1 /*-
2 * Copyright (c) 2017 Andrew Turner
3 * All rights reserved.
4 *
5 * This software was developed by SRI International and the University of
6 * Cambridge Computer Laboratory under DARPA/AFRL contract FA8750-10-C-0237
7 * ("CTSRD"), as part of the DARPA CRASH research programme.
8 *
9 * Redistribution and use in source and binary forms, with or without
10 * modification, are permitted provided that the following conditions
11 * are met:
12 * 1. Redistributions of source code must retain the above copyright
13 * notice, this list of conditions and the following disclaimer.
14 * 2. Redistributions in binary form must reproduce the above copyright
15 * notice, this list of conditions and the following disclaimer in the
16 * documentation and/or other materials provided with the distribution.
17 *
18 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
19 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
20 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
21 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
22 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
23 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
24 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
25 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
26 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
27 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
28 * SUCH DAMAGE.
29 */
30
31 #include <sys/param.h>
32 #include <sys/systm.h>
33 #include <sys/kernel.h>
34 #include <sys/malloc.h>
35 #include <sys/proc.h>
36 #include <sys/queue.h>
37 #include <sys/signal.h>
38 #include <sys/signalvar.h>
39 #include <sys/sysctl.h>
40 #include <sys/sysent.h>
41
42 #include <machine/atomic.h>
43 #include <machine/frame.h>
44 #define _MD_WANT_SWAPWORD
45 #include <machine/md_var.h>
46 #include <machine/pcb.h>
47 #include <machine/undefined.h>
48 #include <machine/vmparam.h>
49
50 #include <vm/vm.h>
51 #include <vm/vm_extern.h>
52
53 /* Low bit masked off */
54 #define INSN_COND(insn) ((insn >> 28) & ~0x1)
55 #define INSN_COND_INVERTED(insn) ((insn >> 28) & 0x1)
56 #define INSN_COND_EQ 0x00 /* NE */
57 #define INSN_COND_CS 0x02 /* CC */
58 #define INSN_COND_MI 0x04 /* PL */
59 #define INSN_COND_VS 0x06 /* VC */
60 #define INSN_COND_HI 0x08 /* LS */
61 #define INSN_COND_GE 0x0a /* LT */
62 #define INSN_COND_GT 0x0c /* LE */
63 #define INSN_COND_AL 0x0e /* Always */
64
65 MALLOC_DEFINE(M_UNDEF, "undefhandler", "Undefined instruction handler data");
66
67 #ifdef COMPAT_FREEBSD32
68 #ifndef EMUL_SWP
69 #define EMUL_SWP 0
70 #endif
71
72 SYSCTL_DECL(_compat_arm);
73
74 static bool compat32_emul_swp = EMUL_SWP;
75 SYSCTL_BOOL(_compat_arm, OID_AUTO, emul_swp,
76 CTLFLAG_RWTUN | CTLFLAG_MPSAFE, &compat32_emul_swp, 0,
77 "Enable SWP/SWPB emulation");
78 #endif
79
80 struct undef_handler {
81 LIST_ENTRY(undef_handler) uh_link;
82 undef_handler_t uh_handler;
83 };
84
85 /* System instruction handlers, e.g. msr, mrs, sys */
86 struct sys_handler {
87 LIST_ENTRY(sys_handler) sys_link;
88 undef_sys_handler_t sys_handler;
89 };
90
91 /*
92 * Create the undefined instruction handler lists.
93 * This allows us to handle instructions that will trap.
94 */
95 LIST_HEAD(, sys_handler) sys_handlers = LIST_HEAD_INITIALIZER(sys_handler);
96 LIST_HEAD(, undef_handler) undef_handlers =
97 LIST_HEAD_INITIALIZER(undef_handlers);
98 #ifdef COMPAT_FREEBSD32
99 LIST_HEAD(, undef_handler) undef32_handlers =
100 LIST_HEAD_INITIALIZER(undef32_handlers);
101 #endif
102
103 static bool
arm_cond_match(uint32_t insn,struct trapframe * frame)104 arm_cond_match(uint32_t insn, struct trapframe *frame)
105 {
106 uint64_t spsr;
107 uint32_t cond;
108 bool invert;
109 bool match;
110
111 /*
112 * Generally based on the function of the same name in NetBSD, though
113 * condition bits left in their original position rather than shifting
114 * over the low bit that indicates inversion for quicker sanity checking
115 * against spec.
