0001
0002
0003
0004
0005
0006
0007
0008
0009
0010
0011
0012
0013
0014
0015
0016
0017
0018
0019
0020
0021
0022
0023
0024
0025
0026
0027
0028
0029
0030
0031
0032
0033
0034
0035
0036
0037
0038
0039
0040
0041
0042
0043
0044
0045
0046
0047
0048
0049
0050
0051
0052
0053
0054
0055
0056
0057
0058
0059
0060
0061
0062
0063
0064
0065
0066
0067
0068
0069
0070
0071
0072
0073
0074
0075
0076
0077
0078
0079
0080
0081
0082
0083
0084
0085
0086
0087
0088
0089
0090
0091
0092
0093
0094
0095
0096
0097
0098
0099
0100
0101
0102
0103
0104
0105
0106
0107
0108
0109
0110
0111
0112
0113
0114
0115
0116
0117
0118
0119
0120
0121
0122
0123
0124
0125
0126
0127
0128
0129
0130
0131
0132
0133
0134
0135
0136
0137
0138
0139
0140
0141
0142
0143
0144
0145
0146
0147
0148
0149
0150
0151
0152
0153
0154
0155
0156
0157
0158
0159
0160
0161
0162
0163
0164
0165
0166
0167
0168
0169
0170
0171
0172
0173
0174
0175
0176
0177
0178
0179
0180
0181
0182
0183
0184
0185
0186
0187
0188
0189
0190
0191
0192
0193
0194
0195
0196
0197
0198
0199
0200 #include <linux/kernel.h>
0201 #include <linux/module.h>
0202 #include <linux/slab.h>
0203 #include <linux/sched/clock.h>
0204 #include <linux/kprobes.h>
0205 #include <linux/errno.h>
0206 #include <linux/stddef.h>
0207 #include <linux/bug.h>
0208 #include <asm/opcodes.h>
0209
0210 #include "core.h"
0211 #include "test-core.h"
0212 #include "../decode-arm.h"
0213 #include "../decode-thumb.h"
0214
0215
0216 #define BENCHMARKING 1
0217
0218
0219
0220
0221
0222
0223 static bool test_regs_ok;
0224 static int test_func_instance;
0225 static int pre_handler_called;
0226 static int post_handler_called;
0227 static int kretprobe_handler_called;
0228 static int tests_failed;
0229
0230 #define FUNC_ARG1 0x12345678
0231 #define FUNC_ARG2 0xabcdef
0232
0233
0234 #ifndef CONFIG_THUMB2_KERNEL
0235
0236 #define RET(reg) "mov pc, "#reg
0237
0238 long arm_func(long r0, long r1);
0239
0240 static void __used __naked __arm_kprobes_test_func(void)
0241 {
0242 __asm__ __volatile__ (
0243 ".arm \n\t"
0244 ".type arm_func, %%function \n\t"
0245 "arm_func: \n\t"
0246 "adds r0, r0, r1 \n\t"
0247 "mov pc, lr \n\t"
0248 ".code "NORMAL_ISA
0249 : : : "r0", "r1", "cc"
0250 );
0251 }
0252
0253 #else
0254
0255 #define RET(reg) "bx "#reg
0256
0257 long thumb16_func(long r0, long r1);
0258 long thumb32even_func(long r0, long r1);
0259 long thumb32odd_func(long r0, long r1);
0260
0261 static void __used __naked __thumb_kprobes_test_funcs(void)
0262 {
0263 __asm__ __volatile__ (
0264 ".type thumb16_func, %%function \n\t"
0265 "thumb16_func: \n\t"
0266 "adds.n r0, r0, r1 \n\t"
0267 "bx lr \n\t"
0268
0269 ".align \n\t"
0270 ".type thumb32even_func, %%function \n\t"
0271 "thumb32even_func: \n\t"
0272 "adds.w r0, r0, r1 \n\t"
0273 "bx lr \n\t"
0274
0275 ".align \n\t"
0276 "nop.n \n\t"
0277 ".type thumb32odd_func, %%function \n\t"
0278 "thumb32odd_func: \n\t"
0279 "adds.w r0, r0, r1 \n\t"
0280 "bx lr \n\t"
0281
0282 : : : "r0", "r1", "cc"
0283 );
0284 }
0285
0286 #endif
0287
0288
0289 static int call_test_func(long (*func)(long, long), bool check_test_regs)
0290 {
0291 long ret;
0292
