[RFC -mm][PATCH 5/6] prepare kprobes code for x86 unification

[RFC -mm][PATCH 5/6] prepare kprobes code for x86 unification

[Masami Hiramatsu]

This patch cleanup kprobes code on x86 for unification.
This patch is based on Arjan's previous work.

- Remove spurious whitespace changes
- Add harmless includes
- Make the 32/64 files more identical
 - Generalize structure fields' and local variable name.
 - Wrap accessing to stack address by macros.
 - Modify bitmap making macro.
 - Merge fixup code into is_riprel() and change its name to fix_riprel().
 - Set MAX_INSN_SIZE to 16 on both arch.

Signed-off-by: Masami Hiramatsu <mhiramat@redhat.com>
Signed-off-by: Arjan van de Ven
 *** ^ is this OK? ***
---
 arch/x86/kernel/kprobes_32.c |  243 +++++++++++++++++-----------
 arch/x86/kernel/kprobes_64.c |  367 ++++++++++++++++++++++---------------------
 arch/x86/mm/fault_32.c       |    1
 arch/x86/mm/fault_64.c       |    1
 include/asm-x86/kprobes_32.h |   24 +-
 include/asm-x86/kprobes_64.h |   28 +--
 6 files changed, 366 insertions(+), 298 deletions(-)

Index: 2.6.24-rc4-mm1/arch/x86/kernel/kprobes_32.c
===================================================================
--- 2.6.24-rc4-mm1.orig/arch/x86/kernel/kprobes_32.c
+++ 2.6.24-rc4-mm1/arch/x86/kernel/kprobes_32.c
@@ -29,10 +29,15 @@

 #include <linux/kprobes.h>
 #include <linux/ptrace.h>
+#include <linux/string.h>
+#include <linux/slab.h>
 #include <linux/preempt.h>
+#include <linux/module.h>
 #include <linux/kdebug.h>
+
 #include <asm/cacheflush.h>
 #include <asm/desc.h>
+#include <asm/pgtable.h>
 #include <asm/uaccess.h>
 #include <asm/alternative.h>

@@ -41,65 +46,114 @@ void jprobe_return_end(void);
 DEFINE_PER_CPU(struct kprobe *, current_kprobe) = NULL;
 DEFINE_PER_CPU(struct kprobe_ctlblk, kprobe_ctlblk);

-struct kretprobe_blackpoint kretprobe_blacklist[] = {
-	{"__switch_to", }, /* This function switches only current task, but
-			     doesn't switch kernel stack.*/
-	{NULL, NULL}	/* Terminator */
-};
-const int kretprobe_blacklist_size = ARRAY_SIZE(kretprobe_blacklist);
-
-/* insert a jmp code */
-static __always_inline void set_jmp_op(void *from, void *to)
-{
-	struct __arch_jmp_op {
-		char op;
-		long raddr;
-	} __attribute__((packed)) *jop;
-	jop = (struct __arch_jmp_op *)from;
-	jop->raddr = (long)(to) - ((long)(from) + 5);
-	jop->op = RELATIVEJUMP_INSTRUCTION;
-}
-
-/*
- * returns non-zero if opcodes can be boosted.
- */
-static __always_inline int can_boost(kprobe_opcode_t *opcodes)
-{
+#define stack_addr(regs) ((unsigned long *)&regs->sp)
+#define C ,
 #define W(row,b0,b1,b2,b3,b4,b5,b6,b7,b8,b9,ba,bb,bc,bd,be,bf)		      \
 	(((b0##UL << 0x0)|(b1##UL << 0x1)|(b2##UL << 0x2)|(b3##UL << 0x3) |   \
 	  (b4##UL << 0x4)|(b5##UL << 0x5)|(b6##UL << 0x6)|(b7##UL << 0x7) |   \
 	  (b8##UL << 0x8)|(b9##UL << 0x9)|(ba##UL << 0xa)|(bb##UL << 0xb) |   \
 	  (bc##UL << 0xc)|(bd##UL << 0xd)|(be##UL << 0xe)|(bf##UL << 0xf))    \
-	 << (row % 32))
+	 << (row % BITS_PER_LONG))
 	/*
 	 * Undefined/reserved opcodes, conditional jump, Opcode Extension
-	 * Groups, and some special opcodes can not be boost.
+	 * Groups, and some special opcodes can not boost.
 	 */
-	static const unsigned long twobyte_is_boostable[256 / 32] = {
+static const unsigned long twobyte_is_boostable[256 / BITS_PER_LONG] = {
 		/*      0 1 2 3 4 5 6 7 8 9 a b c d e f         */
 		/*      -------------------------------         */
 		W(0x00, 0,0,1,1,0,0,1,0,1,1,0,0,0,0,0,0)| /* 00 */
-		W(0x10, 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0), /* 10 */
+		W(0x10, 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0)C /* 10 */
 		W(0x20, 1,1,1,1,0,0,0,0,0,0,0,0,0,0,0,0)| /* 20 */
 		W(0x30, 0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0), /* 30 */
 		W(0x40, 1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1)| /* 40 */
-		W(0x50, 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0), /* 50 */
+		W(0x50, 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0)C /* 50 */
 		W(0x60, 1,1,1,1,1,1,1,1,1,1,1,1,0,0,1,1)| /* 60 */
 		W(0x70, 0,0,0,0,1,1,1,1,0,0,0,0,0,0,1,1), /* 70 */
 		W(0x80, 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0)| /* 80 */
-		W(0x90, 1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1), /* 90 */
+		W(0x90, 1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1)C /* 90 */
 		W(0xa0, 1,1,0,1,1,1,0,0,1,1,0,1,1,1,0,1)| /* a0 */
 		W(0xb0, 1,1,1,1,1,1,1,1,0,0,0,1,1,1,1,1), /* b0 */
 		W(0xc0, 1,1,0,0,0,0,0,0,1,1,1,1,1,1,1,1)| /* c0 */
-		W(0xd0, 0,1,1,1,0,1,0,0,1,1,0,1,1,1,0,1), /* d0 */
+		W(0xd0, 0,1,1,1,0,1,0,0,1,1,0,1,1,1,0,1)C /* d0 */
 		W(0xe0, 0,1,1,0,0,1,0,0,1,1,0,1,1,1,0,1)| /* e0 */
 		W(0xf0, 0,1,1,1,0,1,0,0,1,1,1,0,1,1,1,0)  /* f0 */
 		/*      -------------------------------         */
 		/*      0 1 2 3 4 5 6 7 8 9 a b c d e f         */
-	};
-#undef W
+};
+static const unsigned long onebyte_has_modrm[256 / BITS_PER_LONG] = {
+		/*      0 1 2 3 4 5 6 7 8 9 a b c d e f         */
+		/*      -------------------------------         */
+		W(0x00, 1,1,1,1,0,0,0,0,1,1,1,1,0,0,0,0)| /* 00 */
+		W(0x10, 1,1,1,1,0,0,0,0,1,1,1,1,0,0,0,0)C /* 10 */
+		W(0x20, 1,1,1,1,0,0,0,0,1,1,1,1,0,0,0,0)| /* 20 */
+		W(0x30, 1,1,1,1,0,0,0,0,1,1,1,1,0,0,0,0), /* 30 */
+		W(0x40, 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0)| /* 40 */
+		W(0x50, 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0)C /* 50 */
+		W(0x60, 0,0,1,1,0,0,0,0,0,1,0,1,0,0,0,0)| /* 60 */
+		W(0x70, 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0), /* 70 */
+		W(0x80, 1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1)| /* 80 */
+		W(0x90, 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0)C /* 90 */
+		W(0xa0, 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0)| /* a0 */
+		W(0xb0, 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0), /* b0 */
+		W(0xc0, 1,1,0,0,1,1,1,1,0,0,0,0,0,0,0,0)| /* c0 */
+		W(0xd0, 1,1,1,1,0,0,0,0,1,1,1,1,1,1,1,1)C /* d0 */
+		W(0xe0, 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0)| /* e0 */
+		W(0xf0, 0,0,0,0,0,0,1,1,0,0,0,0,0,0,1,1)  /* f0 */
+		/*      -------------------------------         */
+		/*      0 1 2 3 4 5 6 7 8 9 a b c d e f         */
+};
+static const unsigned long twobyte_has_modrm[256 / BITS_PER_LONG] = {
+		/*      0 1 2 3 4 5 6 7 8 9 a b c d e f         */
+		/*      -------------------------------         */
+		W(0x00, 1,1,1,1,0,0,0,0,0,0,0,0,0,1,0,1)| /* 0f */
+		W(0x10, 1,1,1,1,1,1,1,1,1,0,0,0,0,0,0,0)C /* 1f */
+		W(0x20, 1,1,1,1,1,0,1,0,1,1,1,1,1,1,1,1)| /* 2f */
+		W(0x30, 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0), /* 3f */
+		W(0x40, 1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1)| /* 4f */
+		W(0x50, 1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1)C /* 5f */
+		W(0x60, 1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1)| /* 6f */
+		W(0x70, 1,1,1,1,1,1,1,0,0,0,0,0,1,1,1,1), /* 7f */
+		W(0x80, 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0)| /* 8f */
+		W(0x90, 1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1)C /* 9f */
+		W(0xa0, 0,0,0,1,1,1,1,1,0,0,0,1,1,1,1,1)| /* af */
+		W(0xb0, 1,1,1,1,1,1,1,1,0,0,1,1,1,1,1,1), /* bf */
+		W(0xc0, 1,1,1,1,1,1,1,1,0,0,0,0,0,0,0,0)| /* cf */
+		W(0xd0, 1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1)C /* df */
+		W(0xe0, 1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1)| /* ef */
+		W(0xf0, 1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,0)  /* ff */
+		/*      -------------------------------         */
+		/*      0 1 2 3 4 5 6 7 8 9 a b c d e f         */
+};
+#undef	W
+#undef  C
+
+struct kretprobe_blackpoint kretprobe_blacklist[] = {
+	{"__switch_to", }, /* This function switches only current task, but
+			      doesn't switch kernel stack.*/
+	{NULL, NULL}	/* Terminator */
+};
+const int kretprobe_blacklist_size = ARRAY_SIZE(kretprobe_blacklist);
+
+/* insert a jmp code */
+static __always_inline void set_jmp_op(void *from, void *to)
+{
+	struct __arch_jmp_op {
+		char op;
+		s32 raddr;
+	} __attribute__((packed)) *jop;
+	jop = (struct __arch_jmp_op *)from;
+	jop->raddr = (s32)((long)(to) - ((long)(from) + 5));
+	jop->op = RELATIVEJUMP_INSTRUCTION;
+}
+
+/*
+ * returns non-zero if opcode is boostable.
+ */
+static __always_inline int can_boost(kprobe_opcode_t *opcodes)
+{
 	kprobe_opcode_t opcode;
 	kprobe_opcode_t *orig_opcodes = opcodes;
+
 retry:
 	if (opcodes - orig_opcodes > MAX_INSN_SIZE - 1)
 		return 0;
@@ -132,12 +186,13 @@ retry:
 	case 0xf0:
 		if ((opcode & 0x0c) == 0 && opcode != 0xf1)
 			goto retry; /* lock/rep(ne) prefix */
-		/* clear and set flags can be boost */
+		/* clear and set flags are boostable */
 		return (opcode == 0xf5 || (0xf7 < opcode && opcode < 0xfe));
 	default:
+		/* segment override prefixes are boostable */
 		if (opcode == 0x26 || opcode == 0x36 || opcode == 0x3e)
 			goto retry; /* prefixes */
-		/* can't boost CS override and call */
+		/* CS override prefix and call are not boostable */
 		return (opcode != 0x2e && opcode != 0x9a);
 	}
 }
@@ -145,9 +200,9 @@ retry:
 /*
  * returns non-zero if opcode modifies the interrupt flag.
  */
-static int __kprobes is_IF_modifier(kprobe_opcode_t opcode)
+static int __kprobes is_IF_modifier(kprobe_opcode_t *insn)
 {
-	switch (opcode) {
+	switch (*insn) {
 	case 0xfa:		/* cli */
 	case 0xfb:		/* sti */
 	case 0xcf:		/* iret/iretd */
@@ -157,20 +212,24 @@ static int __kprobes is_IF_modifier(kpro
 	return 0;
 }

-int __kprobes arch_prepare_kprobe(struct kprobe *p)
+static void __kprobes arch_copy_kprobe(struct kprobe *p)
 {
-	/* insn: must be on special executable page on i386. */
-	p->ainsn.insn = get_insn_slot();
-	if (!p->ainsn.insn)
-		return -ENOMEM;
-
 	memcpy(p->ainsn.insn, p->addr, MAX_INSN_SIZE * sizeof(kprobe_opcode_t));
-	p->opcode = *p->addr;
 	if (can_boost(p->addr)) {
 		p->ainsn.boostable = 0;
 	} else {
 		p->ainsn.boostable = -1;
 	}
+	p->opcode = *p->addr;
+}
+
+int __kprobes arch_prepare_kprobe(struct kprobe *p)
+{
+	/* insn: must be on special executable page on x86. */
+	p->ainsn.insn = get_insn_slot();
+	if (!p->ainsn.insn)
+		return -ENOMEM;
+	arch_copy_kprobe(p);
 	return 0;
 }

