1 /* SPDX-License-Identifier: GPL-2.0-only */ 2 /* 3 * arch/arm/probes/decode.h 4 * 5 * Copyright (C) 2011 Jon Medhurst <tixy@yxit.co.uk>. 6 * 7 * Some contents moved here from arch/arm/include/asm/kprobes.h which is 8 * Copyright (C) 2006, 2007 Motorola Inc. 9 */ 10 11 #ifndef _ARM_KERNEL_PROBES_H 12 #define _ARM_KERNEL_PROBES_H 13 14 #include <linux/types.h> 15 #include <linux/stddef.h> 16 #include <asm/probes.h> 17 #include <asm/ptrace.h> 18 #include <asm/kprobes.h> 19 20 void __init arm_probes_decode_init(void); 21 22 extern probes_check_cc * const probes_condition_checks[16]; 23 24 #if __LINUX_ARM_ARCH__ >= 7 25 26 /* str_pc_offset is architecturally defined from ARMv7 onwards */ 27 #define str_pc_offset 8 28 #define find_str_pc_offset() 29 30 #else /* __LINUX_ARM_ARCH__ < 7 */ 31 32 /* We need a run-time check to determine str_pc_offset */ 33 extern int str_pc_offset; 34 void __init find_str_pc_offset(void); 35 36 #endif 37 38 39 static inline void __kprobes bx_write_pc(long pcv, struct pt_regs *regs) 40 { 41 long cpsr = regs->ARM_cpsr; 42 if (pcv & 0x1) { 43 cpsr |= PSR_T_BIT; 44 pcv &= ~0x1; 45 } else { 46 cpsr &= ~PSR_T_BIT; 47 pcv &= ~0x2; /* Avoid UNPREDICTABLE address allignment */ 48 } 49 regs->ARM_cpsr = cpsr; 50 regs->ARM_pc = pcv; 51 } 52 53 54 #if __LINUX_ARM_ARCH__ >= 6 55 56 /* Kernels built for >= ARMv6 should never run on <= ARMv5 hardware, so... */ 57 #define load_write_pc_interworks true 58 #define test_load_write_pc_interworking() 59 60 #else /* __LINUX_ARM_ARCH__ < 6 */ 61 62 /* We need run-time testing to determine if load_write_pc() should interwork. */ 63 extern bool load_write_pc_interworks; 64 void __init test_load_write_pc_interworking(void); 65 66 #endif 67 68 static inline void __kprobes load_write_pc(long pcv, struct pt_regs *regs) 69 { 70 if (load_write_pc_interworks) 71 bx_write_pc(pcv, regs); 72 else 73 regs->ARM_pc = pcv; 74 } 75 76 77 #if __LINUX_ARM_ARCH__ >= 7 78 79 #define alu_write_pc_interworks true 80 #define test_alu_write_pc_interworking() 81 82 #elif __LINUX_ARM_ARCH__ <= 5 83 84 /* Kernels built for <= ARMv5 should never run on >= ARMv6 hardware, so... */ 85 #define alu_write_pc_interworks false 86 #define test_alu_write_pc_interworking() 87 88 #else /* __LINUX_ARM_ARCH__ == 6 */ 89 90 /* We could be an ARMv6 binary on ARMv7 hardware so we need a run-time check. */ 91 extern bool alu_write_pc_interworks; 92 void __init test_alu_write_pc_interworking(void); 93 94 #endif /* __LINUX_ARM_ARCH__ == 6 */ 95 96 static inline void __kprobes alu_write_pc(long pcv, struct pt_regs *regs) 97 { 98 if (alu_write_pc_interworks) 99 bx_write_pc(pcv, regs); 100 else 101 regs->ARM_pc = pcv; 102 } 103 104 105 /* 106 * Test if load/store instructions writeback the address register. 107 * if P (bit 24) == 0 or W (bit 21) == 1 108 */ 109 #define is_writeback(insn) ((insn ^ 0x01000000) & 0x01200000) 110 111 /* 112 * The following definitions and macros are used to build instruction 113 * decoding tables for use by probes_decode_insn. 114 * 115 * These tables are a concatenation of entries each of which consist of one of 116 * the decode_* structs. All of the fields in every type of decode structure 117 * are of the union type decode_item, therefore the entire decode table can be 118 * viewed as an array of these and declared like: 119 * 120 * static const union decode_item table_name[] = {}; 121 * 122 * In order to construct each entry in the table, macros are used to 123 * initialise a number of sequential decode_item values in a layout which 124 * matches the relevant struct. E.g. DECODE_SIMULATE initialise a struct 125 * decode_simulate by initialising four decode_item objects like this... 126 * 127 * {.bits = _type}, 128 * {.bits = _mask}, 129 * {.bits = _value}, 130 * {.action = _handler}, 131 * 132 * Initialising a specified member of the union means that the compiler 133 * will produce a warning if the argument is of an incorrect type. 134 * 135 * Below is a list of each of the macros used to initialise entries and a 136 * description of the action performed when that entry is matched to an 137 * instruction. A match is found when (instruction & mask) == value. 