1 #include <dbi_kprobes.h>
2 #include <asm/dbi_kprobes.h>
3 #include <asm/dbi_kprobes_arm.h>
5 #include <swap_uprobes.h>
6 #include <asm/swap_uprobes.h>
7 #include <dbi_insn_slots.h>
8 #include "trampoline_thumb.h"
11 #include <dbi_kdebug.h>
12 extern struct hlist_head uprobe_insn_pages;
15 #define sign_extend(x, signbit) ((x) | (0 - ((x) & (1 << (signbit)))))
16 #define branch_displacement(insn) sign_extend(((insn) & 0xffffff) << 2, 25)
18 static kprobe_opcode_t get_addr_b(kprobe_opcode_t insn, kprobe_opcode_t *addr)
20 // real position less then PC by 8
21 return (kprobe_opcode_t)((long)addr + 8 + branch_displacement(insn));
24 /* is instruction Thumb2 and NOT a branch, etc... */
25 static int is_thumb2(kprobe_opcode_t insn)
27 return ((insn & 0xf800) == 0xe800 ||
28 (insn & 0xf800) == 0xf000 ||
29 (insn & 0xf800) == 0xf800);
32 static int arch_copy_trampoline_arm_uprobe(struct kprobe *p, struct task_struct *task, int atomic)
34 kprobe_opcode_t insns[UPROBES_TRAMP_LEN];
36 kprobe_opcode_t insn[MAX_INSN_SIZE];
37 struct arch_specific_insn ainsn;
40 if ((unsigned long)p->addr & 0x01) {
41 printk("Error in %s at %d: attempt to register kprobe at an unaligned address\n", __FILE__, __LINE__);
46 ainsn.insn_arm = insn;
47 if (!arch_check_insn_arm(&ainsn)) {
53 if (ARM_INSN_MATCH(DPIS, insn[0]) || ARM_INSN_MATCH(LRO, insn[0]) ||
54 ARM_INSN_MATCH(SRO, insn[0])) {
56 if ((ARM_INSN_REG_RN(insn[0]) == 15) || (ARM_INSN_REG_RM(insn[0]) == 15) ||
57 (ARM_INSN_MATCH(SRO, insn[0]) && (ARM_INSN_REG_RD(insn[0]) == 15))) {
58 DBPRINTF("Unboostable insn %lx, DPIS/LRO/SRO\n", insn[0]);
63 } else if (ARM_INSN_MATCH(DPI, insn[0]) || ARM_INSN_MATCH(LIO, insn[0]) ||
64 ARM_INSN_MATCH (SIO, insn[0])) {
66 if ((ARM_INSN_REG_RN(insn[0]) == 15) || (ARM_INSN_MATCH(SIO, insn[0]) &&
67 (ARM_INSN_REG_RD(insn[0]) == 15))) {
69 DBPRINTF("Unboostable insn %lx/%p, DPI/LIO/SIO\n", insn[0], p);
73 } else if (ARM_INSN_MATCH(DPRS, insn[0])) {
75 if ((ARM_INSN_REG_RN(insn[0]) == 15) || (ARM_INSN_REG_RM(insn[0]) == 15) ||
76 (ARM_INSN_REG_RS(insn[0]) == 15)) {
78 DBPRINTF("Unboostable insn %lx, DPRS\n", insn[0]);
82 } else if (ARM_INSN_MATCH(SM, insn[0])) {
84 if (ARM_INSN_REG_MR (insn[0], 15))
86 DBPRINTF ("Unboostable insn %lx, SM\n", insn[0]);
91 // check instructions that can write result to SP andu uses PC
92 if (pc_dep && (ARM_INSN_REG_RD (ainsn.insn_arm[0]) == 13)) {
93 printk("Error in %s at %d: instruction check failed (arm)\n", __FILE__, __LINE__);
95 // TODO: move free to later phase
96 //free_insn_slot (&uprobe_insn_pages, task, p->ainsn.insn_arm, 0);
100 if (unlikely(uregs && pc_dep)) {
101 memcpy(insns, pc_dep_insn_execbuf, sizeof(insns));
102 if (prep_pc_dep_insn_execbuf(insns, insn[0], uregs) != 0) {
103 printk("Error in %s at %d: failed to prepare exec buffer for insn %lx!",
104 __FILE__, __LINE__, insn[0]);
106 // TODO: move free to later phase
107 //free_insn_slot (&uprobe_insn_pages, task, p->ainsn.insn_arm, 0);
111 insns[6] = (kprobe_opcode_t) (p->addr + 2);
113 memcpy(insns, gen_insn_execbuf, sizeof(insns));
114 insns[UPROBES_TRAMP_INSN_IDX] = insn[0];
117 insns[UPROBES_TRAMP_RET_BREAK_IDX] = BREAKPOINT_INSTRUCTION;
118 insns[7] = (kprobe_opcode_t) (p->addr + 1);
121 if(ARM_INSN_MATCH(B, ainsn.insn_arm[0])) {
122 memcpy(insns, pc_dep_insn_execbuf, sizeof(insns));
123 insns[UPROBES_TRAMP_RET_BREAK_IDX] = BREAKPOINT_INSTRUCTION;
124 insns[6] = (kprobe_opcode_t)(p->addr + 2);
125 insns[7] = get_addr_b(p->opcode, p->addr);
128 DBPRINTF("arch_prepare_uprobe: to %p - %lx %lx %lx %lx %lx %lx %lx %lx %lx",
129 p->ainsn.insn_arm, insns[0], insns[1], insns[2], insns[3], insns[4],
130 insns[5], insns[6], insns[7], insns[8]);
131 if (!write_proc_vm_atomic(task, (unsigned long)p->ainsn.insn_arm, insns, sizeof(insns))) {
132 panic("failed to write memory %p!\n", p->ainsn.insn_arm);
133 // Mr_Nobody: we have to panic, really??...
