1 /*
2 * arch/arm/probes/decode.h
3 *
4 * Copyright (C) 2011 Jon Medhurst <tixy@yxit.co.uk>.
5 *
6 * Some contents moved here from arch/arm/include/asm/kprobes.h which is
7 * Copyright (C) 2006, 2007 Motorola Inc.
8 *
9 * This program is free software; you can redistribute it and/or modify
10 * it under the terms of the GNU General Public License version 2 as
11 * published by the Free Software Foundation.
12 *
13 * This program is distributed in the hope that it will be useful,
14 * but WITHOUT ANY WARRANTY; without even the implied warranty of
15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
16 * General Public License for more details.
17 */
18
19 #ifndef _ARM_KERNEL_PROBES_H
20 #define _ARM_KERNEL_PROBES_H
21
22 #include <linux/types.h>
23 #include <linux/stddef.h>
24 #include <asm/probes.h>
25 #include <asm/kprobes.h>
26
27 void __init arm_probes_decode_init(void);
28
29 extern probes_check_cc * const probes_condition_checks[16];
30
31 #if __LINUX_ARM_ARCH__ >= 7
32
33 /* str_pc_offset is architecturally defined from ARMv7 onwards */
34 #define str_pc_offset 8
35 #define find_str_pc_offset()
36
37 #else /* __LINUX_ARM_ARCH__ < 7 */
38
39 /* We need a run-time check to determine str_pc_offset */
40 extern int str_pc_offset;
41 void __init find_str_pc_offset(void);
42
43 #endif
44
45
46 /*
47 * Update ITSTATE after normal execution of an IT block instruction.
48 *
49 * The 8 IT state bits are split into two parts in CPSR:
50 * ITSTATE<1:0> are in CPSR<26:25>
51 * ITSTATE<7:2> are in CPSR<15:10>
52 */
it_advance(unsigned long cpsr)53 static inline unsigned long it_advance(unsigned long cpsr)
54 {
55 if ((cpsr & 0x06000400) == 0) {
56 /* ITSTATE<2:0> == 0 means end of IT block, so clear IT state */
57 cpsr &= ~PSR_IT_MASK;
58 } else {
59 /* We need to shift left ITSTATE<4:0> */
60 const unsigned long mask = 0x06001c00; /* Mask ITSTATE<4:0> */
61 unsigned long it = cpsr & mask;
62 it <<= 1;
63 it |= it >> (27 - 10); /* Carry ITSTATE<2> to correct place */
64 it &= mask;
65 cpsr &= ~mask;
66 cpsr |= it;
67 }
68 return cpsr;
69 }
70
bx_write_pc(long pcv,struct pt_regs * regs)71 static inline void __kprobes bx_write_pc(long pcv, struct pt_regs *regs)
72 {
73 long cpsr = regs->ARM_cpsr;
74 if (pcv & 0x1) {
75 cpsr |= PSR_T_BIT;
76 pcv &= ~0x1;
77 } else {
78 cpsr &= ~PSR_T_BIT;
79 pcv &= ~0x2; /* Avoid UNPREDICTABLE address allignment */
80 }
81 regs->ARM_cpsr = cpsr;
82 regs->ARM_pc = pcv;
83 }
84
85
86 #if __LINUX_ARM_ARCH__ >= 6
87
88 /* Kernels built for >= ARMv6 should never run on <= ARMv5 hardware, so... */
89 #define load_write_pc_interworks true
90 #define test_load_write_pc_interworking()
91
92 #else /* __LINUX_ARM_ARCH__ < 6 */
93
94 /* We need run-time testing to determine if load_write_pc() should interwork. */
95 extern bool load_write_pc_interworks;
96 void __init test_load_write_pc_interworking(void);
97
98 #endif
99
load_write_pc(long pcv,struct pt_regs * regs)100 static inline void __kprobes load_write_pc(long pcv, struct pt_regs *regs)
101 {
102 if (load_write_pc_interworks)
103 bx_write_pc(pcv, regs);
104 else
105 regs->ARM_pc = pcv;
106 }
107
108
109 #if __LINUX_ARM_ARCH__ >= 7
110
111 #define alu_write_pc_interworks true
112 #define test_alu_write_pc_interworking()
113
114 #elif __LINUX_ARM_ARCH__ <= 5
115
116 /* Kernels built for <= ARMv5 should never run on >= ARMv6 hardware, so... */
117 #define alu_write_pc_interworks false
118 #define test_alu_write_pc_interworking()
119
120 #else /* __LINUX_ARM_ARCH__ == 6 */
121
122 /* We could be an ARMv6 binary on ARMv7 hardware so we need a run-time check. */
123 extern bool alu_write_pc_interworks;
124 void __init test_alu_write_pc_interworking(void);
125
126 #endif /* __LINUX_ARM_ARCH__ == 6 */
127
alu_write_pc(long pcv,struct pt_regs * regs)128 static inline void __kprobes alu_write_pc(long pcv, struct pt_regs *regs)
129 {
130 if (alu_write_pc_interworks)
131 bx_write_pc(pcv, regs);
132 else
133 regs->ARM_pc = pcv;
134 }
135
136
137 /*
138 * Test if load/store instructions writeback the address register.