0293 ++test_func_instance;
0294 test_regs_ok = false;
0295
0296 ret = (*func)(FUNC_ARG1, FUNC_ARG2);
0297 if (ret != FUNC_ARG1 + FUNC_ARG2) {
0298 pr_err("FAIL: call_test_func: func returned %lx\n", ret);
0299 return false;
0300 }
0301
0302 if (check_test_regs && !test_regs_ok) {
0303 pr_err("FAIL: test regs not OK\n");
0304 return false;
0305 }
0306
0307 return true;
0308 }
0309
0310 static int __kprobes pre_handler(struct kprobe *p, struct pt_regs *regs)
0311 {
0312 pre_handler_called = test_func_instance;
0313 if (regs->ARM_r0 == FUNC_ARG1 && regs->ARM_r1 == FUNC_ARG2)
0314 test_regs_ok = true;
0315 return 0;
0316 }
0317
0318 static void __kprobes post_handler(struct kprobe *p, struct pt_regs *regs,
0319 unsigned long flags)
0320 {
0321 post_handler_called = test_func_instance;
0322 if (regs->ARM_r0 != FUNC_ARG1 + FUNC_ARG2 || regs->ARM_r1 != FUNC_ARG2)
0323 test_regs_ok = false;
0324 }
0325
0326 static struct kprobe the_kprobe = {
0327 .addr = 0,
0328 .pre_handler = pre_handler,
0329 .post_handler = post_handler
0330 };
0331
0332 static int test_kprobe(long (*func)(long, long))
0333 {
0334 int ret;
0335
0336 the_kprobe.addr = (kprobe_opcode_t *)func;
0337 ret = register_kprobe(&the_kprobe);
0338 if (ret < 0) {
0339 pr_err("FAIL: register_kprobe failed with %d\n", ret);
0340 return ret;
0341 }
0342
0343 ret = call_test_func(func, true);
0344
0345 unregister_kprobe(&the_kprobe);
0346 the_kprobe.flags = 0;
0347
0348 if (!ret)
0349 return -EINVAL;
0350 if (pre_handler_called != test_func_instance) {
0351 pr_err("FAIL: kprobe pre_handler not called\n");
0352 return -EINVAL;
0353 }
0354 if (post_handler_called != test_func_instance) {
0355 pr_err("FAIL: kprobe post_handler not called\n");
0356 return -EINVAL;
0357 }
0358 if (!call_test_func(func, false))
0359 return -EINVAL;
0360 if (pre_handler_called == test_func_instance ||
0361 post_handler_called == test_func_instance) {
0362 pr_err("FAIL: probe called after unregistering\n");
0363 return -EINVAL;
0364 }
0365
0366 return 0;
0367 }
0368
0369 static int __kprobes
0370 kretprobe_handler(struct kretprobe_instance *ri, struct pt_regs *regs)
0371 {
0372 kretprobe_handler_called = test_func_instance;
0373 if (regs_return_value(regs) == FUNC_ARG1 + FUNC_ARG2)
0374 test_regs_ok = true;
0375 return 0;
0376 }
0377
0378 static struct kretprobe the_kretprobe = {
0379 .handler = kretprobe_handler,
0380 };
0381
0382 static int test_kretprobe(long (*func)(long, long))
0383 {
0384 int ret;
0385
0386 the_kretprobe.kp.addr = (kprobe_opcode_t *)func;
0387 ret = register_kretprobe(&the_kretprobe);
0388 if (ret < 0) {
0389 pr_err("FAIL: register_kretprobe failed with %d\n", ret);
0390 return ret;
0391 }
0392
0393 ret = call_test_func(func, true);
0394
0395 unregister_kretprobe(&the_kretprobe);
0396 the_kretprobe.kp.flags = 0;
0397
0398 if (!ret)
0399 return -EINVAL;
0400 if (kretprobe_handler_called != test_func_instance) {
0401 pr_err("FAIL: kretprobe handler not called\n");
0402 return -EINVAL;
0403 }
0404 if (!call_test_func(func, false))
0405 return -EINVAL;
0406 if (kretprobe_handler_called == test_func_instance) {
