Message ID | 1560420444-25737-1-git-send-email-anshuman.khandual@arm.com (mailing list archive) |
---|---|
State | New, archived |
Headers | show |
Series | mm: Generalize and rename notify_page_fault() as kprobe_page_fault() | expand |
+CC Masami San On 6/13/19 3:07 AM, Anshuman Khandual wrote: > Questions: > > AFAICT there is no equivalent of erstwhile notify_page_fault() during page > fault handling in arc and mips archs which can call this generic function. > Please let me know if that is not the case. For ARC do_page_fault() is entered for MMU exceptions (TLB Miss, access violations r/w/x etc). kprobes uses a combination of UNIMP_S and TRAP_S instructions which don't funnel into do_page_fault(). UINMP_S leads to instr_service do_insterror_or_kprobe notify_die(DIE_IERR) kprobe_exceptions_notify arc_kprobe_handler TRAP_S 2 leads to EV_Trap do_non_swi_trap trap_is_kprobe notify_die(DIE_TRAP) kprobe_exceptions_notify arc_post_kprobe_handler But indeed we are *not* calling into kprobe_fault_handler() - from eithet of those paths and not sure if the existing arc*_kprobe_handler() combination does the equivalent in tandem. -Vineet
On Thu, 13 Jun 2019 15:37:24 +0530 Anshuman Khandual <anshuman.khandual@arm.com> wrote: > Architectures which support kprobes have very similar boilerplate around > calling kprobe_fault_handler(). Use a helper function in kprobes.h to unify > them, based on the x86 code. > > This changes the behaviour for other architectures when preemption is > enabled. Previously, they would have disabled preemption while calling the > kprobe handler. However, preemption would be disabled if this fault was > due to a kprobe, so we know the fault was not due to a kprobe handler and > can simply return failure. > > This behaviour was introduced in the commit a980c0ef9f6d ("x86/kprobes: > Refactor kprobes_fault() like kprobe_exceptions_notify()") > > ... > > --- a/arch/arm/mm/fault.c > +++ b/arch/arm/mm/fault.c > @@ -30,28 +30,6 @@ > > #ifdef CONFIG_MMU > > -#ifdef CONFIG_KPROBES > -static inline int notify_page_fault(struct pt_regs *regs, unsigned int fsr) Some architectures make this `static inline'. Others make it `nokprobes_inline', others make it `static inline __kprobes'. The latter seems weird - why try to put an inline function into .kprobes.text? So.. what's the best thing to do here? You chose `static nokprobe_inline' - is that the best approach, if so why? Does kprobe_page_fault() actually need to be inlined? Also, some architectures had notify_page_fault returning int, others bool. You chose bool and that seems appropriate and all callers are OK with that.
On 06/14/2019 01:34 AM, Andrew Morton wrote: > On Thu, 13 Jun 2019 15:37:24 +0530 Anshuman Khandual <anshuman.khandual@arm.com> wrote: > >> Architectures which support kprobes have very similar boilerplate around >> calling kprobe_fault_handler(). Use a helper function in kprobes.h to unify >> them, based on the x86 code. >> >> This changes the behaviour for other architectures when preemption is >> enabled. Previously, they would have disabled preemption while calling the >> kprobe handler. However, preemption would be disabled if this fault was >> due to a kprobe, so we know the fault was not due to a kprobe handler and >> can simply return failure. >> >> This behaviour was introduced in the commit a980c0ef9f6d ("x86/kprobes: >> Refactor kprobes_fault() like kprobe_exceptions_notify()") >> >> ... >> >> --- a/arch/arm/mm/fault.c >> +++ b/arch/arm/mm/fault.c >> @@ -30,28 +30,6 @@ >> >> #ifdef CONFIG_MMU >> >> -#ifdef CONFIG_KPROBES >> -static inline int notify_page_fault(struct pt_regs *regs, unsigned int fsr) > > Some architectures make this `static inline'. Others make it > `nokprobes_inline', others make it `static inline __kprobes'. The > latter seems weird - why try