core.c 31.4 KB
Newer Older
L
Linus Torvalds 已提交
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24
/*
 *  Kernel Probes (KProbes)
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation; either version 2 of the License, or
 * (at your option) any later version.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with this program; if not, write to the Free Software
 * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
 *
 * Copyright (C) IBM Corporation, 2002, 2004
 *
 * 2002-Oct	Created by Vamsi Krishna S <vamsi_krishna@in.ibm.com> Kernel
 *		Probes initial implementation ( includes contributions from
 *		Rusty Russell).
 * 2004-July	Suparna Bhattacharya <suparna@in.ibm.com> added jumper probes
 *		interface to access function arguments.
25 26
 * 2004-Oct	Jim Keniston <jkenisto@us.ibm.com> and Prasanna S Panchamukhi
 *		<prasanna@in.ibm.com> adapted for x86_64 from i386.
L
Linus Torvalds 已提交
27 28
 * 2005-Mar	Roland McGrath <roland@redhat.com>
 *		Fixed to handle %rip-relative addressing mode correctly.
29 30 31 32
 * 2005-May	Hien Nguyen <hien@us.ibm.com>, Jim Keniston
 *		<jkenisto@us.ibm.com> and Prasanna S Panchamukhi
 *		<prasanna@in.ibm.com> added function-return probes.
 * 2005-May	Rusty Lynch <rusty.lynch@intel.com>
33
 *		Added function return probes functionality
34
 * 2006-Feb	Masami Hiramatsu <hiramatu@sdl.hitachi.co.jp> added
35
 *		kprobe-booster and kretprobe-booster for i386.
36
 * 2007-Dec	Masami Hiramatsu <mhiramat@redhat.com> added kprobe-booster
37
 *		and kretprobe-booster for x86-64
38
 * 2007-Dec	Masami Hiramatsu <mhiramat@redhat.com>, Arjan van de Ven
39 40
 *		<arjan@infradead.org> and Jim Keniston <jkenisto@us.ibm.com>
 *		unified x86 kprobes code.
L
Linus Torvalds 已提交
41 42 43 44 45
 */
#include <linux/kprobes.h>
#include <linux/ptrace.h>
#include <linux/string.h>
#include <linux/slab.h>
46
#include <linux/hardirq.h>
L
Linus Torvalds 已提交
47
#include <linux/preempt.h>
48
#include <linux/sched/debug.h>
49
#include <linux/extable.h>
50
#include <linux/kdebug.h>
51
#include <linux/kallsyms.h>
52
#include <linux/ftrace.h>
53
#include <linux/frame.h>
54
#include <linux/kasan.h>
55
#include <linux/moduleloader.h>
56

57
#include <asm/text-patching.h>
58 59
#include <asm/cacheflush.h>
#include <asm/desc.h>
L
Linus Torvalds 已提交
60
#include <asm/pgtable.h>
61
#include <linux/uaccess.h>
62
#include <asm/alternative.h>
63
#include <asm/insn.h>
64
#include <asm/debugreg.h>
65
#include <asm/set_memory.h>
L
Linus Torvalds 已提交
66

67
#include "common.h"
68

69 70
DEFINE_PER_CPU(struct kprobe *, current_kprobe) = NULL;
DEFINE_PER_CPU(struct kprobe_ctlblk, kprobe_ctlblk);
L
Linus Torvalds 已提交
71

72
#define stack_addr(regs) ((unsigned long *)kernel_stack_pointer(regs))
73 74 75 76 77 78 79 80 81 82

#define W(row, b0, b1, b2, b3, b4, b5, b6, b7, b8, b9, ba, bb, bc, bd, be, bf)\
	(((b0##UL << 0x0)|(b1##UL << 0x1)|(b2##UL << 0x2)|(b3##UL << 0x3) |   \
	  (b4##UL << 0x4)|(b5##UL << 0x5)|(b6##UL << 0x6)|(b7##UL << 0x7) |   \
	  (b8##UL << 0x8)|(b9##UL << 0x9)|(ba##UL << 0xa)|(bb##UL << 0xb) |   \
	  (bc##UL << 0xc)|(bd##UL << 0xd)|(be##UL << 0xe)|(bf##UL << 0xf))    \
	 << (row % 32))
	/*
	 * Undefined/reserved opcodes, conditional jump, Opcode Extension
	 * Groups, and some special opcodes can not boost.
83 84
	 * This is non-const and volatile to keep gcc from statically
	 * optimizing it out, as variable_test_bit makes gcc think only
85
	 * *(unsigned long*) is used.
86
	 */
87
static volatile u32 twobyte_is_boostable[256 / 32] = {
88 89 90
	/*      0  1  2  3  4  5  6  7  8  9  a  b  c  d  e  f          */
	/*      ----------------------------------------------          */
	W(0x00, 0, 0, 1, 1, 0, 0, 1, 0, 1, 1, 0, 0, 0, 0, 0, 0) | /* 00 */
91
	W(0x10, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1) , /* 10 */
92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110
	W(0x20, 1, 1, 1, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0) | /* 20 */
	W(0x30, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0) , /* 30 */
	W(0x40, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1) | /* 40 */
	W(0x50, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0) , /* 50 */
	W(0x60, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 0, 0, 1, 1) | /* 60 */
	W(0x70, 0, 0, 0, 0, 1, 1, 1, 1, 0, 0, 0, 0, 0, 0, 1, 1) , /* 70 */
	W(0x80, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0) | /* 80 */
	W(0x90, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1) , /* 90 */
	W(0xa0, 1, 1, 0, 1, 1, 1, 0, 0, 1, 1, 0, 1, 1, 1, 0, 1) | /* a0 */
	W(0xb0, 1, 1, 1, 1, 1, 1, 1, 1, 0, 0, 0, 1, 1, 1, 1, 1) , /* b0 */
	W(0xc0, 1, 1, 0, 0, 0, 0, 0, 0, 1, 1, 1, 1, 1, 1, 1, 1) | /* c0 */
	W(0xd0, 0, 1, 1, 1, 0, 1, 0, 0, 1, 1, 0, 1, 1, 1, 0, 1) , /* d0 */
	W(0xe0, 0, 1, 1, 0, 0, 1, 0, 0, 1, 1, 0, 1, 1, 1, 0, 1) | /* e0 */
	W(0xf0, 0, 1, 1, 1, 0, 1, 0, 0, 1, 1, 1, 0, 1, 1, 1, 0)   /* f0 */
	/*      -----------------------------------------------         */
	/*      0  1  2  3  4  5  6  7  8  9  a  b  c  d  e  f          */
};
#undef W

