arch/arm/probes/kprobes/core.c

   1 /*
   2  * arch/arm/kernel/kprobes.c
   3  *
   4  * Kprobes on ARM
   5  *
   6  * Abhishek Sagar <sagar.abhishek@gmail.com>
   7  * Copyright (C) 2006, 2007 Motorola Inc.
   8  *
   9  * Nicolas Pitre <nico@marvell.com>
  10  * Copyright (C) 2007 Marvell Ltd.
  11  *
  12  * This program is free software; you can redistribute it and/or modify
  13  * it under the terms of the GNU General Public License version 2 as
  14  * published by the Free Software Foundation.
  15  *
  16  * This program is distributed in the hope that it will be useful,
  17  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  18  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  19  * General Public License for more details.
  20  */
  21
  22 #include <linux/kernel.h>
  23 #include <linux/kprobes.h>
  24 #include <linux/module.h>
  25 #include <linux/slab.h>
  26 #include <linux/stop_machine.h>
  27 #include <linux/stringify.h>
  28 #include <asm/traps.h>
  29 #include <asm/opcodes.h>
  30 #include <asm/cacheflush.h>
  31 #include <linux/percpu.h>
  32 #include <linux/bug.h>
  33 #include <asm/patch.h>
  34
  35 #include "../decode-arm.h"
  36 #include "../decode-thumb.h"
  37 #include "core.h"
  38
  39 #define MIN_STACK_SIZE(addr)                            \
  40         min((unsigned long)MAX_STACK_SIZE,              \
  41             (unsigned long)current_thread_info() + THREAD_START_SP - (addr))
  42
  43 #define flush_insns(addr, size)                         \
  44         flush_icache_range((unsigned long)(addr),       \
  45                            (unsigned long)(addr) +      \
  46                            (size))
  47
  48 /* Used as a marker in ARM_pc to note when we're in a jprobe. */
  49 #define JPROBE_MAGIC_ADDR               0xffffffff
  50
  51 DEFINE_PER_CPU(struct kprobe *, current_kprobe) = NULL;
  52 DEFINE_PER_CPU(struct kprobe_ctlblk, kprobe_ctlblk);
  53
  54
  55 int __kprobes arch_prepare_kprobe(struct kprobe *p)
  56 {
  57         kprobe_opcode_t insn;
  58         kprobe_opcode_t tmp_insn[MAX_INSN_SIZE];
  59         unsigned long addr = (unsigned long)p->addr;
  60         bool thumb;
  61         kprobe_decode_insn_t *decode_insn;
  62         const union decode_action *actions;
  63         int is;
  64         const struct decode_checker **checkers;
  65
  66         if (in_exception_text(addr))
  67                 return -EINVAL;
  68
  69 #ifdef CONFIG_THUMB2_KERNEL
  70         thumb = true;
  71         addr &= ~1; /* Bit 0 would normally be set to indicate Thumb code */
  72         insn = __mem_to_opcode_thumb16(((u16 *)addr)[0]);
  73         if (is_wide_instruction(insn)) {
  74                 u16 inst2 = __mem_to_opcode_thumb16(((u16 *)addr)[1]);
  75                 insn = __opcode_thumb32_compose(insn, inst2);
  76                 decode_insn = thumb32_probes_decode_insn;
  77                 actions = kprobes_t32_actions;
  78                 checkers = kprobes_t32_checkers;
  79         } else {
  80                 decode_insn = thumb16_probes_decode_insn;
  81                 actions = kprobes_t16_actions;
  82                 checkers = kprobes_t16_checkers;
  83         }
  84 #else /* !CONFIG_THUMB2_KERNEL */
  85         thumb = false;
  86         if (addr & 0x3)
  87                 return -EINVAL;
  88         insn = __mem_to_opcode_arm(*p->addr);
  89         decode_insn = arm_probes_decode_insn;
  90         actions = kprobes_arm_actions;
  91         checkers = kprobes_arm_checkers;
  92 #endif
  93
  94         p->opcode = insn;
  95         p->ainsn.insn = tmp_insn;
  96
  97         switch ((*decode_insn)(insn, &p->ainsn, true, actions, checkers)) {
  98         case INSN_REJECTED:     /* not supported */
  99                 return -EINVAL;
 100
 101         case INSN_GOOD:         /* instruction uses slot */
 102                 p->ainsn.insn = get_insn_slot();
 103                 if (!p->ainsn.insn)
 104                         return -ENOMEM;
 105                 for (is = 0; is < MAX_INSN_SIZE; ++is)
 106                         p->ainsn.insn[is] = tmp_insn[is];
 107                 flush_insns(p->ainsn.insn,
 108                                 sizeof(p->ainsn.insn[0]) * MAX_INSN_SIZE);
 109                 p->ainsn.insn_fn = (probes_insn_fn_t *)
 110                                         ((uintptr_t)p->ainsn.insn | thumb);
 111                 break;
 112
 113         case INSN_GOOD_NO_SLOT: /* instruction doesn't need insn slot */
 114                 p->ainsn.insn = NULL;
 115                 break;
 116         }
 117
 118         /*
 119          * Never instrument insn like 'str r0, [sp, +/-r1]'. Also, insn likes
 120          * 'str r0, [sp, #-68]' should also be prohibited.
