1 // SPDX-License-Identifier: GPL-2.0-only 2 /* 3 * arch/arm64/kernel/ftrace.c 4 * 5 * Copyright (C) 2013 Linaro Limited 6 * Author: AKASHI Takahiro <takahiro.akashi@linaro.org> 7 */ 8 9 #include <linux/ftrace.h> 10 #include <linux/module.h> 11 #include <linux/swab.h> 12 #include <linux/uaccess.h> 13 14 #include <asm/cacheflush.h> 15 #include <asm/debug-monitors.h> 16 #include <asm/ftrace.h> 17 #include <asm/insn.h> 18 #include <asm/text-patching.h> 19 20 #ifdef CONFIG_DYNAMIC_FTRACE_WITH_ARGS 21 struct fregs_offset { 22 const char *name; 23 int offset; 24 }; 25 26 #define FREGS_OFFSET(n, field) \ 27 { \ 28 .name = n, \ 29 .offset = offsetof(struct __arch_ftrace_regs, field), \ 30 } 31 32 static const struct fregs_offset fregs_offsets[] = { 33 FREGS_OFFSET("x0", regs[0]), 34 FREGS_OFFSET("x1", regs[1]), 35 FREGS_OFFSET("x2", regs[2]), 36 FREGS_OFFSET("x3", regs[3]), 37 FREGS_OFFSET("x4", regs[4]), 38 FREGS_OFFSET("x5", regs[5]), 39 FREGS_OFFSET("x6", regs[6]), 40 FREGS_OFFSET("x7", regs[7]), 41 FREGS_OFFSET("x8", regs[8]), 42 43 FREGS_OFFSET("x29", fp), 44 FREGS_OFFSET("x30", lr), 45 FREGS_OFFSET("lr", lr), 46 47 FREGS_OFFSET("sp", sp), 48 FREGS_OFFSET("pc", pc), 49 }; 50 51 int ftrace_regs_query_register_offset(const char *name) 52 { 53 for (int i = 0; i < ARRAY_SIZE(fregs_offsets); i++) { 54 const struct fregs_offset *roff = &fregs_offsets[i]; 55 if (!strcmp(roff->name, name)) 56 return roff->offset; 57 } 58 59 return -EINVAL; 60 } 61 #endif 62 63 unsigned long ftrace_call_adjust(unsigned long addr) 64 { 65 /* 66 * When using mcount, addr is the address of the mcount call 67 * instruction, and no adjustment is necessary. 68 */ 69 if (!IS_ENABLED(CONFIG_DYNAMIC_FTRACE_WITH_ARGS)) 70 return addr; 71 72 /* 73 * When using patchable-function-entry without pre-function NOPS, addr 74 * is the address of the first NOP after the function entry point. 75 * 76 * The compiler has either generated: 77 * 78 * addr+00: func: NOP // To be patched to MOV X9, LR 79 * addr+04: NOP // To be patched to BL <caller> 80 * 81 * Or: 82 * 83 * addr-04: BTI C 84 * addr+00: func: NOP // To be patched to MOV X9, LR 85 * addr+04: NOP // To be patched to BL <caller> 86 * 87 * We must adjust addr to the address of the NOP which will be patched 88 * to `BL <caller>`, which is at `addr + 4` bytes in either case. 89 * 90 */ 91 if (!IS_ENABLED(CONFIG_DYNAMIC_FTRACE_WITH_CALL_OPS)) 92 return addr + AARCH64_INSN_SIZE; 93 94 /* 95 * When using patchable-function-entry with pre-function NOPs, addr is 96 * the address of the first pre-function NOP. 97 * 98 * Starting from an 8-byte aligned base, the compiler has either 99 * generated: 100 * 101 * addr+00: NOP // Literal (first 32 bits) 102 * addr+04: NOP // Literal (last 32 bits) 103 * addr+08: func: NOP // To be patched to MOV X9, LR 104 * addr+12: NOP // To be patched to BL <caller> 105 * 106 * Or: 107 * 108 * addr+00: NOP // Literal (first 32 bits) 109 * addr+04: NOP // Literal (last 32 bits) 110 * addr+08: func: BTI C 111 * addr+12: NOP // To be patched to MOV X9, LR 112 * addr+16: NOP // To be patched to BL <caller> 113 * 114 * We must adjust addr to the address of the NOP which will be patched 115 * to `BL <caller>`, which is at either addr+12 or addr+16 depending on 116 * whether there is a BTI. 117 */ 118 119 if (!IS_ALIGNED(addr, sizeof(unsigned long))) { 120 WARN_RATELIMIT(1, "Misaligned patch-site %pS\n", 121 (void *)(addr + 8)); 122 return 0; 123 } 124 125 /* Skip the NOPs placed before the function