Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
From:   Martin Lau <kafai@fb.com>
To:     Matt Mullins <mmullins@fb.com>
CC:     "ast@kernel.org" <ast@kernel.org>,
        "daniel@iogearbox.net" <daniel@iogearbox.net>,
        "netdev@vger.kernel.org" <netdev@vger.kernel.org>,
        Kernel Team <Kernel-team@fb.com>, Jessica Yu <jeyu@kernel.org>,
        "Steven Rostedt" <rostedt@goodmis.org>,
        Ingo Molnar <mingo@redhat.com>,
        "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>
Subject: Re: [PATCH bpf-next] bpf: support raw tracepoints in modules
Thread-Topic: [PATCH bpf-next] bpf: support raw tracepoints in modules
Thread-Index: AQHUeHi0sGCTL06GVk6d1TS/CZtC0qVMlTiA
Date:   Mon, 12 Nov 2018 20:05:41 +0000
Message-ID: <20181112200539.fclawehoyphxy5na@kafai-mbp.dhcp.thefacebook.com>
References: <20181109220632.3944136-1-mmullins@fb.com>
In-Reply-To: <20181109220632.3944136-1-mmullins@fb.com>
Accept-Language: en-US
Content-Language: en-US
x-ms-exchange-messagesentrepresentingtype: 1
x-originating-ip: [2620:10d:c090:180::1:3bcf]
x-ms-publictraffictype: Email
x-microsoft-exchange-diagnostics: 1;MWHPR15MB1566;20:wDbZA90ShftjkMFSwvPXt6brW/7kAvDUMujZnByG1xjUgn0IjpPmX2nx+Z/yvTTkwDX5lB2nk/kEZwhLuxYzpd7yRaZyDntMGlriCzjMHhslC+AwYtGHKNBOAarBAlLWtHH8pgCZQraqZ8/iW0TMHdBvOZkNM8gXrUdFqb8jmNQ=
x-ms-office365-filtering-correlation-id: 7e106666-764a-44ed-30e0-08d648da38a5
x-microsoft-antispam: BCL:0;PCL:0;RULEID:(2390040)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600074)(711020)(2017052603328)(7153060)(7193020);SRVR:MWHPR15MB1566;
x-ms-traffictypediagnostic: MWHPR15MB1566:
x-microsoft-antispam-prvs: <MWHPR15MB15666D711883F9439F7125DAD5C10@MWHPR15MB1566.namprd15.prod.outlook.com>
x-exchange-antispam-report-test: UriScan:(67672495146484);
x-ms-exchange-senderadcheck: 1
x-exchange-antispam-report-cfa-test: BCL:0;PCL:0;RULEID:(8211001083)(6040522)(2401047)(8121501046)(5005006)(823302103)(3231382)(11241501184)(944501410)(52105112)(3002001)(10201501046)(93006095)(93001095)(148016)(149066)(150057)(6041310)(20161123562045)(20161123558120)(201703131423095)(201702281528075)(20161123555045)(201703061421075)(201703061406153)(20161123560045)(20161123564045)(201708071742011)(7699051)(76991095);SRVR:MWHPR15MB1566;BCL:0;PCL:0;RULEID:;SRVR:MWHPR15MB1566;
x-forefront-prvs: 0854128AF0
x-forefront-antispam-report: SFV:NSPM;SFS:(10019020)(39860400002)(136003)(396003)(346002)(376002)(366004)(189003)(199004)(2900100001)(6636002)(46003)(478600001)(6486002)(6436002)(53936002)(5024004)(7736002)(229853002)(6512007)(14454004)(14444005)(9686003)(305945005)(6246003)(86362001)(256004)(6862004)(446003)(71200400001)(386003)(5660300001)(71190400001)(33896004)(106356001)(76176011)(6506007)(54906003)(316002)(1076002)(2906002)(6116002)(4326008)(486006)(105586002)(8676002)(68736007)(102836004)(97736004)(186003)(8936002)(11346002)(99286004)(81166006)(81156014)(476003)(25786009)(52116002);DIR:OUT;SFP:1102;SCL:1;SRVR:MWHPR15MB1566;H:MWHPR15MB1790.namprd15.prod.outlook.com;FPR:;SPF:None;LANG:en;PTR:InfoNoRecords;MX:1;A:1;
received-spf: None (protection.outlook.com: fb.com does not designate
 permitted sender hosts)
