1 // SPDX-License-Identifier: GPL-2.0-only !! 1 /* arch/sparc64/kernel/kprobes.c
2 /* !! 2 *
3 * Copyright (C) 2004, 2007-2010, 2011-2012 Sy !! 3 * Copyright (C) 2004 David S. Miller <davem@davemloft.net>
4 */ 4 */
5 5
6 #include <linux/types.h> !! 6 #include <linux/kernel.h>
7 #include <linux/kprobes.h> 7 #include <linux/kprobes.h>
8 #include <linux/slab.h> <<
9 #include <linux/module.h> 8 #include <linux/module.h>
10 #include <linux/kdebug.h> 9 #include <linux/kdebug.h>
11 #include <linux/sched.h> !! 10 #include <linux/slab.h>
12 #include <linux/uaccess.h> !! 11 #include <linux/context_tracking.h>
>> 12 #include <asm/signal.h>
13 #include <asm/cacheflush.h> 13 #include <asm/cacheflush.h>
14 #include <asm/current.h> !! 14 #include <asm/uaccess.h>
15 #include <asm/disasm.h> <<
16 15
17 #define MIN_STACK_SIZE(addr) min((unsigned !! 16 /* We do not have hardware single-stepping on sparc64.
18 (unsigned long)current_thread_ !! 17 * So we implement software single-stepping with breakpoint
>> 18 * traps. The top-level scheme is similar to that used
>> 19 * in the x86 kprobes implementation.
>> 20 *
>> 21 * In the kprobe->ainsn.insn[] array we store the original
>> 22 * instruction at index zero and a break instruction at
>> 23 * index one.
>> 24 *
>> 25 * When we hit a kprobe we:
>> 26 * - Run the pre-handler
>> 27 * - Remember "regs->tnpc" and interrupt level stored in
>> 28 * "regs->tstate" so we can restore them later
>> 29 * - Disable PIL interrupts
>> 30 * - Set regs->tpc to point to kprobe->ainsn.insn[0]
>> 31 * - Set regs->tnpc to point to kprobe->ainsn.insn[1]
>> 32 * - Mark that we are actively in a kprobe
>> 33 *
>> 34 * At this point we wait for the second breakpoint at
>> 35 * kprobe->ainsn.insn[1] to hit. When it does we:
>> 36 * - Run the post-handler
>> 37 * - Set regs->tpc to "remembered" regs->tnpc stored above,
>> 38 * restore the PIL interrupt level in "regs->tstate" as well
>> 39 * - Make any adjustments necessary to regs->tnpc in order
>> 40 * to handle relative branches correctly. See below.
>> 41 * - Mark that we are no longer actively in a kprobe.
>> 42 */
19 43
20 DEFINE_PER_CPU(struct kprobe *, current_kprobe 44 DEFINE_PER_CPU(struct kprobe *, current_kprobe) = NULL;
21 DEFINE_PER_CPU(struct kprobe_ctlblk, kprobe_ct 45 DEFINE_PER_CPU(struct kprobe_ctlblk, kprobe_ctlblk);
22 46
>> 47 struct kretprobe_blackpoint kretprobe_blacklist[] = {{NULL, NULL}};
>> 48
23 int __kprobes arch_prepare_kprobe(struct kprob 49 int __kprobes arch_prepare_kprobe(struct kprobe *p)
24 { 50 {
25 /* Attempt to probe at unaligned addre !! 51 if ((unsigned long) p->addr & 0x3UL)
26 if ((unsigned long)p->addr & 0x01) !! 52 return -EILSEQ;
27 return -EINVAL; <<
28 53
29 /* Address should not be in exception !! 54 p->ainsn.insn[0] = *p->addr;
>> 55 flushi(&p->ainsn.insn[0]);
30 56
31 p->ainsn.is_short = is_short_instr((un !! 57 p->ainsn.insn[1] = BREAKPOINT_INSTRUCTION_2;
32 p->opcode = *p->addr; !! 58 flushi(&p->ainsn.insn[1]);
33 59
>> 60 p->opcode = *p->addr;
34 return 0; 61 return 0;
35 } 62 }
36 63
37 void __kprobes arch_arm_kprobe(struct kprobe * 64 void __kprobes arch_arm_kprobe(struct kprobe *p)
38 { 65 {
39 *p->addr = UNIMP_S_INSTRUCTION; !! 66 *p->addr = BREAKPOINT_INSTRUCTION;
40 !! 67 flushi(p->addr);
41 flush_icache_range((unsigned long)p->a <<
42 (unsigned long)p->a <<
43 } 68 }
44 69
45 void __kprobes arch_disarm_kprobe(struct kprob 70 void __kprobes arch_disarm_kprobe(struct kprobe *p)
46 { 71 {
47 *p->addr = p->opcode; 72 *p->addr = p->opcode;
48 !! 73 flushi(p->addr);
49 flush_icache_range((unsigned long)p->a <<
50 (unsigned long)p->a <<
51 } <<
