Linux Audio

Check our new training course

Loading...
v5.9
  1// SPDX-License-Identifier: GPL-2.0-or-later
  2/*
  3 *  Kernel Probes (KProbes)
  4 *
 
 
 
 
 
 
 
 
 
 
 
 
 
 
  5 * Copyright (C) IBM Corporation, 2002, 2004
  6 *
  7 * 2002-Oct	Created by Vamsi Krishna S <vamsi_krishna@in.ibm.com> Kernel
  8 *		Probes initial implementation ( includes contributions from
  9 *		Rusty Russell).
 10 * 2004-July	Suparna Bhattacharya <suparna@in.ibm.com> added jumper probes
 11 *		interface to access function arguments.
 12 * 2004-Nov	Ananth N Mavinakayanahalli <ananth@in.ibm.com> kprobes port
 13 *		for PPC64
 14 */
 15
 16#include <linux/kprobes.h>
 17#include <linux/ptrace.h>
 18#include <linux/preempt.h>
 19#include <linux/extable.h>
 20#include <linux/kdebug.h>
 21#include <linux/slab.h>
 22#include <asm/code-patching.h>
 23#include <asm/cacheflush.h>
 24#include <asm/sstep.h>
 25#include <asm/sections.h>
 26#include <asm/inst.h>
 27#include <linux/uaccess.h>
 28
 29DEFINE_PER_CPU(struct kprobe *, current_kprobe) = NULL;
 30DEFINE_PER_CPU(struct kprobe_ctlblk, kprobe_ctlblk);
 31
 32struct kretprobe_blackpoint kretprobe_blacklist[] = {{NULL, NULL}};
 33
 34bool arch_within_kprobe_blacklist(unsigned long addr)
 35{
 36	return  (addr >= (unsigned long)__kprobes_text_start &&
 37		 addr < (unsigned long)__kprobes_text_end) ||
 38		(addr >= (unsigned long)_stext &&
 39		 addr < (unsigned long)__head_end);
 40}
 41
 42kprobe_opcode_t *kprobe_lookup_name(const char *name, unsigned int offset)
 43{
 44	kprobe_opcode_t *addr = NULL;
 45
 46#ifdef PPC64_ELF_ABI_v2
 47	/* PPC64 ABIv2 needs local entry point */
 48	addr = (kprobe_opcode_t *)kallsyms_lookup_name(name);
 49	if (addr && !offset) {
 50#ifdef CONFIG_KPROBES_ON_FTRACE
 51		unsigned long faddr;
 52		/*
 53		 * Per livepatch.h, ftrace location is always within the first
 54		 * 16 bytes of a function on powerpc with -mprofile-kernel.
 55		 */
 56		faddr = ftrace_location_range((unsigned long)addr,
 57					      (unsigned long)addr + 16);
 58		if (faddr)
 59			addr = (kprobe_opcode_t *)faddr;
 60		else
 61#endif
 62			addr = (kprobe_opcode_t *)ppc_function_entry(addr);
 63	}
 64#elif defined(PPC64_ELF_ABI_v1)
 65	/*
 66	 * 64bit powerpc ABIv1 uses function descriptors:
 67	 * - Check for the dot variant of the symbol first.
 68	 * - If that fails, try looking up the symbol provided.
 69	 *
 70	 * This ensures we always get to the actual symbol and not
 71	 * the descriptor.
 72	 *
 73	 * Also handle <module:symbol> format.
 74	 */
 75	char dot_name[MODULE_NAME_LEN + 1 + KSYM_NAME_LEN];
 76	bool dot_appended = false;
 77	const char *c;
 78	ssize_t ret = 0;
 79	int len = 0;
 80
 81	if ((c = strnchr(name, MODULE_NAME_LEN, ':')) != NULL) {
 82		c++;
 83		len = c - name;
 84		memcpy(dot_name, name, len);
 85	} else
 86		c = name;
 87
 88	if (*c != '\0' && *c != '.') {
 89		dot_name[len++] = '.';
 90		dot_appended = true;
 91	}
 92	ret = strscpy(dot_name + len, c, KSYM_NAME_LEN);
 93	if (ret > 0)
 94		addr = (kprobe_opcode_t *)kallsyms_lookup_name(dot_name);
 95
 96	/* Fallback to the original non-dot symbol lookup */
 97	if (!addr && dot_appended)
 98		addr = (kprobe_opcode_t *)kallsyms_lookup_name(name);
 99#else
100	addr = (kprobe_opcode_t *)kallsyms_lookup_name(name);
101#endif
102
103	return addr;
104}
105
106int arch_prepare_kprobe(struct kprobe *p)
107{
108	int ret = 0;
109	struct kprobe *prev;
110	struct ppc_inst insn = ppc_inst_read((struct ppc_inst *)p->addr);
111	struct ppc_inst prefix = ppc_inst_read((struct ppc_inst *)(p->addr - 1));
112
113	if ((unsigned long)p->addr & 0x03) {
114		printk("Attempt to register kprobe at an unaligned address\n");
115		ret = -EINVAL;
116	} else if (IS_MTMSRD(insn) || IS_RFID(insn) || IS_RFI(insn)) {
117		printk("Cannot register a kprobe on rfi/rfid or mtmsr[d]\n");
118		ret = -EINVAL;
119	} else if (ppc_inst_prefixed(prefix)) {
120		printk("Cannot register a kprobe on the second word of prefixed instruction\n");
121		ret = -EINVAL;
122	}
123	preempt_disable();
124	prev = get_kprobe(p->addr - 1);
125	preempt_enable_no_resched();
126	if (prev &&
127	    ppc_inst_prefixed(ppc_inst_read((struct ppc_inst *)prev->ainsn.insn))) {
128		printk("Cannot register a kprobe on the second word of prefixed instruction\n");
129		ret = -EINVAL;
130	}
131
132	/* insn must be on a special executable page on ppc64.  This is
133	 * not explicitly required on ppc32 (right now), but it doesn't hurt */
134	if (!ret) {
135		p->ainsn.insn = get_insn_slot();
136		if (!p->ainsn.insn)
137			ret = -ENOMEM;
138	}
139
140	if (!ret) {
141		patch_instruction((struct ppc_inst *)p->ainsn.insn, insn);
142		p->opcode = ppc_inst_val(insn);
 
