1 /*
2 * User-space Probes (UProbes) for s390
3 *
4 * Copyright IBM Corp. 2014
5 * Author(s): Jan Willeke,
6 */
7
8 #include <linux/uaccess.h>
9 #include <linux/uprobes.h>
10 #include <linux/compat.h>
11 #include <linux/kdebug.h>
12 #include <asm/switch_to.h>
13 #include <asm/facility.h>
14 #include <asm/kprobes.h>
15 #include <asm/dis.h>
16 #include "entry.h"
17
18 #define UPROBE_TRAP_NR UINT_MAX
19
arch_uprobe_analyze_insn(struct arch_uprobe * auprobe,struct mm_struct * mm,unsigned long addr)20 int arch_uprobe_analyze_insn(struct arch_uprobe *auprobe, struct mm_struct *mm,
21 unsigned long addr)
22 {
23 return probe_is_prohibited_opcode(auprobe->insn);
24 }
25
arch_uprobe_pre_xol(struct arch_uprobe * auprobe,struct pt_regs * regs)26 int arch_uprobe_pre_xol(struct arch_uprobe *auprobe, struct pt_regs *regs)
27 {
28 if (psw_bits(regs->psw).eaba == PSW_AMODE_24BIT)
29 return -EINVAL;
30 if (!is_compat_task() && psw_bits(regs->psw).eaba == PSW_AMODE_31BIT)
31 return -EINVAL;
32 clear_pt_regs_flag(regs, PIF_PER_TRAP);
33 auprobe->saved_per = psw_bits(regs->psw).r;
34 auprobe->saved_int_code = regs->int_code;
35 regs->int_code = UPROBE_TRAP_NR;
36 regs->psw.addr = current->utask->xol_vaddr;
37 set_tsk_thread_flag(current, TIF_UPROBE_SINGLESTEP);
38 update_cr_regs(current);
39 return 0;
40 }
41
arch_uprobe_xol_was_trapped(struct task_struct * tsk)42 bool arch_uprobe_xol_was_trapped(struct task_struct *tsk)
43 {
44 struct pt_regs *regs = task_pt_regs(tsk);
45
46 if (regs->int_code != UPROBE_TRAP_NR)
47 return true;
48 return false;
49 }
50
check_per_event(unsigned short cause,unsigned long control,struct pt_regs * regs)51 static int check_per_event(unsigned short cause, unsigned long control,
52 struct pt_regs *regs)
53 {
54 if (!(regs->psw.mask & PSW_MASK_PER))
55 return 0;
56 /* user space single step */
57 if (control == 0)
58 return 1;
59 /* over indication for storage alteration */
60 if ((control & 0x20200000) && (cause & 0x2000))
61 return 1;
62 if (cause & 0x8000) {
63 /* all branches */
64 if ((control & 0x80800000) == 0x80000000)
65 return 1;
66 /* branch into selected range */
67 if (((control & 0x80800000) == 0x80800000) &&
68 regs->psw.addr >= current->thread.per_user.start &&
69 regs->psw.addr <= current->thread.per_user.end)
70 return 1;
71 }
72 return 0;
73 }
74
arch_uprobe_post_xol(struct arch_uprobe * auprobe,struct pt_regs * regs)75 int arch_uprobe_post_xol(struct arch_uprobe *auprobe, struct pt_regs *regs)
76 {
77 int fixup = probe_get_fixup_type(auprobe->insn);
78 struct uprobe_task *utask = current->utask;
79
80 clear_tsk_thread_flag(current, TIF_UPROBE_SINGLESTEP);
81 update_cr_regs(current);
82 psw_bits(regs->psw).r = auprobe->saved_per;
83 regs->int_code = auprobe->saved_int_code;
84
85 if (fixup & FIXUP_PSW_NORMAL)
86 regs->psw.addr += utask->vaddr - utask->xol_vaddr;
87 if (fixup & FIXUP_RETURN_REGISTER) {
88 int reg = (auprobe->insn[0] & 0xf0) >> 4;
89
90 regs->gprs[reg] += utask->vaddr - utask->xol_vaddr;
