1 #include <dbi_kprobes.h>
2 #include <asm/dbi_kprobes.h>
6 #include <dbi_kdebug.h>
7 extern struct hlist_head uprobe_insn_pages;
8 kprobe_opcode_t *get_insn_slot(struct task_struct *task, struct hlist_head *page_list, int atomic);
9 int arch_check_insn_arm(struct arch_specific_insn *ainsn);
10 int prep_pc_dep_insn_execbuf(kprobe_opcode_t *insns, kprobe_opcode_t insn, int uregs);
11 void free_insn_slot(struct hlist_head *page_list, struct task_struct *task, kprobe_opcode_t *slot);
12 void pc_dep_insn_execbuf(void);
13 void gen_insn_execbuf(void);
14 void gen_insn_execbuf_thumb(void);
15 void pc_dep_insn_execbuf_thumb(void);
16 int kprobe_trap_handler(struct pt_regs *regs, unsigned int instr);
19 #define sign_extend(x, signbit) ((x) | (0 - ((x) & (1 << (signbit)))))
20 #define branch_displacement(insn) sign_extend(((insn) & 0xffffff) << 2, 25)
22 static kprobe_opcode_t get_addr_b(kprobe_opcode_t insn, kprobe_opcode_t *addr)
24 // real position less then PC by 8
25 return (kprobe_opcode_t)((long)addr + 8 + branch_displacement(insn));
28 /* is instruction Thumb2 and NOT a branch, etc... */
29 static int is_thumb2(kprobe_opcode_t insn)
31 return ((insn & 0xf800) == 0xe800 ||
32 (insn & 0xf800) == 0xf000 ||
33 (insn & 0xf800) == 0xf800);
36 static int arch_copy_trampoline_arm_uprobe(struct kprobe *p, struct task_struct *task, int atomic)
38 kprobe_opcode_t insns[UPROBES_TRAMP_LEN];
40 kprobe_opcode_t insn[MAX_INSN_SIZE];
41 struct arch_specific_insn ainsn;
44 if ((unsigned long)p->addr & 0x01) {
45 printk("Error in %s at %d: attempt to register kprobe at an unaligned address\n", __FILE__, __LINE__);
50 ainsn.insn_arm = insn;
51 if (!arch_check_insn_arm(&ainsn)) {
57 if (ARM_INSN_MATCH(DPIS, insn[0]) || ARM_INSN_MATCH(LRO, insn[0]) ||
58 ARM_INSN_MATCH(SRO, insn[0])) {
60 if ((ARM_INSN_REG_RN(insn[0]) == 15) || (ARM_INSN_REG_RM(insn[0]) == 15) ||
61 (ARM_INSN_MATCH(SRO, insn[0]) && (ARM_INSN_REG_RD(insn[0]) == 15))) {
62 DBPRINTF("Unboostable insn %lx, DPIS/LRO/SRO\n", insn[0]);
67 } else if (ARM_INSN_MATCH(DPI, insn[0]) || ARM_INSN_MATCH(LIO, insn[0]) ||
68 ARM_INSN_MATCH (SIO, insn[0])) {
70 if ((ARM_INSN_REG_RN(insn[0]) == 15) || (ARM_INSN_MATCH(SIO, insn[0]) &&
71 (ARM_INSN_REG_RD(insn[0]) == 15))) {
73 DBPRINTF("Unboostable insn %lx/%p, DPI/LIO/SIO\n", insn[0], p);
77 } else if (ARM_INSN_MATCH(DPRS, insn[0])) {
79 if ((ARM_INSN_REG_RN(insn[0]) == 15) || (ARM_INSN_REG_RM(insn[0]) == 15) ||
80 (ARM_INSN_REG_RS(insn[0]) == 15)) {
82 DBPRINTF("Unboostable insn %lx, DPRS\n", insn[0]);
86 } else if (ARM_INSN_MATCH(SM, insn[0])) {
88 if (ARM_INSN_REG_MR (insn[0], 15))
90 DBPRINTF ("Unboostable insn %lx, SM\n", insn[0]);
95 // check instructions that can write result to SP andu uses PC
96 if (pc_dep && (ARM_INSN_REG_RD (ainsn.insn_arm[0]) == 13)) {
97 printk("Error in %s at %d: instruction check failed (arm)\n", __FILE__, __LINE__);
99 // TODO: move free to later phase
100 //free_insn_slot (&uprobe_insn_pages, task, p->ainsn.insn_arm, 0);
104 if (unlikely(uregs && pc_dep)) {
105 memcpy(insns, pc_dep_insn_execbuf, sizeof(insns));
106 if (prep_pc_dep_insn_execbuf(insns, insn[0], uregs) != 0) {
107 printk("Error in %s at %d: failed to prepare exec buffer for insn %lx!",
108 __FILE__, __LINE__, insn[0]);
110 // TODO: move free to later phase
111 //free_insn_slot (&uprobe_insn_pages, task, p->ainsn.insn_arm, 0);
115 insns[6] = (kprobe_opcode_t) (p->addr + 2);
117 memcpy(insns, gen_insn_execbuf, sizeof(insns));
118 insns[UPROBES_TRAMP_INSN_IDX] = insn[0];
121 insns[UPROBES_TRAMP_RET_BREAK_IDX] = BREAKPOINT_INSTRUCTION;
122 insns[7] = (kprobe_opcode_t) (p->addr + 1);
125 if(ARM_INSN_MATCH(B, ainsn.insn_arm[0])) {
126 memcpy(insns, pc_dep_insn_execbuf, sizeof(insns));
127 insns[UPROBES_TRAMP_RET_BREAK_IDX] = BREAKPOINT_INSTRUCTION;
128 insns[6] = (kprobe_opcode_t)(p->addr + 2);
129 insns[7] = get_addr_b(p->opcode, p->addr);
132 DBPRINTF("arch_prepare_uprobe: to %p - %lx %lx %lx %lx %lx %lx %lx %lx %lx",
133 p->ainsn.insn_arm, insns[0], insns[1], insns[2], insns[3], insns[4],
134 insns[5], insns[6], insns[7], insns[8]);
135 if (!write_proc_vm_atomic(task, (unsigned long)p->ainsn.insn_arm, insns, sizeof(insns))) {
136 panic("failed to write memory %p!\n", p->ainsn.insn_arm);
137 // Mr_Nobody: we have to panic, really??...
