[deliverable/linux.git] / arch / arm / kernel / kprobes-thumb.c

/*
 * arch/arm/kernel/kprobes-thumb.c
 *
 * Copyright (C) 2011 Jon Medhurst <tixy@yxit.co.uk>.
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License version 2 as
 * published by the Free Software Foundation.
 */

#include <linux/kernel.h>
#include <linux/kprobes.h>

#include "kprobes.h"


/*
 * True if current instruction is in an IT block.
 */
#define in_it_block(cpsr)	((cpsr & 0x06000c00) != 0x00000000)

/*
 * Return the condition code to check for the currently executing instruction.
 * This is in ITSTATE<7:4> which is in CPSR<15:12> but is only valid if
 * in_it_block returns true.
 */
#define current_cond(cpsr)	((cpsr >> 12) & 0xf)

/*
 * Return the PC value for a probe in thumb code.
 * This is the address of the probed instruction plus 4.
 * We subtract one because the address will have bit zero set to indicate
 * a pointer to thumb code.
 */
static inline unsigned long __kprobes thumb_probe_pc(struct kprobe *p)
{
	return (unsigned long)p->addr - 1 + 4;
}

static void __kprobes
t16_simulate_bxblx(struct kprobe *p, struct pt_regs *regs)
{
	kprobe_opcode_t insn = p->opcode;
	unsigned long pc = thumb_probe_pc(p);
	int rm = (insn >> 3) & 0xf;
	unsigned long rmv = (rm == 15) ? pc : regs->uregs[rm];

	if (insn & (1 << 7)) /* BLX ? */
		regs->ARM_lr = (unsigned long)p->addr + 2;

	bx_write_pc(rmv, regs);
}

static void __kprobes
t16_simulate_ldr_literal(struct kprobe *p, struct pt_regs *regs)
{
	kprobe_opcode_t insn = p->opcode;
	unsigned long* base = (unsigned long *)(thumb_probe_pc(p) & ~3);
	long index = insn & 0xff;
	int rt = (insn >> 8) & 0x7;
	regs->uregs[rt] = base[index];
}

static void __kprobes
t16_simulate_ldrstr_sp_relative(struct kprobe *p, struct pt_regs *regs)
{
	kprobe_opcode_t insn = p->opcode;
	unsigned long* base = (unsigned long *)regs->ARM_sp;
	long index = insn & 0xff;
	int rt = (insn >> 8) & 0x7;
	if (insn & 0x800) /* LDR */
		regs->uregs[rt] = base[index];
	else /* STR */
		base[index] = regs->uregs[rt];
}

static void __kprobes
t16_simulate_reladr(struct kprobe *p, struct pt_regs *regs)
{
	kprobe_opcode_t insn = p->opcode;
	unsigned long base = (insn & 0x800) ? regs->ARM_sp
					    : (thumb_probe_pc(p) & ~3);
	long offset = insn & 0xff;
	int rt = (insn >> 8) & 0x7;
	regs->uregs[rt] = base + offset * 4;
}

static void __kprobes
t16_simulate_add_sp_imm(struct kprobe *p, struct pt_regs *regs)
{
	kprobe_opcode_t insn = p->opcode;
	long imm = insn & 0x7f;
	if (insn & 0x80) /* SUB */
		regs->ARM_sp -= imm * 4;
	else /* ADD */
		regs->ARM_sp += imm * 4;
}

static void __kprobes
t16_simulate_cbz(struct kprobe *p, struct pt_regs *regs)
{
	kprobe_opcode_t insn = p->opcode;
	int rn = insn & 0x7;
	kprobe_opcode_t nonzero = regs->uregs[rn] ? insn : ~insn;
	if (nonzero & 0x800) {
		long i = insn & 0x200;
		long imm5 = insn & 0xf8;
		unsigned long pc = thumb_probe_pc(p);
		regs->ARM_pc = pc + (i >> 3) + (imm5 >> 2);
	}
}

static void __kprobes
t16_simulate_it(struct kprobe *p, struct pt_regs *regs)
{
	/*
	 * The 8 IT state bits are split into two parts in CPSR:
	 *	ITSTATE<1:0> are in CPSR<26:25>
	 *	ITSTATE<7:2> are in CPSR<15:10>
	 * The new IT state is in the lower byte of insn.
	 */
	kprobe_opcode_t insn = p->opcode;
	unsigned long cpsr = regs->ARM_cpsr;
	cpsr &= ~PSR_IT_MASK;
	cpsr |= (insn & 0xfc) << 8;
	cpsr |= (insn & 0x03) << 25;
	regs->ARM_cpsr = cpsr;
}

static void __kprobes
t16_singlestep_it(struct kprobe *p, struct pt_regs *regs)
{
	regs->ARM_pc += 2;
	t16_simulate_it(p, regs);
}

static enum kprobe_insn __kprobes
t16_decode_it(kprobe_opcode_t insn, struct arch_specific_insn *asi)
{
	asi->insn_singlestep = t16_singlestep_it;
	return INSN_GOOD_NO_SLOT;
}

static unsigned long __kprobes
t16_emulate_loregs(struct kprobe *p, struct pt_regs *regs)
{
	unsigned long oldcpsr = regs->ARM_cpsr;
	unsigned long newcpsr;

