uprobe/swap_uprobes.c

   1 /*
   2  *  Dynamic Binary Instrumentation Module based on KProbes
   3  *  modules/kprobe/dbi_uprobes.h
   4  *
   5  * This program is free software; you can redistribute it and/or modify
   6  * it under the terms of the GNU General Public License as published by
   7  * the Free Software Foundation; either version 2 of the License, or
   8  * (at your option) any later version.
   9  *
  10  * This program is distributed in the hope that it will be useful,
  11  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  12  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  13  * GNU General Public License for more details.
  14  *
  15  * You should have received a copy of the GNU General Public License
  16  * along with this program; if not, write to the Free Software
  17  * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
  18  *
  19  * Copyright (C) Samsung Electronics, 2006-2010
  20  *
  21  * 2008-2009    Alexey Gerenkov <a.gerenkov@samsung.com> User-Space
  22  *              Probes initial implementation; Support x86/ARM/MIPS for both user and kernel spaces.
  23  * 2010         Ekaterina Gorelkina <e.gorelkina@samsung.com>: redesign module for separating core and arch parts
  24  *
  25  */
  26
  27
  28 #include "swap_uprobes.h"
  29 #include "dbi_kdebug.h"
  30
  31 #include <asm/swap_uprobes.h>
  32
  33 #include <linux/hash.h>
  34 #include <linux/mempolicy.h>
  35 #include <linux/module.h>
  36 #include <dbi_insn_slots.h>
  37
  38 enum {
  39         UPROBE_HASH_BITS  = 10,
  40         UPROBE_TABLE_SIZE = (1 << UPROBE_HASH_BITS)
  41 };
  42
  43 struct hlist_head uprobe_insn_slot_table[UPROBE_TABLE_SIZE];
  44 struct hlist_head uprobe_table[UPROBE_TABLE_SIZE];
  45 struct hlist_head uprobe_insn_pages;
  46
  47 DEFINE_SPINLOCK(uretprobe_lock);        /* Protects uretprobe_inst_table */
  48 static struct hlist_head uretprobe_inst_table[UPROBE_TABLE_SIZE];
  49
  50 #define DEBUG_PRINT_HASH_TABLE 0
  51
  52 #if DEBUG_PRINT_HASH_TABLE
  53 void print_kprobe_hash_table(void)
  54 {
  55         int i;
  56         struct hlist_head *head;
  57         struct hlist_node *node;
  58         struct kprobe *p;
  59
  60         // print uprobe table
  61         for (i = 0; i < KPROBE_TABLE_SIZE; ++i) {
  62                 head = &kprobe_table[i];
  63                 hlist_for_each_entry_rcu (p, node, head, is_hlist_arm) {
  64                         printk("####### find K tgid=%u, addr=%x\n",
  65                                         p->tgid, p->addr);
  66                 }
  67         }
  68 }
  69
  70 void print_kretprobe_hash_table(void)
  71 {
  72         int i;
  73         struct hlist_head *head;
  74         struct hlist_node *node;
  75         struct kprobe *p;
  76
  77         // print uprobe table
  78         for (i = 0; i < KPROBE_TABLE_SIZE; ++i) {
  79                 head = &kretprobe_inst_table[i];
  80                 hlist_for_each_entry_rcu (p, node, head, is_hlist_arm) {
  81                         printk("####### find KR tgid=%u, addr=%x\n",
  82                                         p->tgid, p->addr);
  83                 }
  84         }
  85 }
  86
  87 void print_uprobe_hash_table(void)
  88 {
  89         int i;
  90         struct hlist_head *head;
  91         struct hlist_node *node;
  92         struct kprobe *p;
  93
  94         // print uprobe table
  95         for (i = 0; i < UPROBE_TABLE_SIZE; ++i) {
  96                 head = &uprobe_insn_slot_table[i];
  97                 hlist_for_each_entry_rcu (p, node, head, is_hlist_arm) {
  98                         printk("####### find U tgid=%u, addr=%x\n",
  99                                         p->tgid, p->addr);
 100                 }
 101         }
 102 }
 103 #endif
 104
 105 /*
 106  * Keep all fields in the uprobe consistent
 107  */
 108 static inline void copy_uprobe(struct kprobe *old_p, struct kprobe *p)
 109 {
 110         memcpy(&p->opcode, &old_p->opcode, sizeof(kprobe_opcode_t));
 111         memcpy(&p->ainsn, &old_p->ainsn, sizeof(struct arch_specific_insn));
