1 /*
2 * arch/arm/kernel/probes-arm.c
3 *
4 * Some code moved here from arch/arm/kernel/kprobes-arm.c
5 *
6 * Copyright (C) 2006, 2007 Motorola Inc.
7 *
8 * This program is free software; you can redistribute it and/or modify
9 * it under the terms of the GNU General Public License version 2 as
10 * published by the Free Software Foundation.
11 *
12 * This program is distributed in the hope that it will be useful,
13 * but WITHOUT ANY WARRANTY; without even the implied warranty of
14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
15 * General Public License for more details.
16 */
17
18 #include <linux/kernel.h>
19 #include <linux/module.h>
20 #include <linux/stddef.h>
21 #include <linux/ptrace.h>
22
23 #include "probes.h"
24 #include "probes-arm.h"
25
26 #define sign_extend(x, signbit) ((x) | (0 - ((x) & (1 << (signbit)))))
27
28 #define branch_displacement(insn) sign_extend(((insn) & 0xffffff) << 2, 25)
29
30 /*
31 * To avoid the complications of mimicing single-stepping on a
32 * processor without a Next-PC or a single-step mode, and to
33 * avoid having to deal with the side-effects of boosting, we
34 * simulate or emulate (almost) all ARM instructions.
35 *
36 * "Simulation" is where the instruction's behavior is duplicated in
37 * C code. "Emulation" is where the original instruction is rewritten
38 * and executed, often by altering its registers.
39 *
40 * By having all behavior of the kprobe'd instruction completed before
41 * returning from the kprobe_handler(), all locks (scheduler and
42 * interrupt) can safely be released. There is no need for secondary
43 * breakpoints, no race with MP or preemptable kernels, nor having to
44 * clean up resources counts at a later time impacting overall system
45 * performance. By rewriting the instruction, only the minimum registers
46 * need to be loaded and saved back optimizing performance.
47 *
48 * Calling the insnslot_*_rwflags version of a function doesn't hurt
49 * anything even when the CPSR flags aren't updated by the
50 * instruction. It's just a little slower in return for saving
51 * a little space by not having a duplicate function that doesn't
52 * update the flags. (The same optimization can be said for
53 * instructions that do or don't perform register writeback)
54 * Also, instructions can either read the flags, only write the
55 * flags, or read and write the flags. To save combinations
56 * rather than for sheer performance, flag functions just assume
57 * read and write of flags.
58 */
59
simulate_bbl(probes_opcode_t insn,struct arch_probes_insn * asi,struct pt_regs * regs)60 void __kprobes simulate_bbl(probes_opcode_t insn,
61 struct arch_probes_insn *asi, struct pt_regs *regs)
62 {
63 long iaddr = (long) regs->ARM_pc - 4;
64 int disp = branch_displacement(insn);
65
66 if (insn & (1 << 24))
67 regs->ARM_lr = iaddr + 4;
68
69 regs->ARM_pc = iaddr + 8 + disp;
70 }
71
simulate_blx1(probes_opcode_t insn,struct arch_probes_insn * asi,struct pt_regs * regs)72 void __kprobes simulate_blx1(probes_opcode_t insn,
73 struct arch_probes_insn *asi, struct pt_regs *regs)
74 {
75 long iaddr = (long) regs->ARM_pc - 4;
76 int disp = branch_displacement(insn);
77
78 regs->ARM_lr = iaddr + 4;
79 regs->ARM_pc = iaddr + 8 + disp + ((insn >> 23) & 0x2);
80 regs->ARM_cpsr |= PSR_T_BIT;
81 }
82
simulate_blx2bx(probes_opcode_t insn,struct arch_probes_insn * asi,struct pt_regs * regs)83 void __kprobes simulate_blx2bx(probes_opcode_t insn,
84 struct arch_probes_insn *asi, struct pt_regs *regs)
85 {
86 int rm = insn & 0xf;
87 long rmv = regs->uregs[rm];
88
89 if (insn & (1 << 5))
90 regs->ARM_lr = (long) regs->ARM_pc;
91
92 regs->ARM_pc = rmv & ~0x1;
93 regs->ARM_cpsr &= ~PSR_T_BIT;
94 if (rmv & 0x1)
95 regs->ARM_cpsr |= PSR_T_BIT;
96 }
97
simulate_mrs(probes_opcode_t insn,struct arch_probes_insn * asi,struct pt_regs * regs)98 void __kprobes simulate_mrs(probes_opcode_t insn,
99 struct arch_probes_insn *asi, struct pt_regs *regs)
100 {
101 int rd = (insn >> 12) & 0xf;
102 unsigned long mask = 0xf8ff03df; /* Mask out execution state */
103 regs->uregs[rd] = regs->ARM_cpsr & mask;
104 }
105
simulate_mov_ipsp(probes_opcode_t insn,struct arch_probes_insn * asi,struct pt_regs * regs)106 void __kprobes simulate_mov_ipsp(probes_opcode_t insn,
107 struct arch_probes_insn *asi, struct pt_regs *regs)
108 {
109 regs->uregs[12] = regs->uregs[13];
110 }
111
112 /*
113 * For the instruction masking and comparisons in all the "space_*"
114 * functions below, Do _not_ rearrange the order of tests unless
115 * you're very, very sure of what you are doing. For the sake of
116 * efficiency, the masks for some tests sometimes assume other test
117 * have been done prior to them so the number of patterns to test
118 * for an instruction set can be as broad as possible to reduce the
119 * number of tests needed.
