mirror of
https://github.com/torvalds/linux.git
synced 2024-12-27 21:33:00 +00:00
8e89c0be17
See the previous "Emulate unconditional relative jmp's" which explains
why we can not execute "jmp" out-of-line, the same applies to "call".
Emulating of rip-relative call is trivial, we only need to additionally
push the ret-address. If this fails, we execute this instruction out of
line and this should trigger the trap, the probed application should die
or the same insn will be restarted if a signal handler expands the stack.
We do not even need ->post_xol() for this case.
But there is a corner (and almost theoretical) case: another thread can
expand the stack right before we execute this insn out of line. In this
case it hit the same problem we are trying to solve. So we simply turn
the probed insn into "call 1f; 1:" and add ->post_xol() which restores
->sp and restarts.
Many thanks to Jonathan who finally found the standalone reproducer,
otherwise I would never resolve the "random SIGSEGV's under systemtap"
bug-report. Now that the problem is clear we can write the simplified
test-case:
void probe_func(void), callee(void);
int failed = 1;
asm (
".text\n"
".align 4096\n"
".globl probe_func\n"
"probe_func:\n"
"call callee\n"
"ret"
);
/*
* This assumes that:
*
* - &probe_func = 0x401000 + a_bit, aligned = 0x402000
*
* - xol_vma->vm_start = TASK_SIZE_MAX - PAGE_SIZE = 0x7fffffffe000
* as xol_add_vma() asks; the 1st slot = 0x7fffffffe080
*
* so we can target the non-canonical address from xol_vma using
* the simple math below, 100 * 4096 is just the random offset
*/
asm (".org . + 0x800000000000 - 0x7fffffffe080 - 5 - 1 + 100 * 4096\n");
void callee(void)
{
failed = 0;
}
int main(void)
{
probe_func();
return failed;
}
It SIGSEGV's if you probe "probe_func" (although this is not very reliable,
randomize_va_space/etc can change the placement of xol area).
Note: as Denys Vlasenko pointed out, amd and intel treat "callw" (0x66 0xe8)
differently. This patch relies on lib/insn.c and thus implements the intel's
behaviour: 0x66 is simply ignored. Fortunately nothing sane should ever use
this insn, so we postpone the fix until we decide what should we do; emulate
or not, support or not, etc.
Reported-by: Jonathan Lebon <jlebon@redhat.com>
Signed-off-by: Oleg Nesterov <oleg@redhat.com>
Reviewed-by: Jim Keniston <jkenisto@us.ibm.com>
68 lines
1.6 KiB
C
68 lines
1.6 KiB
C
#ifndef _ASM_UPROBES_H
|
|
#define _ASM_UPROBES_H
|
|
/*
|
|
* User-space Probes (UProbes) for x86
|
|
*
|
|
* This program is free software; you can redistribute it and/or modify
|
|
* it under the terms of the GNU General Public License as published by
|
|
* the Free Software Foundation; either version 2 of the License, or
|
|
* (at your option) any later version.
|
|
*
|
|
* This program is distributed in the hope that it will be useful,
|
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
* GNU General Public License for more details.
|
|
*
|
|
* You should have received a copy of the GNU General Public License
|
|
* along with this program; if not, write to the Free Software
|
|
* Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
|
|
*
|
|
* Copyright (C) IBM Corporation, 2008-2011
|
|
* Authors:
|
|
* Srikar Dronamraju
|
|
* Jim Keniston
|
|
*/
|
|
|
|
#include <linux/notifier.h>
|
|
|
|
typedef u8 uprobe_opcode_t;
|
|
|
|
#define MAX_UINSN_BYTES 16
|
|
#define UPROBE_XOL_SLOT_BYTES 128 /* to keep it cache aligned */
|
|
|
|
#define UPROBE_SWBP_INSN 0xcc
|
|
#define UPROBE_SWBP_INSN_SIZE 1
|
|
|
|
struct uprobe_xol_ops;
|
|
|
|
struct arch_uprobe {
|
|
union {
|
|
u8 insn[MAX_UINSN_BYTES];
|
|
u8 ixol[MAX_UINSN_BYTES];
|
|
};
|
|
|
|
u16 fixups;
|
|
const struct uprobe_xol_ops *ops;
|
|
|
|
union {
|
|
#ifdef CONFIG_X86_64
|
|
unsigned long rip_rela_target_address;
|
|
#endif
|
|
struct {
|
|
s32 offs;
|
|
u8 ilen;
|
|
u8 opc1;
|
|
} branch;
|
|
};
|
|
};
|
|
|
|
struct arch_uprobe_task {
|
|
#ifdef CONFIG_X86_64
|
|
unsigned long saved_scratch_register;
|
|
#endif
|
|
unsigned int saved_trap_nr;
|
|
unsigned int saved_tf;
|
|
};
|
|
|
|
#endif /* _ASM_UPROBES_H */
|