 121          * See __und_svc.
 122          */
 123         if ((p->ainsn.stack_space < 0) ||
 124                         (p->ainsn.stack_space > MAX_STACK_SIZE))
 125                 return -EINVAL;
 126
 127         return 0;
 128 }
 129
 130 void __kprobes arch_arm_kprobe(struct kprobe *p)
 131 {
 132         unsigned int brkp;
 133         void *addr;
 134
 135         if (IS_ENABLED(CONFIG_THUMB2_KERNEL)) {
 136                 /* Remove any Thumb flag */
 137                 addr = (void *)((uintptr_t)p->addr & ~1);
 138
 139                 if (is_wide_instruction(p->opcode))
 140                         brkp = KPROBE_THUMB32_BREAKPOINT_INSTRUCTION;
 141                 else
 142                         brkp = KPROBE_THUMB16_BREAKPOINT_INSTRUCTION;
 143         } else {
 144                 kprobe_opcode_t insn = p->opcode;
 145
 146                 addr = p->addr;
 147                 brkp = KPROBE_ARM_BREAKPOINT_INSTRUCTION;
 148
 149                 if (insn >= 0xe0000000)
 150                         brkp |= 0xe0000000;  /* Unconditional instruction */
 151                 else
 152                         brkp |= insn & 0xf0000000;  /* Copy condition from insn */
 153         }
 154
 155         patch_text(addr, brkp);
 156 }
 157
 158 /*
 159  * The actual disarming is done here on each CPU and synchronized using
 160  * stop_machine. This synchronization is necessary on SMP to avoid removing
 161  * a probe between the moment the 'Undefined Instruction' exception is raised
 162  * and the moment the exception handler reads the faulting instruction from
 163  * memory. It is also needed to atomically set the two half-words of a 32-bit
 164  * Thumb breakpoint.