120 */
121
122 static const union decode_item arm_1111_table[] = {
123 /* Unconditional instructions */
124
125 /* memory hint 1111 0100 x001 xxxx xxxx xxxx xxxx xxxx */
126 /* PLDI (immediate) 1111 0100 x101 xxxx xxxx xxxx xxxx xxxx */
127 /* PLDW (immediate) 1111 0101 x001 xxxx xxxx xxxx xxxx xxxx */
128 /* PLD (immediate) 1111 0101 x101 xxxx xxxx xxxx xxxx xxxx */
129 DECODE_SIMULATE (0xfe300000, 0xf4100000, PROBES_PRELOAD_IMM),
130
131 /* memory hint 1111 0110 x001 xxxx xxxx xxxx xxx0 xxxx */
132 /* PLDI (register) 1111 0110 x101 xxxx xxxx xxxx xxx0 xxxx */
133 /* PLDW (register) 1111 0111 x001 xxxx xxxx xxxx xxx0 xxxx */
134 /* PLD (register) 1111 0111 x101 xxxx xxxx xxxx xxx0 xxxx */
135 DECODE_SIMULATE (0xfe300010, 0xf6100000, PROBES_PRELOAD_REG),
136
137 /* BLX (immediate) 1111 101x xxxx xxxx xxxx xxxx xxxx xxxx */
138 DECODE_SIMULATE (0xfe000000, 0xfa000000, PROBES_BRANCH_IMM),
139
140 /* CPS 1111 0001 0000 xxx0 xxxx xxxx xx0x xxxx */
141 /* SETEND 1111 0001 0000 0001 xxxx xxxx 0000 xxxx */
142 /* SRS 1111 100x x1x0 xxxx xxxx xxxx xxxx xxxx */
143 /* RFE 1111 100x x0x1 xxxx xxxx xxxx xxxx xxxx */
144
145 /* Coprocessor instructions... */
146 /* MCRR2 1111 1100 0100 xxxx xxxx xxxx xxxx xxxx */
147 /* MRRC2 1111 1100 0101 xxxx xxxx xxxx xxxx xxxx */
148 /* LDC2 1111 110x xxx1 xxxx xxxx xxxx xxxx xxxx */
149 /* STC2 1111 110x xxx0 xxxx xxxx xxxx xxxx xxxx */
150 /* CDP2 1111 1110 xxxx xxxx xxxx xxxx xxx0 xxxx */
151 /* MCR2 1111 1110 xxx0 xxxx xxxx xxxx xxx1 xxxx */
152 /* MRC2 1111 1110 xxx1 xxxx xxxx xxxx xxx1 xxxx */
153
154 /* Other unallocated instructions... */
155 DECODE_END
156 };
157
158 static const union decode_item arm_cccc_0001_0xx0____0xxx_table[] = {
159 /* Miscellaneous instructions */
160
161 /* MRS cpsr cccc 0001 0000 xxxx xxxx xxxx 0000 xxxx */
162 DECODE_SIMULATEX(0x0ff000f0, 0x01000000, PROBES_MRS,
163 REGS(0, NOPC, 0, 0, 0)),
164
165 /* BX cccc 0001 0010 xxxx xxxx xxxx 0001 xxxx */
166 DECODE_SIMULATE (0x0ff000f0, 0x01200010, PROBES_BRANCH_REG),
167
168 /* BLX (register) cccc 0001 0010 xxxx xxxx xxxx 0011 xxxx */
169 DECODE_SIMULATEX(0x0ff000f0, 0x01200030, PROBES_BRANCH_REG,
170 REGS(0, 0, 0, 0, NOPC)),
171
172 /* CLZ cccc 0001 0110 xxxx xxxx xxxx 0001 xxxx */
173 DECODE_EMULATEX (0x0ff000f0, 0x01600010, PROBES_CLZ,
174 REGS(0, NOPC, 0, 0, NOPC)),
175
176 /* QADD cccc 0001 0000 xxxx xxxx xxxx 0101 xxxx */
177 /* QSUB cccc 0001 0010 xxxx xxxx xxxx 0101 xxxx */
178 /* QDADD cccc 0001 0100 xxxx xxxx xxxx 0101 xxxx */
179 /* QDSUB cccc 0001 0110 xxxx xxxx xxxx 0101 xxxx */
180 DECODE_EMULATEX (0x0f9000f0, 0x01000050, PROBES_SATURATING_ARITHMETIC,
181 REGS(NOPC, NOPC, 0, 0, NOPC)),
182
183 /* BXJ cccc 0001 0010 xxxx xxxx xxxx 0010 xxxx */
184 /* MSR cccc 0001 0x10 xxxx xxxx xxxx 0000 xxxx */
185 /* MRS spsr cccc 0001 0100 xxxx xxxx xxxx 0000 xxxx */
186 /* BKPT 1110 0001 0010 xxxx xxxx xxxx 0111 xxxx */
187 /* SMC cccc 0001 0110 xxxx xxxx xxxx 0111 xxxx */
188 /* And unallocated instructions... */
189 DECODE_END
190 };
191
192 static const union decode_item arm_cccc_0001_0xx0____1xx0_table[] = {
193 /* Halfword multiply and multiply-accumulate */
194
195 /* SMLALxy cccc 0001 0100 xxxx xxxx xxxx 1xx0 xxxx */
196 DECODE_EMULATEX (0x0ff00090, 0x01400080, PROBES_MUL1,
197 REGS(NOPC, NOPC, NOPC, 0, NOPC)),
198
199 /* SMULWy cccc 0001 0010 xxxx xxxx xxxx 1x10 xxxx */
200 DECODE_OR (0x0ff000b0, 0x012000a0),
201 /* SMULxy cccc 0001 0110 xxxx xxxx xxxx 1xx0 xxxx */
202 DECODE_EMULATEX (0x0ff00090, 0x01600080, PROBES_MUL2,
203 REGS(NOPC, 0, NOPC, 0, NOPC)),
204
205 /* SMLAxy cccc 0001 0000 xxxx xxxx xxxx 1xx0 xxxx */
206 DECODE_OR (0x0ff00090, 0x01000080),
207 /* SMLAWy cccc 0001 0010 xxxx xxxx xxxx 1x00 xxxx */
208 DECODE_EMULATEX (0x0ff000b0, 0x01200080, PROBES_MUL2,