138 //free_insn_slot (&uprobe_insn_pages, task, p->ainsn.insn_arm, 0);
145 static int arch_check_insn_thumb(struct arch_specific_insn *ainsn)
149 // check instructions that can change PC
150 if (THUMB_INSN_MATCH(UNDEF, ainsn->insn_thumb[0]) ||
151 THUMB_INSN_MATCH(SWI, ainsn->insn_thumb[0]) ||
152 THUMB_INSN_MATCH(BREAK, ainsn->insn_thumb[0]) ||
153 THUMB2_INSN_MATCH(BL, ainsn->insn_thumb[0]) ||
154 THUMB_INSN_MATCH(B1, ainsn->insn_thumb[0]) ||
155 THUMB_INSN_MATCH(B2, ainsn->insn_thumb[0]) ||
156 THUMB_INSN_MATCH(CBZ, ainsn->insn_thumb[0]) ||
157 THUMB2_INSN_MATCH(B1, ainsn->insn_thumb[0]) ||
158 THUMB2_INSN_MATCH(B2, ainsn->insn_thumb[0]) ||
159 THUMB2_INSN_MATCH(BLX1, ainsn->insn_thumb[0]) ||
160 THUMB_INSN_MATCH(BLX2, ainsn->insn_thumb[0]) ||
161 THUMB_INSN_MATCH(BX, ainsn->insn_thumb[0]) ||
162 THUMB2_INSN_MATCH(BXJ, ainsn->insn_thumb[0]) ||
163 (THUMB2_INSN_MATCH(ADR, ainsn->insn_thumb[0]) && THUMB2_INSN_REG_RD(ainsn->insn_thumb[0]) == 15) ||
164 (THUMB2_INSN_MATCH(LDRW, ainsn->insn_thumb[0]) && THUMB2_INSN_REG_RT(ainsn->insn_thumb[0]) == 15) ||
165 (THUMB2_INSN_MATCH(LDRW1, ainsn->insn_thumb[0]) && THUMB2_INSN_REG_RT(ainsn->insn_thumb[0]) == 15) ||
166 (THUMB2_INSN_MATCH(LDRHW, ainsn->insn_thumb[0]) && THUMB2_INSN_REG_RT(ainsn->insn_thumb[0]) == 15) ||
167 (THUMB2_INSN_MATCH(LDRHW1, ainsn->insn_thumb[0]) && THUMB2_INSN_REG_RT(ainsn->insn_thumb[0]) == 15) ||
168 (THUMB2_INSN_MATCH(LDRWL, ainsn->insn_thumb[0]) && THUMB2_INSN_REG_RT(ainsn->insn_thumb[0]) == 15) ||
169 THUMB2_INSN_MATCH(LDMIA, ainsn->insn_thumb[0]) ||
170 THUMB2_INSN_MATCH(LDMDB, ainsn->insn_thumb[0]) ||
171 (THUMB2_INSN_MATCH(DP, ainsn->insn_thumb[0]) && THUMB2_INSN_REG_RD(ainsn->insn_thumb[0]) == 15) ||
172 (THUMB2_INSN_MATCH(RSBW, ainsn->insn_thumb[0]) && THUMB2_INSN_REG_RD(ainsn->insn_thumb[0]) == 15) ||
173 (THUMB2_INSN_MATCH(RORW, ainsn->insn_thumb[0]) && THUMB2_INSN_REG_RD(ainsn->insn_thumb[0]) == 15) ||
174 (THUMB2_INSN_MATCH(ROR, ainsn->insn_thumb[0]) && THUMB2_INSN_REG_RD(ainsn->insn_thumb[0]) == 15) ||
175 (THUMB2_INSN_MATCH(LSLW1, ainsn->insn_thumb[0]) && THUMB2_INSN_REG_RD(ainsn->insn_thumb[0]) == 15) ||
176 (THUMB2_INSN_MATCH(LSLW2, ainsn->insn_thumb[0]) && THUMB2_INSN_REG_RD(ainsn->insn_thumb[0]) == 15) ||
177 (THUMB2_INSN_MATCH(LSRW1, ainsn->insn_thumb[0]) && THUMB2_INSN_REG_RD(ainsn->insn_thumb[0]) == 15) ||
178 (THUMB2_INSN_MATCH(LSRW2, ainsn->insn_thumb[0]) && THUMB2_INSN_REG_RD(ainsn->insn_thumb[0]) == 15) ||