@@ -195,26 +254,26 @@ static void __kprobes save_previous_kpro
 {
 	kcb->prev_kprobe.kp = kprobe_running();
 	kcb->prev_kprobe.status = kcb->kprobe_status;
-	kcb->prev_kprobe.old_eflags = kcb->kprobe_old_eflags;
-	kcb->prev_kprobe.saved_eflags = kcb->kprobe_saved_eflags;
+	kcb->prev_kprobe.old_flags = kcb->kprobe_old_flags;
+	kcb->prev_kprobe.saved_flags = kcb->kprobe_saved_flags;
 }

 static void __kprobes restore_previous_kprobe(struct kprobe_ctlblk *kcb)
 {
 	__get_cpu_var(current_kprobe) = kcb->prev_kprobe.kp;
 	kcb->kprobe_status = kcb->prev_kprobe.status;
-	kcb->kprobe_old_eflags = kcb->prev_kprobe.old_eflags;
-	kcb->kprobe_saved_eflags = kcb->prev_kprobe.saved_eflags;
+	kcb->kprobe_old_flags = kcb->prev_kprobe.old_flags;
+	kcb->kprobe_saved_flags = kcb->prev_kprobe.saved_flags;
 }

 static void __kprobes set_current_kprobe(struct kprobe *p, struct pt_regs *regs,
 				struct kprobe_ctlblk *kcb)
 {
 	__get_cpu_var(current_kprobe) = p;
-	kcb->kprobe_saved_eflags = kcb->kprobe_old_eflags
+	kcb->kprobe_saved_flags = kcb->kprobe_old_flags
 		= (regs->flags & (TF_MASK | IF_MASK));
-	if (is_IF_modifier(p->opcode))
-		kcb->kprobe_saved_eflags &= ~IF_MASK;
+	if (is_IF_modifier(p->ainsn.insn))
+		kcb->kprobe_saved_flags &= ~IF_MASK;
 }

 static __always_inline void clear_btf(void)
@@ -245,7 +304,7 @@ static void __kprobes prepare_singlestep
 void __kprobes arch_prepare_kretprobe(struct kretprobe_instance *ri,
 				      struct pt_regs *regs)
 {
-	unsigned long *sara = (unsigned long *)&regs->sp;
+	unsigned long *sara = stack_addr(regs);

 	ri->ret_addr = (kprobe_opcode_t *) *sara;

@@ -280,7 +339,7 @@ static int __kprobes kprobe_handler(stru
 			if (kcb->kprobe_status == KPROBE_HIT_SS &&
 				*p->ainsn.insn == BREAKPOINT_INSTRUCTION) {
 				regs->flags &= ~TF_MASK;
-				regs->flags |= kcb->kprobe_saved_eflags;
+				regs->flags |= kcb->kprobe_saved_flags;
 				goto no_kprobe;
 			}
 			/* We have reentered the kprobe_handler(), since
@@ -301,7 +360,7 @@ static int __kprobes kprobe_handler(stru
 			 * another cpu right after we hit, no further
 			 * handling of this interrupt is appropriate
 			 */
-				regs->ip -= sizeof(kprobe_opcode_t);
+				regs->ip = (unsigned long)p->addr;
 				ret = 1;
 				goto no_kprobe;
 			}
@@ -325,7 +384,7 @@ static int __kprobes kprobe_handler(stru
 			 * Back up over the (now missing) int3 and run
 			 * the original instruction.
 			 */
-			regs->ip -= sizeof(kprobe_opcode_t);
+			regs->ip = (unsigned long)p->addr;
 			ret = 1;
 		}
 		/* Not one of ours: let kernel handle it */
@@ -359,9 +418,8 @@ no_kprobe:
 }

 /*
- * For function-return probes, init_kprobes() establishes a probepoint
- * here. When a retprobed function returns, this probe is hit and
- * trampoline_probe_handler() runs, calling the kretprobe's handler.
+ * When a retprobed function returns, this code saves registers and
+ * calls trampoline_handler() runs, calling the kretprobe's handler.
  */
  void __kprobes kretprobe_trampoline_holder(void)
  {
@@ -403,7 +461,7 @@ no_kprobe:
 /*
  * Called from kretprobe_trampoline
  */
-fastcall void *__kprobes trampoline_handler(struct pt_regs *regs)
+fastcall void * __kprobes trampoline_handler(struct pt_regs *regs)
 {
 	struct kretprobe_instance *ri = NULL;
 	struct hlist_head *head, empty_rp;
@@ -417,7 +475,7 @@ fastcall void *__kprobes trampoline_hand
 	/* fixup registers */
 	regs->cs = __KERNEL_CS | get_kernel_rpl();
 	regs->ip = trampoline_address;
-	regs->orig_ax = 0xffffffff;
+	regs->orig_ax = ~0UL;

 	/*
 	 * It is possible to have multiple instances associated with a given
@@ -437,7 +495,7 @@ fastcall void *__kprobes trampoline_hand
 			/* another task is sharing our hash bucket */
 			continue;

-		if (ri->rp && ri->rp->handler){
+		if (ri->rp && ri->rp->handler) {
 			__get_cpu_var(current_kprobe) = &ri->rp->kp;
 			get_kprobe_ctlblk()->kprobe_status = KPROBE_HIT_ACTIVE;
 			ri->rp->handler(ri, regs);
@@ -457,6 +515,7 @@ fastcall void *__kprobes trampoline_hand
 	}

 	kretprobe_assert(ri, orig_ret_address, trampoline_address);
+
 	spin_unlock_irqrestore(&kretprobe_lock, flags);

 	hlist_for_each_entry_safe(ri, node, tmp, &empty_rp, hlist) {
@@ -493,15 +552,16 @@ fastcall void *__kprobes trampoline_hand
 static void __kprobes resume_execution(struct kprobe *p,
 		struct pt_regs *regs, struct kprobe_ctlblk *kcb)
 {
-	unsigned long *tos = (unsigned long *)&regs->sp;
-	unsigned long copy_eip = (unsigned long)p->ainsn.insn;
-	unsigned long orig_eip = (unsigned long)p->addr;
+	unsigned long *tos = stack_addr(regs);
+	unsigned long copy_ip = (unsigned long)p->ainsn.insn;
+	unsigned long orig_ip = (unsigned long)p->addr;
+	kprobe_opcode_t *insn = p->ainsn.insn;

 	regs->flags &= ~TF_MASK;
-	switch (p->ainsn.insn[0]) {
+	switch (*insn) {
 	case 0x9c:		/* pushfl */
 		*tos &= ~(TF_MASK | IF_MASK);
-		*tos |= kcb->kprobe_old_eflags;
+		*tos |= kcb->kprobe_old_flags;
 		break;
 	case 0xc2:		/* iret/ret/lret */
 	case 0xc3:
@@ -513,22 +573,22 @@ static void __kprobes resume_execution(s
 		p->ainsn.boostable = 1;
 		goto no_change;
 	case 0xe8:		/* call relative - Fix return addr */
-		*tos = orig_eip + (*tos - copy_eip);
+		*tos = orig_ip + (*tos - copy_ip);
 		break;
 	case 0x9a:		/* call absolute -- same as call absolute, indirect */
-		*tos = orig_eip + (*tos - copy_eip);
+		*tos = orig_ip + (*tos - copy_ip);
 		goto no_change;
 	case 0xff:
-		if ((p->ainsn.insn[1] & 0x30) == 0x10) {
+		if ((insn[1] & 0x30) == 0x10) {
 			/*
 			 * call absolute, indirect
 			 * Fix return addr; ip is correct.
 			 * But this is not boostable
 			 */
-			*tos = orig_eip + (*tos - copy_eip);
+			*tos = orig_ip + (*tos - copy_ip);
 			goto no_change;
-		} else if (((p->ainsn.insn[1] & 0x31) == 0x20) ||	/* jmp near, absolute indirect */
-			   ((p->ainsn.insn[1] & 0x31) == 0x21)) {	/* jmp far, absolute indirect */
+		} else if (((insn[1] & 0x31) == 0x20) ||	/* jmp near, absolute indirect */
+			   ((insn[1] & 0x31) == 0x21)) {	/* jmp far, absolute indirect */
 			/* ip is correct. And this is boostable */
 			p->ainsn.boostable = 1;
 			goto no_change;
@@ -538,21 +598,21 @@ static void __kprobes resume_execution(s
 	}

 	if (p->ainsn.boostable == 0) {
-		if ((regs->ip > copy_eip) &&
-		    (regs->ip - copy_eip) + 5 < MAX_INSN_SIZE) {
+		if ((regs->ip > copy_ip) &&
+		    (regs->ip - copy_ip) + 5 < MAX_INSN_SIZE) {
 			/*
 			 * These instructions can be executed directly if it
 			 * jumps back to correct address.
 			 */
 			set_jmp_op((void *)regs->ip,
-				   (void *)orig_eip + (regs->ip - copy_eip));
+				   (void *)orig_ip + (regs->ip - copy_ip));
 			p->ainsn.boostable = 1;
 		} else {
 			p->ainsn.boostable = -1;
 		}
 	}

-	regs->ip = orig_eip + (regs->ip - copy_eip);
+	regs->ip += orig_ip - copy_ip;

 no_change:
 	restore_btf();
@@ -578,10 +638,10 @@ static int __kprobes post_kprobe_handler
 	}

 	resume_execution(cur, regs, kcb);
-	regs->flags |= kcb->kprobe_saved_eflags;
+	regs->flags |= kcb->kprobe_saved_flags;
 	trace_hardirqs_fixup_flags(regs->flags);

-	/*Restore back the original saved kprobes variables and continue. */
+	/* Restore back the original saved kprobes variables and continue. */
 	if (kcb->kprobe_status == KPROBE_REENTER) {
 		restore_previous_kprobe(kcb);
 		goto out;
@@ -617,7 +677,7 @@ int __kprobes kprobe_fault_handler(struc
 		 * normal page fault.
 		 */
 		regs->ip = (unsigned long)cur->addr;
-		regs->flags |= kcb->kprobe_old_eflags;
+		regs->flags |= kcb->kprobe_old_flags;
 		if (kcb->kprobe_status == KPROBE_REENTER)
 			restore_previous_kprobe(kcb);
 		else
@@ -651,7 +711,7 @@ int __kprobes kprobe_fault_handler(struc
 			return 1;

 		/*
-		 * fixup_exception() could not handle it,
+		 * fixup routine could not handle it,
 		 * Let do_page_fault() fix it.
 		 */
 		break;
@@ -662,7 +722,7 @@ int __kprobes kprobe_fault_handler(struc
 }

 /*
- * Wrapper routine to for handling exceptions.
+ * Wrapper routine for handling exceptions.
  */
 int __kprobes kprobe_exceptions_notify(struct notifier_block *self,
 				       unsigned long val, void *data)
@@ -703,11 +763,11 @@ int __kprobes setjmp_pre_handler(struct
 	struct kprobe_ctlblk *kcb = get_kprobe_ctlblk();

 	kcb->jprobe_saved_regs = *regs;
-	kcb->jprobe_saved_esp = &regs->sp;
-	addr = (unsigned long)(kcb->jprobe_saved_esp);
+	kcb->jprobe_saved_sp = stack_addr(regs);
+	addr = (unsigned long)(kcb->jprobe_saved_sp);

 	/*
-	 * TBD: As Linus pointed out, gcc assumes that the callee
+	 * As Linus pointed out, gcc assumes that the callee
 	 * owns the argument space and could overwrite it, e.g.
 	 * tailcall optimization. So, to be absolutely safe
 	 * we also save and restore enough stack bytes to cover
@@ -730,21 +790,20 @@ void __kprobes jprobe_return(void)
 		      "       .globl jprobe_return_end	\n"
 		      "       jprobe_return_end:	\n"
 		      "       nop			\n"::"b"
-		      (kcb->jprobe_saved_esp):"memory");
+		      (kcb->jprobe_saved_sp):"memory");
 }

 int __kprobes longjmp_break_handler(struct kprobe *p, struct pt_regs *regs)
 {
 	struct kprobe_ctlblk *kcb = get_kprobe_ctlblk();
 	u8 *addr = (u8 *) (regs->ip - 1);
-	unsigned long stack_addr = (unsigned long)(kcb->jprobe_saved_esp);
 	struct jprobe *jp = container_of(p, struct jprobe, kp);

 	if ((addr > (u8 *) jprobe_return) && (addr < (u8 *) jprobe_return_end)) {
-		if (&regs->sp != kcb->jprobe_saved_esp) {
+		if (stack_addr(regs) != kcb->jprobe_saved_sp) {
 			struct pt_regs *saved_regs = &kcb->jprobe_saved_regs;
 			printk("current sp %p does not match saved sp %p\n",
-			       &regs->sp, kcb->jprobe_saved_esp);
+			       stack_addr(regs), kcb->jprobe_saved_sp);
 			printk("Saved registers for jprobe %p\n", jp);
 			show_registers(saved_regs);
 			printk("Current registers\n");
@@ -752,20 +811,20 @@ int __kprobes longjmp_break_handler(stru
 			BUG();
 		}
 		*regs = kcb->jprobe_saved_regs;
-		memcpy((kprobe_opcode_t *) stack_addr, kcb->jprobes_stack,
-		       MIN_STACK_SIZE(stack_addr));
+		memcpy((kprobe_opcode_t *)(kcb->jprobe_saved_sp),
+		       kcb->jprobes_stack, MIN_STACK_SIZE(kcb->jprobe_saved_sp));
 		preempt_enable_no_resched();
 		return 1;
 	}
 	return 0;
 }

-int __kprobes arch_trampoline_kprobe(struct kprobe *p)
+int __init arch_init_kprobes(void)
 {
 	return 0;
 }

