Commit | Line | Data |
---|---|---|
c18377c3 | 1 | /* |
fca08f32 | 2 | * arch/arm/probes/decode.c |
c18377c3 DL |
3 | * |
4 | * Copyright (C) 2011 Jon Medhurst <tixy@yxit.co.uk>. | |
5 | * | |
6 | * Some contents moved here from arch/arm/include/asm/kprobes-arm.c which is | |
7 | * Copyright (C) 2006, 2007 Motorola Inc. | |
8 | * | |
9 | * This program is free software; you can redistribute it and/or modify | |
10 | * it under the terms of the GNU General Public License version 2 as | |
11 | * published by the Free Software Foundation. | |
12 | */ | |
13 | ||
14 | #include <linux/kernel.h> | |
15 | #include <linux/types.h> | |
c18377c3 DL |
16 | #include <asm/system_info.h> |
17 | #include <asm/ptrace.h> | |
18 | #include <linux/bug.h> | |
19 | ||
fca08f32 | 20 | #include "decode.h" |
c18377c3 DL |
21 | |
22 | ||
23 | #ifndef find_str_pc_offset | |
24 | ||
25 | /* | |
26 | * For STR and STM instructions, an ARM core may choose to use either | |
27 | * a +8 or a +12 displacement from the current instruction's address. | |
28 | * Whichever value is chosen for a given core, it must be the same for | |
29 | * both instructions and may not change. This function measures it. | |
30 | */ | |
31 | ||
32 | int str_pc_offset; | |
33 | ||
34 | void __init find_str_pc_offset(void) | |
35 | { | |
36 | int addr, scratch, ret; | |
37 | ||
38 | __asm__ ( | |
39 | "sub %[ret], pc, #4 \n\t" | |
40 | "str pc, %[addr] \n\t" | |
41 | "ldr %[scr], %[addr] \n\t" | |
42 | "sub %[ret], %[scr], %[ret] \n\t" | |
43 | : [ret] "=r" (ret), [scr] "=r" (scratch), [addr] "+m" (addr)); | |
44 | ||
45 | str_pc_offset = ret; | |
46 | } | |
47 | ||
48 | #endif /* !find_str_pc_offset */ | |
49 | ||
50 | ||
51 | #ifndef test_load_write_pc_interworking | |
52 | ||
53 | bool load_write_pc_interworks; | |
54 | ||
55 | void __init test_load_write_pc_interworking(void) | |
56 | { | |
57 | int arch = cpu_architecture(); | |
58 | BUG_ON(arch == CPU_ARCH_UNKNOWN); | |
59 | load_write_pc_interworks = arch >= CPU_ARCH_ARMv5T; | |
60 | } | |
61 | ||
62 | #endif /* !test_load_write_pc_interworking */ | |
63 | ||
64 | ||
65 | #ifndef test_alu_write_pc_interworking | |
66 | ||
67 | bool alu_write_pc_interworks; | |
68 | ||
69 | void __init test_alu_write_pc_interworking(void) | |
70 | { | |
71 | int arch = cpu_architecture(); | |
72 | BUG_ON(arch == CPU_ARCH_UNKNOWN); | |
73 | alu_write_pc_interworks = arch >= CPU_ARCH_ARMv7; | |
74 | } | |
75 | ||
76 | #endif /* !test_alu_write_pc_interworking */ | |
77 | ||
78 | ||
eb73ea97 | 79 | void __init arm_probes_decode_init(void) |
c18377c3 DL |
80 | { |
81 | find_str_pc_offset(); | |
82 | test_load_write_pc_interworking(); | |
83 | test_alu_write_pc_interworking(); | |
84 | } | |
85 | ||
86 | ||
87 | static unsigned long __kprobes __check_eq(unsigned long cpsr) | |
88 | { | |
89 | return cpsr & PSR_Z_BIT; | |
90 | } | |
91 | ||
92 | static unsigned long __kprobes __check_ne(unsigned long cpsr) | |
93 | { | |
94 | return (~cpsr) & PSR_Z_BIT; | |
95 | } | |
96 | ||
97 | static unsigned long __kprobes __check_cs(unsigned long cpsr) | |
