test-core.c 41 KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273747576777879808182838485868788899091929394959697989910010110210310410510610710810911011111211311411511611711811912012112212312412512612712812913013113213313413513613713813914014114214314414514614714814915015115215315415515615715815916016116216316416516616716816917017117217317417517617717817918018118218318418518618718818919019119219319419519619719819920020120220320420520620720820921021121221321421521621721821922022122222322422522622722822923023123223323423523623723823924024124224324424524624724824925025125225325425525625725825926026126226326426526626726826927027127227327427527627727827928028128228328428528628728828929029129229329429529629729829930030130230330430530630730830931031131231331431531631731831932032132232332432532632732832933033133233333433533633733833934034134234334434534634734834935035135235335435535635735835936036136236336436536636736836937037137237337437537637737837938038138238338438538638738838939039139239339439539639739839940040140240340440540640740840941041141241341441541641741841942042142242342442542642742842943043143243343443543643743843944044144244344444544644744844945045145245345445545645745845946046146246346446546646746846947047147247347447547647747847948048148248348448548648748848949049149249349449549649749849950050150250350450550650750850951051151251351451551651751851952052152252352452552652752852953053153253353453553653753853954054154254354454554654754854955055155255355455555655755855956056156256356456556656756856957057157257357457557657757857958058158258358458558658758858959059159259359459559659759859960060160260360460560660760860961061161261361461561661761861962062162262362462562662762862963063163263363463563663763863964064164264364464564664764864965065165265365465565665765865966066166266366466566666766866967067167267367467567667767867968068168268368468568668768868969069169269369469569669769869970070170270370470570670770870971071171271371471571671771871972072172272372472572672772872973073173273373473573673773873974074174274374474574674774874975075175275375475575675775875976076176276376476576676776876977077177277377477577677777877978078178278378478578678778878979079179279379479579679779879980080180280380480580680780880981081181281381481581681781881982082182282382482582682782882983083183283383483583683783883984084184284384484584684784884985085185285385485585685785885986086186286386486586686786886987087187287387487587687787887988088188288388488588688788888989089189289389489589689789889990090190290390490590690790890991091191291391491591691791891992092192292392492592692792892993093193293393493593693793893994094194294394494594694794894995095195295395495595695795895996096196296396496596696796896997097197297397497597697797897998098198298398498598698798898999099199299399499599699799899910001001100210031004100510061007100810091010101110121013101410151016101710181019102010211022102310241025102610271028102910301031103210331034103510361037103810391040104110421043104410451046104710481049105010511052105310541055105610571058105910601061106210631064106510661067106810691070107110721073107410751076107710781079108010811082108310841085108610871088108910901091109210931094109510961097109810991100110111021103110411051106110711081109111011111112111311141115111611171118111911201121112211231124112511261127112811291130113111321133113411351136113711381139114011411142114311441145114611471148114911501151115211531154115511561157115811591160116111621163116411651166116711681169117011711172117311741175117611771178117911801181118211831184118511861187118811891190119111921193119411951196119711981199120012011202120312041205120612071208120912101211121212131214121512161217121812191220122112221223122412251226122712281229123012311232123312341235123612371238123912401241124212431244124512461247124812491250125112521253125412551256125712581259126012611262126312641265126612671268126912701271127212731274127512761277127812791280128112821283128412851286128712881289129012911292129312941295129612971298129913001301130213031304130513061307130813091310131113121313131413151316131713181319132013211322132313241325132613271328132913301331133213331334133513361337133813391340134113421343134413451346134713481349135013511352135313541355135613571358135913601361136213631364136513661367136813691370137113721373137413751376137713781379138013811382138313841385138613871388138913901391139213931394139513961397139813991400140114021403140414051406140714081409141014111412141314141415141614171418141914201421142214231424142514261427142814291430143114321433143414351436143714381439144014411442144314441445144614471448144914501451145214531454145514561457145814591460146114621463146414651466146714681469147014711472147314741475147614771478147914801481148214831484148514861487148814891490149114921493149414951496149714981499150015011502150315041505150615071508150915101511151215131514151515161517151815191520152115221523152415251526152715281529153015311532153315341535153615371538153915401541154215431544154515461547154815491550155115521553155415551556155715581559156015611562156315641565156615671568156915701571157215731574157515761577157815791580158115821583158415851586158715881589159015911592159315941595159615971598159916001601160216031604160516061607160816091610161116121613161416151616161716181619162016211622162316241625162616271628162916301631163216331634163516361637163816391640164116421643164416451646164716481649165016511652165316541655165616571658165916601661166216631664166516661667166816691670167116721673167416751676
  1. /*
  2. * arch/arm/kernel/kprobes-test.c
  3. *
  4. * Copyright (C) 2011 Jon Medhurst <tixy@yxit.co.uk>.
  5. *
  6. * This program is free software; you can redistribute it and/or modify
  7. * it under the terms of the GNU General Public License version 2 as
  8. * published by the Free Software Foundation.
  9. */
  10. /*
  11. * This file contains test code for ARM kprobes.
  12. *
  13. * The top level function run_all_tests() executes tests for all of the
  14. * supported instruction sets: ARM, 16-bit Thumb, and 32-bit Thumb. These tests
  15. * fall into two categories; run_api_tests() checks basic functionality of the
  16. * kprobes API, and run_test_cases() is a comprehensive test for kprobes
  17. * instruction decoding and simulation.
  18. *
  19. * run_test_cases() first checks the kprobes decoding table for self consistency
  20. * (using table_test()) then executes a series of test cases for each of the CPU
  21. * instruction forms. coverage_start() and coverage_end() are used to verify
  22. * that these test cases cover all of the possible combinations of instructions
  23. * described by the kprobes decoding tables.
  24. *
  25. * The individual test cases are in kprobes-test-arm.c and kprobes-test-thumb.c
  26. * which use the macros defined in kprobes-test.h. The rest of this
  27. * documentation will describe the operation of the framework used by these
  28. * test cases.
  29. */
  30. /*
  31. * TESTING METHODOLOGY
  32. * -------------------
  33. *
  34. * The methodology used to test an ARM instruction 'test_insn' is to use
  35. * inline assembler like:
  36. *
  37. * test_before: nop
  38. * test_case: test_insn
  39. * test_after: nop
  40. *
  41. * When the test case is run a kprobe is placed of each nop. The
  42. * post-handler of the test_before probe is used to modify the saved CPU
  43. * register context to that which we require for the test case. The
  44. * pre-handler of the of the test_after probe saves a copy of the CPU
  45. * register context. In this way we can execute test_insn with a specific
  46. * register context and see the results afterwards.
  47. *
  48. * To actually test the kprobes instruction emulation we perform the above
  49. * step a second time but with an additional kprobe on the test_case
  50. * instruction itself. If the emulation is accurate then the results seen
  51. * by the test_after probe will be identical to the first run which didn't
  52. * have a probe on test_case.
  53. *
  54. * Each test case is run several times with a variety of variations in the
  55. * flags value of stored in CPSR, and for Thumb code, different ITState.
  56. *
  57. * For instructions which can modify PC, a second test_after probe is used
  58. * like this:
  59. *
  60. * test_before: nop
  61. * test_case: test_insn
  62. * test_after: nop
  63. * b test_done
  64. * test_after2: nop
  65. * test_done:
  66. *
  67. * The test case is constructed such that test_insn branches to
  68. * test_after2, or, if testing a conditional instruction, it may just
  69. * continue to test_after. The probes inserted at both locations let us
  70. * determine which happened. A similar approach is used for testing
  71. * backwards branches...
  72. *
  73. * b test_before
  74. * b test_done @ helps to cope with off by 1 branches
  75. * test_after2: nop
  76. * b test_done
  77. * test_before: nop
  78. * test_case: test_insn
  79. * test_after: nop
  80. * test_done:
  81. *
  82. * The macros used to generate the assembler instructions describe above
  83. * are TEST_INSTRUCTION, TEST_BRANCH_F (branch forwards) and TEST_BRANCH_B
  84. * (branch backwards). In these, the local variables numbered 1, 50, 2 and
  85. * 99 represent: test_before, test_case, test_after2 and test_done.
