LKML Archive on lore.kernel.org
help / color / mirror / Atom feed
* [PATCH bpf-next 0/2] Add bpf_task_pt_regs() helper
@ 2021-08-18 23:41 Daniel Xu
  2021-08-18 23:41 ` [PATCH bpf-next 1/2] bpf: " Daniel Xu
  2021-08-18 23:41 ` [PATCH bpf-next 2/2] bpf: selftests: Add bpf_task_pt_regs() selftest Daniel Xu
  0 siblings, 2 replies; 6+ messages in thread
From: Daniel Xu @ 2021-08-18 23:41 UTC (permalink / raw)
  To: bpf, yhs, andriin; +Cc: Daniel Xu, kernel-team, linux-kernel

The motivation behind this helper is to access userspace pt_regs in a
kprobe handler.

uprobe's ctx is the userspace pt_regs. kprobe's ctx is the kernelspace
pt_regs. bpf_task_pt_regs() allows accessing userspace pt_regs in a
kprobe handler. The final case (kernelspace pt_regs in uprobe) is
pretty rare (usermode helper) so I think that can be solved later if
necessary.

More concretely, this helper is useful in doing BPF-based DWARF stack
unwinding. Currently the kernel can only do framepointer based stack
unwinds for userspace code. This is because the DWARF state machines are
too fragile to be computed in kernelspace [0]. The idea behind
DWARF-based stack unwinds w/ BPF is to copy a chunk of the userspace
stack (while in prog context) and send it up to userspace for unwinding
(probably with libunwind) [1]. This would effectively enable profiling
applications with -fomit-frame-pointer using kprobes and uprobes.

[0]: https://lkml.org/lkml/2012/2/10/356
[1]: https://github.com/danobi/bpf-dwarf-walk

Daniel Xu (2):
  bpf: Add bpf_task_pt_regs() helper
  bpf: selftests: Add bpf_task_pt_regs() selftest

 include/uapi/linux/bpf.h                      |  7 +++
 kernel/trace/bpf_trace.c                      | 20 ++++++++
 tools/include/uapi/linux/bpf.h                |  7 +++
 .../selftests/bpf/prog_tests/task_pt_regs.c   | 50 +++++++++++++++++++
 .../selftests/bpf/progs/test_task_pt_regs.c   | 29 +++++++++++
 5 files changed, 113 insertions(+)
 create mode 100644 tools/testing/selftests/bpf/prog_tests/task_pt_regs.c
 create mode 100644 tools/testing/selftests/bpf/progs/test_task_pt_regs.c

-- 
2.32.0


^ permalink raw reply	[flat|nested] 6+ messages in thread

* [PATCH bpf-next 1/2] bpf: Add bpf_task_pt_regs() helper
  2021-08-18 23:41 [PATCH bpf-next 0/2] Add bpf_task_pt_regs() helper Daniel Xu
@ 2021-08-18 23:41 ` Daniel Xu
  2021-08-19 20:27   ` Andrii Nakryiko
  2021-08-18 23:41 ` [PATCH bpf-next 2/2] bpf: selftests: Add bpf_task_pt_regs() selftest Daniel Xu
  1 sibling, 1 reply; 6+ messages in thread
From: Daniel Xu @ 2021-08-18 23:41 UTC (permalink / raw)
  To: bpf, yhs, andriin; +Cc: Daniel Xu, kernel-team, linux-kernel

The motivation behind this helper is to access userspace pt_regs in a
kprobe handler.

uprobe's ctx is the userspace pt_regs. kprobe's ctx is the kernelspace
pt_regs. bpf_task_pt_regs() allows accessing userspace pt_regs in a
kprobe handler. The final case (kernelspace pt_regs in uprobe) is
pretty rare (usermode helper) so I think that can be solved later if
necessary.

More concretely, this helper is useful in doing BPF-based DWARF stack
unwinding. Currently the kernel can only do framepointer based stack
unwinds for userspace code. This is because the DWARF state machines are
too fragile to be computed in kernelspace [0]. The idea behind
DWARF-based stack unwinds w/ BPF is to copy a chunk of the userspace
stack (while in prog context) and send it up to userspace for unwinding
(probably with libunwind) [1]. This would effectively enable profiling
applications with -fomit-frame-pointer using kprobes and uprobes.

