uprobe/arch/x86/swap-asm/swap_uprobes.c

   1 /**
   2  * uprobe/arch/asm-x86/swap_uprobes.c
   3  * @author Alexey Gerenkov <a.gerenkov@samsung.com> User-Space Probes initial
   4  * implementation; Support x86/ARM/MIPS for both user and kernel spaces.
   5  * @author Ekaterina Gorelkina <e.gorelkina@samsung.com>: redesign module for
   6  * separating core and arch parts
   7  *
   8  * @section LICENSE
   9  *
  10  * This program is free software; you can redistribute it and/or modify
  11  * it under the terms of the GNU General Public License as published by
  12  * the Free Software Foundation; either version 2 of the License, or
  13  * (at your option) any later version.
  14  *
  15  * This program is distributed in the hope that it will be useful,
  16  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  17  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  18  * GNU General Public License for more details.
  19  *
  20  * You should have received a copy of the GNU General Public License
  21  * along with this program; if not, write to the Free Software
  22  * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
  23  *
  24  * @section COPYRIGHT
  25  *
  26  * Copyright (C) Samsung Electronics, 2006-2010
  27  *
  28  * @section DESCRIPTION
  29  *
  30  * Arch-dependent uprobe interface implementation for x86.
  31  */
  32
  33
  34 #include <linux/kdebug.h>
  35
  36 #include <kprobe/swap_slots.h>
  37 #include <uprobe/swap_uprobes.h>
  38
  39 #include "swap_uprobes.h"
  40
  41
  42 /**
  43  * @struct uprobe_ctlblk
  44  * @brief Uprobe control block
  45  */
  46 struct uprobe_ctlblk {
  47         unsigned long flags;            /**< Flags */
  48         struct kprobe *p;               /**< Pointer to the uprobe's kprobe */
  49 };
  50
  51 static unsigned long trampoline_addr(struct uprobe *up)
  52 {
  53         return (unsigned long)(up->kp.ainsn.insn +
  54                                UPROBES_TRAMP_RET_BREAK_IDX);
  55 }
  56
  57 static struct uprobe_ctlblk *current_ucb(void)
  58 {
  59         /* FIXME hardcoded offset */
  60         return (struct uprobe_ctlblk *)(end_of_stack(current) + 20);
  61 }
  62
  63 static struct kprobe *get_current_probe(void)
  64 {
  65         return current_ucb()->p;
  66 }
  67
  68 static void set_current_probe(struct kprobe *p)
  69 {
  70         current_ucb()->p = p;
  71 }
  72
  73 static void save_current_flags(struct pt_regs *regs)
  74 {
  75         current_ucb()->flags = regs->flags;
  76 }
  77
  78 static void restore_current_flags(struct pt_regs *regs, unsigned long flags)
  79 {
  80         regs->flags &= ~IF_MASK;
  81         regs->flags |= flags & IF_MASK;
  82 }
  83
  84 /**
  85  * @brief Prepares uprobe for x86.
  86  *
  87  * @param up Pointer to the uprobe.
  88  * @return 0 on success,\n
  89  * -1 on error.
  90  */
  91 int arch_prepare_uprobe(struct uprobe *up)
  92 {
  93         struct kprobe *p = up2kp(up);
  94         struct task_struct *task = up->task;
  95         u8 *tramp = up->atramp.tramp;
  96         enum { call_relative_opcode = 0xe8 };
  97
  98         if (!read_proc_vm_atomic(task, (unsigned long)p->addr,
  99                                  tramp, MAX_INSN_SIZE)) {
 100                 printk(KERN_ERR "failed to read memory %p!\n", p->addr);
 101                 return -EINVAL;
 102         }
 103         /* TODO: this is a workaround */
 104         if (tramp[0] == call_relative_opcode) {
 105                 printk(KERN_INFO "cannot install probe: 1st instruction is call\n");
 106                 return -EINVAL;
 107         }
 108
 109         tramp[UPROBES_TRAMP_RET_BREAK_IDX] = BREAKPOINT_INSTRUCTION;
 110
 111         /* TODO: remove dual info */
 112         p->opcode = tramp[0];
 113
 114         p->ainsn.boostable = swap_can_boost(tramp) ? 0 : -1;
 115
 116         p->ainsn.insn = swap_slot_alloc(up->sm);
 117         if (p->ainsn.insn == NULL) {
 118                 printk(KERN_ERR "trampoline out of memory\n");
 119                 return -ENOMEM;
 120         }
 121
 122         if (!write_proc_vm_atomic(task, (unsigned long)p->ainsn.insn,
 123                                   tramp, sizeof(up->atramp.tramp))) {
 124                 swap_slot_free(up->sm, p->ainsn.insn);
 125                 printk(KERN_INFO "failed to write memory %p!\n", tramp);
 126                 return -EINVAL;
 127         }
 128
 129         /* for uretprobe */
 130         add_uprobe_table(p);
 131
 132         return 0;
 133 }
 134
 135 /**
 136  * @brief Jump pre-handler.
