opensnoop on ARM64 fails to read filename

[joelagnel]

BCC's eBPF-based opensnoop tool [1] installs a
kprobe on do_sys_open to monitor calls to the open syscall globally.

do_sys_open() has prototype:

long do_sys_open(int dfd, const char __user *filename, int flags, umode_t mode);

This causes a "blank" filename to be displayed by opensnoop when I run it on
my Pixel 3 (arm64), possibly because this is a user pointer. However, it
works fine on x86-64.

So it seems to me that on arm64, reading user pointers directly still doesn't
work even if there is a distinction between user/kernel addresses. In that
case reading the user pointer using user accessors (possibly using
bpf_probe_user_read helper) should be needed to fix this issue

[joelagnel]

(this is being discussed upstream and Yonghong will fix it upstream, I just opened it here to track it)

[yonghong-song]

Looks like this is the case. https://lkml.org/lkml/2019/2/28/1369
I am working on this now.

[joelagnel]

Yonghong, any updates on this? Thanks a lot.

[yonghong-song]

On Wed, Apr 3, 2019 at 1:46 PM Joel ***@***.***> wrote: Yonghong, any updates on this? Thanks a lot.

Not yet. Full automatic detection through BTF is long way to go. Full automatic detection support needs llvm/gcc support. Maybe we can wait the following patch land https://lore.kernel.org/patchwork/cover/1051586/ and then we introduction new bpf_probe_read_user() helper.

[joelagnel]

May be I am missing something. This changes does not depend on BTF as far as I know. We are already know that the pointer is __user, we don't need to do any automatic detection. All that is needed is to call bpf_probe_read_user. If you want, I can work on a patch for that. I really need this since our users are complaining that opensnoop is not working on arm On Thu, Apr 4, 2019 at 1:46 AM yonghong-song <notifications@github.com> wrote:

…

On Wed, Apr 3, 2019 at 1:46 PM Joel ***@***.***> wrote: > > Yonghong, any updates on this? Thanks a lot. Not yet. Full automatic detection through BTF is long way to go. Full automatic detection support needs llvm/gcc support. Maybe we can wait the following patch land https://lore.kernel.org/patchwork/cover/1051586/ and then we introduction new bpf_probe_read_user() helper. — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub <#2253 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AACSVLfv5e-zKPNvhM5sEW5mUPqpQBs8ks5vdZHMgaJpZM4bfdEb> .

[yonghong-song]

On Thu, Apr 4, 2019 at 9:40 AM Joel ***@***.***> wrote: May be I am missing something. This changes does not depend on BTF as far as I know. We are already know that the pointer is __user, we don't need to do any automatic detection. All that is needed is to call bpf_probe_read_user. If you want, I can work on a patch for that. I really need this since our users are complaining that opensnoop is not working on arm

Sorry for confusion. Your above proposal is what I mean. Waiting for Masami Hiramatsu <https://lore.kernel.org/patchwork/project/lkml/list/?submitter=20377>'s patch and then implement bpf_probe_read_user, no need for BTF at this point. Please go ahead to work on such a patch. We may or may not need his patch. Thanks!

…

On Thu, Apr 4, 2019 at 1:46 AM yonghong-song ***@***.***> wrote: > On Wed, Apr 3, 2019 at 1:46 PM Joel ***@***.***> wrote: > > > > Yonghong, any updates on this? Thanks a lot. > > Not yet. Full automatic detection through BTF is long way to go. Full > automatic detection support needs llvm/gcc support. Maybe we can wait > the following patch land > https://lore.kernel.org/patchwork/cover/1051586/ and then we > introduction new bpf_probe_read_user() helper. > > — > You are receiving this because you authored the thread. > Reply to this email directly, view it on GitHub > <#2253 (comment)>, or mute > the thread > < https://github.com/notifications/unsubscribe-auth/AACSVLfv5e-zKPNvhM5sEW5mUPqpQBs8ks5vdZHMgaJpZM4bfdEb > > . > — You are receiving this because you commented. Reply to this email directly, view it on GitHub <#2253 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/ALq6oo9hhVH0A1S4n33WsDHgLfPTs57pks5vdirngaJpZM4bfdEb> .