Loading...
1#include <linux/highmem.h>
2#include <linux/kdebug.h>
3#include <linux/types.h>
4#include <linux/notifier.h>
5#include <linux/sched.h>
6#include <linux/uprobes.h>
7
8#include <asm/branch.h>
9#include <asm/cpu-features.h>
10#include <asm/ptrace.h>
11#include <asm/inst.h>
12
13static inline int insn_has_delay_slot(const union mips_instruction insn)
14{
15 switch (insn.i_format.opcode) {
16 /*
17 * jr and jalr are in r_format format.
18 */
19 case spec_op:
20 switch (insn.r_format.func) {
21 case jalr_op:
22 case jr_op:
23 return 1;
24 }
25 break;
26
27 /*
28 * This group contains:
29 * bltz_op, bgez_op, bltzl_op, bgezl_op,
30 * bltzal_op, bgezal_op, bltzall_op, bgezall_op.
31 */
32 case bcond_op:
33 switch (insn.i_format.rt) {
34 case bltz_op:
35 case bltzl_op:
36 case bgez_op:
37 case bgezl_op:
38 case bltzal_op:
39 case bltzall_op:
40 case bgezal_op:
41 case bgezall_op:
42 case bposge32_op:
43 return 1;
44 }
45 break;
46
47 /*
48 * These are unconditional and in j_format.
49 */
50 case jal_op:
51 case j_op:
52 case beq_op:
53 case beql_op:
54 case bne_op:
55 case bnel_op:
56 case blez_op: /* not really i_format */
57 case blezl_op:
58 case bgtz_op:
59 case bgtzl_op:
60 return 1;
61
62 /*
63 * And now the FPA/cp1 branch instructions.
64 */
65 case cop1_op:
66#ifdef CONFIG_CPU_CAVIUM_OCTEON
67 case lwc2_op: /* This is bbit0 on Octeon */
68 case ldc2_op: /* This is bbit032 on Octeon */
69 case swc2_op: /* This is bbit1 on Octeon */
70 case sdc2_op: /* This is bbit132 on Octeon */
71#endif
72 return 1;
73 }
74
75 return 0;
76}
77
78/**
79 * arch_uprobe_analyze_insn - instruction analysis including validity and fixups.
80 * @mm: the probed address space.
81 * @arch_uprobe: the probepoint information.
82 * @addr: virtual address at which to install the probepoint
83 * Return 0 on success or a -ve number on error.
84 */
85int arch_uprobe_analyze_insn(struct arch_uprobe *aup,
86 struct mm_struct *mm, unsigned long addr)
87{
88 union mips_instruction inst;
89
90 /*
91 * For the time being this also blocks attempts to use uprobes with
92 * MIPS16 and microMIPS.
93 */
94 if (addr & 0x03)
95 return -EINVAL;
96
97 inst.word = aup->insn[0];
98 aup->ixol[0] = aup->insn[insn_has_delay_slot(inst)];
99 aup->ixol[1] = UPROBE_BRK_UPROBE_XOL; /* NOP */
100
101 return 0;
102}
103
104/**
105 * is_trap_insn - check if the instruction is a trap variant
106 * @insn: instruction to be checked.
107 * Returns true if @insn is a trap variant.
108 *
109 * This definition overrides the weak definition in kernel/events/uprobes.c.
110 * and is needed for the case where an architecture has multiple trap
111 * instructions (like PowerPC or MIPS). We treat BREAK just like the more
112 * modern conditional trap instructions.
113 */
114bool is_trap_insn(uprobe_opcode_t *insn)
115{
116 union mips_instruction inst;
117
118 inst.word = *insn;
119
120 switch (inst.i_format.opcode) {
121 case spec_op:
122 switch (inst.r_format.func) {
123 case break_op:
124 case teq_op:
125 case tge_op:
126 case tgeu_op:
127 case tlt_op:
128 case tltu_op:
129 case tne_op:
130 return 1;
131 }
132 break;
133
134 case bcond_op: /* Yes, really ... */
135 switch (inst.u_format.rt) {
136 case teqi_op:
137 case tgei_op:
138 case tgeiu_op:
139 case tlti_op:
140 case tltiu_op:
141 case tnei_op:
142 return 1;
143 }
144 break;
145 }
146
147 return 0;
148}
149
150#define UPROBE_TRAP_NR ULONG_MAX
151
152/*
153 * arch_uprobe_pre_xol - prepare to execute out of line.
