2 * Kernel Probes (KProbes)
5 * This program is free software; you can redistribute it and/or modify
6 * it under the terms of the GNU General Public License as published by
7 * the Free Software Foundation; either version 2 of the License, or
8 * (at your option) any later version.
10 * This program is distributed in the hope that it will be useful,
11 * but WITHOUT ANY WARRANTY; without even the implied warranty of
12 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
13 * GNU General Public License for more details.
15 * You should have received a copy of the GNU General Public License
16 * along with this program; if not, write to the Free Software
17 * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
19 * Copyright (C) IBM Corporation, 2002, 2004
21 * 2002-Oct Created by Vamsi Krishna S <vamsi_krishna@in.ibm.com> Kernel
22 * Probes initial implementation (includes suggestions from
24 * 2004-Aug Updated by Prasanna S Panchamukhi <prasanna@in.ibm.com> with
25 * hlists and exceptions notifier as suggested by Andi Kleen.
26 * 2004-July Suparna Bhattacharya <suparna@in.ibm.com> added jumper probes
27 * interface to access function arguments.
28 * 2004-Sep Prasanna S Panchamukhi <prasanna@in.ibm.com> Changed Kprobes
29 * exceptions notifier to be first on the priority list.
30 * 2005-May Hien Nguyen <hien@us.ibm.com>, Jim Keniston
31 * <jkenisto@us.ibm.com> and Prasanna S Panchamukhi
32 * <prasanna@in.ibm.com> added function-return probes.
34 #include <linux/kprobes.h>
35 #include <linux/hash.h>
36 #include <linux/init.h>
37 #include <linux/slab.h>
38 #include <linux/stddef.h>
39 #include <linux/module.h>
40 #include <linux/moduleloader.h>
41 #include <linux/kallsyms.h>
42 #include <linux/freezer.h>
43 #include <linux/seq_file.h>
44 #include <linux/debugfs.h>
45 #include <linux/kdebug.h>
47 #include <asm-generic/sections.h>
48 #include <asm/cacheflush.h>
49 #include <asm/errno.h>
50 #include <asm/uaccess.h>
52 #define KPROBE_HASH_BITS 6
53 #define KPROBE_TABLE_SIZE (1 << KPROBE_HASH_BITS)
57 * Some oddball architectures like 64bit powerpc have function descriptors
58 * so this must be overridable.
60 #ifndef kprobe_lookup_name
61 #define kprobe_lookup_name(name, addr) \
62 addr = ((kprobe_opcode_t *)(kallsyms_lookup_name(name)))
65 static int kprobes_initialized
;
66 static struct hlist_head kprobe_table
[KPROBE_TABLE_SIZE
];
67 static struct hlist_head kretprobe_inst_table
[KPROBE_TABLE_SIZE
];
69 /* NOTE: change this value only with kprobe_mutex held */
70 static bool kprobe_enabled
;
72 DEFINE_MUTEX(kprobe_mutex
); /* Protects kprobe_table */
73 static DEFINE_PER_CPU(struct kprobe
*, kprobe_instance
) = NULL
;
75 spinlock_t lock ____cacheline_aligned_in_smp
;
76 } kretprobe_table_locks
[KPROBE_TABLE_SIZE
];
78 static spinlock_t
*kretprobe_table_lock_ptr(unsigned long hash
)
80 return &(kretprobe_table_locks
[hash
].lock
);
84 * Normally, functions that we'd want to prohibit kprobes in, are marked
85 * __kprobes. But, there are cases where such functions already belong to
86 * a different section (__sched for preempt_schedule)
88 * For such cases, we now have a blacklist
90 static struct kprobe_blackpoint kprobe_blacklist
[] = {
91 {"preempt_schedule",},
92 {NULL
} /* Terminator */
95 #ifdef __ARCH_WANT_KPROBES_INSN_SLOT
97 * kprobe->ainsn.insn points to the copy of the instruction to be
98 * single-stepped. x86_64, POWER4 and above have no-exec support and
99 * stepping on the instruction on a vmalloced/kmalloced/data page
100 * is a recipe for disaster
102 #define INSNS_PER_PAGE (PAGE_SIZE/(MAX_INSN_SIZE * sizeof(kprobe_opcode_t)))
104 struct kprobe_insn_page
{
105 struct hlist_node hlist
;
106 kprobe_opcode_t
*insns
; /* Page of instruction slots */
107 char slot_used
[INSNS_PER_PAGE
];
112 enum kprobe_slot_state
{
118 static struct hlist_head kprobe_insn_pages
;
119 static int kprobe_garbage_slots
;
120 static int collect_garbage_slots(void);
122 static int __kprobes
check_safety(void)
125 #if defined(CONFIG_PREEMPT) && defined(CONFIG_PM)
126 ret
= freeze_processes();
128 struct task_struct
*p
, *q
;
129 do_each_thread(p
, q
) {
130 if (p
!= current
&& p
->state
== TASK_RUNNING
&&
132 printk("Check failed: %s is running\n",p
->comm
);
136 } while_each_thread(p
, q
);
147 * get_insn_slot() - Find a slot on an executable page for an instruction.