138 * 139 * DECODE_TABLE(mask, value, table) 140 * Instruction decoding jumps to parsing the new sub-table 'table'. 141 * 142 * DECODE_CUSTOM(mask, value, decoder) 143 * The value of 'decoder' is used as an index into the array of 144 * action functions, and the retrieved decoder function is invoked 145 * to complete decoding of the instruction. 146 * 147 * DECODE_SIMULATE(mask, value, handler) 148 * The probes instruction handler is set to the value found by 149 * indexing into the action array using the value of 'handler'. This 150 * will be used to simulate the instruction when the probe is hit. 151 * Decoding returns with INSN_GOOD_NO_SLOT. 152 * 153 * DECODE_EMULATE(mask, value, handler) 154 * The probes instruction handler is set to the value found by 155 * indexing into the action array using the value of 'handler'. This 156 * will be used to emulate the instruction when the probe is hit. The 157 * modified instruction (see below) is placed in the probes instruction 158 * slot so it may be called by the emulation code. Decoding returns 159 * with INSN_GOOD. 160 * 161 * DECODE_REJECT(mask, value) 162 * Instruction decoding fails with INSN_REJECTED 163 * 164 * DECODE_OR(mask, value) 165 * This allows the mask/value test of multiple table entries to be 166 * logically ORed. Once an 'or' entry is matched the decoding action to 167 * be performed is that of the next entry which isn't an 'or'. E.g. 168 * 169 * DECODE_OR (mask1, value1) 170 * DECODE_OR (mask2, value2) 171 * DECODE_SIMULATE (mask3, value3, simulation_handler) 172 * 173 * This means that if any of the three mask/value pairs match the 174 * instruction being decoded, then 'simulation_handler' will be used 175 * for it. 176 * 177 * Both the SIMULATE and EMULATE macros have a second form which take an 178 * additional 'regs' argument. 179 * 180 * DECODE_SIMULATEX(mask, value, handler, regs) 181 * DECODE_EMULATEX (mask, value, handler, regs) 182 * 183 * These are used to specify what kind of CPU register is encoded in each of the 184 * least significant 5 nibbles of the instruction being decoded. The regs value 185 * is specified using the REGS macro, this takes any of the REG_TYPE_* values 186 * from enum decode_reg_type as arguments; only the '*' part of the name is 187 * given. E.g. 188 * 189 * REGS(0, ANY, NOPC, 0, ANY) 190 * 191 * This indicates an instruction is encoded like: 192 * 193 * bits 19..16 ignore 194 * bits 15..12 any register allowed here 195 * bits 11.. 8 any register except PC allowed here 196 * bits 7.. 4 ignore 197 * bits 3.. 0 any register allowed here 198 * 199 * This register specification is checked after a decode table entry is found to 200 * match an instruction (through the mask/value test). Any invalid register then 201 * found in the instruction will cause decoding to fail with INSN_REJECTED. In 202 * the above example this would happen if bits 11..8 of the instruction were 203 * 1111, indicating R15 or PC. 204 * 205 * As well as checking for legal combinations of registers, this data is also 206 * used to modify the registers encoded in the instructions so that an 207 * emulation routines can use it. (See decode_regs() and INSN_NEW_BITS.) 208 * 209 * Here is a real example which matches ARM instructions of the form 210 * "AND <Rd>,<Rn>,<Rm>,<shift> <Rs>" 211 * 212 * DECODE_EMULATEX (0x0e000090, 0x00000010, PROBES_DATA_PROCESSING_REG, 213 * REGS(ANY, ANY, NOPC, 0, ANY)), 214 * ^ ^ ^ ^ 215 * Rn Rd Rs Rm 216 * 217 * Decoding the instruction "AND R4, R5, R6, ASL R15" will be rejected because 218 * Rs == R15 219 * 220 * Decoding the instruction "AND R4, R5, R6, ASL R7" will be accepted and the 221 * instruction will be modified to "AND R0, R2, R3, ASL R1" and then placed into 222 * the kprobes instruction slot. This can then be called later by the handler 223 * function emulate_rd12rn16rm0rs8_rwflags (a pointer to which is retrieved from 224 * the indicated slot in the action array), in order to simulate the instruction. 