111 112 113 114 115
struct kretprobe_blackpoint kretprobe_blacklist[] = {
	{"__switch_to", }, /* This function switches only current task, but
			      doesn't switch kernel stack.*/
	{NULL, NULL}	/* Terminator */
};
116

117 118
const int kretprobe_blacklist_size = ARRAY_SIZE(kretprobe_blacklist);

119
static nokprobe_inline void
120
__synthesize_relative_insn(void *dest, void *from, void *to, u8 op)
121
{
122 123
	struct __arch_relative_insn {
		u8 op;
124
		s32 raddr;
125
	} __packed *insn;
126

127
	insn = (struct __arch_relative_insn *)dest;
128 129 130 131 132
	insn->raddr = (s32)((long)(to) - ((long)(from) + 5));
	insn->op = op;
}

/* Insert a jump instruction at address 'from', which jumps to address 'to'.*/
133
void synthesize_reljump(void *dest, void *from, void *to)
134
{
135
	__synthesize_relative_insn(dest, from, to, RELATIVEJUMP_OPCODE);
136
}
137
NOKPROBE_SYMBOL(synthesize_reljump);
138

139
/* Insert a call instruction at address 'from', which calls address 'to'.*/
140
void synthesize_relcall(void *dest, void *from, void *to)
141
{
142
	__synthesize_relative_insn(dest, from, to, RELATIVECALL_OPCODE);
143
}
144
NOKPROBE_SYMBOL(synthesize_relcall);
145

146
/*
147
 * Skip the prefixes of the instruction.
148
 */
149
static kprobe_opcode_t *skip_prefixes(kprobe_opcode_t *insn)
150
{
151 152 153 154 155 156 157
	insn_attr_t attr;

	attr = inat_get_opcode_attribute((insn_byte_t)*insn);
	while (inat_is_legacy_prefix(attr)) {
		insn++;
		attr = inat_get_opcode_attribute((insn_byte_t)*insn);
	}
158
#ifdef CONFIG_X86_64
159 160
	if (inat_is_rex_prefix(attr))
		insn++;
161
#endif
162
	return insn;
163
}
164
NOKPROBE_SYMBOL(skip_prefixes);
165

166
/*
167
 * Returns non-zero if INSN is boostable.
168
 * RIP relative instructions are adjusted at copying time in 64 bits mode
169
 */
170
int can_boost(struct insn *insn, void *addr)
171 172 173
{
	kprobe_opcode_t opcode;

174
	if (search_exception_tables((unsigned long)addr))
175 176
		return 0;	/* Page fault may occur on this address. */

177
	/* 2nd-byte opcode */
178 179
	if (insn->opcode.nbytes == 2)
		return test_bit(insn->opcode.bytes[1],
180
				(unsigned long *)twobyte_is_boostable);
181

182
	if (insn->opcode.nbytes != 1)
183 184 185
		return 0;

	/* Can't boost Address-size override prefix */
186
	if (unlikely(inat_is_address_size_prefix(insn->attr)))
187 188
		return 0;

189
	opcode = insn->opcode.bytes[0];
190 191 192

	switch (opcode & 0xf0) {
	case 0x60:
193 194
		/* can't boost "bound" */
		return (opcode != 0x62);
195 196
	case 0x70:
		return 0; /* can't boost conditional jump */
197 198
	case 0x90:
		return opcode != 0x9a;	/* can't boost call far */
199 200 201 202 203 204 205 206 207 208 209 210 211 212 213 214 215 216
	case 0xc0:
		/* can't boost software-interruptions */
		return (0xc1 < opcode && opcode < 0xcc) || opcode == 0xcf;
	case 0xd0:
		/* can boost AA* and XLAT */
		return (opcode == 0xd4 || opcode == 0xd5 || opcode == 0xd7);
	case 0xe0:
		/* can boost in/out and absolute jmps */
		return ((opcode & 0x04) || opcode == 0xea);
	case 0xf0:
		/* clear and set flags are boostable */
		return (opcode == 0xf5 || (0xf7 < opcode && opcode < 0xfe));
	default:
		/* CS override prefix and call are not boostable */
		return (opcode != 0x2e && opcode != 0x9a);
	}
}

217 218
static unsigned long
__recover_probed_insn(kprobe_opcode_t *buf, unsigned long addr)
219 220
{
	struct kprobe *kp;
221
	unsigned long faddr;
222

223
	kp = get_kprobe((void *)addr);
224
	faddr = ftrace_location(addr);
225 226 227 228 229 230 231
	/*
	 * Addresses inside the ftrace location are refused by
	 * arch_check_ftrace_location(). Something went terribly wrong
	 * if such an address is checked here.
	 */
	if (WARN_ON(faddr && faddr != addr))
		return 0UL;
232 233 234 235 236
	/*
	 * Use the current code if it is not modified by Kprobe
	 * and it cannot be modified by ftrace.
	 */
	if (!kp && !faddr)
237
		return addr;
238 239

