1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23#include <linux/kprobes.h>
24#include <linux/ptrace.h>
25#include <linux/preempt.h>
26#include <linux/stop_machine.h>
27#include <linux/kdebug.h>
28#include <linux/uaccess.h>
29#include <asm/cacheflush.h>
30#include <asm/sections.h>
31#include <linux/module.h>
32
33DEFINE_PER_CPU(struct kprobe *, current_kprobe) = NULL;
34DEFINE_PER_CPU(struct kprobe_ctlblk, kprobe_ctlblk);
35
36struct kretprobe_blackpoint kretprobe_blacklist[] = {{NULL, NULL}};
37
38int __kprobes arch_prepare_kprobe(struct kprobe *p)
39{
40
41 if (is_prohibited_opcode((kprobe_opcode_t *) p->addr))
42 return -EINVAL;
43
44 if ((unsigned long)p->addr & 0x01)
45 return -EINVAL;
46
47
48 if (!(p->ainsn.insn = get_insn_slot()))
49 return -ENOMEM;
50
51 memcpy(p->ainsn.insn, p->addr, MAX_INSN_SIZE * sizeof(kprobe_opcode_t));
52
53 get_instruction_type(&p->ainsn);
54 p->opcode = *p->addr;
55 return 0;
56}
57
58int __kprobes is_prohibited_opcode(kprobe_opcode_t *instruction)
59{
60 switch (*(__u8 *) instruction) {
61 case 0x0c:
62 case 0x0b:
63 case 0x83:
64 case 0x44:
65 return -EINVAL;
66 }
67 switch (*(__u16 *) instruction) {
68 case 0x0101:
69 case 0xb25a:
70 case 0xb240:
71 case 0xb258:
72 case 0xb218:
73 case 0xb228:
74 return -EINVAL;
75 }
76 return 0;
77}
78
79void __kprobes get_instruction_type(struct arch_specific_insn *ainsn)
80{
81
82 ainsn->fixup = FIXUP_PSW_NORMAL;
83
84
85 ainsn->reg = (*ainsn->insn & 0xf0) >> 4;
86
87
88 switch (*(__u8 *) (ainsn->insn) >> 6) {
89 case 0:
90 ainsn->ilen = 2;
91 break;
92 case 1:
93 case 2:
94 ainsn->ilen = 4;
95 break;
96 case 3:
97 ainsn->ilen = 6;
98 break;
99 }
100
101 switch (*(__u8 *) ainsn->insn) {
102 case 0x05:
103 case 0x0d:
104 ainsn->fixup = FIXUP_RETURN_REGISTER;
105
106 if ((*ainsn->insn & 0x0f) == 0)
107 ainsn->fixup |= FIXUP_BRANCH_NOT_TAKEN;
108 break;
109 case 0x06:
110 case 0x07:
111 ainsn->fixup = FIXUP_BRANCH_NOT_TAKEN;
112 break;
113 case 0x45:
114 case 0x4d:
115 ainsn->fixup = FIXUP_RETURN_REGISTER;
116 break;
117 case 0x47:
118 case 0x46:
119 case 0x86:
120 case 0x87:
121 ainsn->fixup = FIXUP_BRANCH_NOT_TAKEN;
122 break;
123 case 0x82:
124 ainsn->fixup = FIXUP_NOT_REQUIRED;
125 break;
126 case 0xb2:
127 if (*(((__u8 *) ainsn->insn) + 1) == 0xb2) {
128 ainsn->fixup = FIXUP_NOT_REQUIRED;
129 }
130 break;
131 case 0xa7:
132 if ((*ainsn->insn & 0x0f) == 0x05) {
133 ainsn->fixup |= FIXUP_RETURN_REGISTER;
134 }
135 break;
136 case 0xc0:
137 if ((*ainsn->insn & 0x0f) == 0x00
138 || (*ainsn->insn & 0x0f) == 0x05)
139 ainsn->fixup |= FIXUP_RETURN_REGISTER;
140 break;
141 case 0xeb:
142 if (*(((__u8 *) ainsn->insn) + 5 ) == 0x44 ||
143 *(((__u8 *) ainsn->insn) + 5) == 0x45) {
144 ainsn->fixup = FIXUP_BRANCH_NOT_TAKEN;
145 }
146 break;
