xXx

Hexid M1n1 5h3ll MobiLe

usr/share/systemtap/runtime/linux/uprobes/_[ Not.Writable ]

File://usr/share/systemtap/runtime/linux/uprobes/uprobes_x86.c

/*
 *  Userspace Probes (UProbes)
 *  uprobes.c
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation; either version 2 of the License, or
 * (at your option) any later version.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with this program.  If not, see <http://www.gnu.org/licenses/>.
 *
 * Copyright (C) IBM Corporation, 2006-2008
 */

#ifdef CONFIG_X86_32
#define is_32bit_app(tsk) 1
#else
#define is_32bit_app(tsk) (test_tsk_thread_flag(tsk, TIF_IA32))
#endif

/* Adapted from arch/x86_64/kprobes.c */
#undef W
#define W(row,b0,b1,b2,b3,b4,b5,b6,b7,b8,b9,ba,bb,bc,bd,be,bf)		      \
	(((b0##ULL << 0x0)|(b1##ULL << 0x1)|(b2##ULL << 0x2)|(b3##ULL << 0x3) |   \
	  (b4##ULL << 0x4)|(b5##ULL << 0x5)|(b6##ULL << 0x6)|(b7##ULL << 0x7) |   \
	  (b8##ULL << 0x8)|(b9##ULL << 0x9)|(ba##ULL << 0xa)|(bb##ULL << 0xb) |   \
	  (bc##ULL << 0xc)|(bd##ULL << 0xd)|(be##ULL << 0xe)|(bf##ULL << 0xf))    \
	 << (row % 64))

static const volatile unsigned long long good_insns_64[256 / 64] = {
	/*      0 1 2 3 4 5 6 7 8 9 a b c d e f         */
	/*      -------------------------------         */
	W(0x00, 1,1,1,1,1,1,0,0,1,1,1,1,1,1,0,0)| /* 00 */
	W(0x10, 1,1,1,1,1,1,0,0,1,1,1,1,1,1,0,0)| /* 10 */
	W(0x20, 1,1,1,1,1,1,0,0,1,1,1,1,1,1,0,0)| /* 20 */
	W(0x30, 1,1,1,1,1,1,0,0,1,1,1,1,1,1,0,0), /* 30 */
	W(0x40, 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0)| /* 40 */
	W(0x50, 1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1)| /* 50 */
	W(0x60, 0,0,0,1,1,1,0,0,1,1,1,1,0,0,0,0)| /* 60 */
	W(0x70, 1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1), /* 70 */
	W(0x80, 1,1,0,1,1,1,1,1,1,1,1,1,1,1,1,1)| /* 80 */
	W(0x90, 1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1)| /* 90 */
	W(0xa0, 1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1)| /* a0 */
	W(0xb0, 1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1), /* b0 */
	W(0xc0, 1,1,1,1,0,0,1,1,1,1,1,1,0,0,0,0)| /* c0 */
	W(0xd0, 1,1,1,1,0,0,0,1,1,1,1,1,1,1,1,1)| /* d0 */
	W(0xe0, 1,1,1,1,0,0,0,0,1,1,1,1,0,0,0,0)| /* e0 */
	W(0xf0, 0,0,1,1,0,1,1,1,1,1,0,0,1,1,1,1)  /* f0 */
	/*      -------------------------------         */
	/*      0 1 2 3 4 5 6 7 8 9 a b c d e f         */
};

