From nobody Sat Nov 30 10:32:12 2024 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C6BB623741; Mon, 9 Sep 2024 22:49:11 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1725922151; cv=none; b=UVxe2kL0f8ZaCIlTzG1UZvi7YJkUzcO/a8xE5EJOXeUWO8Qozzs3kBxStJzsr0o9OAP1zadfiDBdbsNDJLIE+L4zO0WkSiO+/DWozIONp88nipgl7cU9f3ySaK6UOBpcwT8rg+2iz/Yg+FpDe1EYizOJCrWb7VeiHfJ1olD2JGY= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1725922151; c=relaxed/simple; bh=zoVReCc/17nWZtG2T0SyXvJwJI8bMpmSZ/W8Nvtbwps=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=HLxgjvKZY079YEiA4Uchea7D4CBDcxcRZchhOQsMMZKtFGKptt/70vCu72iSEfRJNxoFyW41PXh5nJFswZ6bILWkyI3Zt0szR4+cmtlpoKzd+KrxyatOCmE+MQJRPskH4dg/xUUY12Uu5/Z8dAHVBnWXw8cqloOHSqtdr8FDk/Y= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=YtPC6RMw; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="YtPC6RMw" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 2F3C3C4CEC6; Mon, 9 Sep 2024 22:49:11 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1725922151; bh=zoVReCc/17nWZtG2T0SyXvJwJI8bMpmSZ/W8Nvtbwps=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=YtPC6RMwKXW3kTlqUTK6S5eRZ1o48YfVGpHDklhRq2biSIe9JB47yhgpmTq6QsX5D HQAyQmIWS7UPGUeEmdBminL+olyRDgiuf3WIUnNH6KXcnHoA9BKR4c36xhDsC8IRMC PvWFh/+zMBxAGUjQAOh2LYa02r31yrEqbjc2oeAUu25ntreJ4gg72EeqNv7PFwe8op JOYNvh/SDIuAO/eRSaE/To7yVXjVn1zEwdBrsaVPJyLfVah6cHK5nVpOF39y6458IV XtRBlCj53kaLC62opl7imHlTQJKMtWHBmrBdAyfXGb/6lclpuJOLqk5wak0kTq84F6 nJxulmb6yvZJQ== From: Andrii Nakryiko To: linux-trace-kernel@vger.kernel.org, peterz@infradead.org, oleg@redhat.com Cc: rostedt@goodmis.org, mhiramat@kernel.org, bpf@vger.kernel.org, linux-kernel@vger.kernel.org, jolsa@kernel.org, paulmck@kernel.org, Andrii Nakryiko Subject: [PATCH 1/3] uprobes: allow put_uprobe() from non-sleepable softirq context Date: Mon, 9 Sep 2024 15:49:01 -0700 Message-ID: <20240909224903.3498207-2-andrii@kernel.org> X-Mailer: git-send-email 2.43.5 In-Reply-To: <20240909224903.3498207-1-andrii@kernel.org> References: <20240909224903.3498207-1-andrii@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Currently put_uprobe() might trigger mutex_lock()/mutex_unlock(), which makes it unsuitable to be called from more restricted context like softirq. Let's make put_uprobe() agnostic to the context in which it is called, and use work queue to defer the mutex-protected clean up steps. To avoid unnecessarily increasing the size of struct uprobe, we colocate work_struct in parallel with rb_node and rcu, both of which are unused by the time we get to schedule clean up work. Signed-off-by: Andrii Nakryiko --- kernel/events/uprobes.c | 30 +++++++++++++++++++++++++++--- 1 file changed, 27 insertions(+), 3 deletions(-) diff --git a/kernel/events/uprobes.c b/kernel/events/uprobes.c index a2e6a57f79f2..377bd524bc8b 100644 --- a/kernel/events/uprobes.c +++ b/kernel/events/uprobes.c @@ -27,6 +27,7 @@ #include #include #include +#include =20 #include =20 @@ -54,14 +55,20 @@ DEFINE_STATIC_PERCPU_RWSEM(dup_mmap_sem); #define UPROBE_COPY_INSN 0 =20 struct uprobe { - struct rb_node rb_node; /* node in the rb tree */ + union { + struct { + struct rb_node rb_node; /* node in the rb tree */ + struct rcu_head rcu; + }; + /* work is used only during freeing, rcu and rb_node are unused at that = point */ + struct work_struct work; + }; refcount_t ref; struct rw_semaphore register_rwsem; struct rw_semaphore consumer_rwsem; struct list_head pending_list; struct list_head consumers; struct inode *inode; /* Also hold a ref to inode */ - struct rcu_head rcu; loff_t offset; loff_t ref_ctr_offset; unsigned long flags; @@ -620,11 +627,28 @@ static inline bool uprobe_is_active(struct uprobe *up= robe) return !RB_EMPTY_NODE(&uprobe->rb_node); } =20 +static void uprobe_free_deferred(struct work_struct *work) +{ + struct uprobe *uprobe =3D container_of(work, struct uprobe, work); + + /* + * If application munmap(exec_vma) before uprobe_unregister() + * gets called, we don't get a chance to remove uprobe from + * delayed_uprobe_list from remove_breakpoint(). Do it here. + */ + mutex_lock(&delayed_uprobe_lock); + delayed_uprobe_remove(uprobe, NULL); + mutex_unlock(&delayed_uprobe_lock); + + kfree(uprobe); +} + static void uprobe_free_rcu(struct rcu_head *rcu) { struct uprobe *uprobe =3D container_of(rcu, struct uprobe, rcu); =20 - kfree(uprobe); + INIT_WORK(&uprobe->work, uprobe_free_deferred); + schedule_work(&uprobe->work); } =20 static void put_uprobe(struct uprobe *uprobe) --=20 