1 // SPDX-License-Identifier: GPL-2.0-only !! 1 // SPDX-License-Identifier: GPL-2.0
2 /* !! 2 /* arch/sparc64/kernel/kprobes.c
3 * Copyright (C) 2004, 2007-2010, 2011-2012 Sy !! 3 *
>> 4 * Copyright (C) 2004 David S. Miller <davem@davemloft.net>
4 */ 5 */
5 6
6 #include <linux/types.h> !! 7 #include <linux/kernel.h>
7 #include <linux/kprobes.h> 8 #include <linux/kprobes.h>
8 #include <linux/slab.h> !! 9 #include <linux/extable.h>
9 #include <linux/module.h> <<
10 #include <linux/kdebug.h> 10 #include <linux/kdebug.h>
11 #include <linux/sched.h> !! 11 #include <linux/slab.h>
12 #include <linux/uaccess.h> !! 12 #include <linux/context_tracking.h>
>> 13 #include <asm/signal.h>
13 #include <asm/cacheflush.h> 14 #include <asm/cacheflush.h>
14 #include <asm/current.h> !! 15 #include <linux/uaccess.h>
15 #include <asm/disasm.h> <<
16 16
17 #define MIN_STACK_SIZE(addr) min((unsigned !! 17 /* We do not have hardware single-stepping on sparc64.
18 (unsigned long)current_thread_ !! 18 * So we implement software single-stepping with breakpoint
>> 19 * traps. The top-level scheme is similar to that used
>> 20 * in the x86 kprobes implementation.
>> 21 *
>> 22 * In the kprobe->ainsn.insn[] array we store the original
>> 23 * instruction at index zero and a break instruction at
>> 24 * index one.
>> 25 *
>> 26 * When we hit a kprobe we:
>> 27 * - Run the pre-handler
>> 28 * - Remember "regs->tnpc" and interrupt level stored in
>> 29 * "regs->tstate" so we can restore them later
>> 30 * - Disable PIL interrupts
>> 31 * - Set regs->tpc to point to kprobe->ainsn.insn[0]
>> 32 * - Set regs->tnpc to point to kprobe->ainsn.insn[1]
>> 33 * - Mark that we are actively in a kprobe
>> 34 *
>> 35 * At this point we wait for the second breakpoint at
>> 36 * kprobe->ainsn.insn[1] to hit. When it does we:
>> 37 * - Run the post-handler
>> 38 * - Set regs->tpc to "remembered" regs->tnpc stored above,
>> 39 * restore the PIL interrupt level in "regs->tstate" as well
>> 40 * - Make any adjustments necessary to regs->tnpc in order
>> 41 * to handle relative branches correctly. See below.
>> 42 * - Mark that we are no longer actively in a kprobe.
>> 43 */
19 44
20 DEFINE_PER_CPU(struct kprobe *, current_kprobe 45 DEFINE_PER_CPU(struct kprobe *, current_kprobe) = NULL;
21 DEFINE_PER_CPU(struct kprobe_ctlblk, kprobe_ct 46 DEFINE_PER_CPU(struct kprobe_ctlblk, kprobe_ctlblk);
22 47
>> 48 struct kretprobe_blackpoint kretprobe_blacklist[] = {{NULL, NULL}};
>> 49
23 int __kprobes arch_prepare_kprobe(struct kprob 50 int __kprobes arch_prepare_kprobe(struct kprobe *p)
24 { 51 {
25 /* Attempt to probe at unaligned addre !! 52 if ((unsigned long) p->addr & 0x3UL)
26 if ((unsigned long)p->addr & 0x01) !! 53 return -EILSEQ;
27 return -EINVAL; <<
28 54
29 /* Address should not be in exception !! 55 p->ainsn.insn[0] = *p->addr;
>> 56 flushi(&p->ainsn.insn[0]);
30 57
31 p->ainsn.is_short = is_short_instr((un !! 58 p->ainsn.insn[1] = BREAKPOINT_INSTRUCTION_2;
32 p->opcode = *p->addr; !! 59 flushi(&p->ainsn.insn[1]);
33 60
