Commit | Line | Data |
---|---|---|
c18377c3 DL |
1 | /* |
2 | * arch/arm/kernel/probes.h | |
3 | * | |
4 | * Copyright (C) 2011 Jon Medhurst <tixy@yxit.co.uk>. | |
5 | * | |
6 | * Some contents moved here from arch/arm/include/asm/kprobes.h which is | |
7 | * Copyright (C) 2006, 2007 Motorola Inc. | |
8 | * | |
9 | * This program is free software; you can redistribute it and/or modify | |
10 | * it under the terms of the GNU General Public License version 2 as | |
11 | * published by the Free Software Foundation. | |
12 | * | |
13 | * This program is distributed in the hope that it will be useful, | |
14 | * but WITHOUT ANY WARRANTY; without even the implied warranty of | |
15 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU | |
16 | * General Public License for more details. | |
17 | */ | |
18 | ||
19 | #ifndef _ARM_KERNEL_PROBES_H | |
20 | #define _ARM_KERNEL_PROBES_H | |
21 | ||
22 | #include <linux/types.h> | |
23 | #include <linux/stddef.h> | |
24 | #include <linux/kprobes.h> | |
7579f4b3 | 25 | #include "kprobes.h" |
c18377c3 | 26 | |
eb73ea97 DL |
27 | void __init arm_probes_decode_init(void); |
28 | ||
c18377c3 DL |
29 | #if __LINUX_ARM_ARCH__ >= 7 |
30 | ||
31 | /* str_pc_offset is architecturally defined from ARMv7 onwards */ | |
32 | #define str_pc_offset 8 | |
33 | #define find_str_pc_offset() | |
34 | ||
35 | #else /* __LINUX_ARM_ARCH__ < 7 */ | |
36 | ||
37 | /* We need a run-time check to determine str_pc_offset */ | |
38 | extern int str_pc_offset; | |
39 | void __init find_str_pc_offset(void); | |
40 | ||
41 | #endif | |
42 | ||
7579f4b3 | 43 | struct decode_header; |
c18377c3 DL |
44 | |
45 | /* | |
46 | * Update ITSTATE after normal execution of an IT block instruction. | |
47 | * | |
48 | * The 8 IT state bits are split into two parts in CPSR: | |
49 | * ITSTATE<1:0> are in CPSR<26:25> | |
50 | * ITSTATE<7:2> are in CPSR<15:10> | |
51 | */ | |
52 | static inline unsigned long it_advance(unsigned long cpsr) | |
53 | { | |
54 | if ((cpsr & 0x06000400) == 0) { | |
55 | /* ITSTATE<2:0> == 0 means end of IT block, so clear IT state */ | |
56 | cpsr &= ~PSR_IT_MASK; | |
57 | } else { | |
58 | /* We need to shift left ITSTATE<4:0> */ | |
59 | const unsigned long mask = 0x06001c00; /* Mask ITSTATE<4:0> */ | |
60 | unsigned long it = cpsr & mask; | |
61 | it <<= 1; | |
62 | it |= it >> (27 - 10); /* Carry ITSTATE<2> to correct place */ | |
63 | it &= mask; | |
64 | cpsr &= ~mask; | |
65 | cpsr |= it; | |
66 | } | |
67 | return cpsr; | |
68 | } | |
69 | ||
70 | static inline void __kprobes bx_write_pc(long pcv, struct pt_regs *regs) | |
71 | { | |
72 | long cpsr = regs->ARM_cpsr; | |
73 | if (pcv & 0x1) { | |
74 | cpsr |= PSR_T_BIT; | |
75 | pcv &= ~0x1; | |
76 | } else { | |
77 | cpsr &= ~PSR_T_BIT; | |
78 | pcv &= ~0x2; /* Avoid UNPREDICTABLE address allignment */ | |
79 | } | |
80 | regs->ARM_cpsr = cpsr; | |
81 | regs->ARM_pc = pcv; | |
82 | } | |
83 | ||
84 | ||
85 | #if __LINUX_ARM_ARCH__ >= 6 | |
86 | ||
87 | /* Kernels built for >= ARMv6 should never run on <= ARMv5 hardware, so... */ | |
88 | #define load_write_pc_interworks true | |
89 | #define test_load_write_pc_interworking() | |
90 | ||
91 | #else /* __LINUX_ARM_ARCH__ < 6 */ | |
92 | ||
93 | /* We need run-time testing to determine if load_write_pc() should interwork. */ | |
94 | extern bool load_write_pc_interworks; | |
95 | void __init test_load_write_pc_interworking(void); | |
96 | ||