/* Good-instruction tables for 32-bit apps -- copied from i386 uprobes */

static const volatile unsigned long long good_insns_32[256 / 64] = {
	/*      0 1 2 3 4 5 6 7 8 9 a b c d e f         */
	/*      -------------------------------         */
	W(0x00, 1,1,1,1,1,1,1,0,1,1,1,1,1,1,1,0)| /* 00 */
	W(0x10, 1,1,1,1,1,1,1,0,1,1,1,1,1,1,1,0)| /* 10 */
	W(0x20, 1,1,1,1,1,1,0,1,1,1,1,1,1,1,0,1)| /* 20 */
	W(0x30, 1,1,1,1,1,1,0,1,1,1,1,1,1,1,0,1), /* 30 */
	W(0x40, 1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1)| /* 40 */
	W(0x50, 1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1)| /* 50 */
	W(0x60, 1,1,1,0,1,1,0,0,1,1,1,1,0,0,0,0)| /* 60 */
	W(0x70, 1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1), /* 70 */
	W(0x80, 1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1)| /* 80 */
	W(0x90, 1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1)| /* 90 */
	W(0xa0, 1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1)| /* a0 */
	W(0xb0, 1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1), /* b0 */
	W(0xc0, 1,1,1,1,1,1,1,1,1,1,1,1,0,0,0,0)| /* c0 */
	W(0xd0, 1,1,1,1,1,1,0,1,1,1,1,1,1,1,1,1)| /* d0 */
	W(0xe0, 1,1,1,1,0,0,0,0,1,1,1,1,0,0,0,0)| /* e0 */
	W(0xf0, 0,0,1,1,0,1,1,1,1,1,0,0,1,1,1,1)  /* f0 */
	/*      -------------------------------         */
	/*      0 1 2 3 4 5 6 7 8 9 a b c d e f         */
};

/* Using this for both 64-bit and 32-bit apps */
static const volatile unsigned long long good_2byte_insns[256 / 64] = {
	/*      0 1 2 3 4 5 6 7 8 9 a b c d e f         */
	/*      -------------------------------         */
	W(0x00, 0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,1)| /* 00 */
	W(0x10, 1,1,1,1,1,1,1,1,0,1,1,1,1,1,1,1)| /* 10 */
	W(0x20, 1,1,1,1,0,0,0,0,1,1,1,1,1,1,1,1)| /* 20 */
	W(0x30, 0,1,1,1,0,0,0,0,0,0,0,0,0,0,0,0), /* 30 */
	W(0x40, 1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1)| /* 40 */
	W(0x50, 1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1)| /* 50 */
	W(0x60, 1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1)| /* 60 */
	W(0x70, 1,1,1,1,1,1,1,1,0,0,0,0,0,0,1,1), /* 70 */
	W(0x80, 1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1)| /* 80 */
	W(0x90, 1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1)| /* 90 */
	W(0xa0, 1,1,1,1,1,1,0,0,1,1,1,1,1,1,0,1)| /* a0 */
	W(0xb0, 1,1,1,1,1,1,1,1,0,1,1,1,1,1,1,1), /* b0 */
	W(0xc0, 1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1)| /* c0 */
	W(0xd0, 0,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1)| /* d0 */
	W(0xe0, 1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1)| /* e0 */
	W(0xf0, 0,1,1,1,1,1,1,1,1,1,1,1,1,1,1,0)  /* f0 */
	/*      -------------------------------         */
	/*      0 1 2 3 4 5 6 7 8 9 a b c d e f         */
};

/*
 * opcodes we'll probably never support:
 * 6c-6d, e4-e5, ec-ed - in
 * 6e-6f, e6-e7, ee-ef - out
 * cc, cd - int3, int
 * cf - iret
 * d6 - illegal instruction
 * f1 - int1/icebp
 * f4 - hlt
 * fa, fb - cli, sti
 * 0f - lar, lsl, syscall, clts, sysret, sysenter, sysexit, invd, wbinvd, ud2
 *
 * invalid opcodes in 64-bit mode:
 * 06, 0e, 16, 1e, 27, 2f, 37, 3f, 60-62, 82, c4-c5, d4-d5
 *
 * 63 - we support this opcode in x86_64 but not in i386.
 * opcodes we may need to refine support for:
 * 0f - 2-byte instructions: For many of these instructions, the validity
 * depends on the prefix and/or the reg field.  On such instructions, we
 * just consider the opcode combination valid if it corresponds to any
 * valid instruction.
 * 8f - Group 1 - only reg = 0 is OK
 * c6-c7 - Group 11 - only reg = 0 is OK
 * d9-df - fpu insns with some illegal encodings
 * f2, f3 - repnz, repz prefixes.  These are also the first byte for
 * certain floating-point instructions, such as addsd.
 * fe - Group 4 - only reg = 0 or 1 is OK
 * ff - Group 5 - only reg = 0-6 is OK
 *
 * others -- Do we need to support these?
 * 0f - (floating-point?) prefetch instructions
 * 07, 17, 1f - pop es, pop ss, pop ds
 * 26, 2e, 36, 3e - es:, cs:, ss:, ds: segment prefixes --
 *	but 64 and 65 (fs: and gs:) seems to be used, so we support them.
 * 67 - addr16 prefix
 * ce - into
 * f0 - lock prefix
 */