to put an inline function into > .kprobes.text? > > So.. what's the best thing to do here? You chose `static > nokprobe_inline' - is that the best approach, if so why? Does > kprobe_page_fault() actually need to be inlined? Matthew had suggested that (nokprobe_-inline) based on current x86 implementation. But every architecture already had an inlined definition which I did not want to deviate from. > > Also, some architectures had notify_page_fault returning int, others > bool. You chose bool and that seems appropriate and all callers are OK > with that. I would believe so. No one has complained yet :)
+CC Masami San, Eugeniy On 6/13/19 10:57 AM, Vineet Gupta wrote: > On 6/13/19 3:07 AM, Anshuman Khandual wrote: >> Questions: >> >> AFAICT there is no equivalent of erstwhile notify_page_fault() during page >> fault handling in arc and mips archs which can call this generic function. >> Please let me know if that is not the case. > > For ARC do_page_fault() is entered for MMU exceptions (TLB Miss, access violations > r/w/x etc). kprobes uses a combination of UNIMP_S and TRAP_S instructions which > don't funnel into do_page_fault(). > > UINMP_S leads to > > instr_service > do_insterror_or_kprobe > notify_die(DIE_IERR) > kprobe_exceptions_notify > arc_kprobe_handler > > > TRAP_S 2 leads to > > EV_Trap > do_non_swi_trap > trap_is_kprobe > notify_die(DIE_TRAP) > kprobe_exceptions_notify > arc_post_kprobe_handler > > But indeed we are *not* calling into kprobe_fault_handler() - from eithet of those > paths and not sure if the existing arc*_kprobe_handler() combination does the > equivalent in tandem. @Eugeniy can you please investigate this - do we have krpobes bit rot in ARC port. -Vineet
Hi, On Tue, 18 Jun 2019 08:56:33 -0700 Vineet Gupta <Vineet.Gupta1@synopsys.com> wrote: > +CC Masami San, Eugeniy > > On 6/13/19 10:57 AM, Vineet Gupta wrote: > > > > On 6/13/19 3:07 AM, Anshuman Khandual wrote: > >> Questions: > >> > >> AFAICT there is no equivalent of erstwhile notify_page_fault() during page > >> fault handling in arc and mips archs which can call this generic function. > >> Please let me know if that is not the case. > > > > For ARC do_page_fault() is entered for MMU exceptions (TLB Miss, access violations > > r/w/x etc). kprobes uses a combination of UNIMP_S and TRAP_S instructions which > > don't funnel into do_page_fault(). > > > > UINMP_S leads to > > > > instr_service > > do_insterror_or_kprobe > > notify_die(DIE_IERR) > > kprobe_exceptions_notify > > arc_kprobe_handler > > > > > > TRAP_S 2 leads to > > > > EV_Trap > > do_non_swi_trap > > trap_is_kprobe > > notify_die(DIE_TRAP) > > kprobe_exceptions_notify > > arc_post_kprobe_handler > > > > But indeed we are *not* calling into kprobe_fault_handler() - from eithet of those > > paths and not sure if the existing arc*_kprobe_handler() combination does the > > equivalent in tandem. Interesting, it seems that the kprobe_fault_handler() has never been called. Anyway, it is used for handling a page fault in kprobe's user handler or single stepping. And a page fault in user handler will not hard to fix up. Only a hard case is a page fault in single stepping. If ARC's kprobes using single-stepping on copied buffer, it may crashes kernel, since fixup code can not find correct address without kprobe_fault_handler. Thank you, > > @Eugeniy can you please investigate this - do we have krpobes bit rot in ARC port. > > -Vineet > >
