arch/mips/kernel/uprobes.c

   1 #include <linux/highmem.h>
   2 #include <linux/kdebug.h>
   3 #include <linux/types.h>
   4 #include <linux/notifier.h>
   5 #include <linux/sched.h>
   6 #include <linux/uprobes.h>
   7
   8 #include <asm/branch.h>
   9 #include <asm/cpu-features.h>
  10 #include <asm/ptrace.h>
  11 #include <asm/inst.h>
  12
  13 static inline int insn_has_delay_slot(const union mips_instruction insn)
  14 {
  15         switch (insn.i_format.opcode) {
  16         /*
  17          * jr and jalr are in r_format format.
  18          */
  19         case spec_op:
  20                 switch (insn.r_format.func) {
  21                 case jalr_op:
  22                 case jr_op:
  23                         return 1;
  24                 }
  25                 break;
  26
  27         /*
  28          * This group contains:
  29          * bltz_op, bgez_op, bltzl_op, bgezl_op,
  30          * bltzal_op, bgezal_op, bltzall_op, bgezall_op.
  31          */
  32         case bcond_op:
  33                 switch (insn.i_format.rt) {
  34                 case bltz_op:
  35                 case bltzl_op:
  36                 case bgez_op:
  37                 case bgezl_op:
  38                 case bltzal_op:
  39                 case bltzall_op:
  40                 case bgezal_op:
  41                 case bgezall_op:
  42                 case bposge32_op:
  43                         return 1;
  44                 }
  45                 break;
  46
  47         /*
  48          * These are unconditional and in j_format.
  49          */
  50         case jal_op:
  51         case j_op:
  52         case beq_op:
  53         case beql_op:
  54         case bne_op:
  55         case bnel_op:
  56         case blez_op: /* not really i_format */
  57         case blezl_op:
  58         case bgtz_op:
  59         case bgtzl_op:
  60                 return 1;
  61
  62         /*
  63          * And now the FPA/cp1 branch instructions.
  64          */
  65         case cop1_op:
  66 #ifdef CONFIG_CPU_CAVIUM_OCTEON
  67         case lwc2_op: /* This is bbit0 on Octeon */
  68         case ldc2_op: /* This is bbit032 on Octeon */
  69         case swc2_op: /* This is bbit1 on Octeon */
  70         case sdc2_op: /* This is bbit132 on Octeon */
  71 #endif
  72                 return 1;
  73         }
  74
  75         return 0;
  76 }
  77
  78 /**
  79  * arch_uprobe_analyze_insn - instruction analysis including validity and fixups.
  80  * @mm: the probed address space.
  81  * @arch_uprobe: the probepoint information.
  82  * @addr: virtual address at which to install the probepoint
  83  * Return 0 on success or a -ve number on error.
  84  */
  85 int arch_uprobe_analyze_insn(struct arch_uprobe *aup,
  86         struct mm_struct *mm, unsigned long addr)
  87 {
  88         union mips_instruction inst;
  89
  90         /*
  91          * For the time being this also blocks attempts to use uprobes with
  92          * MIPS16 and microMIPS.
  93          */
  94         if (addr & 0x03)
  95                 return -EINVAL;
  96
  97         inst.word = aup->insn[0];
  98         aup->ixol[0] = aup->insn[insn_has_delay_slot(inst)];
  99         aup->ixol[1] = UPROBE_BRK_UPROBE_XOL;           /* NOP  */
 100
 101         return 0;
 102 }
 103
 104 /**
 105  * is_trap_insn - check if the instruction is a trap variant
 106  * @insn: instruction to be checked.
 107  * Returns true if @insn is a trap variant.
 108  *
 109  * This definition overrides the weak definition in kernel/events/uprobes.c.
 110  * and is needed for the case where an architecture has multiple trap
 111  * instructions (like PowerPC or MIPS).  We treat BREAK just like the more
 112  * modern conditional trap instructions.