179 /* skip PC, #-imm12 -> SP, #-imm8 and Tegra-hanging instructions */
180 (THUMB2_INSN_MATCH(STRW1, ainsn->insn_thumb[0]) && THUMB2_INSN_REG_RN(ainsn->insn_thumb[0]) == 15) ||
181 (THUMB2_INSN_MATCH(STRBW1, ainsn->insn_thumb[0]) && THUMB2_INSN_REG_RN(ainsn->insn_thumb[0]) == 15) ||
182 (THUMB2_INSN_MATCH(STRHW1, ainsn->insn_thumb[0]) && THUMB2_INSN_REG_RN(ainsn->insn_thumb[0]) == 15) ||
183 (THUMB2_INSN_MATCH(STRW, ainsn->insn_thumb[0]) && THUMB2_INSN_REG_RN(ainsn->insn_thumb[0]) == 15) ||
184 (THUMB2_INSN_MATCH(STRHW, ainsn->insn_thumb[0]) && THUMB2_INSN_REG_RN(ainsn->insn_thumb[0]) == 15) ||
185 (THUMB2_INSN_MATCH(LDRW, ainsn->insn_thumb[0]) && THUMB2_INSN_REG_RN(ainsn->insn_thumb[0]) == 15) ||
186 (THUMB2_INSN_MATCH(LDRBW, ainsn->insn_thumb[0]) && THUMB2_INSN_REG_RN(ainsn->insn_thumb[0]) == 15) ||
187 (THUMB2_INSN_MATCH(LDRHW, ainsn->insn_thumb[0]) && THUMB2_INSN_REG_RN(ainsn->insn_thumb[0]) == 15) ||
188 /* skip STRDx/LDRDx Rt, Rt2, [Rd, ...] */
189 (THUMB2_INSN_MATCH(LDRD, ainsn->insn_thumb[0]) || THUMB2_INSN_MATCH(LDRD1, ainsn->insn_thumb[0]) || THUMB2_INSN_MATCH(STRD, ainsn->insn_thumb[0])) ) {
190 DBPRINTF("Bad insn arch_check_insn_thumb: %lx\n", ainsn->insn_thumb[0]);
197 static int prep_pc_dep_insn_execbuf_thumb(kprobe_opcode_t * insns, kprobe_opcode_t insn, int uregs)
199 unsigned char mreg = 0;
200 unsigned char reg = 0;
202 if (THUMB_INSN_MATCH(APC, insn) || THUMB_INSN_MATCH(LRO3, insn)) {
203 reg = ((insn & 0xffff) & uregs) >> 8;
205 if (THUMB_INSN_MATCH(MOV3, insn)) {
206 if (((((unsigned char) insn) & 0xff) >> 3) == 15) {
207 reg = (insn & 0xffff) & uregs;
212 if (THUMB2_INSN_MATCH(ADR, insn)) {
213 reg = ((insn >> 16) & uregs) >> 8;
218 if (THUMB2_INSN_MATCH(LDRW, insn) || THUMB2_INSN_MATCH(LDRW1, insn) ||
219 THUMB2_INSN_MATCH(LDRHW, insn) || THUMB2_INSN_MATCH(LDRHW1, insn) ||
220 THUMB2_INSN_MATCH(LDRWL, insn)) {
221 reg = ((insn >> 16) & uregs) >> 12;
226 // LDRB.W PC, [PC, #immed] => PLD [PC, #immed], so Rt == PC is skipped
227 if (THUMB2_INSN_MATCH(LDRBW, insn) || THUMB2_INSN_MATCH(LDRBW1, insn) ||
228 THUMB2_INSN_MATCH(LDREX, insn)) {
229 reg = ((insn >> 16) & uregs) >> 12;
231 if (THUMB2_INSN_MATCH(DP, insn)) {
232 reg = ((insn >> 16) & uregs) >> 12;
237 if (THUMB2_INSN_MATCH(RSBW, insn)) {
238 reg = ((insn >> 12) & uregs) >> 8;
243 if (THUMB2_INSN_MATCH(RORW, insn)) {
244 reg = ((insn >> 12) & uregs) >> 8;
249 if (THUMB2_INSN_MATCH(ROR, insn) || THUMB2_INSN_MATCH(LSLW1, insn) ||