139 * if P (bit 24) == 0 or W (bit 21) == 1
140 */
141 #define is_writeback(insn) ((insn ^ 0x01000000) & 0x01200000)
142
143 /*
144 * The following definitions and macros are used to build instruction
145 * decoding tables for use by probes_decode_insn.
146 *
147 * These tables are a concatenation of entries each of which consist of one of
148 * the decode_* structs. All of the fields in every type of decode structure
149 * are of the union type decode_item, therefore the entire decode table can be
150 * viewed as an array of these and declared like:
151 *
152 * static const union decode_item table_name[] = {};
153 *
154 * In order to construct each entry in the table, macros are used to
155 * initialise a number of sequential decode_item values in a layout which
156 * matches the relevant struct. E.g. DECODE_SIMULATE initialise a struct
157 * decode_simulate by initialising four decode_item objects like this...
158 *
159 * {.bits = _type},
160 * {.bits = _mask},
161 * {.bits = _value},
162 * {.action = _handler},
163 *
164 * Initialising a specified member of the union means that the compiler
165 * will produce a warning if the argument is of an incorrect type.
166 *
167 * Below is a list of each of the macros used to initialise entries and a
168 * description of the action performed when that entry is matched to an
169 * instruction. A match is found when (instruction & mask) == value.
170 *
171 * DECODE_TABLE(mask, value, table)
172 * Instruction decoding jumps to parsing the new sub-table 'table'.
173 *
174 * DECODE_CUSTOM(mask, value, decoder)
175 * The value of 'decoder' is used as an index into the array of
176 * action functions, and the retrieved decoder function is invoked
177 * to complete decoding of the instruction.
178 *
179 * DECODE_SIMULATE(mask, value, handler)
180 * The probes instruction handler is set to the value found by
181 * indexing into the action array using the value of 'handler'. This
182 * will be used to simulate the instruction when the probe is hit.
183 * Decoding returns with INSN_GOOD_NO_SLOT.
184 *
185 * DECODE_EMULATE(mask, value, handler)
186 * The probes instruction handler is set to the value found by
187 * indexing into the action array using the value of 'handler'. This
188 * will be used to emulate the instruction when the probe is hit. The
189 * modified instruction (see below) is placed in the probes instruction
190 * slot so it may be called by the emulation code. Decoding returns
191 * with INSN_GOOD.
192 *
193 * DECODE_REJECT(mask, value)
194 * Instruction decoding fails with INSN_REJECTED
195 *
196 * DECODE_OR(mask, value)
197 * This allows the mask/value test of multiple table entries to be
198 * logically ORed. Once an 'or' entry is matched the decoding action to
199 * be performed is that of the next entry which isn't an 'or'. E.g.
200 *
201 * DECODE_OR (mask1, value1)
202 * DECODE_OR (mask2, value2)
203 * DECODE_SIMULATE (mask3, value3, simulation_handler)
204 *
205 * This means that if any of the three mask/value pairs match the
206 * instruction being decoded, then 'simulation_handler' will be used
207 * for it.
