kprobes-common.c revision 21254ebc9e509967317ad8c6922797e21137ad53
1/* 2 * arch/arm/kernel/kprobes-common.c 3 * 4 * Copyright (C) 2011 Jon Medhurst <tixy@yxit.co.uk>. 5 * 6 * Some contents moved here from arch/arm/include/asm/kprobes-arm.c which is 7 * Copyright (C) 2006, 2007 Motorola Inc. 8 * 9 * This program is free software; you can redistribute it and/or modify 10 * it under the terms of the GNU General Public License version 2 as 11 * published by the Free Software Foundation. 12 */ 13 14#include <linux/kernel.h> 15#include <linux/kprobes.h> 16#include <asm/system_info.h> 17#include <linux/types.h> 18#include <linux/stddef.h> 19#include <linux/bug.h> 20 21#include "kprobes.h" 22 23 24#ifndef find_str_pc_offset 25 26/* 27 * For STR and STM instructions, an ARM core may choose to use either 28 * a +8 or a +12 displacement from the current instruction's address. 29 * Whichever value is chosen for a given core, it must be the same for 30 * both instructions and may not change. This function measures it. 31 */ 32 33int str_pc_offset; 34 35void __init find_str_pc_offset(void) 36{ 37 int addr, scratch, ret; 38 39 __asm__ ( 40 "sub %[ret], pc, #4 \n\t" 41 "str pc, %[addr] \n\t" 42 "ldr %[scr], %[addr] \n\t" 43 "sub %[ret], %[scr], %[ret] \n\t" 44 : [ret] "=r" (ret), [scr] "=r" (scratch), [addr] "+m" (addr)); 45 46 str_pc_offset = ret; 47} 48 49#endif /* !find_str_pc_offset */ 50 51 52#ifndef test_load_write_pc_interworking 53 54bool load_write_pc_interworks; 55 56void __init test_load_write_pc_interworking(void) 57{ 58 int arch = cpu_architecture(); 59 BUG_ON(arch == CPU_ARCH_UNKNOWN); 60 load_write_pc_interworks = arch >= CPU_ARCH_ARMv5T; 61} 62 63#endif /* !test_load_write_pc_interworking */ 64 65 66#ifndef test_alu_write_pc_interworking 67 68bool alu_write_pc_interworks; 69 70void __init test_alu_write_pc_interworking(void) 71{ 72 int arch = cpu_architecture(); 73 BUG_ON(arch == CPU_ARCH_UNKNOWN); 74 alu_write_pc_interworks = arch >= CPU_ARCH_ARMv7; 75} 76 77#endif /* !test_alu_write_pc_interworking */ 78 79 80void __init arm_kprobe_decode_init(void) 81{ 82 find_str_pc_offset(); 83 test_load_write_pc_interworking(); 84 test_alu_write_pc_interworking(); 85} 86 87 88static unsigned long __kprobes __check_eq(unsigned long cpsr) 89{ 90 return cpsr & PSR_Z_BIT; 91} 92 93static unsigned long __kprobes __check_ne(unsigned long cpsr) 94{ 95 return (~cpsr) & PSR_Z_BIT; 96} 97 98static unsigned long __kprobes __check_cs(unsigned long cpsr) 99{ 100 return cpsr & PSR_C_BIT; 101} 102 103static unsigned long __kprobes __check_cc(unsigned long cpsr) 104{ 105 return (~cpsr) & PSR_C_BIT; 106} 107 108static unsigned long __kprobes __check_mi(unsigned long cpsr) 109{ 110 return cpsr & PSR_N_BIT; 111} 112 113static unsigned long __kprobes __check_pl(unsigned long cpsr) 114{ 115 return (~cpsr) & PSR_N_BIT; 116} 117 118static unsigned long __kprobes __check_vs(unsigned long cpsr) 119{ 120 return cpsr & PSR_V_BIT; 121} 122 123static unsigned long __kprobes __check_vc(unsigned long cpsr) 124{ 125 return (~cpsr) & PSR_V_BIT; 126} 127 128static unsigned long __kprobes __check_hi(unsigned long cpsr) 129{ 130 cpsr &= ~(cpsr >> 1); /* PSR_C_BIT &= ~PSR_Z_BIT */ 131 return