kprobes.c 20.8 KB
Newer Older
L
Linus Torvalds 已提交
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29
/*
 *  Kernel Probes (KProbes)
 *  kernel/kprobes.c
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation; either version 2 of the License, or
 * (at your option) any later version.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with this program; if not, write to the Free Software
 * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
 *
 * Copyright (C) IBM Corporation, 2002, 2004
 *
 * 2002-Oct	Created by Vamsi Krishna S <vamsi_krishna@in.ibm.com> Kernel
 *		Probes initial implementation (includes suggestions from
 *		Rusty Russell).
 * 2004-Aug	Updated by Prasanna S Panchamukhi <prasanna@in.ibm.com> with
 *		hlists and exceptions notifier as suggested by Andi Kleen.
 * 2004-July	Suparna Bhattacharya <suparna@in.ibm.com> added jumper probes
 *		interface to access function arguments.
 * 2004-Sep	Prasanna S Panchamukhi <prasanna@in.ibm.com> Changed Kprobes
 *		exceptions notifier to be first on the priority list.
30 31 32
 * 2005-May	Hien Nguyen <hien@us.ibm.com>, Jim Keniston
 *		<jkenisto@us.ibm.com> and Prasanna S Panchamukhi
 *		<prasanna@in.ibm.com> added function-return probes.
L
Linus Torvalds 已提交
33 34 35 36
 */
#include <linux/kprobes.h>
#include <linux/hash.h>
#include <linux/init.h>
T
Tim Schmielau 已提交
37
#include <linux/slab.h>
L
Linus Torvalds 已提交
38
#include <linux/module.h>
39
#include <linux/moduleloader.h>
40
#include <linux/kallsyms.h>
41
#include <linux/freezer.h>
42
#include <asm-generic/sections.h>
L
Linus Torvalds 已提交
43 44 45 46 47 48 49
#include <asm/cacheflush.h>
#include <asm/errno.h>
#include <asm/kdebug.h>

#define KPROBE_HASH_BITS 6
#define KPROBE_TABLE_SIZE (1 << KPROBE_HASH_BITS)

50 51 52 53 54 55 56 57 58 59

/*
 * Some oddball architectures like 64bit powerpc have function descriptors
 * so this must be overridable.
 */
#ifndef kprobe_lookup_name
#define kprobe_lookup_name(name, addr) \
	addr = ((kprobe_opcode_t *)(kallsyms_lookup_name(name)))
#endif

L
Linus Torvalds 已提交
60
static struct hlist_head kprobe_table[KPROBE_TABLE_SIZE];
61
static struct hlist_head kretprobe_inst_table[KPROBE_TABLE_SIZE];
62
static atomic_t kprobe_count;
L
Linus Torvalds 已提交
63

I
Ingo Molnar 已提交
64
DEFINE_MUTEX(kprobe_mutex);		/* Protects kprobe_table */
65
DEFINE_SPINLOCK(kretprobe_lock);	/* Protects kretprobe_inst_table */
66
static DEFINE_PER_CPU(struct kprobe *, kprobe_instance) = NULL;
L
Linus Torvalds 已提交
67

68 69 70 71 72
static struct notifier_block kprobe_page_fault_nb = {
	.notifier_call = kprobe_exceptions_notify,
	.priority = 0x7fffffff /* we need to notified first */
};

73
#ifdef __ARCH_WANT_KPROBES_INSN_SLOT
74 75 76 77 78 79 80 81 82 83 84 85 86
/*
 * kprobe->ainsn.insn points to the copy of the instruction to be
 * single-stepped. x86_64, POWER4 and above have no-exec support and
 * stepping on the instruction on a vmalloced/kmalloced/data page
 * is a recipe for disaster
 */
#define INSNS_PER_PAGE	(PAGE_SIZE/(MAX_INSN_SIZE * sizeof(kprobe_opcode_t)))

struct kprobe_insn_page {
	struct hlist_node hlist;
	kprobe_opcode_t *insns;		/* Page of instruction slots */
	char slot_used[INSNS_PER_PAGE];
	int nused;
87
	int ngarbage;
88 89 90
};