[0]: https://lkml.org/lkml/2012/2/10/356
[1]: https://github.com/danobi/bpf-dwarf-walk

Signed-off-by: Daniel Xu <dxu@dxuuu.xyz>
---
 include/uapi/linux/bpf.h       |  7 +++++++
 kernel/trace/bpf_trace.c       | 20 ++++++++++++++++++++
 tools/include/uapi/linux/bpf.h |  7 +++++++
 3 files changed, 34 insertions(+)

diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h
index c4f7892edb2b..47427493206a 100644
--- a/include/uapi/linux/bpf.h
+++ b/include/uapi/linux/bpf.h
@@ -4871,6 +4871,12 @@ union bpf_attr {
  * 	Return
  *		Value specified by user at BPF link creation/attachment time
  *		or 0, if it was not specified.
+ *
+ * long bpf_task_pt_regs(struct task_struct *task)
+ *	Description
+ *		Get the struct pt_regs associated with **task**.
+ *	Return
+ *		A pointer to struct pt_regs.
  */
 #define __BPF_FUNC_MAPPER(FN)		\
 	FN(unspec),			\
@@ -5048,6 +5054,7 @@ union bpf_attr {
 	FN(timer_cancel),		\
 	FN(get_func_ip),		\
 	FN(get_attach_cookie),		\
+	FN(task_pt_regs),		\
 	/* */
 
 /* integer value in 'imm' field of BPF_CALL instruction selects which helper
diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c
index cbc73c08c4a4..5924bb5a1462 100644
--- a/kernel/trace/bpf_trace.c
+++ b/kernel/trace/bpf_trace.c
@@ -723,6 +723,24 @@ static const struct bpf_func_proto bpf_get_current_task_btf_proto = {
 	.ret_btf_id	= &bpf_get_current_btf_ids[0],
 };
 
+BPF_CALL_1(bpf_task_pt_regs, struct task_struct *, task)
+{
+	return (unsigned long) task_pt_regs(task);
+}
+
+BTF_ID_LIST(bpf_task_pt_regs_ids)
+BTF_ID(struct, task_struct)
+BTF_ID(struct, pt_regs)
+
+static const struct bpf_func_proto bpf_task_pt_regs_proto = {
+	.func		= bpf_task_pt_regs,
+	.gpl_only	= true,
+	.arg1_type	= ARG_PTR_TO_BTF_ID,
+	.arg1_btf_id	= &bpf_task_pt_regs_ids[0],
+	.ret_type	= RET_PTR_TO_BTF_ID,
+	.ret_btf_id	= &bpf_task_pt_regs_ids[1],
+};
+
 BPF_CALL_2(bpf_current_task_under_cgroup, struct bpf_map *, map, u32, idx)
 {
 	struct bpf_array *array = container_of(map, struct bpf_array, map);
@@ -1032,6 +1050,8 @@ bpf_tracing_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog)
 		return &bpf_get_current_task_proto;
 	case BPF_FUNC_get_current_task_btf:
 		return &bpf_get_current_task_btf_proto;
+	case BPF_FUNC_task_pt_regs:
+		return &bpf_task_pt_regs_proto;
 	case BPF_FUNC_get_current_uid_gid:
 		return &bpf_get_current_uid_gid_proto;
 	case BPF_FUNC_get_current_comm:
diff --git a/tools/include/uapi/linux/bpf.h b/tools/include/uapi/linux/bpf.h
index c4f7892edb2b..47427493206a 100644
--- a/tools/include/uapi/linux/bpf.h
+++ b/tools/include/uapi/linux/bpf.h
@@ -4871,6 +4871,12 @@ union bpf_attr {
  * 	Return
  *		Value specified by user at BPF link creation/attachment time
  *		or 0, if it was not specified.
+ *
+ * long bpf_task_pt_regs(struct task_struct *task)
+ *	Description
+ *		Get the struct pt_regs associated with **task**.
+ *	Return
+ *		A pointer to struct pt_regs.
  */
 #define __BPF_FUNC_MAPPER(FN)		\
 	FN(unspec),			\
@@ -5048,6 +5054,7 @@ union bpf_attr {
 	FN(timer_cancel),		\
 	FN(get_func_ip),		\
 	FN(get_attach_cookie),		\
+	FN(task_pt_regs),		\
 	/* */
 
