xref: /openbmc/linux/arch/s390/kernel/uprobes.c (revision 4efd417f)
1 // SPDX-License-Identifier: GPL-2.0
2 /*
3  *  User-space Probes (UProbes) for s390
4  *
5  *    Copyright IBM Corp. 2014
6  *    Author(s): Jan Willeke,
7  */
8 
9 #include <linux/uaccess.h>
10 #include <linux/uprobes.h>
11 #include <linux/compat.h>
12 #include <linux/kdebug.h>
13 #include <linux/sched/task_stack.h>
14 
15 #include <asm/switch_to.h>
16 #include <asm/facility.h>
17 #include <asm/kprobes.h>
18 #include <asm/dis.h>
19 #include "entry.h"
20 
21 #define	UPROBE_TRAP_NR	UINT_MAX
22 
arch_uprobe_analyze_insn(struct arch_uprobe * auprobe,struct mm_struct * mm,unsigned long addr)23 int arch_uprobe_analyze_insn(struct arch_uprobe *auprobe, struct mm_struct *mm,
24 			     unsigned long addr)
25 {
26 	return probe_is_prohibited_opcode(auprobe->insn);
27 }
28 
arch_uprobe_pre_xol(struct arch_uprobe * auprobe,struct pt_regs * regs)29 int arch_uprobe_pre_xol(struct arch_uprobe *auprobe, struct pt_regs *regs)
30 {
31 	if (psw_bits(regs->psw).eaba == PSW_BITS_AMODE_24BIT)
32 		return -EINVAL;
33 	if (!is_compat_task() && psw_bits(regs->psw).eaba == PSW_BITS_AMODE_31BIT)
34 		return -EINVAL;
35 	clear_thread_flag(TIF_PER_TRAP);
36 	auprobe->saved_per = psw_bits(regs->psw).per;
37 	auprobe->saved_int_code = regs->int_code;
38 	regs->int_code = UPROBE_TRAP_NR;
39 	regs->psw.addr = current->utask->xol_vaddr;
40 	set_tsk_thread_flag(current, TIF_UPROBE_SINGLESTEP);
41 	update_cr_regs(current);
42 	return 0;
43 }
44 
arch_uprobe_xol_was_trapped(struct task_struct * tsk)45 bool arch_uprobe_xol_was_trapped(struct task_struct *tsk)
46 {
47 	struct pt_regs *regs = task_pt_regs(tsk);
48 
49 	if (regs->int_code != UPROBE_TRAP_NR)
50 		return true;
51 	return false;
52 }
53 
check_per_event(unsigned short cause,unsigned long control,struct pt_regs * regs)54 static int check_per_event(unsigned short cause, unsigned long control,
55 			   struct pt_regs *regs)
56 {
57 	if (!(regs->psw.mask & PSW_MASK_PER))
58 		return 0;
59 	/* user space single step */
60 	if (control == 0)
61 		return 1;
62 	/* over indication for storage alteration */
63 	if ((control & 0x20200000) && (cause & 0x2000))
64 		return 1;
65 	if (cause & 0x8000) {
66 		/* all branches */
67 		if ((control & 0x80800000) == 0x80000000)
68 			return 1;
69 		/* branch into selected range */
70 		if (((control & 0x80800000) == 0x80800000) &&
71 		    regs->psw.addr >= current->thread.per_user.start &&
72 		    regs->psw.addr <= current->thread.per_user.end)
73 			return 1;
74 	}
75 	return 0;
76 }
77 
arch_uprobe_post_xol(struct arch_uprobe * auprobe,struct pt_regs * regs)78 int arch_uprobe_post_xol(struct arch_uprobe *auprobe, struct pt_regs *regs)
79 {
80 	int fixup = probe_get_fixup_type(auprobe->insn);
81 	struct uprobe_task *utask = current->utask;
82 
83 	clear_tsk_thread_flag(current, TIF_UPROBE_SINGLESTEP);
84 	update_cr_regs(current);
85 	psw_bits(regs->psw).per = auprobe->saved_per;
86 	regs->int_code = auprobe->saved_int_code;
87 
88 	if (fixup & FIXUP_PSW_NORMAL)
89 		regs->psw.addr += utask->vaddr - utask->xol_vaddr;
90 	if (fixup & FIXUP_RETURN_REGISTER) {
