Re: [PATCH v2 2/4] perf,uprobes: fix user stack traces in the presence of pending uretprobes
On Mon, Jun 24, 2024 at 5:39 PM Masami Hiramatsu wrote: > > On Mon, 24 Jun 2024 13:32:35 -0700 > Andrii Nakryiko wrote: > > > On Mon, Jun 17, 2024 at 3:37 PM Andrii Nakryiko > > wrote: > > > > > > On Tue, Jun 4, 2024 at 10:16 AM Andrii Nakryiko > > > wrote: > > > > > > > > On Tue, Jun 4, 2024 at 7:13 AM Masami Hiramatsu > > > > wrote: > > > > > > > > > > On Tue, 21 May 2024 18:38:43 -0700 > > > > > Andrii Nakryiko wrote: > > > > > > > > > > > When kernel has pending uretprobes installed, it hijacks original > > > > > > user > > > > > > function return address on the stack with a uretprobe trampoline > > > > > > address. There could be multiple such pending uretprobes (either on > > > > > > different user functions or on the same recursive one) at any given > > > > > > time within the same task. > > > > > > > > > > > > This approach interferes with the user stack trace capture logic, > > > > > > which > > > > > > would report suprising addresses (like 0x7fffe000) that > > > > > > correspond > > > > > > to a special "[uprobes]" section that kernel installs in the target > > > > > > process address space for uretprobe trampoline code, while > > > > > > logically it > > > > > > should be an address somewhere within the calling function of > > > > > > another > > > > > > traced user function. > > > > > > > > > > > > This is easy to correct for, though. Uprobes subsystem keeps track > > > > > > of > > > > > > pending uretprobes and records original return addresses. This > > > > > > patch is > > > > > > using this to do a post-processing step and restore each trampoline > > > > > > address entries with correct original return address. This is done > > > > > > only > > > > > > if there are pending uretprobes for current task. > > > > > > > > > > > > This is a similar approach to what fprobe/kretprobe infrastructure > > > > > > is > > > > > > doing when capturing kernel stack traces in the presence of pending > > > > > > return probes. > > > > > > > > > > > > > > > > This looks good to me because this trampoline information is only > > > > > managed in uprobes. And it should be provided when unwinding user > > > > > stack. > > > > > > > > > > Reviewed-by: Masami Hiramatsu (Google) > > > > > > > > > > Thank you! > > > > > > > > Great, thanks for reviewing, Masami! > > > > > > > > Would you take this fix through your tree, or where should it be routed > > > > to? > > > > > > > > > > Ping! What would you like me to do with this patch set? Should I > > > resend it without patch 3 (the one that tries to guess whether we are > > > at the entry to the function?), or did I manage to convince you that > > > this heuristic is OK, given perf's stack trace capturing logic already > > > makes heavy assumption of rbp register being used for frame pointer? > > > > > > Please let me know your preference, I could drop patch 3 and send it > > > separately, if that helps move the main fix forward. Thanks! > > > > Masami, > > > > Another week went by with absolutely no action or reaction from you. > > Is there any way I can help improve the collaboration here? > > OK, if there is no change without [3/4], let me pick the others on Thanks, Masami! Selftest is probably failing (as it expects correct stack trace), but that's ok, we can fix it up once linux-trace-kernel and bpf-next trees converge. > probes/for-next directly. [3/4] I need other x86 maintainer's > comments. And it should be handled by PMU maintainers. Sounds good, I'll repost it separately. Do I need to CC anyone else besides people on this thread already? > > Thanks, > > > > > > I'm preparing more patches for uprobes and about to submit them. If > > each reviewed and ready to be applied patch set has to sit idle for > > multiple weeks for no good reason, we all will soon be lost just plain > > forgetting the context in which the patch was prepared. > > > > Please, prioritize handling patches that are meant to be routed > > through your tree in a more timely fashion. Or propose some > > alternative acceptable arrangement. > > > > Thank you. > > > > > > > > > > > > > > > > Reported-by: Riham Selim > > > > > > Signed-off-by: Andrii Nakryiko > > > > > > --- > > > > > > kernel/events/callchain.c | 43 > > > > > > ++- > > > > > > kernel/events/uprobes.c | 9 > > > > > > 2 files changed, 51 insertions(+), 1 deletion(-) > > > > > > > > > > > > > > [...] > > > -- > Masami Hiramatsu (Google)
Re: [PATCH v2 2/4] perf,uprobes: fix user stack traces in the presence of pending uretprobes
