On Wed, 18 Dec 2019 06:21:35 +0000
Jisheng Zhang <Jisheng.Zhang@xxxxxxxxxxxxx> wrote:
> KPROBES_ON_FTRACE avoids much of the overhead with regular kprobes as it
> eliminates the need for a trap, as well as the need to emulate or
> single-step instructions.
>
> Tested on berlin arm64 platform.
>
> ~ # mount -t debugfs debugfs /sys/kernel/debug/
> ~ # cd /sys/kernel/debug/
> /sys/kernel/debug # echo 'p _do_fork' > tracing/kprobe_events
>
> before the patch:
>
> /sys/kernel/debug # cat kprobes/list
> ffffff801009fe28 k _do_fork+0x0 [DISABLED]
>
> after the patch:
>
> /sys/kernel/debug # cat kprobes/list
> ffffff801009ff54 k _do_fork+0x4 [DISABLED][FTRACE]
BTW, it seems this automatically changes the offset without
user's intention or any warnings. How would you manage if the user
pass a new probe on _do_fork+0x4?
IOW, it is still the question who really wants to probe on
the _do_fork+"0", if kprobes modifies it automatically,
no one can do that anymore.
This can be happen if the user want to record LR or SP value
at the function call for debug. If kprobe always modifies it,
we will lose the way to do it.
Could you remove below function at this moment?
> +kprobe_opcode_t *kprobe_lookup_name(const char *name, unsigned int offset)
> +{
> + unsigned long addr = kallsyms_lookup_name(name);
> +
> + if (addr && !offset) {
> + unsigned long faddr;
> + /*
> + * with -fpatchable-function-entry=2, the first 4 bytes is the
> + * LR saver, then the actual call insn. So ftrace location is
> + * always on the first 4 bytes offset.
> + */
> + faddr = ftrace_location_range(addr,
> + addr + AARCH64_INSN_SIZE);
> + if (faddr)
> + return (kprobe_opcode_t *)faddr;
> + }
> + return (kprobe_opcode_t *)addr;
> +}
> +
> +bool arch_kprobe_on_func_entry(unsigned long offset)
> +{
> + return offset <= AARCH64_INSN_SIZE;
> +}
Without this automatic change, we still can change the offset
in upper layer.
Thank you,
--
Masami Hiramatsu <mhiramat@xxxxxxxxxx>
