1/* 2 * arch/arm/kernel/kprobes.h 3 * 4 * Copyright (C) 2011 Jon Medhurst <tixy@yxit.co.uk>. 5 * 6 * Some contents moved here from arch/arm/include/asm/kprobes.h which is 7 * Copyright (C) 2006, 2007 Motorola Inc. 8 * 9 * This program is free software; you can redistribute it and/or modify 10 * it under the terms of the GNU General Public License version 2 as 11 * published by the Free Software Foundation. 12 * 13 * This program is distributed in the hope that it will be useful, 14 * but WITHOUT ANY WARRANTY; without even the implied warranty of 15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU 16 * General Public License for more details. 17 */ 18 19#ifndef _ARM_KERNEL_KPROBES_H 20#define _ARM_KERNEL_KPROBES_H 21 22/* 23 * These undefined instructions must be unique and 24 * reserved solely for kprobes' use. 25 */ 26#define KPROBE_ARM_BREAKPOINT_INSTRUCTION 0x07f001f8 27#define KPROBE_THUMB16_BREAKPOINT_INSTRUCTION 0xde18 28#define KPROBE_THUMB32_BREAKPOINT_INSTRUCTION 0xf7f0a018 29 30 31enum kprobe_insn { 32 INSN_REJECTED, 33 INSN_GOOD, 34 INSN_GOOD_NO_SLOT 35}; 36 37typedef enum kprobe_insn (kprobe_decode_insn_t)(kprobe_opcode_t, 38 struct arch_specific_insn *); 39 40#ifdef CONFIG_THUMB2_KERNEL 41 42enum kprobe_insn thumb16_kprobe_decode_insn(kprobe_opcode_t, 43 struct arch_specific_insn *); 44enum kprobe_insn thumb32_kprobe_decode_insn(kprobe_opcode_t, 45 struct arch_specific_insn *); 46 47#else /* !CONFIG_THUMB2_KERNEL */ 48 49enum kprobe_insn arm_kprobe_decode_insn(kprobe_opcode_t, 50 struct arch_specific_insn *); 51#endif 52 53void __init arm_kprobe_decode_init(void); 54 55extern kprobe_check_cc * const kprobe_condition_checks[16]; 56 57 58#if __LINUX_ARM_ARCH__ >= 7 59 60/* str_pc_offset is architecturally defined from ARMv7 onwards */ 61#define str_pc_offset 8 62#define find_str_pc_offset() 63 64#else /* __LINUX_ARM_ARCH__ < 7 */ 65 66/* We need a run-time check to determine str_pc_offset */ 67extern int str_pc_offset; 68void __init find_str_pc_offset(void); 69 70#endif 71 72 73/* 74 * Update ITSTATE after normal execution of an IT block instruction. 75 * 76 * The 8 IT state bits are split into two parts in CPSR: 77 * ITSTATE<1:0> are in CPSR<26:25> 78 * ITSTATE<7:2> are in CPSR<15:10> 79 */ 80static inline unsigned long it_advance(unsigned long cpsr) 81 { 82 if ((cpsr & 0x06000400) == 0) { 83 /* ITSTATE<2:0> == 0 means end of IT block, so clear IT state */ 84 cpsr &= ~PSR_IT_MASK; 85 } else { 86 /* We need to shift left ITSTATE<4:0> */ 87 const unsigned long mask = 0x06001c00; /* Mask ITSTATE<4:0> */ 88 unsigned long it = cpsr & mask; 89 it <<= 1; 90 it |= it >> (27 - 10); /* Carry ITSTATE<2> to correct place */ 91 it &= mask; 92 cpsr &= ~mask; 93 cpsr |= it; 94 } 95 return cpsr; 96} 97 98static inline void __kprobes bx_write_pc(long pcv, struct pt_regs *regs) 99{ 100 long cpsr = regs->ARM_cpsr; 101 if (pcv & 0x1) { 102 cpsr |= PSR_T_BIT; 103 pcv &= ~0x1; 104 } else { 105 cpsr &= ~PSR_T_BIT; 106 pcv &= ~0x2; /* Avoid UNPREDICTABLE address allignment */ 107 } 108 regs->ARM_cpsr = cpsr; 109 regs->ARM_pc = pcv; 110} 111 112 113#if __LINUX_ARM_ARCH__ >= 6 114 115/* Kernels built for >= ARMv6 should never run on <= ARMv5 hardware, so... */ 116#define load_write_pc_interworks true 117#define test_load_write_pc_interworking() 118 119#else /* __LINUX_ARM_ARCH__ < 6 */ 120 121/* We need run-time testing to determine if load_write_pc() should interwork. */ 122extern bool load_write_pc_interworks; 