	__asm__ __volatile__ (
		"msr	cpsr_fs, %[oldcpsr]	\n\t"
		"ldmia	%[regs], {r0-r7}	\n\t"
		"blx	%[fn]			\n\t"
		"stmia	%[regs], {r0-r7}	\n\t"
		"mrs	%[newcpsr], cpsr	\n\t"
		: [newcpsr] "=r" (newcpsr)
		: [oldcpsr] "r" (oldcpsr), [regs] "r" (regs),
		  [fn] "r" (p->ainsn.insn_fn)
		: "r0", "r1", "r2", "r3", "r4", "r5", "r6", "r7",
		  "lr", "memory", "cc"
		);

	return (oldcpsr & ~APSR_MASK) | (newcpsr & APSR_MASK);
}

static void __kprobes
t16_emulate_loregs_rwflags(struct kprobe *p, struct pt_regs *regs)
{
	regs->ARM_cpsr = t16_emulate_loregs(p, regs);
}

static void __kprobes
t16_emulate_loregs_noitrwflags(struct kprobe *p, struct pt_regs *regs)
{
	unsigned long cpsr = t16_emulate_loregs(p, regs);
	if (!in_it_block(cpsr))
		regs->ARM_cpsr = cpsr;
}

static void __kprobes
t16_emulate_hiregs(struct kprobe *p, struct pt_regs *regs)
{
	kprobe_opcode_t insn = p->opcode;
	unsigned long pc = thumb_probe_pc(p);
	int rdn = (insn & 0x7) | ((insn & 0x80) >> 4);
	int rm = (insn >> 3) & 0xf;

	register unsigned long rdnv asm("r1");
	register unsigned long rmv asm("r0");
	unsigned long cpsr = regs->ARM_cpsr;

	rdnv = (rdn == 15) ? pc : regs->uregs[rdn];
	rmv = (rm == 15) ? pc : regs->uregs[rm];

	__asm__ __volatile__ (
		"msr	cpsr_fs, %[cpsr]	\n\t"
		"blx    %[fn]			\n\t"
		"mrs	%[cpsr], cpsr		\n\t"
		: "=r" (rdnv), [cpsr] "=r" (cpsr)
		: "0" (rdnv), "r" (rmv), "1" (cpsr), [fn] "r" (p->ainsn.insn_fn)
		: "lr", "memory", "cc"
	);

	if (rdn == 15)
		rdnv &= ~1;

	regs->uregs[rdn] = rdnv;
	regs->ARM_cpsr = (regs->ARM_cpsr & ~APSR_MASK) | (cpsr & APSR_MASK);
}

static enum kprobe_insn __kprobes
t16_decode_hiregs(kprobe_opcode_t insn, struct arch_specific_insn *asi)
{
	insn &= ~0x00ff;
	insn |= 0x001; /* Set Rdn = R1 and Rm = R0 */
	((u16 *)asi->insn)[0] = insn;
	asi->insn_handler = t16_emulate_hiregs;
	return INSN_GOOD;
}

static void __kprobes
t16_emulate_push(struct kprobe *p, struct pt_regs *regs)
{
	__asm__ __volatile__ (
		"ldr	r9, [%[regs], #13*4]	\n\t"
		"ldr	r8, [%[regs], #14*4]	\n\t"
		"ldmia	%[regs], {r0-r7}	\n\t"
		"blx	%[fn]			\n\t"
		"str	r9, [%[regs], #13*4]	\n\t"
		:
		: [regs] "r" (regs), [fn] "r" (p->ainsn.insn_fn)
		: "r0", "r1", "r2", "r3", "r4", "r5", "r6", "r7", "r8", "r9",
		  "lr", "memory", "cc"
		);
}

static enum kprobe_insn __kprobes
t16_decode_push(kprobe_opcode_t insn, struct arch_specific_insn *asi)
{
	/*
	 * To simulate a PUSH we use a Thumb-2 "STMDB R9!, {registers}"
	 * and call it with R9=SP and LR in the register list represented
	 * by R8.
	 */
	((u16 *)asi->insn)[0] = 0xe929;		/* 1st half STMDB R9!,{} */
	((u16 *)asi->insn)[1] = insn & 0x1ff;	/* 2nd half (register list) */
	asi->insn_handler = t16_emulate_push;
	return INSN_GOOD;
}

static void __kprobes
t16_emulate_pop_nopc(struct kprobe *p, struct pt_regs *regs)
{
	__asm__ __volatile__ (
		"ldr	r9, [%[regs], #13*4]	\n\t"
		"ldmia	%[regs], {r0-r7}	\n\t"
		"blx	%[fn]			\n\t"
		"stmia	%[regs], {r0-r7}	\n\t"
		"str	r9, [%[regs], #13*4]	\n\t"
		:
		: [regs] "r" (regs), [fn] "r" (p->ainsn.insn_fn)
		: "r0", "r1", "r2", "r3", "r4", "r5", "r6", "r7", "r9",
		  "lr", "memory", "cc"
		);
}

static void __kprobes
t16_emulate_pop_pc(struct kprobe *p, struct pt_regs *regs)
{
	register unsigned long pc asm("r8");

	__asm__ __volatile__ (
		"ldr	r9, [%[regs], #13*4]	\n\t"
		"ldmia	%[regs], {r0-r7}	\n\t"
		"blx	%[fn]			\n\t"
		"stmia	%[regs], {r0-r7}	\n\t"
		"str	r9, [%[regs], #13*4]	\n\t"
		: "=r" (pc)
		: [regs] "r" (regs), [fn] "r" (p->ainsn.insn_fn)
		: "r0", "r1", "r2", "r3", "r4", "r5", "r6", "r7", "r9",
		  "lr", "memory", "cc"
		);

	bx_write_pc(pc, regs);
}

static enum kprobe_insn __kprobes
t16_decode_pop(kprobe_opcode_t insn, struct arch_specific_insn *asi)
{
	/*
	 * To simulate a POP we use a Thumb-2 "LDMDB R9!, {registers}"
	 * and call it with R9=SP and PC in the register list represented
	 * by R8.
	 */
	((u16 *)asi->insn)[0] = 0xe8b9;		/* 1st half LDMIA R9!,{} */
	((u16 *)asi->insn)[1] = insn & 0x1ff;	/* 2nd half (register list) */
	asi->insn_handler = insn & 0x100 ? t16_emulate_pop_pc
					 : t16_emulate_pop_nopc;
	return INSN_GOOD;
}

static const union decode_item t16_table_1011[] = {
	/* Miscellaneous 16-bit instructions		    */

