[mirror_ubuntu-artful-kernel.git] / arch / mips / kernel / uprobes.c

#include <linux/highmem.h>
#include <linux/kdebug.h>
#include <linux/types.h>
#include <linux/notifier.h>
#include <linux/sched.h>
#include <linux/uprobes.h>

#include <asm/branch.h>
#include <asm/cpu-features.h>
#include <asm/ptrace.h>
#include <asm/inst.h>

static inline int insn_has_delay_slot(const union mips_instruction insn)
{
	switch (insn.i_format.opcode) {
	/*
	 * jr and jalr are in r_format format.
	 */
	case spec_op:
		switch (insn.r_format.func) {
		case jalr_op:
		case jr_op:
			return 1;
		}
		break;

	/*
	 * This group contains:
	 * bltz_op, bgez_op, bltzl_op, bgezl_op,
	 * bltzal_op, bgezal_op, bltzall_op, bgezall_op.
	 */
	case bcond_op:
		switch (insn.i_format.rt) {
		case bltz_op:
		case bltzl_op:
		case bgez_op:
		case bgezl_op:
		case bltzal_op:
		case bltzall_op:
		case bgezal_op:
		case bgezall_op:
		case bposge32_op:
			return 1;
		}
		break;

	/*
	 * These are unconditional and in j_format.
	 */
	case jal_op:
	case j_op:
	case beq_op:
	case beql_op:
	case bne_op:
	case bnel_op:
	case blez_op: /* not really i_format */
	case blezl_op:
	case bgtz_op:
	case bgtzl_op:
		return 1;

	/*
	 * And now the FPA/cp1 branch instructions.
	 */
	case cop1_op:
#ifdef CONFIG_CPU_CAVIUM_OCTEON
	case lwc2_op: /* This is bbit0 on Octeon */
	case ldc2_op: /* This is bbit032 on Octeon */
	case swc2_op: /* This is bbit1 on Octeon */
	case sdc2_op: /* This is bbit132 on Octeon */
#endif
		return 1;
	}

	return 0;
}

/**
 * arch_uprobe_analyze_insn - instruction analysis including validity and fixups.
 * @mm: the probed address space.
 * @arch_uprobe: the probepoint information.
 * @addr: virtual address at which to install the probepoint
 * Return 0 on success or a -ve number on error.
 */
int arch_uprobe_analyze_insn(struct arch_uprobe *aup,
	struct mm_struct *mm, unsigned long addr)
{
	union mips_instruction inst;

	/*
	 * For the time being this also blocks attempts to use uprobes with
	 * MIPS16 and microMIPS.
	 */
	if (addr & 0x03)
		return -EINVAL;

	inst.word = aup->insn[0];
	aup->ixol[0] = aup->insn[insn_has_delay_slot(inst)];
	aup->ixol[1] = UPROBE_BRK_UPROBE_XOL;		/* NOP  */

	return 0;
}

/**
 * is_trap_insn - check if the instruction is a trap variant
 * @insn: instruction to be checked.
 * Returns true if @insn is a trap variant.
 *
 * This definition overrides the weak definition in kernel/events/uprobes.c.
 * and is needed for the case where an architecture has multiple trap
 * instructions (like PowerPC or MIPS).  We treat BREAK just like the more
 * modern conditional trap instructions.
 */
bool is_trap_insn(uprobe_opcode_t *insn)
{
	union mips_instruction inst;

	inst.word = *insn;

	switch (inst.i_format.opcode) {
	case spec_op:
		switch (inst.r_format.func) {
		case break_op:
		case teq_op:
		case tge_op:
		case tgeu_op:
		case tlt_op:
		case tltu_op:
		case tne_op:
			return 1;
		}
		break;

	case bcond_op:	/* Yes, really ...  */
		switch (inst.u_format.rt) {
		case teqi_op:
		case tgei_op:
		case tgeiu_op:
		case tlti_op:
		case tltiu_op:
		case tnei_op:
			return 1;
		}
		break;
	}

	return 0;
}

#define UPROBE_TRAP_NR	ULONG_MAX

/*
 * arch_uprobe_pre_xol - prepare to execute out of line.
 * @auprobe: the probepoint information.
 * @regs: reflects the saved user state of current task.
 */
int arch_uprobe_pre_xol(struct arch_uprobe *aup, struct pt_regs *regs)
{
	struct uprobe_task *utask = current->utask;