123void __init test_load_write_pc_interworking(void); 124 125#endif 126 127static inline void __kprobes load_write_pc(long pcv, struct pt_regs *regs) 128{ 129 if (load_write_pc_interworks) 130 bx_write_pc(pcv, regs); 131 else 132 regs->ARM_pc = pcv; 133} 134 135 136#if __LINUX_ARM_ARCH__ >= 7 137 138#define alu_write_pc_interworks true 139#define test_alu_write_pc_interworking() 140 141#elif __LINUX_ARM_ARCH__ <= 5 142 143/* Kernels built for <= ARMv5 should never run on >= ARMv6 hardware, so... */ 144#define alu_write_pc_interworks false 145#define test_alu_write_pc_interworking() 146 147#else /* __LINUX_ARM_ARCH__ == 6 */ 148 149/* We could be an ARMv6 binary on ARMv7 hardware so we need a run-time check. */ 150extern bool alu_write_pc_interworks; 151void __init test_alu_write_pc_interworking(void); 152 153#endif /* __LINUX_ARM_ARCH__ == 6 */ 154 155static inline void __kprobes alu_write_pc(long pcv, struct pt_regs *regs) 156{ 157 if (alu_write_pc_interworks) 158 bx_write_pc(pcv, regs); 159 else 160 regs->ARM_pc = pcv; 161} 162 163 164void __kprobes kprobe_simulate_nop(struct kprobe *p, struct pt_regs *regs); 165void __kprobes kprobe_emulate_none(struct kprobe *p, struct pt_regs *regs); 166 167enum kprobe_insn __kprobes 168kprobe_decode_ldmstm(kprobe_opcode_t insn, struct arch_specific_insn *asi); 169 170/* 171 * Test if load/store instructions writeback the address register. 172 * if P (bit 24) == 0 or W (bit 21) == 1 173 */ 174#define is_writeback(insn) ((insn ^ 0x01000000) & 0x01200000) 175 176/* 177 * The following definitions and macros are used to build instruction 178 * decoding tables for use by kprobe_decode_insn. 179 * 180 * These tables are a concatenation of entries each of which consist of one of 181 * the decode_* structs. All of the fields in every type of decode structure 182 * are of the union type decode_item, therefore the entire decode table can be 183 * viewed as an array of these and declared like: 184 * 185 * static const union decode_item table_name[] = {}; 186 * 187 * In order to construct each entry in the table, macros are used to 188 * initialise a number of sequential decode_item values in a layout which 189 * matches the relevant struct. E.g. DECODE_SIMULATE initialise a struct 190 * decode_simulate by initialising four decode_item objects like this... 191 * 192 * {.bits = _type}, 193 * {.bits = _mask}, 194 * {.bits = _value}, 195 * {.handler = _handler}, 196 * 197 * Initialising a specified member of the union means that the compiler 198 * will produce a warning if the argument is of an incorrect type. 199 * 200 * Below is a list of each of the macros used to initialise entries and a 201 * description of the action performed when that entry is matched to an 202 * instruction. A match is found when (instruction & mask) == value. 203 * 204 * DECODE_TABLE(mask, value, table) 205 * Instruction decoding jumps to parsing the new sub-table 'table'. 206 * 207 * DECODE_CUSTOM(mask, value, decoder) 208 * The custom function 'decoder' is called to the complete decoding 209 * of an instruction. 