-int __init arch_init_kprobes(void)
+int __kprobes arch_trampoline_kprobe(struct kprobe *p)
 {
 	return 0;
 }
Index: 2.6.24-rc4-mm1/arch/x86/kernel/kprobes_64.c
===================================================================
--- 2.6.24-rc4-mm1.orig/arch/x86/kernel/kprobes_64.c
+++ 2.6.24-rc4-mm1/arch/x86/kernel/kprobes_64.c
@@ -38,74 +38,123 @@
 #include <linux/module.h>
 #include <linux/kdebug.h>

+#include <asm/cacheflush.h>
+#include <asm/desc.h>
 #include <asm/pgtable.h>
 #include <asm/uaccess.h>
 #include <asm/alternative.h>

 void jprobe_return_end(void);
-static void __kprobes arch_copy_kprobe(struct kprobe *p);

 DEFINE_PER_CPU(struct kprobe *, current_kprobe) = NULL;
 DEFINE_PER_CPU(struct kprobe_ctlblk, kprobe_ctlblk);

-struct kretprobe_blackpoint kretprobe_blacklist[] = {
-	{"__switch_to", }, /* This function switches only current task, but
-			      doesn't switch kernel stack.*/
-	{NULL, NULL}	/* Terminator */
-};
-const int kretprobe_blacklist_size = ARRAY_SIZE(kretprobe_blacklist);
-
-/* insert a jmp code */
-static __always_inline void set_jmp_op(void *from, void *to)
-{
-	struct __arch_jmp_op {
-		char op;
-		s32 raddr;
-	} __attribute__((packed)) *jop;
-	jop = (struct __arch_jmp_op *)from;
-	jop->raddr = (s32)((long)(to) - ((long)(from) + 5));
-	jop->op = RELATIVEJUMP_INSTRUCTION;
-}
-
-/*
- * returns non-zero if opcode is boostable
- * RIP relative instructions are adjusted at copying time
- */
-static __always_inline int can_boost(kprobe_opcode_t *opcodes)
-{
+#define stack_addr(regs) ((unsigned long *)regs->sp)
+#define C |
 #define W(row,b0,b1,b2,b3,b4,b5,b6,b7,b8,b9,ba,bb,bc,bd,be,bf)		      \
 	(((b0##UL << 0x0)|(b1##UL << 0x1)|(b2##UL << 0x2)|(b3##UL << 0x3) |   \
 	  (b4##UL << 0x4)|(b5##UL << 0x5)|(b6##UL << 0x6)|(b7##UL << 0x7) |   \
 	  (b8##UL << 0x8)|(b9##UL << 0x9)|(ba##UL << 0xa)|(bb##UL << 0xb) |   \
 	  (bc##UL << 0xc)|(bd##UL << 0xd)|(be##UL << 0xe)|(bf##UL << 0xf))    \
-	 << (row % 64))
+	 << (row % BITS_PER_LONG))
 	/*
 	 * Undefined/reserved opcodes, conditional jump, Opcode Extension
 	 * Groups, and some special opcodes can not boost.
 	 */
-	static const unsigned long twobyte_is_boostable[256 / 64] = {
+static const unsigned long twobyte_is_boostable[256 / BITS_PER_LONG] = {
 		/*      0 1 2 3 4 5 6 7 8 9 a b c d e f         */
 		/*      -------------------------------         */
 		W(0x00, 0,0,1,1,0,0,1,0,1,1,0,0,0,0,0,0)| /* 00 */
-		W(0x10, 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0)| /* 10 */
+		W(0x10, 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0)C /* 10 */
 		W(0x20, 1,1,1,1,0,0,0,0,0,0,0,0,0,0,0,0)| /* 20 */
 		W(0x30, 0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0), /* 30 */
 		W(0x40, 1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1)| /* 40 */
-		W(0x50, 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0)| /* 50 */
+		W(0x50, 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0)C /* 50 */
 		W(0x60, 1,1,1,1,1,1,1,1,1,1,1,1,0,0,1,1)| /* 60 */
 		W(0x70, 0,0,0,0,1,1,1,1,0,0,0,0,0,0,1,1), /* 70 */
 		W(0x80, 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0)| /* 80 */
-		W(0x90, 1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1)| /* 90 */
+		W(0x90, 1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1)C /* 90 */
 		W(0xa0, 1,1,0,1,1,1,0,0,1,1,0,1,1,1,0,1)| /* a0 */
 		W(0xb0, 1,1,1,1,1,1,1,1,0,0,0,1,1,1,1,1), /* b0 */
 		W(0xc0, 1,1,0,0,0,0,0,0,1,1,1,1,1,1,1,1)| /* c0 */
-		W(0xd0, 0,1,1,1,0,1,0,0,1,1,0,1,1,1,0,1)| /* d0 */
+		W(0xd0, 0,1,1,1,0,1,0,0,1,1,0,1,1,1,0,1)C /* d0 */
 		W(0xe0, 0,1,1,0,0,1,0,0,1,1,0,1,1,1,0,1)| /* e0 */
 		W(0xf0, 0,1,1,1,0,1,0,0,1,1,1,0,1,1,1,0)  /* f0 */
 		/*      -------------------------------         */
 		/*      0 1 2 3 4 5 6 7 8 9 a b c d e f         */
-	};
-#undef W
+};
+static const unsigned long onebyte_has_modrm[256 / BITS_PER_LONG] = {
+		/*      0 1 2 3 4 5 6 7 8 9 a b c d e f         */
+		/*      -------------------------------         */
+		W(0x00, 1,1,1,1,0,0,0,0,1,1,1,1,0,0,0,0)| /* 00 */
+		W(0x10, 1,1,1,1,0,0,0,0,1,1,1,1,0,0,0,0)C /* 10 */
+		W(0x20, 1,1,1,1,0,0,0,0,1,1,1,1,0,0,0,0)| /* 20 */
+		W(0x30, 1,1,1,1,0,0,0,0,1,1,1,1,0,0,0,0), /* 30 */
+		W(0x40, 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0)| /* 40 */
+		W(0x50, 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0)C /* 50 */
+		W(0x60, 0,0,1,1,0,0,0,0,0,1,0,1,0,0,0,0)| /* 60 */
+		W(0x70, 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0), /* 70 */
+		W(0x80, 1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1)| /* 80 */
+		W(0x90, 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0)C /* 90 */
+		W(0xa0, 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0)| /* a0 */
+		W(0xb0, 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0), /* b0 */
+		W(0xc0, 1,1,0,0,1,1,1,1,0,0,0,0,0,0,0,0)| /* c0 */
+		W(0xd0, 1,1,1,1,0,0,0,0,1,1,1,1,1,1,1,1)C /* d0 */
+		W(0xe0, 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0)| /* e0 */
+		W(0xf0, 0,0,0,0,0,0,1,1,0,0,0,0,0,0,1,1)  /* f0 */
+		/*      -------------------------------         */
+		/*      0 1 2 3 4 5 6 7 8 9 a b c d e f         */
+};
+static const unsigned long twobyte_has_modrm[256 / BITS_PER_LONG] = {
+		/*      0 1 2 3 4 5 6 7 8 9 a b c d e f         */
+		/*      -------------------------------         */
+		W(0x00, 1,1,1,1,0,0,0,0,0,0,0,0,0,1,0,1)| /* 0f */
+		W(0x10, 1,1,1,1,1,1,1,1,1,0,0,0,0,0,0,0)C /* 1f */
+		W(0x20, 1,1,1,1,1,0,1,0,1,1,1,1,1,1,1,1)| /* 2f */
+		W(0x30, 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0), /* 3f */
+		W(0x40, 1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1)| /* 4f */
+		W(0x50, 1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1)C /* 5f */
+		W(0x60, 1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1)| /* 6f */
+		W(0x70, 1,1,1,1,1,1,1,0,0,0,0,0,1,1,1,1), /* 7f */
+		W(0x80, 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0)| /* 8f */
+		W(0x90, 1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1)C /* 9f */
+		W(0xa0, 0,0,0,1,1,1,1,1,0,0,0,1,1,1,1,1)| /* af */
+		W(0xb0, 1,1,1,1,1,1,1,1,0,0,1,1,1,1,1,1), /* bf */
+		W(0xc0, 1,1,1,1,1,1,1,1,0,0,0,0,0,0,0,0)| /* cf */
+		W(0xd0, 1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1)C /* df */
+		W(0xe0, 1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1)| /* ef */
+		W(0xf0, 1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,0)  /* ff */
+		/*      -------------------------------         */
+		/*      0 1 2 3 4 5 6 7 8 9 a b c d e f         */
+};
+#undef	W
+#undef  C
+
+struct kretprobe_blackpoint kretprobe_blacklist[] = {
+	{"__switch_to", }, /* This function switches only current task, but
+			      doesn't switch kernel stack.*/
+	{NULL, NULL}	/* Terminator */
+};
+const int kretprobe_blacklist_size = ARRAY_SIZE(kretprobe_blacklist);
+
+/* insert a jmp code */
+static __always_inline void set_jmp_op(void *from, void *to)
+{
+	struct __arch_jmp_op {
+		char op;
+		s32 raddr;
+	} __attribute__((packed)) *jop;
+	jop = (struct __arch_jmp_op *)from;
+	jop->raddr = (s32)((long)(to) - ((long)(from) + 5));
+	jop->op = RELATIVEJUMP_INSTRUCTION;
+}
+
+/*
+ * returns non-zero if opcode is boostable.
+ * RIP relative instructions are adjusted at copying time
+ */
+static __always_inline int can_boost(kprobe_opcode_t *opcodes)
+{
 	kprobe_opcode_t opcode;
 	kprobe_opcode_t *orig_opcodes = opcodes;

@@ -167,80 +216,25 @@ static int __kprobes is_IF_modifier(kpro
 		return 1;
 	}

-	if (*insn  >= 0x40 && *insn <= 0x4f && *++insn == 0xcf)
-		return 1;
-	return 0;
-}
-
-int __kprobes arch_prepare_kprobe(struct kprobe *p)
-{
-	/* insn: must be on special executable page on x86_64. */
-	p->ainsn.insn = get_insn_slot();
-	if (!p->ainsn.insn) {
-		return -ENOMEM;
-	}
-	arch_copy_kprobe(p);
+	/*
+	 * on 64 bit x86, 0x40-0x4f are prefixes so we need to look
+	 * at the next byte instead.. but of course not recurse infinitely
+         */
+	if (*insn  >= 0x40 && *insn <= 0x4f)
+		return is_IF_modifier(++insn);
 	return 0;
 }

 /*
- * Determine if the instruction uses the %rip-relative addressing mode.
+ * Adjust the displacement if the instruction uses the %rip-relative
+ * addressing mode.
  * If it does, return the address of the 32-bit displacement word.
  * If not, return null.
  */
-static s32 __kprobes *is_riprel(u8 *insn)
+static void __kprobes fix_riprel(struct kprobe *p)
 {
-#define W(row,b0,b1,b2,b3,b4,b5,b6,b7,b8,b9,ba,bb,bc,bd,be,bf)		      \
-	(((b0##UL << 0x0)|(b1##UL << 0x1)|(b2##UL << 0x2)|(b3##UL << 0x3) |   \
-	  (b4##UL << 0x4)|(b5##UL << 0x5)|(b6##UL << 0x6)|(b7##UL << 0x7) |   \
-	  (b8##UL << 0x8)|(b9##UL << 0x9)|(ba##UL << 0xa)|(bb##UL << 0xb) |   \
-	  (bc##UL << 0xc)|(bd##UL << 0xd)|(be##UL << 0xe)|(bf##UL << 0xf))    \
-	 << (row % 64))
-	static const u64 onebyte_has_modrm[256 / 64] = {
-		/*      0 1 2 3 4 5 6 7 8 9 a b c d e f         */
-		/*      -------------------------------         */
-		W(0x00, 1,1,1,1,0,0,0,0,1,1,1,1,0,0,0,0)| /* 00 */
-		W(0x10, 1,1,1,1,0,0,0,0,1,1,1,1,0,0,0,0)| /* 10 */
-		W(0x20, 1,1,1,1,0,0,0,0,1,1,1,1,0,0,0,0)| /* 20 */
-		W(0x30, 1,1,1,1,0,0,0,0,1,1,1,1,0,0,0,0), /* 30 */
-		W(0x40, 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0)| /* 40 */
-		W(0x50, 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0)| /* 50 */
-		W(0x60, 0,0,1,1,0,0,0,0,0,1,0,1,0,0,0,0)| /* 60 */
-		W(0x70, 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0), /* 70 */
-		W(0x80, 1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1)| /* 80 */
-		W(0x90, 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0)| /* 90 */
-		W(0xa0, 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0)| /* a0 */
-		W(0xb0, 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0), /* b0 */
-		W(0xc0, 1,1,0,0,1,1,1,1,0,0,0,0,0,0,0,0)| /* c0 */
-		W(0xd0, 1,1,1,1,0,0,0,0,1,1,1,1,1,1,1,1)| /* d0 */
-		W(0xe0, 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0)| /* e0 */
-		W(0xf0, 0,0,0,0,0,0,1,1,0,0,0,0,0,0,1,1)  /* f0 */
-		/*      -------------------------------         */
-		/*      0 1 2 3 4 5 6 7 8 9 a b c d e f         */
-	};
-	static const u64 twobyte_has_modrm[256 / 64] = {
-		/*      0 1 2 3 4 5 6 7 8 9 a b c d e f         */
-		/*      -------------------------------         */
-		W(0x00, 1,1,1,1,0,0,0,0,0,0,0,0,0,1,0,1)| /* 0f */
-		W(0x10, 1,1,1,1,1,1,1,1,1,0,0,0,0,0,0,0)| /* 1f */
-		W(0x20, 1,1,1,1,1,0,1,0,1,1,1,1,1,1,1,1)| /* 2f */
-		W(0x30, 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0), /* 3f */
-		W(0x40, 1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1)| /* 4f */
-		W(0x50, 1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1)| /* 5f */
-		W(0x60, 1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1)| /* 6f */
-		W(0x70, 1,1,1,1,1,1,1,0,0,0,0,0,1,1,1,1), /* 7f */
-		W(0x80, 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0)| /* 8f */
-		W(0x90, 1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1)| /* 9f */
-		W(0xa0, 0,0,0,1,1,1,1,1,0,0,0,1,1,1,1,1)| /* af */
-		W(0xb0, 1,1,1,1,1,1,1,1,0,0,1,1,1,1,1,1), /* bf */
-		W(0xc0, 1,1,1,1,1,1,1,1,0,0,0,0,0,0,0,0)| /* cf */
-		W(0xd0, 1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1)| /* df */
-		W(0xe0, 1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1)| /* ef */
-		W(0xf0, 1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,0)  /* ff */
-		/*      -------------------------------         */
-		/*      0 1 2 3 4 5 6 7 8 9 a b c d e f         */
-	};
-#undef	W
+	u8 *insn = p->ainsn.insn;
+	s64 disp;
 	int need_modrm;