 112         p->tgid = old_p->tgid;
 113         p->ss_addr = old_p->ss_addr;
 114 #ifdef CONFIG_ARM
 115         p->safe_arm = old_p->safe_arm;
 116         p->safe_thumb = old_p->safe_thumb;
 117 #endif
 118 }
 119
 120 /*
 121  * Aggregate handlers for multiple uprobes support - these handlers
 122  * take care of invoking the individual uprobe handlers on p->list
 123  */
 124 static int aggr_pre_uhandler(struct kprobe *p, struct pt_regs *regs)
 125 {
 126         struct kprobe *kp;
 127         int ret;
 128
 129         list_for_each_entry_rcu(kp, &p->list, list) {
 130                 if (kp->pre_handler) {
 131                         ret = kp->pre_handler(kp, regs);
 132                         if (ret) {
 133                                 return ret;
 134                         }
 135                 }
 136         }
 137
 138         return 0;
 139 }
 140
 141 static void aggr_post_uhandler(struct kprobe *p, struct pt_regs *regs, unsigned long flags)
 142 {
 143         struct kprobe *kp;
 144
 145         list_for_each_entry_rcu(kp, &p->list, list) {
 146                 if (kp->post_handler) {
 147                         kp->post_handler(kp, regs, flags);
 148                 }
 149         }
 150 }
 151
 152 static int aggr_fault_uhandler(struct kprobe *p, struct pt_regs *regs, int trapnr)
 153 {
 154         return 0;
 155 }
 156
 157 static int aggr_break_uhandler(struct kprobe *p, struct pt_regs *regs)
 158 {
 159         return 0;
 160 }
 161
 162 /*
 163  * Add the new probe to old_p->list. Fail if this is the
 164  * second ujprobe at the address - two ujprobes can't coexist
 165  */
 166 static int add_new_uprobe(struct kprobe *old_p, struct kprobe *p)
 167 {
 168         if (p->break_handler) {
 169                 if (old_p->break_handler) {
 170                         return -EEXIST;
 171                 }
 172
 173                 list_add_tail_rcu(&p->list, &old_p->list);
 174                 old_p->break_handler = aggr_break_uhandler;
 175         } else {
 176                 list_add_rcu (&p->list, &old_p->list);
 177         }
 178
 179         if (p->post_handler && !old_p->post_handler) {
 180                 old_p->post_handler = aggr_post_uhandler;
 181         }
 182
 183         return 0;
 184 }
 185
 186 /*
 187  * Fill in the required fields of the "manager uprobe". Replace the
 188  * earlier uprobe in the hlist with the manager uprobe
 189  */
 190 static inline void add_aggr_uprobe(struct kprobe *ap, struct kprobe *p)
 191 {
 192         copy_uprobe(p, ap);
 193
 194         ap->addr = p->addr;
 195         ap->pre_handler = aggr_pre_uhandler;
 196         ap->fault_handler = aggr_fault_uhandler;
 197
 198         if (p->post_handler) {
 199                 ap->post_handler = aggr_post_uhandler;
 200         }
 201
 202         if (p->break_handler) {
 203                 ap->break_handler = aggr_break_uhandler;
 204         }
 205
 206         INIT_LIST_HEAD(&ap->list);
 207         list_add_rcu(&p->list, &ap->list);
 208
 209         hlist_replace_rcu(&p->hlist, &ap->hlist);
 210 }
 211
 212 /*
 213  * This is the second or subsequent uprobe at the address - handle
 214  * the intricacies
 215  */
 216 static int register_aggr_uprobe(struct kprobe *old_p, struct kprobe *p)
 217 {
 218         int ret = 0;
 219         struct kprobe *ap;
 220
 221         if (old_p->pre_handler == aggr_pre_uhandler) {
 222                 copy_uprobe(old_p, p);
 223                 ret = add_new_uprobe(old_p, p);
 224         } else {
 225                 struct uprobe *uap = kzalloc(sizeof(*uap), GFP_KERNEL);
 226                 if (!uap) {
 227                         return -ENOMEM;
 228                 }
 229
 230                 uap->task = kp2up(p)->task;
 231                 ap = up2kp(uap);
 232                 add_aggr_uprobe(ap, old_p);
 233                 copy_uprobe(ap, p);
 234                 ret = add_new_uprobe(ap, p);
 235         }
 236
 237         return ret;
 238 }
 239
 240 static void arm_uprobe(struct uprobe *p)
