On Mon, Apr 12, 2021 at 10:46:41PM +0300, Zidenberg, Tsahi wrote: > > > On 10/04/2021 14:30, Greg KH wrote: > > On Mon, Mar 29, 2021 at 01:56:53PM +0300, Zidenberg, Tsahi wrote: > >> arm64 access to userspace addresses in bpf and kprobes is broken, > >> because kernelspace address accessors are always used, and won't work > >> for userspace. > > What does not work exactly? > > > > What is broken that is fixed in these changes? I can't seem to > > understand that as it feels like bpf and kprobes works on 5.4.y unless > > something broke it? > > > > confused, > > > > greg k-h > > The original bug that I was working on: command line parameters don't > appear when snooping execve using bpf on arm64. Has this ever worked? If not, it's not really a regression that needs to be fixed, just use a newer kernel version, right? > This is true using > either osquery (with --enable_bpf_events) or bcc (execsnoop-bpfcc). > The reason, it seems, is that in arm64 userspace addresses cannot be > accessed with kernelspace accessors. > This bug is fixed with Patch 1. > > Since Patch 1 added ARCH_HAS_NON_OVERLAPPING_ADDRESS_SPACE, I thought > it made sense to check what else uses this config. I did not verify > kprobes are also broken in the same way, but it seems likely, and the > fix is very small. If only Patch 1 is merged - I'll be happy :) But your "patch 1" is no where near what that commit is upstream so now you have divered from what is there and created something new. And we don't like that for obvious reasons (no testing, maintaining over time, etc.) So again, if you want to do this type of thing, why not just use a newer kernel? thanks, greg k-h
