher Boessenkool <segher@...nel.crashing.org> wrote:

> > >>Querying for function arguments is supported on kprobes only at function
> > >>entry. This is a negative test case where the offset is intentionally
> > >>set beyond function entry while querying for function arguments.
> > >>I guess, simply setting the offset to 20 (vfs_read is anyway
> > >>going to be beyond 5 instructions) instead of 8 for powerpc would
> > >>make all platforms and ABI variants happy?  
> > >
> > >I have no idea.  What is this "offset" anyway?  
> > 
> > offset (in bytes) from function start address..  
> 
> But what is there?

Function start address is what kallsyms returns. That is:

  grep function /proc/kallsyms

> 
> > >This is just the ELFv2 ABI.  No platform can make up its own thing at
> > >all (well, none decided to be gratuitously incompatible, so far).  And
> > >there are no "ABI variants"!  
> > 
> > The test case applies for ABIv1 & ABIv2. All ppc32 & ppc64 platforms..  
> 
> Hrm.  So you allow essentially random entry points on other ABIs to
> work?
> 
> > >You're just making assumptions here that are based on nothing else but
> > >observations of what is done most of the time.  That might work for a
> > >while -- maybe a long while even! -- but it can easily break down.  
> > 
> > Hmmm.. I understand that you want the test case to read st_other field
> > but would you rather suggest an offset of 64?  
> 
> I have no idea what "offset" means here.

The offset is the number of bytes from the address that is returned by
kallsyms.


> 
> > Is a GEP of 8/16 instructions going to be true anytime soon or is it
> > true already for some cases? The reason I ask that is some kprobe/ftrace
> > code in the kernel might need a bit of re-look if that is the case.  
> 
> An entry point has no instructions at all.  Oh, you mean the code at
> the GEP.
> 
> The LEP can already be all the allowed distances after the GEP.  And
> the .localentry GAS directive already supports all those distances
> always.  Not a lot of code written in assembler does use that, and
> certainly GCC does not use a lot of the freedom it has here, but it
> could (and so could assembler programmers).  Typically people will want
> to make the code here as short as possible, and there are restrictions
> on what is *allowed* to be done here anyway (ld, the link editor, can
> change this code after all!), so it is not too likely you will ever see
> big code at the GEP often, but times change, etc.


This is all determined by the kernel. It's considered a function entry by
the function:

   arch_kprobe_on_func_entry()

Which on PowerPC has:

static bool arch_kprobe_on_func_entry(unsigned long offset)
{
#ifdef CONFIG_PPC64_ELF_ABI_V2
#ifdef CONFIG_KPROBES_ON_FTRACE
        return offset <= 16;
#else
        return offset <= 8;
#endif
#else
        return !offset;
#endif  
}

So, being greater than 16 on powerpc with config CONFIG_PPC64_ELF_ABI_V2
set, would work. If that function changes, then the test needs to change.

-- Steve