>> 61 p->opcode = *p->addr;
34 return 0; 62 return 0;
35 } 63 }
36 64
37 void __kprobes arch_arm_kprobe(struct kprobe * 65 void __kprobes arch_arm_kprobe(struct kprobe *p)
38 { 66 {
39 *p->addr = UNIMP_S_INSTRUCTION; !! 67 *p->addr = BREAKPOINT_INSTRUCTION;
40 !! 68 flushi(p->addr);
41 flush_icache_range((unsigned long)p->a <<
42 (unsigned long)p->a <<
43 } 69 }
44 70
45 void __kprobes arch_disarm_kprobe(struct kprob 71 void __kprobes arch_disarm_kprobe(struct kprobe *p)
46 { 72 {
47 *p->addr = p->opcode; 73 *p->addr = p->opcode;
48 !! 74 flushi(p->addr);
49 flush_icache_range((unsigned long)p->a <<
50 (unsigned long)p->a <<
51 } <<
52 <<
53 void __kprobes arch_remove_kprobe(struct kprob <<
54 { <<
55 arch_disarm_kprobe(p); <<
56 <<
57 /* Can we remove the kprobe in the mid <<
58 if (p->ainsn.t1_addr) { <<
59 *(p->ainsn.t1_addr) = p->ainsn <<
60 <<
61 flush_icache_range((unsigned l <<
62 (unsigned l <<
63 sizeof(kpro <<
64 <<
65 p->ainsn.t1_addr = NULL; <<
66 } <<
67 <<
68 if (p->ainsn.t2_addr) { <<
69 *(p->ainsn.t2_addr) = p->ainsn <<
70 <<
71 flush_icache_range((unsigned l <<
72 (unsigned l <<
73 sizeof(kpro <<
74 <<
75 p->ainsn.t2_addr = NULL; <<
76 } <<
77 } 75 }
78 76
79 static void __kprobes save_previous_kprobe(str 77 static void __kprobes save_previous_kprobe(struct kprobe_ctlblk *kcb)
80 { 78 {
81 kcb->prev_kprobe.kp = kprobe_running() 79 kcb->prev_kprobe.kp = kprobe_running();
82 kcb->prev_kprobe.status = kcb->kprobe_ 80 kcb->prev_kprobe.status = kcb->kprobe_status;
>> 81 kcb->prev_kprobe.orig_tnpc = kcb->kprobe_orig_tnpc;
>> 82 kcb->prev_kprobe.orig_tstate_pil = kcb->kprobe_orig_tstate_pil;
83 } 83 }
84 84
85 static void __kprobes restore_previous_kprobe( 85 static void __kprobes restore_previous_kprobe(struct kprobe_ctlblk *kcb)
86 { 86 {
87 __this_cpu_write(current_kprobe, kcb-> 87 __this_cpu_write(current_kprobe, kcb->prev_kprobe.kp);
88 kcb->kprobe_status = kcb->prev_kprobe. 88 kcb->kprobe_status = kcb->prev_kprobe.status;
>> 89 kcb->kprobe_orig_tnpc = kcb->prev_kprobe.orig_tnpc;
>> 90 kcb->kprobe_orig_tstate_pil = kcb->prev_kprobe.orig_tstate_pil;
89 } 91 }
90 92
91 static inline void __kprobes set_current_kprob !! 93 static void __kprobes set_current_kprobe(struct kprobe *p, struct pt_regs *regs,
>> 94 struct kprobe_ctlblk *kcb)
92 { 95 {
93 __this_cpu_write(current_kprobe, p); 96 __this_cpu_write(current_kprobe, p);
>> 97 kcb->kprobe_orig_tnpc = regs->tnpc;
>> 98 kcb->kprobe_orig_tstate_pil = (regs->tstate & TSTATE_PIL);
94 } 99 }
95 100
96 static void __kprobes resume_execution(struct !! 101 static void __kprobes prepare_singlestep(struct kprobe *p, struct pt_regs *regs,
97 struct !! 102 struct kprobe_ctlblk *kcb)
98 { 103 {
99 /* Remove the trap instructions insert !! 104 regs->tstate |= TSTATE_PIL;
100 * restore the original instructions <<
101 */ <<
102 if (p->ainsn.t1_addr) { <<
103 *(p->ainsn.t1_addr) = p->ainsn <<
104 105
105 flush_icache_range((unsigned l !! 106 /*single step inline, if it a breakpoint instruction*/