 241 {
 242         kprobe_opcode_t insn = BREAKPOINT_INSTRUCTION;
 243         int ret = write_proc_vm_atomic(p->task, (unsigned long)p->kp.addr,
 244                                        &insn, sizeof(insn));
 245         if (!ret) {
 246                 panic("arm_uprobe: failed to write memory "
 247                       "tgid=%u addr=%p!\n", p->task->tgid, p->kp.addr);
 248         }
 249 }
 250
 251 void disarm_uprobe(struct uprobe *p)
 252 {
 253         int ret = write_proc_vm_atomic(p->task, (unsigned long)p->kp.addr,
 254                                        &p->kp.opcode, sizeof(p->kp.opcode));
 255         if (!ret) {
 256                 panic("disarm_uprobe: failed to write memory "
 257                       "tgid=%u, addr=%p!\n", p->task->tgid, p->kp.addr);
 258         }
 259 }
 260 EXPORT_SYMBOL_GPL(disarm_uprobe);
 261
 262 static void init_uprobes_insn_slots(void)
 263 {
 264         int i;
 265         for (i = 0; i < UPROBE_TABLE_SIZE; ++i) {
 266                 INIT_HLIST_HEAD(&uprobe_insn_slot_table[i]);
 267         }
 268 }
 269
 270 static void init_uprobe_table(void)
 271 {
 272         int i;
 273         for (i = 0; i < UPROBE_TABLE_SIZE; ++i) {
 274                 INIT_HLIST_HEAD(&uprobe_table[i]);
 275         }
 276 }
 277
 278 static void init_uretprobe_inst_table(void)
 279 {
 280         int i;
 281         for (i = 0; i < UPROBE_TABLE_SIZE; ++i) {
 282                 INIT_HLIST_HEAD (&uretprobe_inst_table[i]);
 283         }
 284 }
 285
 286 struct kprobe *get_ukprobe(void *addr, pid_t tgid)
 287 {
 288         struct hlist_head *head;
 289         struct hlist_node *node;
 290         struct kprobe *p;
 291
 292         head = &uprobe_table[hash_ptr(addr, UPROBE_HASH_BITS)];
 293         hlist_for_each_entry_rcu(p, node, head, hlist) {
 294                 if (p->addr == addr && kp2up(p)->task->tgid == tgid) {
 295                         return p;
 296                 }
 297         }
 298
 299         return NULL;
 300 }
 301
 302 static void add_uprobe_table(struct kprobe *p)
 303 {
 304 #ifdef CONFIG_ARM
 305         INIT_HLIST_NODE(&p->is_hlist_arm);
 306         hlist_add_head_rcu(&p->is_hlist_arm, &uprobe_insn_slot_table[hash_ptr(p->ainsn.insn_arm, UPROBE_HASH_BITS)]);
 307         INIT_HLIST_NODE(&p->is_hlist_thumb);
 308         hlist_add_head_rcu(&p->is_hlist_thumb, &uprobe_insn_slot_table[hash_ptr(p->ainsn.insn_thumb, UPROBE_HASH_BITS)]);
 309 #else /* CONFIG_ARM */
 310         INIT_HLIST_NODE(&p->is_hlist);
 311         hlist_add_head_rcu(&p->is_hlist, &uprobe_insn_slot_table[hash_ptr(p->ainsn.insn, UPROBE_HASH_BITS)]);
 312 #endif /* CONFIG_ARM */
 313 }
 314
 315 #ifdef CONFIG_ARM
 316 static struct kprobe *get_ukprobe_bis_arm(void *addr, pid_t tgid)
 317 {
 318         struct hlist_head *head;
 319         struct hlist_node *node;
 320         struct kprobe *p;
 321
 322         /* TODO: test - two processes invokes instrumented function */
 323         head = &uprobe_insn_slot_table[hash_ptr(addr, UPROBE_HASH_BITS)];
 324         hlist_for_each_entry_rcu(p, node, head, is_hlist_arm) {
 325                 if (p->ainsn.insn == addr && kp2up(p)->task->tgid == tgid) {
 326                         return p;
 327                 }
 328         }
 329
 330         return NULL;
 331 }
 332
 333 static struct kprobe *get_ukprobe_bis_thumb(void *addr, pid_t tgid)
 334 {
 335         struct hlist_head *head;
 336         struct hlist_node *node;
 337         struct kprobe *p;
 338
 339         /* TODO: test - two processes invokes instrumented function */
 340         head = &uprobe_insn_slot_table[hash_ptr(addr, UPROBE_HASH_BITS)];
 341         hlist_for_each_entry_rcu(p, node, head, is_hlist_thumb) {
 342                 if (p->ainsn.insn == addr && kp2up(p)->task->tgid == tgid) {
 343                         return p;
 344                 }
 345         }
 346
 347         return NULL;
 348 }
 349
 350 struct kprobe *get_ukprobe_by_insn_slot(void *addr, pid_t tgid, struct pt_regs *regs)
 351 {
 352         return thumb_mode(regs) ?