cpsr & PSR_C_BIT; 132} 133 134static unsigned long __kprobes __check_ls(unsigned long cpsr) 135{ 136 cpsr &= ~(cpsr >> 1); /* PSR_C_BIT &= ~PSR_Z_BIT */ 137 return (~cpsr) & PSR_C_BIT; 138} 139 140static unsigned long __kprobes __check_ge(unsigned long cpsr) 141{ 142 cpsr ^= (cpsr << 3); /* PSR_N_BIT ^= PSR_V_BIT */ 143 return (~cpsr) & PSR_N_BIT; 144} 145 146static unsigned long __kprobes __check_lt(unsigned long cpsr) 147{ 148 cpsr ^= (cpsr << 3); /* PSR_N_BIT ^= PSR_V_BIT */ 149 return cpsr & PSR_N_BIT; 150} 151 152static unsigned long __kprobes __check_gt(unsigned long cpsr) 153{ 154 unsigned long temp = cpsr ^ (cpsr << 3); /* PSR_N_BIT ^= PSR_V_BIT */ 155 temp |= (cpsr << 1); /* PSR_N_BIT |= PSR_Z_BIT */ 156 return (~temp) & PSR_N_BIT; 157} 158 159static unsigned long __kprobes __check_le(unsigned long cpsr) 160{ 161 unsigned long temp = cpsr ^ (cpsr << 3); /* PSR_N_BIT ^= PSR_V_BIT */ 162 temp |= (cpsr << 1); /* PSR_N_BIT |= PSR_Z_BIT */ 163 return temp & PSR_N_BIT; 164} 165 166static unsigned long __kprobes __check_al(unsigned long cpsr) 167{ 168 return true; 169} 170 171kprobe_check_cc * const kprobe_condition_checks[16] = { 172 &__check_eq, &__check_ne, &__check_cs, &__check_cc, 173 &__check_mi, &__check_pl, &__check_vs, &__check_vc, 174 &__check_hi, &__check_ls, &__check_ge, &__check_lt, 175 &__check_gt, &__check_le, &__check_al, &__check_al 176}; 177 178 179void __kprobes kprobe_simulate_nop(struct kprobe *p, struct pt_regs *regs) 180{ 181} 182 183void __kprobes kprobe_emulate_none(struct kprobe *p, struct pt_regs *regs) 184{ 185 p->ainsn.insn_fn(); 186} 187 188static void __kprobes simulate_ldm1stm1(struct kprobe *p, struct pt_regs *regs) 189{ 190 kprobe_opcode_t insn = p->opcode; 191 int rn = (insn >> 16) & 0xf; 192 int lbit = insn & (1 << 20); 193 int wbit = insn & (1 << 21); 194 int ubit = insn & (1 << 23); 195 int pbit = insn & (1 << 24); 196 long *addr = (long *)regs->uregs[rn]; 197 int reg_bit_vector; 198 int reg_count; 199 200 reg_count = 0; 201 reg_bit_vector = insn & 0xffff; 202 while (reg_bit_vector) { 203 reg_bit_vector &= (reg_bit_vector - 1); 204 ++reg_count; 205 } 206 207 if (!ubit) 208 addr -= reg_count; 209 addr += (!pbit == !ubit); 210 211 reg_bit_vector = insn & 0xffff; 212 while (reg_bit_vector) { 213 int reg = __ffs(reg_bit_vector); 214 reg_bit_vector &= (reg_bit_vector - 1); 215 if (lbit) 216 regs->uregs[reg] = *addr++; 217 else 218 *addr++ = regs->uregs[reg]; 219 } 220 221 if (wbit) { 222 if (!ubit) 223 addr -= reg_count; 224 addr -= (!pbit == !ubit); 225 regs->uregs[rn] = (long)addr; 226 } 227} 228 229static void __kprobes simulate_stm1_pc(struct kprobe *p, struct pt_regs *regs) 230{ 231 regs->ARM_pc = (long)p->addr + str_pc_offset; 232 simulate_ldm1stm1(p, regs); 233 regs->ARM_pc = (long)p->addr + 4; 234} 235 236static void __kprobes simulate_ldm1_pc(struct kprobe *p, struct pt_regs *regs) 237{ 238 simulate_ldm1stm1(p, regs); 239 load_write_pc(regs->ARM_pc, regs); 240} 241 242static void __kprobes 243emulate_generic_r0_12_noflags(struct kprobe *p, struct pt_regs *regs) 244{ 245 register void *rregs asm("r1") = regs; 246 register void *rfn asm("lr") = p->ainsn.insn_fn; 247 248 __asm__ __volatile__ ( 249 "stmdb