kprobes-thumb.c 19 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666
  1. /*
  2. * arch/arm/kernel/kprobes-thumb.c
  3. *
  4. * Copyright (C) 2011 Jon Medhurst <tixy@yxit.co.uk>.
  5. *
  6. * This program is free software; you can redistribute it and/or modify
  7. * it under the terms of the GNU General Public License version 2 as
  8. * published by the Free Software Foundation.
  9. */
  10. #include <linux/types.h>
  11. #include <linux/kernel.h>
  12. #include <linux/ptrace.h>
  13. #include <linux/kprobes.h>
  14. #include "kprobes.h"
  15. #include "probes-thumb.h"
  16. /* These emulation encodings are functionally equivalent... */
  17. #define t32_emulate_rd8rn16rm0ra12_noflags \
  18. t32_emulate_rdlo12rdhi8rn16rm0_noflags
  19. /* t32 thumb actions */
  20. static void __kprobes
  21. t32_simulate_table_branch(probes_opcode_t insn,
  22. struct arch_probes_insn *asi, struct pt_regs *regs)
  23. {
  24. unsigned long pc = regs->ARM_pc;
  25. int rn = (insn >> 16) & 0xf;
  26. int rm = insn & 0xf;
  27. unsigned long rnv = (rn == 15) ? pc : regs->uregs[rn];
  28. unsigned long rmv = regs->uregs[rm];
  29. unsigned int halfwords;
  30. if (insn & 0x10) /* TBH */
  31. halfwords = ((u16 *)rnv)[rmv];
  32. else /* TBB */
  33. halfwords = ((u8 *)rnv)[rmv];
  34. regs->ARM_pc = pc + 2 * halfwords;
  35. }
  36. static void __kprobes
  37. t32_simulate_mrs(probes_opcode_t insn,
  38. struct arch_probes_insn *asi, struct pt_regs *regs)
  39. {
  40. int rd = (insn >> 8) & 0xf;
  41. unsigned long mask = 0xf8ff03df; /* Mask out execution state */
  42. regs->uregs[rd] = regs->ARM_cpsr & mask;
  43. }
  44. static void __kprobes
  45. t32_simulate_cond_branch(probes_opcode_t insn,
  46. struct arch_probes_insn *asi, struct pt_regs *regs)
  47. {
  48. unsigned long pc = regs->ARM_pc;
  49. long offset = insn & 0x7ff; /* imm11 */
  50. offset += (insn & 0x003f0000) >> 5; /* imm6 */
  51. offset += (insn & 0x00002000) << 4; /* J1 */
  52. offset += (insn & 0x00000800) << 7; /* J2 */
  53. offset -= (insn & 0x04000000) >> 7; /* Apply sign bit */
  54. regs->ARM_pc = pc + (offset * 2);
  55. }
  56. static enum probes_insn __kprobes
  57. t32_decode_cond_branch(probes_opcode_t insn, struct arch_probes_insn *asi,
  58. const struct decode_header *d)
  59. {
  60. int cc = (insn >> 22) & 0xf;
  61. asi->insn_check_cc = probes_condition_checks[cc];
  62. asi->insn_handler = t32_simulate_cond_branch;
  63. return INSN_GOOD_NO_SLOT;
  64. }
  65. static void __kprobes
  66. t32_simulate_branch(probes_opcode_t insn,
  67. struct arch_probes_insn *asi, struct pt_regs *regs)
  68. {
  69. unsigned long pc = regs->ARM_pc;
  70. long offset = insn & 0x7ff; /* imm11 */
  71. offset += (insn & 0x03ff0000) >> 5; /* imm10 */
  72. offset += (insn & 0x00002000) << 9; /* J1 */
  73. offset += (insn & 0x00000800) << 10; /* J2 */
  74. if (insn & 0x04000000)
  75. offset -= 0x00800000; /* Apply sign bit */
  76. else
