netdev - Re: pull-request: bpf-next 2022-03-21

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20220322140537.d3f3fa3600d3b80c4f226e7c@kernel.org>
Date:   Tue, 22 Mar 2022 14:05:37 +0900
From:   Masami Hiramatsu <mhiramat@...nel.org>
To:     Alexei Starovoitov <alexei.starovoitov@...il.com>
Cc:     Linus Torvalds <torvalds@...ux-foundation.org>,
        David Miller <davem@...emloft.net>,
        Daniel Borkmann <daniel@...earbox.net>,
        Peter Zijlstra <peterz@...radead.org>,
        Steven Rostedt <rostedt@...dmis.org>,
        Jakub Kicinski <kuba@...nel.org>,
        Andrii Nakryiko <andrii@...nel.org>,
        Stephen Rothwell <sfr@...b.auug.org.au>,
        Netdev <netdev@...r.kernel.org>, bpf <bpf@...r.kernel.org>,
        Kernel Team <kernel-team@...com>
Subject: Re: pull-request: bpf-next 2022-03-21

On Mon, 21 Mar 2022 21:35:55 -0700
Alexei Starovoitov <alexei.starovoitov@...il.com> wrote:

> On Mon, Mar 21, 2022 at 7:36 PM Masami Hiramatsu <mhiramat@...nel.org> wrote:
> >
> > Hi Linus and Alexei,
> >
> > At first, sorry about this issue. I missed to Cc'ed to arch maintainers.
> >
> > On Mon, 21 Mar 2022 17:31:28 -0700
> > Alexei Starovoitov <alexei.starovoitov@...il.com> wrote:
> >
> > > On Mon, Mar 21, 2022 at 4:59 PM Linus Torvalds
> > > <torvalds@...ux-foundation.org> wrote:
> > > >
> > > > On Mon, Mar 21, 2022 at 4:11 PM Alexei Starovoitov
> > > > <alexei.starovoitov@...il.com> wrote:
> > > > >
> > > > > Did you look at the code?
> > > > > In particular:
> > > > > https://lore.kernel.org/bpf/164735286243.1084943.7477055110527046644.stgit@devnote2/
> > > > >
> > > > > it's a copy paste of arch/x86/kernel/kprobes/core.c
> > > > >
> > > > > How is it "bad architecture code" ?
> > > >
> > > > It's "bad architecture code" because the architecture maintainers have
> > > > made changes to check ENDBR in the meantime.
> > > >
> > > > So it used to be perfectly fine. It's not any longer - and the
> > > > architecture maintainers were clearly never actually cc'd on the
> > > > changes, so they didn't find out until much too late.
> >
> > Let me retry porting fprobe on top of ENDBR things and confirm with
> > arch maintainers.
> 
> Just look at linux-next.
> objtool warning is the only issue.

Actually, there are conflicts with arm tree and Rust tree too.
I found I missed the objtool annotation patch on IBT series and fixed it.

> 
> > >
> > > Not denying that missing cc was an issue.
> > >
> > > We can drop just arch patches:
> > >       rethook: x86: Add rethook x86 implementation
> > >       arm64: rethook: Add arm64 rethook implementation
> > >       powerpc: Add rethook support
> > >       ARM: rethook: Add rethook arm implementation
> > >
> > > or everything including Jiri's work on top of it.
> > > Which would be a massive 27 patches.
> > >
> > > We'd prefer the former, of course.
> > > Later during the merge window we can add a single
> > > 'rethook: x86' patch that takes endbr into account,
> > > so that multi-kprobe feature will work on x86.
> > > For the next merge window we can add other archs.
> > > Would that work?
> >
> > BTW, As far as I can see the ENDBR things, the major issue on fprobe
> > is that the ftrace'ed ip address will be different from the symbol
> > address (even) on x86. That must be ensured to work before merge.
> > Let me check it on Linus's tree at first.
> 
> That's not an issue. Peter tweaked ftrace logic and fprobe plugs
> into that.
> The fprobe/multi-kprobe works fine in linux-next.

Yeah, I think fprobe should work because it uses 
ftrace_location_range(func-entry, func-end) for non-x86 arch.

> 
> bpf selftest for multi kprobe needs this hack:
> diff --git a/tools/testing/selftests/bpf/progs/kprobe_multi.c
> b/tools/testing/selftests/bpf/progs/kprobe_multi.c
> index af27d2c6fce8..530a64e2996a 100644
> --- a/tools/testing/selftests/bpf/progs/kprobe_multi.c
> +++ b/tools/testing/selftests/bpf/progs/kprobe_multi.c
> @@ -45,7 +45,7 @@ static void kprobe_multi_check(void *ctx, bool is_return)
>         __u64 addr = bpf_get_func_ip(ctx);
> 
>  #define SET(__var, __addr, __cookie) ({                        \
> -       if (((const void *) addr == __addr) &&          \
> +       if (((const void *) addr == __addr + 4) &&              \
>              (!test_cookie || (cookie == __cookie)))    \

Hmm, this is an ugly hack... You need to use actual ftrace addr, instead of
symbol addr. With IBT series, you can use ftrace_location(symbol-addr) to
get the ftrace-addr. (e.g. addr == ftrace_location(__addr) should work)

> 
> to pass when both CONFIG_FPROBE=y and CONFIG_X86_KERNEL_IBT=y.
> The test is too strict. It didn't account for the possibility of endbr.
> 
> So I'm inclined to drop only 4 arch patches instead of the whole thing.

OK, but it is hard to understand how it works without knowing rethook itself.
I would like to send whole v13 patch series to arch maintainers.

Thank you,

-- 
Masami Hiramatsu <mhiramat@...nel.org>