	/* ADD (SP plus immediate)	1011 0000 0xxx xxxx */
	/* SUB (SP minus immediate)	1011 0000 1xxx xxxx */
	DECODE_SIMULATE	(0xff00, 0xb000, t16_simulate_add_sp_imm),

	/* CBZ				1011 00x1 xxxx xxxx */
	/* CBNZ				1011 10x1 xxxx xxxx */
	DECODE_SIMULATE	(0xf500, 0xb100, t16_simulate_cbz),

	/* SXTH				1011 0010 00xx xxxx */
	/* SXTB				1011 0010 01xx xxxx */
	/* UXTH				1011 0010 10xx xxxx */
	/* UXTB				1011 0010 11xx xxxx */
	/* REV				1011 1010 00xx xxxx */
	/* REV16			1011 1010 01xx xxxx */
	/* ???				1011 1010 10xx xxxx */
	/* REVSH			1011 1010 11xx xxxx */
	DECODE_REJECT	(0xffc0, 0xba80),
	DECODE_EMULATE	(0xf500, 0xb000, t16_emulate_loregs_rwflags),

	/* PUSH				1011 010x xxxx xxxx */
	DECODE_CUSTOM	(0xfe00, 0xb400, t16_decode_push),
	/* POP				1011 110x xxxx xxxx */
	DECODE_CUSTOM	(0xfe00, 0xbc00, t16_decode_pop),

	/*
	 * If-Then, and hints
	 *				1011 1111 xxxx xxxx
	 */

	/* YIELD			1011 1111 0001 0000 */
	DECODE_OR	(0xffff, 0xbf10),
	/* SEV				1011 1111 0100 0000 */
	DECODE_EMULATE	(0xffff, 0xbf40, kprobe_emulate_none),
	/* NOP				1011 1111 0000 0000 */
	/* WFE				1011 1111 0010 0000 */
	/* WFI				1011 1111 0011 0000 */
	DECODE_SIMULATE	(0xffcf, 0xbf00, kprobe_simulate_nop),
	/* Unassigned hints		1011 1111 xxxx 0000 */
	DECODE_REJECT	(0xff0f, 0xbf00),
	/* IT				1011 1111 xxxx xxxx */
	DECODE_CUSTOM	(0xff00, 0xbf00, t16_decode_it),

	DECODE_END
};

const union decode_item kprobe_decode_thumb16_table[] = {

	/*
	 * Shift (immediate), add, subtract, move, and compare
	 *				00xx xxxx xxxx xxxx
	 */

	/* CMP (immediate)		0010 1xxx xxxx xxxx */
	DECODE_EMULATE	(0xf800, 0x2800, t16_emulate_loregs_rwflags),

	/* ADD (register)		0001 100x xxxx xxxx */
	/* SUB (register)		0001 101x xxxx xxxx */
	/* LSL (immediate)		0000 0xxx xxxx xxxx */
	/* LSR (immediate)		0000 1xxx xxxx xxxx */
	/* ASR (immediate)		0001 0xxx xxxx xxxx */
	/* ADD (immediate, Thumb)	0001 110x xxxx xxxx */
	/* SUB (immediate, Thumb)	0001 111x xxxx xxxx */
	/* MOV (immediate)		0010 0xxx xxxx xxxx */
	/* ADD (immediate, Thumb)	0011 0xxx xxxx xxxx */
	/* SUB (immediate, Thumb)	0011 1xxx xxxx xxxx */
	DECODE_EMULATE	(0xc000, 0x0000, t16_emulate_loregs_noitrwflags),

	/*
	 * 16-bit Thumb data-processing instructions
	 *				0100 00xx xxxx xxxx
	 */

	/* TST (register)		0100 0010 00xx xxxx */
	DECODE_EMULATE	(0xffc0, 0x4200, t16_emulate_loregs_rwflags),
	/* CMP (register)		0100 0010 10xx xxxx */
	/* CMN (register)		0100 0010 11xx xxxx */
	DECODE_EMULATE	(0xff80, 0x4280, t16_emulate_loregs_rwflags),
	/* AND (register)		0100 0000 00xx xxxx */
	/* EOR (register)		0100 0000 01xx xxxx */
	/* LSL (register)		0100 0000 10xx xxxx */
	/* LSR (register)		0100 0000 11xx xxxx */
	/* ASR (register)		0100 0001 00xx xxxx */
	/* ADC (register)		0100 0001 01xx xxxx */
	/* SBC (register)		0100 0001 10xx xxxx */
	/* ROR (register)		0100 0001 11xx xxxx */
	/* RSB (immediate)		0100 0010 01xx xxxx */
	/* ORR (register)		0100 0011 00xx xxxx */
	/* MUL				0100 0011 00xx xxxx */
	/* BIC (register)		0100 0011 10xx xxxx */
	/* MVN (register)		0100 0011 10xx xxxx */
	DECODE_EMULATE	(0xfc00, 0x4000, t16_emulate_loregs_noitrwflags),

	/*
	 * Special data instructions and branch and exchange
	 *				0100 01xx xxxx xxxx
	 */

	/* BLX pc			0100 0111 1111 1xxx */
	DECODE_REJECT	(0xfff8, 0x47f8),

	/* BX (register)		0100 0111 0xxx xxxx */
	/* BLX (register)		0100 0111 1xxx xxxx */
	DECODE_SIMULATE (0xff00, 0x4700, t16_simulate_bxblx),

	/* ADD pc, pc			0100 0100 1111 1111 */
	DECODE_REJECT	(0xffff, 0x44ff),

	/* ADD (register)		0100 0100 xxxx xxxx */
	/* CMP (register)		0100 0101 xxxx xxxx */
	/* MOV (register)		0100 0110 xxxx xxxx */
	DECODE_CUSTOM	(0xfc00, 0x4400, t16_decode_hiregs),

	/*
	 * Load from Literal Pool
	 * LDR (literal)		0100 1xxx xxxx xxxx
	 */
	DECODE_SIMULATE	(0xf800, 0x4800, t16_simulate_ldr_literal),