98 | { | |
99 | return cpsr & PSR_C_BIT; | |
100 | } | |
101 | ||
102 | static unsigned long __kprobes __check_cc(unsigned long cpsr) | |
103 | { | |
104 | return (~cpsr) & PSR_C_BIT; | |
105 | } | |
106 | ||
107 | static unsigned long __kprobes __check_mi(unsigned long cpsr) | |
108 | { | |
109 | return cpsr & PSR_N_BIT; | |
110 | } | |
111 | ||
112 | static unsigned long __kprobes __check_pl(unsigned long cpsr) | |
113 | { | |
114 | return (~cpsr) & PSR_N_BIT; | |
115 | } | |
116 | ||
117 | static unsigned long __kprobes __check_vs(unsigned long cpsr) | |
118 | { | |
119 | return cpsr & PSR_V_BIT; | |
120 | } | |
121 | ||
122 | static unsigned long __kprobes __check_vc(unsigned long cpsr) | |
123 | { | |
124 | return (~cpsr) & PSR_V_BIT; | |
125 | } | |
126 | ||
127 | static unsigned long __kprobes __check_hi(unsigned long cpsr) | |
128 | { | |
129 | cpsr &= ~(cpsr >> 1); /* PSR_C_BIT &= ~PSR_Z_BIT */ | |
130 | return cpsr & PSR_C_BIT; | |
131 | } | |
132 | ||
133 | static unsigned long __kprobes __check_ls(unsigned long cpsr) | |
134 | { | |
135 | cpsr &= ~(cpsr >> 1); /* PSR_C_BIT &= ~PSR_Z_BIT */ | |
136 | return (~cpsr) & PSR_C_BIT; | |
137 | } | |
138 | ||
139 | static unsigned long __kprobes __check_ge(unsigned long cpsr) | |
140 | { | |
141 | cpsr ^= (cpsr << 3); /* PSR_N_BIT ^= PSR_V_BIT */ | |
142 | return (~cpsr) & PSR_N_BIT; | |
143 | } | |
144 | ||
145 | static unsigned long __kprobes __check_lt(unsigned long cpsr) | |
146 | { | |
147 | cpsr ^= (cpsr << 3); /* PSR_N_BIT ^= PSR_V_BIT */ | |
148 | return cpsr & PSR_N_BIT; | |
149 | } | |
150 | ||
151 | static unsigned long __kprobes __check_gt(unsigned long cpsr) | |
152 | { | |
153 | unsigned long temp = cpsr ^ (cpsr << 3); /* PSR_N_BIT ^= PSR_V_BIT */ | |
154 | temp |= (cpsr << 1); /* PSR_N_BIT |= PSR_Z_BIT */ | |
155 | return (~temp) & PSR_N_BIT; | |
156 | } | |
157 | ||
158 | static unsigned long __kprobes __check_le(unsigned long cpsr) | |
159 | { | |
160 | unsigned long temp = cpsr ^ (cpsr << 3); /* PSR_N_BIT ^= PSR_V_BIT */ | |
161 | temp |= (cpsr << 1); /* PSR_N_BIT |= PSR_Z_BIT */ | |
162 | return temp & PSR_N_BIT; | |
163 | } | |
164 | ||
165 | static unsigned long __kprobes __check_al(unsigned long cpsr) | |
166 | { | |
167 | return true; | |
168 | } | |
169 | ||
f145d664 | 170 | probes_check_cc * const probes_condition_checks[16] = { |
c18377c3 DL |
171 | &__check_eq, &__check_ne, &__check_cs, &__check_cc, |
172 | &__check_mi, &__check_pl, &__check_vs, &__check_vc, | |
173 | &__check_hi, &__check_ls, &__check_ge, &__check_lt, | |
174 | &__check_gt, &__check_le, &__check_al, &__check_al | |
175 | }; | |
176 | ||
177 | ||
eb73ea97 | 178 | void __kprobes probes_simulate_nop(probes_opcode_t opcode, |
b4cd605c | 179 | struct arch_probes_insn *asi, |
7579f4b3 | 180 | struct pt_regs *regs) |
c18377c3 DL |
181 | { |
182 | } | |
183 | ||
eb73ea97 | 184 | void __kprobes probes_emulate_none(probes_opcode_t opcode, |
b4cd605c | 185 | struct arch_probes_insn *asi, |
7579f4b3 | 186 | struct pt_regs *regs) |
c18377c3 | 187 | { |
