1 // SPDX-License-Identifier: GPL-2.0-only
3 * arch/arm64/kernel/ftrace.c
5 * Copyright (C) 2013 Linaro Limited
6 * Author: AKASHI Takahiro <takahiro.akashi@linaro.org>
9 #include <linux/ftrace.h>
10 #include <linux/module.h>
11 #include <linux/swab.h>
12 #include <linux/uaccess.h>
14 #include <asm/cacheflush.h>
15 #include <asm/debug-monitors.h>
16 #include <asm/ftrace.h>
18 #include <asm/text-patching.h>
20 #ifdef CONFIG_DYNAMIC_FTRACE_WITH_ARGS
26 #define FREGS_OFFSET(n, field) \
29 .offset = offsetof(struct __arch_ftrace_regs, field), \
32 static const struct fregs_offset fregs_offsets
[] = {
33 FREGS_OFFSET("x0", regs
[0]),
34 FREGS_OFFSET("x1", regs
[1]),
35 FREGS_OFFSET("x2", regs
[2]),
36 FREGS_OFFSET("x3", regs
[3]),
37 FREGS_OFFSET("x4", regs
[4]),
38 FREGS_OFFSET("x5", regs
[5]),
39 FREGS_OFFSET("x6", regs
[6]),
40 FREGS_OFFSET("x7", regs
[7]),
41 FREGS_OFFSET("x8", regs
[8]),
43 FREGS_OFFSET("x29", fp
),
44 FREGS_OFFSET("x30", lr
),
45 FREGS_OFFSET("lr", lr
),
47 FREGS_OFFSET("sp", sp
),
48 FREGS_OFFSET("pc", pc
),
51 int ftrace_regs_query_register_offset(const char *name
)
53 for (int i
= 0; i
< ARRAY_SIZE(fregs_offsets
); i
++) {
54 const struct fregs_offset
*roff
= &fregs_offsets
[i
];
55 if (!strcmp(roff
->name
, name
))
63 unsigned long ftrace_call_adjust(unsigned long addr
)
66 * When using mcount, addr is the address of the mcount call
67 * instruction, and no adjustment is necessary.
69 if (!IS_ENABLED(CONFIG_DYNAMIC_FTRACE_WITH_ARGS
))
73 * When using patchable-function-entry without pre-function NOPS, addr
74 * is the address of the first NOP after the function entry point.
76 * The compiler has either generated:
78 * addr+00: func: NOP // To be patched to MOV X9, LR
79 * addr+04: NOP // To be patched to BL <caller>
84 * addr+00: func: NOP // To be patched to MOV X9, LR
85 * addr+04: NOP // To be patched to BL <caller>
87 * We must adjust addr to the address of the NOP which will be patched
88 * to `BL <caller>`, which is at `addr + 4` bytes in either case.
91 if (!IS_ENABLED(CONFIG_DYNAMIC_FTRACE_WITH_CALL_OPS
))
92 return addr
+ AARCH64_INSN_SIZE
;
95 * When using patchable-function-entry with pre-function NOPs, addr is
96 * the address of the first pre-function NOP.
98 * Starting from an 8-byte aligned base, the compiler has either
101 * addr+00: NOP // Literal (first 32 bits)
102 * addr+04: NOP // Literal (last 32 bits)
103 * addr+08: func: NOP // To be patched to MOV X9, LR
104 * addr+12: NOP // To be patched to BL <caller>
108 * addr+00: NOP // Literal (first 32 bits)
109 * addr+04: NOP // Literal (last 32 bits)
110 * addr+08: func: BTI C
111 * addr+12: NOP // To be patched to MOV X9, LR
112 * addr+16: NOP // To be patched to BL <caller>
114 * We must adjust addr to the address of the NOP which will be patched
115 * to `BL <caller>`, which is at either addr+12 or addr+16 depending on
116 * whether there is a BTI.