static struct hlist_head kprobe_insn_pages;
91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116
static int kprobe_garbage_slots;
static int collect_garbage_slots(void);

static int __kprobes check_safety(void)
{
	int ret = 0;
#if defined(CONFIG_PREEMPT) && defined(CONFIG_PM)
	ret = freeze_processes();
	if (ret == 0) {
		struct task_struct *p, *q;
		do_each_thread(p, q) {
			if (p != current && p->state == TASK_RUNNING &&
			    p->pid != 0) {
				printk("Check failed: %s is running\n",p->comm);
				ret = -1;
				goto loop_end;
			}
		} while_each_thread(p, q);
	}
loop_end:
	thaw_processes();
#else
	synchronize_sched();
#endif
	return ret;
}
117 118 119 120 121

/**
 * get_insn_slot() - Find a slot on an executable page for an instruction.
 * We allocate an executable page if there's no room on existing ones.
 */
122
kprobe_opcode_t __kprobes *get_insn_slot(void)
123 124 125 126
{
	struct kprobe_insn_page *kip;
	struct hlist_node *pos;

127
      retry:
128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143
	hlist_for_each(pos, &kprobe_insn_pages) {
		kip = hlist_entry(pos, struct kprobe_insn_page, hlist);
		if (kip->nused < INSNS_PER_PAGE) {
			int i;
			for (i = 0; i < INSNS_PER_PAGE; i++) {
				if (!kip->slot_used[i]) {
					kip->slot_used[i] = 1;
					kip->nused++;
					return kip->insns + (i * MAX_INSN_SIZE);
				}
			}
			/* Surprise!  No unused slots.  Fix kip->nused. */
			kip->nused = INSNS_PER_PAGE;
		}
	}

144 145 146 147 148
	/* If there are any garbage slots, collect it and try again. */
	if (kprobe_garbage_slots && collect_garbage_slots() == 0) {
		goto retry;
	}
	/* All out of space.  Need to allocate a new page. Use slot 0. */
149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168
	kip = kmalloc(sizeof(struct kprobe_insn_page), GFP_KERNEL);
	if (!kip) {
		return NULL;
	}

	/*
	 * Use module_alloc so this page is within +/- 2GB of where the
	 * kernel image and loaded module images reside. This is required
	 * so x86_64 can correctly handle the %rip-relative fixups.
	 */
	kip->insns = module_alloc(PAGE_SIZE);
	if (!kip->insns) {
		kfree(kip);
		return NULL;
	}
	INIT_HLIST_NODE(&kip->hlist);
	hlist_add_head(&kip->hlist, &kprobe_insn_pages);
	memset(kip->slot_used, 0, INSNS_PER_PAGE);
	kip->slot_used[0] = 1;
	kip->nused = 1;
169
	kip->ngarbage = 0;
170 171 172
	return kip->insns;
}

173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 204 205 206 207 208 209 210 211 212 213 214 215 216 217 218 219 220 221 222 223 224
/* Return 1 if all garbages are collected, otherwise 0. */
static int __kprobes collect_one_slot(struct kprobe_insn_page *kip, int idx)
{
	kip->slot_used[idx] = 0;
	kip->nused--;
	if (kip->nused == 0) {
		/*
		 * Page is no longer in use.  Free it unless
		 * it's the last one.  We keep the last one
		 * so as not to have to set it up again the
		 * next time somebody inserts a probe.
		 */
		hlist_del(&kip->hlist);
		if (hlist_empty(&kprobe_insn_pages)) {
			INIT_HLIST_NODE(&kip->hlist);
			hlist_add_head(&kip->hlist,
				       &kprobe_insn_pages);
		} else {
			module_free(NULL, kip->insns);
			kfree(kip);
		}
		return 1;
	}
	return 0;
}

static int __kprobes collect_garbage_slots(void)
{
	struct kprobe_insn_page *kip;
	struct hlist_node *pos, *next;

