arm64: kprobes: Cleanup jprobe_return
[firefly-linux-kernel-4.4.55.git] / arch / arm64 / kernel / probes / kprobes.c
1 /*
2  * arch/arm64/kernel/probes/kprobes.c
3  *
4  * Kprobes support for ARM64
5  *
6  * Copyright (C) 2013 Linaro Limited.
7  * Author: Sandeepa Prabhu <sandeepa.prabhu@linaro.org>
8  *
9  * This program is free software; you can redistribute it and/or modify
10  * it under the terms of the GNU General Public License version 2 as
11  * published by the Free Software Foundation.
12  *
13  * This program is distributed in the hope that it will be useful,
14  * but WITHOUT ANY WARRANTY; without even the implied warranty of
15  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
16  * General Public License for more details.
17  *
18  */
19 #include <linux/kernel.h>
20 #include <linux/kprobes.h>
21 #include <linux/module.h>
22 #include <linux/slab.h>
23 #include <linux/stop_machine.h>
24 #include <linux/stringify.h>
25 #include <asm/traps.h>
26 #include <asm/ptrace.h>
27 #include <asm/cacheflush.h>
28 #include <asm/debug-monitors.h>
29 #include <asm/system_misc.h>
30 #include <asm/insn.h>
31 #include <asm/uaccess.h>
32 #include <asm/irq.h>
33 #include <asm-generic/sections.h>
34
35 #include "decode-insn.h"
36
37 DEFINE_PER_CPU(struct kprobe *, current_kprobe) = NULL;
38 DEFINE_PER_CPU(struct kprobe_ctlblk, kprobe_ctlblk);
39
40 static void __kprobes
41 post_kprobe_handler(struct kprobe_ctlblk *, struct pt_regs *);
42
43 static inline unsigned long min_stack_size(unsigned long addr)
44 {
45         unsigned long size;
46
47         size = (unsigned long)current_thread_info() + THREAD_START_SP - addr;
48
49         return min(size, FIELD_SIZEOF(struct kprobe_ctlblk, jprobes_stack));
50 }
51
52 static void __kprobes arch_prepare_ss_slot(struct kprobe *p)
53 {
54         /* prepare insn slot */
55         p->ainsn.insn[0] = cpu_to_le32(p->opcode);
56
57         flush_icache_range((uintptr_t) (p->ainsn.insn),
58                            (uintptr_t) (p->ainsn.insn) +
59                            MAX_INSN_SIZE * sizeof(kprobe_opcode_t));
60
61         /*
62          * Needs restoring of return address after stepping xol.
63          */
64         p->ainsn.restore = (unsigned long) p->addr +
65           sizeof(kprobe_opcode_t);
66 }
67
68 static void __kprobes arch_prepare_simulate(struct kprobe *p)
69 {
70         /* This instructions is not executed xol. No need to adjust the PC */
71         p->ainsn.restore = 0;
72 }
73
74 static void __kprobes arch_simulate_insn(struct kprobe *p, struct pt_regs *regs)
75 {
76         struct kprobe_ctlblk *kcb = get_kprobe_ctlblk();
77
78         if (p->ainsn.handler)
79                 p->ainsn.handler((u32)p->opcode, (long)p->addr, regs);
80
81         /* single step simulated, now go for post processing */
82         post_kprobe_handler(kcb, regs);
83 }
84
85 int __kprobes arch_prepare_kprobe(struct kprobe *p)
86 {
87         unsigned long probe_addr = (unsigned long)p->addr;
88         extern char __start_rodata[];
89         extern char __end_rodata[];
90
91         if (probe_addr & 0x3)
92                 return -EINVAL;
93
94         /* copy instruction */
95         p->opcode = le32_to_cpu(*p->addr);
96
97         if (in_exception_text(probe_addr))
98                 return -EINVAL;
99         if (probe_addr >= (unsigned long) __start_rodata &&