sp!, {%[regs], r11} \n\t" 250 "ldmia %[regs], {r0-r12} \n\t" 251#if __LINUX_ARM_ARCH__ >= 6 252 "blx %[fn] \n\t" 253#else 254 "str %[fn], [sp, #-4]! \n\t" 255 "adr lr, 1f \n\t" 256 "ldr pc, [sp], #4 \n\t" 257 "1: \n\t" 258#endif 259 "ldr lr, [sp], #4 \n\t" /* lr = regs */ 260 "stmia lr, {r0-r12} \n\t" 261 "ldr r11, [sp], #4 \n\t" 262 : [regs] "=r" (rregs), [fn] "=r" (rfn) 263 : "0" (rregs), "1" (rfn) 264 : "r0", "r2", "r3", "r4", "r5", "r6", "r7", 265 "r8", "r9", "r10", "r12", "memory", "cc" 266 ); 267} 268 269static void __kprobes 270emulate_generic_r2_14_noflags(struct kprobe *p, struct pt_regs *regs) 271{ 272 emulate_generic_r0_12_noflags(p, (struct pt_regs *)(regs->uregs+2)); 273} 274 275static void __kprobes 276emulate_ldm_r3_15(struct kprobe *p, struct pt_regs *regs) 277{ 278 emulate_generic_r0_12_noflags(p, (struct pt_regs *)(regs->uregs+3)); 279 load_write_pc(regs->ARM_pc, regs); 280} 281 282enum kprobe_insn __kprobes 283kprobe_decode_ldmstm(kprobe_opcode_t insn, struct arch_specific_insn *asi) 284{ 285 kprobe_insn_handler_t *handler = 0; 286 unsigned reglist = insn & 0xffff; 287 int is_ldm = insn & 0x100000; 288 int rn = (insn >> 16) & 0xf; 289 290 if (rn <= 12 && (reglist & 0xe000) == 0) { 291 /* Instruction only uses registers in the range R0..R12 */ 292 handler = emulate_generic_r0_12_noflags; 293 294 } else if (rn >= 2 && (reglist & 0x8003) == 0) { 295 /* Instruction only uses registers in the range R2..R14 */ 296 rn -= 2; 297 reglist >>= 2; 298 handler = emulate_generic_r2_14_noflags; 299 300 } else if (rn >= 3 && (reglist & 0x0007) == 0) { 301 /* Instruction only uses registers in the range R3..R15 */ 302 if (is_ldm && (reglist & 0x8000)) { 303 rn -= 3; 304 reglist >>= 3; 305 handler = emulate_ldm_r3_15; 306 } 307 } 308 309 if (handler) { 310 /* We can emulate the instruction in (possibly) modified form */ 311 asi->insn[0] = (insn & 0xfff00000) | (rn << 16) | reglist; 312 asi->insn_handler = handler; 313 return INSN_GOOD; 314 } 315 316 /* Fallback to slower simulation... */ 317 if (reglist & 0x8000) 318 handler = is_ldm ? simulate_ldm1_pc : simulate_stm1_pc; 319 else 320 handler = simulate_ldm1stm1; 321 asi->insn_handler = handler; 322 return INSN_GOOD_NO_SLOT; 323} 324 325 326/* 327 * Prepare an instruction slot to receive an instruction for emulating. 328 * This is done by placing a subroutine return after the location where the 329 * instruction will be placed. We also modify ARM instructions to be 330 * unconditional as the condition code will already be checked before any 331 * emulation handler is called. 332 */ 333static kprobe_opcode_t __kprobes 334prepare_emulated_insn(kprobe_opcode_t insn, struct arch_specific_insn *asi, 335 bool thumb) 336{ 337#ifdef CONFIG_THUMB2_KERNEL 338 if (thumb) { 339 u16 *thumb_insn = (u16 *)asi->insn; 340 thumb_insn[1] = 0x4770; /* Thumb bx lr */ 341 thumb_insn[2] = 0x4770; /* Thumb bx lr */ 342 return insn; 343 } 344 asi->insn[1] = 0xe12fff1e; /* ARM bx lr */ 345#else 346 asi->insn[1] = 0xe1a0f00e; /* mov pc, lr */ 347#endif 348 /* Make an ARM instruction unconditional */ 349 if (insn < 0xe0000000) 350 insn = (insn | 0xe0000000) & ~0x10000000; 351 return insn; 352} 353 354/* 355 * Write a (probably