147 case 0xe3:
148 if (*(((__u8 *) ainsn->insn) + 5) == 0x46) {
149 ainsn->fixup = FIXUP_BRANCH_NOT_TAKEN;
150 }
151 break;
152 }
153}
154
155static int __kprobes swap_instruction(void *aref)
156{
157 struct kprobe_ctlblk *kcb = get_kprobe_ctlblk();
158 unsigned long status = kcb->kprobe_status;
159 struct ins_replace_args *args = aref;
160 int rc;
161
162 kcb->kprobe_status = KPROBE_SWAP_INST;
163 rc = probe_kernel_write(args->ptr, &args->new, sizeof(args->new));
164 kcb->kprobe_status = status;
165 return rc;
166}
167
168void __kprobes arch_arm_kprobe(struct kprobe *p)
169{
170 struct ins_replace_args args;
171
172 args.ptr = p->addr;
173 args.old = p->opcode;
174 args.new = BREAKPOINT_INSTRUCTION;
175 stop_machine(swap_instruction, &args, NULL);
176}
177
178void __kprobes arch_disarm_kprobe(struct kprobe *p)
179{
180 struct ins_replace_args args;
181
182 args.ptr = p->addr;
183 args.old = BREAKPOINT_INSTRUCTION;
184 args.new = p->opcode;
185 stop_machine(swap_instruction, &args, NULL);
186}
187
188void __kprobes arch_remove_kprobe(struct kprobe *p)
189{
190 if (p->ainsn.insn) {
191 free_insn_slot(p->ainsn.insn, 0);
192 p->ainsn.insn = NULL;
193 }
194}
195
196static void __kprobes prepare_singlestep(struct kprobe *p, struct pt_regs *regs)
197{
198 per_cr_bits kprobe_per_regs[1];
199
200 memset(kprobe_per_regs, 0, sizeof(per_cr_bits));
201 regs->psw.addr = (unsigned long)p->ainsn.insn | PSW_ADDR_AMODE;
202
203
204 kprobe_per_regs[0].em_instruction_fetch = 1;
205 kprobe_per_regs[0].starting_addr = (unsigned long)p->ainsn.insn;
206 kprobe_per_regs[0].ending_addr = (unsigned long)p->ainsn.insn + 1;
207
208
209 __ctl_load(kprobe_per_regs, 9, 11);
210 regs->psw.mask |= PSW_MASK_PER;
211 regs->psw.mask &= ~(PSW_MASK_IO | PSW_MASK_EXT | PSW_MASK_MCHECK);
212}
213
214static void __kprobes save_previous_kprobe(struct kprobe_ctlblk *kcb)
215{
216 kcb->prev_kprobe.kp = kprobe_running();
217 kcb->prev_kprobe.status = kcb->kprobe_status;
218 kcb->prev_kprobe.kprobe_saved_imask = kcb->kprobe_saved_imask;
219 memcpy(kcb->prev_kprobe.kprobe_saved_ctl, kcb->kprobe_saved_ctl,
220 sizeof(kcb->kprobe_saved_ctl));
221}
222
223static void __kprobes restore_previous_kprobe(struct kprobe_ctlblk *kcb)
224{
225 __get_cpu_var(current_kprobe) = kcb->prev_kprobe.kp;
226 kcb->kprobe_status = kcb->prev_kprobe.status;
227 kcb->kprobe_saved_imask = kcb->prev_kprobe.kprobe_saved_imask;
228 memcpy(kcb->kprobe_saved_ctl, kcb->prev_kprobe.kprobe_saved_ctl,
229 sizeof(kcb->kprobe_saved_ctl));
230}
231
232static void __kprobes set_current_kprobe(struct kprobe *p, struct pt_regs *regs,
233 struct kprobe_ctlblk *kcb)
234{
235 __get_cpu_var(current_kprobe) = p;
236
237 kcb->kprobe_saved_imask = regs->psw.mask &
238 (PSW_MASK_PER | PSW_MASK_IO | PSW_MASK_EXT | PSW_MASK_MCHECK);