106 (unsigned l !! 107 if (p->opcode == BREAKPOINT_INSTRUCTION) {
107 sizeof(kpro !! 108 regs->tpc = (unsigned long) p->addr;
108 !! 109 regs->tnpc = kcb->kprobe_orig_tnpc;
109 p->ainsn.t1_addr = NULL; !! 110 } else {
>> 111 regs->tpc = (unsigned long) &p->ainsn.insn[0];
>> 112 regs->tnpc = (unsigned long) &p->ainsn.insn[1];
110 } 113 }
>> 114 }
111 115
112 if (p->ainsn.t2_addr) { !! 116 static int __kprobes kprobe_handler(struct pt_regs *regs)
113 *(p->ainsn.t2_addr) = p->ainsn !! 117 {
>> 118 struct kprobe *p;
>> 119 void *addr = (void *) regs->tpc;
>> 120 int ret = 0;
>> 121 struct kprobe_ctlblk *kcb;
114 122
115 flush_icache_range((unsigned l !! 123 /*
116 (unsigned l !! 124 * We don't want to be preempted for the entire
117 sizeof(kpro !! 125 * duration of kprobe processing
>> 126 */
>> 127 preempt_disable();
>> 128 kcb = get_kprobe_ctlblk();
118 129
119 p->ainsn.t2_addr = NULL; !! 130 if (kprobe_running()) {
>> 131 p = get_kprobe(addr);
>> 132 if (p) {
>> 133 if (kcb->kprobe_status == KPROBE_HIT_SS) {
>> 134 regs->tstate = ((regs->tstate & ~TSTATE_PIL) |
>> 135 kcb->kprobe_orig_tstate_pil);
>> 136 goto no_kprobe;
>> 137 }
>> 138 /* We have reentered the kprobe_handler(), since
>> 139 * another probe was hit while within the handler.
>> 140 * We here save the original kprobes variables and
>> 141 * just single step on the instruction of the new probe
>> 142 * without calling any user handlers.
>> 143 */
>> 144 save_previous_kprobe(kcb);
>> 145 set_current_kprobe(p, regs, kcb);
>> 146 kprobes_inc_nmissed_count(p);
>> 147 kcb->kprobe_status = KPROBE_REENTER;
>> 148 prepare_singlestep(p, regs, kcb);
>> 149 return 1;
>> 150 } else if (*(u32 *)addr != BREAKPOINT_INSTRUCTION) {
>> 151 /* The breakpoint instruction was removed by
>> 152 * another cpu right after we hit, no further
>> 153 * handling of this interrupt is appropriate
>> 154 */
>> 155 ret = 1;
>> 156 }
>> 157 goto no_kprobe;
>> 158 }
>> 159
>> 160 p = get_kprobe(addr);
>> 161 if (!p) {
>> 162 if (*(u32 *)addr != BREAKPOINT_INSTRUCTION) {
>> 163 /*
>> 164 * The breakpoint instruction was removed right
>> 165 * after we hit it. Another cpu has removed
>> 166 * either a probepoint or a debugger breakpoint
>> 167 * at this address. In either case, no further
>> 168 * handling of this interrupt is appropriate.
>> 169 */
>> 170 ret = 1;
>> 171 }
>> 172 /* Not one of ours: let kernel handle it */
>> 173 goto no_kprobe;
>> 174 }
>> 175
>> 176 set_current_kprobe(p, regs, kcb);
>> 177 kcb->kprobe_status = KPROBE_HIT_ACTIVE;
>> 178 if (p->pre_handler && p->pre_handler(p, regs)) {
>> 179 reset_current_kprobe();
>> 180 preempt_enable_no_resched();
>> 181 return 1;
120 } 182 }
121 183
122 return; !! 184 prepare_singlestep(p, regs, kcb);
>> 185 kcb->kprobe_status = KPROBE_HIT_SS;
>> 186 return 1;
>> 187
>> 188 no_kprobe:
>> 189 preempt_enable_no_resched();
>> 190 return ret;
123 } 191 }
124 192
125 static void __kprobes setup_singlestep(struct !! 193 /* If INSN is a relative control transfer instruction,
>> 194 * return the corrected branch destination value.