	/*
	 * 16-bit Thumb Load/store instructions
	 *				0101 xxxx xxxx xxxx
	 *				011x xxxx xxxx xxxx
	 *				100x xxxx xxxx xxxx
	 */

	/* STR (register)		0101 000x xxxx xxxx */
	/* STRH (register)		0101 001x xxxx xxxx */
	/* STRB (register)		0101 010x xxxx xxxx */
	/* LDRSB (register)		0101 011x xxxx xxxx */
	/* LDR (register)		0101 100x xxxx xxxx */
	/* LDRH (register)		0101 101x xxxx xxxx */
	/* LDRB (register)		0101 110x xxxx xxxx */
	/* LDRSH (register)		0101 111x xxxx xxxx */
	/* STR (immediate, Thumb)	0110 0xxx xxxx xxxx */
	/* LDR (immediate, Thumb)	0110 1xxx xxxx xxxx */
	/* STRB (immediate, Thumb)	0111 0xxx xxxx xxxx */
	/* LDRB (immediate, Thumb)	0111 1xxx xxxx xxxx */
	DECODE_EMULATE	(0xc000, 0x4000, t16_emulate_loregs_rwflags),
	/* STRH (immediate, Thumb)	1000 0xxx xxxx xxxx */
	/* LDRH (immediate, Thumb)	1000 1xxx xxxx xxxx */
	DECODE_EMULATE	(0xf000, 0x8000, t16_emulate_loregs_rwflags),
	/* STR (immediate, Thumb)	1001 0xxx xxxx xxxx */
	/* LDR (immediate, Thumb)	1001 1xxx xxxx xxxx */
	DECODE_SIMULATE	(0xf000, 0x9000, t16_simulate_ldrstr_sp_relative),

	/*
	 * Generate PC-/SP-relative address
	 * ADR (literal)		1010 0xxx xxxx xxxx
	 * ADD (SP plus immediate)	1010 1xxx xxxx xxxx
	 */
	DECODE_SIMULATE	(0xf000, 0xa000, t16_simulate_reladr),

	/*
	 * Miscellaneous 16-bit instructions
	 *				1011 xxxx xxxx xxxx
	 */
	DECODE_TABLE	(0xf000, 0xb000, t16_table_1011),

	/* STM				1100 0xxx xxxx xxxx */
	/* LDM				1100 1xxx xxxx xxxx */
	DECODE_EMULATE	(0xf000, 0xc000, t16_emulate_loregs_rwflags),

	/*
	 * Conditional branch, and Supervisor Call
	 */

	/* Permanently UNDEFINED	1101 1110 xxxx xxxx */
	/* SVC				1101 1111 xxxx xxxx */
	DECODE_REJECT	(0xfe00, 0xde00),

	DECODE_END
};

static unsigned long __kprobes thumb_check_cc(unsigned long cpsr)
{
	if (unlikely(in_it_block(cpsr)))
		return kprobe_condition_checks[current_cond(cpsr)](cpsr);
	return true;
}

static void __kprobes thumb16_singlestep(struct kprobe *p, struct pt_regs *regs)
{
	regs->ARM_pc += 2;
	p->ainsn.insn_handler(p, regs);
	regs->ARM_cpsr = it_advance(regs->ARM_cpsr);
}

static void __kprobes thumb32_singlestep(struct kprobe *p, struct pt_regs *regs)
{
	regs->ARM_pc += 4;
	p->ainsn.insn_handler(p, regs);
	regs->ARM_cpsr = it_advance(regs->ARM_cpsr);
}

enum kprobe_insn __kprobes
thumb16_kprobe_decode_insn(kprobe_opcode_t insn, struct arch_specific_insn *asi)
{
	asi->insn_singlestep = thumb16_singlestep;
	asi->insn_check_cc = thumb_check_cc;
	return kprobe_decode_insn(insn, asi, kprobe_decode_thumb16_table, true);
}

