Skip to content

Commit f3a112c

Browse files
mhiramatAlexei Starovoitov
mhiramat
authored and
Alexei Starovoitov
committed
x86,rethook,kprobes: Replace kretprobe with rethook on x86
Replaces the kretprobe code with rethook on x86. With this patch, kretprobe on x86 uses the rethook instead of kretprobe specific trampoline code. Signed-off-by: Masami Hiramatsu <mhiramat@kernel.org> Signed-off-by: Alexei Starovoitov <ast@kernel.org> Tested-by: Jiri Olsa <jolsa@kernel.org> Link: https://lore.kernel.org/bpf/164826163692.2455864.13745421016848209527.stgit@devnote2
1 parent 73f9b91 commit f3a112c

7 files changed

Lines changed: 144 additions & 124 deletions

File tree

‎arch/x86/Kconfig‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -224,6 +224,7 @@ config X86
224224
select HAVE_KPROBES_ON_FTRACE
225225
select HAVE_FUNCTION_ERROR_INJECTION
226226
select HAVE_KRETPROBES
227+
select HAVE_RETHOOK
227228
select HAVE_KVM
228229
select HAVE_LIVEPATCH if X86_64
229230
select HAVE_MIXED_BREAKPOINTS_REGS

‎arch/x86/include/asm/unwind.h‎

Lines changed: 11 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@
44

55
#include <linux/sched.h>
66
#include <linux/ftrace.h>
7-
#include <linux/kprobes.h>
7+
#include <linux/rethook.h>
88
#include <asm/ptrace.h>
99
#include <asm/stacktrace.h>
1010

@@ -16,7 +16,7 @@ struct unwind_state {
1616
unsigned long stack_mask;
1717
struct task_struct *task;
1818
int graph_idx;
19-
#ifdef CONFIG_KRETPROBES
19+
#if defined(CONFIG_RETHOOK)
2020
struct llist_node *kr_cur;
2121
#endif
2222
bool error;
@@ -104,19 +104,18 @@ void unwind_module_init(struct module *mod, void *orc_ip, size_t orc_ip_size,
104104
#endif
105105

106106
static inline
107-
unsigned long unwind_recover_kretprobe(struct unwind_state *state,
108-
unsigned long addr, unsigned long *addr_p)
107+
unsigned long unwind_recover_rethook(struct unwind_state *state,
108+
unsigned long addr, unsigned long *addr_p)
109109
{
110-
#ifdef CONFIG_KRETPROBES
111-
return is_kretprobe_trampoline(addr) ?
112-
kretprobe_find_ret_addr(state->task, addr_p, &state->kr_cur) :
113-
addr;
114-
#else
115-
return addr;
110+
#ifdef CONFIG_RETHOOK
111+
if (is_rethook_trampoline(addr))
112+
return rethook_find_ret_addr(state->task, (unsigned long)addr_p,
113+
&state->kr_cur);
116114
#endif
115+
return addr;
117116
}
118117

119-
/* Recover the return address modified by kretprobe and ftrace_graph. */
118+
/* Recover the return address modified by rethook and ftrace_graph. */
120119
static inline
121120
unsigned long unwind_recover_ret_addr(struct unwind_state *state,
122121
unsigned long addr, unsigned long *addr_p)
@@ -125,7 +124,7 @@ unsigned long unwind_recover_ret_addr(struct unwind_state *state,
125124

126125
ret = ftrace_graph_ret_addr(state->task, &state->graph_idx,
127126
addr, addr_p);
128-
return unwind_recover_kretprobe(state, ret, addr_p);
127+
return unwind_recover_rethook(state, ret, addr_p);
129128
}
130129

131130
/*

‎arch/x86/kernel/Makefile‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -103,6 +103,7 @@ obj-$(CONFIG_FUNCTION_GRAPH_TRACER) += ftrace.o
103103
obj-$(CONFIG_FTRACE_SYSCALLS) += ftrace.o
104104
obj-$(CONFIG_X86_TSC) += trace_clock.o
105105
obj-$(CONFIG_TRACING) += trace.o
106+
obj-$(CONFIG_RETHOOK) += rethook.o
106107
obj-$(CONFIG_CRASH_CORE) += crash_core_$(BITS).o
107108
obj-$(CONFIG_KEXEC_CORE) += machine_kexec_$(BITS).o
108109
obj-$(CONFIG_KEXEC_CORE) += relocate_kernel_$(BITS).o crash.o