100             probe_addr <= (unsigned long) __end_rodata)
101                 return -EINVAL;
102
103         /* decode instruction */
104         switch (arm_kprobe_decode_insn(p->addr, &p->ainsn)) {
105         case INSN_REJECTED:     /* insn not supported */
106                 return -EINVAL;
107
108         case INSN_GOOD_NO_SLOT: /* insn need simulation */
109                 p->ainsn.insn = NULL;
110                 break;
111
112         case INSN_GOOD: /* instruction uses slot */
113                 p->ainsn.insn = get_insn_slot();
114                 if (!p->ainsn.insn)
115                         return -ENOMEM;
116                 break;
117         };
118
119         /* prepare the instruction */
120         if (p->ainsn.insn)
121                 arch_prepare_ss_slot(p);
122         else
123                 arch_prepare_simulate(p);
124
125         return 0;
126 }
127
128 static int __kprobes patch_text(kprobe_opcode_t *addr, u32 opcode)
129 {
130         void *addrs[1];
131         u32 insns[1];
132
133         addrs[0] = (void *)addr;
134         insns[0] = (u32)opcode;
135
136         return aarch64_insn_patch_text(addrs, insns, 1);
137 }
138
139 /* arm kprobe: install breakpoint in text */
140 void __kprobes arch_arm_kprobe(struct kprobe *p)
141 {
142         patch_text(p->addr, BRK64_OPCODE_KPROBES);
143 }
144
145 /* disarm kprobe: remove breakpoint from text */
146 void __kprobes arch_disarm_kprobe(struct kprobe *p)
147 {
148         patch_text(p->addr, p->opcode);
149 }
150
151 void __kprobes arch_remove_kprobe(struct kprobe *p)
152 {
153         if (p->ainsn.insn) {
154                 free_insn_slot(p->ainsn.insn, 0);
155                 p->ainsn.insn = NULL;
156         }
157 }
158
159 static void __kprobes save_previous_kprobe(struct kprobe_ctlblk *kcb)
160 {
161         kcb->prev_kprobe.kp = kprobe_running();
162         kcb->prev_kprobe.status = kcb->kprobe_status;
163 }
164
165 static void __kprobes restore_previous_kprobe(struct kprobe_ctlblk *kcb)
166 {
167         __this_cpu_write(current_kprobe, kcb->prev_kprobe.kp);
168         kcb->kprobe_status = kcb->prev_kprobe.status;
169 }
170
171 static void __kprobes set_current_kprobe(struct kprobe *p)
172 {
173         __this_cpu_write(current_kprobe, p);
174 }
175
176 /*
177  * The D-flag (Debug mask) is set (masked) upon debug exception entry.
178  * Kprobes needs to clear (unmask) D-flag -ONLY- in case of recursive
179  * probe i.e. when probe hit from kprobe handler context upon
180  * executing the pre/post handlers. In this case we return with
181  * D-flag clear so that single-stepping can be carried-out.
182  *
183  * Leave D-flag set in all other cases.
184  */
185 static void __kprobes
186 spsr_set_debug_flag(struct pt_regs *regs, int mask)
187 {
188         unsigned long spsr = regs->pstate;
189
190         if (mask)
191                 spsr |= PSR_D_BIT;
192         else
193                 spsr &= ~PSR_D_BIT;
194
195         regs->pstate = spsr;
196 }
197
198 /*
199  * Interrupts need to be disabled before single-step mode is set, and not
200  * reenabled until after single-step mode ends.
201  * Without disabling interrupt on local CPU, there is a chance of
202  * interrupt occurrence in the period of exception return and  start of
203  * out-of-line single-step, that result in wrongly single stepping
204  * into the interrupt handler.
