1 /* 2 * arch/arm/probes/decode.h 3 * 4 * Copyright (C) 2011 Jon Medhurst <tixy@yxit.co.uk>. 5 * 6 * Some contents moved here from arch/arm/include/asm/kprobes.h which is 7 * Copyright (C) 2006, 2007 Motorola Inc. 8 * 9 * This program is free software; you can redistribute it and/or modify 10 * it under the terms of the GNU General Public License version 2 as 11 * published by the Free Software Foundation. 12 * 13 * This program is distributed in the hope that it will be useful, 14 * but WITHOUT ANY WARRANTY; without even the implied warranty of 15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU 16 * General Public License for more details. 17 */ 18 19 #ifndef _ARM_KERNEL_PROBES_H 20 #define _ARM_KERNEL_PROBES_H 21 22 #include <linux/types.h> 23 #include <linux/stddef.h> 24 #include <asm/probes.h> 25 26 void __init arm_probes_decode_init(void); 27 28 extern probes_check_cc * const probes_condition_checks[16]; 29 30 #if __LINUX_ARM_ARCH__ >= 7 31 32 /* str_pc_offset is architecturally defined from ARMv7 onwards */ 33 #define str_pc_offset 8 34 #define find_str_pc_offset() 35 36 #else /* __LINUX_ARM_ARCH__ < 7 */ 37 38 /* We need a run-time check to determine str_pc_offset */ 39 extern int str_pc_offset; 40 void __init find_str_pc_offset(void); 41 42 #endif 43 44 45 /* 46 * Update ITSTATE after normal execution of an IT block instruction. 47 * 48 * The 8 IT state bits are split into two parts in CPSR: 49 * ITSTATE<1:0> are in CPSR<26:25> 50 * ITSTATE<7:2> are in CPSR<15:10> 51 */ 52 static inline unsigned long it_advance(unsigned long cpsr) 53 { 54 if ((cpsr & 0x06000400) == 0) { 55 /* ITSTATE<2:0> == 0 means end of IT block, so clear IT state */ 56 cpsr &= ~PSR_IT_MASK; 57 } else { 58 /* We need to shift left ITSTATE<4:0> */ 59 const unsigned long mask = 0x06001c00; /* Mask ITSTATE<4:0> */ 60 unsigned long it = cpsr & mask; 61 it <<= 1; 62 it |= it >> (27 - 10); /* Carry ITSTATE<2> to correct place */ 63 it &= mask; 64 cpsr &= ~mask; 65 cpsr |= it; 66 } 67 return cpsr; 68 } 69 70 static inline void __kprobes bx_write_pc(long pcv, struct pt_regs *regs) 71 { 72 long cpsr = regs->ARM_cpsr; 73 if (pcv & 0x1) { 74 cpsr |= PSR_T_BIT; 75 pcv &= ~0x1; 76 } else { 77 cpsr &= ~PSR_T_BIT; 78 pcv &= ~0x2; /* Avoid UNPREDICTABLE address allignment */ 79 } 80 regs->ARM_cpsr = cpsr; 81 regs->ARM_pc = pcv; 82 } 83 84 85 #if __LINUX_ARM_ARCH__ >= 6 86 87 /* Kernels built for >= ARMv6 should never run on <= ARMv5 hardware, so... */ 88 #define load_write_pc_interworks true 89 #define test_load_write_pc_interworking() 90 91 #else /* __LINUX_ARM_ARCH__ < 6 */ 92 93 /* We need run-time testing to determine if load_write_pc() should interwork. */ 94 extern bool load_write_pc_interworks; 95 void __init test_load_write_pc_interworking(void); 96 97 #endif 98 99 static inline void __kprobes load_write_pc(long pcv, struct pt_regs *regs) 100 { 101 if (load_write_pc_interworks) 102 bx_write_pc(pcv, regs); 103 else 104 regs->ARM_pc = pcv; 105 } 106 107 108 #if __LINUX_ARM_ARCH__ >= 7 109 110 #define alu_write_pc_interworks true 111 #define test_alu_write_pc_interworking() 112 113 #elif __LINUX_ARM_ARCH__ <= 5 114 115 /* Kernels built for <= ARMv5 should never run on >= ARMv6 hardware, so... */ 116 #define alu_write_pc_interworks false 117 #define test_alu_write_pc_interworking() 118 119 #else /* __LINUX_ARM_ARCH__ == 6 */ 120 121 /* We could be an ARMv6 binary on ARMv7 hardware so we need a run-time check. */ 122 extern bool alu_write_pc_interworks; 123 void __init test_alu_write_pc_interworking(void); 124 125 #endif /* __LINUX_ARM_ARCH__ == 6 */ 126 127 static inline void __kprobes alu_write_pc(long pcv, struct pt_regs *regs) 128 { 129 if (alu_write_pc_interworks) 130 bx_write_pc(pcv, regs); 131 else 132 regs->ARM_pc = pcv; 133 } 134 135 136 /* 137 * Test if load/store instructions writeback the address register. 