‎arch/x86/kernel/kprobes/common.h‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@
66

77
#include <asm/asm.h>
88
#include <asm/frame.h>
9+
#include <asm/insn.h>
910

1011
#ifdef CONFIG_X86_64
1112

‎arch/x86/kernel/kprobes/core.c‎

Lines changed: 0 additions & 107 deletions
Original file line numberDiff line numberDiff line change
@@ -811,18 +811,6 @@ set_current_kprobe(struct kprobe *p, struct pt_regs *regs,
811811
= (regs->flags & X86_EFLAGS_IF);
812812
}
813813

814-
void arch_prepare_kretprobe(struct kretprobe_instance *ri, struct pt_regs *regs)
815-
{
816-
unsigned long *sara = stack_addr(regs);
817-
818-
ri->ret_addr = (kprobe_opcode_t *) *sara;
819-
ri->fp = sara;
820-
821-
/* Replace the return addr with trampoline addr */
822-
*sara = (unsigned long) &__kretprobe_trampoline;
823-
}
824-
NOKPROBE_SYMBOL(arch_prepare_kretprobe);
825-
826814
static void kprobe_post_process(struct kprobe *cur, struct pt_regs *regs,
827815
struct kprobe_ctlblk *kcb)
828816
{
@@ -1023,101 +1011,6 @@ int kprobe_int3_handler(struct pt_regs *regs)
10231011
}
10241012
NOKPROBE_SYMBOL(kprobe_int3_handler);
10251013

1026-
/*
1027-
* When a retprobed function returns, this code saves registers and
1028-
* calls trampoline_handler() runs, which calls the kretprobe's handler.
1029-
*/
1030-
asm(
1031-
".text\n"
1032-
".global __kretprobe_trampoline\n"
1033-
".type __kretprobe_trampoline, @function\n"
1034-
"__kretprobe_trampoline:\n"
1035-
#ifdef CONFIG_X86_64
1036-
ANNOTATE_NOENDBR
1037-
/* Push a fake return address to tell the unwinder it's a kretprobe. */
1038-
" pushq $__kretprobe_trampoline\n"
1039-
UNWIND_HINT_FUNC
1040-
/* Save the 'sp - 8', this will be fixed later. */
1041-
" pushq %rsp\n"
1042-
" pushfq\n"
1043-
SAVE_REGS_STRING
1044-
" movq %rsp, %rdi\n"
1045-
" call trampoline_handler\n"
1046-
RESTORE_REGS_STRING
1047-
/* In trampoline_handler(), 'regs->flags' is copied to 'regs->sp'. */
1048-
" addq $8, %rsp\n"
1049-
" popfq\n"
1050-
#else
1051-
/* Push a fake return address to tell the unwinder it's a kretprobe. */
1052-
" pushl $__kretprobe_trampoline\n"
1053-
UNWIND_HINT_FUNC
1054-
/* Save the 'sp - 4', this will be fixed later. */
1055-
" pushl %esp\n"
1056-
" pushfl\n"
1057-
SAVE_REGS_STRING
1058-
" movl %esp, %eax\n"
1059-
" call trampoline_handler\n"
1060-
RESTORE_REGS_STRING
1061-
/* In trampoline_handler(), 'regs->flags' is copied to 'regs->sp'. */
1062-
" addl $4, %esp\n"
1063-
" popfl\n"
1064-
#endif
1065-
ASM_RET
1066-
".size __kretprobe_trampoline, .-__kretprobe_trampoline\n"
1067-
);
1068-
NOKPROBE_SYMBOL(__kretprobe_trampoline);
1069-
/*
1070-
* __kretprobe_trampoline() skips updating frame pointer. The frame pointer
1071-
* saved in trampoline_handler() points to the real caller function's
1072-
* frame pointer. Thus the __kretprobe_trampoline() doesn't have a
1073-
* standard stack frame with CONFIG_FRAME_POINTER=y.
1074-
* Let's mark it non-standard function. Anyway, FP unwinder can correctly
1075-
* unwind without the hint.
1076-
*/
1077-
STACK_FRAME_NON_STANDARD_FP(__kretprobe_trampoline);
1078-
1079-
/* This is called from kretprobe_trampoline_handler(). */
1080-
void arch_kretprobe_fixup_return(struct pt_regs *regs,
1081-
kprobe_opcode_t *correct_ret_addr)
1082-
{
1083-
unsigned long *frame_pointer = &regs->sp + 1;
1084-
1085-
/* Replace fake return address with real one. */
1086-
*frame_pointer = (unsigned long)correct_ret_addr;
1087-
}
1088-
1089-
/*
1090-
* Called from __kretprobe_trampoline
1091-
*/
1092-
__used __visible void trampoline_handler(struct pt_regs *regs)
1093-
{
1094-
unsigned long *frame_pointer;
1095-
1096-
/* fixup registers */
1097-
regs->cs = __KERNEL_CS;
1098-
#ifdef CONFIG_X86_32
1099-
regs->gs = 0;
1100-
#endif
1101-
regs->ip = (unsigned long)&__kretprobe_trampoline;
1102-
regs->orig_ax = ~0UL;
1103-
regs->sp += sizeof(long);
1104-
frame_pointer = &regs->sp + 1;
1105-
1106-
/*
1107-
* The return address at 'frame_pointer' is recovered by the
1108-
* arch_kretprobe_fixup_return() which called from the
1109-
* kretprobe_trampoline_handler().
1110-
*/
1111-
kretprobe_trampoline_handler(regs, frame_pointer);
1112-
1113-
/*
1114-
* Copy FLAGS to 'pt_regs::sp' so that __kretprobe_trapmoline()
1115-
* can do RET right after POPF.
1116-
*/
1117-
regs->sp = regs->flags;
1118-
}
1119-
NOKPROBE_SYMBOL(trampoline_handler);
1120-
11211014
int kprobe_fault_handler(struct pt_regs *regs, int trapnr)
11221015
{
11231016
struct kprobe *cur = kprobe_running();