  77. offset ^= 0x00600000; /* Invert J1 and J2 */
  78. if (insn & (1 << 14)) {
  79. /* BL or BLX */
  80. regs->ARM_lr = regs->ARM_pc | 1;
  81. if (!(insn & (1 << 12))) {
  82. /* BLX so switch to ARM mode */
  83. regs->ARM_cpsr &= ~PSR_T_BIT;
  84. pc &= ~3;
  85. }
  86. }
  87. regs->ARM_pc = pc + (offset * 2);
  88. }
  89. static void __kprobes
  90. t32_simulate_ldr_literal(probes_opcode_t insn,
  91. struct arch_probes_insn *asi, struct pt_regs *regs)
  92. {
  93. unsigned long addr = regs->ARM_pc & ~3;
  94. int rt = (insn >> 12) & 0xf;
  95. unsigned long rtv;
  96. long offset = insn & 0xfff;
  97. if (insn & 0x00800000)
  98. addr += offset;
  99. else
  100. addr -= offset;
  101. if (insn & 0x00400000) {
  102. /* LDR */
  103. rtv = *(unsigned long *)addr;
  104. if (rt == 15) {
  105. bx_write_pc(rtv, regs);
  106. return;
  107. }
  108. } else if (insn & 0x00200000) {
  109. /* LDRH */
  110. if (insn & 0x01000000)
  111. rtv = *(s16 *)addr;
  112. else
  113. rtv = *(u16 *)addr;
  114. } else {
  115. /* LDRB */
  116. if (insn & 0x01000000)
  117. rtv = *(s8 *)addr;
  118. else
  119. rtv = *(u8 *)addr;
  120. }
  121. regs->uregs[rt] = rtv;
  122. }
  123. static enum probes_insn __kprobes
  124. t32_decode_ldmstm(probes_opcode_t insn, struct arch_probes_insn *asi,
  125. const struct decode_header *d)
  126. {
  127. enum probes_insn ret = kprobe_decode_ldmstm(insn, asi, d);
  128. /* Fixup modified instruction to have halfwords in correct order...*/
  129. insn = __mem_to_opcode_arm(asi->insn[0]);
  130. ((u16 *)asi->insn)[0] = __opcode_to_mem_thumb16(insn >> 16);
  131. ((u16 *)asi->insn)[1] = __opcode_to_mem_thumb16(insn & 0xffff);
  132. return ret;
  133. }
  134. static void __kprobes
  135. t32_emulate_ldrdstrd(probes_opcode_t insn,
  136. struct arch_probes_insn *asi, struct pt_regs *regs)
  137. {
  138. unsigned long pc = regs->ARM_pc & ~3;
  139. int rt1 = (insn >> 12) & 0xf;
  140. int rt2 = (insn >> 8) & 0xf;
  141. int rn = (insn >> 16) & 0xf;
  142. register unsigned long rt1v asm("r0") = regs->uregs[rt1];
  143. register unsigned long rt2v asm("r1") = regs->uregs[rt2];
  144. register unsigned long rnv asm("r2") = (rn == 15) ? pc
  145. : regs->uregs[rn];
  146. __asm__ __volatile__ (
  147. "blx %[fn]"
  148. : "=r" (rt1v), "=r" (rt2v), "=r" (rnv)
  149. : "0" (rt1v), "1" (rt2v), "2" (rnv), [fn] "r" (asi->insn_fn)
  150. : "lr", "memory", "cc"
  151. );
  152. if (rn != 15)
  153. regs->uregs[rn] = rnv; /* Writeback base register */
  154. regs->uregs[rt1] = rt1v;
  155. regs->uregs[rt2] = rt2v;
  156. }
  157. static void __kprobes
  158. t32_emulate_ldrstr(probes_opcode_t insn,
  159. struct arch_probes_insn *asi, struct pt_regs *regs)
  160. {
  161. int rt = (insn >> 12) & 0xf;
  162. int rn = (insn >> 16) & 0xf;
  163. int rm = insn & 0xf;
  164. register unsigned long rtv asm("r0") = regs->uregs[rt];
  165. register unsigned long rnv asm("r2") = regs->uregs[rn];
  166. register unsigned long rmv asm("r3") = regs->uregs[rm];