210 * 211 * DECODE_SIMULATE(mask, value, handler) 212 * Set the probes instruction handler to 'handler', this will be used 213 * to simulate the instruction when the probe is hit. Decoding returns 214 * with INSN_GOOD_NO_SLOT. 215 * 216 * DECODE_EMULATE(mask, value, handler) 217 * Set the probes instruction handler to 'handler', this will be used 218 * to emulate the instruction when the probe is hit. The modified 219 * instruction (see below) is placed in the probes instruction slot so it 220 * may be called by the emulation code. Decoding returns with INSN_GOOD. 221 * 222 * DECODE_REJECT(mask, value) 223 * Instruction decoding fails with INSN_REJECTED 224 * 225 * DECODE_OR(mask, value) 226 * This allows the mask/value test of multiple table entries to be 227 * logically ORed. Once an 'or' entry is matched the decoding action to 228 * be performed is that of the next entry which isn't an 'or'. E.g. 229 * 230 * DECODE_OR (mask1, value1) 231 * DECODE_OR (mask2, value2) 232 * DECODE_SIMULATE (mask3, value3, simulation_handler) 233 * 234 * This means that if any of the three mask/value pairs match the 235 * instruction being decoded, then 'simulation_handler' will be used 236 * for it. 237 * 238 * Both the SIMULATE and EMULATE macros have a second form which take an 239 * additional 'regs' argument. 240 * 241 * DECODE_SIMULATEX(mask, value, handler, regs) 242 * DECODE_EMULATEX (mask, value, handler, regs) 243 * 244 * These are used to specify what kind of CPU register is encoded in each of the 245 * least significant 5 nibbles of the instruction being decoded. The regs value 246 * is specified using the REGS macro, this takes any of the REG_TYPE_* values 247 * from enum decode_reg_type as arguments; only the '*' part of the name is 248 * given. E.g. 249 * 250 * REGS(0, ANY, NOPC, 0, ANY) 251 * 252 * This indicates an instruction is encoded like: 253 * 254 * bits 19..16 ignore 255 * bits 15..12 any register allowed here 256 * bits 11.. 8 any register except PC allowed here 257 * bits 7.. 4 ignore 258 * bits 3.. 0 any register allowed here 259 * 260 * This register specification is checked after a decode table entry is found to 261 * match an instruction (through the mask/value test). Any invalid register then 262 * found in the instruction will cause decoding to fail with INSN_REJECTED. In 263 * the above example this would happen if bits 11..8 of the instruction were 264 * 1111, indicating R15 or PC. 265 * 266 * As well as checking for legal combinations of registers, this data is also 267 * used to modify the registers encoded in the instructions so that an 268 * emulation routines can use it. (See decode_regs() and INSN_NEW_BITS.) 269 * 270 * Here is a real example which matches ARM instructions of the form 271 * "AND <Rd>,<Rn>,<Rm>,<shift> <Rs>" 272 * 273 * DECODE_EMULATEX (0x0e000090, 0x00000010, emulate_rd12rn16rm0rs8_rwflags, 274 * REGS(ANY, ANY, NOPC, 0, ANY)), 275 * ^ ^ ^ ^ 276 * Rn Rd Rs Rm 277 * 278 * Decoding the instruction "AND R4, R5, R6, ASL R15" will be rejected because 279 * Rs == R15 280 * 281 * Decoding the instruction "AND R4, R5, R6, ASL R7" will be accepted and the 282 * instruction will be modified to "AND R0, R2, R3, ASL R1" and then placed into 283 * the kprobes instruction slot. This can then be called later by the handler 284 * function emulate_rd12rn16rm0rs8_rwflags in order to simulate the instruction. 