[REFACTOR] create uretprobe
[kernel/swap-modules.git] / uprobe / arch / asm-arm / swap_uprobes.c
1 #include <dbi_kprobes.h>
2 #include <asm/dbi_kprobes.h>
3 #include <asm/traps.h>
4 #include <swap_uprobes.h>
5 #include <asm/swap_uprobes.h>
6 #include <dbi_insn_slots.h>
7
8 // FIXME:
9 #include <dbi_kdebug.h>
10 extern struct hlist_head uprobe_insn_pages;
11 int arch_check_insn_arm(struct arch_specific_insn *ainsn);
12 int prep_pc_dep_insn_execbuf(kprobe_opcode_t *insns, kprobe_opcode_t insn, int uregs);
13 void pc_dep_insn_execbuf(void);
14 void gen_insn_execbuf(void);
15 void gen_insn_execbuf_thumb(void);
16 void pc_dep_insn_execbuf_thumb(void);
17 int kprobe_trap_handler(struct pt_regs *regs, unsigned int instr);
18 void add_rp_inst(struct kretprobe_instance *ri);
19
20
21 #define sign_extend(x, signbit) ((x) | (0 - ((x) & (1 << (signbit)))))
22 #define branch_displacement(insn) sign_extend(((insn) & 0xffffff) << 2, 25)
23
24 static kprobe_opcode_t get_addr_b(kprobe_opcode_t insn, kprobe_opcode_t *addr)
25 {
26         // real position less then PC by 8
27         return (kprobe_opcode_t)((long)addr + 8 + branch_displacement(insn));
28 }
29
30 /* is instruction Thumb2 and NOT a branch, etc... */
31 static int is_thumb2(kprobe_opcode_t insn)
32 {
33         return ((insn & 0xf800) == 0xe800 ||
34                 (insn & 0xf800) == 0xf000 ||
35                 (insn & 0xf800) == 0xf800);
36 }
37
38 static int arch_copy_trampoline_arm_uprobe(struct kprobe *p, struct task_struct *task, int atomic)
39 {
40         kprobe_opcode_t insns[UPROBES_TRAMP_LEN];
41         int uregs, pc_dep;
42         kprobe_opcode_t insn[MAX_INSN_SIZE];
43         struct arch_specific_insn ainsn;
44
45         p->safe_arm = -1;
46         if ((unsigned long)p->addr & 0x01) {
47                 printk("Error in %s at %d: attempt to register kprobe at an unaligned address\n", __FILE__, __LINE__);
48                 return -EINVAL;
49         }
50
51         insn[0] = p->opcode;
52         ainsn.insn_arm = insn;
53         if (!arch_check_insn_arm(&ainsn)) {
54                 p->safe_arm = 0;
55         }
56
57         uregs = pc_dep = 0;
58         // Rn, Rm ,Rd
59         if (ARM_INSN_MATCH(DPIS, insn[0]) || ARM_INSN_MATCH(LRO, insn[0]) ||
60             ARM_INSN_MATCH(SRO, insn[0])) {
61                 uregs = 0xb;
62                 if ((ARM_INSN_REG_RN(insn[0]) == 15) || (ARM_INSN_REG_RM(insn[0]) == 15) ||
63                     (ARM_INSN_MATCH(SRO, insn[0]) && (ARM_INSN_REG_RD(insn[0]) == 15))) {
64                         DBPRINTF("Unboostable insn %lx, DPIS/LRO/SRO\n", insn[0]);
65                         pc_dep = 1;
66                 }
67
68         // Rn ,Rd
69         } else if (ARM_INSN_MATCH(DPI, insn[0]) || ARM_INSN_MATCH(LIO, insn[0]) ||
70                    ARM_INSN_MATCH (SIO, insn[0])) {
71                 uregs = 0x3;
72                 if ((ARM_INSN_REG_RN(insn[0]) == 15) || (ARM_INSN_MATCH(SIO, insn[0]) &&
73                     (ARM_INSN_REG_RD(insn[0]) == 15))) {
74                         pc_dep = 1;
75                         DBPRINTF("Unboostable insn %lx/%p, DPI/LIO/SIO\n", insn[0], p);
76                 }
77
78         // Rn, Rm, Rs
79         } else if (ARM_INSN_MATCH(DPRS, insn[0])) {
80                 uregs = 0xd;
81                 if ((ARM_INSN_REG_RN(insn[0]) == 15) || (ARM_INSN_REG_RM(insn[0]) == 15) ||
82                     (ARM_INSN_REG_RS(insn[0]) == 15)) {
83                         pc_dep = 1;
84                         DBPRINTF("Unboostable insn %lx, DPRS\n", insn[0]);
85                 }
86
87         // register list
88         } else if (ARM_INSN_MATCH(SM, insn[0])) {
89                 uregs = 0x10;
90                 if (ARM_INSN_REG_MR (insn[0], 15))
91                 {
92                         DBPRINTF ("Unboostable insn %lx, SM\n", insn[0]);
93                         pc_dep = 1;
94                 }
95         }
96
97         // check instructions that can write result to SP andu uses PC
98         if (pc_dep  && (ARM_INSN_REG_RD (ainsn.insn_arm[0]) == 13)) {
99                 printk("Error in %s at %d: instruction check failed (arm)\n", __FILE__, __LINE__);
100                 p->safe_arm = -1;
101                 // TODO: move free to later phase
102                 //free_insn_slot (&uprobe_insn_pages, task, p->ainsn.insn_arm, 0);
103                 //ret = -EFAULT;
104         }
105
106         if (unlikely(uregs && pc_dep)) {
107                 memcpy(insns, pc_dep_insn_execbuf, sizeof(insns));
108                 if (prep_pc_dep_insn_execbuf(insns, insn[0], uregs) != 0) {
109                         printk("Error in %s at %d: failed to prepare exec buffer for insn %lx!",
110                                __FILE__, __LINE__, insn[0]);
111                         p->safe_arm = -1;
112                         // TODO: move free to later phase
113                         //free_insn_slot (&uprobe_insn_pages, task, p->ainsn.insn_arm, 0);
114                         //return -EINVAL;
115                 }
116
117                 insns[6] = (kprobe_opcode_t) (p->addr + 2);
118         } else {
119                 memcpy(insns, gen_insn_execbuf, sizeof(insns));
120                 insns[UPROBES_TRAMP_INSN_IDX] = insn[0];
121         }
122
123         insns[UPROBES_TRAMP_RET_BREAK_IDX] = BREAKPOINT_INSTRUCTION;
124         insns[7] = (kprobe_opcode_t) (p->addr + 1);
125
126         // B
127         if(ARM_INSN_MATCH(B, ainsn.insn_arm[0])) {
128                 memcpy(insns, pc_dep_insn_execbuf, sizeof(insns));
129                 insns[UPROBES_TRAMP_RET_BREAK_IDX] = BREAKPOINT_INSTRUCTION;
130                 insns[6] = (kprobe_opcode_t)(p->addr + 2);
131                 insns[7] = get_addr_b(p->opcode, p->addr);
132         }
133
134         DBPRINTF("arch_prepare_uprobe: to %p - %lx %lx %lx %lx %lx %lx %lx %lx %lx",
135                  p->ainsn.insn_arm, insns[0], insns[1], insns[2], insns[3], insns[4],
136                  insns[5], insns[6], insns[7], insns[8]);
137         if (!write_proc_vm_atomic(task, (unsigned long)p->ainsn.insn_arm, insns, sizeof(insns))) {
138                 panic("failed to write memory %p!\n", p->ainsn.insn_arm);
139                 // Mr_Nobody: we have to panic, really??...