52 <<
53 void __kprobes arch_remove_kprobe(struct kprob <<
54 { <<
55 arch_disarm_kprobe(p); <<
56 <<
57 /* Can we remove the kprobe in the mid <<
58 if (p->ainsn.t1_addr) { <<
59 *(p->ainsn.t1_addr) = p->ainsn <<
60 <<
61 flush_icache_range((unsigned l <<
62 (unsigned l <<
63 sizeof(kpro <<
64 <<
65 p->ainsn.t1_addr = NULL; <<
66 } <<
67 <<
68 if (p->ainsn.t2_addr) { <<
69 *(p->ainsn.t2_addr) = p->ainsn <<
70 <<
71 flush_icache_range((unsigned l <<
72 (unsigned l <<
73 sizeof(kpro <<
74 <<
75 p->ainsn.t2_addr = NULL; <<
76 } <<
77 } 74 }
78 75
79 static void __kprobes save_previous_kprobe(str 76 static void __kprobes save_previous_kprobe(struct kprobe_ctlblk *kcb)
80 { 77 {
81 kcb->prev_kprobe.kp = kprobe_running() 78 kcb->prev_kprobe.kp = kprobe_running();
82 kcb->prev_kprobe.status = kcb->kprobe_ 79 kcb->prev_kprobe.status = kcb->kprobe_status;
>> 80 kcb->prev_kprobe.orig_tnpc = kcb->kprobe_orig_tnpc;
>> 81 kcb->prev_kprobe.orig_tstate_pil = kcb->kprobe_orig_tstate_pil;
83 } 82 }
84 83
85 static void __kprobes restore_previous_kprobe( 84 static void __kprobes restore_previous_kprobe(struct kprobe_ctlblk *kcb)
86 { 85 {
87 __this_cpu_write(current_kprobe, kcb-> 86 __this_cpu_write(current_kprobe, kcb->prev_kprobe.kp);
88 kcb->kprobe_status = kcb->prev_kprobe. 87 kcb->kprobe_status = kcb->prev_kprobe.status;
>> 88 kcb->kprobe_orig_tnpc = kcb->prev_kprobe.orig_tnpc;
>> 89 kcb->kprobe_orig_tstate_pil = kcb->prev_kprobe.orig_tstate_pil;
89 } 90 }
90 91
91 static inline void __kprobes set_current_kprob !! 92 static void __kprobes set_current_kprobe(struct kprobe *p, struct pt_regs *regs,
>> 93 struct kprobe_ctlblk *kcb)
92 { 94 {
93 __this_cpu_write(current_kprobe, p); 95 __this_cpu_write(current_kprobe, p);
>> 96 kcb->kprobe_orig_tnpc = regs->tnpc;
>> 97 kcb->kprobe_orig_tstate_pil = (regs->tstate & TSTATE_PIL);
94 } 98 }
95 99
96 static void __kprobes resume_execution(struct !! 100 static void __kprobes prepare_singlestep(struct kprobe *p, struct pt_regs *regs,
97 struct !! 101 struct kprobe_ctlblk *kcb)
98 { 102 {
99 /* Remove the trap instructions insert !! 103 regs->tstate |= TSTATE_PIL;
100 * restore the original instructions <<
101 */ <<
102 if (p->ainsn.t1_addr) { <<
103 *(p->ainsn.t1_addr) = p->ainsn <<
104 104
105 flush_icache_range((unsigned l !! 105 /*single step inline, if it a breakpoint instruction*/
106 (unsigned l !! 106 if (p->opcode == BREAKPOINT_INSTRUCTION) {
107 sizeof(kpro !! 107 regs->tpc = (unsigned long) p->addr;
108 !! 108 regs->tnpc = kcb->kprobe_orig_tnpc;
109 p->ainsn.t1_addr = NULL; !! 109 } else {
>> 110 regs->tpc = (unsigned long) &p->ainsn.insn[0];
>> 111 regs->tnpc = (unsigned long) &p->ainsn.insn[1];
110 } 112 }
>> 113 }
111 114
112 if (p->ainsn.t2_addr) { !! 115 static int __kprobes kprobe_handler(struct pt_regs *regs)
113 *(p->ainsn.t2_addr) = p->ainsn !! 116 {
>> 117 struct kprobe *p;
>> 118 void *addr = (void *) regs->tpc;
>> 119 int ret = 0;
>> 120 struct kprobe_ctlblk *kcb;
114 121
115 flush_icache_range((unsigned l !! 122 /*
116 (unsigned l !! 123 * We don't want to be preempted for the entire
117 sizeof(kpro !! 124 * duration of kprobe processing
>> 125 */
>> 126 preempt_disable();
>> 127 kcb = get_kprobe_ctlblk();
118 128
119 p->ainsn.t2_addr = NULL; !! 129 if (kprobe_running()) {
>> 130 p = get_kprobe(addr);
>> 131 if (p) {
>> 132 if (kcb->kprobe_status == KPROBE_HIT_SS) {
>> 133 regs->tstate = ((regs->tstate & ~TSTATE_PIL) |
>> 134 kcb->kprobe_orig_tstate_pil);
>> 135 goto no_kprobe;
>> 136 }
>> 137 /* We have reentered the kprobe_handler(), since
>> 138 * another probe was hit while within the handler.