2.43.5 From nobody Sat Nov 30 10:32:12 2024 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 3566B12E4A; Mon, 9 Sep 2024 22:49:14 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1725922155; cv=none; b=gkujdo1RIU9gk/RExEc+VH6brGiBDPSHWtUtrYMwRlihWiihByVZpkAIUXVq5I7Uih5JGW3AP22o124qLxbPzBGc1+roKmiOt3UiCOAJC3MjggYC/rls5+ubOI6slC9FgmkMzgr44LKlR57G7nU91gN4P5DZ+bnybzRMi8KU51E= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1725922155; c=relaxed/simple; bh=nUSDYW27ax++e0+MPCAQUHhXp+4EmQ46vOn0Rgh1ruM=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=S/j3Tf4yrywsPKHGd1KSTfEXlZzZd/JorWrQDPOUkbI97PUEYHvMdglghR9eBIHNNpXCk9PK9kGdDroq2zYFkENKLpUddjJ8oQELn1IsJQIF0quwMo9nquKOsZOfdaJHhQP/y0qvI2mhJJCEKhKmnKg7hu+XioLvqxBL9NpMuqM= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=IwURe1CU; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="IwURe1CU" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 7ACD3C4CEC5; Mon, 9 Sep 2024 22:49:14 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1725922154; bh=nUSDYW27ax++e0+MPCAQUHhXp+4EmQ46vOn0Rgh1ruM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=IwURe1CUrpKF46HeYZQamHmpbrsBSsBBEP83mTFcfhcb0WSnQX+aFYnC8/fv1ramu OXLOPUbgxAyqpzRMG2vZU0ASQys7JXKDycREO/x2OwtQAeNnmU1TxUrWF2UPrDC99S bYJOc5/GMvVh7XT5OeJ1ruk0PJvw9nk0CWAccG2Ol2jZeNFd8NjrD1AAynE9YzYMMv vH2bplgUKnxUDe9ybp/LY3RY+b/uEVv7FQ4KL2LJKurJ5yMIR3Wsq8/1L6aONvQp+D e+mKVRZ5/urVnf27AEQxnFvvBgRGLeRWv2x/hslXXENplid968hfyC+ZUbX5vp5aW4 M75/12i+6t+Sg== From: Andrii Nakryiko To: linux-trace-kernel@vger.kernel.org, peterz@infradead.org, oleg@redhat.com Cc: rostedt@goodmis.org, mhiramat@kernel.org, bpf@vger.kernel.org, linux-kernel@vger.kernel.org, jolsa@kernel.org, paulmck@kernel.org, Andrii Nakryiko Subject: [PATCH 2/3] uprobes: SRCU-protect uretprobe lifetime (with timeout) Date: Mon, 9 Sep 2024 15:49:02 -0700 Message-ID: <20240909224903.3498207-3-andrii@kernel.org> X-Mailer: git-send-email 2.43.5 In-Reply-To: <20240909224903.3498207-1-andrii@kernel.org> References: <20240909224903.3498207-1-andrii@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Avoid taking refcount on uprobe in prepare_uretprobe(), instead take uretprobe-specific SRCU lock and keep it active as kernel transfers control back to user space. Given we can't rely on user space returning from traced function within reasonable time period, we need to make sure not to keep SRCU lock active for too long, though. To that effect, we employ a timer callback which is meant to terminate SRCU lock region after predefined timeout (currently set to 100ms), and instead transfer underlying struct uprobe's lifetime protection to refcounting. This fallback to less scalable refcounting after 100ms is a fine tradeoff from uretprobe's scalability and performance perspective, because uretprobing *long running* user functions inherently doesn't run into scalability issues (there is just not enough frequency to cause noticeable issues with either performance or scalability). The overall trick is in ensuring synchronization between current thread and timer's callback fired on some other thread. To cope with that with minimal logic complications, we add hprobe wrapper which is used to contain all the racy and synchronization related issues behind a small number of basic helpers: hprobe_expire() for "downgrading" uprobe from SRCU-protected state to refcounted state, and a hprobe_consume() + hprobe_finalize() pair of single-use consuming helpers. Other than that whatever current thread's logic is there stays the same, as timer thread cannot modify return_instance state (or add new/remove old return_instances). It only takes care of SRCU unlock and uprobe refcounting, which is hidden from the higher-level uretprobe handling logic. We use atomic xchg() in hprobe_consume(), which is called from performance critical handle_uretprobe_chain() function run in the current context. When uncontended, this xchg() doesn't seem to hurt performance as there are no other competing CPUs fighting for the same cache line. We also mark struct return_instance as ____cacheline_aligned to ensure no false sharing can happen. Another technical moment, we need to make sure that the list of return instances can be safely traversed under RCU from timer callback, so we delay return_instance freeing with kfree_rcu() and make sure that list modifications use RCU-aware operations. Also, given SRCU lock survives transition from kernel to user space and back we need to use lower-level __srcu_read_lock() and __srcu_read_unlock() to avoid lockdep complaining. Just to give an impression of a kind of performance improvements this change brings, below are benchmarking results with and without these SRCU changes, assuming other uprobe optimizations (mainly RCU Tasks Trace for entry uprobes, lockless RB-tree lookup, and lockless VMA to uprobe lookup) are left intact: WITHOUT SRCU for uretprobes =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D uretprobe-nop ( 1 cpus): 2.197 =C2=B1 0.002M/s ( 2.197M/s/cpu) uretprobe-nop ( 2 cpus): 3.325 =C2=B1 0.001M/s ( 1.662M/s/cpu) uretprobe-nop ( 3 cpus): 4.129 =C2=B1 0.002M/s ( 1.376M/s/cpu) uretprobe-nop ( 4 cpus): 6.180 =C2=B1 0.003M/s ( 1.545M/s/cpu) uretprobe-nop ( 8 cpus): 7.323 =C2=B1 0.005M/s ( 0.915M/s/cpu) uretprobe-nop (16 cpus): 6.943 =C2=B1 0.005M/s ( 0.434M/s/cpu) uretprobe-nop (32 cpus): 5.931 =C2=B1 0.014M/s ( 0.185M/s/cpu) uretprobe-nop (64 cpus): 5.145 =C2=B1 0.003M/s ( 0.080M/s/cpu) uretprobe-nop (80 cpus): 4.925 =C2=B1 0.005M/s ( 0.062M/s/cpu) WITH SRCU for uretprobes =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D uretprobe-nop ( 1 cpus): 1.968 =C2=B1 0.001M/s ( 1.968M/s/cpu) uretprobe-nop ( 2 cpus): 3.739 =C2=B1 0.003M/s ( 1.869M/s/cpu) uretprobe-nop ( 3 cpus): 5.616 =C2=B1 0.003M/s ( 1.872M/s/cpu) uretprobe-nop ( 4 cpus): 7.286 =C2=B1 0.002M/s ( 1.822M/s/cpu) uretprobe-nop ( 8 cpus): 13.657 =C2=B1 0.007M/s ( 1.707M/s/cpu) uretprobe-nop (32 cpus): 45.305 =C2=B1 0.066M/s ( 1.416M/s/cpu) uretprobe-nop (64 cpus): 42.390 =C2=B1 0.922M/s ( 0.662M/s/cpu) uretprobe-nop (80 cpus): 47.554 =C2=B1 2.411M/s ( 0.594M/s/cpu) Signed-off-by: Andrii Nakryiko --- include/linux/uprobes.h | 49 ++++++- kernel/events/uprobes.c | 285 ++++++++++++++++++++++++++++++++++------ 2 files changed, 292 insertions(+), 42 deletions(-) diff --git a/include/linux/uprobes.h b/include/linux/uprobes.h index 2b294bf1881f..1b194c51d4d3 100644 --- a/include/linux/uprobes.h +++ b/include/linux/uprobes.h @@ -15,6 +15,7 @@ #include #include #include +#include =20 struct uprobe; struct vm_area_struct; @@ -56,6 +57,45 @@ enum uprobe_task_state { UTASK_SSTEP_TRAPPED, }; =20 +/* + * Hybrid lifetime uprobe. Represents a uprobe instance that could be eith= er + * SRCU protected (with SRCU protection eventually potentially timing out), + * refcounted using uprobe->ref, or there could be no valid uprobe (NULL). + * + * hprobe's internal state is setup such that background timer thread can + * atomically "downgrade" temporarily RCU-protected uprobe into refcounted= one + * (or no uprobe, if refcounting failed). + * + * *stable* pointer always point to the uprobe (or could be NULL if there = is + * was no valid underlying uprobe to begin with). + * + * *leased* pointer is the key to achieving race-free atomic lifetime state + * transition and can have three possible states: + * - either the same non-NULL value as *stable*, in which case uprobe is + * SRCU-protected; + * - NULL, in which case uprobe (if there is any) is refcounted; + * - special __UPROBE_DEAD value, which represents an uprobe that was SR= CU + * protected initially, but SRCU period timed out and we attempted to + * convert it to refcounted, but refcount_inc_not_zero() failed, becau= se + * uprobe effectively went away (the last consumer unsubscribed). In t= his + * case it's important to know that *stable* pointer (which still has + * non-NULL uprobe pointer) shouldn't be used, because lifetime of + * underlying uprobe is not guaranteed anymore. __UPROBE_DEAD is just = an + * internal marker and is handled transparently by hprobe_fetch() help= er. + * + * When uprobe is SRCU-protected, we also record srcu_idx value, necessary= for + * SRCU unlocking. + * + * See hprobe_expire() and hprobe_fetch() for details of race-free uprobe + * state transitioning details. It all hinges on atomic xchg() over *leade= d* + * pointer. *stable* pointer, once initially set, is not modified concurre= ntly. + */ +struct hprobe { + struct uprobe *stable; + struct uprobe *leased; + int srcu_idx; +}; + /* * uprobe_task: Metadata of a task while it singlesteps. */ @@ -75,6 +115,7 @@ struct uprobe_task { }; =20 struct uprobe *active_uprobe; + struct timer_list ri_timer; unsigned long xol_vaddr; =20 struct arch_uprobe *auprobe; @@ -84,14 +125,18 @@ struct uprobe_task { }; =20 struct return_instance { - struct uprobe *uprobe; unsigned long func; unsigned long stack; /* stack pointer */ unsigned long orig_ret_vaddr; /* original