Optprobes on powerpc are limited to kernel text area. We decided to also
optimize kretprobe_trampoline since that is also in kernel text area.
However,we failed to take into consideration the fact that the same
trampoline is also used to catch function returns from kernel modules.
As an example:
$ sudo modprobe kobject-example
$ sudo bash -c "echo 'r foo_show+8' > /sys/kernel/debug/tracing/kprobe_events"
$ sudo bash -c "echo 1 > /sys/kernel/debug/tracing/events/kprobes/enable"
$ sudo cat /sys/kernel/debug/kprobes/list
c000000000041350 k kretprobe_trampoline+0x0 [OPTIMIZED]
d000000000e00200 r foo_show+0x8 kobject_example
$ cat /sys/kernel/kobject_example/foo
Segmentation fault
With the below (trimmed) splat in dmesg:
Unable to handle kernel paging request for data at address 0xfec40000
Faulting instruction address: 0xc000000000041540
Oops: Kernel access of bad area, sig: 11 [#1]
...
NIP [c000000000041540] optimized_callback+0x70/0xe0
LR [c000000000041e60] optinsn_slot+0xf8/0x10000
Call Trace:
[c0000000c7327850] [c000000000289af4] alloc_set_pte+0x1c4/0x860 (unreliable)
[c0000000c7327890] [c000000000041e60] optinsn_slot+0xf8/0x10000
--- interrupt: 700 at 0xc0000000c7327a80
LR = kretprobe_trampoline+0x0/0x10
[c0000000c7327ba0] [c0000000003a30d4] sysfs_kf_seq_show+0x104/0x1d0
[c0000000c7327bf0] [c0000000003a0bb4] kernfs_seq_show+0x44/0x60
[c0000000c7327c10] [c000000000330578] seq_read+0xf8/0x560
[c0000000c7327cb0] [c0000000003a1e64] kernfs_fop_read+0x194/0x260
[c0000000c7327d00] [c0000000002f9954] __vfs_read+0x44/0x1a0
[c0000000c7327d90] [c0000000002fb4cc] vfs_read+0xbc/0x1b0
[c0000000c7327de0] [c0000000002fd138] SyS_read+0x68/0x110
[c0000000c7327e30] [c00000000000b8e0] system_call+0x38/0xfc
Fix this by loading up the kernel TOC before calling into the kernel.
The original TOC gets restored as part of the usual pt_regs restore.
Fixes: 762df10bad ("powerpc/kprobes: Optimize kprobe in kretprobe_trampoline()")
Signed-off-by: Naveen N. Rao <naveen.n.rao@linux.vnet.ibm.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Current infrastructure of kprobe uses the unconditional trap instruction
to probe a running kernel. Optprobe allows kprobe to replace the trap
with a branch instruction to a detour buffer. Detour buffer contains
instructions to create an in memory pt_regs. Detour buffer also has a
call to optimized_callback() which in turn call the pre_handler(). After
the execution of the pre-handler, a call is made for instruction
emulation. The NIP is determined in advanced through dummy instruction
emulation and a branch instruction is created to the NIP at the end of
the trampoline.
To address the limitation of branch instruction in POWER architecture,
detour buffer slot is allocated from a reserved area. For the time
being, 64KB is reserved in memory for this purpose.
Instructions which can be emulated using analyse_instr() are the
candidates for optimization. Before optimization ensure that the address
range between the detour buffer allocated and the instruction being
probed is within +/- 32MB.
Signed-off-by: Anju T Sudhakar <anju@linux.vnet.ibm.com>
Signed-off-by: Naveen N. Rao <naveen.n.rao@linux.vnet.ibm.com>
Acked-by: Masami Hiramatsu <mhiramat@kernel.org>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