250 THUMB2_INSN_MATCH(LSLW2, insn) || THUMB2_INSN_MATCH(LSRW1, insn) ||
251 THUMB2_INSN_MATCH(LSRW2, insn)) {
252 reg = ((insn >> 12) & uregs) >> 8;
257 if (THUMB2_INSN_MATCH(TEQ1, insn) || THUMB2_INSN_MATCH(TST1, insn)) {
260 if (THUMB2_INSN_MATCH(TEQ2, insn) || THUMB2_INSN_MATCH(TST2, insn)) {
261 reg = THUMB2_INSN_REG_RM(insn);
274 if ((THUMB2_INSN_MATCH(STRW, insn) || THUMB2_INSN_MATCH(STRBW, insn) ||
275 THUMB2_INSN_MATCH(STRD, insn) || THUMB2_INSN_MATCH(STRHT, insn) ||
276 THUMB2_INSN_MATCH(STRT, insn) || THUMB2_INSN_MATCH(STRHW1, insn) ||
277 THUMB2_INSN_MATCH(STRHW, insn)) && THUMB2_INSN_REG_RT(insn) == 15) {
278 reg = THUMB2_INSN_REG_RT(insn);
281 if (reg == 6 || reg == 7) {
282 *((unsigned short*)insns + 0) = (*((unsigned short*)insns + 0) & 0x00ff) | ((1 << mreg) | (1 << (mreg + 1)));
283 *((unsigned short*)insns + 1) = (*((unsigned short*)insns + 1) & 0xf8ff) | (mreg << 8);
284 *((unsigned short*)insns + 2) = (*((unsigned short*)insns + 2) & 0xfff8) | (mreg + 1);
285 *((unsigned short*)insns + 3) = (*((unsigned short*)insns + 3) & 0xffc7) | (mreg << 3);
286 *((unsigned short*)insns + 7) = (*((unsigned short*)insns + 7) & 0xf8ff) | (mreg << 8);
287 *((unsigned short*)insns + 8) = (*((unsigned short*)insns + 8) & 0xffc7) | (mreg << 3);
288 *((unsigned short*)insns + 9) = (*((unsigned short*)insns + 9) & 0xffc7) | ((mreg + 1) << 3);
289 *((unsigned short*)insns + 10) = (*((unsigned short*)insns + 10) & 0x00ff) | (( 1 << mreg) | (1 << (mreg + 1)));
292 if (THUMB_INSN_MATCH(APC, insn)) {
293 // ADD Rd, PC, #immed_8*4 -> ADD Rd, SP, #immed_8*4
294 *((unsigned short*)insns + 4) = ((insn & 0xffff) | 0x800); // ADD Rd, SP, #immed_8*4
296 if (THUMB_INSN_MATCH(LRO3, insn)) {
297 // LDR Rd, [PC, #immed_8*4] -> LDR Rd, [SP, #immed_8*4]
298 *((unsigned short*)insns + 4) = ((insn & 0xffff) + 0x5000); // LDR Rd, [SP, #immed_8*4]
300 if (THUMB_INSN_MATCH(MOV3, insn)) {
301 // MOV Rd, PC -> MOV Rd, SP
302 *((unsigned short*)insns + 4) = ((insn & 0xffff) ^ 0x10); // MOV Rd, SP
304 if (THUMB2_INSN_MATCH(ADR, insn)) {
305 // ADDW Rd, PC, #imm -> ADDW Rd, SP, #imm
306 insns[2] = (insn & 0xfffffff0) | 0x0d; // ADDW Rd, SP, #imm
308 if (THUMB2_INSN_MATCH(LDRW, insn) || THUMB2_INSN_MATCH(LDRBW, insn) ||
309 THUMB2_INSN_MATCH(LDRHW, insn)) {
310 // LDR.W Rt, [PC, #-<imm_12>] -> LDR.W Rt, [SP, #-<imm_8>]
311 // !!!!!!!!!!!!!!!!!!!!!!!!
312 // !!! imm_12 vs. imm_8 !!!
313 // !!!!!!!!!!!!!!!!!!!!!!!!
