Jon Medhurst | 221bf15 | 2011-04-20 10:52:38 +0100 | [diff] [blame] | 1 | /* |
| 2 | * arch/arm/kernel/kprobes.h |
| 3 | * |
Jon Medhurst | 0d1a095 | 2011-04-26 15:15:56 +0100 | [diff] [blame] | 4 | * Copyright (C) 2011 Jon Medhurst <tixy@yxit.co.uk>. |
| 5 | * |
| 6 | * Some contents moved here from arch/arm/include/asm/kprobes.h which is |
Jon Medhurst | 221bf15 | 2011-04-20 10:52:38 +0100 | [diff] [blame] | 7 | * Copyright (C) 2006, 2007 Motorola Inc. |
| 8 | * |
| 9 | * This program is free software; you can redistribute it and/or modify |
| 10 | * it under the terms of the GNU General Public License version 2 as |
| 11 | * published by the Free Software Foundation. |
| 12 | * |
| 13 | * This program is distributed in the hope that it will be useful, |
| 14 | * but WITHOUT ANY WARRANTY; without even the implied warranty of |
| 15 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU |
| 16 | * General Public License for more details. |
| 17 | */ |
| 18 | |
| 19 | #ifndef _ARM_KERNEL_KPROBES_H |
| 20 | #define _ARM_KERNEL_KPROBES_H |
| 21 | |
| 22 | /* |
Jon Medhurst | aceb487 | 2011-04-19 17:18:35 +0100 | [diff] [blame] | 23 | * These undefined instructions must be unique and |
Jon Medhurst | 221bf15 | 2011-04-20 10:52:38 +0100 | [diff] [blame] | 24 | * reserved solely for kprobes' use. |
| 25 | */ |
Jon Medhurst | 3b26945 | 2011-06-16 17:22:37 +0100 | [diff] [blame] | 26 | #define KPROBE_ARM_BREAKPOINT_INSTRUCTION 0x07f001f8 |
Jon Medhurst | aceb487 | 2011-04-19 17:18:35 +0100 | [diff] [blame] | 27 | #define KPROBE_THUMB16_BREAKPOINT_INSTRUCTION 0xde18 |
| 28 | #define KPROBE_THUMB32_BREAKPOINT_INSTRUCTION 0xf7f0a018 |
| 29 | |
Jon Medhurst | 221bf15 | 2011-04-20 10:52:38 +0100 | [diff] [blame] | 30 | |
| 31 | enum kprobe_insn { |
| 32 | INSN_REJECTED, |
| 33 | INSN_GOOD, |
| 34 | INSN_GOOD_NO_SLOT |
| 35 | }; |
| 36 | |
Jon Medhurst | 2437170 | 2011-04-19 17:56:58 +0100 | [diff] [blame] | 37 | typedef enum kprobe_insn (kprobe_decode_insn_t)(kprobe_opcode_t, |
| 38 | struct arch_specific_insn *); |
| 39 | |
| 40 | #ifdef CONFIG_THUMB2_KERNEL |
| 41 | |
| 42 | enum kprobe_insn thumb16_kprobe_decode_insn(kprobe_opcode_t, |
| 43 | struct arch_specific_insn *); |
| 44 | enum kprobe_insn thumb32_kprobe_decode_insn(kprobe_opcode_t, |
| 45 | struct arch_specific_insn *); |
| 46 | |
| 47 | #else /* !CONFIG_THUMB2_KERNEL */ |
| 48 | |
Jon Medhurst | 221bf15 | 2011-04-20 10:52:38 +0100 | [diff] [blame] | 49 | enum kprobe_insn arm_kprobe_decode_insn(kprobe_opcode_t, |
| 50 | struct arch_specific_insn *); |
Jon Medhurst | 2437170 | 2011-04-19 17:56:58 +0100 | [diff] [blame] | 51 | #endif |
Jon Medhurst | 221bf15 | 2011-04-20 10:52:38 +0100 | [diff] [blame] | 52 | |
| 53 | void __init arm_kprobe_decode_init(void); |
| 54 | |
Jon Medhurst | 0ab4c02 | 2011-07-06 11:25:18 +0100 | [diff] [blame] | 55 | extern kprobe_check_cc * const kprobe_condition_checks[16]; |
| 56 | |
Jon Medhurst | aea4902 | 2011-07-07 19:58:29 +0100 | [diff] [blame] | 57 | |
| 58 | #if __LINUX_ARM_ARCH__ >= 7 |
| 59 | |
| 60 | /* str_pc_offset is architecturally defined from ARMv7 onwards */ |