 
 
143	}
144
145	p->ainsn.boostable = 0;
146	return ret;
147}
148NOKPROBE_SYMBOL(arch_prepare_kprobe);
149
150void arch_arm_kprobe(struct kprobe *p)
151{
152	patch_instruction((struct ppc_inst *)p->addr, ppc_inst(BREAKPOINT_INSTRUCTION));
 
 
153}
154NOKPROBE_SYMBOL(arch_arm_kprobe);
155
156void arch_disarm_kprobe(struct kprobe *p)
157{
158	patch_instruction((struct ppc_inst *)p->addr, ppc_inst(p->opcode));
 
 
159}
160NOKPROBE_SYMBOL(arch_disarm_kprobe);
161
162void arch_remove_kprobe(struct kprobe *p)
163{
164	if (p->ainsn.insn) {
165		free_insn_slot(p->ainsn.insn, 0);
166		p->ainsn.insn = NULL;
167	}
168}
169NOKPROBE_SYMBOL(arch_remove_kprobe);
170
171static nokprobe_inline void prepare_singlestep(struct kprobe *p, struct pt_regs *regs)
172{
173	enable_single_step(regs);
174
175	/*
176	 * On powerpc we should single step on the original
177	 * instruction even if the probed insn is a trap
178	 * variant as values in regs could play a part in
179	 * if the trap is taken or not
180	 */
181	regs->nip = (unsigned long)p->ainsn.insn;
182}
183
184static nokprobe_inline void save_previous_kprobe(struct kprobe_ctlblk *kcb)
185{
186	kcb->prev_kprobe.kp = kprobe_running();
187	kcb->prev_kprobe.status = kcb->kprobe_status;
188	kcb->prev_kprobe.saved_msr = kcb->kprobe_saved_msr;
189}
190
191static nokprobe_inline void restore_previous_kprobe(struct kprobe_ctlblk *kcb)
192{
193	__this_cpu_write(current_kprobe, kcb->prev_kprobe.kp);
194	kcb->kprobe_status = kcb->prev_kprobe.status;
195	kcb->kprobe_saved_msr = kcb->prev_kprobe.saved_msr;
196}
197
198static nokprobe_inline void set_current_kprobe(struct kprobe *p, struct pt_regs *regs,
199				struct kprobe_ctlblk *kcb)
200{
201	__this_cpu_write(current_kprobe, p);
202	kcb->kprobe_saved_msr = regs->msr;
203}
204
205bool arch_kprobe_on_func_entry(unsigned long offset)
206{
207#ifdef PPC64_ELF_ABI_v2
208#ifdef CONFIG_KPROBES_ON_FTRACE
209	return offset <= 16;
210#else
211	return offset <= 8;
212#endif
213#else
214	return !offset;
215#endif
216}
217
218void arch_prepare_kretprobe(struct kretprobe_instance *ri, struct pt_regs *regs)
219{
220	ri->ret_addr = (kprobe_opcode_t *)regs->link;
221
222	/* Replace the return addr with trampoline addr */
223	regs->link = (unsigned long)kretprobe_trampoline;
224}
225NOKPROBE_SYMBOL(arch_prepare_kretprobe);
226
227static int try_to_emulate(struct kprobe *p, struct pt_regs *regs)
228{
229	int ret;
230	struct ppc_inst insn = ppc_inst_read((struct ppc_inst *)p->ainsn.insn);
231
232	/* regs->nip is also adjusted if emulate_step returns 1 */
233	ret = emulate_step(regs, insn);
234	if (ret > 0) {
235		/*
236		 * Once this instruction has been boosted
237		 * successfully, set the boostable flag
238		 */
239		if (unlikely(p->ainsn.boostable == 0))
240			p->ainsn.boostable = 1;
241	} else if (ret < 0) {
242		/*
243		 * We don't allow kprobes on mtmsr(d)/rfi(d), etc.
244		 * So, we should never get here... but, its still
245		 * good to catch them, just in case...
246		 */
247		printk("Can't step on instruction %s\n", ppc_inst_as_str(insn));
248		BUG();
249	} else {
250		/*
251		 * If we haven't previously emulated this instruction, then it
252		 * can't be boosted. Note it down so we don't try to do so again.
253		 *
254		 * If, however, we had emulated this instruction in the past,
255		 * then this is just an error with the current run (for
256		 * instance, exceptions due to a load/store). We return 0 so
257		 * that this is now single-stepped, but continue to try
258		 * emulating it in subsequent probe hits.
259		 */
260		if (unlikely(p->ainsn.boostable != 1))
261			p->ainsn.boostable = -1;
262	}
263
264	return ret;
265}
266NOKPROBE_SYMBOL(try_to_emulate);
267
268int kprobe_handler(struct pt_regs *regs)
269{
270	struct kprobe *p;
271	int ret = 0;
272	unsigned int *addr = (unsigned int *)regs->nip;
273	struct kprobe_ctlblk *kcb;
274
275	if (user_mode(regs))
276		return 0;
277
278	if (!(regs->msr & MSR_IR) || !(regs->msr & MSR_DR))
279		return 0;
280
281	/*
282	 * We don't want to be preempted for the entire
283	 * duration of kprobe processing
284	 */
285	preempt_disable();
286	kcb = get_kprobe_ctlblk();
287
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
288	p = get_kprobe(addr);
289	if (!p) {
290		unsigned int instr;
291
292		if (get_kernel_nofault(instr, addr))
293			goto no_kprobe;
294
295		if (instr != BREAKPOINT_INSTRUCTION) {
296			/*
297			 * PowerPC has multiple variants of the "trap"
298			 * instruction. If the current instruction is a
299			 * trap variant, it could belong to someone else
300			 */
301			if (is_trap(instr))
302				goto no_kprobe;
 
