~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

TOMOYO Linux Cross Reference
Linux/arch/arc/kernel/kprobes.c

Version: ~ [ linux-5.4-rc7 ] ~ [ linux-5.3.11 ] ~ [ linux-5.2.21 ] ~ [ linux-5.1.21 ] ~ [ linux-5.0.21 ] ~ [ linux-4.20.17 ] ~ [ linux-4.19.84 ] ~ [ linux-4.18.20 ] ~ [ linux-4.17.19 ] ~ [ linux-4.16.18 ] ~ [ linux-4.15.18 ] ~ [ linux-4.14.154 ] ~ [ linux-4.13.16 ] ~ [ linux-4.12.14 ] ~ [ linux-4.11.12 ] ~ [ linux-4.10.17 ] ~ [ linux-4.9.201 ] ~ [ linux-4.8.17 ] ~ [ linux-4.7.10 ] ~ [ linux-4.6.7 ] ~ [ linux-4.5.7 ] ~ [ linux-4.4.201 ] ~ [ linux-4.3.6 ] ~ [ linux-4.2.8 ] ~ [ linux-4.1.52 ] ~ [ linux-4.0.9 ] ~ [ linux-3.19.8 ] ~ [ linux-3.18.140 ] ~ [ linux-3.17.8 ] ~ [ linux-3.16.77 ] ~ [ linux-3.15.10 ] ~ [ linux-3.14.79 ] ~ [ linux-3.13.11 ] ~ [ linux-3.12.74 ] ~ [ linux-3.11.10 ] ~ [ linux-3.10.108 ] ~ [ linux-3.9.11 ] ~ [ linux-3.8.13 ] ~ [ linux-3.7.10 ] ~ [ linux-3.6.11 ] ~ [ linux-3.5.7 ] ~ [ linux-3.4.113 ] ~ [ linux-3.3.8 ] ~ [ linux-3.2.102 ] ~ [ linux-3.1.10 ] ~ [ linux-3.0.101 ] ~ [ linux-2.6.32.71 ] ~ [ linux-2.6.0 ] ~ [ linux-2.4.37.11 ] ~ [ unix-v6-master ] ~ [ ccs-tools-1.8.5 ] ~ [ policy-sample ] ~
Architecture: ~ [ i386 ] ~ [ alpha ] ~ [ m68k ] ~ [ mips ] ~ [ ppc ] ~ [ sparc ] ~ [ sparc64 ] ~

  1 /*
  2  * Copyright (C) 2004, 2007-2010, 2011-2012 Synopsys, Inc. (www.synopsys.com)
  3  *
  4  * This program is free software; you can redistribute it and/or modify
  5  * it under the terms of the GNU General Public License version 2 as
  6  * published by the Free Software Foundation.
  7  */
  8 
  9 #include <linux/types.h>
 10 #include <linux/kprobes.h>
 11 #include <linux/slab.h>
 12 #include <linux/module.h>
 13 #include <linux/kdebug.h>
 14 #include <linux/sched.h>
 15 #include <linux/uaccess.h>
 16 #include <asm/cacheflush.h>
 17 #include <asm/current.h>
 18 #include <asm/disasm.h>
 19 
 20 #define MIN_STACK_SIZE(addr)    min((unsigned long)MAX_STACK_SIZE, \
 21                 (unsigned long)current_thread_info() + THREAD_SIZE - (addr))
 22 
 23 DEFINE_PER_CPU(struct kprobe *, current_kprobe) = NULL;
 24 DEFINE_PER_CPU(struct kprobe_ctlblk, kprobe_ctlblk);
 25 
 26 int __kprobes arch_prepare_kprobe(struct kprobe *p)
 27 {
 28         /* Attempt to probe at unaligned address */
 29         if ((unsigned long)p->addr & 0x01)
 30                 return -EINVAL;
 31 
 32         /* Address should not be in exception handling code */
 33 
 34         p->ainsn.is_short = is_short_instr((unsigned long)p->addr);
 35         p->opcode = *p->addr;
 36 
 37         return 0;
 38 }
 39 
 40 void __kprobes arch_arm_kprobe(struct kprobe *p)
 41 {
 42         *p->addr = UNIMP_S_INSTRUCTION;
 43 
 44         flush_icache_range((unsigned long)p->addr,
 45                            (unsigned long)p->addr + sizeof(kprobe_opcode_t));
 46 }
 47 
 48 void __kprobes arch_disarm_kprobe(struct kprobe *p)
 49 {
 50         *p->addr = p->opcode;
 51 
 52         flush_icache_range((unsigned long)p->addr,
 53                            (unsigned long)p->addr + sizeof(kprobe_opcode_t));
 54 }
 55 
 56 void __kprobes arch_remove_kprobe(struct kprobe *p)
 57 {
 58         arch_disarm_kprobe(p);
 59 
 60         /* Can we remove the kprobe in the middle of kprobe handling? */
 61         if (p->ainsn.t1_addr) {
 62                 *(p->ainsn.t1_addr) = p->ainsn.t1_opcode;
 63 
 64                 flush_icache_range((unsigned long)p->ainsn.t1_addr,
 65                                    (unsigned long)p->ainsn.t1_addr +
 66                                    sizeof(kprobe_opcode_t));
 67 
 68                 p->ainsn.t1_addr = NULL;
 69         }
 70 
 71         if (p->ainsn.t2_addr) {
 72                 *(p->ainsn.t2_addr) = p->ainsn.t2_opcode;
 73 
 74                 flush_icache_range((unsigned long)p->ainsn.t2_addr,
 75                                    (unsigned long)p->ainsn.t2_addr +
 76                                    sizeof(kprobe_opcode_t));
 77 
 78                 p->ainsn.t2_addr = NULL;
 79         }
 80 }
 81 
