Loading...
1#include <linux/highmem.h>
2#include <linux/kdebug.h>
3#include <linux/types.h>
4#include <linux/notifier.h>
5#include <linux/sched.h>
6#include <linux/uprobes.h>
7
8#include <asm/branch.h>
9#include <asm/cpu-features.h>
10#include <asm/ptrace.h>
11#include <asm/inst.h>
12
13static inline int insn_has_delay_slot(const union mips_instruction insn)
14{
15 switch (insn.i_format.opcode) {
16 /*
17 * jr and jalr are in r_format format.
18 */
19 case spec_op:
20 switch (insn.r_format.func) {
21 case jalr_op:
22 case jr_op:
23 return 1;
24 }
25 break;
26
27 /*
28 * This group contains:
29 * bltz_op, bgez_op, bltzl_op, bgezl_op,
30 * bltzal_op, bgezal_op, bltzall_op, bgezall_op.
31 */
32 case bcond_op:
33 switch (insn.i_format.rt) {
34 case bltz_op:
35 case bltzl_op:
36 case bgez_op:
37 case bgezl_op:
38 case bltzal_op:
39 case bltzall_op:
40 case bgezal_op:
41 case bgezall_op:
42 case bposge32_op:
43 return 1;
44 }
45 break;
46
47 /*
48 * These are unconditional and in j_format.
49 */
50 case jal_op:
51 case j_op:
52 case beq_op:
53 case beql_op:
54 case bne_op:
55 case bnel_op:
56 case blez_op: /* not really i_format */
57 case blezl_op:
58 case bgtz_op:
59 case bgtzl_op:
60 return 1;
61
62 /*
63 * And now the FPA/cp1 branch instructions.
64 */
65 case cop1_op:
66#ifdef CONFIG_CPU_CAVIUM_OCTEON
67 case lwc2_op: /* This is bbit0 on Octeon */
68 case ldc2_op: /* This is bbit032 on Octeon */
69 case swc2_op: /* This is bbit1 on Octeon */
70 case sdc2_op: /* This is bbit132 on Octeon */
71#endif
72 return 1;
73 }
74
75 return 0;
76}
77
78/**
79 * arch_uprobe_analyze_insn - instruction analysis including validity and fixups.
80 * @mm: the probed address space.
81 * @arch_uprobe: the probepoint information.
82 * @addr: virtual address at which to install the probepoint
83 * Return 0 on success or a -ve number on error.
84 */
85int arch_uprobe_analyze_insn(struct arch_uprobe *aup,
86 struct mm_struct *mm, unsigned long addr)
87{
88 union mips_instruction inst;
89
90 /*
91 * For the time being this also blocks attempts to use uprobes with
92 * MIPS16 and microMIPS.
93 */
94 if (addr & 0x03)
95 return -EINVAL;
96
97 inst.word = aup->insn[0];
98 aup->ixol[0] = aup->insn[insn_has_delay_slot(inst)];
99 aup->ixol[1] = UPROBE_BRK_UPROBE_XOL; /* NOP */
100
101 return 0;
102}
103
104/**
105 * is_trap_insn - check if the instruction is a trap variant
106 * @insn: instruction to be checked.
107 * Returns true if @insn is a trap variant.
108 *
109 * This definition overrides the weak definition in kernel/events/uprobes.c.
110 * and is needed for the case where an architecture has multiple trap
111 * instructions (like PowerPC or MIPS). We treat BREAK just like the more
112 * modern conditional trap instructions.
113 */
114bool is_trap_insn(uprobe_opcode_t *insn)
115{
116 union mips_instruction inst;
117
118 inst.word = *insn;
119
120 switch (inst.i_format.opcode) {
121 case spec_op:
122 switch (inst.r_format.func) {
123 case break_op:
124 case teq_op:
125 case tge_op:
126 case tgeu_op:
127 case tlt_op:
128 case tltu_op:
129 case tne_op:
130 return 1;
131 }
132 break;
133
134 case bcond_op: /* Yes, really ... */
135 switch (inst.u_format.rt) {
136 case teqi_op:
137 case tgei_op:
138 case tgeiu_op:
139 case tlti_op:
140 case tltiu_op:
141 case tnei_op:
142 return 1;
143 }
144 break;
145 }
146
147 return 0;
148}
149
150#define UPROBE_TRAP_NR ULONG_MAX
151
152/*
153 * arch_uprobe_pre_xol - prepare to execute out of line.