148 * We allocate an executable page if there's no room on existing ones.
150 kprobe_opcode_t __kprobes
*get_insn_slot(void)
152 struct kprobe_insn_page
*kip
;
153 struct hlist_node
*pos
;
156 hlist_for_each_entry(kip
, pos
, &kprobe_insn_pages
, hlist
) {
157 if (kip
->nused
< INSNS_PER_PAGE
) {
159 for (i
= 0; i
< INSNS_PER_PAGE
; i
++) {
160 if (kip
->slot_used
[i
] == SLOT_CLEAN
) {
161 kip
->slot_used
[i
] = SLOT_USED
;
163 return kip
->insns
+ (i
* MAX_INSN_SIZE
);
166 /* Surprise! No unused slots. Fix kip->nused. */
167 kip
->nused
= INSNS_PER_PAGE
;
171 /* If there are any garbage slots, collect it and try again. */
172 if (kprobe_garbage_slots
&& collect_garbage_slots() == 0) {
175 /* All out of space. Need to allocate a new page. Use slot 0. */
176 kip
= kmalloc(sizeof(struct kprobe_insn_page
), GFP_KERNEL
);
181 * Use module_alloc so this page is within +/- 2GB of where the
182 * kernel image and loaded module images reside. This is required
183 * so x86_64 can correctly handle the %rip-relative fixups.
185 kip
->insns
= module_alloc(PAGE_SIZE
);
190 INIT_HLIST_NODE(&kip
->hlist
);
191 hlist_add_head(&kip
->hlist
, &kprobe_insn_pages
);
192 memset(kip
->slot_used
, SLOT_CLEAN
, INSNS_PER_PAGE
);
193 kip
->slot_used
[0] = SLOT_USED
;
199 /* Return 1 if all garbages are collected, otherwise 0. */
200 static int __kprobes
collect_one_slot(struct kprobe_insn_page
*kip
, int idx
)
202 kip
->slot_used
[idx
] = SLOT_CLEAN
;
204 if (kip
->nused
== 0) {
206 * Page is no longer in use. Free it unless
207 * it's the last one. We keep the last one
208 * so as not to have to set it up again the
209 * next time somebody inserts a probe.
211 hlist_del(&kip
->hlist
);
212 if (hlist_empty(&kprobe_insn_pages
)) {
213 INIT_HLIST_NODE(&kip
->hlist
);
214 hlist_add_head(&kip
->hlist
,
217 module_free(NULL
, kip
->insns
);
225 static int __kprobes
collect_garbage_slots(void)
227 struct kprobe_insn_page
*kip
;
228 struct hlist_node
*pos
, *next
;
230 /* Ensure no-one is preepmted on the garbages */
231 if (check_safety() != 0)
234 hlist_for_each_entry_safe(kip
, pos
, next
, &kprobe_insn_pages
, hlist
) {
236 if (kip
->ngarbage
== 0)
238 kip
->ngarbage
= 0; /* we will collect all garbages */
239 for (i
= 0; i
< INSNS_PER_PAGE
; i
++) {
240 if (kip
->slot_used
[i
] == SLOT_DIRTY
&&
241 collect_one_slot(kip
, i
))
245 kprobe_garbage_slots
= 0;
249 void __kprobes
free_insn_slot(kprobe_opcode_t
* slot
, int dirty
)
251 struct kprobe_insn_page
*kip
;
252 struct hlist_node
*pos
;
254 hlist_for_each_entry(kip
, pos
, &kprobe_insn_pages
, hlist
) {
255 if (kip
->insns
<= slot
&&
256 slot
< kip
->insns
+ (INSNS_PER_PAGE
* MAX_INSN_SIZE
)) {
257 int i
= (slot
- kip
->insns
) / MAX_INSN_SIZE
;
259 kip
->slot_used
[i
] = SLOT_DIRTY
;
262 collect_one_slot(kip
, i
);
268 if (dirty
&& ++kprobe_garbage_slots
> INSNS_PER_PAGE
)
269 collect_garbage_slots();
273 /* We have preemption disabled.. so it is safe to use __ versions */
274 static inline void set_kprobe_instance(struct kprobe
*kp
)
276 __get_cpu_var(kprobe_instance
) = kp
;
279 static inline void reset_kprobe_instance(void)
281 __get_cpu_var(kprobe_instance
) = NULL
;
285 * This routine is called either:
286 * - under the kprobe_mutex - during kprobe_[un]register()
288 * - with preemption disabled - from arch/xxx/kernel/kprobes.c
290 struct kprobe __kprobes
*get_kprobe(void *addr
)
