/*
* Copy an instruction and adjust the displacement if the instruction
* uses the %rip-relative addressing mode.
* If it does, Return the address of the 32-bit displacement word.
* If not, return null.
* Only applicable to 64-bit x86.
*/
int __copy_instruction(u8 *dest, u8 *src)
{
struct insn insn;
kprobe_opcode_t buf[MAX_INSN_SIZE];
int length;
unsigned long recovered_insn =
recover_probed_instruction(buf, (unsigned long)src);
if (!recovered_insn)
return 0;
kernel_insn_init(&insn, (void *)recovered_insn, MAX_INSN_SIZE);
insn_get_length(&insn);
length = insn.length;
/* Another subsystem puts a breakpoint, failed to recover */
if (insn.opcode.bytes[0] == BREAKPOINT_INSTRUCTION)
return 0;
pax_open_kernel();
memcpy(dest, insn.kaddr, length);
pax_close_kernel();
#ifdef CONFIG_X86_64
if (insn_rip_relative(&insn)) {
s64 newdisp;
u8 *disp;
kernel_insn_init(&insn, dest, length);
insn_get_displacement(&insn);
/*
* The copied instruction uses the %rip-relative addressing
* mode. Adjust the displacement for the difference between
* the original location of this instruction and the location
* of the copy that will actually be run. The tricky bit here
* is making sure that the sign extension happens correctly in
* this calculation, since we need a signed 32-bit result to
* be sign-extended to 64 bits when it's added to the %rip
* value and yield the same 64-bit result that the sign-
* extension of the original signed 32-bit displacement would
* have given.
*/
newdisp = (u8 *) src + (s64) insn.displacement.value - (u8 *) dest;
if ((s64) (s32) newdisp != newdisp) {
pr_err("Kprobes error: new displacement does not fit into s32 (%llx)\n", newdisp);
pr_err("\tSrc: %p, Dest: %p, old disp: %x\n", src, dest, insn.displacement.value);
return 0;
}
disp = (u8 *) dest + insn_offset_displacement(&insn);
pax_open_kernel();
*(s32 *) disp = (s32) newdisp;
pax_close_kernel();
}
#endif
return length;
}
/*
* Adjust the displacement if the instruction uses the %rip-relative
* addressing mode.
* If it does, Return the address of the 32-bit displacement word.
* If not, return null.
* Only applicable to 64-bit x86.
*/
static void __kprobes fix_riprel(struct kprobe *p)
{
#ifdef CONFIG_X86_64
struct insn insn;
kernel_insn_init(&insn, p->ainsn.insn);
if (insn_rip_relative(&insn)) {
s64 newdisp;
u8 *disp;
insn_get_displacement(&insn);
/*
* The copied instruction uses the %rip-relative addressing
* mode. Adjust the displacement for the difference between
* the original location of this instruction and the location
* of the copy that will actually be run. The tricky bit here
* is making sure that the sign extension happens correctly in
* this calculation, since we need a signed 32-bit result to
* be sign-extended to 64 bits when it's added to the %rip
* value and yield the same 64-bit result that the sign-
* extension of the original signed 32-bit displacement would
* have given.
*/
newdisp = (u8 *) p->addr + (s64) insn.displacement.value -
(u8 *) p->ainsn.insn;
BUG_ON((s64) (s32) newdisp != newdisp); /* Sanity check. */
disp = (u8 *) p->ainsn.insn + insn_offset_displacement(&insn);
*(s32 *) disp = (s32) newdisp;
}
#endif
}
/* Check if paddr is at an instruction boundary */
static int __kprobes can_probe(unsigned long paddr)
{
unsigned long addr, __addr, offset = 0;
struct insn insn;
kprobe_opcode_t buf[MAX_INSN_SIZE];
if (!kallsyms_lookup_size_offset(paddr, NULL, &offset))
return 0;
/* Decode instructions */
addr = paddr - offset;
while (addr < paddr) {
/*
* Check if the instruction has been modified by another
* kprobe, in which case we replace the breakpoint by the
* original instruction in our buffer.