enum kprobe_insn __kprobes
thumb32_kprobe_decode_insn(kprobe_opcode_t insn, struct arch_specific_insn *asi)
{
	asi->insn_singlestep = thumb32_singlestep;
	asi->insn_check_cc = thumb_check_cc;
	return INSN_REJECTED;
}
Commit	Line	Data
24371707 JM	1	/*
	2	* arch/arm/kernel/kprobes-thumb.c
	3	*
	4	* Copyright (C) 2011 Jon Medhurst <tixy@yxit.co.uk>.
	5	*
	6	* This program is free software; you can redistribute it and/or modify
	7	* it under the terms of the GNU General Public License version 2 as
	8	* published by the Free Software Foundation.
	9	*/
	10
	11	#include <linux/kernel.h>
	12	#include <linux/kprobes.h>
	13
	14	#include "kprobes.h"
	15
eaf4f33f JM	16
	17	/*
	18	* True if current instruction is in an IT block.
	19	*/
	20	#define in_it_block(cpsr) ((cpsr & 0x06000c00) != 0x00000000)
	21
	22	/*
	23	* Return the condition code to check for the currently executing instruction.
	24	* This is in ITSTATE<7:4> which is in CPSR<15:12> but is only valid if
	25	* in_it_block returns true.
	26	*/
	27	#define current_cond(cpsr) ((cpsr >> 12) & 0xf)
	28
a9c3c29e JM	29	/*
	30	* Return the PC value for a probe in thumb code.
	31	* This is the address of the probed instruction plus 4.
	32	* We subtract one because the address will have bit zero set to indicate
	33	* a pointer to thumb code.
	34	*/
	35	static inline unsigned long __kprobes thumb_probe_pc(struct kprobe *p)
	36	{
	37	return (unsigned long)p->addr - 1 + 4;
	38	}
	39
	40	static void __kprobes
	41	t16_simulate_bxblx(struct kprobe p, struct pt_regs regs)
	42	{
	43	kprobe_opcode_t insn = p->opcode;
	44	unsigned long pc = thumb_probe_pc(p);
	45	int rm = (insn >> 3) & 0xf;
	46	unsigned long rmv = (rm == 15) ? pc : regs->uregs[rm];
	47
	48	if (insn & (1 << 7)) /* BLX ? */
	49	regs->ARM_lr = (unsigned long)p->addr + 2;
	50
	51	bx_write_pc(rmv, regs);
	52	}
	53
f8695142 JM	54	static void __kprobes
	55	t16_simulate_ldr_literal(struct kprobe p, struct pt_regs regs)
	56	{
	57	kprobe_opcode_t insn = p->opcode;
	58	unsigned long* base = (unsigned long *)(thumb_probe_pc(p) & ~3);
	59	long index = insn & 0xff;
	60	int rt = (insn >> 8) & 0x7;
	61	regs->uregs[rt] = base[index];
	62	}
	63
	64	static void __kprobes
	65	t16_simulate_ldrstr_sp_relative(struct kprobe p, struct pt_regs regs)
	66	{
	67	kprobe_opcode_t insn = p->opcode;
	68	unsigned long* base = (unsigned long *)regs->ARM_sp;
	69	long index = insn & 0xff;
	70	int rt = (insn >> 8) & 0x7;
	71	if (insn & 0x800) /* LDR */
	72	regs->uregs[rt] = base[index];
	73	else /* STR */
	74	base[index] = regs->uregs[rt];
	75	}
	76
2f335829 JM	77	static void __kprobes
	78	t16_simulate_reladr(struct kprobe p, struct pt_regs regs)
	79	{
	80	kprobe_opcode_t insn = p->opcode;
	81	unsigned long base = (insn & 0x800) ? regs->ARM_sp
	82	: (thumb_probe_pc(p) & ~3);
	83	long offset = insn & 0xff;
	84	int rt = (insn >> 8) & 0x7;
	85	regs->uregs[rt] = base + offset * 4;
	86	}
	87
	88	static void __kprobes
	89	t16_simulate_add_sp_imm(struct kprobe p, struct pt_regs regs)
	90	{
	91	kprobe_opcode_t insn = p->opcode;
	92	long imm = insn & 0x7f;
	93	if (insn & 0x80) /* SUB */
	94	regs->ARM_sp -= imm * 4;
	95	else /* ADD */
	96	regs->ARM_sp += imm * 4;
	97	}
	98
32818f31 JM	99	static void __kprobes
	100	t16_simulate_cbz(struct kprobe p, struct pt_regs regs)
	101	{
	102	kprobe_opcode_t insn = p->opcode;
	103	int rn = insn & 0x7;
	104	kprobe_opcode_t nonzero = regs->uregs[rn] ? insn : ~insn;
	105	if (nonzero & 0x800) {
	106	long i = insn & 0x200;
	107	long imm5 = insn & 0xf8;
	108	unsigned long pc = thumb_probe_pc(p);
	109	regs->ARM_pc = pc + (i >> 3) + (imm5 >> 2);
	110	}
	111	}
	112
5b94faf8 JM	113	static void __kprobes
	114	t16_simulate_it(struct kprobe p, struct pt_regs regs)
	115	{
	116	/*
	117	* The 8 IT state bits are split into two parts in CPSR:
	118	* ITSTATE<1:0> are in CPSR<26:25>
	119	* ITSTATE<7:2> are in CPSR<15:10>
	120	* The new IT state is in the lower byte of insn.
	121	*/
	122	kprobe_opcode_t insn = p->opcode;
	123	unsigned long cpsr = regs->ARM_cpsr;
	124	cpsr &= ~PSR_IT_MASK;
	125	cpsr \|= (insn & 0xfc) << 8;
	126	cpsr \|= (insn & 0x03) << 25;
	127	regs->ARM_cpsr = cpsr;
	128	}
	129
	130	static void __kprobes
	131	t16_singlestep_it(struct kprobe p, struct pt_regs regs)
	132	{
	133	regs->ARM_pc += 2;