140                 //free_insn_slot (&uprobe_insn_pages, task, p->ainsn.insn_arm, 0);
141                 //return -EINVAL;
142         }
143
144         return 0;
145 }
146
147 static int arch_check_insn_thumb(struct arch_specific_insn *ainsn)
148 {
149         int ret = 0;
150
151         // check instructions that can change PC
152         if (THUMB_INSN_MATCH(UNDEF, ainsn->insn_thumb[0]) ||
153             THUMB_INSN_MATCH(SWI, ainsn->insn_thumb[0]) ||
154             THUMB_INSN_MATCH(BREAK, ainsn->insn_thumb[0]) ||
155             THUMB2_INSN_MATCH(BL, ainsn->insn_thumb[0]) ||
156             THUMB_INSN_MATCH(B1, ainsn->insn_thumb[0]) ||
157             THUMB_INSN_MATCH(B2, ainsn->insn_thumb[0]) ||
158             THUMB_INSN_MATCH(CBZ, ainsn->insn_thumb[0]) ||
159             THUMB2_INSN_MATCH(B1, ainsn->insn_thumb[0]) ||
160             THUMB2_INSN_MATCH(B2, ainsn->insn_thumb[0]) ||
161             THUMB2_INSN_MATCH(BLX1, ainsn->insn_thumb[0]) ||
162             THUMB_INSN_MATCH(BLX2, ainsn->insn_thumb[0]) ||
163             THUMB_INSN_MATCH(BX, ainsn->insn_thumb[0]) ||
164             THUMB2_INSN_MATCH(BXJ, ainsn->insn_thumb[0]) ||
165             (THUMB2_INSN_MATCH(ADR, ainsn->insn_thumb[0]) && THUMB2_INSN_REG_RD(ainsn->insn_thumb[0]) == 15) ||
166             (THUMB2_INSN_MATCH(LDRW, ainsn->insn_thumb[0]) && THUMB2_INSN_REG_RT(ainsn->insn_thumb[0]) == 15) ||
167             (THUMB2_INSN_MATCH(LDRW1, ainsn->insn_thumb[0]) && THUMB2_INSN_REG_RT(ainsn->insn_thumb[0]) == 15) ||
168             (THUMB2_INSN_MATCH(LDRHW, ainsn->insn_thumb[0]) && THUMB2_INSN_REG_RT(ainsn->insn_thumb[0]) == 15) ||
169             (THUMB2_INSN_MATCH(LDRHW1, ainsn->insn_thumb[0]) && THUMB2_INSN_REG_RT(ainsn->insn_thumb[0]) == 15) ||
170             (THUMB2_INSN_MATCH(LDRWL, ainsn->insn_thumb[0]) && THUMB2_INSN_REG_RT(ainsn->insn_thumb[0]) == 15) ||
171             THUMB2_INSN_MATCH(LDMIA, ainsn->insn_thumb[0]) ||
172             THUMB2_INSN_MATCH(LDMDB, ainsn->insn_thumb[0]) ||
173             (THUMB2_INSN_MATCH(DP, ainsn->insn_thumb[0]) && THUMB2_INSN_REG_RD(ainsn->insn_thumb[0]) == 15) ||
174             (THUMB2_INSN_MATCH(RSBW, ainsn->insn_thumb[0]) && THUMB2_INSN_REG_RD(ainsn->insn_thumb[0]) == 15) ||
175             (THUMB2_INSN_MATCH(RORW, ainsn->insn_thumb[0]) && THUMB2_INSN_REG_RD(ainsn->insn_thumb[0]) == 15) ||
176             (THUMB2_INSN_MATCH(ROR, ainsn->insn_thumb[0]) && THUMB2_INSN_REG_RD(ainsn->insn_thumb[0]) == 15) ||
177             (THUMB2_INSN_MATCH(LSLW1, ainsn->insn_thumb[0]) && THUMB2_INSN_REG_RD(ainsn->insn_thumb[0]) == 15) ||
178             (THUMB2_INSN_MATCH(LSLW2, ainsn->insn_thumb[0]) && THUMB2_INSN_REG_RD(ainsn->insn_thumb[0]) == 15) ||
179             (THUMB2_INSN_MATCH(LSRW1, ainsn->insn_thumb[0]) && THUMB2_INSN_REG_RD(ainsn->insn_thumb[0]) == 15) ||
180             (THUMB2_INSN_MATCH(LSRW2, ainsn->insn_thumb[0]) && THUMB2_INSN_REG_RD(ainsn->insn_thumb[0]) == 15) ||
181             /* skip PC, #-imm12 -> SP, #-imm8 and Tegra-hanging instructions */
182             (THUMB2_INSN_MATCH(STRW1, ainsn->insn_thumb[0]) && THUMB2_INSN_REG_RN(ainsn->insn_thumb[0]) == 15) ||
183             (THUMB2_INSN_MATCH(STRBW1, ainsn->insn_thumb[0]) && THUMB2_INSN_REG_RN(ainsn->insn_thumb[0]) == 15) ||
184             (THUMB2_INSN_MATCH(STRHW1, ainsn->insn_thumb[0]) && THUMB2_INSN_REG_RN(ainsn->insn_thumb[0]) == 15) ||
185             (THUMB2_INSN_MATCH(STRW, ainsn->insn_thumb[0]) && THUMB2_INSN_REG_RN(ainsn->insn_thumb[0]) == 15) ||
186             (THUMB2_INSN_MATCH(STRHW, ainsn->insn_thumb[0]) && THUMB2_INSN_REG_RN(ainsn->insn_thumb[0]) == 15) ||
187             (THUMB2_INSN_MATCH(LDRW, ainsn->insn_thumb[0]) && THUMB2_INSN_REG_RN(ainsn->insn_thumb[0]) == 15) ||
188             (THUMB2_INSN_MATCH(LDRBW, ainsn->insn_thumb[0]) && THUMB2_INSN_REG_RN(ainsn->insn_thumb[0]) == 15) ||
189             (THUMB2_INSN_MATCH(LDRHW, ainsn->insn_thumb[0]) && THUMB2_INSN_REG_RN(ainsn->insn_thumb[0]) == 15) ||
190             /* skip STRDx/LDRDx Rt, Rt2, [Rd, ...] */
191             (THUMB2_INSN_MATCH(LDRD, ainsn->insn_thumb[0]) || THUMB2_INSN_MATCH(LDRD1, ainsn->insn_thumb[0]) || THUMB2_INSN_MATCH(STRD, ainsn->insn_thumb[0])) ) {
192                 DBPRINTF("Bad insn arch_check_insn_thumb: %lx\n", ainsn->insn_thumb[0]);
193                 ret = -EFAULT;
194         }
195
196         return ret;
197 }
198
199 static int prep_pc_dep_insn_execbuf_thumb(kprobe_opcode_t * insns, kprobe_opcode_t insn, int uregs)
200 {
201         unsigned char mreg = 0;
202         unsigned char reg = 0;
203
204         if (THUMB_INSN_MATCH(APC, insn) || THUMB_INSN_MATCH(LRO3, insn)) {
205                 reg = ((insn & 0xffff) & uregs) >> 8;
206         } else {
207                 if (THUMB_INSN_MATCH(MOV3, insn)) {
208                         if (((((unsigned char) insn) & 0xff) >> 3) == 15) {
209                                 reg = (insn & 0xffff) & uregs;
210                         } else {
211                                 return 0;
212                         }
213                 } else {
214                         if (THUMB2_INSN_MATCH(ADR, insn)) {
215                                 reg = ((insn >> 16) & uregs) >> 8;
216                                 if (reg == 15) {
217                                         return 0;
218                                 }
219                         } else {
220                                 if (THUMB2_INSN_MATCH(LDRW, insn) || THUMB2_INSN_MATCH(LDRW1, insn) ||
221                                     THUMB2_INSN_MATCH(LDRHW, insn) || THUMB2_INSN_MATCH(LDRHW1, insn) ||
222                                     THUMB2_INSN_MATCH(LDRWL, insn)) {
223                                         reg = ((insn >> 16) & uregs) >> 12;
224                                         if (reg == 15) {
225                                                 return 0;
226                                         }
227                                 } else {
228                                         // LDRB.W PC, [PC, #immed] => PLD [PC, #immed], so Rt == PC is skipped
229                                         if (THUMB2_INSN_MATCH(LDRBW, insn) || THUMB2_INSN_MATCH(LDRBW1, insn) ||
230                                             THUMB2_INSN_MATCH(LDREX, insn)) {
231                                                 reg = ((insn >> 16) & uregs) >> 12;
232                                         } else {
233                                                 if (THUMB2_INSN_MATCH(DP, insn)) {
234                                                         reg = ((insn >> 16) & uregs) >> 12;
235                                                         if (reg == 15) {
