1 | /* SPDX-License-Identifier: GPL-2.0-only */ |
2 | /* |
3 | * arch/arm/probes/decode.h |
4 | * |
5 | * Copyright (C) 2011 Jon Medhurst <tixy@yxit.co.uk>. |
6 | * |
7 | * Some contents moved here from arch/arm/include/asm/kprobes.h which is |
8 | * Copyright (C) 2006, 2007 Motorola Inc. |
9 | */ |
10 | |
11 | #ifndef _ARM_KERNEL_PROBES_H |
12 | #define _ARM_KERNEL_PROBES_H |
13 | |
14 | #include <linux/types.h> |
15 | #include <linux/stddef.h> |
16 | #include <asm/probes.h> |
17 | #include <asm/ptrace.h> |
18 | #include <asm/kprobes.h> |
19 | |
20 | void __init arm_probes_decode_init(void); |
21 | |
22 | extern probes_check_cc * const probes_condition_checks[16]; |
23 | |
24 | #if __LINUX_ARM_ARCH__ >= 7 |
25 | |
26 | /* str_pc_offset is architecturally defined from ARMv7 onwards */ |
27 | #define str_pc_offset 8 |
28 | #define find_str_pc_offset() |
29 | |
30 | #else /* __LINUX_ARM_ARCH__ < 7 */ |
31 | |
32 | /* We need a run-time check to determine str_pc_offset */ |
33 | extern int str_pc_offset; |
34 | void __init find_str_pc_offset(void); |
35 | |
36 | #endif |
37 | |
38 | |
39 | static inline void __kprobes bx_write_pc(long pcv, struct pt_regs *regs) |
40 | { |
41 | long cpsr = regs->ARM_cpsr; |
42 | if (pcv & 0x1) { |
43 | cpsr |= PSR_T_BIT; |
44 | pcv &= ~0x1; |
45 | } else { |
46 | cpsr &= ~PSR_T_BIT; |
47 | pcv &= ~0x2; /* Avoid UNPREDICTABLE address allignment */ |
48 | } |
49 | regs->ARM_cpsr = cpsr; |
50 | regs->ARM_pc = pcv; |
51 | } |
52 | |
53 | |
54 | #if __LINUX_ARM_ARCH__ >= 6 |
55 | |
56 | /* Kernels built for >= ARMv6 should never run on <= ARMv5 hardware, so... */ |
57 | #define load_write_pc_interworks true |
58 | #define test_load_write_pc_interworking() |
59 | |
60 | #else /* __LINUX_ARM_ARCH__ < 6 */ |
61 | |
62 | /* We need run-time testing to determine if load_write_pc() should interwork. */ |
63 | extern bool load_write_pc_interworks; |
64 | void __init test_load_write_pc_interworking(void); |
65 | |
66 | #endif |
67 | |
68 | static inline void __kprobes load_write_pc(long pcv, struct pt_regs *regs) |
69 | { |
70 | if (load_write_pc_interworks) |
71 | bx_write_pc(pcv, regs); |
72 | else |
73 | regs->ARM_pc = pcv; |
74 | } |
75 | |
76 | |
77 | #if __LINUX_ARM_ARCH__ >= 7 |
78 | |
79 | #define alu_write_pc_interworks true |
80 | #define test_alu_write_pc_interworking() |
81 | |
82 | #elif __LINUX_ARM_ARCH__ <= 5 |
83 | |
84 | /* Kernels built for <= ARMv5 should never run on >= ARMv6 hardware, so... */ |
85 | #define alu_write_pc_interworks false |
86 | #define test_alu_write_pc_interworking() |
87 | |
88 | #else /* __LINUX_ARM_ARCH__ == 6 */ |
89 | |
90 | /* We could be an ARMv6 binary on ARMv7 hardware so we need a run-time check. */ |
91 | extern bool alu_write_pc_interworks; |
92 | void __init test_alu_write_pc_interworking(void); |
93 | |
94 | #endif /* __LINUX_ARM_ARCH__ == 6 */ |
95 | |
96 | static inline void __kprobes alu_write_pc(long pcv, struct pt_regs *regs) |
97 | { |
98 | if (alu_write_pc_interworks) |
99 | bx_write_pc(pcv, regs); |
100 | else |
101 | regs->ARM_pc = pcv; |
102 | } |
103 | |
104 | |
105 | /* |
106 | * Test if load/store instructions writeback the address register. |
107 | * if P (bit 24) == 0 or W (bit 21) == 1 |
108 | */ |
109 | #define is_writeback(insn) ((insn ^ 0x01000000) & 0x01200000) |
110 | |
111 | /* |
112 | * The following definitions and macros are used to build instruction |
113 | * decoding tables for use by probes_decode_insn. |
114 | * |