  86. *
  87. * FRAMEWORK
  88. * ---------
  89. *
  90. * Each test case is wrapped between the pair of macros TESTCASE_START and
  91. * TESTCASE_END. As well as performing the inline assembler boilerplate,
  92. * these call out to the kprobes_test_case_start() and
  93. * kprobes_test_case_end() functions which drive the execution of the test
  94. * case. The specific arguments to use for each test case are stored as
  95. * inline data constructed using the various TEST_ARG_* macros. Putting
  96. * this all together, a simple test case may look like:
  97. *
  98. * TESTCASE_START("Testing mov r0, r7")
  99. * TEST_ARG_REG(7, 0x12345678) // Set r7=0x12345678
  100. * TEST_ARG_END("")
  101. * TEST_INSTRUCTION("mov r0, r7")
  102. * TESTCASE_END
  103. *
  104. * Note, in practice the single convenience macro TEST_R would be used for this
  105. * instead.
  106. *
  107. * The above would expand to assembler looking something like:
  108. *
  109. * @ TESTCASE_START
  110. * bl __kprobes_test_case_start
  111. * .pushsection .rodata
  112. * "10:
  113. * .ascii "mov r0, r7" @ text title for test case
  114. * .byte 0
  115. * .popsection
  116. * @ start of inline data...
  117. * .word 10b @ pointer to title in .rodata section
  118. *
  119. * @ TEST_ARG_REG
  120. * .byte ARG_TYPE_REG
  121. * .byte 7
  122. * .short 0
  123. * .word 0x1234567
  124. *
  125. * @ TEST_ARG_END
  126. * .byte ARG_TYPE_END
  127. * .byte TEST_ISA @ flags, including ISA being tested
  128. * .short 50f-0f @ offset of 'test_before'
  129. * .short 2f-0f @ offset of 'test_after2' (if relevent)
  130. * .short 99f-0f @ offset of 'test_done'
  131. * @ start of test case code...
  132. * 0:
  133. * .code TEST_ISA @ switch to ISA being tested
  134. *
  135. * @ TEST_INSTRUCTION
  136. * 50: nop @ location for 'test_before' probe
  137. * 1: mov r0, r7 @ the test case instruction 'test_insn'
  138. * nop @ location for 'test_after' probe
  139. *
  140. * // TESTCASE_END
  141. * 2:
  142. * 99: bl __kprobes_test_case_end_##TEST_ISA
  143. * .code NONMAL_ISA
  144. *
  145. * When the above is execute the following happens...
  146. *
  147. * __kprobes_test_case_start() is an assembler wrapper which sets up space
  148. * for a stack buffer and calls the C function kprobes_test_case_start().
  149. * This C function will do some initial processing of the inline data and
  150. * setup some global state. It then inserts the test_before and test_after
  151. * kprobes and returns a value which causes the assembler wrapper to jump
  152. * to the start of the test case code, (local label '0').
  153. *
  154. * When the test case code executes, the test_before probe will be hit and
  155. * test_before_post_handler will call setup_test_context(). This fills the
  156. * stack buffer and CPU registers with a test pattern and then processes
  157. * the test case arguments. In our example there is one TEST_ARG_REG which
  158. * indicates that R7 should be loaded with the value 0x12345678.
  159. *
  160. * When the test_before probe ends, the test case continues and executes
  161. * the "mov r0, r7" instruction. It then hits the test_after probe and the
  162. * pre-handler for this (test_after_pre_handler) will save a copy of the
  163. * CPU register context. This should now have R0 holding the same value as
  164. * R7.
  165. *
  166. * Finally we get to the call to __kprobes_test_case_end_{32,16}. This is
  167. * an assembler wrapper which switches back to the ISA used by the test
  168. * code and calls the C function kprobes_test_case_end().
  169. *
  170. * For each run through the test case, test_case_run_count is incremented
  171. * by one. For even runs, kprobes_test_case_end() saves a copy of the
  172. * register and stack buffer contents from the test case just run. It then
  173. * inserts a kprobe on the test case instruction 'test_insn' and returns a
  174. * value to cause the test case code to be re-run.
  175. *
  176. * For odd numbered runs, kprobes_test_case_end() compares the register and
  177. * stack buffer contents to those that were saved on the previous even
  178. * numbered run (the one without the kprobe on test_insn). These should be
  179. * the same if the kprobe instruction simulation routine is correct.
  180. *
  181. * The pair of test case runs is repeated with different combinations of
  182. * flag values in CPSR and, for Thumb, different ITState. This is
  183. * controlled by test_context_cpsr().
  184. *
  185. * BUILDING TEST CASES
  186. * -------------------
  187. *
  188. *
  189. * As an aid to building test cases, the stack buffer is initialised with
  190. * some special values:
  191. *
  192. * [SP+13*4] Contains SP+120. This can be used to test instructions
  193. * which load a value into SP.
  194. *
  195. * [SP+15*4] When testing branching instructions using TEST_BRANCH_{F,B},
  196. * this holds the target address of the branch, 'test_after2'.
  197. * This can be used to test instructions which load a PC value
  198. * from memory.
  199. */
  200. #include <linux/kernel.h>
  201. #include <linux/module.h>
  202. #include <linux/slab.h>
  203. #include <linux/sched/clock.h>
  204. #include <linux/kprobes.h>
  205. #include <linux/errno.h>
  206. #include <linux/stddef.h>
  207. #include <linux/bug.h>
  208. #include <asm/opcodes.h>
  209. #include "core.h"
  210. #include "test-core.h"
  211. #include "../decode-arm.h"
  212. #include "../decode-thumb.h"
  213. #define BENCHMARKING 1
  214. /*
  215. * Test basic API
  216. */
  217. static bool test_regs_ok;
  218. static int test_func_instance;
  219. static int pre_handler_called;
  220. static int post_handler_called;
  221. static int kretprobe_handler_called;
  222. static int tests_failed;
  223. #define FUNC_ARG1 0x12345678
  224. #define FUNC_ARG2 0xabcdef
  225. #ifndef CONFIG_THUMB2_KERNEL
  226. #define RET(reg) "mov pc, "#reg
  227. long arm_func(long r0, long r1);
  228. static void __used __naked __arm_kprobes_test_func(void)
  229. {
  230. __asm__ __volatile__ (
  231. ".arm \n\t"
  232. ".type arm_func, %%function \n\t"
  233. "arm_func: \n\t"
  234. "adds r0, r0, r1 \n\t"
  235. "mov pc, lr \n\t"
  236. ".code "NORMAL_ISA /* Back to Thumb if necessary */
  237. : : : "r0", "r1", "cc"
  238. );
  239. }
  240. #else /* CONFIG_THUMB2_KERNEL */
  241. #define RET(reg) "bx "#reg
  242. long thumb16_func(long r0, long r1);
  243. long thumb32even_func(long r0, long r1);
  244. long thumb32odd_func(long r0, long r1);
  245. static void __used __naked __thumb_kprobes_test_funcs(void)
  246. {
  247. __asm__ __volatile__ (
  248. ".type thumb16_func, %%function \n\t"
  249. "thumb16_func: \n\t"
  250. "adds.n r0, r0, r1 \n\t"
  251. "bx lr \n\t"
  252. ".align \n\t"
  253. ".type thumb32even_func, %%function \n\t"