0407 pr_err("FAIL: kretprobe called after unregistering\n");
0408 return -EINVAL;
0409 }
0410
0411 return 0;
0412 }
0413
0414 static int run_api_tests(long (*func)(long, long))
0415 {
0416 int ret;
0417
0418 pr_info(" kprobe\n");
0419 ret = test_kprobe(func);
0420 if (ret < 0)
0421 return ret;
0422
0423 pr_info(" kretprobe\n");
0424 ret = test_kretprobe(func);
0425 if (ret < 0)
0426 return ret;
0427
0428 return 0;
0429 }
0430
0431
0432
0433
0434
0435
0436 #if BENCHMARKING
0437
0438 static void __naked benchmark_nop(void)
0439 {
0440 __asm__ __volatile__ (
0441 "nop \n\t"
0442 RET(lr)" \n\t"
0443 );
0444 }
0445
0446 #ifdef CONFIG_THUMB2_KERNEL
0447 #define wide ".w"
0448 #else
0449 #define wide
0450 #endif
0451
0452 static void __naked benchmark_pushpop1(void)
0453 {
0454 __asm__ __volatile__ (
0455 "stmdb"wide" sp!, {r3-r11,lr} \n\t"
0456 "ldmia"wide" sp!, {r3-r11,pc}"
0457 );
0458 }
0459
0460 static void __naked benchmark_pushpop2(void)
0461 {
0462 __asm__ __volatile__ (
0463 "stmdb"wide" sp!, {r0-r8,lr} \n\t"
0464 "ldmia"wide" sp!, {r0-r8,pc}"
0465 );
0466 }
0467
0468 static void __naked benchmark_pushpop3(void)
0469 {
0470 __asm__ __volatile__ (
0471 "stmdb"wide" sp!, {r4,lr} \n\t"
0472 "ldmia"wide" sp!, {r4,pc}"
0473 );
0474 }
0475
0476 static void __naked benchmark_pushpop4(void)
0477 {
0478 __asm__ __volatile__ (
0479 "stmdb"wide" sp!, {r0,lr} \n\t"
0480 "ldmia"wide" sp!, {r0,pc}"
0481 );
0482 }
0483
0484
0485 #ifdef CONFIG_THUMB2_KERNEL
0486
0487 static void __naked benchmark_pushpop_thumb(void)
0488 {
0489 __asm__ __volatile__ (
0490 "push.n {r0-r7,lr} \n\t"
0491 "pop.n {r0-r7,pc}"
0492 );
0493 }
0494
0495 #endif
0496
0497 static int __kprobes
0498 benchmark_pre_handler(struct kprobe *p, struct pt_regs *regs)
0499 {
0500 return 0;
0501 }
0502
0503 static int benchmark(void(*fn)(void))
0504 {
0505 unsigned n, i, t, t0;
0506
0507 for (n = 1000; ; n *= 2) {
0508 t0 = sched_clock();
0509 for (i = n; i > 0; --i)
0510 fn();
0511 t = sched_clock() - t0;
0512 if (t >= 250000000)
0513 break;
0514 }
0515 return t / n;
0516 };
0517
0518 static int kprobe_benchmark(void(*fn)(void), unsigned offset)
0519 {
0520 struct kprobe k = {
0521 .addr = (kprobe_opcode_t *)((uintptr_t)fn + offset),
0522 .pre_handler = benchmark_pre_handler,
0523 };
0524
0525 int ret = register_kprobe(&k);
0526 if (ret < 0) {
0527 pr_err("FAIL: register_kprobe failed with %d\n", ret);
0528 return ret;
0529 }
0530
0531 ret = benchmark(fn);
0532
0533 unregister_kprobe(&k);
0534 return ret;
0535 };
0536
0537 struct benchmarks {
0538 void (*fn)(void);
0539 unsigned offset;
0540 const char *title;
0541 };
0542
0543 static int run_benchmarks(void)
0544 {
0545 int ret;
0546 struct benchmarks list[] = {
0547 {&benchmark_nop, 0, "nop"},
0548
0549
0550
0551
0552
0553 {&benchmark_pushpop1, 0, "stmdb sp!, {r3-r11,lr}"},
0554 {&benchmark_pushpop1, 4, "ldmia sp!, {r3-r11,pc}"},
0555 {&benchmark_pushpop2, 0, "stmdb sp!, {r0-r8,lr}"},
0556 {&benchmark_pushpop2, 4, "ldmia sp!, {r0-r8,pc}"},
0557 {&benchmark_pushpop3, 0, "stmdb sp!, {r4,lr}"},
0558 {&benchmark_pushpop3, 4, "ldmia sp!, {r4,pc}"},