115 | * These tables are a concatenation of entries each of which consist of one of |
116 | * the decode_* structs. All of the fields in every type of decode structure |
117 | * are of the union type decode_item, therefore the entire decode table can be |
118 | * viewed as an array of these and declared like: |
119 | * |
120 | * static const union decode_item table_name[] = {}; |
121 | * |
122 | * In order to construct each entry in the table, macros are used to |
123 | * initialise a number of sequential decode_item values in a layout which |
124 | * matches the relevant struct. E.g. DECODE_SIMULATE initialise a struct |
125 | * decode_simulate by initialising four decode_item objects like this... |
126 | * |
127 | * {.bits = _type}, |
128 | * {.bits = _mask}, |
129 | * {.bits = _value}, |
130 | * {.action = _handler}, |
131 | * |
132 | * Initialising a specified member of the union means that the compiler |
133 | * will produce a warning if the argument is of an incorrect type. |
134 | * |
135 | * Below is a list of each of the macros used to initialise entries and a |
136 | * description of the action performed when that entry is matched to an |
137 | * instruction. A match is found when (instruction & mask) == value. |
138 | * |
139 | * DECODE_TABLE(mask, value, table) |
140 | * Instruction decoding jumps to parsing the new sub-table 'table'. |
141 | * |
142 | * DECODE_CUSTOM(mask, value, decoder) |
143 | * The value of 'decoder' is used as an index into the array of |
144 | * action functions, and the retrieved decoder function is invoked |
145 | * to complete decoding of the instruction. |
146 | * |
147 | * DECODE_SIMULATE(mask, value, handler) |
148 | * The probes instruction handler is set to the value found by |
149 | * indexing into the action array using the value of 'handler'. This |
150 | * will be used to simulate the instruction when the probe is hit. |
151 | * Decoding returns with INSN_GOOD_NO_SLOT. |
152 | * |
153 | * DECODE_EMULATE(mask, value, handler) |
154 | * The probes instruction handler is set to the value found by |
155 | * indexing into the action array using the value of 'handler'. This |
156 | * will be used to emulate the instruction when the probe is hit. The |
157 | * modified instruction (see below) is placed in the probes instruction |
158 | * slot so it may be called by the emulation code. Decoding returns |
159 | * with INSN_GOOD. |
160 | * |
161 | * DECODE_REJECT(mask, value) |
162 | * Instruction decoding fails with INSN_REJECTED |
163 | * |
164 | * DECODE_OR(mask, value) |
165 | * This allows the mask/value test of multiple table entries to be |
166 | * logically ORed. Once an 'or' entry is matched the decoding action to |
167 | * be performed is that of the next entry which isn't an 'or'. E.g. |
168 | * |
169 | * DECODE_OR (mask1, value1) |
170 | * DECODE_OR (mask2, value2) |
171 | * DECODE_SIMULATE (mask3, value3, simulation_handler) |
172 | * |
173 | * This means that if any of the three mask/value pairs match the |
174 | * instruction being decoded, then 'simulation_handler' will be used |
175 | * for it. |
176 | * |
177 | * Both the SIMULATE and EMULATE macros have a second form which take an |
178 | * additional 'regs' argument. |
179 | * |
180 | * DECODE_SIMULATEX(mask, value, handler, regs) |
181 | * DECODE_EMULATEX (mask, value, handler, regs) |
182 | * |
183 | * These are used to specify what kind of CPU register is encoded in each of the |
184 | * least significant 5 nibbles of the instruction being decoded. The regs value |
