decode.c 13 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518
  1. // SPDX-License-Identifier: GPL-2.0-only
  2. /*
  3. * arch/arm/probes/decode.c
  4. *
  5. * Copyright (C) 2011 Jon Medhurst <[email protected]>.
  6. *
  7. * Some contents moved here from arch/arm/include/asm/kprobes-arm.c which is
  8. * Copyright (C) 2006, 2007 Motorola Inc.
  9. */
  10. #include <linux/kernel.h>
  11. #include <linux/types.h>
  12. #include <asm/system_info.h>
  13. #include <asm/ptrace.h>
  14. #include <linux/bug.h>
  15. #include "decode.h"
  16. #ifndef find_str_pc_offset
  17. /*
  18. * For STR and STM instructions, an ARM core may choose to use either
  19. * a +8 or a +12 displacement from the current instruction's address.
  20. * Whichever value is chosen for a given core, it must be the same for
  21. * both instructions and may not change. This function measures it.
  22. */
  23. int str_pc_offset;
  24. void __init find_str_pc_offset(void)
  25. {
  26. int addr, scratch, ret;
  27. __asm__ (
  28. "sub %[ret], pc, #4 \n\t"
  29. "str pc, %[addr] \n\t"
  30. "ldr %[scr], %[addr] \n\t"
  31. "sub %[ret], %[scr], %[ret] \n\t"
  32. : [ret] "=r" (ret), [scr] "=r" (scratch), [addr] "+m" (addr));
  33. str_pc_offset = ret;
  34. }
  35. #endif /* !find_str_pc_offset */
  36. #ifndef test_load_write_pc_interworking
  37. bool load_write_pc_interworks;
  38. void __init test_load_write_pc_interworking(void)
  39. {
  40. int arch = cpu_architecture();
  41. BUG_ON(arch == CPU_ARCH_UNKNOWN);
  42. load_write_pc_interworks = arch >= CPU_ARCH_ARMv5T;
  43. }
  44. #endif /* !test_load_write_pc_interworking */
  45. #ifndef test_alu_write_pc_interworking
  46. bool alu_write_pc_interworks;
  47. void __init test_alu_write_pc_interworking(void)
  48. {
  49. int arch = cpu_architecture();
  50. BUG_ON(arch == CPU_ARCH_UNKNOWN);
  51. alu_write_pc_interworks = arch >= CPU_ARCH_ARMv7;
  52. }
  53. #endif /* !test_alu_write_pc_interworking */
  54. void __init arm_probes_decode_init(void)
  55. {
  56. find_str_pc_offset();
  57. test_load_write_pc_interworking();
  58. test_alu_write_pc_interworking();
  59. }
  60. static unsigned long __kprobes __check_eq(unsigned long cpsr)
  61. {
  62. return cpsr & PSR_Z_BIT;
  63. }
  64. static unsigned long __kprobes __check_ne(unsigned long cpsr)
  65. {
  66. return (~cpsr) & PSR_Z_BIT;
  67. }
  68. static unsigned long __kprobes __check_cs(unsigned long cpsr)
  69. {
  70. return cpsr & PSR_C_BIT;
  71. }
  72. static unsigned long __kprobes __check_cc(unsigned long cpsr)
  73. {
  74. return (~cpsr) & PSR_C_BIT;
  75. }
  76. static unsigned long __kprobes __check_mi(unsigned long cpsr)
  77. {
  78. return cpsr & PSR_N_BIT;
  79. }
  80. static unsigned long __kprobes __check_pl(unsigned long cpsr)
  81. {
  82. return (~cpsr) & PSR_N_BIT;
  83. }
  84. static unsigned long __kprobes __check_vs(unsigned long cpsr)
  85. {
  86. return cpsr & PSR_V_BIT;
  87. }
  88. static unsigned long __kprobes __check_vc(unsigned long cpsr)
  89. {
  90. return (~cpsr) & PSR_V_BIT;
  91. }
  92. static unsigned long __kprobes __check_hi(unsigned long cpsr)
  93. {
  94. cpsr &= ~(cpsr >> 1); /* PSR_C_BIT &= ~PSR_Z_BIT */
  95. return cpsr & PSR_C_BIT;
  96. }
  97. static unsigned long __kprobes __check_ls(unsigned long cpsr)
  98. {
  99. cpsr &= ~(cpsr >> 1); /* PSR_C_BIT &= ~PSR_Z_BIT */
  100. return (~cpsr) & PSR_C_BIT;
  101. }
  102. static unsigned long __kprobes __check_ge(unsigned long cpsr)
  103. {
  104. cpsr ^= (cpsr << 3); /* PSR_N_BIT ^= PSR_V_BIT */
  105. return (~cpsr) & PSR_N_BIT;
  106. }
  107. static unsigned long __kprobes __check_lt(unsigned long cpsr)
