GNU Linux-libre 4.19.286-gnu1
[releases.git] / arch / s390 / kernel / kprobes.c
1 // SPDX-License-Identifier: GPL-2.0+
2 /*
3  *  Kernel Probes (KProbes)
4  *
5  * Copyright IBM Corp. 2002, 2006
6  *
7  * s390 port, used ppc64 as template. Mike Grundy <grundym@us.ibm.com>
8  */
9
10 #include <linux/kprobes.h>
11 #include <linux/ptrace.h>
12 #include <linux/preempt.h>
13 #include <linux/stop_machine.h>
14 #include <linux/kdebug.h>
15 #include <linux/uaccess.h>
16 #include <linux/extable.h>
17 #include <linux/module.h>
18 #include <linux/slab.h>
19 #include <linux/hardirq.h>
20 #include <linux/ftrace.h>
21 #include <asm/set_memory.h>
22 #include <asm/sections.h>
23 #include <asm/dis.h>
24
25 DEFINE_PER_CPU(struct kprobe *, current_kprobe);
26 DEFINE_PER_CPU(struct kprobe_ctlblk, kprobe_ctlblk);
27
28 struct kretprobe_blackpoint kretprobe_blacklist[] = { };
29
30 DEFINE_INSN_CACHE_OPS(dmainsn);
31
32 static void *alloc_dmainsn_page(void)
33 {
34         void *page;
35
36         page = (void *) __get_free_page(GFP_KERNEL | GFP_DMA);
37         if (page)
38                 set_memory_x((unsigned long) page, 1);
39         return page;
40 }
41
42 static void free_dmainsn_page(void *page)
43 {
44         set_memory_nx((unsigned long) page, 1);
45         free_page((unsigned long)page);
46 }
47
48 struct kprobe_insn_cache kprobe_dmainsn_slots = {
49         .mutex = __MUTEX_INITIALIZER(kprobe_dmainsn_slots.mutex),
50         .alloc = alloc_dmainsn_page,
51         .free = free_dmainsn_page,
52         .pages = LIST_HEAD_INIT(kprobe_dmainsn_slots.pages),
53         .insn_size = MAX_INSN_SIZE,
54 };
55
56 static void copy_instruction(struct kprobe *p)
57 {
58         unsigned long ip = (unsigned long) p->addr;
59         s64 disp, new_disp;
60         u64 addr, new_addr;
61
62         if (ftrace_location(ip) == ip) {
63                 /*
64                  * If kprobes patches the instruction that is morphed by
65                  * ftrace make sure that kprobes always sees the branch
66                  * "jg .+24" that skips the mcount block or the "brcl 0,0"
67                  * in case of hotpatch.
68                  */
69                 ftrace_generate_nop_insn((struct ftrace_insn *)p->ainsn.insn);
70                 p->ainsn.is_ftrace_insn = 1;
71         } else
72                 memcpy(p->ainsn.insn, p->addr, insn_length(*p->addr >> 8));
73         p->opcode = p->ainsn.insn[0];
74         if (!probe_is_insn_relative_long(p->ainsn.insn))
75                 return;
76         /*
77          * For pc-relative instructions in RIL-b or RIL-c format patch the
78          * RI2 displacement field. We have already made sure that the insn
79          * slot for the patched instruction is within the same 2GB area
80          * as the original instruction (either kernel image or module area).
81          * Therefore the new displacement will always fit.
82          */
83         disp = *(s32 *)&p->ainsn.insn[1];
84         addr = (u64)(unsigned long)p->addr;
85         new_addr = (u64)(unsigned long)p->ainsn.insn;
86         new_disp = ((addr + (disp * 2)) - new_addr) / 2;
87         *(s32 *)&p->ainsn.insn[1] = new_disp;
88 }
89 NOKPROBE_SYMBOL(copy_instruction);
90
91 static inline int is_kernel_addr(void *addr)
92 {
93         return addr < (void *)_end;
94 }
95
96 static int s390_get_insn_slot(struct kprobe *p)
97 {
98         /*
99          * Get an insn slot that is within the same 2GB area like the original
100          * instruction. That way instructions with a 32bit signed displacement
101          * field can be patched and executed within the insn slot.