209 REGS(NOPC, NOPC, NOPC, 0, NOPC)),
210
211 DECODE_END
212 };
213
214 static const union decode_item arm_cccc_0000_____1001_table[] = {
215 /* Multiply and multiply-accumulate */
216
217 /* MUL cccc 0000 0000 xxxx xxxx xxxx 1001 xxxx */
218 /* MULS cccc 0000 0001 xxxx xxxx xxxx 1001 xxxx */
219 DECODE_EMULATEX (0x0fe000f0, 0x00000090, PROBES_MUL2,
220 REGS(NOPC, 0, NOPC, 0, NOPC)),
221
222 /* MLA cccc 0000 0010 xxxx xxxx xxxx 1001 xxxx */
223 /* MLAS cccc 0000 0011 xxxx xxxx xxxx 1001 xxxx */
224 DECODE_OR (0x0fe000f0, 0x00200090),
225 /* MLS cccc 0000 0110 xxxx xxxx xxxx 1001 xxxx */
226 DECODE_EMULATEX (0x0ff000f0, 0x00600090, PROBES_MUL2,
227 REGS(NOPC, NOPC, NOPC, 0, NOPC)),
228
229 /* UMAAL cccc 0000 0100 xxxx xxxx xxxx 1001 xxxx */
230 DECODE_OR (0x0ff000f0, 0x00400090),
231 /* UMULL cccc 0000 1000 xxxx xxxx xxxx 1001 xxxx */
232 /* UMULLS cccc 0000 1001 xxxx xxxx xxxx 1001 xxxx */
233 /* UMLAL cccc 0000 1010 xxxx xxxx xxxx 1001 xxxx */
234 /* UMLALS cccc 0000 1011 xxxx xxxx xxxx 1001 xxxx */
235 /* SMULL cccc 0000 1100 xxxx xxxx xxxx 1001 xxxx */
236 /* SMULLS cccc 0000 1101 xxxx xxxx xxxx 1001 xxxx */
237 /* SMLAL cccc 0000 1110 xxxx xxxx xxxx 1001 xxxx */
238 /* SMLALS cccc 0000 1111 xxxx xxxx xxxx 1001 xxxx */
239 DECODE_EMULATEX (0x0f8000f0, 0x00800090, PROBES_MUL1,
240 REGS(NOPC, NOPC, NOPC, 0, NOPC)),
241
242 DECODE_END
243 };
244
245 static const union decode_item arm_cccc_0001_____1001_table[] = {
246 /* Synchronization primitives */
247
248 #if __LINUX_ARM_ARCH__ < 6
249 /* Deprecated on ARMv6 and may be UNDEFINED on v7 */
250 /* SMP/SWPB cccc 0001 0x00 xxxx xxxx xxxx 1001 xxxx */
251 DECODE_EMULATEX (0x0fb000f0, 0x01000090, PROBES_SWP,
252 REGS(NOPC, NOPC, 0, 0, NOPC)),
253 #endif
254 /* LDREX/STREX{,D,B,H} cccc 0001 1xxx xxxx xxxx xxxx 1001 xxxx */
255 /* And unallocated instructions... */
256 DECODE_END
257 };
258
259 static const union decode_item arm_cccc_000x_____1xx1_table[] = {
260 /* Extra load/store instructions */
261
262 /* STRHT cccc 0000 xx10 xxxx xxxx xxxx 1011 xxxx */
263 /* ??? cccc 0000 xx10 xxxx xxxx xxxx 11x1 xxxx */
264 /* LDRHT cccc 0000 xx11 xxxx xxxx xxxx 1011 xxxx */
265 /* LDRSBT cccc 0000 xx11 xxxx xxxx xxxx 1101 xxxx */
266 /* LDRSHT cccc 0000 xx11 xxxx xxxx xxxx 1111 xxxx */
267 DECODE_REJECT (0x0f200090, 0x00200090),
268
269 /* LDRD/STRD lr,pc,{... cccc 000x x0x0 xxxx 111x xxxx 1101 xxxx */
270 DECODE_REJECT (0x0e10e0d0, 0x0000e0d0),
271
272 /* LDRD (register) cccc 000x x0x0 xxxx xxxx xxxx 1101 xxxx */
273 /* STRD (register) cccc 000x x0x0 xxxx xxxx xxxx 1111 xxxx */
274 DECODE_EMULATEX (0x0e5000d0, 0x000000d0, PROBES_LDRSTRD,
275 REGS(NOPCWB, NOPCX, 0, 0, NOPC)),
276
277 /* LDRD (immediate) cccc 000x x1x0 xxxx xxxx xxxx 1101 xxxx */
278 /* STRD (immediate) cccc 000x x1x0 xxxx xxxx xxxx 1111 xxxx */
279 DECODE_EMULATEX (0x0e5000d0, 0x004000d0, PROBES_LDRSTRD,
280 REGS(NOPCWB, NOPCX, 0, 0, 0)),
281
282 /* STRH (register) cccc 000x x0x0 xxxx xxxx xxxx 1011 xxxx */
283 DECODE_EMULATEX (0x0e5000f0, 0x000000b0, PROBES_STORE_EXTRA,
284 REGS(NOPCWB, NOPC, 0, 0, NOPC)),
285
286 /* LDRH (register) cccc 000x x0x1 xxxx xxxx xxxx 1011 xxxx */
287 /* LDRSB (register) cccc 000x x0x1 xxxx xxxx xxxx 1101 xxxx */
288 /* LDRSH (register) cccc 000x x0x1 xxxx xxxx xxxx 1111 xxxx */
289 DECODE_EMULATEX (0x0e500090, 0x00100090, PROBES_LOAD_EXTRA,
290 REGS(NOPCWB, NOPC, 0, 0, NOPC)),
291
292 /* STRH (immediate) cccc 000x x1x0 xxxx xxxx xxxx 1011 xxxx */
293 DECODE_EMULATEX (0x0e5000f0, 0x004000b0, PROBES_STORE_EXTRA,
294 REGS(NOPCWB, NOPC, 0, 0, 0)),
295
296 /* LDRH (immediate) cccc 000x x1x1 xxxx xxxx xxxx 1011 xxxx */
297 /* LDRSB (immediate) cccc 000x x1x1 xxxx xxxx xxxx 1101 xxxx */
298 /* LDRSH (immediate) cccc 000x x1x1 xxxx xxxx xxxx 1111 xxxx */
