kprobes.c 22 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825
  1. /*
  2. * Kernel Probes (KProbes)
  3. *
  4. * This program is free software; you can redistribute it and/or modify
  5. * it under the terms of the GNU General Public License as published by
  6. * the Free Software Foundation; either version 2 of the License, or
  7. * (at your option) any later version.
  8. *
  9. * This program is distributed in the hope that it will be useful,
  10. * but WITHOUT ANY WARRANTY; without even the implied warranty of
  11. * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  12. * GNU General Public License for more details.
  13. *
  14. * You should have received a copy of the GNU General Public License
  15. * along with this program; if not, write to the Free Software
  16. * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
  17. *
  18. * Copyright IBM Corp. 2002, 2006
  19. *
  20. * s390 port, used ppc64 as template. Mike Grundy <grundym@us.ibm.com>
  21. */
  22. #include <linux/kprobes.h>
  23. #include <linux/ptrace.h>
  24. #include <linux/preempt.h>
  25. #include <linux/stop_machine.h>
  26. #include <linux/kdebug.h>
  27. #include <linux/uaccess.h>
  28. #include <linux/module.h>
  29. #include <linux/slab.h>
  30. #include <linux/hardirq.h>
  31. #include <asm/cacheflush.h>
  32. #include <asm/sections.h>
  33. #include <asm/dis.h>
  34. DEFINE_PER_CPU(struct kprobe *, current_kprobe);
  35. DEFINE_PER_CPU(struct kprobe_ctlblk, kprobe_ctlblk);
  36. struct kretprobe_blackpoint kretprobe_blacklist[] = { };
  37. DEFINE_INSN_CACHE_OPS(dmainsn);
  38. static void *alloc_dmainsn_page(void)
  39. {
  40. return (void *)__get_free_page(GFP_KERNEL | GFP_DMA);
  41. }
  42. static void free_dmainsn_page(void *page)
  43. {
  44. free_page((unsigned long)page);
  45. }
  46. struct kprobe_insn_cache kprobe_dmainsn_slots = {
  47. .mutex = __MUTEX_INITIALIZER(kprobe_dmainsn_slots.mutex),
  48. .alloc = alloc_dmainsn_page,
  49. .free = free_dmainsn_page,
  50. .pages = LIST_HEAD_INIT(kprobe_dmainsn_slots.pages),
  51. .insn_size = MAX_INSN_SIZE,
  52. };
  53. static int __kprobes is_prohibited_opcode(kprobe_opcode_t *insn)
  54. {
  55. if (!is_known_insn((unsigned char *)insn))
  56. return -EINVAL;
  57. switch (insn[0] >> 8) {
  58. case 0x0c: /* bassm */
  59. case 0x0b: /* bsm */
  60. case 0x83: /* diag */
  61. case 0x44: /* ex */
  62. case 0xac: /* stnsm */
  63. case 0xad: /* stosm */
  64. return -EINVAL;
  65. case 0xc6:
  66. switch (insn[0] & 0x0f) {
  67. case 0x00: /* exrl */
  68. return -EINVAL;
  69. }
  70. }
  71. switch (insn[0]) {
  72. case 0x0101: /* pr */
  73. case 0xb25a: /* bsa */
  74. case 0xb240: /* bakr */
  75. case 0xb258: /* bsg */
  76. case 0xb218: /* pc */
  77. case 0xb228: /* pt */
  78. case 0xb98d: /* epsw */
  79. return -EINVAL;
  80. }
  81. return 0;
  82. }
  83. static int __kprobes get_fixup_type(kprobe_opcode_t *insn)
  84. {
  85. /* default fixup method */
  86. int fixup = FIXUP_PSW_NORMAL;
  87. switch (insn[0] >> 8) {
  88. case 0x05: /* balr */
  89. case 0x0d: /* basr */
  90. fixup = FIXUP_RETURN_REGISTER;
  91. /* if r2 = 0, no branch will be taken */
  92. if ((insn[0] & 0x0f) == 0)
  93. fixup |= FIXUP_BRANCH_NOT_TAKEN;
  94. break;
  95. case 0x06: /* bctr */
