Minki/linux
1
0
Fork 1
mirror of https://github.com/torvalds/linux.git synced 2024-11-16 17:12:06 +00:00
Code Issues Packages Projects Releases Wiki Activity

uprobes/x86: Simplify rip-relative handling

Browse Source 
It is possible to replace rip-relative addressing mode with addressing
mode of the same length: (reg+disp32). This eliminates the need to fix
up immediate and correct for changing instruction length.

And we can kill arch_uprobe->def.riprel_target.

Signed-off-by: Denys Vlasenko <dvlasenk@redhat.com>
Reviewed-by: Jim Keniston <jkenisto@us.ibm.com>
Signed-off-by: Oleg Nesterov <oleg@redhat.com>
This commit is contained in:
Denys Vlasenko 2014-05-01 16:52:46 +02:00 committed by Oleg Nesterov
parent 29dedee0e6
commit 50204c6f6d
2 changed files with 30 additions and 44 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
arch/x86/include/asm/uprobes.h
View File

@ -50,9 +50,6 @@ struct arch_uprobe {
u8 opc1;
} branch;
struct {
#ifdef CONFIG_X86_64
long riprel_target;
#endif
u8 fixups;
u8 ilen;
} def;

71
arch/x86/kernel/uprobes.c
View File

@ -251,9 +251,9 @@ static inline bool is_64bit_mm(struct mm_struct *mm)
* If arch_uprobe->insn doesn't use rip-relative addressing, return
* immediately. Otherwise, rewrite the instruction so that it accesses
* its memory operand indirectly through a scratch register. Set
* def->fixups and def->riprel_target accordingly. (The contents of the
* scratch register will be saved before we single-step the modified
* instruction, and restored afterward).
* def->fixups accordingly. (The contents of the scratch register
* will be saved before we single-step the modified instruction,
* and restored afterward).
*
* We do this because a rip-relative instruction can access only a
* relatively small area (+/- 2 GB from the instruction), and the XOL
@ -264,9 +264,12 @@ static inline bool is_64bit_mm(struct mm_struct *mm)
*
* Some useful facts about rip-relative instructions:
*
* - There's always a modrm byte.
* - There's always a modrm byte with bit layout "00 reg 101".
* - There's never a SIB byte.
* - The displacement is always 4 bytes.
* - REX.B=1 bit in REX prefix, which normally extends r/m field,
* has no effect on rip-relative mode. It doesn't make modrm byte
* with r/m=101 refer to register 1101 = R13.
*/
static void riprel_analyze(struct arch_uprobe *auprobe, struct insn *insn)
{
@ -293,9 +296,8 @@ static void riprel_analyze(struct arch_uprobe *auprobe, struct insn *insn)
*/
cursor = auprobe->insn + insn_offset_modrm(insn);
/*
* Convert from rip-relative addressing to indirect addressing
* via a scratch register. Change the r/m field from 0x5 (%rip)
* to 0x0 (%rax) or 0x1 (%rcx), and squeeze out the offset field.
* Convert from rip-relative addressing
* to register-relative addressing via a scratch register.
*/
reg = MODRM_REG(insn);
if (reg == 0) {
@ -307,22 +309,21 @@ static void riprel_analyze(struct arch_uprobe *auprobe, struct insn *insn)
* #1) for the scratch register.
*/
auprobe->def.fixups |= UPROBE_FIX_RIP_CX;
/* Change modrm from 00 000 101 to 00 000 001. */
*cursor = 0x1;
/*
* Change modrm from "00 000 101" to "10 000 001". Example:
* 89 05 disp32 mov %eax,disp32(%rip) becomes
* 89 81 disp32 mov %eax,disp32(%rcx)
*/
*cursor = 0x81;
} else {
/* Use %rax (register #0) for the scratch register. */
auprobe->def.fixups |= UPROBE_FIX_RIP_AX;
/* Change modrm from 00 xxx 101 to 00 xxx 000 */
*cursor = (reg << 3);
}