299 DECODE_EMULATEX (0x0e500090, 0x00500090, PROBES_LOAD_EXTRA,
300 REGS(NOPCWB, NOPC, 0, 0, 0)),
301
302 DECODE_END
303 };
304
305 static const union decode_item arm_cccc_000x_table[] = {
306 /* Data-processing (register) */
307
308 /* <op>S PC, ... cccc 000x xxx1 xxxx 1111 xxxx xxxx xxxx */
309 DECODE_REJECT (0x0e10f000, 0x0010f000),
310
311 /* MOV IP, SP 1110 0001 1010 0000 1100 0000 0000 1101 */
312 DECODE_SIMULATE (0xffffffff, 0xe1a0c00d, PROBES_MOV_IP_SP),
313
314 /* TST (register) cccc 0001 0001 xxxx xxxx xxxx xxx0 xxxx */
315 /* TEQ (register) cccc 0001 0011 xxxx xxxx xxxx xxx0 xxxx */
316 /* CMP (register) cccc 0001 0101 xxxx xxxx xxxx xxx0 xxxx */
317 /* CMN (register) cccc 0001 0111 xxxx xxxx xxxx xxx0 xxxx */
318 DECODE_EMULATEX (0x0f900010, 0x01100000, PROBES_DATA_PROCESSING_REG,
319 REGS(ANY, 0, 0, 0, ANY)),
320
321 /* MOV (register) cccc 0001 101x xxxx xxxx xxxx xxx0 xxxx */
322 /* MVN (register) cccc 0001 111x xxxx xxxx xxxx xxx0 xxxx */
323 DECODE_EMULATEX (0x0fa00010, 0x01a00000, PROBES_DATA_PROCESSING_REG,
324 REGS(0, ANY, 0, 0, ANY)),
325
326 /* AND (register) cccc 0000 000x xxxx xxxx xxxx xxx0 xxxx */
327 /* EOR (register) cccc 0000 001x xxxx xxxx xxxx xxx0 xxxx */
328 /* SUB (register) cccc 0000 010x xxxx xxxx xxxx xxx0 xxxx */
329 /* RSB (register) cccc 0000 011x xxxx xxxx xxxx xxx0 xxxx */
330 /* ADD (register) cccc 0000 100x xxxx xxxx xxxx xxx0 xxxx */
331 /* ADC (register) cccc 0000 101x xxxx xxxx xxxx xxx0 xxxx */
332 /* SBC (register) cccc 0000 110x xxxx xxxx xxxx xxx0 xxxx */
333 /* RSC (register) cccc 0000 111x xxxx xxxx xxxx xxx0 xxxx */
334 /* ORR (register) cccc 0001 100x xxxx xxxx xxxx xxx0 xxxx */
335 /* BIC (register) cccc 0001 110x xxxx xxxx xxxx xxx0 xxxx */
336 DECODE_EMULATEX (0x0e000010, 0x00000000, PROBES_DATA_PROCESSING_REG,
337 REGS(ANY, ANY, 0, 0, ANY)),
338
339 /* TST (reg-shift reg) cccc 0001 0001 xxxx xxxx xxxx 0xx1 xxxx */
340 /* TEQ (reg-shift reg) cccc 0001 0011 xxxx xxxx xxxx 0xx1 xxxx */
341 /* CMP (reg-shift reg) cccc 0001 0101 xxxx xxxx xxxx 0xx1 xxxx */
342 /* CMN (reg-shift reg) cccc 0001 0111 xxxx xxxx xxxx 0xx1 xxxx */
343 DECODE_EMULATEX (0x0f900090, 0x01100010, PROBES_DATA_PROCESSING_REG,
344 REGS(NOPC, 0, NOPC, 0, NOPC)),
345
346 /* MOV (reg-shift reg) cccc 0001 101x xxxx xxxx xxxx 0xx1 xxxx */
347 /* MVN (reg-shift reg) cccc 0001 111x xxxx xxxx xxxx 0xx1 xxxx */
348 DECODE_EMULATEX (0x0fa00090, 0x01a00010, PROBES_DATA_PROCESSING_REG,
349 REGS(0, NOPC, NOPC, 0, NOPC)),
350
351 /* AND (reg-shift reg) cccc 0000 000x xxxx xxxx xxxx 0xx1 xxxx */
352 /* EOR (reg-shift reg) cccc 0000 001x xxxx xxxx xxxx 0xx1 xxxx */
353 /* SUB (reg-shift reg) cccc 0000 010x xxxx xxxx xxxx 0xx1 xxxx */
354 /* RSB (reg-shift reg) cccc 0000 011x xxxx xxxx xxxx 0xx1 xxxx */
355 /* ADD (reg-shift reg) cccc 0000 100x xxxx xxxx xxxx 0xx1 xxxx */
356 /* ADC (reg-shift reg) cccc 0000 101x xxxx xxxx xxxx 0xx1 xxxx */
357 /* SBC (reg-shift reg) cccc 0000 110x xxxx xxxx xxxx 0xx1 xxxx */
358 /* RSC (reg-shift reg) cccc 0000 111x xxxx xxxx xxxx 0xx1 xxxx */
359 /* ORR (reg-shift reg) cccc 0001 100x xxxx xxxx xxxx 0xx1 xxxx */
360 /* BIC (reg-shift reg) cccc 0001 110x xxxx xxxx xxxx 0xx1 xxxx */
361 DECODE_EMULATEX (0x0e000090, 0x00000010, PROBES_DATA_PROCESSING_REG,
362 REGS(NOPC, NOPC, NOPC, 0, NOPC)),
363
364 DECODE_END
365 };
366
367 static const union decode_item arm_cccc_001x_table[] = {
368 /* Data-processing (immediate) */
369
370 /* MOVW cccc 0011 0000 xxxx xxxx xxxx xxxx xxxx */
371 /* MOVT cccc 0011 0100 xxxx xxxx xxxx xxxx xxxx */
372 DECODE_EMULATEX (0x0fb00000, 0x03000000, PROBES_DATA_PROCESSING_IMM,
373 REGS(0, NOPC, 0, 0, 0)),
374
375 /* YIELD cccc 0011 0010 0000 xxxx xxxx 0000 0001 */
376 DECODE_OR (0x0fff00ff, 0x03200001),
