kprobes.c 13 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506
  1. // SPDX-License-Identifier: GPL-2.0
  2. /* arch/sparc64/kernel/kprobes.c
  3. *
  4. * Copyright (C) 2004 David S. Miller <davem@davemloft.net>
  5. */
  6. #include <linux/kernel.h>
  7. #include <linux/kprobes.h>
  8. #include <linux/extable.h>
  9. #include <linux/kdebug.h>
  10. #include <linux/slab.h>
  11. #include <linux/context_tracking.h>
  12. #include <asm/signal.h>
  13. #include <asm/cacheflush.h>
  14. #include <linux/uaccess.h>
  15. /* We do not have hardware single-stepping on sparc64.
  16. * So we implement software single-stepping with breakpoint
  17. * traps. The top-level scheme is similar to that used
  18. * in the x86 kprobes implementation.
  19. *
  20. * In the kprobe->ainsn.insn[] array we store the original
  21. * instruction at index zero and a break instruction at
  22. * index one.
  23. *
  24. * When we hit a kprobe we:
  25. * - Run the pre-handler
  26. * - Remember "regs->tnpc" and interrupt level stored in
  27. * "regs->tstate" so we can restore them later
  28. * - Disable PIL interrupts
  29. * - Set regs->tpc to point to kprobe->ainsn.insn[0]
  30. * - Set regs->tnpc to point to kprobe->ainsn.insn[1]
  31. * - Mark that we are actively in a kprobe
  32. *
  33. * At this point we wait for the second breakpoint at
  34. * kprobe->ainsn.insn[1] to hit. When it does we:
  35. * - Run the post-handler
  36. * - Set regs->tpc to "remembered" regs->tnpc stored above,
  37. * restore the PIL interrupt level in "regs->tstate" as well
  38. * - Make any adjustments necessary to regs->tnpc in order
  39. * to handle relative branches correctly. See below.
  40. * - Mark that we are no longer actively in a kprobe.
  41. */
  42. DEFINE_PER_CPU(struct kprobe *, current_kprobe) = NULL;
  43. DEFINE_PER_CPU(struct kprobe_ctlblk, kprobe_ctlblk);
  44. struct kretprobe_blackpoint kretprobe_blacklist[] = {{NULL, NULL}};
  45. int __kprobes arch_prepare_kprobe(struct kprobe *p)
  46. {
  47. if ((unsigned long) p->addr & 0x3UL)
  48. return -EILSEQ;
  49. p->ainsn.insn[0] = *p->addr;
  50. flushi(&p->ainsn.insn[0]);
  51. p->ainsn.insn[1] = BREAKPOINT_INSTRUCTION_2;
  52. flushi(&p->ainsn.insn[1]);
  53. p->opcode = *p->addr;
  54. return 0;
  55. }
  56. void __kprobes arch_arm_kprobe(struct kprobe *p)
  57. {
  58. *p->addr = BREAKPOINT_INSTRUCTION;
  59. flushi(p->addr);
  60. }
  61. void __kprobes arch_disarm_kprobe(struct kprobe *p)
  62. {
  63. *p->addr = p->opcode;
  64. flushi(p->addr);
  65. }
  66. static void __kprobes save_previous_kprobe(struct kprobe_ctlblk *kcb)
  67. {
  68. kcb->prev_kprobe.kp = kprobe_running();
  69. kcb->prev_kprobe.status = kcb->kprobe_status;
  70. kcb->prev_kprobe.orig_tnpc = kcb->kprobe_orig_tnpc;
  71. kcb->prev_kprobe.orig_tstate_pil = kcb->kprobe_orig_tstate_pil;
  72. }
  73. static void __kprobes restore_previous_kprobe(struct kprobe_ctlblk *kcb)
  74. {
  75. __this_cpu_write(current_kprobe, kcb->prev_kprobe.kp);
  76. kcb->kprobe_status = kcb->prev_kprobe.status;
  77. kcb->kprobe_orig_tnpc = kcb->prev_kprobe.orig_tnpc;
  78. kcb->kprobe_orig_tstate_pil = kcb->prev_kprobe.orig_tstate_pil;
  79. }
  80. static void __kprobes set_current_kprobe(struct kprobe *p, struct pt_regs *regs,
  81. struct kprobe_ctlblk *kcb)
  82. {
  83. __this_cpu_write(current_kprobe, p);
  84. kcb->kprobe_orig_tnpc = regs->tnpc;
  85. kcb->kprobe_orig_tstate_pil = (regs->tstate & TSTATE_PIL);
  86. }
  87. static void __kprobes prepare_singlestep(struct kprobe *p, struct pt_regs *regs,
  88. struct kprobe_ctlblk *kcb)
  89. {
  90. regs->tstate |= TSTATE_PIL;
  91. /*single step inline, if it a breakpoint instruction*/
  92. if (p->opcode == BREAKPOINT_INSTRUCTION) {
  93. regs->tpc = (unsigned long) p->addr;
  94. regs->tnpc = kcb->kprobe_orig_tnpc;
  95. } else {
  96. regs->tpc = (unsigned long) &p->ainsn.insn[0];
  97. regs->tnpc = (unsigned long) &p->ainsn.insn[1];
  98. }
  99. }
  100. static int __kprobes kprobe_handler(struct pt_regs *regs)
  101. {
  102. struct kprobe *p;
  103. void *addr = (void *) regs->tpc;
  104. int ret = 0;
  105. struct kprobe_ctlblk *kcb;
  106. /*
  107. * We don't want to be preempted for the entire
  108. * duration of kprobe processing
  109. */
  110. preempt_disable();
  111. kcb = get_kprobe_ctlblk();
  112. if (kprobe_running()) {
  113. p = get_kprobe(addr);
  114. if (p) {
  115. if (kcb->kprobe_status == KPROBE_HIT_SS) {
  116. regs->tstate = ((regs->tstate & ~TSTATE_PIL) |
  117. kcb->kprobe_orig_tstate_pil);
  118. goto no_kprobe;
  119. }
  120. /* We have reentered the kprobe_handler(), since
  121. * another probe was hit while within the handler.