91 }
92 if (fixup & FIXUP_BRANCH_NOT_TAKEN) {
93 int ilen = insn_length(auprobe->insn[0] >> 8);
94
95 if (regs->psw.addr - utask->xol_vaddr == ilen)
96 regs->psw.addr = utask->vaddr + ilen;
97 }
98 if (check_per_event(current->thread.per_event.cause,
99 current->thread.per_user.control, regs)) {
100 /* fix per address */
101 current->thread.per_event.address = utask->vaddr;
102 /* trigger per event */
103 set_pt_regs_flag(regs, PIF_PER_TRAP);
104 }
105 return 0;
106 }
107
arch_uprobe_exception_notify(struct notifier_block * self,unsigned long val,void * data)108 int arch_uprobe_exception_notify(struct notifier_block *self, unsigned long val,
109 void *data)
110 {
111 struct die_args *args = data;
112 struct pt_regs *regs = args->regs;
113
114 if (!user_mode(regs))
115 return NOTIFY_DONE;
116 if (regs->int_code & 0x200) /* Trap during transaction */
117 return NOTIFY_DONE;
118 switch (val) {
119 case DIE_BPT:
120 if (uprobe_pre_sstep_notifier(regs))
121 return NOTIFY_STOP;
122 break;
123 case DIE_SSTEP:
124 if (uprobe_post_sstep_notifier(regs))
125 return NOTIFY_STOP;
126 default:
127 break;
128 }
129 return NOTIFY_DONE;
130 }
131
arch_uprobe_abort_xol(struct arch_uprobe * auprobe,struct pt_regs * regs)132 void arch_uprobe_abort_xol(struct arch_uprobe *auprobe, struct pt_regs *regs)
133 {
134 clear_thread_flag(TIF_UPROBE_SINGLESTEP);
135 regs->int_code = auprobe->saved_int_code;
136 regs->psw.addr = current->utask->vaddr;
137 current->thread.per_event.address = current->utask->vaddr;
138 }
139
arch_uretprobe_hijack_return_addr(unsigned long trampoline,struct pt_regs * regs)140 unsigned long arch_uretprobe_hijack_return_addr(unsigned long trampoline,
141 struct pt_regs *regs)
142 {
143 unsigned long orig;
144
145 orig = regs->gprs[14];
146 regs->gprs[14] = trampoline;
147 return orig;
148 }
149
arch_uretprobe_is_alive(struct return_instance * ret,enum rp_check ctx,struct pt_regs * regs)150 bool arch_uretprobe_is_alive(struct return_instance *ret, enum rp_check ctx,
151 struct pt_regs *regs)
152 {
153 if (ctx == RP_CHECK_CHAIN_CALL)
154 return user_stack_pointer(regs) <= ret->stack;
155 else
156 return user_stack_pointer(regs) < ret->stack;
157 }
158
159 /* Instruction Emulation */
160
adjust_psw_addr(psw_t * psw,unsigned long len)161 static void adjust_psw_addr(psw_t *psw, unsigned long len)
162 {
163 psw->addr = __rewind_psw(*psw, -len);
164 }
165
166 #define EMU_ILLEGAL_OP 1
167 #define EMU_SPECIFICATION 2
168 #define EMU_ADDRESSING 3
169
170 #define emu_load_ril(ptr, output) \
171 ({ \
172 unsigned int mask = sizeof(*(ptr)) - 1; \
173 __typeof__(*(ptr)) input; \
174 int __rc = 0; \
175 \
176 if (!test_facility(34)) \
177 __rc = EMU_ILLEGAL_OP; \
178 else if ((u64 __force)ptr & mask) \
179 __rc = EMU_SPECIFICATION; \
180 else if (get_user(input, ptr)) \
181 __rc = EMU_ADDRESSING; \
182 else \
183 *(output) = input; \
184 __rc; \
185 })
186
187 #define emu_store_ril(regs, ptr, input) \
188 ({ \
189 unsigned int mask = sizeof(*(ptr)) - 1; \