205  */
206 static void __kprobes kprobes_save_local_irqflag(struct kprobe_ctlblk *kcb,
207                                                 struct pt_regs *regs)
208 {
209         kcb->saved_irqflag = regs->pstate;
210         regs->pstate |= PSR_I_BIT;
211 }
212
213 static void __kprobes kprobes_restore_local_irqflag(struct kprobe_ctlblk *kcb,
214                                                 struct pt_regs *regs)
215 {
216         if (kcb->saved_irqflag & PSR_I_BIT)
217                 regs->pstate |= PSR_I_BIT;
218         else
219                 regs->pstate &= ~PSR_I_BIT;
220 }
221
222 static void __kprobes
223 set_ss_context(struct kprobe_ctlblk *kcb, unsigned long addr)
224 {
225         kcb->ss_ctx.ss_pending = true;
226         kcb->ss_ctx.match_addr = addr + sizeof(kprobe_opcode_t);
227 }
228
229 static void __kprobes clear_ss_context(struct kprobe_ctlblk *kcb)
230 {
231         kcb->ss_ctx.ss_pending = false;
232         kcb->ss_ctx.match_addr = 0;
233 }
234
235 static void __kprobes setup_singlestep(struct kprobe *p,
236                                        struct pt_regs *regs,
237                                        struct kprobe_ctlblk *kcb, int reenter)
238 {
239         unsigned long slot;
240
241         if (reenter) {
242                 save_previous_kprobe(kcb);
243                 set_current_kprobe(p);
244                 kcb->kprobe_status = KPROBE_REENTER;
245         } else {
246                 kcb->kprobe_status = KPROBE_HIT_SS;
247         }
248
249
250         if (p->ainsn.insn) {
251                 /* prepare for single stepping */
252                 slot = (unsigned long)p->ainsn.insn;
253
254                 set_ss_context(kcb, slot);      /* mark pending ss */
255
256                 if (kcb->kprobe_status == KPROBE_REENTER)
257                         spsr_set_debug_flag(regs, 0);
258                 else
259                         WARN_ON(regs->pstate & PSR_D_BIT);
260
261                 /* IRQs and single stepping do not mix well. */
262                 kprobes_save_local_irqflag(kcb, regs);
263                 kernel_enable_single_step(regs);
264                 instruction_pointer_set(regs, slot);
265         } else {
266                 /* insn simulation */
267                 arch_simulate_insn(p, regs);
268         }
269 }
270
271 static int __kprobes reenter_kprobe(struct kprobe *p,
272                                     struct pt_regs *regs,
273                                     struct kprobe_ctlblk *kcb)
274 {
275         switch (kcb->kprobe_status) {
276         case KPROBE_HIT_SSDONE:
277         case KPROBE_HIT_ACTIVE:
278                 kprobes_inc_nmissed_count(p);
279                 setup_singlestep(p, regs, kcb, 1);
280                 break;
281         case KPROBE_HIT_SS:
282         case KPROBE_REENTER:
283                 pr_warn("Unrecoverable kprobe detected at %p.\n", p->addr);
284                 dump_kprobe(p);
285                 BUG();
286                 break;
287         default:
288                 WARN_ON(1);
289                 return 0;
290         }
291
292         return 1;
293 }
294
295 static void __kprobes
296 post_kprobe_handler(struct kprobe_ctlblk *kcb, struct pt_regs *regs)
297 {
298         struct kprobe *cur = kprobe_running();
299
300         if (!cur)
301                 return;
302
303         /* return addr restore if non-branching insn */
304         if (cur->ainsn.restore != 0)
305                 instruction_pointer_set(regs, cur->ainsn.restore);
306
307         /* restore back original saved kprobe variables and continue */
308         if (kcb->kprobe_status == KPROBE_REENTER) {
309                 restore_previous_kprobe(kcb);
310                 return;
311         }
312         /* call post handler */
313         kcb->kprobe_status = KPROBE_HIT_SSDONE;
314         if (cur->post_handler)  {
315                 /* post_handler can hit breakpoint and single step
316                  * again, so we enable D-flag for recursive exception.
317                  */
318                 cur->post_handler(cur, regs, 0);
319         }
320
321         reset_current_kprobe();
322 }
323
324 int __kprobes kprobe_fault_handler(struct pt_regs *regs, unsigned int fsr)
325 {
326         struct kprobe *cur = kprobe_running();
327         struct kprobe_ctlblk *kcb = get_kprobe_ctlblk();
328
329         switch (kcb->kprobe_status) {
330         case KPROBE_HIT_SS:
331         case KPROBE_REENTER:
332                 /*
333                  * We are here because the instruction being single
334                  * stepped caused a page fault. We reset the current
335                  * kprobe and the ip points back to the probe address
336                  * and allow the page fault handler to continue as a
337                  * normal page fault.