7579f4b3 | 188 | asi->insn_fn(); |
c18377c3 DL |
189 | } |
190 | ||
191 | /* | |
192 | * Prepare an instruction slot to receive an instruction for emulating. | |
193 | * This is done by placing a subroutine return after the location where the | |
194 | * instruction will be placed. We also modify ARM instructions to be | |
195 | * unconditional as the condition code will already be checked before any | |
196 | * emulation handler is called. | |
197 | */ | |
f145d664 | 198 | static probes_opcode_t __kprobes |
b4cd605c | 199 | prepare_emulated_insn(probes_opcode_t insn, struct arch_probes_insn *asi, |
c18377c3 DL |
200 | bool thumb) |
201 | { | |
202 | #ifdef CONFIG_THUMB2_KERNEL | |
203 | if (thumb) { | |
204 | u16 *thumb_insn = (u16 *)asi->insn; | |
888be254 BD |
205 | /* Thumb bx lr */ |
206 | thumb_insn[1] = __opcode_to_mem_thumb16(0x4770); | |
207 | thumb_insn[2] = __opcode_to_mem_thumb16(0x4770); | |
c18377c3 DL |
208 | return insn; |
209 | } | |
888be254 | 210 | asi->insn[1] = __opcode_to_mem_arm(0xe12fff1e); /* ARM bx lr */ |
c18377c3 | 211 | #else |
888be254 | 212 | asi->insn[1] = __opcode_to_mem_arm(0xe1a0f00e); /* mov pc, lr */ |
c18377c3 DL |
213 | #endif |
214 | /* Make an ARM instruction unconditional */ | |
215 | if (insn < 0xe0000000) | |
216 | insn = (insn | 0xe0000000) & ~0x10000000; | |
217 | return insn; | |
218 | } | |
219 | ||
220 | /* | |
221 | * Write a (probably modified) instruction into the slot previously prepared by | |
222 | * prepare_emulated_insn | |
223 | */ | |
224 | static void __kprobes | |
b4cd605c | 225 | set_emulated_insn(probes_opcode_t insn, struct arch_probes_insn *asi, |
c18377c3 DL |
226 | bool thumb) |
227 | { | |
228 | #ifdef CONFIG_THUMB2_KERNEL | |
229 | if (thumb) { | |
230 | u16 *ip = (u16 *)asi->insn; | |
231 | if (is_wide_instruction(insn)) | |
888be254 BD |
232 | *ip++ = __opcode_to_mem_thumb16(insn >> 16); |
233 | *ip++ = __opcode_to_mem_thumb16(insn); | |
c18377c3 DL |
234 | return; |
235 | } | |
236 | #endif | |
888be254 | 237 | asi->insn[0] = __opcode_to_mem_arm(insn); |
c18377c3 DL |
238 | } |
239 | ||
240 | /* | |
241 | * When we modify the register numbers encoded in an instruction to be emulated, | |
242 | * the new values come from this define. For ARM and 32-bit Thumb instructions | |
243 | * this gives... | |
244 | * | |
245 | * bit position 16 12 8 4 0 | |
246 | * ---------------+---+---+---+---+---+ | |
247 | * register r2 r0 r1 -- r3 | |
248 | */ | |
249 | #define INSN_NEW_BITS 0x00020103 | |
250 | ||
251 | /* Each nibble has same value as that at INSN_NEW_BITS bit 16 */ | |
252 | #define INSN_SAMEAS16_BITS 0x22222222 | |
253 | ||
254 | /* | |
255 | * Validate and modify each of the registers encoded in an instruction. | |
256 | * | |
257 | * Each nibble in regs contains a value from enum decode_reg_type. For each | |
258 | * non-zero value, the corresponding nibble in pinsn is validated and modified | |
259 | * according to the type. | |
260 | */ | |
602cd260 | 261 | static bool __kprobes decode_regs(probes_opcode_t *pinsn, u32 regs, bool modify) |