modified) instruction into the slot previously prepared by 356 * prepare_emulated_insn 357 */ 358static void __kprobes 359set_emulated_insn(kprobe_opcode_t insn, struct arch_specific_insn *asi, 360 bool thumb) 361{ 362#ifdef CONFIG_THUMB2_KERNEL 363 if (thumb) { 364 u16 *ip = (u16 *)asi->insn; 365 if (is_wide_instruction(insn)) 366 *ip++ = insn >> 16; 367 *ip++ = insn; 368 return; 369 } 370#endif 371 asi->insn[0] = insn; 372} 373 374/* 375 * When we modify the register numbers encoded in an instruction to be emulated, 376 * the new values come from this define. For ARM and 32-bit Thumb instructions 377 * this gives... 378 * 379 * bit position 16 12 8 4 0 380 * ---------------+---+---+---+---+---+ 381 * register r2 r0 r1 -- r3 382 */ 383#define INSN_NEW_BITS 0x00020103 384 385/* Each nibble has same value as that at INSN_NEW_BITS bit 16 */ 386#define INSN_SAMEAS16_BITS 0x22222222 387 388/* 389 * Validate and modify each of the registers encoded in an instruction. 390 * 391 * Each nibble in regs contains a value from enum decode_reg_type. For each 392 * non-zero value, the corresponding nibble in pinsn is validated and modified 393 * according to the type. 394 */ 395static bool __kprobes decode_regs(kprobe_opcode_t* pinsn, u32 regs) 396{ 397 kprobe_opcode_t insn = *pinsn; 398 kprobe_opcode_t mask = 0xf; /* Start at least significant nibble */ 399 400 for (; regs != 0; regs >>= 4, mask <<= 4) { 401 402 kprobe_opcode_t new_bits = INSN_NEW_BITS; 403 404 switch (regs & 0xf) { 405 406 case REG_TYPE_NONE: 407 /* Nibble not a register, skip to next */ 408 continue; 409 410 case REG_TYPE_ANY: 411 /* Any register is allowed */ 412 break; 413 414 case REG_TYPE_SAMEAS16: 415 /* Replace register with same as at bit position 16 */ 416 new_bits = INSN_SAMEAS16_BITS; 417 break; 418 419 case REG_TYPE_SP: 420 /* Only allow SP (R13) */ 421 if ((insn ^ 0xdddddddd) & mask) 422 goto reject; 423 break; 424 425 case REG_TYPE_PC: 426 /* Only allow PC (R15) */ 427 if ((insn ^ 0xffffffff) & mask) 428 goto reject; 429 break; 430 431 case REG_TYPE_NOSP: 432 /* Reject SP (R13) */ 433 if (((insn ^ 0xdddddddd) & mask) == 0) 434 goto reject; 435 break; 436 437 case REG_TYPE_NOSPPC: 438 case REG_TYPE_NOSPPCX: 439 /* Reject SP and PC (R13 and R15) */ 440 if (((insn ^ 0xdddddddd) & 0xdddddddd & mask) == 0) 441 goto reject; 442 break; 443 444 case REG_TYPE_NOPCWB: 445 if (!is_writeback(insn)) 446 break; /* No writeback, so any register is OK */ 447 /* fall through... */ 448 case REG_TYPE_NOPC: 449 case REG_TYPE_NOPCX: 450 /* Reject PC (R15) */ 451 if (((insn ^ 0xffffffff) & mask) == 0) 452 goto reject; 453 break; 454 } 455 456 /* Replace value of nibble with new register number... */ 457 insn &= ~mask; 458 insn |= new_bits & mask; 459 } 460 461 *pinsn = insn; 462 return true; 463 464reject: 465 return false; 466} 467 468static const int decode_struct_sizes[NUM_DECODE_TYPES] = { 469 [DECODE_TYPE_TABLE] = sizeof(struct decode_table), 470 [DECODE_TYPE_CUSTOM] = sizeof(struct decode_custom), 471 [DECODE_TYPE_SIMULATE] = sizeof(struct decode_simulate), 472 [DECODE_TYPE_EMULATE] = sizeof(struct decode_emulate), 473 [DECODE_TYPE_OR] = sizeof(struct decode_or), 474 [DECODE_TYPE_REJECT] = sizeof(struct decode_reject) 475}; 476 477/* 478 * kprobe_decode_insn operates on data tables in order to decode an ARM 479 * architecture instruction onto which a kprobe has been placed. 