1 // SPDX-License-Identifier: GPL-2.0+ 2 3 #include <linux/bitops.h> 4 #include <linux/kernel.h> 5 #include <linux/kprobes.h> 6 7 #include "decode-insn.h" 8 #include "simulate-insn.h" 9 10 static inline bool rv_insn_reg_get_val(struct pt_regs *regs, u32 index, 11 unsigned long *ptr) 12 { 13 if (index == 0) 14 *ptr = 0; 15 else if (index <= 31) 16 *ptr = *((unsigned long *)regs + index); 17 else 18 return false; 19 20 return true; 21 } 22 23 static inline bool rv_insn_reg_set_val(struct pt_regs *regs, u32 index, 24 unsigned long val) 25 { 26 if (index == 0) 27 return true; 28 else if (index <= 31) 29 *((unsigned long *)regs + index) = val; 30 else 31 return false; 32 33 return true; 34 } 35 36 bool __kprobes simulate_jal(u32 opcode, unsigned long addr, struct pt_regs *regs) 37 { 38 /* 39 * 31 30 21 20 19 12 11 7 6 0 40 * imm [20] | imm[10:1] | imm[11] | imm[19:12] | rd | opcode 41 * 1 10 1 8 5 JAL/J 42 */ 43 bool ret; 44 s32 imm; 45 u32 index = RV_EXTRACT_RD_REG(opcode); 46 47 ret = rv_insn_reg_set_val(regs, index, addr + 4); 48 if (!ret) 49 return ret; 50 51 imm = RV_EXTRACT_JTYPE_IMM(opcode); 52 53 instruction_pointer_set(regs, addr + imm); 54 55 return ret; 56 } 57 58 bool __kprobes simulate_jalr(u32 opcode, unsigned long addr, struct pt_regs *regs) 59 { 60 /* 61 * 31 20 19 15 14 12 11 7 6 0 62 * offset[11:0] | rs1 | 010 | rd | opcode 63 * 12 5 3 5 JALR/JR 64 */ 65 bool ret; 66 unsigned long base_addr; 67 u32 imm = (opcode >> 20) & 0xfff; 68 u32 rd_index = RV_EXTRACT_RD_REG(opcode); 69 u32 rs1_index = RV_EXTRACT_RS1_REG(opcode); 70 71 ret = rv_insn_reg_get_val(regs, rs1_index, &base_addr); 72 if (!ret) 73 return ret; 74 75 ret = rv_insn_reg_set_val(regs, rd_index, addr + 4); 76 if (!ret) 77 return ret; 78 79 instruction_pointer_set(regs, (base_addr + sign_extend32((imm), 11))&~1); 80 81 return ret; 82 } 83 84 #define auipc_imm(opcode) \ 85 ((((opcode) >> 12) & 0xfffff) << 12) 86 87 #if __riscv_xlen == 64 88 #define auipc_offset(opcode) sign_extend64(auipc_imm(opcode), 31) 89 #elif __riscv_xlen == 32 90 #define auipc_offset(opcode) auipc_imm(opcode) 91 #else 92 #error "Unexpected __riscv_xlen" 93 #endif 94 95 bool __kprobes simulate_auipc(u32 opcode, unsigned long addr, struct pt_regs *regs) 96 { 97 /* 98 * auipc instruction: 99 * 31 12 11 7 6 0 100 * | imm[31:12] | rd | opcode | 101 * 20 5 7 102 */ 103 104 u32 rd_idx = RV_EXTRACT_RD_REG(opcode); 105 unsigned long rd_val = addr + auipc_offset(opcode); 106 107 if (!rv_insn_reg_set_val(regs, rd_idx, rd_val)) 108 return false; 109 110 instruction_pointer_set(regs, addr + 4); 111 112 return true; 113 } 114 115 bool __kprobes simulate_branch(u32 opcode, unsigned long addr, struct pt_regs *regs) 116 { 117 /* 118 * branch instructions: 119 * 31 30 25 24 20 19 15 14 12 11 8 7 6 0 120 * | imm[12] | imm[10:5] | rs2 | rs1 | funct3 | imm[4:1] | imm[11] | opcode | 121 * 1 6 5 5 3 4 1 7 122 * imm[12|10:5] rs2 rs1 000 imm[4:1|11] 1100011 BEQ 123 * imm[12|10:5] rs2 rs1 001 imm[4:1|11] 1100011 BNE 124 * imm[12|10:5] rs2 rs1 100 imm[4:1|11] 1100011 BLT 125 * imm[12|10:5] rs2 rs1 101 imm[4:1|11] 1100011 BGE 126 * imm[12|10:5] rs2 rs1 110 imm[4:1|11] 1100011 BLTU 127 * imm[12|10:5] rs2 rs1 111 imm[4:1|11] 