1 // SPDX-License-Identifier: GPL-2.0-only
3 * Kernel Probes (KProbes)
4 * arch/mips/kernel/kprobes.c
6 * Copyright 2006 Sony Corp.
7 * Copyright 2010 Cavium Networks
9 * Some portions copied from the powerpc version.
11 * Copyright (C) IBM Corporation, 2002, 2004
14 #define pr_fmt(fmt) "kprobes: " fmt
16 #include <linux/kprobes.h>
17 #include <linux/preempt.h>
18 #include <linux/uaccess.h>
19 #include <linux/kdebug.h>
20 #include <linux/slab.h>
22 #include <asm/ptrace.h>
23 #include <asm/branch.h>
24 #include <asm/break.h>
26 #include "probes-common.h"
28 static const union mips_instruction breakpoint_insn = {
31 .code = BRK_KPROBE_BP,
36 static const union mips_instruction breakpoint2_insn = {
39 .code = BRK_KPROBE_SSTEPBP,
44 DEFINE_PER_CPU(struct kprobe *, current_kprobe);
45 DEFINE_PER_CPU(struct kprobe_ctlblk, kprobe_ctlblk);
47 static int __kprobes insn_has_delayslot(union mips_instruction insn)
49 return __insn_has_delay_slot(insn);
53 * insn_has_ll_or_sc function checks whether instruction is ll or sc
54 * one; putting breakpoint on top of atomic ll/sc pair is bad idea;
55 * so we need to prevent it and refuse kprobes insertion for such
56 * instructions; cannot do much about breakpoint in the middle of
57 * ll/sc pair; it is upto user to avoid those places
59 static int __kprobes insn_has_ll_or_sc(union mips_instruction insn)
63 switch (insn.i_format.opcode) {
76 int __kprobes arch_prepare_kprobe(struct kprobe *p)
78 union mips_instruction insn;
79 union mips_instruction prev_insn;
84 if (insn_has_ll_or_sc(insn)) {
85 pr_notice("Kprobes for ll and sc instructions are not supported\n");
90 if (copy_from_kernel_nofault(&prev_insn, p->addr - 1,
91 sizeof(mips_instruction)) == 0 &&
92 insn_has_delayslot(prev_insn)) {
93 pr_notice("Kprobes for branch delayslot are not supported\n");
98 if (__insn_is_compact_branch(insn)) {
99 pr_notice("Kprobes for compact branches are not supported\n");
104 /* insn: must be on special executable page on mips. */
105 p->ainsn.insn = get_insn_slot();
106 if (!p->ainsn.insn) {
112 * In the kprobe->ainsn.insn[] array we store the original
113 * instruction at index zero and a break trap instruction at
116 * On MIPS arch if the instruction at probed address is a
117 * branch instruction, we need to execute the instruction at
118 * Branch Delayslot (BD) at the time of probe hit. As MIPS also
119 * doesn't have single stepping support, the BD instruction can
120 * not be executed in-line and it would be executed on SSOL slot
121 * using a normal breakpoint instruction in the next slot.
122 * So, read the instruction and save it for later execution.
124 if (insn_has_delayslot(insn))
125 memcpy(&p->ainsn.insn[0], p->addr + 1, sizeof(kprobe_opcode_t));
127 memcpy(&p->ainsn.insn[0], p->addr, sizeof(kprobe_opcode_t));
129 p->ainsn.insn[1] = breakpoint2_insn;
130 p->opcode = *p->addr;
136 void __kprobes arch_arm_kprobe(struct kprobe *p)
138 *p->addr = breakpoint_insn;
142 void __kprobes arch_disarm_kprobe(struct kprobe *p)
144 *p->addr = p->opcode;
148 void __kprobes arch_remove_kprobe(struct kprobe *p)
151 free_insn_slot(p->ainsn.insn, 0);
152 p->ainsn.insn = NULL;
156 static void save_previous_kprobe(struct kprobe_ctlblk *kcb)
158 kcb->prev_kprobe.kp = kprobe_running();
159 kcb->prev_kprobe.status = kcb->kprobe_status;
160 kcb->prev_kprobe.old_SR = kcb->kprobe_old_SR;
161 kcb->prev_kprobe.saved_SR = kcb->kprobe_saved_SR;
162 kcb->prev_kprobe.saved_epc = kcb->kprobe_saved_epc;
165 static void restore_previous_kprobe(struct kprobe_ctlblk *kcb)
167 __this_cpu_write(current_kprobe, kcb->prev_kprobe.kp);
168 kcb->kprobe_status = kcb->prev_kprobe.status;
169 kcb->kprobe_old_SR = kcb->prev_kprobe.old_SR;
170 kcb->kprobe_saved_SR = kcb->prev_kprobe.saved_SR;
171 kcb->kprobe_saved_epc = kcb->prev_kprobe.saved_epc;
174 static void set_current_kprobe(struct kprobe *p, struct pt_regs *regs,
175 struct kprobe_ctlblk *kcb)
177 __this_cpu_write(current_kprobe, p);
178 kcb->kprobe_saved_SR = kcb->kprobe_old_SR = (regs->cp0_status & ST0_IE);
179 kcb->kprobe_saved_epc = regs->cp0_epc;
183 * evaluate_branch_instrucion -
185 * Evaluate the branch instruction at probed address during probe hit. The
186 * result of evaluation would be the updated epc. The insturction in delayslot
187 * would actually be single stepped using a normal breakpoint) on SSOL slot.