On Mon, 24 Jun 2024 13:32:35 -0700 Andrii Nakryiko wrote: > On Mon, Jun 17, 2024 at 3:37 PM Andrii Nakryiko > wrote: > > > > On Tue, Jun 4, 2024 at 10:16 AM Andrii Nakryiko > > wrote: > > > > > > On Tue, Jun 4, 2024 at 7:13 AM Masami Hiramatsu > > > wrote: > > > > > > > > On Tue, 21 May 2024 18:38:43 -0700 > > > > Andrii Nakryiko wrote: > > > > > > > > > When kernel has pending uretprobes installed, it hijacks original user > > > > > function return address on the stack with a uretprobe trampoline > > > > > address. There could be multiple such pending uretprobes (either on > > > > > different user functions or on the same recursive one) at any given > > > > > time within the same task. > > > > > > > > > > This approach interferes with the user stack trace capture logic, > > > > > which > > > > > would report suprising addresses (like 0x7fffe000) that correspond > > > > > to a special "[uprobes]" section that kernel installs in the target > > > > > process address space for uretprobe trampoline code, while logically > > > > > it > > > > > should be an address somewhere within the calling function of another > > > > > traced user function. > > > > > > > > > > This is easy to correct for, though. Uprobes subsystem keeps track of > > > > > pending uretprobes and records original return addresses. This patch > > > > > is > > > > > using this to do a post-processing step and restore each trampoline > > > > > address entries with correct original return address. This is done > > > > > only > > > > > if there are pending uretprobes for current task. > > > > > > > > > > This is a similar approach to what fprobe/kretprobe infrastructure is > > > > > doing when capturing kernel stack traces in the presence of pending > > > > > return probes. > > > > > > > > > > > > > This looks good to me because this trampoline information is only > > > > managed in uprobes. And it should be provided when unwinding user > > > > stack. > > > > > > > > Reviewed-by: Masami Hiramatsu (Google) > > > > > > > > Thank you! > > > > > > Great, thanks for reviewing, Masami! > > > > > > Would you take this fix through your tree, or where should it be routed > > > to? > > > > > > > Ping! What would you like me to do with this patch set? Should I > > resend it without patch 3 (the one that tries to guess whether we are > > at the entry to the function?), or did I manage to convince you that > > this heuristic is OK, given perf's stack trace capturing logic already > > makes heavy assumption of rbp register being used for frame pointer? > > > > Please let me know your preference, I could drop patch 3 and send it > > separately, if that helps move the main fix forward. Thanks! > > Masami, > > Another week went by with absolutely no action or reaction from you. > Is there any way I can help improve the collaboration here? OK, if there is no change without [3/4], let me pick the others on probes/for-next directly. [3/4] I need other x86 maintainer's comments. And it should be handled by PMU maintainers. Thanks, > > I'm preparing more patches for uprobes and about to submit them. If > each reviewed and ready to be applied patch set has to sit idle for > multiple weeks for no good reason, we all will soon be lost just plain > forgetting the context in which the patch was prepared. > > Please, prioritize handling patches that are meant to be routed > through your tree in a more timely fashion. Or propose some > alternative acceptable arrangement. > > Thank you. > > > > > > > > > > > > Reported-by: Riham Selim > > > > > Signed-off-by: Andrii Nakryiko > > > > > --- > > > > > kernel/events/callchain.c | 43 > > > > > ++- > > > > > kernel/events/uprobes.c | 9 > > > > > 2 files changed, 51 insertions(+), 1 deletion(-) > > > > > > > > > > > [...] -- Masami Hiramatsu (Google)
Re: [PATCH v2 2/4] perf,uprobes: fix user stack traces in the presence of pending uretprobes
On Mon, Jun 17, 2024 at 3:37 PM Andrii Nakryiko wrote: > > On Tue, Jun 4, 2024 at 10:16 AM Andrii Nakryiko > wrote: > > > > On Tue, Jun 4, 2024 at 7:13 AM Masami Hiramatsu wrote: > > > > > > On Tue, 21 May 2024 18:38:43 -0700 > > > Andrii Nakryiko wrote: > > > > > > > When kernel has pending uretprobes installed, it hijacks original user > > > > function return address on the stack with a uretprobe trampoline > > > > address. There could be multiple such pending uretprobes (either on > > > > different user functions or on the same recursive one) at any given > > > > time within the same task. > > > > > > > > This approach interferes with the user stack trace capture logic, which > > > > would report suprising addresses (like 0x7fffe000) that correspond > > > > to a special "[uprobes]" section that kernel installs in the target > > > > process address space for uretprobe trampoline code, while logically it > > > > should be an address somewhere within the calling function of another > > > > traced user function. > > > > > > > > This is easy to correct for, though. Uprobes subsystem keeps track of > > > > pending uretprobes and records original return addresses. This patch is > > > > using this to do a post-processing step and restore each trampoline > > > > address entries with correct original return address. This is done only > > > > if there are pending uretprobes for current task. > > > > > > > > This is a similar approach to what fprobe/kretprobe infrastructure is > > > > doing when capturing kernel stack traces in the presence of pending > > > > return probes. > > > > > > > > > > This looks good to me because this trampoline information is only > > > managed in uprobes. And it should be provided when unwinding user > > > stack. > > > > > > Reviewed-by: Masami Hiramatsu (Google) > > > > > > Thank you! > > > > Great, thanks for reviewing, Masami! > > > > Would you take this fix through your tree, or where should it be routed to? > > > > Ping! What would you like me to do with this patch set? Should I > resend it without patch 3 (the one that tries to guess whether we are > at the entry to the function?), or did I manage to convince you that > this heuristic is OK, given perf's stack trace capturing logic already > makes heavy assumption of rbp register being used for frame pointer? > > Please let me know your preference, I could drop patch 3 and send it > separately, if that helps move the main fix forward. Thanks! Masami, Another week went by with absolutely no action or reaction from you. Is there any way I can help improve the collaboration here? I'm preparing more patches for uprobes and about to submit them. If each reviewed and ready to be applied patch set has to sit idle for multiple weeks for no good reason, we all will soon be lost just plain forgetting the context in which the patch was prepared. Please, prioritize handling patches that are meant to be routed through your tree in a more timely fashion. Or propose some alternative acceptable arrangement. Thank you. > > > > > > > > Reported-by: Riham Selim > > > > Signed-off-by: Andrii Nakryiko > > > > --- > > > > kernel/events/callchain.c | 43 ++- > > > > kernel/events/uprobes.c | 9 > > > > 2 files changed, 51 insertions(+), 1 deletion(-) > > > > > > > > [...]
Re: [PATCH v2 2/4] perf,uprobes: fix user stack traces in the presence of pending uretprobes
On Tue, Jun 4, 2024 at 10:16 AM Andrii Nakryiko wrote: > > On Tue, Jun 4, 2024 at 7:13 AM Masami Hiramatsu wrote: > > > > On Tue, 21 May 2024 18:38:43 -0700 > > Andrii Nakryiko wrote: > > > > > When kernel has pending uretprobes installed, it hijacks original user > > > function return address on the stack with a uretprobe trampoline > > > address. There could be multiple such pending uretprobes (either on > > > different user functions or on the same recursive one) at any given > > > time within the same task. > > > > > > This approach interferes with the user stack trace capture logic, which > > > would report suprising addresses (like 0x7fffe000) that correspond > > > to a special "[uprobes]" section that kernel installs in the target > > > process address space for uretprobe trampoline code, while logically it > > > should be an address somewhere within the calling function of another > > > traced user function. > > > > > > This is easy to correct for, though. Uprobes subsystem keeps track of > > > pending uretprobes and records original return addresses. This patch is > > > using this to do a post-processing step and restore each trampoline > > > address entries with correct original return address. This is done only > > > if there are pending uretprobes for current task. > > > > > > This is a similar approach to what fprobe/kretprobe infrastructure is > > > doing when capturing kernel stack traces in the presence of pending > > > return probes. > > > > > > > This looks good to me because this trampoline information is only > > managed in uprobes. And it should be provided when unwinding user > > stack. > > > > Reviewed-by: Masami Hiramatsu (Google) > > > > Thank you! > > Great, thanks for reviewing, Masami! > > Would you take this fix through your tree, or where should it be routed to? > Ping! What would you like me to do with this patch set? Should I resend it without patch 3 (the one that tries to guess whether we are at the entry to the function?), or did I manage to convince you that this heuristic is OK, given perf's stack trace capturing logic already makes heavy assumption of rbp register being used for frame pointer? Please let me know your preference, I could drop patch 3 and send it separately, if that helps move the main fix forward. Thanks! > > > > > Reported-by: Riham Selim > > > Signed-off-by: Andrii Nakryiko > > > --- > > > kernel/events/callchain.c | 43 ++- > > > kernel/events/uprobes.c | 9 > > > 2 files changed, 51 insertions(+), 1 deletion(-) > > > > > [...]
