2 * arch/arm/kernel/probes.h
4 * Copyright (C) 2011 Jon Medhurst <tixy@yxit.co.uk>.
6 * Some contents moved here from arch/arm/include/asm/kprobes.h which is
7 * Copyright (C) 2006, 2007 Motorola Inc.
9 * This program is free software; you can redistribute it and/or modify
10 * it under the terms of the GNU General Public License version 2 as
11 * published by the Free Software Foundation.
13 * This program is distributed in the hope that it will be useful,
14 * but WITHOUT ANY WARRANTY; without even the implied warranty of
15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
16 * General Public License for more details.
19 #ifndef _ARM_KERNEL_PROBES_H
20 #define _ARM_KERNEL_PROBES_H
22 #include <linux/types.h>
23 #include <linux/stddef.h>
24 #include <linux/kprobes.h>
26 #if __LINUX_ARM_ARCH__ >= 7
28 /* str_pc_offset is architecturally defined from ARMv7 onwards */
29 #define str_pc_offset 8
30 #define find_str_pc_offset()
32 #else /* __LINUX_ARM_ARCH__ < 7 */
34 /* We need a run-time check to determine str_pc_offset */
35 extern int str_pc_offset;
36 void __init find_str_pc_offset(void);
42 * Update ITSTATE after normal execution of an IT block instruction.
44 * The 8 IT state bits are split into two parts in CPSR:
45 * ITSTATE<1:0> are in CPSR<26:25>
46 * ITSTATE<7:2> are in CPSR<15:10>
48 static inline unsigned long it_advance(unsigned long cpsr)
50 if ((cpsr & 0x06000400) == 0) {
51 /* ITSTATE<2:0> == 0 means end of IT block, so clear IT state */
54 /* We need to shift left ITSTATE<4:0> */
55 const unsigned long mask = 0x06001c00; /* Mask ITSTATE<4:0> */
56 unsigned long it = cpsr & mask;
58 it |= it >> (27 - 10); /* Carry ITSTATE<2> to correct place */
66 static inline void __kprobes bx_write_pc(long pcv, struct pt_regs *regs)
68 long cpsr = regs->ARM_cpsr;
74 pcv &= ~0x2; /* Avoid UNPREDICTABLE address allignment */
76 regs->ARM_cpsr = cpsr;
81 #if __LINUX_ARM_ARCH__ >= 6
83 /* Kernels built for >= ARMv6 should never run on <= ARMv5 hardware, so... */
84 #define load_write_pc_interworks true
85 #define test_load_write_pc_interworking()
87 #else /* __LINUX_ARM_ARCH__ < 6 */
89 /* We need run-time testing to determine if load_write_pc() should interwork. */
90 extern bool load_write_pc_interworks;
91 void __init test_load_write_pc_interworking(void);
95 static inline void __kprobes load_write_pc(long pcv, struct pt_regs *regs)
97 if (load_write_pc_interworks)
98 bx_write_pc(pcv, regs);
104 #if __LINUX_ARM_ARCH__ >= 7
106 #define alu_write_pc_interworks true
107 #define test_alu_write_pc_interworking()
109 #elif __LINUX_ARM_ARCH__ <= 5
111 /* Kernels built for <= ARMv5 should never run on >= ARMv6 hardware, so... */
112 #define alu_write_pc_interworks false
113 #define test_alu_write_pc_interworking()
115 #else /* __LINUX_ARM_ARCH__ == 6 */
117 /* We could be an ARMv6 binary on ARMv7 hardware so we need a run-time check. */
118 extern bool alu_write_pc_interworks;
119 void __init test_alu_write_pc_interworking(void);
121 #endif /* __LINUX_ARM_ARCH__ == 6 */
123 static inline void __kprobes alu_write_pc(long pcv, struct pt_regs *regs)
125 if (alu_write_pc_interworks)
126 bx_write_pc(pcv, regs);
132 void __kprobes kprobe_simulate_nop(struct kprobe *p, struct pt_regs *regs);
133 void __kprobes kprobe_emulate_none(struct kprobe *p, struct pt_regs *regs);
135 enum kprobe_insn __kprobes
136 kprobe_decode_ldmstm(kprobe_opcode_t insn, struct arch_specific_insn *asi);
139 * Test if load/store instructions writeback the address register.
140 * if P (bit 24) == 0 or W (bit 21) == 1
142 #define is_writeback(insn) ((insn ^ 0x01000000) & 0x01200000)
145 * The following definitions and macros are used to build instruction
146 * decoding tables for use by kprobe_decode_insn.