154 * @auprobe: the probepoint information.
155 * @regs: reflects the saved user state of current task.
156 */
157int arch_uprobe_pre_xol(struct arch_uprobe *aup, struct pt_regs *regs)
158{
159 struct uprobe_task *utask = current->utask;
160 union mips_instruction insn;
161
162 /*
163 * Now find the EPC where to resume after the breakpoint has been
164 * dealt with. This may require emulation of a branch.
165 */
166 aup->resume_epc = regs->cp0_epc + 4;
167 if (insn_has_delay_slot((union mips_instruction) aup->insn[0])) {
168 unsigned long epc;
169
170 epc = regs->cp0_epc;
171 __compute_return_epc_for_insn(regs, insn);
172 aup->resume_epc = regs->cp0_epc;
173 }
174
175 utask->autask.saved_trap_nr = current->thread.trap_nr;
176 current->thread.trap_nr = UPROBE_TRAP_NR;
177 regs->cp0_epc = current->utask->xol_vaddr;
178
179 return 0;
180}
181
182int arch_uprobe_post_xol(struct arch_uprobe *aup, struct pt_regs *regs)
183{
184 struct uprobe_task *utask = current->utask;
185
186 current->thread.trap_nr = utask->autask.saved_trap_nr;
187 regs->cp0_epc = aup->resume_epc;
188
189 return 0;
190}
191
192/*
193 * If xol insn itself traps and generates a signal(Say,
194 * SIGILL/SIGSEGV/etc), then detect the case where a singlestepped
195 * instruction jumps back to its own address. It is assumed that anything
196 * like do_page_fault/do_trap/etc sets thread.trap_nr != -1.
197 *
198 * arch_uprobe_pre_xol/arch_uprobe_post_xol save/restore thread.trap_nr,
199 * arch_uprobe_xol_was_trapped() simply checks that ->trap_nr is not equal to
200 * UPROBE_TRAP_NR == -1 set by arch_uprobe_pre_xol().
201 */
202bool arch_uprobe_xol_was_trapped(struct task_struct *tsk)
203{
204 if (tsk->thread.trap_nr != UPROBE_TRAP_NR)
205 return true;
206
207 return false;
208}
209
210int arch_uprobe_exception_notify(struct notifier_block *self,
211 unsigned long val, void *data)
212{
213 struct die_args *args = data;
214 struct pt_regs *regs = args->regs;
215
216 /* regs == NULL is a kernel bug */
217 if (WARN_ON(!regs))
218 return NOTIFY_DONE;
219
220 /* We are only interested in userspace traps */
221 if (!user_mode(regs))
222 return NOTIFY_DONE;
223
224 switch (val) {
225 case DIE_BREAK:
226 if (uprobe_pre_sstep_notifier(regs))
227 return NOTIFY_STOP;
228 break;
229 case DIE_UPROBE_XOL:
230 if (uprobe_post_sstep_notifier(regs))
231 return NOTIFY_STOP;
232 default:
233 break;
234 }
235
236 return 0;
237}
238
239/*
240 * This function gets called when XOL instruction either gets trapped or
241 * the thread has a fatal signal. Reset the instruction pointer to its
242 * probed address for the potential restart or for post mortem analysis.
243 */
244void arch_uprobe_abort_xol(struct arch_uprobe *aup,
245 struct pt_regs *regs)
246{
247 struct uprobe_task *utask = current->utask;
248
249 instruction_pointer_set(regs, utask->vaddr);
250}
251
252unsigned long arch_uretprobe_hijack_return_addr(
253 unsigned long trampoline_vaddr, struct pt_regs *regs)
254{
255 unsigned long ra;
256
257 ra = regs->regs[31];
258
259 /* Replace the return address with the trampoline address */
260 regs->regs[31] = ra;
261
262 return ra;
263}
264
265/**
266 * set_swbp - store breakpoint at a given address.