>> 195 *
>> 196 * regs->tpc and regs->tnpc still hold the values of the
>> 197 * program counters at the time of trap due to the execution
>> 198 * of the BREAKPOINT_INSTRUCTION_2 at p->ainsn.insn[1]
>> 199 *
>> 200 */
>> 201 static unsigned long __kprobes relbranch_fixup(u32 insn, struct kprobe *p,
>> 202 struct pt_regs *regs)
126 { 203 {
127 unsigned long next_pc; !! 204 unsigned long real_pc = (unsigned long) p->addr;
128 unsigned long tgt_if_br = 0; <<
129 int is_branch; <<
130 unsigned long bta; <<
131 205
132 /* Copy the opcode back to the kprobe !! 206 /* Branch not taken, no mods necessary. */
133 * instruction. Because of this we wil !! 207 if (regs->tnpc == regs->tpc + 0x4UL)
134 * same kprobe until this kprobe is do !! 208 return real_pc + 0x8UL;
135 */ <<
136 *(p->addr) = p->opcode; <<
137 209
138 flush_icache_range((unsigned long)p->a !! 210 /* The three cases are call, branch w/prediction,
139 (unsigned long)p->a !! 211 * and traditional branch.
>> 212 */
>> 213 if ((insn & 0xc0000000) == 0x40000000 ||
>> 214 (insn & 0xc1c00000) == 0x00400000 ||
>> 215 (insn & 0xc1c00000) == 0x00800000) {
>> 216 unsigned long ainsn_addr;
>> 217
>> 218 ainsn_addr = (unsigned long) &p->ainsn.insn[0];
>> 219
>> 220 /* The instruction did all the work for us
>> 221 * already, just apply the offset to the correct
>> 222 * instruction location.
>> 223 */
>> 224 return (real_pc + (regs->tnpc - ainsn_addr));
>> 225 }
140 226
141 /* Now we insert the trap at the next !! 227 /* It is jmpl or some other absolute PC modification instruction,
142 * single step. If it is a branch we i !! 228 * leave NPC as-is.
143 * targets <<
144 */ 229 */
>> 230 return regs->tnpc;
>> 231 }
145 232
146 bta = regs->bta; !! 233 /* If INSN is an instruction which writes it's PC location
>> 234 * into a destination register, fix that up.
>> 235 */
>> 236 static void __kprobes retpc_fixup(struct pt_regs *regs, u32 insn,
>> 237 unsigned long real_pc)
>> 238 {
>> 239 unsigned long *slot = NULL;
147 240
148 if (regs->status32 & 0x40) { !! 241 /* Simplest case is 'call', which always uses %o7 */
149 /* We are in a delay slot with !! 242 if ((insn & 0xc0000000) == 0x40000000) {
>> 243 slot = ®s->u_regs[UREG_I7];
>> 244 }
150 245
151 next_pc = bta & ~0x01; !! 246 /* 'jmpl' encodes the register inside of the opcode */
>> 247 if ((insn & 0xc1f80000) == 0x81c00000) {
>> 248 unsigned long rd = ((insn >> 25) & 0x1f);
152 249
153 if (!p->ainsn.is_short) { !! 250 if (rd <= 15) {
154 if (bta & 0x01) !! 251 slot = ®s->u_regs[rd];
155 regs->blink += !! 252 } else {
156 else { !! 253 /* Hard case, it goes onto the stack. */
157 /* Branch not !! 254 flushw_all();
158 next_pc += 2; <<
159 <<
160 /* next pc is <<
161 * delay slot <<
162 */ <<
163 regs->bta += 2 <<
164 } <<
165 } <<
166 255
167 is_branch = 0; !! 256 rd -= 16;
168 } else !! 257 slot = (unsigned long *)
169 is_branch = !! 258 (regs->u_regs[UREG_FP] + STACK_BIAS);
170 disasm_next_pc((unsigned l !! 259 slot += rd;
171 (struct callee_regs *) !! 260 }
172 &next_pc, &tgt_if_br); <<
173 <<
174 p->ainsn.t1_addr = (kprobe_opcode_t *) <<
175 p->ainsn.t1_opcode = *(p->ainsn.t1_add <<
176 *(p->ainsn.t1_addr) = TRAP_S_2_INSTRUC <<
177 <<
178 flush_icache_range((unsigned long)p->a <<
179 (unsigned long)p->a <<
180 sizeof(kprobe_opcod <<
181 <<
182 if (is_branch) { <<
183 p->ainsn.t2_addr = (kprobe_opc <<
184 p->ainsn.t2_opcode = *(p->ains <<
185 *(p->ainsn.t2_addr) = TRAP_S_2 <<
186 <<
187 flush_icache_range((unsigned l <<
188 (unsigned l <<
189 sizeof(kpro <<
190 } 261 }
>> 262 if (slot != NULL)
>> 263 *slot = real_pc;
191 } 264 }
192 265
193 static int !! 266 /*
194 __kprobes arc_kprobe_handler(unsigned long add !! 267 * Called after single-stepping. p->addr is the address of the
>> 268 * instruction which has been replaced by the breakpoint
>> 269 * instruction. To avoid the SMP problems that can occur when we
>> 270 * temporarily put back the original opcode to single-step, we
>> 271 * single-stepped a copy of the instruction. The address of this
>> 272 * copy is &p->ainsn.insn[0].