Re: [PATCH v2 2/4] perf,uprobes: fix user stack traces in the presence of pending uretprobes
On Tue, Jun 4, 2024 at 7:13 AM Masami Hiramatsu wrote: > > On Tue, 21 May 2024 18:38:43 -0700 > Andrii Nakryiko wrote: > > > When kernel has pending uretprobes installed, it hijacks original user > > function return address on the stack with a uretprobe trampoline > > address. There could be multiple such pending uretprobes (either on > > different user functions or on the same recursive one) at any given > > time within the same task. > > > > This approach interferes with the user stack trace capture logic, which > > would report suprising addresses (like 0x7fffe000) that correspond > > to a special "[uprobes]" section that kernel installs in the target > > process address space for uretprobe trampoline code, while logically it > > should be an address somewhere within the calling function of another > > traced user function. > > > > This is easy to correct for, though. Uprobes subsystem keeps track of > > pending uretprobes and records original return addresses. This patch is > > using this to do a post-processing step and restore each trampoline > > address entries with correct original return address. This is done only > > if there are pending uretprobes for current task. > > > > This is a similar approach to what fprobe/kretprobe infrastructure is > > doing when capturing kernel stack traces in the presence of pending > > return probes. > > > > This looks good to me because this trampoline information is only > managed in uprobes. And it should be provided when unwinding user > stack. > > Reviewed-by: Masami Hiramatsu (Google) > > Thank you! Great, thanks for reviewing, Masami! Would you take this fix through your tree, or where should it be routed to? > > > Reported-by: Riham Selim > > Signed-off-by: Andrii Nakryiko > > --- > > kernel/events/callchain.c | 43 ++- > > kernel/events/uprobes.c | 9 > > 2 files changed, 51 insertions(+), 1 deletion(-) > > [...]
Re: [PATCH v2 2/4] perf,uprobes: fix user stack traces in the presence of pending uretprobes
On Tue, 21 May 2024 18:38:43 -0700
Andrii Nakryiko wrote:
> When kernel has pending uretprobes installed, it hijacks original user
> function return address on the stack with a uretprobe trampoline
> address. There could be multiple such pending uretprobes (either on
> different user functions or on the same recursive one) at any given
> time within the same task.
>
> This approach interferes with the user stack trace capture logic, which
> would report suprising addresses (like 0x7fffe000) that correspond
> to a special "[uprobes]" section that kernel installs in the target
> process address space for uretprobe trampoline code, while logically it
> should be an address somewhere within the calling function of another
> traced user function.
>
> This is easy to correct for, though. Uprobes subsystem keeps track of
> pending uretprobes and records original return addresses. This patch is
> using this to do a post-processing step and restore each trampoline
> address entries with correct original return address. This is done only
> if there are pending uretprobes for current task.
>
> This is a similar approach to what fprobe/kretprobe infrastructure is
> doing when capturing kernel stack traces in the presence of pending
> return probes.
>
This looks good to me because this trampoline information is only
managed in uprobes. And it should be provided when unwinding user
stack.
Reviewed-by: Masami Hiramatsu (Google)
Thank you!