	/* Ensure no-one is preepmted on the garbages */
	if (check_safety() != 0)
		return -EAGAIN;

	hlist_for_each_safe(pos, next, &kprobe_insn_pages) {
		int i;
		kip = hlist_entry(pos, struct kprobe_insn_page, hlist);
		if (kip->ngarbage == 0)
			continue;
		kip->ngarbage = 0;	/* we will collect all garbages */
		for (i = 0; i < INSNS_PER_PAGE; i++) {
			if (kip->slot_used[i] == -1 &&
			    collect_one_slot(kip, i))
				break;
		}
	}
	kprobe_garbage_slots = 0;
	return 0;
}

void __kprobes free_insn_slot(kprobe_opcode_t * slot, int dirty)
225 226 227 228 229 230 231 232 233
{
	struct kprobe_insn_page *kip;
	struct hlist_node *pos;

	hlist_for_each(pos, &kprobe_insn_pages) {
		kip = hlist_entry(pos, struct kprobe_insn_page, hlist);
		if (kip->insns <= slot &&
		    slot < kip->insns + (INSNS_PER_PAGE * MAX_INSN_SIZE)) {
			int i = (slot - kip->insns) / MAX_INSN_SIZE;
234 235 236 237 238
			if (dirty) {
				kip->slot_used[i] = -1;
				kip->ngarbage++;
			} else {
				collect_one_slot(kip, i);
239
			}
240
			break;
241 242
		}
	}
243 244 245
	if (dirty && (++kprobe_garbage_slots > INSNS_PER_PAGE)) {
		collect_garbage_slots();
	}
246
}
247
#endif
248

249 250 251 252 253 254 255 256 257 258 259
/* We have preemption disabled.. so it is safe to use __ versions */
static inline void set_kprobe_instance(struct kprobe *kp)
{
	__get_cpu_var(kprobe_instance) = kp;
}

static inline void reset_kprobe_instance(void)
{
	__get_cpu_var(kprobe_instance) = NULL;
}

260 261
/*
 * This routine is called either:
262
 * 	- under the kprobe_mutex - during kprobe_[un]register()
263
 * 				OR
264
 * 	- with preemption disabled - from arch/xxx/kernel/kprobes.c
265
 */
266
struct kprobe __kprobes *get_kprobe(void *addr)
L
Linus Torvalds 已提交
267 268 269
{
	struct hlist_head *head;
	struct hlist_node *node;
270
	struct kprobe *p;
L
Linus Torvalds 已提交
271 272

	head = &kprobe_table[hash_ptr(addr, KPROBE_HASH_BITS)];
273
	hlist_for_each_entry_rcu(p, node, head, hlist) {
L
Linus Torvalds 已提交
274 275 276 277 278 279
		if (p->addr == addr)
			return p;
	}
	return NULL;
}

280 281 282 283
/*
 * Aggregate handlers for multiple kprobes support - these handlers
 * take care of invoking the individual kprobe handlers on p->list
 */
284
static int __kprobes aggr_pre_handler(struct kprobe *p, struct pt_regs *regs)
285 286 287
{
	struct kprobe *kp;

288
	list_for_each_entry_rcu(kp, &p->list, list) {
289
		if (kp->pre_handler) {
290
			set_kprobe_instance(kp);
291 292
			if (kp->pre_handler(kp, regs))
				return 1;
293
		}
294
		reset_kprobe_instance();
295 296 297 298
	}
	return 0;
}

299 300
static void __kprobes aggr_post_handler(struct kprobe *p, struct pt_regs *regs,
					unsigned long flags)
301 302 303
{
	struct kprobe *kp;

304
	list_for_each_entry_rcu(kp, &p->list, list) {
305
		if (kp->post_handler) {
306
			set_kprobe_instance(kp);
307
			kp->post_handler(kp, regs, flags);
308
			reset_kprobe_instance();
309 310 311 312 313
		}
	}
	return;
}

314 315
static int __kprobes aggr_fault_handler(struct kprobe *p, struct pt_regs *regs,
					int trapnr)
316
{
317 318
	struct kprobe *cur = __get_cpu_var(kprobe_instance);