292 struct hlist_head
*head
;
293 struct hlist_node
*node
;
296 head
= &kprobe_table
[hash_ptr(addr
, KPROBE_HASH_BITS
)];
297 hlist_for_each_entry_rcu(p
, node
, head
, hlist
) {
305 * Aggregate handlers for multiple kprobes support - these handlers
306 * take care of invoking the individual kprobe handlers on p->list
308 static int __kprobes
aggr_pre_handler(struct kprobe
*p
, struct pt_regs
*regs
)
312 list_for_each_entry_rcu(kp
, &p
->list
, list
) {
313 if (kp
->pre_handler
) {
314 set_kprobe_instance(kp
);
315 if (kp
->pre_handler(kp
, regs
))
318 reset_kprobe_instance();
323 static void __kprobes
aggr_post_handler(struct kprobe
*p
, struct pt_regs
*regs
,
328 list_for_each_entry_rcu(kp
, &p
->list
, list
) {
329 if (kp
->post_handler
) {
330 set_kprobe_instance(kp
);
331 kp
->post_handler(kp
, regs
, flags
);
332 reset_kprobe_instance();
337 static int __kprobes
aggr_fault_handler(struct kprobe
*p
, struct pt_regs
*regs
,
340 struct kprobe
*cur
= __get_cpu_var(kprobe_instance
);
343 * if we faulted "during" the execution of a user specified
344 * probe handler, invoke just that probe's fault handler
346 if (cur
&& cur
->fault_handler
) {
347 if (cur
->fault_handler(cur
, regs
, trapnr
))
353 static int __kprobes
aggr_break_handler(struct kprobe
*p
, struct pt_regs
*regs
)
355 struct kprobe
*cur
= __get_cpu_var(kprobe_instance
);
358 if (cur
&& cur
->break_handler
) {
359 if (cur
->break_handler(cur
, regs
))
362 reset_kprobe_instance();
366 /* Walks the list and increments nmissed count for multiprobe case */
367 void __kprobes
kprobes_inc_nmissed_count(struct kprobe
*p
)
370 if (p
->pre_handler
!= aggr_pre_handler
) {
373 list_for_each_entry_rcu(kp
, &p
->list
, list
)
379 void __kprobes
recycle_rp_inst(struct kretprobe_instance
*ri
,
380 struct hlist_head
*head
)
382 struct kretprobe
*rp
= ri
->rp
;
384 /* remove rp inst off the rprobe_inst_table */
385 hlist_del(&ri
->hlist
);
386 INIT_HLIST_NODE(&ri
->hlist
);
388 spin_lock(&rp
->lock
);
389 hlist_add_head(&ri
->hlist
, &rp
->free_instances
);
390 spin_unlock(&rp
->lock
);
393 hlist_add_head(&ri
->hlist
, head
);
396 void kretprobe_hash_lock(struct task_struct
*tsk
,
397 struct hlist_head
**head
, unsigned long *flags
)
399 unsigned long hash
= hash_ptr(tsk
, KPROBE_HASH_BITS
);
400 spinlock_t
*hlist_lock
;
402 *head
= &kretprobe_inst_table
[hash
];
403 hlist_lock
= kretprobe_table_lock_ptr(hash
);
404 spin_lock_irqsave(hlist_lock
, *flags
);
407 static void kretprobe_table_lock(unsigned long hash
, unsigned long *flags
)
409 spinlock_t
*hlist_lock
= kretprobe_table_lock_ptr(hash
);
410 spin_lock_irqsave(hlist_lock
, *flags
);
413 void kretprobe_hash_unlock(struct task_struct
*tsk
, unsigned long *flags
)
415 unsigned long hash
= hash_ptr(tsk
, KPROBE_HASH_BITS
);
416 spinlock_t
*hlist_lock
;
418 hlist_lock
= kretprobe_table_lock_ptr(hash
);
419 spin_unlock_irqrestore(hlist_lock
, *flags
);
422 void kretprobe_table_unlock(unsigned long hash
, unsigned long *flags
)
424 spinlock_t
*hlist_lock
= kretprobe_table_lock_ptr(hash
);
425 spin_unlock_irqrestore(hlist_lock
, *flags
);
429 * This function is called from finish_task_switch when task tk becomes dead,
430 * so that we can recycle any function-return probe instances associated
431 * with this task. These left over instances represent probed functions
432 * that have been called but will never return.