236                                                                 return 0;
237                                                         }
238                                                 } else {
239                                                         if (THUMB2_INSN_MATCH(RSBW, insn)) {
240                                                                 reg = ((insn >> 12) & uregs) >> 8;
241                                                                 if (reg == 15){
242                                                                         return 0;
243                                                                 }
244                                                         } else {
245                                                                 if (THUMB2_INSN_MATCH(RORW, insn)) {
246                                                                         reg = ((insn >> 12) & uregs) >> 8;
247                                                                         if (reg == 15) {
248                                                                                 return 0;
249                                                                         }
250                                                                 } else {
251                                                                         if (THUMB2_INSN_MATCH(ROR, insn) || THUMB2_INSN_MATCH(LSLW1, insn) ||
252                                                                             THUMB2_INSN_MATCH(LSLW2, insn) || THUMB2_INSN_MATCH(LSRW1, insn) ||
253                                                                             THUMB2_INSN_MATCH(LSRW2, insn)) {
254                                                                                 reg = ((insn >> 12) & uregs) >> 8;
255                                                                                 if (reg == 15) {
256                                                                                         return 0;
257                                                                                 }
258                                                                         } else {
259                                                                                 if (THUMB2_INSN_MATCH(TEQ1, insn) || THUMB2_INSN_MATCH(TST1, insn)) {
260                                                                                         reg = 15;
261                                                                                 } else {
262                                                                                         if (THUMB2_INSN_MATCH(TEQ2, insn) || THUMB2_INSN_MATCH(TST2, insn)) {
263                                                                                                 reg = THUMB2_INSN_REG_RM(insn);
264                                                                                         }
265                                                                                 }
266                                                                         }
267                                                                 }
268                                                         }
269                                                 }
270                                         }
271                                 }
272                         }
273                 }
274         }
275
276         if ((THUMB2_INSN_MATCH(STRW, insn) || THUMB2_INSN_MATCH(STRBW, insn) ||
277              THUMB2_INSN_MATCH(STRD, insn) || THUMB2_INSN_MATCH(STRHT, insn) ||
278              THUMB2_INSN_MATCH(STRT, insn) || THUMB2_INSN_MATCH(STRHW1, insn) ||
279              THUMB2_INSN_MATCH(STRHW, insn)) && THUMB2_INSN_REG_RT(insn) == 15) {
280                 reg = THUMB2_INSN_REG_RT(insn);
281         }
282
283         if (reg == 6 || reg == 7) {
284                 *((unsigned short*)insns + 0) = (*((unsigned short*)insns + 0) & 0x00ff) | ((1 << mreg) | (1 << (mreg + 1)));
285                 *((unsigned short*)insns + 1) = (*((unsigned short*)insns + 1) & 0xf8ff) | (mreg << 8);
286                 *((unsigned short*)insns + 2) = (*((unsigned short*)insns + 2) & 0xfff8) | (mreg + 1);
287                 *((unsigned short*)insns + 3) = (*((unsigned short*)insns + 3) & 0xffc7) | (mreg << 3);
288                 *((unsigned short*)insns + 7) = (*((unsigned short*)insns + 7) & 0xf8ff) | (mreg << 8);
289                 *((unsigned short*)insns + 8) = (*((unsigned short*)insns + 8) & 0xffc7) | (mreg << 3);
290                 *((unsigned short*)insns + 9) = (*((unsigned short*)insns + 9) & 0xffc7) | ((mreg + 1) << 3);
291                 *((unsigned short*)insns + 10) = (*((unsigned short*)insns + 10) & 0x00ff) | (( 1 << mreg) | (1 << (mreg + 1)));
292         }
293
294         if (THUMB_INSN_MATCH(APC, insn)) {
295                 // ADD Rd, PC, #immed_8*4 -> ADD Rd, SP, #immed_8*4
296                 *((unsigned short*)insns + 4) = ((insn & 0xffff) | 0x800);                              // ADD Rd, SP, #immed_8*4
297         } else {
298                 if (THUMB_INSN_MATCH(LRO3, insn)) {
299                         // LDR Rd, [PC, #immed_8*4] -> LDR Rd, [SP, #immed_8*4]
300                         *((unsigned short*)insns + 4) = ((insn & 0xffff) + 0x5000);                     // LDR Rd, [SP, #immed_8*4]
301                 } else {
302                         if (THUMB_INSN_MATCH(MOV3, insn)) {
303                                 // MOV Rd, PC -> MOV Rd, SP
304                                 *((unsigned short*)insns + 4) = ((insn & 0xffff) ^ 0x10);               // MOV Rd, SP
305                         } else {
306                                 if (THUMB2_INSN_MATCH(ADR, insn)) {
307                                         // ADDW Rd, PC, #imm -> ADDW Rd, SP, #imm
308                                         insns[2] = (insn & 0xfffffff0) | 0x0d;                          // ADDW Rd, SP, #imm
309                                 } else {
310                                         if (THUMB2_INSN_MATCH(LDRW, insn) || THUMB2_INSN_MATCH(LDRBW, insn) ||
311                                             THUMB2_INSN_MATCH(LDRHW, insn)) {
312                                                 // LDR.W Rt, [PC, #-<imm_12>] -> LDR.W Rt, [SP, #-<imm_8>]
313                                                 // !!!!!!!!!!!!!!!!!!!!!!!!
314                                                 // !!! imm_12 vs. imm_8 !!!
315                                                 // !!!!!!!!!!!!!!!!!!!!!!!!
316                                                 insns[2] = (insn & 0xf0fffff0) | 0x0c00000d;            // LDR.W Rt, [SP, #-<imm_8>]