>> 273 *
>> 274 * This function prepares to return from the post-single-step
>> 275 * breakpoint trap.
>> 276 */
>> 277 static void __kprobes resume_execution(struct kprobe *p,
>> 278 struct pt_regs *regs, struct kprobe_ctlblk *kcb)
195 { 279 {
196 struct kprobe *p; !! 280 u32 insn = p->ainsn.insn[0];
197 struct kprobe_ctlblk *kcb; <<
198 281
199 preempt_disable(); !! 282 regs->tnpc = relbranch_fixup(insn, p, regs);
200 283
201 kcb = get_kprobe_ctlblk(); !! 284 /* This assignment must occur after relbranch_fixup() */
202 p = get_kprobe((unsigned long *)addr); !! 285 regs->tpc = kcb->kprobe_orig_tnpc;
203 286
204 if (p) { !! 287 retpc_fixup(regs, insn, (unsigned long) p->addr);
205 /* <<
206 * We have reentered the kprob <<
207 * was hit while within the ha <<
208 * kprobes and single step on <<
209 * without calling any user ha <<
210 * kprobes. <<
211 */ <<
212 if (kprobe_running()) { <<
213 save_previous_kprobe(k <<
214 set_current_kprobe(p); <<
215 kprobes_inc_nmissed_co <<
216 setup_singlestep(p, re <<
217 kcb->kprobe_status = K <<
218 return 1; <<
219 } <<
220 <<
221 set_current_kprobe(p); <<
222 kcb->kprobe_status = KPROBE_HI <<
223 <<
224 /* If we have no pre-handler o <<
225 * normal processing. If we ha <<
226 * non-zero - which means user <<
227 * to another instruction, we <<
228 */ <<
229 if (!p->pre_handler || !p->pre <<
230 setup_singlestep(p, re <<
231 kcb->kprobe_status = K <<
232 } else { <<
233 reset_current_kprobe() <<
234 preempt_enable_no_resc <<
235 } <<
236 288
237 return 1; !! 289 regs->tstate = ((regs->tstate & ~TSTATE_PIL) |
238 } !! 290 kcb->kprobe_orig_tstate_pil);
239 <<
240 /* no_kprobe: */ <<
241 preempt_enable_no_resched(); <<
242 return 0; <<
243 } 291 }
244 292
245 static int !! 293 static int __kprobes post_kprobe_handler(struct pt_regs *regs)
246 __kprobes arc_post_kprobe_handler(unsigned lon <<
247 { 294 {
248 struct kprobe *cur = kprobe_running(); 295 struct kprobe *cur = kprobe_running();
249 struct kprobe_ctlblk *kcb = get_kprobe 296 struct kprobe_ctlblk *kcb = get_kprobe_ctlblk();
250 297
251 if (!cur) 298 if (!cur)
252 return 0; 299 return 0;
253 300
254 resume_execution(cur, addr, regs); <<
255 <<
256 /* Rearm the kprobe */ <<
257 arch_arm_kprobe(cur); <<
258 <<
259 /* <<
260 * When we return from trap instructio <<
261 * We restored the actual instruction <<
262 * return to the same address and exec <<
263 */ <<
264 regs->ret = addr; <<
265 <<
266 if ((kcb->kprobe_status != KPROBE_REEN 301 if ((kcb->kprobe_status != KPROBE_REENTER) && cur->post_handler) {
267 kcb->kprobe_status = KPROBE_HI 302 kcb->kprobe_status = KPROBE_HIT_SSDONE;
268 cur->post_handler(cur, regs, 0 303 cur->post_handler(cur, regs, 0);
269 } 304 }
270 305
>> 306 resume_execution(cur, regs, kcb);
>> 307
>> 308 /*Restore back the original saved kprobes variables and continue. */
271 if (kcb->kprobe_status == KPROBE_REENT 309 if (kcb->kprobe_status == KPROBE_REENTER) {
272 restore_previous_kprobe(kcb); 310 restore_previous_kprobe(kcb);
273 goto out; 311 goto out;
274 } 312 }
275 <<
276 reset_current_kprobe(); 313 reset_current_kprobe();
277 <<
278 out: 314 out:
279 preempt_enable_no_resched(); 315 preempt_enable_no_resched();
