uprobes.c 8.5 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318
  1. // SPDX-License-Identifier: GPL-2.0-or-later
  2. /*
  3. * User-space Probes (UProbes) for sparc
  4. *
  5. * Copyright (C) 2013 Oracle Inc.
  6. *
  7. * Authors:
  8. * Jose E. Marchesi <jose.marchesi@oracle.com>
  9. * Eric Saint Etienne <eric.saint.etienne@oracle.com>
  10. */
  11. #include <linux/kernel.h>
  12. #include <linux/highmem.h>
  13. #include <linux/uprobes.h>
  14. #include <linux/uaccess.h>
  15. #include <linux/sched.h> /* For struct task_struct */
  16. #include <linux/kdebug.h>
  17. #include <asm/cacheflush.h>
  18. /* Compute the address of the breakpoint instruction and return it.
  19. *
  20. * Note that uprobe_get_swbp_addr is defined as a weak symbol in
  21. * kernel/events/uprobe.c.
  22. */
  23. unsigned long uprobe_get_swbp_addr(struct pt_regs *regs)
  24. {
  25. return instruction_pointer(regs);
  26. }
  27. static void copy_to_page(struct page *page, unsigned long vaddr,
  28. const void *src, int len)
  29. {
  30. void *kaddr = kmap_atomic(page);
  31. memcpy(kaddr + (vaddr & ~PAGE_MASK), src, len);
  32. kunmap_atomic(kaddr);
  33. }
  34. /* Fill in the xol area with the probed instruction followed by the
  35. * single-step trap. Some fixups in the copied instruction are
  36. * performed at this point.
  37. *
  38. * Note that uprobe_xol_copy is defined as a weak symbol in
  39. * kernel/events/uprobe.c.
  40. */
  41. void arch_uprobe_copy_ixol(struct page *page, unsigned long vaddr,
  42. void *src, unsigned long len)
  43. {
  44. const u32 stp_insn = UPROBE_STP_INSN;
  45. u32 insn = *(u32 *) src;
  46. /* Branches annulling their delay slot must be fixed to not do
  47. * so. Clearing the annul bit on these instructions we can be
  48. * sure the single-step breakpoint in the XOL slot will be
  49. * executed.
  50. */
  51. u32 op = (insn >> 30) & 0x3;
  52. u32 op2 = (insn >> 22) & 0x7;
  53. if (op == 0 &&
  54. (op2 == 1 || op2 == 2 || op2 == 3 || op2 == 5 || op2 == 6) &&
  55. (insn & ANNUL_BIT) == ANNUL_BIT)
  56. insn &= ~ANNUL_BIT;
  57. copy_to_page(page, vaddr, &insn, len);
  58. copy_to_page(page, vaddr+len, &stp_insn, 4);
  59. }
  60. /* Instruction analysis/validity.
  61. *
  62. * This function returns 0 on success or a -ve number on error.
  63. */
  64. int arch_uprobe_analyze_insn(struct arch_uprobe *auprobe,
  65. struct mm_struct *mm, unsigned long addr)
  66. {
  67. /* Any unsupported instruction? Then return -EINVAL */
  68. return 0;
  69. }
  70. /* If INSN is a relative control transfer instruction, return the
  71. * corrected branch destination value.
  72. *
  73. * Note that regs->tpc and regs->tnpc still hold the values of the
  74. * program counters at the time of the single-step trap due to the
  75. * execution of the UPROBE_STP_INSN at utask->xol_vaddr + 4.
  76. *
  77. */
  78. static unsigned long relbranch_fixup(u32 insn, struct uprobe_task *utask,
  79. struct pt_regs *regs)
  80. {
  81. /* Branch not taken, no mods necessary. */
  82. if (regs->tnpc == regs->tpc + 0x4UL)
  83. return utask->autask.saved_tnpc + 0x4UL;
  84. /* The three cases are call, branch w/prediction,
  85. * and traditional branch.
