1 /* SPDX-License-Identifier: GPL-2.0-only */
2 /*
3 * arch/arm/probes/decode.h
4 *
5 * Copyright (C) 2011 Jon Medhurst <tixy@yxit.co.uk>.
6 *
7 * Some contents moved here from arch/arm/include/asm/kprobes.h which is
8 * Copyright (C) 2006, 2007 Motorola Inc.
9 */
10
11 #ifndef _ARM_KERNEL_PROBES_H
12 #define _ARM_KERNEL_PROBES_H
13
14 #include <linux/types.h>
15 #include <linux/stddef.h>
16 #include <asm/probes.h>
17 #include <asm/ptrace.h>
18 #include <asm/kprobes.h>
19
20 void __init arm_probes_decode_init(void);
21
22 extern probes_check_cc * const probes_condition_checks[16];
23
24 #if __LINUX_ARM_ARCH__ >= 7
25
26 /* str_pc_offset is architecturally defined from ARMv7 onwards */
27 #define str_pc_offset 8
28 #define find_str_pc_offset()
29
30 #else /* __LINUX_ARM_ARCH__ < 7 */
31
32 /* We need a run-time check to determine str_pc_offset */
33 extern int str_pc_offset;
34 void __init find_str_pc_offset(void);
35
36 #endif
37
38
bx_write_pc(long pcv,struct pt_regs * regs)39 static inline void __kprobes bx_write_pc(long pcv, struct pt_regs *regs)
40 {
41 long cpsr = regs->ARM_cpsr;
42 if (pcv & 0x1) {
43 cpsr |= PSR_T_BIT;
44 pcv &= ~0x1;
45 } else {
46 cpsr &= ~PSR_T_BIT;
47 pcv &= ~0x2; /* Avoid UNPREDICTABLE address allignment */
48 }
49 regs->ARM_cpsr = cpsr;
50 regs->ARM_pc = pcv;
51 }
52
53
54 #if __LINUX_ARM_ARCH__ >= 6
55
56 /* Kernels built for >= ARMv6 should never run on <= ARMv5 hardware, so... */
57 #define load_write_pc_interworks true
58 #define test_load_write_pc_interworking()
59
60 #else /* __LINUX_ARM_ARCH__ < 6 */
61
62 /* We need run-time testing to determine if load_write_pc() should interwork. */
63 extern bool load_write_pc_interworks;
64 void __init test_load_write_pc_interworking(void);
65
66 #endif
67
load_write_pc(long pcv,struct pt_regs * regs)68 static inline void __kprobes load_write_pc(long pcv, struct pt_regs *regs)
69 {
70 if (load_write_pc_interworks)
71 bx_write_pc(pcv, regs);
72 else
73 regs->ARM_pc = pcv;
74 }
75
76
77 #if __LINUX_ARM_ARCH__ >= 7
78
79 #define alu_write_pc_interworks true
80 #define test_alu_write_pc_interworking()
81
82 #elif __LINUX_ARM_ARCH__ <= 5
83
84 /* Kernels built for <= ARMv5 should never run on >= ARMv6 hardware, so... */
85 #define alu_write_pc_interworks false
86 #define test_alu_write_pc_interworking()
87
88 #else /* __LINUX_ARM_ARCH__ == 6 */
89
90 /* We could be an ARMv6 binary on ARMv7 hardware so we need a run-time check. */
91 extern bool alu_write_pc_interworks;
92 void __init test_alu_write_pc_interworking(void);
93
94 #endif /* __LINUX_ARM_ARCH__ == 6 */
95
alu_write_pc(long pcv,struct pt_regs * regs)96 static inline void __kprobes alu_write_pc(long pcv, struct pt_regs *regs)
97 {
98 if (alu_write_pc_interworks)
99 bx_write_pc(pcv, regs);
100 else
101 regs->ARM_pc = pcv;
102 }
103
104
105 /*
106 * Test if load/store instructions writeback the address register.
107 * if P (bit 24) == 0 or W (bit 21) == 1
108 */
109 #define is_writeback(insn) ((insn ^ 0x01000000) & 0x01200000)
110
111 /*
112 * The following definitions and macros are used to build instruction
113 * decoding tables for use by probes_decode_insn.
114 *
115 * These tables are a concatenation of entries each of which consist of one of
116 * the decode_* structs. All of the fields in every type of decode structure
117 * are of the union type decode_item, therefore the entire decode table can be
118 * viewed as an array of these and declared like:
119 *
120 * static const union decode_item table_name[] = {};
121 *
122 * In order to construct each entry in the table, macros are used to
123 * initialise a number of sequential decode_item values in a layout which
124 * matches the relevant struct. E.g. DECODE_SIMULATE initialise a struct
125 * decode_simulate by initialising four decode_item objects like this...
126 *
127 * {.bits = _type},
128 * {.bits = _mask},
129 * {.bits = _value},
130 * {.action = _handler},
131 *
132 * Initialising a specified member of the union means that the compiler
133 * will produce a warning if the argument is of an incorrect type.