	/*
240 241 242 243 244 245 246 247 248 249 250
	 * Basically, kp->ainsn.insn has an original instruction.
	 * However, RIP-relative instruction can not do single-stepping
	 * at different place, __copy_instruction() tweaks the displacement of
	 * that instruction. In that case, we can't recover the instruction
	 * from the kp->ainsn.insn.
	 *
	 * On the other hand, in case on normal Kprobe, kp->opcode has a copy
	 * of the first byte of the probed instruction, which is overwritten
	 * by int3. And the instruction at kp->addr is not modified by kprobes
	 * except for the first byte, we can recover the original instruction
	 * from it and kp->opcode.
251
	 *
252 253 254 255 256
	 * In case of Kprobes using ftrace, we do not have a copy of
	 * the original instruction. In fact, the ftrace location might
	 * be modified at anytime and even could be in an inconsistent state.
	 * Fortunately, we know that the original code is the ideal 5-byte
	 * long NOP.
257
	 */
258 259 260 261
	if (probe_kernel_read(buf, (void *)addr,
		MAX_INSN_SIZE * sizeof(kprobe_opcode_t)))
		return 0UL;

262 263 264 265
	if (faddr)
		memcpy(buf, ideal_nops[NOP_ATOMIC5], 5);
	else
		buf[0] = kp->opcode;
266 267 268 269 270 271 272
	return (unsigned long)buf;
}

/*
 * Recover the probed instruction at addr for further analysis.
 * Caller must lock kprobes by kprobe_mutex, or disable preemption
 * for preventing to release referencing kprobes.
273
 * Returns zero if the instruction can not get recovered (or access failed).
274
 */
275
unsigned long recover_probed_instruction(kprobe_opcode_t *buf, unsigned long addr)
276 277 278 279 280 281 282 283
{
	unsigned long __addr;

	__addr = __recover_optprobed_insn(buf, addr);
	if (__addr != addr)
		return __addr;

	return __recover_probed_insn(buf, addr);
284 285 286
}

/* Check if paddr is at an instruction boundary */
287
static int can_probe(unsigned long paddr)
288
{
289
	unsigned long addr, __addr, offset = 0;
290 291 292
	struct insn insn;
	kprobe_opcode_t buf[MAX_INSN_SIZE];

N
Namhyung Kim 已提交
293
	if (!kallsyms_lookup_size_offset(paddr, NULL, &offset))
294 295 296 297 298 299 300 301 302
		return 0;

	/* Decode instructions */
	addr = paddr - offset;
	while (addr < paddr) {
		/*
		 * Check if the instruction has been modified by another
		 * kprobe, in which case we replace the breakpoint by the
		 * original instruction in our buffer.
303 304 305
		 * Also, jump optimization will change the breakpoint to
		 * relative-jump. Since the relative-jump itself is
		 * normally used, we just go through if there is no kprobe.
306
		 */
307
		__addr = recover_probed_instruction(buf, addr);
308 309
		if (!__addr)
			return 0;
310
		kernel_insn_init(&insn, (void *)__addr, MAX_INSN_SIZE);
311
		insn_get_length(&insn);
312 313 314 315 316 317 318

		/*
		 * Another debugging subsystem might insert this breakpoint.
		 * In that case, we can't recover it.
		 */
		if (insn.opcode.bytes[0] == BREAKPOINT_INSTRUCTION)
			return 0;
319 320 321 322 323 324
		addr += insn.length;
	}

	return (addr == paddr);
}

L
Linus Torvalds 已提交
325
/*
326
 * Returns non-zero if opcode modifies the interrupt flag.
L
Linus Torvalds 已提交
327
 */
328
static int is_IF_modifier(kprobe_opcode_t *insn)
L
Linus Torvalds 已提交
329
{
330 331 332
	/* Skip prefixes */
	insn = skip_prefixes(insn);

L
Linus Torvalds 已提交
333 334 335 336 337 338 339
	switch (*insn) {
	case 0xfa:		/* cli */
	case 0xfb:		/* sti */
	case 0xcf:		/* iret/iretd */
	case 0x9d:		/* popf/popfd */
		return 1;
	}
340

L
Linus Torvalds 已提交
341 342 343 344
	return 0;
}

/*
345 346
 * Copy an instruction with recovering modified instruction by kprobes
 * and adjust the displacement if the instruction uses the %rip-relative
347 348
 * addressing mode. Note that since @real will be the final place of copied
 * instruction, displacement must be adjust by @real, not @dest.
349
 * This returns the length of copied instruction, or 0 if it has an error.
L
Linus Torvalds 已提交
350
 */
351
int __copy_instruction(u8 *dest, u8 *src, u8 *real, struct insn *insn)
L
Linus Torvalds 已提交
352
{
353
	kprobe_opcode_t buf[MAX_INSN_SIZE];
354 355
	unsigned long recovered_insn =
		recover_probed_instruction(buf, (unsigned long)src);
356

357
	if (!recovered_insn || !insn)
358
		return 0;
359

360 361
	/* This can access kernel text if given address is not recovered */
	if (probe_kernel_read(dest, (void *)recovered_insn, MAX_INSN_SIZE))
362
		return 0;
363

364 365 366 367 368
	kernel_insn_init(insn, dest, MAX_INSN_SIZE);
	insn_get_length(insn);

	/* Another subsystem puts a breakpoint, failed to recover */
	if (insn->opcode.bytes[0] == BREAKPOINT_INSTRUCTION)
369
		return 0;
370

371 372 373 374
	/* We should not singlestep on the exception masking instructions */
	if (insn_masking_exception(insn))
		return 0;

375
#ifdef CONFIG_X86_64
376
	/* Only x86_64 has RIP relative instructions */
377
	if (insn_rip_relative(insn)) {
378 379 380 381 382 383 384 385 386 387 388 389 390 391
		s64 newdisp;
		u8 *disp;
		/*
		 * The copied instruction uses the %rip-relative addressing
		 * mode.  Adjust the displacement for the difference between
		 * the original location of this instruction and the location
		 * of the copy that will actually be run.  The tricky bit here
		 * is making sure that the sign extension happens correctly in
		 * this calculation, since we need a signed 32-bit result to
		 * be sign-extended to 64 bits when it's added to the %rip
		 * value and yield the same 64-bit result that the sign-
		 * extension of the original signed 32-bit displacement would
		 * have given.
		 */
392
		newdisp = (u8 *) src + (s64) insn->displacement.value
393
			  - (u8 *) real;
394 395 396 397
		if ((s64) (s32) newdisp != newdisp) {
			pr_err("Kprobes error: new displacement does not fit into s32 (%llx)\n", newdisp);
			return 0;
		}
398
		disp = (u8 *) dest + insn_offset_displacement(insn);
399
		*(s32 *) disp = (s32) newdisp;
L
Linus Torvalds 已提交
400
	}
401
#endif
402
	return insn->length;
403
}
L
Linus Torvalds 已提交
404