 113  */
 114 bool is_trap_insn(uprobe_opcode_t *insn)
 115 {
 116         union mips_instruction inst;
 117
 118         inst.word = *insn;
 119
 120         switch (inst.i_format.opcode) {
 121         case spec_op:
 122                 switch (inst.r_format.func) {
 123                 case break_op:
 124                 case teq_op:
 125                 case tge_op:
 126                 case tgeu_op:
 127                 case tlt_op:
 128                 case tltu_op:
 129                 case tne_op:
 130                         return 1;
 131                 }
 132                 break;
 133
 134         case bcond_op:  /* Yes, really ...  */
 135                 switch (inst.u_format.rt) {
 136                 case teqi_op:
 137                 case tgei_op:
 138                 case tgeiu_op:
 139                 case tlti_op:
 140                 case tltiu_op:
 141                 case tnei_op:
 142                         return 1;
 143                 }
 144                 break;
 145         }
 146
 147         return 0;
 148 }
 149
 150 #define UPROBE_TRAP_NR  ULONG_MAX
 151
 152 /*
 153  * arch_uprobe_pre_xol - prepare to execute out of line.
 154  * @auprobe: the probepoint information.
 155  * @regs: reflects the saved user state of current task.
 156  */
 157 int arch_uprobe_pre_xol(struct arch_uprobe *aup, struct pt_regs *regs)
 158 {
 159         struct uprobe_task *utask = current->utask;
 160         union mips_instruction insn;
 161
 162         /*
 163          * Now find the EPC where to resume after the breakpoint has been
 164          * dealt with.  This may require emulation of a branch.
 165          */
 166         aup->resume_epc = regs->cp0_epc + 4;
 167         if (insn_has_delay_slot((union mips_instruction) aup->insn[0])) {
 168                 unsigned long epc;
 169
 170                 epc = regs->cp0_epc;
 171                 __compute_return_epc_for_insn(regs, insn);
 172                 aup->resume_epc = regs->cp0_epc;
 173         }
 174
 175         utask->autask.saved_trap_nr = current->thread.trap_nr;
 176         current->thread.trap_nr = UPROBE_TRAP_NR;
 177         regs->cp0_epc = current->utask->xol_vaddr;
 178
 179         return 0;
 180 }
 181
 182 int arch_uprobe_post_xol(struct arch_uprobe *aup, struct pt_regs *regs)
 183 {
 184         struct uprobe_task *utask = current->utask;
 185
 186         current->thread.trap_nr = utask->autask.saved_trap_nr;
 187         regs->cp0_epc = aup->resume_epc;
 188
 189         return 0;
 190 }
 191
 192 /*
 193  * If xol insn itself traps and generates a signal(Say,
 194  * SIGILL/SIGSEGV/etc), then detect the case where a singlestepped
 195  * instruction jumps back to its own address. It is assumed that anything
 196  * like do_page_fault/do_trap/etc sets thread.trap_nr != -1.
 197  *
 198  * arch_uprobe_pre_xol/arch_uprobe_post_xol save/restore thread.trap_nr,
 199  * arch_uprobe_xol_was_trapped() simply checks that ->trap_nr is not equal to
 200  * UPROBE_TRAP_NR == -1 set by arch_uprobe_pre_xol().
 201  */
 202 bool arch_uprobe_xol_was_trapped(struct task_struct *tsk)
 203 {
 204         if (tsk->thread.trap_nr != UPROBE_TRAP_NR)
 205                 return true;
 206
 207         return false;
 208 }
 209
 210 int arch_uprobe_exception_notify(struct notifier_block *self,
 211         unsigned long val, void *data)
 212 {
 213         struct die_args *args = data;
 214         struct pt_regs *regs = args->regs;
 215
 216         /* regs == NULL is a kernel bug */
 217         if (WARN_ON(!regs))
 218                 return NOTIFY_DONE;
 219
 220         /* We are only interested in userspace traps */
 221         if (!user_mode(regs))
 222                 return NOTIFY_DONE;
 223
 224         switch (val) {
 225         case DIE_UPROBE:
 226                 if (uprobe_pre_sstep_notifier(regs))
 227                         return NOTIFY_STOP;
 228                 break;
 229         case DIE_UPROBE_XOL:
 230                 if (uprobe_post_sstep_notifier(regs))
 231                         return NOTIFY_STOP;
 232         default:
 233                 break;
 234         }
 235
 236         return 0;
 237 }
 238
 239 /*
 240  * This function gets called when XOL instruction either gets trapped or
 241  * the thread has a fatal signal. Reset the instruction pointer to its
 242  * probed address for the potential restart or for post mortem analysis.
