1 // SPDX-License-Identifier: GPL-2.0-only
3 * Copyright (C) 2004, 2007-2010, 2011-2012 Synopsys, Inc. (www.synopsys.com)
6 #include <linux/types.h>
7 #include <linux/kprobes.h>
8 #include <linux/slab.h>
9 #include <linux/module.h>
10 #include <linux/kdebug.h>
11 #include <linux/sched.h>
12 #include <linux/uaccess.h>
13 #include <asm/cacheflush.h>
14 #include <asm/current.h>
15 #include <asm/disasm.h>
17 #define MIN_STACK_SIZE(addr) min((unsigned long)MAX_STACK_SIZE, \
18 (unsigned long)current_thread_info() + THREAD_SIZE - (addr))
20 DEFINE_PER_CPU(struct kprobe
*, current_kprobe
) = NULL
;
21 DEFINE_PER_CPU(struct kprobe_ctlblk
, kprobe_ctlblk
);
23 int __kprobes
arch_prepare_kprobe(struct kprobe
*p
)
25 /* Attempt to probe at unaligned address */
26 if ((unsigned long)p
->addr
& 0x01)
29 /* Address should not be in exception handling code */
31 p
->ainsn
.is_short
= is_short_instr((unsigned long)p
->addr
);
37 void __kprobes
arch_arm_kprobe(struct kprobe
*p
)
39 *p
->addr
= UNIMP_S_INSTRUCTION
;
41 flush_icache_range((unsigned long)p
->addr
,
42 (unsigned long)p
->addr
+ sizeof(kprobe_opcode_t
));
45 void __kprobes
arch_disarm_kprobe(struct kprobe
*p
)
49 flush_icache_range((unsigned long)p
->addr
,
50 (unsigned long)p
->addr
+ sizeof(kprobe_opcode_t
));
53 void __kprobes
arch_remove_kprobe(struct kprobe
*p
)
55 arch_disarm_kprobe(p
);
57 /* Can we remove the kprobe in the middle of kprobe handling? */
58 if (p
->ainsn
.t1_addr
) {
59 *(p
->ainsn
.t1_addr
) = p
->ainsn
.t1_opcode
;
61 flush_icache_range((unsigned long)p
->ainsn
.t1_addr
,
62 (unsigned long)p
->ainsn
.t1_addr
+
63 sizeof(kprobe_opcode_t
));
65 p
->ainsn
.t1_addr
= NULL
;
68 if (p
->ainsn
.t2_addr
) {
69 *(p
->ainsn
.t2_addr
) = p
->ainsn
.t2_opcode
;
71 flush_icache_range((unsigned long)p
->ainsn
.t2_addr
,
72 (unsigned long)p
->ainsn
.t2_addr
+
73 sizeof(kprobe_opcode_t
));
75 p
->ainsn
.t2_addr
= NULL
;
79 static void __kprobes
save_previous_kprobe(struct kprobe_ctlblk
*kcb
)
81 kcb
->prev_kprobe
.kp
= kprobe_running();
82 kcb
->prev_kprobe
.status
= kcb
->kprobe_status
;
85 static void __kprobes
restore_previous_kprobe(struct kprobe_ctlblk
*kcb
)
87 __this_cpu_write(current_kprobe
, kcb
->prev_kprobe
.kp
);
88 kcb
->kprobe_status
= kcb
->prev_kprobe
.status
;
91 static inline void __kprobes
set_current_kprobe(struct kprobe
*p
)
93 __this_cpu_write(current_kprobe
, p
);
96 static void __kprobes
resume_execution(struct kprobe
*p
, unsigned long addr
,
99 /* Remove the trap instructions inserted for single step and
100 * restore the original instructions
102 if (p
->ainsn
.t1_addr
) {
103 *(p
->ainsn
.t1_addr
) = p
->ainsn
.t1_opcode
;
105 flush_icache_range((unsigned long)p
->ainsn
.t1_addr
,
106 (unsigned long)p
->ainsn
.t1_addr
+
107 sizeof(kprobe_opcode_t
));
109 p
->ainsn
.t1_addr
= NULL
;
112 if (p
->ainsn
.t2_addr
) {
113 *(p
->ainsn
.t2_addr
) = p
->ainsn
.t2_opcode
;
115 flush_icache_range((unsigned long)p
->ainsn
.t2_addr
,
116 (unsigned long)p
->ainsn
.t2_addr
+
117 sizeof(kprobe_opcode_t
));
119 p
->ainsn
.t2_addr
= NULL
;
125 static void __kprobes
setup_singlestep(struct kprobe
*p
, struct pt_regs
*regs
)
127 unsigned long next_pc
;
128 unsigned long tgt_if_br
= 0;
132 /* Copy the opcode back to the kprobe location and execute the
133 * instruction. Because of this we will not be able to get into the
134 * same kprobe until this kprobe is done