| 61 | #define str_pc_offset 8 |
| 62 | #define find_str_pc_offset() |
| 63 | |
| 64 | #else /* __LINUX_ARM_ARCH__ < 7 */ |
| 65 | |
| 66 | /* We need a run-time check to determine str_pc_offset */ |
Jon Medhurst | 6c8df33 | 2011-07-07 10:21:40 +0100 | [diff] [blame] | 67 | extern int str_pc_offset; |
Jon Medhurst | aea4902 | 2011-07-07 19:58:29 +0100 | [diff] [blame] | 68 | void __init find_str_pc_offset(void); |
| 69 | |
| 70 | #endif |
| 71 | |
Jon Medhurst | 6c8df33 | 2011-07-07 10:21:40 +0100 | [diff] [blame] | 72 | |
Jon Medhurst | 1b59d87 | 2011-07-06 20:33:41 +0100 | [diff] [blame] | 73 | /* |
Jon Medhurst | 6aaa8b5 | 2011-06-16 14:53:56 +0100 | [diff] [blame] | 74 | * Update ITSTATE after normal execution of an IT block instruction. |
| 75 | * |
| 76 | * The 8 IT state bits are split into two parts in CPSR: |
| 77 | * ITSTATE<1:0> are in CPSR<26:25> |
| 78 | * ITSTATE<7:2> are in CPSR<15:10> |
| 79 | */ |
| 80 | static inline unsigned long it_advance(unsigned long cpsr) |
| 81 | { |
| 82 | if ((cpsr & 0x06000400) == 0) { |
| 83 | /* ITSTATE<2:0> == 0 means end of IT block, so clear IT state */ |
| 84 | cpsr &= ~PSR_IT_MASK; |
| 85 | } else { |
| 86 | /* We need to shift left ITSTATE<4:0> */ |
| 87 | const unsigned long mask = 0x06001c00; /* Mask ITSTATE<4:0> */ |
| 88 | unsigned long it = cpsr & mask; |
| 89 | it <<= 1; |
| 90 | it |= it >> (27 - 10); /* Carry ITSTATE<2> to correct place */ |
| 91 | it &= mask; |
| 92 | cpsr &= ~mask; |
| 93 | cpsr |= it; |
| 94 | } |
| 95 | return cpsr; |
| 96 | } |
| 97 | |
Jon Medhurst | 059987f | 2011-06-09 11:01:54 +0100 | [diff] [blame] | 98 | static inline void __kprobes bx_write_pc(long pcv, struct pt_regs *regs) |
| 99 | { |
| 100 | long cpsr = regs->ARM_cpsr; |
| 101 | if (pcv & 0x1) { |
| 102 | cpsr |= PSR_T_BIT; |
| 103 | pcv &= ~0x1; |
| 104 | } else { |
| 105 | cpsr &= ~PSR_T_BIT; |
| 106 | pcv &= ~0x2; /* Avoid UNPREDICTABLE address allignment */ |
| 107 | } |
| 108 | regs->ARM_cpsr = cpsr; |
| 109 | regs->ARM_pc = pcv; |
| 110 | } |
| 111 | |
Jon Medhurst | 263e368 | 2011-06-10 20:29:04 +0100 | [diff] [blame] | 112 | |
| 113 | #if __LINUX_ARM_ARCH__ >= 6 |
| 114 | |
| 115 | /* Kernels built for >= ARMv6 should never run on <= ARMv5 hardware, so... */ |
| 116 | #define load_write_pc_interworks true |
| 117 | #define test_load_write_pc_interworking() |
| 118 | |
| 119 | #else /* __LINUX_ARM_ARCH__ < 6 */ |
| 120 | |
| 121 | /* We need run-time testing to determine if load_write_pc() should interwork. */ |
| 122 | extern bool load_write_pc_interworks; |
| 123 | void __init test_load_write_pc_interworking(void); |
| 124 | |
| 125 | #endif |
| 126 | |
| 127 | static inline void __kprobes load_write_pc(long pcv, struct pt_regs *regs) |
| 128 | { |
| 129 | if (load_write_pc_interworks) |
| 130 | bx_write_pc(pcv, regs); |
| 131 | else |
| 132 | regs->ARM_pc = pcv; |
| 133 | } |
| 134 | |
| 135 | |
Jon Medhurst | df4fa1f | 2011-07-01 17:32:06 +0100 | [diff] [blame] | 136 | #if __LINUX_ARM_ARCH__ >= 7 |
| 137 | |
| 138 | #define alu_write_pc_interworks true |