97 | #endif | |
98 | ||
99 | static inline void __kprobes load_write_pc(long pcv, struct pt_regs *regs) | |
100 | { | |
101 | if (load_write_pc_interworks) | |
102 | bx_write_pc(pcv, regs); | |
103 | else | |
104 | regs->ARM_pc = pcv; | |
105 | } | |
106 | ||
107 | ||
108 | #if __LINUX_ARM_ARCH__ >= 7 | |
109 | ||
110 | #define alu_write_pc_interworks true | |
111 | #define test_alu_write_pc_interworking() | |
112 | ||
113 | #elif __LINUX_ARM_ARCH__ <= 5 | |
114 | ||
115 | /* Kernels built for <= ARMv5 should never run on >= ARMv6 hardware, so... */ | |
116 | #define alu_write_pc_interworks false | |
117 | #define test_alu_write_pc_interworking() | |
118 | ||
119 | #else /* __LINUX_ARM_ARCH__ == 6 */ | |
120 | ||
121 | /* We could be an ARMv6 binary on ARMv7 hardware so we need a run-time check. */ | |
122 | extern bool alu_write_pc_interworks; | |
123 | void __init test_alu_write_pc_interworking(void); | |
124 | ||
125 | #endif /* __LINUX_ARM_ARCH__ == 6 */ | |
126 | ||
127 | static inline void __kprobes alu_write_pc(long pcv, struct pt_regs *regs) | |
128 | { | |
129 | if (alu_write_pc_interworks) | |
130 | bx_write_pc(pcv, regs); | |
131 | else | |
132 | regs->ARM_pc = pcv; | |
133 | } | |
134 | ||
135 | ||
eb73ea97 | 136 | void __kprobes probes_simulate_nop(probes_opcode_t, struct arch_specific_insn *, |
7579f4b3 | 137 | struct pt_regs *regs); |
eb73ea97 | 138 | void __kprobes probes_emulate_none(probes_opcode_t, struct arch_specific_insn *, |
7579f4b3 | 139 | struct pt_regs *regs); |
c18377c3 | 140 | |
44a0a59c | 141 | enum probes_insn __kprobes |
f145d664 | 142 | kprobe_decode_ldmstm(probes_opcode_t insn, struct arch_specific_insn *asi, |
3e6cd394 | 143 | const struct decode_header *h); |
c18377c3 DL |
144 | |
145 | /* | |
146 | * Test if load/store instructions writeback the address register. | |
147 | * if P (bit 24) == 0 or W (bit 21) == 1 | |
148 | */ | |
149 | #define is_writeback(insn) ((insn ^ 0x01000000) & 0x01200000) | |
150 | ||
151 | /* | |
152 | * The following definitions and macros are used to build instruction | |
153 | * decoding tables for use by kprobe_decode_insn. | |
154 | * | |
155 | * These tables are a concatenation of entries each of which consist of one of | |
156 | * the decode_* structs. All of the fields in every type of decode structure | |
157 | * are of the union type decode_item, therefore the entire decode table can be | |
158 | * viewed as an array of these and declared like: | |
159 | * | |
160 | * static const union decode_item table_name[] = {}; | |
161 | * | |
162 | * In order to construct each entry in the table, macros are used to | |
163 | * initialise a number of sequential decode_item values in a layout which | |
164 | * matches the relevant struct. E.g. DECODE_SIMULATE initialise a struct | |
165 | * decode_simulate by initialising four decode_item objects like this... | |
166 | * | |
167 | * {.bits = _type}, | |
168 | * {.bits = _mask}, | |
169 | * {.bits = _value}, | |
3e6cd394 | 170 | * {.action = _handler}, |
c18377c3 DL |
171 | * |
172 | * Initialising a specified member of the union means that the compiler | |
173 | * will produce a warning if the argument is of an incorrect type. | |
174 | * | |
175 | * Below is a list of each of the macros used to initialise entries and a | |
176 | * description of the action performed when that entry is matched to an | |
177 | * instruction. A match is found when (instruction & mask) == value. | |
