2005-04-17 02:20:36 +04:00
# ifndef _ASM_KPROBES_H
# define _ASM_KPROBES_H
/*
* Kernel Probes ( KProbes )
* include / asm - x86_64 / kprobes . h
*
* This program is free software ; you can redistribute it and / or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation ; either version 2 of the License , or
* ( at your option ) any later version .
*
* This program is distributed in the hope that it will be useful ,
* but WITHOUT ANY WARRANTY ; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE . See the
* GNU General Public License for more details .
*
* You should have received a copy of the GNU General Public License
* along with this program ; if not , write to the Free Software
* Foundation , Inc . , 59 Temple Place - Suite 330 , Boston , MA 02111 - 1307 , USA .
*
* Copyright ( C ) IBM Corporation , 2002 , 2004
*
* 2004 - Oct Prasanna S Panchamukhi < prasanna @ in . ibm . com > and Jim Keniston
* kenistoj @ us . ibm . com adopted from i386 .
*/
# include <linux/types.h>
# include <linux/ptrace.h>
2005-11-07 12:00:12 +03:00
# include <linux/percpu.h>
2005-04-17 02:20:36 +04:00
2006-01-10 07:52:41 +03:00
# define __ARCH_WANT_KPROBES_INSN_SLOT
2005-04-17 02:20:36 +04:00
struct pt_regs ;
2006-01-10 07:52:46 +03:00
struct kprobe ;
2005-04-17 02:20:36 +04:00
typedef u8 kprobe_opcode_t ;
# define BREAKPOINT_INSTRUCTION 0xcc
# define MAX_INSN_SIZE 15
# define MAX_STACK_SIZE 64
# define MIN_STACK_SIZE(ADDR) (((MAX_STACK_SIZE) < \
( ( ( unsigned long ) current_thread_info ( ) ) + THREAD_SIZE - ( ADDR ) ) ) \
? ( MAX_STACK_SIZE ) \
: ( ( ( unsigned long ) current_thread_info ( ) ) + THREAD_SIZE - ( ADDR ) ) )
# define JPROBE_ENTRY(pentry) (kprobe_opcode_t *)pentry
[PATCH] x86_64 specific function return probes
The following patch adds the x86_64 architecture specific implementation
for function return probes.
Function return probes is a mechanism built on top of kprobes that allows
a caller to register a handler to be called when a given function exits.
For example, to instrument the return path of sys_mkdir:
static int sys_mkdir_exit(struct kretprobe_instance *i, struct pt_regs *regs)
{
printk("sys_mkdir exited\n");
return 0;
}
static struct kretprobe return_probe = {
.handler = sys_mkdir_exit,
};
<inside setup function>
return_probe.kp.addr = (kprobe_opcode_t *) kallsyms_lookup_name("sys_mkdir");
if (register_kretprobe(&return_probe)) {
printk(KERN_DEBUG "Unable to register return probe!\n");
/* do error path */
}
<inside cleanup function>
unregister_kretprobe(&return_probe);
The way this works is that:
* At system initialization time, kernel/kprobes.c installs a kprobe
on a function called kretprobe_trampoline() that is implemented in
the arch/x86_64/kernel/kprobes.c (More on this later)
* When a return probe is registered using register_kretprobe(),
kernel/kprobes.c will install a kprobe on the first instruction of the
targeted function with the pre handler set to arch_prepare_kretprobe()
which is implemented in arch/x86_64/kernel/kprobes.c.
* arch_prepare_kretprobe() will prepare a kretprobe instance that stores:
- nodes for hanging this instance in an empty or free list
- a pointer to the return probe
- the original return address
- a pointer to the stack address
With all this stowed away, arch_prepare_kretprobe() then sets the return
address for the targeted function to a special trampoline function called
kretprobe_trampoline() implemented in arch/x86_64/kernel/kprobes.c
* The kprobe completes as normal, with control passing back to the target
function that executes as normal, and eventually returns to our trampoline
function.
* Since a kprobe was installed on kretprobe_trampoline() during system
initialization, control passes back to kprobes via the architecture
specific function trampoline_probe_handler() which will lookup the
instance in an hlist maintained by kernel/kprobes.c, and then call
the handler function.
* When trampoline_probe_handler() is done, the kprobes infrastructure
single steps the original instruction (in this case just a top), and
then calls trampoline_post_handler(). trampoline_post_handler() then
looks up the instance again, puts the instance back on the free list,
and then makes a long jump back to the original return instruction.
So to recap, to instrument the exit path of a function this implementation
will cause four interruptions:
- A breakpoint at the very beginning of the function allowing us to
switch out the return address
- A single step interruption to execute the original instruction that
we replaced with the break instruction (normal kprobe flow)
- A breakpoint in the trampoline function where our instrumented function
returned to
- A single step interruption to execute the original instruction that
we replaced with the break instruction (normal kprobe flow)
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2005-06-23 11:09:23 +04:00
# define ARCH_SUPPORTS_KRETPROBES
void kretprobe_trampoline ( void ) ;
2006-01-10 07:52:46 +03:00
extern void arch_remove_kprobe ( struct kprobe * p ) ;
2005-04-17 02:20:36 +04:00
/* Architecture specific copy of original instruction*/
struct arch_specific_insn {
/* copy of the original instruction */
kprobe_opcode_t * insn ;
} ;
2005-11-07 12:00:12 +03:00
struct prev_kprobe {
struct kprobe * kp ;
unsigned long status ;
unsigned long old_rflags ;
unsigned long saved_rflags ;
} ;
/* per-cpu kprobe control block */
struct kprobe_ctlblk {
unsigned long kprobe_status ;
unsigned long kprobe_old_rflags ;
unsigned long kprobe_saved_rflags ;
long * jprobe_saved_rsp ;
struct pt_regs jprobe_saved_regs ;
kprobe_opcode_t jprobes_stack [ MAX_STACK_SIZE ] ;
struct prev_kprobe prev_kprobe ;
} ;
2005-04-17 02:20:36 +04:00
/* trap3/1 are intr gates for kprobes. So, restore the status of IF,
* if necessary , before executing the original int3 / 1 ( trap ) handler .
*/
static inline void restore_interrupts ( struct pt_regs * regs )
{
if ( regs - > eflags & IF_MASK )
local_irq_enable ( ) ;
}
extern int post_kprobe_handler ( struct pt_regs * regs ) ;
extern int kprobe_fault_handler ( struct pt_regs * regs , int trapnr ) ;
extern int kprobe_handler ( struct pt_regs * regs ) ;
extern int kprobe_exceptions_notify ( struct notifier_block * self ,
unsigned long val , void * data ) ;
# endif /* _ASM_KPROBES_H */