 353                         get_ukprobe_bis_thumb(addr - 0x1a, tgid) :
 354                         get_ukprobe_bis_arm(addr - 4 * UPROBES_TRAMP_RET_BREAK_IDX, tgid);
 355 }
 356 #else /* CONFIG_ARM */
 357 struct kprobe *get_ukprobe_by_insn_slot(void *addr, pid_t tgid, struct pt_regs *regs)
 358 {
 359         struct hlist_head *head;
 360         struct hlist_node *node;
 361         struct kprobe *p;
 362
 363         /* TODO: test - two processes invokes instrumented function */
 364         head = &uprobe_insn_slot_table[hash_ptr(addr, UPROBE_HASH_BITS)];
 365         hlist_for_each_entry_rcu(p, node, head, is_hlist) {
 366                 if (p->ainsn.insn == addr && kp2up(p)->task->tgid == tgid) {
 367                         return p;
 368                 }
 369         }
 370
 371         return NULL;
 372 }
 373 #endif /* CONFIG_ARM */
 374
 375
 376 static void remove_uprobe(struct uprobe *up)
 377 {
 378         struct kprobe *p = &up->kp;
 379         struct task_struct *task = up->task;
 380
 381         if (p->tgid == 0) {
 382                 panic("remove_uprobe for tgid == 0!!!");
 383         }
 384
 385 #ifdef CONFIG_ARM
 386         free_insn_slot(&uprobe_insn_pages, task, p->ainsn.insn_arm);
 387         free_insn_slot(&uprobe_insn_pages, task, p->ainsn.insn_thumb);
 388 #else /* CONFIG_ARM */
 389         free_insn_slot(&uprobe_insn_pages, task, p->ainsn.insn);
 390 #endif /* CONFIG_ARM */
 391 }
 392
 393 static struct hlist_head *uretprobe_inst_table_head(void *hash_key)
 394 {
 395         return &uretprobe_inst_table[hash_ptr (hash_key, UPROBE_HASH_BITS)];
 396 }
 397
 398 /* Called with uretprobe_lock held */
 399 static void add_urp_inst(struct uretprobe_instance *ri)
 400 {
 401         /*
 402          * Remove rp inst off the free list -
 403          * Add it back when probed function returns
 404          */
 405         hlist_del(&ri->uflist);
 406
 407         /* Add rp inst onto table */
 408         INIT_HLIST_NODE(&ri->hlist);
 409         hlist_add_head(&ri->hlist, uretprobe_inst_table_head(ri->task->mm));
 410
 411         /* Also add this rp inst to the used list. */
 412         INIT_HLIST_NODE(&ri->uflist);
 413         hlist_add_head(&ri->uflist, &ri->rp->used_instances);
 414 }
 415
 416 /* Called with uretprobe_lock held */
 417 static void recycle_urp_inst(struct uretprobe_instance *ri)
 418 {
 419         if (ri->rp) {
 420                 hlist_del(&ri->hlist);
 421                 /* remove rp inst off the used list */
 422                 hlist_del(&ri->uflist);
 423                 /* put rp inst back onto the free list */
 424                 INIT_HLIST_NODE(&ri->uflist);
 425                 hlist_add_head(&ri->uflist, &ri->rp->free_instances);
 426         }
 427 }
 428
 429 /* Called with uretprobe_lock held */
 430 static struct uretprobe_instance *get_used_urp_inst(struct uretprobe *rp)
 431 {
 432         struct hlist_node *node;
 433         struct uretprobe_instance *ri;
 434
 435         hlist_for_each_entry(ri, node, &rp->used_instances, uflist) {
 436                 return ri;
 437         }
 438
 439         return NULL;
 440 }
 441
 442 /* Called with uretprobe_lock held */
 443 struct uretprobe_instance *get_free_urp_inst_no_alloc(struct uretprobe *rp)
 444 {
 445         struct hlist_node *node;
 446         struct uretprobe_instance *ri;
 447
 448         hlist_for_each_entry (ri, node, &rp->free_instances, uflist) {
 449                 return ri;
 450         }
 451
 452         return NULL;
 453 }
 454
 455 /* Called with uretprobe_lock held */
 456 static void free_urp_inst(struct uretprobe *rp)
 457 {
 458         struct uretprobe_instance *ri;
 459         while ((ri = get_free_urp_inst_no_alloc(rp)) != NULL) {
 460                 hlist_del(&ri->uflist);
 461                 kfree(ri);
 462         }
 463 }
 464
 465 #define COMMON_URP_NR 10
 466
 467 static int alloc_nodes_uretprobe(struct uretprobe *rp)
 468 {
 469         int alloc_nodes;
 470         struct uretprobe_instance *inst;
 471         int i;
 472
 473 #if 1//def CONFIG_PREEMPT
 474         rp->maxactive += max(COMMON_URP_NR, 2 * NR_CPUS);
 475 #else
 476         rp->maxacpptive += NR_CPUS;
 477 #endif
 478         alloc_nodes = COMMON_URP_NR;
 479
 480         for (i = 0; i < alloc_nodes; ++i) {
 481                 inst = kmalloc(sizeof(*inst), GFP_ATOMIC);
 482                 if (inst == NULL) {
 483                         free_urp_inst(rp);
 484                         return -ENOMEM;
 485                 }
 486                 INIT_HLIST_NODE(&inst->uflist);
 487                 hlist_add_head(&inst->uflist, &rp->free_instances);
 488         }
 489
 490         return 0;
 491 }
 492
 493 /* Called with uretprobe_lock held */
 494 static struct uretprobe_instance *get_free_urp_inst(struct uretprobe *rp)
 495 {
 496         struct hlist_node *node;
 497         struct uretprobe_instance *ri;
 498
 499         hlist_for_each_entry(ri, node, &rp->free_instances, uflist) {
 500                 return ri;
 501         }
 502
 503         if (!alloc_nodes_uretprobe(rp)) {
 504                 hlist_for_each_entry(ri, node, &rp->free_instances, uflist) {