319 320 321 322
	/*
	 * if we faulted "during" the execution of a user specified
	 * probe handler, invoke just that probe's fault handler
	 */
323 324
	if (cur && cur->fault_handler) {
		if (cur->fault_handler(cur, regs, trapnr))
325 326 327 328 329
			return 1;
	}
	return 0;
}

330
static int __kprobes aggr_break_handler(struct kprobe *p, struct pt_regs *regs)
331
{
332 333 334 335 336 337
	struct kprobe *cur = __get_cpu_var(kprobe_instance);
	int ret = 0;

	if (cur && cur->break_handler) {
		if (cur->break_handler(cur, regs))
			ret = 1;
338
	}
339 340
	reset_kprobe_instance();
	return ret;
341 342
}

343 344 345 346 347 348 349 350 351 352 353 354 355
/* Walks the list and increments nmissed count for multiprobe case */
void __kprobes kprobes_inc_nmissed_count(struct kprobe *p)
{
	struct kprobe *kp;
	if (p->pre_handler != aggr_pre_handler) {
		p->nmissed++;
	} else {
		list_for_each_entry_rcu(kp, &p->list, list)
			kp->nmissed++;
	}
	return;
}

356
/* Called with kretprobe_lock held */
357
struct kretprobe_instance __kprobes *get_free_rp_inst(struct kretprobe *rp)
358 359 360 361 362 363 364 365
{
	struct hlist_node *node;
	struct kretprobe_instance *ri;
	hlist_for_each_entry(ri, node, &rp->free_instances, uflist)
		return ri;
	return NULL;
}

366
/* Called with kretprobe_lock held */
367 368
static struct kretprobe_instance __kprobes *get_used_rp_inst(struct kretprobe
							      *rp)
369 370 371 372 373 374 375 376
{
	struct hlist_node *node;
	struct kretprobe_instance *ri;
	hlist_for_each_entry(ri, node, &rp->used_instances, uflist)
		return ri;
	return NULL;
}

377
/* Called with kretprobe_lock held */
378
void __kprobes add_rp_inst(struct kretprobe_instance *ri)
379 380 381 382 383 384
{
	/*
	 * Remove rp inst off the free list -
	 * Add it back when probed function returns
	 */
	hlist_del(&ri->uflist);
385

386 387 388
	/* Add rp inst onto table */
	INIT_HLIST_NODE(&ri->hlist);
	hlist_add_head(&ri->hlist,
389
			&kretprobe_inst_table[hash_ptr(ri->task, KPROBE_HASH_BITS)]);
390 391 392 393 394 395

	/* Also add this rp inst to the used list. */
	INIT_HLIST_NODE(&ri->uflist);
	hlist_add_head(&ri->uflist, &ri->rp->used_instances);
}

396
/* Called with kretprobe_lock held */
397 398
void __kprobes recycle_rp_inst(struct kretprobe_instance *ri,
				struct hlist_head *head)
399 400 401 402 403 404 405 406 407 408 409
{
	/* remove rp inst off the rprobe_inst_table */
	hlist_del(&ri->hlist);
	if (ri->rp) {
		/* remove rp inst off the used list */
		hlist_del(&ri->uflist);
		/* put rp inst back onto the free list */
		INIT_HLIST_NODE(&ri->uflist);
		hlist_add_head(&ri->uflist, &ri->rp->free_instances);
	} else
		/* Unregistering */
410
		hlist_add_head(&ri->hlist, head);
411 412
}

413
struct hlist_head __kprobes *kretprobe_inst_table_head(struct task_struct *tsk)
414 415 416 417 418
{
	return &kretprobe_inst_table[hash_ptr(tsk, KPROBE_HASH_BITS)];
}

