1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
|
/*
* Code for replacing ftrace calls with jumps.
*
* Copyright (C) 2007-2008 Steven Rostedt <srostedt@redhat.com>
* Copyright (C) 2009 DSLab, Lanzhou University, China
* Author: Wu Zhangjin <wuzhangjin@gmail.com>
*
* Thanks goes to Steven Rostedt for writing the original x86 version.
*/
#include <linux/uaccess.h>
#include <linux/init.h>
#include <linux/ftrace.h>
#include <asm/cacheflush.h>
#include <asm/asm.h>
#include <asm/asm-offsets.h>
#ifdef CONFIG_DYNAMIC_FTRACE
#define JAL 0x0c000000 /* jump & link: ip --> ra, jump to target */
#define ADDR_MASK 0x03ffffff /* op_code|addr : 31...26|25 ....0 */
#define jump_insn_encode(op_code, addr) \
((unsigned int)((op_code) | (((addr) >> 2) & ADDR_MASK)))
#define INSN_B_1F_4 0x10000004 /* b 1f; offset = 4 */
#define INSN_B_1F_5 0x10000005 /* b 1f; offset = 5 */
#define INSN_NOP 0x00000000 /* nop */
#define INSN_JAL(addr) jump_insn_encode(JAL, addr)
static int ftrace_modify_code(unsigned long ip, unsigned int new_code)
{
int faulted;
/* *(unsigned int *)ip = new_code; */
safe_store_code(new_code, ip, faulted);
if (unlikely(faulted))
return -EFAULT;
flush_icache_range(ip, ip + 8);
return 0;
}
static int lui_v1;
static int jal_mcount;
int ftrace_make_nop(struct module *mod,
struct dyn_ftrace *rec, unsigned long addr)
{
unsigned int new;
int faulted;
unsigned long ip = rec->ip;
/* We have compiled module with -mlong-calls, but compiled the kernel
* without it, we need to cope with them respectively. */
if (ip & 0x40000000) {
/* record it for ftrace_make_call */
if (lui_v1 == 0) {
/* lui_v1 = *(unsigned int *)ip; */
safe_load_code(lui_v1, ip, faulted);
if (unlikely(faulted))
return -EFAULT;
}
#if defined(KBUILD_MCOUNT_RA_ADDRESS) && defined(CONFIG_32BIT)
/* lui v1, hi_16bit_of_mcount --> b 1f (0x10000005)
* addiu v1, v1, low_16bit_of_mcount
* move at, ra
* move $12, ra_address
* jalr v1
* sub sp, sp, 8
* 1: offset = 5 instructions
*/
new = INSN_B_1F_5;
#else
/* lui v1, hi_16bit_of_mcount --> b 1f (0x10000004)
* addiu v1, v1, low_16bit_of_mcount
* move at, ra
* jalr v1
* nop | move $12, ra_address | sub sp, sp, 8
* 1: offset = 4 instructions
*/
new = INSN_B_1F_4;
#endif
} else {
/* record/calculate it for ftrace_make_call */
if (jal_mcount == 0) {
/* We can record it directly like this:
* jal_mcount = *(unsigned int *)ip;
* Herein, jump over the first two nop instructions */
jal_mcount = INSN_JAL(MCOUNT_ADDR + 8);
}
/* move at, ra
* jalr v1 --> nop
*/
new = INSN_NOP;
}
return ftrace_modify_code(ip, new);
}
static int modified; /* initialized as 0 by default */
int ftrace_make_call(struct dyn_ftrace *rec, unsigned long addr)
{
unsigned int new;
unsigned long ip = rec->ip;
/* We just need to remove the "b ftrace_stub" at the fist time! */
if (modified == 0) {
modified = 1;
ftrace_modify_code(addr, INSN_NOP);
}
/* ip, module: 0xc0000000, kernel: 0x80000000 */
new = (ip & 0x40000000) ? lui_v1 : jal_mcount;
return ftrace_modify_code(ip, new);
}
#define FTRACE_CALL_IP ((unsigned long)(&ftrace_call))
int ftrace_update_ftrace_func(ftrace_func_t func)
{
unsigned int new;
new = INSN_JAL((unsigned long)func);
return ftrace_modify_code(FTRACE_CALL_IP, new);
}
int __init ftrace_dyn_arch_init(void *data)
{
/* The return code is retured via data */
*(unsigned long *)data = 0;
return 0;
}
#endif /* CONFIG_DYNAMIC_FTRACE */
#ifdef CONFIG_FUNCTION_GRAPH_TRACER
#ifdef CONFIG_DYNAMIC_FTRACE
extern void ftrace_graph_call(void);
#define JMP 0x08000000 /* jump to target directly */
#define CALL_FTRACE_GRAPH_CALLER \
jump_insn_encode(JMP, (unsigned long)(&ftrace_graph_caller))
