2023-04-23 09:26:17

by Jinjie Ruan

Subject: [PATCH v2] riscv: fix kprobe __user string arg print fault issue

On riscv qemu platform, when add kprobe event on do_sys_open() to show
filename string arg, it just print fault as follow:

echo 'p:myprobe do_sys_open dfd=$arg1 filename=+0($arg2):string flags=$arg3
mode=$arg4' > kprobe_events

bash-166 [000] ...1. 360.195367: myprobe: (do_sys_open+0x0/0x84)
dfd=0xffffffffffffff9c filename=(fault) flags=0x8241 mode=0x1b6

bash-166 [000] ...1. 360.219369: myprobe: (do_sys_open+0x0/0x84)
dfd=0xffffffffffffff9c filename=(fault) flags=0x8241 mode=0x1b6

bash-191 [000] ...1. 360.378827: myprobe: (do_sys_open+0x0/0x84)
dfd=0xffffffffffffff9c filename=(fault) flags=0x98800 mode=0x0

As riscv do not select ARCH_HAS_NON_OVERLAPPING_ADDRESS_SPACE,
the +0($arg2) addr is processed as a kernel address though it is a
userspace address, cause the above filename=(fault) print. So select
ARCH_HAS_NON_OVERLAPPING_ADDRESS_SPACE to avoid the issue, after that the
kprobe trace is ok as below:

bash-166 [000] ...1. 96.767641: myprobe: (do_sys_open+0x0/0x84)
dfd=0xffffffffffffff9c filename="/dev/null" flags=0x8241 mode=0x1b6

bash-166 [000] ...1. 96.793751: myprobe: (do_sys_open+0x0/0x84)
dfd=0xffffffffffffff9c filename="/dev/null" flags=0x8241 mode=0x1b6

bash-177 [000] ...1. 96.962354: myprobe: (do_sys_open+0x0/0x84)
dfd=0xffffffffffffff9c filename="/sys/kernel/debug/tracing/events/kprobes/"
flags=0x98800 mode=0x0

Signed-off-by: ruanjinjie <[email protected]>
---
v2:
- add the config in alphabetical order
---
arch/riscv/Kconfig | 1 +
1 file changed, 1 insertion(+)

diff --git a/arch/riscv/Kconfig b/arch/riscv/Kconfig
index eb7f29a412f8..b462ed7d41fe 100644
--- a/arch/riscv/Kconfig
+++ b/arch/riscv/Kconfig
@@ -25,6 +25,7 @@ config RISCV
select ARCH_HAS_GIGANTIC_PAGE
select ARCH_HAS_KCOV
select ARCH_HAS_MMIOWB
+ select ARCH_HAS_NON_OVERLAPPING_ADDRESS_SPACE
select ARCH_HAS_PMEM_API
select ARCH_HAS_PTE_SPECIAL
select ARCH_HAS_SET_DIRECT_MAP if MMU
--
2.25.1

2023-05-04 01:23:13

by Jinjie Ruan

Subject: Re: [PATCH v2] riscv: fix kprobe __user string arg print fault issue

Ping.

On 2023/4/23 17:12, ruanjinjie wrote:
> On riscv qemu platform, when add kprobe event on do_sys_open() to show
> filename string arg, it just print fault as follow:
>
> echo 'p:myprobe do_sys_open dfd=$arg1 filename=+0($arg2):string flags=$arg3
> mode=$arg4' > kprobe_events
>
> bash-166 [000] ...1. 360.195367: myprobe: (do_sys_open+0x0/0x84)
> dfd=0xffffffffffffff9c filename=(fault) flags=0x8241 mode=0x1b6
>
> bash-166 [000] ...1. 360.219369: myprobe: (do_sys_open+0x0/0x84)
> dfd=0xffffffffffffff9c filename=(fault) flags=0x8241 mode=0x1b6
>
> bash-191 [000] ...1. 360.378827: myprobe: (do_sys_open+0x0/0x84)
> dfd=0xffffffffffffff9c filename=(fault) flags=0x98800 mode=0x0
>
> As riscv do not select ARCH_HAS_NON_OVERLAPPING_ADDRESS_SPACE,
> the +0($arg2) addr is processed as a kernel address though it is a
> userspace address, cause the above filename=(fault) print. So select
> ARCH_HAS_NON_OVERLAPPING_ADDRESS_SPACE to avoid the issue, after that the
> kprobe trace is ok as below:
>
> bash-166 [000] ...1. 96.767641: myprobe: (do_sys_open+0x0/0x84)
> dfd=0xffffffffffffff9c filename="/dev/null" flags=0x8241 mode=0x1b6
>
> bash-166 [000] ...1. 96.793751: myprobe: (do_sys_open+0x0/0x84)
> dfd=0xffffffffffffff9c filename="/dev/null" flags=0x8241 mode=0x1b6
>
> bash-177 [000] ...1. 96.962354: myprobe: (do_sys_open+0x0/0x84)
> dfd=0xffffffffffffff9c filename="/sys/kernel/debug/tracing/events/kprobes/"
> flags=0x98800 mode=0x0
>
> Signed-off-by: ruanjinjie <[email protected]>
> ---
> v2:
> - add the config in alphabetical order
> ---
> arch/riscv/Kconfig | 1 +
> 1 file changed, 1 insertion(+)
>
> diff --git a/arch/riscv/Kconfig b/arch/riscv/Kconfig
> index eb7f29a412f8..b462ed7d41fe 100644
> --- a/arch/riscv/Kconfig
> +++ b/arch/riscv/Kconfig
> @@ -25,6 +25,7 @@ config RISCV
> select ARCH_HAS_GIGANTIC_PAGE
> select ARCH_HAS_KCOV
> select ARCH_HAS_MMIOWB
> + select ARCH_HAS_NON_OVERLAPPING_ADDRESS_SPACE
> select ARCH_HAS_PMEM_API
> select ARCH_HAS_PTE_SPECIAL
> select ARCH_HAS_SET_DIRECT_MAP if MMU