 505                         return ri;
 506                 }
 507         }
 508
 509         return NULL;
 510 }
 511 // ===================================================================
 512
 513 int dbi_register_uprobe(struct uprobe *up, int atomic)
 514 {
 515         int ret = 0;
 516         struct kprobe *p, *old_p;
 517
 518         p = &up->kp;
 519         if (!p->addr) {
 520                 return -EINVAL;
 521         }
 522
 523         DBPRINTF("p->addr = 0x%p p = 0x%p\n", p->addr, p);
 524
 525 // thumb address = address-1;
 526 #if defined(CONFIG_ARM)
 527         // TODO: must be corrected in 'bundle'
 528         if ((unsigned long) p->addr & 0x01) {
 529                 p->addr = (kprobe_opcode_t *)((unsigned long)p->addr & 0xfffffffe);
 530         }
 531 #endif
 532
 533         p->mod_refcounted = 0;
 534         p->nmissed = 0;
 535         INIT_LIST_HEAD(&p->list);
 536 #ifdef KPROBES_PROFILE
 537         p->start_tm.tv_sec = p->start_tm.tv_usec = 0;
 538         p->hnd_tm_sum.tv_sec = p->hnd_tm_sum.tv_usec = 0;
 539         p->count = 0;
 540 #endif
 541
 542         // get the first item
 543         old_p = get_ukprobe(p->addr, p->tgid);
 544         if (old_p) {
 545 #ifdef CONFIG_ARM
 546                 p->safe_arm = old_p->safe_arm;
 547                 p->safe_thumb = old_p->safe_thumb;
 548 #endif
 549                 ret = register_aggr_uprobe(old_p, p);
 550                 if (!ret) {
 551 //                      atomic_inc(&kprobe_count);
 552                         add_uprobe_table(p);
 553                 }
 554                 DBPRINTF("goto out\n", ret);
 555                 goto out;
 556         }
 557
 558         ret = arch_prepare_uprobe(up, atomic);
 559         if (ret) {
 560                 DBPRINTF("goto out\n", ret);
 561                 goto out;
 562         }
 563
 564         DBPRINTF ("before out ret = 0x%x\n", ret);
 565
 566         // TODO: add uprobe (must be in function)
 567         INIT_HLIST_NODE(&p->hlist);
 568         hlist_add_head_rcu(&p->hlist, &uprobe_table[hash_ptr(p->addr, UPROBE_HASH_BITS)]);
 569         add_uprobe_table(p);
 570         arm_uprobe(up);
 571
 572 out:
 573         DBPRINTF("out ret = 0x%x\n", ret);
 574         return ret;
 575 }
 576
 577 void dbi_unregister_uprobe(struct uprobe *up, int atomic)
 578 {
 579         struct kprobe *p, *old_p, *list_p;
 580         int cleanup_p;
 581
 582         p = &up->kp;
 583         old_p = get_ukprobe(p->addr, p->tgid);
 584         if (unlikely(!old_p)) {
 585                 return;
 586         }
 587
 588         if (p != old_p) {
 589                 list_for_each_entry_rcu(list_p, &old_p->list, list) {
 590                         if (list_p == p) {
 591                                 /* uprobe p is a valid probe */
 592                                 goto valid_p;
 593                         }
 594                 }
 595
 596                 return;
 597         }
 598
 599 valid_p:
 600         if ((old_p == p) || ((old_p->pre_handler == aggr_pre_uhandler) &&
 601             (p->list.next == &old_p->list) && (p->list.prev == &old_p->list))) {
 602                 /* Only probe on the hash list */
 603                 disarm_uprobe(up);
 604                 hlist_del_rcu(&old_p->hlist);
 605                 cleanup_p = 1;
 606         } else {
 607                 list_del_rcu(&p->list);
 608                 cleanup_p = 0;
 609         }
 610
 611         if (cleanup_p) {
 612                 if (p != old_p) {
 613                         list_del_rcu(&p->list);
 614                         kfree(old_p);
 615                 }
 616
 617                 if (!in_atomic()) {
 618                         synchronize_sched();
 619                 }
 620
 621                 remove_uprobe(up);
 622         } else {
 623                 if (p->break_handler) {
 624                         old_p->break_handler = NULL;
 625                 }
 626
 627                 if (p->post_handler) {
 628                         list_for_each_entry_rcu (list_p, &old_p->list, list) {
 629                                 if (list_p->post_handler) {
 630                                         cleanup_p = 2;
 631                                         break;
 632                                 }
 633                         }
 634
 635                         if (cleanup_p == 0) {
 636                                 old_p->post_handler = NULL;
 637                         }
 638                 }
 639         }
 640 }
 641
 642 int dbi_register_ujprobe(struct ujprobe *jp, int atomic)
 643 {
 644         int ret = 0;
 645
 646         /* Todo: Verify probepoint is a function entry point */
 647         jp->up.kp.pre_handler = setjmp_upre_handler;
 648         jp->up.kp.break_handler = longjmp_break_uhandler;
 649
 650         ret = dbi_register_uprobe(&jp->up, atomic);
 651
 652         return ret;
 653 }
 654
 655 void dbi_unregister_ujprobe(struct ujprobe *jp, int atomic)
 656 {
 657         dbi_unregister_uprobe(&jp->up, atomic);
 658         /*
 659          * Here is an attempt to unregister even those probes that have not been
 660          * installed (hence not added to the hlist).
