uprobe/swap_uprobes.c

   1 /*
   2  *  Dynamic Binary Instrumentation Module based on KProbes
   3  *  modules/kprobe/dbi_uprobes.h
   4  *
   5  * This program is free software; you can redistribute it and/or modify
   6  * it under the terms of the GNU General Public License as published by
   7  * the Free Software Foundation; either version 2 of the License, or
   8  * (at your option) any later version.
   9  *
  10  * This program is distributed in the hope that it will be useful,
  11  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  12  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  13  * GNU General Public License for more details.
  14  *
  15  * You should have received a copy of the GNU General Public License
  16  * along with this program; if not, write to the Free Software
  17  * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
  18  *
  19  * Copyright (C) Samsung Electronics, 2006-2010
  20  *
  21  * 2008-2009    Alexey Gerenkov <a.gerenkov@samsung.com> User-Space
  22  *              Probes initial implementation; Support x86/ARM/MIPS for both user and kernel spaces.
  23  * 2010         Ekaterina Gorelkina <e.gorelkina@samsung.com>: redesign module for separating core and arch parts
  24  *
  25  */
  26
  27
  28 #include "swap_uprobes.h"
  29 #include "dbi_kdebug.h"
  30
  31 #include <asm/swap_uprobes.h>
  32
  33 #include <linux/hash.h>
  34 #include <linux/mempolicy.h>
  35 #include <linux/module.h>
  36 #include <dbi_insn_slots.h>
  37 #include <dbi_kprobes_deps.h>
  38
  39 enum {
  40         UPROBE_HASH_BITS  = 10,
  41         UPROBE_TABLE_SIZE = (1 << UPROBE_HASH_BITS)
  42 };
  43
  44 struct hlist_head uprobe_insn_slot_table[UPROBE_TABLE_SIZE];
  45 struct hlist_head uprobe_table[UPROBE_TABLE_SIZE];
  46 struct hlist_head uprobe_insn_pages;
  47
  48 DEFINE_SPINLOCK(uretprobe_lock);        /* Protects uretprobe_inst_table */
  49 static struct hlist_head uretprobe_inst_table[UPROBE_TABLE_SIZE];
  50
  51 #define DEBUG_PRINT_HASH_TABLE 0
  52
  53 #if DEBUG_PRINT_HASH_TABLE
  54 void print_kprobe_hash_table(void)
  55 {
  56         int i;
  57         struct hlist_head *head;
  58         struct hlist_node *node;
  59         struct kprobe *p;
  60
  61         // print uprobe table
  62         for (i = 0; i < KPROBE_TABLE_SIZE; ++i) {
  63                 head = &kprobe_table[i];
  64                 swap_hlist_for_each_entry_rcu(p, node, head, is_hlist_arm) {
  65                         printk("####### find K tgid=%u, addr=%x\n",
  66                                         p->tgid, p->addr);
  67                 }
  68         }
  69 }
  70
  71 void print_kretprobe_hash_table(void)
  72 {
  73         int i;
  74         struct hlist_head *head;
  75         struct hlist_node *node;
  76         struct kprobe *p;
  77
  78         // print uprobe table
  79         for (i = 0; i < KPROBE_TABLE_SIZE; ++i) {
  80                 head = &kretprobe_inst_table[i];
  81                 swap_hlist_for_each_entry_rcu(p, node, head, is_hlist_arm) {
  82                         printk("####### find KR tgid=%u, addr=%x\n",
  83                                         p->tgid, p->addr);
  84                 }
  85         }
  86 }
  87
  88 void print_uprobe_hash_table(void)
  89 {
  90         int i;
  91         struct hlist_head *head;
  92         struct hlist_node *node;
  93         struct kprobe *p;
  94
  95         // print uprobe table
  96         for (i = 0; i < UPROBE_TABLE_SIZE; ++i) {
  97                 head = &uprobe_insn_slot_table[i];
  98                 swap_hlist_for_each_entry_rcu(p, node, head, is_hlist_arm) {
  99                         printk("####### find U tgid=%u, addr=%x\n",
 100                                         p->tgid, p->addr);
 101                 }
 102         }
 103 }
 104 #endif
 105
 106 /*
 107  * Keep all fields in the uprobe consistent
 108  */
 109 static inline void copy_uprobe(struct kprobe *old_p, struct kprobe *p)
 110 {
 111         memcpy(&p->opcode, &old_p->opcode, sizeof(kprobe_opcode_t));