 165  */
 166 struct patch {
 167         void *addr;
 168         unsigned int insn;
 169 };
 170
 171 static int __kprobes_remove_breakpoint(void *data)
 172 {
 173         struct patch *p = data;
 174         __patch_text(p->addr, p->insn);
 175         return 0;
 176 }
 177
 178 void __kprobes kprobes_remove_breakpoint(void *addr, unsigned int insn)
 179 {
 180         struct patch p = {
 181                 .addr = addr,
 182                 .insn = insn,
 183         };
 184         stop_machine(__kprobes_remove_breakpoint, &p, cpu_online_mask);
 185 }
 186
 187 void __kprobes arch_disarm_kprobe(struct kprobe *p)
 188 {
 189         kprobes_remove_breakpoint((void *)((uintptr_t)p->addr & ~1),
 190                         p->opcode);
 191 }
 192
 193 void __kprobes arch_remove_kprobe(struct kprobe *p)
 194 {
 195         if (p->ainsn.insn) {
 196                 free_insn_slot(p->ainsn.insn, 0);
 197                 p->ainsn.insn = NULL;
 198         }
 199 }
 200
 201 static void __kprobes save_previous_kprobe(struct kprobe_ctlblk *kcb)
 202 {
 203         kcb->prev_kprobe.kp = kprobe_running();
 204         kcb->prev_kprobe.status = kcb->kprobe_status;
 205 }
 206
 207 static void __kprobes restore_previous_kprobe(struct kprobe_ctlblk *kcb)
 208 {
 209         __this_cpu_write(current_kprobe, kcb->prev_kprobe.kp);
 210         kcb->kprobe_status = kcb->prev_kprobe.status;
 211 }
 212
 213 static void __kprobes set_current_kprobe(struct kprobe *p)
 214 {
 215         __this_cpu_write(current_kprobe, p);
 216 }
 217
 218 static void __kprobes
 219 singlestep_skip(struct kprobe *p, struct pt_regs *regs)
 220 {
 221 #ifdef CONFIG_THUMB2_KERNEL
 222         regs->ARM_cpsr = it_advance(regs->ARM_cpsr);
 223         if (is_wide_instruction(p->opcode))
 224                 regs->ARM_pc += 4;
 225         else
 226                 regs->ARM_pc += 2;
 227 #else
 228         regs->ARM_pc += 4;
 229 #endif
 230 }
 231
 232 static inline void __kprobes
 233 singlestep(struct kprobe *p, struct pt_regs *regs, struct kprobe_ctlblk *kcb)
 234 {
 235         p->ainsn.insn_singlestep(p->opcode, &p->ainsn, regs);
 236 }
 237
 238 /*
 239  * Called with IRQs disabled. IRQs must remain disabled from that point
 240  * all the way until processing this kprobe is complete.  The current
 241  * kprobes implementation cannot process more than one nested level of
 242  * kprobe, and that level is reserved for user kprobe handlers, so we can't
 243  * risk encountering a new kprobe in an interrupt handler.
 244  */
 245 void __kprobes kprobe_handler(struct pt_regs *regs)
 246 {
 247         struct kprobe *p, *cur;
 248         struct kprobe_ctlblk *kcb;
 249
 250         kcb = get_kprobe_ctlblk();
 251         cur = kprobe_running();
 252
 253 #ifdef CONFIG_THUMB2_KERNEL
 254         /*
 255          * First look for a probe which was registered using an address with
 256          * bit 0 set, this is the usual situation for pointers to Thumb code.
 257          * If not found, fallback to looking for one with bit 0 clear.
 258          */
 259         p = get_kprobe((kprobe_opcode_t *)(regs->ARM_pc | 1));
 260         if (!p)
 261                 p = get_kprobe((kprobe_opcode_t *)regs->ARM_pc);
 262
 263 #else /* ! CONFIG_THUMB2_KERNEL */
 264         p = get_kprobe((kprobe_opcode_t *)regs->ARM_pc);
 265 #endif
 266
 267         if (p) {
 268                 if (cur) {
 269                         /* Kprobe is pending, so we're recursing. */
 270                         switch (kcb->kprobe_status) {
 271                         case KPROBE_HIT_ACTIVE:
 272                         case KPROBE_HIT_SSDONE:
 273                         case KPROBE_HIT_SS:
 274                                 /* A pre- or post-handler probe got us here. */
 275                                 kprobes_inc_nmissed_count(p);
 276                                 save_previous_kprobe(kcb);
 277                                 set_current_kprobe(p);
 278                                 kcb->kprobe_status = KPROBE_REENTER;
 279                                 singlestep(p, regs, kcb);
 280                                 restore_previous_kprobe(kcb);
 281                                 break;
 282                         case KPROBE_REENTER:
 283                                 /* A nested probe was hit in FIQ, it is a BUG */
 284                                 pr_warn("Unrecoverable kprobe detected at %p.\n",
 285                                         p->addr);
 286                                 /* fall through */
 287                         default:
 288                                 /* impossible cases */
 289                                 BUG();
 290                         }
 291                 } else if (p->ainsn.insn_check_cc(regs->ARM_cpsr)) {
 292                         /* Probe hit and conditional execution check ok. */
 293                         set_current_kprobe(p);
 294                         kcb->kprobe_status = KPROBE_HIT_ACTIVE;
 295
 296                         /*
 297                          * If we have no pre-handler or it returned 0, we
 298                          * continue with normal processing.  If we have a
 299                          * pre-handler and it returned non-zero, it prepped
 300                          * for calling the break_handler below on re-entry,
 301                          * so get out doing nothing more here.
