1 // SPDX-License-Identifier: GPL-2.0-only 2 /* 3 * arch/arm/kernel/kprobes-test.c 4 * 5 * Copyright (C) 2011 Jon Medhurst <tixy@yxit.co.uk>. 6 */ 7 8 /* 9 * This file contains test code for ARM kprobes. 10 * 11 * The top level function run_all_tests() executes tests for all of the 12 * supported instruction sets: ARM, 16-bit Thumb, and 32-bit Thumb. These tests 13 * fall into two categories; run_api_tests() checks basic functionality of the 14 * kprobes API, and run_test_cases() is a comprehensive test for kprobes 15 * instruction decoding and simulation. 16 * 17 * run_test_cases() first checks the kprobes decoding table for self consistency 18 * (using table_test()) then executes a series of test cases for each of the CPU 19 * instruction forms. coverage_start() and coverage_end() are used to verify 20 * that these test cases cover all of the possible combinations of instructions 21 * described by the kprobes decoding tables. 22 * 23 * The individual test cases are in kprobes-test-arm.c and kprobes-test-thumb.c 24 * which use the macros defined in kprobes-test.h. The rest of this 25 * documentation will describe the operation of the framework used by these 26 * test cases. 27 */ 28 29 /* 30 * TESTING METHODOLOGY 31 * ------------------- 32 * 33 * The methodology used to test an ARM instruction 'test_insn' is to use 34 * inline assembler like: 35 * 36 * test_before: nop 37 * test_case: test_insn 38 * test_after: nop 39 * 40 * When the test case is run a kprobe is placed of each nop. The 41 * post-handler of the test_before probe is used to modify the saved CPU 42 * register context to that which we require for the test case. The 43 * pre-handler of the of the test_after probe saves a copy of the CPU 44 * register context. In this way we can execute test_insn with a specific 45 * register context and see the results afterwards. 46 * 47 * To actually test the kprobes instruction emulation we perform the above 48 * step a second time but with an additional kprobe on the test_case 49 * instruction itself. If the emulation is accurate then the results seen 50 * by the test_after probe will be identical to the first run which didn't 51 * have a probe on test_case. 52 * 53 * Each test case is run several times with a variety of variations in the 54 * flags value of stored in CPSR, and for Thumb code, different ITState. 55 * 56 * For instructions which can modify PC, a second test_after probe is used 57 * like this: 58 * 59 * test_before: nop 60 * test_case: test_insn 61 * test_after: nop 62 * b test_done 63 * test_after2: nop 64 * test_done: 65 * 66 * The test case is constructed such that test_insn branches to 67 * test_after2, or, if testing a conditional instruction, it may just 68 * continue to test_after. The probes inserted at both locations let us 69 * determine which happened. A similar approach is used for testing 70 * backwards branches... 71 * 72 * b test_before 73 * b test_done @ helps to cope with off by 1 branches 74 * test_after2: nop 75 * b test_done 76 * test_before: nop 77 * test_case: test_insn 78 * test_after: nop 79 * test_done: 80 * 81 * The macros used to generate the assembler instructions describe above 82 * are TEST_INSTRUCTION, TEST_BRANCH_F (branch forwards) and TEST_BRANCH_B 83 * (branch backwards). In these, the local variables numbered 1, 50, 2 and 84 * 99 represent: test_before, test_case, test_after2 and test_done. 85 * 86 * FRAMEWORK 87 * --------- 88 * 89 * Each test case is wrapped between the pair of macros TESTCASE_START and 90 * TESTCASE_END. As well as performing the inline assembler boilerplate, 91 * these call out to the kprobes_test_case_start() and 92 * kprobes_test_case_end() functions which drive the execution of the test 93 * case. The specific arguments to use for each test case are stored as 94 * inline data constructed using the various TEST_ARG_* macros. Putting 95 * this all together, a simple test case may look like: 96 * 97 * TESTCASE_START("Testing mov r0, r7") 98 * TEST_ARG_REG(7, 0x12345678) // Set r7=0x12345678 99 * TEST_ARG_END("") 100 * TEST_INSTRUCTION("mov r0, r7") 101 * TESTCASE_END 102 * 103 * Note, in practice the single convenience macro TEST_R would be used for this 104 * instead. 105 * 106 * The above would expand to assembler looking something like: 107 * 108 * @ TESTCASE_START 109 * bl __kprobes_test_case_start 110 * .pushsection .rodata 111 * "10: 112 * .ascii "mov r0, r7" @ text title for test case 113 * .byte 0 114 * .popsection 115 * @ start of inline data... 116 * .word 10b @ pointer to title in .rodata section 117 * 118 * @ TEST_ARG_REG 119 * .byte ARG_TYPE_REG 120 * .byte 7 121 * .short 0 122 * .word 0x1234567 123 * 124 * @ TEST_ARG_END 125 * .byte ARG_TYPE_END 126 * .byte TEST_ISA @ flags, including ISA being tested 127 * .short 50f-0f @ offset of 'test_before' 128 * .short 2f-0f @ offset of 'test_after2' (if relevent) 129 * .short 99f-0f @ offset of 'test_done' 130 * @ start of test case code... 131 * 0: 132 * .code TEST_ISA @ switch to ISA being tested 133 * 134 * @ TEST_INSTRUCTION 135 * 50: nop @ location for 'test_before' probe 136 * 1: mov r0, r7 @ the test case instruction 'test_insn' 137 * nop @ location for 'test_after' probe 138 * 139 * // TESTCASE_END 140 * 2: 141 * 99: bl __kprobes_test_case_end_##TEST_ISA 142 * .code NONMAL_ISA 143 * 144 * When the above is execute the following happens... 145 * 146 * __kprobes_test_case_start() is an assembler wrapper which sets up space 147 * for a stack buffer and calls the C function kprobes_test_case_start(). 148 * This C function will do some initial processing of the inline data and 149 * setup some global state. It then inserts the test_before and test_after 150 * kprobes and returns a value which causes the assembler wrapper to jump 151 * to the start of the test case code, (local label '0'). 