154 * @auprobe: the probepoint information.
155 * @regs: reflects the saved user state of current task.
156 */
157int arch_uprobe_pre_xol(struct arch_uprobe *aup, struct pt_regs *regs)
158{
159 struct uprobe_task *utask = current->utask;
160 union mips_instruction insn;
161
162 /*
163 * Now find the EPC where to resume after the breakpoint has been
164 * dealt with. This may require emulation of a branch.
165 */
166 aup->resume_epc = regs->cp0_epc + 4;
167 if (insn_has_delay_slot((union mips_instruction) aup->insn[0])) {
168 unsigned long epc;
169
170 epc = regs->cp0_epc;
171 __compute_return_epc_for_insn(regs, insn);
172 aup->resume_epc = regs->cp0_epc;
173 }
174
175 utask->autask.saved_trap_nr = current->thread.trap_nr;
176 current->thread.trap_nr = UPROBE_TRAP_NR;
177 regs->cp0_epc = current->utask->xol_vaddr;
178
179 return 0;
180}
181
182int arch_uprobe_post_xol(struct arch_uprobe *aup, struct pt_regs *regs)
183{
184 struct uprobe_task *utask = current->utask;
185
186 current->thread.trap_nr = utask->autask.saved_trap_nr;
187 regs->cp0_epc = aup->resume_epc;
188
189 return 0;
190}
191
192/*
193 * If xol insn itself traps and generates a signal(Say,
194 * SIGILL/SIGSEGV/etc), then detect the case where a singlestepped
195 * instruction jumps back to its own address. It is assumed that anything
196 * like do_page_fault/do_trap/etc sets thread.trap_nr != -1.
197 *
198 * arch_uprobe_pre_xol/arch_uprobe_post_xol save/restore thread.trap_nr,
199 * arch_uprobe_xol_was_trapped() simply checks that ->trap_nr is not equal to
200 * UPROBE_TRAP_NR == -1 set by arch_uprobe_pre_xol().
201 */
202bool arch_uprobe_xol_was_trapped(struct task_struct *tsk)
203{
204 if (tsk->thread.trap_nr != UPROBE_TRAP_NR)
205 return true;
206
207 return false;
208}
209
210int arch_uprobe_exception_notify(struct notifier_block *self,
211 unsigned long val, void *data)
212{
213 struct die_args *args = data;
214 struct pt_regs *regs = args->regs;
215
216 /* regs == NULL is a kernel bug */
217 if (WARN_ON(!regs))
218 return NOTIFY_DONE;
219
220 /* We are only interested in userspace traps */
221 if (!user_mode(regs))
222 return NOTIFY_DONE;
223
224 switch (val) {
225 case DIE_BREAK:
226 if (uprobe_pre_sstep_notifier(regs))
227 return NOTIFY_STOP;
228 break;
229 case DIE_UPROBE_XOL:
230 if (uprobe_post_sstep_notifier(regs))
231 return NOTIFY_STOP;
232 default:
233 break;
234 }
235
236 return 0;
237}
238
239/*
240 * This function gets called when XOL instruction either gets trapped or
241 * the thread has a fatal signal. Reset the instruction pointer to its
242 * probed address for the potential restart or for post mortem analysis.