  254. "thumb32even_func: \n\t"
  255. "adds.w r0, r0, r1 \n\t"
  256. "bx lr \n\t"
  257. ".align \n\t"
  258. "nop.n \n\t"
  259. ".type thumb32odd_func, %%function \n\t"
  260. "thumb32odd_func: \n\t"
  261. "adds.w r0, r0, r1 \n\t"
  262. "bx lr \n\t"
  263. : : : "r0", "r1", "cc"
  264. );
  265. }
  266. #endif /* CONFIG_THUMB2_KERNEL */
  267. static int call_test_func(long (*func)(long, long), bool check_test_regs)
  268. {
  269. long ret;
  270. ++test_func_instance;
  271. test_regs_ok = false;
  272. ret = (*func)(FUNC_ARG1, FUNC_ARG2);
  273. if (ret != FUNC_ARG1 + FUNC_ARG2) {
  274. pr_err("FAIL: call_test_func: func returned %lx\n", ret);
  275. return false;
  276. }
  277. if (check_test_regs && !test_regs_ok) {
  278. pr_err("FAIL: test regs not OK\n");
  279. return false;
  280. }
  281. return true;
  282. }
  283. static int __kprobes pre_handler(struct kprobe *p, struct pt_regs *regs)
  284. {
  285. pre_handler_called = test_func_instance;
  286. if (regs->ARM_r0 == FUNC_ARG1 && regs->ARM_r1 == FUNC_ARG2)
  287. test_regs_ok = true;
  288. return 0;
  289. }
  290. static void __kprobes post_handler(struct kprobe *p, struct pt_regs *regs,
  291. unsigned long flags)
  292. {
  293. post_handler_called = test_func_instance;
  294. if (regs->ARM_r0 != FUNC_ARG1 + FUNC_ARG2 || regs->ARM_r1 != FUNC_ARG2)
  295. test_regs_ok = false;
  296. }
  297. static struct kprobe the_kprobe = {
  298. .addr = 0,
  299. .pre_handler = pre_handler,
  300. .post_handler = post_handler
  301. };
  302. static int test_kprobe(long (*func)(long, long))
  303. {
  304. int ret;
  305. the_kprobe.addr = (kprobe_opcode_t *)func;
  306. ret = register_kprobe(&the_kprobe);
  307. if (ret < 0) {
  308. pr_err("FAIL: register_kprobe failed with %d\n", ret);
  309. return ret;
  310. }
  311. ret = call_test_func(func, true);
  312. unregister_kprobe(&the_kprobe);
  313. the_kprobe.flags = 0; /* Clear disable flag to allow reuse */
  314. if (!ret)
  315. return -EINVAL;
  316. if (pre_handler_called != test_func_instance) {
  317. pr_err("FAIL: kprobe pre_handler not called\n");
  318. return -EINVAL;
  319. }
  320. if (post_handler_called != test_func_instance) {
  321. pr_err("FAIL: kprobe post_handler not called\n");
  322. return -EINVAL;
  323. }
  324. if (!call_test_func(func, false))
  325. return -EINVAL;
  326. if (pre_handler_called == test_func_instance ||
  327. post_handler_called == test_func_instance) {
  328. pr_err("FAIL: probe called after unregistering\n");
  329. return -EINVAL;
  330. }
  331. return 0;
  332. }
  333. static int __kprobes
  334. kretprobe_handler(struct kretprobe_instance *ri, struct pt_regs *regs)
  335. {
  336. kretprobe_handler_called = test_func_instance;
  337. if (regs_return_value(regs) == FUNC_ARG1 + FUNC_ARG2)
  338. test_regs_ok = true;
  339. return 0;
  340. }
  341. static struct kretprobe the_kretprobe = {
  342. .handler = kretprobe_handler,
  343. };
  344. static int test_kretprobe(long (*func)(long, long))
  345. {
  346. int ret;
  347. the_kretprobe.kp.addr = (kprobe_opcode_t *)func;
  348. ret = register_kretprobe(&the_kretprobe);
  349. if (ret < 0) {
  350. pr_err("FAIL: register_kretprobe failed with %d\n", ret);
  351. return ret;
  352. }
  353. ret = call_test_func(func, true);
  354. unregister_kretprobe(&the_kretprobe);
  355. the_kretprobe.kp.flags = 0; /* Clear disable flag to allow reuse */
  356. if (!ret)
  357. return -EINVAL;
  358. if (kretprobe_handler_called != test_func_instance) {
  359. pr_err("FAIL: kretprobe handler not called\n");
  360. return -EINVAL;
  361. }
  362. if (!call_test_func(func, false))
  363. return -EINVAL;
  364. if (kretprobe_handler_called == test_func_instance) {
  365. pr_err("FAIL: kretprobe called after unregistering\n");
  366. return -EINVAL;
  367. }
  368. return 0;
  369. }
  370. static int run_api_tests(long (*func)(long, long))
  371. {
  372. int ret;
  373. pr_info(" kprobe\n");
  374. ret = test_kprobe(func);
  375. if (ret < 0)
  376. return ret;
  377. pr_info(" kretprobe\n");
  378. ret = test_kretprobe(func);
  379. if (ret < 0)
  380. return ret;
  381. return 0;
  382. }
  383. /*
  384. * Benchmarking
  385. */
  386. #if BENCHMARKING
  387. static void __naked benchmark_nop(void)
  388. {
  389. __asm__ __volatile__ (
  390. "nop \n\t"
  391. RET(lr)" \n\t"
  392. );
  393. }
  394. #ifdef CONFIG_THUMB2_KERNEL
  395. #define wide ".w"
  396. #else
  397. #define wide
  398. #endif
  399. static void __naked benchmark_pushpop1(void)
  400. {
  401. __asm__ __volatile__ (
  402. "stmdb"wide" sp!, {r3-r11,lr} \n\t"
  403. "ldmia"wide" sp!, {r3-r11,pc}"
  404. );
  405. }
  406. static void __naked benchmark_pushpop2(void)
  407. {
  408. __asm__ __volatile__ (
  409. "stmdb"wide" sp!, {r0-r8,lr} \n\t"
  410. "ldmia"wide" sp!, {r0-r8,pc}"
  411. );
  412. }
  413. static void __naked benchmark_pushpop3(void)
  414. {
  415. __asm__ __volatile__ (
  416. "stmdb"wide" sp!, {r4,lr} \n\t"
  417. "ldmia"wide" sp!, {r4,pc}"
  418. );
  419. }
  420. static void __naked benchmark_pushpop4(void)
  421. {
  422. __asm__ __volatile__ (
  423. "stmdb"wide" sp!, {r0,lr} \n\t"
  424. "ldmia"wide" sp!, {r0,pc}"
  425. );
  426. }
  427. #ifdef CONFIG_THUMB2_KERNEL
  428. static void __naked benchmark_pushpop_thumb(void)
  429. {
  430. __asm__ __volatile__ (
  431. "push.n {r0-r7,lr} \n\t"
  432. "pop.n {r0-r7,pc}"
  433. );
  434. }
  435. #endif
  436. static int __kprobes
  437. benchmark_pre_handler(struct kprobe *p, struct pt_regs *regs)
  438. {
  439. return 0;
  440. }
  441. static int benchmark(void(*fn)(void))
  442. {
  443. unsigned n, i, t, t0;
  444. for (n = 1000; ; n *= 2) {
  445. t0 = sched_clock();
  446. for (i = n; i > 0; --i)
  447. fn();
  448. t = sched_clock() - t0;
  449. if (t >= 250000000)
  450. break; /* Stop once we took more than 0.25 seconds */
  451. }
  452. return t / n; /* Time for one iteration in nanoseconds */
  453. };
  454. static int kprobe_benchmark(void(*fn)(void), unsigned offset)
  455. {
  456. struct kprobe k = {
  457. .addr = (kprobe_opcode_t *)((uintptr_t)fn + offset),
  458. .pre_handler = benchmark_pre_handler,
  459. };
  460. int ret = register_kprobe(&k);
  461. if (ret < 0) {
  462. pr_err("FAIL: register_kprobe failed with %d\n", ret);
  463. return ret;
  464. }
  465. ret = benchmark(fn);
  466. unregister_kprobe(&k);
  467. return ret;
  468. };
  469. struct benchmarks {
  470. void (*fn)(void);
  471. unsigned offset;
  472. const char *title;
  473. };
  474. static int run_benchmarks(void)
  475. {
  476. int ret;
  477. struct benchmarks list[] = {
  478. {&benchmark_nop, 0, "nop"},
  479. /*
  480. * benchmark_pushpop{1,3} will have the optimised
  481. * instruction emulation, whilst benchmark_pushpop{2,4} will
  482. * be the equivalent unoptimised instructions.