148 * These tables are a concatenation of entries each of which consist of one of
149 * the decode_* structs. All of the fields in every type of decode structure
150 * are of the union type decode_item, therefore the entire decode table can be
151 * viewed as an array of these and declared like:
153 * static const union decode_item table_name[] = {};
155 * In order to construct each entry in the table, macros are used to
156 * initialise a number of sequential decode_item values in a layout which
157 * matches the relevant struct. E.g. DECODE_SIMULATE initialise a struct
158 * decode_simulate by initialising four decode_item objects like this...
163 * {.handler = _handler},
165 * Initialising a specified member of the union means that the compiler
166 * will produce a warning if the argument is of an incorrect type.
168 * Below is a list of each of the macros used to initialise entries and a
169 * description of the action performed when that entry is matched to an
170 * instruction. A match is found when (instruction & mask) == value.
172 * DECODE_TABLE(mask, value, table)
173 * Instruction decoding jumps to parsing the new sub-table 'table'.
175 * DECODE_CUSTOM(mask, value, decoder)
176 * The custom function 'decoder' is called to the complete decoding
179 * DECODE_SIMULATE(mask, value, handler)
180 * Set the probes instruction handler to 'handler', this will be used
181 * to simulate the instruction when the probe is hit. Decoding returns
182 * with INSN_GOOD_NO_SLOT.
184 * DECODE_EMULATE(mask, value, handler)
185 * Set the probes instruction handler to 'handler', this will be used
186 * to emulate the instruction when the probe is hit. The modified
187 * instruction (see below) is placed in the probes instruction slot so it
188 * may be called by the emulation code. Decoding returns with INSN_GOOD.
190 * DECODE_REJECT(mask, value)
191 * Instruction decoding fails with INSN_REJECTED
193 * DECODE_OR(mask, value)
194 * This allows the mask/value test of multiple table entries to be
195 * logically ORed. Once an 'or' entry is matched the decoding action to
196 * be performed is that of the next entry which isn't an 'or'. E.g.
198 * DECODE_OR (mask1, value1)
199 * DECODE_OR (mask2, value2)
200 * DECODE_SIMULATE (mask3, value3, simulation_handler)
202 * This means that if any of the three mask/value pairs match the
203 * instruction being decoded, then 'simulation_handler' will be used
206 * Both the SIMULATE and EMULATE macros have a second form which take an
207 * additional 'regs' argument.
209 * DECODE_SIMULATEX(mask, value, handler, regs)
210 * DECODE_EMULATEX (mask, value, handler, regs)
212 * These are used to specify what kind of CPU register is encoded in each of the
213 * least significant 5 nibbles of the instruction being decoded. The regs value
214 * is specified using the REGS macro, this takes any of the REG_TYPE_* values
215 * from enum decode_reg_type as arguments; only the '*' part of the name is
218 * REGS(0, ANY, NOPC, 0, ANY)
220 * This indicates an instruction is encoded like:
223 * bits 15..12 any register allowed here
224 * bits 11.. 8 any register except PC allowed here
226 * bits 3.. 0 any register allowed here
228 * This register specification is checked after a decode table entry is found to
229 * match an instruction (through the mask/value test). Any invalid register then
230 * found in the instruction will cause decoding to fail with INSN_REJECTED. In
231 * the above example this would happen if bits 11..8 of the instruction were
232 * 1111, indicating R15 or PC.
234 * As well as checking for legal combinations of registers, this data is also
235 * used to modify the registers encoded in the instructions so that an
236 * emulation routines can use it. (See decode_regs() and INSN_NEW_BITS.)
238 * Here is a real example which matches ARM instructions of the form
239 * "AND <Rd>,<Rn>,<Rm>,<shift> <Rs>"
241 * DECODE_EMULATEX (0x0e000090, 0x00000010, emulate_rd12rn16rm0rs8_rwflags,
242 * REGS(ANY, ANY, NOPC, 0, ANY)),
246 * Decoding the instruction "AND R4, R5, R6, ASL R15" will be rejected because
249 * Decoding the instruction "AND R4, R5, R6, ASL R7" will be accepted and the
250 * instruction will be modified to "AND R0, R2, R3, ASL R1" and then placed into
251 * the kprobes instruction slot. This can then be called later by the handler
252 * function emulate_rd12rn16rm0rs8_rwflags in order to simulate the instruction.