152 * 153 * When the test case code executes, the test_before probe will be hit and 154 * test_before_post_handler will call setup_test_context(). This fills the 155 * stack buffer and CPU registers with a test pattern and then processes 156 * the test case arguments. In our example there is one TEST_ARG_REG which 157 * indicates that R7 should be loaded with the value 0x12345678. 158 * 159 * When the test_before probe ends, the test case continues and executes 160 * the "mov r0, r7" instruction. It then hits the test_after probe and the 161 * pre-handler for this (test_after_pre_handler) will save a copy of the 162 * CPU register context. This should now have R0 holding the same value as 163 * R7. 164 * 165 * Finally we get to the call to __kprobes_test_case_end_{32,16}. This is 166 * an assembler wrapper which switches back to the ISA used by the test 167 * code and calls the C function kprobes_test_case_end(). 168 * 169 * For each run through the test case, test_case_run_count is incremented 170 * by one. For even runs, kprobes_test_case_end() saves a copy of the 171 * register and stack buffer contents from the test case just run. It then 172 * inserts a kprobe on the test case instruction 'test_insn' and returns a 173 * value to cause the test case code to be re-run. 174 * 175 * For odd numbered runs, kprobes_test_case_end() compares the register and 176 * stack buffer contents to those that were saved on the previous even 177 * numbered run (the one without the kprobe on test_insn). These should be 178 * the same if the kprobe instruction simulation routine is correct. 179 * 180 * The pair of test case runs is repeated with different combinations of 181 * flag values in CPSR and, for Thumb, different ITState. This is 182 * controlled by test_context_cpsr(). 183 * 184 * BUILDING TEST CASES 185 * ------------------- 186 * 187 * 188 * As an aid to building test cases, the stack buffer is initialised with 189 * some special values: 190 * 191 * [SP+13*4] Contains SP+120. This can be used to test instructions 192 * which load a value into SP. 193 * 194 * [SP+15*4] When testing branching instructions using TEST_BRANCH_{F,B}, 195 * this holds the target address of the branch, 'test_after2'. 196 * This can be used to test instructions which load a PC value 197 * from memory. 198 */ 199 200 #include <linux/kernel.h> 201 #include <linux/module.h> 202 #include <linux/slab.h> 203 #include <linux/sched/clock.h> 204 #include <linux/kprobes.h> 205 #include <linux/errno.h> 206 #include <linux/stddef.h> 207 #include <linux/bug.h> 208 #include <asm/opcodes.h> 209 210 #include "core.h" 211 #include "test-core.h" 212 #include "../decode-arm.h" 213 #include "../decode-thumb.h" 214 215 216 #define BENCHMARKING 1 217 218 219 /* 220 * Test basic API 221 */ 222 223 static bool test_regs_ok; 224 static int test_func_instance; 225 static int pre_handler_called; 226 static int post_handler_called; 227 static int kretprobe_handler_called; 228 static int tests_failed; 229 230 #define FUNC_ARG1 0x12345678 231 #define FUNC_ARG2 0xabcdef 232 233 234 #ifndef CONFIG_THUMB2_KERNEL 235 236 #define RET(reg) "mov pc, "#reg 237 238 long arm_func(long r0, long r1); 239 240 static void __used __naked __arm_kprobes_test_func(void) 241 { 242 __asm__ __volatile__ ( 243 ".arm \n\t" 244 ".type arm_func, %%function \n\t" 245 "arm_func: \n\t" 246 "adds r0, r0, r1 \n\t" 247 "mov pc, lr \n\t" 248 ".code "NORMAL_ISA /* Back to Thumb if necessary */ 249 : : : "r0", "r1", "cc" 250 ); 251 } 252 253 #else /* CONFIG_THUMB2_KERNEL */ 254 255 #define RET(reg) "bx "#reg 256 257 long thumb16_func(long r0, long r1); 258 long thumb32even_func(long r0, long r1); 259 long thumb32odd_func(long r0, long r1); 260 261 static void __used __naked __thumb_kprobes_test_funcs(void) 262 { 263 __asm__ __volatile__ ( 264 ".type thumb16_func, %%function \n\t" 265 "thumb16_func: \n\t" 266 "adds.n r0, r0, r1 \n\t" 267 "bx lr \n\t" 268 269 ".align \n\t" 270 ".type thumb32even_func, %%function \n\t" 271 "thumb32even_func: \n\t" 272 "adds.w r0, r0, r1 \n\t" 273 "bx lr \n\t" 274 275 ".align \n\t" 276 "nop.n \n\t" 277 ".type thumb32odd_func, %%function \n\t" 278 "thumb32odd_func: \n\t" 279 "adds.w r0, r0, r1 \n\t" 280 "bx lr \n\t" 281 282 : : : "r0", "r1", "cc" 283 ); 284 } 285 286 #endif /* CONFIG_THUMB2_KERNEL */ 287 288 289 static int call_test_func(long (*func)(long, long), bool check_test_regs) 290 { 291 long ret; 292 293 ++test_func_instance; 294 test_regs_ok = false; 295 296 ret = (*func)(FUNC_ARG1, FUNC_ARG2); 297 if (ret != FUNC_ARG1 + FUNC_ARG2) { 298 pr_err("FAIL: call_test_func: func returned %lx\n", ret); 299 return false; 300 } 301 302 if (check_test_regs && !test_regs_ok) { 303 pr_err("FAIL: test regs not OK\n"); 304 return false; 305 } 306 307 return true; 308 } 309 310 static int __kprobes pre_handler(struct kprobe *p, struct pt_regs *regs) 311 { 312 pre_handler_called = test_func_instance; 313 if (regs->ARM_r0 == FUNC_ARG1 && regs->ARM_r1 == FUNC_ARG2) 314 test_regs_ok = true; 315 return 0; 316 } 317 318 static void __kprobes post_handler(struct kprobe *p, struct pt_regs *regs, 319 unsigned long flags) 320 { 321 post_handler_called = test_func_instance; 322 if (regs->ARM_r0 != FUNC_ARG1 + FUNC_ARG2 || regs->ARM_r1 != FUNC_ARG2) 323 test_regs_ok = false; 324 } 325 326 static struct kprobe the_kprobe = { 327 .addr = 0, 328 .pre_handler = pre_handler, 329 .post_handler = post_handler 330 }; 331 332 static int test_kprobe(long (*func)(long, long)) 333 { 334 int ret; 335 336 the_kprobe.addr = (kprobe_opcode_t *)func; 337 ret = register_kprobe(&the_kprobe); 338 if (ret < 0) { 339 pr_err("FAIL: register_kprobe failed with %d\n", ret); 340 return ret; 341 } 342 343 ret = call_test_func(func, true); 344 345 unregister_kprobe(&the_kprobe); 346 the_kprobe.flags = 0; /* Clear disable flag to allow reuse */ 347 348 if (!ret) 349 return -EINVAL; 350 if (pre_handler_called != test_func_instance) { 351 pr_err("FAIL: kprobe pre_handler not called\n"); 352 return -EINVAL; 353 } 354 if (post_handler_called != test_func_instance) { 355 pr_err("FAIL: kprobe post_handler not called\n"); 356 return -EINVAL; 357 } 358 if (!call_test_func(func, false)) 359 return -EINVAL; 360 if (pre_handler_called == test_func_instance || 361 post_handler_called == test_func_instance) { 362 pr_err("FAIL: probe called after unregistering\n"); 363 return -EINVAL; 364 } 365 366 return 0; 367 } 368 369 static int __kprobes 370 kretprobe_handler(struct kretprobe_instance *ri, struct pt_regs *regs) 371 { 372 kretprobe_handler_called = test_func_instance; 373 if (regs_return_value(regs) == FUNC_ARG1 + FUNC_ARG2) 374 test_regs_ok = true; 375 return 0; 376 } 377 378 static struct kretprobe the_kretprobe = { 379 .handler = kretprobe_handler, 380 }; 381 382 static int test_kretprobe(long (*func)(long, long)) 383 { 384 int ret; 385 386 the_kretprobe.kp.addr = (kprobe_opcode_t *)func; 387 ret = register_kretprobe(&the_kretprobe); 388 if (ret < 0) { 389 pr_err("FAIL: register_kretprobe failed with %d\n", ret); 390 return ret; 391 } 392 393 ret = call_test_func(func, true); 394 395 unregister_kretprobe(&the_kretprobe); 396 the_kretprobe.kp.flags = 0; /* Clear disable flag to allow reuse */ 397 398 if (!ret) 399 return -EINVAL; 400 if (kretprobe_handler_called != test_func_instance) { 401 pr_err("FAIL: kretprobe handler not called\n"); 402 return -EINVAL; 403 } 404 if (!call_test_func(func, false)) 405 return -EINVAL; 406 if (kretprobe_handler_called == test_func_instance) { 407 pr_err("FAIL: kretprobe called after unregistering\n"); 408 return -EINVAL; 409 } 410 411 return 0; 412 } 413 414 static int run_api_tests(long (*func)(long, long)) 415 { 416 int ret; 417 418 pr_info(" kprobe\n"); 419 ret = test_kprobe(func); 420 if (ret < 0) 421 return ret; 422 423 pr_info(" kretprobe\n"); 424 ret = test_kretprobe(func); 425 if (ret < 0) 426 return ret; 427 428 return 0; 429 } 430 431 432 /* 433 * Benchmarking 434 */ 435 436 #if BENCHMARKING 437 438 static void __naked benchmark_nop(void) 439 { 440 __asm__ __volatile__ ( 441 "nop \n\t" 442 RET(lr)" \n\t" 443 ); 444 } 445 446 #ifdef CONFIG_THUMB2_KERNEL 447 #define wide ".w" 448 #else 449 #define wide 450 #endif 451 452 static void __naked benchmark_pushpop1(void) 453 { 454 __asm__ __volatile__ ( 455 "stmdb"wide" sp!, {r3-r11,lr} \n\t" 456 "ldmia"wide" sp!, {r3-r11,pc}" 457 ); 458 } 459 460 static void __naked benchmark_pushpop2(void) 461 { 462 __asm__ __volatile__ ( 463 "stmdb"wide" sp!, {r0-r8,lr} \n\t" 464 "ldmia"wide" sp!, {r0-r8,pc}" 465 ); 466 } 467 468 static void __naked benchmark_pushpop3(void) 469 { 470 __asm__ __volatile__ ( 471 "stmdb"wide" sp!, {r4,lr} \n\t" 472 "ldmia"wide" sp!, {r4,pc}" 473 ); 474 } 475 476 static void __naked benchmark_pushpop4(void) 477 { 478 __asm__ __volatile__ ( 479 "stmdb"wide" sp!, {r0,lr} \n\t" 480 "ldmia"wide" sp!, {r0,pc}" 481 ); 482 } 483 484 485 #ifdef CONFIG_THUMB2_KERNEL 486 487 static void __naked benchmark_pushpop_thumb(void) 488 { 489 __asm__ __volatile__ ( 490 "push.n {r0-r7,lr} \n\t" 491 "pop.n {r0-r7,pc}" 492 ); 493 } 494 495 #endif 496 497 static int __kprobes 498 benchmark_pre_handler(struct kprobe *p, struct pt_regs *regs) 499 { 500 return 0; 501 } 502 503 static int benchmark(void(*fn)(void)) 504 { 505 unsigned n, i, t, t0; 506 507 for (n = 1000; ; n *= 2) { 508 t0 = sched_clock(); 509 for (i = n; i > 0; --i) 510 fn(); 511 t = sched_clock() - t0; 512 if (t >= 250000000) 513 break; /* Stop once we took more than 0.25 seconds */ 514 } 515 return t / n; /* Time for one iteration in nanoseconds */ 516 }; 517 518 static int kprobe_benchmark(void(*fn)(void), unsigned offset) 519 { 520 struct kprobe k = { 521 .addr = (kprobe_opcode_t *)((uintptr_t)fn + offset), 522 .pre_handler = benchmark_pre_handler, 523 }; 524 525 int ret = register_kprobe(&k); 526 if (ret < 0) { 527 pr_err("FAIL: register_kprobe failed with %d\n", ret); 528 return ret; 529 } 530 531 ret = benchmark(fn); 532 533 unregister_kprobe(&k); 534 return ret; 535 }; 536 537 struct benchmarks { 538 void (*fn)(void); 539 unsigned offset; 540 const char *title; 541 }; 542 543 static int run_benchmarks(void) 544 { 545 int ret; 546 struct benchmarks list[] = { 547 {&benchmark_nop, 0, "nop"}, 548 /* 549 * benchmark_pushpop{1,3} will have the optimised 550 * instruction emulation, whilst benchmark_pushpop{2,4} will 551 * be the equivalent unoptimised instructions. 552 */ 553 {&benchmark_pushpop1, 0, "stmdb sp!, {r3-r11,lr}"}, 554 {&benchmark_pushpop1, 4, "ldmia sp!, {r3-r11,pc}"}, 555 {&benchmark_pushpop2, 0, "stmdb sp!, {r0-r8,lr}"}, 556 {&benchmark_pushpop2, 4, "ldmia sp!, {r0-r8,pc}"}, 557 {&benchmark_pushpop3, 0, "stmdb sp!, {r4,lr}"}, 558 {&benchmark_pushpop3, 4, "ldmia sp!, {r4,pc}"}, 559 {&benchmark_pushpop4, 0, "stmdb sp!, {r0,lr}"}, 560 {&benchmark_pushpop4, 4, "ldmia sp!, {r0,pc}"}, 561 #ifdef CONFIG_THUMB2_KERNEL 562 {&benchmark_pushpop_thumb, 0, "push.n {r0-r7,lr}"}, 563 {&benchmark_pushpop_thumb, 2, "pop.n {r0-r7,pc}"}, 564 #endif 565 {0} 566 }; 567 568 struct benchmarks *b; 569 for (b = list; b->fn; ++b) { 570 ret = kprobe_benchmark(b->fn, b->offset); 571 if (ret < 0) 572 return ret; 573 pr_info(" %dns for kprobe %s\n", ret, b->title); 574 } 575 576 pr_info("\n"); 577 return 0; 578 } 579 580 #endif /* BENCHMARKING */ 581 582 583 /* 584 * Decoding table self-consistency tests 585 */ 586 587 static const int decode_struct_sizes[NUM_DECODE_TYPES] = { 588 [DECODE_TYPE_TABLE] = sizeof(struct decode_table), 589 [DECODE_TYPE_CUSTOM] = sizeof(struct decode_custom), 590 [DECODE_TYPE_SIMULATE] = sizeof(struct decode_simulate), 591 [DECODE_TYPE_EMULATE] = sizeof(struct decode_emulate), 592 [DECODE_TYPE_OR] = sizeof(struct decode_or), 593 [DECODE_TYPE_REJECT] = sizeof(struct decode_reject) 594 }; 595 596 static int table_iter(const