  167. __asm__ __volatile__ (
  168. "blx %[fn]"
  169. : "=r" (rtv), "=r" (rnv)
  170. : "0" (rtv), "1" (rnv), "r" (rmv), [fn] "r" (asi->insn_fn)
  171. : "lr", "memory", "cc"
  172. );
  173. regs->uregs[rn] = rnv; /* Writeback base register */
  174. if (rt == 15) /* Can't be true for a STR as they aren't allowed */
  175. bx_write_pc(rtv, regs);
  176. else
  177. regs->uregs[rt] = rtv;
  178. }
  179. static void __kprobes
  180. t32_emulate_rd8rn16rm0_rwflags(probes_opcode_t insn,
  181. struct arch_probes_insn *asi, struct pt_regs *regs)
  182. {
  183. int rd = (insn >> 8) & 0xf;
  184. int rn = (insn >> 16) & 0xf;
  185. int rm = insn & 0xf;
  186. register unsigned long rdv asm("r1") = regs->uregs[rd];
  187. register unsigned long rnv asm("r2") = regs->uregs[rn];
  188. register unsigned long rmv asm("r3") = regs->uregs[rm];
  189. unsigned long cpsr = regs->ARM_cpsr;
  190. __asm__ __volatile__ (
  191. "msr cpsr_fs, %[cpsr] \n\t"
  192. "blx %[fn] \n\t"
  193. "mrs %[cpsr], cpsr \n\t"
  194. : "=r" (rdv), [cpsr] "=r" (cpsr)
  195. : "0" (rdv), "r" (rnv), "r" (rmv),
  196. "1" (cpsr), [fn] "r" (asi->insn_fn)
  197. : "lr", "memory", "cc"
  198. );
  199. regs->uregs[rd] = rdv;
  200. regs->ARM_cpsr = (regs->ARM_cpsr & ~APSR_MASK) | (cpsr & APSR_MASK);
  201. }
  202. static void __kprobes
  203. t32_emulate_rd8pc16_noflags(probes_opcode_t insn,
  204. struct arch_probes_insn *asi, struct pt_regs *regs)
  205. {
  206. unsigned long pc = regs->ARM_pc;
  207. int rd = (insn >> 8) & 0xf;
  208. register unsigned long rdv asm("r1") = regs->uregs[rd];
  209. register unsigned long rnv asm("r2") = pc & ~3;
  210. __asm__ __volatile__ (
  211. "blx %[fn]"
  212. : "=r" (rdv)
  213. : "0" (rdv), "r" (rnv), [fn] "r" (asi->insn_fn)
  214. : "lr", "memory", "cc"
  215. );
  216. regs->uregs[rd] = rdv;
  217. }
  218. static void __kprobes
  219. t32_emulate_rd8rn16_noflags(probes_opcode_t insn,
  220. struct arch_probes_insn *asi, struct pt_regs *regs)
  221. {
  222. int rd = (insn >> 8) & 0xf;
  223. int rn = (insn >> 16) & 0xf;
  224. register unsigned long rdv asm("r1") = regs->uregs[rd];
  225. register unsigned long rnv asm("r2") = regs->uregs[rn];
  226. __asm__ __volatile__ (
  227. "blx %[fn]"
  228. : "=r" (rdv)
  229. : "0" (rdv), "r" (rnv), [fn] "r" (asi->insn_fn)
  230. : "lr", "memory", "cc"
  231. );
  232. regs->uregs[rd] = rdv;
  233. }
  234. static void __kprobes
  235. t32_emulate_rdlo12rdhi8rn16rm0_noflags(probes_opcode_t insn,
  236. struct arch_probes_insn *asi,
  237. struct pt_regs *regs)
  238. {
  239. int rdlo = (insn >> 12) & 0xf;
  240. int rdhi = (insn >> 8) & 0xf;
  241. int rn = (insn >> 16) & 0xf;
  242. int rm = insn & 0xf;
  243. register unsigned long rdlov asm("r0") = regs->uregs[rdlo];
  244. register unsigned long rdhiv asm("r1") = regs->uregs[rdhi];
  245. register unsigned long rnv asm("r2") = regs->uregs[rn];
  246. register unsigned long rmv asm("r3") = regs->uregs[rm];