405
/* Prepare reljump right after instruction to boost */
406 407
static int prepare_boost(kprobe_opcode_t *buf, struct kprobe *p,
			  struct insn *insn)
408
{
409 410
	int len = insn->length;

411
	if (can_boost(insn, p->addr) &&
412
	    MAX_INSN_SIZE - len >= RELATIVEJUMP_SIZE) {
413 414 415 416
		/*
		 * These instructions can be executed directly if it
		 * jumps back to correct address.
		 */
417
		synthesize_reljump(buf + len, p->ainsn.insn + len,
418
				   p->addr + insn->length);
419
		len += RELATIVEJUMP_SIZE;
420
		p->ainsn.boostable = true;
421
	} else {
422
		p->ainsn.boostable = false;
423
	}
424 425 426 427 428 429 430 431 432 433 434 435 436 437

	return len;
}

/* Make page to RO mode when allocate it */
void *alloc_insn_page(void)
{
	void *page;

	page = module_alloc(PAGE_SIZE);
	if (page)
		set_memory_ro((unsigned long)page & PAGE_MASK, 1);

	return page;
438 439
}

440 441 442 443 444 445 446 447
/* Recover page to RW mode before releasing it */
void free_insn_page(void *page)
{
	set_memory_nx((unsigned long)page & PAGE_MASK, 1);
	set_memory_rw((unsigned long)page & PAGE_MASK, 1);
	module_memfree(page);
}

448
static int arch_copy_kprobe(struct kprobe *p)
L
Linus Torvalds 已提交
449
{
450
	struct insn insn;
451
	kprobe_opcode_t buf[MAX_INSN_SIZE];
452
	int len;
453

454
	/* Copy an instruction with recovering if other optprobe modifies it.*/
455
	len = __copy_instruction(buf, p->addr, p->ainsn.insn, &insn);
456
	if (!len)
457
		return -EINVAL;
458

459
	/*
460 461
	 * __copy_instruction can modify the displacement of the instruction,
	 * but it doesn't affect boostable check.
462
	 */
463
	len = prepare_boost(buf, p, &insn);
464

465
	/* Check whether the instruction modifies Interrupt Flag or not */
466
	p->ainsn.if_modifier = is_IF_modifier(buf);
467

468
	/* Also, displacement change doesn't affect the first byte */
469 470 471 472
	p->opcode = buf[0];

	/* OK, write back the instruction(s) into ROX insn buffer */
	text_poke(p->ainsn.insn, buf, len);
473 474

	return 0;
L
Linus Torvalds 已提交
475 476
}

477
int arch_prepare_kprobe(struct kprobe *p)
478
{
479 480
	int ret;

481 482 483
	if (alternatives_text_reserved(p->addr, p->addr))
		return -EINVAL;

484 485
	if (!can_probe((unsigned long)p->addr))
		return -EILSEQ;
486 487 488 489
	/* insn: must be on special executable page on x86. */
	p->ainsn.insn = get_insn_slot();
	if (!p->ainsn.insn)
		return -ENOMEM;
490

491 492 493 494 495 496 497
	ret = arch_copy_kprobe(p);
	if (ret) {
		free_insn_slot(p->ainsn.insn, 0);
		p->ainsn.insn = NULL;
	}

	return ret;
498 499
}

500
void arch_arm_kprobe(struct kprobe *p)
L
Linus Torvalds 已提交
501
{
502
	text_poke(p->addr, ((unsigned char []){BREAKPOINT_INSTRUCTION}), 1);
L
Linus Torvalds 已提交
503 504
}

505
void arch_disarm_kprobe(struct kprobe *p)
L
Linus Torvalds 已提交
506
{
507
	text_poke(p->addr, &p->opcode, 1);
508 509
}

510
void arch_remove_kprobe(struct kprobe *p)
511
{
512
	if (p->ainsn.insn) {
513
		free_insn_slot(p->ainsn.insn, p->ainsn.boostable);
514 515
		p->ainsn.insn = NULL;
	}
L
Linus Torvalds 已提交
516 517
}

518 519
static nokprobe_inline void
save_previous_kprobe(struct kprobe_ctlblk *kcb)
520
{
521 522
	kcb->prev_kprobe.kp = kprobe_running();
	kcb->prev_kprobe.status = kcb->kprobe_status;
523 524
	kcb->prev_kprobe.old_flags = kcb->kprobe_old_flags;
	kcb->prev_kprobe.saved_flags = kcb->kprobe_saved_flags;
525 526
}

527 528
static nokprobe_inline void
restore_previous_kprobe(struct kprobe_ctlblk *kcb)
529
{
C
Christoph Lameter 已提交
530
	__this_cpu_write(current_kprobe, kcb->prev_kprobe.kp);
531
	kcb->kprobe_status = kcb->prev_kprobe.status;
532 533
	kcb->kprobe_old_flags = kcb->prev_kprobe.old_flags;
	kcb->kprobe_saved_flags = kcb->prev_kprobe.saved_flags;
534 535
}

536 537 538
static nokprobe_inline void
set_current_kprobe(struct kprobe *p, struct pt_regs *regs,
		   struct kprobe_ctlblk *kcb)
539
{
C
Christoph Lameter 已提交
540
	__this_cpu_write(current_kprobe, p);
541
	kcb->kprobe_saved_flags = kcb->kprobe_old_flags
542
		= (regs->flags & (X86_EFLAGS_TF | X86_EFLAGS_IF));
543
	if (p->ainsn.if_modifier)
544
		kcb->kprobe_saved_flags &= ~X86_EFLAGS_IF;
545 546
}

