netdev - Re: pull-request: bpf-next 2022-03-21

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <CAADnVQKXi_sO-3ouBM0DnGvtEp0SjdzctPRD-E_ODv=XxH+SFw@mail.gmail.com>
Date:   Mon, 21 Mar 2022 22:18:04 -0700
From:   Alexei Starovoitov <alexei.starovoitov@...il.com>
To:     Masami Hiramatsu <mhiramat@...nel.org>
Cc:     Linus Torvalds <torvalds@...ux-foundation.org>,
        David Miller <davem@...emloft.net>,
        Daniel Borkmann <daniel@...earbox.net>,
        Peter Zijlstra <peterz@...radead.org>,
        Steven Rostedt <rostedt@...dmis.org>,
        Jakub Kicinski <kuba@...nel.org>,
        Andrii Nakryiko <andrii@...nel.org>,
        Stephen Rothwell <sfr@...b.auug.org.au>,
        Netdev <netdev@...r.kernel.org>, bpf <bpf@...r.kernel.org>,
        Kernel Team <kernel-team@...com>
Subject: Re: pull-request: bpf-next 2022-03-21

On Mon, Mar 21, 2022 at 10:05 PM Masami Hiramatsu <mhiramat@...nel.org> wrote:
>
> On Mon, 21 Mar 2022 21:35:55 -0700
> Alexei Starovoitov <alexei.starovoitov@...il.com> wrote:
>
> > On Mon, Mar 21, 2022 at 7:36 PM Masami Hiramatsu <mhiramat@...nel.org> wrote:
> > >
> > > Hi Linus and Alexei,
> > >
> > > At first, sorry about this issue. I missed to Cc'ed to arch maintainers.
> > >
> > > On Mon, 21 Mar 2022 17:31:28 -0700
> > > Alexei Starovoitov <alexei.starovoitov@...il.com> wrote:
> > >
> > > > On Mon, Mar 21, 2022 at 4:59 PM Linus Torvalds
> > > > <torvalds@...ux-foundation.org> wrote:
> > > > >
> > > > > On Mon, Mar 21, 2022 at 4:11 PM Alexei Starovoitov
> > > > > <alexei.starovoitov@...il.com> wrote:
> > > > > >
> > > > > > Did you look at the code?
> > > > > > In particular:
> > > > > > https://lore.kernel.org/bpf/164735286243.1084943.7477055110527046644.stgit@devnote2/
> > > > > >
> > > > > > it's a copy paste of arch/x86/kernel/kprobes/core.c
> > > > > >
> > > > > > How is it "bad architecture code" ?
> > > > >
> > > > > It's "bad architecture code" because the architecture maintainers have
> > > > > made changes to check ENDBR in the meantime.
> > > > >
> > > > > So it used to be perfectly fine. It's not any longer - and the
> > > > > architecture maintainers were clearly never actually cc'd on the
> > > > > changes, so they didn't find out until much too late.
> > >
> > > Let me retry porting fprobe on top of ENDBR things and confirm with
> > > arch maintainers.
> >
> > Just look at linux-next.
> > objtool warning is the only issue.
>
> Actually, there are conflicts with arm tree and Rust tree too.
> I found I missed the objtool annotation patch on IBT series and fixed it.

4 arch patches were reverted.

> >
> > > >
> > > > Not denying that missing cc was an issue.
> > > >
> > > > We can drop just arch patches:
> > > >       rethook: x86: Add rethook x86 implementation
> > > >       arm64: rethook: Add arm64 rethook implementation
> > > >       powerpc: Add rethook support
> > > >       ARM: rethook: Add rethook arm implementation
> > > >
> > > > or everything including Jiri's work on top of it.
> > > > Which would be a massive 27 patches.
> > > >
> > > > We'd prefer the former, of course.
> > > > Later during the merge window we can add a single
> > > > 'rethook: x86' patch that takes endbr into account,
> > > > so that multi-kprobe feature will work on x86.
> > > > For the next merge window we can add other archs.
> > > > Would that work?
> > >
> > > BTW, As far as I can see the ENDBR things, the major issue on fprobe
> > > is that the ftrace'ed ip address will be different from the symbol
> > > address (even) on x86. That must be ensured to work before merge.
> > > Let me check it on Linus's tree at first.
> >
> > That's not an issue. Peter tweaked ftrace logic and fprobe plugs
> > into that.
> > The fprobe/multi-kprobe works fine in linux-next.
>
> Yeah, I think fprobe should work because it uses
> ftrace_location_range(func-entry, func-end) for non-x86 arch.
>
> >
> > bpf selftest for multi kprobe needs this hack:
> > diff --git a/tools/testing/selftests/bpf/progs/kprobe_multi.c
> > b/tools/testing/selftests/bpf/progs/kprobe_multi.c
> > index af27d2c6fce8..530a64e2996a 100644
> > --- a/tools/testing/selftests/bpf/progs/kprobe_multi.c
> > +++ b/tools/testing/selftests/bpf/progs/kprobe_multi.c
> > @@ -45,7 +45,7 @@ static void kprobe_multi_check(void *ctx, bool is_return)
> >         __u64 addr = bpf_get_func_ip(ctx);
> >
> >  #define SET(__var, __addr, __cookie) ({                        \
> > -       if (((const void *) addr == __addr) &&          \
> > +       if (((const void *) addr == __addr + 4) &&              \
> >              (!test_cookie || (cookie == __cookie)))    \
>
> Hmm, this is an ugly hack... You need to use actual ftrace addr, instead of
> symbol addr. With IBT series, you can use ftrace_location(symbol-addr) to
> get the ftrace-addr. (e.g. addr == ftrace_location(__addr) should work)

It's a temporary hack.
bpf prog cannot call an arbitrary function like ftrace_location.

> >
> > to pass when both CONFIG_FPROBE=y and CONFIG_X86_KERNEL_IBT=y.
> > The test is too strict. It didn't account for the possibility of endbr.
> >
> > So I'm inclined to drop only 4 arch patches instead of the whole thing.
>
> OK, but it is hard to understand how it works without knowing rethook itself.
> I would like to send whole v13 patch series to arch maintainers.

fprobe is a glorified kprobe and pretty simple code by itself.
It's too late for v13. Please send 'rethook: x86' patch only
with endbr annotations and get it acked.
The other archs will wait until the next merge window.