entry point */ 126 addr += 2 * AARCH64_INSN_SIZE; 127 128 /* Skip any BTI */ 129 if (IS_ENABLED(CONFIG_ARM64_BTI_KERNEL)) { 130 u32 insn = le32_to_cpu(*(__le32 *)addr); 131 132 if (aarch64_insn_is_bti(insn)) { 133 addr += AARCH64_INSN_SIZE; 134 } else if (insn != aarch64_insn_gen_nop()) { 135 WARN_RATELIMIT(1, "unexpected insn in patch-site %pS: 0x%08x\n", 136 (void *)addr, insn); 137 } 138 } 139 140 /* Skip the first NOP after function entry */ 141 addr += AARCH64_INSN_SIZE; 142 143 return addr; 144 } 145 146 /* Convert fentry_ip to the symbol address without kallsyms */ 147 unsigned long arch_ftrace_get_symaddr(unsigned long fentry_ip) 148 { 149 u32 insn; 150 151 /* 152 * When using patchable-function-entry without pre-function NOPS, ftrace 153 * entry is the address of the first NOP after the function entry point. 154 * 155 * The compiler has either generated: 156 * 157 * func+00: func: NOP // To be patched to MOV X9, LR 158 * func+04: NOP // To be patched to BL <caller> 159 * 160 * Or: 161 * 162 * func-04: BTI C 163 * func+00: func: NOP // To be patched to MOV X9, LR 164 * func+04: NOP // To be patched to BL <caller> 165 * 166 * The fentry_ip is the address of `BL <caller>` which is at `func + 4` 167 * bytes in either case. 168 */ 169 if (!IS_ENABLED(CONFIG_DYNAMIC_FTRACE_WITH_CALL_OPS)) 170 return fentry_ip - AARCH64_INSN_SIZE; 171 172 /* 173 * When using patchable-function-entry with pre-function NOPs, BTI is 174 * a bit different. 175 * 176 * func+00: func: NOP // To be patched to MOV X9, LR 177 * func+04: NOP // To be patched to BL <caller> 178 * 179 * Or: 180 * 181 * func+00: func: BTI C 182 * func+04: NOP // To be patched to MOV X9, LR 183 * func+08: NOP // To be patched to BL <caller> 184 * 185 * The fentry_ip is the address of `BL <caller>` which is at either 186 * `func + 4` or `func + 8` depends on whether there is a BTI. 187 */ 188 189 /* If there is no BTI, the func address should be one instruction before. */ 190 if (!IS_ENABLED(CONFIG_ARM64_BTI_KERNEL)) 191 return fentry_ip - AARCH64_INSN_SIZE; 192 193 /* We want to be extra safe in case entry ip is on the page edge, 194 * but otherwise we need to avoid get_kernel_nofault()'s overhead. 195 */ 196 if ((fentry_ip & ~PAGE_MASK) < AARCH64_INSN_SIZE * 2) { 197 if (get_kernel_nofault(insn, (u32 *)(fentry_ip - AARCH64_INSN_SIZE * 2))) 198 return 0; 199 } else { 200 insn = *(u32 *)(fentry_ip - AARCH64_INSN_SIZE * 2); 201 } 202 203 if (aarch64_insn_is_bti(le32_to_cpu((__le32)insn))) 204 return fentry_ip - AARCH64_INSN_SIZE * 2; 205 206 return fentry_ip - AARCH64_INSN_SIZE; 207 } 208 209 /* 210 * Replace a single instruction, which may be a branch or NOP. 211 * If @validate == true, a replaced instruction is checked against 'old'. 212 */ 213 static int ftrace_modify_code(unsigned long pc, u32 old, u32 new, 214 bool validate) 215 { 216 u32 replaced; 217 218 /* 219 * Note: 220 * We are paranoid about modifying text, as if a bug were to happen, it 221 * could cause us to read or write to someplace that could cause harm. 222 * Carefully read and modify the code with aarch64_insn_*() which uses 223 * probe_kernel_*(), and make sure what we read is what we expected it 224 * to be before modifying it. 225 */ 226 if (validate) { 227 if (aarch64_insn_read((void *)pc, &replaced)) 228 return -EFAULT; 229 230 if (replaced != old) 231 return -EINVAL; 232 } 233 if (aarch64_insn_patch_text_nosync((void *)pc, new)) 234 return -EPERM; 235 236 return 0; 237 } 238 239 /* 240 * Replace tracer function in ftrace_caller() 241 */ 242 int ftrace_update_ftrace_func(ftrace_func_t func) 243 { 244 unsigned long pc; 245 u32 new; 246 247 /* 248 * When using CALL_OPS, the function to call is associated with the 249 * call site, and we don't have a global function pointer to update. 