Thread (37 messages) 37 messages, 11 authors, 2022-06-15

Re: [PATCH] kprobes: Enable tracing for mololithic kernel images

From: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Date: 2022-06-12 12:31:09
Also in: linux-mips, linux-modules, linux-riscv, linux-s390, lkml, sparclinux

hiro Yamada [off-list ref], Jarkko Sakkinen [off-list ref], Sami Tolvanen [off-list ref], "Naveen N. Rao" [off-list ref], Marco Elver [off-list ref], Kees Cook [off-list ref], Steven Rostedt [off-list ref], Nathan Chancellor [off-list ref], "Russell King \(Oracle\)" [off-list ref], Mark Brown [off-list ref], Borislav Petkov [off-list ref], Alexander Egorenkov [off-list ref], Thomas Bogendoerfer [off-list ref], linux-parisc@vger.kernel.org, Nathaniel McCallum [off-list ref], Dmitry Torokhov [off-list ref], "David S. Miller" [off-list ref], "Kirill A. Shutemov" [off-list ref], Tobias Huschle [off-list ref], "Peter Zijlstra \(Intel\)" [off-list ref], "H. Peter Anvin" [off-list ref], sparclinux@vger.kernel.org, Tiezhu Yang [off-list ref], Miroslav Benes [off-list ref], Chen Zhongjin <chenzhongjin@huawei.co
 m>, Ard Biesheuvel [off-list ref], X86 ML [off-list ref], Russell King [off-list ref], linux-riscv@lists.infradead.org, Ingo Molnar [off-list ref], Aaron Tomlin [off-list ref], Albert Ou [off-list ref], Heiko Carstens [off-list ref], Liao Chang [off-list ref], Paul Walmsley [off-list ref], Josh Poimboeuf [off-list ref], Thomas Richter [off-list ref], linux-mips@vger.kernel.org, Changbin Du [off-list ref], Palmer Dabbelt [off-list ref], linuxppc-dev@lists.ozlabs.org, linux-modules@vger.kernel.org
Errors-To: linuxppc-dev-bounces+linuxppc-dev=archiver.kernel.org@lists.ozlabs.org
Sender: "Linuxppc-dev" [off-list ref]

On Wed, 8 Jun 2022 11:19:19 -0700
Song Liu [off-list ref] wrote:
On Wed, Jun 8, 2022 at 9:28 AM Ard Biesheuvel [off-list ref] wrote:
quoted
Hello Jarkko,

On Wed, 8 Jun 2022 at 02:02, Jarkko Sakkinen [off-list ref] wrote:
quoted
Tracing with kprobes while running a monolithic kernel is currently
impossible because CONFIG_KPROBES is dependent of CONFIG_MODULES.  This
dependency is a result of kprobes code using the module allocator for the
trampoline code.

Detaching kprobes from modules helps to squeeze down the user space,
e.g. when developing new core kernel features, while still having all
the nice tracing capabilities.

For kernel/ and arch/*, move module_alloc() and module_memfree() to
module_alloc.c, and compile as part of vmlinux when either CONFIG_MODULES
or CONFIG_KPROBES is enabled.  In addition, flag kernel module specific
code with CONFIG_MODULES.

As the result, kprobes can be used with a monolithic kernel.
I think I may have mentioned this the previous time as well, but I
don't think this is the right approach.

Kprobes uses alloc_insn_page() to allocate executable memory, but the
requirements for this memory are radically different compared to
loadable modules, which need to be within an arch-specific distance of
the core kernel, need KASAN backing etc etc.
I think the distance of core kernel requirement is the same for kprobe
alloc_insn_page and modules, no?
This strongly depends on how kprobes (software breakpoint and
single-step) is implemented on the arch. For example, x86 implements
the so-called "kprobe-booster" which jumps back from the single
stepping trampoline buffer. Then the buffer address must be within
the range where it can jump to the original address.
However, if the arch implements single-step as an instruction
emulation, it has no such limitation. As far as I know, arm64
will do emulation for the instructions which change PC register
and will do direct execution with another software breakpoint
for other instructions.

Why I'm using module_alloc() for a generic function, is that
can cover the limitation most widely.
Thus, if we have CONFIG_ARCH_HAVE_ALLOC_INSN_PAGE flag and
kprobes can check it instead of using __weak function, the
kprobes may not need to depend on module_alloc() in general.

Thank you,
Thanks,
Song
quoted
This is why arm64, for instance, does not implement alloc_insn_page()
in terms of module_alloc() [and likely does not belong in this patch
for that reason]

quoted
Is there any reason kprobes cannot simply use vmalloc()?

-- 
Masami Hiramatsu (Google) [off-list ref]
Keyboard shortcuts
hback out one level
jnext message in thread
kprevious message in thread
ldrill in
Escclose help / fold thread tree
?toggle this help