/* Target address = address of next instruction + (signed) offset */
auprobe->def.riprel_target = (long)insn->length + insn->displacement.value;
/* Displacement field is gone; slide immediate field (if any) over. */
if (insn->immediate.nbytes) {
cursor++;
memmove(cursor, cursor + insn->displacement.nbytes, insn->immediate.nbytes);
/*
* Change modrm from "00 reg 101" to "10 reg 000". Example:
* 89 1d disp32 mov %edx,disp32(%rip) becomes
* 89 98 disp32 mov %edx,disp32(%rax)
*/
*cursor = (reg << 3) | 0x80;
}
}
@ -343,26 +344,17 @@ static void riprel_pre_xol(struct arch_uprobe *auprobe, struct pt_regs *regs)
unsigned long *sr = scratch_reg(auprobe, regs);
utask->autask.saved_scratch_register = *sr;
*sr = utask->vaddr + auprobe->def.riprel_target;
*sr = utask->vaddr + auprobe->def.ilen;
}
}
static void riprel_post_xol(struct arch_uprobe *auprobe, struct pt_regs *regs,
long *correction)
static void riprel_post_xol(struct arch_uprobe *auprobe, struct pt_regs *regs)
{
if (auprobe->def.fixups & (UPROBE_FIX_RIP_AX | UPROBE_FIX_RIP_CX)) {
struct uprobe_task *utask = current->utask;
unsigned long *sr = scratch_reg(auprobe, regs);
*sr = utask->autask.saved_scratch_register;
/*
* The original instruction includes a displacement, and so
* is 4 bytes longer than what we've just single-stepped.
* Caller may need to apply other fixups to handle stuff
* like "jmpq *...(%rip)" and "callq *...(%rip)".
*/
if (correction)
*correction += 4;
}
}
#else /* 32-bit: */
@ -379,8 +371,7 @@ static void riprel_analyze(struct arch_uprobe *auprobe, struct insn *insn)
static void riprel_pre_xol(struct arch_uprobe *auprobe, struct pt_regs *regs)
{
}
static void riprel_post_xol(struct arch_uprobe *auprobe, struct pt_regs *regs,
long *correction)
static void riprel_post_xol(struct arch_uprobe *auprobe, struct pt_regs *regs)
{
}
#endif /* CONFIG_X86_64 */
@ -417,10 +408,10 @@ static int push_ret_address(struct pt_regs *regs, unsigned long ip)
static int default_post_xol_op(struct arch_uprobe *auprobe, struct pt_regs *regs)
{
struct uprobe_task *utask = current->utask;
long correction = (long)(utask->vaddr - utask->xol_vaddr);
riprel_post_xol(auprobe, regs, &correction);
riprel_post_xol(auprobe, regs);
if (auprobe->def.fixups & UPROBE_FIX_IP) {
long correction = utask->vaddr - utask->xol_vaddr;
regs->ip += correction;
} else if (auprobe->def.fixups & UPROBE_FIX_CALL) {
regs->sp += sizeof_long();
@ -436,7 +427,7 @@ static int default_post_xol_op(struct arch_uprobe *auprobe, struct pt_regs *regs
static void default_abort_op(struct arch_uprobe *auprobe, struct pt_regs *regs)
{
riprel_post_xol(auprobe, regs, NULL);
riprel_post_xol(auprobe, regs);
}
static struct uprobe_xol_ops default_xol_ops = {
@ -732,11 +723,9 @@ bool arch_uprobe_xol_was_trapped(struct task_struct *t)
*
* If the original instruction was a rip-relative instruction such as
* "movl %edx,0xnnnn(%rip)", we have instead executed an equivalent
* instruction using a scratch register -- e.g., "movl %edx,(%rax)".
* We need to restore the contents of the scratch register and adjust
* the ip, keeping in mind that the instruction we executed is 4 bytes
* shorter than the original instruction (since we squeezed out the offset
* field). (FIX_RIP_AX or FIX_RIP_CX)
* instruction using a scratch register -- e.g., "movl %edx,0xnnnn(%rax)".
* We need to restore the contents of the scratch register
* (FIX_RIP_AX or FIX_RIP_CX).
*/
int arch_uprobe_post_xol(struct arch_uprobe *auprobe, struct pt_regs *regs)
{