union decode_item *table, 597 int (*fn)(const struct decode_header *, void *), 598 void *args) 599 { 600 const struct decode_header *h = (struct decode_header *)table; 601 int result; 602 603 for (;;) { 604 enum decode_type type = h->type_regs.bits & DECODE_TYPE_MASK; 605 606 if (type == DECODE_TYPE_END) 607 return 0; 608 609 result = fn(h, args); 610 if (result) 611 return result; 612 613 h = (struct decode_header *) 614 ((uintptr_t)h + decode_struct_sizes[type]); 615 616 } 617 } 618 619 static int table_test_fail(const struct decode_header *h, const char* message) 620 { 621 622 pr_err("FAIL: kprobes test failure \"%s\" (mask %08x, value %08x)\n", 623 message, h->mask.bits, h->value.bits); 624 return -EINVAL; 625 } 626 627 struct table_test_args { 628 const union decode_item *root_table; 629 u32 parent_mask; 630 u32 parent_value; 631 }; 632 633 static int table_test_fn(const struct decode_header *h, void *args) 634 { 635 struct table_test_args *a = (struct table_test_args *)args; 636 enum decode_type type = h->type_regs.bits & DECODE_TYPE_MASK; 637 638 if (h->value.bits & ~h->mask.bits) 639 return table_test_fail(h, "Match value has bits not in mask"); 640 641 if ((h->mask.bits & a->parent_mask) != a->parent_mask) 642 return table_test_fail(h, "Mask has bits not in parent mask"); 643 644 if ((h->value.bits ^ a->parent_value) & a->parent_mask) 645 return table_test_fail(h, "Value is inconsistent with parent"); 646 647 if (type == DECODE_TYPE_TABLE) { 648 struct decode_table *d = (struct decode_table *)h; 649 struct table_test_args args2 = *a; 650 args2.parent_mask = h->mask.bits; 651 args2.parent_value = h->value.bits; 652 return table_iter(d->table.table, table_test_fn, &args2); 653 } 654 655 return 0; 656 } 657 658 static int table_test(const union decode_item *table) 659 { 660 struct table_test_args args = { 661 .root_table = table, 662 .parent_mask = 0, 663 .parent_value = 0 664 }; 665 return table_iter(args.root_table, table_test_fn, &args); 666 } 667 668 669 /* 670 * Decoding table test coverage analysis 671 * 672 * coverage_start() builds a coverage_table which contains a list of 673 * coverage_entry's to match each entry in the specified kprobes instruction 674 * decoding table. 675 * 676 * When test cases are run, coverage_add() is called to process each case. 677 * This looks up the corresponding entry in the coverage_table and sets it as 678 * being matched, as well as clearing the regs flag appropriate for the test. 679 * 680 * After all test cases have been run, coverage_end() is called to check that 681 * all entries in coverage_table have been matched and that all regs flags are 682 * cleared. I.e. that all possible combinations of instructions described by 683 * the kprobes decoding tables have had a test case executed for them. 684 */ 685 686 bool coverage_fail; 687 688 #define MAX_COVERAGE_ENTRIES 256 689 690 struct coverage_entry { 691 const struct decode_header *header; 692 unsigned regs; 693 unsigned nesting; 694 char matched; 695 }; 696 697 struct coverage_table { 698 struct coverage_entry *base; 699 unsigned num_entries; 700 unsigned nesting; 701 }; 702 703 struct coverage_table coverage; 704 705 #define COVERAGE_ANY_REG (1<<0) 706 #define COVERAGE_SP (1<<1) 707 #define COVERAGE_PC (1<<2) 708 #define COVERAGE_PCWB (1<<3) 709 710 static const char coverage_register_lookup[16] = { 711 [REG_TYPE_ANY] = COVERAGE_ANY_REG | COVERAGE_SP | COVERAGE_PC, 712 [REG_TYPE_SAMEAS16] = COVERAGE_ANY_REG, 713 [REG_TYPE_SP] = COVERAGE_SP, 714 [REG_TYPE_PC] = COVERAGE_PC, 715 [REG_TYPE_NOSP] = COVERAGE_ANY_REG | COVERAGE_SP, 716 [REG_TYPE_NOSPPC] = COVERAGE_ANY_REG | COVERAGE_SP | COVERAGE_PC, 717 [REG_TYPE_NOPC] = COVERAGE_ANY_REG | COVERAGE_PC, 718 [REG_TYPE_NOPCWB] = COVERAGE_ANY_REG | COVERAGE_PC | COVERAGE_PCWB, 719 [REG_TYPE_NOPCX] = COVERAGE_ANY_REG, 720 [REG_TYPE_NOSPPCX] = COVERAGE_ANY_REG | COVERAGE_SP, 721 }; 722 723 static unsigned coverage_start_registers(const struct decode_header *h) 724 { 725 unsigned regs = 0; 726 int i; 727 for (i = 0; i < 20; i += 4) { 728 int r = (h->type_regs.bits >> (DECODE_TYPE_BITS + i)) & 0xf; 729 regs |= coverage_register_lookup[r] << i; 730 } 731 return regs; 732 } 733 734 static int coverage_start_fn(const struct decode_header *h, void *args) 735 { 736 struct coverage_table *coverage = (struct coverage_table *)args; 737 enum decode_type type = h->type_regs.bits & DECODE_TYPE_MASK; 738 struct coverage_entry *entry = coverage->base + coverage->num_entries; 739 740 if (coverage->num_entries == MAX_COVERAGE_ENTRIES - 1) { 741 pr_err("FAIL: Out of space for test coverage data"); 742 return -ENOMEM; 743 } 744 745 ++coverage->num_entries; 746 747 entry->header = h; 748 entry->regs = coverage_start_registers(h); 749 entry->nesting = coverage->nesting; 750 entry->matched = false; 751 752 if (type == DECODE_TYPE_TABLE) { 753 struct decode_table *d = (struct decode_table *)h; 754 int ret; 755 ++coverage->nesting; 756 ret = table_iter(d->table.table, coverage_start_fn, coverage); 757 --coverage->nesting; 758 return ret; 759 } 760 761 return 0; 762 } 763 764 static int coverage_start(const union decode_item *table) 765 { 766 coverage.base = kmalloc_objs(struct coverage_entry, 767 MAX_COVERAGE_ENTRIES); 768 coverage.num_entries = 0; 769 coverage.nesting = 0; 770 return table_iter(table, coverage_start_fn, &coverage); 771 } 772 773 static void 774 coverage_add_registers(struct coverage_entry *entry, kprobe_opcode_t insn) 775 { 776 int regs = entry->header->type_regs.bits >> DECODE_TYPE_BITS; 777 int i; 778 for (i = 0; i < 20; i += 4) { 779 enum decode_reg_type reg_type = (regs >> i) & 0xf; 780 int reg = (insn >> i) & 0xf; 781 int flag; 782 783 if (!reg_type) 784 continue; 785 786 if (reg == 13) 787 flag = COVERAGE_SP; 788 else if (reg == 15) 789 flag = COVERAGE_PC; 790 else 791 flag = COVERAGE_ANY_REG; 792 entry->regs &= ~(flag << i); 