>> 139 * We here save the original kprobes variables and
>> 140 * just single step on the instruction of the new probe
>> 141 * without calling any user handlers.
>> 142 */
>> 143 save_previous_kprobe(kcb);
>> 144 set_current_kprobe(p, regs, kcb);
>> 145 kprobes_inc_nmissed_count(p);
>> 146 kcb->kprobe_status = KPROBE_REENTER;
>> 147 prepare_singlestep(p, regs, kcb);
>> 148 return 1;
>> 149 } else {
>> 150 if (*(u32 *)addr != BREAKPOINT_INSTRUCTION) {
>> 151 /* The breakpoint instruction was removed by
>> 152 * another cpu right after we hit, no further
>> 153 * handling of this interrupt is appropriate
>> 154 */
>> 155 ret = 1;
>> 156 goto no_kprobe;
>> 157 }
>> 158 p = __this_cpu_read(current_kprobe);
>> 159 if (p->break_handler && p->break_handler(p, regs))
>> 160 goto ss_probe;
>> 161 }
>> 162 goto no_kprobe;
120 } 163 }
121 164
122 return; !! 165 p = get_kprobe(addr);
>> 166 if (!p) {
>> 167 if (*(u32 *)addr != BREAKPOINT_INSTRUCTION) {
>> 168 /*
>> 169 * The breakpoint instruction was removed right
>> 170 * after we hit it. Another cpu has removed
>> 171 * either a probepoint or a debugger breakpoint
>> 172 * at this address. In either case, no further
>> 173 * handling of this interrupt is appropriate.
>> 174 */
>> 175 ret = 1;
>> 176 }
>> 177 /* Not one of ours: let kernel handle it */
>> 178 goto no_kprobe;
>> 179 }
>> 180
>> 181 set_current_kprobe(p, regs, kcb);
>> 182 kcb->kprobe_status = KPROBE_HIT_ACTIVE;
>> 183 if (p->pre_handler && p->pre_handler(p, regs))
>> 184 return 1;
>> 185
>> 186 ss_probe:
>> 187 prepare_singlestep(p, regs, kcb);
>> 188 kcb->kprobe_status = KPROBE_HIT_SS;
>> 189 return 1;
>> 190
>> 191 no_kprobe:
>> 192 preempt_enable_no_resched();
>> 193 return ret;
123 } 194 }
124 195
125 static void __kprobes setup_singlestep(struct !! 196 /* If INSN is a relative control transfer instruction,
>> 197 * return the corrected branch destination value.
>> 198 *
>> 199 * regs->tpc and regs->tnpc still hold the values of the
>> 200 * program counters at the time of trap due to the execution
>> 201 * of the BREAKPOINT_INSTRUCTION_2 at p->ainsn.insn[1]
>> 202 *
>> 203 */
>> 204 static unsigned long __kprobes relbranch_fixup(u32 insn, struct kprobe *p,
>> 205 struct pt_regs *regs)
126 { 206 {
127 unsigned long next_pc; !! 207 unsigned long real_pc = (unsigned long) p->addr;
128 unsigned long tgt_if_br = 0; <<
129 int is_branch; <<
130 unsigned long bta; <<
131 208
132 /* Copy the opcode back to the kprobe !! 209 /* Branch not taken, no mods necessary. */
133 * instruction. Because of this we wil !! 210 if (regs->tnpc == regs->tpc + 0x4UL)
134 * same kprobe until this kprobe is do !! 211 return real_pc + 0x8UL;
135 */ <<
136 *(p->addr) = p->opcode; <<
137 212
138 flush_icache_range((unsigned long)p->a !! 213 /* The three cases are call, branch w/prediction,
139 (unsigned long)p->a !! 214 * and traditional branch.
