1
2
3
4
5
6
7
8
9
10
11
12
13
14#include <linux/kernel.h>
15#include <linux/kprobes.h>
16#include <asm/system_info.h>
17
18#include "kprobes.h"
19
20
21#ifndef find_str_pc_offset
22
23
24
25
26
27
28
29
30int str_pc_offset;
31
32void __init find_str_pc_offset(void)
33{
34 int addr, scratch, ret;
35
36 __asm__ (
37 "sub %[ret], pc, #4 \n\t"
38 "str pc, %[addr] \n\t"
39 "ldr %[scr], %[addr] \n\t"
40 "sub %[ret], %[scr], %[ret] \n\t"
41 : [ret] "=r" (ret), [scr] "=r" (scratch), [addr] "+m" (addr));
42
43 str_pc_offset = ret;
44}
45
46#endif
47
48
49#ifndef test_load_write_pc_interworking
50
51bool load_write_pc_interworks;
52
53void __init test_load_write_pc_interworking(void)
54{
55 int arch = cpu_architecture();
56 BUG_ON(arch == CPU_ARCH_UNKNOWN);
57 load_write_pc_interworks = arch >= CPU_ARCH_ARMv5T;
58}
59
60#endif
61
62
63#ifndef test_alu_write_pc_interworking
64
65bool alu_write_pc_interworks;
66
67void __init test_alu_write_pc_interworking(void)
68{
69 int arch = cpu_architecture();
70 BUG_ON(arch == CPU_ARCH_UNKNOWN);
71 alu_write_pc_interworks = arch >= CPU_ARCH_ARMv7;
72}
73
74#endif
75
76
77void __init arm_kprobe_decode_init(void)
78{
79 find_str_pc_offset();
80 test_load_write_pc_interworking();
81 test_alu_write_pc_interworking();
82}
83
84
85static unsigned long __kprobes __check_eq(unsigned long cpsr)
86{
87 return cpsr & PSR_Z_BIT;
88}
89
90static unsigned long __kprobes __check_ne(unsigned long cpsr)
91{
92 return (~cpsr) & PSR_Z_BIT;
93}
94
95static unsigned long __kprobes __check_cs(unsigned long cpsr)
96{
97 return cpsr & PSR_C_BIT;
98}
99
100static unsigned long __kprobes __check_cc(unsigned long cpsr)
101{
102 return (~cpsr) & PSR_C_BIT;
103}
104
105static unsigned long __kprobes __check_mi(unsigned long cpsr)
106{
107 return cpsr & PSR_N_BIT;
108}
109
110static unsigned long __kprobes __check_pl(unsigned long cpsr)
111{
112 return (~cpsr) & PSR_N_BIT;
113}
114
115static unsigned long __kprobes __check_vs(unsigned long cpsr)
116{
117 return cpsr & PSR_V_BIT;
118}
119
120static unsigned long __kprobes __check_vc(unsigned long cpsr)
121{
122 return (~cpsr) & PSR_V_BIT;
123}
124
125static unsigned long __kprobes __check_hi(unsigned long cpsr)
126{
127 cpsr &= ~(cpsr >> 1);
128 return cpsr & PSR_C_BIT;
129}
130
131static unsigned long __kprobes __check_ls(unsigned long cpsr)
132{
133 cpsr &= ~(cpsr >> 1);
134 return (~cpsr) & PSR_C_BIT;
135}
136
137static unsigned long __kprobes __check_ge(unsigned long cpsr)
138{
139 cpsr ^= (cpsr << 3);
140 return (~cpsr) & PSR_N_BIT;
141}
142
143static unsigned long __kprobes __check_lt(unsigned long cpsr)
144{
145 cpsr ^= (cpsr << 3);
146 return cpsr & PSR_N_BIT;
147}
148
149static unsigned long __kprobes __check_gt(unsigned long cpsr)
150{
151 unsigned long temp = cpsr ^ (cpsr << 3);
152 temp |= (cpsr << 1);
153 return (~temp) & PSR_N_BIT;
154}
155
