1 #include <linux/highmem.h>
2 #include <linux/kdebug.h>
3 #include <linux/types.h>
4 #include <linux/notifier.h>
5 #include <linux/sched.h>
6 #include <linux/uprobes.h>
7
8 #include <asm/branch.h>
9 #include <asm/cpu-features.h>
10 #include <asm/ptrace.h>
11 #include <asm/inst.h>
12
insn_has_delay_slot(const union mips_instruction insn)13 static inline int insn_has_delay_slot(const union mips_instruction insn)
14 {
15 switch (insn.i_format.opcode) {
16 /*
17 * jr and jalr are in r_format format.
18 */
19 case spec_op:
20 switch (insn.r_format.func) {
21 case jalr_op:
22 case jr_op:
23 return 1;
24 }
25 break;
26
27 /*
28 * This group contains:
29 * bltz_op, bgez_op, bltzl_op, bgezl_op,
30 * bltzal_op, bgezal_op, bltzall_op, bgezall_op.
31 */
32 case bcond_op:
33 switch (insn.i_format.rt) {
34 case bltz_op:
35 case bltzl_op:
36 case bgez_op:
37 case bgezl_op:
38 case bltzal_op:
39 case bltzall_op:
40 case bgezal_op:
41 case bgezall_op:
42 case bposge32_op:
43 return 1;
44 }
45 break;
46
47 /*
48 * These are unconditional and in j_format.
49 */
50 case jal_op:
51 case j_op:
52 case beq_op:
53 case beql_op:
54 case bne_op:
55 case bnel_op:
56 case blez_op: /* not really i_format */
57 case blezl_op:
58 case bgtz_op:
59 case bgtzl_op:
60 return 1;
61
62 /*
63 * And now the FPA/cp1 branch instructions.
64 */
65 case cop1_op:
66 #ifdef CONFIG_CPU_CAVIUM_OCTEON
67 case lwc2_op: /* This is bbit0 on Octeon */
68 case ldc2_op: /* This is bbit032 on Octeon */
69 case swc2_op: /* This is bbit1 on Octeon */
70 case sdc2_op: /* This is bbit132 on Octeon */
71 #endif
72 return 1;
73 }
74
75 return 0;
76 }
77
78 /**
79 * arch_uprobe_analyze_insn - instruction analysis including validity and fixups.
80 * @mm: the probed address space.
81 * @arch_uprobe: the probepoint information.
82 * @addr: virtual address at which to install the probepoint
83 * Return 0 on success or a -ve number on error.
84 */
arch_uprobe_analyze_insn(struct arch_uprobe * aup,struct mm_struct * mm,unsigned long addr)85 int arch_uprobe_analyze_insn(struct arch_uprobe *aup,
86 struct mm_struct *mm, unsigned long addr)
87 {
88 union mips_instruction inst;
89
90 /*
91 * For the time being this also blocks attempts to use uprobes with
92 * MIPS16 and microMIPS.
93 */
94 if (addr & 0x03)
95 return -EINVAL;
96
97 inst.word = aup->insn[0];
98 aup->ixol[0] = aup->insn[insn_has_delay_slot(inst)];
99 aup->ixol[1] = UPROBE_BRK_UPROBE_XOL; /* NOP */
100
101 return 0;
102 }
103
104 /**
105 * is_trap_insn - check if the instruction is a trap variant
106 * @insn: instruction to be checked.
107 * Returns true if @insn is a trap variant.
108 *
109 * This definition overrides the weak definition in kernel/events/uprobes.c.
110 * and is needed for the case where an architecture has multiple trap
111 * instructions (like PowerPC or MIPS). We treat BREAK just like the more
112 * modern conditional trap instructions.
