mbox series

[v2,bpf-next,0/8] Support BTF-powered BPF tracing programs for kernel modules

Message ID 20201201035545.3013177-1-andrii@kernel.org (mailing list archive)
Headers show
Series Support BTF-powered BPF tracing programs for kernel modules | expand

Message

Andrii Nakryiko Dec. 1, 2020, 3:55 a.m. UTC
Building on top of two previous patch sets ([0] and not yet landed [1]), this
patch sets extends kernel and libbpf with support for attaching BTF-powered
raw tracepoint (tp_btf) and tracing (fentry/fexit/fmod_ret/lsm) BPF programs
to BPF hooks defined in kernel modules.

Kernel UAPI for BPF_PROG_LOAD is extended with extra parameter
(attach_btf_obj_id) which allows to specify kernel module BTF in which the BTF
type is identifed by attach_btf_id.

From end user perspective there are no extra actions that need to happen.
Libbpf will continue searching across all kernel module BTFs, if desired
attach BTF type is not found in vmlinux. That way it doesn't matter if BPF
hook that user is trying to attach to is built-in into vmlinux image or is
loaded in kernel module.

Currently pahole doesn't generate BTF_KIND_FUNC info for ftrace-able static
functions in kernel modules, so expose traced function in bpf_sidecar.ko. Once
pahole is enhanced, we can go back to static function.

  [0] https://patchwork.kernel.org/project/netdevbpf/list/?series=380759&state=*
  [1] https://patchwork.kernel.org/project/netdevbpf/list/?series=393677&state=*

v1->v2:
  - avoid increasing bpf_reg_state by reordering fields (Alexei);
  - preserve btf_data_size in struct module;
  - rebase on top of v3 of patch [1].

Andrii Nakryiko (8):
  bpf: keep module's btf_data_size intact after load
  bpf: remove hard-coded btf_vmlinux assumption from BPF verifier
  bpf: allow to specify kernel module BTFs when attaching BPF programs
  libbpf: factor out low-level BPF program loading helper
  libbpf: support attachment of BPF tracing programs to kernel modules
  selftests/bpf: add tp_btf CO-RE reloc test for modules
  selftests/bpf: make bpf_testmod's traceable function global
  selftests/bpf: add fentry/fexit/fmod_ret selftest for kernel module

 include/linux/bpf.h                           |  13 +-
 include/linux/bpf_verifier.h                  |  28 +++-
 include/linux/btf.h                           |   7 +-
 include/uapi/linux/bpf.h                      |   1 +
 kernel/bpf/btf.c                              |  90 +++++++----
 kernel/bpf/syscall.c                          |  44 +++++-
 kernel/bpf/verifier.c                         |  77 ++++++----
 kernel/module.c                               |   1 -
 net/ipv4/bpf_tcp_ca.c                         |   3 +-
 tools/include/uapi/linux/bpf.h                |   1 +
 tools/lib/bpf/bpf.c                           | 101 ++++++++----
 tools/lib/bpf/libbpf.c                        | 145 +++++++++++++-----
 tools/lib/bpf/libbpf_internal.h               |  30 ++++
 .../selftests/bpf/bpf_testmod/bpf_testmod.c   |   3 +-
 .../selftests/bpf/prog_tests/core_reloc.c     |   3 +-
 .../selftests/bpf/prog_tests/module_attach.c  |  53 +++++++
 .../bpf/progs/test_core_reloc_module.c        |  32 +++-
 .../selftests/bpf/progs/test_module_attach.c  |  66 ++++++++
 18 files changed, 546 insertions(+), 152 deletions(-)
 create mode 100644 tools/testing/selftests/bpf/prog_tests/module_attach.c
 create mode 100644 tools/testing/selftests/bpf/progs/test_module_attach.c