156static unsigned long __kprobes __check_le(unsigned long cpsr)
157{
158 unsigned long temp = cpsr ^ (cpsr << 3);
159 temp |= (cpsr << 1);
160 return temp & PSR_N_BIT;
161}
162
163static unsigned long __kprobes __check_al(unsigned long cpsr)
164{
165 return true;
166}
167
168kprobe_check_cc * const kprobe_condition_checks[16] = {
169 &__check_eq, &__check_ne, &__check_cs, &__check_cc,
170 &__check_mi, &__check_pl, &__check_vs, &__check_vc,
171 &__check_hi, &__check_ls, &__check_ge, &__check_lt,
172 &__check_gt, &__check_le, &__check_al, &__check_al
173};
174
175
176void __kprobes kprobe_simulate_nop(struct kprobe *p, struct pt_regs *regs)
177{
178}
179
180void __kprobes kprobe_emulate_none(struct kprobe *p, struct pt_regs *regs)
181{
182 p->ainsn.insn_fn();
183}
184
185static void __kprobes simulate_ldm1stm1(struct kprobe *p, struct pt_regs *regs)
186{
187 kprobe_opcode_t insn = p->opcode;
188 int rn = (insn >> 16) & 0xf;
189 int lbit = insn & (1 << 20);
190 int wbit = insn & (1 << 21);
191 int ubit = insn & (1 << 23);
192 int pbit = insn & (1 << 24);
193 long *addr = (long *)regs->uregs[rn];
194 int reg_bit_vector;
195 int reg_count;
196
197 reg_count = 0;
198 reg_bit_vector = insn & 0xffff;
199 while (reg_bit_vector) {
200 reg_bit_vector &= (reg_bit_vector - 1);
201 ++reg_count;
202 }
203
204 if (!ubit)
205 addr -= reg_count;
206 addr += (!pbit == !ubit);
207
208 reg_bit_vector = insn & 0xffff;
209 while (reg_bit_vector) {
210 int reg = __ffs(reg_bit_vector);
211 reg_bit_vector &= (reg_bit_vector - 1);
212 if (lbit)
213 regs->uregs[reg] = *addr++;
214 else
215 *addr++ = regs->uregs[reg];
216 }
217
218 if (wbit) {
219 if (!ubit)
220 addr -= reg_count;
221 addr -= (!pbit == !ubit);
222 regs->uregs[rn] = (long)addr;
223 }
224}
225
226static void __kprobes simulate_stm1_pc(struct kprobe *p, struct pt_regs *regs)
227{
228 regs->ARM_pc = (long)p->addr + str_pc_offset;
229 simulate_ldm1stm1(p, regs);
230 regs->ARM_pc = (long)p->addr + 4;
231}
232
233static void __kprobes simulate_ldm1_pc(struct kprobe *p, struct pt_regs *regs)
234{
235 simulate_ldm1stm1(p, regs);
236 load_write_pc(regs->ARM_pc, regs);
237}
238
239static void __kprobes
240emulate_generic_r0_12_noflags(struct kprobe *p, struct pt_regs *regs)
241{
242 register void *rregs asm("r1") = regs;
243 register void *rfn asm("lr") = p->ainsn.insn_fn;
244
245 __asm__ __volatile__ (
246 "stmdb sp!, {%[regs], r11} \n\t"
247 "ldmia %[regs], {r0-r12} \n\t"
248#if __LINUX_ARM_ARCH__ >= 6
249 "blx %[fn] \n\t"
250#else
251 "str %[fn], [sp, #-4]! \n\t"
252 "adr lr, 1f \n\t"
253 "ldr pc, [sp], #4 \n\t"
254 "1: \n\t"
255#endif
256 "ldr lr, [sp], #4 \n\t"
257 "stmia lr, {r0-r12} \n\t"
258 "ldr r11, [sp], #4 \n\t"
259 : [regs] "=r" (rregs), [fn] "=r" (rfn)
260 : "0" (rregs), "1" (rfn)
261 : "r0", "r2", "r3", "r4", "r5", "r6", "r7",
262 "r8", "r9", "r10", "r12", "memory", "cc"
263 );
264}
265
266static void __kprobes