793 794 switch (reg_type) { 795 796 case REG_TYPE_NONE: 797 case REG_TYPE_ANY: 798 case REG_TYPE_SAMEAS16: 799 break; 800 801 case REG_TYPE_SP: 802 if (reg != 13) 803 return; 804 break; 805 806 case REG_TYPE_PC: 807 if (reg != 15) 808 return; 809 break; 810 811 case REG_TYPE_NOSP: 812 if (reg == 13) 813 return; 814 break; 815 816 case REG_TYPE_NOSPPC: 817 case REG_TYPE_NOSPPCX: 818 if (reg == 13 || reg == 15) 819 return; 820 break; 821 822 case REG_TYPE_NOPCWB: 823 if (!is_writeback(insn)) 824 break; 825 if (reg == 15) { 826 entry->regs &= ~(COVERAGE_PCWB << i); 827 return; 828 } 829 break; 830 831 case REG_TYPE_NOPC: 832 case REG_TYPE_NOPCX: 833 if (reg == 15) 834 return; 835 break; 836 } 837 838 } 839 } 840 841 static void coverage_add(kprobe_opcode_t insn) 842 { 843 struct coverage_entry *entry = coverage.base; 844 struct coverage_entry *end = coverage.base + coverage.num_entries; 845 bool matched = false; 846 unsigned nesting = 0; 847 848 for (; entry < end; ++entry) { 849 const struct decode_header *h = entry->header; 850 enum decode_type type = h->type_regs.bits & DECODE_TYPE_MASK; 851 852 if (entry->nesting > nesting) 853 continue; /* Skip sub-table we didn't match */ 854 855 if (entry->nesting < nesting) 856 break; /* End of sub-table we were scanning */ 857 858 if (!matched) { 859 if ((insn & h->mask.bits) != h->value.bits) 860 continue; 861 entry->matched = true; 862 } 863 864 switch (type) { 865 866 case DECODE_TYPE_TABLE: 867 ++nesting; 868 break; 869 870 case DECODE_TYPE_CUSTOM: 871 case DECODE_TYPE_SIMULATE: 872 case DECODE_TYPE_EMULATE: 873 coverage_add_registers(entry, insn); 874 return; 875 876 case DECODE_TYPE_OR: 877 matched = true; 878 break; 879 880 case DECODE_TYPE_REJECT: 881 default: 882 return; 883 } 884 885 } 886 } 887 888 static void coverage_end(void) 889 { 890 struct coverage_entry *entry = coverage.base; 891 struct coverage_entry *end = coverage.base + coverage.num_entries; 892 893 for (; entry < end; ++entry) { 894 u32 mask = entry->header->mask.bits; 895 u32 value = entry->header->value.bits; 896 897 if (entry->regs) { 898 pr_err("FAIL: Register test coverage missing for %08x %08x (%05x)\n", 899 mask, value, entry->regs); 900 coverage_fail = true; 901 } 902 if (!entry->matched) { 903 pr_err("FAIL: Test coverage entry missing for %08x %08x\n", 904 mask, value); 905 coverage_fail = true; 906 } 907 } 908 909 kfree(coverage.base); 910 } 911 912 913 /* 914 * Framework for instruction set test cases 915 */ 916 917 void __naked __kprobes_test_case_start(void) 918 { 919 __asm__ __volatile__ ( 920 "mov r2, sp \n\t" 921 "bic r3, r2, #7 \n\t" 922 "mov sp, r3 \n\t" 923 "stmdb sp!, {r2-r11} \n\t" 924 "sub sp, sp, #"__stringify(TEST_MEMORY_SIZE)"\n\t" 925 "bic r0, lr, #1 @ r0 = inline data \n\t" 926 "mov r1, sp \n\t" 927 "bl kprobes_test_case_start \n\t" 928 RET(r0)" \n\t" 929 ); 930 } 931 932 #ifndef CONFIG_THUMB2_KERNEL 933 934 void __naked __kprobes_test_case_end_32(void) 935 { 936 __asm__ __volatile__ ( 937 "mov r4, lr \n\t" 938 "bl kprobes_test_case_end \n\t" 939 "cmp r0, #0 \n\t" 940 "movne pc, r0 \n\t" 941 "mov r0, r4 \n\t" 942 "add sp, sp, #"__stringify(TEST_MEMORY_SIZE)"\n\t" 943 "ldmia sp!, {r2-r11} \n\t" 944 "mov sp, r2 \n\t" 945 "mov pc, r0 \n\t" 946 ); 947 } 948 949 #else /* CONFIG_THUMB2_KERNEL */ 950 951 void __naked __kprobes_test_case_end_16(void) 952 { 953 __asm__ __volatile__ ( 954 "mov r4, lr \n\t" 955 "bl kprobes_test_case_end \n\t" 956 "cmp r0, #0 \n\t" 957 "bxne r0 \n\t" 958 "mov r0, r4 \n\t" 959 "add sp, sp, #"__stringify(TEST_MEMORY_SIZE)"\n\t" 960 "ldmia sp!, {r2-r11} \n\t" 961 "mov sp, r2 \n\t" 962 "bx r0 \n\t" 963 ); 964 } 965 966 void __naked __kprobes_test_case_end_32(void) 967 { 968 __asm__ __volatile__ ( 969 ".arm \n\t" 970 "orr lr, lr, #1 @ will return to Thumb code \n\t" 971 "ldr pc, 1f \n\t" 972 "1: \n\t" 973 ".word __kprobes_test_case_end_16 \n\t" 974 ); 975 } 976 977 #endif 978 979 980 int kprobe_test_flags; 981 int kprobe_test_cc_position; 982 983 static int test_try_count; 984 static int test_pass_count; 985 static int test_fail_count; 986 987 static struct pt_regs initial_regs; 988 static struct pt_regs expected_regs; 989 static struct pt_regs result_regs; 990 991 static u32 expected_memory[TEST_MEMORY_SIZE/sizeof(u32)]; 992 993 static const char *current_title; 994 static struct test_arg *current_args; 995 static u32 *current_stack; 996 static uintptr_t current_branch_target; 997 998 static uintptr_t current_code_start; 999 static kprobe_opcode_t current_instruction; 1000 1001 1002 #define TEST_CASE_PASSED -1 1003 #define TEST_CASE_FAILED -2 1004 1005 static int test_case_run_count; 1006 static bool test_case_is_thumb; 1007 static int test_instance; 1008 1009 static unsigned long test_check_cc(int cc, unsigned long cpsr) 1010 { 1011 int ret = arm_check_condition(cc << 28, cpsr); 1012 1013 return (ret != ARM_OPCODE_CONDTEST_FAIL); 1014 } 1015 1016 static int is_last_scenario; 1017 static int probe_should_run; /* 0 = no, 1 = yes, -1 = unknown */ 1018 static int memory_needs_checking; 1019 1020 static unsigned long test_context_cpsr(int scenario) 1021 { 1022 unsigned long cpsr; 1023 1024 probe_should_run = 1; 1025 1026 /* Default case is that we cycle through 16 combinations of flags */ 1027 cpsr = (scenario & 0xf) << 28; /* N,Z,C,V flags */ 1028 cpsr |= (scenario & 0xf) << 16; /* GE flags */ 1029 cpsr |= (scenario & 0x1) << 27; /* Toggle Q flag */ 1030 1031 if (!test_case_is_thumb) { 1032 /* Testing ARM code */ 1033 int cc = current_instruction >> 28; 1034 1035 probe_should_run = test_check_cc(cc, cpsr) != 0; 1036 if (scenario == 15) 1037 is_last_scenario = true; 1038 1039 } else if (kprobe_test_flags & TEST_FLAG_NO_ITBLOCK) { 1040 /* Testing Thumb code without setting ITSTATE */ 1041 if (kprobe_test_cc_position) { 1042 int cc = (current_instruction >> kprobe_test_cc_position) & 0xf; 1043 probe_should_run = test_check_cc(cc, cpsr) != 0; 1044 } 1045 1046 if (scenario == 15) 1047 is_last_scenario = true; 1048 1049 } else if (kprobe_test_flags & TEST_FLAG_FULL_ITBLOCK) { 1050 /* Testing Thumb code with all combinations of ITSTATE */ 1051 unsigned x = (scenario >> 4); 1052 unsigned cond_base = x % 7; /* ITSTATE<7:5> */ 1053 unsigned mask = x / 7 + 2; /* ITSTATE<4:0>, bits reversed */ 1054 1055 if (mask > 0x1f) { 1056 /* Finish by testing state from instruction 'itt al' */ 1057 cond_base = 7; 1058 mask = 0x4; 1059 if ((scenario & 0xf) == 0xf) 1060 is_last_scenario = true; 1061 } 1062 1063 cpsr |= cond_base << 13; /* ITSTATE<7:5> */ 1064 cpsr |= (mask & 0x1) << 12; /* ITSTATE<4> */ 1065 cpsr |= (mask & 0x2) << 10; /* ITSTATE<3> */ 1066 cpsr |= (mask & 0x4) << 8; /* ITSTATE<2> */ 1067 cpsr |= (mask & 0x8) << 23; /* ITSTATE<1> */ 1068 cpsr |= (mask & 0x10) << 21; /* ITSTATE<0> */ 1069 1070 probe_should_run = test_check_cc((cpsr >> 12) & 0xf, cpsr) != 0; 1071 1072 } else { 1073 /* Testing Thumb code with several combinations of ITSTATE */ 1074 switch (scenario) { 1075 case 16: /* Clear NZCV flags and 'it eq' state (false as Z=0) */ 1076 cpsr = 0x00000800; 1077 probe_should_run = 0; 1078 break; 1079 case 17: /* Set NZCV flags and 'it vc' state (false as V=1) */ 1080 cpsr = 0xf0007800; 1081 probe_should_run = 0; 1082 break; 1083 case 18: /* Clear NZCV flags and 'it ls' state (true as C=0) */ 1084 cpsr = 0x00009800; 1085 break; 1086 case 19: /* Set NZCV flags and 'it cs' state (true as C=1) */ 1087 cpsr = 0xf0002800; 1088 is_last_scenario = true; 1089 break; 1090 } 1091 } 1092 1093 return cpsr; 1094 } 1095 1096 static void setup_test_context(struct pt_regs *regs) 1097 { 1098 int scenario = test_case_run_count>>1; 1099 unsigned long val; 1100 struct test_arg *args; 1101 int i; 1102 1103 is_last_scenario = false; 1104 memory_needs_checking = false; 1105 1106 /* Initialise test memory on stack */ 1107 val = (scenario & 1) ? VALM : ~VALM; 1108 for (i = 0; i < TEST_MEMORY_SIZE / sizeof(current_stack[0]); ++i) 1109 current_stack[i] = val + (i << 8); 1110 /* Put target of branch on stack for tests which load PC from memory */ 1111 if (current_branch_target) 1112 current_stack[15] = current_branch_target; 1113 /* Put a value for SP on stack for tests which load SP from memory */ 1114 current_stack[13] = (u32)current_stack + 120; 1115 1116 /* Initialise register values to their default state */ 1117 val = (scenario & 2) ? VALR : ~VALR; 1118 for (i = 0; i < 13; ++i) 1119 regs->uregs[i] = val ^ (i << 8); 1120 regs->ARM_lr = val ^ (14 << 8); 1121 regs->ARM_cpsr &= ~(APSR_MASK | PSR_IT_MASK); 1122 regs->ARM_cpsr |= test_context_cpsr(scenario); 1123 1124 /* Perform testcase specific register setup */ 1125 args = current_args; 1126 for (; args[0].type != ARG_TYPE_END; ++args) 1127 switch (args[0].type) { 1128 case ARG_TYPE_REG: { 1129 struct test_arg_regptr *arg = 1130 (struct test_arg_regptr *)args; 1131 regs->uregs[arg->reg] = arg->val; 1132 break; 1133 } 1134 case ARG_TYPE_PTR: { 1135 struct test_arg_regptr *arg = 1136 (struct test_arg_regptr *)args; 1137 regs->uregs[arg->reg] = 1138 (unsigned long)current_stack + arg->val; 1139 memory_needs_checking = true; 1140 /* 1141 * Test memory at an address below SP is in danger of 1142 * being altered by an interrupt occurring and pushing 1143 * data onto the stack. Disable interrupts to stop this. 1144 */ 1145 if (arg->reg == 13) 1146 regs->ARM_cpsr |= PSR_I_BIT; 1147 break; 1148 } 1149 case ARG_TYPE_MEM: { 1150 struct test_arg_mem *arg = (struct test_arg_mem *)args; 1151 current_stack[arg->index] = arg->val; 1152 break; 1153 } 1154 default: 1155 break; 1156 } 1157 } 1158 1159 struct test_probe { 1160 struct kprobe kprobe; 1161 bool registered; 1162 int hit; 1163 }; 1164 1165 static void unregister_test_probe(struct test_probe *probe) 1166 { 1167 if (probe->registered) { 1168 unregister_kprobe(&probe->kprobe); 1169 probe->kprobe.flags = 0; /* Clear disable flag to allow reuse */ 1170 } 1171 probe->registered = false; 1172 } 1173 1174 static int register_test_probe(struct test_probe *probe) 1175 { 1176 int ret; 1177 1178 if (probe->registered) 1179 BUG(); 1180 1181 ret = register_kprobe(&probe->kprobe); 1182 if (ret >= 0) { 1183 probe->registered = true; 1184 probe->hit = -1; 1185 } 1186 return ret; 1187 } 1188 1189 static int __kprobes 1190 test_before_pre_handler(struct kprobe *p, struct pt_regs *regs) 1191 { 1192 container_of(p, struct test_probe, kprobe)->hit = test_instance; 1193 return 0; 1194 } 1195 1196 static void __kprobes 1197 test_before_post_handler(struct kprobe *p, struct pt_regs *regs, 1198 unsigned long flags) 1199 { 1200 setup_test_context(regs); 1201 initial_regs = *regs; 1202 initial_regs.ARM_cpsr &= ~PSR_IGNORE_BITS; 1203 } 1204 1205 static int __kprobes 1206 test_case_pre_handler(struct kprobe *p, struct pt_regs *regs) 1207 { 1208 container_of(p, struct test_probe, kprobe)->hit = test_instance; 1209 return 0; 1210 } 1211 1212 static int __kprobes 1213 test_after_pre_handler(struct kprobe *p, struct pt_regs *regs) 1214 { 1215 struct test_arg *args; 1216 1217 if (container_of(p, struct test_probe, kprobe)->hit == test_instance) 1218 return 0; /* Already run for this test instance */ 1219 1220 result_regs = *regs; 1221 1222 /* Mask out results which are indeterminate */ 1223 result_regs.ARM_cpsr &= ~PSR_IGNORE_BITS; 1224 for (args = current_args; args[0].type != ARG_TYPE_END; ++args) 1225 if (args[0].type == ARG_TYPE_REG_MASKED) { 1226 struct test_arg_regptr *arg = 1227 (struct test_arg_regptr *)args; 1228 result_regs.uregs[arg->reg] &= arg->val; 1229 } 1230 1231 /* Undo any changes done to SP by the test case */ 1232 regs->ARM_sp = (unsigned long)current_stack; 1233 /* Enable interrupts in case setup_test_context disabled them */ 1234 regs->ARM_cpsr &= ~PSR_I_BIT; 1235 1236 container_of(p, struct test_probe, kprobe)->hit = test_instance; 1237 return 0; 1238 } 1239 1240 static struct test_probe test_before_probe = { 1241 .kprobe.pre_handler = test_before_pre_handler, 1242 .kprobe.post_handler = test_before_post_handler, 1243 }; 1244 1245 static struct test_probe test_case_probe = { 1246 .kprobe.pre_handler = test_case_pre_handler, 1247 }; 1248 1249 static struct test_probe test_after_probe = { 1250 .kprobe.pre_handler = test_after_pre_handler, 1251 }; 1252 1253 static struct test_probe test_after2_probe = { 1254 .kprobe.pre_handler = test_after_pre_handler, 1255 }; 1256 1257 static void test_case_cleanup(void) 1258 { 1259 unregister_test_probe(&test_before_probe); 1260 unregister_test_probe(&test_case_probe); 1261 unregister_test_probe(&test_after_probe); 1262 unregister_test_probe(&test_after2_probe); 1263 } 1264 1265 static void print_registers(struct pt_regs *regs) 1266 { 1267 pr_err("r0 %08lx | r1 %08lx | r2 %08lx | r3 %08lx\n", 1268 regs->ARM_r0, regs->ARM_r1, regs->ARM_r2, regs->ARM_r3); 1269 pr_err("r4 %08lx | r5 %08lx | r6 %08lx | r7 %08lx\n", 1270 regs->ARM_r4, regs->ARM_r5, regs->ARM_r6, regs->ARM_r7); 1271 pr_err("r8 %08lx | r9 %08lx | r10 %08lx | r11 %08lx\n", 1272 regs->ARM_r8, regs->ARM_r9, regs->ARM_r10, regs->ARM_fp); 1273 pr_err("r12 %08lx | sp %08lx | lr %08lx | pc %08lx\n", 1274 regs->ARM_ip, regs->ARM_sp, regs->ARM_lr, regs->ARM_pc); 1275 pr_err("cpsr %08lx\n", regs->ARM_cpsr); 1276 } 1277 1278 static void print_memory(u32 *mem, size_t size) 1279 { 1280 int i; 1281 for (i = 0; i < size / sizeof(u32); i += 4) 1282 pr_err("%08x %08x %08x %08x\n", mem[i], mem[i+1], 1283 mem[i+2], mem[i+3]); 1284 } 1285 1286 static size_t expected_memory_size(u32 *sp) 1287 { 1288 size_t size = sizeof(expected_memory); 1289 int offset = (uintptr_t)sp - (uintptr_t)current_stack; 1290 if (offset > 0) 1291 size -= offset; 1292 return size; 1293 } 1294 1295 static void test_case_failed(const char *message) 1296 { 1297 test_case_cleanup(); 1298 1299 pr_err("FAIL: %s\n", message); 1300 pr_err("FAIL: Test %s\n", current_title); 1301 pr_err("FAIL: Scenario %d\n", test_case_run_count >> 1); 1302 } 1303 1304 static unsigned long next_instruction(unsigned long pc) 1305 { 1306 #ifdef CONFIG_THUMB2_KERNEL 1307 if ((pc & 1) && 1308 !is_wide_instruction(__mem_to_opcode_thumb16(*(u16 *)(pc - 1)))) 1309 return pc + 2; 1310 else 1311 #endif 1312 return pc + 4; 1313 } 1314 1315 static uintptr_t __used kprobes_test_case_start(const char **title, void *stack) 1316 { 1317 struct test_arg *args; 1318 struct test_arg_end *end_arg; 1319 unsigned long test_code; 1320 1321 current_title = *title++; 1322 args = (struct test_arg *)title; 1323 current_args = args; 1324 current_stack = stack; 1325 1326 ++test_try_count; 1327 1328 while (args->type != ARG_TYPE_END) 1329 ++args; 1330 end_arg = (struct test_arg_end *)args; 1331 1332 test_code = (unsigned long)(args + 1); /* Code starts after args */ 1333 1334 test_case_is_thumb = end_arg->flags & ARG_FLAG_THUMB; 1335 if (test_case_is_thumb) 1336 test_code |= 1; 1337 1338 current_code_start = test_code; 1339 1340 current_branch_target = 0; 1341 if (end_arg->branch_offset != end_arg->end_offset) 1342 current_branch_target = test_code + end_arg->branch_offset; 1343 1344 test_code += end_arg->code_offset; 1345 test_before_probe.kprobe.addr = (kprobe_opcode_t *)test_code; 1346 1347 test_code = next_instruction(test_code); 1348 test_case_probe.kprobe.addr = (kprobe_opcode_t *)test_code; 1349 1350 if (test_case_is_thumb) { 1351 u16 *p = (u16 *)(test_code & ~1); 1352 current_instruction = __mem_to_opcode_thumb16(p[0]); 1353 if (is_wide_instruction(current_instruction)) { 1354 u16 instr2 = __mem_to_opcode_thumb16(p[1]); 1355 current_instruction = __opcode_thumb32_compose(current_instruction, instr2); 1356 } 1357 } else { 1358 current_instruction = __mem_to_opcode_arm(*(u32 *)test_code); 1359 } 1360 1361 if (current_title[0] == '.') 1362 verbose("%s\n", current_title); 1363 else 1364 verbose("%s\t@ %0*x\n", current_title, 1365 test_case_is_thumb ? 4 : 8, 1366 current_instruction); 1367 1368 test_code = next_instruction(test_code); 1369 test_after_probe.kprobe.addr = (kprobe_opcode_t *)test_code; 1370 1371 if (kprobe_test_flags & TEST_FLAG_NARROW_INSTR) { 1372 if (!test_case_is_thumb || 1373 is_wide_instruction(current_instruction)) { 1374 test_case_failed("expected 16-bit instruction"); 1375 goto fail; 1376 } 1377 } else { 1378 if (test_case_is_thumb && 1379 !is_wide_instruction(current_instruction)) { 1380 test_case_failed("expected 32-bit instruction"); 1381 goto fail; 1382 } 1383 } 1384 1385 coverage_add(current_instruction); 1386 1387 if (end_arg->flags & ARG_FLAG_UNSUPPORTED) { 1388 if (register_test_probe(&test_case_probe) < 0) 1389 goto pass; 1390 test_case_failed("registered probe for unsupported instruction"); 1391 goto fail; 1392 } 1393 1394 if (end_arg->flags & ARG_FLAG_SUPPORTED) { 1395 if (register_test_probe(&test_case_probe) >= 0) 1396 goto pass; 1397 test_case_failed("couldn't register probe for supported instruction"); 1398 goto fail; 1399 } 1400 1401 if (register_test_probe(&test_before_probe) < 0) { 1402 test_case_failed("register test_before_probe failed"); 1403 goto fail; 1404 } 1405 if (register_test_probe(&test_after_probe) < 0) { 1406 test_case_failed("register test_after_probe failed"); 1407 goto fail; 1408 } 1409 if (current_branch_target) { 1410 test_after2_probe.kprobe.addr = 1411 (kprobe_opcode_t *)current_branch_target; 1412 if (register_test_probe(&test_after2_probe) < 0) { 1413 test_case_failed("register test_after2_probe failed"); 1414 goto fail; 1415 } 1416 } 1417 1418 /* Start first run of test case */ 1419 test_case_run_count = 0; 1420 ++test_instance; 1421 return current_code_start; 1422 pass: 1423 test_case_run_count = TEST_CASE_PASSED; 1424 return (uintptr_t)test_after_probe.kprobe.addr; 1425 fail: 1426 test_case_run_count = TEST_CASE_FAILED; 