303			/*
304			 * The breakpoint instruction was removed right
305			 * after we hit it.  Another cpu has removed
306			 * either a probepoint or a debugger breakpoint
307			 * at this address.  In either case, no further
308			 * handling of this interrupt is appropriate.
309			 */
310			ret = 1;
311		}
312		/* Not one of ours: let kernel handle it */
313		goto no_kprobe;
314	}
315
316	/* Check we're not actually recursing */
317	if (kprobe_running()) {
318		kprobe_opcode_t insn = *p->ainsn.insn;
319		if (kcb->kprobe_status == KPROBE_HIT_SS && is_trap(insn)) {
320			/* Turn off 'trace' bits */
321			regs->msr &= ~MSR_SINGLESTEP;
322			regs->msr |= kcb->kprobe_saved_msr;
323			goto no_kprobe;
324		}
325
326		/*
327		 * We have reentered the kprobe_handler(), since another probe
328		 * was hit while within the handler. We here save the original
329		 * kprobes variables and just single step on the instruction of
330		 * the new probe without calling any user handlers.
331		 */
332		save_previous_kprobe(kcb);
333		set_current_kprobe(p, regs, kcb);
334		kprobes_inc_nmissed_count(p);
335		kcb->kprobe_status = KPROBE_REENTER;
336		if (p->ainsn.boostable >= 0) {
337			ret = try_to_emulate(p, regs);
338
339			if (ret > 0) {
340				restore_previous_kprobe(kcb);
341				preempt_enable_no_resched();
342				return 1;
343			}
344		}
345		prepare_singlestep(p, regs);
346		return 1;
347	}
348
349	kcb->kprobe_status = KPROBE_HIT_ACTIVE;
350	set_current_kprobe(p, regs, kcb);
351	if (p->pre_handler && p->pre_handler(p, regs)) {
352		/* handler changed execution path, so skip ss setup */
353		reset_current_kprobe();
354		preempt_enable_no_resched();
355		return 1;
356	}
357
 
358	if (p->ainsn.boostable >= 0) {
359		ret = try_to_emulate(p, regs);
360
 
 
361		if (ret > 0) {
 
 
 
 
 
 
 
362			if (p->post_handler)
363				p->post_handler(p, regs, 0);
364
365			kcb->kprobe_status = KPROBE_HIT_SSDONE;
366			reset_current_kprobe();
367			preempt_enable_no_resched();
368			return 1;
369		}
 
 
 
 
 
 
 
 
 
 
370	}
371	prepare_singlestep(p, regs);
372	kcb->kprobe_status = KPROBE_HIT_SS;
373	return 1;
374
375no_kprobe:
376	preempt_enable_no_resched();
377	return ret;
378}
379NOKPROBE_SYMBOL(kprobe_handler);
380
381/*
382 * Function return probe trampoline:
383 * 	- init_kprobes() establishes a probepoint here
384 * 	- When the probed function returns, this probe
385 * 		causes the handlers to fire
386 */
387asm(".global kretprobe_trampoline\n"
388	".type kretprobe_trampoline, @function\n"
389	"kretprobe_trampoline:\n"
390	"nop\n"
391	"blr\n"
392	".size kretprobe_trampoline, .-kretprobe_trampoline\n");
393
394/*
395 * Called when the probe at kretprobe trampoline is hit
396 */
397static int trampoline_probe_handler(struct kprobe *p, struct pt_regs *regs)
 
398{
399	struct kretprobe_instance *ri = NULL;
400	struct hlist_head *head, empty_rp;
401	struct hlist_node *tmp;
402	unsigned long flags, orig_ret_address = 0;
403	unsigned long trampoline_address =(unsigned long)&kretprobe_trampoline;
404
405	INIT_HLIST_HEAD(&empty_rp);
406	kretprobe_hash_lock(current, &head, &flags);
407
408	/*
409	 * It is possible to have multiple instances associated with a given
410	 * task either because an multiple functions in the call path
411	 * have a return probe installed on them, and/or more than one return
412	 * return probe was registered for a target function.
413	 *
414	 * We can handle this because:
415	 *     - instances are always inserted at the head of the list
416	 *     - when multiple return probes are registered for the same
417	 *       function, the first instance's ret_addr will point to the
418	 *       real return address, and all the rest will point to
419	 *       kretprobe_trampoline
420	 */
421	hlist_for_each_entry_safe(ri, tmp, head, hlist) {
422		if (ri->task != current)
423			/* another task is sharing our hash bucket */
424			continue;
425
426		if (ri->rp && ri->rp->handler)
427			ri->rp->handler(ri, regs);
428
429		orig_ret_address = (unsigned long)ri->ret_addr;
430		recycle_rp_inst(ri, &empty_rp);
431
432		if (orig_ret_address != trampoline_address)
433			/*
434			 * This is the real return address. Any other
435			 * instances associated with this task are for
436			 * other calls deeper on the call stack
437			 */
438			break;
439	}
440
441	kretprobe_assert(ri, orig_ret_address, trampoline_address);
 