102          */
103         p->ainsn.insn = NULL;
104         if (is_kernel_addr(p->addr))
105                 p->ainsn.insn = get_dmainsn_slot();
106         else if (is_module_addr(p->addr))
107                 p->ainsn.insn = get_insn_slot();
108         return p->ainsn.insn ? 0 : -ENOMEM;
109 }
110 NOKPROBE_SYMBOL(s390_get_insn_slot);
111
112 static void s390_free_insn_slot(struct kprobe *p)
113 {
114         if (!p->ainsn.insn)
115                 return;
116         if (is_kernel_addr(p->addr))
117                 free_dmainsn_slot(p->ainsn.insn, 0);
118         else
119                 free_insn_slot(p->ainsn.insn, 0);
120         p->ainsn.insn = NULL;
121 }
122 NOKPROBE_SYMBOL(s390_free_insn_slot);
123
124 int arch_prepare_kprobe(struct kprobe *p)
125 {
126         if ((unsigned long) p->addr & 0x01)
127                 return -EINVAL;
128         /* Make sure the probe isn't going on a difficult instruction */
129         if (probe_is_prohibited_opcode(p->addr))
130                 return -EINVAL;
131         if (s390_get_insn_slot(p))
132                 return -ENOMEM;
133         copy_instruction(p);
134         return 0;
135 }
136 NOKPROBE_SYMBOL(arch_prepare_kprobe);
137
138 int arch_check_ftrace_location(struct kprobe *p)
139 {
140         return 0;
141 }
142
143 struct swap_insn_args {
144         struct kprobe *p;
145         unsigned int arm_kprobe : 1;
146 };
147
148 static int swap_instruction(void *data)
149 {
150         struct swap_insn_args *args = data;
151         struct ftrace_insn new_insn, *insn;
152         struct kprobe *p = args->p;
153         size_t len;
154
155         new_insn.opc = args->arm_kprobe ? BREAKPOINT_INSTRUCTION : p->opcode;
156         len = sizeof(new_insn.opc);
157         if (!p->ainsn.is_ftrace_insn)
158                 goto skip_ftrace;
159         len = sizeof(new_insn);
160         insn = (struct ftrace_insn *) p->addr;
161         if (args->arm_kprobe) {
162                 if (is_ftrace_nop(insn))
163                         new_insn.disp = KPROBE_ON_FTRACE_NOP;
164                 else
165                         new_insn.disp = KPROBE_ON_FTRACE_CALL;
166         } else {
167                 ftrace_generate_call_insn(&new_insn, (unsigned long)p->addr);
168                 if (insn->disp == KPROBE_ON_FTRACE_NOP)
169                         ftrace_generate_nop_insn(&new_insn);
170         }
171 skip_ftrace:
172         s390_kernel_write(p->addr, &new_insn, len);
173         return 0;
174 }
175 NOKPROBE_SYMBOL(swap_instruction);
176
177 void arch_arm_kprobe(struct kprobe *p)
178 {
179         struct swap_insn_args args = {.p = p, .arm_kprobe = 1};
180
181         stop_machine_cpuslocked(swap_instruction, &args, NULL);
182 }
183 NOKPROBE_SYMBOL(arch_arm_kprobe);
184
185 void arch_disarm_kprobe(struct kprobe *p)
186 {
187         struct swap_insn_args args = {.p = p, .arm_kprobe = 0};
188
189         stop_machine_cpuslocked(swap_instruction, &args, NULL);
190 }
191 NOKPROBE_SYMBOL(arch_disarm_kprobe);
192
193 void arch_remove_kprobe(struct kprobe *p)
194 {
195         s390_free_insn_slot(p);
196 }
197 NOKPROBE_SYMBOL(arch_remove_kprobe);
198
199 static void enable_singlestep(struct kprobe_ctlblk *kcb,
200                               struct pt_regs *regs,
201                               unsigned long ip)
202 {
203         struct per_regs per_kprobe;
204
205         /* Set up the PER control registers %cr9-%cr11 */
206         per_kprobe.control = PER_EVENT_IFETCH;
207         per_kprobe.start = ip;
208         per_kprobe.end = ip;
209
210         /* Save control regs and psw mask */
211         __ctl_store(kcb->kprobe_saved_ctl, 9, 11);
212         kcb->kprobe_saved_imask = regs->psw.mask &
213                 (PSW_MASK_PER | PSW_MASK_IO | PSW_MASK_EXT);
214
215         /* Set PER control regs, turns on single step for the given address */
216         __ctl_load(per_kprobe, 9, 11);
217         regs->psw.mask |= PSW_MASK_PER;
218         regs->psw.mask &= ~(PSW_MASK_IO | PSW_MASK_EXT);
219         regs->psw.addr = ip;
220 }
221 NOKPROBE_SYMBOL(enable_singlestep);
222
223 static void disable_singlestep(struct kprobe_ctlblk *kcb,
224                                struct pt_regs *regs,
225                                unsigned long ip)
226 {
227         /* Restore control regs and psw mask, set new psw address */
228         __ctl_load(kcb->kprobe_saved_ctl, 9, 11);
229         regs->psw.mask &= ~PSW_MASK_PER;
230         regs->psw.mask |= kcb->kprobe_saved_imask;
231         regs->psw.addr = ip;
232 }
233 NOKPROBE_SYMBOL(disable_singlestep);
234
235 /*
236  * Activate a kprobe by storing its pointer to current_kprobe. The
237  * previous kprobe is stored in kcb->prev_kprobe. A stack of up to
238  * two kprobes can be active, see KPROBE_REENTER.