134 //free_insn_slot (&uprobe_insn_pages, task, p->ainsn.insn_arm, 0);
141 static int arch_check_insn_thumb(struct arch_specific_insn *ainsn)
145 // check instructions that can change PC
146 if (THUMB_INSN_MATCH(UNDEF, ainsn->insn_thumb[0]) ||
147 THUMB_INSN_MATCH(SWI, ainsn->insn_thumb[0]) ||
148 THUMB_INSN_MATCH(BREAK, ainsn->insn_thumb[0]) ||
149 THUMB2_INSN_MATCH(BL, ainsn->insn_thumb[0]) ||
150 THUMB_INSN_MATCH(B1, ainsn->insn_thumb[0]) ||
151 THUMB_INSN_MATCH(B2, ainsn->insn_thumb[0]) ||
152 THUMB_INSN_MATCH(CBZ, ainsn->insn_thumb[0]) ||
153 THUMB2_INSN_MATCH(B1, ainsn->insn_thumb[0]) ||
154 THUMB2_INSN_MATCH(B2, ainsn->insn_thumb[0]) ||
155 THUMB2_INSN_MATCH(BLX1, ainsn->insn_thumb[0]) ||
156 THUMB_INSN_MATCH(BLX2, ainsn->insn_thumb[0]) ||
157 THUMB_INSN_MATCH(BX, ainsn->insn_thumb[0]) ||
158 THUMB2_INSN_MATCH(BXJ, ainsn->insn_thumb[0]) ||
159 (THUMB2_INSN_MATCH(ADR, ainsn->insn_thumb[0]) && THUMB2_INSN_REG_RD(ainsn->insn_thumb[0]) == 15) ||
160 (THUMB2_INSN_MATCH(LDRW, ainsn->insn_thumb[0]) && THUMB2_INSN_REG_RT(ainsn->insn_thumb[0]) == 15) ||
161 (THUMB2_INSN_MATCH(LDRW1, ainsn->insn_thumb[0]) && THUMB2_INSN_REG_RT(ainsn->insn_thumb[0]) == 15) ||
162 (THUMB2_INSN_MATCH(LDRHW, ainsn->insn_thumb[0]) && THUMB2_INSN_REG_RT(ainsn->insn_thumb[0]) == 15) ||
163 (THUMB2_INSN_MATCH(LDRHW1, ainsn->insn_thumb[0]) && THUMB2_INSN_REG_RT(ainsn->insn_thumb[0]) == 15) ||
164 (THUMB2_INSN_MATCH(LDRWL, ainsn->insn_thumb[0]) && THUMB2_INSN_REG_RT(ainsn->insn_thumb[0]) == 15) ||
165 THUMB2_INSN_MATCH(LDMIA, ainsn->insn_thumb[0]) ||
166 THUMB2_INSN_MATCH(LDMDB, ainsn->insn_thumb[0]) ||
167 (THUMB2_INSN_MATCH(DP, ainsn->insn_thumb[0]) && THUMB2_INSN_REG_RD(ainsn->insn_thumb[0]) == 15) ||
168 (THUMB2_INSN_MATCH(RSBW, ainsn->insn_thumb[0]) && THUMB2_INSN_REG_RD(ainsn->insn_thumb[0]) == 15) ||
169 (THUMB2_INSN_MATCH(RORW, ainsn->insn_thumb[0]) && THUMB2_INSN_REG_RD(ainsn->insn_thumb[0]) == 15) ||
170 (THUMB2_INSN_MATCH(ROR, ainsn->insn_thumb[0]) && THUMB2_INSN_REG_RD(ainsn->insn_thumb[0]) == 15) ||
171 (THUMB2_INSN_MATCH(LSLW1, ainsn->insn_thumb[0]) && THUMB2_INSN_REG_RD(ainsn->insn_thumb[0]) == 15) ||
172 (THUMB2_INSN_MATCH(LSLW2, ainsn->insn_thumb[0]) && THUMB2_INSN_REG_RD(ainsn->insn_thumb[0]) == 15) ||
173 (THUMB2_INSN_MATCH(LSRW1, ainsn->insn_thumb[0]) && THUMB2_INSN_REG_RD(ainsn->insn_thumb[0]) == 15) ||
174 (THUMB2_INSN_MATCH(LSRW2, ainsn->insn_thumb[0]) && THUMB2_INSN_REG_RD(ainsn->insn_thumb[0]) == 15) ||
175 /* skip PC, #-imm12 -> SP, #-imm8 and Tegra-hanging instructions */
176 (THUMB2_INSN_MATCH(STRW1, ainsn->insn_thumb[0]) && THUMB2_INSN_REG_RN(ainsn->insn_thumb[0]) == 15) ||
177 (THUMB2_INSN_MATCH(STRBW1, ainsn->insn_thumb[0]) && THUMB2_INSN_REG_RN(ainsn->insn_thumb[0]) == 15) ||
178 (THUMB2_INSN_MATCH(STRHW1, ainsn->insn_thumb[0]) && THUMB2_INSN_REG_RN(ainsn->insn_thumb[0]) == 15) ||
179 (THUMB2_INSN_MATCH(STRW, ainsn->insn_thumb[0]) && THUMB2_INSN_REG_RN(ainsn->insn_thumb[0]) == 15) ||
180 (THUMB2_INSN_MATCH(STRHW, ainsn->insn_thumb[0]) && THUMB2_INSN_REG_RN(ainsn->insn_thumb[0]) == 15) ||