91 		int reg = (auprobe->insn[0] & 0xf0) >> 4;
92 
93 		regs->gprs[reg] += utask->vaddr - utask->xol_vaddr;
94 	}
95 	if (fixup & FIXUP_BRANCH_NOT_TAKEN) {
96 		int ilen = insn_length(auprobe->insn[0] >> 8);
97 
98 		if (regs->psw.addr - utask->xol_vaddr == ilen)
99 			regs->psw.addr = utask->vaddr + ilen;
100 	}
101 	if (check_per_event(current->thread.per_event.cause,
102 			    current->thread.per_user.control, regs)) {
103 		/* fix per address */
104 		current->thread.per_event.address = utask->vaddr;
105 		/* trigger per event */
106 		set_thread_flag(TIF_PER_TRAP);
107 	}
108 	return 0;
109 }
110 
arch_uprobe_exception_notify(struct notifier_block * self,unsigned long val,void * data)111 int arch_uprobe_exception_notify(struct notifier_block *self, unsigned long val,
112 				 void *data)
113 {
114 	struct die_args *args = data;
115 	struct pt_regs *regs = args->regs;
116 
117 	if (!user_mode(regs))
118 		return NOTIFY_DONE;
119 	if (regs->int_code & 0x200) /* Trap during transaction */
120 		return NOTIFY_DONE;
121 	switch (val) {
122 	case DIE_BPT:
123 		if (uprobe_pre_sstep_notifier(regs))
124 			return NOTIFY_STOP;
125 		break;
126 	case DIE_SSTEP:
127 		if (uprobe_post_sstep_notifier(regs))
128 			return NOTIFY_STOP;
129 		break;
130 	default:
131 		break;
132 	}
133 	return NOTIFY_DONE;
134 }
135 
arch_uprobe_abort_xol(struct arch_uprobe * auprobe,struct pt_regs * regs)136 void arch_uprobe_abort_xol(struct arch_uprobe *auprobe, struct pt_regs *regs)
137 {
138 	clear_thread_flag(TIF_UPROBE_SINGLESTEP);
139 	regs->int_code = auprobe->saved_int_code;
140 	regs->psw.addr = current->utask->vaddr;
141 	current->thread.per_event.address = current->utask->vaddr;
142 }
143 
arch_uretprobe_hijack_return_addr(unsigned long trampoline,struct pt_regs * regs)144 unsigned long arch_uretprobe_hijack_return_addr(unsigned long trampoline,
145 						struct pt_regs *regs)
146 {
147 	unsigned long orig;
148 
149 	orig = regs->gprs[14];
150 	regs->gprs[14] = trampoline;
151 	return orig;
152 }
153 
arch_uretprobe_is_alive(struct return_instance * ret,enum rp_check ctx,struct pt_regs * regs)154 bool arch_uretprobe_is_alive(struct return_instance *ret, enum rp_check ctx,
155 			     struct pt_regs *regs)
156 {
157 	if (ctx == RP_CHECK_CHAIN_CALL)
158 		return user_stack_pointer(regs) <= ret->stack;
159 	else
160 		return user_stack_pointer(regs) < ret->stack;
161 }
162 
163 /* Instruction Emulation */
164 
adjust_psw_addr(psw_t * psw,unsigned long len)165 static void adjust_psw_addr(psw_t *psw, unsigned long len)
166 {
167 	psw->addr = __rewind_psw(*psw, -len);
168 }
169 
170 #define EMU_ILLEGAL_OP		1
171 #define EMU_SPECIFICATION	2
172 #define EMU_ADDRESSING		3
173 
174 #define emu_load_ril(ptr, output)			\
175 ({							\
176 	unsigned int mask = sizeof(*(ptr)) - 1;		\
177 	__typeof__(*(ptr)) input;			\
178 	int __rc = 0;					\
179 							\
180 	if ((u64 __force)ptr & mask)			\
181 		__rc = EMU_SPECIFICATION;		\
182 	else if (get_user(input, ptr))			\
183 		__rc = EMU_ADDRESSING;			\
184 	else						\
185 		*(output) = input;			\
186 	__rc;						\
187 })
188 