267 * @auprobe: arch specific probepoint information.
268 * @mm: the probed process address space.
269 * @vaddr: the virtual address to insert the opcode.
270 *
271 * For mm @mm, store the breakpoint instruction at @vaddr.
272 * Return 0 (success) or a negative errno.
273 *
274 * This version overrides the weak version in kernel/events/uprobes.c.
275 * It is required to handle MIPS16 and microMIPS.
276 */
277int __weak set_swbp(struct arch_uprobe *auprobe, struct mm_struct *mm,
278 unsigned long vaddr)
279{
280 return uprobe_write_opcode(mm, vaddr, UPROBE_SWBP_INSN);
281}
282
283/**
284 * set_orig_insn - Restore the original instruction.
285 * @mm: the probed process address space.
286 * @auprobe: arch specific probepoint information.
287 * @vaddr: the virtual address to insert the opcode.
288 *
289 * For mm @mm, restore the original opcode (opcode) at @vaddr.
290 * Return 0 (success) or a negative errno.
291 *
292 * This overrides the weak version in kernel/events/uprobes.c.
293 */
294int set_orig_insn(struct arch_uprobe *auprobe, struct mm_struct *mm,
295 unsigned long vaddr)
296{
297 return uprobe_write_opcode(mm, vaddr,
298 *(uprobe_opcode_t *)&auprobe->orig_inst[0].word);
299}
300
301void __weak arch_uprobe_copy_ixol(struct page *page, unsigned long vaddr,
302 void *src, unsigned long len)
303{
304 void *kaddr;
305
306 /* Initialize the slot */
307 kaddr = kmap_atomic(page);
308 memcpy(kaddr + (vaddr & ~PAGE_MASK), src, len);
309 kunmap_atomic(kaddr);
310
311 /*
312 * The MIPS version of flush_icache_range will operate safely on
313 * user space addresses and more importantly, it doesn't require a
314 * VMA argument.
315 */
316 flush_icache_range(vaddr, vaddr + len);
317}
318
319/**
320 * uprobe_get_swbp_addr - compute address of swbp given post-swbp regs
321 * @regs: Reflects the saved state of the task after it has hit a breakpoint
322 * instruction.
323 * Return the address of the breakpoint instruction.
324 *
325 * This overrides the weak version in kernel/events/uprobes.c.
326 */
327unsigned long uprobe_get_swbp_addr(struct pt_regs *regs)
328{
329 return instruction_pointer(regs);
330}
331
332/*
333 * See if the instruction can be emulated.
334 * Returns true if instruction was emulated, false otherwise.
335 *
336 * For now we always emulate so this function just returns 0.
337 */
338bool arch_uprobe_skip_sstep(struct arch_uprobe *auprobe, struct pt_regs *regs)
339{
340 return 0;
341}
1// SPDX-License-Identifier: GPL-2.0
2#include <linux/highmem.h>
3#include <linux/kdebug.h>
4#include <linux/types.h>
5#include <linux/notifier.h>
6#include <linux/sched.h>
7#include <linux/uprobes.h>
8
9#include <asm/branch.h>
10#include <asm/cpu-features.h>
11#include <asm/ptrace.h>
12
13#include "probes-common.h"
14
15static inline int insn_has_delay_slot(const union mips_instruction insn)
16{
17 return __insn_has_delay_slot(insn);
18}
19
20/**
21 * arch_uprobe_analyze_insn - instruction analysis including validity and fixups.
22 * @mm: the probed address space.
23 * @arch_uprobe: the probepoint information.
24 * @addr: virtual address at which to install the probepoint
25 * Return 0 on success or a -ve number on error.