181 (THUMB2_INSN_MATCH(LDRW, ainsn->insn_thumb[0]) && THUMB2_INSN_REG_RN(ainsn->insn_thumb[0]) == 15) ||
182 (THUMB2_INSN_MATCH(LDRBW, ainsn->insn_thumb[0]) && THUMB2_INSN_REG_RN(ainsn->insn_thumb[0]) == 15) ||
183 (THUMB2_INSN_MATCH(LDRHW, ainsn->insn_thumb[0]) && THUMB2_INSN_REG_RN(ainsn->insn_thumb[0]) == 15) ||
184 /* skip STRDx/LDRDx Rt, Rt2, [Rd, ...] */
185 (THUMB2_INSN_MATCH(LDRD, ainsn->insn_thumb[0]) || THUMB2_INSN_MATCH(LDRD1, ainsn->insn_thumb[0]) || THUMB2_INSN_MATCH(STRD, ainsn->insn_thumb[0])) ) {
186 DBPRINTF("Bad insn arch_check_insn_thumb: %lx\n", ainsn->insn_thumb[0]);
193 static int prep_pc_dep_insn_execbuf_thumb(kprobe_opcode_t * insns, kprobe_opcode_t insn, int uregs)
195 unsigned char mreg = 0;
196 unsigned char reg = 0;
198 if (THUMB_INSN_MATCH(APC, insn) || THUMB_INSN_MATCH(LRO3, insn)) {
199 reg = ((insn & 0xffff) & uregs) >> 8;
201 if (THUMB_INSN_MATCH(MOV3, insn)) {
202 if (((((unsigned char) insn) & 0xff) >> 3) == 15) {
203 reg = (insn & 0xffff) & uregs;
208 if (THUMB2_INSN_MATCH(ADR, insn)) {
209 reg = ((insn >> 16) & uregs) >> 8;
214 if (THUMB2_INSN_MATCH(LDRW, insn) || THUMB2_INSN_MATCH(LDRW1, insn) ||
215 THUMB2_INSN_MATCH(LDRHW, insn) || THUMB2_INSN_MATCH(LDRHW1, insn) ||
216 THUMB2_INSN_MATCH(LDRWL, insn)) {
217 reg = ((insn >> 16) & uregs) >> 12;
222 // LDRB.W PC, [PC, #immed] => PLD [PC, #immed], so Rt == PC is skipped
223 if (THUMB2_INSN_MATCH(LDRBW, insn) || THUMB2_INSN_MATCH(LDRBW1, insn) ||
224 THUMB2_INSN_MATCH(LDREX, insn)) {
225 reg = ((insn >> 16) & uregs) >> 12;
227 if (THUMB2_INSN_MATCH(DP, insn)) {
228 reg = ((insn >> 16) & uregs) >> 12;
233 if (THUMB2_INSN_MATCH(RSBW, insn)) {
234 reg = ((insn >> 12) & uregs) >> 8;
239 if (THUMB2_INSN_MATCH(RORW, insn)) {
240 reg = ((insn >> 12) & uregs) >> 8;
245 if (THUMB2_INSN_MATCH(ROR, insn) || THUMB2_INSN_MATCH(LSLW1, insn) ||
246 THUMB2_INSN_MATCH(LSLW2, insn) || THUMB2_INSN_MATCH(LSRW1, insn) ||
247 THUMB2_INSN_MATCH(LSRW2, insn)) {
248 reg = ((insn >> 12) & uregs) >> 8;
253 if (THUMB2_INSN_MATCH(TEQ1, insn) || THUMB2_INSN_MATCH(TST1, insn)) {
256 if (THUMB2_INSN_MATCH(TEQ2, insn) || THUMB2_INSN_MATCH(TST2, insn)) {
257 reg = THUMB2_INSN_REG_RM(insn);
270 if ((THUMB2_INSN_MATCH(STRW, insn) || THUMB2_INSN_MATCH(STRBW, insn) ||
271 THUMB2_INSN_MATCH(STRD, insn) || THUMB2_INSN_MATCH(STRHT, insn) ||
272 THUMB2_INSN_MATCH(STRT, insn) || THUMB2_INSN_MATCH(STRHW1, insn) ||
273 THUMB2_INSN_MATCH(STRHW, insn)) && THUMB2_INSN_REG_RT(insn) == 15) {
274 reg = THUMB2_INSN_REG_RT(insn);
277 if (reg == 6 || reg == 7) {
278 *((unsigned short*)insns + 0) = (*((unsigned short*)insns + 0) & 0x00ff) | ((1 << mreg) | (1 << (mreg + 1)));
279 *((unsigned short*)insns + 1) = (*((unsigned short*)insns + 1) & 0xf8ff) | (mreg << 8);
280 *((unsigned short*)insns + 2) = (*((unsigned short*)insns + 2) & 0xfff8) | (mreg + 1);
281 *((unsigned short*)insns + 3) = (*((unsigned short*)insns + 3) & 0xffc7) | (mreg << 3);
282 *((unsigned short*)insns + 7) = (*((unsigned short*)insns + 7) & 0xf8ff) | (mreg << 8);