338                  */
339                 instruction_pointer_set(regs, (unsigned long) cur->addr);
340                 if (!instruction_pointer(regs))
341                         BUG();
342
343                 kernel_disable_single_step();
344                 if (kcb->kprobe_status == KPROBE_REENTER)
345                         spsr_set_debug_flag(regs, 1);
346
347                 if (kcb->kprobe_status == KPROBE_REENTER)
348                         restore_previous_kprobe(kcb);
349                 else
350                         reset_current_kprobe();
351
352                 break;
353         case KPROBE_HIT_ACTIVE:
354         case KPROBE_HIT_SSDONE:
355                 /*
356                  * We increment the nmissed count for accounting,
357                  * we can also use npre/npostfault count for accounting
358                  * these specific fault cases.
359                  */
360                 kprobes_inc_nmissed_count(cur);
361
362                 /*
363                  * We come here because instructions in the pre/post
364                  * handler caused the page_fault, this could happen
365                  * if handler tries to access user space by
366                  * copy_from_user(), get_user() etc. Let the
367                  * user-specified handler try to fix it first.
368                  */
369                 if (cur->fault_handler && cur->fault_handler(cur, regs, fsr))
370                         return 1;
371
372                 /*
373                  * In case the user-specified fault handler returned
374                  * zero, try to fix up.
375                  */
376                 if (fixup_exception(regs))
377                         return 1;
378         }
379         return 0;
380 }
381
382 int __kprobes kprobe_exceptions_notify(struct notifier_block *self,
383                                        unsigned long val, void *data)
384 {
385         return NOTIFY_DONE;
386 }
387
388 static void __kprobes kprobe_handler(struct pt_regs *regs)
389 {
390         struct kprobe *p, *cur_kprobe;
391         struct kprobe_ctlblk *kcb;
392         unsigned long addr = instruction_pointer(regs);
393
394         kcb = get_kprobe_ctlblk();
395         cur_kprobe = kprobe_running();
396
397         p = get_kprobe((kprobe_opcode_t *) addr);
398
399         if (p) {
400                 if (cur_kprobe) {
401                         if (reenter_kprobe(p, regs, kcb))
402                                 return;
403                 } else {
404                         /* Probe hit */
405                         set_current_kprobe(p);
406                         kcb->kprobe_status = KPROBE_HIT_ACTIVE;
407
408                         /*
409                          * If we have no pre-handler or it returned 0, we
410                          * continue with normal processing.  If we have a
411                          * pre-handler and it returned non-zero, it prepped
412                          * for calling the break_handler below on re-entry,
413                          * so get out doing nothing more here.
414                          *
415                          * pre_handler can hit a breakpoint and can step thru
416                          * before return, keep PSTATE D-flag enabled until
417                          * pre_handler return back.
418                          */
419                         if (!p->pre_handler || !p->pre_handler(p, regs)) {
420                                 setup_singlestep(p, regs, kcb, 0);
421                                 return;
422                         }
423                 }
424         } else if ((le32_to_cpu(*(kprobe_opcode_t *) addr) ==
425             BRK64_OPCODE_KPROBES) && cur_kprobe) {
426                 /* We probably hit a jprobe.  Call its break handler. */
427                 if (cur_kprobe->break_handler  &&
428                      cur_kprobe->break_handler(cur_kprobe, regs)) {
429                         setup_singlestep(cur_kprobe, regs, kcb, 0);
430                         return;
431                 }
432         }
433         /*
434          * The breakpoint instruction was removed right
435          * after we hit it.  Another cpu has removed
436          * either a probepoint or a debugger breakpoint
437          * at this address.  In either case, no further
438          * handling of this interrupt is appropriate.
439          * Return back to original instruction, and continue.