>> 215 */
>> 216 if ((insn & 0xc0000000) == 0x40000000 ||
>> 217 (insn & 0xc1c00000) == 0x00400000 ||
>> 218 (insn & 0xc1c00000) == 0x00800000) {
>> 219 unsigned long ainsn_addr;
>> 220
>> 221 ainsn_addr = (unsigned long) &p->ainsn.insn[0];
>> 222
>> 223 /* The instruction did all the work for us
>> 224 * already, just apply the offset to the correct
>> 225 * instruction location.
>> 226 */
>> 227 return (real_pc + (regs->tnpc - ainsn_addr));
>> 228 }
140 229
141 /* Now we insert the trap at the next !! 230 /* It is jmpl or some other absolute PC modification instruction,
142 * single step. If it is a branch we i !! 231 * leave NPC as-is.
143 * targets <<
144 */ 232 */
>> 233 return regs->tnpc;
>> 234 }
145 235
146 bta = regs->bta; !! 236 /* If INSN is an instruction which writes it's PC location
>> 237 * into a destination register, fix that up.
>> 238 */
>> 239 static void __kprobes retpc_fixup(struct pt_regs *regs, u32 insn,
>> 240 unsigned long real_pc)
>> 241 {
>> 242 unsigned long *slot = NULL;
147 243
148 if (regs->status32 & 0x40) { !! 244 /* Simplest case is 'call', which always uses %o7 */
149 /* We are in a delay slot with !! 245 if ((insn & 0xc0000000) == 0x40000000) {
>> 246 slot = ®s->u_regs[UREG_I7];
>> 247 }
150 248
151 next_pc = bta & ~0x01; !! 249 /* 'jmpl' encodes the register inside of the opcode */
>> 250 if ((insn & 0xc1f80000) == 0x81c00000) {
>> 251 unsigned long rd = ((insn >> 25) & 0x1f);
152 252
153 if (!p->ainsn.is_short) { !! 253 if (rd <= 15) {
154 if (bta & 0x01) !! 254 slot = ®s->u_regs[rd];
155 regs->blink += !! 255 } else {
156 else { !! 256 /* Hard case, it goes onto the stack. */
157 /* Branch not !! 257 flushw_all();
158 next_pc += 2; <<
159 <<
160 /* next pc is <<
161 * delay slot <<
162 */ <<
163 regs->bta += 2 <<
164 } <<
165 } <<
166 258
167 is_branch = 0; !! 259 rd -= 16;
168 } else !! 260 slot = (unsigned long *)
169 is_branch = !! 261 (regs->u_regs[UREG_FP] + STACK_BIAS);
170 disasm_next_pc((unsigned l !! 262 slot += rd;
171 (struct callee_regs *) !! 263 }
172 &next_pc, &tgt_if_br); <<
173 <<
174 p->ainsn.t1_addr = (kprobe_opcode_t *) <<
175 p->ainsn.t1_opcode = *(p->ainsn.t1_add <<
176 *(p->ainsn.t1_addr) = TRAP_S_2_INSTRUC <<
177 <<
178 flush_icache_range((unsigned long)p->a <<
179 (unsigned long)p->a <<
180 sizeof(kprobe_opcod <<
181 <<
182 if (is_branch) { <<
183 p->ainsn.t2_addr = (kprobe_opc <<
184 p->ainsn.t2_opcode = *(p->ains <<
185 *(p->ainsn.t2_addr) = TRAP_S_2 <<
186 <<
187 flush_icache_range((unsigned l <<
188 (unsigned l <<
189 sizeof(kpro <<
190 } 264 }
>> 265 if (slot != NULL)
>> 266 *slot = real_pc;
191 } 267 }
192 268
193 static int !! 269 /*
194 __kprobes arc_kprobe_handler(unsigned long add !! 270 * Called after single-stepping. p->addr is the address of the
>> 271 * instruction which has been replaced by the breakpoint
>> 272 * instruction. To avoid the SMP problems that can occur when we
>> 273 * temporarily put back the original opcode to single-step, we
>> 274 * single-stepped a copy of the instruction. The address of this
>> 275 * copy is &p->ainsn.insn[0].
>> 276 *
>> 277 * This function prepares to return from the post-single-step
>> 278 * breakpoint trap.