138 * if P (bit 24) == 0 or W (bit 21) == 1 139 */ 140 #define is_writeback(insn) ((insn ^ 0x01000000) & 0x01200000) 141 142 /* 143 * The following definitions and macros are used to build instruction 144 * decoding tables for use by probes_decode_insn. 145 * 146 * These tables are a concatenation of entries each of which consist of one of 147 * the decode_* structs. All of the fields in every type of decode structure 148 * are of the union type decode_item, therefore the entire decode table can be 149 * viewed as an array of these and declared like: 150 * 151 * static const union decode_item table_name[] = {}; 152 * 153 * In order to construct each entry in the table, macros are used to 154 * initialise a number of sequential decode_item values in a layout which 155 * matches the relevant struct. E.g. DECODE_SIMULATE initialise a struct 156 * decode_simulate by initialising four decode_item objects like this... 157 * 158 * {.bits = _type}, 159 * {.bits = _mask}, 160 * {.bits = _value}, 161 * {.action = _handler}, 162 * 163 * Initialising a specified member of the union means that the compiler 164 * will produce a warning if the argument is of an incorrect type. 165 * 166 * Below is a list of each of the macros used to initialise entries and a 167 * description of the action performed when that entry is matched to an 168 * instruction. A match is found when (instruction & mask) == value. 169 * 170 * DECODE_TABLE(mask, value, table) 171 * Instruction decoding jumps to parsing the new sub-table 'table'. 172 * 173 * DECODE_CUSTOM(mask, value, decoder) 174 * The value of 'decoder' is used as an index into the array of 175 * action functions, and the retrieved decoder function is invoked 176 * to complete decoding of the instruction. 177 * 178 * DECODE_SIMULATE(mask, value, handler) 179 * The probes instruction handler is set to the value found by 180 * indexing into the action array using the value of 'handler'. This 181 * will be used to simulate the instruction when the probe is hit. 182 * Decoding returns with INSN_GOOD_NO_SLOT. 183 * 184 * DECODE_EMULATE(mask, value, handler) 185 * The probes instruction handler is set to the value found by 186 * indexing into the action array using the value of 'handler'. This 187 * will be used to emulate the instruction when the probe is hit. The 188 * modified instruction (see below) is placed in the probes instruction 189 * slot so it may be called by the emulation code. Decoding returns 190 * with INSN_GOOD. 191 * 192 * DECODE_REJECT(mask, value) 193 * Instruction decoding fails with INSN_REJECTED 194 * 195 * DECODE_OR(mask, value) 196 * This allows the mask/value test of multiple table entries to be 197 * logically ORed. Once an 'or' entry is matched the decoding action to 198 * be performed is that of the next entry which isn't an 'or'. E.g. 199 * 200 * DECODE_OR (mask1, value1) 201 * DECODE_OR (mask2, value2) 202 * DECODE_SIMULATE (mask3, value3, simulation_handler) 203 * 204 * This means that if any of the three mask/value pairs match the 205 * instruction being decoded, then 'simulation_handler' will be used 206 * for it. 207 * 208 * Both the SIMULATE and EMULATE macros have a second form which take an 209 * additional 'regs' argument. 