x-microsoft-antispam-message-info: fXjHDztkRhhtgnHbpDZNMerVi5hb49G6MzNYWV4pogmlTAneoyQoBkeG4FOpaY3fG8TbFfXSSiL5jvqcpQeG6p2g2WiNGw7oH56osvoHcsmNQDMPKJeWsSyygV02aUoPDO5tBOct0bqh6w5crVD6/PhQnq0wT1NWonNfNKkXmuul6/51duxotd5jIg6bB938DFrqmk7L1UJXtdQ5uzrACWZM+k29FSt1oS4cdcXSfedGTf7BDB/neKyZqhxfFqc/ckFz05OXJY73+UaAJZjOp/FW6Rth3BpiNTUDEGx+RSnkgtfvU8RVewGqxZmKlTGpE/wWMi3bEQIvAHhV/lrecMV4iXM0NmOWlo02oTfj3QE=
spamdiagnosticoutput: 1:99
spamdiagnosticmetadata: NSPM
Content-Type: text/plain; charset="us-ascii"
Content-ID: <F086A4D3568C7B4F9C06097FAE9F97EB@namprd15.prod.outlook.com>
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-MS-Exchange-CrossTenant-Network-Message-Id: 7e106666-764a-44ed-30e0-08d648da38a5
X-MS-Exchange-CrossTenant-originalarrivaltime: 12 Nov 2018 20:05:42.0773
 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 8ae927fe-1255-47a7-a2af-5f3a069daaa2
X-MS-Exchange-Transport-CrossTenantHeadersStamped: MWHPR15MB1566
X-OriginatorOrg: fb.com
X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:,, definitions=2018-11-12_13:,,
 signatures=0
X-Proofpoint-Spam-Reason: safe
X-FB-Internal: Safe
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

On Fri, Nov 09, 2018 at 02:06:32PM -0800, Matt Mullins wrote:
> Distributions build drivers as modules, including network and filesystem
> drivers which export numerous tracepoints.  This enables
> bpf(BPF_RAW_TRACEPOINT_OPEN) to attach to those tracepoints.
>=20
> Signed-off-by: Matt Mullins <mmullins@fb.com>
> ---
> My apologies if this got duplicated to some of the recipients; I think I =
have
> SMTP working now.
>=20
>  include/linux/module.h       |  4 ++
>  include/linux/trace_events.h |  8 ++-
>  kernel/bpf/syscall.c         | 11 +++--
>  kernel/module.c              |  5 ++
>  kernel/trace/bpf_trace.c     | 96 +++++++++++++++++++++++++++++++++++-
>  5 files changed, 117 insertions(+), 7 deletions(-)
>=20
> diff --git a/include/linux/module.h b/include/linux/module.h
> index fce6b4335e36..5f147dd5e709 100644
> --- a/include/linux/module.h
> +++ b/include/linux/module.h
> @@ -432,6 +432,10 @@ struct module {
>  	unsigned int num_tracepoints;
>  	tracepoint_ptr_t *tracepoints_ptrs;
>  #endif
> +#ifdef CONFIG_BPF_EVENTS
> +	unsigned int num_bpf_raw_events;
> +	struct bpf_raw_event_map *bpf_raw_events;
> +#endif
>  #ifdef HAVE_JUMP_LABEL
>  	struct jump_entry *jump_entries;
>  	unsigned int num_jump_entries;
> diff --git a/include/linux/trace_events.h b/include/linux/trace_events.h
> index 4130a5497d40..8a62731673f7 100644
> --- a/include/linux/trace_events.h
> +++ b/include/linux/trace_events.h
> @@ -471,7 +471,8 @@ void perf_event_detach_bpf_prog(struct perf_event *ev=
ent);
>  int perf_event_query_prog_array(struct perf_event *event, void __user *i=
nfo);
>  int bpf_probe_register(struct bpf_raw_event_map *btp, struct bpf_prog *p=
rog);
>  int bpf_probe_unregister(struct bpf_raw_event_map *btp, struct bpf_prog =
*prog);
> -struct bpf_raw_event_map *bpf_find_raw_tracepoint(const char *name);
> +struct bpf_raw_event_map *bpf_get_raw_tracepoint(const char *name);
> +void bpf_put_raw_tracepoint(struct bpf_raw_event_map *btp);
>  int bpf_get_perf_event_info(const struct perf_event *event, u32 *prog_id=
,
>  			    u32 *fd_type, const char **buf,