 112         memcpy(&p->ainsn, &old_p->ainsn, sizeof(struct arch_specific_insn));
 113         p->ss_addr = old_p->ss_addr;
 114 #ifdef CONFIG_ARM
 115         p->safe_arm = old_p->safe_arm;
 116         p->safe_thumb = old_p->safe_thumb;
 117 #endif
 118 }
 119
 120 /*
 121  * Aggregate handlers for multiple uprobes support - these handlers
 122  * take care of invoking the individual uprobe handlers on p->list
 123  */
 124 static int aggr_pre_uhandler(struct kprobe *p, struct pt_regs *regs)
 125 {
 126         struct kprobe *kp;
 127         int ret;
 128
 129         list_for_each_entry_rcu(kp, &p->list, list) {
 130                 if (kp->pre_handler) {
 131                         ret = kp->pre_handler(kp, regs);
 132                         if (ret) {
 133                                 return ret;
 134                         }
 135                 }
 136         }
 137
 138         return 0;
 139 }
 140
 141 static void aggr_post_uhandler(struct kprobe *p, struct pt_regs *regs, unsigned long flags)
 142 {
 143         struct kprobe *kp;
 144
 145         list_for_each_entry_rcu(kp, &p->list, list) {
 146                 if (kp->post_handler) {
 147                         kp->post_handler(kp, regs, flags);
 148                 }
 149         }
 150 }
 151
 152 static int aggr_fault_uhandler(struct kprobe *p, struct pt_regs *regs, int trapnr)
 153 {
 154         return 0;
 155 }
 156
 157 static int aggr_break_uhandler(struct kprobe *p, struct pt_regs *regs)
 158 {
 159         return 0;
 160 }
 161
 162 /*
 163  * Add the new probe to old_p->list. Fail if this is the
 164  * second ujprobe at the address - two ujprobes can't coexist
 165  */
 166 static int add_new_uprobe(struct kprobe *old_p, struct kprobe *p)
 167 {
 168         if (p->break_handler) {
 169                 if (old_p->break_handler) {
 170                         return -EEXIST;
 171                 }
 172
 173                 list_add_tail_rcu(&p->list, &old_p->list);
 174                 old_p->break_handler = aggr_break_uhandler;
 175         } else {
 176                 list_add_rcu (&p->list, &old_p->list);
 177         }
 178
 179         if (p->post_handler && !old_p->post_handler) {
 180                 old_p->post_handler = aggr_post_uhandler;
 181         }
 182
 183         return 0;
 184 }
 185
 186 /*
 187  * Fill in the required fields of the "manager uprobe". Replace the
 188  * earlier uprobe in the hlist with the manager uprobe
 189  */
 190 static inline void add_aggr_uprobe(struct kprobe *ap, struct kprobe *p)
 191 {
 192         copy_uprobe(p, ap);
 193
 194         ap->addr = p->addr;
 195         ap->pre_handler = aggr_pre_uhandler;
 196         ap->fault_handler = aggr_fault_uhandler;
 197
 198         if (p->post_handler) {
 199                 ap->post_handler = aggr_post_uhandler;
 200         }
 201
 202         if (p->break_handler) {
 203                 ap->break_handler = aggr_break_uhandler;
 204         }
 205
 206         INIT_LIST_HEAD(&ap->list);
 207         list_add_rcu(&p->list, &ap->list);
 208
 209         hlist_replace_rcu(&p->hlist, &ap->hlist);
 210 }
 211
 212 /*
 213  * This is the second or subsequent uprobe at the address - handle
 214  * the intricacies
 215  */
 216 static int register_aggr_uprobe(struct kprobe *old_p, struct kprobe *p)
 217 {
 218         int ret = 0;
 219         struct kprobe *ap;
 220
 221         if (old_p->pre_handler == aggr_pre_uhandler) {
 222                 copy_uprobe(old_p, p);
 223                 ret = add_new_uprobe(old_p, p);
 224         } else {
 225                 struct uprobe *uap = kzalloc(sizeof(*uap), GFP_KERNEL);
 226                 if (!uap) {
 227                         return -ENOMEM;
 228                 }
 229
 230                 uap->task = kp2up(p)->task;
 231                 ap = up2kp(uap);
 232                 add_aggr_uprobe(ap, old_p);
 233                 copy_uprobe(ap, p);
 234                 ret = add_new_uprobe(ap, p);
 235         }
 236
 237         return ret;
 238 }
 239
 240 static void arm_uprobe(struct uprobe *p)
 241 {