c18377c3 | 262 | { |
f145d664 DL |
263 | probes_opcode_t insn = *pinsn; |
264 | probes_opcode_t mask = 0xf; /* Start at least significant nibble */ | |
c18377c3 DL |
265 | |
266 | for (; regs != 0; regs >>= 4, mask <<= 4) { | |
267 | ||
f145d664 | 268 | probes_opcode_t new_bits = INSN_NEW_BITS; |
c18377c3 DL |
269 | |
270 | switch (regs & 0xf) { | |
271 | ||
272 | case REG_TYPE_NONE: | |
273 | /* Nibble not a register, skip to next */ | |
274 | continue; | |
275 | ||
276 | case REG_TYPE_ANY: | |
277 | /* Any register is allowed */ | |
278 | break; | |
279 | ||
280 | case REG_TYPE_SAMEAS16: | |
281 | /* Replace register with same as at bit position 16 */ | |
282 | new_bits = INSN_SAMEAS16_BITS; | |
283 | break; | |
284 | ||
285 | case REG_TYPE_SP: | |
286 | /* Only allow SP (R13) */ | |
287 | if ((insn ^ 0xdddddddd) & mask) | |
288 | goto reject; | |
289 | break; | |
290 | ||
291 | case REG_TYPE_PC: | |
292 | /* Only allow PC (R15) */ | |
293 | if ((insn ^ 0xffffffff) & mask) | |
294 | goto reject; | |
295 | break; | |
296 | ||
297 | case REG_TYPE_NOSP: | |
298 | /* Reject SP (R13) */ | |
299 | if (((insn ^ 0xdddddddd) & mask) == 0) | |
300 | goto reject; | |
301 | break; | |
302 | ||
303 | case REG_TYPE_NOSPPC: | |
304 | case REG_TYPE_NOSPPCX: | |
305 | /* Reject SP and PC (R13 and R15) */ | |
306 | if (((insn ^ 0xdddddddd) & 0xdddddddd & mask) == 0) | |
307 | goto reject; | |
308 | break; | |
309 | ||
310 | case REG_TYPE_NOPCWB: | |
311 | if (!is_writeback(insn)) | |
312 | break; /* No writeback, so any register is OK */ | |
313 | /* fall through... */ | |
314 | case REG_TYPE_NOPC: | |
315 | case REG_TYPE_NOPCX: | |
316 | /* Reject PC (R15) */ | |
317 | if (((insn ^ 0xffffffff) & mask) == 0) | |
318 | goto reject; | |
319 | break; | |
320 | } | |
321 | ||
322 | /* Replace value of nibble with new register number... */ | |
323 | insn &= ~mask; | |
324 | insn |= new_bits & mask; | |
325 | } | |
326 | ||
602cd260 DL |
327 | if (modify) |
328 | *pinsn = insn; | |
329 | ||
c18377c3 DL |
330 | return true; |
331 | ||
332 | reject: | |
333 | return false; | |
334 | } | |
335 | ||
336 | static const int decode_struct_sizes[NUM_DECODE_TYPES] = { | |
337 | [DECODE_TYPE_TABLE] = sizeof(struct decode_table), | |
338 | [DECODE_TYPE_CUSTOM] = sizeof(struct decode_custom), | |
339 | [DECODE_TYPE_SIMULATE] = sizeof(struct decode_simulate), | |
340 | [DECODE_TYPE_EMULATE] = sizeof(struct decode_emulate), | |
341 | [DECODE_TYPE_OR] = sizeof(struct decode_or), | |
342 | [DECODE_TYPE_REJECT] = sizeof(struct decode_reject) | |
343 | }; | |
344 | ||
83803d97 WN |
345 | static int run_checkers(const struct decode_checker *checkers[], |
346 | int action, probes_opcode_t insn, | |
347 | struct arch_probes_insn *asi, | |
348 | const struct decode_header *h) | |
349 | { | |
350 | const struct decode_checker **p; | |
351 | ||
352 | if (!checkers) | |
353 | return INSN_GOOD; | |
354 | ||
355 | p = checkers; | |
356 | while (*p != NULL) { | |
357 | int retval; | |
358 | probes_check_t *checker_func = (*p)[action].checker; | |
359 | ||