return address */ bool chained; /* true, if instance is nested */ =20 struct return_instance *next; /* keep as stack */ -}; + + union { + struct hprobe hprobe; + struct rcu_head rcu; + }; +} ____cacheline_aligned; =20 enum rp_check { RP_CHECK_CALL, diff --git a/kernel/events/uprobes.c b/kernel/events/uprobes.c index 377bd524bc8b..b047e68499d5 100644 --- a/kernel/events/uprobes.c +++ b/kernel/events/uprobes.c @@ -28,6 +28,7 @@ #include #include #include +#include =20 #include =20 @@ -51,6 +52,9 @@ static struct mutex uprobes_mmap_mutex[UPROBES_HASH_SZ]; =20 DEFINE_STATIC_PERCPU_RWSEM(dup_mmap_sem); =20 +/* Covers return_instance's uprobe lifetime. */ +DEFINE_STATIC_SRCU(uretprobes_srcu); + /* Have a copy of original instruction */ #define UPROBE_COPY_INSN 0 =20 @@ -602,13 +606,6 @@ set_orig_insn(struct arch_uprobe *auprobe, struct mm_s= truct *mm, unsigned long v *(uprobe_opcode_t *)&auprobe->insn); } =20 -/* uprobe should have guaranteed positive refcount */ -static struct uprobe *get_uprobe(struct uprobe *uprobe) -{ - refcount_inc(&uprobe->ref); - return uprobe; -} - /* * uprobe should have guaranteed lifetime, which can be either of: * - caller already has refcount taken (and wants an extra one); @@ -643,7 +640,7 @@ static void uprobe_free_deferred(struct work_struct *wo= rk) kfree(uprobe); } =20 -static void uprobe_free_rcu(struct rcu_head *rcu) +static void uprobe_free_rcu_tasks_trace(struct rcu_head *rcu) { struct uprobe *uprobe =3D container_of(rcu, struct uprobe, rcu); =20 @@ -651,6 +648,13 @@ static void uprobe_free_rcu(struct rcu_head *rcu) schedule_work(&uprobe->work); } =20 +static void uprobe_free_srcu(struct rcu_head *rcu) +{ + struct uprobe *uprobe =3D container_of(rcu, struct uprobe, rcu); + + call_rcu_tasks_trace(&uprobe->rcu, uprobe_free_rcu_tasks_trace); +} + static void put_uprobe(struct uprobe *uprobe) { if (!refcount_dec_and_test(&uprobe->ref)) @@ -675,7 +679,146 @@ static void put_uprobe(struct uprobe *uprobe) delayed_uprobe_remove(uprobe, NULL); mutex_unlock(&delayed_uprobe_lock); =20 - call_rcu_tasks_trace(&uprobe->rcu, uprobe_free_rcu); + /* start srcu -> rcu_tasks_trace -> kfree chain */ + call_srcu(&uretprobes_srcu, &uprobe->rcu, uprobe_free_srcu); +} + +/* + * Special marker pointer for when ri_timer() expired, unlocking RCU, but + * failed to acquire refcount on uprobe (because it doesn't have any + * associated consumer anymore, for example). In such case it's important = for + * hprobe_consume() to return NULL uprobe, instead of "stable" uprobe poin= ter, + * as that one isn't protected by either refcount nor RCU region now. + */ +#define __UPROBE_DEAD ((struct uprobe *)(-0xdead)) + +#define RI_TIMER_PERIOD (HZ/10) /* 100 ms */ + +/* Initialize hprobe as SRCU-protected "leased" uprobe */ +static void hprobe_init_leased(struct hprobe *hprobe, struct uprobe *uprob= e, int srcu_idx) +{ + hprobe->srcu_idx =3D srcu_idx; + hprobe->stable =3D uprobe; + hprobe->leased =3D uprobe; +} + +/* Initialize hprobe as refcounted ("stable") uprobe (uprobe can be NULL).= */ +static void hprobe_init_stable(struct hprobe *hprobe, struct uprobe *uprob= e) +{ + hprobe->srcu_idx =3D -1; + hprobe->stable =3D uprobe; + hprobe->leased =3D NULL; +} + +/* + * hprobe_consume() fetches hprobe's underlying uprobe and detects whether + * uprobe is still SRCU protected, or is refcounted. hprobe_consume() can = be + * used only once for a given hprobe. + * + * Caller has to perform SRCU unlock if under_rcu is set to true; + * otherwise, either properly refcounted uprobe is returned or NULL. + */ +static inline struct uprobe *hprobe_consume(struct hprobe *hprobe, bool *u= nder_rcu) +{ + struct uprobe *uprobe; + + uprobe =3D xchg(&hprobe->leased, NULL); + if (uprobe) { + if (unlikely(uprobe =3D=3D __UPROBE_DEAD)) { + *under_rcu =3D false; + return NULL; + } + + *under_rcu =3D true; + return uprobe; + } + + *under_rcu =3D false; + return hprobe->stable; +} + +/* + * Reset hprobe state and, if under_rcu is true, release SRCU lock. + * hprobe_finalize() can only be used from current context after + * hprobe_consume() call (which determines uprobe and under_rcu value). + */ +static void hprobe_finalize(struct hprobe *hprobe, struct uprobe *uprobe, = bool under_rcu) +{ + if (under_rcu) + __srcu_read_unlock(&uretprobes_srcu, hprobe->srcu_idx); + else if (uprobe) + put_uprobe(uprobe); + /* prevent free_ret_instance() from double-putting uprobe */ + hprobe->stable =3D NULL; +} + +/* + * Attempt