  483. */
  484. {&benchmark_pushpop1, 0, "stmdb sp!, {r3-r11,lr}"},
  485. {&benchmark_pushpop1, 4, "ldmia sp!, {r3-r11,pc}"},
  486. {&benchmark_pushpop2, 0, "stmdb sp!, {r0-r8,lr}"},
  487. {&benchmark_pushpop2, 4, "ldmia sp!, {r0-r8,pc}"},
  488. {&benchmark_pushpop3, 0, "stmdb sp!, {r4,lr}"},
  489. {&benchmark_pushpop3, 4, "ldmia sp!, {r4,pc}"},
  490. {&benchmark_pushpop4, 0, "stmdb sp!, {r0,lr}"},
  491. {&benchmark_pushpop4, 4, "ldmia sp!, {r0,pc}"},
  492. #ifdef CONFIG_THUMB2_KERNEL
  493. {&benchmark_pushpop_thumb, 0, "push.n {r0-r7,lr}"},
  494. {&benchmark_pushpop_thumb, 2, "pop.n {r0-r7,pc}"},
  495. #endif
  496. {0}
  497. };
  498. struct benchmarks *b;
  499. for (b = list; b->fn; ++b) {
  500. ret = kprobe_benchmark(b->fn, b->offset);
  501. if (ret < 0)
  502. return ret;
  503. pr_info(" %dns for kprobe %s\n", ret, b->title);
  504. }
  505. pr_info("\n");
  506. return 0;
  507. }
  508. #endif /* BENCHMARKING */
  509. /*
  510. * Decoding table self-consistency tests
  511. */
  512. static const int decode_struct_sizes[NUM_DECODE_TYPES] = {
  513. [DECODE_TYPE_TABLE] = sizeof(struct decode_table),
  514. [DECODE_TYPE_CUSTOM] = sizeof(struct decode_custom),
  515. [DECODE_TYPE_SIMULATE] = sizeof(struct decode_simulate),
  516. [DECODE_TYPE_EMULATE] = sizeof(struct decode_emulate),
  517. [DECODE_TYPE_OR] = sizeof(struct decode_or),
  518. [DECODE_TYPE_REJECT] = sizeof(struct decode_reject)
  519. };
  520. static int table_iter(const union decode_item *table,
  521. int (*fn)(const struct decode_header *, void *),
  522. void *args)
  523. {
  524. const struct decode_header *h = (struct decode_header *)table;
  525. int result;
  526. for (;;) {
  527. enum decode_type type = h->type_regs.bits & DECODE_TYPE_MASK;
  528. if (type == DECODE_TYPE_END)
  529. return 0;
  530. result = fn(h, args);
  531. if (result)
  532. return result;
  533. h = (struct decode_header *)
  534. ((uintptr_t)h + decode_struct_sizes[type]);
  535. }
  536. }
  537. static int table_test_fail(const struct decode_header *h, const char* message)
  538. {
  539. pr_err("FAIL: kprobes test failure \"%s\" (mask %08x, value %08x)\n",
  540. message, h->mask.bits, h->value.bits);
  541. return -EINVAL;
  542. }
  543. struct table_test_args {
  544. const union decode_item *root_table;
  545. u32 parent_mask;
  546. u32 parent_value;
  547. };
  548. static int table_test_fn(const struct decode_header *h, void *args)
  549. {
  550. struct table_test_args *a = (struct table_test_args *)args;
  551. enum decode_type type = h->type_regs.bits & DECODE_TYPE_MASK;
  552. if (h->value.bits & ~h->mask.bits)
  553. return table_test_fail(h, "Match value has bits not in mask");
  554. if ((h->mask.bits & a->parent_mask) != a->parent_mask)
  555. return table_test_fail(h, "Mask has bits not in parent mask");
  556. if ((h->value.bits ^ a->parent_value) & a->parent_mask)
  557. return table_test_fail(h, "Value is inconsistent with parent");
  558. if (type == DECODE_TYPE_TABLE) {
  559. struct decode_table *d = (struct decode_table *)h;
  560. struct table_test_args args2 = *a;
  561. args2.parent_mask = h->mask.bits;
  562. args2.parent_value = h->value.bits;
  563. return table_iter(d->table.table, table_test_fn, &args2);
  564. }
  565. return 0;
  566. }
  567. static int table_test(const union decode_item *table)
  568. {
  569. struct table_test_args args = {
  570. .root_table = table,
  571. .parent_mask = 0,
  572. .parent_value = 0
  573. };
  574. return table_iter(args.root_table, table_test_fn, &args);
  575. }
  576. /*
  577. * Decoding table test coverage analysis
  578. *
  579. * coverage_start() builds a coverage_table which contains a list of
  580. * coverage_entry's to match each entry in the specified kprobes instruction
  581. * decoding table.
  582. *
  583. * When test cases are run, coverage_add() is called to process each case.
  584. * This looks up the corresponding entry in the coverage_table and sets it as
  585. * being matched, as well as clearing the regs flag appropriate for the test.
  586. *
  587. * After all test cases have been run, coverage_end() is called to check that
  588. * all entries in coverage_table have been matched and that all regs flags are
  589. * cleared. I.e. that all possible combinations of instructions described by
  590. * the kprobes decoding tables have had a test case executed for them.
  591. */
  592. bool coverage_fail;
  593. #define MAX_COVERAGE_ENTRIES 256
  594. struct coverage_entry {
  595. const struct decode_header *header;
  596. unsigned regs;
  597. unsigned nesting;
  598. char matched;
  599. };
  600. struct coverage_table {
  601. struct coverage_entry *base;
  602. unsigned num_entries;
  603. unsigned nesting;
  604. };
  605. struct coverage_table coverage;
  606. #define COVERAGE_ANY_REG (1<<0)
  607. #define COVERAGE_SP (1<<1)
  608. #define COVERAGE_PC (1<<2)
  609. #define COVERAGE_PCWB (1<<3)
  610. static const char coverage_register_lookup[16] = {
  611. [REG_TYPE_ANY] = COVERAGE_ANY_REG | COVERAGE_SP | COVERAGE_PC,
  612. [REG_TYPE_SAMEAS16] = COVERAGE_ANY_REG,
  613. [REG_TYPE_SP] = COVERAGE_SP,
  614. [REG_TYPE_PC] = COVERAGE_PC,
  615. [REG_TYPE_NOSP] = COVERAGE_ANY_REG | COVERAGE_SP,
  616. [REG_TYPE_NOSPPC] = COVERAGE_ANY_REG | COVERAGE_SP | COVERAGE_PC,
  617. [REG_TYPE_NOPC] = COVERAGE_ANY_REG | COVERAGE_PC,
  618. [REG_TYPE_NOPCWB] = COVERAGE_ANY_REG | COVERAGE_PC | COVERAGE_PCWB,
  619. [REG_TYPE_NOPCX] = COVERAGE_ANY_REG,
  620. [REG_TYPE_NOSPPCX] = COVERAGE_ANY_REG | COVERAGE_SP,
  621. };
  622. unsigned coverage_start_registers(const struct decode_header *h)
  623. {
  624. unsigned regs = 0;
  625. int i;
  626. for (i = 0; i < 20; i += 4) {
  627. int r = (h->type_regs.bits >> (DECODE_TYPE_BITS + i)) & 0xf;