208 *
209 * Both the SIMULATE and EMULATE macros have a second form which take an
210 * additional 'regs' argument.
211 *
212 * DECODE_SIMULATEX(mask, value, handler, regs)
213 * DECODE_EMULATEX (mask, value, handler, regs)
214 *
215 * These are used to specify what kind of CPU register is encoded in each of the
216 * least significant 5 nibbles of the instruction being decoded. The regs value
217 * is specified using the REGS macro, this takes any of the REG_TYPE_* values
218 * from enum decode_reg_type as arguments; only the '*' part of the name is
219 * given. E.g.
220 *
221 * REGS(0, ANY, NOPC, 0, ANY)
222 *
223 * This indicates an instruction is encoded like:
224 *
225 * bits 19..16 ignore
226 * bits 15..12 any register allowed here
227 * bits 11.. 8 any register except PC allowed here
228 * bits 7.. 4 ignore
229 * bits 3.. 0 any register allowed here
230 *
231 * This register specification is checked after a decode table entry is found to
232 * match an instruction (through the mask/value test). Any invalid register then
233 * found in the instruction will cause decoding to fail with INSN_REJECTED. In
234 * the above example this would happen if bits 11..8 of the instruction were
235 * 1111, indicating R15 or PC.
236 *
237 * As well as checking for legal combinations of registers, this data is also
238 * used to modify the registers encoded in the instructions so that an
239 * emulation routines can use it. (See decode_regs() and INSN_NEW_BITS.)
240 *
241 * Here is a real example which matches ARM instructions of the form
242 * "AND <Rd>,<Rn>,<Rm>,<shift> <Rs>"
243 *
244 * DECODE_EMULATEX (0x0e000090, 0x00000010, PROBES_DATA_PROCESSING_REG,
245 * REGS(ANY, ANY, NOPC, 0, ANY)),
246 * ^ ^ ^ ^
247 * Rn Rd Rs Rm
248 *
249 * Decoding the instruction "AND R4, R5, R6, ASL R15" will be rejected because
250 * Rs == R15
251 *
252 * Decoding the instruction "AND R4, R5, R6, ASL R7" will be accepted and the
253 * instruction will be modified to "AND R0, R2, R3, ASL R1" and then placed into
254 * the kprobes instruction slot. This can then be called later by the handler
255 * function emulate_rd12rn16rm0rs8_rwflags (a pointer to which is retrieved from
256 * the indicated slot in the action array), in order to simulate the instruction.
257 */
258
259 enum decode_type {
260 DECODE_TYPE_END,
261 DECODE_TYPE_TABLE,
262 DECODE_TYPE_CUSTOM,
263 DECODE_TYPE_SIMULATE,
264 DECODE_TYPE_EMULATE,
265 DECODE_TYPE_OR,
266 DECODE_TYPE_REJECT,
267 NUM_DECODE_TYPES /* Must be last enum */
268 };
269
270 #define DECODE_TYPE_BITS 4
271 #define DECODE_TYPE_MASK ((1 << DECODE_TYPE_BITS) - 1)
272
273 enum decode_reg_type {
274 REG_TYPE_NONE = 0, /* Not a register, ignore */
275 REG_TYPE_ANY, /* Any register allowed */
276 REG_TYPE_SAMEAS16, /* Register should be same as that at bits 19..16 */
277 REG_TYPE_SP, /* Register must be SP */
278 REG_TYPE_PC, /* Register must be PC */
279 REG_TYPE_NOSP, /* Register must not be SP */
280 REG_TYPE_NOSPPC, /* Register must not be SP or PC */
281 REG_TYPE_NOPC, /* Register must not be PC */
282 REG_TYPE_NOPCWB, /* No PC if load/store write-back flag also set */
283
284 /* The following types are used when the encoding for PC indicates
285 * another instruction form. This distiction only matters for test
286 * case coverage checks.