  96. case 0x07: /* bcr */
  97. fixup = FIXUP_BRANCH_NOT_TAKEN;
  98. break;
  99. case 0x45: /* bal */
  100. case 0x4d: /* bas */
  101. fixup = FIXUP_RETURN_REGISTER;
  102. break;
  103. case 0x47: /* bc */
  104. case 0x46: /* bct */
  105. case 0x86: /* bxh */
  106. case 0x87: /* bxle */
  107. fixup = FIXUP_BRANCH_NOT_TAKEN;
  108. break;
  109. case 0x82: /* lpsw */
  110. fixup = FIXUP_NOT_REQUIRED;
  111. break;
  112. case 0xb2: /* lpswe */
  113. if ((insn[0] & 0xff) == 0xb2)
  114. fixup = FIXUP_NOT_REQUIRED;
  115. break;
  116. case 0xa7: /* bras */
  117. if ((insn[0] & 0x0f) == 0x05)
  118. fixup |= FIXUP_RETURN_REGISTER;
  119. break;
  120. case 0xc0:
  121. if ((insn[0] & 0x0f) == 0x05) /* brasl */
  122. fixup |= FIXUP_RETURN_REGISTER;
  123. break;
  124. case 0xeb:
  125. switch (insn[2] & 0xff) {
  126. case 0x44: /* bxhg */
  127. case 0x45: /* bxleg */
  128. fixup = FIXUP_BRANCH_NOT_TAKEN;
  129. break;
  130. }
  131. break;
  132. case 0xe3: /* bctg */
  133. if ((insn[2] & 0xff) == 0x46)
  134. fixup = FIXUP_BRANCH_NOT_TAKEN;
  135. break;
  136. case 0xec:
  137. switch (insn[2] & 0xff) {
  138. case 0xe5: /* clgrb */
  139. case 0xe6: /* cgrb */
  140. case 0xf6: /* crb */
  141. case 0xf7: /* clrb */
  142. case 0xfc: /* cgib */
  143. case 0xfd: /* cglib */
  144. case 0xfe: /* cib */
  145. case 0xff: /* clib */
  146. fixup = FIXUP_BRANCH_NOT_TAKEN;
  147. break;
  148. }
  149. break;
  150. }
  151. return fixup;
  152. }
  153. static int __kprobes is_insn_relative_long(kprobe_opcode_t *insn)
  154. {
  155. /* Check if we have a RIL-b or RIL-c format instruction which
  156. * we need to modify in order to avoid instruction emulation. */
  157. switch (insn[0] >> 8) {
  158. case 0xc0:
  159. if ((insn[0] & 0x0f) == 0x00) /* larl */
  160. return true;
  161. break;
  162. case 0xc4:
  163. switch (insn[0] & 0x0f) {
  164. case 0x02: /* llhrl */
  165. case 0x04: /* lghrl */
  166. case 0x05: /* lhrl */
  167. case 0x06: /* llghrl */
  168. case 0x07: /* sthrl */
  169. case 0x08: /* lgrl */
  170. case 0x0b: /* stgrl */
  171. case 0x0c: /* lgfrl */
  172. case 0x0d: /* lrl */
  173. case 0x0e: /* llgfrl */
  174. case 0x0f: /* strl */
  175. return true;
  176. }
  177. break;
  178. case 0xc6:
  179. switch (insn[0] & 0x0f) {
  180. case 0x02: /* pfdrl */
  181. case 0x04: /* cghrl */
  182. case 0x05: /* chrl */
  183. case 0x06: /* clghrl */
  184. case 0x07: /* clhrl */
  185. case 0x08: /* cgrl */
  186. case 0x0a: /* clgrl */
  187. case 0x0c: /* cgfrl */
  188. case 0x0d: /* crl */
  189. case 0x0e: /* clgfrl */
  190. case 0x0f: /* clrl */
  191. return true;
  192. }
  193. break;
  194. }
  195. return false;
  196. }
  197. static void __kprobes copy_instruction(struct kprobe *p)
  198. {
  199. s64 disp, new_disp;
  200. u64 addr, new_addr;
  201. memcpy(p->ainsn.insn, p->addr, insn_length(p->opcode >> 8));
  202. if (!is_insn_relative_long(p->ainsn.insn))
  203. return;
  204. /*
  205. * For pc-relative instructions in RIL-b or RIL-c format patch the
  206. * RI2 displacement field. We have already made sure that the insn
  207. * slot for the patched instruction is within the same 2GB area
  208. * as the original instruction (either kernel image or module area).