267emulate_generic_r2_14_noflags(struct kprobe *p, struct pt_regs *regs)
268{
269 emulate_generic_r0_12_noflags(p, (struct pt_regs *)(regs->uregs+2));
270}
271
272static void __kprobes
273emulate_ldm_r3_15(struct kprobe *p, struct pt_regs *regs)
274{
275 emulate_generic_r0_12_noflags(p, (struct pt_regs *)(regs->uregs+3));
276 load_write_pc(regs->ARM_pc, regs);
277}
278
279enum kprobe_insn __kprobes
280kprobe_decode_ldmstm(kprobe_opcode_t insn, struct arch_specific_insn *asi)
281{
282 kprobe_insn_handler_t *handler = 0;
283 unsigned reglist = insn & 0xffff;
284 int is_ldm = insn & 0x100000;
285 int rn = (insn >> 16) & 0xf;
286
287 if (rn <= 12 && (reglist & 0xe000) == 0) {
288
289 handler = emulate_generic_r0_12_noflags;
290
291 } else if (rn >= 2 && (reglist & 0x8003) == 0) {
292
293 rn -= 2;
294 reglist >>= 2;
295 handler = emulate_generic_r2_14_noflags;
296
297 } else if (rn >= 3 && (reglist & 0x0007) == 0) {
298
299 if (is_ldm && (reglist & 0x8000)) {
300 rn -= 3;
301 reglist >>= 3;
302 handler = emulate_ldm_r3_15;
303 }
304 }
305
306 if (handler) {
307
308 asi->insn[0] = (insn & 0xfff00000) | (rn << 16) | reglist;
309 asi->insn_handler = handler;
310 return INSN_GOOD;
311 }
312
313
314 if (reglist & 0x8000)
315 handler = is_ldm ? simulate_ldm1_pc : simulate_stm1_pc;
316 else
317 handler = simulate_ldm1stm1;
318 asi->insn_handler = handler;
319 return INSN_GOOD_NO_SLOT;
320}
321
322
323
324
325
326
327
328
329
330static kprobe_opcode_t __kprobes
331prepare_emulated_insn(kprobe_opcode_t insn, struct arch_specific_insn *asi,
332 bool thumb)
333{
334#ifdef CONFIG_THUMB2_KERNEL
335 if (thumb) {
336 u16 *thumb_insn = (u16 *)asi->insn;
337 thumb_insn[1] = 0x4770;
338 thumb_insn[2] = 0x4770;
339 return insn;
340 }
341 asi->insn[1] = 0xe12fff1e;
342#else
343 asi->insn[1] = 0xe1a0f00e;
344#endif
345
346 if (insn < 0xe0000000)
347 insn = (insn | 0xe0000000) & ~0x10000000;
348 return insn;
349}
350
351
352
353
354
355static void __kprobes
356set_emulated_insn(kprobe_opcode_t insn, struct arch_specific_insn *asi,
357 bool thumb)
358{
359#ifdef CONFIG_THUMB2_KERNEL
360 if (thumb) {
361 u16 *ip = (u16 *)asi->insn;
362 if (is_wide_instruction(insn))
363 *ip++ = insn >> 16;
364 *ip++ = insn;
365 return;
366 }
367#endif
368 asi->insn[0] = insn;
369}
370
371
372
373
374
375
376
377
378
379
380#define INSN_NEW_BITS 0x00020103
381
382
383#define INSN_SAMEAS16_BITS 0x22222222
384
385
386
387
388
389
390
391
392static bool __kprobes decode_regs(kprobe_opcode_t* pinsn, u32 regs)
393{
394 kprobe_opcode_t insn = *pinsn;
395 kprobe_opcode_t mask = 0xf;
396
397 for (; regs != 0; regs >>= 4, mask <<= 4) {
398
399 kprobe_opcode_t new_bits = INSN_NEW_BITS;
400
401 switch (regs & 0xf) {
402
403 case REG_TYPE_NONE:
404
405 continue;
406
407 case REG_TYPE_ANY:
408
409 break;
410
411 case REG_TYPE_SAMEAS16:
412
413 new_bits = INSN_SAMEAS16_BITS;
414 break;
