arch_prepare_bpf_trampoline() for arm ?

arch_prepare_bpf_trampoline() for arm ?

[Luigi Rizzo]

I prepared a BPF version of kstats[1]
https://github.com/luigirizzo/lr-cstats
that uses fentry/fexit hooks to monitor the execution time
of a kernel function.

I hoped to have it working on ARM64 too, but it looks like
arch_prepare_bpf_trampoline() only exists for x86.

Is there any outstanding patch for this function on ARM64,
or any similar function I could look at to implement it myself ?

thanks
luigi


[1] kstats is an in-kernel also in the above repo and previously
discussed at https://lwn.net/Articles/813303/

-- 
-----------------------------------------+-------------------------------
 Prof. Luigi RIZZO, rizzo@iet.unipi.it  . Dip. di Ing. dell'Informazione
 http://www.iet.unipi.it/~luigi/        . Universita` di Pisa
 TEL      +39-050-2217533               . via Diotisalvi 2
 Mobile   +39-338-6809875               . 56122 PISA (Italy)
-----------------------------------------+-------------------------------

Re: arch_prepare_bpf_trampoline() for arm ?

[Daniel Borkmann]

On 2/24/21 8:54 PM, Luigi Rizzo wrote:
> I prepared a BPF version of kstats[1]
> https://github.com/luigirizzo/lr-cstats
> that uses fentry/fexit hooks to monitor the execution time
> of a kernel function.
> 
> I hoped to have it working on ARM64 too, but it looks like
> arch_prepare_bpf_trampoline() only exists for x86.
> 
> Is there any outstanding patch for this function on ARM64,
> or any similar function I could look at to implement it myself ?

Not that I'm currently aware of, arm64 support would definitely be great
to have. From x86 side, the underlying arch dependency was basically on
text_poke_bp() to patch instructions on a live kernel. Haven't checked
recently whether an equivalent exists on arm64 yet, but perhaps Will
might know.

> [1] kstats is an in-kernel also in the above repo and previously
> discussed at https://lwn.net/Articles/813303/

Re: arch_prepare_bpf_trampoline() for arm ?

[Toke Høiland-Jørgensen]

Daniel Borkmann <daniel@iogearbox.net> writes:

> On 2/24/21 8:54 PM, Luigi Rizzo wrote:
>> I prepared a BPF version of kstats[1]
>> https://github.com/luigirizzo/lr-cstats
>> that uses fentry/fexit hooks to monitor the execution time
>> of a kernel function.
>> 
>> I hoped to have it working on ARM64 too, but it looks like
>> arch_prepare_bpf_trampoline() only exists for x86.
>> 
>> Is there any outstanding patch for this function on ARM64,
>> or any similar function I could look at to implement it myself ?
>
> Not that I'm currently aware of, arm64 support would definitely be great
> to have. From x86 side, the underlying arch dependency was basically on
> text_poke_bp() to patch instructions on a live kernel. Haven't checked
> recently whether an equivalent exists on arm64 yet, but perhaps Will
> might know.

Adding Jean-Philippe; I believe he is/was working on this...?

-Toke

Re: arch_prepare_bpf_trampoline() for arm ?

[KP Singh]

I checked with Will about it and learnt that ARM64 does support
patching certain instructions (e.g. branch, brk, nops) using
aarch64_insn_patch_text_nosync, it's used in ftrace:

https://elixir.bootlin.com/linux/latest/source/arch/arm64/kernel/ftrace.c#L24

But one has to tolerate that not all CPUs will execute these
instructions until a context synchronization happens due to an
exception or an ISB instruction. But I think we can start
with the same thing that FTrace does?

- KP

On Wed, Feb 24, 2021 at 10:01 PM Daniel Borkmann <daniel@iogearbox.net> wrote:
>
> On 2/24/21 8:54 PM, Luigi Rizzo wrote:
> > I prepared a BPF version of kstats[1]
> > https://github.com/luigirizzo/lr-cstats
> > that uses fentry/fexit hooks to monitor the execution time
> > of a kernel function.
> >
> > I hoped to have it working on ARM64 too, but it looks like
> > arch_prepare_bpf_trampoline() only exists for x86.
> >
> > Is there any outstanding patch for this function on ARM64,
> > or any similar function I could look at to implement it myself ?
>
> Not that I'm currently aware of, arm64 support would definitely be great
> to have. From x86 side, the underlying arch dependency was basically on
> text_poke_bp() to patch instructions on a live kernel. Haven't checked
> recently whether an equivalent exists on arm64 yet, but perhaps Will
> might know.
>
> > [1] kstats is an in-kernel also in the above repo and previously
> > discussed at https://lwn.net/Articles/813303/
>

Re: arch_prepare_bpf_trampoline() for arm ?