  209. * Therefore the new displacement will always fit.
  210. */
  211. disp = *(s32 *)&p->ainsn.insn[1];
  212. addr = (u64)(unsigned long)p->addr;
  213. new_addr = (u64)(unsigned long)p->ainsn.insn;
  214. new_disp = ((addr + (disp * 2)) - new_addr) / 2;
  215. *(s32 *)&p->ainsn.insn[1] = new_disp;
  216. }
  217. static inline int is_kernel_addr(void *addr)
  218. {
  219. return addr < (void *)_end;
  220. }
  221. static inline int is_module_addr(void *addr)
  222. {
  223. #ifdef CONFIG_64BIT
  224. BUILD_BUG_ON(MODULES_LEN > (1UL << 31));
  225. if (addr < (void *)MODULES_VADDR)
  226. return 0;
  227. if (addr > (void *)MODULES_END)
  228. return 0;
  229. #endif
  230. return 1;
  231. }
  232. static int __kprobes s390_get_insn_slot(struct kprobe *p)
  233. {
  234. /*
  235. * Get an insn slot that is within the same 2GB area like the original
  236. * instruction. That way instructions with a 32bit signed displacement
  237. * field can be patched and executed within the insn slot.
  238. */
  239. p->ainsn.insn = NULL;
  240. if (is_kernel_addr(p->addr))
  241. p->ainsn.insn = get_dmainsn_slot();
  242. else if (is_module_addr(p->addr))
  243. p->ainsn.insn = get_insn_slot();
  244. return p->ainsn.insn ? 0 : -ENOMEM;
  245. }
  246. static void __kprobes s390_free_insn_slot(struct kprobe *p)
  247. {
  248. if (!p->ainsn.insn)
  249. return;
  250. if (is_kernel_addr(p->addr))
  251. free_dmainsn_slot(p->ainsn.insn, 0);
  252. else
  253. free_insn_slot(p->ainsn.insn, 0);
  254. p->ainsn.insn = NULL;
  255. }
  256. int __kprobes arch_prepare_kprobe(struct kprobe *p)
  257. {
  258. if ((unsigned long) p->addr & 0x01)
  259. return -EINVAL;
  260. /* Make sure the probe isn't going on a difficult instruction */
  261. if (is_prohibited_opcode(p->addr))
  262. return -EINVAL;
  263. if (s390_get_insn_slot(p))
  264. return -ENOMEM;
  265. p->opcode = *p->addr;
  266. copy_instruction(p);
  267. return 0;
  268. }
  269. struct ins_replace_args {
  270. kprobe_opcode_t *ptr;
  271. kprobe_opcode_t opcode;
  272. };
  273. static int __kprobes swap_instruction(void *aref)
  274. {
  275. struct kprobe_ctlblk *kcb = get_kprobe_ctlblk();
  276. unsigned long status = kcb->kprobe_status;
  277. struct ins_replace_args *args = aref;
  278. kcb->kprobe_status = KPROBE_SWAP_INST;
  279. probe_kernel_write(args->ptr, &args->opcode, sizeof(args->opcode));
  280. kcb->kprobe_status = status;
  281. return 0;
  282. }
  283. void __kprobes arch_arm_kprobe(struct kprobe *p)
  284. {
  285. struct ins_replace_args args;
  286. args.ptr = p->addr;
  287. args.opcode = BREAKPOINT_INSTRUCTION;
  288. stop_machine(swap_instruction, &args, NULL);
  289. }
  290. void __kprobes arch_disarm_kprobe(struct kprobe *p)
  291. {
  292. struct ins_replace_args args;
  293. args.ptr = p->addr;
  294. args.opcode = p->opcode;
  295. stop_machine(swap_instruction, &args, NULL);
  296. }
  297. void __kprobes arch_remove_kprobe(struct kprobe *p)