 242         kprobe_opcode_t insn = BREAKPOINT_INSTRUCTION;
 243         int ret = write_proc_vm_atomic(p->task, (unsigned long)p->kp.addr,
 244                                        &insn, sizeof(insn));
 245         if (!ret) {
 246                 panic("arm_uprobe: failed to write memory "
 247                       "tgid=%u addr=%p!\n", p->task->tgid, p->kp.addr);
 248         }
 249 }
 250
 251 void disarm_uprobe(struct kprobe *p, struct task_struct *task)
 252 {
 253         int ret = write_proc_vm_atomic(task, (unsigned long)p->addr,
 254                                        &p->opcode, sizeof(p->opcode));
 255         if (!ret) {
 256                 panic("disarm_uprobe: failed to write memory "
 257                       "tgid=%u, addr=%p!\n", task->tgid, p->addr);
 258         }
 259 }
 260 EXPORT_SYMBOL_GPL(disarm_uprobe);
 261
 262 static void init_uprobes_insn_slots(void)
 263 {
 264         int i;
 265         for (i = 0; i < UPROBE_TABLE_SIZE; ++i) {
 266                 INIT_HLIST_HEAD(&uprobe_insn_slot_table[i]);
 267         }
 268 }
 269
 270 static void init_uprobe_table(void)
 271 {
 272         int i;
 273         for (i = 0; i < UPROBE_TABLE_SIZE; ++i) {
 274                 INIT_HLIST_HEAD(&uprobe_table[i]);
 275         }
 276 }
 277
 278 static void init_uretprobe_inst_table(void)
 279 {
 280         int i;
 281         for (i = 0; i < UPROBE_TABLE_SIZE; ++i) {
 282                 INIT_HLIST_HEAD (&uretprobe_inst_table[i]);
 283         }
 284 }
 285
 286 struct kprobe *get_ukprobe(void *addr, pid_t tgid)
 287 {
 288         struct hlist_head *head;
 289         struct hlist_node *node;
 290         struct kprobe *p;
 291
 292         head = &uprobe_table[hash_ptr(addr, UPROBE_HASH_BITS)];
 293         swap_hlist_for_each_entry_rcu(p, node, head, hlist) {
 294                 if (p->addr == addr && kp2up(p)->task->tgid == tgid) {
 295                         return p;
 296                 }
 297         }
 298
 299         return NULL;
 300 }
 301
 302 static void add_uprobe_table(struct kprobe *p)
 303 {
 304 #ifdef CONFIG_ARM
 305         INIT_HLIST_NODE(&p->is_hlist_arm);
 306         hlist_add_head_rcu(&p->is_hlist_arm, &uprobe_insn_slot_table[hash_ptr(p->ainsn.insn_arm, UPROBE_HASH_BITS)]);
 307         INIT_HLIST_NODE(&p->is_hlist_thumb);
 308         hlist_add_head_rcu(&p->is_hlist_thumb, &uprobe_insn_slot_table[hash_ptr(p->ainsn.insn_thumb, UPROBE_HASH_BITS)]);
 309 #else /* CONFIG_ARM */
 310         INIT_HLIST_NODE(&p->is_hlist);
 311         hlist_add_head_rcu(&p->is_hlist, &uprobe_insn_slot_table[hash_ptr(p->ainsn.insn, UPROBE_HASH_BITS)]);
 312 #endif /* CONFIG_ARM */
 313 }
 314
 315 #ifdef CONFIG_ARM
 316 static struct kprobe *get_ukprobe_bis_arm(void *addr, pid_t tgid)
 317 {
 318         struct hlist_head *head;
 319         struct hlist_node *node;
 320         struct kprobe *p;
 321
 322         /* TODO: test - two processes invokes instrumented function */
 323         head = &uprobe_insn_slot_table[hash_ptr(addr, UPROBE_HASH_BITS)];
 324         swap_hlist_for_each_entry_rcu(p, node, head, is_hlist_arm) {
 325                 if (p->ainsn.insn == addr && kp2up(p)->task->tgid == tgid) {
 326                         return p;
 327                 }
 328         }
 329
 330         return NULL;
 331 }
 332
 333 static struct kprobe *get_ukprobe_bis_thumb(void *addr, pid_t tgid)
 334 {
 335         struct hlist_head *head;
 336         struct hlist_node *node;
 337         struct kprobe *p;
 338
 339         /* TODO: test - two processes invokes instrumented function */
 340         head = &uprobe_insn_slot_table[hash_ptr(addr, UPROBE_HASH_BITS)];
 341         swap_hlist_for_each_entry_rcu(p, node, head, is_hlist_thumb) {
 342                 if (p->ainsn.insn == addr && kp2up(p)->task->tgid == tgid) {
 343                         return p;
 344                 }
 345         }
 346
 347         return NULL;
 348 }
 349
 350 struct kprobe *get_ukprobe_by_insn_slot(void *addr, pid_t tgid, struct pt_regs *regs)
 351 {
 352         return thumb_mode(regs) ?