377 /* SEV cccc 0011 0010 0000 xxxx xxxx 0000 0100 */
378 DECODE_EMULATE (0x0fff00ff, 0x03200004, PROBES_EMULATE_NONE),
379 /* NOP cccc 0011 0010 0000 xxxx xxxx 0000 0000 */
380 /* WFE cccc 0011 0010 0000 xxxx xxxx 0000 0010 */
381 /* WFI cccc 0011 0010 0000 xxxx xxxx 0000 0011 */
382 DECODE_SIMULATE (0x0fff00fc, 0x03200000, PROBES_SIMULATE_NOP),
383 /* DBG cccc 0011 0010 0000 xxxx xxxx ffff xxxx */
384 /* unallocated hints cccc 0011 0010 0000 xxxx xxxx xxxx xxxx */
385 /* MSR (immediate) cccc 0011 0x10 xxxx xxxx xxxx xxxx xxxx */
386 DECODE_REJECT (0x0fb00000, 0x03200000),
387
388 /* <op>S PC, ... cccc 001x xxx1 xxxx 1111 xxxx xxxx xxxx */
389 DECODE_REJECT (0x0e10f000, 0x0210f000),
390
391 /* TST (immediate) cccc 0011 0001 xxxx xxxx xxxx xxxx xxxx */
392 /* TEQ (immediate) cccc 0011 0011 xxxx xxxx xxxx xxxx xxxx */
393 /* CMP (immediate) cccc 0011 0101 xxxx xxxx xxxx xxxx xxxx */
394 /* CMN (immediate) cccc 0011 0111 xxxx xxxx xxxx xxxx xxxx */
395 DECODE_EMULATEX (0x0f900000, 0x03100000, PROBES_DATA_PROCESSING_IMM,
396 REGS(ANY, 0, 0, 0, 0)),
397
398 /* MOV (immediate) cccc 0011 101x xxxx xxxx xxxx xxxx xxxx */
399 /* MVN (immediate) cccc 0011 111x xxxx xxxx xxxx xxxx xxxx */
400 DECODE_EMULATEX (0x0fa00000, 0x03a00000, PROBES_DATA_PROCESSING_IMM,
401 REGS(0, ANY, 0, 0, 0)),
402
403 /* AND (immediate) cccc 0010 000x xxxx xxxx xxxx xxxx xxxx */
404 /* EOR (immediate) cccc 0010 001x xxxx xxxx xxxx xxxx xxxx */
405 /* SUB (immediate) cccc 0010 010x xxxx xxxx xxxx xxxx xxxx */
406 /* RSB (immediate) cccc 0010 011x xxxx xxxx xxxx xxxx xxxx */
407 /* ADD (immediate) cccc 0010 100x xxxx xxxx xxxx xxxx xxxx */
408 /* ADC (immediate) cccc 0010 101x xxxx xxxx xxxx xxxx xxxx */
409 /* SBC (immediate) cccc 0010 110x xxxx xxxx xxxx xxxx xxxx */
410 /* RSC (immediate) cccc 0010 111x xxxx xxxx xxxx xxxx xxxx */
411 /* ORR (immediate) cccc 0011 100x xxxx xxxx xxxx xxxx xxxx */
412 /* BIC (immediate) cccc 0011 110x xxxx xxxx xxxx xxxx xxxx */
413 DECODE_EMULATEX (0x0e000000, 0x02000000, PROBES_DATA_PROCESSING_IMM,
414 REGS(ANY, ANY, 0, 0, 0)),
415
416 DECODE_END
417 };
418
419 static const union decode_item arm_cccc_0110_____xxx1_table[] = {
420 /* Media instructions */
421
422 /* SEL cccc 0110 1000 xxxx xxxx xxxx 1011 xxxx */
423 DECODE_EMULATEX (0x0ff000f0, 0x068000b0, PROBES_SATURATE,
424 REGS(NOPC, NOPC, 0, 0, NOPC)),
425
426 /* SSAT cccc 0110 101x xxxx xxxx xxxx xx01 xxxx */
427 /* USAT cccc 0110 111x xxxx xxxx xxxx xx01 xxxx */
428 DECODE_OR(0x0fa00030, 0x06a00010),
429 /* SSAT16 cccc 0110 1010 xxxx xxxx xxxx 0011 xxxx */
430 /* USAT16 cccc 0110 1110 xxxx xxxx xxxx 0011 xxxx */
431 DECODE_EMULATEX (0x0fb000f0, 0x06a00030, PROBES_SATURATE,
432 REGS(0, NOPC, 0, 0, NOPC)),
433
434 /* REV cccc 0110 1011 xxxx xxxx xxxx 0011 xxxx */
435 /* REV16 cccc 0110 1011 xxxx xxxx xxxx 1011 xxxx */
436 /* RBIT cccc 0110 1111 xxxx xxxx xxxx 0011 xxxx */
437 /* REVSH cccc 0110 1111 xxxx xxxx xxxx 1011 xxxx */
438 DECODE_EMULATEX (0x0fb00070, 0x06b00030, PROBES_REV,
439 REGS(0, NOPC, 0, 0, NOPC)),
440
441 /* ??? cccc 0110 0x00 xxxx xxxx xxxx xxx1 xxxx */
442 DECODE_REJECT (0x0fb00010, 0x06000010),
443 /* ??? cccc 0110 0xxx xxxx xxxx xxxx 1011 xxxx */
444 DECODE_REJECT (0x0f8000f0, 0x060000b0),
445 /* ??? cccc 0110 0xxx xxxx xxxx xxxx 1101 xxxx */
446 DECODE_REJECT (0x0f8000f0, 0x060000d0),
447 /* SADD16 cccc 0110 0001 xxxx xxxx xxxx 0001 xxxx */
448 /* SADDSUBX cccc 0110 0001 xxxx xxxx xxxx 0011 xxxx */
449 /* SSUBADDX cccc 0110 0001 xxxx xxxx xxxx 0101 xxxx */
450 /* SSUB16 cccc 0110 0001 xxxx xxxx xxxx 0111 xxxx */
451 /* SADD8 cccc 0110 0001 xxxx xxxx xxxx 1001 xxxx */
452 /* SSUB8 cccc 0110 0001 xxxx xxxx xxxx 1111 xxxx */
453 /* QADD16 cccc 0110 0010 xxxx xxxx xxxx 0001 xxxx */
454 /* QADDSUBX cccc 0110 0010 xxxx xxxx xxxx 0011 xxxx */