  86. */
  87. if ((insn & 0xc0000000) == 0x40000000 ||
  88. (insn & 0xc1c00000) == 0x00400000 ||
  89. (insn & 0xc1c00000) == 0x00800000) {
  90. unsigned long real_pc = (unsigned long) utask->vaddr;
  91. unsigned long ixol_addr = utask->xol_vaddr;
  92. /* The instruction did all the work for us
  93. * already, just apply the offset to the correct
  94. * instruction location.
  95. */
  96. return (real_pc + (regs->tnpc - ixol_addr));
  97. }
  98. /* It is jmpl or some other absolute PC modification instruction,
  99. * leave NPC as-is.
  100. */
  101. return regs->tnpc;
  102. }
  103. /* If INSN is an instruction which writes its PC location
  104. * into a destination register, fix that up.
  105. */
  106. static int retpc_fixup(struct pt_regs *regs, u32 insn,
  107. unsigned long real_pc)
  108. {
  109. unsigned long *slot = NULL;
  110. int rc = 0;
  111. /* Simplest case is 'call', which always uses %o7 */
  112. if ((insn & 0xc0000000) == 0x40000000)
  113. slot = &regs->u_regs[UREG_I7];
  114. /* 'jmpl' encodes the register inside of the opcode */
  115. if ((insn & 0xc1f80000) == 0x81c00000) {
  116. unsigned long rd = ((insn >> 25) & 0x1f);
  117. if (rd <= 15) {
  118. slot = &regs->u_regs[rd];
  119. } else {
  120. unsigned long fp = regs->u_regs[UREG_FP];
  121. /* Hard case, it goes onto the stack. */
  122. flushw_all();
  123. rd -= 16;
  124. if (test_thread_64bit_stack(fp)) {
  125. unsigned long __user *uslot =
  126. (unsigned long __user *) (fp + STACK_BIAS) + rd;
  127. rc = __put_user(real_pc, uslot);
  128. } else {
  129. unsigned int __user *uslot = (unsigned int
  130. __user *) fp + rd;
  131. rc = __put_user((u32) real_pc, uslot);
  132. }
  133. }
  134. }
  135. if (slot != NULL)
  136. *slot = real_pc;
  137. return rc;
  138. }
  139. /* Single-stepping can be avoided for certain instructions: NOPs and
  140. * instructions that can be emulated. This function determines
  141. * whether the instruction where the uprobe is installed falls in one
  142. * of these cases and emulates it.
  143. *
  144. * This function returns true if the single-stepping can be skipped,
  145. * false otherwise.
  146. */
  147. bool arch_uprobe_skip_sstep(struct arch_uprobe *auprobe, struct pt_regs *regs)
  148. {
  149. /* We currently only emulate NOP instructions.
  150. */
  151. if (auprobe->ixol == (1 << 24)) {
  152. regs->tnpc += 4;
  153. regs->tpc += 4;
  154. return true;
  155. }
  156. return false;
  157. }
  158. /* Prepare to execute out of line. At this point
  159. * current->utask->xol_vaddr points to an allocated XOL slot properly
  160. * initialized with the original instruction and the single-stepping
  161. * trap instruction.
  162. *
  163. * This function returns 0 on success, any other number on error.
  164. */
  165. int arch_uprobe_pre_xol(struct arch_uprobe *auprobe, struct pt_regs *regs)
  166. {
  167. struct uprobe_task *utask = current->utask;
  168. struct arch_uprobe_task *autask = &current->utask->autask;
  169. /* Save the current program counters so they can be restored
  170. * later.
  171. */
  172. autask->saved_tpc = regs->tpc;
  173. autask->saved_tnpc = regs->tnpc;
  174. /* Adjust PC and NPC so the first instruction in the XOL slot
  175. * will be executed by the user task.
  176. */
  177. instruction_pointer_set(regs, utask->xol_vaddr);
  178. return 0;
  179. }
  180. /* Prepare to resume execution after the single-step. Called after
  181. * single-stepping. To avoid the SMP problems that can occur when we
  182. * temporarily put back the original opcode to single-step, we
  183. * single-stepped a copy of the instruction.