 353                         get_ukprobe_bis_thumb(addr - 0x1a, tgid) :
 354                         get_ukprobe_bis_arm(addr - 4 * UPROBES_TRAMP_RET_BREAK_IDX, tgid);
 355 }
 356 #else /* CONFIG_ARM */
 357 struct kprobe *get_ukprobe_by_insn_slot(void *addr, pid_t tgid, struct pt_regs *regs)
 358 {
 359         struct hlist_head *head;
 360         struct hlist_node *node;
 361         struct kprobe *p;
 362
 363         addr -= UPROBES_TRAMP_RET_BREAK_IDX;
 364
 365         /* TODO: test - two processes invokes instrumented function */
 366         head = &uprobe_insn_slot_table[hash_ptr(addr, UPROBE_HASH_BITS)];
 367         swap_hlist_for_each_entry_rcu(p, node, head, is_hlist) {
 368                 if (p->ainsn.insn == addr && kp2up(p)->task->tgid == tgid) {
 369                         return p;
 370                 }
 371         }
 372
 373         return NULL;
 374 }
 375 #endif /* CONFIG_ARM */
 376
 377
 378 static void remove_uprobe(struct uprobe *up)
 379 {
 380         struct kprobe *p = &up->kp;
 381         struct task_struct *task = up->task;
 382
 383 #ifdef CONFIG_ARM
 384         free_insn_slot(up->sm, p->ainsn.insn_arm);
 385         free_insn_slot(up->sm, p->ainsn.insn_thumb);
 386 #else /* CONFIG_ARM */
 387         free_insn_slot(up->sm, p->ainsn.insn);
 388 #endif /* CONFIG_ARM */
 389 }
 390
 391 static struct hlist_head *uretprobe_inst_table_head(void *hash_key)
 392 {
 393         return &uretprobe_inst_table[hash_ptr (hash_key, UPROBE_HASH_BITS)];
 394 }
 395
 396 /* Called with uretprobe_lock held */
 397 static void add_urp_inst(struct uretprobe_instance *ri)
 398 {
 399         /*
 400          * Remove rp inst off the free list -
 401          * Add it back when probed function returns
 402          */
 403         hlist_del(&ri->uflist);
 404
 405         /* Add rp inst onto table */
 406         INIT_HLIST_NODE(&ri->hlist);
 407         hlist_add_head(&ri->hlist, uretprobe_inst_table_head(ri->task->mm));
 408
 409         /* Also add this rp inst to the used list. */
 410         INIT_HLIST_NODE(&ri->uflist);
 411         hlist_add_head(&ri->uflist, &ri->rp->used_instances);
 412 }
 413
 414 /* Called with uretprobe_lock held */
 415 static void recycle_urp_inst(struct uretprobe_instance *ri)
 416 {
 417         if (ri->rp) {
 418                 hlist_del(&ri->hlist);
 419                 /* remove rp inst off the used list */
 420                 hlist_del(&ri->uflist);
 421                 /* put rp inst back onto the free list */
 422                 INIT_HLIST_NODE(&ri->uflist);
 423                 hlist_add_head(&ri->uflist, &ri->rp->free_instances);
 424         }
 425 }
 426
 427 /* Called with uretprobe_lock held */
 428 static struct uretprobe_instance *get_used_urp_inst(struct uretprobe *rp)
 429 {
 430         struct hlist_node *node;
 431         struct uretprobe_instance *ri;
 432
 433         swap_hlist_for_each_entry(ri, node, &rp->used_instances, uflist) {
 434                 return ri;
 435         }
 436
 437         return NULL;
 438 }
 439
 440 /* Called with uretprobe_lock held */
 441 struct uretprobe_instance *get_free_urp_inst_no_alloc(struct uretprobe *rp)
 442 {
 443         struct hlist_node *node;
 444         struct uretprobe_instance *ri;
 445
 446         swap_hlist_for_each_entry(ri, node, &rp->free_instances, uflist) {
 447                 return ri;
 448         }
 449
 450         return NULL;
 451 }
 452
 453 /* Called with uretprobe_lock held */
 454 static void free_urp_inst(struct uretprobe *rp)
 455 {
 456         struct uretprobe_instance *ri;
 457         while ((ri = get_free_urp_inst_no_alloc(rp)) != NULL) {
 458                 hlist_del(&ri->uflist);
 459                 kfree(ri);
 460         }
 461 }
 462
 463 #define COMMON_URP_NR 10
 464
 465 static int alloc_nodes_uretprobe(struct uretprobe *rp)
 466 {
 467         int alloc_nodes;
 468         struct uretprobe_instance *inst;
 469         int i;
 470
 471 #if 1//def CONFIG_PREEMPT
 472         rp->maxactive += max(COMMON_URP_NR, 2 * NR_CPUS);
 473 #else
 474         rp->maxacpptive += NR_CPUS;
 475 #endif
 476         alloc_nodes = COMMON_URP_NR;
 477
 478         for (i = 0; i < alloc_nodes; ++i) {
 479                 inst = kmalloc(sizeof(*inst), GFP_ATOMIC);
 480                 if (inst == NULL) {
 481                         free_urp_inst(rp);
 482                         return -ENOMEM;
 483                 }
 484                 INIT_HLIST_NODE(&inst->uflist);
 485                 hlist_add_head(&inst->uflist, &rp->free_instances);
 486         }
 487
 488         return 0;
 489 }
 490
 491 /* Called with uretprobe_lock held */
 492 static struct uretprobe_instance *get_free_urp_inst(struct uretprobe *rp)
 493 {
 494         struct hlist_node *node;
 495         struct uretprobe_instance *ri;
 496
 497         swap_hlist_for_each_entry(ri, node, &rp->free_instances, uflist) {
 498                 return ri;
 499         }
 500
 501         if (!alloc_nodes_uretprobe(rp)) {
 502                 swap_hlist_for_each_entry(ri, node, &rp->free_instances, uflist) {
 503                         return ri;