113 */
is_trap_insn(uprobe_opcode_t * insn)114 bool is_trap_insn(uprobe_opcode_t *insn)
115 {
116 union mips_instruction inst;
117
118 inst.word = *insn;
119
120 switch (inst.i_format.opcode) {
121 case spec_op:
122 switch (inst.r_format.func) {
123 case break_op:
124 case teq_op:
125 case tge_op:
126 case tgeu_op:
127 case tlt_op:
128 case tltu_op:
129 case tne_op:
130 return 1;
131 }
132 break;
133
134 case bcond_op: /* Yes, really ... */
135 switch (inst.u_format.rt) {
136 case teqi_op:
137 case tgei_op:
138 case tgeiu_op:
139 case tlti_op:
140 case tltiu_op:
141 case tnei_op:
142 return 1;
143 }
144 break;
145 }
146
147 return 0;
148 }
149
150 #define UPROBE_TRAP_NR ULONG_MAX
151
152 /*
153 * arch_uprobe_pre_xol - prepare to execute out of line.
154 * @auprobe: the probepoint information.
155 * @regs: reflects the saved user state of current task.
156 */
arch_uprobe_pre_xol(struct arch_uprobe * aup,struct pt_regs * regs)157 int arch_uprobe_pre_xol(struct arch_uprobe *aup, struct pt_regs *regs)
158 {
159 struct uprobe_task *utask = current->utask;
160
161 /*
162 * Now find the EPC where to resume after the breakpoint has been
163 * dealt with. This may require emulation of a branch.
164 */
165 aup->resume_epc = regs->cp0_epc + 4;
166 if (insn_has_delay_slot((union mips_instruction) aup->insn[0])) {
167 __compute_return_epc_for_insn(regs,
168 (union mips_instruction) aup->insn[0]);
169 aup->resume_epc = regs->cp0_epc;
170 }
171 utask->autask.saved_trap_nr = current->thread.trap_nr;
172 current->thread.trap_nr = UPROBE_TRAP_NR;
173 regs->cp0_epc = current->utask->xol_vaddr;
174
175 return 0;
176 }
177
arch_uprobe_post_xol(struct arch_uprobe * aup,struct pt_regs * regs)178 int arch_uprobe_post_xol(struct arch_uprobe *aup, struct pt_regs *regs)
179 {
180 struct uprobe_task *utask = current->utask;
181
182 current->thread.trap_nr = utask->autask.saved_trap_nr;
183 regs->cp0_epc = aup->resume_epc;
184
185 return 0;
186 }
187
188 /*
189 * If xol insn itself traps and generates a signal(Say,
190 * SIGILL/SIGSEGV/etc), then detect the case where a singlestepped
191 * instruction jumps back to its own address. It is assumed that anything
192 * like do_page_fault/do_trap/etc sets thread.trap_nr != -1.
193 *
194 * arch_uprobe_pre_xol/arch_uprobe_post_xol save/restore thread.trap_nr,
195 * arch_uprobe_xol_was_trapped() simply checks that ->trap_nr is not equal to
196 * UPROBE_TRAP_NR == -1 set by arch_uprobe_pre_xol().
197 */
arch_uprobe_xol_was_trapped(struct task_struct * tsk)198 bool arch_uprobe_xol_was_trapped(struct task_struct *tsk)
199 {
200 if (tsk->thread.trap_nr != UPROBE_TRAP_NR)
201 return true;
202
203 return false;
204 }
205
arch_uprobe_exception_notify(struct notifier_block * self,unsigned long val,void * data)206 int arch_uprobe_exception_notify(struct notifier_block *self,
207 unsigned long val, void *data)
208 {
209 struct die_args *args = data;
210 struct pt_regs *regs = args->regs;
211
212 /* regs == NULL is a kernel bug */
213 if (WARN_ON(!regs))
214 return NOTIFY_DONE;
215
216 /* We are only interested in userspace traps */
217 if (!user_mode(regs))
218 return NOTIFY_DONE;
219
220 switch (val) {
221 case DIE_BREAK:
222 if (uprobe_pre_sstep_notifier(regs))
223 return NOTIFY_STOP;
224 break;
225 case DIE_UPROBE_XOL:
226 if (uprobe_post_sstep_notifier(regs))
227 return NOTIFY_STOP;
228 default:
229 break;
230 }
231
232 return 0;
233 }
234
235 /*
236 * This function gets called when XOL instruction either gets trapped or
237 * the thread has a fatal signal. Reset the instruction pointer to its
238 * probed address for the potential restart or for post mortem analysis.