239  */
240 static void push_kprobe(struct kprobe_ctlblk *kcb, struct kprobe *p)
241 {
242         kcb->prev_kprobe.kp = __this_cpu_read(current_kprobe);
243         kcb->prev_kprobe.status = kcb->kprobe_status;
244         __this_cpu_write(current_kprobe, p);
245 }
246 NOKPROBE_SYMBOL(push_kprobe);
247
248 /*
249  * Deactivate a kprobe by backing up to the previous state. If the
250  * current state is KPROBE_REENTER prev_kprobe.kp will be non-NULL,
251  * for any other state prev_kprobe.kp will be NULL.
252  */
253 static void pop_kprobe(struct kprobe_ctlblk *kcb)
254 {
255         __this_cpu_write(current_kprobe, kcb->prev_kprobe.kp);
256         kcb->kprobe_status = kcb->prev_kprobe.status;
257         kcb->prev_kprobe.kp = NULL;
258 }
259 NOKPROBE_SYMBOL(pop_kprobe);
260
261 void arch_prepare_kretprobe(struct kretprobe_instance *ri, struct pt_regs *regs)
262 {
263         ri->ret_addr = (kprobe_opcode_t *) regs->gprs[14];
264
265         /* Replace the return addr with trampoline addr */
266         regs->gprs[14] = (unsigned long) &kretprobe_trampoline;
267 }
268 NOKPROBE_SYMBOL(arch_prepare_kretprobe);
269
270 static void kprobe_reenter_check(struct kprobe_ctlblk *kcb, struct kprobe *p)
271 {
272         switch (kcb->kprobe_status) {
273         case KPROBE_HIT_SSDONE:
274         case KPROBE_HIT_ACTIVE:
275                 kprobes_inc_nmissed_count(p);
276                 break;
277         case KPROBE_HIT_SS:
278         case KPROBE_REENTER:
279         default:
280                 /*
281                  * A kprobe on the code path to single step an instruction
282                  * is a BUG. The code path resides in the .kprobes.text
283                  * section and is executed with interrupts disabled.
284                  */
285                 pr_err("Invalid kprobe detected.\n");
286                 dump_kprobe(p);
287                 BUG();
288         }
289 }
290 NOKPROBE_SYMBOL(kprobe_reenter_check);
291
292 static int kprobe_handler(struct pt_regs *regs)
293 {
294         struct kprobe_ctlblk *kcb;
295         struct kprobe *p;
296
297         /*
298          * We want to disable preemption for the entire duration of kprobe
299          * processing. That includes the calls to the pre/post handlers
300          * and single stepping the kprobe instruction.
301          */
302         preempt_disable();
303         kcb = get_kprobe_ctlblk();
304         p = get_kprobe((void *)(regs->psw.addr - 2));
305
306         if (p) {
307                 if (kprobe_running()) {
308                         /*
309                          * We have hit a kprobe while another is still
310                          * active. This can happen in the pre and post
311                          * handler. Single step the instruction of the
312                          * new probe but do not call any handler function
313                          * of this secondary kprobe.
314                          * push_kprobe and pop_kprobe saves and restores
315                          * the currently active kprobe.