455 /* QSUBADDX cccc 0110 0010 xxxx xxxx xxxx 0101 xxxx */
456 /* QSUB16 cccc 0110 0010 xxxx xxxx xxxx 0111 xxxx */
457 /* QADD8 cccc 0110 0010 xxxx xxxx xxxx 1001 xxxx */
458 /* QSUB8 cccc 0110 0010 xxxx xxxx xxxx 1111 xxxx */
459 /* SHADD16 cccc 0110 0011 xxxx xxxx xxxx 0001 xxxx */
460 /* SHADDSUBX cccc 0110 0011 xxxx xxxx xxxx 0011 xxxx */
461 /* SHSUBADDX cccc 0110 0011 xxxx xxxx xxxx 0101 xxxx */
462 /* SHSUB16 cccc 0110 0011 xxxx xxxx xxxx 0111 xxxx */
463 /* SHADD8 cccc 0110 0011 xxxx xxxx xxxx 1001 xxxx */
464 /* SHSUB8 cccc 0110 0011 xxxx xxxx xxxx 1111 xxxx */
465 /* UADD16 cccc 0110 0101 xxxx xxxx xxxx 0001 xxxx */
466 /* UADDSUBX cccc 0110 0101 xxxx xxxx xxxx 0011 xxxx */
467 /* USUBADDX cccc 0110 0101 xxxx xxxx xxxx 0101 xxxx */
468 /* USUB16 cccc 0110 0101 xxxx xxxx xxxx 0111 xxxx */
469 /* UADD8 cccc 0110 0101 xxxx xxxx xxxx 1001 xxxx */
470 /* USUB8 cccc 0110 0101 xxxx xxxx xxxx 1111 xxxx */
471 /* UQADD16 cccc 0110 0110 xxxx xxxx xxxx 0001 xxxx */
472 /* UQADDSUBX cccc 0110 0110 xxxx xxxx xxxx 0011 xxxx */
473 /* UQSUBADDX cccc 0110 0110 xxxx xxxx xxxx 0101 xxxx */
474 /* UQSUB16 cccc 0110 0110 xxxx xxxx xxxx 0111 xxxx */
475 /* UQADD8 cccc 0110 0110 xxxx xxxx xxxx 1001 xxxx */
476 /* UQSUB8 cccc 0110 0110 xxxx xxxx xxxx 1111 xxxx */
477 /* UHADD16 cccc 0110 0111 xxxx xxxx xxxx 0001 xxxx */
478 /* UHADDSUBX cccc 0110 0111 xxxx xxxx xxxx 0011 xxxx */
479 /* UHSUBADDX cccc 0110 0111 xxxx xxxx xxxx 0101 xxxx */
480 /* UHSUB16 cccc 0110 0111 xxxx xxxx xxxx 0111 xxxx */
481 /* UHADD8 cccc 0110 0111 xxxx xxxx xxxx 1001 xxxx */
482 /* UHSUB8 cccc 0110 0111 xxxx xxxx xxxx 1111 xxxx */
483 DECODE_EMULATEX (0x0f800010, 0x06000010, PROBES_MMI,
484 REGS(NOPC, NOPC, 0, 0, NOPC)),
485
486 /* PKHBT cccc 0110 1000 xxxx xxxx xxxx x001 xxxx */
487 /* PKHTB cccc 0110 1000 xxxx xxxx xxxx x101 xxxx */
488 DECODE_EMULATEX (0x0ff00030, 0x06800010, PROBES_PACK,
489 REGS(NOPC, NOPC, 0, 0, NOPC)),
490
491 /* ??? cccc 0110 1001 xxxx xxxx xxxx 0111 xxxx */
492 /* ??? cccc 0110 1101 xxxx xxxx xxxx 0111 xxxx */
493 DECODE_REJECT (0x0fb000f0, 0x06900070),
494
495 /* SXTB16 cccc 0110 1000 1111 xxxx xxxx 0111 xxxx */
496 /* SXTB cccc 0110 1010 1111 xxxx xxxx 0111 xxxx */
497 /* SXTH cccc 0110 1011 1111 xxxx xxxx 0111 xxxx */
498 /* UXTB16 cccc 0110 1100 1111 xxxx xxxx 0111 xxxx */
499 /* UXTB cccc 0110 1110 1111 xxxx xxxx 0111 xxxx */
500 /* UXTH cccc 0110 1111 1111 xxxx xxxx 0111 xxxx */
501 DECODE_EMULATEX (0x0f8f00f0, 0x068f0070, PROBES_EXTEND,
502 REGS(0, NOPC, 0, 0, NOPC)),
503
504 /* SXTAB16 cccc 0110 1000 xxxx xxxx xxxx 0111 xxxx */
505 /* SXTAB cccc 0110 1010 xxxx xxxx xxxx 0111 xxxx */
506 /* SXTAH cccc 0110 1011 xxxx xxxx xxxx 0111 xxxx */
507 /* UXTAB16 cccc 0110 1100 xxxx xxxx xxxx 0111 xxxx */
508 /* UXTAB cccc 0110 1110 xxxx xxxx xxxx 0111 xxxx */
509 /* UXTAH cccc 0110 1111 xxxx xxxx xxxx 0111 xxxx */
510 DECODE_EMULATEX (0x0f8000f0, 0x06800070, PROBES_EXTEND_ADD,
511 REGS(NOPCX, NOPC, 0, 0, NOPC)),
512
513 DECODE_END
514 };
515
516 static const union decode_item arm_cccc_0111_____xxx1_table[] = {
517 /* Media instructions */
518
519 /* UNDEFINED cccc 0111 1111 xxxx xxxx xxxx 1111 xxxx */
520 DECODE_REJECT (0x0ff000f0, 0x07f000f0),
521
522 /* SMLALD cccc 0111 0100 xxxx xxxx xxxx 00x1 xxxx */
523 /* SMLSLD cccc 0111 0100 xxxx xxxx xxxx 01x1 xxxx */
524 DECODE_EMULATEX (0x0ff00090, 0x07400010, PROBES_MUL_ADD_LONG,
525 REGS(NOPC, NOPC, NOPC, 0, NOPC)),
526
527 /* SMUAD cccc 0111 0000 xxxx 1111 xxxx 00x1 xxxx */
528 /* SMUSD cccc 0111 0000 xxxx 1111 xxxx 01x1 xxxx */
529 DECODE_OR (0x0ff0f090, 0x0700f010),
530 /* SMMUL cccc 0111 0101 xxxx 1111 xxxx 00x1 xxxx */
531 DECODE_OR (0x0ff0f0d0, 0x0750f010),
532 /* USAD8 cccc 0111 1000 xxxx 1111 xxxx 0001 xxxx */