434 void __kprobes
kprobe_flush_task(struct task_struct
*tk
)
436 struct kretprobe_instance
*ri
;
437 struct hlist_head
*head
, empty_rp
;
438 struct hlist_node
*node
, *tmp
;
439 unsigned long hash
, flags
= 0;
441 if (unlikely(!kprobes_initialized
))
442 /* Early boot. kretprobe_table_locks not yet initialized. */
445 hash
= hash_ptr(tk
, KPROBE_HASH_BITS
);
446 head
= &kretprobe_inst_table
[hash
];
447 kretprobe_table_lock(hash
, &flags
);
448 hlist_for_each_entry_safe(ri
, node
, tmp
, head
, hlist
) {
450 recycle_rp_inst(ri
, &empty_rp
);
452 kretprobe_table_unlock(hash
, &flags
);
453 INIT_HLIST_HEAD(&empty_rp
);
454 hlist_for_each_entry_safe(ri
, node
, tmp
, &empty_rp
, hlist
) {
455 hlist_del(&ri
->hlist
);
460 static inline void free_rp_inst(struct kretprobe
*rp
)
462 struct kretprobe_instance
*ri
;
463 struct hlist_node
*pos
, *next
;
465 hlist_for_each_entry_safe(ri
, pos
, next
, &rp
->free_instances
, hlist
) {
466 hlist_del(&ri
->hlist
);
471 static void __kprobes
cleanup_rp_inst(struct kretprobe
*rp
)
473 unsigned long flags
, hash
;
474 struct kretprobe_instance
*ri
;
475 struct hlist_node
*pos
, *next
;
476 struct hlist_head
*head
;
479 for (hash
= 0; hash
< KPROBE_TABLE_SIZE
; hash
++) {
480 kretprobe_table_lock(hash
, &flags
);
481 head
= &kretprobe_inst_table
[hash
];
482 hlist_for_each_entry_safe(ri
, pos
, next
, head
, hlist
) {
486 kretprobe_table_unlock(hash
, &flags
);
492 * Keep all fields in the kprobe consistent
494 static inline void copy_kprobe(struct kprobe
*old_p
, struct kprobe
*p
)
496 memcpy(&p
->opcode
, &old_p
->opcode
, sizeof(kprobe_opcode_t
));
497 memcpy(&p
->ainsn
, &old_p
->ainsn
, sizeof(struct arch_specific_insn
));
501 * Add the new probe to old_p->list. Fail if this is the
502 * second jprobe at the address - two jprobes can't coexist
504 static int __kprobes
add_new_kprobe(struct kprobe
*old_p
, struct kprobe
*p
)
506 if (p
->break_handler
) {
507 if (old_p
->break_handler
)
509 list_add_tail_rcu(&p
->list
, &old_p
->list
);
510 old_p
->break_handler
= aggr_break_handler
;
512 list_add_rcu(&p
->list
, &old_p
->list
);
513 if (p
->post_handler
&& !old_p
->post_handler
)
514 old_p
->post_handler
= aggr_post_handler
;
519 * Fill in the required fields of the "manager kprobe". Replace the
520 * earlier kprobe in the hlist with the manager kprobe
522 static inline void add_aggr_kprobe(struct kprobe
*ap
, struct kprobe
*p
)
527 ap
->pre_handler
= aggr_pre_handler
;
528 ap
->fault_handler
= aggr_fault_handler
;
530 ap
->post_handler
= aggr_post_handler
;
531 if (p
->break_handler
)
532 ap
->break_handler
= aggr_break_handler
;
534 INIT_LIST_HEAD(&ap
->list
);
535 list_add_rcu(&p
->list
, &ap
->list
);
537 hlist_replace_rcu(&p
->hlist
, &ap
->hlist
);
541 * This is the second or subsequent kprobe at the address - handle
544 static int __kprobes
register_aggr_kprobe(struct kprobe
*old_p
,
550 if (old_p
->pre_handler
== aggr_pre_handler
) {
551 copy_kprobe(old_p
, p
);
552 ret
= add_new_kprobe(old_p
, p
);
554 ap
= kzalloc(sizeof(struct kprobe
), GFP_KERNEL
);
557 add_aggr_kprobe(ap
, old_p
);
559 ret
= add_new_kprobe(ap
, p
);
564 static int __kprobes
in_kprobes_functions(unsigned long addr
)
566 struct kprobe_blackpoint
*kb
;
568 if (addr
>= (unsigned long)__kprobes_text_start
&&
569 addr
< (unsigned long)__kprobes_text_end
)
572 * If there exists a kprobe_blacklist, verify and
573 * fail any probe registration in the prohibited area
575 for (kb
= kprobe_blacklist
; kb
->name
!= NULL
; kb
++) {
576 if (kb
->start_addr
) {
577 if (addr
>= kb
->start_addr
&&
578 addr
< (kb
->start_addr
+ kb
->range
))
586 * If we have a symbol_name argument, look it up and add the offset field
587 * to it. This way, we can specify a relative address to a symbol.
589 static kprobe_opcode_t __kprobes
*kprobe_addr(struct kprobe
*p
)
591 kprobe_opcode_t
*addr
= p
->addr
;
592 if (p
->symbol_name
) {
595 kprobe_lookup_name(p
->symbol_name
, addr
);
600 return (kprobe_opcode_t
*)(((char *)addr
) + p
->offset
);
603 static int __kprobes
__register_kprobe(struct kprobe
*p
,
604 unsigned long called_from
)
607 struct kprobe
*old_p
;
608 struct module
*probed_mod
;
609 kprobe_opcode_t
*addr
;
611 addr
= kprobe_addr(p
);
617 if (!__kernel_text_address((unsigned long) p
->addr
) ||
618 in_kprobes_functions((unsigned long) p
->addr
)) {
623 p
->mod_refcounted
= 0;
626 * Check if are we probing a module.
628 probed_mod
= __module_text_address((unsigned long) p
->addr
);
630 struct module
*calling_mod
;
631 calling_mod
= __module_text_address(called_from
);
633 * We must allow modules to probe themself and in this case
634 * avoid incrementing the module refcount, so as to allow
635 * unloading of self probing modules.