/*
 * TODO:
 * - Where necessary, examine the modrm byte and allow only valid instructions
 * in the different Groups and fpu instructions.
 * - Note: If we go past the first byte, do we need to verify that
 * subsequent bytes were actually there, rather than off the last page?
 * - Be clearer about which instructions we'll never probe.
 */

/*
 * Return 1 if this is a legacy instruction prefix we support, -1 if
 * it's one we don't support, or 0 if it's not a prefix at all.
 */
static inline int check_legacy_prefix(u8 byte)
{
	switch (byte) {
	case 0x26:
	case 0x2e:
	case 0x36:
	case 0x3e:
	case 0xf0:
		return -1;
	case 0x64:
	case 0x65:
	case 0x66:
	case 0x67:
	case 0xf2:
	case 0xf3:
		return 1;
	default:
		return 0;
	}
}

static void report_bad_1byte_opcode(int mode, uprobe_opcode_t op)
{
	printk(KERN_ERR "In %d-bit apps, "
		"uprobes does not currently support probing "
		"instructions whose first byte is 0x%2.2x\n", mode, op);
}

static void report_bad_2byte_opcode(uprobe_opcode_t op)
{
	printk(KERN_ERR "uprobes does not currently support probing "
		"instructions with the 2-byte opcode 0x0f 0x%2.2x\n", op);
}

static void report_bad_opcode_prefix(uprobe_opcode_t op, uprobe_opcode_t prefix)
{
	printk(KERN_ERR "uprobes does not currently support probing "
		"instructions whose first byte is 0x%2.2x "
		"with a prefix 0x%2.2x\n", op, prefix);
}

/* Figure out how uprobe_post_ssout should perform ip fixup. */
static int setup_uprobe_post_ssout(struct uprobe_probept *ppt,
		uprobe_opcode_t *insn)
{
	/*
	 * Some of these require special treatment, but we don't know what to
	 * do with arbitrary prefixes, so we refuse to probe them.
	 */
	int prefix_ok = 0;
	switch (*insn) {
	case 0xc3:		/* ret */
		if ((insn - ppt->insn == 1) &&
		    (*ppt->insn == 0xf3 || *ppt->insn == 0xf2))
			/*
			 * "rep ret" is an AMD kludge that's used by GCC,
			 * so we need to treat it like a normal ret.
			 */
			prefix_ok = 1;
	case 0xcb:		/* more ret/lret */
	case 0xc2:
	case 0xca:
		/* rip is correct */
		ppt->arch_info.flags |= UPFIX_ABS_IP;
		break;
	case 0xe8:		/* call relative - Fix return addr */
		ppt->arch_info.flags |= UPFIX_RETURN;
		break;
	case 0x9a:		/* call absolute - Fix return addr */
		ppt->arch_info.flags |= UPFIX_RETURN | UPFIX_ABS_IP;
		break;
	case 0xff:
		if ((insn[1] & 0x30) == 0x10) {
			/* call absolute, indirect */
			/* Fix return addr; rip is correct. */
			ppt->arch_info.flags |= UPFIX_ABS_IP | UPFIX_RETURN;
		} else if ((insn[1] & 0x31) == 0x20 ||	/* jmp near, absolute indirect */
			   (insn[1] & 0x31) == 0x21) {	/* jmp far, absolute indirect */
			/* rip is correct. */
			ppt->arch_info.flags |= UPFIX_ABS_IP;
		}
		break;
	case 0xea:		/* jmp absolute -- rip is correct */
		ppt->arch_info.flags |= UPFIX_ABS_IP;
		break;
	default:
		/* Assuming that normal ip-fixup is ok for other prefixed opcodes. */
		prefix_ok = 1;
		break;
	}

	if (!prefix_ok && insn != ppt->insn) {
		report_bad_opcode_prefix(*insn, *ppt->insn);
		return -EPERM;
	}

	return 0;
}

static int validate_insn_32bits(struct uprobe_probept *ppt)
{
	uprobe_opcode_t *insn = ppt->insn;
	int pfx, ret;