/*
419 420 421 422
 * This function is called from finish_task_switch when task tk becomes dead,
 * so that we can recycle any function-return probe instances associated
 * with this task. These left over instances represent probed functions
 * that have been called but will never return.
423
 */
424
void __kprobes kprobe_flush_task(struct task_struct *tk)
425
{
B
bibo,mao 已提交
426
	struct kretprobe_instance *ri;
427
	struct hlist_head *head, empty_rp;
428
	struct hlist_node *node, *tmp;
429
	unsigned long flags = 0;
430

431
	INIT_HLIST_HEAD(&empty_rp);
432
	spin_lock_irqsave(&kretprobe_lock, flags);
B
bibo,mao 已提交
433 434 435
	head = kretprobe_inst_table_head(tk);
	hlist_for_each_entry_safe(ri, node, tmp, head, hlist) {
		if (ri->task == tk)
436
			recycle_rp_inst(ri, &empty_rp);
B
bibo,mao 已提交
437
	}
438
	spin_unlock_irqrestore(&kretprobe_lock, flags);
439 440 441 442 443

	hlist_for_each_entry_safe(ri, node, tmp, &empty_rp, hlist) {
		hlist_del(&ri->hlist);
		kfree(ri);
	}
444 445 446 447 448 449 450 451 452 453 454
}

static inline void free_rp_inst(struct kretprobe *rp)
{
	struct kretprobe_instance *ri;
	while ((ri = get_free_rp_inst(rp)) != NULL) {
		hlist_del(&ri->uflist);
		kfree(ri);
	}
}

455 456 457 458 459 460 461 462 463 464 465 466 467
/*
 * Keep all fields in the kprobe consistent
 */
static inline void copy_kprobe(struct kprobe *old_p, struct kprobe *p)
{
	memcpy(&p->opcode, &old_p->opcode, sizeof(kprobe_opcode_t));
	memcpy(&p->ainsn, &old_p->ainsn, sizeof(struct arch_specific_insn));
}

/*
* Add the new probe to old_p->list. Fail if this is the
* second jprobe at the address - two jprobes can't coexist
*/
468
static int __kprobes add_new_kprobe(struct kprobe *old_p, struct kprobe *p)
469 470
{
	if (p->break_handler) {
471 472
		if (old_p->break_handler)
			return -EEXIST;
473
		list_add_tail_rcu(&p->list, &old_p->list);
474
		old_p->break_handler = aggr_break_handler;
475
	} else
476
		list_add_rcu(&p->list, &old_p->list);
477 478
	if (p->post_handler && !old_p->post_handler)
		old_p->post_handler = aggr_post_handler;
479 480 481
	return 0;
}

482 483 484 485 486 487
/*
 * Fill in the required fields of the "manager kprobe". Replace the
 * earlier kprobe in the hlist with the manager kprobe
 */
static inline void add_aggr_kprobe(struct kprobe *ap, struct kprobe *p)
{
488
	copy_kprobe(p, ap);
489
	flush_insn_slot(ap);
490 491 492
	ap->addr = p->addr;
	ap->pre_handler = aggr_pre_handler;
	ap->fault_handler = aggr_fault_handler;
493 494 495 496
	if (p->post_handler)
		ap->post_handler = aggr_post_handler;
	if (p->break_handler)
		ap->break_handler = aggr_break_handler;
497 498

	INIT_LIST_HEAD(&ap->list);
499
	list_add_rcu(&p->list, &ap->list);
500

501
	hlist_replace_rcu(&p->hlist, &ap->hlist);
502 503 504 505 506 507
}

/*
 * This is the second or subsequent kprobe at the address - handle
 * the intricacies
 */
508 509
static int __kprobes register_aggr_kprobe(struct kprobe *old_p,
					  struct kprobe *p)
510 511 512 513
{
	int ret = 0;
	struct kprobe *ap;

514 515 516
	if (old_p->pre_handler == aggr_pre_handler) {
		copy_kprobe(old_p, p);
		ret = add_new_kprobe(old_p, p);
517
	} else {
518
		ap = kzalloc(sizeof(struct kprobe), GFP_KERNEL);
519 520 521
		if (!ap)
			return -ENOMEM;
		add_aggr_kprobe(ap, old_p);
522 523
		copy_kprobe(ap, p);
		ret = add_new_kprobe(ap, p);
524 525 526 527
	}
	return ret;
}