 	/* Skip legacy instruction prefixes.  */
@@ -278,37 +272,31 @@ static s32 __kprobes *is_riprel(u8 *insn
 		u8 modrm = *++insn;
 		if ((modrm & 0xc7) == 0x05) { /* %rip+disp32 addressing mode */
 			/* Displacement follows ModRM byte.  */
-			return (s32 *) ++insn;
+			++insn;
+			/*
+			 * The copied instruction uses the %rip-relative
+			 * addressing mode.  Adjust the displacement for the
+			 * difference between the original location of this
+			 * instruction and the location of the copy that will
+			 * actually be run.  The tricky bit here is making sure
+			 * that the sign extension happens correctly in this
+			 * calculation, since we need a signed 32-bit result to
+			 * be sign-extended to 64 bits when it's added to the
+			 * %rip value and yield the same 64-bit result that the
+			 * sign-extension of the original signed 32-bit
+			 * displacement would have given.
+			 */
+			disp = (u8 *) p->addr + *((s32 *) insn) - (u8 *) p->ainsn.insn;
+			BUG_ON((s64) (s32) disp != disp); /* Sanity check.  */
+			*(s32 *)insn = (s32) disp;
 		}
 	}
-
-	/* No %rip-relative addressing mode here.  */
-	return NULL;
 }

 static void __kprobes arch_copy_kprobe(struct kprobe *p)
 {
-	s32 *ripdisp;
-	memcpy(p->ainsn.insn, p->addr, MAX_INSN_SIZE);
-	ripdisp = is_riprel(p->ainsn.insn);
-	if (ripdisp) {
-		/*
-		 * The copied instruction uses the %rip-relative
-		 * addressing mode.  Adjust the displacement for the
-		 * difference between the original location of this
-		 * instruction and the location of the copy that will
-		 * actually be run.  The tricky bit here is making sure
-		 * that the sign extension happens correctly in this
-		 * calculation, since we need a signed 32-bit result to
-		 * be sign-extended to 64 bits when it's added to the
-		 * %rip value and yield the same 64-bit result that the
-		 * sign-extension of the original signed 32-bit
-		 * displacement would have given.
-		 */
-		s64 disp = (u8 *) p->addr + *ripdisp - (u8 *) p->ainsn.insn;
-		BUG_ON((s64) (s32) disp != disp); /* Sanity check.  */
-		*ripdisp = disp;
-	}
+	memcpy(p->ainsn.insn, p->addr, MAX_INSN_SIZE * sizeof(kprobe_opcode_t));
+	fix_riprel(p);
 	if (can_boost(p->addr)) {
 		p->ainsn.boostable = 0;
 	} else {
@@ -317,6 +305,16 @@ static void __kprobes arch_copy_kprobe(s
 	p->opcode = *p->addr;
 }

+int __kprobes arch_prepare_kprobe(struct kprobe *p)
+{
+	/* insn: must be on special executable page on x86. */
+	p->ainsn.insn = get_insn_slot();
+	if (!p->ainsn.insn)
+		return -ENOMEM;
+	arch_copy_kprobe(p);
+	return 0;
+}
+
 void __kprobes arch_arm_kprobe(struct kprobe *p)
 {
 	text_poke(p->addr, ((unsigned char []){BREAKPOINT_INSTRUCTION}), 1);
@@ -338,26 +336,26 @@ static void __kprobes save_previous_kpro
 {
 	kcb->prev_kprobe.kp = kprobe_running();
 	kcb->prev_kprobe.status = kcb->kprobe_status;
-	kcb->prev_kprobe.old_rflags = kcb->kprobe_old_rflags;
-	kcb->prev_kprobe.saved_rflags = kcb->kprobe_saved_rflags;
+	kcb->prev_kprobe.old_flags = kcb->kprobe_old_flags;
+	kcb->prev_kprobe.saved_flags = kcb->kprobe_saved_flags;
 }

 static void __kprobes restore_previous_kprobe(struct kprobe_ctlblk *kcb)
 {
 	__get_cpu_var(current_kprobe) = kcb->prev_kprobe.kp;
 	kcb->kprobe_status = kcb->prev_kprobe.status;
-	kcb->kprobe_old_rflags = kcb->prev_kprobe.old_rflags;
-	kcb->kprobe_saved_rflags = kcb->prev_kprobe.saved_rflags;
+	kcb->kprobe_old_flags = kcb->prev_kprobe.old_flags;
+	kcb->kprobe_saved_flags = kcb->prev_kprobe.saved_flags;
 }

 static void __kprobes set_current_kprobe(struct kprobe *p, struct pt_regs *regs,
 				struct kprobe_ctlblk *kcb)
 {
 	__get_cpu_var(current_kprobe) = p;
-	kcb->kprobe_saved_rflags = kcb->kprobe_old_rflags
+	kcb->kprobe_saved_flags = kcb->kprobe_old_flags
 		= (regs->flags & (TF_MASK | IF_MASK));
 	if (is_IF_modifier(p->ainsn.insn))
-		kcb->kprobe_saved_rflags &= ~IF_MASK;
+		kcb->kprobe_saved_flags &= ~IF_MASK;
 }

 static __always_inline void clear_btf(void)
@@ -388,20 +386,27 @@ static void __kprobes prepare_singlestep
 void __kprobes arch_prepare_kretprobe(struct kretprobe_instance *ri,
 				      struct pt_regs *regs)
 {
-	unsigned long *sara = (unsigned long *)regs->sp;
+	unsigned long *sara = stack_addr(regs);

 	ri->ret_addr = (kprobe_opcode_t *) *sara;
+
 	/* Replace the return addr with trampoline addr */
 	*sara = (unsigned long) &kretprobe_trampoline;
 }

-int __kprobes kprobe_handler(struct pt_regs *regs)
+/*
+ * Interrupts are disabled on entry as trap3 is an interrupt gate and they
+ * remain disabled thorough out this function.
+ */
+static int __kprobes kprobe_handler(struct pt_regs *regs)
 {
 	struct kprobe *p;
 	int ret = 0;
-	kprobe_opcode_t *addr = (kprobe_opcode_t *)(regs->ip - sizeof(kprobe_opcode_t));
+	kprobe_opcode_t *addr;
 	struct kprobe_ctlblk *kcb;

+	addr = (kprobe_opcode_t *)(regs->ip - sizeof(kprobe_opcode_t));
+
 	/*
 	 * We don't want to be preempted for the entire
 	 * duration of kprobe processing
@@ -416,7 +421,7 @@ int __kprobes kprobe_handler(struct pt_r
 			if (kcb->kprobe_status == KPROBE_HIT_SS &&
 				*p->ainsn.insn == BREAKPOINT_INSTRUCTION) {
 				regs->flags &= ~TF_MASK;
-				regs->flags |= kcb->kprobe_saved_rflags;
+				regs->flags |= kcb->kprobe_saved_flags;
 				goto no_kprobe;
 			} else if (kcb->kprobe_status == KPROBE_HIT_SSDONE) {
 				/* TODO: Provide re-entrancy from
@@ -427,22 +432,20 @@ int __kprobes kprobe_handler(struct pt_r
 				arch_disarm_kprobe(p);
 				regs->ip = (unsigned long)p->addr;
 				reset_current_kprobe();
-				ret = 1;
-			} else {
-				/* We have reentered the kprobe_handler(), since
-				 * another probe was hit while within the
-				 * handler. We here save the original kprobe
-				 * variables and just single step on instruction
-				 * of the new probe without calling any user
-				 * handlers.
-				 */
-				save_previous_kprobe(kcb);
-				set_current_kprobe(p, regs, kcb);
-				kprobes_inc_nmissed_count(p);
-				prepare_singlestep(p, regs);
-				kcb->kprobe_status = KPROBE_REENTER;
 				return 1;
 			}
+			/* We have reentered the kprobe_handler(), since
+			 * another probe was hit while within the handler.
+			 * We here save the original kprobes variables and
+			 * just single step on the instruction of the new probe
+			 * without calling any user handlers.
+			 */
+			save_previous_kprobe(kcb);
+			set_current_kprobe(p, regs, kcb);
+			kprobes_inc_nmissed_count(p);
+			prepare_singlestep(p, regs);
+			kcb->kprobe_status = KPROBE_REENTER;
+			return 1;
 		} else {
 			if (*addr != BREAKPOINT_INSTRUCTION) {
 			/* The breakpoint instruction was removed by
@@ -572,10 +575,10 @@ fastcall void * __kprobes trampoline_han
 	INIT_HLIST_HEAD(&empty_rp);
 	spin_lock_irqsave(&kretprobe_lock, flags);
 	head = kretprobe_inst_table_head(current);
-	/* fixup rt_regs */
+	/* fixup registers */
 	regs->cs = __KERNEL_CS;
 	regs->ip = trampoline_address;
-	regs->orig_ax = 0xffffffffffffffff;
+	regs->orig_ax = ~0UL;

 	/*
 	 * It is possible to have multiple instances associated with a given
@@ -652,9 +655,9 @@ fastcall void * __kprobes trampoline_han
 static void __kprobes resume_execution(struct kprobe *p,
 		struct pt_regs *regs, struct kprobe_ctlblk *kcb)
 {
-	unsigned long *tos = (unsigned long *)regs->sp;
-	unsigned long copy_rip = (unsigned long)p->ainsn.insn;
-	unsigned long orig_rip = (unsigned long)p->addr;
+	unsigned long *tos = stack_addr(regs);
+	unsigned long copy_ip = (unsigned long)p->ainsn.insn;
+	unsigned long orig_ip = (unsigned long)p->addr;
 	kprobe_opcode_t *insn = p->ainsn.insn;

 	/*skip the REX prefix*/
@@ -665,7 +668,7 @@ static void __kprobes resume_execution(s
 	switch (*insn) {
 	case 0x9c:		/* pushfl */
 		*tos &= ~(TF_MASK | IF_MASK);
-		*tos |= kcb->kprobe_old_rflags;
+		*tos |= kcb->kprobe_old_flags;
 		break;
 	case 0xc2:		/* iret/ret/lret */
 	case 0xc3:
@@ -677,17 +680,19 @@ static void __kprobes resume_execution(s
 		p->ainsn.boostable = 1;
 		goto no_change;
 	case 0xe8:		/* call relative - Fix return addr */
-		*tos = orig_rip + (*tos - copy_rip);
+		*tos = orig_ip + (*tos - copy_ip);
 		break;
 	case 0x9a:		/* call absolute -- same as call absolute, indirect */
-		*tos = orig_rip + (*tos - copy_rip);
+		*tos = orig_ip + (*tos - copy_ip);
 		goto no_change;
 	case 0xff:
 		if ((insn[1] & 0x30) == 0x10) {
-			/* call absolute, indirect */
-			/* Fix return addr; ip is correct. */
-			/* not boostable */
-			*tos = orig_rip + (*tos - copy_rip);
+			/*
+			 * call absolute, indirect
+			 * Fix return addr; ip is correct.
+			 * But this is not boostable
+			 */
+			*tos = orig_ip + (*tos - copy_ip);
 			goto no_change;
 		} else if (((insn[1] & 0x31) == 0x20) ||	/* jmp near, absolute indirect */
 			   ((insn[1] & 0x31) == 0x21)) {	/* jmp far, absolute indirect */
@@ -700,21 +705,21 @@ static void __kprobes resume_execution(s
 	}

 	if (p->ainsn.boostable == 0) {
-		if ((regs->ip > copy_rip) &&
-		    (regs->ip - copy_rip) + 5 < MAX_INSN_SIZE) {
+		if ((regs->ip > copy_ip) &&
+		    (regs->ip - copy_ip) + 5 < MAX_INSN_SIZE) {
 			/*
 			 * These instructions can be executed directly if it
 			 * jumps back to correct address.
 			 */
 			set_jmp_op((void *)regs->ip,
-				   (void *)orig_rip + (regs->ip - copy_rip));
+				   (void *)orig_ip + (regs->ip - copy_ip));
 			p->ainsn.boostable = 1;
 		} else {
 			p->ainsn.boostable = -1;
 		}
 	}