	134	t16_simulate_it(p, regs);
	135	}
	136
	137	static enum kprobe_insn __kprobes
	138	t16_decode_it(kprobe_opcode_t insn, struct arch_specific_insn *asi)
	139	{
	140	asi->insn_singlestep = t16_singlestep_it;
	141	return INSN_GOOD_NO_SLOT;
	142	}
	143
02d194f6 JM	144	static unsigned long __kprobes
	145	t16_emulate_loregs(struct kprobe p, struct pt_regs regs)
	146	{
	147	unsigned long oldcpsr = regs->ARM_cpsr;
	148	unsigned long newcpsr;
	149
	150	__asm__ __volatile__ (
	151	"msr cpsr_fs, %[oldcpsr] \n\t"
	152	"ldmia %[regs], {r0-r7} \n\t"
	153	"blx %[fn] \n\t"
	154	"stmia %[regs], {r0-r7} \n\t"
	155	"mrs %[newcpsr], cpsr \n\t"
	156	: [newcpsr] "=r" (newcpsr)
	157	: [oldcpsr] "r" (oldcpsr), [regs] "r" (regs),
	158	[fn] "r" (p->ainsn.insn_fn)
	159	: "r0", "r1", "r2", "r3", "r4", "r5", "r6", "r7",
	160	"lr", "memory", "cc"
	161	);
	162
	163	return (oldcpsr & ~APSR_MASK) \| (newcpsr & APSR_MASK);
	164	}
	165
	166	static void __kprobes
	167	t16_emulate_loregs_rwflags(struct kprobe p, struct pt_regs regs)
	168	{
	169	regs->ARM_cpsr = t16_emulate_loregs(p, regs);
	170	}
	171
	172	static void __kprobes
	173	t16_emulate_loregs_noitrwflags(struct kprobe p, struct pt_regs regs)
	174	{
	175	unsigned long cpsr = t16_emulate_loregs(p, regs);
	176	if (!in_it_block(cpsr))
	177	regs->ARM_cpsr = cpsr;
	178	}
	179
3b5940e8 JM	180	static void __kprobes
	181	t16_emulate_hiregs(struct kprobe p, struct pt_regs regs)
	182	{
	183	kprobe_opcode_t insn = p->opcode;
	184	unsigned long pc = thumb_probe_pc(p);
	185	int rdn = (insn & 0x7) \| ((insn & 0x80) >> 4);
	186	int rm = (insn >> 3) & 0xf;
	187
	188	register unsigned long rdnv asm("r1");
	189	register unsigned long rmv asm("r0");
	190	unsigned long cpsr = regs->ARM_cpsr;
	191
	192	rdnv = (rdn == 15) ? pc : regs->uregs[rdn];
	193	rmv = (rm == 15) ? pc : regs->uregs[rm];
	194
	195	__asm__ __volatile__ (
	196	"msr cpsr_fs, %[cpsr] \n\t"
	197	"blx %[fn] \n\t"
	198	"mrs %[cpsr], cpsr \n\t"
	199	: "=r" (rdnv), [cpsr] "=r" (cpsr)
	200	: "0" (rdnv), "r" (rmv), "1" (cpsr), [fn] "r" (p->ainsn.insn_fn)
	201	: "lr", "memory", "cc"
	202	);
	203
	204	if (rdn == 15)
	205	rdnv &= ~1;
	206
	207	regs->uregs[rdn] = rdnv;
	208	regs->ARM_cpsr = (regs->ARM_cpsr & ~APSR_MASK) \| (cpsr & APSR_MASK);
	209	}
	210
	211	static enum kprobe_insn __kprobes
	212	t16_decode_hiregs(kprobe_opcode_t insn, struct arch_specific_insn *asi)
	213	{
	214	insn &= ~0x00ff;
	215	insn \|= 0x001; /* Set Rdn = R1 and Rm = R0 */
	216	((u16 *)asi->insn)[0] = insn;
	217	asi->insn_handler = t16_emulate_hiregs;
	218	return INSN_GOOD;
	219	}
	220
fd0c8d8a JM	221	static void __kprobes
	222	t16_emulate_push(struct kprobe p, struct pt_regs regs)
	223	{
	224	__asm__ __volatile__ (
	225	"ldr r9, [%[regs], #13*4] \n\t"
	226	"ldr r8, [%[regs], #14*4] \n\t"
	227	"ldmia %[regs], {r0-r7} \n\t"
	228	"blx %[fn] \n\t"
	229	"str r9, [%[regs], #13*4] \n\t"
	230	:
	231	: [regs] "r" (regs), [fn] "r" (p->ainsn.insn_fn)
	232	: "r0", "r1", "r2", "r3", "r4", "r5", "r6", "r7", "r8", "r9",
	233	"lr", "memory", "cc"
	234	);
	235	}
	236
	237	static enum kprobe_insn __kprobes
	238	t16_decode_push(kprobe_opcode_t insn, struct arch_specific_insn *asi)
	239	{
	240	/*
	241	* To simulate a PUSH we use a Thumb-2 "STMDB R9!, {registers}"
	242	* and call it with R9=SP and LR in the register list represented
	243	* by R8.
	244	*/
	245	((u16 )asi->insn)[0] = 0xe929; / 1st half STMDB R9!,{} */
	246	((u16 )asi->insn)[1] = insn & 0x1ff; / 2nd half (register list) */
	247	asi->insn_handler = t16_emulate_push;
	248	return INSN_GOOD;
	249	}
	250
	251	static void __kprobes
	252	t16_emulate_pop_nopc(struct kprobe p, struct pt_regs regs)
	253	{
	254	__asm__ __volatile__ (
	255	"ldr r9, [%[regs], #13*4] \n\t"
	256	"ldmia %[regs], {r0-r7} \n\t"
	257	"blx %[fn] \n\t"
	258	"stmia %[regs], {r0-r7} \n\t"
	259	"str r9, [%[regs], #13*4] \n\t"
	260	:
	261	: [regs] "r" (regs), [fn] "r" (p->ainsn.insn_fn)
	262	: "r0", "r1", "r2", "r3", "r4", "r5", "r6", "r7", "r9",
	263	"lr", "memory", "cc"
	264	);
	265	}
	266
	267	static void __kprobes
	268	t16_emulate_pop_pc(struct kprobe p, struct pt_regs regs)
	269	{
	270	register unsigned long pc asm("r8");
	271
	272	__asm__ __volatile__ (
	273	"ldr r9, [%[regs], #13*4] \n\t"
	274	"ldmia %[regs], {r0-r7} \n\t"