178 | * | |
179 | * DECODE_TABLE(mask, value, table) | |
180 | * Instruction decoding jumps to parsing the new sub-table 'table'. | |
181 | * | |
182 | * DECODE_CUSTOM(mask, value, decoder) | |
3e6cd394 DL |
183 | * The value of 'decoder' is used as an index into the array of |
184 | * action functions, and the retrieved decoder function is invoked | |
185 | * to complete decoding of the instruction. | |
c18377c3 DL |
186 | * |
187 | * DECODE_SIMULATE(mask, value, handler) | |
3e6cd394 DL |
188 | * The probes instruction handler is set to the value found by |
189 | * indexing into the action array using the value of 'handler'. This | |
190 | * will be used to simulate the instruction when the probe is hit. | |
191 | * Decoding returns with INSN_GOOD_NO_SLOT. | |
c18377c3 DL |
192 | * |
193 | * DECODE_EMULATE(mask, value, handler) | |
3e6cd394 DL |
194 | * The probes instruction handler is set to the value found by |
195 | * indexing into the action array using the value of 'handler'. This | |
196 | * will be used to emulate the instruction when the probe is hit. The | |
197 | * modified instruction (see below) is placed in the probes instruction | |
198 | * slot so it may be called by the emulation code. Decoding returns | |
199 | * with INSN_GOOD. | |
c18377c3 DL |
200 | * |
201 | * DECODE_REJECT(mask, value) | |
202 | * Instruction decoding fails with INSN_REJECTED | |
203 | * | |
204 | * DECODE_OR(mask, value) | |
205 | * This allows the mask/value test of multiple table entries to be | |
206 | * logically ORed. Once an 'or' entry is matched the decoding action to | |
207 | * be performed is that of the next entry which isn't an 'or'. E.g. | |
208 | * | |
209 | * DECODE_OR (mask1, value1) | |
210 | * DECODE_OR (mask2, value2) | |
211 | * DECODE_SIMULATE (mask3, value3, simulation_handler) | |
212 | * | |
213 | * This means that if any of the three mask/value pairs match the | |
214 | * instruction being decoded, then 'simulation_handler' will be used | |
215 | * for it. | |
216 | * | |
217 | * Both the SIMULATE and EMULATE macros have a second form which take an | |
218 | * additional 'regs' argument. | |
219 | * | |
220 | * DECODE_SIMULATEX(mask, value, handler, regs) | |
221 | * DECODE_EMULATEX (mask, value, handler, regs) | |
222 | * | |
223 | * These are used to specify what kind of CPU register is encoded in each of the | |
224 | * least significant 5 nibbles of the instruction being decoded. The regs value | |
225 | * is specified using the REGS macro, this takes any of the REG_TYPE_* values | |
226 | * from enum decode_reg_type as arguments; only the '*' part of the name is | |
227 | * given. E.g. | |
228 | * | |
229 | * REGS(0, ANY, NOPC, 0, ANY) | |
230 | * | |
231 | * This indicates an instruction is encoded like: | |
232 | * | |
233 | * bits 19..16 ignore | |
234 | * bits 15..12 any register allowed here | |
235 | * bits 11.. 8 any register except PC allowed here | |
236 | * bits 7.. 4 ignore | |
237 | * bits 3.. 0 any register allowed here | |
238 | * | |
239 | * This register specification is checked after a decode table entry is found to | |
240 | * match an instruction (through the mask/value test). Any invalid register then | |
241 | * found in the instruction will cause decoding to fail with INSN_REJECTED. In | |
242 | * the above example this would happen if bits 11..8 of the instruction were | |
243 | * 1111, indicating R15 or PC. | |
244 | * | |