316                          */
317                         kprobe_reenter_check(kcb, p);
318                         push_kprobe(kcb, p);
319                         kcb->kprobe_status = KPROBE_REENTER;
320                 } else {
321                         /*
322                          * If we have no pre-handler or it returned 0, we
323                          * continue with single stepping. If we have a
324                          * pre-handler and it returned non-zero, it prepped
325                          * for changing execution path, so get out doing
326                          * nothing more here.
327                          */
328                         push_kprobe(kcb, p);
329                         kcb->kprobe_status = KPROBE_HIT_ACTIVE;
330                         if (p->pre_handler && p->pre_handler(p, regs)) {
331                                 pop_kprobe(kcb);
332                                 preempt_enable_no_resched();
333                                 return 1;
334                         }
335                         kcb->kprobe_status = KPROBE_HIT_SS;
336                 }
337                 enable_singlestep(kcb, regs, (unsigned long) p->ainsn.insn);
338                 return 1;
339         } /* else:
340            * No kprobe at this address and no active kprobe. The trap has
341            * not been caused by a kprobe breakpoint. The race of breakpoint
342            * vs. kprobe remove does not exist because on s390 as we use
343            * stop_machine to arm/disarm the breakpoints.
344            */
345         preempt_enable_no_resched();
346         return 0;
347 }
348 NOKPROBE_SYMBOL(kprobe_handler);
349
350 /*
351  * Function return probe trampoline:
352  *      - init_kprobes() establishes a probepoint here
353  *      - When the probed function returns, this probe
354  *              causes the handlers to fire
355  */
356 static void __used kretprobe_trampoline_holder(void)
357 {
358         asm volatile(".global kretprobe_trampoline\n"
359                      "kretprobe_trampoline: bcr 0,0\n");
360 }
361
362 /*
363  * Called when the probe at kretprobe trampoline is hit
364  */
365 static int trampoline_probe_handler(struct kprobe *p, struct pt_regs *regs)
366 {
367         struct kretprobe_instance *ri;
368         struct hlist_head *head, empty_rp;
369         struct hlist_node *tmp;
370         unsigned long flags, orig_ret_address;
371         unsigned long trampoline_address;
372         kprobe_opcode_t *correct_ret_addr;
373
374         INIT_HLIST_HEAD(&empty_rp);
375         kretprobe_hash_lock(current, &head, &flags);
376
377         /*
378          * It is possible to have multiple instances associated with a given
379          * task either because an multiple functions in the call path
380          * have a return probe installed on them, and/or more than one return
381          * return probe was registered for a target function.
382          *
383          * We can handle this because:
384          *     - instances are always inserted at the head of the list
385          *     - when multiple return probes are registered for the same
386          *       function, the first instance's ret_addr will point to the
387          *       real return address, and all the rest will point to
388          *       kretprobe_trampoline
389          */
390         ri = NULL;
391         orig_ret_address = 0;
392         correct_ret_addr = NULL;
393         trampoline_address = (unsigned long) &kretprobe_trampoline;
394         hlist_for_each_entry_safe(ri, tmp, head, hlist) {
395                 if (ri->task != current)
396                         /* another task is sharing our hash bucket */
397                         continue;
398
399                 orig_ret_address = (unsigned long) ri->ret_addr;
400
401                 if (orig_ret_address != trampoline_address)
402                         /*
403                          * This is the real return address. Any other
404                          * instances associated with this task are for
405                          * other calls deeper on the call stack
406                          */
407                         break;
408         }
409
410         kretprobe_assert(ri, orig_ret_address, trampoline_address);
411
412         correct_ret_addr = ri->ret_addr;
413         hlist_for_each_entry_safe(ri, tmp, head, hlist) {
414                 if (ri->task != current)
415                         /* another task is sharing our hash bucket */
416                         continue;
417
418                 orig_ret_address = (unsigned long) ri->ret_addr;
419
420                 if (ri->rp && ri->rp->handler) {
421                         ri->ret_addr = correct_ret_addr;
422                         ri->rp->handler(ri, regs);
423                 }
424
425                 recycle_rp_inst(ri, &empty_rp);
426
427                 if (orig_ret_address != trampoline_address)
428                         /*
429                          * This is the real return address. Any other
430                          * instances associated with this task are for
431                          * other calls deeper on the call stack
432                          */
433                         break;
434         }
435
436         regs->psw.addr = orig_ret_address;
437
438         kretprobe_hash_unlock(current, &flags);
439
440         hlist_for_each_entry_safe(ri, tmp, &empty_rp, hlist) {
441                 hlist_del(&ri->hlist);
442                 kfree(ri);
443         }
444         /*
445          * By returning a non-zero value, we are telling
446          * kprobe_handler() that we don't want the post_handler
447          * to run (and have re-enabled preemption)
448          */
449         return 1;
450 }
451 NOKPROBE_SYMBOL(trampoline_probe_handler);
452
453 /*
454  * Called after single-stepping.  p->addr is the address of the
455  * instruction whose first byte has been replaced by the "breakpoint"
456  * instruction.  To avoid the SMP problems that can occur when we
457  * temporarily put back the original opcode to single-step, we
458  * single-stepped a copy of the instruction.  The address of this
459  * copy is p->ainsn.insn.