 82 static void __kprobes save_previous_kprobe(struct kprobe_ctlblk *kcb)
 83 {
 84         kcb->prev_kprobe.kp = kprobe_running();
 85         kcb->prev_kprobe.status = kcb->kprobe_status;
 86 }
 87 
 88 static void __kprobes restore_previous_kprobe(struct kprobe_ctlblk *kcb)
 89 {
 90         __this_cpu_write(current_kprobe, kcb->prev_kprobe.kp);
 91         kcb->kprobe_status = kcb->prev_kprobe.status;
 92 }
 93 
 94 static inline void __kprobes set_current_kprobe(struct kprobe *p)
 95 {
 96         __this_cpu_write(current_kprobe, p);
 97 }
 98 
 99 static void __kprobes resume_execution(struct kprobe *p, unsigned long addr,
100                                        struct pt_regs *regs)
101 {
102         /* Remove the trap instructions inserted for single step and
103          * restore the original instructions
104          */
105         if (p->ainsn.t1_addr) {
106                 *(p->ainsn.t1_addr) = p->ainsn.t1_opcode;
107 
108                 flush_icache_range((unsigned long)p->ainsn.t1_addr,
109                                    (unsigned long)p->ainsn.t1_addr +
110                                    sizeof(kprobe_opcode_t));
111 
112                 p->ainsn.t1_addr = NULL;
113         }
114 
115         if (p->ainsn.t2_addr) {
116                 *(p->ainsn.t2_addr) = p->ainsn.t2_opcode;
117 
118                 flush_icache_range((unsigned long)p->ainsn.t2_addr,
119                                    (unsigned long)p->ainsn.t2_addr +
120                                    sizeof(kprobe_opcode_t));
121 
122                 p->ainsn.t2_addr = NULL;
123         }
124 
125         return;
126 }
127 
128 static void __kprobes setup_singlestep(struct kprobe *p, struct pt_regs *regs)
129 {
130         unsigned long next_pc;
131         unsigned long tgt_if_br = 0;
132         int is_branch;
133         unsigned long bta;
134 
135         /* Copy the opcode back to the kprobe location and execute the
136          * instruction. Because of this we will not be able to get into the
137          * same kprobe until this kprobe is done
138          */
139         *(p->addr) = p->opcode;
140 
141         flush_icache_range((unsigned long)p->addr,
142                            (unsigned long)p->addr + sizeof(kprobe_opcode_t));
143 
144         /* Now we insert the trap at the next location after this instruction to
145          * single step. If it is a branch we insert the trap at possible branch
146          * targets
147          */
148 
149         bta = regs->bta;
150 
151         if (regs->status32 & 0x40) {
152                 /* We are in a delay slot with the branch taken */
153 
154                 next_pc = bta & ~0x01;
155 
156                 if (!p->ainsn.is_short) {
157                         if (bta & 0x01)
158                                 regs->blink += 2;
159                         else {
160                                 /* Branch not taken */
161                                 next_pc += 2;
162 
163                                 /* next pc is taken from bta after executing the
164                                  * delay slot instruction
165                                  */
166                                 regs->bta += 2;
167                         }
168                 }
169 
170                 is_branch = 0;
171         } else
172                 is_branch =
173                     disasm_next_pc((unsigned long)p->addr, regs,
174                         (struct callee_regs *) current->thread.callee_reg,
175                         &next_pc, &tgt_if_br);
176 
177         p->ainsn.t1_addr = (kprobe_opcode_t *) next_pc;
178         p->ainsn.t1_opcode = *(p->ainsn.t1_addr);
179         *(p->ainsn.t1_addr) = TRAP_S_2_INSTRUCTION;
180 
181         flush_icache_range((unsigned long)p->ainsn.t1_addr,
182                            (unsigned long)p->ainsn.t1_addr +
183                            sizeof(kprobe_opcode_t));
184 
185         if (is_branch) {
186                 p->ainsn.t2_addr = (kprobe_opcode_t *) tgt_if_br;
187                 p->ainsn.t2_opcode = *(p->ainsn.t2_addr);
