Re: [PATCH bpf-next 2/4] selftests/bpf: adopt attach_probe selftest to work on old kernels

[Andrii Nakryiko <andrii.nakryiko@gmail.com>]

On Tue, Sep 21, 2021 at 1:48 PM Alexei Starovoitov
<alexei.starovoitov@gmail.com> wrote:
>
> On Tue, Sep 21, 2021 at 1:47 PM Andrii Nakryiko
> <andrii.nakryiko@gmail.com> wrote:
> >
> > On Tue, Sep 21, 2021 at 1:34 PM Alexei Starovoitov
> > <alexei.starovoitov@gmail.com> wrote:
> > >
> > > On Mon, Sep 20, 2021 at 4:18 PM Andrii Nakryiko <andrii@kernel.org> wrote:
> > > >
> > > > Make sure to not use ref_ctr_off feature when running on old kernels
> > > > that don't support this feature. This allows to test libbpf's legacy
> > > > kprobe and uprobe logic on old kernels.
> > > >
> > > > Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
> > > > ---
> > > >  .../selftests/bpf/prog_tests/attach_probe.c      | 16 ++++++++++++----
> > > >  1 file changed, 12 insertions(+), 4 deletions(-)
> > > >
> > > > diff --git a/tools/testing/selftests/bpf/prog_tests/attach_probe.c b/tools/testing/selftests/bpf/prog_tests/attach_probe.c
> > > > index bf307bb9e446..cbd6b6175d5c 100644
> > > > --- a/tools/testing/selftests/bpf/prog_tests/attach_probe.c
> > > > +++ b/tools/testing/selftests/bpf/prog_tests/attach_probe.c
> > > > @@ -14,6 +14,12 @@ void test_attach_probe(void)
> > > >         struct test_attach_probe* skel;
> > > >         size_t uprobe_offset;
> > > >         ssize_t base_addr, ref_ctr_offset;
> > > > +       bool legacy;
> > > > +
> > > > +       /* check is new-style kprobe/uprobe API is supported */
> > > > +       legacy = access("/sys/bus/event_source/devices/kprobe/type", F_OK) != 0;
> > > > +
> > > > +       legacy = true;
> > >
> > > What is the idea of the above?
> > > One of them is a leftover?
> >
> > Oh, sorry, `legacy = true` was me locally testing, forgot to remove
> > that. This will be properly tested in libbpf CI where we have 4.9
> > kernel, I was just trying to simulate this locally on modern kernel.
> > I'll re-submit with this removed.
>
> Got it.
> Could you explain how access() works to detect it?

Yeah, I'll expand the comment with this as well. The gist is that if
/sys/bus/event_source/devices/kprobe/type exists in the system, then
new FD-based kprobe attachment through perf system is supported,
because that file exposes a magic number that's passed to
perf_event_open() to create a kprobe event. So if access() is
successful, then it's a new enough kernel. Having said that, this is a
kprobe-specific file, while uprobe has its own (under
.../uprobe/type). Given we actually care about uprobe features for
this legacy check, I'll switch to an uprobe-specific one. But the idea
is the same.