442
443	/*
444	 * We get here through one of two paths:
445	 * 1. by taking a trap -> kprobe_handler() -> here
446	 * 2. by optprobe branch -> optimized_callback() -> opt_pre_handler() -> here
447	 *
448	 * When going back through (1), we need regs->nip to be setup properly
449	 * as it is used to determine the return address from the trap.
450	 * For (2), since nip is not honoured with optprobes, we instead setup
451	 * the link register properly so that the subsequent 'blr' in
452	 * kretprobe_trampoline jumps back to the right instruction.
453	 *
454	 * For nip, we should set the address to the previous instruction since
455	 * we end up emulating it in kprobe_handler(), which increments the nip
456	 * again.
457	 */
458	regs->nip = orig_ret_address - 4;
459	regs->link = orig_ret_address;
460
461	kretprobe_hash_unlock(current, &flags);
 
462
463	hlist_for_each_entry_safe(ri, tmp, &empty_rp, hlist) {
464		hlist_del(&ri->hlist);
465		kfree(ri);
466	}
467
468	return 0;
 
 
 
 
469}
470NOKPROBE_SYMBOL(trampoline_probe_handler);
471
472/*
473 * Called after single-stepping.  p->addr is the address of the
474 * instruction whose first byte has been replaced by the "breakpoint"
475 * instruction.  To avoid the SMP problems that can occur when we
476 * temporarily put back the original opcode to single-step, we
477 * single-stepped a copy of the instruction.  The address of this
478 * copy is p->ainsn.insn.
479 */
480int kprobe_post_handler(struct pt_regs *regs)
481{
482	int len;
483	struct kprobe *cur = kprobe_running();
484	struct kprobe_ctlblk *kcb = get_kprobe_ctlblk();
485
486	if (!cur || user_mode(regs))
487		return 0;
488
489	len = ppc_inst_len(ppc_inst_read((struct ppc_inst *)cur->ainsn.insn));
490	/* make sure we got here for instruction we have a kprobe on */
491	if (((unsigned long)cur->ainsn.insn + len) != regs->nip)
492		return 0;
493
494	if ((kcb->kprobe_status != KPROBE_REENTER) && cur->post_handler) {
495		kcb->kprobe_status = KPROBE_HIT_SSDONE;
496		cur->post_handler(cur, regs, 0);
497	}
498
499	/* Adjust nip to after the single-stepped instruction */
500	regs->nip = (unsigned long)cur->addr + len;
501	regs->msr |= kcb->kprobe_saved_msr;
502
503	/*Restore back the original saved kprobes variables and continue. */
504	if (kcb->kprobe_status == KPROBE_REENTER) {
505		restore_previous_kprobe(kcb);
506		goto out;
507	}
508	reset_current_kprobe();
509out:
510	preempt_enable_no_resched();
511
512	/*
513	 * if somebody else is singlestepping across a probe point, msr
514	 * will have DE/SE set, in which case, continue the remaining processing
515	 * of do_debug, as if this is not a probe hit.
516	 */
517	if (regs->msr & MSR_SINGLESTEP)
518		return 0;
519
520	return 1;
521}
522NOKPROBE_SYMBOL(kprobe_post_handler);
523
524int kprobe_fault_handler(struct pt_regs *regs, int trapnr)
525{
526	struct kprobe *cur = kprobe_running();
527	struct kprobe_ctlblk *kcb = get_kprobe_ctlblk();
528	const struct exception_table_entry *entry;
529
530	switch(kcb->kprobe_status) {
531	case KPROBE_HIT_SS:
532	case KPROBE_REENTER:
533		/*
534		 * We are here because the instruction being single
535		 * stepped caused a page fault. We reset the current
536		 * kprobe and the nip points back to the probe address
537		 * and allow the page fault handler to continue as a
538		 * normal page fault.
539		 */
540		regs->nip = (unsigned long)cur->addr;
541		regs->msr &= ~MSR_SINGLESTEP; /* Turn off 'trace' bits */
542		regs->msr |= kcb->kprobe_saved_msr;
543		if (kcb->kprobe_status == KPROBE_REENTER)
544			restore_previous_kprobe(kcb);
545		else
546			reset_current_kprobe();
547		preempt_enable_no_resched();
548		break;
549	case KPROBE_HIT_ACTIVE:
550	case KPROBE_HIT_SSDONE:
551		/*
552		 * We increment the nmissed count for accounting,
553		 * we can also use npre/npostfault count for accounting
554		 * these specific fault cases.
555		 */
556		kprobes_inc_nmissed_count(cur);
557
558		/*
559		 * We come here because instructions in the pre/post
560		 * handler caused the page_fault, this could happen
561		 * if handler tries to access user space by
562		 * copy_from_user(), get_user() etc. Let the
563		 * user-specified handler try to fix it first.
564		 */
565		if (cur->fault_handler && cur->fault_handler(cur, regs, trapnr))
566			return 1;
567
568		/*
569		 * In case the user-specified fault handler returned
570		 * zero, try to fix up.
571		 */
572		if ((entry = search_exception_tables(regs->nip)) != NULL) {
573			regs->nip = extable_fixup(entry);
574			return 1;
575		}
576
577		/*
578		 * fixup_exception() could not handle it,
579		 * Let do_page_fault() fix it.
580		 */
581		break;
582	default:
583		break;
584	}
585	return 0;
586}
587NOKPROBE_SYMBOL(kprobe_fault_handler);
588
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
589unsigned long arch_deref_entry_point(void *entry)
590{
591#ifdef PPC64_ELF_ABI_v1
592	if (!kernel_text_address((unsigned long)entry))
593		return ppc_global_function_entry(entry);
594	else
 