637 if (calling_mod
&& calling_mod
!= probed_mod
) {
638 if (unlikely(!try_module_get(probed_mod
))) {
642 p
->mod_refcounted
= 1;
649 INIT_LIST_HEAD(&p
->list
);
650 mutex_lock(&kprobe_mutex
);
651 old_p
= get_kprobe(p
->addr
);
653 ret
= register_aggr_kprobe(old_p
, p
);
657 ret
= arch_prepare_kprobe(p
);
661 INIT_HLIST_NODE(&p
->hlist
);
662 hlist_add_head_rcu(&p
->hlist
,
663 &kprobe_table
[hash_ptr(p
->addr
, KPROBE_HASH_BITS
)]);
669 mutex_unlock(&kprobe_mutex
);
671 if (ret
&& probed_mod
)
672 module_put(probed_mod
);
677 * Unregister a kprobe without a scheduler synchronization.
679 static int __kprobes
__unregister_kprobe_top(struct kprobe
*p
)
681 struct kprobe
*old_p
, *list_p
;
683 old_p
= get_kprobe(p
->addr
);
684 if (unlikely(!old_p
))
688 list_for_each_entry_rcu(list_p
, &old_p
->list
, list
)
690 /* kprobe p is a valid probe */
696 (old_p
->pre_handler
== aggr_pre_handler
&&
697 list_is_singular(&old_p
->list
))) {
699 * Only probe on the hash list. Disarm only if kprobes are
700 * enabled - otherwise, the breakpoint would already have
701 * been removed. We save on flushing icache.
704 arch_disarm_kprobe(p
);
705 hlist_del_rcu(&old_p
->hlist
);
707 if (p
->break_handler
)
708 old_p
->break_handler
= NULL
;
709 if (p
->post_handler
) {
710 list_for_each_entry_rcu(list_p
, &old_p
->list
, list
) {
711 if ((list_p
!= p
) && (list_p
->post_handler
))
714 old_p
->post_handler
= NULL
;
717 list_del_rcu(&p
->list
);
722 static void __kprobes
__unregister_kprobe_bottom(struct kprobe
*p
)
725 struct kprobe
*old_p
;
727 if (p
->mod_refcounted
) {
729 * Since we've already incremented refcount,
730 * we don't need to disable preemption.
732 mod
= module_text_address((unsigned long)p
->addr
);
737 if (list_empty(&p
->list
) || list_is_singular(&p
->list
)) {
738 if (!list_empty(&p
->list
)) {
739 /* "p" is the last child of an aggr_kprobe */
740 old_p
= list_entry(p
->list
.next
, struct kprobe
, list
);
744 arch_remove_kprobe(p
);
748 static int __register_kprobes(struct kprobe
**kps
, int num
,
749 unsigned long called_from
)
755 for (i
= 0; i
< num
; i
++) {
756 ret
= __register_kprobe(kps
[i
], called_from
);
759 unregister_kprobes(kps
, i
);
767 * Registration and unregistration functions for kprobe.
769 int __kprobes
register_kprobe(struct kprobe
*p
)
771 return __register_kprobes(&p
, 1,
772 (unsigned long)__builtin_return_address(0));
775 void __kprobes
unregister_kprobe(struct kprobe
*p
)
777 unregister_kprobes(&p
, 1);
780 int __kprobes
register_kprobes(struct kprobe
**kps
, int num
)
782 return __register_kprobes(kps
, num
,
783 (unsigned long)__builtin_return_address(0));
786 void __kprobes
unregister_kprobes(struct kprobe
**kps
, int num
)
792 mutex_lock(&kprobe_mutex
);
793 for (i
= 0; i
< num
; i
++)
794 if (__unregister_kprobe_top(kps
[i
]) < 0)
796 mutex_unlock(&kprobe_mutex
);
799 for (i
= 0; i
< num
; i
++)
801 __unregister_kprobe_bottom(kps
[i
]);
804 static struct notifier_block kprobe_exceptions_nb
= {
805 .notifier_call
= kprobe_exceptions_notify
,
806 .priority
= 0x7fffffff /* we need to be notified first */
809 unsigned long __weak
arch_deref_entry_point(void *entry
)
811 return (unsigned long)entry
;
814 static int __register_jprobes(struct jprobe
**jps
, int num
,
815 unsigned long called_from
)
822 for (i
= 0; i
< num
; i
++) {
825 addr
= arch_deref_entry_point(jp
->entry
);
827 if (!kernel_text_address(addr
))
830 /* Todo: Verify probepoint is a function entry point */
831 jp
->kp
.pre_handler
= setjmp_pre_handler
;
832 jp
->kp
.break_handler
= longjmp_break_handler
;
833 ret
= __register_kprobe(&jp
->kp
, called_from
);
837 unregister_jprobes(jps
, i
);
844 int __kprobes
register_jprobe(struct jprobe
*jp
)
846 return __register_jprobes(&jp
, 1,
847 (unsigned long)__builtin_return_address(0));
850 void __kprobes
unregister_jprobe(struct jprobe
*jp
)
852 unregister_jprobes(&jp
, 1);
855 int __kprobes
register_jprobes(struct jprobe
**jps
, int num
)
857 return __register_jprobes(jps
, num
,
858 (unsigned long)__builtin_return_address(0));
861 void __kprobes
unregister_jprobes(struct jprobe
**jps
, int num
)
867 mutex_lock(&kprobe_mutex
);
868 for (i
= 0; i
< num
; i
++)
869 if (__unregister_kprobe_top(&jps
[i
]->kp
) < 0)
870 jps
[i
]->kp
.addr
= NULL
;
871 mutex_unlock(&kprobe_mutex
);
874 for (i
= 0; i
< num
; i
++) {
876 __unregister_kprobe_bottom(&jps
[i
]->kp
);
880 #ifdef CONFIG_KRETPROBES
882 * This kprobe pre_handler is registered with every kretprobe. When probe
883 * hits it will set up the return probe.