 302                          */
 303                         if (!p->pre_handler || !p->pre_handler(p, regs)) {
 304                                 kcb->kprobe_status = KPROBE_HIT_SS;
 305                                 singlestep(p, regs, kcb);
 306                                 if (p->post_handler) {
 307                                         kcb->kprobe_status = KPROBE_HIT_SSDONE;
 308                                         p->post_handler(p, regs, 0);
 309                                 }
 310                                 reset_current_kprobe();
 311                         }
 312                 } else {
 313                         /*
 314                          * Probe hit but conditional execution check failed,
 315                          * so just skip the instruction and continue as if
 316                          * nothing had happened.
 317                          */
 318                         singlestep_skip(p, regs);
 319                 }
 320         } else if (cur) {
 321                 /* We probably hit a jprobe.  Call its break handler. */
 322                 if (cur->break_handler && cur->break_handler(cur, regs)) {
 323                         kcb->kprobe_status = KPROBE_HIT_SS;
 324                         singlestep(cur, regs, kcb);
 325                         if (cur->post_handler) {
 326                                 kcb->kprobe_status = KPROBE_HIT_SSDONE;
 327                                 cur->post_handler(cur, regs, 0);
 328                         }
 329                 }
 330                 reset_current_kprobe();
 331         } else {
 332                 /*
 333                  * The probe was removed and a race is in progress.
 334                  * There is nothing we can do about it.  Let's restart
 335                  * the instruction.  By the time we can restart, the
 336                  * real instruction will be there.
 337                  */
 338         }
 339 }
 340
 341 static int __kprobes kprobe_trap_handler(struct pt_regs *regs, unsigned int instr)
 342 {
 343         unsigned long flags;
 344         local_irq_save(flags);
 345         kprobe_handler(regs);
 346         local_irq_restore(flags);
 347         return 0;
 348 }
 349
 350 int __kprobes kprobe_fault_handler(struct pt_regs *regs, unsigned int fsr)
 351 {
 352         struct kprobe *cur = kprobe_running();
 353         struct kprobe_ctlblk *kcb = get_kprobe_ctlblk();
 354
 355         switch (kcb->kprobe_status) {
 356         case KPROBE_HIT_SS:
 357         case KPROBE_REENTER:
 358                 /*
 359                  * We are here because the instruction being single
 360                  * stepped caused a page fault. We reset the current
 361                  * kprobe and the PC to point back to the probe address
 362                  * and allow the page fault handler to continue as a
 363                  * normal page fault.
 364                  */
 365                 regs->ARM_pc = (long)cur->addr;
 366                 if (kcb->kprobe_status == KPROBE_REENTER) {
 367                         restore_previous_kprobe(kcb);
 368                 } else {
 369                         reset_current_kprobe();
 370                 }
 371                 break;
 372
 373         case KPROBE_HIT_ACTIVE:
 374         case KPROBE_HIT_SSDONE:
 375                 /*
 376                  * We increment the nmissed count for accounting,
 377                  * we can also use npre/npostfault count for accounting
 378                  * these specific fault cases.
 379                  */
 380                 kprobes_inc_nmissed_count(cur);
 381
 382                 /*
 383                  * We come here because instructions in the pre/post
 384                  * handler caused the page_fault, this could happen
 385                  * if handler tries to access user space by
 386                  * copy_from_user(), get_user() etc. Let the
 387                  * user-specified handler try to fix it.
 388                  */
 389                 if (cur->fault_handler && cur->fault_handler(cur, regs, fsr))
 390                         return 1;
 391                 break;
 392
 393         default:
 394                 break;
 395         }
 396
 397         return 0;
 398 }
 399
 400 int __kprobes kprobe_exceptions_notify(struct notifier_block *self,
 401                                        unsigned long val, void *data)
 402 {
 403         /*
 404          * notify_die() is currently never called on ARM,
 405          * so this callback is currently empty.
