linux-kernel - Re: [BUG?] ppc64le: fentry BPF not triggered after live patch (v6.14)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <873f3934-e964-49d4-a312-1debb1c77255@linux.ibm.com>
Date: Mon, 7 Apr 2025 13:46:19 +0530
From: Hari Bathini <hbathini@...ux.ibm.com>
To: Shung-Hsi Yu <shung-hsi.yu@...e.com>, "Naveen N. Rao"
 <naveen@...nel.org>,
        bpf@...r.kernel.org
Cc: Michael Ellerman <mpe@...erman.id.au>,
        Mark Rutland
 <mark.rutland@....com>,
        Daniel Borkmann <daniel@...earbox.net>,
        Masahiro Yamada <masahiroy@...nel.org>,
        Nicholas Piggin <npiggin@...il.com>,
        Alexei Starovoitov <ast@...nel.org>,
        Steven Rostedt <rostedt@...dmis.org>,
        Masami Hiramatsu <mhiramat@...nel.org>,
        Andrii Nakryiko <andrii@...nel.org>,
        Christophe Leroy <christophe.leroy@...roup.eu>,
        Vishal Chourasia <vishalc@...ux.ibm.com>,
        Mahesh J Salgaonkar <mahesh@...ux.ibm.com>,
        Miroslav Benes <mbenes@...e.cz>,
        Michal Suchánek <msuchanek@...e.de>,
        linux-kernel@...r.kernel.org, linuxppc-dev@...ts.ozlabs.org,
        linux-trace-kernel@...r.kernel.org, live-patching@...r.kernel.org
Subject: Re: [BUG?] ppc64le: fentry BPF not triggered after live patch (v6.14)

Hi Shung-Hsi Yu

Thanks for reporting this.

On 31/03/25 6:49 pm, Shung-Hsi Yu wrote:
> Hi all,
> 
> On ppc64le (v6.14, kernel config attached), I've observed that fentry
> BPF programs stop being invoked after the target kernel function is live
> patched. This occurs regardless of whether the BPF program was attached
> before or after the live patch. I believe fentry/fprobe on ppc64le is
> added with [1].
> 
> Steps to reproduce on ppc64le:
> - Use bpftrace (v0.10.0+) to attach a BPF program to cmdline_proc_show
>    with fentry (kfunc is the older name bpftrace used for fentry, used
>    here for max compatability)
> 
>      bpftrace -e 'kfunc:cmdline_proc_show { printf("%lld: cmdline_proc_show() called by %s\n", nsecs(), comm) }'
> 
> - Run `cat /proc/cmdline` and observe bpftrace output
> 
> - Load samples/livepatch/livepatch-sample.ko
> 
> - Run `cat /proc/cmdline` again. Observe "this has been live patched" in
>    output, but no new bpftrace output.
> 
> Note: once the live patching module is disabled through the sysfs interface
> the BPF program invocation is restored.
> 
> Is this the expected interaction between fentry BPF and live patching?
> On x86_64 it does _not_ happen, so I'd guess the behavior on ppc64le is
> unintended. Any insights appreciated.

As Naveen updated in another thread already, this behavior is expected
as ppc64le does not handle it. Will take a stab at fixing it.

> 
> Thanks,
> Shung-Hsi Yu
> 
> 1: https://lore.kernel.org/all/20241030070850.1361304-2-hbathini@linux.ibm.com/

fwiw, the above patch was necessary for fentry, but the support was
complete with:

  
https://lore.kernel.org/all/20241018173632.277333-18-hbathini@linux.ibm.com/

Thanks
Hari