The single-stepped copy of a branch has a break instruction in its delay slot. An annulled branch that is not taken skips that slot and runs past the copy, and a taken ba,a or cbcond branches away without reaching it.
Put a second break instruction after the delay slot, and resume after the original delay slot when it is hit. Refuse probes on ba,a, fba,a and cbcond. Link: https://github.com/sparclinux/issues/issues/110 Signed-off-by: Stian Halseth <[email protected]> --- arch/sparc/include/asm/kprobes.h | 3 ++- arch/sparc/kernel/kprobes.c | 43 ++++++++++++++++++++++++++++---- 2 files changed, 40 insertions(+), 6 deletions(-) diff --git a/arch/sparc/include/asm/kprobes.h b/arch/sparc/include/asm/kprobes.h index 8cc9697846fa1..2f0980da80d3b 100644 --- a/arch/sparc/include/asm/kprobes.h +++ b/arch/sparc/include/asm/kprobes.h @@ -15,7 +15,7 @@ typedef u32 kprobe_opcode_t; -#define MAX_INSN_SIZE 2 +#define MAX_INSN_SIZE 3 #define kretprobe_blacklist_size 0 @@ -25,6 +25,7 @@ void arch_remove_kprobe(struct kprobe *p); #define flush_insn_slot(p) \ do { flushi(&(p)->ainsn.insn[0]); \ flushi(&(p)->ainsn.insn[1]); \ + flushi(&(p)->ainsn.insn[2]); \ } while (0) void __kretprobe_trampoline(void); diff --git a/arch/sparc/kernel/kprobes.c b/arch/sparc/kernel/kprobes.c index 327d83188a978..dc1180d4c2338 100644 --- a/arch/sparc/kernel/kprobes.c +++ b/arch/sparc/kernel/kprobes.c @@ -21,7 +21,8 @@ * * In the kprobe->ainsn.insn[] array we store the original * instruction at index zero and a break instruction at - * index one. + * index one, and another at index two for a branch that + * annuls its delay slot. * * When we hit a kprobe we: * - Run the pre-handler @@ -47,11 +48,34 @@ DEFINE_PER_CPU(struct kprobe_ctlblk, kprobe_ctlblk); struct kretprobe_blackpoint kretprobe_blacklist[] = {{NULL, NULL}}; +/* cbcond has no delay slot and ba,a annuls it, so when taken the + * single-stepped copy branches away without reaching a break instruction. + */ +static bool __kprobes kprobe_insn_rejected(u32 insn) +{ + if (insn & 0xc0000000) + return false; + + switch ((insn >> 22) & 0x7) { + case 1: /* BPcc */ + case 2: /* Bicc */ + case 5: /* FBPfcc */ + case 6: /* FBfcc */ + return (insn & 0x3e000000) == 0x30000000; + case 3: /* BPr, cbcond */ + return insn & 0x10000000; + } + return false; +} + int __kprobes arch_prepare_kprobe(struct kprobe *p) { if ((unsigned long) p->addr & 0x3UL) return -EILSEQ; + if (kprobe_insn_rejected(*p->addr)) + return -EINVAL; + p->ainsn.insn = get_insn_slot(); if (!p->ainsn.insn) return -ENOMEM; @@ -62,6 +86,9 @@ int __kprobes arch_prepare_kprobe(struct kprobe *p) p->ainsn.insn[1] = BREAKPOINT_INSTRUCTION_2; flushi(&p->ainsn.insn[1]); + p->ainsn.insn[2] = BREAKPOINT_INSTRUCTION_2; + flushi(&p->ainsn.insn[2]); + p->opcode = *p->addr; return 0; } @@ -295,12 +322,18 @@ static void __kprobes resume_execution(struct kprobe *p, { u32 insn = p->ainsn.insn[0]; - regs->tnpc = relbranch_fixup(insn, p, regs, kcb); + if (regs->tpc == (unsigned long) &p->ainsn.insn[2]) { + /* An untaken branch annulled its delay slot. */ + regs->tpc = kcb->kprobe_orig_tnpc + 0x4UL; + regs->tnpc = kcb->kprobe_orig_tnpc + 0x8UL; + } else { + regs->tnpc = relbranch_fixup(insn, p, regs, kcb); - /* This assignment must occur after relbranch_fixup() */ - regs->tpc = kcb->kprobe_orig_tnpc; + /* This assignment must occur after relbranch_fixup() */ + regs->tpc = kcb->kprobe_orig_tnpc; - retpc_fixup(regs, insn, (unsigned long) p->addr); + retpc_fixup(regs, insn, (unsigned long) p->addr); + } regs->tstate = ((regs->tstate & ~TSTATE_PIL) | kcb->kprobe_orig_tstate_pil); -- 2.43.0