-	regs->ip = orig_rip + (regs->ip - copy_rip);
+	regs->ip += orig_ip - copy_ip;

 no_change:
 	restore_btf();
@@ -722,7 +727,11 @@ no_change:
 	return;
 }

-int __kprobes post_kprobe_handler(struct pt_regs *regs)
+/*
+ * Interrupts are disabled on entry as trap1 is an interrupt gate and they
+ * remain disabled thoroughout this function.
+ */
+static int __kprobes post_kprobe_handler(struct pt_regs *regs)
 {
 	struct kprobe *cur = kprobe_running();
 	struct kprobe_ctlblk *kcb = get_kprobe_ctlblk();
@@ -736,10 +745,10 @@ int __kprobes post_kprobe_handler(struct
 	}

 	resume_execution(cur, regs, kcb);
-	regs->flags |= kcb->kprobe_saved_rflags;
+	regs->flags |= kcb->kprobe_saved_flags;
 	trace_hardirqs_fixup_flags(regs->flags);

-	/* Restore the original saved kprobes variables and continue. */
+	/* Restore back the original saved kprobes variables and continue. */
 	if (kcb->kprobe_status == KPROBE_REENTER) {
 		restore_previous_kprobe(kcb);
 		goto out;
@@ -776,7 +785,7 @@ int __kprobes kprobe_fault_handler(struc
 		 * normal page fault.
 		 */
 		regs->ip = (unsigned long)cur->addr;
-		regs->flags |= kcb->kprobe_old_rflags;
+		regs->flags |= kcb->kprobe_old_flags;
 		if (kcb->kprobe_status == KPROBE_REENTER)
 			restore_previous_kprobe(kcb);
 		else
@@ -813,7 +822,7 @@ int __kprobes kprobe_fault_handler(struc
 		}

 		/*
-		 * fixup() could not handle it,
+		 * fixup routine could not handle it,
 		 * Let do_page_fault() fix it.
 		 */
 		break;
@@ -832,7 +841,7 @@ int __kprobes kprobe_exceptions_notify(s
 	struct die_args *args = (struct die_args *)data;
 	int ret = NOTIFY_DONE;

-	if (args->regs && user_mode(args->regs))
+	if (args->regs && user_mode_vm(args->regs))
 		return ret;

 	switch (val) {
@@ -865,8 +874,9 @@ int __kprobes setjmp_pre_handler(struct
 	struct kprobe_ctlblk *kcb = get_kprobe_ctlblk();

 	kcb->jprobe_saved_regs = *regs;
-	kcb->jprobe_saved_rsp = (long *) regs->sp;
-	addr = (unsigned long)(kcb->jprobe_saved_rsp);
+	kcb->jprobe_saved_sp = stack_addr(regs);
+	addr = (unsigned long)(kcb->jprobe_saved_sp);
+
 	/*
 	 * As Linus pointed out, gcc assumes that the callee
 	 * owns the argument space and could overwrite it, e.g.
@@ -891,21 +901,20 @@ void __kprobes jprobe_return(void)
 		      "       .globl jprobe_return_end	\n"
 		      "       jprobe_return_end:	\n"
 		      "       nop			\n"::"b"
-		      (kcb->jprobe_saved_rsp):"memory");
+		      (kcb->jprobe_saved_sp):"memory");
 }

 int __kprobes longjmp_break_handler(struct kprobe *p, struct pt_regs *regs)
 {
 	struct kprobe_ctlblk *kcb = get_kprobe_ctlblk();
 	u8 *addr = (u8 *) (regs->ip - 1);
-	unsigned long stack_addr = (unsigned long)(kcb->jprobe_saved_rsp);
 	struct jprobe *jp = container_of(p, struct jprobe, kp);

 	if ((addr > (u8 *) jprobe_return) && (addr < (u8 *) jprobe_return_end)) {
-		if ((long *)regs->sp != kcb->jprobe_saved_rsp) {
+		if (stack_addr(regs) != kcb->jprobe_saved_sp) {
 			struct pt_regs *saved_regs = &kcb->jprobe_saved_regs;
 			printk("current sp %p does not match saved sp %p\n",
-			       (long *)regs->sp, kcb->jprobe_saved_rsp);
+			       stack_addr(regs), kcb->jprobe_saved_sp);
 			printk("Saved registers for jprobe %p\n", jp);
 			show_registers(saved_regs);
 			printk("Current registers\n");
@@ -913,8 +922,8 @@ int __kprobes longjmp_break_handler(stru
 			BUG();
 		}
 		*regs = kcb->jprobe_saved_regs;
-		memcpy((kprobe_opcode_t *) stack_addr, kcb->jprobes_stack,
-		       MIN_STACK_SIZE(stack_addr));
+		memcpy((kprobe_opcode_t *)(kcb->jprobe_saved_sp),
+		       kcb->jprobes_stack, MIN_STACK_SIZE(kcb->jprobe_saved_sp));
 		preempt_enable_no_resched();
 		return 1;
 	}
Index: 2.6.24-rc4-mm1/arch/x86/mm/fault_32.c
===================================================================
--- 2.6.24-rc4-mm1.orig/arch/x86/mm/fault_32.c
+++ 2.6.24-rc4-mm1/arch/x86/mm/fault_32.c
@@ -25,7 +25,6 @@
 #include <linux/kprobes.h>
 #include <linux/uaccess.h>
 #include <linux/kdebug.h>
-#include <linux/kprobes.h>

 #include <asm/system.h>
 #include <asm/desc.h>
Index: 2.6.24-rc4-mm1/arch/x86/mm/fault_64.c
===================================================================
--- 2.6.24-rc4-mm1.orig/arch/x86/mm/fault_64.c
+++ 2.6.24-rc4-mm1/arch/x86/mm/fault_64.c
@@ -25,7 +25,6 @@
 #include <linux/kprobes.h>
 #include <linux/uaccess.h>
 #include <linux/kdebug.h>
-#include <linux/kprobes.h>

 #include <asm/system.h>
 #include <asm/pgalloc.h>
Index: 2.6.24-rc4-mm1/include/asm-x86/kprobes_32.h
===================================================================
--- 2.6.24-rc4-mm1.orig/include/asm-x86/kprobes_32.h
+++ 2.6.24-rc4-mm1/include/asm-x86/kprobes_32.h
@@ -2,7 +2,6 @@
 #define _ASM_KPROBES_H
 /*
  *  Kernel Probes (KProbes)
- *  include/asm-i386/kprobes.h
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -23,14 +22,17 @@
  * 2002-Oct	Created by Vamsi Krishna S <vamsi_krishna@in.ibm.com> Kernel
  *		Probes initial implementation ( includes suggestions from
  *		Rusty Russell).
+ * 2004-Oct	Prasanna S Panchamukhi <prasanna@in.ibm.com> and Jim Keniston
+ *		kenistoj@us.ibm.com adopted from i386.
  */
 #include <linux/types.h>
 #include <linux/ptrace.h>
+#include <linux/percpu.h>

 #define  __ARCH_WANT_KPROBES_INSN_SLOT

-struct kprobe;
 struct pt_regs;
+struct kprobe;

 typedef u8 kprobe_opcode_t;
 #define BREAKPOINT_INSTRUCTION	0xcc
@@ -38,9 +40,9 @@ typedef u8 kprobe_opcode_t;
 #define MAX_INSN_SIZE 16
 #define MAX_STACK_SIZE 64
 #define MIN_STACK_SIZE(ADDR) (((MAX_STACK_SIZE) < \
-	(((unsigned long)current_thread_info()) + THREAD_SIZE - (ADDR))) \
+	(((unsigned long)current_thread_info()) + THREAD_SIZE - (unsigned long)(ADDR))) \
 	? (MAX_STACK_SIZE) \
-	: (((unsigned long)current_thread_info()) + THREAD_SIZE - (ADDR)))
+	: (((unsigned long)current_thread_info()) + THREAD_SIZE - (unsigned long)(ADDR)))

 #define ARCH_SUPPORTS_KRETPROBES
 #define flush_insn_slot(p)	do { } while (0)
@@ -55,7 +57,7 @@ struct arch_specific_insn {
 	/* copy of the original instruction */
 	kprobe_opcode_t *insn;
 	/*
-	 * If this flag is not 0, this kprobe can be boost when its
+	 * If this flag is 1, this kprobe can be boosted when its
 	 * post_handler and break_handler is not set.
 	 */
 	int boostable;
@@ -64,16 +66,16 @@ struct arch_specific_insn {
 struct prev_kprobe {
 	struct kprobe *kp;
 	unsigned long status;
-	unsigned long old_eflags;
-	unsigned long saved_eflags;
+	unsigned long old_flags;
+	unsigned long saved_flags;
 };

 /* per-cpu kprobe control block */
 struct kprobe_ctlblk {
 	unsigned long kprobe_status;
-	unsigned long kprobe_old_eflags;
-	unsigned long kprobe_saved_eflags;
-	unsigned long *jprobe_saved_esp;
+	unsigned long kprobe_old_flags;
+	unsigned long kprobe_saved_flags;
+	unsigned long *jprobe_saved_sp;
 	struct pt_regs jprobe_saved_regs;
 	kprobe_opcode_t jprobes_stack[MAX_STACK_SIZE];
 	struct prev_kprobe prev_kprobe;
@@ -88,7 +90,7 @@ static inline void restore_interrupts(st
 		local_irq_enable();
 }

+extern int kprobe_fault_handler(struct pt_regs *regs, int trapnr);
 extern int kprobe_exceptions_notify(struct notifier_block *self,
 				    unsigned long val, void *data);
-extern int kprobe_fault_handler(struct pt_regs *regs, int trapnr);
 #endif				/* _ASM_KPROBES_H */
Index: 2.6.24-rc4-mm1/include/asm-x86/kprobes_64.h
===================================================================
--- 2.6.24-rc4-mm1.orig/include/asm-x86/kprobes_64.h
+++ 2.6.24-rc4-mm1/include/asm-x86/kprobes_64.h
@@ -2,7 +2,6 @@
 #define _ASM_KPROBES_H
 /*
  *  Kernel Probes (KProbes)
- *  include/asm-x86_64/kprobes.h
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -20,6 +19,9 @@
  *
  * Copyright (C) IBM Corporation, 2002, 2004
  *
+ * 2002-Oct	Created by Vamsi Krishna S <vamsi_krishna@in.ibm.com> Kernel
+ *		Probes initial implementation ( includes suggestions from
+ *		Rusty Russell).
  * 2004-Oct	Prasanna S Panchamukhi <prasanna@in.ibm.com> and Jim Keniston
  *		kenistoj@us.ibm.com adopted from i386.
  */
@@ -35,19 +37,20 @@ struct kprobe;
 typedef u8 kprobe_opcode_t;
 #define BREAKPOINT_INSTRUCTION	0xcc
 #define RELATIVEJUMP_INSTRUCTION 0xe9
-#define MAX_INSN_SIZE 15
+#define MAX_INSN_SIZE 16
 #define MAX_STACK_SIZE 64
 #define MIN_STACK_SIZE(ADDR) (((MAX_STACK_SIZE) < \
-	(((unsigned long)current_thread_info()) + THREAD_SIZE - (ADDR))) \
+	(((unsigned long)current_thread_info()) + THREAD_SIZE - (unsigned long)(ADDR))) \
 	? (MAX_STACK_SIZE) \
-	: (((unsigned long)current_thread_info()) + THREAD_SIZE - (ADDR)))
+	: (((unsigned long)current_thread_info()) + THREAD_SIZE - (unsigned long)(ADDR)))

 #define ARCH_SUPPORTS_KRETPROBES
+#define flush_insn_slot(p)	do { } while (0)
+
 extern const int kretprobe_blacklist_size;

+void arch_remove_kprobe(struct kprobe *p);
 void kretprobe_trampoline(void);
-extern void arch_remove_kprobe(struct kprobe *p);
-#define flush_insn_slot(p)	do { } while (0)

 /* Architecture specific copy of original instruction*/
 struct arch_specific_insn {
@@ -63,16 +66,16 @@ struct arch_specific_insn {
 struct prev_kprobe {
 	struct kprobe *kp;
 	unsigned long status;
-	unsigned long old_rflags;
-	unsigned long saved_rflags;
+	unsigned long old_flags;
+	unsigned long saved_flags;
 };

 /* per-cpu kprobe control block */
 struct kprobe_ctlblk {
 	unsigned long kprobe_status;
-	unsigned long kprobe_old_rflags;
-	unsigned long kprobe_saved_rflags;
-	unsigned long *jprobe_saved_rsp;
+	unsigned long kprobe_old_flags;
+	unsigned long kprobe_saved_flags;
+	unsigned long *jprobe_saved_sp;
 	struct pt_regs jprobe_saved_regs;
 	kprobe_opcode_t jprobes_stack[MAX_STACK_SIZE];
 	struct prev_kprobe prev_kprobe;
@@ -87,10 +90,7 @@ static inline void restore_interrupts(st
 		local_irq_enable();
 }

-extern int post_kprobe_handler(struct pt_regs *regs);
 extern int kprobe_fault_handler(struct pt_regs *regs, int trapnr);
-extern int kprobe_handler(struct pt_regs *regs);
-
 extern int kprobe_exceptions_notify(struct notifier_block *self,
 				    unsigned long val, void *data);
 #endif				/* _ASM_KPROBES_H */

-- 
Masami Hiramatsu

Software Engineer
Hitachi Computer Products (America) Inc.
Software Solutions Division

e-mail: mhiramat@redhat.com, masami.hiramatsu.pt@hitachi.com

Re: [RFC -mm][PATCH 5/6] prepare kprobes code for x86 unification

[Srinivasa Ds]

Masami Hiramatsu wrote:
> This patch cleanup kprobes code on x86 for unification.
> This patch is based on Arjan's previous work.
> 
> - Remove spurious whitespace changes
> - Add harmless includes
> - Make the 32/64 files more identical
>  - Generalize structure fields' and local variable name.
>  - Wrap accessing to stack address by macros.
>  - Modify bitmap making macro.
>  - Merge fixup code into is_riprel() and change its name to fix_riprel().
>  - Set MAX_INSN_SIZE to 16 on both arch.
> 

Hi Masami
 
I was testing your patch on x86_64 by executing systemtap tests. I got this oops message.