* Also, jump optimization will change the breakpoint to
* relative-jump. Since the relative-jump itself is
* normally used, we just go through if there is no kprobe.
*/
__addr = recover_probed_instruction(buf, addr);
kernel_insn_init(&insn, (void *)__addr);
insn_get_length(&insn);
/*
* Another debugging subsystem might insert this breakpoint.
* In that case, we can't recover it.
*/
if (insn.opcode.bytes[0] == BREAKPOINT_INSTRUCTION)
return 0;
addr += insn.length;
}
return (addr == paddr);
}
/*
* Copy an instruction and adjust the displacement if the instruction
* uses the %rip-relative addressing mode.
* If it does, Return the address of the 32-bit displacement word.
* If not, return null.
* Only applicable to 64-bit x86.
*/
static int __kprobes __copy_instruction(u8 *dest, u8 *src, int recover)
{
struct insn insn;
int ret;
kprobe_opcode_t buf[MAX_INSN_SIZE];
kernel_insn_init(&insn, src);
if (recover) {
insn_get_opcode(&insn);
if (insn.opcode.bytes[0] == BREAKPOINT_INSTRUCTION) {
ret = recover_probed_instruction(buf,
(unsigned long)src);
if (ret)
return 0;
kernel_insn_init(&insn, buf);
}
}
insn_get_length(&insn);
memcpy(dest, insn.kaddr, insn.length);
#ifdef CONFIG_X86_64
if (insn_rip_relative(&insn)) {
s64 newdisp;
u8 *disp;
kernel_insn_init(&insn, dest);
insn_get_displacement(&insn);
/*
* The copied instruction uses the %rip-relative addressing
* mode. Adjust the displacement for the difference between
* the original location of this instruction and the location
* of the copy that will actually be run. The tricky bit here
* is making sure that the sign extension happens correctly in
* this calculation, since we need a signed 32-bit result to
* be sign-extended to 64 bits when it's added to the %rip
* value and yield the same 64-bit result that the sign-
* extension of the original signed 32-bit displacement would
* have given.
*/
newdisp = (u8 *) src + (s64) insn.displacement.value -
(u8 *) dest;
BUG_ON((s64) (s32) newdisp != newdisp); /* Sanity check. */
disp = (u8 *) dest + insn_offset_displacement(&insn);
*(s32 *) disp = (s32) newdisp;
}
#endif
return insn.length;
}
/*
* Copy an instruction with recovering modified instruction by kprobes
* and adjust the displacement if the instruction uses the %rip-relative
* addressing mode. Note that since @real will be the final place of copied
* instruction, displacement must be adjust by @real, not @dest.
* This returns the length of copied instruction, or 0 if it has an error.
*/
int __copy_instruction(u8 *dest, u8 *src, u8 *real, struct insn *insn)
{
kprobe_opcode_t buf[MAX_INSN_SIZE];
unsigned long recovered_insn =
recover_probed_instruction(buf, (unsigned long)src);
if (!recovered_insn || !insn)
return 0;
/* This can access kernel text if given address is not recovered */
if (probe_kernel_read(dest, (void *)recovered_insn, MAX_INSN_SIZE))
return 0;
kernel_insn_init(insn, dest, MAX_INSN_SIZE);
insn_get_length(insn);
/* Another subsystem puts a breakpoint, failed to recover */
if (insn->opcode.bytes[0] == BREAKPOINT_INSTRUCTION)
return 0;
/* We should not singlestep on the exception masking instructions */
if (insn_masking_exception(insn))
return 0;
#ifdef CONFIG_X86_64
/* Only x86_64 has RIP relative instructions */
if (insn_rip_relative(insn)) {
s64 newdisp;
u8 *disp;
/*
* The copied instruction uses the %rip-relative addressing
* mode. Adjust the displacement for the difference between
* the original location of this instruction and the location
* of the copy that will actually be run. The tricky bit here
* is making sure that the sign extension happens correctly in
* this calculation, since we need a signed 32-bit result to
* be sign-extended to 64 bits when it's added to the %rip
* value and yield the same 64-bit result that the sign-
* extension of the original signed 32-bit displacement would
* have given.