  628. regs |= coverage_register_lookup[r] << i;
  629. }
  630. return regs;
  631. }
  632. static int coverage_start_fn(const struct decode_header *h, void *args)
  633. {
  634. struct coverage_table *coverage = (struct coverage_table *)args;
  635. enum decode_type type = h->type_regs.bits & DECODE_TYPE_MASK;
  636. struct coverage_entry *entry = coverage->base + coverage->num_entries;
  637. if (coverage->num_entries == MAX_COVERAGE_ENTRIES - 1) {
  638. pr_err("FAIL: Out of space for test coverage data");
  639. return -ENOMEM;
  640. }
  641. ++coverage->num_entries;
  642. entry->header = h;
  643. entry->regs = coverage_start_registers(h);
  644. entry->nesting = coverage->nesting;
  645. entry->matched = false;
  646. if (type == DECODE_TYPE_TABLE) {
  647. struct decode_table *d = (struct decode_table *)h;
  648. int ret;
  649. ++coverage->nesting;
  650. ret = table_iter(d->table.table, coverage_start_fn, coverage);
  651. --coverage->nesting;
  652. return ret;
  653. }
  654. return 0;
  655. }
  656. static int coverage_start(const union decode_item *table)
  657. {
  658. coverage.base = kmalloc_array(MAX_COVERAGE_ENTRIES,
  659. sizeof(struct coverage_entry),
  660. GFP_KERNEL);
  661. coverage.num_entries = 0;
  662. coverage.nesting = 0;
  663. return table_iter(table, coverage_start_fn, &coverage);
  664. }
  665. static void
  666. coverage_add_registers(struct coverage_entry *entry, kprobe_opcode_t insn)
  667. {
  668. int regs = entry->header->type_regs.bits >> DECODE_TYPE_BITS;
  669. int i;
  670. for (i = 0; i < 20; i += 4) {
  671. enum decode_reg_type reg_type = (regs >> i) & 0xf;
  672. int reg = (insn >> i) & 0xf;
  673. int flag;
  674. if (!reg_type)
  675. continue;
  676. if (reg == 13)
  677. flag = COVERAGE_SP;
  678. else if (reg == 15)
  679. flag = COVERAGE_PC;
  680. else
  681. flag = COVERAGE_ANY_REG;
  682. entry->regs &= ~(flag << i);
  683. switch (reg_type) {
  684. case REG_TYPE_NONE:
  685. case REG_TYPE_ANY:
  686. case REG_TYPE_SAMEAS16:
  687. break;
  688. case REG_TYPE_SP:
  689. if (reg != 13)
  690. return;
  691. break;
  692. case REG_TYPE_PC:
  693. if (reg != 15)
  694. return;
  695. break;
  696. case REG_TYPE_NOSP:
  697. if (reg == 13)
  698. return;
  699. break;
  700. case REG_TYPE_NOSPPC:
  701. case REG_TYPE_NOSPPCX:
  702. if (reg == 13 || reg == 15)
  703. return;
  704. break;
  705. case REG_TYPE_NOPCWB:
  706. if (!is_writeback(insn))
  707. break;
  708. if (reg == 15) {
  709. entry->regs &= ~(COVERAGE_PCWB << i);
  710. return;
  711. }
  712. break;
  713. case REG_TYPE_NOPC:
  714. case REG_TYPE_NOPCX:
  715. if (reg == 15)
  716. return;
  717. break;
  718. }
  719. }
  720. }
  721. static void coverage_add(kprobe_opcode_t insn)
  722. {
  723. struct coverage_entry *entry = coverage.base;
  724. struct coverage_entry *end = coverage.base + coverage.num_entries;
  725. bool matched = false;
  726. unsigned nesting = 0;
  727. for (; entry < end; ++entry) {
  728. const struct decode_header *h = entry->header;
  729. enum decode_type type = h->type_regs.bits & DECODE_TYPE_MASK;
  730. if (entry->nesting > nesting)
  731. continue; /* Skip sub-table we didn't match */
  732. if (entry->nesting < nesting)
  733. break; /* End of sub-table we were scanning */
  734. if (!matched) {
  735. if ((insn & h->mask.bits) != h->value.bits)
  736. continue;
  737. entry->matched = true;
  738. }
  739. switch (type) {
  740. case DECODE_TYPE_TABLE:
  741. ++nesting;
  742. break;
  743. case DECODE_TYPE_CUSTOM:
  744. case DECODE_TYPE_SIMULATE:
  745. case DECODE_TYPE_EMULATE:
  746. coverage_add_registers(entry, insn);
  747. return;
  748. case DECODE_TYPE_OR:
  749. matched = true;
  750. break;
  751. case DECODE_TYPE_REJECT:
  752. default:
  753. return;
  754. }
  755. }
  756. }
  757. static void coverage_end(void)
  758. {
  759. struct coverage_entry *entry = coverage.base;
  760. struct coverage_entry *end = coverage.base + coverage.num_entries;
  761. for (; entry < end; ++entry) {
  762. u32 mask = entry->header->mask.bits;
  763. u32 value = entry->header->value.bits;
  764. if (entry->regs) {
  765. pr_err("FAIL: Register test coverage missing for %08x %08x (%05x)\n",
  766. mask, value, entry->regs);
  767. coverage_fail = true;
  768. }
  769. if (!entry->matched) {
  770. pr_err("FAIL: Test coverage entry missing for %08x %08x\n",
  771. mask, value);
  772. coverage_fail = true;
  773. }
  774. }
  775. kfree(coverage.base);
  776. }
  777. /*
  778. * Framework for instruction set test cases
  779. */
  780. void __naked __kprobes_test_case_start(void)
  781. {
  782. __asm__ __volatile__ (
  783. "mov r2, sp \n\t"
  784. "bic r3, r2, #7 \n\t"
  785. "mov sp, r3 \n\t"
  786. "stmdb sp!, {r2-r11} \n\t"
  787. "sub sp, sp, #"__stringify(TEST_MEMORY_SIZE)"\n\t"
  788. "bic r0, lr, #1 @ r0 = inline data \n\t"
  789. "mov r1, sp \n\t"
  790. "bl kprobes_test_case_start \n\t"
  791. RET(r0)" \n\t"
  792. );
  793. }
  794. #ifndef CONFIG_THUMB2_KERNEL
  795. void __naked __kprobes_test_case_end_32(void)
  796. {
  797. __asm__ __volatile__ (
  798. "mov r4, lr \n\t"
  799. "bl kprobes_test_case_end \n\t"
  800. "cmp r0, #0 \n\t"
  801. "movne pc, r0 \n\t"
  802. "mov r0, r4 \n\t"
  803. "add sp, sp, #"__stringify(TEST_MEMORY_SIZE)"\n\t"
  804. "ldmia sp!, {r2-r11} \n\t"
  805. "mov sp, r2 \n\t"
  806. "mov pc, r0 \n\t"
  807. );
  808. }
  809. #else /* CONFIG_THUMB2_KERNEL */
  810. void __naked __kprobes_test_case_end_16(void)
  811. {
  812. __asm__ __volatile__ (
  813. "mov r4, lr \n\t"
  814. "bl kprobes_test_case_end \n\t"
  815. "cmp r0, #0 \n\t"
  816. "bxne r0 \n\t"
  817. "mov r0, r4 \n\t"
  818. "add sp, sp, #"__stringify(TEST_MEMORY_SIZE)"\n\t"
  819. "ldmia sp!, {r2-r11} \n\t"
  820. "mov sp, r2 \n\t"