225 */ 226 227 enum decode_type { 228 DECODE_TYPE_END, 229 DECODE_TYPE_TABLE, 230 DECODE_TYPE_CUSTOM, 231 DECODE_TYPE_SIMULATE, 232 DECODE_TYPE_EMULATE, 233 DECODE_TYPE_OR, 234 DECODE_TYPE_REJECT, 235 NUM_DECODE_TYPES /* Must be last enum */ 236 }; 237 238 #define DECODE_TYPE_BITS 4 239 #define DECODE_TYPE_MASK ((1 << DECODE_TYPE_BITS) - 1) 240 241 enum decode_reg_type { 242 REG_TYPE_NONE = 0, /* Not a register, ignore */ 243 REG_TYPE_ANY, /* Any register allowed */ 244 REG_TYPE_SAMEAS16, /* Register should be same as that at bits 19..16 */ 245 REG_TYPE_SP, /* Register must be SP */ 246 REG_TYPE_PC, /* Register must be PC */ 247 REG_TYPE_NOSP, /* Register must not be SP */ 248 REG_TYPE_NOSPPC, /* Register must not be SP or PC */ 249 REG_TYPE_NOPC, /* Register must not be PC */ 250 REG_TYPE_NOPCWB, /* No PC if load/store write-back flag also set */ 251 252 /* The following types are used when the encoding for PC indicates 253 * another instruction form. This distiction only matters for test 254 * case coverage checks. 255 */ 256 REG_TYPE_NOPCX, /* Register must not be PC */ 257 REG_TYPE_NOSPPCX, /* Register must not be SP or PC */ 258 259 /* Alias to allow '0' arg to be used in REGS macro. */ 260 REG_TYPE_0 = REG_TYPE_NONE 261 }; 262 263 #define REGS(r16, r12, r8, r4, r0) \ 264 (((REG_TYPE_##r16) << 16) + \ 265 ((REG_TYPE_##r12) << 12) + \ 266 ((REG_TYPE_##r8) << 8) + \ 267 ((REG_TYPE_##r4) << 4) + \ 268 (REG_TYPE_##r0)) 269 270 union decode_item { 271 u32 bits; 272 const union decode_item *table; 273 int action; 274 }; 275 276 struct decode_header; 277 typedef enum probes_insn (probes_custom_decode_t)(probes_opcode_t, 278 struct arch_probes_insn *, 279 const struct decode_header *); 280 281 union decode_action { 282 probes_insn_handler_t *handler; 283 probes_custom_decode_t *decoder; 284 }; 285 286 typedef enum probes_insn (probes_check_t)(probes_opcode_t, 287 struct arch_probes_insn *, 288 const struct decode_header *); 289 290 struct decode_checker { 291 probes_check_t *checker; 292 }; 293 294 #define DECODE_END \ 295 {.bits = DECODE_TYPE_END} 296 297 298 struct decode_header { 299 union decode_item type_regs; 300 union decode_item mask; 301 union decode_item value; 302 }; 303 304 #define DECODE_HEADER(_type, _mask, _value, _regs) \ 305 {.bits = (_type) | ((_regs) << DECODE_TYPE_BITS)}, \ 306 {.bits = (_mask)}, \ 307 {.bits = (_value)} 308 309 310 struct decode_table { 311 struct decode_header header; 312 union decode_item table; 313 }; 314 315 #define DECODE_TABLE(_mask, _value, _table) \ 316 DECODE_HEADER(DECODE_TYPE_TABLE, _mask, _value, 0), \ 317 {.table = (_table)} 318 319 320 struct decode_custom { 321 struct decode_header header; 322 union decode_item decoder; 323 }; 324 325 #define DECODE_CUSTOM(_mask, _value, _decoder) \ 326 DECODE_HEADER(DECODE_TYPE_CUSTOM, _mask, _value, 0), \ 327 {.action = (_decoder)} 328 329 330 struct decode_simulate { 331 struct decode_header header; 332 union decode_item handler; 333 }; 334 335 #define DECODE_SIMULATEX(_mask, _value, _handler, _regs) \ 336 DECODE_HEADER(DECODE_TYPE_SIMULATE, _mask, _value, _regs), \ 337 {.action = (_handler)} 338 339 #define DECODE_SIMULATE(_mask, _value, _handler) \ 340 DECODE_SIMULATEX(_mask, _value, _handler, 0) 341 342 343 struct decode_emulate { 344 struct decode_header header; 345 union decode_item handler; 346 }; 347 348 #define DECODE_EMULATEX(_mask, _value, _handler, _regs) \ 349 DECODE_HEADER(DECODE_TYPE_EMULATE, _mask, _value, _regs), \ 350 {.action = (_handler)} 351 352 #define DECODE_EMULATE(_mask, _value, _handler) \ 353 DECODE_EMULATEX(_mask, _value, _handler, 0) 354 355 356 struct decode_or { 357 struct decode_header header; 358 }; 359 360 #define DECODE_OR(_mask, _value) \ 361 DECODE_HEADER(DECODE_TYPE_OR, _mask, _value, 0) 362 363 enum probes_insn { 364 INSN_REJECTED, 365 INSN_GOOD, 366 INSN_GOOD_NO_SLOT 367 }; 368 369 struct decode_reject { 370 struct decode_header header; 371 }; 372 373 #define DECODE_REJECT(_mask, _value) \ 374 DECODE_HEADER(DECODE_TYPE_REJECT, _mask, _value, 0) 375 376 probes_insn_handler_t probes_simulate_nop; 377 probes_insn_handler_t probes_emulate_none; 378 379 int __kprobes 380 probes_decode_insn(probes_opcode_t insn, struct arch_probes_insn *asi, 381 const union decode_item *table, bool thumb, bool emulate, 382 const union decode_action *actions, 383 const struct decode_checker **checkers); 384 385 #endif 386