Comments

Yonghong Song Dec. 1, 2020, 7:26 a.m. UTC | #1
On 11/30/20 7:55 PM, Andrii Nakryiko wrote:
> Building on top of two previous patch sets ([0] and not yet landed [1]), this
> patch sets extends kernel and libbpf with support for attaching BTF-powered
> raw tracepoint (tp_btf) and tracing (fentry/fexit/fmod_ret/lsm) BPF programs
> to BPF hooks defined in kernel modules.
> 
> Kernel UAPI for BPF_PROG_LOAD is extended with extra parameter
> (attach_btf_obj_id) which allows to specify kernel module BTF in which the BTF
> type is identifed by attach_btf_id.
> 
>  From end user perspective there are no extra actions that need to happen.
> Libbpf will continue searching across all kernel module BTFs, if desired
> attach BTF type is not found in vmlinux. That way it doesn't matter if BPF
> hook that user is trying to attach to is built-in into vmlinux image or is
> loaded in kernel module.
> 
> Currently pahole doesn't generate BTF_KIND_FUNC info for ftrace-able static
> functions in kernel modules, so expose traced function in bpf_sidecar.ko. Once

bpf_sidecar.ko => bpf_testmod.ko

> pahole is enhanced, we can go back to static function.
> 
>    [0] https://patchwork.kernel.org/project/netdevbpf/list/?series=380759&state=*
>    [1] https://patchwork.kernel.org/project/netdevbpf/list/?series=393677&state=*
> 
> v1->v2:
>    - avoid increasing bpf_reg_state by reordering fields (Alexei);
>    - preserve btf_data_size in struct module;
>    - rebase on top of v3 of patch [1].
> 
> Andrii Nakryiko (8):
>    bpf: keep module's btf_data_size intact after load
>    bpf: remove hard-coded btf_vmlinux assumption from BPF verifier
>    bpf: allow to specify kernel module BTFs when attaching BPF programs
>    libbpf: factor out low-level BPF program loading helper
>    libbpf: support attachment of BPF tracing programs to kernel modules
>    selftests/bpf: add tp_btf CO-RE reloc test for modules
>    selftests/bpf: make bpf_testmod's traceable function global
>    selftests/bpf: add fentry/fexit/fmod_ret selftest for kernel module
> 
>   include/linux/bpf.h                           |  13 +-
>   include/linux/bpf_verifier.h                  |  28 +++-
>   include/linux/btf.h                           |   7 +-
>   include/uapi/linux/bpf.h                      |   1 +
>   kernel/bpf/btf.c                              |  90 +++++++----
>   kernel/bpf/syscall.c                          |  44 +++++-
>   kernel/bpf/verifier.c                         |  77 ++++++----
>   kernel/module.c                               |   1 -
>   net/ipv4/bpf_tcp_ca.c                         |   3 +-
>   tools/include/uapi/linux/bpf.h                |   1 +
>   tools/lib/bpf/bpf.c                           | 101 ++++++++----
>   tools/lib/bpf/libbpf.c                        | 145 +++++++++++++-----
>   tools/lib/bpf/libbpf_internal.h               |  30 ++++
>   .../selftests/bpf/bpf_testmod/bpf_testmod.c   |   3 +-
>   .../selftests/bpf/prog_tests/core_reloc.c     |   3 +-
>   .../selftests/bpf/prog_tests/module_attach.c  |  53 +++++++
>   .../bpf/progs/test_core_reloc_module.c        |  32 +++-
>   .../selftests/bpf/progs/test_module_attach.c  |  66 ++++++++
>   18 files changed, 546 insertions(+), 152 deletions(-)
>   create mode 100644 tools/testing/selftests/bpf/prog_tests/module_attach.c
>   create mode 100644 tools/testing/selftests/bpf/progs/test_module_attach.c
>
Andrii Nakryiko Dec. 1, 2020, 9:50 p.m. UTC | #2
On Mon, Nov 30, 2020 at 11:26 PM Yonghong Song <yhs@fb.com> wrote:
>
>
>
> On 11/30/20 7:55 PM, Andrii Nakryiko wrote:
> > Building on top of two previous patch sets ([0] and not yet landed [1]), this
> > patch sets extends kernel and libbpf with support for attaching BTF-powered
> > raw tracepoint (tp_btf) and tracing (fentry/fexit/fmod_ret/lsm) BPF programs
> > to BPF hooks defined in kernel modules.
> >
> > Kernel UAPI for BPF_PROG_LOAD is extended with extra parameter
> > (attach_btf_obj_id) which allows to specify kernel module BTF in which the BTF
> > type is identifed by attach_btf_id.
> >
> >  From end user perspective there are no extra actions that need to happen.
> > Libbpf will continue searching across all kernel module BTFs, if desired
> > attach BTF type is not found in vmlinux. That way it doesn't matter if BPF
> > hook that user is trying to attach to is built-in into vmlinux image or is
> > loaded in kernel module.
> >
> > Currently pahole doesn't generate BTF_KIND_FUNC info for ftrace-able static
> > functions in kernel modules, so expose traced function in bpf_sidecar.ko. Once
>
> bpf_sidecar.ko => bpf_testmod.ko
>