415
416 case REG_TYPE_SP:
417
418 if ((insn ^ 0xdddddddd) & mask)
419 goto reject;
420 break;
421
422 case REG_TYPE_PC:
423
424 if ((insn ^ 0xffffffff) & mask)
425 goto reject;
426 break;
427
428 case REG_TYPE_NOSP:
429
430 if (((insn ^ 0xdddddddd) & mask) == 0)
431 goto reject;
432 break;
433
434 case REG_TYPE_NOSPPC:
435 case REG_TYPE_NOSPPCX:
436
437 if (((insn ^ 0xdddddddd) & 0xdddddddd & mask) == 0)
438 goto reject;
439 break;
440
441 case REG_TYPE_NOPCWB:
442 if (!is_writeback(insn))
443 break;
444
445 case REG_TYPE_NOPC:
446 case REG_TYPE_NOPCX:
447
448 if (((insn ^ 0xffffffff) & mask) == 0)
449 goto reject;
450 break;
451 }
452
453
454 insn &= ~mask;
455 insn |= new_bits & mask;
456 }
457
458 *pinsn = insn;
459 return true;
460
461reject:
462 return false;
463}
464
465static const int decode_struct_sizes[NUM_DECODE_TYPES] = {
466 [DECODE_TYPE_TABLE] = sizeof(struct decode_table),
467 [DECODE_TYPE_CUSTOM] = sizeof(struct decode_custom),
468 [DECODE_TYPE_SIMULATE] = sizeof(struct decode_simulate),
469 [DECODE_TYPE_EMULATE] = sizeof(struct decode_emulate),
470 [DECODE_TYPE_OR] = sizeof(struct decode_or),
471 [DECODE_TYPE_REJECT] = sizeof(struct decode_reject)
472};
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517int __kprobes
518kprobe_decode_insn(kprobe_opcode_t insn, struct arch_specific_insn *asi,
519 const union decode_item *table, bool thumb)
520{
521 const struct decode_header *h = (struct decode_header *)table;
522 const struct decode_header *next;
523 bool matched = false;
524
525 insn = prepare_emulated_insn(insn, asi, thumb);
526
527 for (;; h = next) {
528 enum decode_type type = h->type_regs.bits & DECODE_TYPE_MASK;
529 u32 regs = h->type_regs.bits >> DECODE_TYPE_BITS;
530
531 if (type == DECODE_TYPE_END)
532 return INSN_REJECTED;
533
534 next = (struct decode_header *)
535 ((uintptr_t)h + decode_struct_sizes[type]);
536
537 if (!matched && (insn & h->mask.bits) != h->value.bits)
538 continue;
539
540 if (!decode_regs(&insn, regs))
541 return INSN_REJECTED;
542
543 switch (type) {
544
545 case DECODE_TYPE_TABLE: {
546 struct decode_table *d = (struct decode_table *)h;
547 next = (struct decode_header *)d->table.table;
548 break;
549 }
550
551 case DECODE_TYPE_CUSTOM: {
552 struct decode_custom *d = (struct decode_custom *)h;
553 return (*d->decoder.decoder)(insn, asi);
554 }
555
556 case DECODE_TYPE_SIMULATE: {
557 struct decode_simulate *d = (struct decode_simulate *)h;
558 asi->insn_handler = d->handler.handler;
559 return INSN_GOOD_NO_SLOT;
560 }
561
562 case DECODE_TYPE_EMULATE: {
563 struct decode_emulate *d = (struct decode_emulate *)h;
564 asi->insn_handler = d->handler.handler;
565 set_emulated_insn(insn, asi, thumb);
566 return INSN_GOOD;
567 }
568
569 case DECODE_TYPE_OR:
570 matched = true;
571 break;
572
573 case DECODE_TYPE_REJECT:
574 default:
575 return INSN_REJECTED;
576 }
577 }
578 }
579