 
 
 
 
 
 
 
 
 
 
595#endif
596		return (unsigned long)entry;
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
597}
598NOKPROBE_SYMBOL(arch_deref_entry_point);
599
600static struct kprobe trampoline_p = {
601	.addr = (kprobe_opcode_t *) &kretprobe_trampoline,
602	.pre_handler = trampoline_probe_handler
603};
604
605int __init arch_init_kprobes(void)
606{
607	return register_kprobe(&trampoline_p);
608}
609
610int arch_trampoline_kprobe(struct kprobe *p)
611{
612	if (p->addr == (kprobe_opcode_t *)&kretprobe_trampoline)
613		return 1;
614
615	return 0;
616}
617NOKPROBE_SYMBOL(arch_trampoline_kprobe);
v3.15
 
  1/*
  2 *  Kernel Probes (KProbes)
  3 *
  4 * This program is free software; you can redistribute it and/or modify
  5 * it under the terms of the GNU General Public License as published by
  6 * the Free Software Foundation; either version 2 of the License, or
  7 * (at your option) any later version.
  8 *
  9 * This program is distributed in the hope that it will be useful,
 10 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 11 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 12 * GNU General Public License for more details.
 13 *
 14 * You should have received a copy of the GNU General Public License
 15 * along with this program; if not, write to the Free Software
 16 * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
 17 *
 18 * Copyright (C) IBM Corporation, 2002, 2004
 19 *
 20 * 2002-Oct	Created by Vamsi Krishna S <vamsi_krishna@in.ibm.com> Kernel
 21 *		Probes initial implementation ( includes contributions from
 22 *		Rusty Russell).
 23 * 2004-July	Suparna Bhattacharya <suparna@in.ibm.com> added jumper probes
 24 *		interface to access function arguments.
 25 * 2004-Nov	Ananth N Mavinakayanahalli <ananth@in.ibm.com> kprobes port
 26 *		for PPC64
 27 */
 28
 29#include <linux/kprobes.h>
 30#include <linux/ptrace.h>
 31#include <linux/preempt.h>
 32#include <linux/module.h>
 33#include <linux/kdebug.h>
 34#include <linux/slab.h>
 
 35#include <asm/cacheflush.h>
 36#include <asm/sstep.h>
 37#include <asm/uaccess.h>
 
 
 38
 39DEFINE_PER_CPU(struct kprobe *, current_kprobe) = NULL;
 40DEFINE_PER_CPU(struct kprobe_ctlblk, kprobe_ctlblk);
 41
 42struct kretprobe_blackpoint kretprobe_blacklist[] = {{NULL, NULL}};
 43
 44int __kprobes arch_prepare_kprobe(struct kprobe *p)
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 45{
 46	int ret = 0;
 47	kprobe_opcode_t insn = *p->addr;
 
 
 48
 49	if ((unsigned long)p->addr & 0x03) {
 50		printk("Attempt to register kprobe at an unaligned address\n");
 51		ret = -EINVAL;
 52	} else if (IS_MTMSRD(insn) || IS_RFID(insn) || IS_RFI(insn)) {
 53		printk("Cannot register a kprobe on rfi/rfid or mtmsr[d]\n");
 54		ret = -EINVAL;
 
 
 
 
 
 
 
 
 
 
 
 55	}
 56
 57	/* insn must be on a special executable page on ppc64.  This is
 58	 * not explicitly required on ppc32 (right now), but it doesn't hurt */
 59	if (!ret) {
 60		p->ainsn.insn = get_insn_slot();
 61		if (!p->ainsn.insn)
 62			ret = -ENOMEM;
 63	}
 64
 65	if (!ret) {
 66		memcpy(p->ainsn.insn, p->addr,
 67				MAX_INSN_SIZE * sizeof(kprobe_opcode_t));
 68		p->opcode = *p->addr;
 69		flush_icache_range((unsigned long)p->ainsn.insn,
 70			(unsigned long)p->ainsn.insn + sizeof(kprobe_opcode_t));
 71	}
 72
 73	p->ainsn.boostable = 0;
 74	return ret;
 75}
 
 76
 77void __kprobes arch_arm_kprobe(struct kprobe *p)
 78{
 79	*p->addr = BREAKPOINT_INSTRUCTION;
 80	flush_icache_range((unsigned long) p->addr,
 81			   (unsigned long) p->addr + sizeof(kprobe_opcode_t));
 82}
 
 83
 84void __kprobes arch_disarm_kprobe(struct kprobe *p)
 85{
 86	*p->addr = p->opcode;
 87	flush_icache_range((unsigned long) p->addr,
 88			   (unsigned long) p->addr + sizeof(kprobe_opcode_t));
 89}
 