283 *((unsigned short*)insns + 8) = (*((unsigned short*)insns + 8) & 0xffc7) | (mreg << 3);
284 *((unsigned short*)insns + 9) = (*((unsigned short*)insns + 9) & 0xffc7) | ((mreg + 1) << 3);
285 *((unsigned short*)insns + 10) = (*((unsigned short*)insns + 10) & 0x00ff) | (( 1 << mreg) | (1 << (mreg + 1)));
288 if (THUMB_INSN_MATCH(APC, insn)) {
289 // ADD Rd, PC, #immed_8*4 -> ADD Rd, SP, #immed_8*4
290 *((unsigned short*)insns + 4) = ((insn & 0xffff) | 0x800); // ADD Rd, SP, #immed_8*4
292 if (THUMB_INSN_MATCH(LRO3, insn)) {
293 // LDR Rd, [PC, #immed_8*4] -> LDR Rd, [SP, #immed_8*4]
294 *((unsigned short*)insns + 4) = ((insn & 0xffff) + 0x5000); // LDR Rd, [SP, #immed_8*4]
296 if (THUMB_INSN_MATCH(MOV3, insn)) {
297 // MOV Rd, PC -> MOV Rd, SP
298 *((unsigned short*)insns + 4) = ((insn & 0xffff) ^ 0x10); // MOV Rd, SP
300 if (THUMB2_INSN_MATCH(ADR, insn)) {
301 // ADDW Rd, PC, #imm -> ADDW Rd, SP, #imm
302 insns[2] = (insn & 0xfffffff0) | 0x0d; // ADDW Rd, SP, #imm
304 if (THUMB2_INSN_MATCH(LDRW, insn) || THUMB2_INSN_MATCH(LDRBW, insn) ||
305 THUMB2_INSN_MATCH(LDRHW, insn)) {
306 // LDR.W Rt, [PC, #-<imm_12>] -> LDR.W Rt, [SP, #-<imm_8>]
307 // !!!!!!!!!!!!!!!!!!!!!!!!
308 // !!! imm_12 vs. imm_8 !!!
309 // !!!!!!!!!!!!!!!!!!!!!!!!
310 insns[2] = (insn & 0xf0fffff0) | 0x0c00000d; // LDR.W Rt, [SP, #-<imm_8>]
312 if (THUMB2_INSN_MATCH(LDRW1, insn) || THUMB2_INSN_MATCH(LDRBW1, insn) ||
313 THUMB2_INSN_MATCH(LDRHW1, insn) || THUMB2_INSN_MATCH(LDRD, insn) ||
314 THUMB2_INSN_MATCH(LDRD1, insn) || THUMB2_INSN_MATCH(LDREX, insn)) {
315 // LDRx.W Rt, [PC, #+<imm_12>] -> LDRx.W Rt, [SP, #+<imm_12>] (+/-imm_8 for LDRD Rt, Rt2, [PC, #<imm_8>]
316 insns[2] = (insn & 0xfffffff0) | 0xd; // LDRx.W Rt, [SP, #+<imm_12>]
318 if (THUMB2_INSN_MATCH(MUL, insn)) {
319 insns[2] = (insn & 0xfff0ffff) | 0x000d0000; // MUL Rd, Rn, SP
321 if (THUMB2_INSN_MATCH(DP, insn)) {
322 if (THUMB2_INSN_REG_RM(insn) == 15) {
323 insns[2] = (insn & 0xfff0ffff) | 0x000d0000; // DP Rd, Rn, PC
324 } else if (THUMB2_INSN_REG_RN(insn) == 15) {
325 insns[2] = (insn & 0xfffffff0) | 0xd; // DP Rd, PC, Rm
328 if (THUMB2_INSN_MATCH(LDRWL, insn)) {
329 // LDRx.W Rt, [PC, #<imm_12>] -> LDRx.W Rt, [SP, #+<imm_12>] (+/-imm_8 for LDRD Rt, Rt2, [PC, #<imm_8>]
330 insns[2] = (insn & 0xfffffff0) | 0xd; // LDRx.W Rt, [SP, #+<imm_12>]
332 if (THUMB2_INSN_MATCH(RSBW, insn)) {
333 insns[2] = (insn & 0xfffffff0) | 0xd; // RSB{S}.W Rd, PC, #<const> -> RSB{S}.W Rd, SP, #<const>
335 if (THUMB2_INSN_MATCH(RORW, insn) || THUMB2_INSN_MATCH(LSLW1, insn) || THUMB2_INSN_MATCH(LSRW1, insn)) {
336 if ((THUMB2_INSN_REG_RM(insn) == 15) && (THUMB2_INSN_REG_RN(insn) == 15)) {
337 insns[2] = (insn & 0xfffdfffd); // ROR.W Rd, PC, PC
338 } else if (THUMB2_INSN_REG_RM(insn) == 15) {
339 insns[2] = (insn & 0xfff0ffff) | 0xd0000; // ROR.W Rd, Rn, PC
340 } else if (THUMB2_INSN_REG_RN(insn) == 15) {
341 insns[2] = (insn & 0xfffffff0) | 0xd; // ROR.W Rd, PC, Rm
344 if (THUMB2_INSN_MATCH(ROR, insn) || THUMB2_INSN_MATCH(LSLW2, insn) || THUMB2_INSN_MATCH(LSRW2, insn)) {