119 if (!IS_ALIGNED(addr
, sizeof(unsigned long))) {
120 WARN_RATELIMIT(1, "Misaligned patch-site %pS\n",
125 /* Skip the NOPs placed before the function entry point */
126 addr
+= 2 * AARCH64_INSN_SIZE
;
129 if (IS_ENABLED(CONFIG_ARM64_BTI_KERNEL
)) {
130 u32 insn
= le32_to_cpu(*(__le32
*)addr
);
132 if (aarch64_insn_is_bti(insn
)) {
133 addr
+= AARCH64_INSN_SIZE
;
134 } else if (insn
!= aarch64_insn_gen_nop()) {
135 WARN_RATELIMIT(1, "unexpected insn in patch-site %pS: 0x%08x\n",
140 /* Skip the first NOP after function entry */
141 addr
+= AARCH64_INSN_SIZE
;
147 * Replace a single instruction, which may be a branch or NOP.
148 * If @validate == true, a replaced instruction is checked against 'old'.
150 static int ftrace_modify_code(unsigned long pc
, u32 old
, u32
new,
157 * We are paranoid about modifying text, as if a bug were to happen, it
158 * could cause us to read or write to someplace that could cause harm.
159 * Carefully read and modify the code with aarch64_insn_*() which uses
160 * probe_kernel_*(), and make sure what we read is what we expected it
161 * to be before modifying it.
164 if (aarch64_insn_read((void *)pc
, &replaced
))
170 if (aarch64_insn_patch_text_nosync((void *)pc
, new))
177 * Replace tracer function in ftrace_caller()
179 int ftrace_update_ftrace_func(ftrace_func_t func
)
185 * When using CALL_OPS, the function to call is associated with the
186 * call site, and we don't have a global function pointer to update.
188 if (IS_ENABLED(CONFIG_DYNAMIC_FTRACE_WITH_CALL_OPS
))
191 pc
= (unsigned long)ftrace_call
;
192 new = aarch64_insn_gen_branch_imm(pc
, (unsigned long)func
,
193 AARCH64_INSN_BRANCH_LINK
);
195 return ftrace_modify_code(pc
, 0, new, false);
198 static struct plt_entry
*get_ftrace_plt(struct module
*mod
)
200 #ifdef CONFIG_MODULES
201 struct plt_entry
*plt
= mod
->arch
.ftrace_trampolines
;
203 return &plt
[FTRACE_PLT_IDX
];
209 static bool reachable_by_bl(unsigned long addr
, unsigned long pc
)
211 long offset
= (long)addr
- (long)pc
;
213 return offset
>= -SZ_128M
&& offset
< SZ_128M
;
217 * Find the address the callsite must branch to in order to reach '*addr'.
219 * Due to the limited range of 'BL' instructions, modules may be placed too far
220 * away to branch directly and must use a PLT.
222 * Returns true when '*addr' contains a reachable target address, or has been
223 * modified to contain a PLT address. Returns false otherwise.
225 static bool ftrace_find_callable_addr(struct dyn_ftrace
*rec
,
229 unsigned long pc
= rec
->ip
;
230 struct plt_entry
*plt
;
233 * If a custom trampoline is unreachable, rely on the ftrace_caller
234 * trampoline which knows how to indirectly reach that trampoline
235 * through ops->direct_call.
237 if (*addr
!= FTRACE_ADDR
&& !reachable_by_bl(*addr
, pc
))
241 * When the target is within range of the 'BL' instruction, use 'addr'
242 * as-is and branch to that directly.
244 if (reachable_by_bl(*addr
, pc
))
248 * When the target is outside of the range of a 'BL' instruction, we
249 * must use a PLT to reach it. We can only place PLTs for modules, and
250 * only when module PLT support is built-in.
252 if (!IS_ENABLED(CONFIG_MODULES
))
256 * 'mod' is only set at module load time, but if we end up
257 * dealing with an out-of-range condition, we can assume it
258 * is due to a module being loaded far away from the kernel.
260 * NOTE: __module_text_address() must be called with preemption
261 * disabled, but we can rely on ftrace_lock to ensure that 'mod'
262 * retains its validity throughout the remainder of this code.