314 insns[2] = (insn & 0xf0fffff0) | 0x0c00000d; // LDR.W Rt, [SP, #-<imm_8>]
316 if (THUMB2_INSN_MATCH(LDRW1, insn) || THUMB2_INSN_MATCH(LDRBW1, insn) ||
317 THUMB2_INSN_MATCH(LDRHW1, insn) || THUMB2_INSN_MATCH(LDRD, insn) ||
318 THUMB2_INSN_MATCH(LDRD1, insn) || THUMB2_INSN_MATCH(LDREX, insn)) {
319 // LDRx.W Rt, [PC, #+<imm_12>] -> LDRx.W Rt, [SP, #+<imm_12>] (+/-imm_8 for LDRD Rt, Rt2, [PC, #<imm_8>]
320 insns[2] = (insn & 0xfffffff0) | 0xd; // LDRx.W Rt, [SP, #+<imm_12>]
322 if (THUMB2_INSN_MATCH(MUL, insn)) {
323 insns[2] = (insn & 0xfff0ffff) | 0x000d0000; // MUL Rd, Rn, SP
325 if (THUMB2_INSN_MATCH(DP, insn)) {
326 if (THUMB2_INSN_REG_RM(insn) == 15) {
327 insns[2] = (insn & 0xfff0ffff) | 0x000d0000; // DP Rd, Rn, PC
328 } else if (THUMB2_INSN_REG_RN(insn) == 15) {
329 insns[2] = (insn & 0xfffffff0) | 0xd; // DP Rd, PC, Rm
332 if (THUMB2_INSN_MATCH(LDRWL, insn)) {
333 // LDRx.W Rt, [PC, #<imm_12>] -> LDRx.W Rt, [SP, #+<imm_12>] (+/-imm_8 for LDRD Rt, Rt2, [PC, #<imm_8>]
334 insns[2] = (insn & 0xfffffff0) | 0xd; // LDRx.W Rt, [SP, #+<imm_12>]
336 if (THUMB2_INSN_MATCH(RSBW, insn)) {
337 insns[2] = (insn & 0xfffffff0) | 0xd; // RSB{S}.W Rd, PC, #<const> -> RSB{S}.W Rd, SP, #<const>
339 if (THUMB2_INSN_MATCH(RORW, insn) || THUMB2_INSN_MATCH(LSLW1, insn) || THUMB2_INSN_MATCH(LSRW1, insn)) {
340 if ((THUMB2_INSN_REG_RM(insn) == 15) && (THUMB2_INSN_REG_RN(insn) == 15)) {
341 insns[2] = (insn & 0xfffdfffd); // ROR.W Rd, PC, PC
342 } else if (THUMB2_INSN_REG_RM(insn) == 15) {
343 insns[2] = (insn & 0xfff0ffff) | 0xd0000; // ROR.W Rd, Rn, PC
344 } else if (THUMB2_INSN_REG_RN(insn) == 15) {
345 insns[2] = (insn & 0xfffffff0) | 0xd; // ROR.W Rd, PC, Rm
348 if (THUMB2_INSN_MATCH(ROR, insn) || THUMB2_INSN_MATCH(LSLW2, insn) || THUMB2_INSN_MATCH(LSRW2, insn)) {
349 insns[2] = (insn & 0xfff0ffff) | 0xd0000; // ROR{S} Rd, PC, #<const> -> ROR{S} Rd, SP, #<const>
363 if (THUMB2_INSN_MATCH(STRW, insn) || THUMB2_INSN_MATCH(STRBW, insn)) {
364 insns[2] = (insn & 0xfff0ffff) | 0x000d0000; // STRx.W Rt, [Rn, SP]
366 if (THUMB2_INSN_MATCH(STRD, insn) || THUMB2_INSN_MATCH(STRHT, insn) ||
367 THUMB2_INSN_MATCH(STRT, insn) || THUMB2_INSN_MATCH(STRHW1, insn)) {
368 if (THUMB2_INSN_REG_RN(insn) == 15) {
369 insns[2] = (insn & 0xfffffff0) | 0xd; // STRD/T/HT{.W} Rt, [SP, ...]
374 if (THUMB2_INSN_MATCH(STRHW, insn) && (THUMB2_INSN_REG_RN(insn) == 15)) {
375 if (THUMB2_INSN_REG_RN(insn) == 15) {
376 insns[2] = (insn & 0xf0fffff0) | 0x0c00000d; // STRH.W Rt, [SP, #-<imm_8>]
385 if ((reg == 15) && (THUMB2_INSN_MATCH(STRW, insn) ||
386 THUMB2_INSN_MATCH(STRBW, insn) ||
387 THUMB2_INSN_MATCH(STRD, insn) ||
388 THUMB2_INSN_MATCH(STRHT, insn) ||
389 THUMB2_INSN_MATCH(STRT, insn) ||
390 THUMB2_INSN_MATCH(STRHW1, insn) ||
391 THUMB2_INSN_MATCH(STRHW, insn) )) {
392 insns[2] = (insns[2] & 0x0fffffff) | 0xd0000000;
395 if (THUMB2_INSN_MATCH(TEQ1, insn) || THUMB2_INSN_MATCH(TST1, insn)) {
396 insns[2] = (insn & 0xfffffff0) | 0xd; // TEQ SP, #<const>
398 if (THUMB2_INSN_MATCH(TEQ2, insn) || THUMB2_INSN_MATCH(TST2, insn)) {
399 if ((THUMB2_INSN_REG_RN(insn) == 15) && (THUMB2_INSN_REG_RM(insn) == 15)) {
400 insns[2] = (insn & 0xfffdfffd); // TEQ/TST PC, PC
401 } else if (THUMB2_INSN_REG_RM(insn) == 15) {
402 insns[2] = (insn & 0xfff0ffff) | 0xd0000; // TEQ/TST Rn, PC
403 } else if (THUMB2_INSN_REG_RN(insn) == 15) {
404 insns[2] = (insn & 0xfffffff0) | 0xd; // TEQ/TST PC, Rm