  108. {
  109. cpsr ^= (cpsr << 3); /* PSR_N_BIT ^= PSR_V_BIT */
  110. return cpsr & PSR_N_BIT;
  111. }
  112. static unsigned long __kprobes __check_gt(unsigned long cpsr)
  113. {
  114. unsigned long temp = cpsr ^ (cpsr << 3); /* PSR_N_BIT ^= PSR_V_BIT */
  115. temp |= (cpsr << 1); /* PSR_N_BIT |= PSR_Z_BIT */
  116. return (~temp) & PSR_N_BIT;
  117. }
  118. static unsigned long __kprobes __check_le(unsigned long cpsr)
  119. {
  120. unsigned long temp = cpsr ^ (cpsr << 3); /* PSR_N_BIT ^= PSR_V_BIT */
  121. temp |= (cpsr << 1); /* PSR_N_BIT |= PSR_Z_BIT */
  122. return temp & PSR_N_BIT;
  123. }
  124. static unsigned long __kprobes __check_al(unsigned long cpsr)
  125. {
  126. return true;
  127. }
  128. probes_check_cc * const probes_condition_checks[16] = {
  129. &__check_eq, &__check_ne, &__check_cs, &__check_cc,
  130. &__check_mi, &__check_pl, &__check_vs, &__check_vc,
  131. &__check_hi, &__check_ls, &__check_ge, &__check_lt,
  132. &__check_gt, &__check_le, &__check_al, &__check_al
  133. };
  134. void __kprobes probes_simulate_nop(probes_opcode_t opcode,
  135. struct arch_probes_insn *asi,
  136. struct pt_regs *regs)
  137. {
  138. }
  139. void __kprobes probes_emulate_none(probes_opcode_t opcode,
  140. struct arch_probes_insn *asi,
  141. struct pt_regs *regs)
  142. {
  143. asi->insn_fn();
  144. }
  145. /*
  146. * Prepare an instruction slot to receive an instruction for emulating.
  147. * This is done by placing a subroutine return after the location where the
  148. * instruction will be placed. We also modify ARM instructions to be
  149. * unconditional as the condition code will already be checked before any
  150. * emulation handler is called.
  151. */
  152. static probes_opcode_t __kprobes
  153. prepare_emulated_insn(probes_opcode_t insn, struct arch_probes_insn *asi,
  154. bool thumb)
  155. {
  156. #ifdef CONFIG_THUMB2_KERNEL
  157. if (thumb) {
  158. u16 *thumb_insn = (u16 *)asi->insn;
  159. /* Thumb bx lr */
  160. thumb_insn[1] = __opcode_to_mem_thumb16(0x4770);
  161. thumb_insn[2] = __opcode_to_mem_thumb16(0x4770);
  162. return insn;
  163. }
  164. asi->insn[1] = __opcode_to_mem_arm(0xe12fff1e); /* ARM bx lr */
  165. #else
  166. asi->insn[1] = __opcode_to_mem_arm(0xe1a0f00e); /* mov pc, lr */
  167. #endif
  168. /* Make an ARM instruction unconditional */
  169. if (insn < 0xe0000000)
  170. insn = (insn | 0xe0000000) & ~0x10000000;
  171. return insn;
  172. }
  173. /*
  174. * Write a (probably modified) instruction into the slot previously prepared by
  175. * prepare_emulated_insn
  176. */
  177. static void __kprobes
  178. set_emulated_insn(probes_opcode_t insn, struct arch_probes_insn *asi,
  179. bool thumb)
  180. {
  181. #ifdef CONFIG_THUMB2_KERNEL
  182. if (thumb) {
  183. u16 *ip = (u16 *)asi->insn;
  184. if (is_wide_instruction(insn))
  185. *ip++ = __opcode_to_mem_thumb16(insn >> 16);
  186. *ip++ = __opcode_to_mem_thumb16(insn);
  187. return;
  188. }
  189. #endif
  190. asi->insn[0] = __opcode_to_mem_arm(insn);
  191. }
  192. /*
  193. * When we modify the register numbers encoded in an instruction to be emulated,
  194. * the new values come from this define. For ARM and 32-bit Thumb instructions
  195. * this gives...
  196. *
  197. * bit position 16 12 8 4 0
  198. * ---------------+---+---+---+---+---+
  199. * register r2 r0 r1 -- r3
  200. */
  201. #define INSN_NEW_BITS 0x00020103
  202. /* Each nibble has same value as that at INSN_NEW_BITS bit 16 */
  203. #define INSN_SAMEAS16_BITS 0x22222222
  204. /*
  205. * Validate and modify each of the registers encoded in an instruction.