134 *
135 * Below is a list of each of the macros used to initialise entries and a
136 * description of the action performed when that entry is matched to an
137 * instruction. A match is found when (instruction & mask) == value.
138 *
139 * DECODE_TABLE(mask, value, table)
140 * Instruction decoding jumps to parsing the new sub-table 'table'.
141 *
142 * DECODE_CUSTOM(mask, value, decoder)
143 * The value of 'decoder' is used as an index into the array of
144 * action functions, and the retrieved decoder function is invoked
145 * to complete decoding of the instruction.
146 *
147 * DECODE_SIMULATE(mask, value, handler)
148 * The probes instruction handler is set to the value found by
149 * indexing into the action array using the value of 'handler'. This
150 * will be used to simulate the instruction when the probe is hit.
151 * Decoding returns with INSN_GOOD_NO_SLOT.
152 *
153 * DECODE_EMULATE(mask, value, handler)
154 * The probes instruction handler is set to the value found by
155 * indexing into the action array using the value of 'handler'. This
156 * will be used to emulate the instruction when the probe is hit. The
157 * modified instruction (see below) is placed in the probes instruction
158 * slot so it may be called by the emulation code. Decoding returns
159 * with INSN_GOOD.
160 *
161 * DECODE_REJECT(mask, value)
162 * Instruction decoding fails with INSN_REJECTED
163 *
164 * DECODE_OR(mask, value)
165 * This allows the mask/value test of multiple table entries to be
166 * logically ORed. Once an 'or' entry is matched the decoding action to
167 * be performed is that of the next entry which isn't an 'or'. E.g.
168 *
169 * DECODE_OR (mask1, value1)
170 * DECODE_OR (mask2, value2)
171 * DECODE_SIMULATE (mask3, value3, simulation_handler)
172 *
173 * This means that if any of the three mask/value pairs match the
174 * instruction being decoded, then 'simulation_handler' will be used
175 * for it.
176 *
177 * Both the SIMULATE and EMULATE macros have a second form which take an
178 * additional 'regs' argument.
179 *
180 * DECODE_SIMULATEX(mask, value, handler, regs)
181 * DECODE_EMULATEX (mask, value, handler, regs)
182 *
183 * These are used to specify what kind of CPU register is encoded in each of the
184 * least significant 5 nibbles of the instruction being decoded. The regs value
185 * is specified using the REGS macro, this takes any of the REG_TYPE_* values
186 * from enum decode_reg_type as arguments; only the '*' part of the name is
187 * given. E.g.
188 *
189 * REGS(0, ANY, NOPC, 0, ANY)
190 *
191 * This indicates an instruction is encoded like:
192 *
193 * bits 19..16 ignore
194 * bits 15..12 any register allowed here
195 * bits 11.. 8 any register except PC allowed here
196 * bits 7.. 4 ignore
197 * bits 3.. 0 any register allowed here
198 *
199 * This register specification is checked after a decode table entry is found to
200 * match an instruction (through the mask/value test). Any invalid register then
201 * found in the instruction will cause decoding to fail with INSN_REJECTED. In
202 * the above example this would happen if bits 11..8 of the instruction were
203 * 1111, indicating R15 or PC.
204 *
205 * As well as checking for legal combinations of registers, this data is also
206 * used to modify the registers encoded in the instructions so that an
207 * emulation routines can use it. (See decode_regs() and INSN_NEW_BITS.)
208 *
209 * Here is a real example which matches ARM instructions of the form
210 * "AND <Rd>,<Rn>,<Rm>,<shift> <Rs>"
211 *
212 * DECODE_EMULATEX (0x0e000090, 0x00000010, PROBES_DATA_PROCESSING_REG,
213 * REGS(ANY, ANY, NOPC, 0, ANY)),
214 * ^ ^ ^ ^
215 * Rn Rd Rs Rm
216 *
217 * Decoding the instruction "AND R4, R5, R6, ASL R15" will be rejected because
218 * Rs == R15
219 *
220 * Decoding the instruction "AND R4, R5, R6, ASL R7" will be accepted and the
221 * instruction will be modified to "AND R0, R2, R3, ASL R1" and then placed into
222 * the kprobes instruction slot. This can then be called later by the handler
223 * function emulate_rd12rn16rm0rs8_rwflags (a pointer to which is retrieved from
224 * the indicated slot in the action array), in order to simulate the instruction.