 504                 }
 505         }
 506
 507         return NULL;
 508 }
 509 // ===================================================================
 510
 511 int dbi_register_uprobe(struct uprobe *up)
 512 {
 513         int ret = 0;
 514         struct kprobe *p, *old_p;
 515
 516         p = &up->kp;
 517         if (!p->addr) {
 518                 return -EINVAL;
 519         }
 520
 521         DBPRINTF("p->addr = 0x%p p = 0x%p\n", p->addr, p);
 522
 523 // thumb address = address-1;
 524 #if defined(CONFIG_ARM)
 525         // TODO: must be corrected in 'bundle'
 526         if ((unsigned long) p->addr & 0x01) {
 527                 p->addr = (kprobe_opcode_t *)((unsigned long)p->addr & 0xfffffffe);
 528         }
 529 #endif
 530
 531         p->mod_refcounted = 0;
 532         p->nmissed = 0;
 533         INIT_LIST_HEAD(&p->list);
 534 #ifdef KPROBES_PROFILE
 535         p->start_tm.tv_sec = p->start_tm.tv_usec = 0;
 536         p->hnd_tm_sum.tv_sec = p->hnd_tm_sum.tv_usec = 0;
 537         p->count = 0;
 538 #endif
 539
 540         // get the first item
 541         old_p = get_ukprobe(p->addr, kp2up(p)->task->tgid);
 542         if (old_p) {
 543 #ifdef CONFIG_ARM
 544                 p->safe_arm = old_p->safe_arm;
 545                 p->safe_thumb = old_p->safe_thumb;
 546 #endif
 547                 ret = register_aggr_uprobe(old_p, p);
 548                 if (!ret) {
 549 //                      atomic_inc(&kprobe_count);
 550                         add_uprobe_table(p);
 551                 }
 552                 DBPRINTF("goto out\n", ret);
 553                 goto out;
 554         }
 555
 556         ret = arch_prepare_uprobe(up, &uprobe_insn_pages);
 557         if (ret) {
 558                 DBPRINTF("goto out\n", ret);
 559                 goto out;
 560         }
 561
 562         DBPRINTF ("before out ret = 0x%x\n", ret);
 563
 564         // TODO: add uprobe (must be in function)
 565         INIT_HLIST_NODE(&p->hlist);
 566         hlist_add_head_rcu(&p->hlist, &uprobe_table[hash_ptr(p->addr, UPROBE_HASH_BITS)]);
 567         add_uprobe_table(p);
 568         arm_uprobe(up);
 569
 570 out:
 571         DBPRINTF("out ret = 0x%x\n", ret);
 572         return ret;
 573 }
 574
 575 void dbi_unregister_uprobe(struct uprobe *up)
 576 {
 577         struct kprobe *p, *old_p, *list_p;
 578         int cleanup_p;
 579
 580         p = &up->kp;
 581         old_p = get_ukprobe(p->addr, kp2up(p)->task->tgid);
 582         if (unlikely(!old_p)) {
 583                 return;
 584         }
 585
 586         if (p != old_p) {
 587                 list_for_each_entry_rcu(list_p, &old_p->list, list) {
 588                         if (list_p == p) {
 589                                 /* uprobe p is a valid probe */
 590                                 goto valid_p;
 591                         }
 592                 }
 593
 594                 return;
 595         }
 596
 597 valid_p:
 598         if ((old_p == p) || ((old_p->pre_handler == aggr_pre_uhandler) &&
 599             (p->list.next == &old_p->list) && (p->list.prev == &old_p->list))) {
 600                 /* Only probe on the hash list */
 601                 disarm_uprobe(&up->kp, up->task);
 602                 hlist_del_rcu(&old_p->hlist);
 603                 cleanup_p = 1;
 604         } else {
 605                 list_del_rcu(&p->list);
 606                 cleanup_p = 0;
 607         }
 608
 609         if (cleanup_p) {
 610                 if (p != old_p) {
 611                         list_del_rcu(&p->list);
 612                         kfree(old_p);
 613                 }
 614
 615                 if (!in_atomic()) {
 616                         synchronize_sched();
 617                 }
 618
 619                 remove_uprobe(up);
 620         } else {
 621                 if (p->break_handler) {
 622                         old_p->break_handler = NULL;
 623                 }
 624
 625                 if (p->post_handler) {
 626                         list_for_each_entry_rcu (list_p, &old_p->list, list) {
 627                                 if (list_p->post_handler) {
 628                                         cleanup_p = 2;
 629                                         break;
 630                                 }
 631                         }
 632
 633                         if (cleanup_p == 0) {
 634                                 old_p->post_handler = NULL;
 635                         }
 636                 }
 637         }
 638 }
 639
 640 int dbi_register_ujprobe(struct ujprobe *jp)
 641 {
 642         int ret = 0;
 643
 644         /* Todo: Verify probepoint is a function entry point */
 645         jp->up.kp.pre_handler = setjmp_upre_handler;
 646         jp->up.kp.break_handler = longjmp_break_uhandler;
 647
 648         ret = dbi_register_uprobe(&jp->up);
 649
 650         return ret;
 651 }
 652
 653 void dbi_unregister_ujprobe(struct ujprobe *jp)
 654 {
 655         dbi_unregister_uprobe(&jp->up);
 656         /*
 657          * Here is an attempt to unregister even those probes that have not been
 658          * installed (hence not added to the hlist).