	275	"blx %[fn] \n\t"
	276	"stmia %[regs], {r0-r7} \n\t"
	277	"str r9, [%[regs], #13*4] \n\t"
	278	: "=r" (pc)
	279	: [regs] "r" (regs), [fn] "r" (p->ainsn.insn_fn)
	280	: "r0", "r1", "r2", "r3", "r4", "r5", "r6", "r7", "r9",
	281	"lr", "memory", "cc"
	282	);
	283
	284	bx_write_pc(pc, regs);
285	}
286
287	static enum kprobe_insn __kprobes
288	t16_decode_pop(kprobe_opcode_t insn, struct arch_specific_insn *asi)
289	{
290	/*
291	* To simulate a POP we use a Thumb-2 "LDMDB R9!, {registers}"
292	* and call it with R9=SP and PC in the register list represented
293	* by R8.
294	*/
295	((u16 )asi->insn)[0] = 0xe8b9; / 1st half LDMIA R9!,{} */
296	((u16 )asi->insn)[1] = insn & 0x1ff; / 2nd half (register list) */
297	asi->insn_handler = insn & 0x100 ? t16_emulate_pop_pc
298	: t16_emulate_pop_nopc;
299	return INSN_GOOD;
300	}
301
3f92dfed JM	302	static const union decode_item t16_table_1011[] = {
	303	/* Miscellaneous 16-bit instructions */
	304
2f335829 JM	305	/* ADD (SP plus immediate) 1011 0000 0xxx xxxx */
	306	/* SUB (SP minus immediate) 1011 0000 1xxx xxxx */
	307	DECODE_SIMULATE (0xff00, 0xb000, t16_simulate_add_sp_imm),
	308
32818f31 JM	309	/* CBZ 1011 00x1 xxxx xxxx */
	310	/* CBNZ 1011 10x1 xxxx xxxx */
	311	DECODE_SIMULATE (0xf500, 0xb100, t16_simulate_cbz),
	312
	313	/* SXTH 1011 0010 00xx xxxx */
	314	/* SXTB 1011 0010 01xx xxxx */
	315	/* UXTH 1011 0010 10xx xxxx */
	316	/* UXTB 1011 0010 11xx xxxx */
	317	/* REV 1011 1010 00xx xxxx */
	318	/* REV16 1011 1010 01xx xxxx */
	319	/* ??? 1011 1010 10xx xxxx */
	320	/* REVSH 1011 1010 11xx xxxx */
	321	DECODE_REJECT (0xffc0, 0xba80),
	322	DECODE_EMULATE (0xf500, 0xb000, t16_emulate_loregs_rwflags),
	323
fd0c8d8a JM	324	/* PUSH 1011 010x xxxx xxxx */
	325	DECODE_CUSTOM (0xfe00, 0xb400, t16_decode_push),
	326	/* POP 1011 110x xxxx xxxx */
	327	DECODE_CUSTOM (0xfe00, 0xbc00, t16_decode_pop),
	328
3f92dfed JM	329	/*
	330	* If-Then, and hints
	331	* 1011 1111 xxxx xxxx
	332	*/
	333
	334	/* YIELD 1011 1111 0001 0000 */
	335	DECODE_OR (0xffff, 0xbf10),
	336	/* SEV 1011 1111 0100 0000 */
	337	DECODE_EMULATE (0xffff, 0xbf40, kprobe_emulate_none),
	338	/* NOP 1011 1111 0000 0000 */
	339	/* WFE 1011 1111 0010 0000 */
	340	/* WFI 1011 1111 0011 0000 */
	341	DECODE_SIMULATE (0xffcf, 0xbf00, kprobe_simulate_nop),
	342	/* Unassigned hints 1011 1111 xxxx 0000 */
	343	DECODE_REJECT (0xff0f, 0xbf00),
5b94faf8 JM	344	/* IT 1011 1111 xxxx xxxx */
5b94faf8 JM	345	DECODE_CUSTOM (0xff00, 0xbf00, t16_decode_it),
3f92dfed JM	346
	347	DECODE_END
	348	};
	349
	350	const union decode_item kprobe_decode_thumb16_table[] = {
	351
02d194f6 JM	352	/*
	353	* Shift (immediate), add, subtract, move, and compare
	354	* 00xx xxxx xxxx xxxx
	355	*/
	356
	357	/* CMP (immediate) 0010 1xxx xxxx xxxx */
	358	DECODE_EMULATE (0xf800, 0x2800, t16_emulate_loregs_rwflags),
	359
	360	/* ADD (register) 0001 100x xxxx xxxx */
	361	/* SUB (register) 0001 101x xxxx xxxx */
	362	/* LSL (immediate) 0000 0xxx xxxx xxxx */
	363	/* LSR (immediate) 0000 1xxx xxxx xxxx */
	364	/* ASR (immediate) 0001 0xxx xxxx xxxx */
	365	/* ADD (immediate, Thumb) 0001 110x xxxx xxxx */
	366	/* SUB (immediate, Thumb) 0001 111x xxxx xxxx */
	367	/* MOV (immediate) 0010 0xxx xxxx xxxx */
	368	/* ADD (immediate, Thumb) 0011 0xxx xxxx xxxx */
	369	/* SUB (immediate, Thumb) 0011 1xxx xxxx xxxx */
	370	DECODE_EMULATE (0xc000, 0x0000, t16_emulate_loregs_noitrwflags),
	371
	372	/*
	373	* 16-bit Thumb data-processing instructions
	374	* 0100 00xx xxxx xxxx
	375	*/
	376
	377	/* TST (register) 0100 0010 00xx xxxx */
	378	DECODE_EMULATE (0xffc0, 0x4200, t16_emulate_loregs_rwflags),
	379	/* CMP (register) 0100 0010 10xx xxxx */
	380	/* CMN (register) 0100 0010 11xx xxxx */
	381	DECODE_EMULATE (0xff80, 0x4280, t16_emulate_loregs_rwflags),
	382	/* AND (register) 0100 0000 00xx xxxx */
	383	/* EOR (register) 0100 0000 01xx xxxx */
	384	/* LSL (register) 0100 0000 10xx xxxx */
	385	/* LSR (register) 0100 0000 11xx xxxx */
	386	/* ASR (register) 0100 0001 00xx xxxx */
	387	/* ADC (register) 0100 0001 01xx xxxx */
	388	/* SBC (register) 0100 0001 10xx xxxx */
	389	/* ROR (register) 0100 0001 11xx xxxx */
	390	/* RSB (immediate) 0100 0010 01xx xxxx */
	391	/* ORR (register) 0100 0011 00xx xxxx */