	/*
	 * Now find the EPC where to resume after the breakpoint has been
	 * dealt with.  This may require emulation of a branch.
	 */
	aup->resume_epc = regs->cp0_epc + 4;
	if (insn_has_delay_slot((union mips_instruction) aup->insn[0])) {
		unsigned long epc;

		epc = regs->cp0_epc;
		__compute_return_epc_for_insn(regs,
			(union mips_instruction) aup->insn[0]);
		aup->resume_epc = regs->cp0_epc;
	}
	utask->autask.saved_trap_nr = current->thread.trap_nr;
	current->thread.trap_nr = UPROBE_TRAP_NR;
	regs->cp0_epc = current->utask->xol_vaddr;

	return 0;
}

int arch_uprobe_post_xol(struct arch_uprobe *aup, struct pt_regs *regs)
{
	struct uprobe_task *utask = current->utask;

	current->thread.trap_nr = utask->autask.saved_trap_nr;
	regs->cp0_epc = aup->resume_epc;

	return 0;
}

/*
 * If xol insn itself traps and generates a signal(Say,
 * SIGILL/SIGSEGV/etc), then detect the case where a singlestepped
 * instruction jumps back to its own address. It is assumed that anything
 * like do_page_fault/do_trap/etc sets thread.trap_nr != -1.
 *
 * arch_uprobe_pre_xol/arch_uprobe_post_xol save/restore thread.trap_nr,
 * arch_uprobe_xol_was_trapped() simply checks that ->trap_nr is not equal to
 * UPROBE_TRAP_NR == -1 set by arch_uprobe_pre_xol().
 */
bool arch_uprobe_xol_was_trapped(struct task_struct *tsk)
{
	if (tsk->thread.trap_nr != UPROBE_TRAP_NR)
		return true;

	return false;
}

int arch_uprobe_exception_notify(struct notifier_block *self,
	unsigned long val, void *data)
{
	struct die_args *args = data;
	struct pt_regs *regs = args->regs;

	/* regs == NULL is a kernel bug */
	if (WARN_ON(!regs))
		return NOTIFY_DONE;

	/* We are only interested in userspace traps */
	if (!user_mode(regs))
		return NOTIFY_DONE;

	switch (val) {
	case DIE_UPROBE:
		if (uprobe_pre_sstep_notifier(regs))
			return NOTIFY_STOP;
		break;
	case DIE_UPROBE_XOL:
		if (uprobe_post_sstep_notifier(regs))
			return NOTIFY_STOP;
	default:
		break;
	}

	return 0;
}

/*
 * This function gets called when XOL instruction either gets trapped or
 * the thread has a fatal signal. Reset the instruction pointer to its
 * probed address for the potential restart or for post mortem analysis.
 */
void arch_uprobe_abort_xol(struct arch_uprobe *aup,
	struct pt_regs *regs)
{
	struct uprobe_task *utask = current->utask;

	instruction_pointer_set(regs, utask->vaddr);
}

unsigned long arch_uretprobe_hijack_return_addr(
	unsigned long trampoline_vaddr, struct pt_regs *regs)
{
	unsigned long ra;

	ra = regs->regs[31];

	/* Replace the return address with the trampoline address */
	regs->regs[31] = trampoline_vaddr;

	return ra;
}

/**
 * set_swbp - store breakpoint at a given address.
 * @auprobe: arch specific probepoint information.
 * @mm: the probed process address space.
 * @vaddr: the virtual address to insert the opcode.
 *
 * For mm @mm, store the breakpoint instruction at @vaddr.
 * Return 0 (success) or a negative errno.
 *
 * This version overrides the weak version in kernel/events/uprobes.c.
 * It is required to handle MIPS16 and microMIPS.
 */
int __weak set_swbp(struct arch_uprobe *auprobe, struct mm_struct *mm,
	unsigned long vaddr)
{
	return uprobe_write_opcode(mm, vaddr, UPROBE_SWBP_INSN);
}

void __weak arch_uprobe_copy_ixol(struct page *page, unsigned long vaddr,
				  void *src, unsigned long len)
{
	unsigned long kaddr, kstart;