  298. {
  299. s390_free_insn_slot(p);
  300. }
  301. static void __kprobes enable_singlestep(struct kprobe_ctlblk *kcb,
  302. struct pt_regs *regs,
  303. unsigned long ip)
  304. {
  305. struct per_regs per_kprobe;
  306. /* Set up the PER control registers %cr9-%cr11 */
  307. per_kprobe.control = PER_EVENT_IFETCH;
  308. per_kprobe.start = ip;
  309. per_kprobe.end = ip;
  310. /* Save control regs and psw mask */
  311. __ctl_store(kcb->kprobe_saved_ctl, 9, 11);
  312. kcb->kprobe_saved_imask = regs->psw.mask &
  313. (PSW_MASK_PER | PSW_MASK_IO | PSW_MASK_EXT);
  314. /* Set PER control regs, turns on single step for the given address */
  315. __ctl_load(per_kprobe, 9, 11);
  316. regs->psw.mask |= PSW_MASK_PER;
  317. regs->psw.mask &= ~(PSW_MASK_IO | PSW_MASK_EXT);
  318. regs->psw.addr = ip | PSW_ADDR_AMODE;
  319. }
  320. static void __kprobes disable_singlestep(struct kprobe_ctlblk *kcb,
  321. struct pt_regs *regs,
  322. unsigned long ip)
  323. {
  324. /* Restore control regs and psw mask, set new psw address */
  325. __ctl_load(kcb->kprobe_saved_ctl, 9, 11);
  326. regs->psw.mask &= ~PSW_MASK_PER;
  327. regs->psw.mask |= kcb->kprobe_saved_imask;
  328. regs->psw.addr = ip | PSW_ADDR_AMODE;
  329. }
  330. /*
  331. * Activate a kprobe by storing its pointer to current_kprobe. The
  332. * previous kprobe is stored in kcb->prev_kprobe. A stack of up to
  333. * two kprobes can be active, see KPROBE_REENTER.
  334. */
  335. static void __kprobes push_kprobe(struct kprobe_ctlblk *kcb, struct kprobe *p)
  336. {
  337. kcb->prev_kprobe.kp = __get_cpu_var(current_kprobe);
  338. kcb->prev_kprobe.status = kcb->kprobe_status;
  339. __get_cpu_var(current_kprobe) = p;
  340. }
  341. /*
  342. * Deactivate a kprobe by backing up to the previous state. If the
  343. * current state is KPROBE_REENTER prev_kprobe.kp will be non-NULL,
  344. * for any other state prev_kprobe.kp will be NULL.
  345. */
  346. static void __kprobes pop_kprobe(struct kprobe_ctlblk *kcb)
  347. {
  348. __get_cpu_var(current_kprobe) = kcb->prev_kprobe.kp;
  349. kcb->kprobe_status = kcb->prev_kprobe.status;
  350. }
  351. void __kprobes arch_prepare_kretprobe(struct kretprobe_instance *ri,
  352. struct pt_regs *regs)
  353. {
  354. ri->ret_addr = (kprobe_opcode_t *) regs->gprs[14];
  355. /* Replace the return addr with trampoline addr */
  356. regs->gprs[14] = (unsigned long) &kretprobe_trampoline;
  357. }
  358. static void __kprobes kprobe_reenter_check(struct kprobe_ctlblk *kcb,
  359. struct kprobe *p)
  360. {
  361. switch (kcb->kprobe_status) {
  362. case KPROBE_HIT_SSDONE:
  363. case KPROBE_HIT_ACTIVE:
  364. kprobes_inc_nmissed_count(p);
  365. break;
  366. case KPROBE_HIT_SS:
  367. case KPROBE_REENTER:
  368. default:
  369. /*
  370. * A kprobe on the code path to single step an instruction
  371. * is a BUG. The code path resides in the .kprobes.text
  372. * section and is executed with interrupts disabled.