239
240 __ctl_store(kcb->kprobe_saved_ctl, 9, 11);
241}
242
243void __kprobes arch_prepare_kretprobe(struct kretprobe_instance *ri,
244 struct pt_regs *regs)
245{
246 ri->ret_addr = (kprobe_opcode_t *) regs->gprs[14];
247
248
249 regs->gprs[14] = (unsigned long)&kretprobe_trampoline;
250}
251
252static int __kprobes kprobe_handler(struct pt_regs *regs)
253{
254 struct kprobe *p;
255 int ret = 0;
256 unsigned long *addr = (unsigned long *)
257 ((regs->psw.addr & PSW_ADDR_INSN) - 2);
258 struct kprobe_ctlblk *kcb;
259
260
261
262
263
264 preempt_disable();
265 kcb = get_kprobe_ctlblk();
266
267
268 if (kprobe_running()) {
269 p = get_kprobe(addr);
270 if (p) {
271 if (kcb->kprobe_status == KPROBE_HIT_SS &&
272 *p->ainsn.insn == BREAKPOINT_INSTRUCTION) {
273 regs->psw.mask &= ~PSW_MASK_PER;
274 regs->psw.mask |= kcb->kprobe_saved_imask;
275 goto no_kprobe;
276 }
277
278
279
280
281
282
283 save_previous_kprobe(kcb);
284 set_current_kprobe(p, regs, kcb);
285 kprobes_inc_nmissed_count(p);
286 prepare_singlestep(p, regs);
287 kcb->kprobe_status = KPROBE_REENTER;
288 return 1;
289 } else {
290 p = __get_cpu_var(current_kprobe);
291 if (p->break_handler && p->break_handler(p, regs)) {
292 goto ss_probe;
293 }
294 }
295 goto no_kprobe;
296 }
297
298 p = get_kprobe(addr);
299 if (!p)
300
301
302
303
304
305
306 goto no_kprobe;
307
308 kcb->kprobe_status = KPROBE_HIT_ACTIVE;
309 set_current_kprobe(p, regs, kcb);
310 if (p->pre_handler && p->pre_handler(p, regs))
311
312 return 1;
313
314ss_probe:
315 prepare_singlestep(p, regs);
316 kcb->kprobe_status = KPROBE_HIT_SS;
317 return 1;
318
319no_kprobe:
320 preempt_enable_no_resched();
321 return ret;
322}
323
324
325
326
327
328
329
330static void __used kretprobe_trampoline_holder(void)
331{
332 asm volatile(".global kretprobe_trampoline\n"
333 "kretprobe_trampoline: bcr 0,0\n");
334}
335
336
337
338
339static int __kprobes trampoline_probe_handler(struct kprobe *p,
340 struct pt_regs *regs)
341{
342 struct kretprobe_instance *ri = NULL;
343 struct hlist_head *head, empty_rp;
344 struct hlist_node *node, *tmp;
345 unsigned long flags, orig_ret_address = 0;
346 unsigned long trampoline_address = (unsigned long)&kretprobe_trampoline;
347
348 INIT_HLIST_HEAD(&empty_rp);
349 kretprobe_hash_lock(current, &head, &flags);
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364 hlist_for_each_entry_safe(ri, node, tmp, head, hlist) {
365 if (ri->task != current)
366
367 continue;
368
369 if (ri->rp && ri->rp->handler)
370 ri->rp->handler(ri, regs);
371
372 orig_ret_address = (unsigned long)ri->ret_addr;
373 recycle_rp_inst(ri, &empty_rp);
374
375 if (orig_ret_address != trampoline_address) {
376
377
378
379
380
381 break;
382 }
383 }