>> 316
280 return 1; 317 return 1;
281 } 318 }
282 319
283 /* !! 320 int __kprobes kprobe_fault_handler(struct pt_regs *regs, int trapnr)
284 * Fault can be for the instruction being sing <<
285 * pre/post handlers in the module. <<
286 * This is applicable for applications like us <<
287 * probe in user space and the handlers in the <<
288 */ <<
289 <<
290 int __kprobes kprobe_fault_handler(struct pt_r <<
291 { 321 {
292 struct kprobe *cur = kprobe_running(); 322 struct kprobe *cur = kprobe_running();
293 struct kprobe_ctlblk *kcb = get_kprobe 323 struct kprobe_ctlblk *kcb = get_kprobe_ctlblk();
>> 324 const struct exception_table_entry *entry;
294 325
295 switch (kcb->kprobe_status) { !! 326 switch(kcb->kprobe_status) {
296 case KPROBE_HIT_SS: 327 case KPROBE_HIT_SS:
297 case KPROBE_REENTER: 328 case KPROBE_REENTER:
298 /* 329 /*
299 * We are here because the ins !! 330 * We are here because the instruction being single
300 * caused the fault. We reset !! 331 * stepped caused a page fault. We reset the current
301 * exception handler as if it !! 332 * kprobe and the tpc points back to the probe address
302 * case it doesn't matter beca !! 333 * and allow the page fault handler to continue as a
>> 334 * normal page fault.
303 */ 335 */
304 resume_execution(cur, (unsigne !! 336 regs->tpc = (unsigned long)cur->addr;
305 !! 337 regs->tnpc = kcb->kprobe_orig_tnpc;
>> 338 regs->tstate = ((regs->tstate & ~TSTATE_PIL) |
>> 339 kcb->kprobe_orig_tstate_pil);
306 if (kcb->kprobe_status == KPRO 340 if (kcb->kprobe_status == KPROBE_REENTER)
307 restore_previous_kprob 341 restore_previous_kprobe(kcb);
308 else 342 else
309 reset_current_kprobe() 343 reset_current_kprobe();
310 <<
311 preempt_enable_no_resched(); 344 preempt_enable_no_resched();
312 break; 345 break;
313 <<
314 case KPROBE_HIT_ACTIVE: 346 case KPROBE_HIT_ACTIVE:
315 case KPROBE_HIT_SSDONE: 347 case KPROBE_HIT_SSDONE:
316 /* 348 /*
317 * We are here because the ins !! 349 * We increment the nmissed count for accounting,
318 * caused the fault. !! 350 * we can also use npre/npostfault count for accounting
>> 351 * these specific fault cases.
>> 352 */
>> 353 kprobes_inc_nmissed_count(cur);
>> 354
>> 355 /*
>> 356 * We come here because instructions in the pre/post
>> 357 * handler caused the page_fault, this could happen
>> 358 * if handler tries to access user space by
>> 359 * copy_from_user(), get_user() etc. Let the
>> 360 * user-specified handler try to fix it first.
319 */ 361 */
>> 362 if (cur->fault_handler && cur->fault_handler(cur, regs, trapnr))
>> 363 return 1;
320 364
321 /* 365 /*
322 * In case the user-specified !! 366 * In case the user-specified fault handler returned
323 * try to fix up. !! 367 * zero, try to fix up.
324 */ 368 */
325 if (fixup_exception(regs)) !! 369
>> 370 entry = search_exception_tables(regs->tpc);
>> 371 if (entry) {
>> 372 regs->tpc = entry->fixup;
>> 373 regs->tnpc = regs->tpc + 4;
326 return 1; 374 return 1;
>> 375 }
327 376
328 /* 377 /*
329 * fixup_exception() could not 378 * fixup_exception() could not handle it,
330 * Let do_page_fault() fix it. 379 * Let do_page_fault() fix it.