  821. "bx r0 \n\t"
  822. );
  823. }
  824. void __naked __kprobes_test_case_end_32(void)
  825. {
  826. __asm__ __volatile__ (
  827. ".arm \n\t"
  828. "orr lr, lr, #1 @ will return to Thumb code \n\t"
  829. "ldr pc, 1f \n\t"
  830. "1: \n\t"
  831. ".word __kprobes_test_case_end_16 \n\t"
  832. );
  833. }
  834. #endif
  835. int kprobe_test_flags;
  836. int kprobe_test_cc_position;
  837. static int test_try_count;
  838. static int test_pass_count;
  839. static int test_fail_count;
  840. static struct pt_regs initial_regs;
  841. static struct pt_regs expected_regs;
  842. static struct pt_regs result_regs;
  843. static u32 expected_memory[TEST_MEMORY_SIZE/sizeof(u32)];
  844. static const char *current_title;
  845. static struct test_arg *current_args;
  846. static u32 *current_stack;
  847. static uintptr_t current_branch_target;
  848. static uintptr_t current_code_start;
  849. static kprobe_opcode_t current_instruction;
  850. #define TEST_CASE_PASSED -1
  851. #define TEST_CASE_FAILED -2
  852. static int test_case_run_count;
  853. static bool test_case_is_thumb;
  854. static int test_instance;
  855. static unsigned long test_check_cc(int cc, unsigned long cpsr)
  856. {
  857. int ret = arm_check_condition(cc << 28, cpsr);
  858. return (ret != ARM_OPCODE_CONDTEST_FAIL);
  859. }
  860. static int is_last_scenario;
  861. static int probe_should_run; /* 0 = no, 1 = yes, -1 = unknown */
  862. static int memory_needs_checking;
  863. static unsigned long test_context_cpsr(int scenario)
  864. {
  865. unsigned long cpsr;
  866. probe_should_run = 1;
  867. /* Default case is that we cycle through 16 combinations of flags */
  868. cpsr = (scenario & 0xf) << 28; /* N,Z,C,V flags */
  869. cpsr |= (scenario & 0xf) << 16; /* GE flags */
  870. cpsr |= (scenario & 0x1) << 27; /* Toggle Q flag */
  871. if (!test_case_is_thumb) {
  872. /* Testing ARM code */
  873. int cc = current_instruction >> 28;
  874. probe_should_run = test_check_cc(cc, cpsr) != 0;
  875. if (scenario == 15)
  876. is_last_scenario = true;
  877. } else if (kprobe_test_flags & TEST_FLAG_NO_ITBLOCK) {
  878. /* Testing Thumb code without setting ITSTATE */
  879. if (kprobe_test_cc_position) {
  880. int cc = (current_instruction >> kprobe_test_cc_position) & 0xf;
  881. probe_should_run = test_check_cc(cc, cpsr) != 0;
  882. }
  883. if (scenario == 15)
  884. is_last_scenario = true;
  885. } else if (kprobe_test_flags & TEST_FLAG_FULL_ITBLOCK) {
  886. /* Testing Thumb code with all combinations of ITSTATE */
  887. unsigned x = (scenario >> 4);
  888. unsigned cond_base = x % 7; /* ITSTATE<7:5> */
  889. unsigned mask = x / 7 + 2; /* ITSTATE<4:0>, bits reversed */
  890. if (mask > 0x1f) {
  891. /* Finish by testing state from instruction 'itt al' */
  892. cond_base = 7;
  893. mask = 0x4;
  894. if ((scenario & 0xf) == 0xf)
  895. is_last_scenario = true;
  896. }
  897. cpsr |= cond_base << 13; /* ITSTATE<7:5> */
  898. cpsr |= (mask & 0x1) << 12; /* ITSTATE<4> */
  899. cpsr |= (mask & 0x2) << 10; /* ITSTATE<3> */
  900. cpsr |= (mask & 0x4) << 8; /* ITSTATE<2> */
  901. cpsr |= (mask & 0x8) << 23; /* ITSTATE<1> */
  902. cpsr |= (mask & 0x10) << 21; /* ITSTATE<0> */
  903. probe_should_run = test_check_cc((cpsr >> 12) & 0xf, cpsr) != 0;
  904. } else {
  905. /* Testing Thumb code with several combinations of ITSTATE */
  906. switch (scenario) {
  907. case 16: /* Clear NZCV flags and 'it eq' state (false as Z=0) */
  908. cpsr = 0x00000800;
  909. probe_should_run = 0;
  910. break;
  911. case 17: /* Set NZCV flags and 'it vc' state (false as V=1) */
  912. cpsr = 0xf0007800;
  913. probe_should_run = 0;
  914. break;
  915. case 18: /* Clear NZCV flags and 'it ls' state (true as C=0) */
  916. cpsr = 0x00009800;
  917. break;
  918. case 19: /* Set NZCV flags and 'it cs' state (true as C=1) */
  919. cpsr = 0xf0002800;
  920. is_last_scenario = true;
  921. break;
  922. }
  923. }
  924. return cpsr;
  925. }
  926. static void setup_test_context(struct pt_regs *regs)
  927. {
  928. int scenario = test_case_run_count>>1;
  929. unsigned long val;
  930. struct test_arg *args;
  931. int i;
  932. is_last_scenario = false;
  933. memory_needs_checking = false;
  934. /* Initialise test memory on stack */
  935. val = (scenario & 1) ? VALM : ~VALM;
  936. for (i = 0; i < TEST_MEMORY_SIZE / sizeof(current_stack[0]); ++i)
  937. current_stack[i] = val + (i << 8);
  938. /* Put target of branch on stack for tests which load PC from memory */
  939. if (current_branch_target)
  940. current_stack[15] = current_branch_target;
  941. /* Put a value for SP on stack for tests which load SP from memory */
  942. current_stack[13] = (u32)current_stack + 120;
  943. /* Initialise register values to their default state */
  944. val = (scenario & 2) ? VALR : ~VALR;
  945. for (i = 0; i < 13; ++i)
  946. regs->uregs[i] = val ^ (i << 8);
  947. regs->ARM_lr = val ^ (14 << 8);
  948. regs->ARM_cpsr &= ~(APSR_MASK | PSR_IT_MASK);
  949. regs->ARM_cpsr |= test_context_cpsr(scenario);
  950. /* Perform testcase specific register setup */
  951. args = current_args;
  952. for (; args[0].type != ARG_TYPE_END; ++args)
  953. switch (args[0].type) {
  954. case ARG_TYPE_REG: {
  955. struct test_arg_regptr *arg =
  956. (struct test_arg_regptr *)args;
  957. regs->uregs[arg->reg] = arg->val;
  958. break;
  959. }
  960. case ARG_TYPE_PTR: {
  961. struct test_arg_regptr *arg =
  962. (struct test_arg_regptr *)args;
  963. regs->uregs[arg->reg] =
  964. (unsigned long)current_stack + arg->val;
  965. memory_needs_checking = true;
  966. /*
  967. * Test memory at an address below SP is in danger of
  968. * being altered by an interrupt occurring and pushing
  969. * data onto the stack. Disable interrupts to stop this.