188                 *(p->ainsn.t2_addr) = TRAP_S_2_INSTRUCTION;
189 
190                 flush_icache_range((unsigned long)p->ainsn.t2_addr,
191                                    (unsigned long)p->ainsn.t2_addr +
192                                    sizeof(kprobe_opcode_t));
193         }
194 }
195 
196 int __kprobes arc_kprobe_handler(unsigned long addr, struct pt_regs *regs)
197 {
198         struct kprobe *p;
199         struct kprobe_ctlblk *kcb;
200 
201         preempt_disable();
202 
203         kcb = get_kprobe_ctlblk();
204         p = get_kprobe((unsigned long *)addr);
205 
206         if (p) {
207                 /*
208                  * We have reentered the kprobe_handler, since another kprobe
209                  * was hit while within the handler, we save the original
210                  * kprobes and single step on the instruction of the new probe
211                  * without calling any user handlers to avoid recursive
212                  * kprobes.
213                  */
214                 if (kprobe_running()) {
215                         save_previous_kprobe(kcb);
216                         set_current_kprobe(p);
217                         kprobes_inc_nmissed_count(p);
218                         setup_singlestep(p, regs);
219                         kcb->kprobe_status = KPROBE_REENTER;
220                         return 1;
221                 }
222 
223                 set_current_kprobe(p);
224                 kcb->kprobe_status = KPROBE_HIT_ACTIVE;
225 
226                 /* If we have no pre-handler or it returned 0, we continue with
227                  * normal processing. If we have a pre-handler and it returned
228                  * non-zero - which is expected from setjmp_pre_handler for
229                  * jprobe, we return without single stepping and leave that to
230                  * the break-handler which is invoked by a kprobe from
231                  * jprobe_return
232                  */
233                 if (!p->pre_handler || !p->pre_handler(p, regs)) {
234                         setup_singlestep(p, regs);
235                         kcb->kprobe_status = KPROBE_HIT_SS;
236                 }
237 
238                 return 1;
239         } else if (kprobe_running()) {
240                 p = __this_cpu_read(current_kprobe);
241                 if (p->break_handler && p->break_handler(p, regs)) {
242                         setup_singlestep(p, regs);
243                         kcb->kprobe_status = KPROBE_HIT_SS;
244                         return 1;
245                 }
246         }
247 
248         /* no_kprobe: */
249         preempt_enable_no_resched();
250         return 0;
251 }
252 
253 static int __kprobes arc_post_kprobe_handler(unsigned long addr,
254                                          struct pt_regs *regs)
255 {
256         struct kprobe *cur = kprobe_running();
257         struct kprobe_ctlblk *kcb = get_kprobe_ctlblk();
258 
259         if (!cur)
260                 return 0;
261 
262         resume_execution(cur, addr, regs);
263 
264         /* Rearm the kprobe */
265         arch_arm_kprobe(cur);
266 
267         /*
268          * When we return from trap instruction we go to the next instruction
269          * We restored the actual instruction in resume_exectuiont and we to
270          * return to the same address and execute it
271          */
272         regs->ret = addr;
273 
274         if ((kcb->kprobe_status != KPROBE_REENTER) && cur->post_handler) {
275                 kcb->kprobe_status = KPROBE_HIT_SSDONE;
276                 cur->post_handler(cur, regs, 0);
277         }
278 
279         if (kcb->kprobe_status == KPROBE_REENTER) {
280                 restore_previous_kprobe(kcb);
281                 goto out;
282         }
283 
284         reset_current_kprobe();
285 
286 out:
287         preempt_enable_no_resched();
288         return 1;
289 }
290 
291 /*
292  * Fault can be for the instruction being single stepped or for the
293  * pre/post handlers in the module.