 661          * So if we try to delete them from the hlist we will get NULL pointer
 662          * dereference error. That is why we check whether this node
 663          * really belongs to the hlist.
 664          */
 665 #ifdef CONFIG_ARM
 666         if (!(hlist_unhashed(&jp->up.kp.is_hlist_arm))) {
 667                 hlist_del_rcu(&jp->up.kp.is_hlist_arm);
 668         }
 669         if (!(hlist_unhashed(&jp->up.kp.is_hlist_thumb))) {
 670                 hlist_del_rcu(&jp->up.kp.is_hlist_thumb);
 671         }
 672 #else /* CONFIG_ARM */
 673         if (!(hlist_unhashed(&jp->up.kp.is_hlist))) {
 674                 hlist_del_rcu(&jp->up.kp.is_hlist);
 675         }
 676 #endif /* CONFIG_ARM */
 677 }
 678
 679 int trampoline_uprobe_handler(struct kprobe *p, struct pt_regs *regs)
 680 {
 681         struct uretprobe_instance *ri = NULL;
 682         struct hlist_head *head;
 683         struct hlist_node *node, *tmp;
 684         unsigned long flags, tramp_addr, orig_ret_addr = 0;
 685
 686         tramp_addr = arch_get_trampoline_addr(p, regs);
 687         spin_lock_irqsave(&uretprobe_lock, flags);
 688
 689         head = uretprobe_inst_table_head(current->mm);
 690
 691         /*
 692          * It is possible to have multiple instances associated with a given
 693          * task either because an multiple functions in the call path
 694          * have a return probe installed on them, and/or more then one
 695          * return probe was registered for a target function.
 696          *
 697          * We can handle this because:
 698          *     - instances are always inserted at the head of the list
 699          *     - when multiple return probes are registered for the same
 700          *       function, the first instance's ret_addr will point to the
 701          *       real return address, and all the rest will point to
 702          *       uretprobe_trampoline
 703          */
 704         hlist_for_each_entry_safe(ri, node, tmp, head, hlist) {
 705                 if (ri->task != current) {
 706                         /* another task is sharing our hash bucket */
 707                         continue;
 708                 }
 709
 710                 if (ri->rp && ri->rp->handler) {
 711                         ri->rp->handler(ri, regs, ri->rp->priv_arg);
 712                 }
 713
 714                 orig_ret_addr = (unsigned long)ri->ret_addr;
 715                 recycle_urp_inst(ri);
 716
 717                 if (orig_ret_addr != tramp_addr) {
 718                         /*
 719                          * This is the real return address. Any other
 720                          * instances associated with this task are for
 721                          * other calls deeper on the call stack
 722                          */
 723                         break;
 724                 }
 725         }
 726
 727         spin_unlock_irqrestore(&uretprobe_lock, flags);
 728         arch_set_orig_ret_addr(orig_ret_addr, regs);
 729
 730         return 1;
 731 }
 732
 733 static int pre_handler_uretprobe(struct kprobe *p, struct pt_regs *regs)
 734 {
 735         struct uprobe *up = container_of(p, struct uprobe, kp);
 736         struct uretprobe *rp = container_of(up, struct uretprobe, up);
 737         struct uretprobe_instance *ri;
 738         unsigned long flags;
 739
 740         /* TODO: consider to only swap the RA after the last pre_handler fired */
 741         spin_lock_irqsave(&uretprobe_lock, flags);
 742
 743         /* TODO: test - remove retprobe after func entry but before its exit */
 744         if ((ri = get_free_urp_inst(rp)) != NULL) {
 745                 ri->rp = rp;
 746                 ri->task = current;
 747
 748                 arch_prepare_uretprobe_hl(ri, regs);
 749
 750                 add_urp_inst(ri);
 751         } else {
 752                 ++rp->nmissed;
 753         }
 754
 755         spin_unlock_irqrestore(&uretprobe_lock, flags);
 756
 757         return 0;
 758 }
 759
 760 int dbi_register_uretprobe(struct uretprobe *rp, int atomic)
 761 {
 762         int i, ret = 0;
 763         struct uretprobe_instance *inst;
 764
 765         DBPRINTF ("START\n");
 766
 767         rp->up.kp.pre_handler = pre_handler_uretprobe;
 768         rp->up.kp.post_handler = NULL;