189 * The result is also saved in the kprobe control block for later use,
190 * in case we need to execute the delayslot instruction. The latter will be
191 * false for NOP instruction in dealyslot and the branch-likely instructions
192 * when the branch is taken. And for those cases we set a flag as
193 * SKIP_DELAYSLOT in the kprobe control block
195 static int evaluate_branch_instruction(struct kprobe *p, struct pt_regs *regs,
196 struct kprobe_ctlblk *kcb)
198 union mips_instruction insn = p->opcode;
206 if (p->ainsn.insn->word == 0)
207 kcb->flags |= SKIP_DELAYSLOT;
209 kcb->flags &= ~SKIP_DELAYSLOT;
211 ret = __compute_return_epc_for_insn(regs, insn);
215 if (ret == BRANCH_LIKELY_TAKEN)
216 kcb->flags |= SKIP_DELAYSLOT;
218 kcb->target_epc = regs->cp0_epc;
223 pr_notice("Failed to emulate branch instruction because of unaligned epc - sending SIGBUS to %s.\n", current->comm);
229 static void prepare_singlestep(struct kprobe *p, struct pt_regs *regs,
230 struct kprobe_ctlblk *kcb)
234 regs->cp0_status &= ~ST0_IE;
236 /* single step inline if the instruction is a break */
237 if (p->opcode.word == breakpoint_insn.word ||
238 p->opcode.word == breakpoint2_insn.word)
239 regs->cp0_epc = (unsigned long)p->addr;
240 else if (insn_has_delayslot(p->opcode)) {
241 ret = evaluate_branch_instruction(p, regs, kcb);
245 regs->cp0_epc = (unsigned long)&p->ainsn.insn[0];
249 * Called after single-stepping. p->addr is the address of the
250 * instruction whose first byte has been replaced by the "break 0"
251 * instruction. To avoid the SMP problems that can occur when we
252 * temporarily put back the original opcode to single-step, we
253 * single-stepped a copy of the instruction. The address of this
254 * copy is p->ainsn.insn.
256 * This function prepares to return from the post-single-step
257 * breakpoint trap. In case of branch instructions, the target
258 * epc to be restored.
260 static void __kprobes resume_execution(struct kprobe *p,
261 struct pt_regs *regs,
262 struct kprobe_ctlblk *kcb)
264 if (insn_has_delayslot(p->opcode))
265 regs->cp0_epc = kcb->target_epc;
267 unsigned long orig_epc = kcb->kprobe_saved_epc;
268 regs->cp0_epc = orig_epc + 4;
272 static int __kprobes kprobe_handler(struct pt_regs *regs)
276 kprobe_opcode_t *addr;
277 struct kprobe_ctlblk *kcb;
279 addr = (kprobe_opcode_t *) regs->cp0_epc;
282 * We don't want to be preempted for the entire
283 * duration of kprobe processing
286 kcb = get_kprobe_ctlblk();
288 /* Check we're not actually recursing */
289 if (kprobe_running()) {
290 p = get_kprobe(addr);
292 if (kcb->kprobe_status == KPROBE_HIT_SS &&
293 p->ainsn.insn->word == breakpoint_insn.word) {
294 regs->cp0_status &= ~ST0_IE;
295 regs->cp0_status |= kcb->kprobe_saved_SR;
299 * We have reentered the kprobe_handler(), since
300 * another probe was hit while within the handler.
301 * We here save the original kprobes variables and
302 * just single step on the instruction of the new probe
303 * without calling any user handlers.