189 #define emu_store_ril(regs, ptr, input)			\
190 ({							\
191 	unsigned int mask = sizeof(*(ptr)) - 1;		\
192 	__typeof__(ptr) __ptr = (ptr);			\
193 	int __rc = 0;					\
194 							\
195 	if ((u64 __force)__ptr & mask)			\
196 		__rc = EMU_SPECIFICATION;		\
197 	else if (put_user(*(input), __ptr))		\
198 		__rc = EMU_ADDRESSING;			\
199 	if (__rc == 0)					\
200 		sim_stor_event(regs,			\
201 			       (void __force *)__ptr,	\
202 			       mask + 1);		\
203 	__rc;						\
204 })
205 
206 #define emu_cmp_ril(regs, ptr, cmp)			\
207 ({							\
208 	unsigned int mask = sizeof(*(ptr)) - 1;		\
209 	__typeof__(*(ptr)) input;			\
210 	int __rc = 0;					\
211 							\
212 	if ((u64 __force)ptr & mask)			\
213 		__rc = EMU_SPECIFICATION;		\
214 	else if (get_user(input, ptr))			\
215 		__rc = EMU_ADDRESSING;			\
216 	else if (input > *(cmp))			\
217 		psw_bits((regs)->psw).cc = 1;		\
218 	else if (input < *(cmp))			\
219 		psw_bits((regs)->psw).cc = 2;		\
220 	else						\
221 		psw_bits((regs)->psw).cc = 0;		\
222 	__rc;						\
223 })
224 
225 struct insn_ril {
226 	u8 opc0;
227 	u8 reg	: 4;
228 	u8 opc1 : 4;
229 	s32 disp;
230 } __packed;
231 
232 union split_register {
233 	u64 u64;
234 	u32 u32[2];
235 	u16 u16[4];
236 	s64 s64;
237 	s32 s32[2];
238 	s16 s16[4];
239 };
240 
241 /*
242  * If user per registers are setup to trace storage alterations and an
243  * emulated store took place on a fitting address a user trap is generated.
244  */
sim_stor_event(struct pt_regs * regs,void * addr,int len)245 static void sim_stor_event(struct pt_regs *regs, void *addr, int len)
246 {
247 	if (!(regs->psw.mask & PSW_MASK_PER))
248 		return;
249 	if (!(current->thread.per_user.control & PER_EVENT_STORE))
250 		return;
251 	if ((void *)current->thread.per_user.start > (addr + len))
252 		return;
253 	if ((void *)current->thread.per_user.end < addr)
254 		return;
255 	current->thread.per_event.address = regs->psw.addr;
256 	current->thread.per_event.cause = PER_EVENT_STORE >> 16;
257 	set_thread_flag(TIF_PER_TRAP);
258 }
259 
260 /*
261  * pc relative instructions are emulated, since parameters may not be
262  * accessible from the xol area due to range limitations.
263  */
handle_insn_ril(struct arch_uprobe * auprobe,struct pt_regs * regs)264 static void handle_insn_ril(struct arch_uprobe *auprobe, struct pt_regs *regs)
265 {
266 	union split_register *rx;
267 	struct insn_ril *insn;
268 	unsigned int ilen;
269 	void *uptr;
270 	int rc = 0;
271 
272 	insn = (struct insn_ril *) &auprobe->insn;
273 	rx = (union split_register *) &regs->gprs[insn->reg];
274 	uptr = (void *)(regs->psw.addr + (insn->disp * 2));
275 	ilen = insn_length(insn->opc0);
276 
277 	switch (insn->opc0) {
278 	case 0xc0:
279 		switch (insn->opc1) {
280 		case 0x00: /* larl */
281 			rx->u64 = (unsigned long)uptr;
282 			break;
283 		}
284 		break;
285 	case 0xc4:
286 		switch (insn->opc1) {
287 		case 0x02: /* llhrl */
288 			rc = emu_load_ril((u16 __user *)uptr, &rx->u32[1]);
289 			break;
290 		case 0x04: /* lghrl */
291 			rc = emu_load_ril((s16 __user *)uptr, &rx->u64);
292 			break;
293 		case 0x05: /* lhrl */
