netdev - Re: [PATCH v2 bpf-next 0/8] Support BTF-powered BPF tracing programs for kernel modules

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CAEf4BzYdHuB=utnxH0kWMorHwfRxakdwA27hqq90bDAbwS7+ew@mail.gmail.com>
Date:   Tue, 1 Dec 2020 13:50:11 -0800
From:   Andrii Nakryiko <andrii.nakryiko@...il.com>
To:     Yonghong Song <yhs@...com>
Cc:     Andrii Nakryiko <andrii@...nel.org>, bpf <bpf@...r.kernel.org>,
        Networking <netdev@...r.kernel.org>,
        Alexei Starovoitov <ast@...com>,
        Daniel Borkmann <daniel@...earbox.net>,
        Kernel Team <kernel-team@...com>
Subject: Re: [PATCH v2 bpf-next 0/8] Support BTF-powered BPF tracing programs
 for kernel modules

On Mon, Nov 30, 2020 at 11:26 PM Yonghong Song <yhs@...com> wrote:
>
>
>
> On 11/30/20 7:55 PM, Andrii Nakryiko wrote:
> > Building on top of two previous patch sets ([0] and not yet landed [1]), this
> > patch sets extends kernel and libbpf with support for attaching BTF-powered
> > raw tracepoint (tp_btf) and tracing (fentry/fexit/fmod_ret/lsm) BPF programs
> > to BPF hooks defined in kernel modules.
> >
> > Kernel UAPI for BPF_PROG_LOAD is extended with extra parameter
> > (attach_btf_obj_id) which allows to specify kernel module BTF in which the BTF
> > type is identifed by attach_btf_id.
> >
> >  From end user perspective there are no extra actions that need to happen.
> > Libbpf will continue searching across all kernel module BTFs, if desired
> > attach BTF type is not found in vmlinux. That way it doesn't matter if BPF
> > hook that user is trying to attach to is built-in into vmlinux image or is
> > loaded in kernel module.
> >
> > Currently pahole doesn't generate BTF_KIND_FUNC info for ftrace-able static
> > functions in kernel modules, so expose traced function in bpf_sidecar.ko. Once
>
> bpf_sidecar.ko => bpf_testmod.ko
>

will fix, thanks!

> > pahole is enhanced, we can go back to static function.
> >
> >    [0] https://patchwork.kernel.org/project/netdevbpf/list/?series=380759&state=*
> >    [1] https://patchwork.kernel.org/project/netdevbpf/list/?series=393677&state=*
> >
> > v1->v2:
> >    - avoid increasing bpf_reg_state by reordering fields (Alexei);
> >    - preserve btf_data_size in struct module;
> >    - rebase on top of v3 of patch [1].
> >
> > Andrii Nakryiko (8):
> >    bpf: keep module's btf_data_size intact after load
> >    bpf: remove hard-coded btf_vmlinux assumption from BPF verifier
> >    bpf: allow to specify kernel module BTFs when attaching BPF programs
> >    libbpf: factor out low-level BPF program loading helper
> >    libbpf: support attachment of BPF tracing programs to kernel modules
> >    selftests/bpf: add tp_btf CO-RE reloc test for modules
> >    selftests/bpf: make bpf_testmod's traceable function global
> >    selftests/bpf: add fentry/fexit/fmod_ret selftest for kernel module
> >
> >   include/linux/bpf.h                           |  13 +-
> >   include/linux/bpf_verifier.h                  |  28 +++-
> >   include/linux/btf.h                           |   7 +-
> >   include/uapi/linux/bpf.h                      |   1 +
> >   kernel/bpf/btf.c                              |  90 +++++++----
> >   kernel/bpf/syscall.c                          |  44 +++++-
> >   kernel/bpf/verifier.c                         |  77 ++++++----
> >   kernel/module.c                               |   1 -
> >   net/ipv4/bpf_tcp_ca.c                         |   3 +-
> >   tools/include/uapi/linux/bpf.h                |   1 +
> >   tools/lib/bpf/bpf.c                           | 101 ++++++++----
> >   tools/lib/bpf/libbpf.c                        | 145 +++++++++++++-----
> >   tools/lib/bpf/libbpf_internal.h               |  30 ++++
> >   .../selftests/bpf/bpf_testmod/bpf_testmod.c   |   3 +-
> >   .../selftests/bpf/prog_tests/core_reloc.c     |   3 +-
> >   .../selftests/bpf/prog_tests/module_attach.c  |  53 +++++++
> >   .../bpf/progs/test_core_reloc_module.c        |  32 +++-
> >   .../selftests/bpf/progs/test_module_attach.c  |  66 ++++++++
> >   18 files changed, 546 insertions(+), 152 deletions(-)
> >   create mode 100644 tools/testing/selftests/bpf/prog_tests/module_attach.c
> >   create mode 100644 tools/testing/selftests/bpf/progs/test_module_attach.c
> >