uprobes single-step a copy of the probed instruction in an XOL slot.
When the copy is a taken PC-relative branch, its target is relative to
the slot, and relbranch_fixup() moves it back to the probed code. Like
its kprobes counterpart, it only recognizes call, BPcc and Bicc. After a
taken BPr (brz, brnz, ...), FBfcc or FBPfcc, the task continues at the
slot's address plus the branch displacement, inside the XOL page, and
dies with SIGILL.
GCC often emits a BPr as a function's first instruction, so a plain
function-entry uprobe can kill the probed program. In QEMU sun4u, with a
uprobe on a "brz,pn %o0, 1f", the first call with %o0 == 0 ends with
init: potentially unexpected fatal signal 4.
TSTATE: 0000000082000203 TPC: fffffffbffffe01c TNPC: fffffffbffffe020
where the task's [uprobes] mapping is fffffffbffffe000-fffffffc00000000.
FBfcc and FBPfcc behave the same.
Add the missing branch formats, as for kprobes.
Fixes: e8f4aa6087fa ("sparc64:Support User Probes for sparc")
Cc: [email protected]
Assisted-by: LLM
Signed-off-by: Danish Khateeb <[email protected]>
---
arch/sparc/kernel/uprobes.c | 13 ++++++++-----
1 file changed, 8 insertions(+), 5 deletions(-)
diff --git a/arch/sparc/kernel/uprobes.c b/arch/sparc/kernel/uprobes.c
index c8cac64e9988..c8ba033427ba 100644
--- a/arch/sparc/kernel/uprobes.c
+++ b/arch/sparc/kernel/uprobes.c
@@ -97,12 +97,15 @@ static unsigned long relbranch_fixup(u32 insn, struct
uprobe_task *utask,
if (regs->tnpc == regs->tpc + 0x4UL)
return utask->autask.saved_tnpc + 0x4UL;
- /* The three cases are call, branch w/prediction,
- * and traditional branch.
+ /* The cases are call and the branches with a PC-relative
+ * displacement.
*/
- if ((insn & 0xc0000000) == 0x40000000 ||
- (insn & 0xc1c00000) == 0x00400000 ||
- (insn & 0xc1c00000) == 0x00800000) {
+ if ((insn & 0xc0000000) == 0x40000000 || /* call */
+ (insn & 0xc1c00000) == 0x00400000 || /* BPcc */
+ (insn & 0xc1c00000) == 0x00800000 || /* Bicc */
+ (insn & 0xd1c00000) == 0x00c00000 || /* BPr */
+ (insn & 0xc1c00000) == 0x01400000 || /* FBPfcc */
+ (insn & 0xc1c00000) == 0x01800000) { /* FBfcc */
unsigned long real_pc = (unsigned long) utask->vaddr;
unsigned long ixol_addr = utask->xol_vaddr;
--
2.55.0