345 insns[2] = (insn & 0xfff0ffff) | 0xd0000; // ROR{S} Rd, PC, #<const> -> ROR{S} Rd, SP, #<const>
359 if (THUMB2_INSN_MATCH(STRW, insn) || THUMB2_INSN_MATCH(STRBW, insn)) {
360 insns[2] = (insn & 0xfff0ffff) | 0x000d0000; // STRx.W Rt, [Rn, SP]
362 if (THUMB2_INSN_MATCH(STRD, insn) || THUMB2_INSN_MATCH(STRHT, insn) ||
363 THUMB2_INSN_MATCH(STRT, insn) || THUMB2_INSN_MATCH(STRHW1, insn)) {
364 if (THUMB2_INSN_REG_RN(insn) == 15) {
365 insns[2] = (insn & 0xfffffff0) | 0xd; // STRD/T/HT{.W} Rt, [SP, ...]
370 if (THUMB2_INSN_MATCH(STRHW, insn) && (THUMB2_INSN_REG_RN(insn) == 15)) {
371 if (THUMB2_INSN_REG_RN(insn) == 15) {
372 insns[2] = (insn & 0xf0fffff0) | 0x0c00000d; // STRH.W Rt, [SP, #-<imm_8>]
381 if ((reg == 15) && (THUMB2_INSN_MATCH(STRW, insn) ||
382 THUMB2_INSN_MATCH(STRBW, insn) ||
383 THUMB2_INSN_MATCH(STRD, insn) ||
384 THUMB2_INSN_MATCH(STRHT, insn) ||
385 THUMB2_INSN_MATCH(STRT, insn) ||
386 THUMB2_INSN_MATCH(STRHW1, insn) ||
387 THUMB2_INSN_MATCH(STRHW, insn) )) {
388 insns[2] = (insns[2] & 0x0fffffff) | 0xd0000000;
391 if (THUMB2_INSN_MATCH(TEQ1, insn) || THUMB2_INSN_MATCH(TST1, insn)) {
392 insns[2] = (insn & 0xfffffff0) | 0xd; // TEQ SP, #<const>
394 if (THUMB2_INSN_MATCH(TEQ2, insn) || THUMB2_INSN_MATCH(TST2, insn)) {
395 if ((THUMB2_INSN_REG_RN(insn) == 15) && (THUMB2_INSN_REG_RM(insn) == 15)) {
396 insns[2] = (insn & 0xfffdfffd); // TEQ/TST PC, PC
397 } else if (THUMB2_INSN_REG_RM(insn) == 15) {
398 insns[2] = (insn & 0xfff0ffff) | 0xd0000; // TEQ/TST Rn, PC
399 } else if (THUMB2_INSN_REG_RN(insn) == 15) {
400 insns[2] = (insn & 0xfffffff0) | 0xd; // TEQ/TST PC, Rm
408 static int arch_copy_trampoline_thumb_uprobe(struct kprobe *p, struct task_struct *task, int atomic)
412 kprobe_opcode_t insn[MAX_INSN_SIZE];
413 struct arch_specific_insn ainsn;
414 kprobe_opcode_t insns[UPROBES_TRAMP_LEN * 2];
417 if ((unsigned long)p->addr & 0x01) {
418 printk("Error in %s at %d: attempt to register kprobe at an unaligned address\n", __FILE__, __LINE__);
423 ainsn.insn_thumb = insn;
424 if (!arch_check_insn_thumb(&ainsn)) {
431 if (THUMB_INSN_MATCH(APC, insn[0]) || THUMB_INSN_MATCH(LRO3, insn[0])) {
432 uregs = 0x0700; // 8-10
434 } else if (THUMB_INSN_MATCH(MOV3, insn[0]) && (((((unsigned char)insn[0]) & 0xff) >> 3) == 15)) {
438 } else if THUMB2_INSN_MATCH(ADR, insn[0]) {
439 uregs = 0x0f00; // Rd 8-11
441 } else if (((THUMB2_INSN_MATCH(LDRW, insn[0]) || THUMB2_INSN_MATCH(LDRW1, insn[0]) ||
442 THUMB2_INSN_MATCH(LDRBW, insn[0]) || THUMB2_INSN_MATCH(LDRBW1, insn[0]) ||
443 THUMB2_INSN_MATCH(LDRHW, insn[0]) || THUMB2_INSN_MATCH(LDRHW1, insn[0]) ||
444 THUMB2_INSN_MATCH(LDRWL, insn[0])) && THUMB2_INSN_REG_RN(insn[0]) == 15) ||
445 THUMB2_INSN_MATCH(LDREX, insn[0]) ||
446 ((THUMB2_INSN_MATCH(STRW, insn[0]) || THUMB2_INSN_MATCH(STRBW, insn[0]) ||
447 THUMB2_INSN_MATCH(STRHW, insn[0]) || THUMB2_INSN_MATCH(STRHW1, insn[0])) &&
448 (THUMB2_INSN_REG_RN(insn[0]) == 15 || THUMB2_INSN_REG_RT(insn[0]) == 15)) ||
449 ((THUMB2_INSN_MATCH(STRT, insn[0]) || THUMB2_INSN_MATCH(STRHT, insn[0])) &&
450 (THUMB2_INSN_REG_RN(insn[0]) == 15 || THUMB2_INSN_REG_RT(insn[0]) == 15))) {