 659          * So if we try to delete them from the hlist we will get NULL pointer
 660          * dereference error. That is why we check whether this node
 661          * really belongs to the hlist.
 662          */
 663 #ifdef CONFIG_ARM
 664         if (!(hlist_unhashed(&jp->up.kp.is_hlist_arm))) {
 665                 hlist_del_rcu(&jp->up.kp.is_hlist_arm);
 666         }
 667         if (!(hlist_unhashed(&jp->up.kp.is_hlist_thumb))) {
 668                 hlist_del_rcu(&jp->up.kp.is_hlist_thumb);
 669         }
 670 #else /* CONFIG_ARM */
 671         if (!(hlist_unhashed(&jp->up.kp.is_hlist))) {
 672                 hlist_del_rcu(&jp->up.kp.is_hlist);
 673         }
 674 #endif /* CONFIG_ARM */
 675 }
 676
 677 int trampoline_uprobe_handler(struct kprobe *p, struct pt_regs *regs)
 678 {
 679         struct uretprobe_instance *ri = NULL;
 680         struct hlist_head *head;
 681         struct hlist_node *node, *tmp;
 682         unsigned long flags, tramp_addr, orig_ret_addr = 0;
 683
 684         tramp_addr = arch_get_trampoline_addr(p, regs);
 685         spin_lock_irqsave(&uretprobe_lock, flags);
 686
 687         head = uretprobe_inst_table_head(current->mm);
 688
 689         /*
 690          * It is possible to have multiple instances associated with a given
 691          * task either because an multiple functions in the call path
 692          * have a return probe installed on them, and/or more then one
 693          * return probe was registered for a target function.
 694          *
 695          * We can handle this because:
 696          *     - instances are always inserted at the head of the list
 697          *     - when multiple return probes are registered for the same
 698          *       function, the first instance's ret_addr will point to the
 699          *       real return address, and all the rest will point to
 700          *       uretprobe_trampoline
 701          */
 702         swap_hlist_for_each_entry_safe(ri, node, tmp, head, hlist) {
 703                 if (ri->task != current) {
 704                         /* another task is sharing our hash bucket */
 705                         continue;
 706                 }
 707
 708                 if (ri->rp && ri->rp->handler) {
 709                         ri->rp->handler(ri, regs, ri->rp->priv_arg);
 710                 }
 711
 712                 orig_ret_addr = (unsigned long)ri->ret_addr;
 713                 recycle_urp_inst(ri);
 714
 715                 if (orig_ret_addr != tramp_addr) {
 716                         /*
 717                          * This is the real return address. Any other
 718                          * instances associated with this task are for
 719                          * other calls deeper on the call stack
 720                          */
 721                         break;
 722                 }
 723         }
 724
 725         spin_unlock_irqrestore(&uretprobe_lock, flags);
 726         arch_set_orig_ret_addr(orig_ret_addr, regs);
 727
 728         return 1;
 729 }
 730
 731 static int pre_handler_uretprobe(struct kprobe *p, struct pt_regs *regs)
 732 {
 733         struct uprobe *up = container_of(p, struct uprobe, kp);
 734         struct uretprobe *rp = container_of(up, struct uretprobe, up);
 735         struct uretprobe_instance *ri;
 736         unsigned long flags;
 737
 738         /* TODO: consider to only swap the RA after the last pre_handler fired */
 739         spin_lock_irqsave(&uretprobe_lock, flags);
 740
 741         /* TODO: test - remove retprobe after func entry but before its exit */
 742         if ((ri = get_free_urp_inst(rp)) != NULL) {
 743                 ri->rp = rp;
 744                 ri->task = current;
 745
 746                 arch_prepare_uretprobe(ri, regs);
 747
 748                 add_urp_inst(ri);
 749         } else {
 750                 ++rp->nmissed;
 751         }
 752
 753         spin_unlock_irqrestore(&uretprobe_lock, flags);
 754
 755         return 0;
 756 }
 757
 758 int dbi_register_uretprobe(struct uretprobe *rp)
 759 {
 760         int i, ret = 0;
 761         struct uretprobe_instance *inst;
 762
 763         DBPRINTF ("START\n");
 764
 765         rp->up.kp.pre_handler = NULL;
 766         rp->up.kp.post_handler = NULL;
 767         rp->up.kp.fault_handler = NULL;
 768         rp->up.kp.break_handler = NULL;
 769