1427 return (uintptr_t)test_after_probe.kprobe.addr; 1428 } 1429 1430 static bool check_test_results(void) 1431 { 1432 size_t mem_size = 0; 1433 u32 *mem = 0; 1434 1435 if (memcmp(&expected_regs, &result_regs, sizeof(expected_regs))) { 1436 test_case_failed("registers differ"); 1437 goto fail; 1438 } 1439 1440 if (memory_needs_checking) { 1441 mem = (u32 *)result_regs.ARM_sp; 1442 mem_size = expected_memory_size(mem); 1443 if (memcmp(expected_memory, mem, mem_size)) { 1444 test_case_failed("test memory differs"); 1445 goto fail; 1446 } 1447 } 1448 1449 return true; 1450 1451 fail: 1452 pr_err("initial_regs:\n"); 1453 print_registers(&initial_regs); 1454 pr_err("expected_regs:\n"); 1455 print_registers(&expected_regs); 1456 pr_err("result_regs:\n"); 1457 print_registers(&result_regs); 1458 1459 if (mem) { 1460 pr_err("expected_memory:\n"); 1461 print_memory(expected_memory, mem_size); 1462 pr_err("result_memory:\n"); 1463 print_memory(mem, mem_size); 1464 } 1465 1466 return false; 1467 } 1468 1469 static uintptr_t __used kprobes_test_case_end(void) 1470 { 1471 if (test_case_run_count < 0) { 1472 if (test_case_run_count == TEST_CASE_PASSED) 1473 /* kprobes_test_case_start did all the needed testing */ 1474 goto pass; 1475 else 1476 /* kprobes_test_case_start failed */ 1477 goto fail; 1478 } 1479 1480 if (test_before_probe.hit != test_instance) { 1481 test_case_failed("test_before_handler not run"); 1482 goto fail; 1483 } 1484 1485 if (test_after_probe.hit != test_instance && 1486 test_after2_probe.hit != test_instance) { 1487 test_case_failed("test_after_handler not run"); 1488 goto fail; 1489 } 1490 1491 /* 1492 * Even numbered test runs ran without a probe on the test case so 1493 * we can gather reference results. The subsequent odd numbered run 1494 * will have the probe inserted. 1495 */ 1496 if ((test_case_run_count & 1) == 0) { 1497 /* Save results from run without probe */ 1498 u32 *mem = (u32 *)result_regs.ARM_sp; 1499 expected_regs = result_regs; 1500 memcpy(expected_memory, mem, expected_memory_size(mem)); 1501 1502 /* Insert probe onto test case instruction */ 1503 if (register_test_probe(&test_case_probe) < 0) { 1504 test_case_failed("register test_case_probe failed"); 1505 goto fail; 1506 } 1507 } else { 1508 /* Check probe ran as expected */ 1509 if (probe_should_run == 1) { 1510 if (test_case_probe.hit != test_instance) { 1511 test_case_failed("test_case_handler not run"); 1512 goto fail; 1513 } 1514 } else if (probe_should_run == 0) { 1515 if (test_case_probe.hit == test_instance) { 1516 test_case_failed("test_case_handler ran"); 1517 goto fail; 1518 } 1519 } 1520 1521 /* Remove probe for any subsequent reference run */ 1522 unregister_test_probe(&test_case_probe); 1523 1524 if (!check_test_results()) 1525 goto fail; 1526 1527 if (is_last_scenario) 1528 goto pass; 1529 } 1530 1531 /* Do next test run */ 1532 ++test_case_run_count; 1533 ++test_instance; 1534 return current_code_start; 1535 fail: 1536 ++test_fail_count; 1537 goto end; 1538 pass: 1539 ++test_pass_count; 1540 end: 1541 test_case_cleanup(); 1542 return 0; 1543 } 1544 1545 1546 /* 1547 * Top level test functions 1548 */ 1549 1550 static int run_test_cases(void (*tests)(void), const union decode_item *table) 1551 { 1552 int ret; 1553 1554 pr_info(" Check decoding tables\n"); 1555 ret = table_test(table); 1556 if (ret) 1557 return ret; 1558 1559 pr_info(" Run test cases\n"); 1560 ret = coverage_start(table); 1561 if (ret) 1562 return ret; 1563 1564 tests(); 1565 1566 coverage_end(); 1567 return 0; 1568 } 1569 1570 1571 static int __init run_all_tests(void) 1572 { 1573 int ret = 0; 1574 1575 pr_info("Beginning kprobe tests...\n"); 1576 1577 #ifndef CONFIG_THUMB2_KERNEL 1578 1579 pr_info("Probe ARM code\n"); 1580 ret = run_api_tests(arm_func); 1581 if (ret) 1582 goto out; 1583 1584 pr_info("ARM instruction simulation\n"); 1585 ret = run_test_cases(kprobe_arm_test_cases, probes_decode_arm_table); 1586 if (ret) 1587 goto out; 1588 1589 #else /* CONFIG_THUMB2_KERNEL */ 1590 1591 pr_info("Probe 16-bit Thumb code\n"); 1592 ret = run_api_tests(thumb16_func); 1593 if (ret) 1594 goto out; 1595 1596 pr_info("Probe 32-bit Thumb code, even halfword\n"); 1597 ret = run_api_tests(thumb32even_func); 1598 if (ret) 1599 goto out; 1600 1601 pr_info("Probe 32-bit Thumb code, odd halfword\n"); 1602 ret = run_api_tests(thumb32odd_func); 1603 if (ret) 1604 goto out; 1605 1606 pr_info("16-bit Thumb instruction simulation\n"); 1607 ret = run_test_cases(kprobe_thumb16_test_cases, 1608 probes_decode_thumb16_table); 1609 if (ret) 1610 goto out; 1611 1612 pr_info("32-bit Thumb instruction simulation\n"); 1613 ret = run_test_cases(kprobe_thumb32_test_cases, 1614 probes_decode_thumb32_table); 1615 if (ret) 1616 goto out; 1617 #endif 1618 1619 pr_info("Total instruction simulation tests=%d, pass=%d fail=%d\n", 1620 test_try_count, test_pass_count, test_fail_count); 1621 if (test_fail_count) { 1622 ret = -EINVAL; 1623 goto out; 1624 } 1625 1626 #if BENCHMARKING 1627 pr_info("Benchmarks\n"); 1628 ret = run_benchmarks(); 1629 if (ret) 1630 goto out; 1631 #endif 1632 1633 #if __LINUX_ARM_ARCH__ >= 7 1634 /* We are able to run all test cases so coverage should be complete */ 1635 if (coverage_fail) { 1636 pr_err("FAIL: Test coverage checks failed\n"); 1637 ret = -EINVAL; 1638 goto out; 1639 } 1640 #endif 1641 1642 out: 1643 if (ret == 0) 1644 ret = tests_failed; 1645 if (ret == 0) 1646 pr_info("Finished kprobe tests OK\n"); 1647 else 1648 pr_err("kprobe tests failed\n"); 1649 1650 return ret; 1651 } 1652 1653 1654 /* 1655 * Module setup 1656 */ 1657 1658 #ifdef MODULE 1659 1660 static void __exit kprobe_test_exit(void) 1661 { 1662 } 1663 1664 module_init(run_all_tests) 1665 module_exit(kprobe_test_exit) 1666 MODULE_LICENSE("GPL"); 1667 1668 #else /* !MODULE */ 1669 1670 late_initcall(run_all_tests); 1671 1672 #endif 1673