> Reported-by: Riham Selim
> Signed-off-by: Andrii Nakryiko
> ---
> kernel/events/callchain.c | 43 ++-
> kernel/events/uprobes.c | 9
> 2 files changed, 51 insertions(+), 1 deletion(-)
>
> diff --git a/kernel/events/callchain.c b/kernel/events/callchain.c
> index 1273be84392c..b17e3323f7f6 100644
> --- a/kernel/events/callchain.c
> +++ b/kernel/events/callchain.c
> @@ -11,6 +11,7 @@
> #include
> #include
> #include
> +#include
>
> #include "internal.h"
>
> @@ -176,13 +177,51 @@ put_callchain_entry(int rctx)
> put_recursion_context(this_cpu_ptr(callchain_recursion), rctx);
> }
>
> +static void fixup_uretprobe_trampoline_entries(struct perf_callchain_entry
> *entry,
> +int start_entry_idx)
> +{
> +#ifdef CONFIG_UPROBES
> + struct uprobe_task *utask = current->utask;
> + struct return_instance *ri;
> + __u64 *cur_ip, *last_ip, tramp_addr;
> +
> + if (likely(!utask || !utask->return_instances))
> + return;
> +
> + cur_ip = &entry->ip[start_entry_idx];
> + last_ip = &entry->ip[entry->nr - 1];
> + ri = utask->return_instances;
> + tramp_addr = uprobe_get_trampoline_vaddr();
> +
> + /*
> + * If there are pending uretprobes for the current thread, they are
> + * recorded in a list inside utask->return_instances; each such
> + * pending uretprobe replaces traced user function's return address on
> + * the stack, so when stack trace is captured, instead of seeing
> + * actual function's return address, we'll have one or many uretprobe
> + * trampoline addresses in the stack trace, which are not helpful and
> + * misleading to users.
> + * So here we go over the pending list of uretprobes, and each
> + * encountered trampoline address is replaced with actual return
> + * address.
> + */
> + while (ri && cur_ip <= last_ip) {
> + if (*cur_ip == tramp_addr) {
> + *cur_ip = ri->orig_ret_vaddr;
> + ri = ri->next;
> + }
> + cur_ip++;
> + }
> +#endif
> +}
> +
> struct perf_callchain_entry *
> get_perf_callchain(struct pt_regs *regs, u32 init_nr, bool kernel, bool user,
> u32 max_stack, bool crosstask, bool add_mark)
> {
> struct perf_callchain_entry *entry;
> struct perf_callchain_entry_ctx ctx;
> - int rctx;
> + int rctx, start_entry_idx;
>
> entry = get_callchain_entry(&rctx);
> if (!entry)
> @@ -215,7 +254,9 @@ get_perf_callchain(struct pt_regs *regs, u32 init_nr,
> bool kernel, bool user,
> if (add_mark)
> perf_callchain_store_context(&ctx,
> PERF_CONTEXT_USER);
>
> + start_entry_idx = entry->nr;
> perf_callchain_user(&ctx, regs);
> + fixup_uretprobe_trampoline_entries(entry,
> start_entry_idx);
> }
> }
>
> diff --git a/kernel/events/uprobes.c b/kernel/events/uprobes.c
> index d60d24f0f2f4..1c99380dc89d 100644
> --- a/kernel/events/uprobes.c
> +++ b/kernel/events/uprobes.c
> @@ -2149,6 +2149,15 @@ static void handle_trampoline(struct pt_regs *regs)
>
> instruction_pointer_set(regs, ri->orig_ret_vaddr);
> do {
> + /* pop current instance from the stack of pending
> return instances,
> + * as it's not pending anymore: we just
[PATCH v2 2/4] perf,uprobes: fix user stack traces in the presence of pending uretprobes
When kernel has pending uretprobes installed, it hijacks original user
function return address on the stack with a uretprobe trampoline
address. There could be multiple such pending uretprobes (either on
different user functions or on the same recursive one) at any given
time within the same task.
This approach interferes with the user stack trace capture logic, which
would report suprising addresses (like 0x7fffe000) that correspond
to a special "[uprobes]" section that kernel installs in the target
process address space for uretprobe trampoline code, while logically it
should be an address somewhere within the calling function of another
traced user function.