250 */ 251 if (IS_ENABLED(CONFIG_DYNAMIC_FTRACE_WITH_CALL_OPS)) 252 return 0; 253 254 pc = (unsigned long)ftrace_call; 255 new = aarch64_insn_gen_branch_imm(pc, (unsigned long)func, 256 AARCH64_INSN_BRANCH_LINK); 257 258 return ftrace_modify_code(pc, 0, new, false); 259 } 260 261 static struct plt_entry *get_ftrace_plt(struct module *mod) 262 { 263 #ifdef CONFIG_MODULES 264 struct plt_entry *plt = mod->arch.ftrace_trampolines; 265 266 return &plt[FTRACE_PLT_IDX]; 267 #else 268 return NULL; 269 #endif 270 } 271 272 static bool reachable_by_bl(unsigned long addr, unsigned long pc) 273 { 274 long offset = (long)addr - (long)pc; 275 276 return offset >= -SZ_128M && offset < SZ_128M; 277 } 278 279 /* 280 * Find the address the callsite must branch to in order to reach '*addr'. 281 * 282 * Due to the limited range of 'BL' instructions, modules may be placed too far 283 * away to branch directly and must use a PLT. 284 * 285 * Returns true when '*addr' contains a reachable target address, or has been 286 * modified to contain a PLT address. Returns false otherwise. 287 */ 288 static bool ftrace_find_callable_addr(struct dyn_ftrace *rec, 289 struct module *mod, 290 unsigned long *addr) 291 { 292 unsigned long pc = rec->ip; 293 struct plt_entry *plt; 294 295 /* 296 * If a custom trampoline is unreachable, rely on the ftrace_caller 297 * trampoline which knows how to indirectly reach that trampoline 298 * through ops->direct_call. 299 */ 300 if (*addr != FTRACE_ADDR && !reachable_by_bl(*addr, pc)) 301 *addr = FTRACE_ADDR; 302 303 /* 304 * When the target is within range of the 'BL' instruction, use 'addr' 305 * as-is and branch to that directly. 306 */ 307 if (reachable_by_bl(*addr, pc)) 308 return true; 309 310 /* 311 * When the target is outside of the range of a 'BL' instruction, we 312 * must use a PLT to reach it. We can only place PLTs for modules, and 313 * only when module PLT support is built-in. 314 */ 315 if (!IS_ENABLED(CONFIG_MODULES)) 316 return false; 317 318 /* 319 * 'mod' is only set at module load time, but if we end up 320 * dealing with an out-of-range condition, we can assume it 321 * is due to a module being loaded far away from the kernel. 322 * 323 * NOTE: __module_text_address() must be called within a RCU read 324 * section, but we can rely on ftrace_lock to ensure that 'mod' 325 * retains its validity throughout the remainder of this code. 326 */ 327 if (!mod) { 328 guard(rcu)(); 329 mod = __module_text_address(pc); 330 } 331 332 if (WARN_ON(!mod)) 333 return false; 334 335 plt = get_ftrace_plt(mod); 336 if (!plt) { 337 pr_err("ftrace: no module PLT for %ps\n", (void *)*addr); 338 return false; 339 } 340 341 *addr = (unsigned long)plt; 342 return true; 343 } 344 345 #ifdef CONFIG_DYNAMIC_FTRACE_WITH_CALL_OPS 346 static const struct ftrace_ops *arm64_rec_get_ops(struct dyn_ftrace *rec) 347 { 348 const struct ftrace_ops *ops = NULL; 349 350 if (rec->flags & FTRACE_FL_CALL_OPS_EN) { 351 ops = ftrace_find_unique_ops(rec); 352 WARN_ON_ONCE(!ops); 353 } 354 355 if (!ops) 356 ops = &ftrace_list_ops; 357 358 return ops; 359 } 360 361 static int ftrace_rec_set_ops(const struct dyn_ftrace *rec, 362 const struct ftrace_ops *ops) 