[Daniel Borkmann]

On 2/24/21 10:30 PM, KP Singh wrote:
> I checked with Will about it and learnt that ARM64 does support
> patching certain instructions (e.g. branch, brk, nops) using
> aarch64_insn_patch_text_nosync, it's used in ftrace:
> 
> https://elixir.bootlin.com/linux/latest/source/arch/arm64/kernel/ftrace.c#L24
> 
> But one has to tolerate that not all CPUs will execute these
> instructions until a context synchronization happens due to an
> exception or an ISB instruction. But I think we can start
> with the same thing that FTrace does?

Is there any downside or road blocker for a aarch64_insn_patch_text_sync()
variant which would then trigger an explicit isb()? Presumably to perform
this reliably at that point you would end up at aarch64_insn_patch_text()
which needs the brute force stop CPU, right? I guess my noob question is
what happens if, for example, an old JITed BPF prog got freed (RCU) and the
JIT mem got reused for something else in meantime when patching JMP->NOP
via aarch64_insn_patch_text_nosync() and not all CPUs did a context sync,
is such scenario/worry realistic?

> On Wed, Feb 24, 2021 at 10:01 PM Daniel Borkmann <daniel@iogearbox.net> wrote:
>>
>> On 2/24/21 8:54 PM, Luigi Rizzo wrote:
>>> I prepared a BPF version of kstats[1]
>>> https://github.com/luigirizzo/lr-cstats
>>> that uses fentry/fexit hooks to monitor the execution time
>>> of a kernel function.
>>>
>>> I hoped to have it working on ARM64 too, but it looks like
>>> arch_prepare_bpf_trampoline() only exists for x86.
>>>
>>> Is there any outstanding patch for this function on ARM64,
>>> or any similar function I could look at to implement it myself ?
>>
>> Not that I'm currently aware of, arm64 support would definitely be great
>> to have. From x86 side, the underlying arch dependency was basically on
>> text_poke_bp() to patch instructions on a live kernel. Haven't checked
>> recently whether an equivalent exists on arm64 yet, but perhaps Will
>> might know.
>>
>>> [1] kstats is an in-kernel also in the above repo and previously
>>> discussed at https://lwn.net/Articles/813303/
>>

Re: arch_prepare_bpf_trampoline() for arm ?

[Jean-Philippe Brucker]

On Wed, Feb 24, 2021 at 10:25:38PM +0100, Toke Høiland-Jørgensen wrote:
> Daniel Borkmann <daniel@iogearbox.net> writes:
> 
> > On 2/24/21 8:54 PM, Luigi Rizzo wrote:
> >> I prepared a BPF version of kstats[1]
> >> https://github.com/luigirizzo/lr-cstats
> >> that uses fentry/fexit hooks to monitor the execution time
> >> of a kernel function.
> >> 
> >> I hoped to have it working on ARM64 too, but it looks like
> >> arch_prepare_bpf_trampoline() only exists for x86.
> >> 
> >> Is there any outstanding patch for this function on ARM64,
> >> or any similar function I could look at to implement it myself ?
> >
> > Not that I'm currently aware of, arm64 support would definitely be great
> > to have. From x86 side, the underlying arch dependency was basically on
> > text_poke_bp() to patch instructions on a live kernel. Haven't checked
> > recently whether an equivalent exists on arm64 yet, but perhaps Will
> > might know.
> 
> Adding Jean-Philippe; I believe he is/was working on this...?

Yes, I have a very rough prototype here:
https://jpbrucker.net/git/linux/log/?h=bpf/devel

But not a ton of time to work on it at the moment, I don't know when I'll
be able to post something.

Thanks,
Jean