2023-05-04 06:23:19

by Björn Töpel

Subject: Re: [PATCH v2] riscv: fix kprobe __user string arg print fault issue

ruanjinjie <[email protected]> writes:

> On riscv qemu platform, when add kprobe event on do_sys_open() to show
> filename string arg, it just print fault as follow:
>
> echo 'p:myprobe do_sys_open dfd=$arg1 filename=+0($arg2):string flags=$arg3
> mode=$arg4' > kprobe_events
>
> bash-166 [000] ...1. 360.195367: myprobe: (do_sys_open+0x0/0x84)
> dfd=0xffffffffffffff9c filename=(fault) flags=0x8241 mode=0x1b6
>
> bash-166 [000] ...1. 360.219369: myprobe: (do_sys_open+0x0/0x84)
> dfd=0xffffffffffffff9c filename=(fault) flags=0x8241 mode=0x1b6
>
> bash-191 [000] ...1. 360.378827: myprobe: (do_sys_open+0x0/0x84)
> dfd=0xffffffffffffff9c filename=(fault) flags=0x98800 mode=0x0
>
> As riscv do not select ARCH_HAS_NON_OVERLAPPING_ADDRESS_SPACE,
> the +0($arg2) addr is processed as a kernel address though it is a
> userspace address, cause the above filename=(fault) print. So select
> ARCH_HAS_NON_OVERLAPPING_ADDRESS_SPACE to avoid the issue, after that the
> kprobe trace is ok as below:
>
> bash-166 [000] ...1. 96.767641: myprobe: (do_sys_open+0x0/0x84)
> dfd=0xffffffffffffff9c filename="/dev/null" flags=0x8241 mode=0x1b6
>
> bash-166 [000] ...1. 96.793751: myprobe: (do_sys_open+0x0/0x84)
> dfd=0xffffffffffffff9c filename="/dev/null" flags=0x8241 mode=0x1b6
>
> bash-177 [000] ...1. 96.962354: myprobe: (do_sys_open+0x0/0x84)
> dfd=0xffffffffffffff9c filename="/sys/kernel/debug/tracing/events/kprobes/"
> flags=0x98800 mode=0x0
>
> Signed-off-by: ruanjinjie <[email protected]>

Please use your full name.

> ---
> v2:
> - add the config in alphabetical order
> ---
> arch/riscv/Kconfig | 1 +
> 1 file changed, 1 insertion(+)
>
> diff --git a/arch/riscv/Kconfig b/arch/riscv/Kconfig
> index eb7f29a412f8..b462ed7d41fe 100644
> --- a/arch/riscv/Kconfig
> +++ b/arch/riscv/Kconfig
> @@ -25,6 +25,7 @@ config RISCV
> select ARCH_HAS_GIGANTIC_PAGE
> select ARCH_HAS_KCOV
> select ARCH_HAS_MMIOWB
> + select ARCH_HAS_NON_OVERLAPPING_ADDRESS_SPACE

After adding proper name in SoB, feel free to add:

Acked-by: Björn Töpel <[email protected]>

> select ARCH_HAS_PMEM_API
> select ARCH_HAS_PTE_SPECIAL
> select ARCH_HAS_SET_DIRECT_MAP if MMU
> --
> 2.25.1