Loading...
Note: File does not exist in v3.1.
1#include <linux/highmem.h>
2#include <linux/kdebug.h>
3#include <linux/types.h>
4#include <linux/notifier.h>
5#include <linux/sched.h>
6#include <linux/uprobes.h>
7
8#include <asm/branch.h>
9#include <asm/cpu-features.h>
10#include <asm/ptrace.h>
11#include <asm/inst.h>
12
13static inline int insn_has_delay_slot(const union mips_instruction insn)
14{
15 switch (insn.i_format.opcode) {
16 /*
17 * jr and jalr are in r_format format.
18 */
19 case spec_op:
20 switch (insn.r_format.func) {
21 case jalr_op:
22 case jr_op:
23 return 1;
24 }
25 break;
26
27 /*
28 * This group contains:
29 * bltz_op, bgez_op, bltzl_op, bgezl_op,
30 * bltzal_op, bgezal_op, bltzall_op, bgezall_op.
31 */
32 case bcond_op:
33 switch (insn.i_format.rt) {
34 case bltz_op:
35 case bltzl_op:
36 case bgez_op:
37 case bgezl_op:
38 case bltzal_op:
39 case bltzall_op:
40 case bgezal_op:
41 case bgezall_op:
42 case bposge32_op:
43 return 1;
44 }
45 break;
46
47 /*
48 * These are unconditional and in j_format.
49 */
50 case jal_op:
51 case j_op:
52 case beq_op:
53 case beql_op:
54 case bne_op:
55 case bnel_op:
56 case blez_op: /* not really i_format */
57 case blezl_op:
58 case bgtz_op:
59 case bgtzl_op:
60 return 1;
61
62 /*
63 * And now the FPA/cp1 branch instructions.
64 */
65 case cop1_op:
66#ifdef CONFIG_CPU_CAVIUM_OCTEON
67 case lwc2_op: /* This is bbit0 on Octeon */
68 case ldc2_op: /* This is bbit032 on Octeon */
69 case swc2_op: /* This is bbit1 on Octeon */
70 case sdc2_op: /* This is bbit132 on Octeon */
71#endif
72 return 1;
73 }
74
75 return 0;
76}
77
78/**
79 * arch_uprobe_analyze_insn - instruction analysis including validity and fixups.
80 * @mm: the probed address space.
81 * @arch_uprobe: the probepoint information.
82 * @addr: virtual address at which to install the probepoint
83 * Return 0 on success or a -ve number on error.
84 */
85int arch_uprobe_analyze_insn(struct arch_uprobe *aup,
86 struct mm_struct *mm, unsigned long addr)
87{
88 union mips_instruction inst;
89
90 /*
91 * For the time being this also blocks attempts to use uprobes with
92 * MIPS16 and microMIPS.
93 */
94 if (addr & 0x03)
95 return -EINVAL;
96
97 inst.word = aup->insn[0];
98 aup->ixol[0] = aup->insn[insn_has_delay_slot(inst)];
99 aup->ixol[1] = UPROBE_BRK_UPROBE_XOL; /* NOP */
100
101 return 0;
102}
103
104/**
105 * is_trap_insn - check if the instruction is a trap variant
106 * @insn: instruction to be checked.
107 * Returns true if @insn is a trap variant.
108 *
109 * This definition overrides the weak definition in kernel/events/uprobes.c.
110 * and is needed for the case where an architecture has multiple trap
111 * instructions (like PowerPC or MIPS). We treat BREAK just like the more
112 * modern conditional trap instructions.
113 */
114bool is_trap_insn(uprobe_opcode_t *insn)
115{
116 union mips_instruction inst;
117
118 inst.word = *insn;
119
120 switch (inst.i_format.opcode) {
121 case spec_op:
122 switch (inst.r_format.func) {
123 case break_op:
124 case teq_op:
125 case tge_op:
126 case tgeu_op:
127 case tlt_op:
128 case tltu_op:
129 case tne_op:
130 return 1;
131 }
132 break;
133
134 case bcond_op: /* Yes, really ... */
135 switch (inst.u_format.rt) {
136 case teqi_op:
137 case tgei_op:
138 case tgeiu_op:
139 case tlti_op:
140 case tltiu_op:
141 case tnei_op:
142 return 1;
143 }
144 break;
145 }
146
147 return 0;
148}
149
150#define UPROBE_TRAP_NR ULONG_MAX
151
152/*
153 * arch_uprobe_pre_xol - prepare to execute out of line.
154 * @auprobe: the probepoint information.
155 * @regs: reflects the saved user state of current task.
156 */
157int arch_uprobe_pre_xol(struct arch_uprobe *aup, struct pt_regs *regs)
158{
159 struct uprobe_task *utask = current->utask;
160 union mips_instruction insn;
161
162 /*
163 * Now find the EPC where to resume after the breakpoint has been
164 * dealt with. This may require emulation of a branch.
165 */
166 aup->resume_epc = regs->cp0_epc + 4;
167 if (insn_has_delay_slot((union mips_instruction) aup->insn[0])) {
168 unsigned long epc;
169
170 epc = regs->cp0_epc;
171 __compute_return_epc_for_insn(regs, insn);
172 aup->resume_epc = regs->cp0_epc;
173 }
174
175 utask->autask.saved_trap_nr = current->thread.trap_nr;
176 current->thread.trap_nr = UPROBE_TRAP_NR;
177 regs->cp0_epc = current->utask->xol_vaddr;
178
179 return 0;
180}
181
182int arch_uprobe_post_xol(struct arch_uprobe *aup, struct pt_regs *regs)
183{
184 struct uprobe_task *utask = current->utask;
185
186 current->thread.trap_nr = utask->autask.saved_trap_nr;
187 regs->cp0_epc = aup->resume_epc;
188
189 return 0;
190}
191
192/*
193 * If xol insn itself traps and generates a signal(Say,
194 * SIGILL/SIGSEGV/etc), then detect the case where a singlestepped
195 * instruction jumps back to its own address. It is assumed that anything
196 * like do_page_fault/do_trap/etc sets thread.trap_nr != -1.