317                                         } else {
318                                                 if (THUMB2_INSN_MATCH(LDRW1, insn) || THUMB2_INSN_MATCH(LDRBW1, insn) ||
319                                                     THUMB2_INSN_MATCH(LDRHW1, insn) || THUMB2_INSN_MATCH(LDRD, insn) ||
320                                                     THUMB2_INSN_MATCH(LDRD1, insn) || THUMB2_INSN_MATCH(LDREX, insn)) {
321                                                         // LDRx.W Rt, [PC, #+<imm_12>] -> LDRx.W Rt, [SP, #+<imm_12>] (+/-imm_8 for LDRD Rt, Rt2, [PC, #<imm_8>]
322                                                         insns[2] = (insn & 0xfffffff0) | 0xd;                                                                                                   // LDRx.W Rt, [SP, #+<imm_12>]
323                                                 } else {
324                                                         if (THUMB2_INSN_MATCH(MUL, insn)) {
325                                                                 insns[2] = (insn & 0xfff0ffff) | 0x000d0000;                                                                                    // MUL Rd, Rn, SP
326                                                         } else {
327                                                                 if (THUMB2_INSN_MATCH(DP, insn)) {
328                                                                         if (THUMB2_INSN_REG_RM(insn) == 15) {
329                                                                                 insns[2] = (insn & 0xfff0ffff) | 0x000d0000;                                                                    // DP Rd, Rn, PC
330                                                                         } else if (THUMB2_INSN_REG_RN(insn) == 15) {
331                                                                                 insns[2] = (insn & 0xfffffff0) | 0xd;                                                                           // DP Rd, PC, Rm
332                                                                         }
333                                                                 } else {
334                                                                         if (THUMB2_INSN_MATCH(LDRWL, insn)) {
335                                                                                 // LDRx.W Rt, [PC, #<imm_12>] -> LDRx.W Rt, [SP, #+<imm_12>] (+/-imm_8 for LDRD Rt, Rt2, [PC, #<imm_8>]
336                                                                                 insns[2] = (insn & 0xfffffff0) | 0xd;                                                                           // LDRx.W Rt, [SP, #+<imm_12>]
337                                                                         } else {
338                                                                                 if (THUMB2_INSN_MATCH(RSBW, insn)) {
339                                                                                         insns[2] = (insn & 0xfffffff0) | 0xd;                                                                   // RSB{S}.W Rd, PC, #<const> -> RSB{S}.W Rd, SP, #<const>
340                                                                                 } else {
341                                                                                         if (THUMB2_INSN_MATCH(RORW, insn) || THUMB2_INSN_MATCH(LSLW1, insn) || THUMB2_INSN_MATCH(LSRW1, insn)) {
342                                                                                                 if ((THUMB2_INSN_REG_RM(insn) == 15) && (THUMB2_INSN_REG_RN(insn) == 15)) {
343                                                                                                         insns[2] = (insn & 0xfffdfffd);                                                         // ROR.W Rd, PC, PC
344                                                                                                 } else if (THUMB2_INSN_REG_RM(insn) == 15) {
345                                                                                                         insns[2] = (insn & 0xfff0ffff) | 0xd0000;                                               // ROR.W Rd, Rn, PC
346                                                                                                 } else if (THUMB2_INSN_REG_RN(insn) == 15) {
347                                                                                                         insns[2] = (insn & 0xfffffff0) | 0xd;                                                   // ROR.W Rd, PC, Rm
348                                                                                                 }
349                                                                                         } else {
350                                                                                                 if (THUMB2_INSN_MATCH(ROR, insn) || THUMB2_INSN_MATCH(LSLW2, insn) || THUMB2_INSN_MATCH(LSRW2, insn)) {
351                                                                                                         insns[2] = (insn & 0xfff0ffff) | 0xd0000;                                               // ROR{S} Rd, PC, #<const> -> ROR{S} Rd, SP, #<const>
352                                                                                                 }
353                                                                                         }
354                                                                                 }
355                                                                         }
356                                                                 }
357                                                         }
358                                                 }
359                                         }
360                                 }
361                         }
362                 }
363         }
364
365         if (THUMB2_INSN_MATCH(STRW, insn) || THUMB2_INSN_MATCH(STRBW, insn)) {
366                 insns[2] = (insn & 0xfff0ffff) | 0x000d0000;                                                            // STRx.W Rt, [Rn, SP]
367         } else {
368                 if (THUMB2_INSN_MATCH(STRD, insn) || THUMB2_INSN_MATCH(STRHT, insn) ||
369                     THUMB2_INSN_MATCH(STRT, insn) || THUMB2_INSN_MATCH(STRHW1, insn)) {
370                         if (THUMB2_INSN_REG_RN(insn) == 15) {
371                                 insns[2] = (insn & 0xfffffff0) | 0xd;                                                   // STRD/T/HT{.W} Rt, [SP, ...]