885 static int __kprobes
pre_handler_kretprobe(struct kprobe
*p
,
886 struct pt_regs
*regs
)
888 struct kretprobe
*rp
= container_of(p
, struct kretprobe
, kp
);
889 unsigned long hash
, flags
= 0;
890 struct kretprobe_instance
*ri
;
892 /*TODO: consider to only swap the RA after the last pre_handler fired */
893 hash
= hash_ptr(current
, KPROBE_HASH_BITS
);
894 spin_lock_irqsave(&rp
->lock
, flags
);
895 if (!hlist_empty(&rp
->free_instances
)) {
896 ri
= hlist_entry(rp
->free_instances
.first
,
897 struct kretprobe_instance
, hlist
);
898 hlist_del(&ri
->hlist
);
899 spin_unlock_irqrestore(&rp
->lock
, flags
);
904 if (rp
->entry_handler
&& rp
->entry_handler(ri
, regs
)) {
905 spin_unlock_irqrestore(&rp
->lock
, flags
);
909 arch_prepare_kretprobe(ri
, regs
);
911 /* XXX(hch): why is there no hlist_move_head? */
912 INIT_HLIST_NODE(&ri
->hlist
);
913 kretprobe_table_lock(hash
, &flags
);
914 hlist_add_head(&ri
->hlist
, &kretprobe_inst_table
[hash
]);
915 kretprobe_table_unlock(hash
, &flags
);
918 spin_unlock_irqrestore(&rp
->lock
, flags
);
923 static int __kprobes
__register_kretprobe(struct kretprobe
*rp
,
924 unsigned long called_from
)
927 struct kretprobe_instance
*inst
;
931 if (kretprobe_blacklist_size
) {
932 addr
= kprobe_addr(&rp
->kp
);
936 for (i
= 0; kretprobe_blacklist
[i
].name
!= NULL
; i
++) {
937 if (kretprobe_blacklist
[i
].addr
== addr
)
942 rp
->kp
.pre_handler
= pre_handler_kretprobe
;
943 rp
->kp
.post_handler
= NULL
;
944 rp
->kp
.fault_handler
= NULL
;
945 rp
->kp
.break_handler
= NULL
;
947 /* Pre-allocate memory for max kretprobe instances */
948 if (rp
->maxactive
<= 0) {
949 #ifdef CONFIG_PREEMPT
950 rp
->maxactive
= max(10, 2 * NR_CPUS
);
952 rp
->maxactive
= NR_CPUS
;
955 spin_lock_init(&rp
->lock
);
956 INIT_HLIST_HEAD(&rp
->free_instances
);
957 for (i
= 0; i
< rp
->maxactive
; i
++) {
958 inst
= kmalloc(sizeof(struct kretprobe_instance
) +
959 rp
->data_size
, GFP_KERNEL
);
964 INIT_HLIST_NODE(&inst
->hlist
);
965 hlist_add_head(&inst
->hlist
, &rp
->free_instances
);
969 /* Establish function entry probe point */
970 ret
= __register_kprobe(&rp
->kp
, called_from
);
976 static int __register_kretprobes(struct kretprobe
**rps
, int num
,
977 unsigned long called_from
)
983 for (i
= 0; i
< num
; i
++) {
984 ret
= __register_kretprobe(rps
[i
], called_from
);
987 unregister_kretprobes(rps
, i
);
994 int __kprobes
register_kretprobe(struct kretprobe
*rp
)
996 return __register_kretprobes(&rp
, 1,
997 (unsigned long)__builtin_return_address(0));
1000 void __kprobes
unregister_kretprobe(struct kretprobe
*rp
)
1002 unregister_kretprobes(&rp
, 1);
1005 int __kprobes
register_kretprobes(struct kretprobe
**rps
, int num
)
1007 return __register_kretprobes(rps
, num
,
1008 (unsigned long)__builtin_return_address(0));
1011 void __kprobes
unregister_kretprobes(struct kretprobe
**rps
, int num
)
1017 mutex_lock(&kprobe_mutex
);
1018 for (i
= 0; i
< num
; i
++)
1019 if (__unregister_kprobe_top(&rps
[i
]->kp
) < 0)
1020 rps
[i
]->kp
.addr
= NULL
;
1021 mutex_unlock(&kprobe_mutex
);
1023 synchronize_sched();
1024 for (i
= 0; i
< num
; i
++) {
1025 if (rps
[i
]->kp
.addr
) {
1026 __unregister_kprobe_bottom(&rps
[i
]->kp
);
1027 cleanup_rp_inst(rps
[i
]);
1032 #else /* CONFIG_KRETPROBES */
1033 int __kprobes
register_kretprobe(struct kretprobe
*rp
)
1038 int __kprobes
register_kretprobes(struct kretprobe