294 			rc = emu_load_ril((s16 __user *)uptr, &rx->u32[1]);
295 			break;
296 		case 0x06: /* llghrl */
297 			rc = emu_load_ril((u16 __user *)uptr, &rx->u64);
298 			break;
299 		case 0x08: /* lgrl */
300 			rc = emu_load_ril((u64 __user *)uptr, &rx->u64);
301 			break;
302 		case 0x0c: /* lgfrl */
303 			rc = emu_load_ril((s32 __user *)uptr, &rx->u64);
304 			break;
305 		case 0x0d: /* lrl */
306 			rc = emu_load_ril((u32 __user *)uptr, &rx->u32[1]);
307 			break;
308 		case 0x0e: /* llgfrl */
309 			rc = emu_load_ril((u32 __user *)uptr, &rx->u64);
310 			break;
311 		case 0x07: /* sthrl */
312 			rc = emu_store_ril(regs, (u16 __user *)uptr, &rx->u16[3]);
313 			break;
314 		case 0x0b: /* stgrl */
315 			rc = emu_store_ril(regs, (u64 __user *)uptr, &rx->u64);
316 			break;
317 		case 0x0f: /* strl */
318 			rc = emu_store_ril(regs, (u32 __user *)uptr, &rx->u32[1]);
319 			break;
320 		}
321 		break;
322 	case 0xc6:
323 		switch (insn->opc1) {
324 		case 0x04: /* cghrl */
325 			rc = emu_cmp_ril(regs, (s16 __user *)uptr, &rx->s64);
326 			break;
327 		case 0x05: /* chrl */
328 			rc = emu_cmp_ril(regs, (s16 __user *)uptr, &rx->s32[1]);
329 			break;
330 		case 0x06: /* clghrl */
331 			rc = emu_cmp_ril(regs, (u16 __user *)uptr, &rx->u64);
332 			break;
333 		case 0x07: /* clhrl */
334 			rc = emu_cmp_ril(regs, (u16 __user *)uptr, &rx->u32[1]);
335 			break;
336 		case 0x08: /* cgrl */
337 			rc = emu_cmp_ril(regs, (s64 __user *)uptr, &rx->s64);
338 			break;
339 		case 0x0a: /* clgrl */
340 			rc = emu_cmp_ril(regs, (u64 __user *)uptr, &rx->u64);
341 			break;
342 		case 0x0c: /* cgfrl */
343 			rc = emu_cmp_ril(regs, (s32 __user *)uptr, &rx->s64);
344 			break;
345 		case 0x0d: /* crl */
346 			rc = emu_cmp_ril(regs, (s32 __user *)uptr, &rx->s32[1]);
347 			break;
348 		case 0x0e: /* clgfrl */
349 			rc = emu_cmp_ril(regs, (u32 __user *)uptr, &rx->u64);
350 			break;
351 		case 0x0f: /* clrl */
352 			rc = emu_cmp_ril(regs, (u32 __user *)uptr, &rx->u32[1]);
353 			break;
354 		}
355 		break;
356 	}
357 	adjust_psw_addr(&regs->psw, ilen);
358 	switch (rc) {
359 	case EMU_ILLEGAL_OP:
360 		regs->int_code = ilen << 16 | 0x0001;
361 		do_report_trap(regs, SIGILL, ILL_ILLOPC, NULL);
362 		break;
363 	case EMU_SPECIFICATION:
364 		regs->int_code = ilen << 16 | 0x0006;
365 		do_report_trap(regs, SIGILL, ILL_ILLOPC , NULL);
366 		break;
367 	case EMU_ADDRESSING:
368 		regs->int_code = ilen << 16 | 0x0005;
369 		do_report_trap(regs, SIGSEGV, SEGV_MAPERR, NULL);
370 		break;
371 	}
372 }
373 
arch_uprobe_skip_sstep(struct arch_uprobe * auprobe,struct pt_regs * regs)374 bool arch_uprobe_skip_sstep(struct arch_uprobe *auprobe, struct pt_regs *regs)
375 {
376 	if ((psw_bits(regs->psw).eaba == PSW_BITS_AMODE_24BIT) ||
377 	    ((psw_bits(regs->psw).eaba == PSW_BITS_AMODE_31BIT) &&
378 	     !is_compat_task())) {
379 		regs->psw.addr = __rewind_psw(regs->psw, UPROBE_SWBP_INSN_SIZE);
380 		do_report_trap(regs, SIGILL, ILL_ILLADR, NULL);
381 		return true;
382 	}
383 	if (probe_is_insn_relative_long(auprobe->insn)) {
384 		handle_insn_ril(auprobe, regs);
385 		return true;
386 	}
387 	return false;
388 }
389