294  * This is applicable for applications like user probes, where we have the
295  * probe in user space and the handlers in the kernel
296  */
297 
298 int __kprobes kprobe_fault_handler(struct pt_regs *regs, unsigned long trapnr)
299 {
300         struct kprobe *cur = kprobe_running();
301         struct kprobe_ctlblk *kcb = get_kprobe_ctlblk();
302 
303         switch (kcb->kprobe_status) {
304         case KPROBE_HIT_SS:
305         case KPROBE_REENTER:
306                 /*
307                  * We are here because the instruction being single stepped
308                  * caused the fault. We reset the current kprobe and allow the
309                  * exception handler as if it is regular exception. In our
310                  * case it doesn't matter because the system will be halted
311                  */
312                 resume_execution(cur, (unsigned long)cur->addr, regs);
313 
314                 if (kcb->kprobe_status == KPROBE_REENTER)
315                         restore_previous_kprobe(kcb);
316                 else
317                         reset_current_kprobe();
318 
319                 preempt_enable_no_resched();
320                 break;
321 
322         case KPROBE_HIT_ACTIVE:
323         case KPROBE_HIT_SSDONE:
324                 /*
325                  * We are here because the instructions in the pre/post handler
326                  * caused the fault.
327                  */
328 
329                 /* We increment the nmissed count for accounting,
330                  * we can also use npre/npostfault count for accounting
331                  * these specific fault cases.
332                  */
333                 kprobes_inc_nmissed_count(cur);
334 
335                 /*
336                  * We come here because instructions in the pre/post
337                  * handler caused the page_fault, this could happen
338                  * if handler tries to access user space by
339                  * copy_from_user(), get_user() etc. Let the
340                  * user-specified handler try to fix it first.
341                  */
342                 if (cur->fault_handler && cur->fault_handler(cur, regs, trapnr))
343                         return 1;
344 
345                 /*
346                  * In case the user-specified fault handler returned zero,
347                  * try to fix up.
348                  */
349                 if (fixup_exception(regs))
350                         return 1;
351 
352                 /*
353                  * fixup_exception() could not handle it,
354                  * Let do_page_fault() fix it.
355                  */
356                 break;
357 
358         default:
359                 break;
360         }
361         return 0;
362 }
363 
364 int __kprobes kprobe_exceptions_notify(struct notifier_block *self,
365                                        unsigned long val, void *data)
366 {
367         struct die_args *args = data;
368         unsigned long addr = args->err;
369         int ret = NOTIFY_DONE;
370 
371         switch (val) {
372         case DIE_IERR:
373                 if (arc_kprobe_handler(addr, args->regs))
374                         return NOTIFY_STOP;
375                 break;
376 
377         case DIE_TRAP:
378                 if (arc_post_kprobe_handler(addr, args->regs))
379                         return NOTIFY_STOP;
380                 break;
381 
382         default:
383                 break;
384         }
385 
386         return ret;
387 }
388 
389 int __kprobes setjmp_pre_handler(struct kprobe *p, struct pt_regs *regs)
390 {
391         struct jprobe *jp = container_of(p, struct jprobe, kp);
392         struct kprobe_ctlblk *kcb = get_kprobe_ctlblk();
393         unsigned long sp_addr = regs->sp;
394 
395         kcb->jprobe_saved_regs = *regs;
396         memcpy(kcb->jprobes_stack, (void *)sp_addr, MIN_STACK_SIZE(sp_addr));
397         regs->ret = (unsigned long)(jp->entry);
398 
399         return 1;
400 }
401 
402 void __kprobes jprobe_return(void)
403 {
404         __asm__ __volatile__("unimp_s");
405         return;
406 }
407 
408 int __kprobes longjmp_break_handler(struct kprobe *p, struct pt_regs *regs)
409 {
410         struct kprobe_ctlblk *kcb = get_kprobe_ctlblk();
411         unsigned long sp_addr;
412 
413         *regs = kcb->jprobe_saved_regs;
414         sp_addr = regs->sp;