26 */
27int arch_uprobe_analyze_insn(struct arch_uprobe *aup,
28 struct mm_struct *mm, unsigned long addr)
29{
30 union mips_instruction inst;
31
32 /*
33 * For the time being this also blocks attempts to use uprobes with
34 * MIPS16 and microMIPS.
35 */
36 if (addr & 0x03)
37 return -EINVAL;
38
39 inst.word = aup->insn[0];
40
41 if (__insn_is_compact_branch(inst)) {
42 pr_notice("Uprobes for compact branches are not supported\n");
43 return -EINVAL;
44 }
45
46 aup->ixol[0] = aup->insn[insn_has_delay_slot(inst)];
47 aup->ixol[1] = UPROBE_BRK_UPROBE_XOL; /* NOP */
48
49 return 0;
50}
51
52/**
53 * is_trap_insn - check if the instruction is a trap variant
54 * @insn: instruction to be checked.
55 * Returns true if @insn is a trap variant.
56 *
57 * This definition overrides the weak definition in kernel/events/uprobes.c.
58 * and is needed for the case where an architecture has multiple trap
59 * instructions (like PowerPC or MIPS). We treat BREAK just like the more
60 * modern conditional trap instructions.
61 */
62bool is_trap_insn(uprobe_opcode_t *insn)
63{
64 union mips_instruction inst;
65
66 inst.word = *insn;
67
68 switch (inst.i_format.opcode) {
69 case spec_op:
70 switch (inst.r_format.func) {
71 case break_op:
72 case teq_op:
73 case tge_op:
74 case tgeu_op:
75 case tlt_op:
76 case tltu_op:
77 case tne_op:
78 return 1;
79 }
80 break;
81
82 case bcond_op: /* Yes, really ... */
83 switch (inst.u_format.rt) {
84 case teqi_op:
85 case tgei_op:
86 case tgeiu_op:
87 case tlti_op:
88 case tltiu_op:
89 case tnei_op:
90 return 1;
91 }
92 break;
93 }
94
95 return 0;
96}
97
98#define UPROBE_TRAP_NR ULONG_MAX
99
100/*
101 * arch_uprobe_pre_xol - prepare to execute out of line.
102 * @auprobe: the probepoint information.
103 * @regs: reflects the saved user state of current task.
104 */
105int arch_uprobe_pre_xol(struct arch_uprobe *aup, struct pt_regs *regs)
106{
107 struct uprobe_task *utask = current->utask;
108
109 /*
110 * Now find the EPC where to resume after the breakpoint has been
111 * dealt with. This may require emulation of a branch.
112 */
113 aup->resume_epc = regs->cp0_epc + 4;
114 if (insn_has_delay_slot((union mips_instruction) aup->insn[0])) {
115 unsigned long epc;
116
117 epc = regs->cp0_epc;
118 __compute_return_epc_for_insn(regs,
119 (union mips_instruction) aup->insn[0]);
120 aup->resume_epc = regs->cp0_epc;
121 }
122 utask->autask.saved_trap_nr = current->thread.trap_nr;
123 current->thread.trap_nr = UPROBE_TRAP_NR;
124 regs->cp0_epc = current->utask->xol_vaddr;
125
126 return 0;
127}
128
129int arch_uprobe_post_xol(struct arch_uprobe *aup, struct pt_regs *regs)
130{
131 struct uprobe_task *utask = current->utask;
132
133 current->thread.trap_nr = utask->autask.saved_trap_nr;
134 regs->cp0_epc = aup->resume_epc;
135
136 return 0;
137}
138
139/*
140 * If xol insn itself traps and generates a signal(Say,
141 * SIGILL/SIGSEGV/etc), then detect the case where a singlestepped
142 * instruction jumps back to its own address. It is assumed that anything
143 * like do_page_fault/do_trap/etc sets thread.trap_nr != -1.
144 *
145 * arch_uprobe_pre_xol/arch_uprobe_post_xol save/restore thread.trap_nr,
146 * arch_uprobe_xol_was_trapped() simply checks that ->trap_nr is not equal to
147 * UPROBE_TRAP_NR == -1 set by arch_uprobe_pre_xol().