  122. * We here save the original kprobes variables and
  123. * just single step on the instruction of the new probe
  124. * without calling any user handlers.
  125. */
  126. save_previous_kprobe(kcb);
  127. set_current_kprobe(p, regs, kcb);
  128. kprobes_inc_nmissed_count(p);
  129. kcb->kprobe_status = KPROBE_REENTER;
  130. prepare_singlestep(p, regs, kcb);
  131. return 1;
  132. } else if (*(u32 *)addr != BREAKPOINT_INSTRUCTION) {
  133. /* The breakpoint instruction was removed by
  134. * another cpu right after we hit, no further
  135. * handling of this interrupt is appropriate
  136. */
  137. ret = 1;
  138. }
  139. goto no_kprobe;
  140. }
  141. p = get_kprobe(addr);
  142. if (!p) {
  143. if (*(u32 *)addr != BREAKPOINT_INSTRUCTION) {
  144. /*
  145. * The breakpoint instruction was removed right
  146. * after we hit it. Another cpu has removed
  147. * either a probepoint or a debugger breakpoint
  148. * at this address. In either case, no further
  149. * handling of this interrupt is appropriate.
  150. */
  151. ret = 1;
  152. }
  153. /* Not one of ours: let kernel handle it */
  154. goto no_kprobe;
  155. }
  156. set_current_kprobe(p, regs, kcb);
  157. kcb->kprobe_status = KPROBE_HIT_ACTIVE;
  158. if (p->pre_handler && p->pre_handler(p, regs)) {
  159. reset_current_kprobe();
  160. preempt_enable_no_resched();
  161. return 1;
  162. }
  163. prepare_singlestep(p, regs, kcb);
  164. kcb->kprobe_status = KPROBE_HIT_SS;
  165. return 1;
  166. no_kprobe:
  167. preempt_enable_no_resched();
  168. return ret;
  169. }
  170. /* If INSN is a relative control transfer instruction,
  171. * return the corrected branch destination value.
  172. *
  173. * regs->tpc and regs->tnpc still hold the values of the
  174. * program counters at the time of trap due to the execution
  175. * of the BREAKPOINT_INSTRUCTION_2 at p->ainsn.insn[1]
  176. *
  177. */
  178. static unsigned long __kprobes relbranch_fixup(u32 insn, struct kprobe *p,
  179. struct pt_regs *regs)
  180. {
  181. unsigned long real_pc = (unsigned long) p->addr;
  182. /* Branch not taken, no mods necessary. */
  183. if (regs->tnpc == regs->tpc + 0x4UL)
  184. return real_pc + 0x8UL;
  185. /* The three cases are call, branch w/prediction,
  186. * and traditional branch.
  187. */
  188. if ((insn & 0xc0000000) == 0x40000000 ||
  189. (insn & 0xc1c00000) == 0x00400000 ||
  190. (insn & 0xc1c00000) == 0x00800000) {
  191. unsigned long ainsn_addr;
  192. ainsn_addr = (unsigned long) &p->ainsn.insn[0];
  193. /* The instruction did all the work for us
  194. * already, just apply the offset to the correct
  195. * instruction location.
  196. */
  197. return (real_pc + (regs->tnpc - ainsn_addr));
  198. }
  199. /* It is jmpl or some other absolute PC modification instruction,
  200. * leave NPC as-is.
  201. */
  202. return regs->tnpc;
  203. }
  204. /* If INSN is an instruction which writes it's PC location
  205. * into a destination register, fix that up.