363 { 364 unsigned long literal = ALIGN_DOWN(rec->ip - 12, 8); 365 return aarch64_insn_write_literal_u64((void *)literal, 366 (unsigned long)ops); 367 } 368 369 static int ftrace_rec_set_nop_ops(struct dyn_ftrace *rec) 370 { 371 return ftrace_rec_set_ops(rec, &ftrace_nop_ops); 372 } 373 374 static int ftrace_rec_update_ops(struct dyn_ftrace *rec) 375 { 376 return ftrace_rec_set_ops(rec, arm64_rec_get_ops(rec)); 377 } 378 #else 379 static int ftrace_rec_set_nop_ops(struct dyn_ftrace *rec) { return 0; } 380 static int ftrace_rec_update_ops(struct dyn_ftrace *rec) { return 0; } 381 #endif 382 383 /* 384 * Turn on the call to ftrace_caller() in instrumented function 385 */ 386 int ftrace_make_call(struct dyn_ftrace *rec, unsigned long addr) 387 { 388 unsigned long pc = rec->ip; 389 u32 old, new; 390 int ret; 391 392 ret = ftrace_rec_update_ops(rec); 393 if (ret) 394 return ret; 395 396 if (!ftrace_find_callable_addr(rec, NULL, &addr)) 397 return -EINVAL; 398 399 old = aarch64_insn_gen_nop(); 400 new = aarch64_insn_gen_branch_imm(pc, addr, AARCH64_INSN_BRANCH_LINK); 401 402 return ftrace_modify_code(pc, old, new, true); 403 } 404 405 #ifdef CONFIG_DYNAMIC_FTRACE_WITH_CALL_OPS 406 int ftrace_modify_call(struct dyn_ftrace *rec, unsigned long old_addr, 407 unsigned long addr) 408 { 409 unsigned long pc = rec->ip; 410 u32 old, new; 411 int ret; 412 413 ret = ftrace_rec_set_ops(rec, arm64_rec_get_ops(rec)); 414 if (ret) 415 return ret; 416 417 if (!ftrace_find_callable_addr(rec, NULL, &old_addr)) 418 return -EINVAL; 419 if (!ftrace_find_callable_addr(rec, NULL, &addr)) 420 return -EINVAL; 421 422 old = aarch64_insn_gen_branch_imm(pc, old_addr, 423 AARCH64_INSN_BRANCH_LINK); 424 new = aarch64_insn_gen_branch_imm(pc, addr, AARCH64_INSN_BRANCH_LINK); 425 426 return ftrace_modify_code(pc, old, new, true); 427 } 428 #endif 429 430 #ifdef CONFIG_DYNAMIC_FTRACE_WITH_ARGS 431 /* 432 * The compiler has inserted two NOPs before the regular function prologue. 433 * All instrumented functions follow the AAPCS, so x0-x8 and x19-x30 are live, 434 * and x9-x18 are free for our use. 435 * 436 * At runtime we want to be able to swing a single NOP <-> BL to enable or 437 * disable the ftrace call. The BL requires us to save the original LR value, 438 * so here we insert a <MOV X9, LR> over the first NOP so the instructions 439 * before the regular prologue are: 440 * 441 * | Compiled | Disabled | Enabled | 442 * +----------+------------+------------+ 443 * | NOP | MOV X9, LR | MOV X9, LR | 444 * | NOP | NOP | BL <entry> | 445 * 446 * The LR value will be recovered by ftrace_caller, and restored into LR 447 * before returning to the regular function prologue. When a function is not 448 * being traced, the MOV is not harmful given x9 is not live per the AAPCS. 449 * 450 * Note: ftrace_process_locs() has pre-adjusted rec->ip to be the address of 451 * the BL. 452 */ 453 int ftrace_init_nop(struct module *mod, struct dyn_ftrace *rec) 454 { 455 unsigned long pc = rec->ip - AARCH64_INSN_SIZE; 456 u32 old, new; 457 int ret; 458 459 ret = ftrace_rec_set_nop_ops(rec); 460 if (ret) 461 return ret; 462 463 old = aarch64_insn_gen_nop(); 464 new = aarch64_insn_gen_move_reg(AARCH64_INSN_REG_9, 465 AARCH64_INSN_REG_LR, 466 AARCH64_INSN_VARIANT_64BIT); 467 return ftrace_modify_code(pc, old, new, true); 468 } 469 #endif 470 471 /* 472 * Turn off the call to ftrace_caller() in instrumented function 473 */ 474 int ftrace_make_nop(struct module *mod, struct dyn_ftrace *rec, 