528 529 530 531 532 533 534 535
static int __kprobes in_kprobes_functions(unsigned long addr)
{
	if (addr >= (unsigned long)__kprobes_text_start
		&& addr < (unsigned long)__kprobes_text_end)
		return -EINVAL;
	return 0;
}

536 537
static int __kprobes __register_kprobe(struct kprobe *p,
	unsigned long called_from)
L
Linus Torvalds 已提交
538 539
{
	int ret = 0;
540
	struct kprobe *old_p;
541
	struct module *probed_mod;
542

543 544 545 546 547 548 549 550 551 552 553 554 555 556 557
	/*
	 * If we have a symbol_name argument look it up,
	 * and add it to the address.  That way the addr
	 * field can either be global or relative to a symbol.
	 */
	if (p->symbol_name) {
		if (p->addr)
			return -EINVAL;
		kprobe_lookup_name(p->symbol_name, p->addr);
	}

	if (!p->addr)
		return -EINVAL;
	p->addr = (kprobe_opcode_t *)(((char *)p->addr)+ p->offset);

558 559 560 561
	if ((!kernel_text_address((unsigned long) p->addr)) ||
		in_kprobes_functions((unsigned long) p->addr))
		return -EINVAL;

562 563 564 565 566 567 568 569 570 571 572 573 574 575 576
	p->mod_refcounted = 0;
	/* Check are we probing a module */
	if ((probed_mod = module_text_address((unsigned long) p->addr))) {
		struct module *calling_mod = module_text_address(called_from);
		/* We must allow modules to probe themself and
		 * in this case avoid incrementing the module refcount,
		 * so as to allow unloading of self probing modules.
		 */
		if (calling_mod && (calling_mod != probed_mod)) {
			if (unlikely(!try_module_get(probed_mod)))
				return -EINVAL;
			p->mod_refcounted = 1;
		} else
			probed_mod = NULL;
	}
L
Linus Torvalds 已提交
577

578
	p->nmissed = 0;
I
Ingo Molnar 已提交
579
	mutex_lock(&kprobe_mutex);
580 581 582
	old_p = get_kprobe(p->addr);
	if (old_p) {
		ret = register_aggr_kprobe(old_p, p);
583 584
		if (!ret)
			atomic_inc(&kprobe_count);
L
Linus Torvalds 已提交
585 586 587
		goto out;
	}

588 589 590
	if ((ret = arch_prepare_kprobe(p)) != 0)
		goto out;

591
	INIT_HLIST_NODE(&p->hlist);
592
	hlist_add_head_rcu(&p->hlist,
L
Linus Torvalds 已提交
593 594
		       &kprobe_table[hash_ptr(p->addr, KPROBE_HASH_BITS)]);

595 596 597 598
	if (atomic_add_return(1, &kprobe_count) == \
				(ARCH_INACTIVE_KPROBE_COUNT + 1))
		register_page_fault_notifier(&kprobe_page_fault_nb);

B
bibo,mao 已提交
599
	arch_arm_kprobe(p);
600

L
Linus Torvalds 已提交
601
out:
I
Ingo Molnar 已提交
602
	mutex_unlock(&kprobe_mutex);
603

604 605
	if (ret && probed_mod)
		module_put(probed_mod);
L
Linus Torvalds 已提交
606 607 608
	return ret;
}

609 610 611 612 613 614
int __kprobes register_kprobe(struct kprobe *p)
{
	return __register_kprobe(p,
		(unsigned long)__builtin_return_address(0));
}

615
void __kprobes unregister_kprobe(struct kprobe *p)
L
Linus Torvalds 已提交
616
{
617
	struct module *mod;
618 619
	struct kprobe *old_p, *list_p;
	int cleanup_p;
620

