Linux Virtualization - Nov 2013 - [PATCH -tip RFC 0/2] kprobes: introduce NOKPROBE_SYMBOL() and prohibit probing on .entry.text

(2013/11/11 20:16), Ingo Molnar wrote:
> 
> * Masami Hiramatsu <masami.hiramatsu.pt at hitachi.com> wrote:
> 
>> Currently the blacklist is maintained by hand in kprobes.c 
>> which is separated from the function definition and is hard
>> to catch up the kernel update.
>> To solve this issue, I've tried to implement new
>> NOKPROBE_SYMBOL() macro for making kprobe blacklist at 
>> build time. Since the NOKPROBE_SYMBOL() macros can be placed
>> right after the function is defined, it is easy to maintain.
>> At this moment, I applied the macro only for the symbols
>> which is listed in kprobes.c. As we discussed in previous
>> thread, if the gcc accepts to introduce new annotation to
>> store the function address (and size) at somewhere, we can
>> easily move onto that by replacing NOKPROBE_SYMBOL() with
>> nokprobe annotation (and just modifying the
>> populate_kprobe_blacklist() a bit).
>>
>> This series also includes a change which prohibits probing
>> on the address in .entry.text because the code is used for
>> very low-level sensitive interrupt/syscall entries. Probing
>> such code may cause unexpected result (actually most of
>> that area is already in the kprobe blacklist).
>> So I've decide to prohibit probing all of them.
>>
>> Since Ingo wasn't convinced about the idea in the previous
>> discussion, I just make this series as RFC series.
>> I'd like to ask again with actual implementation and plan.
>>
>> Thank you,
>>
>> ---
>>
>> Masami Hiramatsu (2):
>>       kprobes: Prohibit probing on .entry.text code
>>       kprobes: Introduce NOKPROBE_SYMBOL() macro for blacklist
>>
>>
>>  arch/x86/kernel/entry_32.S        |   33 ------------
>>  arch/x86/kernel/entry_64.S        |   20 --------
>>  arch/x86/kernel/paravirt.c        |    4 ++
>>  include/asm-generic/vmlinux.lds.h |    9 +++
>>  include/linux/kprobes.h           |   19 +++++++
>>  kernel/kprobes.c                  |   98
++++++++++++++++++-------------------
>>  kernel/sched/core.c               |    1 
>>  7 files changed, 80 insertions(+), 104 deletions(-)
> 
> Ok, I like it after all.
> 
> Mind changing over arch/x86/kprobes/* to use this new facility? There's
no
> sense in kprobes internals using two types
Sure, that's why I introduced this :)
> After that we can convert all the rest, probably as part of this series.
OK, I'll do. :)
BTW, converting all the __kprobes involves many archs, which
kprobes ported. In that case, which mailing-list would better me
to post the series, linux-arch?
> 
> There's a good reason now to do it: it's not just about
cleanliness, it
> will also impact generated code less.
Thank you!


-- 
Masami HIRAMATSU
IT Management Research Dept. Linux Technology Center
Hitachi, Ltd., Yokohama Research Laboratory
E-mail: masami.hiramatsu.pt at hitachi.com

On Tue, 12 Nov 2013 02:18:53 +0900
Masami Hiramatsu <masami.hiramatsu.pt at hitachi.com>
wrote:
> 
> > After that we can convert all the rest, probably as part of this
series.
> 
> OK, I'll do. :)
> BTW, converting all the __kprobes involves many archs, which
> kprobes ported. In that case, which mailing-list would better me
> to post the series, linux-arch?
I would add linux-arch.

Note, you may need to support both ways for the current time being, as
new __kprobes are being added (I've seen several in patches flying by
in LKML).

But perhaps at a later -rc we convert the rest and discontinue them.
That way, linux-next will break all new __kprobes, and that should get
them fixed before we enter 3.14-rc.

-- Steve

* Steven Rostedt <rostedt at goodmis.org> wrote:
> On Tue, 12 Nov 2013 02:18:53 +0900
> Masami Hiramatsu <masami.hiramatsu.pt at hitachi.com> wrote:
> > 
> > > After that we can convert all the rest, probably as part of this
series.
> > 
> > OK, I'll do. :)
> > BTW, converting all the __kprobes involves many archs, which
> > kprobes ported. In that case, which mailing-list would better me
> > to post the series, linux-arch?
> 
> I would add linux-arch.
> 
> Note, you may need to support both ways for the current time being, as 
> new __kprobes are being added (I've seen several in patches flying by
in
> LKML).
We'd rather like to know about all cases where new code is added to 
kprobes (or where we missed to consider some existing code).

It's really just a handful of annotations, the brunt of which is internal 
to kprobes.

Thanks,

	Ingo