  206. */
  207. static void __kprobes retpc_fixup(struct pt_regs *regs, u32 insn,
  208. unsigned long real_pc)
  209. {
  210. unsigned long *slot = NULL;
  211. /* Simplest case is 'call', which always uses %o7 */
  212. if ((insn & 0xc0000000) == 0x40000000) {
  213. slot = &regs->u_regs[UREG_I7];
  214. }
  215. /* 'jmpl' encodes the register inside of the opcode */
  216. if ((insn & 0xc1f80000) == 0x81c00000) {
  217. unsigned long rd = ((insn >> 25) & 0x1f);
  218. if (rd <= 15) {
  219. slot = &regs->u_regs[rd];
  220. } else {
  221. /* Hard case, it goes onto the stack. */
  222. flushw_all();
  223. rd -= 16;
  224. slot = (unsigned long *)
  225. (regs->u_regs[UREG_FP] + STACK_BIAS);
  226. slot += rd;
  227. }
  228. }
  229. if (slot != NULL)
  230. *slot = real_pc;
  231. }
  232. /*
  233. * Called after single-stepping. p->addr is the address of the
  234. * instruction which has been replaced by the breakpoint
  235. * instruction. To avoid the SMP problems that can occur when we
  236. * temporarily put back the original opcode to single-step, we
  237. * single-stepped a copy of the instruction. The address of this
  238. * copy is &p->ainsn.insn[0].
  239. *
  240. * This function prepares to return from the post-single-step
  241. * breakpoint trap.
  242. */
  243. static void __kprobes resume_execution(struct kprobe *p,
  244. struct pt_regs *regs, struct kprobe_ctlblk *kcb)
  245. {
  246. u32 insn = p->ainsn.insn[0];
  247. regs->tnpc = relbranch_fixup(insn, p, regs);
  248. /* This assignment must occur after relbranch_fixup() */
  249. regs->tpc = kcb->kprobe_orig_tnpc;
  250. retpc_fixup(regs, insn, (unsigned long) p->addr);
  251. regs->tstate = ((regs->tstate & ~TSTATE_PIL) |
  252. kcb->kprobe_orig_tstate_pil);
  253. }
  254. static int __kprobes post_kprobe_handler(struct pt_regs *regs)
  255. {
  256. struct kprobe *cur = kprobe_running();
  257. struct kprobe_ctlblk *kcb = get_kprobe_ctlblk();
  258. if (!cur)
  259. return 0;
  260. if ((kcb->kprobe_status != KPROBE_REENTER) && cur->post_handler) {
  261. kcb->kprobe_status = KPROBE_HIT_SSDONE;
  262. cur->post_handler(cur, regs, 0);
  263. }
  264. resume_execution(cur, regs, kcb);
  265. /*Restore back the original saved kprobes variables and continue. */
  266. if (kcb->kprobe_status == KPROBE_REENTER) {
  267. restore_previous_kprobe(kcb);
  268. goto out;
  269. }
  270. reset_current_kprobe();
  271. out:
  272. preempt_enable_no_resched();
  273. return 1;
  274. }
  275. int __kprobes kprobe_fault_handler(struct pt_regs *regs, int trapnr)
  276. {
  277. struct kprobe *cur = kprobe_running();
  278. struct kprobe_ctlblk *kcb = get_kprobe_ctlblk();
  279. const struct exception_table_entry *entry;
  280. switch(kcb->kprobe_status) {
  281. case KPROBE_HIT_SS:
  282. case KPROBE_REENTER:
  283. /*
  284. * We are here because the instruction being single
  285. * stepped caused a page fault. We reset the current
  286. * kprobe and the tpc points back to the probe address
  287. * and allow the page fault handler to continue as a
  288. * normal page fault.
  289. */
  290. regs->tpc = (unsigned long)cur->addr;
  291. regs->tnpc = kcb->kprobe_orig_tnpc;
  292. regs->tstate = ((regs->tstate & ~TSTATE_PIL) |
  293. kcb->kprobe_orig_tstate_pil);
  294. if (kcb->kprobe_status == KPROBE_REENTER)
  295. restore_previous_kprobe(kcb);
  296. else
  297. reset_current_kprobe();
  298. preempt_enable_no_resched();
  299. break;
  300. case KPROBE_HIT_ACTIVE:
  301. case KPROBE_HIT_SSDONE:
  302. /*
  303. * We increment the nmissed count for accounting,
  304. * we can also use npre/npostfault count for accounting
  305. * these specific fault cases.
  306. */
  307. kprobes_inc_nmissed_count(cur);
  308. /*
  309. * We come here because instructions in the pre/post
  310. * handler caused the page_fault, this could happen
  311. * if handler tries to access user space by
  312. * copy_from_user(), get_user() etc. Let the
  313. * user-specified handler try to fix it first.