	392	/* MUL 0100 0011 00xx xxxx */
	393	/* BIC (register) 0100 0011 10xx xxxx */
	394	/* MVN (register) 0100 0011 10xx xxxx */
	395	DECODE_EMULATE (0xfc00, 0x4000, t16_emulate_loregs_noitrwflags),
	396
a9c3c29e JM	397	/*
	398	* Special data instructions and branch and exchange
	399	* 0100 01xx xxxx xxxx
	400	*/
	401
	402	/* BLX pc 0100 0111 1111 1xxx */
	403	DECODE_REJECT (0xfff8, 0x47f8),
	404
	405	/* BX (register) 0100 0111 0xxx xxxx */
	406	/* BLX (register) 0100 0111 1xxx xxxx */
	407	DECODE_SIMULATE (0xff00, 0x4700, t16_simulate_bxblx),
	408
3b5940e8 JM	409	/* ADD pc, pc 0100 0100 1111 1111 */
	410	DECODE_REJECT (0xffff, 0x44ff),
	411
	412	/* ADD (register) 0100 0100 xxxx xxxx */
	413	/* CMP (register) 0100 0101 xxxx xxxx */
	414	/* MOV (register) 0100 0110 xxxx xxxx */
	415	DECODE_CUSTOM (0xfc00, 0x4400, t16_decode_hiregs),
	416
f8695142 JM	417	/*
	418	* Load from Literal Pool
	419	* LDR (literal) 0100 1xxx xxxx xxxx
	420	*/
	421	DECODE_SIMULATE (0xf800, 0x4800, t16_simulate_ldr_literal),
	422
	423	/*
	424	* 16-bit Thumb Load/store instructions
	425	* 0101 xxxx xxxx xxxx
	426	* 011x xxxx xxxx xxxx
	427	* 100x xxxx xxxx xxxx
	428	*/
	429
	430	/* STR (register) 0101 000x xxxx xxxx */
	431	/* STRH (register) 0101 001x xxxx xxxx */
	432	/* STRB (register) 0101 010x xxxx xxxx */
	433	/* LDRSB (register) 0101 011x xxxx xxxx */
	434	/* LDR (register) 0101 100x xxxx xxxx */
	435	/* LDRH (register) 0101 101x xxxx xxxx */
	436	/* LDRB (register) 0101 110x xxxx xxxx */
	437	/* LDRSH (register) 0101 111x xxxx xxxx */
	438	/* STR (immediate, Thumb) 0110 0xxx xxxx xxxx */
	439	/* LDR (immediate, Thumb) 0110 1xxx xxxx xxxx */
	440	/* STRB (immediate, Thumb) 0111 0xxx xxxx xxxx */
	441	/* LDRB (immediate, Thumb) 0111 1xxx xxxx xxxx */
	442	DECODE_EMULATE (0xc000, 0x4000, t16_emulate_loregs_rwflags),
	443	/* STRH (immediate, Thumb) 1000 0xxx xxxx xxxx */
	444	/* LDRH (immediate, Thumb) 1000 1xxx xxxx xxxx */
	445	DECODE_EMULATE (0xf000, 0x8000, t16_emulate_loregs_rwflags),
	446	/* STR (immediate, Thumb) 1001 0xxx xxxx xxxx */
	447	/* LDR (immediate, Thumb) 1001 1xxx xxxx xxxx */
	448	DECODE_SIMULATE (0xf000, 0x9000, t16_simulate_ldrstr_sp_relative),
	449
2f335829 JM	450	/*
	451	* Generate PC-/SP-relative address
	452	* ADR (literal) 1010 0xxx xxxx xxxx
	453	* ADD (SP plus immediate) 1010 1xxx xxxx xxxx
	454	*/
	455	DECODE_SIMULATE (0xf000, 0xa000, t16_simulate_reladr),
	456
3f92dfed JM	457	/*
	458	* Miscellaneous 16-bit instructions
	459	* 1011 xxxx xxxx xxxx
	460	*/
	461	DECODE_TABLE (0xf000, 0xb000, t16_table_1011),
	462
f8695142 JM	463	/* STM 1100 0xxx xxxx xxxx */
	464	/* LDM 1100 1xxx xxxx xxxx */
	465	DECODE_EMULATE (0xf000, 0xc000, t16_emulate_loregs_rwflags),
	466
44495667 JM	467	/*
	468	* Conditional branch, and Supervisor Call
	469	*/
	470
	471	/* Permanently UNDEFINED 1101 1110 xxxx xxxx */
	472	/* SVC 1101 1111 xxxx xxxx */
	473	DECODE_REJECT (0xfe00, 0xde00),
	474
3f92dfed JM	475	DECODE_END
	476	};
	477
eaf4f33f JM	478	static unsigned long __kprobes thumb_check_cc(unsigned long cpsr)
	479	{
	480	if (unlikely(in_it_block(cpsr)))
	481	return kprobe_condition_checks[current_cond(cpsr)](cpsr);
	482	return true;
	483	}
	484
c6a7d97d JM	485	static void __kprobes thumb16_singlestep(struct kprobe p, struct pt_regs regs)
	486	{
	487	regs->ARM_pc += 2;
	488	p->ainsn.insn_handler(p, regs);
	489	regs->ARM_cpsr = it_advance(regs->ARM_cpsr);
	490	}
	491
	492	static void __kprobes thumb32_singlestep(struct kprobe p, struct pt_regs regs)
	493	{
	494	regs->ARM_pc += 4;
	495	p->ainsn.insn_handler(p, regs);
	496	regs->ARM_cpsr = it_advance(regs->ARM_cpsr);
	497	}
	498
24371707 JM	499	enum kprobe_insn __kprobes
	500	thumb16_kprobe_decode_insn(kprobe_opcode_t insn, struct arch_specific_insn *asi)
	501	{
c6a7d97d	502	asi->insn_singlestep = thumb16_singlestep;
eaf4f33f	503	asi->insn_check_cc = thumb_check_cc;
3f92dfed	504	return kprobe_decode_insn(insn, asi, kprobe_decode_thumb16_table, true);
24371707 JM	505	}
	506
	507	enum kprobe_insn __kprobes
	508	thumb32_kprobe_decode_insn(kprobe_opcode_t insn, struct arch_specific_insn *asi)
	509	{
c6a7d97d	510	asi->insn_singlestep = thumb32_singlestep;
eaf4f33f	511	asi->insn_check_cc = thumb_check_cc;
24371707 JM	512	return INSN_REJECTED;
24371707 JM	513	}