331 */ 380 */
332 break; 381 break;
333 <<
334 default: 382 default:
335 break; 383 break;
336 } 384 }
>> 385
337 return 0; 386 return 0;
338 } 387 }
339 388
>> 389 /*
>> 390 * Wrapper routine to for handling exceptions.
>> 391 */
340 int __kprobes kprobe_exceptions_notify(struct 392 int __kprobes kprobe_exceptions_notify(struct notifier_block *self,
341 unsigne 393 unsigned long val, void *data)
342 { 394 {
343 struct die_args *args = data; !! 395 struct die_args *args = (struct die_args *)data;
344 unsigned long addr = args->err; <<
345 int ret = NOTIFY_DONE; 396 int ret = NOTIFY_DONE;
346 397
>> 398 if (args->regs && user_mode(args->regs))
>> 399 return ret;
>> 400
347 switch (val) { 401 switch (val) {
348 case DIE_IERR: !! 402 case DIE_DEBUG:
349 if (arc_kprobe_handler(addr, a !! 403 if (kprobe_handler(args->regs))
350 return NOTIFY_STOP; !! 404 ret = NOTIFY_STOP;
351 break; 405 break;
352 !! 406 case DIE_DEBUG_2:
353 case DIE_TRAP: !! 407 if (post_kprobe_handler(args->regs))
354 if (arc_post_kprobe_handler(ad !! 408 ret = NOTIFY_STOP;
355 return NOTIFY_STOP; <<
356 break; 409 break;
357 <<
358 default: 410 default:
359 break; 411 break;
360 } 412 }
361 <<
362 return ret; 413 return ret;
363 } 414 }
364 415
365 static void __used kretprobe_trampoline_holder !! 416 asmlinkage void __kprobes kprobe_trap(unsigned long trap_level,
>> 417 struct pt_regs *regs)
366 { 418 {
367 __asm__ __volatile__(".global __kretpr !! 419 enum ctx_state prev_state = exception_enter();
368 "__kretprobe_tram !! 420
369 "nop\n"); !! 421 BUG_ON(trap_level != 0x170 && trap_level != 0x171);
>> 422
>> 423 if (user_mode(regs)) {
>> 424 local_irq_enable();
>> 425 bad_trap(regs, trap_level);
>> 426 goto out;
>> 427 }
>> 428
>> 429 /* trap_level == 0x170 --> ta 0x70
>> 430 * trap_level == 0x171 --> ta 0x71
>> 431 */
>> 432 if (notify_die((trap_level == 0x170) ? DIE_DEBUG : DIE_DEBUG_2,
>> 433 (trap_level == 0x170) ? "debug" : "debug_2",
>> 434 regs, 0, trap_level, SIGTRAP) != NOTIFY_STOP)
>> 435 bad_trap(regs, trap_level);
>> 436 out:
>> 437 exception_exit(prev_state);
370 } 438 }
371 439
>> 440 /* The value stored in the return address register is actually 2
>> 441 * instructions before where the callee will return to.
>> 442 * Sequences usually look something like this
>> 443 *
>> 444 * call some_function <--- return register points here
>> 445 * nop <--- call delay slot
>> 446 * whatever <--- where callee returns to
>> 447 *
>> 448 * To keep trampoline_probe_handler logic simpler, we normalize the
>> 449 * value kept in ri->ret_addr so we don't need to keep adjusting it
>> 450 * back and forth.
>> 451 */
372 void __kprobes arch_prepare_kretprobe(struct k 452 void __kprobes arch_prepare_kretprobe(struct kretprobe_instance *ri,
373 struct p 453 struct pt_regs *regs)
374 { 454 {
375 !! 455 ri->ret_addr = (kprobe_opcode_t *)(regs->u_regs[UREG_RETPC] + 8);
376 ri->ret_addr = (kprobe_opcode_t *) reg <<
377 ri->fp = NULL; <<
378 456
379 /* Replace the return addr with trampo 457 /* Replace the return addr with trampoline addr */
380 regs->blink = (unsigned long)&__kretpr !! 458 regs->u_regs[UREG_RETPC] =
>> 459 ((unsigned long)kretprobe_trampoline) - 8;
381 } 460 }
382 461
>> 462 /*
>> 463 * Called when the probe at kretprobe trampoline is hit
>> 464 */
383 static int __kprobes trampoline_probe_handler( 465 static int __kprobes trampoline_probe_handler(struct kprobe *p,
384 466 struct pt_regs *regs)
385 { 467 {
386 regs->ret = __kretprobe_trampoline_han !! 468 struct kretprobe_instance *ri = NULL;
>> 469 struct hlist_head *head, empty_rp;
>> 470 struct hlist_node *tmp;
>> 471 unsigned long flags, orig_ret_address = 0;
>> 472 unsigned long trampoline_address =(unsigned long)&kretprobe_trampoline;
>> 473
>> 474 INIT_HLIST_HEAD(&empty_rp);
>> 475 kretprobe_hash_lock(current, &head, &flags);
387 476
388 /* By returning a non zero value, we a !! 477 /*
389 * that we don't want the post_handler !! 478 * It is possible to have multiple instances associated with a given
>> 479 * task either because an multiple functions in the call path
>> 480 * have a return probe installed on them, and/or more than one return
>> 481 * return probe was registered for a target function.