*/
newdisp = (u8 *) src + (s64) insn->displacement.value
- (u8 *) real;
if ((s64) (s32) newdisp != newdisp) {
pr_err("Kprobes error: new displacement does not fit into s32 (%llx)\n", newdisp);
return 0;
}
disp = (u8 *) dest + insn_offset_displacement(insn);
*(s32 *) disp = (s32) newdisp;
}
#endif
return insn->length;
}
/* Check if paddr is at an instruction boundary */
static int __kprobes can_probe(unsigned long paddr)
{
int ret;
unsigned long addr, offset = 0;
struct insn insn;
kprobe_opcode_t buf[MAX_INSN_SIZE];
if (!kallsyms_lookup(paddr, NULL, &offset, NULL, __dummy_buf))
return 0;
/* Decode instructions */
addr = paddr - offset;
while (addr < paddr) {
kernel_insn_init(&insn, (void *)addr);
insn_get_opcode(&insn);
/*
* Check if the instruction has been modified by another
* kprobe, in which case we replace the breakpoint by the
* original instruction in our buffer.
*/
if (insn.opcode.bytes[0] == BREAKPOINT_INSTRUCTION) {
ret = recover_probed_instruction(buf, addr);
if (ret)
/*
* Another debugging subsystem might insert
* this breakpoint. In that case, we can't
* recover it.
*/
return 0;
kernel_insn_init(&insn, buf);
}
insn_get_length(&insn);
addr += insn.length;
}
return (addr == paddr);
}
/* Decode and process the instruction ('c_insn') at
* the address 'kaddr' - see the description of do_process_area for details.
*
* Check if we get past the end of the buffer [kaddr, end_kaddr)
*
* The function returns the length of the instruction in bytes.
* 0 is returned in case of failure.
*/
static unsigned int
do_process_insn(struct insn* c_insn, void* kaddr, void* end_kaddr,
void** from_funcs, void** to_funcs, unsigned int nfuncs)
{
/* ptr to the 32-bit offset argument in the instruction */
u32* offset = NULL;
/* address of the function being called */
void* addr = NULL;
static const unsigned char op = 0xe8; /* 'call <offset>' */
int i;
BUG_ON(from_funcs == NULL || to_funcs == NULL);
/* Decode the instruction and populate 'insn' structure */
kernel_insn_init(c_insn, kaddr);
insn_get_length(c_insn);
if (c_insn->length == 0)
{
return 0;
}
if (kaddr + c_insn->length > end_kaddr)
{
/* Note: it is OK to stop at 'end_kaddr' but no further */
KEDR_MSG(COMPONENT_STRING
"instruction decoder stopped past the end of the section.\n");
insn_get_opcode(c_insn);
printk(KERN_ALERT COMPONENT_STRING
"kaddr=%p, end_kaddr=%p, c_insn->length=%d, opcode=0x%x\n",
(void*)kaddr,
(void*)end_kaddr,
(int)c_insn->length,
(unsigned int)c_insn->opcode.value
);
WARN_ON(1);
}
/* This call may be overkill as insn_get_length() probably has to decode
* the instruction completely.
* Still, to operate safely, we need insn_get_opcode() before we can access
* c_insn->opcode.
* The call is cheap anyway, no re-decoding is performed.
*/
insn_get_opcode(c_insn);
if (c_insn->opcode.value != op)
{
/* Not a 'call' instruction, nothing to do. */
return c_insn->length;
}
/* [NB] For some reason, the decoder stores the argument of 'call' and 'jmp'
* as 'immediate' rather than 'displacement' (as Intel manuals name it).
* May be it is a bug, may be it is not.
* Meanwhile, I'll call this value 'offset' to avoid confusion.