**rps
, int num
)
1042 void __kprobes
unregister_kretprobe(struct kretprobe
*rp
)
1046 void __kprobes
unregister_kretprobes(struct kretprobe
**rps
, int num
)
1050 static int __kprobes
pre_handler_kretprobe(struct kprobe
*p
,
1051 struct pt_regs
*regs
)
1056 #endif /* CONFIG_KRETPROBES */
1058 static int __init
init_kprobes(void)
1061 unsigned long offset
= 0, size
= 0;
1062 char *modname
, namebuf
[128];
1063 const char *symbol_name
;
1065 struct kprobe_blackpoint
*kb
;
1067 /* FIXME allocate the probe table, currently defined statically */
1068 /* initialize all list heads */
1069 for (i
= 0; i
< KPROBE_TABLE_SIZE
; i
++) {
1070 INIT_HLIST_HEAD(&kprobe_table
[i
]);
1071 INIT_HLIST_HEAD(&kretprobe_inst_table
[i
]);
1072 spin_lock_init(&(kretprobe_table_locks
[i
].lock
));
1076 * Lookup and populate the kprobe_blacklist.
1078 * Unlike the kretprobe blacklist, we'll need to determine
1079 * the range of addresses that belong to the said functions,
1080 * since a kprobe need not necessarily be at the beginning
1083 for (kb
= kprobe_blacklist
; kb
->name
!= NULL
; kb
++) {
1084 kprobe_lookup_name(kb
->name
, addr
);
1088 kb
->start_addr
= (unsigned long)addr
;
1089 symbol_name
= kallsyms_lookup(kb
->start_addr
,
1090 &size
, &offset
, &modname
, namebuf
);
1097 if (kretprobe_blacklist_size
) {
1098 /* lookup the function address from its name */
1099 for (i
= 0; kretprobe_blacklist
[i
].name
!= NULL
; i
++) {
1100 kprobe_lookup_name(kretprobe_blacklist
[i
].name
,
1101 kretprobe_blacklist
[i
].addr
);
1102 if (!kretprobe_blacklist
[i
].addr
)
1103 printk("kretprobe: lookup failed: %s\n",
1104 kretprobe_blacklist
[i
].name
);
1108 /* By default, kprobes are enabled */
1109 kprobe_enabled
= true;
1111 err
= arch_init_kprobes();
1113 err
= register_die_notifier(&kprobe_exceptions_nb
);
1114 kprobes_initialized
= (err
== 0);
1121 #ifdef CONFIG_DEBUG_FS
1122 static void __kprobes
report_probe(struct seq_file
*pi
, struct kprobe
*p
,
1123 const char *sym
, int offset
,char *modname
)
1127 if (p
->pre_handler
== pre_handler_kretprobe
)
1129 else if (p
->pre_handler
== setjmp_pre_handler
)
1134 seq_printf(pi
, "%p %s %s+0x%x %s\n", p
->addr
, kprobe_type
,
1135 sym
, offset
, (modname
? modname
: " "));
1137 seq_printf(pi
, "%p %s %p\n", p
->addr
, kprobe_type
, p
->addr
);
1140 static void __kprobes
*kprobe_seq_start(struct seq_file
*f
, loff_t
*pos
)
1142 return (*pos
< KPROBE_TABLE_SIZE
) ? pos
: NULL
;
1145 static void __kprobes
*kprobe_seq_next(struct seq_file
*f
, void *v
, loff_t
*pos
)
1148 if (*pos
>= KPROBE_TABLE_SIZE
)
1153 static void __kprobes
kprobe_seq_stop(struct seq_file
*f
, void *v
)
1158 static int __kprobes
show_kprobe_addr(struct seq_file
*pi
, void *v
)
1160 struct hlist_head
*head
;
1161 struct hlist_node
*node
;
1162 struct kprobe
*p
, *kp
;
1163 const char *sym
= NULL
;
1164 unsigned int i
= *(loff_t
*) v
;
1165 unsigned long offset
= 0;
1166 char *modname
, namebuf
[128];
1168 head
= &kprobe_table
[i
];
1170 hlist_for_each_entry_rcu(p
, node
, head
, hlist
) {
1171 sym
= kallsyms_lookup((unsigned long)p
->addr
, NULL
,
1172 &offset
, &modname
, namebuf
);
1173 if (p
->pre_handler
== aggr_pre_handler
) {
1174 list_for_each_entry_rcu(kp
, &p
->list
, list
)
1175 report_probe(pi
, kp
, sym
, offset
, modname
);
1177 report_probe(pi
, p
, sym
, offset
, modname
);
1183 static struct seq_operations kprobes_seq_ops
= {