to switch (atomically) uprobe from being RCU protected ("leased= ") + * to refcounted ("stable") state. Competes with hprobe_consume(), only on= e of + * them can win the race to perform SRCU unlocking. Whoever wins must perf= orm + * SRCU unlock. + * + * Returns underlying valid uprobe or NULL, if there was no underlying upr= obe + * to begin with or we failed to bump its refcount and it's going away. + * + * Returned non-NULL uprobe can be still safely used within an ongoing SRCU + * locked region. It's not guaranteed that returned uprobe has a positive + * refcount, so caller has to attempt try_get_uprobe(), if it needs to use + * returned uprobe instance beyond ongoing SRCU lock region. See dup_utask= (). + */ +static struct uprobe* hprobe_expire(struct hprobe *hprobe) +{ + struct uprobe *uprobe; + + /* + * return_instance's hprobe is protected by RCU. + * Underlying uprobe is itself protected from reuse by SRCU. + */ + lockdep_assert(rcu_read_lock_held() && srcu_read_lock_held(&uretprobes_sr= cu)); + + /* + * Leased pointer can only be NULL, __UPROBE_DEAD, or some valid uprobe + * pointer. This pointer can only be updated to NULL or __UPROBE_DEAD, + * not any other valid uprobe pointer. So it's safe to fetch it with + * READ_ONCE() and try to refcount it, if it's not NULL or __UPROBE_DEAD. + */ + uprobe =3D data_race(READ_ONCE(hprobe->leased)); + if (!uprobe || uprobe =3D=3D __UPROBE_DEAD) + return NULL; + + if (!try_get_uprobe(uprobe)) { + /* + * hprobe_consume() might have xchg()'ed to NULL already, + * in which case we shouldn't set __UPROBE_DEAD. + */ + cmpxchg(&hprobe->leased, uprobe, __UPROBE_DEAD); + return NULL; + } + + /* + * Even if hprobe_consume() won and unlocked SRCU, we still have + * a guarantee that uprobe won't be freed (and thus won't be reused) + * because out caller maintains its own SRCU locked region. + * So cmpxchg() below is well-formed. + */ + if (cmpxchg(&hprobe->leased, uprobe, NULL)) { + /* + * At this point uprobe is properly refcounted, so it's safe + * to end its original SRCU locked region. + */ + __srcu_read_unlock(&uretprobes_srcu, hprobe->srcu_idx); + return uprobe; + } + + /* We lost the race, undo our refcount bump. It can drop to zero. */ + put_uprobe(uprobe); + + /* + * We return underlying uprobe nevertheless because it's still valid + * until the end of current SRCU locked region, and can be used to + * try_get_uprobe(). This is used in dup_utask(). + */ + return uprobe; } =20 static __always_inline @@ -1180,6 +1323,7 @@ void uprobe_unregister_sync(void) * handler_chain() or handle_uretprobe_chain() to do an use-after-free. */ synchronize_rcu_tasks_trace(); + synchronize_srcu(&uretprobes_srcu); } EXPORT_SYMBOL_GPL(uprobe_unregister_sync); =20 @@ -1760,11 +1904,18 @@ unsigned long uprobe_get_trap_addr(struct pt_regs *= regs) return instruction_pointer(regs); } =20 -static struct return_instance *free_ret_instance(struct return_instance *r= i) +static struct return_instance *free_ret_instance(struct return_instance *r= i, bool cleanup_hprobe) { struct return_instance *next =3D ri->next; - put_uprobe(ri->uprobe); - kfree(ri); + struct uprobe *uprobe; + bool under_rcu; + + if (cleanup_hprobe) { + uprobe =3D hprobe_consume(&ri->hprobe, &under_rcu); + hprobe_finalize(&ri->hprobe, uprobe, under_rcu); + } + + kfree_rcu(ri, rcu); return next; } =20 @@ -1780,18 +1931,51 @@ void uprobe_free_utask(struct task_struct *t) if (!utask) return; =20 + timer_delete_sync(&utask->ri_timer); + if (utask->active_uprobe) put_uprobe(utask->active_uprobe); =20 ri =3D utask->return_instances; while (ri) - ri =3D free_ret_instance(ri); + ri =3D free_ret_instance(ri, true /* cleanup_hprobe */); =20 xol_free_insn_slot(t); kfree(utask); t->utask =3D NULL; } =20 +#define for_each_ret_instance_rcu(pos, head) \ + for (pos =3D rcu_dereference_raw(head); pos; pos =3D rcu_dereference_raw(= pos->next)) + +static void ri_timer(struct timer_list *timer) +{ + struct uprobe_task *utask =3D container_of(timer, struct uprobe_task, ri_= timer); + struct return_instance *ri; + + /* SRCU protects uprobe from reuse for the cmpxchg() inside hprobe_expire= (). */ + guard(srcu)(&uretprobes_srcu); + /* RCU protects return_instance from freeing. */ + guard(rcu)(); + + for_each_ret_instance_rcu(ri, utask->return_instances) { + hprobe_expire(&ri->hprobe); + } +} + +static struct uprobe_task *alloc_utask(void) +{ + struct uprobe_task *utask; + + utask =3D kzalloc(sizeof(*utask), GFP_KERNEL); + if (!utask) + return NULL; + + timer_setup(&utask->ri_timer, ri_timer, 0); + + return utask; +} + /* * Allocate a uprobe_task object for the task if necessary. * Called when the thread hits a breakpoint. @@ -1803,7 +1987,7 @@ void uprobe_free_utask(struct task_struct *t) static struct uprobe_task *get_utask(void) { if (!current->utask) - current->utask =3D kzalloc(sizeof(struct uprobe_task), GFP_KERNEL); + current->utask =3D alloc_utask(); return current->utask; } =20 @@ -1811,12 +1995,16 @@ static int dup_utask(struct task_struct *t, struct = uprobe_task *o_utask) { struct uprobe_task *n_utask; struct return_instance **p, *o, *n; + struct uprobe *uprobe; =20 - n_utask =3D kzalloc(sizeof(struct uprobe_task), GFP_KERNEL); + n_utask =3D alloc_utask(); if (!n_utask) return -ENOMEM; t->utask =3D n_utask; =20 + /* protect uprobes from freeing, we'll need try_get_uprobe() them */ + guard(srcu)(&uretprobes_srcu); + p =3D &n_utask->return_instances; for (o =3D o_utask->return_instances; o; o =3D o->next) { n =3D kmalloc(sizeof(struct return_instance), GFP_KERNEL); @@ -1824,17 +2012,24 @@ static int dup_utask(struct task_struct *t, struct = uprobe_task *o_utask) return -ENOMEM; =20 *n =3D *o; + + /* see hprobe_expire() comments */ + uprobe =3D hprobe_expire(&o->hprobe); + if (uprobe) /* refcount bump for new utask */ + uprobe =3D try_get_uprobe(uprobe); + /* - * uprobe's refcnt has to be positive at this point, kept by - * utask->return_instances items; return_instances can't be - * removed right now, as task is blocked due to duping; so - * get_uprobe() is safe to use here. + * New utask will have stable properly refcounted uprobe or NULL. + * Even if we failed to get refcounted uprobe, we still need + * to preserve full set of return_instances for proper + * uretprobe handling and nesting in forked task. */ - get_uprobe(n->uprobe); - n->next =3D NULL; + hprobe_init_stable(&n->hprobe, uprobe); =20 - *p =3D n; + n->next =3D NULL; + rcu_assign_pointer(*p, n); p =3D &n->next; + n_utask->depth++; } =20 @@ -1910,10 +2105,10 @@ static void cleanup_return_instances(struct uprobe_= task *utask, bool chained, enum rp_check ctx =3D chained ? RP_CHECK_CHAIN_CALL : RP_CHECK_CALL; =20 while (ri && !arch_uretprobe_is_alive(ri, ctx, regs)) { - ri =3D free_ret_instance(ri); + ri =3D free_ret_instance(ri, true /* cleanup_hprobe */); utask->depth--; } - utask->return_instances =3D ri; + rcu_assign_pointer(utask->return_instances, ri); } =20 static void prepare_uretprobe(struct uprobe *uprobe, struct pt_regs *regs) @@ -1922,6 +2117,7 @@ static void prepare_uretprobe(struct uprobe *uprobe, = struct pt_regs *regs) struct uprobe_task *utask; unsigned long orig_ret_vaddr, trampoline_vaddr; bool chained; + int srcu_idx; =20 if (!get_xol_area()) return; @@ -1937,10 +2133,6 @@ static void prepare_uretprobe(struct uprobe *uprobe,= struct pt_regs *regs) return; } =20 - /* we need to bump refcount to store uprobe in utask */ - if (!try_get_uprobe(uprobe)) - return; - ri =3D kmalloc(sizeof(struct return_instance), GFP_KERNEL); if (!ri) goto fail; @@ -1970,20 +2162,26 @@ static void prepare_uretprobe(struct uprobe *uprobe= , struct pt_regs *regs) } orig_ret_vaddr =3D utask->return_instances->orig_ret_vaddr; } - ri->uprobe =3D uprobe; + + /* __srcu_read_lock() because SRCU lock survives switch to user space */ + srcu_idx =3D __srcu_read_lock(&uretprobes_srcu); + ri->func =3D instruction_pointer(regs); ri->stack =3D user_stack_pointer(regs); ri->orig_ret_vaddr =3D orig_ret_vaddr; ri->chained =3D chained; =20 utask->depth++; + + hprobe_init_leased(&ri->hprobe, uprobe, srcu_idx); ri->next =3D utask->return_instances; - utask->return_instances =3D ri; + rcu_assign_pointer(utask->return_instances, ri); + + mod_timer(&utask->ri_timer, jiffies + RI_TIMER_PERIOD); =20 return; fail: kfree(ri); - put_uprobe(uprobe); } =20 /* Prepare to single-step probed instruction out of line. */ @@ -2178,11 +2376,14 @@ static void handler_chain(struct uprobe *uprobe, st= ruct pt_regs *regs) } =20 static void -handle_uretprobe_chain(struct return_instance *ri, struct pt_regs *regs) +handle_uretprobe_chain(struct return_instance *ri, struct uprobe *uprobe, = struct pt_regs *regs) { - struct uprobe *uprobe =3D ri->uprobe; struct uprobe_consumer *uc; =20 + /* all consumers unsubscribed meanwhile */ + if (unlikely(!uprobe)) + return; + rcu_read_lock_trace(); list_for_each_entry_rcu(uc, &uprobe->consumers, cons_node, rcu_read_lock_= trace_held()) { if (uc->ret_handler) @@ -2207,7 +2408,8 @@ void uprobe_handle_trampoline(struct pt_regs *regs) { struct uprobe_task *utask; struct return_instance *ri, *next; - bool valid; + struct uprobe *uprobe; + bool valid, under_rcu; =20 utask =3D current->utask; if (!utask) @@ -2237,21 +2439,24 @@ void uprobe_handle_trampoline(struct pt_regs *regs) * trampoline addresses on the stack are replaced with correct * original return addresses */ - utask->return_instances =3D ri->next; + rcu_assign_pointer(utask->return_instances, ri->next); + + uprobe =3D hprobe_consume(&ri->hprobe, &under_rcu); if (valid) - handle_uretprobe_chain(ri, regs); - ri =3D free_ret_instance(ri); + handle_uretprobe_chain(ri, uprobe, regs); + hprobe_finalize(&ri->hprobe, uprobe, under_rcu); + + /* We already took care of hprobe, no need to waste more time on that. = */ + ri =3D free_ret_instance(ri, false /* !cleanup_hprobe */); utask->depth--; } while (ri !=3D next); } while (!valid); =20 - utask->return_instances =3D ri; return; =20 - sigill: +sigill: uprobe_warn(current, "handle uretprobe, sending SIGILL."); force_sig(SIGILL); - } =20 bool __weak arch_uprobe_ignore(struct arch_uprobe *aup, struct pt_regs *re= gs) --=20 2.43.5 From nobody Sat Nov 30 10:32:12 2024 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 545BE18DF63; Mon, 9 Sep 2024 22:49:18 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1725922158; cv=none; b=DAGBiIrrrisCwutSRlK8o34C9V3xUBV7FcMTUUxWe4+/uzY+CiRCVOA4fPmrsmhdbXbBb0Q/oibnVqJi86h7+m1Wh+HzDMRYil3cwmVHU25lP9cioUiFSbZuE8+Mlai2UoGOzBeRjQdyJsTF73N5xvtdt6b8eGQQcgcq89ZLAaU= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1725922158; c=relaxed/simple; bh=THYLFg3kjLTPYm13kyoEYDqmRzKJALbi+j9hfhgBwow=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=h8cvKax465bSvIkKZNIC/tDGt3TBfyiGv3z4A5F8MtOcgzG54jD5m6eWalT7FPMYKwv5dNKNScDxRsgawb1+9WyltMmIHsMRCGxTvJbr9eaHARd1mD2qHMpVxHC1VLydA8QKYji2x/lU9ZwPs5JV+72kUnG2yh6CT2Bsfb3x/W4= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=h/EqOHNC; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="h/EqOHNC" Received: by smtp.kernel.org (Postfix) with ESMTPSA id BDDA0C4CEC5; Mon, 9 Sep 2024 22:49:17 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1725922158; bh=THYLFg3kjLTPYm13kyoEYDqmRzKJALbi+j9hfhgBwow=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=h/EqOHNCKrRaRTdRlMHnqzqyaGgPC6wjPR4DvcOmMAxm22c+tHHsIqUE55OrrAgAY ntnv5Y+/MniUUoxq9TEPUJkagRmWsyhjXdXro0ZMwS7dfIdYHRp/cYr5snDRffACCq mBbVTCwIBwhUTrYJp6x+dyv5sFCtjmlvbpnkjkZSCCkPGFU/oi9BQK0GuYJ8RYKgL6 7UXkaqadY00xgHrBfu2ta5gTGAJDDk1CA2NUc3vku4Z2yYgrRdg3hW7usv/2RfxMw0 JnsZLeWQJDnq1PYkwPluG6fMgklN1LeE0g6bWgaPUbwKf55FB55zafeM6P5PXM6xbF n3vh66nYsrmug== From: Andrii Nakryiko To: linux-trace-kernel@vger.kernel.org, peterz@infradead.org, oleg@redhat.com Cc: rostedt@goodmis.org, mhiramat@kernel.org, bpf@vger.kernel.org, linux-kernel@vger.kernel.org, jolsa@kernel.org, paulmck@kernel.org, Andrii Nakryiko Subject: [PATCH 3/3] uprobes: implement SRCU-protected lifetime for single-stepped uprobe Date: Mon, 9 Sep 2024 15:49:03 -0700 Message-ID: <20240909224903.3498207-4-andrii@kernel.org> X-Mailer: git-send-email 2.43.5 In-Reply-To: <20240909224903.3498207-1-andrii@kernel.org> References: <20240909224903.3498207-1-andrii@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Similarly to how we SRCU-protect uprobe instance (and avoid refcounting it unnecessarily) when waiting for return probe hit, use hprobe approach to do the same with single-stepped uprobe. Same hprobe_* primitives are used. We also reuse ri_timer() callback to expire both pending single-step uprobe and return instances. Signed-off-by: Andrii Nakryiko --- include/linux/uprobes.h | 4 +-- kernel/events/uprobes.c | 55 ++++++++++++++++++++++++----------------- 2 files changed, 34 insertions(+), 25 deletions(-) diff --git a/include/linux/uprobes.h b/include/linux/uprobes.h index 1b194c51d4d3..31cf7306cdf6 100644 --- a/include/linux/uprobes.h +++ b/include/linux/uprobes.h @@ -114,7 +114,7 @@ struct uprobe_task { }; }; =20 - struct uprobe *active_uprobe; + struct hprobe active_hprobe; struct timer_list ri_timer; unsigned long xol_vaddr; =20 @@ -122,7 +122,7 @@ struct uprobe_task { =20 struct return_instance *return_instances; unsigned int depth; -}; +} ____cacheline_aligned; =20 struct return_instance { unsigned long func; diff --git a/kernel/events/uprobes.c b/kernel/events/uprobes.c index b047e68499d5..d9ab5e0dd9dd 100644 --- a/kernel/events/uprobes.c +++ b/kernel/events/uprobes.c @@ -1894,11 +1894,16 @@ unsigned long __weak uprobe_get_swbp_addr(struct pt= _regs *regs) return instruction_pointer(regs) - UPROBE_SWBP_INSN_SIZE; } =20 +static bool utask_has_pending_sstep_uprobe(struct uprobe_task *utask) +{ + return utask->active_hprobe.stable !