>  			    u64 *probe_offset, u64 *probe_addr);
> @@ -502,10 +503,13 @@ static inline int bpf_probe_unregister(struct bpf_r=
aw_event_map *btp, struct bpf
>  {
>  	return -EOPNOTSUPP;
>  }
> -static inline struct bpf_raw_event_map *bpf_find_raw_tracepoint(const ch=
ar *name)
> +static inline struct bpf_raw_event_map *bpf_get_raw_tracepoint(const cha=
r *name)
>  {
>  	return NULL;
>  }
> +static inline void bpf_put_raw_tracepoint(struct bpf_raw_event_map *btp)
> +{
> +}
>  static inline int bpf_get_perf_event_info(const struct perf_event *event=
,
>  					  u32 *prog_id, u32 *fd_type,
>  					  const char **buf, u64 *probe_offset,
> diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
> index cf5040fd5434..c447aa1ce770 100644
> --- a/kernel/bpf/syscall.c
> +++ b/kernel/bpf/syscall.c
> @@ -1597,6 +1597,7 @@ static int bpf_raw_tracepoint_release(struct inode =
*inode, struct file *filp)
>  		bpf_probe_unregister(raw_tp->btp, raw_tp->prog);
>  		bpf_prog_put(raw_tp->prog);
>  	}
> +	bpf_put_raw_tracepoint(raw_tp->btp);
>  	kfree(raw_tp);
>  	return 0;
>  }
> @@ -1622,13 +1623,15 @@ static int bpf_raw_tracepoint_open(const union bp=
f_attr *attr)
>  		return -EFAULT;
>  	tp_name[sizeof(tp_name) - 1] =3D 0;
> =20
> -	btp =3D bpf_find_raw_tracepoint(tp_name);
> +	btp =3D bpf_get_raw_tracepoint(tp_name);
>  	if (!btp)
>  		return -ENOENT;
> =20
>  	raw_tp =3D kzalloc(sizeof(*raw_tp), GFP_USER);
> -	if (!raw_tp)
> -		return -ENOMEM;
> +	if (!raw_tp) {
> +		err =3D -ENOMEM;
> +		goto out_put_btp;
> +	}
>  	raw_tp->btp =3D btp;
> =20
>  	prog =3D bpf_prog_get_type(attr->raw_tracepoint.prog_fd,
> @@ -1656,6 +1659,8 @@ static int bpf_raw_tracepoint_open(const union bpf_=
attr *attr)
>  	bpf_prog_put(prog);
>  out_free_tp:
>  	kfree(raw_tp);
> +out_put_btp:
> +	bpf_put_raw_tracepoint(btp);
>  	return err;
>  }
> =20
> diff --git a/kernel/module.c b/kernel/module.c
> index 49a405891587..06ec68f08387 100644
> --- a/kernel/module.c
> +++ b/kernel/module.c
> @@ -3093,6 +3093,11 @@ static int find_module_sections(struct module *mod=
, struct load_info *info)
>  					     sizeof(*mod->tracepoints_ptrs),
>  					     &mod->num_tracepoints);
>  #endif
> +#ifdef CONFIG_BPF_EVENTS
> +	mod->bpf_raw_events =3D section_objs(info, "__bpf_raw_tp_map",
> +					   sizeof(*mod->bpf_raw_events),
> +					   &mod->num_bpf_raw_events);
> +#endif
>  #ifdef HAVE_JUMP_LABEL
>  	mod->jump_entries =3D section_objs(info, "__jump_table",
>  					sizeof(*mod->jump_entries),
> diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c
> index 08fcfe440c63..a12d28c123eb 100644
> --- a/kernel/trace/bpf_trace.c
> +++ b/kernel/trace/bpf_trace.c
> @@ -17,6 +17,43 @@
>  #include "trace_probe.h"
>  #include "trace.h"
> =20
> +#ifdef CONFIG_MODULES
> +struct bpf_trace_module {
> +	struct module *module;
> +	struct list_head list;
> +};
> +
> +static LIST_HEAD(bpf_trace_modules);
> +static DEFINE_MUTEX(bpf_module_mutex);
> +
> +static struct bpf_raw_event_map *bpf_get_raw_tracepoint_module(const cha=
r *name)
> +{
> +	struct bpf_raw_event_map *btp, *ret =3D NULL;
> +	struct bpf_trace_module *btm;
> +	unsigned int i;
> +
Nit. May be check for list_empty() first before taking mutex?