1100011 BGEU 128 */ 129 130 s32 offset; 131 s32 offset_tmp; 132 unsigned long rs1_val; 133 unsigned long rs2_val; 134 135 if (!rv_insn_reg_get_val(regs, RV_EXTRACT_RS1_REG(opcode), &rs1_val) || 136 !rv_insn_reg_get_val(regs, RV_EXTRACT_RS2_REG(opcode), &rs2_val)) 137 return false; 138 139 offset_tmp = RV_EXTRACT_BTYPE_IMM(opcode); 140 switch (RV_EXTRACT_FUNCT3(opcode)) { 141 case RVG_FUNCT3_BEQ: 142 offset = (rs1_val == rs2_val) ? offset_tmp : 4; 143 break; 144 case RVG_FUNCT3_BNE: 145 offset = (rs1_val != rs2_val) ? offset_tmp : 4; 146 break; 147 case RVG_FUNCT3_BLT: 148 offset = ((long)rs1_val < (long)rs2_val) ? offset_tmp : 4; 149 break; 150 case RVG_FUNCT3_BGE: 151 offset = ((long)rs1_val >= (long)rs2_val) ? offset_tmp : 4; 152 break; 153 case RVG_FUNCT3_BLTU: 154 offset = (rs1_val < rs2_val) ? offset_tmp : 4; 155 break; 156 case RVG_FUNCT3_BGEU: 157 offset = (rs1_val >= rs2_val) ? offset_tmp : 4; 158 break; 159 default: 160 return false; 161 } 162 163 instruction_pointer_set(regs, addr + offset); 164 165 return true; 166 } 167 168 bool __kprobes simulate_c_j(u32 opcode, unsigned long addr, struct pt_regs *regs) 169 { 170 s32 offset = RVC_EXTRACT_JTYPE_IMM(opcode); 171 172 instruction_pointer_set(regs, addr + offset); 173 174 return true; 175 } 176 177 static bool __kprobes simulate_c_jr_jalr(u32 opcode, unsigned long addr, struct pt_regs *regs, 178 bool is_jalr) 179 { 180 /* 181 * 15 12 11 7 6 2 1 0 182 * | funct4 | rs1 | rs2 | op | 183 * 4 5 5 2 184 */ 185 186 unsigned long jump_addr; 187 188 u32 rs1 = RVC_EXTRACT_C2_RS1_REG(opcode); 189 190 if (rs1 == 0) /* C.JR is only valid when rs1 != x0 */ 191 return false; 192 193 if (!rv_insn_reg_get_val(regs, rs1, &jump_addr)) 194 return false; 195 196 if (is_jalr && !rv_insn_reg_set_val(regs, 1, addr + 2)) 197 return false; 198 199 instruction_pointer_set(regs, jump_addr); 200 201 return true; 202 } 203 204 bool __kprobes simulate_c_jr(u32 opcode, unsigned long addr, struct pt_regs *regs) 205 { 206 return simulate_c_jr_jalr(opcode, addr, regs, false); 207 } 208 209 bool __kprobes simulate_c_jalr(u32 opcode, unsigned long addr, struct pt_regs *regs) 210 { 211 return simulate_c_jr_jalr(opcode, addr, regs, true); 212 } 213 214 static bool __kprobes simulate_c_bnez_beqz(u32 opcode, unsigned long addr, struct pt_regs *regs, 215 bool is_bnez) 216 { 217 /* 218 * 15 13 12 10 9 7 6 2 1 0 219 * | funct3 | offset[8|4:3] | rs1' | offset[7:6|2:1|5] | op | 220 * 3 3 3 5 2 221 */ 222 223 s32 offset; 224 u32 rs1; 225 unsigned long rs1_val; 226 227 rs1 = 0x8 | ((opcode >> 7) & 0x7); 228 229 if (!rv_insn_reg_get_val(regs, rs1, &rs1_val)) 230 return false; 231 232 if ((rs1_val != 0 && is_bnez) || (rs1_val == 0 && !is_bnez)) 233 offset = RVC_EXTRACT_BTYPE_IMM(opcode); 234 else 235 offset = 2; 236 237 instruction_pointer_set(regs, addr + offset); 238 239 return true; 240 } 241 242 bool __kprobes simulate_c_bnez(u32 opcode, unsigned long addr, struct pt_regs *regs) 243 { 244 return simulate_c_bnez_beqz(opcode, addr, regs, true); 245 } 246 247 bool __kprobes simulate_c_beqz(u32 opcode, unsigned long addr, struct pt_regs *regs) 248 { 249 return simulate_c_bnez_beqz(opcode, addr, regs, false); 250 } 251