	/* Skip good instruction prefixes; reject "bad" ones. */
	while ((pfx = check_legacy_prefix(insn[0])) == 1)
		insn++;
	if (pfx < 0) {
		report_bad_1byte_opcode(32, insn[0]);
		return -EPERM;
	}
	if ((ret = setup_uprobe_post_ssout(ppt, insn)) != 0)
		return ret;
	if (test_bit(insn[0], (unsigned long*)good_insns_32))
		return 0;
	if (insn[0] == 0x0f) {
		if (test_bit(insn[1], (unsigned long*)good_2byte_insns))
			return 0;
		report_bad_2byte_opcode(insn[1]);
	} else
		report_bad_1byte_opcode(32, insn[0]);
	return -EPERM;
}

static int validate_insn_64bits(struct uprobe_probept *ppt)
{
	uprobe_opcode_t *insn = ppt->insn;
	int pfx, ret;

	/* Skip good instruction prefixes; reject "bad" ones. */
	while ((pfx = check_legacy_prefix(insn[0])) == 1)
		insn++;
	if (pfx < 0) {
		report_bad_1byte_opcode(64, insn[0]);
		return -EPERM;
	}
	/* Skip REX prefix. */
	if ((insn[0] & 0xf0) == 0x40)
		insn++;
	if ((ret = setup_uprobe_post_ssout(ppt, insn)) != 0)
		return ret;
	if (test_bit(insn[0], (unsigned long*)good_insns_64))
		return 0;
	if (insn[0] == 0x0f) {
		if (test_bit(insn[1], (unsigned long*)good_2byte_insns))
			return 0;
		report_bad_2byte_opcode(insn[1]);
	} else
		report_bad_1byte_opcode(64, insn[0]);
	return -EPERM;
}

#ifdef CONFIG_X86_64
static int handle_riprel_insn(struct uprobe_probept *ppt);
#endif

static
int arch_validate_probed_insn(struct uprobe_probept *ppt,
						struct task_struct *tsk)
{
	int ret;

	ppt->arch_info.flags = 0x0;
#ifdef CONFIG_X86_64
	ppt->arch_info.rip_target_address = 0x0;
#endif

	if (is_32bit_app(tsk))
		return validate_insn_32bits(ppt);
	if ((ret = validate_insn_64bits(ppt)) != 0)
		return ret;
#ifdef CONFIG_X86_64
	(void) handle_riprel_insn(ppt);
#endif
	return 0;
}

#ifdef CONFIG_X86_64
/*
 * Returns 0 if the indicated instruction has no immediate operand
 * and/or can't use rip-relative addressing.  Otherwise returns
 * the size of the immediate operand in the instruction.  (Note that
 * for instructions such as "movq $7,xxxx(%rip)" the immediate-operand
 * field is 4 bytes, even though 8 bytes are stored.)
 */
static int immediate_operand_size(u8 opcode1, u8 opcode2, u8 reg,
						int operand_size_prefix)
{
	switch (opcode1) {
	case 0x6b:	/* imul immed,mem,reg */
	case 0x80:	/* Group 1 */
	case 0x83:	/* Group 1 */
	case 0xc0:	/* Group 2 */
	case 0xc1:	/* Group 2 */
	case 0xc6:	/* Group 11 */
		return 1;
	case 0x69:	/* imul immed,mem,reg */
	case 0x81:	/* Group 1 */
	case 0xc7:	/* Group 11 */
		return (operand_size_prefix ? 2 : 4);
	case 0xf6:	/* Group 3, reg field == 0 or 1 */
		return (reg > 1 ? 0 : 1);
	case 0xf7:	/* Group 3, reg field == 0 or 1 */
		if (reg > 1)
			return 0;
		return (operand_size_prefix ? 2 : 4);
	case 0x0f:
		/* 2-byte opcodes */
		switch (opcode2) {
		/*
		 * Note: 0x71-73 (Groups 12-14) have immediate operands,
		 * but not memory operands.
		 */
		case 0x70:	/* pshuf* immed,mem,reg */
		case 0xa4:	/* shld immed,reg,mem */
		case 0xac:	/* shrd immed,reg,mem */
		case 0xc2:	/* cmpps or cmppd */
		case 0xc4:	/* pinsrw */
		case 0xc5:	/* pextrw */
		case 0xc6:	/* shufps or shufpd */
		case 0x0f:	/* 3DNow extensions */
			return 1;
		default:
			return 0;
		}
	}
	return 0;
}