 406          */
 407         return NOTIFY_DONE;
 408 }
 409
 410 /*
 411  * When a retprobed function returns, trampoline_handler() is called,
 412  * calling the kretprobe's handler. We construct a struct pt_regs to
 413  * give a view of registers r0-r11 to the user return-handler.  This is
 414  * not a complete pt_regs structure, but that should be plenty sufficient
 415  * for kretprobe handlers which should normally be interested in r0 only
 416  * anyway.
 417  */
 418 void __naked __kprobes kretprobe_trampoline(void)
 419 {
 420         __asm__ __volatile__ (
 421                 "stmdb  sp!, {r0 - r11}         \n\t"
 422                 "mov    r0, sp                  \n\t"
 423                 "bl     trampoline_handler      \n\t"
 424                 "mov    lr, r0                  \n\t"
 425                 "ldmia  sp!, {r0 - r11}         \n\t"
 426 #ifdef CONFIG_THUMB2_KERNEL
 427                 "bx     lr                      \n\t"
 428 #else
 429                 "mov    pc, lr                  \n\t"
 430 #endif
 431                 : : : "memory");
 432 }
 433
 434 /* Called from kretprobe_trampoline */
 435 static __used __kprobes void *trampoline_handler(struct pt_regs *regs)
 436 {
 437         struct kretprobe_instance *ri = NULL;
 438         struct hlist_head *head, empty_rp;
 439         struct hlist_node *tmp;
 440         unsigned long flags, orig_ret_address = 0;
 441         unsigned long trampoline_address = (unsigned long)&kretprobe_trampoline;
 442         kprobe_opcode_t *correct_ret_addr = NULL;
 443
 444         INIT_HLIST_HEAD(&empty_rp);
 445         kretprobe_hash_lock(current, &head, &flags);
 446
 447         /*
 448          * It is possible to have multiple instances associated with a given
 449          * task either because multiple functions in the call path have
 450          * a return probe installed on them, and/or more than one return
 451          * probe was registered for a target function.
 452          *
 453          * We can handle this because:
 454          *     - instances are always inserted at the head of the list
 455          *     - when multiple return probes are registered for the same
 456          *       function, the first instance's ret_addr will point to the
 457          *       real return address, and all the rest will point to
 458          *       kretprobe_trampoline
 459          */
 460         hlist_for_each_entry_safe(ri, tmp, head, hlist) {
 461                 if (ri->task != current)
 462                         /* another task is sharing our hash bucket */
 463                         continue;
 464
 465                 orig_ret_address = (unsigned long)ri->ret_addr;
 466
 467                 if (orig_ret_address != trampoline_address)
 468                         /*
 469                          * This is the real return address. Any other
 470                          * instances associated with this task are for
 471                          * other calls deeper on the call stack
 472                          */
 473                         break;
 474         }
 475
 476         kretprobe_assert(ri, orig_ret_address, trampoline_address);
 477
 478         correct_ret_addr = ri->ret_addr;
 479         hlist_for_each_entry_safe(ri, tmp, head, hlist) {
 480                 if (ri->task != current)
 481                         /* another task is sharing our hash bucket */
 482                         continue;
 483
 484                 orig_ret_address = (unsigned long)ri->ret_addr;
 485                 if (ri->rp && ri->rp->handler) {
 486                         __this_cpu_write(current_kprobe, &ri->rp->kp);
 487                         get_kprobe_ctlblk()->kprobe_status = KPROBE_HIT_ACTIVE;