185 | * is specified using the REGS macro, this takes any of the REG_TYPE_* values |
186 | * from enum decode_reg_type as arguments; only the '*' part of the name is |
187 | * given. E.g. |
188 | * |
189 | * REGS(0, ANY, NOPC, 0, ANY) |
190 | * |
191 | * This indicates an instruction is encoded like: |
192 | * |
193 | * bits 19..16 ignore |
194 | * bits 15..12 any register allowed here |
195 | * bits 11.. 8 any register except PC allowed here |
196 | * bits 7.. 4 ignore |
197 | * bits 3.. 0 any register allowed here |
198 | * |
199 | * This register specification is checked after a decode table entry is found to |
200 | * match an instruction (through the mask/value test). Any invalid register then |
201 | * found in the instruction will cause decoding to fail with INSN_REJECTED. In |
202 | * the above example this would happen if bits 11..8 of the instruction were |
203 | * 1111, indicating R15 or PC. |
204 | * |
205 | * As well as checking for legal combinations of registers, this data is also |
206 | * used to modify the registers encoded in the instructions so that an |
207 | * emulation routines can use it. (See decode_regs() and INSN_NEW_BITS.) |
208 | * |
209 | * Here is a real example which matches ARM instructions of the form |
210 | * "AND <Rd>,<Rn>,<Rm>,<shift> <Rs>" |
211 | * |
212 | * DECODE_EMULATEX (0x0e000090, 0x00000010, PROBES_DATA_PROCESSING_REG, |
213 | * REGS(ANY, ANY, NOPC, 0, ANY)), |
214 | * ^ ^ ^ ^ |
215 | * Rn Rd Rs Rm |
216 | * |
217 | * Decoding the instruction "AND R4, R5, R6, ASL R15" will be rejected because |
218 | * Rs == R15 |
219 | * |
220 | * Decoding the instruction "AND R4, R5, R6, ASL R7" will be accepted and the |
221 | * instruction will be modified to "AND R0, R2, R3, ASL R1" and then placed into |
222 | * the kprobes instruction slot. This can then be called later by the handler |
223 | * function emulate_rd12rn16rm0rs8_rwflags (a pointer to which is retrieved from |
224 | * the indicated slot in the action array), in order to simulate the instruction. |
225 | */ |
226 | |
227 | enum decode_type { |
228 | DECODE_TYPE_END, |
229 | DECODE_TYPE_TABLE, |
230 | DECODE_TYPE_CUSTOM, |
231 | DECODE_TYPE_SIMULATE, |
232 | DECODE_TYPE_EMULATE, |
233 | DECODE_TYPE_OR, |
234 | DECODE_TYPE_REJECT, |
235 | NUM_DECODE_TYPES /* Must be last enum */ |
236 | }; |
237 | |
238 | #define DECODE_TYPE_BITS 4 |
239 | #define DECODE_TYPE_MASK ((1 << DECODE_TYPE_BITS) - 1) |
240 | |
241 | enum decode_reg_type { |
242 | REG_TYPE_NONE = 0, /* Not a register, ignore */ |
243 | REG_TYPE_ANY, /* Any register allowed */ |
244 | REG_TYPE_SAMEAS16, /* Register should be same as that at bits 19..16 */ |
245 | REG_TYPE_SP, /* Register must be SP */ |
246 | REG_TYPE_PC, /* Register must be PC */ |
247 | REG_TYPE_NOSP, /* Register must not be SP */ |
248 | REG_TYPE_NOSPPC, /* Register must not be SP or PC */ |
249 | REG_TYPE_NOPC, /* Register must not be PC */ |
250 | REG_TYPE_NOPCWB, /* No PC if load/store write-back flag also set */ |
251 | |
252 | /* The following types are used when the encoding for PC indicates |
253 | * another instruction form. This distiction only matters for test |
254 | * case coverage checks. |
255 | */ |
256 | REG_TYPE_NOPCX, /* Register must not be PC */ |
257 | REG_TYPE_NOSPPCX, /* Register must not be SP or PC */ |
258 | |
259 | /* Alias to allow '0' arg to be used in REGS macro. */ |
260 | REG_TYPE_0 = REG_TYPE_NONE |
261 | }; |
262 | |
263 | #define REGS(r16, r12, r8, r4, r0) \ |