/*
 * TODO: These tables are common for kprobes and uprobes and can be moved
 * to a common place.
 */
static const volatile u64 onebyte_has_modrm[256 / 64] = {
	/*      0 1 2 3 4 5 6 7 8 9 a b c d e f         */
	/*      -------------------------------         */
	W(0x00, 1,1,1,1,0,0,0,0,1,1,1,1,0,0,0,0)| /* 00 */
	W(0x10, 1,1,1,1,0,0,0,0,1,1,1,1,0,0,0,0)| /* 10 */
	W(0x20, 1,1,1,1,0,0,0,0,1,1,1,1,0,0,0,0)| /* 20 */
	W(0x30, 1,1,1,1,0,0,0,0,1,1,1,1,0,0,0,0), /* 30 */
	W(0x40, 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0)| /* 40 */
	W(0x50, 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0)| /* 50 */
	W(0x60, 0,0,1,1,0,0,0,0,0,1,0,1,0,0,0,0)| /* 60 */
	W(0x70, 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0), /* 70 */
	W(0x80, 1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1)| /* 80 */
	W(0x90, 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0)| /* 90 */
	W(0xa0, 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0)| /* a0 */
	W(0xb0, 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0), /* b0 */
	W(0xc0, 1,1,0,0,1,1,1,1,0,0,0,0,0,0,0,0)| /* c0 */
	W(0xd0, 1,1,1,1,0,0,0,0,1,1,1,1,1,1,1,1)| /* d0 */
	W(0xe0, 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0)| /* e0 */
	W(0xf0, 0,0,0,0,0,0,1,1,0,0,0,0,0,0,1,1)  /* f0 */
	/*      -------------------------------         */
	/*      0 1 2 3 4 5 6 7 8 9 a b c d e f         */
};
static const volatile u64 twobyte_has_modrm[256 / 64] = {
	/*      0 1 2 3 4 5 6 7 8 9 a b c d e f         */
	/*      -------------------------------         */
	W(0x00, 1,1,1,1,0,0,0,0,0,0,0,0,0,1,0,1)| /* 0f */
	W(0x10, 1,1,1,1,1,1,1,1,1,0,0,0,0,0,0,0)| /* 1f */
	W(0x20, 1,1,1,1,1,0,1,0,1,1,1,1,1,1,1,1)| /* 2f */
	W(0x30, 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0), /* 3f */
	W(0x40, 1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1)| /* 4f */
	W(0x50, 1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1)| /* 5f */
	W(0x60, 1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1)| /* 6f */
	W(0x70, 1,1,1,1,1,1,1,0,0,0,0,0,1,1,1,1), /* 7f */
	W(0x80, 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0)| /* 8f */
	W(0x90, 1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1)| /* 9f */
	W(0xa0, 0,0,0,1,1,1,1,1,0,0,0,1,1,1,1,1)| /* af */
	W(0xb0, 1,1,1,1,1,1,1,1,0,0,1,1,1,1,1,1), /* bf */
	W(0xc0, 1,1,1,1,1,1,1,1,0,0,0,0,0,0,0,0)| /* cf */
	W(0xd0, 1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1)| /* df */
	W(0xe0, 1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1)| /* ef */
	W(0xf0, 1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,0)  /* ff */
	/*      -------------------------------         */
	/*      0 1 2 3 4 5 6 7 8 9 a b c d e f         */
};