	/* Initialize the slot */
	kaddr = (unsigned long)kmap_atomic(page);
	kstart = kaddr + (vaddr & ~PAGE_MASK);
	memcpy((void *)kstart, src, len);
	flush_icache_range(kstart, kstart + len);
	kunmap_atomic((void *)kaddr);
}

/**
 * uprobe_get_swbp_addr - compute address of swbp given post-swbp regs
 * @regs: Reflects the saved state of the task after it has hit a breakpoint
 * instruction.
 * Return the address of the breakpoint instruction.
 *
 * This overrides the weak version in kernel/events/uprobes.c.
 */
unsigned long uprobe_get_swbp_addr(struct pt_regs *regs)
{
	return instruction_pointer(regs);
}

/*
 * See if the instruction can be emulated.
 * Returns true if instruction was emulated, false otherwise.
 *
 * For now we always emulate so this function just returns 0.
 */
bool arch_uprobe_skip_sstep(struct arch_uprobe *auprobe, struct pt_regs *regs)
{
	return 0;
}
Commit	Line	Data
40e084a5 RB	1	#include <linux/highmem.h>
	2	#include <linux/kdebug.h>
	3	#include <linux/types.h>
	4	#include <linux/notifier.h>
	5	#include <linux/sched.h>
	6	#include <linux/uprobes.h>
	7
	8	#include <asm/branch.h>
	9	#include <asm/cpu-features.h>
	10	#include <asm/ptrace.h>
	11	#include <asm/inst.h>
	12
	13	static inline int insn_has_delay_slot(const union mips_instruction insn)
	14	{
	15	switch (insn.i_format.opcode) {
	16	/*
	17	* jr and jalr are in r_format format.
	18	*/
	19	case spec_op:
	20	switch (insn.r_format.func) {
	21	case jalr_op:
	22	case jr_op:
	23	return 1;
	24	}
	25	break;
	26
	27	/*
	28	* This group contains:
	29	* bltz_op, bgez_op, bltzl_op, bgezl_op,
	30	* bltzal_op, bgezal_op, bltzall_op, bgezall_op.
	31	*/
	32	case bcond_op:
	33	switch (insn.i_format.rt) {
	34	case bltz_op:
	35	case bltzl_op:
	36	case bgez_op:
	37	case bgezl_op:
	38	case bltzal_op:
	39	case bltzall_op:
	40	case bgezal_op:
	41	case bgezall_op:
	42	case bposge32_op:
	43	return 1;
	44	}
	45	break;
	46
	47	/*
	48	* These are unconditional and in j_format.
	49	*/
	50	case jal_op:
	51	case j_op:
	52	case beq_op:
	53	case beql_op:
	54	case bne_op:
	55	case bnel_op:
	56	case blez_op: /* not really i_format */
	57	case blezl_op:
	58	case bgtz_op:
	59	case bgtzl_op:
	60	return 1;
	61
	62	/*
	63	* And now the FPA/cp1 branch instructions.
	64	*/
65	case cop1_op:
66	#ifdef CONFIG_CPU_CAVIUM_OCTEON
67	case lwc2_op: /* This is bbit0 on Octeon */
68	case ldc2_op: /* This is bbit032 on Octeon */
69	case swc2_op: /* This is bbit1 on Octeon */
70	case sdc2_op: /* This is bbit132 on Octeon */
71	#endif
72	return 1;
73	}
74
75	return 0;
76	}
77
78	/**
79	* arch_uprobe_analyze_insn - instruction analysis including validity and fixups.
80	* @mm: the probed address space.
81	* @arch_uprobe: the probepoint information.
82	* @addr: virtual address at which to install the probepoint
83	* Return 0 on success or a -ve number on error.
84	*/
85	int arch_uprobe_analyze_insn(struct arch_uprobe *aup,
86	struct mm_struct *mm, unsigned long addr)
87	{
88	union mips_instruction inst;
89
90	/*
91	* For the time being this also blocks attempts to use uprobes with
92	* MIPS16 and microMIPS.
93	*/
94	if (addr & 0x03)
95	return -EINVAL;
96
97	inst.word = aup->insn[0];
98	aup->ixol[0] = aup->insn[insn_has_delay_slot(inst)];
99	aup->ixol[1] = UPROBE_BRK_UPROBE_XOL; /* NOP */