Unable to handle kernel paging request at ffffffff8086ccb3 RIP: 
 [<ffffffff804739c5>] arch_prepare_kprobe+0x22/0x217
PGD 203067 PUD 207063 PMD 7e086163 PTE 86c000
Oops: 0000 [1] SMP 
last sysfs file: /sys/module/stap_60ea9007c2ab1a78963339fffdc0a88e_356908/sections/.bss
CPU 1 
Modules linked in: stap_60ea9007c2ab1a78963339fffdc0a88e_356908 systemtap_test_module1 systemtap_test_module2 ipv6 autofs4 hidp rfcomm l2cap bluetooth sunrpc dm_multipath video output sbs sbshc battery acpi_memhotplug ac power_supply lp sg tg3 button i2c_i801 ide_cd parport_pc shpchp parport serio_raw cdrom i2c_core e752x_edac floppy edac_core pcspkr dm_snapshot dm_zero dm_mirror dm_mod ata_piix libata aic79xx scsi_transport_spi sd_mod scsi_mod ext3 jbd ehci_hcd ohci_hcd uhci_hcd
Pid: 3171, comm: stapio Tainted: GF       2.6.24-rc4-mm1 #2
RIP: 0010:[<ffffffff804739c5>]  [<ffffffff804739c5>] arch_prepare_kprobe+0x22/0x217
RSP: 0018:ffff81003b6d7e48  EFLAGS: 00010282
RAX: ffffffff8086ccb3 RBX: ffffffff884371d0 RCX: ffffffff88224f20
RDX: 0000000000000f20 RSI: 6600000000000000 RDI: ffffffff884371d0
RBP: ffffffff884371d0 R08: ffff810035daf000 R09: ffff81007f834000
R10: ffffffff8024bf9c R11: 0000000000000000 R12: 00000000000036b0
R13: 0000000000000000 R14: ffffffff8840e3b2 R15: 0000000000000000
FS:  00002b2e14748b00(0000) GS:ffff81007fbac840(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
CR2: ffffffff8086ccb3 CR3: 000000007c5a3000 CR4: 00000000000006e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff4ff0 DR7: 0000000000000400
Process stapio (pid: 3171, threadinfo ffff81003b6d6000, task ffff8100187bc340)
Stack:  0000000000000000 ffffffff80474c5c 0000000000000000 ffffffff884371d0
 0000000000000000 00000000000036b0 00000000000001d2 ffffffff8840485b
 00000000000036b0 00000000000a7fc4 ffff81003b6d7ee8 0000000000000008
Call Trace:
 [<ffffffff80474c5c>] __register_kprobe+0x1f0/0x2e8
 [<ffffffff8840485b>] :stap_60ea9007c2ab1a78963339fffdc0a88e_356908:systemtap_module_init+0x202/0x45f
 [<ffffffff88404ac1>] :stap_60ea9007c2ab1a78963339fffdc0a88e_356908:probe_start+0x9/0x12
 [<ffffffff88404aeb>] :stap_60ea9007c2ab1a78963339fffdc0a88e_356908:_stp_handle_start+0x21/0x7c
 [<ffffffff88404bb8>] :stap_60ea9007c2ab1a78963339fffdc0a88e_356908:_stp_ctl_write_cmd+0x72/0xc3
 [<ffffffff80265748>] audit_syscall_entry+0x141/0x174
 [<ffffffff80296349>] vfs_write+0xc6/0x14f
 [<ffffffff8029689f>] sys_write+0x45/0x6e
 [<ffffffff8020c0dc>] tracesys+0xdc/0xe1


Code: 48 8b 10 48 89 11 48 8b 40 08 48 89 41 08 48 8b 53 70 8a 02 
RIP  [<ffffffff804739c5>] arch_prepare_kprobe+0x22/0x217
 RSP <ffff81003b6d7e48>
CR2: ffffffff8086ccb3


On debugging it further I found that, current.stp is causing oops(easily reproducible too)
Current.stp probes all functions in kernel/sched.c and some module functions.

 743 arch_copy_kprobe():
    744 /root/linux-2.6.24-rc4/arch/x86/kernel/kprobes.c:312
    745  6bf:   48 8b 43 30             mov    0x30(%rbx),%rax
    746  6c3:   48 8b 10                mov    (%rax),%rdx  <<<<<<<<IP is here>>>>>
    747  6c6:   48 89 11                mov    %rdx,(%rcx)
    748  6c9:   48 8b 40 08             mov    0x8(%rax),%rax
    749  6cd:   48 89 41 08             mov    %rax,0x8(%rcx)
==============================================
  310 static void __kprobes arch_copy_kprobe(struct kprobe *p)
    311 {
    312         memcpy(p->ainsn.insn, p->addr, MAX_INSN_SIZE * sizeof(kprobe_opcode_t)); <<IP>>
    313         fix_riprel(p);
    314         if (can_boost(p->addr)) {

That means on accessing rax(p->addr), kernel has crashed.
RAX=p->addr= ffffffff8086ccb3
 
 cat /proc/kallsyms | grep ffffffff8086ccb3
ffffffff8086ccb3 t init_sched_debug_procfs

Since "init_sched_debug_procfs" is a __init function and deallocation of memory
of __init function may be causing the problem.I tried probing this function directly,
 but didn't see any oops. 


Thanks
 Srinivasa DS

Re: [RFC -mm][PATCH 5/6] prepare kprobes code for x86 unification

[Arjan van de Ven]

On Mon, 10 Dec 2007 17:53:22 -0500
Masami Hiramatsu <mhiramat@redhat.com> wrote:
> +#define stack_addr(regs) ((unsigned long *)&regs->sp)


Hi,

thanks for taking up this work again, however this line has a bug (yes it's a bug in the 32 bit retprobes);
the address of the stack is regs->sp not &regs->sp, since &regs->sp is the address of the memory we store the stackpointer in, not the actual address on the stack...

Greetings,
  Arjan van de Ven

Re: [RFC -mm][PATCH 5/6] prepare kprobes code for x86 unification

[Masami Hiramatsu]

Hi Arjan,

Thank you for comment.
Arjan van de Ven wrote:
> On Mon, 10 Dec 2007 17:53:22 -0500
> Masami Hiramatsu <mhiramat@redhat.com> wrote:
>> +#define stack_addr(regs) ((unsigned long *)&regs->sp)
> 
> Hi,
> 
> thanks for taking up this work again, however this line has a bug (yes it's a bug in the 32 bit retprobes);
> the address of the stack is regs->sp not &regs->sp, since &regs->sp is the address of the 
> memory we store the stackpointer in, not the actual address on the stack...

As far as I know, it is true on x86-64, but it's not true on x86-32(kernel mode).
I checked it in __show_registers()@arch/x86/kernel/process_32.c.

Here is that code:
>         if (user_mode_vm(regs)) {
>                 sp = regs->sp;
>                 ss = regs->ss & 0xffff;
>                 savesegment(gs, gs);
>         } else {
>                 sp = (unsigned long) (&regs->sp);
>                 savesegment(ss, ss);
>                 savesegment(gs, gs);
>         }

So, in kernel mode, &regs->sp is the address of the top of stack.

Best Regards,

> 
> Greetings,
>   Arjan van de Ven

-- 
Masami Hiramatsu

Software Engineer
Hitachi Computer Products (America) Inc.
Software Solutions Division

e-mail: mhiramat@redhat.com, masami.hiramatsu.pt@hitachi.com

Re: [RFC -mm][PATCH 5/6] prepare kprobes code for x86 unification

[Masami Hiramatsu]

Hi Srinivasa,

Thank you for reporting.

Srinivasa Ds wrote:
> Hi Masami
>  
> I was testing your patch on x86_64 by executing systemtap tests. I got this oops message.

I ran systemtap testsuite on x86-64. But I could not reproduce it yet.
Would you apply all of these patches or just first 5 patches?

> Unable to handle kernel paging request at ffffffff8086ccb3 RIP: 
>  [<ffffffff804739c5>] arch_prepare_kprobe+0x22/0x217
> PGD 203067 PUD 207063 PMD 7e086163 PTE 86c000
> Oops: 0000 [1] SMP 
> last sysfs file: /sys/module/stap_60ea9007c2ab1a78963339fffdc0a88e_356908/sections/.bss
> CPU 1 
> Modules linked in: stap_60ea9007c2ab1a78963339fffdc0a88e_356908 systemtap_test_module1 systemtap_test_module2 ipv6 autofs4 hidp rfcomm l2cap bluetooth sunrpc dm_multipath video output sbs sbshc battery acpi_memhotplug ac power_supply lp sg tg3 button i2c_i801 ide_cd parport_pc shpchp parport serio_raw cdrom i2c_core e752x_edac floppy edac_core pcspkr dm_snapshot dm_zero dm_mirror dm_mod ata_piix libata aic79xx scsi_transport_spi sd_mod scsi_mod ext3 jbd ehci_hcd ohci_hcd uhci_hcd
> Pid: 3171, comm: stapio Tainted: GF       2.6.24-rc4-mm1 #2
> RIP: 0010:[<ffffffff804739c5>]  [<ffffffff804739c5>] arch_prepare_kprobe+0x22/0x217
> RSP: 0018:ffff81003b6d7e48  EFLAGS: 00010282
> RAX: ffffffff8086ccb3 RBX: ffffffff884371d0 RCX: ffffffff88224f20
> RDX: 0000000000000f20 RSI: 6600000000000000 RDI: ffffffff884371d0
> RBP: ffffffff884371d0 R08: ffff810035daf000 R09: ffff81007f834000
> R10: ffffffff8024bf9c R11: 0000000000000000 R12: 00000000000036b0
> R13: 0000000000000000 R14: ffffffff8840e3b2 R15: 0000000000000000
> FS:  00002b2e14748b00(0000) GS:ffff81007fbac840(0000) knlGS:0000000000000000
> CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
> CR2: ffffffff8086ccb3 CR3: 000000007c5a3000 CR4: 00000000000006e0
> DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
> DR3: 0000000000000000 DR6: 00000000ffff4ff0 DR7: 0000000000000400
> Process stapio (pid: 3171, threadinfo ffff81003b6d6000, task ffff8100187bc340)
> Stack:  0000000000000000 ffffffff80474c5c 0000000000000000 ffffffff884371d0
>  0000000000000000 00000000000036b0 00000000000001d2 ffffffff8840485b
>  00000000000036b0 00000000000a7fc4 ffff81003b6d7ee8 0000000000000008
> Call Trace:
>  [<ffffffff80474c5c>] __register_kprobe+0x1f0/0x2e8
>  [<ffffffff8840485b>] :stap_60ea9007c2ab1a78963339fffdc0a88e_356908:systemtap_module_init+0x202/0x45f
>  [<ffffffff88404ac1>] :stap_60ea9007c2ab1a78963339fffdc0a88e_356908:probe_start+0x9/0x12
>  [<ffffffff88404aeb>] :stap_60ea9007c2ab1a78963339fffdc0a88e_356908:_stp_handle_start+0x21/0x7c
>  [<ffffffff88404bb8>] :stap_60ea9007c2ab1a78963339fffdc0a88e_356908:_stp_ctl_write_cmd+0x72/0xc3
>  [<ffffffff80265748>] audit_syscall_entry+0x141/0x174
>  [<ffffffff80296349>] vfs_write+0xc6/0x14f
>  [<ffffffff8029689f>] sys_write+0x45/0x6e
>  [<ffffffff8020c0dc>] tracesys+0xdc/0xe1
> 
> 
> Code: 48 8b 10 48 89 11 48 8b 40 08 48 89 41 08 48 8b 53 70 8a 02 
> RIP  [<ffffffff804739c5>] arch_prepare_kprobe+0x22/0x217
>  RSP <ffff81003b6d7e48>
> CR2: ffffffff8086ccb3
> 
> 
> On debugging it further I found that, current.stp is causing oops(easily reproducible too)
> Current.stp probes all functions in kernel/sched.c and some module functions.

Unfortunately, I could not reproduce it by executing current.stp too.