  970. */
  971. if (arg->reg == 13)
  972. regs->ARM_cpsr |= PSR_I_BIT;
  973. break;
  974. }
  975. case ARG_TYPE_MEM: {
  976. struct test_arg_mem *arg = (struct test_arg_mem *)args;
  977. current_stack[arg->index] = arg->val;
  978. break;
  979. }
  980. default:
  981. break;
  982. }
  983. }
  984. struct test_probe {
  985. struct kprobe kprobe;
  986. bool registered;
  987. int hit;
  988. };
  989. static void unregister_test_probe(struct test_probe *probe)
  990. {
  991. if (probe->registered) {
  992. unregister_kprobe(&probe->kprobe);
  993. probe->kprobe.flags = 0; /* Clear disable flag to allow reuse */
  994. }
  995. probe->registered = false;
  996. }
  997. static int register_test_probe(struct test_probe *probe)
  998. {
  999. int ret;
  1000. if (probe->registered)
  1001. BUG();
  1002. ret = register_kprobe(&probe->kprobe);
  1003. if (ret >= 0) {
  1004. probe->registered = true;
  1005. probe->hit = -1;
  1006. }
  1007. return ret;
  1008. }
  1009. static int __kprobes
  1010. test_before_pre_handler(struct kprobe *p, struct pt_regs *regs)
  1011. {
  1012. container_of(p, struct test_probe, kprobe)->hit = test_instance;
  1013. return 0;
  1014. }
  1015. static void __kprobes
  1016. test_before_post_handler(struct kprobe *p, struct pt_regs *regs,
  1017. unsigned long flags)
  1018. {
  1019. setup_test_context(regs);
  1020. initial_regs = *regs;
  1021. initial_regs.ARM_cpsr &= ~PSR_IGNORE_BITS;
  1022. }
  1023. static int __kprobes
  1024. test_case_pre_handler(struct kprobe *p, struct pt_regs *regs)
  1025. {
  1026. container_of(p, struct test_probe, kprobe)->hit = test_instance;
  1027. return 0;
  1028. }
  1029. static int __kprobes
  1030. test_after_pre_handler(struct kprobe *p, struct pt_regs *regs)
  1031. {
  1032. struct test_arg *args;
  1033. if (container_of(p, struct test_probe, kprobe)->hit == test_instance)
  1034. return 0; /* Already run for this test instance */
  1035. result_regs = *regs;
  1036. /* Mask out results which are indeterminate */
  1037. result_regs.ARM_cpsr &= ~PSR_IGNORE_BITS;
  1038. for (args = current_args; args[0].type != ARG_TYPE_END; ++args)
  1039. if (args[0].type == ARG_TYPE_REG_MASKED) {
  1040. struct test_arg_regptr *arg =
  1041. (struct test_arg_regptr *)args;
  1042. result_regs.uregs[arg->reg] &= arg->val;
  1043. }
  1044. /* Undo any changes done to SP by the test case */
  1045. regs->ARM_sp = (unsigned long)current_stack;
  1046. /* Enable interrupts in case setup_test_context disabled them */
  1047. regs->ARM_cpsr &= ~PSR_I_BIT;
  1048. container_of(p, struct test_probe, kprobe)->hit = test_instance;
  1049. return 0;
  1050. }
  1051. static struct test_probe test_before_probe = {
  1052. .kprobe.pre_handler = test_before_pre_handler,
  1053. .kprobe.post_handler = test_before_post_handler,
  1054. };
  1055. static struct test_probe test_case_probe = {
  1056. .kprobe.pre_handler = test_case_pre_handler,
  1057. };
  1058. static struct test_probe test_after_probe = {
  1059. .kprobe.pre_handler = test_after_pre_handler,
  1060. };
  1061. static struct test_probe test_after2_probe = {
  1062. .kprobe.pre_handler = test_after_pre_handler,
  1063. };
  1064. static void test_case_cleanup(void)
  1065. {
  1066. unregister_test_probe(&test_before_probe);
  1067. unregister_test_probe(&test_case_probe);
  1068. unregister_test_probe(&test_after_probe);
  1069. unregister_test_probe(&test_after2_probe);
  1070. }
  1071. static void print_registers(struct pt_regs *regs)
  1072. {
  1073. pr_err("r0 %08lx | r1 %08lx | r2 %08lx | r3 %08lx\n",
  1074. regs->ARM_r0, regs->ARM_r1, regs->ARM_r2, regs->ARM_r3);
  1075. pr_err("r4 %08lx | r5 %08lx | r6 %08lx | r7 %08lx\n",
  1076. regs->ARM_r4, regs->ARM_r5, regs->ARM_r6, regs->ARM_r7);
  1077. pr_err("r8 %08lx | r9 %08lx | r10 %08lx | r11 %08lx\n",
  1078. regs->ARM_r8, regs->ARM_r9, regs->ARM_r10, regs->ARM_fp);
  1079. pr_err("r12 %08lx | sp %08lx | lr %08lx | pc %08lx\n",
  1080. regs->ARM_ip, regs->ARM_sp, regs->ARM_lr, regs->ARM_pc);
  1081. pr_err("cpsr %08lx\n", regs->ARM_cpsr);
  1082. }
  1083. static void print_memory(u32 *mem, size_t size)
  1084. {
  1085. int i;
  1086. for (i = 0; i < size / sizeof(u32); i += 4)
  1087. pr_err("%08x %08x %08x %08x\n", mem[i], mem[i+1],
  1088. mem[i+2], mem[i+3]);
  1089. }
  1090. static size_t expected_memory_size(u32 *sp)
  1091. {
  1092. size_t size = sizeof(expected_memory);
  1093. int offset = (uintptr_t)sp - (uintptr_t)current_stack;
  1094. if (offset > 0)
  1095. size -= offset;
  1096. return size;
  1097. }
  1098. static void test_case_failed(const char *message)
  1099. {
  1100. test_case_cleanup();
  1101. pr_err("FAIL: %s\n", message);
  1102. pr_err("FAIL: Test %s\n", current_title);
  1103. pr_err("FAIL: Scenario %d\n", test_case_run_count >> 1);
  1104. }
  1105. static unsigned long next_instruction(unsigned long pc)
  1106. {
  1107. #ifdef CONFIG_THUMB2_KERNEL
  1108. if ((pc & 1) &&
  1109. !is_wide_instruction(__mem_to_opcode_thumb16(*(u16 *)(pc - 1))))
  1110. return pc + 2;
  1111. else
  1112. #endif
  1113. return pc + 4;
  1114. }
  1115. static uintptr_t __used kprobes_test_case_start(const char **title, void *stack)
  1116. {
  1117. struct test_arg *args;
  1118. struct test_arg_end *end_arg;
  1119. unsigned long test_code;
  1120. current_title = *title++;
  1121. args = (struct test_arg *)title;
  1122. current_args = args;
  1123. current_stack = stack;
  1124. ++test_try_count;
  1125. while (args->type != ARG_TYPE_END)
  1126. ++args;
  1127. end_arg = (struct test_arg_end *)args;
  1128. test_code = (unsigned long)(args + 1); /* Code starts after args */
  1129. test_case_is_thumb = end_arg->flags & ARG_FLAG_THUMB;
  1130. if (test_case_is_thumb)
  1131. test_code |= 1;
  1132. current_code_start = test_code;
  1133. current_branch_target = 0;
  1134. if (end_arg->branch_offset != end_arg->end_offset)
  1135. current_branch_target = test_code + end_arg->branch_offset;
  1136. test_code += end_arg->code_offset;
  1137. test_before_probe.kprobe.addr = (kprobe_opcode_t *)test_code;
  1138. test_code = next_instruction(test_code);
  1139. test_case_probe.kprobe.addr = (kprobe_opcode_t *)test_code;
  1140. if (test_case_is_thumb) {
  1141. u16 *p = (u16 *)(test_code & ~1);
  1142. current_instruction = __mem_to_opcode_thumb16(p[0]);
  1143. if (is_wide_instruction(current_instruction)) {
  1144. u16 instr2 = __mem_to_opcode_thumb16(p[1]);
  1145. current_instruction = __opcode_thumb32_compose(current_instruction, instr2);
  1146. }
  1147. } else {
  1148. current_instruction = __mem_to_opcode_arm(*(u32 *)test_code);
  1149. }
  1150. if (current_title[0] == '.')