547
static nokprobe_inline void clear_btf(void)
R
Roland McGrath 已提交
548
{
P
Peter Zijlstra 已提交
549 550 551 552 553 554
	if (test_thread_flag(TIF_BLOCKSTEP)) {
		unsigned long debugctl = get_debugctlmsr();

		debugctl &= ~DEBUGCTLMSR_BTF;
		update_debugctlmsr(debugctl);
	}
R
Roland McGrath 已提交
555 556
}

557
static nokprobe_inline void restore_btf(void)
R
Roland McGrath 已提交
558
{
P
Peter Zijlstra 已提交
559 560 561 562 563 564
	if (test_thread_flag(TIF_BLOCKSTEP)) {
		unsigned long debugctl = get_debugctlmsr();

		debugctl |= DEBUGCTLMSR_BTF;
		update_debugctlmsr(debugctl);
	}
R
Roland McGrath 已提交
565 566
}

567
void arch_prepare_kretprobe(struct kretprobe_instance *ri, struct pt_regs *regs)
568
{
569
	unsigned long *sara = stack_addr(regs);
570

571
	ri->ret_addr = (kprobe_opcode_t *) *sara;
572

573 574
	/* Replace the return addr with trampoline addr */
	*sara = (unsigned long) &kretprobe_trampoline;
575
}
576
NOKPROBE_SYMBOL(arch_prepare_kretprobe);
577

578 579
static void setup_singlestep(struct kprobe *p, struct pt_regs *regs,
			     struct kprobe_ctlblk *kcb, int reenter)
580
{
581 582 583
	if (setup_detour_execution(p, regs, reenter))
		return;

584
#if !defined(CONFIG_PREEMPT)
585
	if (p->ainsn.boostable && !p->post_handler) {
586
		/* Boost up -- we can execute copied instructions directly */
587 588 589 590 591 592 593
		if (!reenter)
			reset_current_kprobe();
		/*
		 * Reentering boosted probe doesn't reset current_kprobe,
		 * nor set current_kprobe, because it doesn't use single
		 * stepping.
		 */
594 595 596 597
		regs->ip = (unsigned long)p->ainsn.insn;
		return;
	}
#endif
598 599 600 601 602 603 604 605 606 607 608 609 610 611 612
	if (reenter) {
		save_previous_kprobe(kcb);
		set_current_kprobe(p, regs, kcb);
		kcb->kprobe_status = KPROBE_REENTER;
	} else
		kcb->kprobe_status = KPROBE_HIT_SS;
	/* Prepare real single stepping */
	clear_btf();
	regs->flags |= X86_EFLAGS_TF;
	regs->flags &= ~X86_EFLAGS_IF;
	/* single step inline if the instruction is an int3 */
	if (p->opcode == BREAKPOINT_INSTRUCTION)
		regs->ip = (unsigned long)p->addr;
	else
		regs->ip = (unsigned long)p->ainsn.insn;
613
}
614
NOKPROBE_SYMBOL(setup_singlestep);
615

H
Harvey Harrison 已提交
616 617 618 619 620
/*
 * We have reentered the kprobe_handler(), since another probe was hit while
 * within the handler. We save the original kprobes variables and just single
 * step on the instruction of the new probe without calling any user handlers.
 */
621 622
static int reenter_kprobe(struct kprobe *p, struct pt_regs *regs,
			  struct kprobe_ctlblk *kcb)
H
Harvey Harrison 已提交
623
{
624 625 626
	switch (kcb->kprobe_status) {
	case KPROBE_HIT_SSDONE:
	case KPROBE_HIT_ACTIVE:
627
	case KPROBE_HIT_SS:
628
		kprobes_inc_nmissed_count(p);
629
		setup_singlestep(p, regs, kcb, 1);
630
		break;
631
	case KPROBE_REENTER:
632 633 634 635 636 637
		/* A probe has been hit in the codepath leading up to, or just
		 * after, single-stepping of a probed instruction. This entire
		 * codepath should strictly reside in .kprobes.text section.
		 * Raise a BUG or we'll continue in an endless reentering loop
		 * and eventually a stack overflow.
		 */
638
		pr_err("Unrecoverable kprobe detected.\n");
639 640
		dump_kprobe(p);
		BUG();
641 642 643
	default:
		/* impossible cases */
		WARN_ON(1);
644
		return 0;
645
	}
646

647
	return 1;
H
Harvey Harrison 已提交
648
}
649
NOKPROBE_SYMBOL(reenter_kprobe);
650

651 652
/*
 * Interrupts are disabled on entry as trap3 is an interrupt gate and they
653
 * remain disabled throughout this function.
654
 */
655
int kprobe_int3_handler(struct pt_regs *regs)
L
Linus Torvalds 已提交
656
{
657
	kprobe_opcode_t *addr;
658
	struct kprobe *p;
659 660
	struct kprobe_ctlblk *kcb;

661
	if (user_mode(regs))
662 663
		return 0;

664
	addr = (kprobe_opcode_t *)(regs->ip - sizeof(kprobe_opcode_t));
665
	/*
666 667 668
	 * We don't want to be preempted for the entire duration of kprobe
	 * processing. Since int3 and debug trap disables irqs and we clear
	 * IF while singlestepping, it must be no preemptible.
669
	 */
L
Linus Torvalds 已提交
670

671
	kcb = get_kprobe_ctlblk();
672
	p = get_kprobe(addr);
673

674 675
	if (p) {
		if (kprobe_running()) {
676 677
			if (reenter_kprobe(p, regs, kcb))
				return 1;
L
Linus Torvalds 已提交
678
		} else {
679 680
			set_current_kprobe(p, regs, kcb);
			kcb->kprobe_status = KPROBE_HIT_ACTIVE;
681