412 static int arch_copy_trampoline_thumb_uprobe(struct kprobe *p, struct task_struct *task, int atomic)
416 kprobe_opcode_t insn[MAX_INSN_SIZE];
417 struct arch_specific_insn ainsn;
418 kprobe_opcode_t insns[UPROBES_TRAMP_LEN * 2];
421 if ((unsigned long)p->addr & 0x01) {
422 printk("Error in %s at %d: attempt to register kprobe at an unaligned address\n", __FILE__, __LINE__);
427 ainsn.insn_thumb = insn;
428 if (!arch_check_insn_thumb(&ainsn)) {
435 if (THUMB_INSN_MATCH(APC, insn[0]) || THUMB_INSN_MATCH(LRO3, insn[0])) {
436 uregs = 0x0700; // 8-10
438 } else if (THUMB_INSN_MATCH(MOV3, insn[0]) && (((((unsigned char)insn[0]) & 0xff) >> 3) == 15)) {
442 } else if THUMB2_INSN_MATCH(ADR, insn[0]) {
443 uregs = 0x0f00; // Rd 8-11
445 } else if (((THUMB2_INSN_MATCH(LDRW, insn[0]) || THUMB2_INSN_MATCH(LDRW1, insn[0]) ||
446 THUMB2_INSN_MATCH(LDRBW, insn[0]) || THUMB2_INSN_MATCH(LDRBW1, insn[0]) ||
447 THUMB2_INSN_MATCH(LDRHW, insn[0]) || THUMB2_INSN_MATCH(LDRHW1, insn[0]) ||
448 THUMB2_INSN_MATCH(LDRWL, insn[0])) && THUMB2_INSN_REG_RN(insn[0]) == 15) ||
449 THUMB2_INSN_MATCH(LDREX, insn[0]) ||
450 ((THUMB2_INSN_MATCH(STRW, insn[0]) || THUMB2_INSN_MATCH(STRBW, insn[0]) ||
451 THUMB2_INSN_MATCH(STRHW, insn[0]) || THUMB2_INSN_MATCH(STRHW1, insn[0])) &&
452 (THUMB2_INSN_REG_RN(insn[0]) == 15 || THUMB2_INSN_REG_RT(insn[0]) == 15)) ||
453 ((THUMB2_INSN_MATCH(STRT, insn[0]) || THUMB2_INSN_MATCH(STRHT, insn[0])) &&
454 (THUMB2_INSN_REG_RN(insn[0]) == 15 || THUMB2_INSN_REG_RT(insn[0]) == 15))) {
455 uregs = 0xf000; // Rt 12-15
457 } else if ((THUMB2_INSN_MATCH(LDRD, insn[0]) || THUMB2_INSN_MATCH(LDRD1, insn[0])) && (THUMB2_INSN_REG_RN(insn[0]) == 15)) {
458 uregs = 0xff00; // Rt 12-15, Rt2 8-11
460 } else if (THUMB2_INSN_MATCH(MUL, insn[0]) && THUMB2_INSN_REG_RM(insn[0]) == 15) {
463 } else if (THUMB2_INSN_MATCH(DP, insn[0]) && (THUMB2_INSN_REG_RN(insn[0]) == 15 || THUMB2_INSN_REG_RM(insn[0]) == 15)) {
464 uregs = 0xf000; // Rd 12-15
466 } else if (THUMB2_INSN_MATCH(STRD, insn[0]) && ((THUMB2_INSN_REG_RN(insn[0]) == 15) || (THUMB2_INSN_REG_RT(insn[0]) == 15) || THUMB2_INSN_REG_RT2(insn[0]) == 15)) {
467 uregs = 0xff00; // Rt 12-15, Rt2 8-11
469 } else if (THUMB2_INSN_MATCH(RSBW, insn[0]) && THUMB2_INSN_REG_RN(insn[0]) == 15) {
470 uregs = 0x0f00; // Rd 8-11
472 } else if (THUMB2_INSN_MATCH (RORW, insn[0]) && (THUMB2_INSN_REG_RN(insn[0]) == 15 || THUMB2_INSN_REG_RM(insn[0]) == 15)) {
475 } else if ((THUMB2_INSN_MATCH(ROR, insn[0]) || THUMB2_INSN_MATCH(LSLW2, insn[0]) || THUMB2_INSN_MATCH(LSRW2, insn[0])) && THUMB2_INSN_REG_RM(insn[0]) == 15) {
476 uregs = 0x0f00; // Rd 8-11
478 } else if ((THUMB2_INSN_MATCH(LSLW1, insn[0]) || THUMB2_INSN_MATCH(LSRW1, insn[0])) && (THUMB2_INSN_REG_RN(insn[0]) == 15 || THUMB2_INSN_REG_RM(insn[0]) == 15)) {
479 uregs = 0x0f00; // Rd 8-11
481 } else if ((THUMB2_INSN_MATCH(TEQ1, insn[0]) || THUMB2_INSN_MATCH(TST1, insn[0])) && THUMB2_INSN_REG_RN(insn[0]) == 15) {
482 uregs = 0xf0000; //Rn 0-3 (16-19)
484 } else if ((THUMB2_INSN_MATCH(TEQ2, insn[0]) || THUMB2_INSN_MATCH(TST2, insn[0])) &&
485 (THUMB2_INSN_REG_RN(insn[0]) == 15 || THUMB2_INSN_REG_RM(insn[0]) == 15)) {
486 uregs = 0xf0000; //Rn 0-3 (16-19)
490 if (unlikely(uregs && pc_dep)) {
491 memcpy(insns, pc_dep_insn_execbuf_thumb, 18 * 2);
492 if (prep_pc_dep_insn_execbuf_thumb(insns, insn[0], uregs) != 0) {
493 printk("Error in %s at %d: failed to prepare exec buffer for insn %lx!",
494 __FILE__, __LINE__, insn[0]);