I
Ingo Molnar 已提交
621
	mutex_lock(&kprobe_mutex);
622
	old_p = get_kprobe(p->addr);
623
	if (unlikely(!old_p)) {
I
Ingo Molnar 已提交
624
		mutex_unlock(&kprobe_mutex);
625 626
		return;
	}
627 628 629 630 631
	if (p != old_p) {
		list_for_each_entry_rcu(list_p, &old_p->list, list)
			if (list_p == p)
			/* kprobe p is a valid probe */
				goto valid_p;
I
Ingo Molnar 已提交
632
		mutex_unlock(&kprobe_mutex);
633 634 635 636
		return;
	}
valid_p:
	if ((old_p == p) || ((old_p->pre_handler == aggr_pre_handler) &&
637
		(p->list.next == &old_p->list) &&
638 639
		(p->list.prev == &old_p->list))) {
		/* Only probe on the hash list */
640 641
		arch_disarm_kprobe(p);
		hlist_del_rcu(&old_p->hlist);
642
		cleanup_p = 1;
643 644
	} else {
		list_del_rcu(&p->list);
645
		cleanup_p = 0;
646
	}
647

I
Ingo Molnar 已提交
648
	mutex_unlock(&kprobe_mutex);
649

650
	synchronize_sched();
651 652
	if (p->mod_refcounted &&
	    (mod = module_text_address((unsigned long)p->addr)))
653
		module_put(mod);
654

655
	if (cleanup_p) {
656
		if (p != old_p) {
657
			list_del_rcu(&p->list);
658
			kfree(old_p);
659
		}
660
		arch_remove_kprobe(p);
661 662 663 664 665 666 667 668 669 670 671 672 673 674 675
	} else {
		mutex_lock(&kprobe_mutex);
		if (p->break_handler)
			old_p->break_handler = NULL;
		if (p->post_handler){
			list_for_each_entry_rcu(list_p, &old_p->list, list){
				if (list_p->post_handler){
					cleanup_p = 2;
					break;
				}
			}
			if (cleanup_p == 0)
				old_p->post_handler = NULL;
		}
		mutex_unlock(&kprobe_mutex);
676
	}
677 678 679 680 681 682 683 684 685 686

	/* Call unregister_page_fault_notifier()
	 * if no probes are active
	 */
	mutex_lock(&kprobe_mutex);
	if (atomic_add_return(-1, &kprobe_count) == \
				ARCH_INACTIVE_KPROBE_COUNT)
		unregister_page_fault_notifier(&kprobe_page_fault_nb);
	mutex_unlock(&kprobe_mutex);
	return;
L
Linus Torvalds 已提交
687 688 689
}

static struct notifier_block kprobe_exceptions_nb = {
690 691 692 693
	.notifier_call = kprobe_exceptions_notify,
	.priority = 0x7fffffff /* we need to be notified first */
};

L
Linus Torvalds 已提交
694

695
int __kprobes register_jprobe(struct jprobe *jp)
L
Linus Torvalds 已提交
696 697 698 699 700
{
	/* Todo: Verify probepoint is a function entry point */
	jp->kp.pre_handler = setjmp_pre_handler;
	jp->kp.break_handler = longjmp_break_handler;

701 702
	return __register_kprobe(&jp->kp,
		(unsigned long)__builtin_return_address(0));
L
Linus Torvalds 已提交
703 704
}

705
void __kprobes unregister_jprobe(struct jprobe *jp)
L
Linus Torvalds 已提交
706 707 708 709
{
	unregister_kprobe(&jp->kp);
}

710 711
#ifdef ARCH_SUPPORTS_KRETPROBES

712 713 714 715 716 717 718 719 720 721 722 723 724 725 726 727 728
/*
 * This kprobe pre_handler is registered with every kretprobe. When probe
 * hits it will set up the return probe.
 */
static int __kprobes pre_handler_kretprobe(struct kprobe *p,
					   struct pt_regs *regs)
{
	struct kretprobe *rp = container_of(p, struct kretprobe, kp);
	unsigned long flags = 0;

