linux-kernel - Re: [PATCH v2 1/4] ftrace: Add print_function

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <8455bc79-a684-476d-88bd-9f7ff9ffa637@oracle.com>
Date: Wed, 8 Jan 2025 15:39:50 +0000
From: Alan Maguire <alan.maguire@...cle.com>
To: Steven Rostedt <rostedt@...dmis.org>
Cc: "Masami Hiramatsu (Google)" <mhiramat@...nel.org>,
        Donglin Peng <dolinux.peng@...il.com>, linux-kernel@...r.kernel.org,
        linux-trace-kernel@...r.kernel.org,
        Mark Rutland <mark.rutland@....com>,
        Mathieu Desnoyers <mathieu.desnoyers@...icios.com>,
        Andrew Morton <akpm@...ux-foundation.org>,
        Sven Schnelle <svens@...ux.ibm.com>,
        Paul Walmsley
 <paul.walmsley@...ive.com>,
        Palmer Dabbelt <palmer@...belt.com>, Albert Ou <aou@...s.berkeley.edu>,
        Guo Ren <guoren@...nel.org>,
        Zheng Yejian <zhengyejian@...weicloud.com>, bpf@...r.kernel.org
Subject: Re: [PATCH v2 1/4] ftrace: Add print_function_args()

On 08/01/2025 15:24, Steven Rostedt wrote:
> On Wed, 8 Jan 2025 11:19:11 +0000
> Alan Maguire <alan.maguire@...cle.com> wrote:
> 
>>>>> +       trace_seq_printf(s, "(");
>>>>> +
>>>>> +       if (!args)
>>>>> +               goto out;
>>>>> +       if (lookup_symbol_name(func, name))
>>>>> +               goto out;
>>>>> +
>>>>> +       btf = bpf_get_btf_vmlinux();
>>>>> +       if (IS_ERR_OR_NULL(btf))
>>>>> +               goto out;  
>>>>
>>>>
>>>> There is no need to the retrieve the BTF of vmlinux, as btf_find_func_proto
>>>> will return the correct BTF via its second parameter.  
>>>
>>> Good catch! The second parameter of btf_find_func_proto() is output.
>>>  
>>
>> One thought here - with btf_find_func_proto(), we will try kernel BTF
>> and then proceed to module BTF, iterating over all modules to find the
>> function prototype. So where we are tracing module functions this could
>> get expensive if such a function is frequently encountered, and it also
>> opens up the risk that we end up using the wrong function prototype from
>> the wrong module that just happens to match on function name.
>>
>> So I wonder if we could use the function address to do a more guided
>> lookup. Perhaps we could use kallsyms_lookup(), retrieving the
>> (potential) module name. Then maybe modify the signature of
>> btf_find_func_proto() to take an optional module name parameter to avoid
>> iteration? None of this is strictly needed, but it may speed things up a
>> bit and give us more accurate parameter info for those few cases with
>> name clashes, so could be done as a follow-up if needed. Thanks!
> 
> Well, every place this is called, we first get the function name from
> kallsyms. Perhaps I can modify the code to get the module name as well, and
> if it exists, we can pass that too?
>

yep, that would be great! One thing we should probably think about for
the future is ways to stash module/BTF ids such that we don't need
lookup each time, but I can't see any obvious way to do that currently.


> -- Steve