245 | * As well as checking for legal combinations of registers, this data is also | |
246 | * used to modify the registers encoded in the instructions so that an | |
247 | * emulation routines can use it. (See decode_regs() and INSN_NEW_BITS.) | |
248 | * | |
249 | * Here is a real example which matches ARM instructions of the form | |
250 | * "AND <Rd>,<Rn>,<Rm>,<shift> <Rs>" | |
251 | * | |
3e6cd394 | 252 | * DECODE_EMULATEX (0x0e000090, 0x00000010, PROBES_DATA_PROCESSING_REG, |
c18377c3 DL |
253 | * REGS(ANY, ANY, NOPC, 0, ANY)), |
254 | * ^ ^ ^ ^ | |
255 | * Rn Rd Rs Rm | |
256 | * | |
257 | * Decoding the instruction "AND R4, R5, R6, ASL R15" will be rejected because | |
258 | * Rs == R15 | |
259 | * | |
260 | * Decoding the instruction "AND R4, R5, R6, ASL R7" will be accepted and the | |
261 | * instruction will be modified to "AND R0, R2, R3, ASL R1" and then placed into | |
262 | * the kprobes instruction slot. This can then be called later by the handler | |
3e6cd394 DL |
263 | * function emulate_rd12rn16rm0rs8_rwflags (a pointer to which is retrieved from |
264 | * the indicated slot in the action array), in order to simulate the instruction. | |
c18377c3 DL |
265 | */ |
266 | ||
267 | enum decode_type { | |
268 | DECODE_TYPE_END, | |
269 | DECODE_TYPE_TABLE, | |
270 | DECODE_TYPE_CUSTOM, | |
271 | DECODE_TYPE_SIMULATE, | |
272 | DECODE_TYPE_EMULATE, | |
273 | DECODE_TYPE_OR, | |
274 | DECODE_TYPE_REJECT, | |
275 | NUM_DECODE_TYPES /* Must be last enum */ | |
276 | }; | |
277 | ||
278 | #define DECODE_TYPE_BITS 4 | |
279 | #define DECODE_TYPE_MASK ((1 << DECODE_TYPE_BITS) - 1) | |
280 | ||
281 | enum decode_reg_type { | |
282 | REG_TYPE_NONE = 0, /* Not a register, ignore */ | |
283 | REG_TYPE_ANY, /* Any register allowed */ | |
284 | REG_TYPE_SAMEAS16, /* Register should be same as that at bits 19..16 */ | |
285 | REG_TYPE_SP, /* Register must be SP */ | |
286 | REG_TYPE_PC, /* Register must be PC */ | |
287 | REG_TYPE_NOSP, /* Register must not be SP */ | |
288 | REG_TYPE_NOSPPC, /* Register must not be SP or PC */ | |
289 | REG_TYPE_NOPC, /* Register must not be PC */ | |
290 | REG_TYPE_NOPCWB, /* No PC if load/store write-back flag also set */ | |
291 | ||
292 | /* The following types are used when the encoding for PC indicates | |
293 | * another instruction form. This distiction only matters for test | |
294 | * case coverage checks. | |
295 | */ | |
296 | REG_TYPE_NOPCX, /* Register must not be PC */ | |
297 | REG_TYPE_NOSPPCX, /* Register must not be SP or PC */ | |
298 | ||
299 | /* Alias to allow '0' arg to be used in REGS macro. */ | |
300 | REG_TYPE_0 = REG_TYPE_NONE | |
301 | }; | |
302 | ||
303 | #define REGS(r16, r12, r8, r4, r0) \ | |
304 | (((REG_TYPE_##r16) << 16) + \ | |
305 | ((REG_TYPE_##r12) << 12) + \ | |
306 | ((REG_TYPE_##r8) << 8) + \ | |
307 | ((REG_TYPE_##r4) << 4) + \ | |
308 | (REG_TYPE_##r0)) | |
309 | ||
310 | union decode_item { | |
311 | u32 bits; | |
312 | const union decode_item *table; | |
3e6cd394 | 313 | int action; |
c18377c3 DL |
314 | }; |
315 | ||
44a0a59c | 316 | typedef enum probes_insn (probes_custom_decode_t)(probes_opcode_t, |
3e6cd394 DL |
317 | struct arch_specific_insn *, |
318 | const struct decode_header *); | |
319 | ||
320 | union decode_action { | |
321 | kprobe_insn_handler_t *handler; | |
322 | probes_custom_decode_t *decoder; | |
323 | }; | |
c18377c3 DL |
324 | |
325 | #define DECODE_END \ | |