 769         rp->up.kp.fault_handler = NULL;
 770         rp->up.kp.break_handler = NULL;
 771
 772         /* Pre-allocate memory for max kretprobe instances */
 773         if (rp->maxactive <= 0) {
 774 #if 1//def CONFIG_PREEMPT
 775                 rp->maxactive = max(10, 2 * NR_CPUS);
 776 #else
 777                 rp->maxactive = NR_CPUS;
 778 #endif
 779         }
 780
 781         INIT_HLIST_HEAD(&rp->used_instances);
 782         INIT_HLIST_HEAD(&rp->free_instances);
 783
 784         for (i = 0; i < rp->maxactive; i++) {
 785                 inst = kmalloc(sizeof(*inst), GFP_KERNEL);
 786                 if (inst == NULL) {
 787                         free_urp_inst(rp);
 788                         ret = -ENOMEM;
 789                         goto out;
 790                 }
 791
 792                 INIT_HLIST_NODE(&inst->uflist);
 793                 hlist_add_head(&inst->uflist, &rp->free_instances);
 794         }
 795
 796         rp->nmissed = 0;
 797
 798         /* Establish function entry probe point */
 799         ret = dbi_register_uprobe(&rp->up, atomic);
 800         if (ret) {
 801                 free_urp_inst(rp);
 802                 goto out;
 803         }
 804
 805 out:
 806         return ret;
 807 }
 808
 809 int dbi_disarm_urp_inst(struct uretprobe_instance *ri, struct task_struct *rm_task)
 810 {
 811         struct task_struct *task = rm_task ? rm_task : ri->task;
 812         kprobe_opcode_t *tramp;
 813         kprobe_opcode_t *sp = (kprobe_opcode_t *)((long)ri->sp & ~1);
 814         kprobe_opcode_t *stack = sp - RETPROBE_STACK_DEPTH + 1;
 815         kprobe_opcode_t *found = NULL;
 816         kprobe_opcode_t *buf[RETPROBE_STACK_DEPTH];
 817         int i, retval;
 818
 819         /* Understand function mode */
 820         if ((long)ri->sp & 1) {
 821                 tramp = (kprobe_opcode_t *)
 822                         ((unsigned long)ri->rp->up.kp.ainsn.insn + 0x1b);
 823         } else {
 824                 tramp = (kprobe_opcode_t *)
 825                         (ri->rp->up.kp.ainsn.insn + UPROBES_TRAMP_RET_BREAK_IDX);
 826         }
 827
 828         retval = read_proc_vm_atomic(task, (unsigned long)stack, buf, sizeof(buf));
 829         if (retval != sizeof(buf)) {
 830                 printk("---> %s (%d/%d): failed to read stack from %08lx",
 831                         task->comm, task->tgid, task->pid, (unsigned long)stack);
 832                 retval = -EFAULT;
 833                 goto out;
 834         }
 835
 836         /* search the stack from the bottom */
 837         for (i = RETPROBE_STACK_DEPTH - 1; i >= 0; i--) {
 838                 if (buf[i] == tramp) {
 839                         found = stack + i;
 840                         break;
 841                 }
 842         }
 843
 844         if (found) {
 845                 printk("---> %s (%d/%d): trampoline found at %08lx (%08lx /%+d) - %p\n",
 846                                 task->comm, task->tgid, task->pid,
 847                                 (unsigned long)found, (unsigned long)sp,
 848                                 found - sp, ri->rp->up.kp.addr);
 849                 retval = write_proc_vm_atomic(task, (unsigned long)found, &ri->ret_addr,
 850                                 sizeof(ri->ret_addr));
 851                 if (retval != sizeof(ri->ret_addr)) {
 852                         printk("---> %s (%d/%d): failed to write value to %08lx",
 853                                 task->comm, task->tgid, task->pid, (unsigned long)found);
 854                         retval = -EFAULT;
 855                 } else {
 856                         retval = 0;
 857                 }
 858         } else {
 859                 struct pt_regs *uregs = task_pt_regs(ri->task);
 860                 unsigned long ra = dbi_get_ret_addr(uregs);
 861                 if (ra == (unsigned long)tramp) {
 862                         printk("---> %s (%d/%d): trampoline found at lr = %08lx - %p\n",
 863                                         task->comm, task->tgid, task->pid, ra, ri->rp->up.kp.addr);
 864                         dbi_set_ret_addr(uregs, (unsigned long)tramp);
 865                         retval = 0;
 866                 } else {
 867                         printk("---> %s (%d/%d): trampoline NOT found at sp = %08lx, lr = %08lx - %p\n",