 488                         ri->ret_addr = correct_ret_addr;
 489                         ri->rp->handler(ri, regs);
 490                         __this_cpu_write(current_kprobe, NULL);
 491                 }
 492
 493                 recycle_rp_inst(ri, &empty_rp);
 494
 495                 if (orig_ret_address != trampoline_address)
 496                         /*
 497                          * This is the real return address. Any other
 498                          * instances associated with this task are for
 499                          * other calls deeper on the call stack
 500                          */
 501                         break;
 502         }
 503
 504         kretprobe_hash_unlock(current, &flags);
 505
 506         hlist_for_each_entry_safe(ri, tmp, &empty_rp, hlist) {
 507                 hlist_del(&ri->hlist);
 508                 kfree(ri);
 509         }
 510
 511         return (void *)orig_ret_address;
 512 }
 513
 514 void __kprobes arch_prepare_kretprobe(struct kretprobe_instance *ri,
 515                                       struct pt_regs *regs)
 516 {
 517         ri->ret_addr = (kprobe_opcode_t *)regs->ARM_lr;
 518
 519         /* Replace the return addr with trampoline addr. */
 520         regs->ARM_lr = (unsigned long)&kretprobe_trampoline;
 521 }
 522
 523 int __kprobes setjmp_pre_handler(struct kprobe *p, struct pt_regs *regs)
 524 {
 525         struct jprobe *jp = container_of(p, struct jprobe, kp);
 526         struct kprobe_ctlblk *kcb = get_kprobe_ctlblk();
 527         long sp_addr = regs->ARM_sp;
 528         long cpsr;
 529
 530         kcb->jprobe_saved_regs = *regs;
 531         memcpy(kcb->jprobes_stack, (void *)sp_addr, MIN_STACK_SIZE(sp_addr));
 532         regs->ARM_pc = (long)jp->entry;
 533
 534         cpsr = regs->ARM_cpsr | PSR_I_BIT;
 535 #ifdef CONFIG_THUMB2_KERNEL
 536         /* Set correct Thumb state in cpsr */
 537         if (regs->ARM_pc & 1)
 538                 cpsr |= PSR_T_BIT;
 539         else
 540                 cpsr &= ~PSR_T_BIT;
 541 #endif
 542         regs->ARM_cpsr = cpsr;
 543
 544         preempt_disable();
 545         return 1;
 546 }
 547
 548 void __kprobes jprobe_return(void)
 549 {
 550         struct kprobe_ctlblk *kcb = get_kprobe_ctlblk();
 551
 552         __asm__ __volatile__ (
 553                 /*
 554                  * Setup an empty pt_regs. Fill SP and PC fields as
 555                  * they're needed by longjmp_break_handler.
 556                  *
 557                  * We allocate some slack between the original SP and start of
 558                  * our fabricated regs. To be precise we want to have worst case
 559                  * covered which is STMFD with all 16 regs so we allocate 2 *
 560                  * sizeof(struct_pt_regs)).
 561                  *
 562                  * This is to prevent any simulated instruction from writing
 563                  * over the regs when they are accessing the stack.
 564                  */
 565 #ifdef CONFIG_THUMB2_KERNEL
 566                 "sub    r0, %0, %1              \n\t"
 567                 "mov    sp, r0                  \n\t"
 568 #else
 569                 "sub    sp, %0, %1              \n\t"
 570 #endif
 571                 "ldr    r0, ="__stringify(JPROBE_MAGIC_ADDR)"\n\t"
 572                 "str    %0, [sp, %2]            \n\t"
 573                 "str    r0, [sp, %3]            \n\t"
 574                 "mov    r0, sp                  \n\t"
 575                 "bl     kprobe_handler          \n\t"
 576
 577                 /*
 578                  * Return to the context saved by setjmp_pre_handler
 579                  * and restored by longjmp_break_handler.