| 139 | #define test_alu_write_pc_interworking() |
| 140 | |
| 141 | #elif __LINUX_ARM_ARCH__ <= 5 |
| 142 | |
| 143 | /* Kernels built for <= ARMv5 should never run on >= ARMv6 hardware, so... */ |
| 144 | #define alu_write_pc_interworks false |
| 145 | #define test_alu_write_pc_interworking() |
| 146 | |
| 147 | #else /* __LINUX_ARM_ARCH__ == 6 */ |
| 148 | |
| 149 | /* We could be an ARMv6 binary on ARMv7 hardware so we need a run-time check. */ |
| 150 | extern bool alu_write_pc_interworks; |
| 151 | void __init test_alu_write_pc_interworking(void); |
| 152 | |
| 153 | #endif /* __LINUX_ARM_ARCH__ == 6 */ |
| 154 | |
| 155 | static inline void __kprobes alu_write_pc(long pcv, struct pt_regs *regs) |
| 156 | { |
| 157 | if (alu_write_pc_interworks) |
| 158 | bx_write_pc(pcv, regs); |
| 159 | else |
| 160 | regs->ARM_pc = pcv; |
| 161 | } |
| 162 | |
| 163 | |
Jon Medhurst | 3f92dfe | 2011-07-02 15:36:32 +0100 | [diff] [blame] | 164 | void __kprobes kprobe_simulate_nop(struct kprobe *p, struct pt_regs *regs); |
| 165 | void __kprobes kprobe_emulate_none(struct kprobe *p, struct pt_regs *regs); |
| 166 | |
Jon Medhurst | 235a4ce | 2011-07-07 08:57:22 +0100 | [diff] [blame] | 167 | enum kprobe_insn __kprobes |
| 168 | kprobe_decode_ldmstm(kprobe_opcode_t insn, struct arch_specific_insn *asi); |
| 169 | |
Jon Medhurst | 6aaa8b5 | 2011-06-16 14:53:56 +0100 | [diff] [blame] | 170 | /* |
Jon Medhurst | 1b59d87 | 2011-07-06 20:33:41 +0100 | [diff] [blame] | 171 | * Test if load/store instructions writeback the address register. |
| 172 | * if P (bit 24) == 0 or W (bit 21) == 1 |
| 173 | */ |
| 174 | #define is_writeback(insn) ((insn ^ 0x01000000) & 0x01200000) |
| 175 | |
Jon Medhurst | 0d1a095 | 2011-04-26 15:15:56 +0100 | [diff] [blame] | 176 | /* |
| 177 | * The following definitions and macros are used to build instruction |
| 178 | * decoding tables for use by kprobe_decode_insn. |
| 179 | * |
| 180 | * These tables are a concatenation of entries each of which consist of one of |
| 181 | * the decode_* structs. All of the fields in every type of decode structure |
| 182 | * are of the union type decode_item, therefore the entire decode table can be |
| 183 | * viewed as an array of these and declared like: |
| 184 | * |
| 185 | * static const union decode_item table_name[] = {}; |
| 186 | * |
| 187 | * In order to construct each entry in the table, macros are used to |
| 188 | * initialise a number of sequential decode_item values in a layout which |
| 189 | * matches the relevant struct. E.g. DECODE_SIMULATE initialise a struct |
| 190 | * decode_simulate by initialising four decode_item objects like this... |
| 191 | * |
| 192 | * {.bits = _type}, |
| 193 | * {.bits = _mask}, |
| 194 | * {.bits = _value}, |
| 195 | * {.handler = _handler}, |
| 196 | * |
| 197 | * Initialising a specified member of the union means that the compiler |
| 198 | * will produce a warning if the argument is of an incorrect type. |
| 199 | * |
| 200 | * Below is a list of each of the macros used to initialise entries and a |
| 201 | * description of the action performed when that entry is matched to an |