/*
 * If pp->insn doesn't use rip-relative addressing, return 0.  Otherwise,
 * rewrite the instruction so that it accesses its memory operand
 * indirectly through a scratch register.  Set flags and rip_target_address
 * in ppt->arch_info accordingly.  (The contents of the scratch register
 * will be saved before we single-step the modified instruction, and
 * restored afterward.)  Return 1.
 *
 * We do this because a rip-relative instruction can access only a
 * relatively small area (+/- 2 GB from the instruction), and the SSOL
 * area typically lies beyond that area.  At least for instructions
 * that store to memory, we can't single-step the original instruction
 * and "fix things up" later, because the misdirected store could be
 * disastrous.
 *
 * Some useful facts about rip-relative instructions:
 * - There's always a modrm byte.
 * - There's never a SIB byte.
 * - The offset is always 4 bytes.
 */
static int handle_riprel_insn(struct uprobe_probept *ppt)
{
	u8 *insn = (u8*) ppt->insn;
	u8 opcode1, opcode2, modrm, reg;
	int need_modrm;
	int operand_size_prefix = 0;
	int immed_size, instruction_size;

	/*
	 * Skip legacy instruction prefixes.  Some of these we don't
	 * support (yet), but here we pretend to support all of them.
	 * Skip the REX prefix, if any.
	 */
	while (check_legacy_prefix(*insn)) {
		if (*insn == 0x66)
			operand_size_prefix = 1;
		insn++;
	}
	if ((*insn & 0xf0) == 0x40)
		insn++;

	opcode1 = *insn;
	if (opcode1 == 0x0f) {	/* Two-byte opcode.  */
		opcode2 = *++insn;
		need_modrm = test_bit(opcode2, twobyte_has_modrm);
	} else {		/* One-byte opcode.  */
		opcode2 = 0x0;
		need_modrm = test_bit(opcode1, onebyte_has_modrm);
	}

	if (!need_modrm)
		return 0;

	modrm = *++insn;
	/*
	 * For rip-relative instructions, the mod field (top 2 bits)
	 * is zero and the r/m field (bottom 3 bits) is 0x5.
	 */
	if ((modrm & 0xc7) != 0x5)
		return 0;

	/*
	 * We have a rip-relative instruction.  insn points at the
	 * modrm byte.  The next 4 bytes are the offset. Beyond the
	 * offset, for some instructions, is the immediate operand.
	 */
	reg = (modrm >> 3) & 0x7;
	immed_size = immediate_operand_size(opcode1, opcode2, reg,
						operand_size_prefix);
	instruction_size =
		(insn - (u8*) ppt->insn)	/* prefixes + opcodes */
		+ 1			/* modrm byte */
		+ 4			/* offset */
		+ immed_size;		/* immediate field */
#ifdef DEBUG_UPROBES_RIP
{
	int i;
	BUG_ON(instruction_size > 15);
	printk(KERN_INFO "Munging rip-relative insn:");
	for (i = 0; i < instruction_size; i++)
		printk(" %2.2x", ppt->insn[i]);
	printk("\n");
}
#endif

	/*
	 * Convert from rip-relative addressing to indirect addressing
	 * via a scratch register.  Change the r/m field from 0x5 (%rip)
	 * to 0x0 (%rax) or 0x1 (%rcx), and squeeze out the offset field.
	 */
	if (reg == 0) {
		/*
		 * The register operand (if any) is either the A register
		 * (%rax, %eax, etc.) or (if the 0x4 bit is set in the
		 * REX prefix) %r8.  In any case, we know the C register
		 * is NOT the register operand, so we use %rcx (register
		 * #1) for the scratch register.
		 */
		ppt->arch_info.flags |= UPFIX_RIP_RCX;
		/* Change modrm from 00 000 101 to 00 000 001. */
		*insn = 0x1;
	} else {
		/* Use %rax (register #0) for the scratch register. */
		ppt->arch_info.flags |= UPFIX_RIP_RAX;
		/* Change modrm from 00 xxx 101 to 00 xxx 000 */
		*insn = (reg << 3);
	}