148 */
149bool arch_uprobe_xol_was_trapped(struct task_struct *tsk)
150{
151 if (tsk->thread.trap_nr != UPROBE_TRAP_NR)
152 return true;
153
154 return false;
155}
156
157int arch_uprobe_exception_notify(struct notifier_block *self,
158 unsigned long val, void *data)
159{
160 struct die_args *args = data;
161 struct pt_regs *regs = args->regs;
162
163 /* regs == NULL is a kernel bug */
164 if (WARN_ON(!regs))
165 return NOTIFY_DONE;
166
167 /* We are only interested in userspace traps */
168 if (!user_mode(regs))
169 return NOTIFY_DONE;
170
171 switch (val) {
172 case DIE_UPROBE:
173 if (uprobe_pre_sstep_notifier(regs))
174 return NOTIFY_STOP;
175 break;
176 case DIE_UPROBE_XOL:
177 if (uprobe_post_sstep_notifier(regs))
178 return NOTIFY_STOP;
179 default:
180 break;
181 }
182
183 return 0;
184}
185
186/*
187 * This function gets called when XOL instruction either gets trapped or
188 * the thread has a fatal signal. Reset the instruction pointer to its
189 * probed address for the potential restart or for post mortem analysis.
190 */
191void arch_uprobe_abort_xol(struct arch_uprobe *aup,
192 struct pt_regs *regs)
193{
194 struct uprobe_task *utask = current->utask;
195
196 instruction_pointer_set(regs, utask->vaddr);
197}
198
199unsigned long arch_uretprobe_hijack_return_addr(
200 unsigned long trampoline_vaddr, struct pt_regs *regs)
201{
202 unsigned long ra;
203
204 ra = regs->regs[31];
205
206 /* Replace the return address with the trampoline address */
207 regs->regs[31] = trampoline_vaddr;
208
209 return ra;
210}
211
212/**
213 * set_swbp - store breakpoint at a given address.
214 * @auprobe: arch specific probepoint information.
215 * @mm: the probed process address space.
216 * @vaddr: the virtual address to insert the opcode.
217 *
218 * For mm @mm, store the breakpoint instruction at @vaddr.
219 * Return 0 (success) or a negative errno.
220 *
221 * This version overrides the weak version in kernel/events/uprobes.c.
222 * It is required to handle MIPS16 and microMIPS.
223 */
224int __weak set_swbp(struct arch_uprobe *auprobe, struct mm_struct *mm,
225 unsigned long vaddr)
226{
227 return uprobe_write_opcode(mm, vaddr, UPROBE_SWBP_INSN);
228}
229
230void arch_uprobe_copy_ixol(struct page *page, unsigned long vaddr,
231 void *src, unsigned long len)
232{
233 unsigned long kaddr, kstart;
234
235 /* Initialize the slot */
236 kaddr = (unsigned long)kmap_atomic(page);
237 kstart = kaddr + (vaddr & ~PAGE_MASK);
238 memcpy((void *)kstart, src, len);
239 flush_icache_range(kstart, kstart + len);
240 kunmap_atomic((void *)kaddr);
241}
242
243/**
244 * uprobe_get_swbp_addr - compute address of swbp given post-swbp regs
245 * @regs: Reflects the saved state of the task after it has hit a breakpoint
246 * instruction.
247 * Return the address of the breakpoint instruction.
248 *
249 * This overrides the weak version in kernel/events/uprobes.c.
250 */
251unsigned long uprobe_get_swbp_addr(struct pt_regs *regs)
252{
253 return instruction_pointer(regs);
254}
255
256/*
257 * See if the instruction can be emulated.
258 * Returns true if instruction was emulated, false otherwise.
259 *
260 * For now we always emulate so this function just returns 0.
261 */
262bool arch_uprobe_skip_sstep(struct arch_uprobe *auprobe, struct pt_regs *regs)
263{
264 return 0;
265}