 /* integer value in 'imm' field of BPF_CALL instruction selects which helper
-- 
2.32.0


^ permalink raw reply	[flat|nested] 6+ messages in thread

* [PATCH bpf-next 2/2] bpf: selftests: Add bpf_task_pt_regs() selftest
  2021-08-18 23:41 [PATCH bpf-next 0/2] Add bpf_task_pt_regs() helper Daniel Xu
  2021-08-18 23:41 ` [PATCH bpf-next 1/2] bpf: " Daniel Xu
@ 2021-08-18 23:41 ` Daniel Xu
  2021-08-19 20:28   ` Andrii Nakryiko
  1 sibling, 1 reply; 6+ messages in thread
From: Daniel Xu @ 2021-08-18 23:41 UTC (permalink / raw)
  To: bpf, yhs, andriin; +Cc: Daniel Xu, kernel-team, linux-kernel

This test retrieves the uprobe's pt_regs in two different ways and
compares the contents in an arch-agnostic way.

Signed-off-by: Daniel Xu <dxu@dxuuu.xyz>
---
 .../selftests/bpf/prog_tests/task_pt_regs.c   | 50 +++++++++++++++++++
 .../selftests/bpf/progs/test_task_pt_regs.c   | 29 +++++++++++
 2 files changed, 79 insertions(+)
 create mode 100644 tools/testing/selftests/bpf/prog_tests/task_pt_regs.c
 create mode 100644 tools/testing/selftests/bpf/progs/test_task_pt_regs.c

diff --git a/tools/testing/selftests/bpf/prog_tests/task_pt_regs.c b/tools/testing/selftests/bpf/prog_tests/task_pt_regs.c
new file mode 100644
index 000000000000..3f0fc2267c1c
--- /dev/null
+++ b/tools/testing/selftests/bpf/prog_tests/task_pt_regs.c
@@ -0,0 +1,50 @@
+// SPDX-License-Identifier: GPL-2.0
+#define _GNU_SOURCE
+#include <test_progs.h>
+#include <linux/ptrace.h>
+#include "test_task_pt_regs.skel.h"
+
+void test_task_pt_regs(void)
+{
+	int duration = 0;
+	struct test_task_pt_regs *skel;
+	struct bpf_link *uprobe_link;
+	size_t uprobe_offset;
+	ssize_t base_addr;
+	bool match;
+
+	base_addr = get_base_addr();
+	if (CHECK(base_addr < 0, "get_base_addr",
+		  "failed to find base addr: %zd", base_addr))
+		return;
+	uprobe_offset = get_uprobe_offset(&get_base_addr, base_addr);
+
+	skel = test_task_pt_regs__open_and_load();
+	if (CHECK(!skel, "skel_open", "failed to open skeleton\n"))
+		return;
+	if (CHECK(!skel->bss, "check_bss", ".bss wasn't mmap()-ed\n"))
+		goto cleanup;
+
+	uprobe_link = bpf_program__attach_uprobe(skel->progs.handle_uprobe,
+						 false /* retprobe */,
+						 0 /* self pid */,
+						 "/proc/self/exe",
+						 uprobe_offset);
+	if (!ASSERT_OK_PTR(uprobe_link, "attach_uprobe"))
+		goto cleanup;
+	skel->links.handle_uprobe = uprobe_link;
+
+	/* trigger & validate uprobe */
+	get_base_addr();
+
+	if (CHECK(skel->bss->uprobe_res != 1, "check_uprobe_res",
+		  "wrong uprobe res: %d\n", skel->bss->uprobe_res))
+		goto cleanup;
+
+	match = !memcmp(&skel->bss->current_regs, &skel->bss->ctx_regs,
+			sizeof(skel->bss->current_regs));
+	CHECK(!match, "check_regs_match", "registers did not match");
+
+cleanup:
+	test_task_pt_regs__destroy(skel);
+}
diff --git a/tools/testing/selftests/bpf/progs/test_task_pt_regs.c b/tools/testing/selftests/bpf/progs/test_task_pt_regs.c
new file mode 100644
index 000000000000..6c059f1cfa1b
--- /dev/null
+++ b/tools/testing/selftests/bpf/progs/test_task_pt_regs.c
@@ -0,0 +1,29 @@
+// SPDX-License-Identifier: GPL-2.0
+
+#include <linux/ptrace.h>
+#include <linux/bpf.h>
+#include <bpf/bpf_helpers.h>
+#include <bpf/bpf_tracing.h>
+
+struct pt_regs current_regs = {};
+struct pt_regs ctx_regs = {};
+int uprobe_res = 0;
+
+SEC("uprobe/trigger_func")
+int handle_uprobe(struct pt_regs *ctx)
+{
+	struct task_struct *current;
+	struct pt_regs *regs;
+
+	current = bpf_get_current_task_btf();
+	regs = (struct pt_regs *) bpf_task_pt_regs(current);
+	__builtin_memcpy(&current_regs, regs, sizeof(*regs));
+	__builtin_memcpy(&ctx_regs, ctx, sizeof(*ctx));
+
+	/* Prove that uprobe was run */
+	uprobe_res = 1;
+
+	return 0;
+}
+
+char _license[] SEC("license") = "GPL";
-- 
2.32.0