266 mod
= __module_text_address(pc
);
273 plt
= get_ftrace_plt(mod
);
275 pr_err("ftrace: no module PLT for %ps\n", (void *)*addr
);
279 *addr
= (unsigned long)plt
;
283 #ifdef CONFIG_DYNAMIC_FTRACE_WITH_CALL_OPS
284 static const struct ftrace_ops
*arm64_rec_get_ops(struct dyn_ftrace
*rec
)
286 const struct ftrace_ops
*ops
= NULL
;
288 if (rec
->flags
& FTRACE_FL_CALL_OPS_EN
) {
289 ops
= ftrace_find_unique_ops(rec
);
294 ops
= &ftrace_list_ops
;
299 static int ftrace_rec_set_ops(const struct dyn_ftrace
*rec
,
300 const struct ftrace_ops
*ops
)
302 unsigned long literal
= ALIGN_DOWN(rec
->ip
- 12, 8);
303 return aarch64_insn_write_literal_u64((void *)literal
,
307 static int ftrace_rec_set_nop_ops(struct dyn_ftrace
*rec
)
309 return ftrace_rec_set_ops(rec
, &ftrace_nop_ops
);
312 static int ftrace_rec_update_ops(struct dyn_ftrace
*rec
)
314 return ftrace_rec_set_ops(rec
, arm64_rec_get_ops(rec
));
317 static int ftrace_rec_set_nop_ops(struct dyn_ftrace
*rec
) { return 0; }
318 static int ftrace_rec_update_ops(struct dyn_ftrace
*rec
) { return 0; }
322 * Turn on the call to ftrace_caller() in instrumented function
324 int ftrace_make_call(struct dyn_ftrace
*rec
, unsigned long addr
)
326 unsigned long pc
= rec
->ip
;
330 ret
= ftrace_rec_update_ops(rec
);
334 if (!ftrace_find_callable_addr(rec
, NULL
, &addr
))
337 old
= aarch64_insn_gen_nop();
338 new = aarch64_insn_gen_branch_imm(pc
, addr
, AARCH64_INSN_BRANCH_LINK
);
340 return ftrace_modify_code(pc
, old
, new, true);
343 #ifdef CONFIG_DYNAMIC_FTRACE_WITH_CALL_OPS
344 int ftrace_modify_call(struct dyn_ftrace
*rec
, unsigned long old_addr
,
347 unsigned long pc
= rec
->ip
;
351 ret
= ftrace_rec_set_ops(rec
, arm64_rec_get_ops(rec
));
355 if (!ftrace_find_callable_addr(rec
, NULL
, &old_addr
))
357 if (!ftrace_find_callable_addr(rec
, NULL
, &addr
))
360 old
= aarch64_insn_gen_branch_imm(pc
, old_addr
,
361 AARCH64_INSN_BRANCH_LINK
);
362 new = aarch64_insn_gen_branch_imm(pc
, addr
, AARCH64_INSN_BRANCH_LINK
);
364 return ftrace_modify_code(pc
, old
, new, true);
368 #ifdef CONFIG_DYNAMIC_FTRACE_WITH_ARGS
370 * The compiler has inserted two NOPs before the regular function prologue.
371 * All instrumented functions follow the AAPCS, so x0-x8 and x19-x30 are live,
372 * and x9-x18 are free for our use.
374 * At runtime we want to be able to swing a single NOP <-> BL to enable or
375 * disable the ftrace call. The BL requires us to save the original LR value,
376 * so here we insert a <MOV X9, LR> over the first NOP so the instructions
377 * before the regular prologue are:
379 * | Compiled | Disabled | Enabled |
380 * +----------+------------+------------+
381 * | NOP | MOV X9, LR | MOV X9, LR |
382 * | NOP | NOP | BL <entry> |
384 * The LR value will be recovered by ftrace_caller, and restored into LR
385 * before returning to the regular function prologue. When a function is not
386 * being traced, the MOV is not harmful given x9 is not live per the AAPCS.