451 uregs = 0xf000; // Rt 12-15
453 } else if ((THUMB2_INSN_MATCH(LDRD, insn[0]) || THUMB2_INSN_MATCH(LDRD1, insn[0])) && (THUMB2_INSN_REG_RN(insn[0]) == 15)) {
454 uregs = 0xff00; // Rt 12-15, Rt2 8-11
456 } else if (THUMB2_INSN_MATCH(MUL, insn[0]) && THUMB2_INSN_REG_RM(insn[0]) == 15) {
459 } else if (THUMB2_INSN_MATCH(DP, insn[0]) && (THUMB2_INSN_REG_RN(insn[0]) == 15 || THUMB2_INSN_REG_RM(insn[0]) == 15)) {
460 uregs = 0xf000; // Rd 12-15
462 } else if (THUMB2_INSN_MATCH(STRD, insn[0]) && ((THUMB2_INSN_REG_RN(insn[0]) == 15) || (THUMB2_INSN_REG_RT(insn[0]) == 15) || THUMB2_INSN_REG_RT2(insn[0]) == 15)) {
463 uregs = 0xff00; // Rt 12-15, Rt2 8-11
465 } else if (THUMB2_INSN_MATCH(RSBW, insn[0]) && THUMB2_INSN_REG_RN(insn[0]) == 15) {
466 uregs = 0x0f00; // Rd 8-11
468 } else if (THUMB2_INSN_MATCH (RORW, insn[0]) && (THUMB2_INSN_REG_RN(insn[0]) == 15 || THUMB2_INSN_REG_RM(insn[0]) == 15)) {
471 } else if ((THUMB2_INSN_MATCH(ROR, insn[0]) || THUMB2_INSN_MATCH(LSLW2, insn[0]) || THUMB2_INSN_MATCH(LSRW2, insn[0])) && THUMB2_INSN_REG_RM(insn[0]) == 15) {
472 uregs = 0x0f00; // Rd 8-11
474 } else if ((THUMB2_INSN_MATCH(LSLW1, insn[0]) || THUMB2_INSN_MATCH(LSRW1, insn[0])) && (THUMB2_INSN_REG_RN(insn[0]) == 15 || THUMB2_INSN_REG_RM(insn[0]) == 15)) {
475 uregs = 0x0f00; // Rd 8-11
477 } else if ((THUMB2_INSN_MATCH(TEQ1, insn[0]) || THUMB2_INSN_MATCH(TST1, insn[0])) && THUMB2_INSN_REG_RN(insn[0]) == 15) {
478 uregs = 0xf0000; //Rn 0-3 (16-19)
480 } else if ((THUMB2_INSN_MATCH(TEQ2, insn[0]) || THUMB2_INSN_MATCH(TST2, insn[0])) &&
481 (THUMB2_INSN_REG_RN(insn[0]) == 15 || THUMB2_INSN_REG_RM(insn[0]) == 15)) {
482 uregs = 0xf0000; //Rn 0-3 (16-19)
486 if (unlikely(uregs && pc_dep)) {
487 memcpy(insns, pc_dep_insn_execbuf_thumb, 18 * 2);
488 if (prep_pc_dep_insn_execbuf_thumb(insns, insn[0], uregs) != 0) {
489 printk("Error in %s at %d: failed to prepare exec buffer for insn %lx!",
490 __FILE__, __LINE__, insn[0]);
492 //free_insn_slot (&uprobe_insn_pages, task, p->ainsn.insn_thumb, 0);
496 addr = ((unsigned int)p->addr) + 4;
497 *((unsigned short*)insns + 13) = 0xdeff;
498 *((unsigned short*)insns + 14) = addr & 0x0000ffff;
499 *((unsigned short*)insns + 15) = addr >> 16;
500 if (!is_thumb2(insn[0])) {
501 addr = ((unsigned int)p->addr) + 2;
502 *((unsigned short*)insns + 16) = (addr & 0x0000ffff) | 0x1;
503 *((unsigned short*)insns + 17) = addr >> 16;
505 addr = ((unsigned int)p->addr) + 4;
506 *((unsigned short*)insns + 16) = (addr & 0x0000ffff) | 0x1;
507 *((unsigned short*)insns + 17) = addr >> 16;
510 memcpy(insns, gen_insn_execbuf_thumb, 18 * 2);
511 *((unsigned short*)insns + 13) = 0xdeff;
512 if (!is_thumb2(insn[0])) {
513 addr = ((unsigned int)p->addr) + 2;
514 *((unsigned short*)insns + 2) = insn[0];
515 *((unsigned short*)insns + 16) = (addr & 0x0000ffff) | 0x1;
516 *((unsigned short*)insns + 17) = addr >> 16;
518 addr = ((unsigned int)p->addr) + 4;
520 *((unsigned short*)insns + 16) = (addr & 0x0000ffff) | 0x1;
521 *((unsigned short*)insns + 17) = addr >> 16;