285 */ 286 287enum decode_type { 288 DECODE_TYPE_END, 289 DECODE_TYPE_TABLE, 290 DECODE_TYPE_CUSTOM, 291 DECODE_TYPE_SIMULATE, 292 DECODE_TYPE_EMULATE, 293 DECODE_TYPE_OR, 294 DECODE_TYPE_REJECT, 295 NUM_DECODE_TYPES /* Must be last enum */ 296}; 297 298#define DECODE_TYPE_BITS 4 299#define DECODE_TYPE_MASK ((1 << DECODE_TYPE_BITS) - 1) 300 301enum decode_reg_type { 302 REG_TYPE_NONE = 0, /* Not a register, ignore */ 303 REG_TYPE_ANY, /* Any register allowed */ 304 REG_TYPE_SAMEAS16, /* Register should be same as that at bits 19..16 */ 305 REG_TYPE_SP, /* Register must be SP */ 306 REG_TYPE_PC, /* Register must be PC */ 307 REG_TYPE_NOSP, /* Register must not be SP */ 308 REG_TYPE_NOSPPC, /* Register must not be SP or PC */ 309 REG_TYPE_NOPC, /* Register must not be PC */ 310 REG_TYPE_NOPCWB, /* No PC if load/store write-back flag also set */ 311 312 /* The following types are used when the encoding for PC indicates 313 * another instruction form. This distiction only matters for test 314 * case coverage checks. 315 */ 316 REG_TYPE_NOPCX, /* Register must not be PC */ 317 REG_TYPE_NOSPPCX, /* Register must not be SP or PC */ 318 319 /* Alias to allow '0' arg to be used in REGS macro. */ 320 REG_TYPE_0 = REG_TYPE_NONE 321}; 322 323#define REGS(r16, r12, r8, r4, r0) \ 324 ((REG_TYPE_##r16) << 16) + \ 325 ((REG_TYPE_##r12) << 12) + \ 326 ((REG_TYPE_##r8) << 8) + \ 327 ((REG_TYPE_##r4) << 4) + \ 328 (REG_TYPE_##r0) 329 330union decode_item { 331 u32 bits; 332 const union decode_item *table; 333 kprobe_insn_handler_t *handler; 334 kprobe_decode_insn_t *decoder; 335}; 336 337 338#define DECODE_END \ 339 {.bits = DECODE_TYPE_END} 340 341 342struct decode_header { 343 union decode_item type_regs; 344 union decode_item mask; 345 union decode_item value; 346}; 347 348#define DECODE_HEADER(_type, _mask, _value, _regs) \ 349 {.bits = (_type) | ((_regs) << DECODE_TYPE_BITS)}, \ 350 {.bits = (_mask)}, \ 351 {.bits = (_value)} 352 353 354struct decode_table { 355 struct decode_header header; 356 union decode_item table; 357}; 358 359#define DECODE_TABLE(_mask, _value, _table) \ 360 DECODE_HEADER(DECODE_TYPE_TABLE, _mask, _value, 0), \ 361 {.table = (_table)} 362 363 364struct decode_custom { 365 struct decode_header header; 366 union decode_item decoder; 367}; 368 369#define DECODE_CUSTOM(_mask, _value, _decoder) \ 370 DECODE_HEADER(DECODE_TYPE_CUSTOM, _mask, _value, 0), \ 371 {.decoder = (_decoder)} 372 373 374struct decode_simulate { 375 struct decode_header header; 376 union decode_item handler; 377}; 378 379#define DECODE_SIMULATEX(_mask, _value, _handler, _regs) \ 380 DECODE_HEADER(DECODE_TYPE_SIMULATE, _mask, _value, _regs), \ 381 {.handler = (_handler)} 382 383#define DECODE_SIMULATE(_mask, _value, _handler) \ 384 DECODE_SIMULATEX(_mask, _value, _handler, 0) 385 386 387struct decode_emulate { 388 struct decode_header header; 389 union decode_item handler; 390}; 391 392#define DECODE_EMULATEX(_mask, _value, _handler, _regs) \ 393 DECODE_HEADER(DECODE_TYPE_EMULATE, _mask, _value, _regs), \ 394 {.handler = (_handler)} 395 396#define DECODE_EMULATE(_mask, _value, _handler) \ 397 DECODE_EMULATEX(_mask, _value, _handler, 0) 398 399 400struct decode_or { 401 struct decode_header header; 402}; 403 404#define DECODE_OR(_mask, _value) \ 405 DECODE_HEADER(DECODE_TYPE_OR, _mask, _value, 0) 406 407 408struct decode_reject { 409 struct decode_header header; 410}; 411 412#define DECODE_REJECT(_mask, _value) \ 413 DECODE_HEADER(DECODE_TYPE_REJECT, _mask, _value, 0) 414 415 416#ifdef CONFIG_THUMB2_KERNEL 417extern const union decode_item kprobe_decode_thumb16_table[]; 418extern const union decode_item kprobe_decode_thumb32_table[]; 419#else 420extern const union decode_item kprobe_decode_arm_table[]; 421#endif 422 423 424int kprobe_decode_insn(kprobe_opcode_t insn, struct arch_specific_insn *asi, 425 const union decode_item *table, bool thumb16); 426 427 428#endif /* _ARM_KERNEL_KPROBES_H */ 429