  247. __asm__ __volatile__ (
  248. "blx %[fn]"
  249. : "=r" (rdlov), "=r" (rdhiv)
  250. : "0" (rdlov), "1" (rdhiv), "r" (rnv), "r" (rmv),
  251. [fn] "r" (asi->insn_fn)
  252. : "lr", "memory", "cc"
  253. );
  254. regs->uregs[rdlo] = rdlov;
  255. regs->uregs[rdhi] = rdhiv;
  256. }
  257. /* t16 thumb actions */
  258. static void __kprobes
  259. t16_simulate_bxblx(probes_opcode_t insn,
  260. struct arch_probes_insn *asi, struct pt_regs *regs)
  261. {
  262. unsigned long pc = regs->ARM_pc + 2;
  263. int rm = (insn >> 3) & 0xf;
  264. unsigned long rmv = (rm == 15) ? pc : regs->uregs[rm];
  265. if (insn & (1 << 7)) /* BLX ? */
  266. regs->ARM_lr = regs->ARM_pc | 1;
  267. bx_write_pc(rmv, regs);
  268. }
  269. static void __kprobes
  270. t16_simulate_ldr_literal(probes_opcode_t insn,
  271. struct arch_probes_insn *asi, struct pt_regs *regs)
  272. {
  273. unsigned long *base = (unsigned long *)((regs->ARM_pc + 2) & ~3);
  274. long index = insn & 0xff;
  275. int rt = (insn >> 8) & 0x7;
  276. regs->uregs[rt] = base[index];
  277. }
  278. static void __kprobes
  279. t16_simulate_ldrstr_sp_relative(probes_opcode_t insn,
  280. struct arch_probes_insn *asi, struct pt_regs *regs)
  281. {
  282. unsigned long* base = (unsigned long *)regs->ARM_sp;
  283. long index = insn & 0xff;
  284. int rt = (insn >> 8) & 0x7;
  285. if (insn & 0x800) /* LDR */
  286. regs->uregs[rt] = base[index];
  287. else /* STR */
  288. base[index] = regs->uregs[rt];
  289. }
  290. static void __kprobes
  291. t16_simulate_reladr(probes_opcode_t insn,
  292. struct arch_probes_insn *asi, struct pt_regs *regs)
  293. {
  294. unsigned long base = (insn & 0x800) ? regs->ARM_sp
  295. : ((regs->ARM_pc + 2) & ~3);
  296. long offset = insn & 0xff;
  297. int rt = (insn >> 8) & 0x7;
  298. regs->uregs[rt] = base + offset * 4;
  299. }
  300. static void __kprobes
  301. t16_simulate_add_sp_imm(probes_opcode_t insn,
  302. struct arch_probes_insn *asi, struct pt_regs *regs)
  303. {
  304. long imm = insn & 0x7f;
  305. if (insn & 0x80) /* SUB */
  306. regs->ARM_sp -= imm * 4;
  307. else /* ADD */
  308. regs->ARM_sp += imm * 4;
  309. }
  310. static void __kprobes
  311. t16_simulate_cbz(probes_opcode_t insn,
  312. struct arch_probes_insn *asi, struct pt_regs *regs)
  313. {
  314. int rn = insn & 0x7;
  315. probes_opcode_t nonzero = regs->uregs[rn] ? insn : ~insn;
  316. if (nonzero & 0x800) {
  317. long i = insn & 0x200;
  318. long imm5 = insn & 0xf8;
  319. unsigned long pc = regs->ARM_pc + 2;
  320. regs->ARM_pc = pc + (i >> 3) + (imm5 >> 2);
  321. }
  322. }
  323. static void __kprobes
  324. t16_simulate_it(probes_opcode_t insn,
  325. struct arch_probes_insn *asi, struct pt_regs *regs)
  326. {
  327. /*
  328. * The 8 IT state bits are split into two parts in CPSR:
  329. * ITSTATE<1:0> are in CPSR<26:25>
  330. * ITSTATE<7:2> are in CPSR<15:10>
  331. * The new IT state is in the lower byte of insn.