| 202 | * instruction. A match is found when (instruction & mask) == value. |
| 203 | * |
| 204 | * DECODE_TABLE(mask, value, table) |
| 205 | * Instruction decoding jumps to parsing the new sub-table 'table'. |
| 206 | * |
| 207 | * DECODE_CUSTOM(mask, value, decoder) |
| 208 | * The custom function 'decoder' is called to the complete decoding |
| 209 | * of an instruction. |
| 210 | * |
| 211 | * DECODE_SIMULATE(mask, value, handler) |
| 212 | * Set the probes instruction handler to 'handler', this will be used |
| 213 | * to simulate the instruction when the probe is hit. Decoding returns |
| 214 | * with INSN_GOOD_NO_SLOT. |
| 215 | * |
| 216 | * DECODE_EMULATE(mask, value, handler) |
| 217 | * Set the probes instruction handler to 'handler', this will be used |
| 218 | * to emulate the instruction when the probe is hit. The modified |
| 219 | * instruction (see below) is placed in the probes instruction slot so it |
| 220 | * may be called by the emulation code. Decoding returns with INSN_GOOD. |
| 221 | * |
| 222 | * DECODE_REJECT(mask, value) |
| 223 | * Instruction decoding fails with INSN_REJECTED |
| 224 | * |
| 225 | * DECODE_OR(mask, value) |
| 226 | * This allows the mask/value test of multiple table entries to be |
| 227 | * logically ORed. Once an 'or' entry is matched the decoding action to |
| 228 | * be performed is that of the next entry which isn't an 'or'. E.g. |
| 229 | * |
| 230 | * DECODE_OR (mask1, value1) |
| 231 | * DECODE_OR (mask2, value2) |
| 232 | * DECODE_SIMULATE (mask3, value3, simulation_handler) |
| 233 | * |
| 234 | * This means that if any of the three mask/value pairs match the |
| 235 | * instruction being decoded, then 'simulation_handler' will be used |
| 236 | * for it. |
| 237 | * |
| 238 | * Both the SIMULATE and EMULATE macros have a second form which take an |
| 239 | * additional 'regs' argument. |
| 240 | * |
| 241 | * DECODE_SIMULATEX(mask, value, handler, regs) |
| 242 | * DECODE_EMULATEX (mask, value, handler, regs) |
| 243 | * |
| 244 | * These are used to specify what kind of CPU register is encoded in each of the |
| 245 | * least significant 5 nibbles of the instruction being decoded. The regs value |
| 246 | * is specified using the REGS macro, this takes any of the REG_TYPE_* values |
| 247 | * from enum decode_reg_type as arguments; only the '*' part of the name is |
| 248 | * given. E.g. |
| 249 | * |
| 250 | * REGS(0, ANY, NOPC, 0, ANY) |
| 251 | * |
| 252 | * This indicates an instruction is encoded like: |
| 253 | * |
| 254 | * bits 19..16 ignore |
| 255 | * bits 15..12 any register allowed here |
| 256 | * bits 11.. 8 any register except PC allowed here |
| 257 | * bits 7.. 4 ignore |
| 258 | * bits 3.. 0 any register allowed here |
| 259 | * |
| 260 | * This register specification is checked after a decode table entry is found to |
| 261 | * match an instruction (through the mask/value test). Any invalid register then |
| 262 | * found in the instruction will cause decoding to fail with INSN_REJECTED. In |
| 263 | * the above example this would happen if bits 11..8 of the instruction were |