460  */
461 static void resume_execution(struct kprobe *p, struct pt_regs *regs)
462 {
463         struct kprobe_ctlblk *kcb = get_kprobe_ctlblk();
464         unsigned long ip = regs->psw.addr;
465         int fixup = probe_get_fixup_type(p->ainsn.insn);
466
467         /* Check if the kprobes location is an enabled ftrace caller */
468         if (p->ainsn.is_ftrace_insn) {
469                 struct ftrace_insn *insn = (struct ftrace_insn *) p->addr;
470                 struct ftrace_insn call_insn;
471
472                 ftrace_generate_call_insn(&call_insn, (unsigned long) p->addr);
473                 /*
474                  * A kprobe on an enabled ftrace call site actually single
475                  * stepped an unconditional branch (ftrace nop equivalent).
476                  * Now we need to fixup things and pretend that a brasl r0,...
477                  * was executed instead.
478                  */
479                 if (insn->disp == KPROBE_ON_FTRACE_CALL) {
480                         ip += call_insn.disp * 2 - MCOUNT_INSN_SIZE;
481                         regs->gprs[0] = (unsigned long)p->addr + sizeof(*insn);
482                 }
483         }
484
485         if (fixup & FIXUP_PSW_NORMAL)
486                 ip += (unsigned long) p->addr - (unsigned long) p->ainsn.insn;
487
488         if (fixup & FIXUP_BRANCH_NOT_TAKEN) {
489                 int ilen = insn_length(p->ainsn.insn[0] >> 8);
490                 if (ip - (unsigned long) p->ainsn.insn == ilen)
491                         ip = (unsigned long) p->addr + ilen;
492         }
493
494         if (fixup & FIXUP_RETURN_REGISTER) {
495                 int reg = (p->ainsn.insn[0] & 0xf0) >> 4;
496                 regs->gprs[reg] += (unsigned long) p->addr -
497                                    (unsigned long) p->ainsn.insn;
498         }
499
500         disable_singlestep(kcb, regs, ip);
501 }
502 NOKPROBE_SYMBOL(resume_execution);
503
504 static int post_kprobe_handler(struct pt_regs *regs)
505 {
506         struct kprobe_ctlblk *kcb = get_kprobe_ctlblk();
507         struct kprobe *p = kprobe_running();
508
509         if (!p)
510                 return 0;
511
512         resume_execution(p, regs);
513         if (kcb->kprobe_status != KPROBE_REENTER && p->post_handler) {
514                 kcb->kprobe_status = KPROBE_HIT_SSDONE;
515                 p->post_handler(p, regs, 0);
516         }
517         pop_kprobe(kcb);
518         preempt_enable_no_resched();
519
520         /*
521          * if somebody else is singlestepping across a probe point, psw mask
522          * will have PER set, in which case, continue the remaining processing
523          * of do_single_step, as if this is not a probe hit.
524          */
525         if (regs->psw.mask & PSW_MASK_PER)
526                 return 0;
527
528         return 1;
529 }
530 NOKPROBE_SYMBOL(post_kprobe_handler);
531
532 static int kprobe_trap_handler(struct pt_regs *regs, int trapnr)
533 {
534         struct kprobe_ctlblk *kcb = get_kprobe_ctlblk();
535         struct kprobe *p = kprobe_running();
536         const struct exception_table_entry *entry;
537
538         switch(kcb->kprobe_status) {
539         case KPROBE_HIT_SS:
540         case KPROBE_REENTER:
541                 /*
542                  * We are here because the instruction being single
543                  * stepped caused a page fault. We reset the current
544                  * kprobe and the nip points back to the probe address
545                  * and allow the page fault handler to continue as a
546                  * normal page fault.