This is easy to correct for, though. Uprobes subsystem keeps track of
pending uretprobes and records original return addresses. This patch is
using this to do a post-processing step and restore each trampoline
address entries with correct original return address. This is done only
if there are pending uretprobes for current task.
This is a similar approach to what fprobe/kretprobe infrastructure is
doing when capturing kernel stack traces in the presence of pending
return probes.
Reported-by: Riham Selim
Signed-off-by: Andrii Nakryiko
---
kernel/events/callchain.c | 43 ++-
kernel/events/uprobes.c | 9
2 files changed, 51 insertions(+), 1 deletion(-)
diff --git a/kernel/events/callchain.c b/kernel/events/callchain.c
index 1273be84392c..b17e3323f7f6 100644
--- a/kernel/events/callchain.c
+++ b/kernel/events/callchain.c
@@ -11,6 +11,7 @@
#include
#include
#include
+#include
#include "internal.h"
@@ -176,13 +177,51 @@ put_callchain_entry(int rctx)
put_recursion_context(this_cpu_ptr(callchain_recursion), rctx);
}
+static void fixup_uretprobe_trampoline_entries(struct perf_callchain_entry
*entry,
+ int start_entry_idx)
+{
+#ifdef CONFIG_UPROBES
+ struct uprobe_task *utask = current->utask;
+ struct return_instance *ri;
+ __u64 *cur_ip, *last_ip, tramp_addr;
+
+ if (likely(!utask || !utask->return_instances))
+ return;
+
+ cur_ip = &entry->ip[start_entry_idx];
+ last_ip = &entry->ip[entry->nr - 1];
+ ri = utask->return_instances;
+ tramp_addr = uprobe_get_trampoline_vaddr();
+
+ /*
+* If there are pending uretprobes for the current thread, they are
+* recorded in a list inside utask->return_instances; each such
+* pending uretprobe replaces traced user function's return address on
+* the stack, so when stack trace is captured, instead of seeing
+* actual function's return address, we'll have one or many uretprobe
+* trampoline addresses in the stack trace, which are not helpful and
+* misleading to users.
+* So here we go over the pending list of uretprobes, and each
+* encountered trampoline address is replaced with actual return
+* address.
+*/
+ while (ri && cur_ip <= last_ip) {
+ if (*cur_ip == tramp_addr) {
+ *cur_ip = ri->orig_ret_vaddr;
+ ri = ri->next;
+ }
+ cur_ip++;
+ }
+#endif
+}
+
struct perf_callchain_entry *
get_perf_callchain(struct pt_regs *regs, u32 init_nr, bool kernel, bool user,
u32 max_stack, bool crosstask, bool add_mark)
{
struct perf_callchain_entry *entry;
struct perf_callchain_entry_ctx ctx;
- int rctx;
+ int rctx, start_entry_idx;
entry = get_callchain_entry(&rctx);
if (!entry)
@@ -215,7 +254,9 @@ get_perf_callchain(struct pt_regs *regs, u32 init_nr, bool
kernel, bool user,
if (add_mark)
perf_callchain_store_context(&ctx,
PERF_CONTEXT_USER);
+ start_entry_idx = entry->nr;
perf_callchain_user(&ctx, regs);
+ fixup_uretprobe_trampoline_entries(entry,
start_entry_idx);
}
}
diff --git a/kernel/events/uprobes.c b/kernel/events/uprobes.c
index d60d24f0f2f4..1c99380dc89d 100644
--- a/kernel/events/uprobes.c
+++ b/kernel/events/uprobes.c
@@ -2149,6 +2149,15 @@ static void handle_trampoline(struct pt_regs *regs)
instruction_pointer_set(regs, ri->orig_ret_vaddr);
do {
+ /* pop current instance from the stack of pending
return instances,
+* as it's not pending anymore: we just fixed up
original
+* instruction pointer in regs and are about to call
handlers;
+* this allows fixup_uretprobe_trampoline_entries() to
properly fix up
+* captured stack traces from uretprobe handlers, in
which pending
+* trampoline addresses on the stack are replaced with
correct
+