533 DECODE_EMULATEX (0x0ff0f0f0, 0x0780f010, PROBES_MUL_ADD,
534 REGS(NOPC, 0, NOPC, 0, NOPC)),
535
536 /* SMLAD cccc 0111 0000 xxxx xxxx xxxx 00x1 xxxx */
537 /* SMLSD cccc 0111 0000 xxxx xxxx xxxx 01x1 xxxx */
538 DECODE_OR (0x0ff00090, 0x07000010),
539 /* SMMLA cccc 0111 0101 xxxx xxxx xxxx 00x1 xxxx */
540 DECODE_OR (0x0ff000d0, 0x07500010),
541 /* USADA8 cccc 0111 1000 xxxx xxxx xxxx 0001 xxxx */
542 DECODE_EMULATEX (0x0ff000f0, 0x07800010, PROBES_MUL_ADD,
543 REGS(NOPC, NOPCX, NOPC, 0, NOPC)),
544
545 /* SMMLS cccc 0111 0101 xxxx xxxx xxxx 11x1 xxxx */
546 DECODE_EMULATEX (0x0ff000d0, 0x075000d0, PROBES_MUL_ADD,
547 REGS(NOPC, NOPC, NOPC, 0, NOPC)),
548
549 /* SBFX cccc 0111 101x xxxx xxxx xxxx x101 xxxx */
550 /* UBFX cccc 0111 111x xxxx xxxx xxxx x101 xxxx */
551 DECODE_EMULATEX (0x0fa00070, 0x07a00050, PROBES_BITFIELD,
552 REGS(0, NOPC, 0, 0, NOPC)),
553
554 /* BFC cccc 0111 110x xxxx xxxx xxxx x001 1111 */
555 DECODE_EMULATEX (0x0fe0007f, 0x07c0001f, PROBES_BITFIELD,
556 REGS(0, NOPC, 0, 0, 0)),
557
558 /* BFI cccc 0111 110x xxxx xxxx xxxx x001 xxxx */
559 DECODE_EMULATEX (0x0fe00070, 0x07c00010, PROBES_BITFIELD,
560 REGS(0, NOPC, 0, 0, NOPCX)),
561
562 DECODE_END
563 };
564
565 static const union decode_item arm_cccc_01xx_table[] = {
566 /* Load/store word and unsigned byte */
567
568 /* LDRB/STRB pc,[...] cccc 01xx x0xx xxxx xxxx xxxx xxxx xxxx */
569 DECODE_REJECT (0x0c40f000, 0x0440f000),
570
571 /* STRT cccc 01x0 x010 xxxx xxxx xxxx xxxx xxxx */
572 /* LDRT cccc 01x0 x011 xxxx xxxx xxxx xxxx xxxx */
573 /* STRBT cccc 01x0 x110 xxxx xxxx xxxx xxxx xxxx */
574 /* LDRBT cccc 01x0 x111 xxxx xxxx xxxx xxxx xxxx */
575 DECODE_REJECT (0x0d200000, 0x04200000),
576
577 /* STR (immediate) cccc 010x x0x0 xxxx xxxx xxxx xxxx xxxx */
578 /* STRB (immediate) cccc 010x x1x0 xxxx xxxx xxxx xxxx xxxx */
579 DECODE_EMULATEX (0x0e100000, 0x04000000, PROBES_STORE,
580 REGS(NOPCWB, ANY, 0, 0, 0)),
581
582 /* LDR (immediate) cccc 010x x0x1 xxxx xxxx xxxx xxxx xxxx */
583 /* LDRB (immediate) cccc 010x x1x1 xxxx xxxx xxxx xxxx xxxx */
584 DECODE_EMULATEX (0x0e100000, 0x04100000, PROBES_LOAD,
585 REGS(NOPCWB, ANY, 0, 0, 0)),
586
587 /* STR (register) cccc 011x x0x0 xxxx xxxx xxxx xxxx xxxx */
588 /* STRB (register) cccc 011x x1x0 xxxx xxxx xxxx xxxx xxxx */
589 DECODE_EMULATEX (0x0e100000, 0x06000000, PROBES_STORE,
590 REGS(NOPCWB, ANY, 0, 0, NOPC)),
591
592 /* LDR (register) cccc 011x x0x1 xxxx xxxx xxxx xxxx xxxx */
593 /* LDRB (register) cccc 011x x1x1 xxxx xxxx xxxx xxxx xxxx */
594 DECODE_EMULATEX (0x0e100000, 0x06100000, PROBES_LOAD,
595 REGS(NOPCWB, ANY, 0, 0, NOPC)),
596
597 DECODE_END
598 };
599
600 static const union decode_item arm_cccc_100x_table[] = {
601 /* Block data transfer instructions */
602
603 /* LDM cccc 100x x0x1 xxxx xxxx xxxx xxxx xxxx */
604 /* STM cccc 100x x0x0 xxxx xxxx xxxx xxxx xxxx */
605 DECODE_CUSTOM (0x0e400000, 0x08000000, PROBES_LDMSTM),
606
607 /* STM (user registers) cccc 100x x1x0 xxxx xxxx xxxx xxxx xxxx */
608 /* LDM (user registers) cccc 100x x1x1 xxxx 0xxx xxxx xxxx xxxx */
609 /* LDM (exception ret) cccc 100x x1x1 xxxx 1xxx xxxx xxxx xxxx */
610 DECODE_END
611 };
612
613 const union decode_item probes_decode_arm_table[] = {
614 /*
615 * Unconditional instructions
616 * 1111 xxxx xxxx xxxx xxxx xxxx xxxx xxxx
617 */
618 DECODE_TABLE (0xf0000000, 0xf0000000, arm_1111_table),
619
620 /*
621 * Miscellaneous instructions
622 * cccc 0001 0xx0 xxxx xxxx xxxx 0xxx xxxx
623 */
624 DECODE_TABLE (0x0f900080, 0x01000000, arm_cccc_0001_0xx0____0xxx_table),
625
626 /*
627 * Halfword multiply and multiply-accumulate
628 * cccc 0001 0xx0 xxxx xxxx xxxx 1xx0 xxxx
629 */
630 DECODE_TABLE (0x0f900090, 0x01000080, arm_cccc_0001_0xx0____1xx0_table),
631
632 /*