239 */
arch_uprobe_abort_xol(struct arch_uprobe * aup,struct pt_regs * regs)240 void arch_uprobe_abort_xol(struct arch_uprobe *aup,
241 struct pt_regs *regs)
242 {
243 struct uprobe_task *utask = current->utask;
244
245 instruction_pointer_set(regs, utask->vaddr);
246 }
247
arch_uretprobe_hijack_return_addr(unsigned long trampoline_vaddr,struct pt_regs * regs)248 unsigned long arch_uretprobe_hijack_return_addr(
249 unsigned long trampoline_vaddr, struct pt_regs *regs)
250 {
251 unsigned long ra;
252
253 ra = regs->regs[31];
254
255 /* Replace the return address with the trampoline address */
256 regs->regs[31] = trampoline_vaddr;
257
258 return ra;
259 }
260
261 /**
262 * set_swbp - store breakpoint at a given address.
263 * @auprobe: arch specific probepoint information.
264 * @mm: the probed process address space.
265 * @vaddr: the virtual address to insert the opcode.
266 *
267 * For mm @mm, store the breakpoint instruction at @vaddr.
268 * Return 0 (success) or a negative errno.
269 *
270 * This version overrides the weak version in kernel/events/uprobes.c.
271 * It is required to handle MIPS16 and microMIPS.
272 */
set_swbp(struct arch_uprobe * auprobe,struct mm_struct * mm,unsigned long vaddr)273 int __weak set_swbp(struct arch_uprobe *auprobe, struct mm_struct *mm,
274 unsigned long vaddr)
275 {
276 return uprobe_write_opcode(mm, vaddr, UPROBE_SWBP_INSN);
277 }
278
arch_uprobe_copy_ixol(struct page * page,unsigned long vaddr,void * src,unsigned long len)279 void __weak arch_uprobe_copy_ixol(struct page *page, unsigned long vaddr,
280 void *src, unsigned long len)
281 {
282 void *kaddr;
283
284 /* Initialize the slot */
285 kaddr = kmap_atomic(page);
286 memcpy(kaddr + (vaddr & ~PAGE_MASK), src, len);
287 kunmap_atomic(kaddr);
288
289 /*
290 * The MIPS version of flush_icache_range will operate safely on
291 * user space addresses and more importantly, it doesn't require a
292 * VMA argument.
293 */
294 flush_icache_range(vaddr, vaddr + len);
295 }
296
297 /**
298 * uprobe_get_swbp_addr - compute address of swbp given post-swbp regs
299 * @regs: Reflects the saved state of the task after it has hit a breakpoint
300 * instruction.
301 * Return the address of the breakpoint instruction.
302 *
303 * This overrides the weak version in kernel/events/uprobes.c.
304 */
uprobe_get_swbp_addr(struct pt_regs * regs)305 unsigned long uprobe_get_swbp_addr(struct pt_regs *regs)
306 {
307 return instruction_pointer(regs);
308 }
309
310 /*
311 * See if the instruction can be emulated.
312 * Returns true if instruction was emulated, false otherwise.
313 *
314 * For now we always emulate so this function just returns 0.
315 */
arch_uprobe_skip_sstep(struct arch_uprobe * auprobe,struct pt_regs * regs)316 bool arch_uprobe_skip_sstep(struct arch_uprobe *auprobe, struct pt_regs *regs)
317 {
318 return 0;
319 }
320