  373. */
  374. printk(KERN_EMERG "Invalid kprobe detected at %p.\n", p->addr);
  375. dump_kprobe(p);
  376. BUG();
  377. }
  378. }
  379. static int __kprobes kprobe_handler(struct pt_regs *regs)
  380. {
  381. struct kprobe_ctlblk *kcb;
  382. struct kprobe *p;
  383. /*
  384. * We want to disable preemption for the entire duration of kprobe
  385. * processing. That includes the calls to the pre/post handlers
  386. * and single stepping the kprobe instruction.
  387. */
  388. preempt_disable();
  389. kcb = get_kprobe_ctlblk();
  390. p = get_kprobe((void *)((regs->psw.addr & PSW_ADDR_INSN) - 2));
  391. if (p) {
  392. if (kprobe_running()) {
  393. /*
  394. * We have hit a kprobe while another is still
  395. * active. This can happen in the pre and post
  396. * handler. Single step the instruction of the
  397. * new probe but do not call any handler function
  398. * of this secondary kprobe.
  399. * push_kprobe and pop_kprobe saves and restores
  400. * the currently active kprobe.
  401. */
  402. kprobe_reenter_check(kcb, p);
  403. push_kprobe(kcb, p);
  404. kcb->kprobe_status = KPROBE_REENTER;
  405. } else {
  406. /*
  407. * If we have no pre-handler or it returned 0, we
  408. * continue with single stepping. If we have a
  409. * pre-handler and it returned non-zero, it prepped
  410. * for calling the break_handler below on re-entry
  411. * for jprobe processing, so get out doing nothing
  412. * more here.
  413. */
  414. push_kprobe(kcb, p);
  415. kcb->kprobe_status = KPROBE_HIT_ACTIVE;
  416. if (p->pre_handler && p->pre_handler(p, regs))
  417. return 1;
  418. kcb->kprobe_status = KPROBE_HIT_SS;
  419. }
  420. enable_singlestep(kcb, regs, (unsigned long) p->ainsn.insn);
  421. return 1;
  422. } else if (kprobe_running()) {
  423. p = __get_cpu_var(current_kprobe);
  424. if (p->break_handler && p->break_handler(p, regs)) {
  425. /*
  426. * Continuation after the jprobe completed and
  427. * caused the jprobe_return trap. The jprobe
  428. * break_handler "returns" to the original
  429. * function that still has the kprobe breakpoint
  430. * installed. We continue with single stepping.
  431. */
  432. kcb->kprobe_status = KPROBE_HIT_SS;
  433. enable_singlestep(kcb, regs,
  434. (unsigned long) p->ainsn.insn);
  435. return 1;
  436. } /* else:
  437. * No kprobe at this address and the current kprobe
  438. * has no break handler (no jprobe!). The kernel just
  439. * exploded, let the standard trap handler pick up the
  440. * pieces.
  441. */
  442. } /* else:
  443. * No kprobe at this address and no active kprobe. The trap has
  444. * not been caused by a kprobe breakpoint. The race of breakpoint
  445. * vs. kprobe remove does not exist because on s390 as we use
  446. * stop_machine to arm/disarm the breakpoints.