372                         } else {
373                                 insns[2] = insn;
374                         }
375                 } else {
376                         if (THUMB2_INSN_MATCH(STRHW, insn) && (THUMB2_INSN_REG_RN(insn) == 15)) {
377                                 if (THUMB2_INSN_REG_RN(insn) == 15) {
378                                         insns[2] = (insn & 0xf0fffff0) | 0x0c00000d;                                    // STRH.W Rt, [SP, #-<imm_8>]
379                                 } else {
380                                         insns[2] = insn;
381                                 }
382                         }
383                 }
384         }
385
386         // STRx PC, xxx
387         if ((reg == 15) && (THUMB2_INSN_MATCH(STRW, insn)   ||
388                             THUMB2_INSN_MATCH(STRBW, insn)  ||
389                             THUMB2_INSN_MATCH(STRD, insn)   ||
390                             THUMB2_INSN_MATCH(STRHT, insn)  ||
391                             THUMB2_INSN_MATCH(STRT, insn)   ||
392                             THUMB2_INSN_MATCH(STRHW1, insn) ||
393                             THUMB2_INSN_MATCH(STRHW, insn) )) {
394                 insns[2] = (insns[2] & 0x0fffffff) | 0xd0000000;
395         }
396
397         if (THUMB2_INSN_MATCH(TEQ1, insn) || THUMB2_INSN_MATCH(TST1, insn)) {
398                 insns[2] = (insn & 0xfffffff0) | 0xd;                                                                   // TEQ SP, #<const>
399         } else {
400                 if (THUMB2_INSN_MATCH(TEQ2, insn) || THUMB2_INSN_MATCH(TST2, insn)) {
401                         if ((THUMB2_INSN_REG_RN(insn) == 15) && (THUMB2_INSN_REG_RM(insn) == 15)) {
402                                 insns[2] = (insn & 0xfffdfffd);                                                         // TEQ/TST PC, PC
403                         } else if (THUMB2_INSN_REG_RM(insn) == 15) {
404                                 insns[2] = (insn & 0xfff0ffff) | 0xd0000;                                               // TEQ/TST Rn, PC
405                         } else if (THUMB2_INSN_REG_RN(insn) == 15) {
406                                 insns[2] = (insn & 0xfffffff0) | 0xd;                                                   // TEQ/TST PC, Rm
407                         }
408                 }
409         }
410
411         return 0;
412 }
413
414 static int arch_copy_trampoline_thumb_uprobe(struct kprobe *p, struct task_struct *task, int atomic)
415 {
416         int uregs, pc_dep;
417         unsigned int addr;
418         kprobe_opcode_t insn[MAX_INSN_SIZE];
419         struct arch_specific_insn ainsn;
420         kprobe_opcode_t insns[UPROBES_TRAMP_LEN * 2];
421
422         p->safe_thumb = -1;
423         if ((unsigned long)p->addr & 0x01) {
424                 printk("Error in %s at %d: attempt to register kprobe at an unaligned address\n", __FILE__, __LINE__);
425                 return -EINVAL;
426         }
427
428         insn[0] = p->opcode;
429         ainsn.insn_thumb = insn;
430         if (!arch_check_insn_thumb(&ainsn)) {
431                 p->safe_thumb = 0;
432         }
433
434         uregs = 0;
435         pc_dep = 0;
436
437         if (THUMB_INSN_MATCH(APC, insn[0]) || THUMB_INSN_MATCH(LRO3, insn[0])) {
438                 uregs = 0x0700;         // 8-10
439                 pc_dep = 1;
440         } else if (THUMB_INSN_MATCH(MOV3, insn[0]) && (((((unsigned char)insn[0]) & 0xff) >> 3) == 15)) {
441                 // MOV Rd, PC
442                 uregs = 0x07;
443                 pc_dep = 1;
444         } else if THUMB2_INSN_MATCH(ADR, insn[0]) {
445                 uregs = 0x0f00;         // Rd 8-11
446                 pc_dep = 1;
447         } else if (((THUMB2_INSN_MATCH(LDRW, insn[0]) || THUMB2_INSN_MATCH(LDRW1, insn[0]) ||
448                      THUMB2_INSN_MATCH(LDRBW, insn[0]) || THUMB2_INSN_MATCH(LDRBW1, insn[0]) ||
449                      THUMB2_INSN_MATCH(LDRHW, insn[0]) || THUMB2_INSN_MATCH(LDRHW1, insn[0]) ||
450                      THUMB2_INSN_MATCH(LDRWL, insn[0])) && THUMB2_INSN_REG_RN(insn[0]) == 15) ||
451                      THUMB2_INSN_MATCH(LDREX, insn[0]) ||
452                      ((THUMB2_INSN_MATCH(STRW, insn[0]) || THUMB2_INSN_MATCH(STRBW, insn[0]) ||
453                        THUMB2_INSN_MATCH(STRHW, insn[0]) || THUMB2_INSN_MATCH(STRHW1, insn[0])) &&
454                       (THUMB2_INSN_REG_RN(insn[0]) == 15 || THUMB2_INSN_REG_RT(insn[0]) == 15)) ||
455                      ((THUMB2_INSN_MATCH(STRT, insn[0]) || THUMB2_INSN_MATCH(STRHT, insn[0])) &&
456                        (THUMB2_INSN_REG_RN(insn[0]) == 15 || THUMB2_INSN_REG_RT(insn[0]) == 15))) {
457                 uregs = 0xf000;         // Rt 12-15
458                 pc_dep = 1;
