Hi all,
On ppc64le (v6.14, kernel config attached), I've observed that fentry
BPF programs stop being invoked after the target kernel function is live
patched. This occurs regardless of whether the BPF program was attached
before or after the live patch. I believe fentry/fprobe on ppc64le is
added with [1].
Steps to reproduce on ppc64le:
- Use bpftrace (v0.10.0+) to attach a BPF program to cmdline_proc_show
with fentry (kfunc is the older name bpftrace used for fentry, used
here for max compatability)
bpftrace -e 'kfunc:cmdline_proc_show { printf("%lld: cmdline_proc_show()
called by %s\n", nsecs(), comm) }'
- Run `cat /proc/cmdline` and observe bpftrace output
- Load samples/livepatch/livepatch-sample.ko
- Run `cat /proc/cmdline` again. Observe "this has been live patched" in
output, but no new bpftrace output.
Note: once the live patching module is disabled through the sysfs interface
the BPF program invocation is restored.
Is this the expected interaction between fentry BPF and live patching?
On x86_64 it does _not_ happen, so I'd guess the behavior on ppc64le is
unintended. Any insights appreciated.
Thanks,
Shung-Hsi Yu
1: https://lore.kernel.org/all/20241030070850.1361304-2-hbath...@linux.ibm.com/