>> 482 *
>> 483 * We can handle this because:
>> 484 * - instances are always inserted at the head of the list
>> 485 * - when multiple return probes are registered for the same
>> 486 * function, the first instance's ret_addr will point to the
>> 487 * real return address, and all the rest will point to
>> 488 * kretprobe_trampoline
>> 489 */
>> 490 hlist_for_each_entry_safe(ri, tmp, head, hlist) {
>> 491 if (ri->task != current)
>> 492 /* another task is sharing our hash bucket */
>> 493 continue;
>> 494
>> 495 if (ri->rp && ri->rp->handler)
>> 496 ri->rp->handler(ri, regs);
>> 497
>> 498 orig_ret_address = (unsigned long)ri->ret_addr;
>> 499 recycle_rp_inst(ri, &empty_rp);
>> 500
>> 501 if (orig_ret_address != trampoline_address)
>> 502 /*
>> 503 * This is the real return address. Any other
>> 504 * instances associated with this task are for
>> 505 * other calls deeper on the call stack
>> 506 */
>> 507 break;
>> 508 }
>> 509
>> 510 kretprobe_assert(ri, orig_ret_address, trampoline_address);
>> 511 regs->tpc = orig_ret_address;
>> 512 regs->tnpc = orig_ret_address + 4;
>> 513
>> 514 kretprobe_hash_unlock(current, &flags);
>> 515
>> 516 hlist_for_each_entry_safe(ri, tmp, &empty_rp, hlist) {
>> 517 hlist_del(&ri->hlist);
>> 518 kfree(ri);
>> 519 }
>> 520 /*
>> 521 * By returning a non-zero value, we are telling
>> 522 * kprobe_handler() that we don't want the post_handler
>> 523 * to run (and have re-enabled preemption)
390 */ 524 */
391 return 1; 525 return 1;
392 } 526 }
393 527
>> 528 static void __used kretprobe_trampoline_holder(void)
>> 529 {
>> 530 asm volatile(".global kretprobe_trampoline\n"
>> 531 "kretprobe_trampoline:\n"
>> 532 "\tnop\n"
>> 533 "\tnop\n");
>> 534 }
394 static struct kprobe trampoline_p = { 535 static struct kprobe trampoline_p = {
395 .addr = (kprobe_opcode_t *) &__kretpro !! 536 .addr = (kprobe_opcode_t *) &kretprobe_trampoline,
396 .pre_handler = trampoline_probe_handle 537 .pre_handler = trampoline_probe_handler
397 }; 538 };
398 539
399 int __init arch_init_kprobes(void) 540 int __init arch_init_kprobes(void)
400 { 541 {
401 /* Registering the trampoline code for <<
402 return register_kprobe(&trampoline_p); 542 return register_kprobe(&trampoline_p);
403 } 543 }
404 544
405 int __kprobes arch_trampoline_kprobe(struct kp 545 int __kprobes arch_trampoline_kprobe(struct kprobe *p)
406 { 546 {
407 if (p->addr == (kprobe_opcode_t *) &__ !! 547 if (p->addr == (kprobe_opcode_t *)&kretprobe_trampoline)
408 return 1; 548 return 1;
409 549
410 return 0; 550 return 0;
411 } <<
412 <<
413 void trap_is_kprobe(unsigned long address, str <<
414 { <<
415 notify_die(DIE_TRAP, "kprobe_trap", re <<
416 } 551 }
417 552
Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.