116 */
117 spsr = frame->tf_spsr;
118 cond = INSN_COND(insn);
119 invert = INSN_COND_INVERTED(insn);
120
121 switch (cond) {
122 case INSN_COND_EQ:
123 match = (spsr & PSR_Z) != 0;
124 break;
125 case INSN_COND_CS:
126 match = (spsr & PSR_C) != 0;
127 break;
128 case INSN_COND_MI:
129 match = (spsr & PSR_N) != 0;
130 break;
131 case INSN_COND_VS:
132 match = (spsr & PSR_V) != 0;
133 break;
134 case INSN_COND_HI:
135 match = (spsr & (PSR_C | PSR_Z)) == PSR_C;
136 break;
137 case INSN_COND_GE:
138 match = (!(spsr & PSR_N) == !(spsr & PSR_V));
139 break;
140 case INSN_COND_GT:
141 match = !(spsr & PSR_Z) && (!(spsr & PSR_N) == !(spsr & PSR_V));
142 break;
143 case INSN_COND_AL:
144 match = true;
145 break;
146 default:
147 __assert_unreachable();
148 }
149
150 return (match != invert);
151 }
152
153 #ifdef COMPAT_FREEBSD32
154 /* arm32 GDB breakpoints */
155 #define GDB_BREAKPOINT 0xe6000011
156 #define GDB5_BREAKPOINT 0xe7ffdefe
157 static int
gdb_trapper(vm_offset_t va,uint32_t insn,struct trapframe * frame,uint32_t esr)158 gdb_trapper(vm_offset_t va, uint32_t insn, struct trapframe *frame,
159 uint32_t esr)
160 {
161 struct thread *td = curthread;
162
163 if (insn == GDB_BREAKPOINT || insn == GDB5_BREAKPOINT) {
164 if (va < VM_MAXUSER_ADDRESS) {
165 ksiginfo_t ksi;
166
167 ksiginfo_init_trap(&ksi);
168 ksi.ksi_signo = SIGTRAP;
169 ksi.ksi_code = TRAP_BRKPT;
170 ksi.ksi_addr = (void *)va;
171 trapsignal(td, &ksi);
172 return 1;
173 }
174 }
175 return 0;
176 }
177
178 static int
swp_emulate(vm_offset_t va,uint32_t insn,struct trapframe * frame,uint32_t esr)179 swp_emulate(vm_offset_t va, uint32_t insn, struct trapframe *frame,
180 uint32_t esr)
181 {
182 ksiginfo_t ksi;
183 struct thread *td;
184 vm_offset_t vaddr;
185 uint64_t *regs;
186 uint32_t val;
187 int attempts, error, Rn, Rd, Rm;
188 bool is_swpb;
189
190 td = curthread;
191
192 /*
193 * swp, swpb only; there are no Thumb swp/swpb instructions so we can
194 * safely bail out if we're in Thumb mode.
195 */
196 if (!compat32_emul_swp || (frame->tf_spsr & PSR_T) != 0)
197 return (0);
198 else if ((insn & 0x0fb00ff0) != 0x01000090)
199 return (0);
200 else if (!arm_cond_match(insn, frame))
201 goto next; /* Handled, but does nothing */
202
203 Rn = (insn & 0xf0000) >> 16;
204 Rd = (insn & 0xf000) >> 12;
205 Rm = (insn & 0xf);
206
207 regs = frame->tf_x;
208 vaddr = regs[Rn] & 0xffffffff;
209 val = regs[Rm];
210
211 /* Enforce alignment for swp. */
212 is_swpb = (insn & 0x00400000) != 0;
213 if (!is_swpb && (vaddr & 3) != 0)
214 goto fault;
215
216 attempts = 0;
217
218 do {
219 if (is_swpb) {
220 uint8_t bval;
221
222 bval = val;
223 error = swapueword8((void *)vaddr, &bval);
224 val = bval;
225 } else {
226 error = swapueword32((void *)vaddr, &val);
227 }
228
229 if (error == -1)
230 goto fault;
231
232 /*
233 * Avoid potential DoS, e.g., on CPUs that don't implement
234 * global monitors.