‎arch/x86/kernel/rethook.c‎

Lines changed: 125 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,125 @@
1+
// SPDX-License-Identifier: GPL-2.0-or-later
2+
/*
3+
* x86 implementation of rethook. Mostly copied from arch/x86/kernel/kprobes/core.c.
4+
*/
5+
#include <linux/bug.h>
6+
#include <linux/rethook.h>
7+
#include <linux/kprobes.h>
8+
#include <linux/objtool.h>
9+
10+
#include "kprobes/common.h"
11+
12+
__visible void arch_rethook_trampoline_callback(struct pt_regs *regs);
13+
14+
#ifndef ANNOTATE_NOENDBR
15+
#define ANNOTATE_NOENDBR
16+
#endif
17+
18+
/*
19+
* When a target function returns, this code saves registers and calls
20+
* arch_rethook_trampoline_callback(), which calls the rethook handler.
21+
*/
22+
asm(
23+
".text\n"
24+
".global arch_rethook_trampoline\n"
25+
".type arch_rethook_trampoline, @function\n"
26+
"arch_rethook_trampoline:\n"
27+
#ifdef CONFIG_X86_64
28+
ANNOTATE_NOENDBR /* This is only jumped from ret instruction */
29+
/* Push a fake return address to tell the unwinder it's a rethook. */
30+
" pushq $arch_rethook_trampoline\n"
31+
UNWIND_HINT_FUNC
32+
/* Save the 'sp - 8', this will be fixed later. */
33+
" pushq %rsp\n"
34+
" pushfq\n"
35+
SAVE_REGS_STRING
36+
" movq %rsp, %rdi\n"
37+
" call arch_rethook_trampoline_callback\n"
38+
RESTORE_REGS_STRING
39+
/* In the callback function, 'regs->flags' is copied to 'regs->sp'. */
40+
" addq $8, %rsp\n"
41+
" popfq\n"
42+
#else
43+
/* Push a fake return address to tell the unwinder it's a rethook. */
44+
" pushl $arch_rethook_trampoline\n"
45+
UNWIND_HINT_FUNC
46+
/* Save the 'sp - 4', this will be fixed later. */
47+
" pushl %esp\n"
48+
" pushfl\n"
49+
SAVE_REGS_STRING
50+
" movl %esp, %eax\n"
51+
" call arch_rethook_trampoline_callback\n"
52+
RESTORE_REGS_STRING
53+
/* In the callback function, 'regs->flags' is copied to 'regs->sp'. */
54+
" addl $4, %esp\n"
55+
" popfl\n"
56+
#endif
57+
ASM_RET
58+
".size arch_rethook_trampoline, .-arch_rethook_trampoline\n"
59+
);
60+
NOKPROBE_SYMBOL(arch_rethook_trampoline);
61+
62+
/*
63+
* Called from arch_rethook_trampoline
64+
*/
65+
__used __visible void arch_rethook_trampoline_callback(struct pt_regs *regs)
66+
{
67+
unsigned long *frame_pointer;
68+
69+
/* fixup registers */
70+
regs->cs = __KERNEL_CS;
71+
#ifdef CONFIG_X86_32
72+
regs->gs = 0;
73+
#endif
74+
regs->ip = (unsigned long)&arch_rethook_trampoline;
75+
regs->orig_ax = ~0UL;
76+
regs->sp += sizeof(long);
77+
frame_pointer = &regs->sp + 1;
78+
79+
/*
80+
* The return address at 'frame_pointer' is recovered by the
81+
* arch_rethook_fixup_return() which called from this
82+
* rethook_trampoline_handler().
83+
*/
84+
rethook_trampoline_handler(regs, (unsigned long)frame_pointer);
85+
86+
/*
87+
* Copy FLAGS to 'pt_regs::sp' so that arch_rethook_trapmoline()
88+
* can do RET right after POPF.
89+
*/
90+