633 * Multiply and multiply-accumulate
634 * cccc 0000 xxxx xxxx xxxx xxxx 1001 xxxx
635 */
636 DECODE_TABLE (0x0f0000f0, 0x00000090, arm_cccc_0000_____1001_table),
637
638 /*
639 * Synchronization primitives
640 * cccc 0001 xxxx xxxx xxxx xxxx 1001 xxxx
641 */
642 DECODE_TABLE (0x0f0000f0, 0x01000090, arm_cccc_0001_____1001_table),
643
644 /*
645 * Extra load/store instructions
646 * cccc 000x xxxx xxxx xxxx xxxx 1xx1 xxxx
647 */
648 DECODE_TABLE (0x0e000090, 0x00000090, arm_cccc_000x_____1xx1_table),
649
650 /*
651 * Data-processing (register)
652 * cccc 000x xxxx xxxx xxxx xxxx xxx0 xxxx
653 * Data-processing (register-shifted register)
654 * cccc 000x xxxx xxxx xxxx xxxx 0xx1 xxxx
655 */
656 DECODE_TABLE (0x0e000000, 0x00000000, arm_cccc_000x_table),
657
658 /*
659 * Data-processing (immediate)
660 * cccc 001x xxxx xxxx xxxx xxxx xxxx xxxx
661 */
662 DECODE_TABLE (0x0e000000, 0x02000000, arm_cccc_001x_table),
663
664 /*
665 * Media instructions
666 * cccc 011x xxxx xxxx xxxx xxxx xxx1 xxxx
667 */
668 DECODE_TABLE (0x0f000010, 0x06000010, arm_cccc_0110_____xxx1_table),
669 DECODE_TABLE (0x0f000010, 0x07000010, arm_cccc_0111_____xxx1_table),
670
671 /*
672 * Load/store word and unsigned byte
673 * cccc 01xx xxxx xxxx xxxx xxxx xxxx xxxx
674 */
675 DECODE_TABLE (0x0c000000, 0x04000000, arm_cccc_01xx_table),
676
677 /*
678 * Block data transfer instructions
679 * cccc 100x xxxx xxxx xxxx xxxx xxxx xxxx
680 */
681 DECODE_TABLE (0x0e000000, 0x08000000, arm_cccc_100x_table),
682
683 /* B cccc 1010 xxxx xxxx xxxx xxxx xxxx xxxx */
684 /* BL cccc 1011 xxxx xxxx xxxx xxxx xxxx xxxx */
685 DECODE_SIMULATE (0x0e000000, 0x0a000000, PROBES_BRANCH),
686
687 /*
688 * Supervisor Call, and coprocessor instructions
689 */
690
691 /* MCRR cccc 1100 0100 xxxx xxxx xxxx xxxx xxxx */
692 /* MRRC cccc 1100 0101 xxxx xxxx xxxx xxxx xxxx */
693 /* LDC cccc 110x xxx1 xxxx xxxx xxxx xxxx xxxx */
694 /* STC cccc 110x xxx0 xxxx xxxx xxxx xxxx xxxx */
695 /* CDP cccc 1110 xxxx xxxx xxxx xxxx xxx0 xxxx */
696 /* MCR cccc 1110 xxx0 xxxx xxxx xxxx xxx1 xxxx */
697 /* MRC cccc 1110 xxx1 xxxx xxxx xxxx xxx1 xxxx */
698 /* SVC cccc 1111 xxxx xxxx xxxx xxxx xxxx xxxx */
699 DECODE_REJECT (0x0c000000, 0x0c000000),
700
701 DECODE_END
702 };
703 #ifdef CONFIG_ARM_KPROBES_TEST_MODULE
704 EXPORT_SYMBOL_GPL(probes_decode_arm_table);
705 #endif
706
arm_singlestep(probes_opcode_t insn,struct arch_probes_insn * asi,struct pt_regs * regs)707 static void __kprobes arm_singlestep(probes_opcode_t insn,
708 struct arch_probes_insn *asi, struct pt_regs *regs)
709 {
710 regs->ARM_pc += 4;
711 asi->insn_handler(insn, asi, regs);
712 }
713
714 /* Return:
715 * INSN_REJECTED If instruction is one not allowed to kprobe,
716 * INSN_GOOD If instruction is supported and uses instruction slot,
717 * INSN_GOOD_NO_SLOT If instruction is supported but doesn't use its slot.
718 *
719 * For instructions we don't want to kprobe (INSN_REJECTED return result):
720 * These are generally ones that modify the processor state making
721 * them "hard" to simulate such as switches processor modes or
722 * make accesses in alternate modes. Any of these could be simulated
723 * if the work was put into it, but low return considering they
724 * should also be very rare.
725 */
726 enum probes_insn __kprobes
arm_probes_decode_insn(probes_opcode_t insn,struct arch_probes_insn * asi,bool emulate,const union decode_action * actions)727 arm_probes_decode_insn(probes_opcode_t insn, struct arch_probes_insn *asi,
728 bool emulate, const union decode_action *actions)
729 {
730 asi->insn_singlestep = arm_singlestep;
731 asi->insn_check_cc = probes_condition_checks[insn>>28];
732 return probes_decode_insn(insn, asi, probes_decode_arm_table, false,
733 emulate, actions);
734 }
735