190 __typeof__(ptr) __ptr = (ptr); \
191 int __rc = 0; \
192 \
193 if (!test_facility(34)) \
194 __rc = EMU_ILLEGAL_OP; \
195 else if ((u64 __force)__ptr & mask) \
196 __rc = EMU_SPECIFICATION; \
197 else if (put_user(*(input), __ptr)) \
198 __rc = EMU_ADDRESSING; \
199 if (__rc == 0) \
200 sim_stor_event(regs, \
201 (void __force *)__ptr, \
202 mask + 1); \
203 __rc; \
204 })
205
206 #define emu_cmp_ril(regs, ptr, cmp) \
207 ({ \
208 unsigned int mask = sizeof(*(ptr)) - 1; \
209 __typeof__(*(ptr)) input; \
210 int __rc = 0; \
211 \
212 if (!test_facility(34)) \
213 __rc = EMU_ILLEGAL_OP; \
214 else if ((u64 __force)ptr & mask) \
215 __rc = EMU_SPECIFICATION; \
216 else if (get_user(input, ptr)) \
217 __rc = EMU_ADDRESSING; \
218 else if (input > *(cmp)) \
219 psw_bits((regs)->psw).cc = 1; \
220 else if (input < *(cmp)) \
221 psw_bits((regs)->psw).cc = 2; \
222 else \
223 psw_bits((regs)->psw).cc = 0; \
224 __rc; \
225 })
226
227 struct insn_ril {
228 u8 opc0;
229 u8 reg : 4;
230 u8 opc1 : 4;
231 s32 disp;
232 } __packed;
233
234 union split_register {
235 u64 u64;
236 u32 u32[2];
237 u16 u16[4];
238 s64 s64;
239 s32 s32[2];
240 s16 s16[4];
241 };
242
243 /*
244 * If user per registers are setup to trace storage alterations and an
245 * emulated store took place on a fitting address a user trap is generated.
246 */
sim_stor_event(struct pt_regs * regs,void * addr,int len)247 static void sim_stor_event(struct pt_regs *regs, void *addr, int len)
248 {
249 if (!(regs->psw.mask & PSW_MASK_PER))
250 return;
251 if (!(current->thread.per_user.control & PER_EVENT_STORE))
252 return;
253 if ((void *)current->thread.per_user.start > (addr + len))
254 return;
255 if ((void *)current->thread.per_user.end < addr)
256 return;
257 current->thread.per_event.address = regs->psw.addr;
258 current->thread.per_event.cause = PER_EVENT_STORE >> 16;
259 set_pt_regs_flag(regs, PIF_PER_TRAP);
260 }
261
262 /*
263 * pc relative instructions are emulated, since parameters may not be
264 * accessible from the xol area due to range limitations.
265 */
handle_insn_ril(struct arch_uprobe * auprobe,struct pt_regs * regs)266 static void handle_insn_ril(struct arch_uprobe *auprobe, struct pt_regs *regs)
267 {
268 union split_register *rx;
269 struct insn_ril *insn;
270 unsigned int ilen;
271 void *uptr;
272 int rc = 0;
273
274 insn = (struct insn_ril *) &auprobe->insn;
275 rx = (union split_register *) ®s->gprs[insn->reg];
276 uptr = (void *)(regs->psw.addr + (insn->disp * 2));
277 ilen = insn_length(insn->opc0);
278
279 switch (insn->opc0) {
280 case 0xc0:
281 switch (insn->opc1) {
282 case 0x00: /* larl */
283 rx->u64 = (unsigned long)uptr;
284 break;
285 }
286 break;
287 case 0xc4:
288 switch (insn->opc1) {
289 case 0x02: /* llhrl */
290 rc = emu_load_ril((u16 __user *)uptr, &rx->u32[1]);
291 break;
292 case 0x04: /* lghrl */
293 rc = emu_load_ril((s16 __user *)uptr, &rx->u64);
294 break;
295 case 0x05: /* lhrl */
296 rc = emu_load_ril((s16 __user *)uptr, &rx->u32[1]);