will fix, thanks!

> > pahole is enhanced, we can go back to static function.
> >
> >    [0] https://patchwork.kernel.org/project/netdevbpf/list/?series=380759&state=*
> >    [1] https://patchwork.kernel.org/project/netdevbpf/list/?series=393677&state=*
> >
> > v1->v2:
> >    - avoid increasing bpf_reg_state by reordering fields (Alexei);
> >    - preserve btf_data_size in struct module;
> >    - rebase on top of v3 of patch [1].
> >
> > Andrii Nakryiko (8):
> >    bpf: keep module's btf_data_size intact after load
> >    bpf: remove hard-coded btf_vmlinux assumption from BPF verifier
> >    bpf: allow to specify kernel module BTFs when attaching BPF programs
> >    libbpf: factor out low-level BPF program loading helper
> >    libbpf: support attachment of BPF tracing programs to kernel modules
> >    selftests/bpf: add tp_btf CO-RE reloc test for modules
> >    selftests/bpf: make bpf_testmod's traceable function global
> >    selftests/bpf: add fentry/fexit/fmod_ret selftest for kernel module
> >
> >   include/linux/bpf.h                           |  13 +-
> >   include/linux/bpf_verifier.h                  |  28 +++-
> >   include/linux/btf.h                           |   7 +-
> >   include/uapi/linux/bpf.h                      |   1 +
> >   kernel/bpf/btf.c                              |  90 +++++++----
> >   kernel/bpf/syscall.c                          |  44 +++++-
> >   kernel/bpf/verifier.c                         |  77 ++++++----
> >   kernel/module.c                               |   1 -
> >   net/ipv4/bpf_tcp_ca.c                         |   3 +-
> >   tools/include/uapi/linux/bpf.h                |   1 +
> >   tools/lib/bpf/bpf.c                           | 101 ++++++++----
> >   tools/lib/bpf/libbpf.c                        | 145 +++++++++++++-----
> >   tools/lib/bpf/libbpf_internal.h               |  30 ++++
> >   .../selftests/bpf/bpf_testmod/bpf_testmod.c   |   3 +-
> >   .../selftests/bpf/prog_tests/core_reloc.c     |   3 +-
> >   .../selftests/bpf/prog_tests/module_attach.c  |  53 +++++++
> >   .../bpf/progs/test_core_reloc_module.c        |  32 +++-
> >   .../selftests/bpf/progs/test_module_attach.c  |  66 ++++++++
> >   18 files changed, 546 insertions(+), 152 deletions(-)
> >   create mode 100644 tools/testing/selftests/bpf/prog_tests/module_attach.c
> >   create mode 100644 tools/testing/selftests/bpf/progs/test_module_attach.c
> >