Messages in this thread | | | Date | Thu, 11 Jun 2020 15:32:40 +0100 | From | Daniel Thompson <> | Subject | Re: [RFC PATCH 0/4] kgdb: Honour the kprobe blacklist when setting breakpoints |
| |
On Thu, Jun 11, 2020 at 09:42:09PM +0900, Masami Hiramatsu wrote: > On Fri, 5 Jun 2020 16:29:53 +0200 > Peter Zijlstra <peterz@infradead.org> wrote: > > > On Fri, Jun 05, 2020 at 02:21:26PM +0100, Daniel Thompson wrote: > > > kgdb has traditionally adopted a no safety rails approach to breakpoint > > > placement. If the debugger is commanded to place a breakpoint at an > > > address then it will do so even if that breakpoint results in kgdb > > > becoming inoperable. > > > > > > A stop-the-world debugger with memory peek/poke does intrinsically > > > provide its operator with the means to hose their system in all manner > > > of exciting ways (not least because stopping-the-world is already a DoS > > > attack ;-) ) but the current no safety rail approach is not easy to > > > defend, especially given kprobes provides us with plenty of machinery to > > > mark parts of the kernel where breakpointing is discouraged. > > > > > > This patchset introduces some safety rails by using the existing > > > kprobes infrastructure. It does not cover all locations where > > > breakpoints can cause trouble but it will definitely block off several > > > avenues, including the architecture specific parts that are handled by > > > arch_within_kprobe_blacklist(). > > > > > > This patch is an RFC because: > > > > > > 1. My workstation is still chugging through the compile testing. > > > > > > 2. Patch 4 needs more runtime testing. > > > > > > 3. The code to extract the kprobe blacklist code (patch 4 again) needs > > > more review especially for its impact on arch specific code. > > > > > > To be clear I do plan to do the detailed review of the kprobe blacklist > > > stuff but would like to check the direction of travel first since the > > > change is already surprisingly big and maybe there's a better way to > > > organise things. > > > > Thanks for doing these patches, esp 1-3 look very good to me. > > > > I've taken the liberty to bounce the entire set to Masami-San, who is > > the kprobes maintainer for comments as well. > > Thanks Peter to Cc me. > > Reusing kprobe blacklist is good to me as far as it doesn't expand it > only for kgdb. For example, if a function which can cause a recursive > trap issue only when the kgdb puts a breakpoint, it should be covered > by kgdb blacklist, or we should make a "noinstr-list" including > both :)
Recursion is what focuses the mind but I don't think we'd need recursion for there to be problems.
For example taking a kprobe trap whilst executing the kgdb trap handler (or vice versa) is already likely to be fragile and is almost certainly untested on most or all architectures. Further if I understood Peter's original nudge correctly then, in addition, x86 plans to explicitly prohibit this anyway.
On other words I think there will only be one blacklist.
> Thus, Nack for PATCH 4/4, that seems a bit selfish change. If kgdb wants > to use the "kprobes blacklist", we should make CONFIG_KGDB depending on > CONFIG_KPROBES.
Some of the architectures currently have kgdb support but do not have kprobes...
> Or, (as I pointed) we should make independent "noinstr-list" > and use it from both.
This sounds like this wouldn't really be a functional change over what I have proposed. More like augmenting it with a massive symbol rename (and maybe a little bit of extra code movement in the headers to give us linux/noinstr.h).
Taking my cues from things like set_fs() I originally decided to keep away from such a big rename ;-) .
Personally I'm open to a rename. I could write PATCH 4/4 assuming a rename will come (e.g. different naming for new files and Kconfig options) and follow that with an automatically generated rename patch (or patches).
Daniel.
| |