 90
 91void __kprobes arch_remove_kprobe(struct kprobe *p)
 92{
 93	if (p->ainsn.insn) {
 94		free_insn_slot(p->ainsn.insn, 0);
 95		p->ainsn.insn = NULL;
 96	}
 97}
 
 98
 99static void __kprobes prepare_singlestep(struct kprobe *p, struct pt_regs *regs)
100{
101	enable_single_step(regs);
102
103	/*
104	 * On powerpc we should single step on the original
105	 * instruction even if the probed insn is a trap
106	 * variant as values in regs could play a part in
107	 * if the trap is taken or not
108	 */
109	regs->nip = (unsigned long)p->ainsn.insn;
110}
111
112static void __kprobes save_previous_kprobe(struct kprobe_ctlblk *kcb)
113{
114	kcb->prev_kprobe.kp = kprobe_running();
115	kcb->prev_kprobe.status = kcb->kprobe_status;
116	kcb->prev_kprobe.saved_msr = kcb->kprobe_saved_msr;
117}
118
119static void __kprobes restore_previous_kprobe(struct kprobe_ctlblk *kcb)
120{
121	__get_cpu_var(current_kprobe) = kcb->prev_kprobe.kp;
122	kcb->kprobe_status = kcb->prev_kprobe.status;
123	kcb->kprobe_saved_msr = kcb->prev_kprobe.saved_msr;
124}
125
126static void __kprobes set_current_kprobe(struct kprobe *p, struct pt_regs *regs,
127				struct kprobe_ctlblk *kcb)
128{
129	__get_cpu_var(current_kprobe) = p;
130	kcb->kprobe_saved_msr = regs->msr;
131}
132
133void __kprobes arch_prepare_kretprobe(struct kretprobe_instance *ri,
134				      struct pt_regs *regs)
 
 
 
 
 
 
 
 
 
 
 
 
135{
136	ri->ret_addr = (kprobe_opcode_t *)regs->link;
137
138	/* Replace the return addr with trampoline addr */
139	regs->link = (unsigned long)kretprobe_trampoline;
140}
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
141
142static int __kprobes kprobe_handler(struct pt_regs *regs)
143{
144	struct kprobe *p;
145	int ret = 0;
146	unsigned int *addr = (unsigned int *)regs->nip;
147	struct kprobe_ctlblk *kcb;
148
 
 
 
 
 
 
149	/*
150	 * We don't want to be preempted for the entire
151	 * duration of kprobe processing
152	 */
153	preempt_disable();
154	kcb = get_kprobe_ctlblk();
155
156	/* Check we're not actually recursing */
157	if (kprobe_running()) {
158		p = get_kprobe(addr);
159		if (p) {
160			kprobe_opcode_t insn = *p->ainsn.insn;
161			if (kcb->kprobe_status == KPROBE_HIT_SS &&
162					is_trap(insn)) {
163				/* Turn off 'trace' bits */
164				regs->msr &= ~MSR_SINGLESTEP;
165				regs->msr |= kcb->kprobe_saved_msr;
166				goto no_kprobe;
167			}
168			/* We have reentered the kprobe_handler(), since
169			 * another probe was hit while within the handler.
170			 * We here save the original kprobes variables and
171			 * just single step on the instruction of the new probe
172			 * without calling any user handlers.
173			 */
174			save_previous_kprobe(kcb);
175			set_current_kprobe(p, regs, kcb);
176			kcb->kprobe_saved_msr = regs->msr;
177			kprobes_inc_nmissed_count(p);
178			prepare_singlestep(p, regs);
179			kcb->kprobe_status = KPROBE_REENTER;
180			return 1;
181		} else {
182			if (*addr != BREAKPOINT_INSTRUCTION) {
183				/* If trap variant, then it belongs not to us */
184				kprobe_opcode_t cur_insn = *addr;
185				if (is_trap(cur_insn))
186		       			goto no_kprobe;
187				/* The breakpoint instruction was removed by
188				 * another cpu right after we hit, no further
189				 * handling of this interrupt is appropriate
190				 */
191				ret = 1;
192				goto no_kprobe;
193			}
194			p = __get_cpu_var(current_kprobe);
195			if (p->break_handler && p->break_handler(p, regs)) {
196				goto ss_probe;
197			}
198		}
199		goto no_kprobe;
200	}
201
202	p = get_kprobe(addr);
203	if (!p) {
204		if (*addr != BREAKPOINT_INSTRUCTION) {
 
 
 
 
 
205			/*
206			 * PowerPC has multiple variants of the "trap"
207			 * instruction. If the current instruction is a
208			 * trap variant, it could belong to someone else
209			 */
210			kprobe_opcode_t cur_insn = *addr;
211			if (is_trap(cur_insn))
212		       		goto no_kprobe;
213			/*
214			 * The breakpoint instruction was removed right
215			 * after we hit it.  Another cpu has removed
216			 * either a probepoint or a debugger breakpoint
217			 * at this address.  In either case, no further
218			 * handling of this interrupt is appropriate.
219			 */
220			ret = 1;
221		}
222		/* Not one of ours: let kernel handle it */
223		goto no_kprobe;
224	}
225
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
226	kcb->kprobe_status = KPROBE_HIT_ACTIVE;
227	set_current_kprobe(p, regs, kcb);
228	if (p->pre_handler && p->pre_handler(p, regs))
229		/* handler has already set things up, so skip ss setup */
 
 
230		return 1;
 