  1151. verbose("%s\n", current_title);
  1152. else
  1153. verbose("%s\t@ %0*x\n", current_title,
  1154. test_case_is_thumb ? 4 : 8,
  1155. current_instruction);
  1156. test_code = next_instruction(test_code);
  1157. test_after_probe.kprobe.addr = (kprobe_opcode_t *)test_code;
  1158. if (kprobe_test_flags & TEST_FLAG_NARROW_INSTR) {
  1159. if (!test_case_is_thumb ||
  1160. is_wide_instruction(current_instruction)) {
  1161. test_case_failed("expected 16-bit instruction");
  1162. goto fail;
  1163. }
  1164. } else {
  1165. if (test_case_is_thumb &&
  1166. !is_wide_instruction(current_instruction)) {
  1167. test_case_failed("expected 32-bit instruction");
  1168. goto fail;
  1169. }
  1170. }
  1171. coverage_add(current_instruction);
  1172. if (end_arg->flags & ARG_FLAG_UNSUPPORTED) {
  1173. if (register_test_probe(&test_case_probe) < 0)
  1174. goto pass;
  1175. test_case_failed("registered probe for unsupported instruction");
  1176. goto fail;
  1177. }
  1178. if (end_arg->flags & ARG_FLAG_SUPPORTED) {
  1179. if (register_test_probe(&test_case_probe) >= 0)
  1180. goto pass;
  1181. test_case_failed("couldn't register probe for supported instruction");
  1182. goto fail;
  1183. }
  1184. if (register_test_probe(&test_before_probe) < 0) {
  1185. test_case_failed("register test_before_probe failed");
  1186. goto fail;
  1187. }
  1188. if (register_test_probe(&test_after_probe) < 0) {
  1189. test_case_failed("register test_after_probe failed");
  1190. goto fail;
  1191. }
  1192. if (current_branch_target) {
  1193. test_after2_probe.kprobe.addr =
  1194. (kprobe_opcode_t *)current_branch_target;
  1195. if (register_test_probe(&test_after2_probe) < 0) {
  1196. test_case_failed("register test_after2_probe failed");
  1197. goto fail;
  1198. }
  1199. }
  1200. /* Start first run of test case */
  1201. test_case_run_count = 0;
  1202. ++test_instance;
  1203. return current_code_start;
  1204. pass:
  1205. test_case_run_count = TEST_CASE_PASSED;
  1206. return (uintptr_t)test_after_probe.kprobe.addr;
  1207. fail:
  1208. test_case_run_count = TEST_CASE_FAILED;
  1209. return (uintptr_t)test_after_probe.kprobe.addr;
  1210. }
  1211. static bool check_test_results(void)
  1212. {
  1213. size_t mem_size = 0;
  1214. u32 *mem = 0;
  1215. if (memcmp(&expected_regs, &result_regs, sizeof(expected_regs))) {
  1216. test_case_failed("registers differ");
  1217. goto fail;
  1218. }
  1219. if (memory_needs_checking) {
  1220. mem = (u32 *)result_regs.ARM_sp;
  1221. mem_size = expected_memory_size(mem);
  1222. if (memcmp(expected_memory, mem, mem_size)) {
  1223. test_case_failed("test memory differs");
  1224. goto fail;
  1225. }
  1226. }
  1227. return true;
  1228. fail:
  1229. pr_err("initial_regs:\n");
  1230. print_registers(&initial_regs);
  1231. pr_err("expected_regs:\n");
  1232. print_registers(&expected_regs);
  1233. pr_err("result_regs:\n");
  1234. print_registers(&result_regs);
  1235. if (mem) {
  1236. pr_err("expected_memory:\n");
  1237. print_memory(expected_memory, mem_size);
  1238. pr_err("result_memory:\n");
  1239. print_memory(mem, mem_size);
  1240. }
  1241. return false;
  1242. }
  1243. static uintptr_t __used kprobes_test_case_end(void)
  1244. {
  1245. if (test_case_run_count < 0) {
  1246. if (test_case_run_count == TEST_CASE_PASSED)
  1247. /* kprobes_test_case_start did all the needed testing */
  1248. goto pass;
  1249. else
  1250. /* kprobes_test_case_start failed */
  1251. goto fail;
  1252. }
  1253. if (test_before_probe.hit != test_instance) {
  1254. test_case_failed("test_before_handler not run");
  1255. goto fail;
  1256. }
  1257. if (test_after_probe.hit != test_instance &&
  1258. test_after2_probe.hit != test_instance) {
  1259. test_case_failed("test_after_handler not run");
  1260. goto fail;
  1261. }
  1262. /*
  1263. * Even numbered test runs ran without a probe on the test case so
  1264. * we can gather reference results. The subsequent odd numbered run
  1265. * will have the probe inserted.
  1266. */
  1267. if ((test_case_run_count & 1) == 0) {
  1268. /* Save results from run without probe */
  1269. u32 *mem = (u32 *)result_regs.ARM_sp;
  1270. expected_regs = result_regs;
  1271. memcpy(expected_memory, mem, expected_memory_size(mem));
  1272. /* Insert probe onto test case instruction */
  1273. if (register_test_probe(&test_case_probe) < 0) {
  1274. test_case_failed("register test_case_probe failed");
  1275. goto fail;
  1276. }
  1277. } else {
  1278. /* Check probe ran as expected */
  1279. if (probe_should_run == 1) {
  1280. if (test_case_probe.hit != test_instance) {
  1281. test_case_failed("test_case_handler not run");
  1282. goto fail;
  1283. }
  1284. } else if (probe_should_run == 0) {
  1285. if (test_case_probe.hit == test_instance) {
  1286. test_case_failed("test_case_handler ran");
  1287. goto fail;
  1288. }
  1289. }
  1290. /* Remove probe for any subsequent reference run */
  1291. unregister_test_probe(&test_case_probe);
  1292. if (!check_test_results())
  1293. goto fail;
  1294. if (is_last_scenario)
  1295. goto pass;
  1296. }
  1297. /* Do next test run */
  1298. ++test_case_run_count;
  1299. ++test_instance;
  1300. return current_code_start;
  1301. fail:
  1302. ++test_fail_count;
  1303. goto end;
  1304. pass:
  1305. ++test_pass_count;
  1306. end:
  1307. test_case_cleanup();
  1308. return 0;
  1309. }
  1310. /*
  1311. * Top level test functions
  1312. */
  1313. static int run_test_cases(void (*tests)(void), const union decode_item *table)
  1314. {
  1315. int ret;
  1316. pr_info(" Check decoding tables\n");
  1317. ret = table_test(table);
  1318. if (ret)
  1319. return ret;
  1320. pr_info(" Run test cases\n");
  1321. ret = coverage_start(table);
  1322. if (ret)
  1323. return ret;
  1324. tests();
  1325. coverage_end();
  1326. return 0;
  1327. }
  1328. static int __init run_all_tests(void)
  1329. {
  1330. int ret = 0;
  1331. pr_info("Beginning kprobe tests...\n");
  1332. #ifndef CONFIG_THUMB2_KERNEL
  1333. pr_info("Probe ARM code\n");
  1334. ret = run_api_tests(arm_func);
  1335. if (ret)
  1336. goto out;
  1337. pr_info("ARM instruction simulation\n");
  1338. ret = run_test_cases(kprobe_arm_test_cases, probes_decode_arm_table);
  1339. if (ret)
  1340. goto out;
  1341. #else /* CONFIG_THUMB2_KERNEL */
  1342. pr_info("Probe 16-bit Thumb code\n");
  1343. ret = run_api_tests(thumb16_func);
  1344. if (ret)
  1345. goto out;
  1346. pr_info("Probe 32-bit Thumb code, even halfword\n");
  1347. ret = run_api_tests(thumb32even_func);
  1348. if (ret)
  1349. goto out;
  1350. pr_info("Probe 32-bit Thumb code, odd halfword\n");
  1351. ret = run_api_tests(thumb32odd_func);
  1352. if (ret)
  1353. goto out;
  1354. pr_info("16-bit Thumb instruction simulation\n");
  1355. ret = run_test_cases(kprobe_thumb16_test_cases,
  1356. probes_decode_thumb16_table);
  1357. if (ret)
  1358. goto out;
  1359. pr_info("32-bit Thumb instruction simulation\n");
  1360. ret = run_test_cases(kprobe_thumb32_test_cases,
  1361. probes_decode_thumb32_table);
  1362. if (ret)
  1363. goto out;
  1364. #endif
  1365. pr_info("Total instruction simulation tests=%d, pass=%d fail=%d\n",
  1366. test_try_count, test_pass_count, test_fail_count);
  1367. if (test_fail_count) {
  1368. ret = -EINVAL;
  1369. goto out;
  1370. }
  1371. #if BENCHMARKING
  1372. pr_info("Benchmarks\n");
  1373. ret = run_benchmarks();
  1374. if (ret)
  1375. goto out;
  1376. #endif
  1377. #if __LINUX_ARM_ARCH__ >= 7
  1378. /* We are able to run all test cases so coverage should be complete */
  1379. if (coverage_fail) {
  1380. pr_err("FAIL: Test coverage checks failed\n");
  1381. ret = -EINVAL;
  1382. goto out;
  1383. }
  1384. #endif
  1385. out:
  1386. if (ret == 0)
  1387. ret = tests_failed;
  1388. if (ret == 0)
  1389. pr_info("Finished kprobe tests OK\n");
  1390. else
  1391. pr_err("kprobe tests failed\n");
  1392. return ret;
  1393. }
  1394. /*
  1395. * Module setup
  1396. */
  1397. #ifdef MODULE
  1398. static void __exit kprobe_test_exit(void)
  1399. {
  1400. }
  1401. module_init(run_all_tests)
  1402. module_exit(kprobe_test_exit)
  1403. MODULE_LICENSE("GPL");
  1404. #else /* !MODULE */
  1405. late_initcall(run_all_tests);
  1406. #endif