475 unsigned long addr) 476 { 477 unsigned long pc = rec->ip; 478 u32 old = 0, new; 479 int ret; 480 481 new = aarch64_insn_gen_nop(); 482 483 ret = ftrace_rec_set_nop_ops(rec); 484 if (ret) 485 return ret; 486 487 /* 488 * When using mcount, callsites in modules may have been initalized to 489 * call an arbitrary module PLT (which redirects to the _mcount stub) 490 * rather than the ftrace PLT we'll use at runtime (which redirects to 491 * the ftrace trampoline). We can ignore the old PLT when initializing 492 * the callsite. 493 * 494 * Note: 'mod' is only set at module load time. 495 */ 496 if (!IS_ENABLED(CONFIG_DYNAMIC_FTRACE_WITH_ARGS) && mod) 497 return aarch64_insn_patch_text_nosync((void *)pc, new); 498 499 if (!ftrace_find_callable_addr(rec, mod, &addr)) 500 return -EINVAL; 501 502 old = aarch64_insn_gen_branch_imm(pc, addr, AARCH64_INSN_BRANCH_LINK); 503 504 return ftrace_modify_code(pc, old, new, true); 505 } 506 507 void arch_ftrace_update_code(int command) 508 { 509 command |= FTRACE_MAY_SLEEP; 510 ftrace_modify_all_code(command); 511 } 512 513 #ifdef CONFIG_FUNCTION_GRAPH_TRACER 514 /* 515 * function_graph tracer expects ftrace_return_to_handler() to be called 516 * on the way back to parent. For this purpose, this function is called 517 * in _mcount() or ftrace_caller() to replace return address (*parent) on 518 * the call stack to return_to_handler. 519 */ 520 void prepare_ftrace_return(unsigned long self_addr, unsigned long *parent, 521 unsigned long frame_pointer) 522 { 523 unsigned long return_hooker = (unsigned long)&return_to_handler; 524 unsigned long old; 525 526 if (unlikely(atomic_read(¤t->tracing_graph_pause))) 527 return; 528 529 /* 530 * Note: 531 * No protection against faulting at *parent, which may be seen 532 * on other archs. It's unlikely on AArch64. 533 */ 534 old = *parent; 535 536 if (!function_graph_enter(old, self_addr, frame_pointer, 537 (void *)frame_pointer)) { 538 *parent = return_hooker; 539 } 540 } 541 542 #ifdef CONFIG_DYNAMIC_FTRACE_WITH_ARGS 543 void ftrace_graph_func(unsigned long ip, unsigned long parent_ip, 544 struct ftrace_ops *op, struct ftrace_regs *fregs) 545 { 546 unsigned long return_hooker = (unsigned long)&return_to_handler; 547 unsigned long frame_pointer = arch_ftrace_regs(fregs)->fp; 548 unsigned long *parent = &arch_ftrace_regs(fregs)->lr; 549 unsigned long old; 550 551 if (unlikely(atomic_read(¤t->tracing_graph_pause))) 552 return; 553 554 old = *parent; 555 556 if (!function_graph_enter_regs(old, ip, frame_pointer, 557 (void *)frame_pointer, fregs)) { 558 *parent = return_hooker; 559 } 560 } 561 #else 562 /* 563 * Turn on/off the call to ftrace_graph_caller() in ftrace_caller() 564 * depending on @enable. 565 */ 566 static int ftrace_modify_graph_caller(bool enable) 567 { 568 unsigned long pc = (unsigned long)&ftrace_graph_call; 569 u32 branch, nop; 570 571 branch = aarch64_insn_gen_branch_imm(pc, 572 (unsigned long)ftrace_graph_caller, 573 AARCH64_INSN_BRANCH_NOLINK); 574 nop = aarch64_insn_gen_nop(); 575 576 if (enable) 577 return ftrace_modify_code(pc, nop, branch, true); 578 else 579 return ftrace_modify_code(pc, branch, nop, true); 580 } 581 582 int ftrace_enable_ftrace_graph_caller(void) 583 { 584 return ftrace_modify_graph_caller(true); 585 } 586 587 int ftrace_disable_ftrace_graph_caller(void) 588 { 589 return ftrace_modify_graph_caller(false); 590 } 591 #endif /* CONFIG_DYNAMIC_FTRACE_WITH_ARGS */ 592 #endif /* CONFIG_FUNCTION_GRAPH_TRACER */ 593