  332. */
  333. unsigned long cpsr = regs->ARM_cpsr;
  334. cpsr &= ~PSR_IT_MASK;
  335. cpsr |= (insn & 0xfc) << 8;
  336. cpsr |= (insn & 0x03) << 25;
  337. regs->ARM_cpsr = cpsr;
  338. }
  339. static void __kprobes
  340. t16_singlestep_it(probes_opcode_t insn,
  341. struct arch_probes_insn *asi, struct pt_regs *regs)
  342. {
  343. regs->ARM_pc += 2;
  344. t16_simulate_it(insn, asi, regs);
  345. }
  346. static enum probes_insn __kprobes
  347. t16_decode_it(probes_opcode_t insn, struct arch_probes_insn *asi,
  348. const struct decode_header *d)
  349. {
  350. asi->insn_singlestep = t16_singlestep_it;
  351. return INSN_GOOD_NO_SLOT;
  352. }
  353. static void __kprobes
  354. t16_simulate_cond_branch(probes_opcode_t insn,
  355. struct arch_probes_insn *asi, struct pt_regs *regs)
  356. {
  357. unsigned long pc = regs->ARM_pc + 2;
  358. long offset = insn & 0x7f;
  359. offset -= insn & 0x80; /* Apply sign bit */
  360. regs->ARM_pc = pc + (offset * 2);
  361. }
  362. static enum probes_insn __kprobes
  363. t16_decode_cond_branch(probes_opcode_t insn, struct arch_probes_insn *asi,
  364. const struct decode_header *d)
  365. {
  366. int cc = (insn >> 8) & 0xf;
  367. asi->insn_check_cc = probes_condition_checks[cc];
  368. asi->insn_handler = t16_simulate_cond_branch;
  369. return INSN_GOOD_NO_SLOT;
  370. }
  371. static void __kprobes
  372. t16_simulate_branch(probes_opcode_t insn,
  373. struct arch_probes_insn *asi, struct pt_regs *regs)
  374. {
  375. unsigned long pc = regs->ARM_pc + 2;
  376. long offset = insn & 0x3ff;
  377. offset -= insn & 0x400; /* Apply sign bit */
  378. regs->ARM_pc = pc + (offset * 2);
  379. }
  380. static unsigned long __kprobes
  381. t16_emulate_loregs(probes_opcode_t insn,
  382. struct arch_probes_insn *asi, struct pt_regs *regs)
  383. {
  384. unsigned long oldcpsr = regs->ARM_cpsr;
  385. unsigned long newcpsr;
  386. __asm__ __volatile__ (
  387. "msr cpsr_fs, %[oldcpsr] \n\t"
  388. "ldmia %[regs], {r0-r7} \n\t"
  389. "blx %[fn] \n\t"
  390. "stmia %[regs], {r0-r7} \n\t"
  391. "mrs %[newcpsr], cpsr \n\t"
  392. : [newcpsr] "=r" (newcpsr)
  393. : [oldcpsr] "r" (oldcpsr), [regs] "r" (regs),
  394. [fn] "r" (asi->insn_fn)
  395. : "r0", "r1", "r2", "r3", "r4", "r5", "r6", "r7",
  396. "lr", "memory", "cc"
  397. );
  398. return (oldcpsr & ~APSR_MASK) | (newcpsr & APSR_MASK);
  399. }
  400. static void __kprobes
  401. t16_emulate_loregs_rwflags(probes_opcode_t insn,
  402. struct arch_probes_insn *asi, struct pt_regs *regs)
  403. {