305 save_previous_kprobe(kcb);
306 set_current_kprobe(p, regs, kcb);
307 kprobes_inc_nmissed_count(p);
308 prepare_singlestep(p, regs, kcb);
309 kcb->kprobe_status = KPROBE_REENTER;
310 if (kcb->flags & SKIP_DELAYSLOT) {
311 resume_execution(p, regs, kcb);
312 restore_previous_kprobe(kcb);
313 preempt_enable_no_resched();
316 } else if (addr->word != breakpoint_insn.word) {
318 * The breakpoint instruction was removed by
319 * another cpu right after we hit, no further
320 * handling of this interrupt is appropriate
327 p = get_kprobe(addr);
329 if (addr->word != breakpoint_insn.word) {
331 * The breakpoint instruction was removed right
332 * after we hit it. Another cpu has removed
333 * either a probepoint or a debugger breakpoint
334 * at this address. In either case, no further
335 * handling of this interrupt is appropriate.
339 /* Not one of ours: let kernel handle it */
343 set_current_kprobe(p, regs, kcb);
344 kcb->kprobe_status = KPROBE_HIT_ACTIVE;
346 if (p->pre_handler && p->pre_handler(p, regs)) {
347 /* handler has already set things up, so skip ss setup */
348 reset_current_kprobe();
349 preempt_enable_no_resched();
353 prepare_singlestep(p, regs, kcb);
354 if (kcb->flags & SKIP_DELAYSLOT) {
355 kcb->kprobe_status = KPROBE_HIT_SSDONE;
357 p->post_handler(p, regs, 0);
358 resume_execution(p, regs, kcb);
359 preempt_enable_no_resched();
361 kcb->kprobe_status = KPROBE_HIT_SS;
366 preempt_enable_no_resched();
371 static inline int post_kprobe_handler(struct pt_regs *regs)
373 struct kprobe *cur = kprobe_running();
374 struct kprobe_ctlblk *kcb = get_kprobe_ctlblk();
379 if ((kcb->kprobe_status != KPROBE_REENTER) && cur->post_handler) {
380 kcb->kprobe_status = KPROBE_HIT_SSDONE;
381 cur->post_handler(cur, regs, 0);
384 resume_execution(cur, regs, kcb);
386 regs->cp0_status |= kcb->kprobe_saved_SR;
388 /* Restore back the original saved kprobes variables and continue. */
389 if (kcb->kprobe_status == KPROBE_REENTER) {
390 restore_previous_kprobe(kcb);
393 reset_current_kprobe();
395 preempt_enable_no_resched();
400 int kprobe_fault_handler(struct pt_regs *regs, int trapnr)
402 struct kprobe *cur = kprobe_running();
403 struct kprobe_ctlblk *kcb = get_kprobe_ctlblk();
405 if (kcb->kprobe_status & KPROBE_HIT_SS) {
406 resume_execution(cur, regs, kcb);
407 regs->cp0_status |= kcb->kprobe_old_SR;
409 reset_current_kprobe();
410 preempt_enable_no_resched();
416 * Wrapper routine for handling exceptions.
418 int __kprobes kprobe_exceptions_notify(struct notifier_block *self,
419 unsigned long val, void *data)
422 struct die_args *args = (struct die_args *)data;
423 int ret = NOTIFY_DONE;
427 if (kprobe_handler(args->regs))
431 if (post_kprobe_handler(args->regs))
436 /* kprobe_running() needs smp_processor_id() */
440 && kprobe_fault_handler(args->regs, args->trapnr))
451 * Function return probe trampoline:
452 * - init_kprobes() establishes a probepoint here
453 * - When the probed function returns, this probe causes the
456 static void __used kretprobe_trampoline_holder(void)
460 /* Keep the assembler from reordering and placing JR here. */
463 ".global kretprobe_trampoline\n"
464 "kretprobe_trampoline:\n\t"
470 void kretprobe_trampoline(void);
472 void __kprobes arch_prepare_kretprobe(struct kretprobe_instance *ri,
473 struct pt_regs *regs)
475 ri->ret_addr = (kprobe_opcode_t *) regs->regs[31];
478 /* Replace the return addr with trampoline addr */
479 regs->regs[31] = (unsigned long)kretprobe_trampoline;
483 * Called when the probe at kretprobe trampoline is hit
485 static int __kprobes trampoline_probe_handler(struct kprobe *p,
486 struct pt_regs *regs)
488 instruction_pointer(regs) = __kretprobe_trampoline_handler(regs,
489 kretprobe_trampoline, NULL);
491 * By returning a non-zero value, we are telling
492 * kprobe_handler() that we don't want the post_handler
493 * to run (and have re-enabled preemption)
498 int __kprobes arch_trampoline_kprobe(struct kprobe *p)
500 if (p->addr == (kprobe_opcode_t *)kretprobe_trampoline)
506 static struct kprobe trampoline_p = {
507 .addr = (kprobe_opcode_t *)kretprobe_trampoline,
508 .pre_handler = trampoline_probe_handler
511 int __init arch_init_kprobes(void)
513 return register_kprobe(&trampoline_p);