210 * 211 * DECODE_SIMULATEX(mask, value, handler, regs) 212 * DECODE_EMULATEX (mask, value, handler, regs) 213 * 214 * These are used to specify what kind of CPU register is encoded in each of the 215 * least significant 5 nibbles of the instruction being decoded. The regs value 216 * is specified using the REGS macro, this takes any of the REG_TYPE_* values 217 * from enum decode_reg_type as arguments; only the '*' part of the name is 218 * given. E.g. 219 * 220 * REGS(0, ANY, NOPC, 0, ANY) 221 * 222 * This indicates an instruction is encoded like: 223 * 224 * bits 19..16 ignore 225 * bits 15..12 any register allowed here 226 * bits 11.. 8 any register except PC allowed here 227 * bits 7.. 4 ignore 228 * bits 3.. 0 any register allowed here 229 * 230 * This register specification is checked after a decode table entry is found to 231 * match an instruction (through the mask/value test). Any invalid register then 232 * found in the instruction will cause decoding to fail with INSN_REJECTED. In 233 * the above example this would happen if bits 11..8 of the instruction were 234 * 1111, indicating R15 or PC. 235 * 236 * As well as checking for legal combinations of registers, this data is also 237 * used to modify the registers encoded in the instructions so that an 238 * emulation routines can use it. (See decode_regs() and INSN_NEW_BITS.) 239 * 240 * Here is a real example which matches ARM instructions of the form 241 * "AND <Rd>,<Rn>,<Rm>,<shift> <Rs>" 242 * 243 * DECODE_EMULATEX (0x0e000090, 0x00000010, PROBES_DATA_PROCESSING_REG, 244 * REGS(ANY, ANY, NOPC, 0, ANY)), 245 * ^ ^ ^ ^ 246 * Rn Rd Rs Rm 247 * 248 * Decoding the instruction "AND R4, R5, R6, ASL R15" will be rejected because 249 * Rs == R15 250 * 251 * Decoding the instruction "AND R4, R5, R6, ASL R7" will be accepted and the 252 * instruction will be modified to "AND R0, R2, R3, ASL R1" and then placed into 253 * the kprobes instruction slot. This can then be called later by the handler 254 * function emulate_rd12rn16rm0rs8_rwflags (a pointer to which is retrieved from 255 * the indicated slot in the action array), in order to simulate the instruction. 256 */ 257 258 enum decode_type { 259 DECODE_TYPE_END, 260 DECODE_TYPE_TABLE, 261 DECODE_TYPE_CUSTOM, 262 DECODE_TYPE_SIMULATE, 263 DECODE_TYPE_EMULATE, 264 DECODE_TYPE_OR, 265 DECODE_TYPE_REJECT, 266 NUM_DECODE_TYPES /* Must be last enum */ 267 }; 268 269 #define DECODE_TYPE_BITS 4 270 #define DECODE_TYPE_MASK ((1 << DECODE_TYPE_BITS) - 1) 271 272 enum decode_reg_type { 273 REG_TYPE_NONE = 0, /* Not a register, ignore */ 274 REG_TYPE_ANY, /* Any register allowed */ 275 REG_TYPE_SAMEAS16, /* Register should be same as that at bits 19..16 */ 276 REG_TYPE_SP, /* Register must be SP */ 277 REG_TYPE_PC, /* Register must be PC */ 278 REG_TYPE_NOSP, /* Register must not be SP */ 279 REG_TYPE_NOSPPC, /* Register must not be SP or PC */ 280 REG_TYPE_NOPC, /* Register must not be PC */ 281 REG_TYPE_NOPCWB, /* No PC if load/store write-back flag also set */ 282 283 /* The following types are used when the encoding for PC indicates 284 * another instruction form. This distiction only matters for test 285 * case coverage checks. 