  404. regs->ARM_cpsr = t16_emulate_loregs(insn, asi, regs);
  405. }
  406. static void __kprobes
  407. t16_emulate_loregs_noitrwflags(probes_opcode_t insn,
  408. struct arch_probes_insn *asi, struct pt_regs *regs)
  409. {
  410. unsigned long cpsr = t16_emulate_loregs(insn, asi, regs);
  411. if (!in_it_block(cpsr))
  412. regs->ARM_cpsr = cpsr;
  413. }
  414. static void __kprobes
  415. t16_emulate_hiregs(probes_opcode_t insn,
  416. struct arch_probes_insn *asi, struct pt_regs *regs)
  417. {
  418. unsigned long pc = regs->ARM_pc + 2;
  419. int rdn = (insn & 0x7) | ((insn & 0x80) >> 4);
  420. int rm = (insn >> 3) & 0xf;
  421. register unsigned long rdnv asm("r1");
  422. register unsigned long rmv asm("r0");
  423. unsigned long cpsr = regs->ARM_cpsr;
  424. rdnv = (rdn == 15) ? pc : regs->uregs[rdn];
  425. rmv = (rm == 15) ? pc : regs->uregs[rm];
  426. __asm__ __volatile__ (
  427. "msr cpsr_fs, %[cpsr] \n\t"
  428. "blx %[fn] \n\t"
  429. "mrs %[cpsr], cpsr \n\t"
  430. : "=r" (rdnv), [cpsr] "=r" (cpsr)
  431. : "0" (rdnv), "r" (rmv), "1" (cpsr), [fn] "r" (asi->insn_fn)
  432. : "lr", "memory", "cc"
  433. );
  434. if (rdn == 15)
  435. rdnv &= ~1;
  436. regs->uregs[rdn] = rdnv;
  437. regs->ARM_cpsr = (regs->ARM_cpsr & ~APSR_MASK) | (cpsr & APSR_MASK);
  438. }
  439. static enum probes_insn __kprobes
  440. t16_decode_hiregs(probes_opcode_t insn, struct arch_probes_insn *asi,
  441. const struct decode_header *d)
  442. {
  443. insn &= ~0x00ff;
  444. insn |= 0x001; /* Set Rdn = R1 and Rm = R0 */
  445. ((u16 *)asi->insn)[0] = __opcode_to_mem_thumb16(insn);
  446. asi->insn_handler = t16_emulate_hiregs;
  447. return INSN_GOOD;
  448. }
  449. static void __kprobes
  450. t16_emulate_push(probes_opcode_t insn,
  451. struct arch_probes_insn *asi, struct pt_regs *regs)
  452. {
  453. __asm__ __volatile__ (
  454. "ldr r9, [%[regs], #13*4] \n\t"
  455. "ldr r8, [%[regs], #14*4] \n\t"
  456. "ldmia %[regs], {r0-r7} \n\t"
  457. "blx %[fn] \n\t"
  458. "str r9, [%[regs], #13*4] \n\t"
  459. :
  460. : [regs] "r" (regs), [fn] "r" (asi->insn_fn)
  461. : "r0", "r1", "r2", "r3", "r4", "r5", "r6", "r7", "r8", "r9",
  462. "lr", "memory", "cc"
  463. );
  464. }
  465. static enum probes_insn __kprobes
  466. t16_decode_push(probes_opcode_t insn, struct arch_probes_insn *asi,
  467. const struct decode_header *d)
  468. {
  469. /*
  470. * To simulate a PUSH we use a Thumb-2 "STMDB R9!, {registers}"
  471. * and call it with R9=SP and LR in the register list represented
  472. * by R8.