> +	mutex_lock(&bpf_module_mutex);
> +	list_for_each_entry(btm, &bpf_trace_modules, list) {
> +		for (i =3D 0; i < btm->module->num_bpf_raw_events; ++i) {
> +			btp =3D &btm->module->bpf_raw_events[i];
> +			if (!strcmp(btp->tp->name, name)) {
> +				if (try_module_get(btm->module))
> +					ret =3D btp;
> +				goto out;
> +			}
> +		}
> +	}
> +out:
> +	mutex_unlock(&bpf_module_mutex);
> +	return ret;
> +}
> +#else
> +static struct bpf_raw_event_map *bpf_get_raw_tracepoint_module(const cha=
r *name)
> +{
> +	return NULL;
> +}
> +#endif /* CONFIG_MODULES */
> +
>  u64 bpf_get_stackid(u64 r1, u64 r2, u64 r3, u64 r4, u64 r5);
>  u64 bpf_get_stack(u64 r1, u64 r2, u64 r3, u64 r4, u64 r5);
> =20
> @@ -1074,7 +1111,7 @@ int perf_event_query_prog_array(struct perf_event *=
event, void __user *info)
>  extern struct bpf_raw_event_map __start__bpf_raw_tp[];
>  extern struct bpf_raw_event_map __stop__bpf_raw_tp[];
> =20
> -struct bpf_raw_event_map *bpf_find_raw_tracepoint(const char *name)
> +struct bpf_raw_event_map *bpf_get_raw_tracepoint(const char *name)
>  {
>  	struct bpf_raw_event_map *btp =3D __start__bpf_raw_tp;
> =20
> @@ -1082,7 +1119,16 @@ struct bpf_raw_event_map *bpf_find_raw_tracepoint(=
const char *name)
>  		if (!strcmp(btp->tp->name, name))
>  			return btp;
>  	}
> -	return NULL;
> +
> +	return bpf_get_raw_tracepoint_module(name);
> +}
> +
> +void bpf_put_raw_tracepoint(struct bpf_raw_event_map *btp)
> +{
> +	struct module *mod =3D __module_address((unsigned long)btp);
> +
> +	if (mod)
> +		module_put(mod);
>  }
> =20
>  static __always_inline
> @@ -1220,3 +1266,49 @@ int bpf_get_perf_event_info(const struct perf_even=
t *event, u32 *prog_id,
> =20
>  	return err;
>  }
> +
> +#ifdef CONFIG_MODULES
> +int bpf_event_notify(struct notifier_block *nb, unsigned long op, void *=
module)
> +{
> +	struct bpf_trace_module *btm, *tmp;
> +	struct module *mod =3D module;
> +
> +	if (mod->num_bpf_raw_events =3D=3D 0)
Also check for MODULE_STATE_GOING and MODULE_STATE_COMING
before taking the mutex.

> +		return 0;
> +
> +	mutex_lock(&bpf_module_mutex);
> +
> +	switch (op) {
> +	case MODULE_STATE_COMING:
> +		btm =3D kzalloc(sizeof(*btm), GFP_KERNEL);
Check for !btm.

> +		btm->module =3D module;
> +		list_add(&btm->list, &bpf_trace_modules);
> +		break;
> +	case MODULE_STATE_GOING:
> +		list_for_each_entry_safe(btm, tmp, &bpf_trace_modules, list) {
Is the "_safe" version needed?

> +			if (btm->module =3D=3D module) {
> +				list_del(&btm->list);
> +				kfree(btm);
> +				break;
> +			}
> +		}
> +		break;
> +	}
> +
> +	mutex_unlock(&bpf_module_mutex);
> +
> +	return 0;
> +}
> +
> +static struct notifier_block bpf_module_nb =3D {
> +	.notifier_call =3D bpf_event_notify,
> +};
> +
> +int __init bpf_event_init(void)
> +{
> +	register_module_notifier(&bpf_module_nb);
> +	return 0;
> +}
> +
> +fs_initcall(bpf_event_init);
> +#endif /* CONFIG_MODULES */
> --=20
> 2.17.1
>=20