326 | {.bits = DECODE_TYPE_END} | |
327 | ||
328 | ||
329 | struct decode_header { | |
330 | union decode_item type_regs; | |
331 | union decode_item mask; | |
332 | union decode_item value; | |
333 | }; | |
334 | ||
335 | #define DECODE_HEADER(_type, _mask, _value, _regs) \ | |
336 | {.bits = (_type) | ((_regs) << DECODE_TYPE_BITS)}, \ | |
337 | {.bits = (_mask)}, \ | |
338 | {.bits = (_value)} | |
339 | ||
340 | ||
341 | struct decode_table { | |
342 | struct decode_header header; | |
343 | union decode_item table; | |
344 | }; | |
345 | ||
346 | #define DECODE_TABLE(_mask, _value, _table) \ | |
347 | DECODE_HEADER(DECODE_TYPE_TABLE, _mask, _value, 0), \ | |
348 | {.table = (_table)} | |
349 | ||
350 | ||
351 | struct decode_custom { | |
352 | struct decode_header header; | |
353 | union decode_item decoder; | |
354 | }; | |
355 | ||
356 | #define DECODE_CUSTOM(_mask, _value, _decoder) \ | |
357 | DECODE_HEADER(DECODE_TYPE_CUSTOM, _mask, _value, 0), \ | |
3e6cd394 | 358 | {.action = (_decoder)} |
c18377c3 DL |
359 | |
360 | ||
361 | struct decode_simulate { | |
362 | struct decode_header header; | |
363 | union decode_item handler; | |
364 | }; | |
365 | ||
366 | #define DECODE_SIMULATEX(_mask, _value, _handler, _regs) \ | |
367 | DECODE_HEADER(DECODE_TYPE_SIMULATE, _mask, _value, _regs), \ | |
3e6cd394 | 368 | {.action = (_handler)} |
c18377c3 DL |
369 | |
370 | #define DECODE_SIMULATE(_mask, _value, _handler) \ | |
371 | DECODE_SIMULATEX(_mask, _value, _handler, 0) | |
372 | ||
373 | ||
374 | struct decode_emulate { | |
375 | struct decode_header header; | |
376 | union decode_item handler; | |
377 | }; | |
378 | ||
379 | #define DECODE_EMULATEX(_mask, _value, _handler, _regs) \ | |
380 | DECODE_HEADER(DECODE_TYPE_EMULATE, _mask, _value, _regs), \ | |
3e6cd394 | 381 | {.action = (_handler)} |
c18377c3 DL |
382 | |
383 | #define DECODE_EMULATE(_mask, _value, _handler) \ | |
384 | DECODE_EMULATEX(_mask, _value, _handler, 0) | |
385 | ||
386 | ||
387 | struct decode_or { | |
388 | struct decode_header header; | |
389 | }; | |
390 | ||
391 | #define DECODE_OR(_mask, _value) \ | |
392 | DECODE_HEADER(DECODE_TYPE_OR, _mask, _value, 0) | |
393 | ||
44a0a59c DL |
394 | enum probes_insn { |
395 | INSN_REJECTED, | |
396 | INSN_GOOD, | |
397 | INSN_GOOD_NO_SLOT | |
398 | }; | |
c18377c3 DL |
399 | |
400 | struct decode_reject { | |
401 | struct decode_header header; | |
402 | }; | |
403 | ||
404 | #define DECODE_REJECT(_mask, _value) \ | |
405 | DECODE_HEADER(DECODE_TYPE_REJECT, _mask, _value, 0) | |
406 | ||
407 | ||
408 | #ifdef CONFIG_THUMB2_KERNEL | |
409 | extern const union decode_item kprobe_decode_thumb16_table[]; | |
410 | extern const union decode_item kprobe_decode_thumb32_table[]; | |
3e6cd394 DL |
411 | extern const union decode_action kprobes_t32_actions[]; |
412 | extern const union decode_action kprobes_t16_actions[]; | |
c18377c3 DL |
413 | #else |
414 | extern const union decode_item kprobe_decode_arm_table[]; | |
3e6cd394 | 415 | extern const union decode_action kprobes_arm_actions[]; |
c18377c3 DL |
416 | #endif |
417 | ||
f145d664 | 418 | extern probes_check_cc * const probes_condition_checks[16]; |
c18377c3 DL |
419 | |
420 | ||
f145d664 | 421 | int kprobe_decode_insn(probes_opcode_t insn, struct arch_specific_insn *asi, |
3e6cd394 DL |
422 | const union decode_item *table, bool thumb16, |
423 | const union decode_action *actions); | |
c18377c3 DL |
424 | |
425 | #endif |