  473. */
  474. /* 1st half STMDB R9!,{} */
  475. ((u16 *)asi->insn)[0] = __opcode_to_mem_thumb16(0xe929);
  476. /* 2nd half (register list) */
  477. ((u16 *)asi->insn)[1] = __opcode_to_mem_thumb16(insn & 0x1ff);
  478. asi->insn_handler = t16_emulate_push;
  479. return INSN_GOOD;
  480. }
  481. static void __kprobes
  482. t16_emulate_pop_nopc(probes_opcode_t insn,
  483. struct arch_probes_insn *asi, struct pt_regs *regs)
  484. {
  485. __asm__ __volatile__ (
  486. "ldr r9, [%[regs], #13*4] \n\t"
  487. "ldmia %[regs], {r0-r7} \n\t"
  488. "blx %[fn] \n\t"
  489. "stmia %[regs], {r0-r7} \n\t"
  490. "str r9, [%[regs], #13*4] \n\t"
  491. :
  492. : [regs] "r" (regs), [fn] "r" (asi->insn_fn)
  493. : "r0", "r1", "r2", "r3", "r4", "r5", "r6", "r7", "r9",
  494. "lr", "memory", "cc"
  495. );
  496. }
  497. static void __kprobes
  498. t16_emulate_pop_pc(probes_opcode_t insn,
  499. struct arch_probes_insn *asi, struct pt_regs *regs)
  500. {
  501. register unsigned long pc asm("r8");
  502. __asm__ __volatile__ (
  503. "ldr r9, [%[regs], #13*4] \n\t"
  504. "ldmia %[regs], {r0-r7} \n\t"
  505. "blx %[fn] \n\t"
  506. "stmia %[regs], {r0-r7} \n\t"
  507. "str r9, [%[regs], #13*4] \n\t"
  508. : "=r" (pc)
  509. : [regs] "r" (regs), [fn] "r" (asi->insn_fn)
  510. : "r0", "r1", "r2", "r3", "r4", "r5", "r6", "r7", "r9",
  511. "lr", "memory", "cc"
  512. );
  513. bx_write_pc(pc, regs);
  514. }
  515. static enum probes_insn __kprobes
  516. t16_decode_pop(probes_opcode_t insn, struct arch_probes_insn *asi,
  517. const struct decode_header *d)
  518. {
  519. /*
  520. * To simulate a POP we use a Thumb-2 "LDMDB R9!, {registers}"
  521. * and call it with R9=SP and PC in the register list represented
  522. * by R8.
  523. */
  524. /* 1st half LDMIA R9!,{} */
  525. ((u16 *)asi->insn)[0] = __opcode_to_mem_thumb16(0xe8b9);
  526. /* 2nd half (register list) */
  527. ((u16 *)asi->insn)[1] = __opcode_to_mem_thumb16(insn & 0x1ff);
  528. asi->insn_handler = insn & 0x100 ? t16_emulate_pop_pc
  529. : t16_emulate_pop_nopc;
  530. return INSN_GOOD;
  531. }
  532. const union decode_action kprobes_t16_actions[NUM_PROBES_T16_ACTIONS] = {
  533. [PROBES_T16_ADD_SP] = {.handler = t16_simulate_add_sp_imm},
  534. [PROBES_T16_CBZ] = {.handler = t16_simulate_cbz},
  535. [PROBES_T16_SIGN_EXTEND] = {.handler = t16_emulate_loregs_rwflags},
  536. [PROBES_T16_PUSH] = {.decoder = t16_decode_push},
  537. [PROBES_T16_POP] = {.decoder = t16_decode_pop},
  538. [PROBES_T16_SEV] = {.handler = probes_emulate_none},
  539. [PROBES_T16_WFE] = {.handler = probes_simulate_nop},
  540. [PROBES_T16_IT] = {.decoder = t16_decode_it},
  541. [PROBES_T16_CMP] = {.handler = t16_emulate_loregs_rwflags},
