On Mon, Mar 31, 2025 at 10:09:40AM -0400, Steven Rostedt wrote:
> On Mon, 31 Mar 2025 21:19:36 +0800
> Shung-Hsi Yu <shung-hsi...@suse.com> wrote:
>
> > Hi all,
> >
> > On ppc64le (v6.14, kernel config attached), I've observed that fentry
> > BPF programs stop being invoked after the target kernel function is live
> > patched. This occurs regardless of whether the BPF program was attached
> > before or after the live patch. I believe fentry/fprobe on ppc64le is
> > added with [1].
> >
> > Steps to reproduce on ppc64le:
> > - Use bpftrace (v0.10.0+) to attach a BPF program to cmdline_proc_show
> > with fentry (kfunc is the older name bpftrace used for fentry, used
> > here for max compatability)
> >
> > bpftrace -e 'kfunc:cmdline_proc_show { printf("%lld:
> > cmdline_proc_show() called by %s\n", nsecs(), comm) }'
> >
> > - Run `cat /proc/cmdline` and observe bpftrace output
> >
> > - Load samples/livepatch/livepatch-sample.ko
> >
> > - Run `cat /proc/cmdline` again. Observe "this has been live patched" in
> > output, but no new bpftrace output.
> >
> > Note: once the live patching module is disabled through the sysfs interface
> > the BPF program invocation is restored.
> >
> > Is this the expected interaction between fentry BPF and live patching?
> > On x86_64 it does _not_ happen, so I'd guess the behavior on ppc64le is
> > unintended. Any insights appreciated.
>
> Hmm, I'm not sure how well BPF function attachment and live patching
> interact. Can you see if on x86 the live patch is actually updated when a
> BPF program is attached?
above works for me on x86, there's both 'this has been live patched'
and bpftrace output
>
> Would be even more interesting to see how BPF reading the return code works
> with live patching, as it calls the function directly from the BPF
> trampoline. I wonder, does it call the live patched function, or does it
> call the original one?
yes, that should work, Song fixed some time ago with:
00963a2e75a8 bpf: Support bpf_trampoline on functions with IPMODIFY (e.g.
livepatch)
jirka
>
> -- Steve
>
>
> >
> >
> > Thanks,
> > Shung-Hsi Yu
> >
> > 1:
> > https://lore.kernel.org/all/20241030070850.1361304-2-hbath...@linux.ibm.com/
>
>