#define FTRACE_GRAPH_CALL_IP ((unsigned long)(&ftrace_graph_call))
int ftrace_enable_ftrace_graph_caller(void)
{
return ftrace_modify_code(FTRACE_GRAPH_CALL_IP,
CALL_FTRACE_GRAPH_CALLER);
}
int ftrace_disable_ftrace_graph_caller(void)
{
return ftrace_modify_code(FTRACE_GRAPH_CALL_IP, INSN_NOP);
}
#endif /* !CONFIG_DYNAMIC_FTRACE */
#ifndef KBUILD_MCOUNT_RA_ADDRESS
#define S_RA_SP (0xafbf << 16) /* s{d,w} ra, offset(sp) */
#define S_R_SP (0xafb0 << 16) /* s{d,w} R, offset(sp) */
#define OFFSET_MASK 0xffff /* stack offset range: 0 ~ PT_SIZE */
unsigned long ftrace_get_parent_addr(unsigned long self_addr,
unsigned long parent,
unsigned long parent_addr,
unsigned long fp)
{
unsigned long sp, ip, ra;
unsigned int code;
int faulted;
/* in module or kernel? */
if (self_addr & 0x40000000) {
/* module: move to the instruction "lui v1, HI_16BIT_OF_MCOUNT" */
ip = self_addr - 20;
} else {
/* kernel: move to the instruction "move ra, at" */
ip = self_addr - 12;
}
/* search the text until finding the non-store instruction or "s{d,w}
* ra, offset(sp)" instruction */
do {
ip -= 4;
/* get the code at "ip": code = *(unsigned int *)ip; */
safe_load_code(code, ip, faulted);
if (unlikely(faulted))
return 0;
/* If we hit the non-store instruction before finding where the
* ra is stored, then this is a leaf function and it does not
* store the ra on the stack. */
if ((code & S_R_SP) != S_R_SP)
return parent_addr;
} while (((code & S_RA_SP) != S_RA_SP));
sp = fp + (code & OFFSET_MASK);
/* ra = *(unsigned long *)sp; */
safe_load_stack(ra, sp, faulted);
if (unlikely(faulted))
return 0;
if (ra == parent)
return sp;
return 0;
}
#endif
/*
* Hook the return address and push it in the stack of return addrs
* in current thread info.
*/
void prepare_ftrace_return(unsigned long *parent, unsigned long self_addr,
unsigned long fp)
{
unsigned long old;
struct ftrace_graph_ent trace;
unsigned long return_hooker = (unsigned long)
&return_to_handler;
int faulted;
if (unlikely(atomic_read(¤t->tracing_graph_pause)))
return;
/* "parent" is the stack address saved the return address of the caller
* of _mcount.
*
* if the gcc < 4.5, a leaf function does not save the return address
* in the stack address, so, we "emulate" one in _mcount's stack space,
* and hijack it directly, but for a non-leaf function, it save the
* return address to the its own stack space, we can not hijack it
* directly, but need to find the real stack address,
* ftrace_get_parent_addr() does it!
*
* if gcc>= 4.5, with the new -mmcount-ra-address option, for a
* non-leaf function, the location of the return address will be saved
* to $12 for us, and for a leaf function, only put a zero into $12. we
* do it in ftrace_graph_caller of mcount.S.
*/
/* old = *parent; */
safe_load_stack(old, parent, faulted);
if (unlikely(faulted))
goto out;
#ifndef KBUILD_MCOUNT_RA_ADDRESS
parent = (unsigned long *)ftrace_get_parent_addr(self_addr, old,
(unsigned long)parent,
fp);
/* If fails when getting the stack address of the non-leaf function's
* ra, stop function graph tracer and return */
if (parent == 0)
goto out;
#endif
/* *parent = return_hooker; */
safe_store_stack(return_hooker, parent, faulted);
if (unlikely(faulted))
goto out;
if (ftrace_push_return_trace(old, self_addr, &trace.depth, fp) ==
-EBUSY) {
*parent = old;
return;
}
trace.func = self_addr;
/* Only trace if the calling function expects to */
if (!ftrace_graph_entry(&trace)) {
current->curr_ret_stack--;
*parent = old;
}
return;
out:
ftrace_graph_stop();
WARN_ON(1);
}
#endif /* CONFIG_FUNCTION_GRAPH_TRACER */
|