  542. [PROBES_T16_ADDSUB] = {.handler = t16_emulate_loregs_noitrwflags},
  543. [PROBES_T16_LOGICAL] = {.handler = t16_emulate_loregs_noitrwflags},
  544. [PROBES_T16_LDR_LIT] = {.handler = t16_simulate_ldr_literal},
  545. [PROBES_T16_BLX] = {.handler = t16_simulate_bxblx},
  546. [PROBES_T16_HIREGOPS] = {.decoder = t16_decode_hiregs},
  547. [PROBES_T16_LDRHSTRH] = {.handler = t16_emulate_loregs_rwflags},
  548. [PROBES_T16_LDRSTR] = {.handler = t16_simulate_ldrstr_sp_relative},
  549. [PROBES_T16_ADR] = {.handler = t16_simulate_reladr},
  550. [PROBES_T16_LDMSTM] = {.handler = t16_emulate_loregs_rwflags},
  551. [PROBES_T16_BRANCH_COND] = {.decoder = t16_decode_cond_branch},
  552. [PROBES_T16_BRANCH] = {.handler = t16_simulate_branch},
  553. };
  554. const union decode_action kprobes_t32_actions[NUM_PROBES_T32_ACTIONS] = {
  555. [PROBES_T32_LDMSTM] = {.decoder = t32_decode_ldmstm},
  556. [PROBES_T32_LDRDSTRD] = {.handler = t32_emulate_ldrdstrd},
  557. [PROBES_T32_TABLE_BRANCH] = {.handler = t32_simulate_table_branch},
  558. [PROBES_T32_TST] = {.handler = t32_emulate_rd8rn16rm0_rwflags},
  559. [PROBES_T32_MOV] = {.handler = t32_emulate_rd8rn16rm0_rwflags},
  560. [PROBES_T32_ADDSUB] = {.handler = t32_emulate_rd8rn16rm0_rwflags},
  561. [PROBES_T32_LOGICAL] = {.handler = t32_emulate_rd8rn16rm0_rwflags},
  562. [PROBES_T32_CMP] = {.handler = t32_emulate_rd8rn16rm0_rwflags},
  563. [PROBES_T32_ADDWSUBW_PC] = {.handler = t32_emulate_rd8pc16_noflags,},
  564. [PROBES_T32_ADDWSUBW] = {.handler = t32_emulate_rd8rn16_noflags},
  565. [PROBES_T32_MOVW] = {.handler = t32_emulate_rd8rn16_noflags},
  566. [PROBES_T32_SAT] = {.handler = t32_emulate_rd8rn16rm0_rwflags},
  567. [PROBES_T32_BITFIELD] = {.handler = t32_emulate_rd8rn16_noflags},
  568. [PROBES_T32_SEV] = {.handler = probes_emulate_none},
  569. [PROBES_T32_WFE] = {.handler = probes_simulate_nop},
  570. [PROBES_T32_MRS] = {.handler = t32_simulate_mrs},
  571. [PROBES_T32_BRANCH_COND] = {.decoder = t32_decode_cond_branch},
  572. [PROBES_T32_BRANCH] = {.handler = t32_simulate_branch},
  573. [PROBES_T32_PLDI] = {.handler = probes_simulate_nop},
  574. [PROBES_T32_LDR_LIT] = {.handler = t32_simulate_ldr_literal},
  575. [PROBES_T32_LDRSTR] = {.handler = t32_emulate_ldrstr},
  576. [PROBES_T32_SIGN_EXTEND] = {.handler = t32_emulate_rd8rn16rm0_rwflags},
  577. [PROBES_T32_MEDIA] = {.handler = t32_emulate_rd8rn16rm0_rwflags},
  578. [PROBES_T32_REVERSE] = {.handler = t32_emulate_rd8rn16_noflags},
  579. [PROBES_T32_MUL_ADD] = {.handler = t32_emulate_rd8rn16rm0_rwflags},
  580. [PROBES_T32_MUL_ADD2] = {.handler = t32_emulate_rd8rn16rm0ra12_noflags},
  581. [PROBES_T32_MUL_ADD_LONG] = {
  582. .handler = t32_emulate_rdlo12rdhi8rn16rm0_noflags},
  583. };