360 | retval = INSN_GOOD; | |
361 | if (checker_func) | |
362 | retval = checker_func(insn, asi, h); | |
363 | if (retval == INSN_REJECTED) | |
364 | return retval; | |
365 | p++; | |
366 | } | |
367 | return INSN_GOOD; | |
368 | } | |
369 | ||
c18377c3 | 370 | /* |
47e190fa | 371 | * probes_decode_insn operates on data tables in order to decode an ARM |
c18377c3 DL |
372 | * architecture instruction onto which a kprobe has been placed. |
373 | * | |
374 | * These instruction decoding tables are a concatenation of entries each | |
375 | * of which consist of one of the following structs: | |
376 | * | |
377 | * decode_table | |
378 | * decode_custom | |
379 | * decode_simulate | |
380 | * decode_emulate | |
381 | * decode_or | |
382 | * decode_reject | |
383 | * | |
384 | * Each of these starts with a struct decode_header which has the following | |
385 | * fields: | |
386 | * | |
387 | * type_regs | |
388 | * mask | |
389 | * value | |
390 | * | |
391 | * The least significant DECODE_TYPE_BITS of type_regs contains a value | |
392 | * from enum decode_type, this indicates which of the decode_* structs | |
393 | * the entry contains. The value DECODE_TYPE_END indicates the end of the | |
394 | * table. | |
395 | * | |
396 | * When the table is parsed, each entry is checked in turn to see if it | |
397 | * matches the instruction to be decoded using the test: | |
398 | * | |
399 | * (insn & mask) == value | |
400 | * | |
401 | * If no match is found before the end of the table is reached then decoding | |
402 | * fails with INSN_REJECTED. | |
403 | * | |
404 | * When a match is found, decode_regs() is called to validate and modify each | |
405 | * of the registers encoded in the instruction; the data it uses to do this | |
406 | * is (type_regs >> DECODE_TYPE_BITS). A validation failure will cause decoding | |
407 | * to fail with INSN_REJECTED. | |
408 | * | |
409 | * Once the instruction has passed the above tests, further processing | |
410 | * depends on the type of the table entry's decode struct. | |
411 | * | |
412 | */ | |
413 | int __kprobes | |
b4cd605c | 414 | probes_decode_insn(probes_opcode_t insn, struct arch_probes_insn *asi, |
3e6cd394 | 415 | const union decode_item *table, bool thumb, |
83803d97 WN |
416 | bool emulate, const union decode_action *actions, |
417 | const struct decode_checker *checkers[]) | |
c18377c3 DL |
418 | { |
419 | const struct decode_header *h = (struct decode_header *)table; | |
420 | const struct decode_header *next; | |
421 | bool matched = false; | |
83803d97 WN |
422 | /* |
423 | * @insn can be modified by decode_regs. Save its original | |
424 | * value for checkers. | |
425 | */ | |
426 | probes_opcode_t origin_insn = insn; | |
c18377c3 | 427 | |
6624cf65 WN |
428 | /* |
429 | * stack_space is initialized to 0 here. Checker functions | |
430 | * should update is value if they find this is a stack store | |
431 | * instruction: positive value means bytes of stack usage, | |
432 | * negitive value means unable to determine stack usage | |
433 | * statically. For instruction doesn't store to stack, checker | |