  206. *
  207. * Each nibble in regs contains a value from enum decode_reg_type. For each
  208. * non-zero value, the corresponding nibble in pinsn is validated and modified
  209. * according to the type.
  210. */
  211. static bool __kprobes decode_regs(probes_opcode_t *pinsn, u32 regs, bool modify)
  212. {
  213. probes_opcode_t insn = *pinsn;
  214. probes_opcode_t mask = 0xf; /* Start at least significant nibble */
  215. for (; regs != 0; regs >>= 4, mask <<= 4) {
  216. probes_opcode_t new_bits = INSN_NEW_BITS;
  217. switch (regs & 0xf) {
  218. case REG_TYPE_NONE:
  219. /* Nibble not a register, skip to next */
  220. continue;
  221. case REG_TYPE_ANY:
  222. /* Any register is allowed */
  223. break;
  224. case REG_TYPE_SAMEAS16:
  225. /* Replace register with same as at bit position 16 */
  226. new_bits = INSN_SAMEAS16_BITS;
  227. break;
  228. case REG_TYPE_SP:
  229. /* Only allow SP (R13) */
  230. if ((insn ^ 0xdddddddd) & mask)
  231. goto reject;
  232. break;
  233. case REG_TYPE_PC:
  234. /* Only allow PC (R15) */
  235. if ((insn ^ 0xffffffff) & mask)
  236. goto reject;
  237. break;
  238. case REG_TYPE_NOSP:
  239. /* Reject SP (R13) */
  240. if (((insn ^ 0xdddddddd) & mask) == 0)
  241. goto reject;
  242. break;
  243. case REG_TYPE_NOSPPC:
  244. case REG_TYPE_NOSPPCX:
  245. /* Reject SP and PC (R13 and R15) */
  246. if (((insn ^ 0xdddddddd) & 0xdddddddd & mask) == 0)
  247. goto reject;
  248. break;
  249. case REG_TYPE_NOPCWB:
  250. if (!is_writeback(insn))
  251. break; /* No writeback, so any register is OK */
  252. fallthrough;
  253. case REG_TYPE_NOPC:
  254. case REG_TYPE_NOPCX:
  255. /* Reject PC (R15) */
  256. if (((insn ^ 0xffffffff) & mask) == 0)
  257. goto reject;
  258. break;
  259. }
  260. /* Replace value of nibble with new register number... */
  261. insn &= ~mask;
  262. insn |= new_bits & mask;
  263. }
  264. if (modify)
  265. *pinsn = insn;
  266. return true;
  267. reject:
  268. return false;
  269. }
  270. static const int decode_struct_sizes[NUM_DECODE_TYPES] = {
  271. [DECODE_TYPE_TABLE] = sizeof(struct decode_table),
  272. [DECODE_TYPE_CUSTOM] = sizeof(struct decode_custom),
  273. [DECODE_TYPE_SIMULATE] = sizeof(struct decode_simulate),
  274. [DECODE_TYPE_EMULATE] = sizeof(struct decode_emulate),
  275. [DECODE_TYPE_OR] = sizeof(struct decode_or),
  276. [DECODE_TYPE_REJECT] = sizeof(struct decode_reject)
  277. };
  278. static int run_checkers(const struct decode_checker *checkers[],
  279. int action, probes_opcode_t insn,
  280. struct arch_probes_insn *asi,
  281. const struct decode_header *h)
  282. {
  283. const struct decode_checker **p;
  284. if (!checkers)
  285. return INSN_GOOD;
  286. p = checkers;
  287. while (*p != NULL) {
  288. int retval;
  289. probes_check_t *checker_func = (*p)[action].checker;
  290. retval = INSN_GOOD;
  291. if (checker_func)
  292. retval = checker_func(insn, asi, h);
  293. if (retval == INSN_REJECTED)
  294. return retval;
  295. p++;
  296. }
  297. return INSN_GOOD;
  298. }
  299. /*
  300. * probes_decode_insn operates on data tables in order to decode an ARM
  301. * architecture instruction onto which a kprobe has been placed.
  302. *
  303. * These instruction decoding tables are a concatenation of entries each
  304. * of which consist of one of the following structs:
  305. *
  306. * decode_table
  307. * decode_custom
  308. * decode_simulate
  309. * decode_emulate
  310. * decode_or
  311. * decode_reject
  312. *
  313. * Each of these starts with a struct decode_header which has the following
  314. * fields:
  315. *
  316. * type_regs
  317. * mask
  318. * value
  319. *
  320. * The least significant DECODE_TYPE_BITS of type_regs contains a value
  321. * from enum decode_type, this indicates which of the decode_* structs
  322. * the entry contains. The value DECODE_TYPE_END indicates the end of the
  323. * table.
