netdev - Re: [PATCH 11/19] bpf: Add support to load multi func tracing program

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <72b9258d-9a1f-2dab-ec59-f8a8a60d7653@fb.com>
Date:   Mon, 7 Jun 2021 12:35:10 -0700
From:   Yonghong Song <yhs@...com>
To:     Jiri Olsa <jolsa@...hat.com>
CC:     Jiri Olsa <jolsa@...nel.org>, Alexei Starovoitov <ast@...nel.org>,
        Daniel Borkmann <daniel@...earbox.net>,
        Andrii Nakryiko <andriin@...com>,
        "Steven Rostedt (VMware)" <rostedt@...dmis.org>,
        <netdev@...r.kernel.org>, <bpf@...r.kernel.org>,
        Martin KaFai Lau <kafai@...com>,
        Song Liu <songliubraving@...com>,
        John Fastabend <john.fastabend@...il.com>,
        KP Singh <kpsingh@...omium.org>, Daniel Xu <dxu@...uu.xyz>,
        Viktor Malik <vmalik@...hat.com>
Subject: Re: [PATCH 11/19] bpf: Add support to load multi func tracing program



On 6/7/21 11:18 AM, Jiri Olsa wrote:
> On Sun, Jun 06, 2021 at 08:56:47PM -0700, Yonghong Song wrote:
>>
>>
>> On 6/5/21 4:10 AM, Jiri Olsa wrote:
>>> Adding support to load tracing program with new BPF_F_MULTI_FUNC flag,
>>> that allows the program to be loaded without specific function to be
>>> attached to.
>>>
>>> The verifier assumes the program is using all (6) available arguments
>>
>> Is this a verifier failure or it is due to the check in the
>> beginning of function arch_prepare_bpf_trampoline()?
>>
>>          /* x86-64 supports up to 6 arguments. 7+ can be added in the future
>> */
>>          if (nr_args > 6)
>>                  return -ENOTSUPP;
> 
> yes, that's the limit.. it allows the traced program to
> touch 6 arguments, because it's the maximum for JIT
> 
>>
>> If it is indeed due to arch_prepare_bpf_trampoline() maybe we
>> can improve it instead of specially processing the first argument
>> "ip" in quite some places?
> 
> do you mean to teach JIT to process more than 6 arguments?

Yes. Not sure how hard it is. If it is doable with reasonable 
complexity, I think it will be worth it as it will benefit this
case to avoid special tweaks of the first argument, but also
benefit other cases e.g., attaching to a kernel function with
7 or more arguments.

> 
>>
>>> as unsigned long values. We can't add extra ip argument at this time,
>>> because JIT on x86 would fail to process this function. Instead we
>>> allow to access extra first 'ip' argument in btf_ctx_access.
>>>
>>> Such program will be allowed to be attached to multiple functions
>>> in following patches.
>>>
>>> Signed-off-by: Jiri Olsa <jolsa@...nel.org>
>>> ---
>>>    include/linux/bpf.h            |  1 +
>>>    include/uapi/linux/bpf.h       |  7 +++++++
>>>    kernel/bpf/btf.c               |  5 +++++
>>>    kernel/bpf/syscall.c           | 35 +++++++++++++++++++++++++++++-----
>>>    kernel/bpf/verifier.c          |  3 ++-
>>>    tools/include/uapi/linux/bpf.h |  7 +++++++
>>>    6 files changed, 52 insertions(+), 6 deletions(-)
>>>
[...]