434 | * do nothing with it. | |
435 | */ | |
436 | asi->stack_space = 0; | |
437 | ||
28a1899d WN |
438 | /* |
439 | * Similarly to stack_space, register_usage_flags is filled by | |
440 | * checkers. Its default value is set to ~0, which is 'all | |
441 | * registers are used', to prevent any potential optimization. | |
442 | */ | |
443 | asi->register_usage_flags = ~0UL; | |
444 | ||
602cd260 DL |
445 | if (emulate) |
446 | insn = prepare_emulated_insn(insn, asi, thumb); | |
c18377c3 DL |
447 | |
448 | for (;; h = next) { | |
449 | enum decode_type type = h->type_regs.bits & DECODE_TYPE_MASK; | |
450 | u32 regs = h->type_regs.bits >> DECODE_TYPE_BITS; | |
451 | ||
452 | if (type == DECODE_TYPE_END) | |
453 | return INSN_REJECTED; | |
454 | ||
455 | next = (struct decode_header *) | |
456 | ((uintptr_t)h + decode_struct_sizes[type]); | |
457 | ||
458 | if (!matched && (insn & h->mask.bits) != h->value.bits) | |
459 | continue; | |
460 | ||
602cd260 | 461 | if (!decode_regs(&insn, regs, emulate)) |
c18377c3 DL |
462 | return INSN_REJECTED; |
463 | ||
464 | switch (type) { | |
465 | ||
466 | case DECODE_TYPE_TABLE: { | |
467 | struct decode_table *d = (struct decode_table *)h; | |
468 | next = (struct decode_header *)d->table.table; | |
469 | break; | |
470 | } | |
471 | ||
472 | case DECODE_TYPE_CUSTOM: { | |
83803d97 | 473 | int err; |
c18377c3 | 474 | struct decode_custom *d = (struct decode_custom *)h; |
83803d97 WN |
475 | int action = d->decoder.action; |
476 | ||
477 | err = run_checkers(checkers, action, origin_insn, asi, h); | |
478 | if (err == INSN_REJECTED) | |
479 | return INSN_REJECTED; | |
480 | return actions[action].decoder(insn, asi, h); | |
c18377c3 DL |
481 | } |
482 | ||
483 | case DECODE_TYPE_SIMULATE: { | |
83803d97 | 484 | int err; |
c18377c3 | 485 | struct decode_simulate *d = (struct decode_simulate *)h; |
83803d97 WN |
486 | int action = d->handler.action; |
487 | ||
488 | err = run_checkers(checkers, action, origin_insn, asi, h); | |
489 | if (err == INSN_REJECTED) | |
490 | return INSN_REJECTED; | |
491 | asi->insn_handler = actions[action].handler; | |
c18377c3 DL |
492 | return INSN_GOOD_NO_SLOT; |
493 | } | |
494 | ||
495 | case DECODE_TYPE_EMULATE: { | |
83803d97 | 496 | int err; |
c18377c3 | 497 | struct decode_emulate *d = (struct decode_emulate *)h; |
83803d97 WN |
498 | int action = d->handler.action; |
499 | ||
500 | err = run_checkers(checkers, action, origin_insn, asi, h); | |
501 | if (err == INSN_REJECTED) | |
502 | return INSN_REJECTED; | |
602cd260 DL |
503 | |
504 | if (!emulate) | |
83803d97 | 505 | return actions[action].decoder(insn, asi, h); |
602cd260 | 506 | |
83803d97 | 507 | asi->insn_handler = actions[action].handler; |
c18377c3 DL |
508 | set_emulated_insn(insn, asi, thumb); |
509 | return INSN_GOOD; | |
510 | } | |
511 | ||
512 | case DECODE_TYPE_OR: | |
513 | matched = true; | |
514 | break; | |
515 | ||
516 | case DECODE_TYPE_REJECT: | |
517 | default: | |
518 | return INSN_REJECTED; | |
519 | } | |
520 | } | |
521 | } |