>> 279 */
>> 280 static void __kprobes resume_execution(struct kprobe *p,
>> 281 struct pt_regs *regs, struct kprobe_ctlblk *kcb)
195 { 282 {
196 struct kprobe *p; !! 283 u32 insn = p->ainsn.insn[0];
197 struct kprobe_ctlblk *kcb; <<
198 <<
199 preempt_disable(); <<
200 <<
201 kcb = get_kprobe_ctlblk(); <<
202 p = get_kprobe((unsigned long *)addr); <<
203 <<
204 if (p) { <<
205 /* <<
206 * We have reentered the kprob <<
207 * was hit while within the ha <<
208 * kprobes and single step on <<
209 * without calling any user ha <<
210 * kprobes. <<
211 */ <<
212 if (kprobe_running()) { <<
213 save_previous_kprobe(k <<
214 set_current_kprobe(p); <<
215 kprobes_inc_nmissed_co <<
216 setup_singlestep(p, re <<
217 kcb->kprobe_status = K <<
218 return 1; <<
219 } <<
220 284
221 set_current_kprobe(p); !! 285 regs->tnpc = relbranch_fixup(insn, p, regs);
222 kcb->kprobe_status = KPROBE_HI <<
223 286
224 /* If we have no pre-handler o !! 287 /* This assignment must occur after relbranch_fixup() */
225 * normal processing. If we ha !! 288 regs->tpc = kcb->kprobe_orig_tnpc;
226 * non-zero - which means user <<
227 * to another instruction, we <<
228 */ <<
229 if (!p->pre_handler || !p->pre <<
230 setup_singlestep(p, re <<
231 kcb->kprobe_status = K <<
232 } else { <<
233 reset_current_kprobe() <<
234 preempt_enable_no_resc <<
235 } <<
236 289
237 return 1; !! 290 retpc_fixup(regs, insn, (unsigned long) p->addr);
238 } <<
239 291
240 /* no_kprobe: */ !! 292 regs->tstate = ((regs->tstate & ~TSTATE_PIL) |
241 preempt_enable_no_resched(); !! 293 kcb->kprobe_orig_tstate_pil);
242 return 0; <<
243 } 294 }
244 295
245 static int !! 296 static int __kprobes post_kprobe_handler(struct pt_regs *regs)
246 __kprobes arc_post_kprobe_handler(unsigned lon <<
247 { 297 {
248 struct kprobe *cur = kprobe_running(); 298 struct kprobe *cur = kprobe_running();
249 struct kprobe_ctlblk *kcb = get_kprobe 299 struct kprobe_ctlblk *kcb = get_kprobe_ctlblk();
250 300
251 if (!cur) 301 if (!cur)
252 return 0; 302 return 0;
253 303
254 resume_execution(cur, addr, regs); <<
255 <<
256 /* Rearm the kprobe */ <<
257 arch_arm_kprobe(cur); <<
258 <<
259 /* <<
260 * When we return from trap instructio <<
261 * We restored the actual instruction <<
262 * return to the same address and exec <<
263 */ <<
264 regs->ret = addr; <<
265 <<
266 if ((kcb->kprobe_status != KPROBE_REEN 304 if ((kcb->kprobe_status != KPROBE_REENTER) && cur->post_handler) {
267 kcb->kprobe_status = KPROBE_HI 305 kcb->kprobe_status = KPROBE_HIT_SSDONE;
268 cur->post_handler(cur, regs, 0 306 cur->post_handler(cur, regs, 0);
269 } 307 }
270 308
>> 309 resume_execution(cur, regs, kcb);
>> 310
>> 311 /*Restore back the original saved kprobes variables and continue. */
271 if (kcb->kprobe_status == KPROBE_REENT 312 if (kcb->kprobe_status == KPROBE_REENTER) {
272 restore_previous_kprobe(kcb); 313 restore_previous_kprobe(kcb);
273 goto out; 314 goto out;
274 } 315 }
275 <<
276 reset_current_kprobe(); 316 reset_current_kprobe();
277 <<
278 out: 317 out:
279 preempt_enable_no_resched(); 318 preempt_enable_no_resched();
>> 319
280 return 1; 320 return 1;
281 } 321 }
282 322
283 /* !! 323 int __kprobes kprobe_fault_handler(struct pt_regs *regs, int trapnr)
284 * Fault can be for the instruction being sing <<
285 * pre/post handlers in the module. <<
286 * This is applicable for applications like us <<
287 * probe in user space and the handlers in the <<
288 */ <<
289 <<
290 int __kprobes kprobe_fault_handler(struct pt_r <<
291 { 324 {
292 struct kprobe *cur = kprobe_running(); 325 struct kprobe *cur = kprobe_running();
293 struct kprobe_ctlblk *kcb = get_kprobe 326 struct kprobe_ctlblk *kcb = get_kprobe_ctlblk();
>> 327 const struct exception_table_entry *entry;
294 328
295 switch (kcb->kprobe_status) { !! 329 switch(kcb->kprobe_status) {
296 case KPROBE_HIT_SS: 330 case KPROBE_HIT_SS:
297 case KPROBE_REENTER: 331 case KPROBE_REENTER:
298 /* 332 /*
299 * We are here because the ins !! 333 * We are here because the instruction being single
300 * caused the fault. We reset !! 334 * stepped caused a page fault. We reset the current
301 * exception handler as if it !! 335 * kprobe and the tpc points back to the probe address
302 * case it doesn't matter beca !! 336 * and allow the page fault handler to continue as a
>> 337 * normal page fault.