  447. */
  448. preempt_enable_no_resched();
  449. return 0;
  450. }
  451. /*
  452. * Function return probe trampoline:
  453. * - init_kprobes() establishes a probepoint here
  454. * - When the probed function returns, this probe
  455. * causes the handlers to fire
  456. */
  457. static void __used kretprobe_trampoline_holder(void)
  458. {
  459. asm volatile(".global kretprobe_trampoline\n"
  460. "kretprobe_trampoline: bcr 0,0\n");
  461. }
  462. /*
  463. * Called when the probe at kretprobe trampoline is hit
  464. */
  465. static int __kprobes trampoline_probe_handler(struct kprobe *p,
  466. struct pt_regs *regs)
  467. {
  468. struct kretprobe_instance *ri;
  469. struct hlist_head *head, empty_rp;
  470. struct hlist_node *tmp;
  471. unsigned long flags, orig_ret_address;
  472. unsigned long trampoline_address;
  473. kprobe_opcode_t *correct_ret_addr;
  474. INIT_HLIST_HEAD(&empty_rp);
  475. kretprobe_hash_lock(current, &head, &flags);
  476. /*
  477. * It is possible to have multiple instances associated with a given
  478. * task either because an multiple functions in the call path
  479. * have a return probe installed on them, and/or more than one return
  480. * return probe was registered for a target function.
  481. *
  482. * We can handle this because:
  483. * - instances are always inserted at the head of the list
  484. * - when multiple return probes are registered for the same
  485. * function, the first instance's ret_addr will point to the
  486. * real return address, and all the rest will point to
  487. * kretprobe_trampoline
  488. */
  489. ri = NULL;
  490. orig_ret_address = 0;
  491. correct_ret_addr = NULL;
  492. trampoline_address = (unsigned long) &kretprobe_trampoline;
  493. hlist_for_each_entry_safe(ri, tmp, head, hlist) {
  494. if (ri->task != current)
  495. /* another task is sharing our hash bucket */
  496. continue;
  497. orig_ret_address = (unsigned long) ri->ret_addr;
  498. if (orig_ret_address != trampoline_address)
  499. /*
  500. * This is the real return address. Any other
  501. * instances associated with this task are for
  502. * other calls deeper on the call stack
  503. */
  504. break;
  505. }
  506. kretprobe_assert(ri, orig_ret_address, trampoline_address);
  507. correct_ret_addr = ri->ret_addr;
  508. hlist_for_each_entry_safe(ri, tmp, head, hlist) {
  509. if (ri->task != current)
  510. /* another task is sharing our hash bucket */
  511. continue;
  512. orig_ret_address = (unsigned long) ri->ret_addr;
  513. if (ri->rp && ri->rp->handler) {
  514. ri->ret_addr = correct_ret_addr;
  515. ri->rp->handler(ri, regs);
  516. }
  517. recycle_rp_inst(ri, &empty_rp);
  518. if (orig_ret_address != trampoline_address)
  519. /*
  520. * This is the real return address. Any other
  521. * instances associated with this task are for
  522. * other calls deeper on the call stack
  523. */
  524. break;
  525. }
  526. regs->psw.addr = orig_ret_address | PSW_ADDR_AMODE;
  527. pop_kprobe(get_kprobe_ctlblk());
  528. kretprobe_hash_unlock(current, &flags);
  529. preempt_enable_no_resched();
  530. hlist_for_each_entry_safe(ri, tmp, &empty_rp, hlist) {
  531. hlist_del(&ri->hlist);
  532. kfree(ri);
  533. }
  534. /*
  535. * By returning a non-zero value, we are telling
  536. * kprobe_handler() that we don't want the post_handler
  537. * to run (and have re-enabled preemption)
  538. */
  539. return 1;
  540. }
  541. /*
  542. * Called after single-stepping. p->addr is the address of the
  543. * instruction whose first byte has been replaced by the "breakpoint"
  544. * instruction. To avoid the SMP problems that can occur when we
  545. * temporarily put back the original opcode to single-step, we
  546. * single-stepped a copy of the instruction. The address of this
  547. * copy is p->ainsn.insn.