 243  */
 244 void arch_uprobe_abort_xol(struct arch_uprobe *aup,
 245         struct pt_regs *regs)
 246 {
 247         struct uprobe_task *utask = current->utask;
 248
 249         instruction_pointer_set(regs, utask->vaddr);
 250 }
 251
 252 unsigned long arch_uretprobe_hijack_return_addr(
 253         unsigned long trampoline_vaddr, struct pt_regs *regs)
 254 {
 255         unsigned long ra;
 256
 257         ra = regs->regs[31];
 258
 259         /* Replace the return address with the trampoline address */
 260         regs->regs[31] = trampoline_vaddr;
 261
 262         return ra;
 263 }
 264
 265 /**
 266  * set_swbp - store breakpoint at a given address.
 267  * @auprobe: arch specific probepoint information.
 268  * @mm: the probed process address space.
 269  * @vaddr: the virtual address to insert the opcode.
 270  *
 271  * For mm @mm, store the breakpoint instruction at @vaddr.
 272  * Return 0 (success) or a negative errno.
 273  *
 274  * This version overrides the weak version in kernel/events/uprobes.c.
 275  * It is required to handle MIPS16 and microMIPS.
 276  */
 277 int __weak set_swbp(struct arch_uprobe *auprobe, struct mm_struct *mm,
 278         unsigned long vaddr)
 279 {
 280         return uprobe_write_opcode(mm, vaddr, UPROBE_SWBP_INSN);
 281 }
 282
 283 /**
 284  * set_orig_insn - Restore the original instruction.
 285  * @mm: the probed process address space.
 286  * @auprobe: arch specific probepoint information.
 287  * @vaddr: the virtual address to insert the opcode.
 288  *
 289  * For mm @mm, restore the original opcode (opcode) at @vaddr.
 290  * Return 0 (success) or a negative errno.
 291  *
 292  * This overrides the weak version in kernel/events/uprobes.c.
 293  */
 294 int set_orig_insn(struct arch_uprobe *auprobe, struct mm_struct *mm,
 295                  unsigned long vaddr)
 296 {
 297         return uprobe_write_opcode(mm, vaddr,
 298                         *(uprobe_opcode_t *)&auprobe->orig_inst[0].word);
 299 }
 300
 301 void __weak arch_uprobe_copy_ixol(struct page *page, unsigned long vaddr,
 302                                   void *src, unsigned long len)
 303 {
 304         void *kaddr;
 305
 306         /* Initialize the slot */
 307         kaddr = kmap_atomic(page);
 308         memcpy(kaddr + (vaddr & ~PAGE_MASK), src, len);
 309         kunmap_atomic(kaddr);
 310
 311         /*
 312          * The MIPS version of flush_icache_range will operate safely on
 313          * user space addresses and more importantly, it doesn't require a
 314          * VMA argument.
 315          */
 316         flush_icache_range(vaddr, vaddr + len);
 317 }
 318
 319 /**
 320  * uprobe_get_swbp_addr - compute address of swbp given post-swbp regs
 321  * @regs: Reflects the saved state of the task after it has hit a breakpoint
 322  * instruction.
 323  * Return the address of the breakpoint instruction.
 324  *
 325  * This overrides the weak version in kernel/events/uprobes.c.
 326  */
 327 unsigned long uprobe_get_swbp_addr(struct pt_regs *regs)
 328 {
 329         return instruction_pointer(regs);
 330 }
 331
 332 /*
 333  * See if the instruction can be emulated.
 334  * Returns true if instruction was emulated, false otherwise.
 335  *
 336  * For now we always emulate so this function just returns 0.
 337  */
 338 bool arch_uprobe_skip_sstep(struct arch_uprobe *auprobe, struct pt_regs *regs)
 339 {
 340         return 0;
 341 }