243 */
244void arch_uprobe_abort_xol(struct arch_uprobe *aup,
245 struct pt_regs *regs)
246{
247 struct uprobe_task *utask = current->utask;
248
249 instruction_pointer_set(regs, utask->vaddr);
250}
251
252unsigned long arch_uretprobe_hijack_return_addr(
253 unsigned long trampoline_vaddr, struct pt_regs *regs)
254{
255 unsigned long ra;
256
257 ra = regs->regs[31];
258
259 /* Replace the return address with the trampoline address */
260 regs->regs[31] = ra;
261
262 return ra;
263}
264
265/**
266 * set_swbp - store breakpoint at a given address.
267 * @auprobe: arch specific probepoint information.
268 * @mm: the probed process address space.
269 * @vaddr: the virtual address to insert the opcode.
270 *
271 * For mm @mm, store the breakpoint instruction at @vaddr.
272 * Return 0 (success) or a negative errno.
273 *
274 * This version overrides the weak version in kernel/events/uprobes.c.
275 * It is required to handle MIPS16 and microMIPS.
276 */
277int __weak set_swbp(struct arch_uprobe *auprobe, struct mm_struct *mm,
278 unsigned long vaddr)
279{
280 return uprobe_write_opcode(mm, vaddr, UPROBE_SWBP_INSN);
281}
282
283/**
284 * set_orig_insn - Restore the original instruction.
285 * @mm: the probed process address space.
286 * @auprobe: arch specific probepoint information.
287 * @vaddr: the virtual address to insert the opcode.
288 *
289 * For mm @mm, restore the original opcode (opcode) at @vaddr.
290 * Return 0 (success) or a negative errno.
291 *
292 * This overrides the weak version in kernel/events/uprobes.c.
293 */
294int set_orig_insn(struct arch_uprobe *auprobe, struct mm_struct *mm,
295 unsigned long vaddr)
296{
297 return uprobe_write_opcode(mm, vaddr,
298 *(uprobe_opcode_t *)&auprobe->orig_inst[0].word);
299}
300
301void __weak arch_uprobe_copy_ixol(struct page *page, unsigned long vaddr,
302 void *src, unsigned long len)
303{
304 void *kaddr;
305
306 /* Initialize the slot */
307 kaddr = kmap_atomic(page);
308 memcpy(kaddr + (vaddr & ~PAGE_MASK), src, len);
309 kunmap_atomic(kaddr);
310
311 /*
312 * The MIPS version of flush_icache_range will operate safely on
313 * user space addresses and more importantly, it doesn't require a
314 * VMA argument.
315 */
316 flush_icache_range(vaddr, vaddr + len);
317}
318
319/**
320 * uprobe_get_swbp_addr - compute address of swbp given post-swbp regs
321 * @regs: Reflects the saved state of the task after it has hit a breakpoint
322 * instruction.
323 * Return the address of the breakpoint instruction.
324 *
325 * This overrides the weak version in kernel/events/uprobes.c.
326 */
327unsigned long uprobe_get_swbp_addr(struct pt_regs *regs)
328{
329 return instruction_pointer(regs);
330}
331
332/*
333 * See if the instruction can be emulated.
334 * Returns true if instruction was emulated, false otherwise.
335 *
336 * For now we always emulate so this function just returns 0.
337 */
338bool arch_uprobe_skip_sstep(struct arch_uprobe *auprobe, struct pt_regs *regs)
339{
340 return 0;
341}
1#include <linux/highmem.h>
2#include <linux/kdebug.h>
3#include <linux/types.h>
4#include <linux/notifier.h>
5#include <linux/sched.h>
6#include <linux/uprobes.h>
7
8#include <asm/branch.h>
9#include <asm/cpu-features.h>
10#include <asm/ptrace.h>
11
12#include "probes-common.h"
13
14static inline int insn_has_delay_slot(const union mips_instruction insn)
15{
16 return __insn_has_delay_slot(insn);
17}
18
19/**
20 * arch_uprobe_analyze_insn - instruction analysis including validity and fixups.
21 * @mm: the probed address space.
22 * @arch_uprobe: the probepoint information.
23 * @addr: virtual address at which to install the probepoint
24 * Return 0 on success or a -ve number on error.