 137  *
 138  * @param p Pointer to the uprobe's kprobe.
 139  * @param regs Pointer to CPU register data.
 140  * @return 0.
 141  */
 142 int setjmp_upre_handler(struct kprobe *p, struct pt_regs *regs)
 143 {
 144         struct uprobe *up = container_of(p, struct uprobe, kp);
 145         struct ujprobe *jp = container_of(up, struct ujprobe, up);
 146         kprobe_pre_entry_handler_t pre_entry =
 147                 (kprobe_pre_entry_handler_t)jp->pre_entry;
 148         entry_point_t entry = (entry_point_t)jp->entry;
 149         unsigned long args[6];
 150
 151         /* FIXME some user space apps crash if we clean interrupt bit */
 152         /* regs->EREG(flags) &= ~IF_MASK; */
 153 #if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 18)
 154         trace_hardirqs_off();
 155 #endif
 156
 157         /* read first 6 args from stack */
 158         if (!read_proc_vm_atomic(current, regs->EREG(sp) + 4,
 159                                  args, sizeof(args)))
 160                 printk(KERN_WARNING
 161                        "failed to read user space func arguments %lx!\n",
 162                        regs->sp + 4);
 163
 164         if (pre_entry)
 165                 p->ss_addr[smp_processor_id()] = (kprobe_opcode_t *)
 166                                                  pre_entry(jp->priv_arg, regs);
 167
 168         if (entry)
 169                 entry(args[0], args[1], args[2], args[3], args[4], args[5]);
 170         else
 171                 arch_ujprobe_return();
 172
 173         return 0;
 174 }
 175
 176 /**
 177  * @brief Prepares uretprobe for x86.
 178  *
 179  * @param ri Pointer to the uretprobe instance.
 180  * @param regs Pointer to CPU register data.
 181  * @return Void.
 182  */
 183 int arch_prepare_uretprobe(struct uretprobe_instance *ri, struct pt_regs *regs)
 184 {
 185         /* Replace the return addr with trampoline addr */
 186         unsigned long ra = trampoline_addr(&ri->rp->up);
 187         ri->sp = (kprobe_opcode_t *)regs->sp;
 188
 189         if (!read_proc_vm_atomic(current, regs->EREG(sp), &(ri->ret_addr),
 190                                  sizeof(ri->ret_addr))) {
 191                 printk(KERN_ERR "failed to read user space func ra %lx addr=%p!\n",
 192                                 regs->EREG(sp), ri->rp->up.kp.addr);
 193                 return -EINVAL;
 194         }
 195
 196         if (!write_proc_vm_atomic(current, regs->EREG(sp), &ra, sizeof(ra))) {
 197                 printk(KERN_ERR "failed to write user space func ra %lx!\n",
 198                        regs->EREG(sp));
 199                 return -EINVAL;
 200         }
 201
 202         return 0;
 203 }
 204
 205 /**
 206  * @brief Disarms uretprobe on x86 arch.
 207  *
 208  * @param ri Pointer to the uretprobe instance.
 209  * @param task Pointer to the task for which the probe.
 210  * @return 0 on success,\n
 211  * negative error code on error.