235 */
236 if (error != 0 && (++attempts % 5) == 0)
237 maybe_yield();
238 } while (error != 0);
239
240 regs[Rd] = val;
241
242 next:
243 /* No thumb SWP/SWPB */
244 frame->tf_elr += 4; //INSN_SIZE;
245
246 return (1);
247 fault:
248 ksiginfo_init_trap(&ksi);
249 ksi.ksi_signo = SIGSEGV;
250 ksi.ksi_code = SEGV_MAPERR;
251 ksi.ksi_addr = (void *)va;
252 trapsignal(td, &ksi);
253
254 return (1);
255 }
256 #endif
257
258 void
undef_init(void)259 undef_init(void)
260 {
261 #ifdef COMPAT_FREEBSD32
262 install_undef32_handler(gdb_trapper);
263 install_undef32_handler(swp_emulate);
264 #endif
265 }
266
267 void *
install_undef_handler(undef_handler_t func)268 install_undef_handler(undef_handler_t func)
269 {
270 struct undef_handler *uh;
271
272 uh = malloc(sizeof(*uh), M_UNDEF, M_WAITOK);
273 uh->uh_handler = func;
274 LIST_INSERT_HEAD(&undef_handlers, uh, uh_link);
275
276 return (uh);
277 }
278
279 #ifdef COMPAT_FREEBSD32
280 void *
install_undef32_handler(undef_handler_t func)281 install_undef32_handler(undef_handler_t func)
282 {
283 struct undef_handler *uh;
284
285 uh = malloc(sizeof(*uh), M_UNDEF, M_WAITOK);
286 uh->uh_handler = func;
287 LIST_INSERT_HEAD(&undef32_handlers, uh, uh_link);
288
289 return (uh);
290 }
291 #endif
292
293 void
remove_undef_handler(void * handle)294 remove_undef_handler(void *handle)
295 {
296 struct undef_handler *uh;
297
298 uh = handle;
299 LIST_REMOVE(uh, uh_link);
300 free(handle, M_UNDEF);
301 }
302
303 void
install_sys_handler(undef_sys_handler_t func)304 install_sys_handler(undef_sys_handler_t func)
305 {
306 struct sys_handler *sysh;
307
308 sysh = malloc(sizeof(*sysh), M_UNDEF, M_WAITOK);
309 sysh->sys_handler = func;
310 LIST_INSERT_HEAD(&sys_handlers, sysh, sys_link);
311 }
312
313 bool
undef_sys(uint64_t esr,struct trapframe * frame)314 undef_sys(uint64_t esr, struct trapframe *frame)
315 {
316 struct sys_handler *sysh;
317
318 LIST_FOREACH(sysh, &sys_handlers, sys_link) {
319 if (sysh->sys_handler(esr, frame))
320 return (true);
321 }
322
323 return (false);
324 }
325
326 static bool
undef_sys_insn(struct trapframe * frame,uint32_t insn)327 undef_sys_insn(struct trapframe *frame, uint32_t insn)
328 {
329 uint64_t esr;
330 bool read;
331
332 #define MRS_MASK 0xfff00000
333 #define MRS_VALUE 0xd5300000
334 #define MSR_REG_VALUE 0xd5100000
335 #define MSR_IMM_VALUE 0xd5000000
336 #define MRS_REGISTER(insn) ((insn) & 0x0000001f)
337 #define MRS_Op0_SHIFT 19
338 #define MRS_Op0_MASK 0x00180000
339 #define MRS_Op1_SHIFT 16
340 #define MRS_Op1_MASK 0x00070000
341 #define MRS_CRn_SHIFT 12
342 #define MRS_CRn_MASK 0x0000f000
343 #define MRS_CRm_SHIFT 8
344 #define MRS_CRm_MASK 0x00000f00
345 #define MRS_Op2_SHIFT 5
346 #define MRS_Op2_MASK 0x000000e0
347
348 read = false;
349 switch (insn & MRS_MASK) {
350 case MRS_VALUE:
351 read = true;
352 break;
353 case MSR_REG_VALUE:
354 break;
355 case MSR_IMM_VALUE:
356 /*
357 * MSR (immediate) needs special handling. The
358 * source register is always 31 (xzr), CRn is 4,
359 * and op0 is hard coded as 0.