459         } else if ((THUMB2_INSN_MATCH(LDRD, insn[0]) || THUMB2_INSN_MATCH(LDRD1, insn[0])) && (THUMB2_INSN_REG_RN(insn[0]) == 15)) {
460                 uregs = 0xff00;         // Rt 12-15, Rt2 8-11
461                 pc_dep = 1;
462         } else if (THUMB2_INSN_MATCH(MUL, insn[0]) && THUMB2_INSN_REG_RM(insn[0]) == 15) {
463                 uregs = 0xf;
464                 pc_dep = 1;
465         } else if (THUMB2_INSN_MATCH(DP, insn[0]) && (THUMB2_INSN_REG_RN(insn[0]) == 15 || THUMB2_INSN_REG_RM(insn[0]) == 15)) {
466                 uregs = 0xf000;         // Rd 12-15
467                 pc_dep = 1;
468         } else if (THUMB2_INSN_MATCH(STRD, insn[0]) && ((THUMB2_INSN_REG_RN(insn[0]) == 15) || (THUMB2_INSN_REG_RT(insn[0]) == 15) || THUMB2_INSN_REG_RT2(insn[0]) == 15)) {
469                 uregs = 0xff00;         // Rt 12-15, Rt2 8-11
470                 pc_dep = 1;
471         } else if (THUMB2_INSN_MATCH(RSBW, insn[0]) && THUMB2_INSN_REG_RN(insn[0]) == 15) {
472                 uregs = 0x0f00;         // Rd 8-11
473                 pc_dep = 1;
474         } else if (THUMB2_INSN_MATCH (RORW, insn[0]) && (THUMB2_INSN_REG_RN(insn[0]) == 15 || THUMB2_INSN_REG_RM(insn[0]) == 15)) {
475                 uregs = 0x0f00;
476                 pc_dep = 1;
477         } else if ((THUMB2_INSN_MATCH(ROR, insn[0]) || THUMB2_INSN_MATCH(LSLW2, insn[0]) || THUMB2_INSN_MATCH(LSRW2, insn[0])) && THUMB2_INSN_REG_RM(insn[0]) == 15) {
478                 uregs = 0x0f00;         // Rd 8-11
479                 pc_dep = 1;
480         } else if ((THUMB2_INSN_MATCH(LSLW1, insn[0]) || THUMB2_INSN_MATCH(LSRW1, insn[0])) && (THUMB2_INSN_REG_RN(insn[0]) == 15 || THUMB2_INSN_REG_RM(insn[0]) == 15)) {
481                 uregs = 0x0f00;         // Rd 8-11
482                 pc_dep = 1;
483         } else if ((THUMB2_INSN_MATCH(TEQ1, insn[0]) || THUMB2_INSN_MATCH(TST1, insn[0])) && THUMB2_INSN_REG_RN(insn[0]) == 15) {
484                 uregs = 0xf0000;        //Rn 0-3 (16-19)
485                 pc_dep = 1;
486         } else if ((THUMB2_INSN_MATCH(TEQ2, insn[0]) || THUMB2_INSN_MATCH(TST2, insn[0])) &&
487                    (THUMB2_INSN_REG_RN(insn[0]) == 15 || THUMB2_INSN_REG_RM(insn[0]) == 15)) {
488                 uregs = 0xf0000;        //Rn 0-3 (16-19)
489                 pc_dep = 1;
490         }
491
492         if (unlikely(uregs && pc_dep)) {
493                 memcpy(insns, pc_dep_insn_execbuf_thumb, 18 * 2);
494                 if (prep_pc_dep_insn_execbuf_thumb(insns, insn[0], uregs) != 0) {
495                         printk("Error in %s at %d: failed to prepare exec buffer for insn %lx!",
496                                __FILE__, __LINE__, insn[0]);
497                         p->safe_thumb = -1;
498                         //free_insn_slot (&uprobe_insn_pages, task, p->ainsn.insn_thumb, 0);
499                         //return -EINVAL;
500                 }
501
502                 addr = ((unsigned int)p->addr) + 4;
503                 *((unsigned short*)insns + 13) = 0xdeff;
504                 *((unsigned short*)insns + 14) = addr & 0x0000ffff;
505                 *((unsigned short*)insns + 15) = addr >> 16;
506                 if (!is_thumb2(insn[0])) {
507                         addr = ((unsigned int)p->addr) + 2;
508                         *((unsigned short*)insns + 16) = (addr & 0x0000ffff) | 0x1;
509                         *((unsigned short*)insns + 17) = addr >> 16;
510                 } else {
511                         addr = ((unsigned int)p->addr) + 4;
512                         *((unsigned short*)insns + 16) = (addr & 0x0000ffff) | 0x1;
513                         *((unsigned short*)insns + 17) = addr >> 16;
514                 }
515         } else {
516                 memcpy(insns, gen_insn_execbuf_thumb, 18 * 2);
517                 *((unsigned short*)insns + 13) = 0xdeff;
518                 if (!is_thumb2(insn[0])) {
519                         addr = ((unsigned int)p->addr) + 2;
520                         *((unsigned short*)insns + 2) = insn[0];
521                         *((unsigned short*)insns + 16) = (addr & 0x0000ffff) | 0x1;
522                         *((unsigned short*)insns + 17) = addr >> 16;
523                 } else {
524                         addr = ((unsigned int)p->addr) + 4;
525                         insns[1] = insn[0];
526                         *((unsigned short*)insns + 16) = (addr & 0x0000ffff) | 0x1;
527                         *((unsigned short*)insns + 17) = addr >> 16;
528                 }
529         }
530
531         if (!write_proc_vm_atomic (task, (unsigned long)p->ainsn.insn_thumb, insns, 18 * 2)) {
532                 panic("failed to write memory %p!\n", p->ainsn.insn_thumb);
533                 // Mr_Nobody: we have to panic, really??...