  548. */
  549. static void __kprobes resume_execution(struct kprobe *p, struct pt_regs *regs)
  550. {
  551. struct kprobe_ctlblk *kcb = get_kprobe_ctlblk();
  552. unsigned long ip = regs->psw.addr & PSW_ADDR_INSN;
  553. int fixup = get_fixup_type(p->ainsn.insn);
  554. if (fixup & FIXUP_PSW_NORMAL)
  555. ip += (unsigned long) p->addr - (unsigned long) p->ainsn.insn;
  556. if (fixup & FIXUP_BRANCH_NOT_TAKEN) {
  557. int ilen = insn_length(p->ainsn.insn[0] >> 8);
  558. if (ip - (unsigned long) p->ainsn.insn == ilen)
  559. ip = (unsigned long) p->addr + ilen;
  560. }
  561. if (fixup & FIXUP_RETURN_REGISTER) {
  562. int reg = (p->ainsn.insn[0] & 0xf0) >> 4;
  563. regs->gprs[reg] += (unsigned long) p->addr -
  564. (unsigned long) p->ainsn.insn;
  565. }
  566. disable_singlestep(kcb, regs, ip);
  567. }
  568. static int __kprobes post_kprobe_handler(struct pt_regs *regs)
  569. {
  570. struct kprobe_ctlblk *kcb = get_kprobe_ctlblk();
  571. struct kprobe *p = kprobe_running();
  572. if (!p)
  573. return 0;
  574. if (kcb->kprobe_status != KPROBE_REENTER && p->post_handler) {
  575. kcb->kprobe_status = KPROBE_HIT_SSDONE;
  576. p->post_handler(p, regs, 0);
  577. }
  578. resume_execution(p, regs);
  579. pop_kprobe(kcb);
  580. preempt_enable_no_resched();
  581. /*
  582. * if somebody else is singlestepping across a probe point, psw mask
  583. * will have PER set, in which case, continue the remaining processing
  584. * of do_single_step, as if this is not a probe hit.
  585. */
  586. if (regs->psw.mask & PSW_MASK_PER)
  587. return 0;
  588. return 1;
  589. }
  590. static int __kprobes kprobe_trap_handler(struct pt_regs *regs, int trapnr)
  591. {
  592. struct kprobe_ctlblk *kcb = get_kprobe_ctlblk();
  593. struct kprobe *p = kprobe_running();
  594. const struct exception_table_entry *entry;
  595. switch(kcb->kprobe_status) {
  596. case KPROBE_SWAP_INST:
  597. /* We are here because the instruction replacement failed */
  598. return 0;
  599. case KPROBE_HIT_SS:
  600. case KPROBE_REENTER:
  601. /*
  602. * We are here because the instruction being single
  603. * stepped caused a page fault. We reset the current
  604. * kprobe and the nip points back to the probe address
  605. * and allow the page fault handler to continue as a
  606. * normal page fault.
  607. */
  608. disable_singlestep(kcb, regs, (unsigned long) p->addr);
  609. pop_kprobe(kcb);
  610. preempt_enable_no_resched();
  611. break;
  612. case KPROBE_HIT_ACTIVE:
  613. case KPROBE_HIT_SSDONE:
  614. /*
  615. * We increment the nmissed count for accounting,
  616. * we can also use npre/npostfault count for accounting
  617. * these specific fault cases.
  618. */
  619. kprobes_inc_nmissed_count(p);
  620. /*
  621. * We come here because instructions in the pre/post
  622. * handler caused the page_fault, this could happen
  623. * if handler tries to access user space by
  624. * copy_from_user(), get_user() etc. Let the
  625. * user-specified handler try to fix it first.
  626. */
  627. if (p->fault_handler && p->fault_handler(p, regs, trapnr))
  628. return 1;
  629. /*
  630. * In case the user-specified fault handler returned
  631. * zero, try to fix up.
  632. */
  633. entry = search_exception_tables(regs->psw.addr & PSW_ADDR_INSN);
  634. if (entry) {
  635. regs->psw.addr = extable_fixup(entry) | PSW_ADDR_AMODE;
  636. return 1;
  637. }
  638. /*
  639. * fixup_exception() could not handle it,
  640. * Let do_page_fault() fix it.