regs->sp = regs->flags;
91+
}
92+
NOKPROBE_SYMBOL(arch_rethook_trampoline_callback);
93+
94+
/*
95+
* arch_rethook_trampoline() skips updating frame pointer. The frame pointer
96+
* saved in arch_rethook_trampoline_callback() points to the real caller
97+
* function's frame pointer. Thus the arch_rethook_trampoline() doesn't have
98+
* a standard stack frame with CONFIG_FRAME_POINTER=y.
99+
* Let's mark it non-standard function. Anyway, FP unwinder can correctly
100+
* unwind without the hint.
101+
*/
102+
STACK_FRAME_NON_STANDARD_FP(arch_rethook_trampoline);
103+
104+
/* This is called from rethook_trampoline_handler(). */
105+
void arch_rethook_fixup_return(struct pt_regs *regs,
106+
unsigned long correct_ret_addr)
107+
{
108+
unsigned long *frame_pointer = &regs->sp + 1;
109+
110+
/* Replace fake return address with real one. */
111+
*frame_pointer = correct_ret_addr;
112+
}
113+
NOKPROBE_SYMBOL(arch_rethook_fixup_return);
114+
115+
void arch_rethook_prepare(struct rethook_node *rh, struct pt_regs *regs, bool mcount)
116+
{
117+
unsigned long *stack = (unsigned long *)regs->sp;
118+
119+
rh->ret_addr = stack[0];
120+
rh->frame = regs->sp;
121+
122+
/* Replace the return addr with trampoline addr */
123+
stack[0] = (unsigned long) arch_rethook_trampoline;
124+
}
125+
NOKPROBE_SYMBOL(arch_rethook_prepare);

‎arch/x86/kernel/unwind_orc.c‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -550,15 +550,15 @@ bool unwind_next_frame(struct unwind_state *state)
550550
}
551551
/*
552552
* There is a small chance to interrupt at the entry of
553-
* __kretprobe_trampoline() where the ORC info doesn't exist.
554-
* That point is right after the RET to __kretprobe_trampoline()
553+
* arch_rethook_trampoline() where the ORC info doesn't exist.
554+
* That point is right after the RET to arch_rethook_trampoline()
555555
* which was modified return address.
556-
* At that point, the @addr_p of the unwind_recover_kretprobe()
556+
* At that point, the @addr_p of the unwind_recover_rethook()
557557
* (this has to point the address of the stack entry storing
558558
* the modified return address) must be "SP - (a stack entry)"
559559
* because SP is incremented by the RET.
560560
*/
561-
state->ip = unwind_recover_kretprobe(state, state->ip,
561+
state->ip = unwind_recover_rethook(state, state->ip,
562562
(unsigned long *)(state->sp - sizeof(long)));
563563
state->regs = (struct pt_regs *)sp;
564564
state->prev_regs = NULL;
@@ -573,7 +573,7 @@ bool unwind_next_frame(struct unwind_state *state)
573573
goto err;
574574
}
575575
/* See UNWIND_HINT_TYPE_REGS case comment. */
576-
state->ip = unwind_recover_kretprobe(state, state->ip,
576+
state->ip = unwind_recover_rethook(state, state->ip,
577577
(unsigned long *)(state->sp - sizeof(long)));
578578

579579
if (state->full_regs)

0 commit comments

Comments
 (0)