415         memcpy((void *)sp_addr, kcb->jprobes_stack, MIN_STACK_SIZE(sp_addr));
416         preempt_enable_no_resched();
417 
418         return 1;
419 }
420 
421 static void __used kretprobe_trampoline_holder(void)
422 {
423         __asm__ __volatile__(".global kretprobe_trampoline\n"
424                              "kretprobe_trampoline:\n" "nop\n");
425 }
426 
427 void __kprobes arch_prepare_kretprobe(struct kretprobe_instance *ri,
428                                       struct pt_regs *regs)
429 {
430 
431         ri->ret_addr = (kprobe_opcode_t *) regs->blink;
432 
433         /* Replace the return addr with trampoline addr */
434         regs->blink = (unsigned long)&kretprobe_trampoline;
435 }
436 
437 static int __kprobes trampoline_probe_handler(struct kprobe *p,
438                                               struct pt_regs *regs)
439 {
440         struct kretprobe_instance *ri = NULL;
441         struct hlist_head *head, empty_rp;
442         struct hlist_node *tmp;
443         unsigned long flags, orig_ret_address = 0;
444         unsigned long trampoline_address = (unsigned long)&kretprobe_trampoline;
445 
446         INIT_HLIST_HEAD(&empty_rp);
447         kretprobe_hash_lock(current, &head, &flags);
448 
449         /*
450          * It is possible to have multiple instances associated with a given
451          * task either because an multiple functions in the call path
452          * have a return probe installed on them, and/or more than one return
453          * return probe was registered for a target function.
454          *
455          * We can handle this because:
456          *     - instances are always inserted at the head of the list
457          *     - when multiple return probes are registered for the same
458          *       function, the first instance's ret_addr will point to the
459          *       real return address, and all the rest will point to
460          *       kretprobe_trampoline
461          */
462         hlist_for_each_entry_safe(ri, tmp, head, hlist) {
463                 if (ri->task != current)
464                         /* another task is sharing our hash bucket */
465                         continue;
466 
467                 if (ri->rp && ri->rp->handler)
468                         ri->rp->handler(ri, regs);
469 
470                 orig_ret_address = (unsigned long)ri->ret_addr;
471                 recycle_rp_inst(ri, &empty_rp);
472 
473                 if (orig_ret_address != trampoline_address) {
474                         /*
475                          * This is the real return address. Any other
476                          * instances associated with this task are for
477                          * other calls deeper on the call stack
478                          */
479                         break;
480                 }
481         }
482 
483         kretprobe_assert(ri, orig_ret_address, trampoline_address);
484         regs->ret = orig_ret_address;
485 
486         reset_current_kprobe();
487         kretprobe_hash_unlock(current, &flags);
488         preempt_enable_no_resched();
489 
490         hlist_for_each_entry_safe(ri, tmp, &empty_rp, hlist) {
491                 hlist_del(&ri->hlist);
492                 kfree(ri);
493         }
494 
495         /* By returning a non zero value, we are telling the kprobe handler
496          * that we don't want the post_handler to run
497          */
498         return 1;
499 }
500 
501 static struct kprobe trampoline_p = {
502         .addr = (kprobe_opcode_t *) &kretprobe_trampoline,
503         .pre_handler = trampoline_probe_handler
504 };
505 
506 int __init arch_init_kprobes(void)
507 {
508         /* Registering the trampoline code for the kret probe */
509         return register_kprobe(&trampoline_p);
510 }
511 
512 int __kprobes arch_trampoline_kprobe(struct kprobe *p)
513 {
514         if (p->addr == (kprobe_opcode_t *) &kretprobe_trampoline)
515                 return 1;
516 
517         return 0;
518 }
519 
520 void trap_is_kprobe(unsigned long address, struct pt_regs *regs)
521 {
522         notify_die(DIE_TRAP, "kprobe_trap", regs, address, 0, SIGTRAP);
523 }
524 

~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

kernel.org | git.kernel.org | LWN.net | Project Home | Wiki (Japanese) | Wiki (English) | SVN repository | Mail admin

Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.

osdn.jp