388 * Note: ftrace_process_locs() has pre-adjusted rec->ip to be the address of
391 int ftrace_init_nop(struct module
*mod
, struct dyn_ftrace
*rec
)
393 unsigned long pc
= rec
->ip
- AARCH64_INSN_SIZE
;
397 ret
= ftrace_rec_set_nop_ops(rec
);
401 old
= aarch64_insn_gen_nop();
402 new = aarch64_insn_gen_move_reg(AARCH64_INSN_REG_9
,
404 AARCH64_INSN_VARIANT_64BIT
);
405 return ftrace_modify_code(pc
, old
, new, true);
410 * Turn off the call to ftrace_caller() in instrumented function
412 int ftrace_make_nop(struct module
*mod
, struct dyn_ftrace
*rec
,
415 unsigned long pc
= rec
->ip
;
419 new = aarch64_insn_gen_nop();
421 ret
= ftrace_rec_set_nop_ops(rec
);
426 * When using mcount, callsites in modules may have been initalized to
427 * call an arbitrary module PLT (which redirects to the _mcount stub)
428 * rather than the ftrace PLT we'll use at runtime (which redirects to
429 * the ftrace trampoline). We can ignore the old PLT when initializing
432 * Note: 'mod' is only set at module load time.
434 if (!IS_ENABLED(CONFIG_DYNAMIC_FTRACE_WITH_ARGS
) && mod
)
435 return aarch64_insn_patch_text_nosync((void *)pc
, new);
437 if (!ftrace_find_callable_addr(rec
, mod
, &addr
))
440 old
= aarch64_insn_gen_branch_imm(pc
, addr
, AARCH64_INSN_BRANCH_LINK
);
442 return ftrace_modify_code(pc
, old
, new, true);
445 void arch_ftrace_update_code(int command
)
447 command
|= FTRACE_MAY_SLEEP
;
448 ftrace_modify_all_code(command
);
451 #ifdef CONFIG_FUNCTION_GRAPH_TRACER
453 * function_graph tracer expects ftrace_return_to_handler() to be called
454 * on the way back to parent. For this purpose, this function is called
455 * in _mcount() or ftrace_caller() to replace return address (*parent) on
456 * the call stack to return_to_handler.
458 void prepare_ftrace_return(unsigned long self_addr
, unsigned long *parent
,
459 unsigned long frame_pointer
)
461 unsigned long return_hooker
= (unsigned long)&return_to_handler
;
464 if (unlikely(atomic_read(¤t
->tracing_graph_pause
)))
469 * No protection against faulting at *parent, which may be seen
470 * on other archs. It's unlikely on AArch64.
474 if (!function_graph_enter(old
, self_addr
, frame_pointer
,
475 (void *)frame_pointer
)) {
476 *parent
= return_hooker
;
480 #ifdef CONFIG_DYNAMIC_FTRACE_WITH_ARGS
481 void ftrace_graph_func(unsigned long ip
, unsigned long parent_ip
,
482 struct ftrace_ops
*op
, struct ftrace_regs
*fregs
)
484 prepare_ftrace_return(ip
, &arch_ftrace_regs(fregs
)->lr
, arch_ftrace_regs(fregs
)->fp
);
488 * Turn on/off the call to ftrace_graph_caller() in ftrace_caller()
489 * depending on @enable.
491 static int ftrace_modify_graph_caller(bool enable
)
493 unsigned long pc
= (unsigned long)&ftrace_graph_call
;
496 branch
= aarch64_insn_gen_branch_imm(pc
,
497 (unsigned long)ftrace_graph_caller
,
498 AARCH64_INSN_BRANCH_NOLINK
);
499 nop
= aarch64_insn_gen_nop();
502 return ftrace_modify_code(pc
, nop
, branch
, true);
504 return ftrace_modify_code(pc
, branch
, nop
, true);
507 int ftrace_enable_ftrace_graph_caller(void)
509 return ftrace_modify_graph_caller(true);
512 int ftrace_disable_ftrace_graph_caller(void)
514 return ftrace_modify_graph_caller(false);
516 #endif /* CONFIG_DYNAMIC_FTRACE_WITH_ARGS */
517 #endif /* CONFIG_FUNCTION_GRAPH_TRACER */