^ permalink raw reply	[flat|nested] 6+ messages in thread

* Re: [PATCH bpf-next 1/2] bpf: Add bpf_task_pt_regs() helper
  2021-08-18 23:41 ` [PATCH bpf-next 1/2] bpf: " Daniel Xu
@ 2021-08-19 20:27   ` Andrii Nakryiko
  2021-08-24  1:38     ` Daniel Xu
  0 siblings, 1 reply; 6+ messages in thread
From: Andrii Nakryiko @ 2021-08-19 20:27 UTC (permalink / raw)
  To: Daniel Xu; +Cc: bpf, Yonghong Song, Andrii Nakryiko, Kernel Team, open list

On Wed, Aug 18, 2021 at 4:42 PM Daniel Xu <dxu@dxuuu.xyz> wrote:
>
> The motivation behind this helper is to access userspace pt_regs in a
> kprobe handler.
>
> uprobe's ctx is the userspace pt_regs. kprobe's ctx is the kernelspace
> pt_regs. bpf_task_pt_regs() allows accessing userspace pt_regs in a
> kprobe handler. The final case (kernelspace pt_regs in uprobe) is
> pretty rare (usermode helper) so I think that can be solved later if
> necessary.
>
> More concretely, this helper is useful in doing BPF-based DWARF stack
> unwinding. Currently the kernel can only do framepointer based stack
> unwinds for userspace code. This is because the DWARF state machines are
> too fragile to be computed in kernelspace [0]. The idea behind
> DWARF-based stack unwinds w/ BPF is to copy a chunk of the userspace
> stack (while in prog context) and send it up to userspace for unwinding
> (probably with libunwind) [1]. This would effectively enable profiling
> applications with -fomit-frame-pointer using kprobes and uprobes.
>
> [0]: https://lkml.org/lkml/2012/2/10/356
> [1]: https://github.com/danobi/bpf-dwarf-walk
>
> Signed-off-by: Daniel Xu <dxu@dxuuu.xyz>
> ---

Seems like a really useful thing. Few notes:

1. Given this is user pt_regs, should we call it bpf_get_user_pt_regs()?
2. Would it be safe to enable it for all types of programs, not just
kprobe/tp/raw_tp/perf? Why limit the list?
3. It seems like it's the sixth declaration of BTF_ID for task_struct,
maybe it's time to consolidate them?

>  include/uapi/linux/bpf.h       |  7 +++++++
>  kernel/trace/bpf_trace.c       | 20 ++++++++++++++++++++
>  tools/include/uapi/linux/bpf.h |  7 +++++++
>  3 files changed, 34 insertions(+)

[...]

^ permalink raw reply	[flat|nested] 6+ messages in thread

* Re: [PATCH bpf-next 2/2] bpf: selftests: Add bpf_task_pt_regs() selftest
  2021-08-18 23:41 ` [PATCH bpf-next 2/2] bpf: selftests: Add bpf_task_pt_regs() selftest Daniel Xu
@ 2021-08-19 20:28   ` Andrii Nakryiko
  0 siblings, 0 replies; 6+ messages in thread
From: Andrii Nakryiko @ 2021-08-19 20:28 UTC (permalink / raw)
  To: Daniel Xu; +Cc: bpf, Yonghong Song, Andrii Nakryiko, Kernel Team, open list

On Wed, Aug 18, 2021 at 4:43 PM Daniel Xu <dxu@dxuuu.xyz> wrote:
>
> This test retrieves the uprobe's pt_regs in two different ways and
> compares the contents in an arch-agnostic way.
>
> Signed-off-by: Daniel Xu <dxu@dxuuu.xyz>
> ---

Please use ASSERT_xxx() macros for new tests.