286 */ 287 REG_TYPE_NOPCX, /* Register must not be PC */ 288 REG_TYPE_NOSPPCX, /* Register must not be SP or PC */ 289 290 /* Alias to allow '0' arg to be used in REGS macro. */ 291 REG_TYPE_0 = REG_TYPE_NONE 292 }; 293 294 #define REGS(r16, r12, r8, r4, r0) \ 295 (((REG_TYPE_##r16) << 16) + \ 296 ((REG_TYPE_##r12) << 12) + \ 297 ((REG_TYPE_##r8) << 8) + \ 298 ((REG_TYPE_##r4) << 4) + \ 299 (REG_TYPE_##r0)) 300 301 union decode_item { 302 u32 bits; 303 const union decode_item *table; 304 int action; 305 }; 306 307 struct decode_header; 308 typedef enum probes_insn (probes_custom_decode_t)(probes_opcode_t, 309 struct arch_probes_insn *, 310 const struct decode_header *); 311 312 union decode_action { 313 probes_insn_handler_t *handler; 314 probes_custom_decode_t *decoder; 315 }; 316 317 typedef enum probes_insn (probes_check_t)(probes_opcode_t, 318 struct arch_probes_insn *, 319 const struct decode_header *); 320 321 struct decode_checker { 322 probes_check_t *checker; 323 }; 324 325 #define DECODE_END \ 326 {.bits = DECODE_TYPE_END} 327 328 329 struct decode_header { 330 union decode_item type_regs; 331 union decode_item mask; 332 union decode_item value; 333 }; 334 335 #define DECODE_HEADER(_type, _mask, _value, _regs) \ 336 {.bits = (_type) | ((_regs) << DECODE_TYPE_BITS)}, \ 337 {.bits = (_mask)}, \ 338 {.bits = (_value)} 339 340 341 struct decode_table { 342 struct decode_header header; 343 union decode_item table; 344 }; 345 346 #define DECODE_TABLE(_mask, _value, _table) \ 347 DECODE_HEADER(DECODE_TYPE_TABLE, _mask, _value, 0), \ 348 {.table = (_table)} 349 350 351 struct decode_custom { 352 struct decode_header header; 353 union decode_item decoder; 354 }; 355 356 #define DECODE_CUSTOM(_mask, _value, _decoder) \ 357 DECODE_HEADER(DECODE_TYPE_CUSTOM, _mask, _value, 0), \ 358 {.action = (_decoder)} 359 360 361 struct decode_simulate { 362 struct decode_header header; 363 union decode_item handler; 364 }; 365 366 #define DECODE_SIMULATEX(_mask, _value, _handler, _regs) \ 367 DECODE_HEADER(DECODE_TYPE_SIMULATE, _mask, _value, _regs), \ 368 {.action = (_handler)} 369 370 #define DECODE_SIMULATE(_mask, _value, _handler) \ 371 DECODE_SIMULATEX(_mask, _value, _handler, 0) 372 373 374 struct decode_emulate { 375 struct decode_header header; 376 union decode_item handler; 377 }; 378 379 #define DECODE_EMULATEX(_mask, _value, _handler, _regs) \ 380 DECODE_HEADER(DECODE_TYPE_EMULATE, _mask, _value, _regs), \ 381 {.action = (_handler)} 382 383 #define DECODE_EMULATE(_mask, _value, _handler) \ 384 DECODE_EMULATEX(_mask, _value, _handler, 0) 385 386 387 struct decode_or { 388 struct decode_header header; 389 }; 390 391 #define DECODE_OR(_mask, _value) \ 392 DECODE_HEADER(DECODE_TYPE_OR, _mask, _value, 0) 393 394 enum probes_insn { 395 INSN_REJECTED, 396 INSN_GOOD, 397 INSN_GOOD_NO_SLOT 398 }; 399 400 struct decode_reject { 401 struct decode_header header; 402 }; 403 404 #define DECODE_REJECT(_mask, _value) \ 405 DECODE_HEADER(DECODE_TYPE_REJECT, _mask, _value, 0) 406 407 probes_insn_handler_t probes_simulate_nop; 408 probes_insn_handler_t probes_emulate_none; 409 410 int __kprobes 411 probes_decode_insn(probes_opcode_t insn, struct arch_probes_insn *asi, 412 const union decode_item *table, bool thumb, bool emulate, 413 const union decode_action *actions, 414 const struct decode_checker **checkers); 415 416 #endif 417