	/* Target address = address of next instruction + (signed) offset */
	insn++;
	ppt->arch_info.rip_target_address =
			(long) ppt->vaddr + instruction_size + *((s32*)insn);
	if (immed_size)
		memmove(insn, insn+4, immed_size);
#ifdef DEBUG_UPROBES_RIP
{
	int i;
	printk(KERN_INFO "Munged rip-relative insn: ");
	for (i = 0; i < instruction_size-4; i++)
		printk(" %2.2x", ppt->insn[i]);
	printk("\n");
	printk(KERN_INFO "Target address = %#lx\n",
				ppt->arch_info.rip_target_address);
}
#endif
	return 1;
}
#endif

/*
 * Get an instruction slot from the process's SSOL area, containing the
 * instruction at ppt's probepoint.  Point the rip at that slot, in
 * preparation for single-stepping out of line.
 *
 * If we're emulating a rip-relative instruction, save the contents
 * of the scratch register and store the target address in that register.
 */
static
void uprobe_pre_ssout(struct uprobe_task *utask, struct uprobe_probept *ppt,
		struct pt_regs *regs)
{
	struct uprobe_ssol_slot *slot;

	slot = uprobe_get_insn_slot(ppt);
	if (!slot) {
		utask->doomed = 1;
		return;
	}

	REGS_IP = (long)slot->insn;
	utask->singlestep_addr = REGS_IP;
#ifdef CONFIG_X86_64
	if (ppt->arch_info.flags & UPFIX_RIP_RAX) {
		utask->arch_info.saved_scratch_register = REGS_AX;
		REGS_AX = ppt->arch_info.rip_target_address;
	} else if (ppt->arch_info.flags & UPFIX_RIP_RCX) {
		utask->arch_info.saved_scratch_register = REGS_CX;
		REGS_CX = ppt->arch_info.rip_target_address;
	}
#endif
}

/*
 * Called by uprobe_post_ssout() to adjust the return address
 * pushed by a call instruction executed out of line.
 */
static void adjust_ret_addr(unsigned long rsp, long correction,
					struct uprobe_task *utask)
{
	unsigned long nleft;
	if (is_32bit_app(current)) {
		s32 ra;
		nleft = copy_from_user(&ra, (const void __user *) rsp, 4);
		if (unlikely(nleft != 0))
			goto fail;
		ra += (s32) correction;
		nleft = copy_to_user((void __user *) rsp, &ra, 4);
		if (unlikely(nleft != 0))
			goto fail;
	} else {
		s64 ra;
		nleft = copy_from_user(&ra, (const void __user *) rsp, 8);
		if (unlikely(nleft != 0))
			goto fail;
		ra += correction;
		nleft = copy_to_user((void __user *) rsp, &ra, 8);
		if (unlikely(nleft != 0))
			goto fail;
	}
	return;

fail:
	printk(KERN_ERR
		"uprobes: Failed to adjust return address after"
		" single-stepping call instruction;"
		" pid=%d, rsp=%#lx\n", current->pid, rsp);
	utask->doomed = 1;
}

/*
 * Called after single-stepping.  ppt->vaddr is the address of the
 * instruction whose first byte has been replaced by the "int3"
 * instruction.  To avoid the SMP problems that can occur when we
 * temporarily put back the original opcode to single-step, we
 * single-stepped a copy of the instruction.  The address of this
 * copy is utask->singlestep_addr.
 *
 * This function prepares to return from the post-single-step
 * trap.  We have to fix things up as follows:
 *
 * 0) Typically, the new rip is relative to the copied instruction.  We
 * need to make it relative to the original instruction.  Exceptions are
 * return instructions and absolute or indirect jump or call instructions.
 *
 * 1) If the single-stepped instruction was a call, the return address
 * that is atop the stack is the address following the copied instruction.
 * We need to make it the address following the original instruction.
 *
 * 2) If the original instruction was a rip-relative instruction such as
 * "movl %edx,0xnnnn(%rip)", we have instead executed an equivalent
 * instruction using a scratch register -- e.g., "movl %edx,(%rax)".
 * We need to restore the contents of the scratch register and adjust
 * the rip, keeping in mind that the instruction we executed is 4 bytes
 * shorter than the original instruction (since we squeezed out the offset
 * field).
 */
static
void uprobe_post_ssout(struct uprobe_task *utask, struct uprobe_probept *ppt,
		struct pt_regs *regs)
{
	unsigned long copy_rip = utask->singlestep_addr;
	unsigned long orig_rip = ppt->vaddr;
	long correction = (long) (orig_rip - copy_rip);
	unsigned long flags = ppt->arch_info.flags;

	up_read(&ppt->slot->rwsem);