525 if (!write_proc_vm_atomic (task, (unsigned long)p->ainsn.insn_thumb, insns, 18 * 2)) {
526 panic("failed to write memory %p!\n", p->ainsn.insn_thumb);
527 // Mr_Nobody: we have to panic, really??...
528 //free_insn_slot (&uprobe_insn_pages, task, p->ainsn.insn_thumb, 0);
535 int arch_prepare_uprobe(struct kprobe *p, struct task_struct *task, int atomic)
538 kprobe_opcode_t insn[MAX_INSN_SIZE];
540 if ((unsigned long)p->addr & 0x01) {
541 printk("Error in %s at %d: attempt to register kprobe at an unaligned address\n", __FILE__, __LINE__);
545 if (!read_proc_vm_atomic(task, (unsigned long)p->addr, &insn, MAX_INSN_SIZE * sizeof(kprobe_opcode_t))) {
546 panic("Failed to read memory task[tgid=%u, comm=%s] %p!\n", task->tgid, task->comm, p->addr);
550 p->ainsn.insn_arm = get_insn_slot(task, &uprobe_insn_pages, atomic);
551 if (!p->ainsn.insn_arm) {
552 printk("Error in %s at %d: kprobe slot allocation error (arm)\n", __FILE__, __LINE__);
556 ret = arch_copy_trampoline_arm_uprobe(p, task, 1);
558 free_insn_slot(&uprobe_insn_pages, task, p->ainsn.insn_arm);
562 p->ainsn.insn_thumb = get_insn_slot(task, &uprobe_insn_pages, atomic);
563 if (!p->ainsn.insn_thumb) {
564 printk("Error in %s at %d: kprobe slot allocation error (thumb)\n", __FILE__, __LINE__);
568 ret = arch_copy_trampoline_thumb_uprobe(p, task, 1);
570 free_insn_slot(&uprobe_insn_pages, task, p->ainsn.insn_arm);
571 free_insn_slot(&uprobe_insn_pages, task, p->ainsn.insn_thumb);
575 if ((p->safe_arm == -1) && (p->safe_thumb == -1)) {
576 printk("Error in %s at %d: failed arch_copy_trampoline_*_uprobe() (both) [tgid=%u, addr=%lx, data=%lx]\n",
577 __FILE__, __LINE__, task->tgid, (unsigned long)p->addr, (unsigned long)p->opcode);
578 if (!write_proc_vm_atomic(task, (unsigned long)p->addr, &p->opcode, sizeof(p->opcode))) {
579 panic("Failed to write memory %p!\n", p->addr);
582 free_insn_slot(&uprobe_insn_pages, task, p->ainsn.insn_arm);
583 free_insn_slot(&uprobe_insn_pages, task, p->ainsn.insn_thumb);
591 void arch_prepare_uretprobe_hl(struct uretprobe_instance *ri,
592 struct pt_regs *regs)
594 ri->ret_addr = (kprobe_opcode_t *)regs->ARM_lr;
595 ri->sp = (kprobe_opcode_t *)regs->ARM_sp;
597 /* Set flag of current mode */
598 ri->sp = (kprobe_opcode_t *)((long)ri->sp | !!thumb_mode(regs));
600 if (thumb_mode(regs)) {
601 regs->ARM_lr = (unsigned long)(ri->rp->kp.ainsn.insn) + 0x1b;
603 regs->ARM_lr = (unsigned long)(ri->rp->kp.ainsn.insn + UPROBES_TRAMP_RET_BREAK_IDX);
607 int setjmp_upre_handler(struct kprobe *p, struct pt_regs *regs)
609 struct jprobe *jp = container_of(p, struct jprobe, kp);
610 kprobe_pre_entry_handler_t pre_entry = (kprobe_pre_entry_handler_t)jp->pre_entry;
611 entry_point_t entry = (entry_point_t)jp->entry;
614 p->ss_addr = (kprobe_opcode_t *)pre_entry(jp->priv_arg, regs);
618 entry(regs->ARM_r0, regs->ARM_r1, regs->ARM_r2,
619 regs->ARM_r3, regs->ARM_r4, regs->ARM_r5);
621 dbi_arch_uprobe_return();
627 unsigned long arch_get_trampoline_addr(struct kprobe *p, struct pt_regs *regs)
629 return thumb_mode(regs) ?