480 * 481 * These instruction decoding tables are a concatenation of entries each 482 * of which consist of one of the following structs: 483 * 484 * decode_table 485 * decode_custom 486 * decode_simulate 487 * decode_emulate 488 * decode_or 489 * decode_reject 490 * 491 * Each of these starts with a struct decode_header which has the following 492 * fields: 493 * 494 * type_regs 495 * mask 496 * value 497 * 498 * The least significant DECODE_TYPE_BITS of type_regs contains a value 499 * from enum decode_type, this indicates which of the decode_* structs 500 * the entry contains. The value DECODE_TYPE_END indicates the end of the 501 * table. 502 * 503 * When the table is parsed, each entry is checked in turn to see if it 504 * matches the instruction to be decoded using the test: 505 * 506 * (insn & mask) == value 507 * 508 * If no match is found before the end of the table is reached then decoding 509 * fails with INSN_REJECTED. 510 * 511 * When a match is found, decode_regs() is called to validate and modify each 512 * of the registers encoded in the instruction; the data it uses to do this 513 * is (type_regs >> DECODE_TYPE_BITS). A validation failure will cause decoding 514 * to fail with INSN_REJECTED. 515 * 516 * Once the instruction has passed the above tests, further processing 517 * depends on the type of the table entry's decode struct. 518 * 519 */ 520int __kprobes 521kprobe_decode_insn(kprobe_opcode_t insn, struct arch_specific_insn *asi, 522 const union decode_item *table, bool thumb) 523{ 524 const struct decode_header *h = (struct decode_header *)table; 525 const struct decode_header *next; 526 bool matched = false; 527 528 insn = prepare_emulated_insn(insn, asi, thumb); 529 530 for (;; h = next) { 531 enum decode_type type = h->type_regs.bits & DECODE_TYPE_MASK; 532 u32 regs = h->type_regs.bits >> DECODE_TYPE_BITS; 533 534 if (type == DECODE_TYPE_END) 535 return INSN_REJECTED; 536 537 next = (struct decode_header *) 538 ((uintptr_t)h + decode_struct_sizes[type]); 539 540 if (!matched && (insn & h->mask.bits) != h->value.bits) 541 continue; 542 543 if (!decode_regs(&insn, regs)) 544 return INSN_REJECTED; 545 546 switch (type) { 547 548 case DECODE_TYPE_TABLE: { 549 struct decode_table *d = (struct decode_table *)h; 550 next = (struct decode_header *)d->table.table; 551 break; 552 } 553 554 case DECODE_TYPE_CUSTOM: { 555 struct decode_custom *d = (struct decode_custom *)h; 556 return (*d->decoder.decoder)(insn, asi); 557 } 558 559 case DECODE_TYPE_SIMULATE: { 560 struct decode_simulate *d = (struct decode_simulate *)h; 561 asi->insn_handler = d->handler.handler; 562 return INSN_GOOD_NO_SLOT; 563 } 564 565 case DECODE_TYPE_EMULATE: { 566 struct decode_emulate *d = (struct decode_emulate *)h; 567 asi->insn_handler = d->handler.handler; 568 set_emulated_insn(insn, asi, thumb); 569 return INSN_GOOD; 570 } 571 572 case DECODE_TYPE_OR: 573 matched = true; 574 break; 575 576 case DECODE_TYPE_REJECT: 577 default: 578 return INSN_REJECTED; 579 } 580 } 581 } 582