=3D NULL; +} + unsigned long uprobe_get_trap_addr(struct pt_regs *regs) { struct uprobe_task *utask =3D current->utask; =20 - if (unlikely(utask && utask->active_uprobe)) + if (unlikely(utask && utask_has_pending_sstep_uprobe(utask))) return utask->vaddr; =20 return instruction_pointer(regs); @@ -1927,14 +1932,17 @@ void uprobe_free_utask(struct task_struct *t) { struct uprobe_task *utask =3D t->utask; struct return_instance *ri; + struct uprobe *uprobe; + bool under_rcu; =20 if (!utask) return; =20 timer_delete_sync(&utask->ri_timer); =20 - if (utask->active_uprobe) - put_uprobe(utask->active_uprobe); + /* clean up pending single-stepped uprobe */ + uprobe =3D hprobe_consume(&utask->active_hprobe, &under_rcu); + hprobe_finalize(&utask->active_hprobe, uprobe, under_rcu); =20 ri =3D utask->return_instances; while (ri) @@ -1958,6 +1966,8 @@ static void ri_timer(struct timer_list *timer) /* RCU protects return_instance from freeing. */ guard(rcu)(); =20 + hprobe_expire(&utask->active_hprobe); + for_each_ret_instance_rcu(ri, utask->return_instances) { hprobe_expire(&ri->hprobe); } @@ -2190,20 +2200,15 @@ pre_ssout(struct uprobe *uprobe, struct pt_regs *re= gs, unsigned long bp_vaddr) { struct uprobe_task *utask; unsigned long xol_vaddr; - int err; + int err, srcu_idx; =20 utask =3D get_utask(); if (!utask) return -ENOMEM; =20 - if (!try_get_uprobe(uprobe)) - return -EINVAL; - xol_vaddr =3D xol_get_insn_slot(uprobe); - if (!xol_vaddr) { - err =3D -ENOMEM; - goto err_out; - } + if (!xol_vaddr) + return -ENOMEM; =20 utask->xol_vaddr =3D xol_vaddr; utask->vaddr =3D bp_vaddr; @@ -2211,15 +2216,17 @@ pre_ssout(struct uprobe *uprobe, struct pt_regs *re= gs, unsigned long bp_vaddr) err =3D arch_uprobe_pre_xol(&uprobe->arch, regs); if (unlikely(err)) { xol_free_insn_slot(current); - goto err_out; + return err; } =20 - utask->active_uprobe =3D uprobe; + srcu_idx =3D __srcu_read_lock(&uretprobes_srcu); + + hprobe_init_leased(&utask->active_hprobe, uprobe, srcu_idx); utask->state =3D UTASK_SSTEP; + + mod_timer(&utask->ri_timer, jiffies + RI_TIMER_PERIOD); + return 0; -err_out: - put_uprobe(uprobe); - return err; } =20 /* @@ -2236,7 +2243,7 @@ bool uprobe_deny_signal(void) struct task_struct *t =3D current; struct uprobe_task *utask =3D t->utask; =20 - if (likely(!utask || !utask->active_uprobe)) + if (likely(!utask || !utask_has_pending_sstep_uprobe(utask))) return false; =20 WARN_ON_ONCE(utask->state !=3D UTASK_SSTEP); @@ -2553,8 +2560,10 @@ static void handle_singlestep(struct uprobe_task *ut= ask, struct pt_regs *regs) { struct uprobe *uprobe; int err =3D 0; + bool under_rcu; + + uprobe =3D hprobe_consume(&utask->active_hprobe, &under_rcu); =20 - uprobe =3D utask->active_uprobe; if (utask->state =3D=3D UTASK_SSTEP_ACK) err =3D arch_uprobe_post_xol(&uprobe->arch, regs); else if (utask->state =3D=3D UTASK_SSTEP_TRAPPED) @@ -2562,8 +2571,8 @@ static void handle_singlestep(struct uprobe_task *uta= sk, struct pt_regs *regs) else WARN_ON_ONCE(1); =20 - put_uprobe(uprobe); - utask->active_uprobe =3D NULL; + hprobe_finalize(&utask->active_hprobe, uprobe, under_rcu); + utask->state =3D UTASK_RUNNING; xol_free_insn_slot(current); =20 @@ -2580,7 +2589,7 @@ static void handle_singlestep(struct uprobe_task *uta= sk, struct pt_regs *regs) /* * On breakpoint hit, breakpoint notifier sets the TIF_UPROBE flag and * allows the thread to return from interrupt. After that handle_swbp() - * sets utask->active_uprobe. + * sets utask->active_hprobe. * * On singlestep exception, singlestep notifier sets the TIF_UPROBE flag * and allows the thread to return from interrupt. @@ -2595,7 +2604,7 @@ void uprobe_notify_resume(struct pt_regs *regs) clear_thread_flag(TIF_UPROBE); =20 utask =3D current->utask; - if (utask && utask->active_uprobe) + if (utask && utask_has_pending_sstep_uprobe(utask)) handle_singlestep(utask, regs); else handle_swbp(regs); @@ -2626,7 +2635,7 @@ int uprobe_post_sstep_notifier(struct pt_regs *regs) { struct uprobe_task *utask =3D current->utask; =20 - if (!current->mm || !utask || !utask->active_uprobe) + if (!current->mm || !utask || !utask_has_pending_sstep_uprobe(utask)) /* task is currently not uprobed */ return 0; =20 --=20 2.43.5