  641. */
  642. break;
  643. default:
  644. break;
  645. }
  646. return 0;
  647. }
  648. int __kprobes kprobe_fault_handler(struct pt_regs *regs, int trapnr)
  649. {
  650. int ret;
  651. if (regs->psw.mask & (PSW_MASK_IO | PSW_MASK_EXT))
  652. local_irq_disable();
  653. ret = kprobe_trap_handler(regs, trapnr);
  654. if (regs->psw.mask & (PSW_MASK_IO | PSW_MASK_EXT))
  655. local_irq_restore(regs->psw.mask & ~PSW_MASK_PER);
  656. return ret;
  657. }
  658. /*
  659. * Wrapper routine to for handling exceptions.
  660. */
  661. int __kprobes kprobe_exceptions_notify(struct notifier_block *self,
  662. unsigned long val, void *data)
  663. {
  664. struct die_args *args = (struct die_args *) data;
  665. struct pt_regs *regs = args->regs;
  666. int ret = NOTIFY_DONE;
  667. if (regs->psw.mask & (PSW_MASK_IO | PSW_MASK_EXT))
  668. local_irq_disable();
  669. switch (val) {
  670. case DIE_BPT:
  671. if (kprobe_handler(regs))
  672. ret = NOTIFY_STOP;
  673. break;
  674. case DIE_SSTEP:
  675. if (post_kprobe_handler(regs))
  676. ret = NOTIFY_STOP;
  677. break;
  678. case DIE_TRAP:
  679. if (!preemptible() && kprobe_running() &&
  680. kprobe_trap_handler(regs, args->trapnr))
  681. ret = NOTIFY_STOP;
  682. break;
  683. default:
  684. break;
  685. }
  686. if (regs->psw.mask & (PSW_MASK_IO | PSW_MASK_EXT))
  687. local_irq_restore(regs->psw.mask & ~PSW_MASK_PER);
  688. return ret;
  689. }
  690. int __kprobes setjmp_pre_handler(struct kprobe *p, struct pt_regs *regs)
  691. {
  692. struct jprobe *jp = container_of(p, struct jprobe, kp);
  693. struct kprobe_ctlblk *kcb = get_kprobe_ctlblk();
  694. unsigned long stack;
  695. memcpy(&kcb->jprobe_saved_regs, regs, sizeof(struct pt_regs));
  696. /* setup return addr to the jprobe handler routine */
  697. regs->psw.addr = (unsigned long) jp->entry | PSW_ADDR_AMODE;
  698. regs->psw.mask &= ~(PSW_MASK_IO | PSW_MASK_EXT);
  699. /* r15 is the stack pointer */
  700. stack = (unsigned long) regs->gprs[15];
  701. memcpy(kcb->jprobes_stack, (void *) stack, MIN_STACK_SIZE(stack));
  702. return 1;
  703. }
  704. void __kprobes jprobe_return(void)
  705. {
  706. asm volatile(".word 0x0002");
  707. }
  708. static void __used __kprobes jprobe_return_end(void)
  709. {
  710. asm volatile("bcr 0,0");
  711. }
  712. int __kprobes longjmp_break_handler(struct kprobe *p, struct pt_regs *regs)
  713. {
  714. struct kprobe_ctlblk *kcb = get_kprobe_ctlblk();
  715. unsigned long stack;
  716. stack = (unsigned long) kcb->jprobe_saved_regs.gprs[15];
  717. /* Put the regs back */
  718. memcpy(regs, &kcb->jprobe_saved_regs, sizeof(struct pt_regs));
  719. /* put the stack back */
  720. memcpy((void *) stack, kcb->jprobes_stack, MIN_STACK_SIZE(stack));
  721. preempt_enable_no_resched();
  722. return 1;
  723. }
  724. static struct kprobe trampoline = {
  725. .addr = (kprobe_opcode_t *) &kretprobe_trampoline,
  726. .pre_handler = trampoline_probe_handler
  727. };
  728. int __init arch_init_kprobes(void)
  729. {
  730. return register_kprobe(&trampoline);
  731. }
  732. int __kprobes arch_trampoline_kprobe(struct kprobe *p)
  733. {
  734. return p->addr == (kprobe_opcode_t *) &kretprobe_trampoline;
  735. }