197 *
198 * arch_uprobe_pre_xol/arch_uprobe_post_xol save/restore thread.trap_nr,
199 * arch_uprobe_xol_was_trapped() simply checks that ->trap_nr is not equal to
200 * UPROBE_TRAP_NR == -1 set by arch_uprobe_pre_xol().
201 */
202bool arch_uprobe_xol_was_trapped(struct task_struct *tsk)
203{
204 if (tsk->thread.trap_nr != UPROBE_TRAP_NR)
205 return true;
206
207 return false;
208}
209
210int arch_uprobe_exception_notify(struct notifier_block *self,
211 unsigned long val, void *data)
212{
213 struct die_args *args = data;
214 struct pt_regs *regs = args->regs;
215
216 /* regs == NULL is a kernel bug */
217 if (WARN_ON(!regs))
218 return NOTIFY_DONE;
219
220 /* We are only interested in userspace traps */
221 if (!user_mode(regs))
222 return NOTIFY_DONE;
223
224 switch (val) {
225 case DIE_BREAK:
226 if (uprobe_pre_sstep_notifier(regs))
227 return NOTIFY_STOP;
228 break;
229 case DIE_UPROBE_XOL:
230 if (uprobe_post_sstep_notifier(regs))
231 return NOTIFY_STOP;
232 default:
233 break;
234 }
235
236 return 0;
237}
238
239/*
240 * This function gets called when XOL instruction either gets trapped or
241 * the thread has a fatal signal. Reset the instruction pointer to its
242 * probed address for the potential restart or for post mortem analysis.
243 */
244void arch_uprobe_abort_xol(struct arch_uprobe *aup,
245 struct pt_regs *regs)
246{
247 struct uprobe_task *utask = current->utask;
248
249 instruction_pointer_set(regs, utask->vaddr);
250}
251
252unsigned long arch_uretprobe_hijack_return_addr(
253 unsigned long trampoline_vaddr, struct pt_regs *regs)
254{
255 unsigned long ra;
256
257 ra = regs->regs[31];
258
259 /* Replace the return address with the trampoline address */
260 regs->regs[31] = ra;
261
262 return ra;
263}
264
265/**
266 * set_swbp - store breakpoint at a given address.
267 * @auprobe: arch specific probepoint information.
268 * @mm: the probed process address space.
269 * @vaddr: the virtual address to insert the opcode.
270 *
271 * For mm @mm, store the breakpoint instruction at @vaddr.
272 * Return 0 (success) or a negative errno.
273 *
274 * This version overrides the weak version in kernel/events/uprobes.c.
275 * It is required to handle MIPS16 and microMIPS.
276 */
277int __weak set_swbp(struct arch_uprobe *auprobe, struct mm_struct *mm,
278 unsigned long vaddr)
279{
280 return uprobe_write_opcode(mm, vaddr, UPROBE_SWBP_INSN);
281}
282
283/**
284 * set_orig_insn - Restore the original instruction.
285 * @mm: the probed process address space.
286 * @auprobe: arch specific probepoint information.
287 * @vaddr: the virtual address to insert the opcode.
288 *
289 * For mm @mm, restore the original opcode (opcode) at @vaddr.
290 * Return 0 (success) or a negative errno.
291 *
292 * This overrides the weak version in kernel/events/uprobes.c.
293 */
294int set_orig_insn(struct arch_uprobe *auprobe, struct mm_struct *mm,
295 unsigned long vaddr)
296{
297 return uprobe_write_opcode(mm, vaddr,
298 *(uprobe_opcode_t *)&auprobe->orig_inst[0].word);
299}
300
301void __weak arch_uprobe_copy_ixol(struct page *page, unsigned long vaddr,
302 void *src, unsigned long len)
303{
304 void *kaddr;
305
306 /* Initialize the slot */
307 kaddr = kmap_atomic(page);
308 memcpy(kaddr + (vaddr & ~PAGE_MASK), src, len);
309 kunmap_atomic(kaddr);
310
311 /*
312 * The MIPS version of flush_icache_range will operate safely on
313 * user space addresses and more importantly, it doesn't require a
314 * VMA argument.
315 */
316 flush_icache_range(vaddr, vaddr + len);
317}
318
319/**
320 * uprobe_get_swbp_addr - compute address of swbp given post-swbp regs
321 * @regs: Reflects the saved state of the task after it has hit a breakpoint
322 * instruction.
323 * Return the address of the breakpoint instruction.
324 *
325 * This overrides the weak version in kernel/events/uprobes.c.
326 */
327unsigned long uprobe_get_swbp_addr(struct pt_regs *regs)
328{
329 return instruction_pointer(regs);
330}
331
332/*
333 * See if the instruction can be emulated.
334 * Returns true if instruction was emulated, false otherwise.
335 *
336 * For now we always emulate so this function just returns 0.
337 */
338bool arch_uprobe_skip_sstep(struct arch_uprobe *auprobe, struct pt_regs *regs)
339{
340 return 0;
341}