264 | (((REG_TYPE_##r16) << 16) + \ |
265 | ((REG_TYPE_##r12) << 12) + \ |
266 | ((REG_TYPE_##r8) << 8) + \ |
267 | ((REG_TYPE_##r4) << 4) + \ |
268 | (REG_TYPE_##r0)) |
269 | |
270 | union decode_item { |
271 | u32 bits; |
272 | const union decode_item *table; |
273 | int action; |
274 | }; |
275 | |
276 | struct decode_header; |
277 | typedef enum probes_insn (probes_custom_decode_t)(probes_opcode_t, |
278 | struct arch_probes_insn *, |
279 | const struct decode_header *); |
280 | |
281 | union decode_action { |
282 | probes_insn_handler_t *handler; |
283 | probes_custom_decode_t *decoder; |
284 | }; |
285 | |
286 | typedef enum probes_insn (probes_check_t)(probes_opcode_t, |
287 | struct arch_probes_insn *, |
288 | const struct decode_header *); |
289 | |
290 | struct decode_checker { |
291 | probes_check_t *checker; |
292 | }; |
293 | |
294 | #define DECODE_END \ |
295 | {.bits = DECODE_TYPE_END} |
296 | |
297 | |
298 | struct { |
299 | union decode_item ; |
300 | union decode_item ; |
301 | union decode_item ; |
302 | }; |
303 | |
304 | #define (_type, _mask, _value, _regs) \ |
305 | {.bits = (_type) | ((_regs) << DECODE_TYPE_BITS)}, \ |
306 | {.bits = (_mask)}, \ |
307 | {.bits = (_value)} |
308 | |
309 | |
310 | struct decode_table { |
311 | struct decode_header ; |
312 | union decode_item table; |
313 | }; |
314 | |
315 | #define DECODE_TABLE(_mask, _value, _table) \ |
316 | DECODE_HEADER(DECODE_TYPE_TABLE, _mask, _value, 0), \ |
317 | {.table = (_table)} |
318 | |
319 | |
320 | struct decode_custom { |
321 | struct decode_header ; |
322 | union decode_item decoder; |
323 | }; |
324 | |
325 | #define DECODE_CUSTOM(_mask, _value, _decoder) \ |
326 | DECODE_HEADER(DECODE_TYPE_CUSTOM, _mask, _value, 0), \ |
327 | {.action = (_decoder)} |
328 | |
329 | |
330 | struct decode_simulate { |
331 | struct decode_header ; |
332 | union decode_item handler; |
333 | }; |
334 | |
335 | #define DECODE_SIMULATEX(_mask, _value, _handler, _regs) \ |
336 | DECODE_HEADER(DECODE_TYPE_SIMULATE, _mask, _value, _regs), \ |
337 | {.action = (_handler)} |
338 | |
339 | #define DECODE_SIMULATE(_mask, _value, _handler) \ |
340 | DECODE_SIMULATEX(_mask, _value, _handler, 0) |
341 | |
342 | |
343 | struct decode_emulate { |
344 | struct decode_header ; |
345 | union decode_item handler; |
346 | }; |
347 | |
348 | #define DECODE_EMULATEX(_mask, _value, _handler, _regs) \ |
349 | DECODE_HEADER(DECODE_TYPE_EMULATE, _mask, _value, _regs), \ |
350 | {.action = (_handler)} |
351 | |
352 | #define DECODE_EMULATE(_mask, _value, _handler) \ |
353 | DECODE_EMULATEX(_mask, _value, _handler, 0) |
354 | |
355 | |
356 | struct decode_or { |
357 | struct decode_header ; |
358 | }; |
359 | |
360 | #define DECODE_OR(_mask, _value) \ |
361 | DECODE_HEADER(DECODE_TYPE_OR, _mask, _value, 0) |
362 | |
363 | enum probes_insn { |
364 | INSN_REJECTED, |
365 | INSN_GOOD, |
366 | INSN_GOOD_NO_SLOT |
367 | }; |
368 | |
369 | struct decode_reject { |
370 | struct decode_header ; |
371 | }; |
372 | |
373 | #define DECODE_REJECT(_mask, _value) \ |
374 | DECODE_HEADER(DECODE_TYPE_REJECT, _mask, _value, 0) |
375 | |
376 | probes_insn_handler_t probes_simulate_nop; |
377 | probes_insn_handler_t probes_emulate_none; |
378 | |
379 | int __kprobes |
380 | probes_decode_insn(probes_opcode_t insn, struct arch_probes_insn *asi, |
381 | const union decode_item *table, bool thumb, bool emulate, |
382 | const union decode_action *actions, |
383 | const struct decode_checker **checkers); |
384 | |
385 | #endif |
386 | |