| 264 | * 1111, indicating R15 or PC. |
| 265 | * |
| 266 | * As well as checking for legal combinations of registers, this data is also |
| 267 | * used to modify the registers encoded in the instructions so that an |
| 268 | * emulation routines can use it. (See decode_regs() and INSN_NEW_BITS.) |
| 269 | * |
| 270 | * Here is a real example which matches ARM instructions of the form |
| 271 | * "AND <Rd>,<Rn>,<Rm>,<shift> <Rs>" |
| 272 | * |
| 273 | * DECODE_EMULATEX (0x0e000090, 0x00000010, emulate_rd12rn16rm0rs8_rwflags, |
| 274 | * REGS(ANY, ANY, NOPC, 0, ANY)), |
| 275 | * ^ ^ ^ ^ |
| 276 | * Rn Rd Rs Rm |
| 277 | * |
| 278 | * Decoding the instruction "AND R4, R5, R6, ASL R15" will be rejected because |
| 279 | * Rs == R15 |
| 280 | * |
| 281 | * Decoding the instruction "AND R4, R5, R6, ASL R7" will be accepted and the |
| 282 | * instruction will be modified to "AND R0, R2, R3, ASL R1" and then placed into |
| 283 | * the kprobes instruction slot. This can then be called later by the handler |
| 284 | * function emulate_rd12rn16rm0rs8_rwflags in order to simulate the instruction. |
| 285 | */ |
| 286 | |
| 287 | enum decode_type { |
| 288 | DECODE_TYPE_END, |
| 289 | DECODE_TYPE_TABLE, |
| 290 | DECODE_TYPE_CUSTOM, |
| 291 | DECODE_TYPE_SIMULATE, |
| 292 | DECODE_TYPE_EMULATE, |
| 293 | DECODE_TYPE_OR, |
| 294 | DECODE_TYPE_REJECT, |
| 295 | NUM_DECODE_TYPES /* Must be last enum */ |
| 296 | }; |
| 297 | |
| 298 | #define DECODE_TYPE_BITS 4 |
| 299 | #define DECODE_TYPE_MASK ((1 << DECODE_TYPE_BITS) - 1) |
| 300 | |
| 301 | enum decode_reg_type { |
| 302 | REG_TYPE_NONE = 0, /* Not a register, ignore */ |
| 303 | REG_TYPE_ANY, /* Any register allowed */ |
| 304 | REG_TYPE_SAMEAS16, /* Register should be same as that at bits 19..16 */ |
| 305 | REG_TYPE_SP, /* Register must be SP */ |
| 306 | REG_TYPE_PC, /* Register must be PC */ |
| 307 | REG_TYPE_NOSP, /* Register must not be SP */ |
| 308 | REG_TYPE_NOSPPC, /* Register must not be SP or PC */ |
| 309 | REG_TYPE_NOPC, /* Register must not be PC */ |
| 310 | REG_TYPE_NOPCWB, /* No PC if load/store write-back flag also set */ |
| 311 | |
| 312 | /* The following types are used when the encoding for PC indicates |
| 313 | * another instruction form. This distiction only matters for test |
| 314 | * case coverage checks. |
| 315 | */ |
| 316 | REG_TYPE_NOPCX, /* Register must not be PC */ |
| 317 | REG_TYPE_NOSPPCX, /* Register must not be SP or PC */ |
| 318 | |
| 319 | /* Alias to allow '0' arg to be used in REGS macro. */ |
| 320 | REG_TYPE_0 = REG_TYPE_NONE |
| 321 | }; |
| 322 | |
| 323 | #define REGS(r16, r12, r8, r4, r0) \ |
| 324 | ((REG_TYPE_##r16) << 16) + \ |
| 325 | ((REG_TYPE_##r12) << 12) + \ |
| 326 | ((REG_TYPE_##r8) << 8) + \ |
| 327 | ((REG_TYPE_##r4) << 4) + \ |
| 328 | (REG_TYPE_##r0) |
| 329 | |
| 330 | union decode_item { |
| 331 | u32 bits; |
| 332 | const union decode_item *table; |
| 333 | kprobe_insn_handler_t *handler; |
| 334 | kprobe_decode_insn_t *decoder; |
| 335 | }; |
| 336 | |
| 337 | |
| 338 | #define DECODE_END \ |