287 */
288 REG_TYPE_NOPCX, /* Register must not be PC */
289 REG_TYPE_NOSPPCX, /* Register must not be SP or PC */
290
291 /* Alias to allow '0' arg to be used in REGS macro. */
292 REG_TYPE_0 = REG_TYPE_NONE
293 };
294
295 #define REGS(r16, r12, r8, r4, r0) \
296 (((REG_TYPE_##r16) << 16) + \
297 ((REG_TYPE_##r12) << 12) + \
298 ((REG_TYPE_##r8) << 8) + \
299 ((REG_TYPE_##r4) << 4) + \
300 (REG_TYPE_##r0))
301
302 union decode_item {
303 u32 bits;
304 const union decode_item *table;
305 int action;
306 };
307
308 struct decode_header;
309 typedef enum probes_insn (probes_custom_decode_t)(probes_opcode_t,
310 struct arch_probes_insn *,
311 const struct decode_header *);
312
313 union decode_action {
314 probes_insn_handler_t *handler;
315 probes_custom_decode_t *decoder;
316 };
317
318 typedef enum probes_insn (probes_check_t)(probes_opcode_t,
319 struct arch_probes_insn *,
320 const struct decode_header *);
321
322 struct decode_checker {
323 probes_check_t *checker;
324 };
325
326 #define DECODE_END \
327 {.bits = DECODE_TYPE_END}
328
329
330 struct decode_header {
331 union decode_item type_regs;
332 union decode_item mask;
333 union decode_item value;
334 };
335
336 #define DECODE_HEADER(_type, _mask, _value, _regs) \
337 {.bits = (_type) | ((_regs) << DECODE_TYPE_BITS)}, \
338 {.bits = (_mask)}, \
339 {.bits = (_value)}
340
341
342 struct decode_table {
343 struct decode_header header;
344 union decode_item table;
345 };
346
347 #define DECODE_TABLE(_mask, _value, _table) \
348 DECODE_HEADER(DECODE_TYPE_TABLE, _mask, _value, 0), \
349 {.table = (_table)}
350
351
352 struct decode_custom {
353 struct decode_header header;
354 union decode_item decoder;
355 };
356
357 #define DECODE_CUSTOM(_mask, _value, _decoder) \
358 DECODE_HEADER(DECODE_TYPE_CUSTOM, _mask, _value, 0), \
359 {.action = (_decoder)}
360
361
362 struct decode_simulate {
363 struct decode_header header;
364 union decode_item handler;
365 };
366
367 #define DECODE_SIMULATEX(_mask, _value, _handler, _regs) \
368 DECODE_HEADER(DECODE_TYPE_SIMULATE, _mask, _value, _regs), \
369 {.action = (_handler)}
370
371 #define DECODE_SIMULATE(_mask, _value, _handler) \
372 DECODE_SIMULATEX(_mask, _value, _handler, 0)
373
374
375 struct decode_emulate {
376 struct decode_header header;
377 union decode_item handler;
378 };
379
380 #define DECODE_EMULATEX(_mask, _value, _handler, _regs) \
381 DECODE_HEADER(DECODE_TYPE_EMULATE, _mask, _value, _regs), \
382 {.action = (_handler)}
383
384 #define DECODE_EMULATE(_mask, _value, _handler) \
385 DECODE_EMULATEX(_mask, _value, _handler, 0)
386
387
388 struct decode_or {
389 struct decode_header header;
390 };
391
392 #define DECODE_OR(_mask, _value) \
393 DECODE_HEADER(DECODE_TYPE_OR, _mask, _value, 0)
394
395 enum probes_insn {
396 INSN_REJECTED,
397 INSN_GOOD,
398 INSN_GOOD_NO_SLOT
399 };
400
401 struct decode_reject {
402 struct decode_header header;
403 };
404
405 #define DECODE_REJECT(_mask, _value) \
406 DECODE_HEADER(DECODE_TYPE_REJECT, _mask, _value, 0)
407
408 probes_insn_handler_t probes_simulate_nop;
409 probes_insn_handler_t probes_emulate_none;
410
411 int __kprobes
412 probes_decode_insn(probes_opcode_t insn, struct arch_probes_insn *asi,
413 const union decode_item *table, bool thumb, bool emulate,
414 const union decode_action *actions,
415 const struct decode_checker **checkers);
416
417 #endif
418