  184. *
  185. * This function returns 0 on success, any other number on error.
  186. */
  187. int arch_uprobe_post_xol(struct arch_uprobe *auprobe, struct pt_regs *regs)
  188. {
  189. struct uprobe_task *utask = current->utask;
  190. struct arch_uprobe_task *autask = &utask->autask;
  191. u32 insn = auprobe->ixol;
  192. int rc = 0;
  193. if (utask->state == UTASK_SSTEP_ACK) {
  194. regs->tnpc = relbranch_fixup(insn, utask, regs);
  195. regs->tpc = autask->saved_tnpc;
  196. rc = retpc_fixup(regs, insn, (unsigned long) utask->vaddr);
  197. } else {
  198. regs->tnpc = utask->vaddr+4;
  199. regs->tpc = autask->saved_tnpc+4;
  200. }
  201. return rc;
  202. }
  203. /* Handler for uprobe traps. This is called from the traps table and
  204. * triggers the proper die notification.
  205. */
  206. asmlinkage void uprobe_trap(struct pt_regs *regs,
  207. unsigned long trap_level)
  208. {
  209. BUG_ON(trap_level != 0x173 && trap_level != 0x174);
  210. /* We are only interested in user-mode code. Uprobe traps
  211. * shall not be present in kernel code.
  212. */
  213. if (!user_mode(regs)) {
  214. local_irq_enable();
  215. bad_trap(regs, trap_level);
  216. return;
  217. }
  218. /* trap_level == 0x173 --> ta 0x73
  219. * trap_level == 0x174 --> ta 0x74
  220. */
  221. if (notify_die((trap_level == 0x173) ? DIE_BPT : DIE_SSTEP,
  222. (trap_level == 0x173) ? "bpt" : "sstep",
  223. regs, 0, trap_level, SIGTRAP) != NOTIFY_STOP)
  224. bad_trap(regs, trap_level);
  225. }
  226. /* Callback routine for handling die notifications.
  227. */
  228. int arch_uprobe_exception_notify(struct notifier_block *self,
  229. unsigned long val, void *data)
  230. {
  231. int ret = NOTIFY_DONE;
  232. struct die_args *args = (struct die_args *)data;
  233. /* We are only interested in userspace traps */
  234. if (args->regs && !user_mode(args->regs))
  235. return NOTIFY_DONE;
  236. switch (val) {
  237. case DIE_BPT:
  238. if (uprobe_pre_sstep_notifier(args->regs))
  239. ret = NOTIFY_STOP;
  240. break;
  241. case DIE_SSTEP:
  242. if (uprobe_post_sstep_notifier(args->regs))
  243. ret = NOTIFY_STOP;
  244. default:
  245. break;
  246. }
  247. return ret;
  248. }
  249. /* This function gets called when a XOL instruction either gets
  250. * trapped or the thread has a fatal signal, so reset the instruction
  251. * pointer to its probed address.
  252. */
  253. void arch_uprobe_abort_xol(struct arch_uprobe *auprobe, struct pt_regs *regs)
  254. {
  255. struct uprobe_task *utask = current->utask;
  256. instruction_pointer_set(regs, utask->vaddr);
  257. }
  258. /* If xol insn itself traps and generates a signal(Say,
  259. * SIGILL/SIGSEGV/etc), then detect the case where a singlestepped
  260. * instruction jumps back to its own address.
  261. */
  262. bool arch_uprobe_xol_was_trapped(struct task_struct *t)
  263. {
  264. return false;
  265. }
  266. unsigned long
  267. arch_uretprobe_hijack_return_addr(unsigned long trampoline_vaddr,
  268. struct pt_regs *regs)
  269. {
  270. unsigned long orig_ret_vaddr = regs->u_regs[UREG_I7];
  271. regs->u_regs[UREG_I7] = trampoline_vaddr-8;
  272. return orig_ret_vaddr + 8;
  273. }