 212  */
 213 int arch_disarm_urp_inst(struct uretprobe_instance *ri,
 214                          struct task_struct *task)
 215 {
 216         int len;
 217         unsigned long ret_addr;
 218         unsigned long sp = (unsigned long)ri->sp;
 219         unsigned long tramp_addr = trampoline_addr(&ri->rp->up);
 220         len = read_proc_vm_atomic(task, sp, &ret_addr, sizeof(ret_addr));
 221         if (len != sizeof(ret_addr)) {
 222                 printk(KERN_INFO "---> %s (%d/%d): failed to read stack from %08lx\n",
 223                        task->comm, task->tgid, task->pid, sp);
 224                 return -EFAULT;
 225         }
 226
 227         if (tramp_addr == ret_addr) {
 228                 len = write_proc_vm_atomic(task, sp, &ri->ret_addr,
 229                                            sizeof(ri->ret_addr));
 230                 if (len != sizeof(ri->ret_addr)) {
 231                         printk(KERN_INFO "---> %s (%d/%d): failed to write "
 232                                "orig_ret_addr to %08lx",
 233                                task->comm, task->tgid, task->pid, sp);
 234                         return -EFAULT;
 235                 }
 236         } else {
 237                 printk(KERN_INFO "---> %s (%d/%d): trampoline NOT found at sp = %08lx\n",
 238                        task->comm, task->tgid, task->pid, sp);
 239                 return -ENOENT;
 240         }
 241
 242         return 0;
 243 }
 244
 245 /**
 246  * @brief Gets trampoline address.
 247  *
 248  * @param p Pointer to the uprobe's kprobe.
 249  * @param regs Pointer to CPU register data.
 250  * @return Trampoline address.
 251  */
 252 unsigned long arch_get_trampoline_addr(struct kprobe *p, struct pt_regs *regs)
 253 {
 254         return trampoline_addr(kp2up(p));
 255 }
 256
 257 /**
 258  * @brief Restores return address.
 259  *
 260  * @param orig_ret_addr Original return address.
 261  * @param regs Pointer to CPU register data.
 262  * @return Void.
 263  */
 264 void arch_set_orig_ret_addr(unsigned long orig_ret_addr, struct pt_regs *regs)
 265 {
 266         regs->EREG(ip) = orig_ret_addr;
 267 }
 268
 269 /**
 270  * @brief Removes uprobe.
 271  *
 272  * @param up Pointer to the target uprobe.
 273  * @return Void.
 274  */
 275 void arch_remove_uprobe(struct uprobe *up)
 276 {
 277         struct kprobe *p = up2kp(up);
 278
 279         swap_slot_free(up->sm, p->ainsn.insn);
 280 }
 281
 282 static void set_user_jmp_op(void *from, void *to)
 283 {
 284         struct __arch_jmp_op {
 285                 char op;
 286                 long raddr;
 287         } __packed jop;
 288
 289         jop.raddr = (long)(to) - ((long)(from) + 5);
 290         jop.op = RELATIVEJUMP_INSTRUCTION;
 291
 292         if (!write_proc_vm_atomic(current, (unsigned long)from, &jop,
 293                                   sizeof(jop)))
 294                 printk(KERN_WARNING
 295                        "failed to write jump opcode to user space %p\n", from);
 296 }
 297
 298 static void resume_execution(struct kprobe *p,
 299                              struct pt_regs *regs,
 300                              unsigned long flags)
 301 {
 302         unsigned long *tos, tos_dword = 0;
 303         unsigned long copy_eip = (unsigned long)p->ainsn.insn;
 304         unsigned long orig_eip = (unsigned long)p->addr;
 305         kprobe_opcode_t insns[2];
 306
 307         regs->EREG(flags) &= ~TF_MASK;
 308
 309         tos = (unsigned long *)&tos_dword;
 310         if (!read_proc_vm_atomic(current, regs->EREG(sp), &tos_dword,
 311                                  sizeof(tos_dword))) {
 312                 printk(KERN_WARNING
 313                        "failed to read dword from top of the user space stack %lx!\n",
 314                        regs->sp);
 315                 return;
 316         }
 317
 318         if (!read_proc_vm_atomic(current, (unsigned long)p->ainsn.insn, insns,
 319                                  2 * sizeof(kprobe_opcode_t))) {
 320                 printk(KERN_WARNING