297 break;
298 case 0x06: /* llghrl */
299 rc = emu_load_ril((u16 __user *)uptr, &rx->u64);
300 break;
301 case 0x08: /* lgrl */
302 rc = emu_load_ril((u64 __user *)uptr, &rx->u64);
303 break;
304 case 0x0c: /* lgfrl */
305 rc = emu_load_ril((s32 __user *)uptr, &rx->u64);
306 break;
307 case 0x0d: /* lrl */
308 rc = emu_load_ril((u32 __user *)uptr, &rx->u32[1]);
309 break;
310 case 0x0e: /* llgfrl */
311 rc = emu_load_ril((u32 __user *)uptr, &rx->u64);
312 break;
313 case 0x07: /* sthrl */
314 rc = emu_store_ril(regs, (u16 __user *)uptr, &rx->u16[3]);
315 break;
316 case 0x0b: /* stgrl */
317 rc = emu_store_ril(regs, (u64 __user *)uptr, &rx->u64);
318 break;
319 case 0x0f: /* strl */
320 rc = emu_store_ril(regs, (u32 __user *)uptr, &rx->u32[1]);
321 break;
322 }
323 break;
324 case 0xc6:
325 switch (insn->opc1) {
326 case 0x02: /* pfdrl */
327 if (!test_facility(34))
328 rc = EMU_ILLEGAL_OP;
329 break;
330 case 0x04: /* cghrl */
331 rc = emu_cmp_ril(regs, (s16 __user *)uptr, &rx->s64);
332 break;
333 case 0x05: /* chrl */
334 rc = emu_cmp_ril(regs, (s16 __user *)uptr, &rx->s32[1]);
335 break;
336 case 0x06: /* clghrl */
337 rc = emu_cmp_ril(regs, (u16 __user *)uptr, &rx->u64);
338 break;
339 case 0x07: /* clhrl */
340 rc = emu_cmp_ril(regs, (u16 __user *)uptr, &rx->u32[1]);
341 break;
342 case 0x08: /* cgrl */
343 rc = emu_cmp_ril(regs, (s64 __user *)uptr, &rx->s64);
344 break;
345 case 0x0a: /* clgrl */
346 rc = emu_cmp_ril(regs, (u64 __user *)uptr, &rx->u64);
347 break;
348 case 0x0c: /* cgfrl */
349 rc = emu_cmp_ril(regs, (s32 __user *)uptr, &rx->s64);
350 break;
351 case 0x0d: /* crl */
352 rc = emu_cmp_ril(regs, (s32 __user *)uptr, &rx->s32[1]);
353 break;
354 case 0x0e: /* clgfrl */
355 rc = emu_cmp_ril(regs, (u32 __user *)uptr, &rx->u64);
356 break;
357 case 0x0f: /* clrl */
358 rc = emu_cmp_ril(regs, (u32 __user *)uptr, &rx->u32[1]);
359 break;
360 }
361 break;
362 }
363 adjust_psw_addr(®s->psw, ilen);
364 switch (rc) {
365 case EMU_ILLEGAL_OP:
366 regs->int_code = ilen << 16 | 0x0001;
367 do_report_trap(regs, SIGILL, ILL_ILLOPC, NULL);
368 break;
369 case EMU_SPECIFICATION:
370 regs->int_code = ilen << 16 | 0x0006;
371 do_report_trap(regs, SIGILL, ILL_ILLOPC , NULL);
372 break;
373 case EMU_ADDRESSING:
374 regs->int_code = ilen << 16 | 0x0005;
375 do_report_trap(regs, SIGSEGV, SEGV_MAPERR, NULL);
376 break;
377 }
378 }
379
arch_uprobe_skip_sstep(struct arch_uprobe * auprobe,struct pt_regs * regs)380 bool arch_uprobe_skip_sstep(struct arch_uprobe *auprobe, struct pt_regs *regs)
381 {
382 if ((psw_bits(regs->psw).eaba == PSW_AMODE_24BIT) ||
383 ((psw_bits(regs->psw).eaba == PSW_AMODE_31BIT) &&
384 !is_compat_task())) {
385 regs->psw.addr = __rewind_psw(regs->psw, UPROBE_SWBP_INSN_SIZE);
386 do_report_trap(regs, SIGILL, ILL_ILLADR, NULL);
387 return true;
388 }
389 if (probe_is_insn_relative_long(auprobe->insn)) {
390 handle_insn_ril(auprobe, regs);
391 return true;
392 }
393 return false;
394 }
395