	/*TODO: consider to only swap the RA after the last pre_handler fired */
	spin_lock_irqsave(&kretprobe_lock, flags);
	arch_prepare_kretprobe(rp, regs);
	spin_unlock_irqrestore(&kretprobe_lock, flags);
	return 0;
}

729
int __kprobes register_kretprobe(struct kretprobe *rp)
730 731 732 733 734 735
{
	int ret = 0;
	struct kretprobe_instance *inst;
	int i;

	rp->kp.pre_handler = pre_handler_kretprobe;
736 737 738
	rp->kp.post_handler = NULL;
	rp->kp.fault_handler = NULL;
	rp->kp.break_handler = NULL;
739 740 741 742 743 744 745 746 747 748 749 750 751 752 753 754 755 756 757 758 759 760 761

	/* Pre-allocate memory for max kretprobe instances */
	if (rp->maxactive <= 0) {
#ifdef CONFIG_PREEMPT
		rp->maxactive = max(10, 2 * NR_CPUS);
#else
		rp->maxactive = NR_CPUS;
#endif
	}
	INIT_HLIST_HEAD(&rp->used_instances);
	INIT_HLIST_HEAD(&rp->free_instances);
	for (i = 0; i < rp->maxactive; i++) {
		inst = kmalloc(sizeof(struct kretprobe_instance), GFP_KERNEL);
		if (inst == NULL) {
			free_rp_inst(rp);
			return -ENOMEM;
		}
		INIT_HLIST_NODE(&inst->uflist);
		hlist_add_head(&inst->uflist, &rp->free_instances);
	}

	rp->nmissed = 0;
	/* Establish function entry probe point */
762 763
	if ((ret = __register_kprobe(&rp->kp,
		(unsigned long)__builtin_return_address(0))) != 0)
764 765 766 767 768 769
		free_rp_inst(rp);
	return ret;
}

#else /* ARCH_SUPPORTS_KRETPROBES */

770
int __kprobes register_kretprobe(struct kretprobe *rp)
771 772 773 774 775 776
{
	return -ENOSYS;
}

#endif /* ARCH_SUPPORTS_KRETPROBES */

777
void __kprobes unregister_kretprobe(struct kretprobe *rp)
778 779 780 781 782 783
{
	unsigned long flags;
	struct kretprobe_instance *ri;

	unregister_kprobe(&rp->kp);
	/* No race here */
784
	spin_lock_irqsave(&kretprobe_lock, flags);
785 786 787 788
	while ((ri = get_used_rp_inst(rp)) != NULL) {
		ri->rp = NULL;
		hlist_del(&ri->uflist);
	}
789
	spin_unlock_irqrestore(&kretprobe_lock, flags);
790
	free_rp_inst(rp);
791 792
}

L
Linus Torvalds 已提交
793 794 795 796 797 798
static int __init init_kprobes(void)
{
	int i, err = 0;

	/* FIXME allocate the probe table, currently defined statically */
	/* initialize all list heads */
799
	for (i = 0; i < KPROBE_TABLE_SIZE; i++) {
L
Linus Torvalds 已提交
800
		INIT_HLIST_HEAD(&kprobe_table[i]);
801 802
		INIT_HLIST_HEAD(&kretprobe_inst_table[i]);
	}
803
	atomic_set(&kprobe_count, 0);
L
Linus Torvalds 已提交
804

805
	err = arch_init_kprobes();
806 807 808
	if (!err)
		err = register_die_notifier(&kprobe_exceptions_nb);

L
Linus Torvalds 已提交
809 810 811 812 813 814 815 816 817 818
	return err;
}

__initcall(init_kprobes);

EXPORT_SYMBOL_GPL(register_kprobe);
EXPORT_SYMBOL_GPL(unregister_kprobe);
EXPORT_SYMBOL_GPL(register_jprobe);
EXPORT_SYMBOL_GPL(unregister_jprobe);
EXPORT_SYMBOL_GPL(jprobe_return);
819 820 821
EXPORT_SYMBOL_GPL(register_kretprobe);
EXPORT_SYMBOL_GPL(unregister_kretprobe);