630 (unsigned long)(p->ainsn.insn) + 0x1b :
631 (unsigned long)(p->ainsn.insn + UPROBES_TRAMP_RET_BREAK_IDX);
634 void arch_set_orig_ret_addr(unsigned long orig_ret_addr, struct pt_regs *regs)
636 regs->ARM_lr = orig_ret_addr;
637 regs->ARM_pc = orig_ret_addr;
639 if (thumb_mode(regs) && !(regs->ARM_lr & 0x01)) {
640 regs->ARM_cpsr &= 0xFFFFFFDF;
641 } else if (user_mode(regs) && (regs->ARM_lr & 0x01)) {
642 regs->ARM_cpsr |= 0x20;
646 static int check_validity_insn(struct kprobe *p, struct pt_regs *regs, struct task_struct *task)
650 if (unlikely(thumb_mode(regs))) {
651 if (p->safe_thumb != -1) {
652 p->ainsn.insn = p->ainsn.insn_thumb;
653 list_for_each_entry_rcu(kp, &p->list, list) {
654 kp->ainsn.insn = p->ainsn.insn_thumb;
657 printk("Error in %s at %d: we are in thumb mode (!) and check instruction was fail \
658 (%0lX instruction at %p address)!\n", __FILE__, __LINE__, p->opcode, p->addr);
659 // Test case when we do our actions on already running application
660 disarm_uprobe(p, task);
664 if (p->safe_arm != -1) {
665 p->ainsn.insn = p->ainsn.insn_arm;
666 list_for_each_entry_rcu(kp, &p->list, list) {
667 kp->ainsn.insn = p->ainsn.insn_arm;
670 printk("Error in %s at %d: we are in arm mode (!) and check instruction was fail \
671 (%0lX instruction at %p address)!\n", __FILE__, __LINE__, p->opcode, p->addr);
672 // Test case when we do our actions on already running application
673 disarm_uprobe(p, task);
681 static int uprobe_handler(struct pt_regs *regs)
683 kprobe_opcode_t *addr = (kprobe_opcode_t *)(regs->ARM_pc);
684 struct task_struct *task = current;
685 pid_t tgid = task->tgid;
688 p = get_uprobe(addr, tgid);
690 if (p && (check_validity_insn(p, regs, task) != 0)) {
691 printk("no_uprobe live\n");
696 p = get_kprobe_by_insn_slot(addr, tgid, regs);
698 printk("no_uprobe\n");
702 trampoline_uprobe_handler(p, regs);
706 /* restore opcode for thumb app */
707 if (thumb_mode(regs)) {
708 if (!is_thumb2(p->opcode)) {
709 unsigned long tmp = p->opcode >> 16;
710 write_proc_vm_atomic(task, (unsigned long)((unsigned short*)p->addr + 1), &tmp, 2);
712 // "2*sizeof(kprobe_opcode_t)" - strange. Should be "sizeof(kprobe_opcode_t)", need to test
713 flush_icache_range((unsigned int)p->addr, ((unsigned int)p->addr) + (2 * sizeof(kprobe_opcode_t)));
717 if (!p->pre_handler || !p->pre_handler(p, regs)) {
718 prepare_singlestep(p, regs);
724 int uprobe_trap_handler(struct pt_regs *regs, unsigned int instr)
728 local_irq_save(flags);
731 ret = uprobe_handler(regs);
732 preempt_enable_no_resched();
734 local_irq_restore(flags);
738 /* userspace probes hook (arm) */
739 static struct undef_hook undef_hook_for_us_arm = {
740 .instr_mask = 0xffffffff,
741 .instr_val = BREAKPOINT_INSTRUCTION,
742 .cpsr_mask = MODE_MASK,
743 .cpsr_val = USR_MODE,
744 .fn = uprobe_trap_handler
747 /* userspace probes hook (thumb) */
748 static struct undef_hook undef_hook_for_us_thumb = {
749 .instr_mask = 0xffffffff,
750 .instr_val = BREAKPOINT_INSTRUCTION & 0x0000ffff,
751 .cpsr_mask = MODE_MASK,
752 .cpsr_val = USR_MODE,
753 .fn = uprobe_trap_handler
756 int swap_arch_init_uprobes(void)
758 swap_register_undef_hook(&undef_hook_for_us_arm);
759 swap_register_undef_hook(&undef_hook_for_us_thumb);
764 void swap_arch_exit_uprobes(void)
766 swap_unregister_undef_hook(&undef_hook_for_us_thumb);
767 swap_unregister_undef_hook(&undef_hook_for_us_arm);