547                  */
548                 disable_singlestep(kcb, regs, (unsigned long) p->addr);
549                 pop_kprobe(kcb);
550                 preempt_enable_no_resched();
551                 break;
552         case KPROBE_HIT_ACTIVE:
553         case KPROBE_HIT_SSDONE:
554                 /*
555                  * We increment the nmissed count for accounting,
556                  * we can also use npre/npostfault count for accounting
557                  * these specific fault cases.
558                  */
559                 kprobes_inc_nmissed_count(p);
560
561                 /*
562                  * We come here because instructions in the pre/post
563                  * handler caused the page_fault, this could happen
564                  * if handler tries to access user space by
565                  * copy_from_user(), get_user() etc. Let the
566                  * user-specified handler try to fix it first.
567                  */
568                 if (p->fault_handler && p->fault_handler(p, regs, trapnr))
569                         return 1;
570
571                 /*
572                  * In case the user-specified fault handler returned
573                  * zero, try to fix up.
574                  */
575                 entry = search_exception_tables(regs->psw.addr);
576                 if (entry) {
577                         regs->psw.addr = extable_fixup(entry);
578                         return 1;
579                 }
580
581                 /*
582                  * fixup_exception() could not handle it,
583                  * Let do_page_fault() fix it.
584                  */
585                 break;
586         default:
587                 break;
588         }
589         return 0;
590 }
591 NOKPROBE_SYMBOL(kprobe_trap_handler);
592
593 int kprobe_fault_handler(struct pt_regs *regs, int trapnr)
594 {
595         int ret;
596
597         if (regs->psw.mask & (PSW_MASK_IO | PSW_MASK_EXT))
598                 local_irq_disable();
599         ret = kprobe_trap_handler(regs, trapnr);
600         if (regs->psw.mask & (PSW_MASK_IO | PSW_MASK_EXT))
601                 local_irq_restore(regs->psw.mask & ~PSW_MASK_PER);
602         return ret;
603 }
604 NOKPROBE_SYMBOL(kprobe_fault_handler);
605
606 /*
607  * Wrapper routine to for handling exceptions.
608  */
609 int kprobe_exceptions_notify(struct notifier_block *self,
610                              unsigned long val, void *data)
611 {
612         struct die_args *args = (struct die_args *) data;
613         struct pt_regs *regs = args->regs;
614         int ret = NOTIFY_DONE;
615
616         if (regs->psw.mask & (PSW_MASK_IO | PSW_MASK_EXT))
617                 local_irq_disable();
618
619         switch (val) {
620         case DIE_BPT:
621                 if (kprobe_handler(regs))
622                         ret = NOTIFY_STOP;
623                 break;
624         case DIE_SSTEP:
625                 if (post_kprobe_handler(regs))
626                         ret = NOTIFY_STOP;
627                 break;
628         case DIE_TRAP:
629                 if (!preemptible() && kprobe_running() &&
630                     kprobe_trap_handler(regs, args->trapnr))
631                         ret = NOTIFY_STOP;
632                 break;
633         default:
634                 break;
635         }
636
637         if (regs->psw.mask & (PSW_MASK_IO | PSW_MASK_EXT))
638                 local_irq_restore(regs->psw.mask & ~PSW_MASK_PER);
639
640         return ret;
641 }
642 NOKPROBE_SYMBOL(kprobe_exceptions_notify);
643
644 static struct kprobe trampoline = {
645         .addr = (kprobe_opcode_t *) &kretprobe_trampoline,
646         .pre_handler = trampoline_probe_handler
647 };
648
649 int __init arch_init_kprobes(void)
650 {
651         return register_kprobe(&trampoline);
652 }
653
654 int arch_trampoline_kprobe(struct kprobe *p)
655 {
656         return p->addr == (kprobe_opcode_t *) &kretprobe_trampoline;
657 }
658 NOKPROBE_SYMBOL(arch_trampoline_kprobe);