136 *(p
->addr
) = p
->opcode
;
138 flush_icache_range((unsigned long)p
->addr
,
139 (unsigned long)p
->addr
+ sizeof(kprobe_opcode_t
));
141 /* Now we insert the trap at the next location after this instruction to
142 * single step. If it is a branch we insert the trap at possible branch
148 if (regs
->status32
& 0x40) {
149 /* We are in a delay slot with the branch taken */
151 next_pc
= bta
& ~0x01;
153 if (!p
->ainsn
.is_short
) {
157 /* Branch not taken */
160 /* next pc is taken from bta after executing the
161 * delay slot instruction
170 disasm_next_pc((unsigned long)p
->addr
, regs
,
171 (struct callee_regs
*) current
->thread
.callee_reg
,
172 &next_pc
, &tgt_if_br
);
174 p
->ainsn
.t1_addr
= (kprobe_opcode_t
*) next_pc
;
175 p
->ainsn
.t1_opcode
= *(p
->ainsn
.t1_addr
);
176 *(p
->ainsn
.t1_addr
) = TRAP_S_2_INSTRUCTION
;
178 flush_icache_range((unsigned long)p
->ainsn
.t1_addr
,
179 (unsigned long)p
->ainsn
.t1_addr
+
180 sizeof(kprobe_opcode_t
));
183 p
->ainsn
.t2_addr
= (kprobe_opcode_t
*) tgt_if_br
;
184 p
->ainsn
.t2_opcode
= *(p
->ainsn
.t2_addr
);
185 *(p
->ainsn
.t2_addr
) = TRAP_S_2_INSTRUCTION
;
187 flush_icache_range((unsigned long)p
->ainsn
.t2_addr
,
188 (unsigned long)p
->ainsn
.t2_addr
+
189 sizeof(kprobe_opcode_t
));
193 int __kprobes
arc_kprobe_handler(unsigned long addr
, struct pt_regs
*regs
)
196 struct kprobe_ctlblk
*kcb
;
200 kcb
= get_kprobe_ctlblk();
201 p
= get_kprobe((unsigned long *)addr
);
205 * We have reentered the kprobe_handler, since another kprobe
206 * was hit while within the handler, we save the original
207 * kprobes and single step on the instruction of the new probe
208 * without calling any user handlers to avoid recursive
211 if (kprobe_running()) {
212 save_previous_kprobe(kcb
);
213 set_current_kprobe(p
);
214 kprobes_inc_nmissed_count(p
);
215 setup_singlestep(p
, regs
);
216 kcb
->kprobe_status
= KPROBE_REENTER
;
220 set_current_kprobe(p
);
221 kcb
->kprobe_status
= KPROBE_HIT_ACTIVE
;
223 /* If we have no pre-handler or it returned 0, we continue with
224 * normal processing. If we have a pre-handler and it returned
225 * non-zero - which means user handler setup registers to exit
226 * to another instruction, we must skip the single stepping.
228 if (!p
->pre_handler
|| !p
->pre_handler(p
, regs
)) {
229 setup_singlestep(p
, regs
);
230 kcb
->kprobe_status
= KPROBE_HIT_SS
;
232 reset_current_kprobe();
233 preempt_enable_no_resched();
240 preempt_enable_no_resched();
244 static int __kprobes
arc_post_kprobe_handler(unsigned long addr
,
245 struct pt_regs
*regs
)
247 struct kprobe
*cur
= kprobe_running();
248 struct kprobe_ctlblk
*kcb
= get_kprobe_ctlblk();
253 resume_execution(cur
, addr
, regs
);
255 /* Rearm the kprobe */
256 arch_arm_kprobe(cur
);
259 * When we return from trap instruction we go to the next instruction
260 * We restored the actual instruction in resume_exectuiont and we to
261 * return to the same address and execute it
265 if ((kcb
->kprobe_status
!= KPROBE_REENTER
) && cur
->post_handler
) {
266 kcb
->kprobe_status
= KPROBE_HIT_SSDONE
;
267 cur
->post_handler(cur
, regs
, 0);
270 if (kcb
->kprobe_status
== KPROBE_REENTER
) {
271 restore_previous_kprobe(kcb
);
275 reset_current_kprobe();
278 preempt_enable_no_resched();
283 * Fault can be for the instruction being single stepped or for the
284 * pre/post handlers in the module.