> 
>  743 arch_copy_kprobe():
>     744 /root/linux-2.6.24-rc4/arch/x86/kernel/kprobes.c:312
>     745  6bf:   48 8b 43 30             mov    0x30(%rbx),%rax
>     746  6c3:   48 8b 10                mov    (%rax),%rdx  <<<<<<<<IP is here>>>>>
>     747  6c6:   48 89 11                mov    %rdx,(%rcx)
>     748  6c9:   48 8b 40 08             mov    0x8(%rax),%rax
>     749  6cd:   48 89 41 08             mov    %rax,0x8(%rcx)
> ==============================================
>   310 static void __kprobes arch_copy_kprobe(struct kprobe *p)
>     311 {
>     312         memcpy(p->ainsn.insn, p->addr, MAX_INSN_SIZE * sizeof(kprobe_opcode_t)); <<IP>>
>     313         fix_riprel(p);
>     314         if (can_boost(p->addr)) {
> 
> That means on accessing rax(p->addr), kernel has crashed.
> RAX=p->addr= ffffffff8086ccb3
>  
>  cat /proc/kallsyms | grep ffffffff8086ccb3
> ffffffff8086ccb3 t init_sched_debug_procfs
> 
> Since "init_sched_debug_procfs" is a __init function and deallocation of memory
> of __init function may be causing the problem.I tried probing this function directly,
>  but didn't see any oops. 

Sure, I also tested it (stap -e 'probe kernel.function("init_sched_debug_procfs"){}')
but it could not cause oops.

By the way, as far as I can see, the current.stp does not probe "init_sched_debug_procfs".
So it could be caused by incorrect debuginfo...

Best Regards,

> 
> 
> Thanks
>  Srinivasa DS

-- 
Masami Hiramatsu

Software Engineer
Hitachi Computer Products (America) Inc.
Software Solutions Division

e-mail: mhiramat@redhat.com, masami.hiramatsu.pt@hitachi.com

Re: [RFC -mm][PATCH 5/6] prepare kprobes code for x86 unification

[Jim Keniston]

On Tue, 2007-12-11 at 11:40 -0500, Masami Hiramatsu wrote:
> Hi Arjan,
> 
> Thank you for comment.
> Arjan van de Ven wrote:
> > On Mon, 10 Dec 2007 17:53:22 -0500
> > Masami Hiramatsu <mhiramat@redhat.com> wrote:
> >> +#define stack_addr(regs) ((unsigned long *)&regs->sp)
> > 
> > Hi,
> > 
> > thanks for taking up this work again, however this line has a bug (yes it's a bug in the 32 bit retprobes);
> > the address of the stack is regs->sp not &regs->sp, since &regs->sp is the address of the 
> > memory we store the stackpointer in, not the actual address on the stack...
> 
> As far as I know, it is true on x86-64, but it's not true on x86-32(kernel mode).
> I checked it in __show_registers()@arch/x86/kernel/process_32.c.
> 
> Here is that code:
> >         if (user_mode_vm(regs)) {
> >                 sp = regs->sp;
> >                 ss = regs->ss & 0xffff;
> >                 savesegment(gs, gs);
> >         } else {
> >                 sp = (unsigned long) (&regs->sp);
> >                 savesegment(ss, ss);
> >                 savesegment(gs, gs);
> >         }
> 
> So, in kernel mode, &regs->sp is the address of the top of stack.
> 
> Best Regards,
> 
> > 
> > Greetings,
> >   Arjan van de Ven

Masami is correct.  x86_32 CPUs don't save the ss and esp registers if
the CPU is already in kernel mode when it traps.  So in this case,
regs->esp and regs->xss are not the [nonexistent] saved stack pointer
and ss register, but rather the last 8 bytes of the pre-int3 stack.  So
&regs->esp happens to point to the top of the pre-int3 stack.

Jim

Re: [RFC -mm][PATCH 5/6] prepare kprobes code for x86 unification

[Srinivasa Ds]

Masami Hiramatsu wrote:
> Hi Srinivasa,
> 
> Thank you for reporting.
> 
> Srinivasa Ds wrote:
>> Hi Masami
>>  
>> I was testing your patch on x86_64 by executing systemtap tests. I got this oops message.
> 
> I ran systemtap testsuite on x86-64. But I could not reproduce it yet.
> Would you apply all of these patches or just first 5 patches?

Yes, I applied all patches and then tested it.

> 
> Sure, I also tested it (stap -e 'probe kernel.function("init_sched_debug_procfs"){}')
> but it could not cause oops.
> 
> By the way, as far as I can see, the current.stp does not probe "init_sched_debug_procfs".
> So it could be caused by incorrect debuginfo...
> 

I verified the debuginfo and then ran the test, but still I could able to reproduce the problem.


Unable to handle kernel paging request at ffffffff8086ccb3 RIP:
 [<ffffffff804739c5>] arch_prepare_kprobe+0x22/0x217
PGD 203067 PUD 207063 PMD 7e0da163 PTE 86c000
Oops: 0000 [1] SMP
last sysfs file: /sys/module/stap_35adaae6e718a71673316d7b16a93286_356228/sections/.bss
CPU 1
Modules linked in: stap_35adaae6e718a71673316d7b16a93286_356228 systemtap_test_module1 systemtap_test_module2 ipv6 autofs4 hidp rfcomm l2cap bluetooth sunrpc dm_multipath video output sbs sbshc battery acpi_memhotplug ac power_supply lp sg tg3 ide_cd cdrom floppy serio_raw parport_pc button e752x_edac parport edac_core i2c_i801 shpchp i2c_core pcspkr dm_snapshot dm_zero dm_mirror dm_mod ata_piix libata aic79xx scsi_transport_spi sd_mod scsi_mod ext3 jbd ehci_hcd ohci_hcd uhci_hcd
Pid: 28478, comm: stapio Tainted: GF       2.6.24-rc4-mm1 #4
RIP: 0010:[<ffffffff804739c5>]  [<ffffffff804739c5>] arch_prepare_kprobe+0x22/0x217
RSP: 0018:ffff810067055e48  EFLAGS: 00010286
RAX: ffffffff8086ccb3 RBX: ffffffff88464130 RCX: ffffffff8842af30
RDX: 0000000000000f30 RSI: 6600000000000000 RDI: ffffffff88464130
RBP: ffffffff88464130 R08: ffff81000d4d6000 R09: ffff81007f834000
R10: ffffffff8024bf9c R11: 0000000000000000 R12: 00000000000036b0
R13: 0000000000000000 R14: ffffffff8843b3b2 R15: 0000000000000000
FS:  00002aebec1e2b00(0000) GS:ffff81007fbac840(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b

[root@llm42 ~]# cat /proc/kallsyms | grep ffffffff8086ccb3
ffffffff8086ccb3 T migration_init
==================
[root@llm42 ~]# cat /root/linux-2.6.24-rc4/System.map | grep ffffffff8086ccb3
ffffffff8086ccb3 T migration_init

This time it was probing "__init migration_init" function in kernel/sched.c,I saw systemtap code 
blacklisting all .init and .exit functions but still it failed.
I replaced all __init function in kernel/sched.c to __kprobes then 
executed the tests successfully.

So may be problem is in naming the section of vmlinux properly.

Thanks 
 Srinivasa DS

Re: [RFC -mm][PATCH 5/6] prepare kprobes code for x86 unification

[Masami Hiramatsu]

Hi Srinivasa,

Srinivasa Ds wrote:
>>> I was testing your patch on x86_64 by executing systemtap tests. I got this oops message.
>> I ran systemtap testsuite on x86-64. But I could not reproduce it yet.
>> Would you apply all of these patches or just first 5 patches?
> 
> Yes, I applied all patches and then tested it.
> 
>> Sure, I also tested it (stap -e 'probe kernel.function("init_sched_debug_procfs"){}')
>> but it could not cause oops.
>>
>> By the way, as far as I can see, the current.stp does not probe "init_sched_debug_procfs".
>> So it could be caused by incorrect debuginfo...
>>
> 
> I verified the debuginfo and then ran the test, but still I could able to reproduce the problem.

Could you send me your .config? It will help me to reproduce this problem.

> Unable to handle kernel paging request at ffffffff8086ccb3 RIP:
>  [<ffffffff804739c5>] arch_prepare_kprobe+0x22/0x217
> PGD 203067 PUD 207063 PMD 7e0da163 PTE 86c000
> Oops: 0000 [1] SMP
> last sysfs file: /sys/module/stap_35adaae6e718a71673316d7b16a93286_356228/sections/.bss
> CPU 1
> Modules linked in: stap_35adaae6e718a71673316d7b16a93286_356228 systemtap_test_module1 systemtap_test_module2 ipv6 autofs4 hidp rfcomm l2cap bluetooth sunrpc dm_multipath video output sbs sbshc battery acpi_memhotplug ac power_supply lp sg tg3 ide_cd cdrom floppy serio_raw parport_pc button e752x_edac parport edac_core i2c_i801 shpchp i2c_core pcspkr dm_snapshot dm_zero dm_mirror dm_mod ata_piix libata aic79xx scsi_transport_spi sd_mod scsi_mod ext3 jbd ehci_hcd ohci_hcd uhci_hcd
> Pid: 28478, comm: stapio Tainted: GF       2.6.24-rc4-mm1 #4
> RIP: 0010:[<ffffffff804739c5>]  [<ffffffff804739c5>] arch_prepare_kprobe+0x22/0x217
> RSP: 0018:ffff810067055e48  EFLAGS: 00010286
> RAX: ffffffff8086ccb3 RBX: ffffffff88464130 RCX: ffffffff8842af30
> RDX: 0000000000000f30 RSI: 6600000000000000 RDI: ffffffff88464130
> RBP: ffffffff88464130 R08: ffff81000d4d6000 R09: ffff81007f834000
> R10: ffffffff8024bf9c R11: 0000000000000000 R12: 00000000000036b0
> R13: 0000000000000000 R14: ffffffff8843b3b2 R15: 0000000000000000
> FS:  00002aebec1e2b00(0000) GS:ffff81007fbac840(0000) knlGS:0000000000000000
> CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
> 
> [root@llm42 ~]# cat /proc/kallsyms | grep ffffffff8086ccb3
> ffffffff8086ccb3 T migration_init
> ==================
> [root@llm42 ~]# cat /root/linux-2.6.24-rc4/System.map | grep ffffffff8086ccb3
> ffffffff8086ccb3 T migration_init
> 
> This time it was probing "__init migration_init" function in kernel/sched.c,I saw systemtap code 
> blacklisting all .init and .exit functions but still it failed.
> I replaced all __init function in kernel/sched.c to __kprobes then 
> executed the tests successfully.
> 
> So may be problem is in naming the section of vmlinux properly.

I think it will cause without my patchset if your presumption is right.
Could you check that?

> 
> Thanks 
>  Srinivasa DS

Thank you,

-- 
Masami Hiramatsu

Software Engineer
Hitachi Computer Products (America) Inc.
Software Solutions Division

e-mail: mhiramat@redhat.com, masami.hiramatsu.pt@hitachi.com

Re: [RFC -mm][PATCH 5/6] prepare kprobes code for x86 unification

[Masami Hiramatsu]

Hi,

Masami Hiramatsu wrote:
>> This time it was probing "__init migration_init" function in kernel/sched.c,I saw systemtap code 
>> blacklisting all .init and .exit functions but still it failed.
>> I replaced all __init function in kernel/sched.c to __kprobes then 
>> executed the tests successfully.
>>
>> So may be problem is in naming the section of vmlinux properly.
> 
> I think it will cause without my patchset if your presumption is right.
> Could you check that?

Finally, I reproduced it by executing a command below:
% stap -e 'probe kernel.function("migration_init"){}'

And also, I found that oops occurred without my patch,
and even more, it occurred with 2.6.24-rc4 on x86-64,
but did not occurred with 2.6.23.8-34.fc7.

We might find an unknown bug.

Thanks,

-- 
Masami Hiramatsu

Software Engineer
Hitachi Computer Products (America) Inc.
Software Solutions Division

e-mail: mhiramat@redhat.com, masami.hiramatsu.pt@hitachi.com

Re: [RFC -mm][PATCH 5/6] prepare kprobes code for x86 unification

[Masami Hiramatsu]

Masami Hiramatsu wrote:
> Finally, I reproduced it by executing a command below:
> % stap -e 'probe kernel.function("migration_init"){}'
> 
> And also, I found that oops occurred without my patch,
> and even more, it occurred with 2.6.24-rc4 on x86-64,
> but did not occurred with 2.6.23.8-34.fc7.
>
> We might find an unknown bug.

I compared both .config files and found that this bug
did not occur with CONFIG_RELOCATABLE=y.
I checked this with vanilla-2.6.23 on x86-64.

I also read the contents of the page which included migration_init().
It was filled by "0xcc"(POISON_FREE_INITMEM).
I think those freed pages are marked as freed and are not purged
from the pagetable when CONFIG_RELOCATABLE=y.

Anyway, probing those "__init" functions after the kernel freed it
is meaningless and even dangerous . I think kprobes should check it
and reject it when registering a probe.

Thank you,

-masami

> 
> Thanks,
> 

-- 
Masami Hiramatsu

Software Engineer
Hitachi Computer Products (America) Inc.
Software Solutions Division

e-mail: mhiramat@redhat.com, masami.hiramatsu.pt@hitachi.com

Re: [RFC -mm][PATCH 5/6] prepare kprobes code for x86 unification

[Ananth N Mavinakayanahalli]

On Wed, Dec 12, 2007 at 08:21:01PM -0500, Masami Hiramatsu wrote:
> Masami Hiramatsu wrote:
> > Finally, I reproduced it by executing a command below:
> > % stap -e 'probe kernel.function("migration_init"){}'
> > 
> > And also, I found that oops occurred without my patch,
> > and even more, it occurred with 2.6.24-rc4 on x86-64,
> > but did not occurred with 2.6.23.8-34.fc7.
> >
> > We might find an unknown bug.
> 
> I compared both .config files and found that this bug
> did not occur with CONFIG_RELOCATABLE=y.
> I checked this with vanilla-2.6.23 on x86-64.
> 
> I also read the contents of the page which included migration_init().
> It was filled by "0xcc"(POISON_FREE_INITMEM).
> I think those freed pages are marked as freed and are not purged
> from the pagetable when CONFIG_RELOCATABLE=y.
> 
> Anyway, probing those "__init" functions after the kernel freed it
> is meaningless and even dangerous . I think kprobes should check it
> and reject it when registering a probe.