0559 {&benchmark_pushpop4, 0, "stmdb sp!, {r0,lr}"},
0560 {&benchmark_pushpop4, 4, "ldmia sp!, {r0,pc}"},
0561 #ifdef CONFIG_THUMB2_KERNEL
0562 {&benchmark_pushpop_thumb, 0, "push.n {r0-r7,lr}"},
0563 {&benchmark_pushpop_thumb, 2, "pop.n {r0-r7,pc}"},
0564 #endif
0565 {0}
0566 };
0567
0568 struct benchmarks *b;
0569 for (b = list; b->fn; ++b) {
0570 ret = kprobe_benchmark(b->fn, b->offset);
0571 if (ret < 0)
0572 return ret;
0573 pr_info(" %dns for kprobe %s\n", ret, b->title);
0574 }
0575
0576 pr_info("\n");
0577 return 0;
0578 }
0579
0580 #endif
0581
0582
0583
0584
0585
0586
0587 static const int decode_struct_sizes[NUM_DECODE_TYPES] = {
0588 [DECODE_TYPE_TABLE] = sizeof(struct decode_table),
0589 [DECODE_TYPE_CUSTOM] = sizeof(struct decode_custom),
0590 [DECODE_TYPE_SIMULATE] = sizeof(struct decode_simulate),
0591 [DECODE_TYPE_EMULATE] = sizeof(struct decode_emulate),
0592 [DECODE_TYPE_OR] = sizeof(struct decode_or),
0593 [DECODE_TYPE_REJECT] = sizeof(struct decode_reject)
0594 };
0595
0596 static int table_iter(const union decode_item *table,
0597 int (*fn)(const struct decode_header *, void *),
0598 void *args)
0599 {
0600 const struct decode_header *h = (struct decode_header *)table;
0601 int result;
0602
0603 for (;;) {
0604 enum decode_type type = h->type_regs.bits & DECODE_TYPE_MASK;
0605
0606 if (type == DECODE_TYPE_END)
0607 return 0;
0608
0609 result = fn(h, args);
0610 if (result)
0611 return result;
0612
0613 h = (struct decode_header *)
0614 ((uintptr_t)h + decode_struct_sizes[type]);
0615
0616 }
0617 }
0618
0619 static int table_test_fail(const struct decode_header *h, const char* message)
0620 {
0621
0622 pr_err("FAIL: kprobes test failure \"%s\" (mask %08x, value %08x)\n",
0623 message, h->mask.bits, h->value.bits);
0624 return -EINVAL;
0625 }
0626
0627 struct table_test_args {
0628 const union decode_item *root_table;
0629 u32 parent_mask;
0630 u32 parent_value;
0631 };
0632
0633 static int table_test_fn(const struct decode_header *h, void *args)
0634 {
0635 struct table_test_args *a = (struct table_test_args *)args;
0636 enum decode_type type = h->type_regs.bits & DECODE_TYPE_MASK;
0637
0638 if (h->value.bits & ~h->mask.bits)
0639 return table_test_fail(h, "Match value has bits not in mask");
0640
0641 if ((h->mask.bits & a->parent_mask) != a->parent_mask)
0642 return table_test_fail(h, "Mask has bits not in parent mask");
0643
0644 if ((h->value.bits ^ a->parent_value) & a->parent_mask)
0645 return table_test_fail(h, "Value is inconsistent with parent");
0646
0647 if (type == DECODE_TYPE_TABLE) {
0648 struct decode_table *d = (struct decode_table *)h;
0649 struct table_test_args args2 = *a;
0650 args2.parent_mask = h->mask.bits;
0651 args2.parent_value = h->value.bits;
0652 return table_iter(d->table.table, table_test_fn, &args2);
0653 }
0654
0655 return 0;
0656 }
0657
0658 static int table_test(const union decode_item *table)
0659 {
0660 struct table_test_args args = {
0661 .root_table = table,
0662 .parent_mask = 0,
0663 .parent_value = 0
0664 };
0665 return table_iter(args.root_table, table_test_fn, &args);