  314. */
  315. if (cur->fault_handler && cur->fault_handler(cur, regs, trapnr))
  316. return 1;
  317. /*
  318. * In case the user-specified fault handler returned
  319. * zero, try to fix up.
  320. */
  321. entry = search_exception_tables(regs->tpc);
  322. if (entry) {
  323. regs->tpc = entry->fixup;
  324. regs->tnpc = regs->tpc + 4;
  325. return 1;
  326. }
  327. /*
  328. * fixup_exception() could not handle it,
  329. * Let do_page_fault() fix it.
  330. */
  331. break;
  332. default:
  333. break;
  334. }
  335. return 0;
  336. }
  337. /*
  338. * Wrapper routine to for handling exceptions.
  339. */
  340. int __kprobes kprobe_exceptions_notify(struct notifier_block *self,
  341. unsigned long val, void *data)
  342. {
  343. struct die_args *args = (struct die_args *)data;
  344. int ret = NOTIFY_DONE;
  345. if (args->regs && user_mode(args->regs))
  346. return ret;
  347. switch (val) {
  348. case DIE_DEBUG:
  349. if (kprobe_handler(args->regs))
  350. ret = NOTIFY_STOP;
  351. break;
  352. case DIE_DEBUG_2:
  353. if (post_kprobe_handler(args->regs))
  354. ret = NOTIFY_STOP;
  355. break;
  356. default:
  357. break;
  358. }
  359. return ret;
  360. }
  361. asmlinkage void __kprobes kprobe_trap(unsigned long trap_level,
  362. struct pt_regs *regs)
  363. {
  364. enum ctx_state prev_state = exception_enter();
  365. BUG_ON(trap_level != 0x170 && trap_level != 0x171);
  366. if (user_mode(regs)) {
  367. local_irq_enable();
  368. bad_trap(regs, trap_level);
  369. goto out;
  370. }
  371. /* trap_level == 0x170 --> ta 0x70
  372. * trap_level == 0x171 --> ta 0x71
  373. */
  374. if (notify_die((trap_level == 0x170) ? DIE_DEBUG : DIE_DEBUG_2,
  375. (trap_level == 0x170) ? "debug" : "debug_2",
  376. regs, 0, trap_level, SIGTRAP) != NOTIFY_STOP)
  377. bad_trap(regs, trap_level);
  378. out:
  379. exception_exit(prev_state);
  380. }
  381. /* The value stored in the return address register is actually 2
  382. * instructions before where the callee will return to.
  383. * Sequences usually look something like this
  384. *
  385. * call some_function <--- return register points here
  386. * nop <--- call delay slot
  387. * whatever <--- where callee returns to
  388. *
  389. * To keep trampoline_probe_handler logic simpler, we normalize the
  390. * value kept in ri->ret_addr so we don't need to keep adjusting it
  391. * back and forth.
  392. */
  393. void __kprobes arch_prepare_kretprobe(struct kretprobe_instance *ri,
  394. struct pt_regs *regs)
  395. {
  396. ri->ret_addr = (kprobe_opcode_t *)(regs->u_regs[UREG_RETPC] + 8);
  397. ri->fp = NULL;
  398. /* Replace the return addr with trampoline addr */
  399. regs->u_regs[UREG_RETPC] =
  400. ((unsigned long)kretprobe_trampoline) - 8;
  401. }
  402. /*
  403. * Called when the probe at kretprobe trampoline is hit
  404. */
  405. static int __kprobes trampoline_probe_handler(struct kprobe *p,
  406. struct pt_regs *regs)
  407. {
  408. unsigned long orig_ret_address = 0;
  409. orig_ret_address = __kretprobe_trampoline_handler(regs, &kretprobe_trampoline, NULL);
  410. regs->tpc = orig_ret_address;
  411. regs->tnpc = orig_ret_address + 4;
  412. /*
  413. * By returning a non-zero value, we are telling
  414. * kprobe_handler() that we don't want the post_handler
  415. * to run (and have re-enabled preemption)
  416. */
  417. return 1;
  418. }
  419. static void __used kretprobe_trampoline_holder(void)
  420. {
  421. asm volatile(".global kretprobe_trampoline\n"
  422. "kretprobe_trampoline:\n"
  423. "\tnop\n"
  424. "\tnop\n");
  425. }
  426. static struct kprobe trampoline_p = {
  427. .addr = (kprobe_opcode_t *) &kretprobe_trampoline,
  428. .pre_handler = trampoline_probe_handler
  429. };
  430. int __init arch_init_kprobes(void)
  431. {
  432. return register_kprobe(&trampoline_p);
  433. }
  434. int __kprobes arch_trampoline_kprobe(struct kprobe *p)
  435. {
  436. if (p->addr == (kprobe_opcode_t *)&kretprobe_trampoline)
  437. return 1;
  438. return 0;
  439. }