  324. *
  325. * When the table is parsed, each entry is checked in turn to see if it
  326. * matches the instruction to be decoded using the test:
  327. *
  328. * (insn & mask) == value
  329. *
  330. * If no match is found before the end of the table is reached then decoding
  331. * fails with INSN_REJECTED.
  332. *
  333. * When a match is found, decode_regs() is called to validate and modify each
  334. * of the registers encoded in the instruction; the data it uses to do this
  335. * is (type_regs >> DECODE_TYPE_BITS). A validation failure will cause decoding
  336. * to fail with INSN_REJECTED.
  337. *
  338. * Once the instruction has passed the above tests, further processing
  339. * depends on the type of the table entry's decode struct.
  340. *
  341. */
  342. int __kprobes
  343. probes_decode_insn(probes_opcode_t insn, struct arch_probes_insn *asi,
  344. const union decode_item *table, bool thumb,
  345. bool emulate, const union decode_action *actions,
  346. const struct decode_checker *checkers[])
  347. {
  348. const struct decode_header *h = (struct decode_header *)table;
  349. const struct decode_header *next;
  350. bool matched = false;
  351. /*
  352. * @insn can be modified by decode_regs. Save its original
  353. * value for checkers.
  354. */
  355. probes_opcode_t origin_insn = insn;
  356. /*
  357. * stack_space is initialized to 0 here. Checker functions
  358. * should update is value if they find this is a stack store
  359. * instruction: positive value means bytes of stack usage,
  360. * negitive value means unable to determine stack usage
  361. * statically. For instruction doesn't store to stack, checker
  362. * do nothing with it.
  363. */
  364. asi->stack_space = 0;
  365. /*
  366. * Similarly to stack_space, register_usage_flags is filled by
  367. * checkers. Its default value is set to ~0, which is 'all
  368. * registers are used', to prevent any potential optimization.
  369. */
  370. asi->register_usage_flags = ~0UL;
  371. if (emulate)
  372. insn = prepare_emulated_insn(insn, asi, thumb);
  373. for (;; h = next) {
  374. enum decode_type type = h->type_regs.bits & DECODE_TYPE_MASK;
  375. u32 regs = h->type_regs.bits >> DECODE_TYPE_BITS;
  376. if (type == DECODE_TYPE_END)
  377. return INSN_REJECTED;
  378. next = (struct decode_header *)
  379. ((uintptr_t)h + decode_struct_sizes[type]);
  380. if (!matched && (insn & h->mask.bits) != h->value.bits)
  381. continue;
  382. if (!decode_regs(&insn, regs, emulate))
  383. return INSN_REJECTED;
  384. switch (type) {
  385. case DECODE_TYPE_TABLE: {
  386. struct decode_table *d = (struct decode_table *)h;
  387. next = (struct decode_header *)d->table.table;
  388. break;
  389. }
  390. case DECODE_TYPE_CUSTOM: {
  391. int err;
  392. struct decode_custom *d = (struct decode_custom *)h;
  393. int action = d->decoder.action;
  394. err = run_checkers(checkers, action, origin_insn, asi, h);
  395. if (err == INSN_REJECTED)
  396. return INSN_REJECTED;
  397. return actions[action].decoder(insn, asi, h);
  398. }
  399. case DECODE_TYPE_SIMULATE: {
  400. int err;
  401. struct decode_simulate *d = (struct decode_simulate *)h;
  402. int action = d->handler.action;
  403. err = run_checkers(checkers, action, origin_insn, asi, h);
  404. if (err == INSN_REJECTED)
  405. return INSN_REJECTED;
  406. asi->insn_handler = actions[action].handler;
  407. return INSN_GOOD_NO_SLOT;
  408. }
  409. case DECODE_TYPE_EMULATE: {
  410. int err;
  411. struct decode_emulate *d = (struct decode_emulate *)h;
  412. int action = d->handler.action;
  413. err = run_checkers(checkers, action, origin_insn, asi, h);
  414. if (err == INSN_REJECTED)
  415. return INSN_REJECTED;
  416. if (!emulate)
  417. return actions[action].decoder(insn, asi, h);
  418. asi->insn_handler = actions[action].handler;
  419. set_emulated_insn(insn, asi, thumb);
  420. return INSN_GOOD;
  421. }
  422. case DECODE_TYPE_OR:
  423. matched = true;
  424. break;
  425. case DECODE_TYPE_REJECT:
  426. default:
  427. return INSN_REJECTED;
  428. }
  429. }
  430. }