285 * This is applicable for applications like user probes, where we have the
286 * probe in user space and the handlers in the kernel
289 int __kprobes
kprobe_fault_handler(struct pt_regs
*regs
, unsigned long trapnr
)
291 struct kprobe
*cur
= kprobe_running();
292 struct kprobe_ctlblk
*kcb
= get_kprobe_ctlblk();
294 switch (kcb
->kprobe_status
) {
298 * We are here because the instruction being single stepped
299 * caused the fault. We reset the current kprobe and allow the
300 * exception handler as if it is regular exception. In our
301 * case it doesn't matter because the system will be halted
303 resume_execution(cur
, (unsigned long)cur
->addr
, regs
);
305 if (kcb
->kprobe_status
== KPROBE_REENTER
)
306 restore_previous_kprobe(kcb
);
308 reset_current_kprobe();
310 preempt_enable_no_resched();
313 case KPROBE_HIT_ACTIVE
:
314 case KPROBE_HIT_SSDONE
:
316 * We are here because the instructions in the pre/post handler
320 /* We increment the nmissed count for accounting,
321 * we can also use npre/npostfault count for accounting
322 * these specific fault cases.
324 kprobes_inc_nmissed_count(cur
);
327 * We come here because instructions in the pre/post
328 * handler caused the page_fault, this could happen
329 * if handler tries to access user space by
330 * copy_from_user(), get_user() etc. Let the
331 * user-specified handler try to fix it first.
333 if (cur
->fault_handler
&& cur
->fault_handler(cur
, regs
, trapnr
))
337 * In case the user-specified fault handler returned zero,
340 if (fixup_exception(regs
))
344 * fixup_exception() could not handle it,
345 * Let do_page_fault() fix it.
355 int __kprobes
kprobe_exceptions_notify(struct notifier_block
*self
,
356 unsigned long val
, void *data
)
358 struct die_args
*args
= data
;
359 unsigned long addr
= args
->err
;
360 int ret
= NOTIFY_DONE
;
364 if (arc_kprobe_handler(addr
, args
->regs
))
369 if (arc_post_kprobe_handler(addr
, args
->regs
))
380 static void __used
kretprobe_trampoline_holder(void)
382 __asm__
__volatile__(".global kretprobe_trampoline\n"
383 "kretprobe_trampoline:\n" "nop\n");
386 void __kprobes
arch_prepare_kretprobe(struct kretprobe_instance
*ri
,
387 struct pt_regs
*regs
)
390 ri
->ret_addr
= (kprobe_opcode_t
*) regs
->blink
;
392 /* Replace the return addr with trampoline addr */
393 regs
->blink
= (unsigned long)&kretprobe_trampoline
;
396 static int __kprobes
trampoline_probe_handler(struct kprobe
*p
,
397 struct pt_regs
*regs
)
399 struct kretprobe_instance
*ri
= NULL
;
400 struct hlist_head
*head
, empty_rp
;
401 struct hlist_node
*tmp
;
402 unsigned long flags
, orig_ret_address
= 0;
403 unsigned long trampoline_address
= (unsigned long)&kretprobe_trampoline
;
405 INIT_HLIST_HEAD(&empty_rp
);
406 kretprobe_hash_lock(current
, &head
, &flags
);
409 * It is possible to have multiple instances associated with a given
410 * task either because an multiple functions in the call path
411 * have a return probe installed on them, and/or more than one return
412 * return probe was registered for a target function.
414 * We can handle this because:
415 * - instances are always inserted at the head of the list
416 * - when multiple return probes are registered for the same
417 * function, the first instance's ret_addr will point to the
418 * real return address, and all the rest will point to
419 * kretprobe_trampoline
421 hlist_for_each_entry_safe(ri
, tmp
, head
, hlist
) {
422 if (ri
->task
!= current
)
423 /* another task is sharing our hash bucket */
426 if (ri
->rp
&& ri
->rp
->handler
)
427 ri
->rp
->handler(ri
, regs
);
429 orig_ret_address
= (unsigned long)ri
->ret_addr
;
430 recycle_rp_inst(ri
, &empty_rp
);
432 if (orig_ret_address
!= trampoline_address
) {
434 * This is the real return address. Any other
435 * instances associated with this task are for
436 * other calls deeper on the call stack
442 kretprobe_assert(ri
, orig_ret_address
, trampoline_address
);
443 regs
->ret
= orig_ret_address
;
445 kretprobe_hash_unlock(current
, &flags
);
447 hlist_for_each_entry_safe(ri
, tmp
, &empty_rp
, hlist
) {
448 hlist_del(&ri
->hlist
);
452 /* By returning a non zero value, we are telling the kprobe handler
453 * that we don't want the post_handler to run
458 static struct kprobe trampoline_p
= {
459 .addr
= (kprobe_opcode_t
*) &kretprobe_trampoline
,
460 .pre_handler
= trampoline_probe_handler
463 int __init
arch_init_kprobes(void)
465 /* Registering the trampoline code for the kret probe */
466 return register_kprobe(&trampoline_p
);
469 int __kprobes
arch_trampoline_kprobe(struct kprobe
*p
)
471 if (p
->addr
== (kprobe_opcode_t
*) &kretprobe_trampoline
)
477 void trap_is_kprobe(unsigned long address
, struct pt_regs
*regs
)
479 notify_die(DIE_TRAP
, "kprobe_trap", regs
, address
, 0, SIGTRAP
);