netdev - Re: fentry/fexit attach to EXT type XDP program does not work

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 09 Jun 2020 10:52:34 +0200
From:   "Eelco Chaudron" <echaudro@...hat.com>
To:     "Yonghong Song" <yhs@...com>
Cc:     bpf@...r.kernel.org, netdev@...r.kernel.org, ast@...nel.org,
        daniel@...earbox.net, kafai@...com, songliubraving@...com,
        andriin@...com, toke@...hat.com
Subject: Re: fentry/fexit attach to EXT type XDP program does not work



On 8 Jun 2020, at 18:58, Yonghong Song wrote:

> On 6/8/20 7:11 AM, Eelco Chaudron wrote:
>> I'm trying for a while to do a fentry/fexit trace an EXT program
>> attached to an XDP program. To make it easier to explain I've
>> created a test case (see patch below) to show the issue.
>>
>> Without the changes to test_xdp_bpf2bpf.c I'll get the following 
>> error:
>>
>>    libbpf: -- BEGIN DUMP LOG ---
>>    libbpf:
>>    arg#0 type is not a struct
>>    Unrecognized arg#0 type PTR
>>    ; int BPF_PROG(trace_on_entry, struct xdp_buff *xdp)
>>    0: (79) r6 = *(u64 *)(r1 +0)
>>    invalid bpf_context access off=0 size=8
>>    processed 1 insns (limit 1000000) max_states_per_insn 0 
>> total_states 0 peak_states 0 mark_read 0
>>
>>    libbpf: -- END LOG --
>>    libbpf: failed to load program 'fentry/FUNC'
>>    libbpf: failed to load object 'test_xdp_bpf2bpf'
>>    libbpf: failed to load BPF skeleton 'test_xdp_bpf2bpf': -4007
>>    test_xdp_fentry_ext:FAIL:__load ftrace skeleton failed
>>    #91 xdp_fentry_ext:FAIL
>>    Summary: 0/0 PASSED, 0 SKIPPED, 1 FAILED
>>
>> With the change I get the following (but I do feel this change
>> should not be needed):
>>
>>    libbpf: -- BEGIN DUMP LOG ---
>>    libbpf:
>>    Unrecognized arg#0 type PTR
>>    ; int trace_on_entry(struct xdp_buff *xdp)
>>    0: (bf) r6 = r1
>>    ; void *data = (void *)(long)xdp->data;
>>    1: (79) r1 = *(u64 *)(r6 +0)
>>    invalid bpf_context access off=0 size=8
>>    processed 2 insns (limit 1000000) max_states_per_insn 0 
>> total_states 0 peak_states 0 mark_read 0
>>
>>    libbpf: -- END LOG --
>>    libbpf: failed to load program 'fentry/FUNC'
>>    libbpf: failed to load object 'test_xdp_bpf2bpf'
>>    libbpf: failed to load BPF skeleton 'test_xdp_bpf2bpf': -4007
>>    test_xdp_fentry_ext:FAIL:__load ftrace skeleton failed
>>    #91 xdp_fentry_ext:FAIL
>>    Summary: 0/0 PASSED, 0 SKIPPED, 1 FAILED
>>
>> Any idea what could be the case here? The same fentry/fexit attach
>> code works fine in the xdp_bpf2bpf.c tests case.

<SNIP>
>
> I think this is not supported now. That is, you cannot attach a fentry 
> trace
> to the EXT program. The current implementation for fentry program 
> simply
> trying to find and match the signature of freplace program which by 
> default
> is a pointer to void.
>
> It is doable in that in kernel we could recognize to-be-attached 
> program is
> a freplace and further trace down to find the real signature. The 
> related
> kernel function is btf_get_prog_ctx_type(). You can try to implement 
> by yourself
> or I can have a patch for this once bpf-next opens.

I’m not familiar with this area of the code, so if you could prepare a 
patch that would nice.
You can also send it to me before bpf-next opens and I can verify it, 
and clean up the self-test so it can be included as well.