L
Linus Torvalds 已提交
682
			/*
683 684
			 * If we have no pre-handler or it returned 0, we
			 * continue with normal processing.  If we have a
685 686 687
			 * pre-handler and it returned non-zero, that means
			 * user handler setup registers to exit to another
			 * instruction, we must skip the single stepping.
L
Linus Torvalds 已提交
688
			 */
689
			if (!p->pre_handler || !p->pre_handler(p, regs))
690
				setup_singlestep(p, regs, kcb, 0);
691
			else
692
				reset_current_kprobe();
693
			return 1;
694
		}
695 696 697 698 699 700 701 702 703 704 705 706
	} else if (*addr != BREAKPOINT_INSTRUCTION) {
		/*
		 * The breakpoint instruction was removed right
		 * after we hit it.  Another cpu has removed
		 * either a probepoint or a debugger breakpoint
		 * at this address.  In either case, no further
		 * handling of this interrupt is appropriate.
		 * Back up over the (now missing) int3 and run
		 * the original instruction.
		 */
		regs->ip = (unsigned long)addr;
		return 1;
707
	} /* else: not a kprobe fault; let the kernel handle it */
L
Linus Torvalds 已提交
708

709
	return 0;
L
Linus Torvalds 已提交
710
}
711
NOKPROBE_SYMBOL(kprobe_int3_handler);
L
Linus Torvalds 已提交
712

713
/*
714 715
 * When a retprobed function returns, this code saves registers and
 * calls trampoline_handler() runs, which calls the kretprobe's handler.
716
 */
717 718 719 720
asm(
	".global kretprobe_trampoline\n"
	".type kretprobe_trampoline, @function\n"
	"kretprobe_trampoline:\n"
721
#ifdef CONFIG_X86_64
722 723 724 725 726 727 728 729 730 731
	/* We don't bother saving the ss register */
	"	pushq %rsp\n"
	"	pushfq\n"
	SAVE_REGS_STRING
	"	movq %rsp, %rdi\n"
	"	call trampoline_handler\n"
	/* Replace saved sp with true return address. */
	"	movq %rax, 152(%rsp)\n"
	RESTORE_REGS_STRING
	"	popfq\n"
732
#else
733 734 735 736 737 738 739 740 741 742 743
	"	pushf\n"
	SAVE_REGS_STRING
	"	movl %esp, %eax\n"
	"	call trampoline_handler\n"
	/* Move flags to cs */
	"	movl 56(%esp), %edx\n"
	"	movl %edx, 52(%esp)\n"
	/* Replace saved flags with true return address. */
	"	movl %eax, 56(%esp)\n"
	RESTORE_REGS_STRING
	"	popf\n"
744
#endif
745 746 747
	"	ret\n"
	".size kretprobe_trampoline, .-kretprobe_trampoline\n"
);
748
NOKPROBE_SYMBOL(kretprobe_trampoline);
749
STACK_FRAME_NON_STANDARD(kretprobe_trampoline);
750 751

/*
752
 * Called from kretprobe_trampoline
753
 */
754
__visible __used void *trampoline_handler(struct pt_regs *regs)
755
{
B
bibo,mao 已提交
756
	struct kretprobe_instance *ri = NULL;
757
	struct hlist_head *head, empty_rp;
758
	struct hlist_node *tmp;
759
	unsigned long flags, orig_ret_address = 0;
760
	unsigned long trampoline_address = (unsigned long)&kretprobe_trampoline;
761
	kprobe_opcode_t *correct_ret_addr = NULL;
762

763
	INIT_HLIST_HEAD(&empty_rp);
764
	kretprobe_hash_lock(current, &head, &flags);
765
	/* fixup registers */
766
#ifdef CONFIG_X86_64
767
	regs->cs = __KERNEL_CS;
768 769
#else
	regs->cs = __KERNEL_CS | get_kernel_rpl();
770
	regs->gs = 0;
771
#endif
772
	regs->ip = trampoline_address;
773
	regs->orig_ax = ~0UL;
774

775 776
	/*
	 * It is possible to have multiple instances associated with a given
777
	 * task either because multiple functions in the call path have
778
	 * return probes installed on them, and/or more than one
779 780 781
	 * return probe was registered for a target function.
	 *
	 * We can handle this because:
782
	 *     - instances are always pushed into the head of the list
783
	 *     - when multiple return probes are registered for the same
784 785 786
	 *	 function, the (chronologically) first instance's ret_addr
	 *	 will be the real return address, and all the rest will
	 *	 point to kretprobe_trampoline.
787
	 */
788
	hlist_for_each_entry(ri, head, hlist) {
B
bibo,mao 已提交
789
		if (ri->task != current)
790
			/* another task is sharing our hash bucket */
B
bibo,mao 已提交
791
			continue;
792

793 794 795 796 797 798 799 800 801 802 803 804 805 806
		orig_ret_address = (unsigned long)ri->ret_addr;

		if (orig_ret_address != trampoline_address)
			/*
			 * This is the real return address. Any other
			 * instances associated with this task are for
			 * other calls deeper on the call stack
			 */
			break;
	}

	kretprobe_assert(ri, orig_ret_address, trampoline_address);

	correct_ret_addr = ri->ret_addr;
807
	hlist_for_each_entry_safe(ri, tmp, head, hlist) {
808 809 810 811 812
		if (ri->task != current)
			/* another task is sharing our hash bucket */
			continue;

		orig_ret_address = (unsigned long)ri->ret_addr;
813
		if (ri->rp && ri->rp->handler) {
C
Christoph Lameter 已提交
814
			__this_cpu_write(current_kprobe, &ri->rp->kp);
815
			get_kprobe_ctlblk()->kprobe_status = KPROBE_HIT_ACTIVE;
816
			ri->ret_addr = correct_ret_addr;
817
			ri->rp->handler(ri, regs);
C
Christoph Lameter 已提交
818
			__this_cpu_write(current_kprobe, NULL);
819
		}
820