303 */ 338 */
304 resume_execution(cur, (unsigne !! 339 regs->tpc = (unsigned long)cur->addr;
305 !! 340 regs->tnpc = kcb->kprobe_orig_tnpc;
>> 341 regs->tstate = ((regs->tstate & ~TSTATE_PIL) |
>> 342 kcb->kprobe_orig_tstate_pil);
306 if (kcb->kprobe_status == KPRO 343 if (kcb->kprobe_status == KPROBE_REENTER)
307 restore_previous_kprob 344 restore_previous_kprobe(kcb);
308 else 345 else
309 reset_current_kprobe() 346 reset_current_kprobe();
310 <<
311 preempt_enable_no_resched(); 347 preempt_enable_no_resched();
312 break; 348 break;
313 <<
314 case KPROBE_HIT_ACTIVE: 349 case KPROBE_HIT_ACTIVE:
315 case KPROBE_HIT_SSDONE: 350 case KPROBE_HIT_SSDONE:
316 /* 351 /*
317 * We are here because the ins !! 352 * We increment the nmissed count for accounting,
318 * caused the fault. !! 353 * we can also use npre/npostfault count for accounting
>> 354 * these specific fault cases.
319 */ 355 */
>> 356 kprobes_inc_nmissed_count(cur);
320 357
321 /* 358 /*
322 * In case the user-specified !! 359 * We come here because instructions in the pre/post
323 * try to fix up. !! 360 * handler caused the page_fault, this could happen
>> 361 * if handler tries to access user space by
>> 362 * copy_from_user(), get_user() etc. Let the
>> 363 * user-specified handler try to fix it first.
324 */ 364 */
325 if (fixup_exception(regs)) !! 365 if (cur->fault_handler && cur->fault_handler(cur, regs, trapnr))
>> 366 return 1;
>> 367
>> 368 /*
>> 369 * In case the user-specified fault handler returned
>> 370 * zero, try to fix up.
>> 371 */
>> 372
>> 373 entry = search_exception_tables(regs->tpc);
>> 374 if (entry) {
>> 375 regs->tpc = entry->fixup;
>> 376 regs->tnpc = regs->tpc + 4;
326 return 1; 377 return 1;
>> 378 }
327 379
328 /* 380 /*
329 * fixup_exception() could not 381 * fixup_exception() could not handle it,
330 * Let do_page_fault() fix it. 382 * Let do_page_fault() fix it.
331 */ 383 */
332 break; 384 break;
333 <<
334 default: 385 default:
335 break; 386 break;
336 } 387 }
>> 388
337 return 0; 389 return 0;
338 } 390 }
339 391
>> 392 /*
>> 393 * Wrapper routine to for handling exceptions.
>> 394 */
340 int __kprobes kprobe_exceptions_notify(struct 395 int __kprobes kprobe_exceptions_notify(struct notifier_block *self,
341 unsigne 396 unsigned long val, void *data)
342 { 397 {
343 struct die_args *args = data; !! 398 struct die_args *args = (struct die_args *)data;
344 unsigned long addr = args->err; <<
345 int ret = NOTIFY_DONE; 399 int ret = NOTIFY_DONE;
346 400
>> 401 if (args->regs && user_mode(args->regs))
>> 402 return ret;
>> 403
347 switch (val) { 404 switch (val) {
348 case DIE_IERR: !! 405 case DIE_DEBUG:
349 if (arc_kprobe_handler(addr, a !! 406 if (kprobe_handler(args->regs))
350 return NOTIFY_STOP; !! 407 ret = NOTIFY_STOP;
351 break; 408 break;
352 !! 409 case DIE_DEBUG_2:
353 case DIE_TRAP: !! 410 if (post_kprobe_handler(args->regs))
354 if (arc_post_kprobe_handler(ad !! 411 ret = NOTIFY_STOP;
355 return NOTIFY_STOP; <<
356 break; 412 break;