100
101	return 0;
102	}
103
104	/**
105	* is_trap_insn - check if the instruction is a trap variant
106	* @insn: instruction to be checked.
107	* Returns true if @insn is a trap variant.
108	*
109	* This definition overrides the weak definition in kernel/events/uprobes.c.
110	* and is needed for the case where an architecture has multiple trap
111	* instructions (like PowerPC or MIPS). We treat BREAK just like the more
112	* modern conditional trap instructions.
113	*/
114	bool is_trap_insn(uprobe_opcode_t *insn)
115	{
116	union mips_instruction inst;
117
118	inst.word = *insn;
119
120	switch (inst.i_format.opcode) {
121	case spec_op:
122	switch (inst.r_format.func) {
123	case break_op:
124	case teq_op:
125	case tge_op:
126	case tgeu_op:
127	case tlt_op:
128	case tltu_op:
129	case tne_op:
130	return 1;
131	}
132	break;
133
134	case bcond_op: /* Yes, really ... */
135	switch (inst.u_format.rt) {
136	case teqi_op:
137	case tgei_op:
138	case tgeiu_op:
139	case tlti_op:
140	case tltiu_op:
141	case tnei_op:
142	return 1;
143	}
144	break;
145	}
146
147	return 0;
148	}
149
150	#define UPROBE_TRAP_NR ULONG_MAX
151
152	/*
153	* arch_uprobe_pre_xol - prepare to execute out of line.
154	* @auprobe: the probepoint information.
155	* @regs: reflects the saved user state of current task.
156	*/
157	int arch_uprobe_pre_xol(struct arch_uprobe aup, struct pt_regs regs)
158	{
159	struct uprobe_task *utask = current->utask;
40e084a5 RB	160
	161	/*
	162	* Now find the EPC where to resume after the breakpoint has been
	163	* dealt with. This may require emulation of a branch.
	164	*/
	165	aup->resume_epc = regs->cp0_epc + 4;
	166	if (insn_has_delay_slot((union mips_instruction) aup->insn[0])) {
	167	unsigned long epc;
	168
	169	epc = regs->cp0_epc;
ca86c9ef MN	170	__compute_return_epc_for_insn(regs,
ca86c9ef MN	171	(union mips_instruction) aup->insn[0]);
40e084a5 RB	172	aup->resume_epc = regs->cp0_epc;
40e084a5 RB	173	}
40e084a5 RB	174	utask->autask.saved_trap_nr = current->thread.trap_nr;
	175	current->thread.trap_nr = UPROBE_TRAP_NR;
	176	regs->cp0_epc = current->utask->xol_vaddr;
	177
	178	return 0;
	179	}
	180
	181	int arch_uprobe_post_xol(struct arch_uprobe aup, struct pt_regs regs)
	182	{
	183	struct uprobe_task *utask = current->utask;
	184
	185	current->thread.trap_nr = utask->autask.saved_trap_nr;
	186	regs->cp0_epc = aup->resume_epc;
	187
	188	return 0;
	189	}
	190
	191	/*
	192	* If xol insn itself traps and generates a signal(Say,
	193	* SIGILL/SIGSEGV/etc), then detect the case where a singlestepped
	194	* instruction jumps back to its own address. It is assumed that anything
	195	* like do_page_fault/do_trap/etc sets thread.trap_nr != -1.
	196	*
	197	* arch_uprobe_pre_xol/arch_uprobe_post_xol save/restore thread.trap_nr,
	198	* arch_uprobe_xol_was_trapped() simply checks that ->trap_nr is not equal to
	199	* UPROBE_TRAP_NR == -1 set by arch_uprobe_pre_xol().
	200	*/
	201	bool arch_uprobe_xol_was_trapped(struct task_struct *tsk)
	202	{
	203	if (tsk->thread.trap_nr != UPROBE_TRAP_NR)
	204	return true;
	205
	206	return false;
	207	}
	208
	209	int arch_uprobe_exception_notify(struct notifier_block *self,
	210	unsigned long val, void *data)
	211	{
	212	struct die_args *args = data;
