netdev - Re: [PATCH v2 bpf-next 0/8] Support BTF-powered BPF tracing programs for kernel modules

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <b29b91dd-a69c-30d3-59ca-4fa15b86492b@fb.com>
Date:   Mon, 30 Nov 2020 23:26:19 -0800
From:   Yonghong Song <yhs@...com>
To:     Andrii Nakryiko <andrii@...nel.org>, <bpf@...r.kernel.org>,
        <netdev@...r.kernel.org>, <ast@...com>, <daniel@...earbox.net>
CC:     <kernel-team@...com>
Subject: Re: [PATCH v2 bpf-next 0/8] Support BTF-powered BPF tracing programs
 for kernel modules



On 11/30/20 7:55 PM, Andrii Nakryiko wrote:
> Building on top of two previous patch sets ([0] and not yet landed [1]), this
> patch sets extends kernel and libbpf with support for attaching BTF-powered
> raw tracepoint (tp_btf) and tracing (fentry/fexit/fmod_ret/lsm) BPF programs
> to BPF hooks defined in kernel modules.
> 
> Kernel UAPI for BPF_PROG_LOAD is extended with extra parameter
> (attach_btf_obj_id) which allows to specify kernel module BTF in which the BTF
> type is identifed by attach_btf_id.
> 
>  From end user perspective there are no extra actions that need to happen.
> Libbpf will continue searching across all kernel module BTFs, if desired
> attach BTF type is not found in vmlinux. That way it doesn't matter if BPF
> hook that user is trying to attach to is built-in into vmlinux image or is
> loaded in kernel module.
> 
> Currently pahole doesn't generate BTF_KIND_FUNC info for ftrace-able static
> functions in kernel modules, so expose traced function in bpf_sidecar.ko. Once

bpf_sidecar.ko => bpf_testmod.ko

> pahole is enhanced, we can go back to static function.
> 
>    [0] https://patchwork.kernel.org/project/netdevbpf/list/?series=380759&state=*
>    [1] https://patchwork.kernel.org/project/netdevbpf/list/?series=393677&state=*
> 
> v1->v2:
>    - avoid increasing bpf_reg_state by reordering fields (Alexei);
>    - preserve btf_data_size in struct module;
>    - rebase on top of v3 of patch [1].
> 
> Andrii Nakryiko (8):
>    bpf: keep module's btf_data_size intact after load
>    bpf: remove hard-coded btf_vmlinux assumption from BPF verifier
>    bpf: allow to specify kernel module BTFs when attaching BPF programs
>    libbpf: factor out low-level BPF program loading helper
>    libbpf: support attachment of BPF tracing programs to kernel modules
>    selftests/bpf: add tp_btf CO-RE reloc test for modules
>    selftests/bpf: make bpf_testmod's traceable function global
>    selftests/bpf: add fentry/fexit/fmod_ret selftest for kernel module
> 
>   include/linux/bpf.h                           |  13 +-
>   include/linux/bpf_verifier.h                  |  28 +++-
>   include/linux/btf.h                           |   7 +-
>   include/uapi/linux/bpf.h                      |   1 +
>   kernel/bpf/btf.c                              |  90 +++++++----
>   kernel/bpf/syscall.c                          |  44 +++++-
>   kernel/bpf/verifier.c                         |  77 ++++++----
>   kernel/module.c                               |   1 -
>   net/ipv4/bpf_tcp_ca.c                         |   3 +-
>   tools/include/uapi/linux/bpf.h                |   1 +
>   tools/lib/bpf/bpf.c                           | 101 ++++++++----
>   tools/lib/bpf/libbpf.c                        | 145 +++++++++++++-----
>   tools/lib/bpf/libbpf_internal.h               |  30 ++++
>   .../selftests/bpf/bpf_testmod/bpf_testmod.c   |   3 +-
>   .../selftests/bpf/prog_tests/core_reloc.c     |   3 +-
>   .../selftests/bpf/prog_tests/module_attach.c  |  53 +++++++
>   .../bpf/progs/test_core_reloc_module.c        |  32 +++-
>   .../selftests/bpf/progs/test_module_attach.c  |  66 ++++++++
>   18 files changed, 546 insertions(+), 152 deletions(-)
>   create mode 100644 tools/testing/selftests/bpf/prog_tests/module_attach.c
>   create mode 100644 tools/testing/selftests/bpf/progs/test_module_attach.c
>