821
		recycle_rp_inst(ri, &empty_rp);
822 823 824 825 826 827 828 829

		if (orig_ret_address != trampoline_address)
			/*
			 * This is the real return address. Any other
			 * instances associated with this task are for
			 * other calls deeper on the call stack
			 */
			break;
830
	}
831

832
	kretprobe_hash_unlock(current, &flags);
833

834
	hlist_for_each_entry_safe(ri, tmp, &empty_rp, hlist) {
835 836 837
		hlist_del(&ri->hlist);
		kfree(ri);
	}
838
	return (void *)orig_ret_address;
839
}
840
NOKPROBE_SYMBOL(trampoline_handler);
841

L
Linus Torvalds 已提交
842 843 844 845 846 847 848 849 850 851 852 853
/*
 * Called after single-stepping.  p->addr is the address of the
 * instruction whose first byte has been replaced by the "int 3"
 * instruction.  To avoid the SMP problems that can occur when we
 * temporarily put back the original opcode to single-step, we
 * single-stepped a copy of the instruction.  The address of this
 * copy is p->ainsn.insn.
 *
 * This function prepares to return from the post-single-step
 * interrupt.  We have to fix up the stack as follows:
 *
 * 0) Except in the case of absolute or indirect jump or call instructions,
854
 * the new ip is relative to the copied instruction.  We need to make
L
Linus Torvalds 已提交
855 856 857
 * it relative to the original instruction.
 *
 * 1) If the single-stepped instruction was pushfl, then the TF and IF
858
 * flags are set in the just-pushed flags, and may need to be cleared.
L
Linus Torvalds 已提交
859 860 861 862
 *
 * 2) If the single-stepped instruction was a call, the return address
 * that is atop the stack is the address following the copied instruction.
 * We need to make it the address following the original instruction.
863 864 865 866 867
 *
 * If this is the first time we've single-stepped the instruction at
 * this probepoint, and the instruction is boostable, boost it: add a
 * jump instruction after the copied instruction, that jumps to the next
 * instruction after the probepoint.
L
Linus Torvalds 已提交
868
 */
869 870
static void resume_execution(struct kprobe *p, struct pt_regs *regs,
			     struct kprobe_ctlblk *kcb)
L
Linus Torvalds 已提交
871
{
872 873 874
	unsigned long *tos = stack_addr(regs);
	unsigned long copy_ip = (unsigned long)p->ainsn.insn;
	unsigned long orig_ip = (unsigned long)p->addr;
L
Linus Torvalds 已提交
875 876
	kprobe_opcode_t *insn = p->ainsn.insn;

877 878
	/* Skip prefixes */
	insn = skip_prefixes(insn);
L
Linus Torvalds 已提交
879

880
	regs->flags &= ~X86_EFLAGS_TF;
L
Linus Torvalds 已提交
881
	switch (*insn) {
M
Masami Hiramatsu 已提交
882
	case 0x9c:	/* pushfl */
883
		*tos &= ~(X86_EFLAGS_TF | X86_EFLAGS_IF);
884
		*tos |= kcb->kprobe_old_flags;
L
Linus Torvalds 已提交
885
		break;
M
Masami Hiramatsu 已提交
886 887
	case 0xc2:	/* iret/ret/lret */
	case 0xc3:
888
	case 0xca:
M
Masami Hiramatsu 已提交
889 890 891 892
	case 0xcb:
	case 0xcf:
	case 0xea:	/* jmp absolute -- ip is correct */
		/* ip is already adjusted, no more changes required */
893
		p->ainsn.boostable = true;
M
Masami Hiramatsu 已提交
894 895
		goto no_change;
	case 0xe8:	/* call relative - Fix return addr */
896
		*tos = orig_ip + (*tos - copy_ip);
L
Linus Torvalds 已提交
897
		break;
H
Harvey Harrison 已提交
898
#ifdef CONFIG_X86_32
899 900 901 902
	case 0x9a:	/* call absolute -- same as call absolute, indirect */
		*tos = orig_ip + (*tos - copy_ip);
		goto no_change;
#endif
L
Linus Torvalds 已提交
903
	case 0xff:
904
		if ((insn[1] & 0x30) == 0x10) {
905 906 907 908 909 910
			/*
			 * call absolute, indirect
			 * Fix return addr; ip is correct.
			 * But this is not boostable
			 */
			*tos = orig_ip + (*tos - copy_ip);
M
Masami Hiramatsu 已提交
911
			goto no_change;
912 913 914 915 916 917
		} else if (((insn[1] & 0x31) == 0x20) ||
			   ((insn[1] & 0x31) == 0x21)) {
			/*
			 * jmp near and far, absolute indirect
			 * ip is correct. And this is boostable
			 */
918
			p->ainsn.boostable = true;
M
Masami Hiramatsu 已提交
919
			goto no_change;
L
Linus Torvalds 已提交
920 921 922 923 924
		}
	default:
		break;
	}

925
	regs->ip += orig_ip - copy_ip;
926

M
Masami Hiramatsu 已提交
927
no_change:
R
Roland McGrath 已提交
928
	restore_btf();
L
Linus Torvalds 已提交
929
}
930
NOKPROBE_SYMBOL(resume_execution);
L
Linus Torvalds 已提交
931

932 933
/*
 * Interrupts are disabled on entry as trap1 is an interrupt gate and they
934
 * remain disabled throughout this function.
935
 */
936
int kprobe_debug_handler(struct pt_regs *regs)
L
Linus Torvalds 已提交
937
{
938 939 940 941
	struct kprobe *cur = kprobe_running();
	struct kprobe_ctlblk *kcb = get_kprobe_ctlblk();

	if (!cur)
L
Linus Torvalds 已提交
942 943
		return 0;

944 945 946
	resume_execution(cur, regs, kcb);
	regs->flags |= kcb->kprobe_saved_flags;

947 948 949
	if ((kcb->kprobe_status != KPROBE_REENTER) && cur->post_handler) {
		kcb->kprobe_status = KPROBE_HIT_SSDONE;
		cur->post_handler(cur, regs, 0);
950
	}
L
Linus Torvalds 已提交
951