	213	struct pt_regs *regs = args->regs;
	214
	215	/* regs == NULL is a kernel bug */
	216	if (WARN_ON(!regs))
	217	return NOTIFY_DONE;
	218
	219	/* We are only interested in userspace traps */
	220	if (!user_mode(regs))
	221	return NOTIFY_DONE;
	222
	223	switch (val) {
2809328f	224	case DIE_UPROBE:
40e084a5 RB	225	if (uprobe_pre_sstep_notifier(regs))
	226	return NOTIFY_STOP;
	227	break;
	228	case DIE_UPROBE_XOL:
	229	if (uprobe_post_sstep_notifier(regs))
	230	return NOTIFY_STOP;
	231	default:
	232	break;
	233	}
	234
	235	return 0;
	236	}
	237
	238	/*
	239	* This function gets called when XOL instruction either gets trapped or
	240	* the thread has a fatal signal. Reset the instruction pointer to its
	241	* probed address for the potential restart or for post mortem analysis.
	242	*/
	243	void arch_uprobe_abort_xol(struct arch_uprobe *aup,
	244	struct pt_regs *regs)
	245	{
	246	struct uprobe_task *utask = current->utask;
	247
	248	instruction_pointer_set(regs, utask->vaddr);
	249	}
	250
	251	unsigned long arch_uretprobe_hijack_return_addr(
	252	unsigned long trampoline_vaddr, struct pt_regs *regs)
	253	{
	254	unsigned long ra;
	255
	256	ra = regs->regs[31];
	257
	258	/* Replace the return address with the trampoline address */
db06068a	259	regs->regs[31] = trampoline_vaddr;
40e084a5 RB	260
	261	return ra;
	262	}
	263
	264	/**
	265	* set_swbp - store breakpoint at a given address.
	266	* @auprobe: arch specific probepoint information.
	267	* @mm: the probed process address space.
	268	* @vaddr: the virtual address to insert the opcode.
	269	*
	270	* For mm @mm, store the breakpoint instruction at @vaddr.
	271	* Return 0 (success) or a negative errno.
	272	*
	273	* This version overrides the weak version in kernel/events/uprobes.c.
	274	* It is required to handle MIPS16 and microMIPS.
	275	*/
	276	int __weak set_swbp(struct arch_uprobe auprobe, struct mm_struct mm,
	277	unsigned long vaddr)
	278	{
	279	return uprobe_write_opcode(mm, vaddr, UPROBE_SWBP_INSN);
	280	}
	281
40e084a5 RB	282	void __weak arch_uprobe_copy_ixol(struct page *page, unsigned long vaddr,
	283	void *src, unsigned long len)
	284	{
d99a043a	285	unsigned long kaddr, kstart;
40e084a5 RB	286
40e084a5 RB	287	/* Initialize the slot */
d99a043a JH	288	kaddr = (unsigned long)kmap_atomic(page);
	289	kstart = kaddr + (vaddr & ~PAGE_MASK);
	290	memcpy((void *)kstart, src, len);
	291	flush_icache_range(kstart, kstart + len);
	292	kunmap_atomic((void *)kaddr);
40e084a5 RB	293	}
	294
	295	/**
	296	* uprobe_get_swbp_addr - compute address of swbp given post-swbp regs
	297	* @regs: Reflects the saved state of the task after it has hit a breakpoint
	298	* instruction.
	299	* Return the address of the breakpoint instruction.
	300	*
	301	* This overrides the weak version in kernel/events/uprobes.c.
	302	*/
	303	unsigned long uprobe_get_swbp_addr(struct pt_regs *regs)
	304	{
	305	return instruction_pointer(regs);
	306	}
	307
	308	/*
	309	* See if the instruction can be emulated.
	310	* Returns true if instruction was emulated, false otherwise.
	311	*
	312	* For now we always emulate so this function just returns 0.
	313	*/
	314	bool arch_uprobe_skip_sstep(struct arch_uprobe auprobe, struct pt_regs regs)
	315	{
	316	return 0;
	317	}