 868                                         task->comm, task->tgid, task->pid,
 869                                         (unsigned long)sp, ra, ri->rp->up.kp.addr);
 870                         retval = -ENOENT;
 871                 }
 872         }
 873
 874 out:
 875         return retval;
 876 }
 877
 878 /* Called with uretprobe_lock held */
 879 int dbi_disarm_urp_inst_for_task(struct task_struct *parent, struct task_struct *task)
 880 {
 881         struct uretprobe_instance *ri;
 882         struct hlist_node *node, *tmp;
 883         struct hlist_head *head = uretprobe_inst_table_head(parent->mm);
 884
 885         hlist_for_each_entry_safe(ri, node, tmp, head, hlist) {
 886                 if (parent == ri->task && ri->rp->up.kp.tgid) {
 887                         dbi_disarm_urp_inst(ri, task);
 888                 }
 889         }
 890
 891         return 0;
 892 }
 893 EXPORT_SYMBOL_GPL(dbi_disarm_urp_inst_for_task);
 894
 895 void dbi_unregister_uretprobe(struct uretprobe *rp, int atomic)
 896 {
 897         unsigned long flags;
 898         struct uretprobe_instance *ri;
 899
 900         spin_lock_irqsave (&uretprobe_lock, flags);
 901
 902         while ((ri = get_used_urp_inst(rp)) != NULL) {
 903                 if (dbi_disarm_urp_inst(ri, NULL) != 0)
 904                         /*panic*/printk("%s (%d/%d): cannot disarm urp instance (%08lx)\n",
 905                                         ri->task->comm, ri->task->tgid, ri->task->pid,
 906                                         (unsigned long)rp->up.kp.addr);
 907                 recycle_urp_inst(ri);
 908         }
 909
 910         if (hlist_empty(&rp->used_instances)) {
 911                 struct kprobe *p = &rp->up.kp;
 912 #ifdef CONFIG_ARM
 913                 if (!(hlist_unhashed(&p->is_hlist_arm))) {
 914                         hlist_del_rcu(&p->is_hlist_arm);
 915                 }
 916
 917                 if (!(hlist_unhashed(&p->is_hlist_thumb))) {
 918                         hlist_del_rcu(&p->is_hlist_thumb);
 919                 }
 920 #else /* CONFIG_ARM */
 921                 if (!(hlist_unhashed(&p->is_hlist))) {
 922                         hlist_del_rcu(&p->is_hlist);
 923                 }
 924 #endif /* CONFIG_ARM */
 925         }
 926
 927         while ((ri = get_used_urp_inst(rp)) != NULL) {
 928                 ri->rp = NULL;
 929                 hlist_del(&ri->uflist);
 930         }
 931
 932         spin_unlock_irqrestore(&uretprobe_lock, flags);
 933         free_urp_inst(rp);
 934
 935         dbi_unregister_uprobe(&rp->up, atomic);
 936 }
 937
 938 void dbi_unregister_all_uprobes(struct task_struct *task, int atomic)
 939 {
 940         struct hlist_head *head;
 941         struct hlist_node *node, *tnode;
 942         struct kprobe *p;
 943         int i;
 944
 945         for (i = 0; i < UPROBE_TABLE_SIZE; ++i) {
 946                 head = &uprobe_table[i];
 947                 hlist_for_each_entry_safe(p, node, tnode, head, hlist) {
 948                         if (p->tgid == task->tgid) {
 949                                 struct uprobe *up = container_of(p, struct uprobe, kp);
 950                                 printk("dbi_unregister_all_uprobes: delete uprobe at %p[%lx] for %s/%d\n",
 951                                                 p->addr, (unsigned long)p->opcode, task->comm, task->pid);
 952                                 dbi_unregister_uprobe(up, atomic);
 953                         }
 954                 }
 955         }
 956 }
 957
 958 void dbi_uprobe_return(void)
 959 {
 960         dbi_arch_uprobe_return();
 961 }
 962
 963 static int __init init_uprobes(void)
 964 {
 965         init_uprobe_table();
 966         init_uprobes_insn_slots();
 967         init_uretprobe_inst_table();
 968
 969         return swap_arch_init_uprobes();
 970 }
 971
 972 static void __exit exit_uprobes(void)
 973 {
 974         swap_arch_exit_uprobes();
 975 }
 976
 977 EXPORT_SYMBOL_GPL(dbi_uprobe_return);
 978 EXPORT_SYMBOL_GPL(dbi_register_ujprobe);
 979 EXPORT_SYMBOL_GPL(dbi_unregister_ujprobe);
 980 EXPORT_SYMBOL_GPL(dbi_register_uretprobe);
 981 EXPORT_SYMBOL_GPL(dbi_unregister_uretprobe);
 982 EXPORT_SYMBOL_GPL(dbi_unregister_all_uprobes);
 983
 984 module_init(init_uprobes);
 985 module_exit(exit_uprobes);
 986
 987 MODULE_LICENSE ("GPL");