384 kretprobe_assert(ri, orig_ret_address, trampoline_address);
385 regs->psw.addr = orig_ret_address | PSW_ADDR_AMODE;
386
387 reset_current_kprobe();
388 kretprobe_hash_unlock(current, &flags);
389 preempt_enable_no_resched();
390
391 hlist_for_each_entry_safe(ri, node, tmp, &empty_rp, hlist) {
392 hlist_del(&ri->hlist);
393 kfree(ri);
394 }
395
396
397
398
399
400 return 1;
401}
402
403
404
405
406
407
408
409
410
411static void __kprobes resume_execution(struct kprobe *p, struct pt_regs *regs)
412{
413 struct kprobe_ctlblk *kcb = get_kprobe_ctlblk();
414
415 regs->psw.addr &= PSW_ADDR_INSN;
416
417 if (p->ainsn.fixup & FIXUP_PSW_NORMAL)
418 regs->psw.addr = (unsigned long)p->addr +
419 ((unsigned long)regs->psw.addr -
420 (unsigned long)p->ainsn.insn);
421
422 if (p->ainsn.fixup & FIXUP_BRANCH_NOT_TAKEN)
423 if ((unsigned long)regs->psw.addr -
424 (unsigned long)p->ainsn.insn == p->ainsn.ilen)
425 regs->psw.addr = (unsigned long)p->addr + p->ainsn.ilen;
426
427 if (p->ainsn.fixup & FIXUP_RETURN_REGISTER)
428 regs->gprs[p->ainsn.reg] = ((unsigned long)p->addr +
429 (regs->gprs[p->ainsn.reg] -
430 (unsigned long)p->ainsn.insn))
431 | PSW_ADDR_AMODE;
432
433 regs->psw.addr |= PSW_ADDR_AMODE;
434
435 regs->psw.mask &= ~PSW_MASK_PER;
436
437 __ctl_load(kcb->kprobe_saved_ctl, 9, 11);
438 regs->psw.mask |= kcb->kprobe_saved_imask;
439}
440
441static int __kprobes post_kprobe_handler(struct pt_regs *regs)
442{
443 struct kprobe *cur = kprobe_running();
444 struct kprobe_ctlblk *kcb = get_kprobe_ctlblk();
445
446 if (!cur)
447 return 0;
448
449 if ((kcb->kprobe_status != KPROBE_REENTER) && cur->post_handler) {
450 kcb->kprobe_status = KPROBE_HIT_SSDONE;
451 cur->post_handler(cur, regs, 0);
452 }
453
454 resume_execution(cur, regs);
455
456
457 if (kcb->kprobe_status == KPROBE_REENTER) {
458 restore_previous_kprobe(kcb);
459 goto out;
460 }
461 reset_current_kprobe();
462out:
463 preempt_enable_no_resched();
464
465
466
467
468
469
470 if (regs->psw.mask & PSW_MASK_PER) {
471 return 0;
472 }
473
474 return 1;
475}
476
477int __kprobes kprobe_fault_handler(struct pt_regs *regs, int trapnr)
478{
479 struct kprobe *cur = kprobe_running();
480 struct kprobe_ctlblk *kcb = get_kprobe_ctlblk();
481 const struct exception_table_entry *entry;
482
483 switch(kcb->kprobe_status) {
484 case KPROBE_SWAP_INST:
485
486 return 0;
487 case KPROBE_HIT_SS:
488 case KPROBE_REENTER:
489
490
491
492
493
494
495
496 regs->psw.addr = (unsigned long)cur->addr | PSW_ADDR_AMODE;
497 regs->psw.mask &= ~PSW_MASK_PER;
498 regs->psw.mask |= kcb->kprobe_saved_imask;
499 if (kcb->kprobe_status == KPROBE_REENTER)
500 restore_previous_kprobe(kcb);
501 else
502 reset_current_kprobe();
503 preempt_enable_no_resched();
504 break;
505 case KPROBE_HIT_ACTIVE:
506 case KPROBE_HIT_SSDONE:
507
508
509
510
511
512 kprobes_inc_nmissed_count(cur);
513
514
515
516
517
518
519
520
521 if (cur->fault_handler && cur->fault_handler(cur, regs, trapnr))
522 return 1;
523
524
525
526
527
528 entry = search_exception_tables(regs->psw.addr & PSW_ADDR_INSN);
529 if (entry) {
530 regs->psw.addr = entry->fixup | PSW_ADDR_AMODE;
531 return 1;
532 }
533
534
535
536
537
538 break;
539 default:
540 break;
541 }
542 return 0;
543}
544
545
546
547
548int __kprobes kprobe_exceptions_notify(struct notifier_block *self,
549 unsigned long val, void *data)
550{
551 struct die_args *args = (struct die_args *)data;
552 int ret = NOTIFY_DONE;
553
554 switch (val) {
555 case DIE_BPT:
556 if (kprobe_handler(args->regs))
557 ret = NOTIFY_STOP;
558 break;
559 case DIE_SSTEP:
560 if (post_kprobe_handler(args->regs))
561 ret = NOTIFY_STOP;
562 break;
563 case DIE_TRAP:
564
565 preempt_disable();
566 if (kprobe_running() &&
567 kprobe_fault_handler(args->regs, args->trapnr))
568 ret = NOTIFY_STOP;
569 preempt_enable();
570 break;
571 default:
572 break;
573 }
574 return ret;
575}
576
577int __kprobes setjmp_pre_handler(struct kprobe *p, struct pt_regs *regs)
578{
579 struct jprobe *jp = container_of(p, struct jprobe, kp);
580 unsigned long addr;
581 struct kprobe_ctlblk *kcb = get_kprobe_ctlblk();
582
583 memcpy(&kcb->jprobe_saved_regs, regs, sizeof(struct pt_regs));
584
585
586 regs->psw.addr = (unsigned long)(jp->entry) | PSW_ADDR_AMODE;
587
588
589 kcb->jprobe_saved_r14 = (unsigned long)regs->gprs[14];
590
591 kcb->jprobe_saved_r15 = (unsigned long)regs->gprs[15];
592 addr = (unsigned long)kcb->jprobe_saved_r15;
593
594 memcpy(kcb->jprobes_stack, (kprobe_opcode_t *) addr,
595 MIN_STACK_SIZE(addr));
596 return 1;
597}
598
599void __kprobes jprobe_return(void)
600{
601 asm volatile(".word 0x0002");
602}
603
604void __kprobes jprobe_return_end(void)
605{
606 asm volatile("bcr 0,0");
607}
608
609int __kprobes longjmp_break_handler(struct kprobe *p, struct pt_regs *regs)
610{
611 struct kprobe_ctlblk *kcb = get_kprobe_ctlblk();
612 unsigned long stack_addr = (unsigned long)(kcb->jprobe_saved_r15);
613
614
615 memcpy(regs, &kcb->jprobe_saved_regs, sizeof(struct pt_regs));
616
617 memcpy((kprobe_opcode_t *) stack_addr, kcb->jprobes_stack,
618 MIN_STACK_SIZE(stack_addr));
619 preempt_enable_no_resched();
620 return 1;
621}
622
623static struct kprobe trampoline_p = {
624 .addr = (kprobe_opcode_t *) & kretprobe_trampoline,
625 .pre_handler = trampoline_probe_handler
626};
627
628int __init arch_init_kprobes(void)
629{
630 return register_kprobe(&trampoline_p);
631}
632
633int __kprobes arch_trampoline_kprobe(struct kprobe *p)
634{
635 if (p->addr == (kprobe_opcode_t *) & kretprobe_trampoline)
636 return 1;
637 return 0;
638}
639