25 */
26int arch_uprobe_analyze_insn(struct arch_uprobe *aup,
27 struct mm_struct *mm, unsigned long addr)
28{
29 union mips_instruction inst;
30
31 /*
32 * For the time being this also blocks attempts to use uprobes with
33 * MIPS16 and microMIPS.
34 */
35 if (addr & 0x03)
36 return -EINVAL;
37
38 inst.word = aup->insn[0];
39
40 if (__insn_is_compact_branch(inst)) {
41 pr_notice("Uprobes for compact branches are not supported\n");
42 return -EINVAL;
43 }
44
45 aup->ixol[0] = aup->insn[insn_has_delay_slot(inst)];
46 aup->ixol[1] = UPROBE_BRK_UPROBE_XOL; /* NOP */
47
48 return 0;
49}
50
51/**
52 * is_trap_insn - check if the instruction is a trap variant
53 * @insn: instruction to be checked.
54 * Returns true if @insn is a trap variant.
55 *
56 * This definition overrides the weak definition in kernel/events/uprobes.c.
57 * and is needed for the case where an architecture has multiple trap
58 * instructions (like PowerPC or MIPS). We treat BREAK just like the more
59 * modern conditional trap instructions.
60 */
61bool is_trap_insn(uprobe_opcode_t *insn)
62{
63 union mips_instruction inst;
64
65 inst.word = *insn;
66
67 switch (inst.i_format.opcode) {
68 case spec_op:
69 switch (inst.r_format.func) {
70 case break_op:
71 case teq_op:
72 case tge_op:
73 case tgeu_op:
74 case tlt_op:
75 case tltu_op:
76 case tne_op:
77 return 1;
78 }
79 break;
80
81 case bcond_op: /* Yes, really ... */
82 switch (inst.u_format.rt) {
83 case teqi_op:
84 case tgei_op:
85 case tgeiu_op:
86 case tlti_op:
87 case tltiu_op:
88 case tnei_op:
89 return 1;
90 }
91 break;
92 }
93
94 return 0;
95}
96
97#define UPROBE_TRAP_NR ULONG_MAX
98
99/*
100 * arch_uprobe_pre_xol - prepare to execute out of line.
101 * @auprobe: the probepoint information.
102 * @regs: reflects the saved user state of current task.
103 */
104int arch_uprobe_pre_xol(struct arch_uprobe *aup, struct pt_regs *regs)
105{
106 struct uprobe_task *utask = current->utask;
107
108 /*
109 * Now find the EPC where to resume after the breakpoint has been
110 * dealt with. This may require emulation of a branch.
111 */
112 aup->resume_epc = regs->cp0_epc + 4;
113 if (insn_has_delay_slot((union mips_instruction) aup->insn[0])) {
114 unsigned long epc;
115
116 epc = regs->cp0_epc;
117 __compute_return_epc_for_insn(regs,
118 (union mips_instruction) aup->insn[0]);
119 aup->resume_epc = regs->cp0_epc;
120 }
121 utask->autask.saved_trap_nr = current->thread.trap_nr;
122 current->thread.trap_nr = UPROBE_TRAP_NR;
123 regs->cp0_epc = current->utask->xol_vaddr;
124
125 return 0;
126}
127
128int arch_uprobe_post_xol(struct arch_uprobe *aup, struct pt_regs *regs)
129{
130 struct uprobe_task *utask = current->utask;
131
132 current->thread.trap_nr = utask->autask.saved_trap_nr;
133 regs->cp0_epc = aup->resume_epc;
134
135 return 0;
136}
137
138/*
139 * If xol insn itself traps and generates a signal(Say,
140 * SIGILL/SIGSEGV/etc), then detect the case where a singlestepped
141 * instruction jumps back to its own address. It is assumed that anything
142 * like do_page_fault/do_trap/etc sets thread.trap_nr != -1.
143 *
144 * arch_uprobe_pre_xol/arch_uprobe_post_xol save/restore thread.trap_nr,
145 * arch_uprobe_xol_was_trapped() simply checks that ->trap_nr is not equal to
146 * UPROBE_TRAP_NR == -1 set by arch_uprobe_pre_xol().