357 <<
358 default: 413 default:
359 break; 414 break;
360 } 415 }
361 <<
362 return ret; 416 return ret;
363 } 417 }
364 418
365 static void __used kretprobe_trampoline_holder !! 419 asmlinkage void __kprobes kprobe_trap(unsigned long trap_level,
>> 420 struct pt_regs *regs)
366 { 421 {
367 __asm__ __volatile__(".global __kretpr !! 422 enum ctx_state prev_state = exception_enter();
368 "__kretprobe_tram !! 423
369 "nop\n"); !! 424 BUG_ON(trap_level != 0x170 && trap_level != 0x171);
>> 425
>> 426 if (user_mode(regs)) {
>> 427 local_irq_enable();
>> 428 bad_trap(regs, trap_level);
>> 429 goto out;
>> 430 }
>> 431
>> 432 /* trap_level == 0x170 --> ta 0x70
>> 433 * trap_level == 0x171 --> ta 0x71
>> 434 */
>> 435 if (notify_die((trap_level == 0x170) ? DIE_DEBUG : DIE_DEBUG_2,
>> 436 (trap_level == 0x170) ? "debug" : "debug_2",
>> 437 regs, 0, trap_level, SIGTRAP) != NOTIFY_STOP)
>> 438 bad_trap(regs, trap_level);
>> 439 out:
>> 440 exception_exit(prev_state);
370 } 441 }
371 442
>> 443 /* Jprobes support. */
>> 444 int __kprobes setjmp_pre_handler(struct kprobe *p, struct pt_regs *regs)
>> 445 {
>> 446 struct jprobe *jp = container_of(p, struct jprobe, kp);
>> 447 struct kprobe_ctlblk *kcb = get_kprobe_ctlblk();
>> 448
>> 449 memcpy(&(kcb->jprobe_saved_regs), regs, sizeof(*regs));
>> 450
>> 451 regs->tpc = (unsigned long) jp->entry;
>> 452 regs->tnpc = ((unsigned long) jp->entry) + 0x4UL;
>> 453 regs->tstate |= TSTATE_PIL;
>> 454
>> 455 return 1;
>> 456 }
>> 457
>> 458 void __kprobes jprobe_return(void)
>> 459 {
>> 460 struct kprobe_ctlblk *kcb = get_kprobe_ctlblk();
>> 461 register unsigned long orig_fp asm("g1");
>> 462
>> 463 orig_fp = kcb->jprobe_saved_regs.u_regs[UREG_FP];
>> 464 __asm__ __volatile__("\n"
>> 465 "1: cmp %%sp, %0\n\t"
>> 466 "blu,a,pt %%xcc, 1b\n\t"
>> 467 " restore\n\t"
>> 468 ".globl jprobe_return_trap_instruction\n"
>> 469 "jprobe_return_trap_instruction:\n\t"
>> 470 "ta 0x70"
>> 471 : /* no outputs */
>> 472 : "r" (orig_fp));
>> 473 }
>> 474
>> 475 extern void jprobe_return_trap_instruction(void);
>> 476
>> 477 int __kprobes longjmp_break_handler(struct kprobe *p, struct pt_regs *regs)
>> 478 {
>> 479 u32 *addr = (u32 *) regs->tpc;
>> 480 struct kprobe_ctlblk *kcb = get_kprobe_ctlblk();
>> 481
>> 482 if (addr == (u32 *) jprobe_return_trap_instruction) {
>> 483 memcpy(regs, &(kcb->jprobe_saved_regs), sizeof(*regs));
>> 484 preempt_enable_no_resched();
>> 485 return 1;
>> 486 }
>> 487 return 0;
>> 488 }
>> 489
>> 490 /* The value stored in the return address register is actually 2
>> 491 * instructions before where the callee will return to.
>> 492 * Sequences usually look something like this
>> 493 *
>> 494 * call some_function <--- return register points here
>> 495 * nop <--- call delay slot
>> 496 * whatever <--- where callee returns to
>> 497 *
>> 498 * To keep trampoline_probe_handler logic simpler, we normalize the
>> 499 * value kept in ri->ret_addr so we don't need to keep adjusting it
>> 500 * back and forth.