*/
/* Call this before trying to access c_insn->immediate */
insn_get_immediate(c_insn);
if (c_insn->immediate.nbytes != 4)
{
KEDR_MSG(COMPONENT_STRING
"at 0x%p: "
"opcode: 0x%x, "
"immediate field is %u rather than 32 bits in size; "
"insn.length = %u, insn.imm = %u, off_immed = %d\n",
kaddr,
(unsigned int)c_insn->opcode.value,
8 * (unsigned int)c_insn->immediate.nbytes,
c_insn->length,
(unsigned int)c_insn->immediate.value,
insn_offset_immediate(c_insn));
WARN_ON(1);
return c_insn->length;
}
offset = (u32*)(kaddr + insn_offset_immediate(c_insn));
addr = CALL_ADDR_FROM_OFFSET(kaddr, c_insn->length, *offset);
/* Check if one of the functions of interest is called */
for (i = 0; i < nfuncs; ++i)
{
if (addr == from_funcs[i])
{
/* Change the address of the function to be called */
BUG_ON(to_funcs[i] == NULL);
KEDR_MSG(COMPONENT_STRING
"at 0x%p: changing address 0x%p to 0x%p (displ: 0x%x to 0x%x)\n",
kaddr,
from_funcs[i],
to_funcs[i],
(unsigned int)(*offset),
(unsigned int)CALL_OFFSET_FROM_ADDR(
kaddr, c_insn->length, to_funcs[i])
);
*offset = CALL_OFFSET_FROM_ADDR(
kaddr,
c_insn->length,
to_funcs[i]
);
break;
}
}
return c_insn->length;
}
int symbol_hijack(struct kernsym *sym, const char *symbol_name, unsigned long *code) {
int ret;
unsigned long orig_addr;
unsigned long dest_addr;
unsigned long end_addr;
u32 *poffset;
struct insn insn;
bool pte_ro;
ret = find_symbol_address(sym, symbol_name);
if (IN_ERR(ret))
return ret;
if (*(u8 *)sym->addr == OP_JMP_REL32) {
printk(PKPRE "error: %s already appears to be hijacked\n", symbol_name);
return -EFAULT;
}
sym->new_addr = malloc(sym->size);
if (sym->new_addr == NULL) {
printk(PKPRE
"Failed to allocate buffer of size %lu for %s\n",
sym->size, sym->name);
return -ENOMEM;
}
memset(sym->new_addr, 0, (size_t)sym->size);
if (sym->size < OP_JMP_SIZE) {
ret = -EFAULT;
goto out_error;
}
orig_addr = (unsigned long)sym->addr;
dest_addr = (unsigned long)sym->new_addr;
end_addr = orig_addr + sym->size;
while (end_addr > orig_addr && *(u8 *)(end_addr - 1) == '\0')
--end_addr;
if (orig_addr == end_addr) {
printk(PKPRE
"A spurious symbol \"%s\" (address: %p) seems to contain only zeros\n",
sym->name,
sym->addr);
ret = -EILSEQ;
goto out_error;
}
while (orig_addr < end_addr) {
kernel_insn_init(&insn, (void *)orig_addr);
insn_get_length(&insn);
if (insn.length == 0) {
printk(PKPRE
"Failed to decode instruction at %p (%s+0x%lx)\n",
(const void *)orig_addr,
sym->name,
orig_addr - (unsigned long)sym->addr);
ret = -EILSEQ;
goto out_error;
}
copy_and_fixup_insn(&insn, (void *)dest_addr, sym);
orig_addr += insn.length;
dest_addr += insn.length;
}
sym->new_size = dest_addr - (unsigned long)sym->new_addr;
sym->run = sym->new_addr;
set_addr_rw((unsigned long) sym->addr, &pte_ro);
memcpy(&sym->orig_start_bytes[0], sym->addr, OP_JMP_SIZE);
*(u8 *)sym->addr = OP_JMP_REL32;
poffset = (u32 *)((unsigned long)sym->addr + 1);
*poffset = CODE_OFFSET_FROM_ADDR((unsigned long)sym->addr,
OP_JMP_SIZE, (unsigned long)code);
set_addr_ro((unsigned long) sym->addr, pte_ro);
sym->hijacked = true;
return 0;
out_error:
malloc_free(sym->new_addr);
return ret;
}