534                 //free_insn_slot (&uprobe_insn_pages, task, p->ainsn.insn_thumb, 0);
535                 //return -EINVAL;
536         }
537
538         return 0;
539 }
540
541 int arch_prepare_uprobe(struct kprobe *p, struct task_struct *task, int atomic)
542 {
543         int ret = 0;
544         kprobe_opcode_t insn[MAX_INSN_SIZE];
545
546         if ((unsigned long)p->addr & 0x01) {
547                 printk("Error in %s at %d: attempt to register kprobe at an unaligned address\n", __FILE__, __LINE__);
548                 return -EINVAL;
549         }
550
551         if (!read_proc_vm_atomic(task, (unsigned long)p->addr, &insn, MAX_INSN_SIZE * sizeof(kprobe_opcode_t))) {
552                 panic("Failed to read memory task[tgid=%u, comm=%s] %p!\n", task->tgid, task->comm, p->addr);
553         }
554
555         p->opcode = insn[0];
556         p->ainsn.insn_arm = get_insn_slot(task, &uprobe_insn_pages, atomic);
557         if (!p->ainsn.insn_arm) {
558                 printk("Error in %s at %d: kprobe slot allocation error (arm)\n", __FILE__, __LINE__);
559                 return -ENOMEM;
560         }
561
562         ret = arch_copy_trampoline_arm_uprobe(p, task, 1);
563         if (ret) {
564                 free_insn_slot(&uprobe_insn_pages, task, p->ainsn.insn_arm);
565                 return -EFAULT;
566         }
567
568         p->ainsn.insn_thumb = get_insn_slot(task, &uprobe_insn_pages, atomic);
569         if (!p->ainsn.insn_thumb) {
570                 printk("Error in %s at %d: kprobe slot allocation error (thumb)\n", __FILE__, __LINE__);
571                 return -ENOMEM;
572         }
573
574         ret = arch_copy_trampoline_thumb_uprobe(p, task, 1);
575         if (ret) {
576                 free_insn_slot(&uprobe_insn_pages, task, p->ainsn.insn_arm);
577                 free_insn_slot(&uprobe_insn_pages, task, p->ainsn.insn_thumb);
578                 return -EFAULT;
579         }
580
581         if ((p->safe_arm == -1) && (p->safe_thumb == -1)) {
582                 printk("Error in %s at %d: failed arch_copy_trampoline_*_uprobe() (both) [tgid=%u, addr=%lx, data=%lx]\n",
583                        __FILE__, __LINE__, task->tgid, (unsigned long)p->addr, (unsigned long)p->opcode);
584                 if (!write_proc_vm_atomic(task, (unsigned long)p->addr, &p->opcode, sizeof(p->opcode))) {
585                         panic("Failed to write memory %p!\n", p->addr);
586                 }
587
588                 free_insn_slot(&uprobe_insn_pages, task, p->ainsn.insn_arm);
589                 free_insn_slot(&uprobe_insn_pages, task, p->ainsn.insn_thumb);
590
591                 return -EFAULT;
592         }
593
594         return ret;
595 }
596
597 void arch_prepare_uretprobe_hl(struct uretprobe_instance *ri,
598                                struct pt_regs *regs)
599 {
600         ri->ret_addr = (kprobe_opcode_t *)regs->ARM_lr;
601         ri->sp = (kprobe_opcode_t *)regs->ARM_sp;
602
603         /* Set flag of current mode */
604         ri->sp = (kprobe_opcode_t *)((long)ri->sp | !!thumb_mode(regs));
605
606         if (thumb_mode(regs)) {
607                 regs->ARM_lr = (unsigned long)(ri->rp->kp.ainsn.insn) + 0x1b;
608         } else {
609                 regs->ARM_lr = (unsigned long)(ri->rp->kp.ainsn.insn + UPROBES_TRAMP_RET_BREAK_IDX);
610         }
611 }
612
613 int setjmp_upre_handler(struct kprobe *p, struct pt_regs *regs)
614 {
615         struct jprobe *jp = container_of(p, struct jprobe, kp);
616         kprobe_pre_entry_handler_t pre_entry = (kprobe_pre_entry_handler_t)jp->pre_entry;
617         entry_point_t entry = (entry_point_t)jp->entry;
618
619         if (pre_entry) {
620                 p->ss_addr = (kprobe_opcode_t *)pre_entry(jp->priv_arg, regs);
621         }
622
623         if (entry) {
624                 entry(regs->ARM_r0, regs->ARM_r1, regs->ARM_r2,
625                       regs->ARM_r3, regs->ARM_r4, regs->ARM_r5);
626         } else {
627                 dbi_arch_uprobe_return();
628         }
629
630         return 0;
631 }
632
633 int trampoline_uprobe_handler(struct kprobe *p, struct pt_regs *regs)
634 {
635         struct uretprobe_instance *ri = NULL;
636         struct hlist_head *head;
637         struct hlist_node *node, *tmp;
638         unsigned long flags, orig_ret_address = 0;
639         unsigned long trampoline_address = 0;
640
641         if (thumb_mode(regs)) {
642                 trampoline_address = (unsigned long)(p->ainsn.insn) + 0x1b;
643         } else {
644                 trampoline_address = (unsigned long)(p->ainsn.insn + UPROBES_TRAMP_RET_BREAK_IDX);
645         }
646
647         spin_lock_irqsave(&uretprobe_lock, flags);
648
649         head = uretprobe_inst_table_head(current->mm);
650
651         /*
652          * It is possible to have multiple instances associated with a given
653          * task either because an multiple functions in the call path
654          * have a return probe installed on them, and/or more then one
655          * return probe was registered for a target function.