>> 501 */
372 void __kprobes arch_prepare_kretprobe(struct k 502 void __kprobes arch_prepare_kretprobe(struct kretprobe_instance *ri,
373 struct p 503 struct pt_regs *regs)
374 { 504 {
375 !! 505 ri->ret_addr = (kprobe_opcode_t *)(regs->u_regs[UREG_RETPC] + 8);
376 ri->ret_addr = (kprobe_opcode_t *) reg <<
377 ri->fp = NULL; <<
378 506
379 /* Replace the return addr with trampo 507 /* Replace the return addr with trampoline addr */
380 regs->blink = (unsigned long)&__kretpr !! 508 regs->u_regs[UREG_RETPC] =
>> 509 ((unsigned long)kretprobe_trampoline) - 8;
381 } 510 }
382 511
>> 512 /*
>> 513 * Called when the probe at kretprobe trampoline is hit
>> 514 */
383 static int __kprobes trampoline_probe_handler( 515 static int __kprobes trampoline_probe_handler(struct kprobe *p,
384 516 struct pt_regs *regs)
385 { 517 {
386 regs->ret = __kretprobe_trampoline_han !! 518 struct kretprobe_instance *ri = NULL;
>> 519 struct hlist_head *head, empty_rp;
>> 520 struct hlist_node *tmp;
>> 521 unsigned long flags, orig_ret_address = 0;
>> 522 unsigned long trampoline_address =(unsigned long)&kretprobe_trampoline;
>> 523
>> 524 INIT_HLIST_HEAD(&empty_rp);
>> 525 kretprobe_hash_lock(current, &head, &flags);
>> 526
>> 527 /*
>> 528 * It is possible to have multiple instances associated with a given
>> 529 * task either because an multiple functions in the call path
>> 530 * have a return probe installed on them, and/or more than one return
>> 531 * return probe was registered for a target function.
>> 532 *
>> 533 * We can handle this because:
>> 534 * - instances are always inserted at the head of the list
>> 535 * - when multiple return probes are registered for the same
>> 536 * function, the first instance's ret_addr will point to the
>> 537 * real return address, and all the rest will point to
>> 538 * kretprobe_trampoline
>> 539 */
>> 540 hlist_for_each_entry_safe(ri, tmp, head, hlist) {
>> 541 if (ri->task != current)
>> 542 /* another task is sharing our hash bucket */
>> 543 continue;
>> 544
>> 545 if (ri->rp && ri->rp->handler)
>> 546 ri->rp->handler(ri, regs);
>> 547
>> 548 orig_ret_address = (unsigned long)ri->ret_addr;
>> 549 recycle_rp_inst(ri, &empty_rp);
>> 550
>> 551 if (orig_ret_address != trampoline_address)
>> 552 /*
>> 553 * This is the real return address. Any other
>> 554 * instances associated with this task are for
>> 555 * other calls deeper on the call stack
>> 556 */
>> 557 break;
>> 558 }
>> 559
>> 560 kretprobe_assert(ri, orig_ret_address, trampoline_address);
>> 561 regs->tpc = orig_ret_address;
>> 562 regs->tnpc = orig_ret_address + 4;
>> 563
>> 564 reset_current_kprobe();
>> 565 kretprobe_hash_unlock(current, &flags);
>> 566 preempt_enable_no_resched();
387 567
388 /* By returning a non zero value, we a !! 568 hlist_for_each_entry_safe(ri, tmp, &empty_rp, hlist) {
389 * that we don't want the post_handler !! 569 hlist_del(&ri->hlist);
>> 570 kfree(ri);
>> 571 }
>> 572 /*
>> 573 * By returning a non-zero value, we are telling
>> 574 * kprobe_handler() that we don't want the post_handler
>> 575 * to run (and have re-enabled preemption)
390 */ 576 */
391 return 1; 577 return 1;
392 } 578 }
393 579
>> 580 static void __used kretprobe_trampoline_holder(void)
>> 581 {
>> 582 asm volatile(".global kretprobe_trampoline\n"
>> 583 "kretprobe_trampoline:\n"
>> 584 "\tnop\n"
>> 585 "\tnop\n");
>> 586 }
394 static struct kprobe trampoline_p = { 587 static struct kprobe trampoline_p = {
395 .addr = (kprobe_opcode_t *) &__kretpro !! 588 .addr = (kprobe_opcode_t *) &kretprobe_trampoline,
396 .pre_handler = trampoline_probe_handle 589 .pre_handler = trampoline_probe_handler
397 }; 590 };
398 591
399 int __init arch_init_kprobes(void) 592 int __init arch_init_kprobes(void)
400 { 593 {
401 /* Registering the trampoline code for <<
402 return register_kprobe(&trampoline_p); 594 return register_kprobe(&trampoline_p);
403 } 595 }
404 596
405 int __kprobes arch_trampoline_kprobe(struct kp 597 int __kprobes arch_trampoline_kprobe(struct kprobe *p)
406 { 598 {
407 if (p->addr == (kprobe_opcode_t *) &__ !! 599 if (p->addr == (kprobe_opcode_t *)&kretprobe_trampoline)
408 return 1; 600 return 1;
409 601
410 return 0; 602 return 0;
411 } <<
412 <<
413 void trap_is_kprobe(unsigned long address, str <<
414 { <<
415 notify_die(DIE_TRAP, "kprobe_trap", re <<
416 } 603 }
417 604
Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.