952
	/* Restore back the original saved kprobes variables and continue. */
953 954
	if (kcb->kprobe_status == KPROBE_REENTER) {
		restore_previous_kprobe(kcb);
955 956
		goto out;
	}
957
	reset_current_kprobe();
958
out:
L
Linus Torvalds 已提交
959
	/*
960
	 * if somebody else is singlestepping across a probe point, flags
L
Linus Torvalds 已提交
961 962 963
	 * will have TF set, in which case, continue the remaining processing
	 * of do_debug, as if this is not a probe hit.
	 */
964
	if (regs->flags & X86_EFLAGS_TF)
L
Linus Torvalds 已提交
965 966 967 968
		return 0;

	return 1;
}
969
NOKPROBE_SYMBOL(kprobe_debug_handler);
L
Linus Torvalds 已提交
970

971
int kprobe_fault_handler(struct pt_regs *regs, int trapnr)
L
Linus Torvalds 已提交
972
{
973 974 975
	struct kprobe *cur = kprobe_running();
	struct kprobe_ctlblk *kcb = get_kprobe_ctlblk();

976 977 978 979
	if (unlikely(regs->ip == (unsigned long)cur->ainsn.insn)) {
		/* This must happen on single-stepping */
		WARN_ON(kcb->kprobe_status != KPROBE_HIT_SS &&
			kcb->kprobe_status != KPROBE_REENTER);
980 981 982
		/*
		 * We are here because the instruction being single
		 * stepped caused a page fault. We reset the current
983
		 * kprobe and the ip points back to the probe address
984 985 986
		 * and allow the page fault handler to continue as a
		 * normal page fault.
		 */
987
		regs->ip = (unsigned long)cur->addr;
988 989 990 991 992 993 994 995 996 997 998
		/*
		 * Trap flag (TF) has been set here because this fault
		 * happened where the single stepping will be done.
		 * So clear it by resetting the current kprobe:
		 */
		regs->flags &= ~X86_EFLAGS_TF;

		/*
		 * If the TF flag was set before the kprobe hit,
		 * don't touch it:
		 */
999
		regs->flags |= kcb->kprobe_old_flags;
1000

1001 1002 1003 1004
		if (kcb->kprobe_status == KPROBE_REENTER)
			restore_previous_kprobe(kcb);
		else
			reset_current_kprobe();
1005 1006
	} else if (kcb->kprobe_status == KPROBE_HIT_ACTIVE ||
		   kcb->kprobe_status == KPROBE_HIT_SSDONE) {
1007 1008
		/*
		 * We increment the nmissed count for accounting,
1009
		 * we can also use npre/npostfault count for accounting
1010 1011 1012 1013 1014 1015 1016 1017 1018 1019 1020 1021 1022 1023 1024 1025 1026 1027
		 * these specific fault cases.
		 */
		kprobes_inc_nmissed_count(cur);

		/*
		 * We come here because instructions in the pre/post
		 * handler caused the page_fault, this could happen
		 * if handler tries to access user space by
		 * copy_from_user(), get_user() etc. Let the
		 * user-specified handler try to fix it first.
		 */
		if (cur->fault_handler && cur->fault_handler(cur, regs, trapnr))
			return 1;

		/*
		 * In case the user-specified fault handler returned
		 * zero, try to fix up.
		 */
1028
		if (fixup_exception(regs, trapnr))
1029
			return 1;
H
Harvey Harrison 已提交
1030

1031
		/*
1032
		 * fixup routine could not handle it,
1033 1034
		 * Let do_page_fault() fix it.
		 */
L
Linus Torvalds 已提交
1035
	}
1036

L
Linus Torvalds 已提交
1037 1038
	return 0;
}
1039
NOKPROBE_SYMBOL(kprobe_fault_handler);
L
Linus Torvalds 已提交
1040 1041 1042 1043

/*
 * Wrapper routine for handling exceptions.
 */
1044 1045
int kprobe_exceptions_notify(struct notifier_block *self, unsigned long val,
			     void *data)
L
Linus Torvalds 已提交
1046
{
J
Jan Engelhardt 已提交
1047
	struct die_args *args = data;
1048 1049
	int ret = NOTIFY_DONE;

1050
	if (args->regs && user_mode(args->regs))
1051 1052
		return ret;

1053
	if (val == DIE_GPF) {
1054 1055 1056 1057 1058 1059
		/*
		 * To be potentially processing a kprobe fault and to
		 * trust the result from kprobe_running(), we have
		 * be non-preemptible.
		 */
		if (!preemptible() && kprobe_running() &&
L
Linus Torvalds 已提交
1060
		    kprobe_fault_handler(args->regs, args->trapnr))
1061
			ret = NOTIFY_STOP;
L
Linus Torvalds 已提交
1062
	}
1063
	return ret;
L
Linus Torvalds 已提交
1064
}
1065
NOKPROBE_SYMBOL(kprobe_exceptions_notify);
L
Linus Torvalds 已提交
1066

1067 1068
bool arch_within_kprobe_blacklist(unsigned long addr)
{
1069 1070 1071 1072 1073 1074 1075
	bool is_in_entry_trampoline_section = false;

#ifdef CONFIG_X86_64
	is_in_entry_trampoline_section =
		(addr >= (unsigned long)__entry_trampoline_start &&
		 addr < (unsigned long)__entry_trampoline_end);
#endif
1076 1077 1078
	return  (addr >= (unsigned long)__kprobes_text_start &&
		 addr < (unsigned long)__kprobes_text_end) ||
		(addr >= (unsigned long)__entry_text_start &&
1079 1080
		 addr < (unsigned long)__entry_text_end) ||
		is_in_entry_trampoline_section;
1081 1082
}

1083
int __init arch_init_kprobes(void)
1084
{
1085
	return 0;
1086
}
1087

1088
int arch_trampoline_kprobe(struct kprobe *p)
1089 1090 1091
{
	return 0;
}