 770         /* Establish function entry probe point */
 771         ret = dbi_register_uprobe(&rp->up);
 772         if (ret)
 773                 return ret;
 774
 775         ret = arch_opcode_analysis_uretprobe(rp->up.kp.opcode);
 776         if (ret)
 777                 goto unregister;
 778
 779         /* Pre-allocate memory for max kretprobe instances */
 780         if (rp->maxactive <= 0) {
 781 #if 1//def CONFIG_PREEMPT
 782                 rp->maxactive = max(10, 2 * NR_CPUS);
 783 #else
 784                 rp->maxactive = NR_CPUS;
 785 #endif
 786         }
 787
 788         INIT_HLIST_HEAD(&rp->used_instances);
 789         INIT_HLIST_HEAD(&rp->free_instances);
 790
 791         for (i = 0; i < rp->maxactive; i++) {
 792                 inst = kmalloc(sizeof(*inst), GFP_KERNEL);
 793                 if (inst == NULL) {
 794                         free_urp_inst(rp);
 795                         ret = -ENOMEM;
 796                         goto unregister;
 797                 }
 798
 799                 INIT_HLIST_NODE(&inst->uflist);
 800                 hlist_add_head(&inst->uflist, &rp->free_instances);
 801         }
 802
 803         rp->nmissed = 0;
 804         rp->up.kp.pre_handler = pre_handler_uretprobe;
 805
 806         return 0;
 807
 808 unregister:
 809         dbi_unregister_uprobe(&rp->up);
 810         return ret;
 811 }
 812
 813 int dbi_disarm_urp_inst(struct uretprobe_instance *ri, struct task_struct *rm_task)
 814 {
 815         struct task_struct *task = rm_task ? rm_task : ri->task;
 816         unsigned long *tramp;
 817         unsigned long *sp = (unsigned long *)((long)ri->sp & ~1);
 818         unsigned long *stack = sp - RETPROBE_STACK_DEPTH + 1;
 819         unsigned long *found = NULL;
 820         unsigned long *buf[RETPROBE_STACK_DEPTH];
 821         int i, retval;
 822
 823         /* Understand function mode */
 824         if ((long)ri->sp & 1) {
 825                 tramp = (unsigned long *)
 826                         ((unsigned long)ri->rp->up.kp.ainsn.insn + 0x1b);
 827         } else {
 828                 tramp = (unsigned long *)
 829                         (ri->rp->up.kp.ainsn.insn + UPROBES_TRAMP_RET_BREAK_IDX);
 830         }
 831
 832         retval = read_proc_vm_atomic(task, (unsigned long)stack, buf, sizeof(buf));
 833         if (retval != sizeof(buf)) {
 834                 printk("---> %s (%d/%d): failed to read stack from %08lx",
 835                         task->comm, task->tgid, task->pid, (unsigned long)stack);
 836                 retval = -EFAULT;
 837                 goto out;
 838         }
 839
 840         /* search the stack from the bottom */
 841         for (i = RETPROBE_STACK_DEPTH - 1; i >= 0; i--) {
 842                 if (buf[i] == tramp) {
 843                         found = stack + i;
 844                         break;
 845                 }
 846         }
 847
 848         if (found) {
 849                 printk("---> %s (%d/%d): trampoline found at %08lx (%08lx /%+d) - %p\n",
 850                                 task->comm, task->tgid, task->pid,
 851                                 (unsigned long)found, (unsigned long)sp,
 852                                 found - sp, ri->rp->up.kp.addr);
 853                 retval = write_proc_vm_atomic(task, (unsigned long)found, &ri->ret_addr,
 854                                 sizeof(ri->ret_addr));
 855                 if (retval != sizeof(ri->ret_addr)) {
 856                         printk("---> %s (%d/%d): failed to write value to %08lx",
 857                                 task->comm, task->tgid, task->pid, (unsigned long)found);
 858                         retval = -EFAULT;
 859                 } else {
 860                         retval = 0;
 861                 }
 862         } else {
 863                 struct pt_regs *uregs = task_pt_regs(ri->task);
 864                 unsigned long ra = dbi_get_ret_addr(uregs);
 865                 if (ra == (unsigned long)tramp) {
 866                         printk("---> %s (%d/%d): trampoline found at lr = %08lx - %p\n",
 867                                         task->comm, task->tgid, task->pid, ra, ri->rp->up.kp.addr);
 868                         dbi_set_ret_addr(uregs, (unsigned long)tramp);
 869                         retval = 0;
 870                 } else {