147 */
148bool arch_uprobe_xol_was_trapped(struct task_struct *tsk)
149{
150 if (tsk->thread.trap_nr != UPROBE_TRAP_NR)
151 return true;
152
153 return false;
154}
155
156int arch_uprobe_exception_notify(struct notifier_block *self,
157 unsigned long val, void *data)
158{
159 struct die_args *args = data;
160 struct pt_regs *regs = args->regs;
161
162 /* regs == NULL is a kernel bug */
163 if (WARN_ON(!regs))
164 return NOTIFY_DONE;
165
166 /* We are only interested in userspace traps */
167 if (!user_mode(regs))
168 return NOTIFY_DONE;
169
170 switch (val) {
171 case DIE_UPROBE:
172 if (uprobe_pre_sstep_notifier(regs))
173 return NOTIFY_STOP;
174 break;
175 case DIE_UPROBE_XOL:
176 if (uprobe_post_sstep_notifier(regs))
177 return NOTIFY_STOP;
178 default:
179 break;
180 }
181
182 return 0;
183}
184
185/*
186 * This function gets called when XOL instruction either gets trapped or
187 * the thread has a fatal signal. Reset the instruction pointer to its
188 * probed address for the potential restart or for post mortem analysis.
189 */
190void arch_uprobe_abort_xol(struct arch_uprobe *aup,
191 struct pt_regs *regs)
192{
193 struct uprobe_task *utask = current->utask;
194
195 instruction_pointer_set(regs, utask->vaddr);
196}
197
198unsigned long arch_uretprobe_hijack_return_addr(
199 unsigned long trampoline_vaddr, struct pt_regs *regs)
200{
201 unsigned long ra;
202
203 ra = regs->regs[31];
204
205 /* Replace the return address with the trampoline address */
206 regs->regs[31] = trampoline_vaddr;
207
208 return ra;
209}
210
211/**
212 * set_swbp - store breakpoint at a given address.
213 * @auprobe: arch specific probepoint information.
214 * @mm: the probed process address space.
215 * @vaddr: the virtual address to insert the opcode.
216 *
217 * For mm @mm, store the breakpoint instruction at @vaddr.
218 * Return 0 (success) or a negative errno.
219 *
220 * This version overrides the weak version in kernel/events/uprobes.c.
221 * It is required to handle MIPS16 and microMIPS.
222 */
223int __weak set_swbp(struct arch_uprobe *auprobe, struct mm_struct *mm,
224 unsigned long vaddr)
225{
226 return uprobe_write_opcode(mm, vaddr, UPROBE_SWBP_INSN);
227}
228
229void __weak arch_uprobe_copy_ixol(struct page *page, unsigned long vaddr,
230 void *src, unsigned long len)
231{
232 unsigned long kaddr, kstart;
233
234 /* Initialize the slot */
235 kaddr = (unsigned long)kmap_atomic(page);
236 kstart = kaddr + (vaddr & ~PAGE_MASK);
237 memcpy((void *)kstart, src, len);
238 flush_icache_range(kstart, kstart + len);
239 kunmap_atomic((void *)kaddr);
240}
241
242/**
243 * uprobe_get_swbp_addr - compute address of swbp given post-swbp regs
244 * @regs: Reflects the saved state of the task after it has hit a breakpoint
245 * instruction.
246 * Return the address of the breakpoint instruction.
247 *
248 * This overrides the weak version in kernel/events/uprobes.c.
249 */
250unsigned long uprobe_get_swbp_addr(struct pt_regs *regs)
251{
252 return instruction_pointer(regs);
253}
254
255/*
256 * See if the instruction can be emulated.
257 * Returns true if instruction was emulated, false otherwise.
258 *
259 * For now we always emulate so this function just returns 0.
260 */
261bool arch_uprobe_skip_sstep(struct arch_uprobe *auprobe, struct pt_regs *regs)
262{
263 return 0;
264}