 321                        "failed to read first 2 opcodes of instruction copy from user space %p!\n",
 322                        p->ainsn.insn);
 323                 return;
 324         }
 325
 326         switch (insns[0]) {
 327         case 0x9c: /* pushfl */
 328                 *tos &= ~(TF_MASK | IF_MASK);
 329                 *tos |= flags & (TF_MASK | IF_MASK);
 330                 break;
 331         case 0xc2: /* iret/ret/lret */
 332         case 0xc3:
 333         case 0xca:
 334         case 0xcb:
 335         case 0xcf:
 336         case 0xea: /* jmp absolute -- eip is correct */
 337                 /* eip is already adjusted, no more changes required */
 338                 p->ainsn.boostable = 1;
 339                 goto no_change;
 340         case 0xe8: /* call relative - Fix return addr */
 341                 *tos = orig_eip + (*tos - copy_eip);
 342                 break;
 343         case 0x9a: /* call absolute -- same as call absolute, indirect */
 344                 *tos = orig_eip + (*tos - copy_eip);
 345
 346                 if (!write_proc_vm_atomic(current,
 347                                           regs->EREG(sp),
 348                                           &tos_dword,
 349                                           sizeof(tos_dword))) {
 350                         printk(KERN_WARNING
 351                                "failed to write dword to top of the user space stack %lx!\n",
 352                                regs->sp);
 353                         return;
 354                 }
 355
 356                 goto no_change;
 357         case 0xff:
 358                 if ((insns[1] & 0x30) == 0x10) {
 359                         /*
 360                          * call absolute, indirect
 361                          * Fix return addr; eip is correct.
 362                          * But this is not boostable
 363                          */
 364                         *tos = orig_eip + (*tos - copy_eip);
 365
 366                         if (!write_proc_vm_atomic(current, regs->EREG(sp),
 367                                                   &tos_dword,
 368                                                   sizeof(tos_dword))) {
 369                                 printk(KERN_WARNING
 370                                        "failed to write dword to top of the user space stack %lx!\n",
 371                                        regs->EREG(sp));
 372                                 return;
 373                         }
 374
 375                         goto no_change;
 376                 } else if (((insns[1] & 0x31) == 0x20) || /* jmp near, absolute
 377                                                            * indirect */
 378                            ((insns[1] & 0x31) == 0x21)) {
 379                         /* jmp far, absolute indirect */
 380                         /* eip is correct. And this is boostable */
 381                         p->ainsn.boostable = 1;
 382                         goto no_change;
 383                 }
 384         case 0xf3:
 385                 if (insns[1] == 0xc3)
 386                         /* repz ret special handling: no more changes */
 387                         goto no_change;
 388                 break;
 389         default:
 390                 break;
 391         }
 392
 393         if (!write_proc_vm_atomic(current, regs->EREG(sp), &tos_dword,
 394                                   sizeof(tos_dword))) {
 395                 printk(KERN_WARNING
 396                        "failed to write dword to top of the user space stack %lx!\n",
 397                        regs->EREG(sp));
 398                 return;
 399         }
 400
 401         if (p->ainsn.boostable == 0) {
 402                 if ((regs->EREG(ip) > copy_eip) && (regs->EREG(ip) - copy_eip) +
 403                     5 < MAX_INSN_SIZE) {
 404                         /*
 405                          * These instructions can be executed directly if it
 406                          * jumps back to correct address.
