[External] Re: Question - Livepatch/Kprobe Coexistence on Ftrace-enabled Functions (Ubuntu kernel based on Linux stable 5.15.30)

[Andrey Grodzovsky]

On 10/21/25 02:07, Song Liu wrote:
> On Mon, Oct 20, 2025 at 2:31 PM Andrey Grodzovsky
> <andrey.grodzovsky at crowdstrike.com> wrote:
> [...]
>> Song, I identified another issue in pre 6.6 kernel, building
>> ~/linux-6.5/samples/livepatch/livepatch-sample.c as ko,
>> before insmoding it, bpftrace fentry/fexit fires as expected, after
>> insmod, while no errors reported on attachments,
>> the hooks stop firing, both if attaching before insmod and if attaching
>> after insmod. If i rrmod the ko, existing hooks
>> resume working.
>>
>> ubuntu at ip-10-10-115-238:~$ cat /proc/version_signature
>> Ubuntu 6.5.0-1008.8-aws 6.5.3
>> Source obtained to build the test module for the AWS kernel from the
>> related stable branch -
>> https://urldefense.com/v3/__https://cdn.kernel.org/pub/linux/kernel/v6.x/linux-6.5.tar.xz__;!!BmdzS3_lV9HdKG8!xLmCb7PCwCj7vM8JjKx_n7ZUVjW0Oj8Ih9T3YqU4I-JoGy7evTsc7U17emt3nnDmdXdchXxcKHi_6mVBt5QbKzj2$
>>
>> Let me know what you think.
> I tested various stable kernels. I got:
>
> With livepatch, fentry and fexit work on 6.3 kernels.
>
> On 6.4 and 6.5 kernels, the combination stops working since this commit:
>
> commit 60c8971899f3b34ad24857913c0784dab08962f0
> Author: Florent Revest <revest at chromium.org>
> Date:   2 years, 7 months ago
>
>      ftrace: Make DIRECT_CALLS work WITH_ARGS and !WITH_REGS
>
>
> On 6.5 kernels, it got fixed by the following two commits:
>
> commit a8b9cf62ade1bf17261a979fc97e40c2d7842353
> Author: Masami Hiramatsu (Google) <mhiramat at kernel.org>
> Date: 1 year, 9 months ago
> ftrace: Fix DIRECT_CALLS to use SAVE_REGS by default
>
> commit bdbddb109c75365d22ec4826f480c5e75869e1cb
> Author: Petr Pavlu <petr.pavlu at suse.com>
> Date:   1 year, 8 months ago
>
>      tracing: Fix HAVE_DYNAMIC_FTRACE_WITH_REGS ifdef
>
> I tried to cherry-pick 60c8971899f3b34ad24857913c0784dab08962f0
> and a8b9cf62ade1bf17261a979fc97e40c2d7842353, on top of 6.5.13
> kernel. Then, fentry and fexit both work with livepatch.


I see, thanks for testing! Is the reason it breaks so often is because 
this combination of having BPF
and llivepatch together on a system with intersection on same functions 
as relatively   rate event and
so regressions go easily unnoticed ? Isn't there any relevant automated 
testing in upstream that checks for
those types of breaks ?

Thanks,
Andrey

>
> Thanks,
> Song