231
232ss_probe:
233	if (p->ainsn.boostable >= 0) {
234		unsigned int insn = *p->ainsn.insn;
235
236		/* regs->nip is also adjusted if emulate_step returns 1 */
237		ret = emulate_step(regs, insn);
238		if (ret > 0) {
239			/*
240			 * Once this instruction has been boosted
241			 * successfully, set the boostable flag
242			 */
243			if (unlikely(p->ainsn.boostable == 0))
244				p->ainsn.boostable = 1;
245
246			if (p->post_handler)
247				p->post_handler(p, regs, 0);
248
249			kcb->kprobe_status = KPROBE_HIT_SSDONE;
250			reset_current_kprobe();
251			preempt_enable_no_resched();
252			return 1;
253		} else if (ret < 0) {
254			/*
255			 * We don't allow kprobes on mtmsr(d)/rfi(d), etc.
256			 * So, we should never get here... but, its still
257			 * good to catch them, just in case...
258			 */
259			printk("Can't step on instruction %x\n", insn);
260			BUG();
261		} else if (ret == 0)
262			/* This instruction can't be boosted */
263			p->ainsn.boostable = -1;
264	}
265	prepare_singlestep(p, regs);
266	kcb->kprobe_status = KPROBE_HIT_SS;
267	return 1;
268
269no_kprobe:
270	preempt_enable_no_resched();
271	return ret;
272}
 
273
274/*
275 * Function return probe trampoline:
276 * 	- init_kprobes() establishes a probepoint here
277 * 	- When the probed function returns, this probe
278 * 		causes the handlers to fire
279 */
280static void __used kretprobe_trampoline_holder(void)
281{
282	asm volatile(".global kretprobe_trampoline\n"
283			"kretprobe_trampoline:\n"
284			"nop\n");
285}
286
287/*
288 * Called when the probe at kretprobe trampoline is hit
289 */
290static int __kprobes trampoline_probe_handler(struct kprobe *p,
291						struct pt_regs *regs)
292{
293	struct kretprobe_instance *ri = NULL;
294	struct hlist_head *head, empty_rp;
295	struct hlist_node *tmp;
296	unsigned long flags, orig_ret_address = 0;
297	unsigned long trampoline_address =(unsigned long)&kretprobe_trampoline;
298
299	INIT_HLIST_HEAD(&empty_rp);
300	kretprobe_hash_lock(current, &head, &flags);
301
302	/*
303	 * It is possible to have multiple instances associated with a given
304	 * task either because an multiple functions in the call path
305	 * have a return probe installed on them, and/or more than one return
306	 * return probe was registered for a target function.
307	 *
308	 * We can handle this because:
309	 *     - instances are always inserted at the head of the list
310	 *     - when multiple return probes are registered for the same
311	 *       function, the first instance's ret_addr will point to the
312	 *       real return address, and all the rest will point to
313	 *       kretprobe_trampoline
314	 */
315	hlist_for_each_entry_safe(ri, tmp, head, hlist) {
316		if (ri->task != current)
317			/* another task is sharing our hash bucket */
318			continue;
319
320		if (ri->rp && ri->rp->handler)
321			ri->rp->handler(ri, regs);
322
323		orig_ret_address = (unsigned long)ri->ret_addr;
324		recycle_rp_inst(ri, &empty_rp);
325
326		if (orig_ret_address != trampoline_address)
327			/*
328			 * This is the real return address. Any other
329			 * instances associated with this task are for
330			 * other calls deeper on the call stack
331			 */
332			break;
333	}
334
335	kretprobe_assert(ri, orig_ret_address, trampoline_address);
336	regs->nip = orig_ret_address;
337
338	reset_current_kprobe();
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
339	kretprobe_hash_unlock(current, &flags);
340	preempt_enable_no_resched();
341
342	hlist_for_each_entry_safe(ri, tmp, &empty_rp, hlist) {
343		hlist_del(&ri->hlist);
344		kfree(ri);
345	}
346	/*
347	 * By returning a non-zero value, we are telling
348	 * kprobe_handler() that we don't want the post_handler
349	 * to run (and have re-enabled preemption)
350	 */
351	return 1;
352}
 
353
354/*
355 * Called after single-stepping.  p->addr is the address of the
356 * instruction whose first byte has been replaced by the "breakpoint"
357 * instruction.  To avoid the SMP problems that can occur when we
358 * temporarily put back the original opcode to single-step, we
359 * single-stepped a copy of the instruction.  The address of this
360 * copy is p->ainsn.insn.
361 */
362static int __kprobes post_kprobe_handler(struct pt_regs *regs)
363{
 
364	struct kprobe *cur = kprobe_running();
365	struct kprobe_ctlblk *kcb = get_kprobe_ctlblk();
366
367	if (!cur)
368		return 0;
369
 
370	/* make sure we got here for instruction we have a kprobe on */
371	if (((unsigned long)cur->ainsn.insn + 4) != regs->nip)
372		return 0;
373
374	if ((kcb->kprobe_status != KPROBE_REENTER) && cur->post_handler) {
375		kcb->kprobe_status = KPROBE_HIT_SSDONE;
376		cur->post_handler(cur, regs, 0);
377	}
378
379	/* Adjust nip to after the single-stepped instruction */
380	regs->nip = (unsigned long)cur->addr + 4;
381	regs->msr |= kcb->kprobe_saved_msr;
382
383	/*Restore back the original saved kprobes variables and continue. */
384	if (kcb->kprobe_status == KPROBE_REENTER) {
385		restore_previous_kprobe(kcb);
386		goto out;
387	}
388	reset_current_kprobe();
389out:
390	preempt_enable_no_resched();
391
392	/*
393	 * if somebody else is singlestepping across a probe point, msr
394	 * will have DE/SE set, in which case, continue the remaining processing
395	 * of do_debug, as if this is not a probe hit.
396	 */
397	if (regs->msr & MSR_SINGLESTEP)
398		return 0;
399
400	return 1;
401}
 