225 */
226
227 enum decode_type {
228 DECODE_TYPE_END,
229 DECODE_TYPE_TABLE,
230 DECODE_TYPE_CUSTOM,
231 DECODE_TYPE_SIMULATE,
232 DECODE_TYPE_EMULATE,
233 DECODE_TYPE_OR,
234 DECODE_TYPE_REJECT,
235 NUM_DECODE_TYPES /* Must be last enum */
236 };
237
238 #define DECODE_TYPE_BITS 4
239 #define DECODE_TYPE_MASK ((1 << DECODE_TYPE_BITS) - 1)
240
241 enum decode_reg_type {
242 REG_TYPE_NONE = 0, /* Not a register, ignore */
243 REG_TYPE_ANY, /* Any register allowed */
244 REG_TYPE_SAMEAS16, /* Register should be same as that at bits 19..16 */
245 REG_TYPE_SP, /* Register must be SP */
246 REG_TYPE_PC, /* Register must be PC */
247 REG_TYPE_NOSP, /* Register must not be SP */
248 REG_TYPE_NOSPPC, /* Register must not be SP or PC */
249 REG_TYPE_NOPC, /* Register must not be PC */
250 REG_TYPE_NOPCWB, /* No PC if load/store write-back flag also set */
251
252 /* The following types are used when the encoding for PC indicates
253 * another instruction form. This distiction only matters for test
254 * case coverage checks.
255 */
256 REG_TYPE_NOPCX, /* Register must not be PC */
257 REG_TYPE_NOSPPCX, /* Register must not be SP or PC */
258
259 /* Alias to allow '0' arg to be used in REGS macro. */
260 REG_TYPE_0 = REG_TYPE_NONE
261 };
262
263 #define REGS(r16, r12, r8, r4, r0) \
264 (((REG_TYPE_##r16) << 16) + \
265 ((REG_TYPE_##r12) << 12) + \
266 ((REG_TYPE_##r8) << 8) + \
267 ((REG_TYPE_##r4) << 4) + \
268 (REG_TYPE_##r0))
269
270 union decode_item {
271 u32 bits;
272 const union decode_item *table;
273 int action;
274 };
275
276 struct decode_header;
277 typedef enum probes_insn (probes_custom_decode_t)(probes_opcode_t,
278 struct arch_probes_insn *,
279 const struct decode_header *);
280
281 union decode_action {
282 probes_insn_handler_t *handler;
283 probes_custom_decode_t *decoder;
284 };
285
286 typedef enum probes_insn (probes_check_t)(probes_opcode_t,
287 struct arch_probes_insn *,
288 const struct decode_header *);
289
290 struct decode_checker {
291 probes_check_t *checker;
292 };
293
294 #define DECODE_END \
295 {.bits = DECODE_TYPE_END}
296
297
298 struct decode_header {
299 union decode_item type_regs;
300 union decode_item mask;
301 union decode_item value;
302 };
303
304 #define DECODE_HEADER(_type, _mask, _value, _regs) \
305 {.bits = (_type) | ((_regs) << DECODE_TYPE_BITS)}, \
306 {.bits = (_mask)}, \
307 {.bits = (_value)}
308
309
310 struct decode_table {
311 struct decode_header header;
312 union decode_item table;
313 };
314
315 #define DECODE_TABLE(_mask, _value, _table) \
316 DECODE_HEADER(DECODE_TYPE_TABLE, _mask, _value, 0), \
317 {.table = (_table)}
318
319
320 struct decode_custom {
321 struct decode_header header;
322 union decode_item decoder;
323 };
324
325 #define DECODE_CUSTOM(_mask, _value, _decoder) \
326 DECODE_HEADER(DECODE_TYPE_CUSTOM, _mask, _value, 0), \
327 {.action = (_decoder)}
328
329
330 struct decode_simulate {
331 struct decode_header header;
332 union decode_item handler;
333 };
334
335 #define DECODE_SIMULATEX(_mask, _value, _handler, _regs) \
336 DECODE_HEADER(DECODE_TYPE_SIMULATE, _mask, _value, _regs), \
337 {.action = (_handler)}
338
339 #define DECODE_SIMULATE(_mask, _value, _handler) \
340 DECODE_SIMULATEX(_mask, _value, _handler, 0)
341
342
343 struct decode_emulate {
344 struct decode_header header;
345 union decode_item handler;
346 };
347
348 #define DECODE_EMULATEX(_mask, _value, _handler, _regs) \
349 DECODE_HEADER(DECODE_TYPE_EMULATE, _mask, _value, _regs), \
350 {.action = (_handler)}
351
352 #define DECODE_EMULATE(_mask, _value, _handler) \
353 DECODE_EMULATEX(_mask, _value, _handler, 0)
354
355
356 struct decode_or {
357 struct decode_header header;
358 };
359
360 #define DECODE_OR(_mask, _value) \
361 DECODE_HEADER(DECODE_TYPE_OR, _mask, _value, 0)
362
363 enum probes_insn {
364 INSN_REJECTED,
365 INSN_GOOD,
366 INSN_GOOD_NO_SLOT
367 };
368
369 struct decode_reject {
370 struct decode_header header;
371 };
372
373 #define DECODE_REJECT(_mask, _value) \
374 DECODE_HEADER(DECODE_TYPE_REJECT, _mask, _value, 0)
375
376 probes_insn_handler_t probes_simulate_nop;
377 probes_insn_handler_t probes_emulate_none;
378
379 int __kprobes
380 probes_decode_insn(probes_opcode_t insn, struct arch_probes_insn *asi,
381 const union decode_item *table, bool thumb, bool emulate,
382 const union decode_action *actions,
383 const struct decode_checker **checkers);
384
385 #endif
386