 407                          */
 408                         set_user_jmp_op((void *) regs->EREG(ip),
 409                                         (void *)orig_eip +
 410                                         (regs->EREG(ip) - copy_eip));
 411                         p->ainsn.boostable = 1;
 412                 } else {
 413                         p->ainsn.boostable = -1;
 414                 }
 415         }
 416
 417         regs->EREG(ip) = orig_eip + (regs->EREG(ip) - copy_eip);
 418
 419 no_change:
 420         return;
 421 }
 422
 423 static bool prepare_ss_addr(struct kprobe *p, struct pt_regs *regs)
 424 {
 425         unsigned long *ss_addr = (long *)&p->ss_addr[smp_processor_id()];
 426
 427         if (*ss_addr) {
 428                 regs->ip = *ss_addr;
 429                 *ss_addr = 0;
 430                 return true;
 431         } else {
 432                 regs->ip = (unsigned long)p->ainsn.insn;
 433                 return false;
 434         }
 435 }
 436
 437 static void prepare_ss(struct pt_regs *regs)
 438 {
 439         /* set single step mode */
 440         regs->flags |= TF_MASK;
 441         regs->flags &= ~IF_MASK;
 442 }
 443
 444 static int uprobe_handler(struct pt_regs *regs)
 445 {
 446         struct kprobe *p;
 447         kprobe_opcode_t *addr;
 448         struct task_struct *task = current;
 449         pid_t tgid = task->tgid;
 450
 451         save_current_flags(regs);
 452
 453         addr = (kprobe_opcode_t *)(regs->EREG(ip) - sizeof(kprobe_opcode_t));
 454         p = get_ukprobe(addr, tgid);
 455
 456         if (p == NULL) {
 457                 void *tramp_addr = (void *)addr - UPROBES_TRAMP_RET_BREAK_IDX;
 458
 459                 p = get_ukprobe_by_insn_slot(tramp_addr, tgid, regs);
 460                 if (p == NULL) {
 461                         printk(KERN_INFO "no_uprobe\n");
 462                         return 0;
 463                 }
 464
 465                 trampoline_uprobe_handler(p, regs);
 466                 return 1;
 467         } else {
 468                 if (!p->pre_handler || !p->pre_handler(p, regs)) {
 469                         if (p->ainsn.boostable == 1 && !p->post_handler) {
 470                                 prepare_ss_addr(p, regs);
 471                                 return 1;
 472                         }
 473
 474                         if (prepare_ss_addr(p, regs) == false) {
 475                                 set_current_probe(p);
 476                                 prepare_ss(regs);
 477                         }
 478                 }
 479         }
 480
 481         return 1;
 482 }
 483
 484 static int post_uprobe_handler(struct pt_regs *regs)
 485 {
 486         struct kprobe *p = get_current_probe();
 487         unsigned long flags = current_ucb()->flags;
 488
 489         if (p == NULL) {
 490                 printk("task[%u %u %s] current uprobe is not found\n",
 491                        current->tgid, current->pid, current->comm);
 492                 return 0;
 493         }
 494
 495         resume_execution(p, regs, flags);
 496         restore_current_flags(regs, flags);
 497
 498         /* clean stack */
 499         current_ucb()->p = 0;
 500         current_ucb()->flags = 0;
 501
 502         return 1;
 503 }
 504
 505 static int uprobe_exceptions_notify(struct notifier_block *self,
 506                                     unsigned long val, void *data)
 507 {
 508         struct die_args *args = (struct die_args *)data;
 509         int ret = NOTIFY_DONE;
 510
 511         if (args->regs == NULL || !user_mode_vm(args->regs))
 512                 return ret;
 513
 514         switch (val) {
 515 #ifdef CONFIG_KPROBES
 516         case DIE_INT3:
 517 #else
 518         case DIE_TRAP:
 519 #endif
 520                 if (uprobe_handler(args->regs))
 521                         ret = NOTIFY_STOP;
 522                 break;
 523         case DIE_DEBUG:
 524                 if (post_uprobe_handler(args->regs))
 525                         ret = NOTIFY_STOP;
 526                 break;
 527         default:
 528                 break;
 529         }
 530
 531         return ret;
 532 }
 533
 534 static struct notifier_block uprobe_exceptions_nb = {
 535         .notifier_call = uprobe_exceptions_notify,
 536         .priority = INT_MAX
 537 };
 538
 539 /**
 540  * @brief Registers notify.
 541  *
 542  * @return register_die_notifier result.
 543  */
 544 int swap_arch_init_uprobes(void)
 545 {
 546         return register_die_notifier(&uprobe_exceptions_nb);
 547 }
 548
 549 /**
 550  * @brief Unregisters notify.
 551  *
 552  * @return Void.
 553  */
 554 void swap_arch_exit_uprobes(void)
 555 {
 556         unregister_die_notifier(&uprobe_exceptions_nb);
 557 }
 558