Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
MIME-Version: 1.0
References: <168198993129.1795549.8306571027057356176.stgit@mhiramat.roam.corp.google.com>
 <168198995084.1795549.16754963116067902376.stgit@mhiramat.roam.corp.google.com>
 <20230420184932.pgv5wiqqt4fzswdk@MacBook-Pro-6.local> <20230421084106.5a02844971e18cdd8ad163be@kernel.org>
 <CAADnVQ+R3ySQpFDnn-2EtUooDmkwTBCh_yRjqNBDhS5SvWrTYQ@mail.gmail.com> <20230421143828.bb274512144e133eb5fead1a@kernel.org>
In-Reply-To: <20230421143828.bb274512144e133eb5fead1a@kernel.org>
From:   Alexei Starovoitov <alexei.starovoitov@gmail.com>
Date:   Fri, 21 Apr 2023 09:31:12 -0700
Message-ID: <CAADnVQKAqZybpvzWRFCXmfbUSpaM2YYx9shRSSLnYWp=tQMyHg@mail.gmail.com>
Subject: Re: [PATCH v5 2/9] tracing/probes: Add fprobe events for tracing
 function entry and exit.
To:     Masami Hiramatsu <mhiramat@kernel.org>
Cc:     linux-trace-kernel@vger.kernel.org,
        LKML <linux-kernel@vger.kernel.org>,
        Steven Rostedt <rostedt@goodmis.org>,
        Florent Revest <revest@chromium.org>,
        Mark Rutland <mark.rutland@arm.com>,
        Will Deacon <will@kernel.org>,
        Mathieu Desnoyers <mathieu.desnoyers@efficios.com>,
        Martin KaFai Lau <martin.lau@linux.dev>,
        bpf <bpf@vger.kernel.org>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Precedence: bulk

On Thu, Apr 20, 2023 at 10:38=E2=80=AFPM Masami Hiramatsu <mhiramat@kernel.=
org> wrote:
>
> On Thu, 20 Apr 2023 16:46:08 -0700
> Alexei Starovoitov <alexei.starovoitov@gmail.com> wrote:
>
> > On Thu, Apr 20, 2023 at 4:41=E2=80=AFPM Masami Hiramatsu <mhiramat@kern=
el.org> wrote:
> > >
> > > On Thu, 20 Apr 2023 11:49:32 -0700
> > > Alexei Starovoitov <alexei.starovoitov@gmail.com> wrote:
> > >
> > > > On Thu, Apr 20, 2023 at 08:25:50PM +0900, Masami Hiramatsu (Google)=
 wrote:
> > > > > +static int fentry_perf_func(struct trace_fprobe *tf, unsigned lo=
ng entry_ip,
> > > > > +                       struct pt_regs *regs)
> > > > > +{
> > > > > +   struct trace_event_call *call =3D trace_probe_event_call(&tf-=
>tp);
> > > > > +   struct fentry_trace_entry_head *entry;
> > > > > +   struct hlist_head *head;
> > > > > +   int size, __size, dsize;
> > > > > +   int rctx;
> > > > > +
> > > > > +   if (bpf_prog_array_valid(call)) {
> > > > > +           unsigned long orig_ip =3D instruction_pointer(regs);
> > > > > +           int ret;
> > > > > +
> > > > > +           ret =3D trace_call_bpf(call, regs);
> > > >
> > > > Please do not call bpf from fprobe.
> > > > There is no use case for it.
> > >
> > > OK.
> > >
> > > >
> > > > > +
> > > > > +           /*
> > > > > +            * We need to check and see if we modified the pc of =
the
> > > > > +            * pt_regs, and if so return 1 so that we don't do th=
e
> > > > > +            * single stepping.
> > > > > +            */
> > > > > +           if (orig_ip !=3D instruction_pointer(regs))
> > > > > +                   return 1;
> > > > > +           if (!ret)
> > > > > +                   return 0;
> > > > > +   }
> > > > > +
> > > > > +   head =3D this_cpu_ptr(call->perf_events);
> > > > > +   if (hlist_empty(head))
> > > > > +           return 0;
> > > > > +
> > > > > +   dsize =3D __get_data_size(&tf->tp, regs);
> > > > > +   __size =3D sizeof(*entry) + tf->tp.size + dsize;
> > > > > +   size =3D ALIGN(__size + sizeof(u32), sizeof(u64));
> > > > > +   size -=3D sizeof(u32);
> > > > > +
> > > > > +   entry =3D perf_trace_buf_alloc(size, NULL, &rctx);
> > > > > +   if (!entry)
> > > > > +           return 0;
> > > > > +
> > > > > +   entry->ip =3D entry_ip;
> > > > > +   memset(&entry[1], 0, dsize);
> > > > > +   store_trace_args(&entry[1], &tf->tp, regs, sizeof(*entry), ds=
ize);
> > > > > +   perf_trace_buf_submit(entry, size, rctx, call->event.type, 1,=
 regs,
> > > > > +                         head, NULL);
> > > > > +   return 0;
> > > > > +}
> > > > > +NOKPROBE_SYMBOL(fentry_perf_func);
> > > > > +
> > > > > +static void
> > > > > +fexit_perf_func(struct trace_fprobe *tf, unsigned long entry_ip,
> > > > > +           unsigned long ret_ip, struct pt_regs *regs)
> > > > > +{
> > > > > +   struct trace_event_call *call =3D trace_probe_event_call(&tf-=
>tp);
> > > > > +   struct fexit_trace_entry_head *entry;
> > > > > +   struct hlist_head *head;
> > > > > +   int size, __size, dsize;
> > > > > +   int rctx;
> > > > > +
> > > > > +   if (bpf_prog_array_valid(call) && !trace_call_bpf(call, regs)=
)
> > > > > +           return;
> > > >
> > > > Same here.
> > > > These two parts look like copy-paste from kprobes.
> > > > I suspect this code wasn't tested at all.
> > >
> > > OK, I missed to test that bpf part. I thought bpf could be appended t=
o
> > > any "trace-event" (looks like trace-event), isn't it?
> >
> > No. We're not applying bpf filtering to any random event
> > that gets introduced in a tracing subsystem.
> > fprobe falls into that category.
> > Every hook where bpf can be invoked has to be thought through.
> > That mental exercise didn't happen here.
>
> OK. Just out of curiousity, where is the "tracepoint" filter applied?
> In the kernel (verifier?) or the userspace?

Sorry. I don't understand the question.
Are you talking about BPF_PROG_TYPE_TRACEPOINT or BPF_PROG_TYPE_RAW_TRACEPO=
INT ?