496 //free_insn_slot (&uprobe_insn_pages, task, p->ainsn.insn_thumb, 0);
500 addr = ((unsigned int)p->addr) + 4;
501 *((unsigned short*)insns + 13) = 0xdeff;
502 *((unsigned short*)insns + 14) = addr & 0x0000ffff;
503 *((unsigned short*)insns + 15) = addr >> 16;
504 if (!is_thumb2(insn[0])) {
505 addr = ((unsigned int)p->addr) + 2;
506 *((unsigned short*)insns + 16) = (addr & 0x0000ffff) | 0x1;
507 *((unsigned short*)insns + 17) = addr >> 16;
509 addr = ((unsigned int)p->addr) + 4;
510 *((unsigned short*)insns + 16) = (addr & 0x0000ffff) | 0x1;
511 *((unsigned short*)insns + 17) = addr >> 16;
514 memcpy(insns, gen_insn_execbuf_thumb, 18 * 2);
515 *((unsigned short*)insns + 13) = 0xdeff;
516 if (!is_thumb2(insn[0])) {
517 addr = ((unsigned int)p->addr) + 2;
518 *((unsigned short*)insns + 2) = insn[0];
519 *((unsigned short*)insns + 16) = (addr & 0x0000ffff) | 0x1;
520 *((unsigned short*)insns + 17) = addr >> 16;
522 addr = ((unsigned int)p->addr) + 4;
524 *((unsigned short*)insns + 16) = (addr & 0x0000ffff) | 0x1;
525 *((unsigned short*)insns + 17) = addr >> 16;
529 if (!write_proc_vm_atomic (task, (unsigned long)p->ainsn.insn_thumb, insns, 18 * 2)) {
530 panic("failed to write memory %p!\n", p->ainsn.insn_thumb);
531 // Mr_Nobody: we have to panic, really??...
532 //free_insn_slot (&uprobe_insn_pages, task, p->ainsn.insn_thumb, 0);
539 int arch_prepare_uprobe(struct kprobe *p, struct task_struct *task, int atomic)
542 kprobe_opcode_t insn[MAX_INSN_SIZE];
544 if ((unsigned long)p->addr & 0x01) {
545 printk("Error in %s at %d: attempt to register kprobe at an unaligned address\n", __FILE__, __LINE__);
549 if (!read_proc_vm_atomic(task, (unsigned long)p->addr, &insn, MAX_INSN_SIZE * sizeof(kprobe_opcode_t))) {
550 panic("Failed to read memory task[tgid=%u, comm=%s] %p!\n", task->tgid, task->comm, p->addr);
554 p->ainsn.insn_arm = get_insn_slot(task, &uprobe_insn_pages, atomic);
555 if (!p->ainsn.insn_arm) {
556 printk("Error in %s at %d: kprobe slot allocation error (arm)\n", __FILE__, __LINE__);
560 ret = arch_copy_trampoline_arm_uprobe(p, task, 1);
562 free_insn_slot(&uprobe_insn_pages, task, p->ainsn.insn_arm);
566 p->ainsn.insn_thumb = get_insn_slot(task, &uprobe_insn_pages, atomic);
567 if (!p->ainsn.insn_thumb) {
568 printk("Error in %s at %d: kprobe slot allocation error (thumb)\n", __FILE__, __LINE__);
572 ret = arch_copy_trampoline_thumb_uprobe(p, task, 1);
574 free_insn_slot(&uprobe_insn_pages, task, p->ainsn.insn_arm);
575 free_insn_slot(&uprobe_insn_pages, task, p->ainsn.insn_thumb);
579 if ((p->safe_arm == -1) && (p->safe_thumb == -1)) {
580 printk("Error in %s at %d: failed arch_copy_trampoline_*_uprobe() (both) [tgid=%u, addr=%lx, data=%lx]\n",
581 __FILE__, __LINE__, task->tgid, (unsigned long)p->addr, (unsigned long)p->opcode);
582 if (!write_proc_vm_atomic(task, (unsigned long)p->addr, &p->opcode, sizeof(p->opcode))) {
583 panic("Failed to write memory %p!\n", p->addr);
586 free_insn_slot(&uprobe_insn_pages, task, p->ainsn.insn_arm);
587 free_insn_slot(&uprobe_insn_pages, task, p->ainsn.insn_thumb);
595 static int check_validity_insn(struct kprobe *p, struct pt_regs *regs, struct task_struct *task)
599 if (unlikely(thumb_mode(regs))) {
600 if (p->safe_thumb != -1) {
601 p->ainsn.insn = p->ainsn.insn_thumb;
602 list_for_each_entry_rcu(kp, &p->list, list) {
603 kp->ainsn.insn = p->ainsn.insn_thumb;
606 printk("Error in %s at %d: we are in thumb mode (!) and check instruction was fail \
