Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Date:   Sun, 6 Aug 2023 16:28:08 +0200
From:   Nam Cao <namcaov@gmail.com>
To:     Masami Hiramatsu <mhiramat@kernel.org>
Cc:     "Naveen N. Rao" <naveen.n.rao@linux.ibm.com>,
        Anil S Keshavamurthy <anil.s.keshavamurthy@intel.com>,
        "David S. Miller" <davem@davemloft.net>,
        linux-kernel@vger.kernel.org, linux-trace-kernel@vger.kernel.org
Subject: Re: confused about kprobes
Message-ID: <ZM+t+EVXIlNbKZ3u@nam-dell>
References: <ZM+BhEz9u7hrWe6e@nam-dell>
 <20230806213150.5571b4a7f4a0531fcb00f689@kernel.org>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20230806213150.5571b4a7f4a0531fcb00f689@kernel.org>
Precedence: bulk

On Sun, Aug 06, 2023 at 09:31:50PM +0900, Masami Hiramatsu wrote:
> Hi Nam,
> 
> On Sun, 6 Aug 2023 13:18:28 +0200
> Nam Cao <namcaov@gmail.com> wrote:
> 
> > Hello,
> > 
> > I am struggling to understand how kprobes works. It would be very nice if someone
> > can spare the time to explain to me. I'm confused about this function in particular:
> > 
> > /*
> >  * Return an optimized kprobe whose optimizing code replaces
> >  * instructions including 'addr' (exclude breakpoint).
> >  */
> > static struct kprobe *get_optimized_kprobe(kprobe_opcode_t *addr)
> > {
> > 	int i;
> > 	struct kprobe *p = NULL;
> > 	struct optimized_kprobe *op;
> > 
> > 	/* Don't check i == 0, since that is a breakpoint case. */
> > 	for (i = 1; !p && i < MAX_OPTIMIZED_LENGTH / sizeof(kprobe_opcode_t); i++)
> > 		p = get_kprobe(addr - i);
> > 
> > 	if (p && kprobe_optready(p)) {
> > 		op = container_of(p, struct optimized_kprobe, kp);
> > 		if (arch_within_optimized_kprobe(op, addr))
> > 			return p;
> > 	}
> > 
> > 	return NULL;
> > }
> > 
> > The document mentions something about optimizing by replacing trap instructions
> > with jump instructions, so I am assuming this function is part of that.
> 
> Yes, you're right. 
> 
> > But I
> > fail to see what this function is trying to do exactly. The for loop seems to
> > call get_kprobe at addresses immediately before "addr". But what for? What are
> > at addresses before "addr"?
> 
> This is for finding a jump optimized kprobe which will modify the instruction
> pointed by 'addr'. As you may know, on x86, the software-breakpoint
> instruction is 1 byte, but the jump will be 5 bytes. In that case, if we put
> something at instruction including 'addr', it will be ignored or it will break
> the jump instruction. So it is used for finding such optimized kprobe.
> 
> For the kprobe, the jump optimization is optional and hidden from the user. We
> should prioritize adding kprobes at specified locations over optimization.
> Thus if we find such optimized kprobe, it must be unoptimized.

Thank you so much for the detailed answer, it is clear now.

Best regards,
Nam