360 */
361 if (MRS_REGISTER(insn) != 31)
362 return (false);
363 if ((insn & MRS_CRn_MASK) >> MRS_CRn_SHIFT != 4)
364 return (false);
365 if ((insn & MRS_Op0_MASK) >> MRS_Op0_SHIFT != 0)
366 return (false);
367 break;
368 default:
369 return (false);
370 }
371
372 /* Create a fake EXCP_MSR esr value */
373 esr = EXCP_MSR << ESR_ELx_EC_SHIFT;
374 esr |= ESR_ELx_IL;
375 esr |= __ISS_MSR_REG(
376 (insn & MRS_Op0_MASK) >> MRS_Op0_SHIFT,
377 (insn & MRS_Op1_MASK) >> MRS_Op1_SHIFT,
378 (insn & MRS_CRn_MASK) >> MRS_CRn_SHIFT,
379 (insn & MRS_CRm_MASK) >> MRS_CRm_SHIFT,
380 (insn & MRS_Op2_MASK) >> MRS_Op2_SHIFT);
381 esr |= MRS_REGISTER(insn) << ISS_MSR_Rt_SHIFT;
382 if (read)
383 esr |= ISS_MSR_DIR;
384
385 #undef MRS_MASK
386 #undef MRS_VALUE
387 #undef MSR_REG_VALUE
388 #undef MSR_IMM_VALUE
389 #undef MRS_REGISTER
390 #undef MRS_Op0_SHIFT
391 #undef MRS_Op0_MASK
392 #undef MRS_Op1_SHIFT
393 #undef MRS_Op1_MASK
394 #undef MRS_CRn_SHIFT
395 #undef MRS_CRn_MASK
396 #undef MRS_CRm_SHIFT
397 #undef MRS_CRm_MASK
398 #undef MRS_Op2_SHIFT
399 #undef MRS_Op2_MASK
400
401 return (undef_sys(esr, frame));
402 }
403
404 int
undef_insn(struct trapframe * frame)405 undef_insn(struct trapframe *frame)
406 {
407 struct undef_handler *uh;
408 uint32_t insn;
409 int ret;
410
411 ret = fueword32((uint32_t *)frame->tf_elr, &insn);
412 /* Raise a SIGILL if we are unable to read the instruction */
413 if (ret != 0)
414 return (0);
415
416 #ifdef COMPAT_FREEBSD32
417 if (SV_PROC_FLAG(curthread->td_proc, SV_ILP32)) {
418 LIST_FOREACH(uh, &undef32_handlers, uh_link) {
419 ret = uh->uh_handler(frame->tf_elr, insn, frame,
420 frame->tf_esr);
421 if (ret)
422 return (1);
423 }
424 return (0);
425 }
426 #endif
427
428 if (undef_sys_insn(frame, insn))
429 return (1);
430
431 LIST_FOREACH(uh, &undef_handlers, uh_link) {
432 ret = uh->uh_handler(frame->tf_elr, insn, frame, frame->tf_esr);
433 if (ret)
434 return (1);
435 }
436
437 return (0);
438 }
439