440          */
441 }
442
443 static int __kprobes
444 kprobe_ss_hit(struct kprobe_ctlblk *kcb, unsigned long addr)
445 {
446         if ((kcb->ss_ctx.ss_pending)
447             && (kcb->ss_ctx.match_addr == addr)) {
448                 clear_ss_context(kcb);  /* clear pending ss */
449                 return DBG_HOOK_HANDLED;
450         }
451         /* not ours, kprobes should ignore it */
452         return DBG_HOOK_ERROR;
453 }
454
455 int __kprobes
456 kprobe_single_step_handler(struct pt_regs *regs, unsigned int esr)
457 {
458         struct kprobe_ctlblk *kcb = get_kprobe_ctlblk();
459         int retval;
460
461         /* return error if this is not our step */
462         retval = kprobe_ss_hit(kcb, instruction_pointer(regs));
463
464         if (retval == DBG_HOOK_HANDLED) {
465                 kprobes_restore_local_irqflag(kcb, regs);
466                 kernel_disable_single_step();
467
468                 if (kcb->kprobe_status == KPROBE_REENTER)
469                         spsr_set_debug_flag(regs, 1);
470
471                 post_kprobe_handler(kcb, regs);
472         }
473
474         return retval;
475 }
476
477 int __kprobes
478 kprobe_breakpoint_handler(struct pt_regs *regs, unsigned int esr)
479 {
480         kprobe_handler(regs);
481         return DBG_HOOK_HANDLED;
482 }
483
484 int __kprobes setjmp_pre_handler(struct kprobe *p, struct pt_regs *regs)
485 {
486         struct jprobe *jp = container_of(p, struct jprobe, kp);
487         struct kprobe_ctlblk *kcb = get_kprobe_ctlblk();
488         long stack_ptr = kernel_stack_pointer(regs);
489
490         kcb->jprobe_saved_regs = *regs;
491         /*
492          * As Linus pointed out, gcc assumes that the callee
493          * owns the argument space and could overwrite it, e.g.
494          * tailcall optimization. So, to be absolutely safe
495          * we also save and restore enough stack bytes to cover
496          * the argument area.
497          */
498         memcpy(kcb->jprobes_stack, (void *)stack_ptr,
499                min_stack_size(stack_ptr));
500
501         instruction_pointer_set(regs, (unsigned long) jp->entry);
502         preempt_disable();
503         pause_graph_tracing();
504         return 1;
505 }
506
507 void __kprobes jprobe_return(void)
508 {
509         struct kprobe_ctlblk *kcb = get_kprobe_ctlblk();
510
511         /*
512          * Jprobe handler return by entering break exception,
513          * encoded same as kprobe, but with following conditions
514          * -a special PC to identify it from the other kprobes.
515          * -restore stack addr to original saved pt_regs
516          */
517         asm volatile("                          mov sp, %0      \n"
518                      "jprobe_return_break:      brk %1          \n"
519                      :
520                      : "r" (kcb->jprobe_saved_regs.sp),
521                        "I" (BRK64_ESR_KPROBES)
522                      : "memory");
523
524         unreachable();
525 }
526
527 int __kprobes longjmp_break_handler(struct kprobe *p, struct pt_regs *regs)
528 {
529         struct kprobe_ctlblk *kcb = get_kprobe_ctlblk();
530         long stack_addr = kcb->jprobe_saved_regs.sp;
531         long orig_sp = kernel_stack_pointer(regs);
532         struct jprobe *jp = container_of(p, struct jprobe, kp);
533         extern const char jprobe_return_break[];
534
535         if (instruction_pointer(regs) != (u64) jprobe_return_break)
536                 return 0;
537
538         if (orig_sp != stack_addr) {
539                 struct pt_regs *saved_regs =
540                     (struct pt_regs *)kcb->jprobe_saved_regs.sp;
541                 pr_err("current sp %lx does not match saved sp %lx\n",
542                        orig_sp, stack_addr);
543                 pr_err("Saved registers for jprobe %p\n", jp);
544                 show_regs(saved_regs);
545                 pr_err("Current registers\n");
546                 show_regs(regs);
547                 BUG();
548         }
549         unpause_graph_tracing();
550         *regs = kcb->jprobe_saved_regs;
551         memcpy((void *)stack_addr, kcb->jprobes_stack,
552                min_stack_size(stack_addr));
553         preempt_enable_no_resched();
554         return 1;
555 }
556
557 bool arch_within_kprobe_blacklist(unsigned long addr)
558 {
559         extern char __idmap_text_start[], __idmap_text_end[];
560
561         if ((addr >= (unsigned long)__kprobes_text_start &&