| 339 | {.bits = DECODE_TYPE_END} |
| 340 | |
| 341 | |
| 342 | struct decode_header { |
| 343 | union decode_item type_regs; |
| 344 | union decode_item mask; |
| 345 | union decode_item value; |
| 346 | }; |
| 347 | |
| 348 | #define DECODE_HEADER(_type, _mask, _value, _regs) \ |
| 349 | {.bits = (_type) | ((_regs) << DECODE_TYPE_BITS)}, \ |
| 350 | {.bits = (_mask)}, \ |
| 351 | {.bits = (_value)} |
| 352 | |
| 353 | |
| 354 | struct decode_table { |
| 355 | struct decode_header header; |
| 356 | union decode_item table; |
| 357 | }; |
| 358 | |
| 359 | #define DECODE_TABLE(_mask, _value, _table) \ |
| 360 | DECODE_HEADER(DECODE_TYPE_TABLE, _mask, _value, 0), \ |
| 361 | {.table = (_table)} |
| 362 | |
| 363 | |
| 364 | struct decode_custom { |
| 365 | struct decode_header header; |
| 366 | union decode_item decoder; |
| 367 | }; |
| 368 | |
| 369 | #define DECODE_CUSTOM(_mask, _value, _decoder) \ |
| 370 | DECODE_HEADER(DECODE_TYPE_CUSTOM, _mask, _value, 0), \ |
| 371 | {.decoder = (_decoder)} |
| 372 | |
| 373 | |
| 374 | struct decode_simulate { |
| 375 | struct decode_header header; |
| 376 | union decode_item handler; |
| 377 | }; |
| 378 | |
| 379 | #define DECODE_SIMULATEX(_mask, _value, _handler, _regs) \ |
| 380 | DECODE_HEADER(DECODE_TYPE_SIMULATE, _mask, _value, _regs), \ |
| 381 | {.handler = (_handler)} |
| 382 | |
| 383 | #define DECODE_SIMULATE(_mask, _value, _handler) \ |
| 384 | DECODE_SIMULATEX(_mask, _value, _handler, 0) |
| 385 | |
| 386 | |
| 387 | struct decode_emulate { |
| 388 | struct decode_header header; |
| 389 | union decode_item handler; |
| 390 | }; |
| 391 | |
| 392 | #define DECODE_EMULATEX(_mask, _value, _handler, _regs) \ |
| 393 | DECODE_HEADER(DECODE_TYPE_EMULATE, _mask, _value, _regs), \ |
| 394 | {.handler = (_handler)} |
| 395 | |
| 396 | #define DECODE_EMULATE(_mask, _value, _handler) \ |
| 397 | DECODE_EMULATEX(_mask, _value, _handler, 0) |
| 398 | |
| 399 | |
| 400 | struct decode_or { |
| 401 | struct decode_header header; |
| 402 | }; |
| 403 | |
| 404 | #define DECODE_OR(_mask, _value) \ |
| 405 | DECODE_HEADER(DECODE_TYPE_OR, _mask, _value, 0) |
| 406 | |
| 407 | |
| 408 | struct decode_reject { |
| 409 | struct decode_header header; |
| 410 | }; |
| 411 | |
| 412 | #define DECODE_REJECT(_mask, _value) \ |
| 413 | DECODE_HEADER(DECODE_TYPE_REJECT, _mask, _value, 0) |
| 414 | |
| 415 | |
Jon Medhurst | 2c89240 | 2011-08-27 12:37:44 +0100 | [diff] [blame] | 416 | #ifdef CONFIG_THUMB2_KERNEL |
| 417 | extern const union decode_item kprobe_decode_thumb16_table[]; |
| 418 | extern const union decode_item kprobe_decode_thumb32_table[]; |
| 419 | #else |
| 420 | extern const union decode_item kprobe_decode_arm_table[]; |
| 421 | #endif |
| 422 | |
| 423 | |
Jon Medhurst | 0d1a095 | 2011-04-26 15:15:56 +0100 | [diff] [blame] | 424 | int kprobe_decode_insn(kprobe_opcode_t insn, struct arch_specific_insn *asi, |
| 425 | const union decode_item *table, bool thumb16); |
| 426 | |
| 427 | |
Jon Medhurst | 221bf15 | 2011-04-20 10:52:38 +0100 | [diff] [blame] | 428 | #endif /* _ARM_KERNEL_KPROBES_H */ |