607 (%0lX instruction at %p address)!\n", __FILE__, __LINE__, p->opcode, p->addr);
608 // Test case when we do our actions on already running application
609 arch_disarm_uprobe(p, task);
613 if (p->safe_arm != -1) {
614 p->ainsn.insn = p->ainsn.insn_arm;
615 list_for_each_entry_rcu(kp, &p->list, list) {
616 kp->ainsn.insn = p->ainsn.insn_arm;
619 printk("Error in %s at %d: we are in arm mode (!) and check instruction was fail \
620 (%0lX instruction at %p address)!\n", __FILE__, __LINE__, p->opcode, p->addr);
621 // Test case when we do our actions on already running application
622 arch_disarm_uprobe(p, task);
630 static int uprobe_handler(struct pt_regs *regs)
633 char *msg_out = NULL;
634 struct task_struct *task = current;
635 pid_t tgid = task->tgid;
636 kprobe_opcode_t *addr = (kprobe_opcode_t *)(regs->ARM_pc);
637 struct kprobe *p = NULL;
638 int ret = 0, retprobe = 0;
639 struct kprobe_ctlblk *kcb;
641 #ifdef SUPRESS_BUG_MESSAGES
642 int swap_oops_in_progress;
643 // oops_in_progress used to avoid BUG() messages that slow down kprobe_handler() execution
644 swap_oops_in_progress = oops_in_progress;
645 oops_in_progress = 1;
648 p = get_kprobe(addr, tgid);
650 if (p && (check_validity_insn(p, regs, task) != 0)) {
654 /* We're in an interrupt, but this is clear and BUG()-safe. */
655 kcb = get_kprobe_ctlblk();
658 p = get_kprobe_by_insn_slot(addr, tgid, regs);
660 /* Not one of ours: let kernel handle it */
667 /* restore opcode for thumb app */
668 if (thumb_mode(regs)) {
669 if (!is_thumb2(p->opcode)) {
670 unsigned long tmp = p->opcode >> 16;
671 write_proc_vm_atomic(task, (unsigned long)((unsigned short*)p->addr + 1), &tmp, 2);
673 // "2*sizeof(kprobe_opcode_t)" - strange. Should be "sizeof(kprobe_opcode_t)", need to test
674 flush_icache_range((unsigned int)p->addr, ((unsigned int)p->addr) + (2 * sizeof(kprobe_opcode_t)));
678 set_current_kprobe(p, NULL, NULL);
679 kcb->kprobe_status = KPROBE_HIT_ACTIVE;
682 ret = trampoline_probe_handler(p, regs);
683 } else if (p->pre_handler) {
684 ret = p->pre_handler(p, regs);
685 if(p->pre_handler != trampoline_probe_handler) {
686 reset_current_kprobe();
691 /* handler has already set things up, so skip ss setup */
697 msg_out = "no_uprobe\n";
698 err_out = 1; // return with death
702 msg_out = "no_uprobe live\n";
703 err_out = 0; // ok - life is life
707 #ifdef SUPRESS_BUG_MESSAGES
708 oops_in_progress = swap_oops_in_progress;
718 int uprobe_trap_handler(struct pt_regs *regs, unsigned int instr)
722 local_irq_save(flags);
725 ret = uprobe_handler(regs);
726 preempt_enable_no_resched();
728 local_irq_restore(flags);
732 /* userspace probes hook (arm) */
733 static struct undef_hook undef_hook_for_us_arm = {
734 .instr_mask = 0xffffffff,
735 .instr_val = BREAKPOINT_INSTRUCTION,
736 .cpsr_mask = MODE_MASK,
737 .cpsr_val = USR_MODE,
738 .fn = uprobe_trap_handler
741 /* userspace probes hook (thumb) */
742 static struct undef_hook undef_hook_for_us_thumb = {
743 .instr_mask = 0xffffffff,
744 .instr_val = BREAKPOINT_INSTRUCTION & 0x0000ffff,
745 .cpsr_mask = MODE_MASK,
746 .cpsr_val = USR_MODE,
747 .fn = uprobe_trap_handler
750 int swap_arch_init_uprobes(void)
752 swap_register_undef_hook(&undef_hook_for_us_arm);
753 swap_register_undef_hook(&undef_hook_for_us_thumb);
758 void swap_arch_exit_uprobes(void)
760 swap_unregister_undef_hook(&undef_hook_for_us_thumb);
761 swap_unregister_undef_hook(&undef_hook_for_us_arm);