656          *
657          * We can handle this because:
658          *     - instances are always inserted at the head of the list
659          *     - when multiple return probes are registered for the same
660          *       function, the first instance's ret_addr will point to the
661          *       real return address, and all the rest will point to
662          *       uretprobe_trampoline
663          */
664         hlist_for_each_entry_safe(ri, node, tmp, head, hlist) {
665                 if (ri->task != current) {
666                         /* another task is sharing our hash bucket */
667                         continue;
668                 }
669
670                 if (ri->rp && ri->rp->handler) {
671                         ri->rp->handler(ri, regs, ri->rp->priv_arg);
672                 }
673
674                 orig_ret_address = (unsigned long)ri->ret_addr;
675                 recycle_urp_inst(ri);
676
677                 if (orig_ret_address != trampoline_address) {
678                         /*
679                          * This is the real return address. Any other
680                          * instances associated with this task are for
681                          * other calls deeper on the call stack
682                          */
683                         break;
684                 }
685         }
686
687         regs->ARM_pc = orig_ret_address;
688         if (thumb_mode(regs) && !(regs->ARM_lr & 0x01)) {
689                 regs->ARM_cpsr &= 0xFFFFFFDF;
690         } else if (user_mode(regs) && (regs->ARM_lr & 0x01)) {
691                 regs->ARM_cpsr |= 0x20;
692         }
693
694         spin_unlock_irqrestore(&uretprobe_lock, flags);
695
696         /*
697          * By returning a non-zero value, we are telling
698          * kprobe_handler() that we don't want the post_handler
699          * to run (and have re-enabled preemption)
700          */
701
702         return 1;
703 }
704
705 static int check_validity_insn(struct kprobe *p, struct pt_regs *regs, struct task_struct *task)
706 {
707         struct kprobe *kp;
708
709         if (unlikely(thumb_mode(regs))) {
710                 if (p->safe_thumb != -1) {
711                         p->ainsn.insn = p->ainsn.insn_thumb;
712                         list_for_each_entry_rcu(kp, &p->list, list) {
713                                 kp->ainsn.insn = p->ainsn.insn_thumb;
714                         }
715                 } else {
716                         printk("Error in %s at %d: we are in thumb mode (!) and check instruction was fail \
717                                 (%0lX instruction at %p address)!\n", __FILE__, __LINE__, p->opcode, p->addr);
718                         // Test case when we do our actions on already running application
719                         disarm_uprobe(p, task);
720                         return -1;
721                 }
722         } else {
723                 if (p->safe_arm != -1) {
724                         p->ainsn.insn = p->ainsn.insn_arm;
725                         list_for_each_entry_rcu(kp, &p->list, list) {
726                                 kp->ainsn.insn = p->ainsn.insn_arm;
727                         }
728                 } else {
729                         printk("Error in %s at %d: we are in arm mode (!) and check instruction was fail \
730                                 (%0lX instruction at %p address)!\n", __FILE__, __LINE__, p->opcode, p->addr);
731                         // Test case when we do our actions on already running application
732                         disarm_uprobe(p, task);
733                         return -1;
734                 }
735         }
736
737         return 0;
738 }
739
740 static int uprobe_handler(struct pt_regs *regs)
741 {
742         kprobe_opcode_t *addr = (kprobe_opcode_t *)(regs->ARM_pc);
743         struct task_struct *task = current;
744         pid_t tgid = task->tgid;
745         struct kprobe *p;
746
747         p = get_uprobe(addr, tgid);
748
749         if (p && (check_validity_insn(p, regs, task) != 0)) {
750                 printk("no_uprobe live\n");
751                 return 0;
752         }
753
754         if (p == NULL) {
755                 p = get_kprobe_by_insn_slot(addr, tgid, regs);
756                 if (p == NULL) {
757                         printk("no_uprobe\n");
758                         return 1;
759                 }
760
761                 trampoline_uprobe_handler(p, regs);
762                 return 0;
763         }
764
765         /* restore opcode for thumb app */
766         if (thumb_mode(regs)) {
767                 if (!is_thumb2(p->opcode)) {
768                         unsigned long tmp = p->opcode >> 16;
769                         write_proc_vm_atomic(task, (unsigned long)((unsigned short*)p->addr + 1), &tmp, 2);
770
771                         // "2*sizeof(kprobe_opcode_t)" - strange. Should be "sizeof(kprobe_opcode_t)", need to test
772                         flush_icache_range((unsigned int)p->addr, ((unsigned int)p->addr) + (2 * sizeof(kprobe_opcode_t)));
773                 }
774         }
775
776         if (!p->pre_handler || !p->pre_handler(p, regs)) {
777                 prepare_singlestep(p, regs);
778         }
779
780         return 0;
781 }
782
783 int uprobe_trap_handler(struct pt_regs *regs, unsigned int instr)
784 {
785         int ret;
786         unsigned long flags;
787         local_irq_save(flags);
788
789         preempt_disable();
790         ret = uprobe_handler(regs);
791         preempt_enable_no_resched();
792
793         local_irq_restore(flags);
794         return ret;
795 }
796
797 /* userspace probes hook (arm) */
798 static struct undef_hook undef_hook_for_us_arm = {
799         .instr_mask     = 0xffffffff,
800         .instr_val      = BREAKPOINT_INSTRUCTION,
801         .cpsr_mask      = MODE_MASK,
802         .cpsr_val       = USR_MODE,
803         .fn             = uprobe_trap_handler
804 };
805
806 /* userspace probes hook (thumb) */
807 static struct undef_hook undef_hook_for_us_thumb = {
808         .instr_mask     = 0xffffffff,
809         .instr_val      = BREAKPOINT_INSTRUCTION & 0x0000ffff,
810         .cpsr_mask      = MODE_MASK,
811         .cpsr_val       = USR_MODE,
812         .fn             = uprobe_trap_handler
813 };
814
815 int swap_arch_init_uprobes(void)
816 {
817         swap_register_undef_hook(&undef_hook_for_us_arm);
818         swap_register_undef_hook(&undef_hook_for_us_thumb);
819
820         return 0;
821 }
822
823 void swap_arch_exit_uprobes(void)
824 {
825         swap_unregister_undef_hook(&undef_hook_for_us_thumb);
826         swap_unregister_undef_hook(&undef_hook_for_us_arm);
827 }