 871                         printk("---> %s (%d/%d): trampoline NOT found at sp = %08lx, lr = %08lx - %p\n",
 872                                         task->comm, task->tgid, task->pid,
 873                                         (unsigned long)sp, ra, ri->rp->up.kp.addr);
 874                         retval = -ENOENT;
 875                 }
 876         }
 877
 878 out:
 879         return retval;
 880 }
 881
 882 /* Called with uretprobe_lock held */
 883 int dbi_disarm_urp_inst_for_task(struct task_struct *parent, struct task_struct *task)
 884 {
 885         struct uretprobe_instance *ri;
 886         struct hlist_node *node, *tmp;
 887         struct hlist_head *head = uretprobe_inst_table_head(parent->mm);
 888
 889         swap_hlist_for_each_entry_safe(ri, node, tmp, head, hlist) {
 890                 if (parent == ri->task) {
 891                         dbi_disarm_urp_inst(ri, task);
 892                 }
 893         }
 894
 895         return 0;
 896 }
 897 EXPORT_SYMBOL_GPL(dbi_disarm_urp_inst_for_task);
 898
 899 void dbi_unregister_uretprobe(struct uretprobe *rp)
 900 {
 901         unsigned long flags;
 902         struct uretprobe_instance *ri;
 903
 904         spin_lock_irqsave (&uretprobe_lock, flags);
 905
 906         while ((ri = get_used_urp_inst(rp)) != NULL) {
 907                 if (dbi_disarm_urp_inst(ri, NULL) != 0)
 908                         /*panic*/printk("%s (%d/%d): cannot disarm urp instance (%08lx)\n",
 909                                         ri->task->comm, ri->task->tgid, ri->task->pid,
 910                                         (unsigned long)rp->up.kp.addr);
 911                 recycle_urp_inst(ri);
 912         }
 913
 914         if (hlist_empty(&rp->used_instances)) {
 915                 struct kprobe *p = &rp->up.kp;
 916 #ifdef CONFIG_ARM
 917                 if (!(hlist_unhashed(&p->is_hlist_arm))) {
 918                         hlist_del_rcu(&p->is_hlist_arm);
 919                 }
 920
 921                 if (!(hlist_unhashed(&p->is_hlist_thumb))) {
 922                         hlist_del_rcu(&p->is_hlist_thumb);
 923                 }
 924 #else /* CONFIG_ARM */
 925                 if (!(hlist_unhashed(&p->is_hlist))) {
 926                         hlist_del_rcu(&p->is_hlist);
 927                 }
 928 #endif /* CONFIG_ARM */
 929         }
 930
 931         while ((ri = get_used_urp_inst(rp)) != NULL) {
 932                 ri->rp = NULL;
 933                 hlist_del(&ri->uflist);
 934         }
 935
 936         spin_unlock_irqrestore(&uretprobe_lock, flags);
 937         free_urp_inst(rp);
 938
 939         dbi_unregister_uprobe(&rp->up);
 940 }
 941
 942 void dbi_unregister_all_uprobes(struct task_struct *task)
 943 {
 944         struct hlist_head *head;
 945         struct hlist_node *node, *tnode;
 946         struct kprobe *p;
 947         int i;
 948
 949         for (i = 0; i < UPROBE_TABLE_SIZE; ++i) {
 950                 head = &uprobe_table[i];
 951                 swap_hlist_for_each_entry_safe(p, node, tnode, head, hlist) {
 952                         if (kp2up(p)->task->tgid == task->tgid) {
 953                                 struct uprobe *up = container_of(p, struct uprobe, kp);
 954                                 printk("dbi_unregister_all_uprobes: delete uprobe at %p[%lx] for %s/%d\n",
 955                                                 p->addr, (unsigned long)p->opcode, task->comm, task->pid);
 956                                 dbi_unregister_uprobe(up);
 957                         }
 958                 }
 959         }
 960 }
 961
 962 void swap_ujprobe_return(void)
 963 {
 964         arch_ujprobe_return();
 965 }
 966 EXPORT_SYMBOL_GPL(swap_ujprobe_return);
 967
 968 static int __init init_uprobes(void)
 969 {
 970         init_uprobe_table();
 971         init_uprobes_insn_slots();
 972         init_uretprobe_inst_table();
 973
 974         return swap_arch_init_uprobes();
 975 }
 976
 977 static void __exit exit_uprobes(void)
 978 {
 979         swap_arch_exit_uprobes();
 980 }
 981
 982 EXPORT_SYMBOL_GPL(dbi_register_ujprobe);
 983 EXPORT_SYMBOL_GPL(dbi_unregister_ujprobe);
 984 EXPORT_SYMBOL_GPL(dbi_register_uretprobe);
 985 EXPORT_SYMBOL_GPL(dbi_unregister_uretprobe);
 986 EXPORT_SYMBOL_GPL(dbi_unregister_all_uprobes);
 987
 988 module_init(init_uprobes);
 989 module_exit(exit_uprobes);
 990
 991 MODULE_LICENSE ("GPL");