Hi, On Thu, Jun 13, 2019 at 03:37:24PM +0530, Anshuman Khandual wrote: > Architectures which support kprobes have very similar boilerplate around > calling kprobe_fault_handler(). Use a helper function in kprobes.h to unify > them, based on the x86 code. > > This changes the behaviour for other architectures when preemption is > enabled. Previously, they would have disabled preemption while calling the > kprobe handler. However, preemption would be disabled if this fault was > due to a kprobe, so we know the fault was not due to a kprobe handler and > can simply return failure. > > This behaviour was introduced in the commit a980c0ef9f6d ("x86/kprobes: > Refactor kprobes_fault() like kprobe_exceptions_notify()") > With this patch applied, parisc:allmodconfig images no longer build. In file included from arch/parisc/mm/fixmap.c:8: include/linux/kprobes.h: In function 'kprobe_page_fault': include/linux/kprobes.h:477:9: error: implicit declaration of function 'kprobe_fault_handler'; did you mean 'kprobe_page_fault'? Reverting the patch fixes the problem. Guenter
Hello Guenter, On 06/29/2019 08:20 PM, Guenter Roeck wrote: > Hi, > > On Thu, Jun 13, 2019 at 03:37:24PM +0530, Anshuman Khandual wrote: >> Architectures which support kprobes have very similar boilerplate around >> calling kprobe_fault_handler(). Use a helper function in kprobes.h to unify >> them, based on the x86 code. >> >> This changes the behaviour for other architectures when preemption is >> enabled. Previously, they would have disabled preemption while calling the >> kprobe handler. However, preemption would be disabled if this fault was >> due to a kprobe, so we know the fault was not due to a kprobe handler and >> can simply return failure. >> >> This behaviour was introduced in the commit a980c0ef9f6d ("x86/kprobes: >> Refactor kprobes_fault() like kprobe_exceptions_notify()") >> > > With this patch applied, parisc:allmodconfig images no longer build. > > In file included from arch/parisc/mm/fixmap.c:8: > include/linux/kprobes.h: In function 'kprobe_page_fault': > include/linux/kprobes.h:477:9: error: > implicit declaration of function 'kprobe_fault_handler'; did you mean 'kprobe_page_fault'? Yikes.. Arch parisc does not even define (unlike mips which did but never exported) now required function kprobe_fault_handler() when CONFIG_KPROBES is enabled. I believe rather than defining one stub version only for parsic it would be better to have an weak symbol generic stub definition for kprobe_fault_handler() in file include/linux/kprobes.h when CONFIG_KPROBES is enabled along side the other stub definition when !CONFIG_KPROBES. But arch which wants to use kprobe_page_fault() cannot use stub kprobe_fault_handler() definition and will have to provide one. I will probably add a comment regarding this. > > Reverting the patch fixes the problem. > > Guenter > Thanks for reporting the problem.
diff --git a/arch/arm/mm/fault.c b/arch/arm/mm/fault.c index 58f69fa..94a97a4 100644 --- a/arch/arm/mm/fault.c +++ b/arch/arm/mm/fault.c @@ -30,28 +30,6 @@ #ifdef CONFIG_MMU -#ifdef CONFIG_KPROBES -static inline int notify_page_fault(struct pt_regs *regs, unsigned int fsr) -{ - int ret = 0; - - if (!user_mode(regs)) { - /* kprobe_running() needs smp_processor_id() */ - preempt_disable(); - if (kprobe_running() && kprobe_fault_handler(regs, fsr)) - ret = 1; - preempt_enable(); - } - - return ret; -} -#else -static inline int notify_page_fault(struct pt_regs *regs, unsigned int fsr) -{ - return 0; -} -#endif - /* * This is useful to dump out the page tables associated with * 'addr' in mm 'mm'. @@ -266,7 +244,7 @@ do_page_fault(unsigned long addr, unsigned int fsr, struct pt_regs *regs) vm_fault_t fault; unsigned int flags = FAULT_FLAG_ALLOW_RETRY | FAULT_FLAG_KILLABLE; - if (notify_page_fault(regs, fsr)) + if (kprobe_page_fault(regs, fsr)) return 0; tsk = current; diff --git a/arch/arm64/mm/fault.c b/arch/arm64/mm/fault.c index a30818e..8fe4bbc 100644 --- a/arch/arm64/mm/fault.c +++ b/arch/arm64/mm/fault.c @@ -70,28 +70,6 @@ static inline const struct fault_info *esr_to_debug_fault_info(unsigned int esr) return debug_fault_info + DBG_ESR_EVT(esr); } -#ifdef CONFIG_KPROBES -static inline int notify_page_fault(struct pt_regs *regs, unsigned int esr) -{ - int ret = 0; - - /* kprobe_running() needs smp_processor_id() */ - if (!user_mode(regs)) { - preempt_disable(); - if (kprobe_running() && kprobe_fault_handler(regs, esr)) - ret = 1; - preempt_enable(); - } - - return ret; -} -#else -static inline int notify_page_fault(struct pt_regs *regs, unsigned int esr) -{ - return 0; -} -#endif - static void data_abort_decode(unsigned int esr) { pr_alert("Data abort info:\n"); @@ -446,7 +424,7 @@ static int __kprobes do_page_fault(unsigned long addr, unsigned int esr, unsigned long vm_flags = VM_READ | VM_WRITE; unsigned int mm_flags = FAULT_FLAG_ALLOW_RETRY | FAULT_FLAG_KILLABLE; - if (notify_page_fault(regs, esr)) + if (kprobe_page_fault(regs, esr)) return 0; tsk = current; diff --git a/arch/ia64/mm/fault.c b/arch/ia64/mm/fault.c index 5baeb02..22582f8 100644 --- a/arch/ia64/mm/fault.c +++ b/arch/ia64/mm/fault.c @@ -21,28 +21,6 @@ extern int die(char *, struct pt_regs *, long); -#ifdef CONFIG_KPROBES -static inline int notify_page_fault(struct pt_regs *regs, int trap) -{ - int ret = 0; - - if (!user_mode(regs)) { - /* kprobe_running() needs smp_processor_id() */ - preempt_disable(); - if (kprobe_running() && kprobe_fault_handler(regs, trap)) - ret = 1; - preempt_enable(); - } - - return ret; -} -#else -static inline int notify_page_fault(struct pt_regs *regs, int trap) -{ - return 0; -} -#endif - /* * Return TRUE if ADDRESS points at a page in the kernel's mapped segment * (inside region 5, on ia64) and that page is present. @@ -116,7 +94,7 @@ ia64_do_page_fault (unsigned long address, unsigned long isr, struct pt_regs *re /* * This is to handle the kprobes on user space access instructions */ - if (notify_page_fault(regs, TRAP_BRKPT)) + if (kprobe_page_fault(regs, TRAP_BRKPT)) return; if (user_mode(regs)) diff --git a/arch/powerpc/mm/fault.c b/arch/powerpc/mm/fault.c index ec6b7ad..bc4e1af 100644 --- a/arch/powerpc/mm/fault.c +++ b/arch/powerpc/mm/fault.c @@ -42,26 +42,6 @@ #include <asm/debug.h> #include <asm/kup.h> -static inline bool notify_page_fault(struct pt_regs *regs) -{ - bool ret = false; - -#ifdef CONFIG_KPROBES - /* kprobe_running() needs smp_processor_id() */ - if (!user_mode(regs)) { - preempt_disable(); - if (kprobe_running() && kprobe_fault_handler(regs, 11)) - ret = true; - preempt_enable(); - } -#endif /* CONFIG_KPROBES */ - - if (unlikely(debugger_fault_handler(regs))) - ret = true; - - return ret; -} - /* * Check whether the instruction inst is a store using * an update addressing form which will update r1. @@ -462,8 +442,9 @@ static int __do_page_fault(struct pt_regs *regs, unsigned long address, int is_write = page_fault_is_write(error_code); vm_fault_t fault, major = 0; bool must_retry = false; + bool kprobe_fault = kprobe_page_fault(regs, 11); - if (notify_page_fault(regs)) + if (unlikely(debugger_fault_handler(regs) || kprobe_fault)) return 0; if (unlikely(page_fault_is_bad(error_code))) { diff --git a/arch/s390/mm/fault.c b/arch/s390/mm/fault.c index df75d57..1aaae2c 100644 --- a/arch/s390/mm/fault.c +++ b/arch/s390/mm/fault.c @@ -67,20 +67,6 @@ static int __init fault_init(void) } early_initcall(fault_init); -static inline int notify_page_fault(struct pt_regs *regs) -{ - int ret = 0; - - /* kprobe_running() needs smp_processor_id() */ - if (kprobes_built_in() && !user_mode(regs)) { - preempt_disable(); - if (kprobe_running() && kprobe_fault_handler(regs, 14)) - ret = 1; - preempt_enable(); - } - return ret; -} - /* * Find out which address space caused the exception. */ @@ -414,7 +400,7 @@ static inline vm_fault_t do_exception(struct pt_regs *regs, int access) */ clear_pt_regs_flag(regs, PIF_PER_TRAP); - if (notify_page_fault(regs)) + if (kprobe_page_fault(regs, 14)) return 0; mm = tsk->mm; diff --git a/arch/sh/mm/fault.c b/arch/sh/mm/fault.c index 6defd2c6..74cd4ac 100644 --- a/arch/sh/mm/fault.c +++ b/arch/sh/mm/fault.c @@ -24,20 +24,6 @@ #include <asm/tlbflush.h> #include <asm/traps.h> -static inline int notify_page_fault(struct pt_regs *regs, int trap) -{ - int ret = 0; - - if (kprobes_built_in() && !user_mode(regs)) { - preempt_disable(); - if (kprobe_running() && kprobe_fault_handler(regs, trap)) - ret = 1; - preempt_enable(); - } - - return ret; -} - static void force_sig_info_fault(int si_signo, int si_code, unsigned long address, struct task_struct *tsk) @@ -415,14 +401,14 @@ asmlinkage void __kprobes do_page_fault(struct pt_regs *regs, if (unlikely(fault_in_kernel_space(address))) { if (vmalloc_fault(address) >= 0) return; - if (notify_page_fault(regs, vec)) + if (kprobe_page_fault(regs, vec)) return; bad_area_nosemaphore(regs, error_code, address); return; } - if (unlikely(notify_page_fault(regs, vec))) + if (unlikely(kprobe_page_fault(regs, vec))) return; /* Only enable interrupts if they were on before the fault */ diff --git a/arch/sparc/mm/fault_64.c b/arch/sparc/mm/fault_64.c index 8f8a604..6865f9c 100644 --- a/arch/sparc/mm/fault_64.c +++ b/arch/sparc/mm/fault_64.c @@ -38,20 +38,6 @@ int show_unhandled_signals = 1; -static inline __kprobes int notify_page_fault(struct pt_regs *regs) -{ - int ret = 0; - - /* kprobe_running() needs smp_processor_id() */ - if (kprobes_built_in() && !user_mode(regs)) { - preempt_disable(); - if (kprobe_running() && kprobe_fault_handler(regs, 0)) - ret = 1; - preempt_enable(); - } - return ret; -} - static void __kprobes unhandled_fault(unsigned long address, struct task_struct *tsk, struct pt_regs *regs) @@ -285,7 +271,7 @@ asmlinkage void __kprobes do_sparc64_fault(struct pt_regs *regs) fault_code = get_thread_fault_code(); - if (notify_page_fault(regs)) + if (kprobe_page_fault(regs, 0)) goto exit_exception; si_code = SEGV_MAPERR; diff --git a/arch/x86/mm/fault.c b/arch/x86/mm/fault.c index 46df4c6..5400f4e 100644 --- a/arch/x86/mm/fault.c +++ b/arch/x86/mm/fault.c @@ -46,23 +46,6 @@ kmmio_fault(struct pt_regs *regs, unsigned long addr) return 0; } -static nokprobe_inline int kprobes_fault(struct pt_regs *regs) -{ - if (!kprobes_built_in()) - return 0; - if (user_mode(regs)) - return 0; - /* - * To be potentially processing a kprobe fault and to be allowed to call - * kprobe_running(), we have to be non-preemptible. - */ - if (preemptible()) - return 0; - if (!kprobe_running()) - return 0; - return kprobe_fault_handler(regs, X86_TRAP_PF); -} - /* * Prefetch quirks: * @@ -1280,7 +1263,7 @@ do_kern_addr_fault(struct pt_regs *regs, unsigned long hw_error_code, return; /* kprobes don't want to hook the spurious faults: */ - if (kprobes_fault(regs)) + if (kprobe_page_fault(regs, X86_TRAP_PF)) return; /* @@ -1311,7 +1294,7 @@ void do_user_addr_fault(struct pt_regs *regs, mm = tsk->mm; /* kprobes don't want to hook the spurious faults: */ - if (unlikely(kprobes_fault(regs))) + if (unlikely(kprobe_page_fault(regs, X86_TRAP_PF))) return; /* diff --git a/include/linux/kprobes.h b/include/linux/kprobes.h index 443d980..04bdaf0 100644 --- a/include/linux/kprobes.h +++ b/include/linux/kprobes.h @@ -458,4 +458,23 @@ static inline bool is_kprobe_optinsn_slot(unsigned long addr) } #endif +/* Returns true if kprobes handled the fault */ +static nokprobe_inline bool kprobe_page_fault(struct pt_regs *regs, + unsigned int trap) +{ + if (!kprobes_built_in()) + return false; + if (user_mode(regs)) + return false; + /* + * To be potentially processing a kprobe fault and to be allowed + * to call kprobe_running(), we have to be non-preemptible. + */ + if (preemptible()) + return false; + if (!kprobe_running()) + return false; + return kprobe_fault_handler(regs, trap); +} + #endif /* _LINUX_KPROBES_H */