>  .../selftests/bpf/prog_tests/task_pt_regs.c   | 50 +++++++++++++++++++
>  .../selftests/bpf/progs/test_task_pt_regs.c   | 29 +++++++++++
>  2 files changed, 79 insertions(+)
>  create mode 100644 tools/testing/selftests/bpf/prog_tests/task_pt_regs.c
>  create mode 100644 tools/testing/selftests/bpf/progs/test_task_pt_regs.c
>

[...]

^ permalink raw reply	[flat|nested] 6+ messages in thread

* Re: [PATCH bpf-next 1/2] bpf: Add bpf_task_pt_regs() helper
  2021-08-19 20:27   ` Andrii Nakryiko
@ 2021-08-24  1:38     ` Daniel Xu
  0 siblings, 0 replies; 6+ messages in thread
From: Daniel Xu @ 2021-08-24  1:38 UTC (permalink / raw)
  To: Andrii Nakryiko
  Cc: bpf, Yonghong Song, Andrii Nakryiko, Kernel Team, open list

On Thu, Aug 19, 2021 at 01:27:16PM -0700, Andrii Nakryiko wrote:
> On Wed, Aug 18, 2021 at 4:42 PM Daniel Xu <dxu@dxuuu.xyz> wrote:
> >
> > The motivation behind this helper is to access userspace pt_regs in a
> > kprobe handler.
> >
> > uprobe's ctx is the userspace pt_regs. kprobe's ctx is the kernelspace
> > pt_regs. bpf_task_pt_regs() allows accessing userspace pt_regs in a
> > kprobe handler. The final case (kernelspace pt_regs in uprobe) is
> > pretty rare (usermode helper) so I think that can be solved later if
> > necessary.
> >
> > More concretely, this helper is useful in doing BPF-based DWARF stack
> > unwinding. Currently the kernel can only do framepointer based stack
> > unwinds for userspace code. This is because the DWARF state machines are
> > too fragile to be computed in kernelspace [0]. The idea behind
> > DWARF-based stack unwinds w/ BPF is to copy a chunk of the userspace
> > stack (while in prog context) and send it up to userspace for unwinding
> > (probably with libunwind) [1]. This would effectively enable profiling
> > applications with -fomit-frame-pointer using kprobes and uprobes.
> >
> > [0]: https://lkml.org/lkml/2012/2/10/356
> > [1]: https://github.com/danobi/bpf-dwarf-walk
> >
> > Signed-off-by: Daniel Xu <dxu@dxuuu.xyz>
> > ---
> 
> Seems like a really useful thing. Few notes:
> 
> 1. Given this is user pt_regs, should we call it bpf_get_user_pt_regs()?

I'm not 100% sure, but it seems to me that task_pt_regs() works for
kernel threads too. I see in arch/x86/kernel/smpboot.c that
task_pt_regs() is being used on the idle thread (which I think is a
kernel thread).

> 2. Would it be safe to enable it for all types of programs, not just
> kprobe/tp/raw_tp/perf? Why limit the list?

Oh I didn't realize I put a limit on it. I'll look closer.

> 3. It seems like it's the sixth declaration of BTF_ID for task_struct,
> maybe it's time to consolidate them?

Ok, will consolidate.

[...]

Thanks,
Daniel

^ permalink raw reply	[flat|nested] 6+ messages in thread

end of thread, other threads:[~2021-08-24  1:38 UTC | newest]

Thread overview: 6+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-08-18 23:41 [PATCH bpf-next 0/2] Add bpf_task_pt_regs() helper Daniel Xu
2021-08-18 23:41 ` [PATCH bpf-next 1/2] bpf: " Daniel Xu
2021-08-19 20:27   ` Andrii Nakryiko
2021-08-24  1:38     ` Daniel Xu
2021-08-18 23:41 ` [PATCH bpf-next 2/2] bpf: selftests: Add bpf_task_pt_regs() selftest Daniel Xu
2021-08-19 20:28   ` Andrii Nakryiko

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).