lkml.org 
[lkml]   [2022]   [Mar]   [25]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
Subject[PATCH bpf-next v2 0/4] kprobes: rethook: x86: Replace kretprobe trampoline with rethook
Date
Hi,

Here are the 2nd version for generic kretprobe and kretprobe on x86 for
replacing the kretprobe trampoline with rethook. The previous version
is here[1]

[1] https://lore.kernel.org/all/164818251899.2252200.7306353689206167903.stgit@devnote2/T/#u

In this version I added completing pt_regs by saving regs->ss register
for rethook (from Peter) and optprobe.

Background:

This rethook came from Jiri's request of multiple kprobe for bpf[1].
He tried to solve an issue that starting bpf with multiple kprobe will
take a long time because bpf-kprobe will wait for RCU grace period for
sync rcu events.

Jiri wanted to attach a single bpf handler to multiple kprobes and
he tried to introduce multiple-probe interface to kprobe. So I asked
him to use ftrace and kretprobe-like hook if it is only for the
function entry and exit, instead of adding ad-hoc interface
to kprobes.
For this purpose, I introduced the fprobe (kprobe like interface for
ftrace) with the rethook (this is a generic return hook feature for
fprobe exit handler)[2].

[1] https://lore.kernel.org/all/20220104080943.113249-1-jolsa@kernel.org/T/#u
[2] https://lore.kernel.org/all/164191321766.806991.7930388561276940676.stgit@devnote2/T/#u

The rethook is basically same as the kretprobe trampoline. I just made
it decoupled from kprobes. Eventually, the all arch dependent kretprobe
trampolines will be replaced with the rethook trampoline instead of
cloning and set HAVE_RETHOOK=y.
When I port the rethook for all arch which supports kretprobe, the
legacy kretprobe specific code (which is for CONFIG_KRETPROBE_ON_RETHOOK=n)
will be removed eventually.

Worktree notice:

BTW, this patch can be applied to next-20220324, not the bpf-next tree
directly, because this depends on ANNOTATE_NOENDBR macro. However, since
the fprobe is merged in the bpf-next, I marked this for bpf-next.
So until merging the both of fprobes and ENDBR series, to compile this
you need below 2 lines in arch/x86/kernel/rethook.c.

#ifndef ANNOTATE_NOENDBR
#define ANNOTATE_NOENDBR

But after those are merged, these lines will be unneeded. How should I
handle this issue? (Just remove ANNOTATE_NOENDBR line in bpf-next?)


Thank you,

---

Masami Hiramatsu (3):
kprobes: Use rethook for kretprobe if possible
rethook: kprobes: x86: Replace kretprobe with rethook on x86
x86,kprobes: Fix optprobe trampoline to generate complete pt_regs

Peter Zijlstra (1):
Subject: x86,rethook: Fix arch_rethook_trampoline() to generate a complete pt_regs


arch/Kconfig | 7 ++
arch/x86/Kconfig | 1
arch/x86/include/asm/unwind.h | 23 +++----
arch/x86/kernel/Makefile | 1
arch/x86/kernel/kprobes/common.h | 1
arch/x86/kernel/kprobes/core.c | 107 ---------------------------------
arch/x86/kernel/kprobes/opt.c | 25 +++++---
arch/x86/kernel/rethook.c | 123 ++++++++++++++++++++++++++++++++++++++
arch/x86/kernel/unwind_orc.c | 10 ++-
include/linux/kprobes.h | 51 +++++++++++++++-
kernel/kprobes.c | 124 ++++++++++++++++++++++++++++++++------
kernel/trace/trace_kprobe.c | 4 +
12 files changed, 319 insertions(+), 158 deletions(-)
create mode 100644 arch/x86/kernel/rethook.c

--
Masami Hiramatsu (Linaro) <mhiramat@kernel.org>

\
 
 \ /
  Last update: 2022-03-25 15:23    [W:0.329 / U:0.092 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site