That does seem like the right thing to do. This also needs to live in
common code.

Srini,
Want to take a stab at it?

Ananth

Re: [RFC -mm][PATCH 5/6] prepare kprobes code for x86 unification

[Srinivasa Ds]

Ananth N Mavinakayanahalli wrote:
> On Wed, Dec 12, 2007 at 08:21:01PM -0500, Masami Hiramatsu wrote:
>> Masami Hiramatsu wrote:
>>> Finally, I reproduced it by executing a command below:
>>> % stap -e 'probe kernel.function("migration_init"){}'
>>>

> 
> That does seem like the right thing to do. This also needs to live in
> common code.
> 
> Srini,
> Want to take a stab at it?


How about this Ananth ???
         

Signed-off-by: Srinivasa DS <srinivasa@in.ibm.com> 




--- kernel/kprobes.c.orig       2007-12-13 13:43:45.000000000 +0530
+++ kernel/kprobes.c    2007-12-13 13:48:32.000000000 +0530
@@ -48,6 +48,7 @@
 #include <asm/cacheflush.h>
 #include <asm/errno.h>
 #include <asm/uaccess.h>
+#include <asm/sections.h>
 
 #define KPROBE_HASH_BITS 6
 #define KPROBE_TABLE_SIZE (1 << KPROBE_HASH_BITS)
@@ -722,6 +723,11 @@ int __kprobes register_kretprobe(struct 
                if (addr == NULL)
                        kprobe_lookup_name(rp->kp.symbol_name, addr);
                addr += rp->kp.offset;
+
+       if (addr >= (unsigned long)_sinittext && 
+           addr <= (unsigned long)_einittext)
+               return -EINVAL;
+
 
                for (i = 0; kretprobe_blacklist[i].name != NULL; i++) {
                        if (kretprobe_blacklist[i].addr == addr)

Re: [RFC -mm][PATCH 5/6] prepare kprobes code for x86 unification

[Ananth N Mavinakayanahalli]

On Thu, Dec 13, 2007 at 01:47:50PM +0530, Srinivasa Ds wrote:
> Ananth N Mavinakayanahalli wrote:
> >On Wed, Dec 12, 2007 at 08:21:01PM -0500, Masami Hiramatsu wrote:
> >>Masami Hiramatsu wrote:
> >>>Finally, I reproduced it by executing a command below:
> >>>% stap -e 'probe kernel.function("migration_init"){}'
> >>>
> 
> >
> >That does seem like the right thing to do. This also needs to live in
> >common code.
> >
> >Srini,
> >Want to take a stab at it?
> 
> 
> How about this Ananth ???
>         
> 
> Signed-off-by: Srinivasa DS <srinivasa@in.ibm.com> 
> 
> 
> 
> 
> --- kernel/kprobes.c.orig       2007-12-13 13:43:45.000000000 +0530
> +++ kernel/kprobes.c    2007-12-13 13:48:32.000000000 +0530
> @@ -48,6 +48,7 @@
> #include <asm/cacheflush.h>
> #include <asm/errno.h>
> #include <asm/uaccess.h>
> +#include <asm/sections.h>
> 
> #define KPROBE_HASH_BITS 6
> #define KPROBE_TABLE_SIZE (1 << KPROBE_HASH_BITS)
> @@ -722,6 +723,11 @@ int __kprobes register_kretprobe(struct 
>                if (addr == NULL)
>                        kprobe_lookup_name(rp->kp.symbol_name, addr);
>                addr += rp->kp.offset;
> +
> +       if (addr >= (unsigned long)_sinittext && 
> +           addr <= (unsigned long)_einittext)
> +               return -EINVAL;
> +

We wouldn't want to permit registration of kprobes also, do we? Looks
like you've changed it only for kretprobes.

Have you tested the patch?

Ananth

> 
>                for (i = 0; kretprobe_blacklist[i].name != NULL; i++) {
>                        if (kretprobe_blacklist[i].addr == addr)

[RFC -mm][PATCH ] Patch to avoid probing __init functions using kprobes

[Srinivasa Ds]

On Thursday 13 Dec 2007 1:53:26 pm Ananth N Mavinakayanahalli wrote:
> On Thu, Dec 13, 2007 at 01:47:50PM +0530, Srinivasa Ds wrote:
> > Ananth N Mavinakayanahalli wrote:
> > >On Wed, Dec 12, 2007 at 08:21:01PM -0500, Masami Hiramatsu wrote:
> > >>Masami Hiramatsu wrote:
> > >>>Finally, I reproduced it by executing a command below:
> > >>>% stap -e 'probe kernel.function("migration_init"){}'
> > >
> > >That does seem like the right thing to do. This also needs to live in
> > >common code.
> > >
> > >Srini,
> > >Want to take a stab at it?
> >

This patch taken against the 2.6.24-rc4-mm1 fixes the problem 
of probing __init functions.I have reused the code from extable.c
and modified the kprobes.c accordingly.

Since we are checking __init functions in __register_kprobe, there is 
no need to call kernel_noninit_text_address() in register_kretprobe.


Signed-off-by: Srinivasa DS <srinivasa@in.ibm.com>

 
---
 include/linux/kernel.h |    1 +
 kernel/extable.c       |   17 ++++++++++++++++-
 kernel/kprobes.c       |    4 ++--
 3 files changed, 19 insertions(+), 3 deletions(-)

Index: linux-2.6.24-rc4/include/linux/kernel.h
===================================================================
--- linux-2.6.24-rc4.orig/include/linux/kernel.h
+++ linux-2.6.24-rc4/include/linux/kernel.h
@@ -169,6 +169,7 @@ extern unsigned long long memparse(char 
 extern int core_kernel_text(unsigned long addr);
 extern int __kernel_text_address(unsigned long addr);
 extern int kernel_text_address(unsigned long addr);
+extern int kernel_noninit_text_address(unsigned long addr);
 struct pid;
 extern struct pid *session_of_pgrp(struct pid *pgrp);
 
Index: linux-2.6.24-rc4/kernel/extable.c
===================================================================
--- linux-2.6.24-rc4.orig/kernel/extable.c
+++ linux-2.6.24-rc4/kernel/extable.c
@@ -40,11 +40,18 @@ const struct exception_table_entry *sear
 	return e;
 }
 
-int core_kernel_text(unsigned long addr)
+static int  core_kernel_noninit_text(unsigned long addr)
 {
 	if (addr >= (unsigned long)_stext &&
 	    addr <= (unsigned long)_etext)
 		return 1;
+	return 0;
+}
+
+int core_kernel_text(unsigned long addr)
+{
+	if (core_kernel_noninit_text(addr))
+		return 1;
 
 	if (addr >= (unsigned long)_sinittext &&
 	    addr <= (unsigned long)_einittext)
@@ -65,3 +72,11 @@ int kernel_text_address(unsigned long ad
 		return 1;
 	return module_text_address(addr) != NULL;
 }
+
+int kernel_noninit_text_address(unsigned long addr)
+{
+	if (core_kernel_noninit_text(addr))
+		return 1;
+	return module_text_address(addr) != NULL;
+}
+
Index: linux-2.6.24-rc4/kernel/kprobes.c
===================================================================
--- linux-2.6.24-rc4.orig/kernel/kprobes.c
+++ linux-2.6.24-rc4/kernel/kprobes.c
@@ -520,7 +520,7 @@ static int __kprobes __register_kprobe(s
 		return -EINVAL;
 	p->addr = (kprobe_opcode_t *)(((char *)p->addr)+ p->offset);
 
-	if (!kernel_text_address((unsigned long) p->addr) ||
+	if (!kernel_noninit_text_address((unsigned long) p->addr) ||
 	    in_kprobes_functions((unsigned long) p->addr))
 		return -EINVAL;
 
@@ -662,7 +662,7 @@ int __kprobes register_jprobe(struct jpr
 {
 	unsigned long addr = arch_deref_entry_point(jp->entry);
 
-	if (!kernel_text_address(addr))
+	if (!kernel_noninit_text_address(addr))
 		return -EINVAL;
 
 	/* Todo: Verify probepoint is a function entry point */

Re: [RFC -mm][PATCH ] Patch to avoid probing __init functions using kprobes

[Ananth N Mavinakayanahalli]

On Thu, Dec 13, 2007 at 04:51:18PM +0530, Srinivasa Ds wrote:
> ines: 102
> 
> On Thursday 13 Dec 2007 1:53:26 pm Ananth N Mavinakayanahalli wrote:
> > On Thu, Dec 13, 2007 at 01:47:50PM +0530, Srinivasa Ds wrote:
> > > Ananth N Mavinakayanahalli wrote:
> > > >On Wed, Dec 12, 2007 at 08:21:01PM -0500, Masami Hiramatsu wrote:
> > > >>Masami Hiramatsu wrote:
> > > >>>Finally, I reproduced it by executing a command below:
> > > >>>% stap -e 'probe kernel.function("migration_init"){}'
> > > >
> > > >That does seem like the right thing to do. This also needs to live in
> > > >common code.
> > > >
> > > >Srini,
> > > >Want to take a stab at it?
> > >
> 
> This patch taken against the 2.6.24-rc4-mm1 fixes the problem 
> of probing __init functions.I have reused the code from extable.c
> and modified the kprobes.c accordingly.
> 
> Since we are checking __init functions in __register_kprobe, there is 
> no need to call kernel_noninit_text_address() in register_kretprobe.
> 
> 
> Signed-off-by: Srinivasa DS <srinivasa@in.ibm.com>
> 
> 
> ---
>  include/linux/kernel.h |    1 +
>  kernel/extable.c       |   17 ++++++++++++++++-
>  kernel/kprobes.c       |    4 ++--
>  3 files changed, 19 insertions(+), 3 deletions(-)
> 
> Index: linux-2.6.24-rc4/include/linux/kernel.h
> ===================================================================
> --- linux-2.6.24-rc4.orig/include/linux/kernel.h
> +++ linux-2.6.24-rc4/include/linux/kernel.h
> @@ -169,6 +169,7 @@ extern unsigned long long memparse(char 
>  extern int core_kernel_text(unsigned long addr);
>  extern int __kernel_text_address(unsigned long addr);
>  extern int kernel_text_address(unsigned long addr);
> +extern int kernel_noninit_text_address(unsigned long addr);
		^^^^^^^^^^^
I prefer a different name non_init_kernel_text() perhaps?

>  struct pid;
>  extern struct pid *session_of_pgrp(struct pid *pgrp);
> 
> Index: linux-2.6.24-rc4/kernel/extable.c
> ===================================================================
> --- linux-2.6.24-rc4.orig/kernel/extable.c
> +++ linux-2.6.24-rc4/kernel/extable.c
> @@ -40,11 +40,18 @@ const struct exception_table_entry *sear
>  	return e;
>  }
> 
> -int core_kernel_text(unsigned long addr)
> +static int  core_kernel_noninit_text(unsigned long addr)
	  ^^^^^^^
spurious whitespace

Ananth

Re: [RFC -mm][PATCH ] Patch to avoid probing __init functions using kprobes

[Masami Hiramatsu]

Hi Srinivasa,

Srinivasa Ds wrote:
> On Thursday 13 Dec 2007 1:53:26 pm Ananth N Mavinakayanahalli wrote:
>> On Thu, Dec 13, 2007 at 01:47:50PM +0530, Srinivasa Ds wrote:
>>> Ananth N Mavinakayanahalli wrote:
>>>> On Wed, Dec 12, 2007 at 08:21:01PM -0500, Masami Hiramatsu wrote:
>>>>> Masami Hiramatsu wrote:
>>>>>> Finally, I reproduced it by executing a command below:
>>>>>> % stap -e 'probe kernel.function("migration_init"){}'
>>>> That does seem like the right thing to do. This also needs to live in
>>>> common code.
>>>>
>>>> Srini,
>>>> Want to take a stab at it?
> 
> This patch taken against the 2.6.24-rc4-mm1 fixes the problem 
> of probing __init functions.I have reused the code from extable.c
> and modified the kprobes.c accordingly.

Thanks, this patch worked fine for me.
---
$ stap -ve 'probe kernel.function("migration_init"){}'
Pass 1: parsed user script and 38 library script(s) in 210usr/10sys/227real ms.
Pass 2: analyzed script: 1 probe(s), 0 function(s), 0 embed(s), 0 global(s) in 230usr/100sys/324real ms.
Pass 3: translated to C into "/tmp/staphufPIP/stap_aefede84fedbb0c1a1c03305e269e9af_273.c" in 0usr/0sys/0real ms.
Pass 4: compiled C into "stap_aefede84fedbb0c1a1c03305e269e9af_273.ko" in 2390usr/390sys/2915real ms.
Pass 5: starting run.
ERROR: probe kernel.function("migration_init@/home/mhiramat/ksrc/2.6-mm/kernel/sched.c:5602") registration error (rc -22)
Pass 5: run completed in 20usr/90sys/112real ms.
---

-- 
Masami Hiramatsu

Software Engineer
Hitachi Computer Products (America) Inc.
Software Solutions Division

e-mail: mhiramat@redhat.com, masami.hiramatsu.pt@hitachi.com