402
403int __kprobes kprobe_fault_handler(struct pt_regs *regs, int trapnr)
404{
405	struct kprobe *cur = kprobe_running();
406	struct kprobe_ctlblk *kcb = get_kprobe_ctlblk();
407	const struct exception_table_entry *entry;
408
409	switch(kcb->kprobe_status) {
410	case KPROBE_HIT_SS:
411	case KPROBE_REENTER:
412		/*
413		 * We are here because the instruction being single
414		 * stepped caused a page fault. We reset the current
415		 * kprobe and the nip points back to the probe address
416		 * and allow the page fault handler to continue as a
417		 * normal page fault.
418		 */
419		regs->nip = (unsigned long)cur->addr;
420		regs->msr &= ~MSR_SINGLESTEP; /* Turn off 'trace' bits */
421		regs->msr |= kcb->kprobe_saved_msr;
422		if (kcb->kprobe_status == KPROBE_REENTER)
423			restore_previous_kprobe(kcb);
424		else
425			reset_current_kprobe();
426		preempt_enable_no_resched();
427		break;
428	case KPROBE_HIT_ACTIVE:
429	case KPROBE_HIT_SSDONE:
430		/*
431		 * We increment the nmissed count for accounting,
432		 * we can also use npre/npostfault count for accounting
433		 * these specific fault cases.
434		 */
435		kprobes_inc_nmissed_count(cur);
436
437		/*
438		 * We come here because instructions in the pre/post
439		 * handler caused the page_fault, this could happen
440		 * if handler tries to access user space by
441		 * copy_from_user(), get_user() etc. Let the
442		 * user-specified handler try to fix it first.
443		 */
444		if (cur->fault_handler && cur->fault_handler(cur, regs, trapnr))
445			return 1;
446
447		/*
448		 * In case the user-specified fault handler returned
449		 * zero, try to fix up.
450		 */
451		if ((entry = search_exception_tables(regs->nip)) != NULL) {
452			regs->nip = entry->fixup;
453			return 1;
454		}
455
456		/*
457		 * fixup_exception() could not handle it,
458		 * Let do_page_fault() fix it.
459		 */
460		break;
461	default:
462		break;
463	}
464	return 0;
465}
 
466
467/*
468 * Wrapper routine to for handling exceptions.
469 */
470int __kprobes kprobe_exceptions_notify(struct notifier_block *self,
471				       unsigned long val, void *data)
472{
473	struct die_args *args = (struct die_args *)data;
474	int ret = NOTIFY_DONE;
475
476	if (args->regs && user_mode(args->regs))
477		return ret;
478
479	switch (val) {
480	case DIE_BPT:
481		if (kprobe_handler(args->regs))
482			ret = NOTIFY_STOP;
483		break;
484	case DIE_SSTEP:
485		if (post_kprobe_handler(args->regs))
486			ret = NOTIFY_STOP;
487		break;
488	default:
489		break;
490	}
491	return ret;
492}
493
494#ifdef CONFIG_PPC64
495unsigned long arch_deref_entry_point(void *entry)
496{
497	return ((func_descr_t *)entry)->entry;
498}
499#endif
500
501int __kprobes setjmp_pre_handler(struct kprobe *p, struct pt_regs *regs)
502{
503	struct jprobe *jp = container_of(p, struct jprobe, kp);
504	struct kprobe_ctlblk *kcb = get_kprobe_ctlblk();
505
506	memcpy(&kcb->jprobe_saved_regs, regs, sizeof(struct pt_regs));
507
508	/* setup return addr to the jprobe handler routine */
509	regs->nip = arch_deref_entry_point(jp->entry);
510#ifdef CONFIG_PPC64
511	regs->gpr[2] = (unsigned long)(((func_descr_t *)jp->entry)->toc);
512#endif
513
514	return 1;
515}
516
517void __used __kprobes jprobe_return(void)
518{
519	asm volatile("trap" ::: "memory");
520}
521
522static void __used __kprobes jprobe_return_end(void)
523{
524};
525
526int __kprobes longjmp_break_handler(struct kprobe *p, struct pt_regs *regs)
527{
528	struct kprobe_ctlblk *kcb = get_kprobe_ctlblk();
529
530	/*
531	 * FIXME - we should ideally be validating that we got here 'cos
532	 * of the "trap" in jprobe_return() above, before restoring the
533	 * saved regs...
534	 */
535	memcpy(regs, &kcb->jprobe_saved_regs, sizeof(struct pt_regs));
536	preempt_enable_no_resched();
537	return 1;
538}
 
539
540static struct kprobe trampoline_p = {
541	.addr = (kprobe_opcode_t *) &kretprobe_trampoline,
542	.pre_handler = trampoline_probe_handler
543};
544
545int __init arch_init_kprobes(void)
546{
547	return register_kprobe(&trampoline_p);
548}
549
550int __kprobes arch_trampoline_kprobe(struct kprobe *p)
551{
552	if (p->addr == (kprobe_opcode_t *)&kretprobe_trampoline)
553		return 1;
554
555	return 0;
556}