 580                  */
 581 #ifdef CONFIG_THUMB2_KERNEL
 582                 "ldr    lr, [sp, %2]            \n\t" /* lr = saved sp */
 583                 "ldrd   r0, r1, [sp, %5]        \n\t" /* r0,r1 = saved lr,pc */
 584                 "ldr    r2, [sp, %4]            \n\t" /* r2 = saved psr */
 585                 "stmdb  lr!, {r0, r1, r2}       \n\t" /* push saved lr and */
 586                                                       /* rfe context */
 587                 "ldmia  sp, {r0 - r12}          \n\t"
 588                 "mov    sp, lr                  \n\t"
 589                 "ldr    lr, [sp], #4            \n\t"
 590                 "rfeia  sp!                     \n\t"
 591 #else
 592                 "ldr    r0, [sp, %4]            \n\t"
 593                 "msr    cpsr_cxsf, r0           \n\t"
 594                 "ldmia  sp, {r0 - pc}           \n\t"
 595 #endif
 596                 :
 597                 : "r" (kcb->jprobe_saved_regs.ARM_sp),
 598                   "I" (sizeof(struct pt_regs) * 2),
 599                   "J" (offsetof(struct pt_regs, ARM_sp)),
 600                   "J" (offsetof(struct pt_regs, ARM_pc)),
 601                   "J" (offsetof(struct pt_regs, ARM_cpsr)),
 602                   "J" (offsetof(struct pt_regs, ARM_lr))
 603                 : "memory", "cc");
 604 }
 605
 606 int __kprobes longjmp_break_handler(struct kprobe *p, struct pt_regs *regs)
 607 {
 608         struct kprobe_ctlblk *kcb = get_kprobe_ctlblk();
 609         long stack_addr = kcb->jprobe_saved_regs.ARM_sp;
 610         long orig_sp = regs->ARM_sp;
 611         struct jprobe *jp = container_of(p, struct jprobe, kp);
 612
 613         if (regs->ARM_pc == JPROBE_MAGIC_ADDR) {
 614                 if (orig_sp != stack_addr) {
 615                         struct pt_regs *saved_regs =
 616                                 (struct pt_regs *)kcb->jprobe_saved_regs.ARM_sp;
 617                         printk("current sp %lx does not match saved sp %lx\n",
 618                                orig_sp, stack_addr);
 619                         printk("Saved registers for jprobe %p\n", jp);
 620                         show_regs(saved_regs);
 621                         printk("Current registers\n");
 622                         show_regs(regs);
 623                         BUG();
 624                 }
 625                 *regs = kcb->jprobe_saved_regs;
 626                 memcpy((void *)stack_addr, kcb->jprobes_stack,
 627                        MIN_STACK_SIZE(stack_addr));
 628                 preempt_enable_no_resched();
 629                 return 1;
 630         }
 631         return 0;
 632 }
 633
 634 int __kprobes arch_trampoline_kprobe(struct kprobe *p)
 635 {
 636         return 0;
 637 }
 638
 639 #ifdef CONFIG_THUMB2_KERNEL
 640
 641 static struct undef_hook kprobes_thumb16_break_hook = {
 642         .instr_mask     = 0xffff,
 643         .instr_val      = KPROBE_THUMB16_BREAKPOINT_INSTRUCTION,
 644         .cpsr_mask      = MODE_MASK,
 645         .cpsr_val       = SVC_MODE,
 646         .fn             = kprobe_trap_handler,
 647 };
 648
 649 static struct undef_hook kprobes_thumb32_break_hook = {
 650         .instr_mask     = 0xffffffff,
 651         .instr_val      = KPROBE_THUMB32_BREAKPOINT_INSTRUCTION,
 652         .cpsr_mask      = MODE_MASK,
 653         .cpsr_val       = SVC_MODE,
 654         .fn             = kprobe_trap_handler,
 655 };
 656
 657 #else  /* !CONFIG_THUMB2_KERNEL */
 658
 659 static struct undef_hook kprobes_arm_break_hook = {
 660         .instr_mask     = 0x0fffffff,
 661         .instr_val      = KPROBE_ARM_BREAKPOINT_INSTRUCTION,
 662         .cpsr_mask      = MODE_MASK,
 663         .cpsr_val       = SVC_MODE,
 664         .fn             = kprobe_trap_handler,
 665 };
 666
 667 #endif /* !CONFIG_THUMB2_KERNEL */
 668
 669 int __init arch_init_kprobes()
 670 {
 671         arm_probes_decode_init();
 672 #ifdef CONFIG_THUMB2_KERNEL
 673         register_undef_hook(&kprobes_thumb16_break_hook);
 674         register_undef_hook(&kprobes_thumb32_break_hook);
 675 #else
 676         register_undef_hook(&kprobes_arm_break_hook);
 677 #endif
 678         return 0;
 679 }