#ifdef CONFIG_X86_64
	if (flags & (UPFIX_RIP_RAX | UPFIX_RIP_RCX)) {
		if (flags & UPFIX_RIP_RAX)
			REGS_AX = utask->arch_info.saved_scratch_register;
		else
			REGS_CX = utask->arch_info.saved_scratch_register;
		/*
		 * The original instruction includes a displacement, and so
		 * is 4 bytes longer than what we've just single-stepped.
		 * Fall through to handle stuff like "jmpq *...(%rip)" and
		 * "callq *...(%rip)".
		 */
		correction += 4;
	}
#endif

	if (flags & UPFIX_RETURN)
		adjust_ret_addr(REGS_SP, correction, utask);

	if (!(flags & UPFIX_ABS_IP))
		REGS_IP += correction;
}

/*
 * Replace the return address with the trampoline address.  Returns
 * the original return address.
 */
static
unsigned long arch_hijack_uret_addr(unsigned long trampoline_address,
	struct pt_regs *regs, struct uprobe_task *utask)
{
	int nleft;
	unsigned long orig_ret_addr = 0;  /* clear high bits for 32-bit apps */
	size_t rasize;

	if (is_32bit_app(current))
		rasize = 4;
	else
		rasize = 8;
	nleft = copy_from_user(&orig_ret_addr, (const void __user *) REGS_SP,
		rasize);
	if (unlikely(nleft != 0))
		return 0;
	if (orig_ret_addr == trampoline_address)
		/*
		 * There's another uretprobe on this function, and it was
		 * processed first, so the return address has already
		 * been hijacked.
		 */
		return orig_ret_addr;

	nleft = copy_to_user((void __user *) REGS_SP, &trampoline_address,
		rasize);
	if (unlikely(nleft != 0)) {
		if (nleft != rasize) {
			printk(KERN_ERR "uretprobe_entry_handler: "
				"return address partially clobbered -- "
				"pid=%d, %%sp=%#lx, %%ip=%#lx\n",
				current->pid, REGS_SP, REGS_IP);
			utask->doomed = 1;
		} // else nothing written, so no harm
		return 0;
	}
	return orig_ret_addr;
}

/*
 * On x86_32, if a function returns a struct or union, the return
 * value is copied into an area created by the caller.  The address
 * of this area is passed on the stack as a "hidden" first argument.
 * When such a function returns, it uses a "ret $4" instruction to pop
 * not only the return address but also the hidden arg.  To accommodate
 * such functions, we add 4 bytes of slop when predicting the return
 * address. See PR #10078.
 */
#define STRUCT_RETURN_SLOP 4

static
unsigned long arch_predict_sp_at_ret(struct pt_regs *regs,
		struct task_struct *tsk)
{
	if (test_tsk_thread_flag(tsk, TIF_IA32))
		return (unsigned long) (REGS_SP + 4 + STRUCT_RETURN_SLOP);
	else
		return (unsigned long) (REGS_SP + 8);
}

/* Check if instruction is nop and return true. */
static int uprobe_emulate_insn(struct pt_regs *regs,
						struct uprobe_probept *ppt)
{
	uprobe_opcode_t *insn = ppt->insn;

	if (insn[0] == 0x90)
		/* regs->ip already points to the insn after the nop/int3. */
		return 1;

	/* TODO: add multibyte nop instructions */
	/* For multibyte nop instructions, we need to set ip accordingly. */
	return 0;
}

Your Access Expired	Date. in : 13-08-2025
Regist : 09-12-2024	Expired : 01-12-2027