This is the mail archive of the
systemtap@sourceware.org
mailing list for the systemtap project.
Re: [PATCH -tip v4 0/6] kprobes: introduce NOKPROBE_SYMBOL() and fixes crash bugs
- From: Masami Hiramatsu <masami dot hiramatsu dot pt at hitachi dot com>
- To: Sandeepa Prabhu <sandeepa dot prabhu at linaro dot org>
- Cc: Ingo Molnar <mingo at kernel dot org>, Ananth N Mavinakayanahalli <ananth at in dot ibm dot com>, x86 at kernel dot org, lkml <linux-kernel at vger dot kernel dot org>, "Steven Rostedt (Red Hat)" <rostedt at goodmis dot org>, systemtap at sourceware dot org, "David S. Miller" <davem at davemloft dot net>
- Date: Fri, 06 Dec 2013 15:23:05 +0900
- Subject: Re: [PATCH -tip v4 0/6] kprobes: introduce NOKPROBE_SYMBOL() and fixes crash bugs
- Authentication-results: sourceware.org; auth=none
- References: <20131204012841 dot 22118 dot 82992 dot stgit at kbuild-fedora dot novalocal> <20131204084551 dot GA31772 at gmail dot com> <529FBA71 dot 6070107 at hitachi dot com> <CA+b37P1ejFn4YJekJFOCe701mLTprqQi4KSyGV4S7QiVaC1=qA at mail dot gmail dot com>
(2013/12/05 22:08), Sandeepa Prabhu wrote:
>> OK, I think the kprobe is like a strong medicine, not a toy,
>> since it can intercept most of the kernel functions which
>> may process a sensitive user private data. Thus even if we
>> fix all bugs and make it safe, I don't think we can open
>> it for all users (of course, there should be a knob to open
>> for any or restricted users.)
>>
>>> So we need both a maintainable and a sane/safe solution, and I'd like
>>> to apply the whole thing at once and be at ease that the solution is
>>> round. We should have done this years ago.
>>
>> For the safeness of kprobes, I have an idea; introduce a whitelist
>> for dynamic events. AFAICS, the biggest unstable issue of kprobes
>> comes from putting *many* probes on the functions called from tracers.
>>
>> It doesn't crash the kernel but slows down so much, because every
>> probes hit many other nested miss-hit probes. This gives us a big
>> performance impact. However, on the other side, this kind of feature
>> can be used *for debugging* static trace events by dynamic one if we
>> carefully use a small number of probes on such functions. :)
>>
>> Thus, I think we can restrict users from probing such functions by
>> using a whitelist which ftrace does already have;
>> available_filter_functions :)
> I am not sure if this question is related, uprobes or ftrace code does
> not define __kprobes, so is it safe to place kprobe on uprobes or
> ftrace code?
Yes, it is "safe" in qualitative meaning. But for ftrace code, it could
give a performance impact by miss-hitting. Since uprobe is independent
from kprobe, it should work.
> Is it expected from arch code to support such cases?
Yes, the arch dependent implementation is the key. If it shares some
code which can be called from miss-hit path, it should be blacklisted.
Thank you,
--
Masami HIRAMATSU
IT Management Research Dept. Linux Technology Center
Hitachi, Ltd., Yokohama Research Laboratory
E-mail: masami.hiramatsu.pt@hitachi.com