[BUG?] ppc64le: fentry BPF not triggered after live patch (v6.14)

[Jiri Olsa]

On Mon, Mar 31, 2025 at 10:09:40AM -0400, Steven Rostedt wrote:
> On Mon, 31 Mar 2025 21:19:36 +0800
> Shung-Hsi Yu <shung-hsi.yu at suse.com> wrote:
> 
> > Hi all,
> > 
> > On ppc64le (v6.14, kernel config attached), I've observed that fentry
> > BPF programs stop being invoked after the target kernel function is live
> > patched. This occurs regardless of whether the BPF program was attached
> > before or after the live patch. I believe fentry/fprobe on ppc64le is
> > added with [1].
> > 
> > Steps to reproduce on ppc64le:
> > - Use bpftrace (v0.10.0+) to attach a BPF program to cmdline_proc_show
> >   with fentry (kfunc is the older name bpftrace used for fentry, used
> >   here for max compatability)
> > 
> >     bpftrace -e 'kfunc:cmdline_proc_show { printf("%lld: cmdline_proc_show() called by %s\n", nsecs(), comm) }'
> > 
> > - Run `cat /proc/cmdline` and observe bpftrace output
> > 
> > - Load samples/livepatch/livepatch-sample.ko
> > 
> > - Run `cat /proc/cmdline` again. Observe "this has been live patched" in
> >   output, but no new bpftrace output.
> > 
> > Note: once the live patching module is disabled through the sysfs interface
> > the BPF program invocation is restored.
> > 
> > Is this the expected interaction between fentry BPF and live patching?
> > On x86_64 it does _not_ happen, so I'd guess the behavior on ppc64le is
> > unintended. Any insights appreciated.
> 
> Hmm, I'm not sure how well BPF function attachment and live patching
> interact. Can you see if on x86 the live patch is actually updated when a
> BPF program is attached?

above works for me on x86, there's both 'this has been live patched'
and bpftrace output

> 
> Would be even more interesting to see how BPF reading the return code works
> with live patching, as it calls the function directly from the BPF
> trampoline. I wonder, does it call the live patched function, or does it
> call the original one?

yes, that should work, Song fixed some time ago with:
  00963a2e75a8 bpf: Support bpf_trampoline on functions with IPMODIFY (e.g. livepatch)

jirka


> 
> -- Steve
> 
> 
> > 
> > 
> > Thanks,
> > Shung-Hsi Yu
> > 
> > 1: https://lore.kernel.org/all/20241030070850.1361304-2-hbathini@linux.ibm.com/
> 
>