562             addr < (unsigned long)__kprobes_text_end) ||
563             (addr >= (unsigned long)__entry_text_start &&
564             addr < (unsigned long)__entry_text_end) ||
565             (addr >= (unsigned long)__idmap_text_start &&
566             addr < (unsigned long)__idmap_text_end) ||
567             !!search_exception_tables(addr))
568                 return true;
569
570
571         return false;
572 }
573
574 void __kprobes __used *trampoline_probe_handler(struct pt_regs *regs)
575 {
576         struct kretprobe_instance *ri = NULL;
577         struct hlist_head *head, empty_rp;
578         struct hlist_node *tmp;
579         unsigned long flags, orig_ret_address = 0;
580         unsigned long trampoline_address =
581                 (unsigned long)&kretprobe_trampoline;
582         kprobe_opcode_t *correct_ret_addr = NULL;
583
584         INIT_HLIST_HEAD(&empty_rp);
585         kretprobe_hash_lock(current, &head, &flags);
586
587         /*
588          * It is possible to have multiple instances associated with a given
589          * task either because multiple functions in the call path have
590          * return probes installed on them, and/or more than one
591          * return probe was registered for a target function.
592          *
593          * We can handle this because:
594          *     - instances are always pushed into the head of the list
595          *     - when multiple return probes are registered for the same
596          *       function, the (chronologically) first instance's ret_addr
597          *       will be the real return address, and all the rest will
598          *       point to kretprobe_trampoline.
599          */
600         hlist_for_each_entry_safe(ri, tmp, head, hlist) {
601                 if (ri->task != current)
602                         /* another task is sharing our hash bucket */
603                         continue;
604
605                 orig_ret_address = (unsigned long)ri->ret_addr;
606
607                 if (orig_ret_address != trampoline_address)
608                         /*
609                          * This is the real return address. Any other
610                          * instances associated with this task are for
611                          * other calls deeper on the call stack
612                          */
613                         break;
614         }
615
616         kretprobe_assert(ri, orig_ret_address, trampoline_address);
617
618         correct_ret_addr = ri->ret_addr;
619         hlist_for_each_entry_safe(ri, tmp, head, hlist) {
620                 if (ri->task != current)
621                         /* another task is sharing our hash bucket */
622                         continue;
623
624                 orig_ret_address = (unsigned long)ri->ret_addr;
625                 if (ri->rp && ri->rp->handler) {
626                         __this_cpu_write(current_kprobe, &ri->rp->kp);
627                         get_kprobe_ctlblk()->kprobe_status = KPROBE_HIT_ACTIVE;
628                         ri->ret_addr = correct_ret_addr;
629                         ri->rp->handler(ri, regs);
630                         __this_cpu_write(current_kprobe, NULL);
631                 }
632
633                 recycle_rp_inst(ri, &empty_rp);
634
635                 if (orig_ret_address != trampoline_address)
636                         /*
637                          * This is the real return address. Any other
638                          * instances associated with this task are for
639                          * other calls deeper on the call stack
640                          */
641                         break;
642         }
643
644         kretprobe_hash_unlock(current, &flags);
645
646         hlist_for_each_entry_safe(ri, tmp, &empty_rp, hlist) {
647                 hlist_del(&ri->hlist);
648                 kfree(ri);
649         }
650         return (void *)orig_ret_address;
651 }
652
653 void __kprobes arch_prepare_kretprobe(struct kretprobe_instance *ri,
654                                       struct pt_regs *regs)
655 {
656         ri->ret_addr = (kprobe_opcode_t *)regs->regs[30];
657
658         /* replace return addr (x30) with trampoline */
659         regs->regs[30] = (long)&kretprobe_trampoline;
660 }
661
662 int __kprobes arch_trampoline_kprobe(struct kprobe *p)
663 {
664         return 0;
665 }
666
667 int __init arch_init_kprobes(void)
668 {
669         return 0;
670 }