1184 .start
= kprobe_seq_start
,
1185 .next
= kprobe_seq_next
,
1186 .stop
= kprobe_seq_stop
,
1187 .show
= show_kprobe_addr
1190 static int __kprobes
kprobes_open(struct inode
*inode
, struct file
*filp
)
1192 return seq_open(filp
, &kprobes_seq_ops
);
1195 static struct file_operations debugfs_kprobes_operations
= {
1196 .open
= kprobes_open
,
1198 .llseek
= seq_lseek
,
1199 .release
= seq_release
,
1202 static void __kprobes
enable_all_kprobes(void)
1204 struct hlist_head
*head
;
1205 struct hlist_node
*node
;
1209 mutex_lock(&kprobe_mutex
);
1211 /* If kprobes are already enabled, just return */
1213 goto already_enabled
;
1215 for (i
= 0; i
< KPROBE_TABLE_SIZE
; i
++) {
1216 head
= &kprobe_table
[i
];
1217 hlist_for_each_entry_rcu(p
, node
, head
, hlist
)
1221 kprobe_enabled
= true;
1222 printk(KERN_INFO
"Kprobes globally enabled\n");
1225 mutex_unlock(&kprobe_mutex
);
1229 static void __kprobes
disable_all_kprobes(void)
1231 struct hlist_head
*head
;
1232 struct hlist_node
*node
;
1236 mutex_lock(&kprobe_mutex
);
1238 /* If kprobes are already disabled, just return */
1239 if (!kprobe_enabled
)
1240 goto already_disabled
;
1242 kprobe_enabled
= false;
1243 printk(KERN_INFO
"Kprobes globally disabled\n");
1244 for (i
= 0; i
< KPROBE_TABLE_SIZE
; i
++) {
1245 head
= &kprobe_table
[i
];
1246 hlist_for_each_entry_rcu(p
, node
, head
, hlist
) {
1247 if (!arch_trampoline_kprobe(p
))
1248 arch_disarm_kprobe(p
);
1252 mutex_unlock(&kprobe_mutex
);
1253 /* Allow all currently running kprobes to complete */
1254 synchronize_sched();
1258 mutex_unlock(&kprobe_mutex
);
1263 * XXX: The debugfs bool file interface doesn't allow for callbacks
1264 * when the bool state is switched. We can reuse that facility when
1267 static ssize_t
read_enabled_file_bool(struct file
*file
,
1268 char __user
*user_buf
, size_t count
, loff_t
*ppos
)
1278 return simple_read_from_buffer(user_buf
, count
, ppos
, buf
, 2);
1281 static ssize_t
write_enabled_file_bool(struct file
*file
,
1282 const char __user
*user_buf
, size_t count
, loff_t
*ppos
)
1287 buf_size
= min(count
, (sizeof(buf
)-1));
1288 if (copy_from_user(buf
, user_buf
, buf_size
))
1295 enable_all_kprobes();
1300 disable_all_kprobes();
1307 static struct file_operations fops_kp
= {
1308 .read
= read_enabled_file_bool
,
1309 .write
= write_enabled_file_bool
,
1312 static int __kprobes
debugfs_kprobe_init(void)
1314 struct dentry
*dir
, *file
;
1315 unsigned int value
= 1;
1317 dir
= debugfs_create_dir("kprobes", NULL
);
1321 file
= debugfs_create_file("list", 0444, dir
, NULL
,
1322 &debugfs_kprobes_operations
);
1324 debugfs_remove(dir
);
1328 file
= debugfs_create_file("enabled", 0600, dir
,
1331 debugfs_remove(dir
);
1338 late_initcall(debugfs_kprobe_init
);
1339 #endif /* CONFIG_DEBUG_FS */
1341 module_init(init_kprobes
);
1343 EXPORT_SYMBOL_GPL(register_kprobe
);
1344 EXPORT_SYMBOL_GPL(unregister_kprobe
);
1345 EXPORT_SYMBOL_GPL(register_kprobes
);
1346 EXPORT_SYMBOL_GPL(unregister_kprobes
);
1347 EXPORT_SYMBOL_GPL(register_jprobe
);
1348 EXPORT_SYMBOL_GPL(unregister_jprobe
);
1349 EXPORT_SYMBOL_GPL(register_jprobes
);
1350 EXPORT_SYMBOL_GPL(unregister_jprobes
);
1351 EXPORT_SYMBOL_GPL(jprobe_return
);
1352 EXPORT_SYMBOL_GPL(register_kretprobe
);
1353 EXPORT_SYMBOL_GPL(unregister_kretprobe
);
1354 EXPORT_SYMBOL_GPL(register_kretprobes
);
1355 EXPORT_SYMBOL_GPL(unregister_kretprobes
);