Re: exercising current aarch64 kprobe support with systemtap

[David Long <dave dot long at linaro dot org>]

On 06/10/2016 09:42 AM, Pratyush Anand wrote:
> On 10/06/2016:01:49:10 AM, David Long wrote:
> > Attached are incremental diffs I hope will fix the latest systemtap
> > failures, without abandoning atomic sequence checking.  I'm trying to avoid
> > the hex constants but I don't think the insn.c functions help in this case.
>
> It will save us from current problem by checking "stp x29,x30,[sp,...]"
> instruction and returning false if matches. However, we will have to find some
> way to recognize .word instructions.
>
> * An assembly function may not start with "stp x29,x30,[sp,...]", e.g.
>   __dma_map_area(), _cpu_resume etc. However, it could be least likely that a
>   .word instruction exists before start of assembly function and that too
>   contains a word value which could be misleading.
>
> * But major issue is, what if someone instruments a kprobe at an address which
>   contains  .word values. Instruction will never hit, so probe function will not
>   be called, but when real code reads that .word value, it reads a wrong value.

I had considered the assembler routine case but my take on it is that 
all of this is just a best effort heuristic attempt to prevent someone 
from kprobe'ing a kernel to death.  I don't hold out any hope for making 
this bullet-proof.  The mode of failure for the atomic sequence is the 
safer choice (rejecting probe registration) so I'm not that worried 
about the rare case of this happening.  Probing inline data doesn't seem 
like something we can protect from, although we now do blacklist some 
more data sections.

> Can GCC provide some compiler option where .word values are located into a
> specific area?

You can't just go moving the effect of .word directives into a new 
location/section.  As likely as not that data (which could be an actual 
instruction) needs to be exactly where they were put in the source.

> ~Pratyush
>
> > -dl
>
> > diff --git a/arch/arm64/kernel/kprobes-arm64.c b/arch/arm64/kernel/kprobes-arm64.c
> > index 28b9c5b..36b4ea5 100644
> > --- a/arch/arm64/kernel/kprobes-arm64.c
> > +++ b/arch/arm64/kernel/kprobes-arm64.c
> > @@ -127,7 +127,9 @@ is_probed_address_atomic(kprobe_opcode_t *scan_start, kprobe_opcode_t *scan_end)
> >   		 * atomic region starts from exclusive load and ends with
> >   		 * exclusive store.
> >   		 */
> > -		if (aarch64_insn_is_store_ex(le32_to_cpu(*scan_start)))
> > +		if ((le32_to_cpu(*scan_start) & 0xffc07fff) == 0xa9807bfd)
> > +			return false;
> > +		else if (aarch64_insn_is_store_ex(le32_to_cpu(*scan_start)))
> >   			return false;
> >   		else if (aarch64_insn_is_load_ex(le32_to_cpu(*scan_start)))
> >   			return true;