259 DECODE_TYPE_SIMULATE,
263 NUM_DECODE_TYPES /* Must be last enum */
266 #define DECODE_TYPE_BITS 4
267 #define DECODE_TYPE_MASK ((1 << DECODE_TYPE_BITS) - 1)
269 enum decode_reg_type {
270 REG_TYPE_NONE = 0, /* Not a register, ignore */
271 REG_TYPE_ANY, /* Any register allowed */
272 REG_TYPE_SAMEAS16, /* Register should be same as that at bits 19..16 */
273 REG_TYPE_SP, /* Register must be SP */
274 REG_TYPE_PC, /* Register must be PC */
275 REG_TYPE_NOSP, /* Register must not be SP */
276 REG_TYPE_NOSPPC, /* Register must not be SP or PC */
277 REG_TYPE_NOPC, /* Register must not be PC */
278 REG_TYPE_NOPCWB, /* No PC if load/store write-back flag also set */
280 /* The following types are used when the encoding for PC indicates
281 * another instruction form. This distiction only matters for test
282 * case coverage checks.
284 REG_TYPE_NOPCX, /* Register must not be PC */
285 REG_TYPE_NOSPPCX, /* Register must not be SP or PC */
287 /* Alias to allow '0' arg to be used in REGS macro. */
288 REG_TYPE_0 = REG_TYPE_NONE
291 #define REGS(r16, r12, r8, r4, r0) \
292 (((REG_TYPE_##r16) << 16) + \
293 ((REG_TYPE_##r12) << 12) + \
294 ((REG_TYPE_##r8) << 8) + \
295 ((REG_TYPE_##r4) << 4) + \
300 const union decode_item *table;
301 kprobe_insn_handler_t *handler;
302 kprobe_decode_insn_t *decoder;
307 {.bits = DECODE_TYPE_END}
310 struct decode_header {
311 union decode_item type_regs;
312 union decode_item mask;
313 union decode_item value;
316 #define DECODE_HEADER(_type, _mask, _value, _regs) \
317 {.bits = (_type) | ((_regs) << DECODE_TYPE_BITS)}, \
322 struct decode_table {
323 struct decode_header header;
324 union decode_item table;
327 #define DECODE_TABLE(_mask, _value, _table) \
328 DECODE_HEADER(DECODE_TYPE_TABLE, _mask, _value, 0), \
332 struct decode_custom {
333 struct decode_header header;
334 union decode_item decoder;
337 #define DECODE_CUSTOM(_mask, _value, _decoder) \
338 DECODE_HEADER(DECODE_TYPE_CUSTOM, _mask, _value, 0), \
339 {.decoder = (_decoder)}
342 struct decode_simulate {
343 struct decode_header header;
344 union decode_item handler;
347 #define DECODE_SIMULATEX(_mask, _value, _handler, _regs) \
348 DECODE_HEADER(DECODE_TYPE_SIMULATE, _mask, _value, _regs), \
349 {.handler = (_handler)}
351 #define DECODE_SIMULATE(_mask, _value, _handler) \
352 DECODE_SIMULATEX(_mask, _value, _handler, 0)
355 struct decode_emulate {
356 struct decode_header header;
357 union decode_item handler;
360 #define DECODE_EMULATEX(_mask, _value, _handler, _regs) \
361 DECODE_HEADER(DECODE_TYPE_EMULATE, _mask, _value, _regs), \
362 {.handler = (_handler)}
364 #define DECODE_EMULATE(_mask, _value, _handler) \
365 DECODE_EMULATEX(_mask, _value, _handler, 0)
369 struct decode_header header;
372 #define DECODE_OR(_mask, _value) \
373 DECODE_HEADER(DECODE_TYPE_OR, _mask, _value, 0)
376 struct decode_reject {
377 struct decode_header header;
380 #define DECODE_REJECT(_mask, _value) \
381 DECODE_HEADER(DECODE_TYPE_REJECT, _mask, _value, 0)
384 #ifdef CONFIG_THUMB2_KERNEL
385 extern const union decode_item kprobe_decode_thumb16_table[];
386 extern const union decode_item kprobe_decode_thumb32_table[];
388 extern const union decode_item kprobe_decode_arm_table[];
391 extern kprobe_check_cc * const kprobe_condition_checks[16];
394 int kprobe_decode_insn(kprobe_opcode_t insn, struct arch_specific_insn *asi,
395 const union decode_item *table, bool thumb16);