0666 }
0667
0668
0669
0670
0671
0672
0673
0674
0675
0676
0677
0678
0679
0680
0681
0682
0683
0684
0685
0686 bool coverage_fail;
0687
0688 #define MAX_COVERAGE_ENTRIES 256
0689
0690 struct coverage_entry {
0691 const struct decode_header *header;
0692 unsigned regs;
0693 unsigned nesting;
0694 char matched;
0695 };
0696
0697 struct coverage_table {
0698 struct coverage_entry *base;
0699 unsigned num_entries;
0700 unsigned nesting;
0701 };
0702
0703 struct coverage_table coverage;
0704
0705 #define COVERAGE_ANY_REG (1<<0)
0706 #define COVERAGE_SP (1<<1)
0707 #define COVERAGE_PC (1<<2)
0708 #define COVERAGE_PCWB (1<<3)
0709
0710 static const char coverage_register_lookup[16] = {
0711 [REG_TYPE_ANY] = COVERAGE_ANY_REG | COVERAGE_SP | COVERAGE_PC,
0712 [REG_TYPE_SAMEAS16] = COVERAGE_ANY_REG,
0713 [REG_TYPE_SP] = COVERAGE_SP,
0714 [REG_TYPE_PC] = COVERAGE_PC,
0715 [REG_TYPE_NOSP] = COVERAGE_ANY_REG | COVERAGE_SP,
0716 [REG_TYPE_NOSPPC] = COVERAGE_ANY_REG | COVERAGE_SP | COVERAGE_PC,
0717 [REG_TYPE_NOPC] = COVERAGE_ANY_REG | COVERAGE_PC,
0718 [REG_TYPE_NOPCWB] = COVERAGE_ANY_REG | COVERAGE_PC | COVERAGE_PCWB,
0719 [REG_TYPE_NOPCX] = COVERAGE_ANY_REG,
0720 [REG_TYPE_NOSPPCX] = COVERAGE_ANY_REG | COVERAGE_SP,
0721 };
0722
0723 unsigned coverage_start_registers(const struct decode_header *h)
0724 {
0725 unsigned regs = 0;
0726 int i;
0727 for (i = 0; i < 20; i += 4) {
0728 int r = (h->type_regs.bits >> (DECODE_TYPE_BITS + i)) & 0xf;
0729 regs |= coverage_register_lookup[r] << i;
0730 }
0731 return regs;
0732 }
0733
0734 static int coverage_start_fn(const struct decode_header *h, void *args)
0735 {
0736 struct coverage_table *coverage = (struct coverage_table *)args;
0737 enum decode_type type = h->type_regs.bits & DECODE_TYPE_MASK;
0738 struct coverage_entry *entry = coverage->base + coverage->num_entries;
0739
0740 if (coverage->num_entries == MAX_COVERAGE_ENTRIES - 1) {
0741 pr_err("FAIL: Out of space for test coverage data");
0742 return -ENOMEM;
0743 }
0744
0745 ++coverage->num_entries;
0746
0747 entry->header = h;
0748 entry->regs = coverage_start_registers(h);
0749 entry->nesting = coverage->nesting;
0750 entry->matched = false;
0751
0752 if (type == DECODE_TYPE_TABLE) {
0753 struct decode_table *d = (struct decode_table *)h;
0754 int ret;
0755 ++coverage->nesting;
0756 ret = table_iter(d->table.table, coverage_start_fn, coverage);
0757 --coverage->nesting;
0758 return ret;
0759 }
0760
0761 return 0;
0762 }
0763
0764 static int coverage_start(const union decode_item *table)
0765 {
0766 coverage.base = kmalloc_array(MAX_COVERAGE_ENTRIES,
0767 sizeof(struct coverage_entry),
0768 GFP_KERNEL);
0769 coverage.num_entries = 0;
0770 coverage.nesting = 0;
0771 return table_iter(table, coverage_start_fn, &coverage);
0772 }
0773
0774 static void
0775 coverage_add_registers(struct coverage_entry *entry, kprobe_opcode_t insn)
0776 {
0777 int regs = entry->header->type_regs.bits >> DECODE_TYPE_BITS;
0778 int i;
0779 for (i = 0; i < 20; i += 4) {
0780 enum decode_reg_type reg_type = (regs >> i) & 0xf;
0781 int reg = (insn >> i) & 0xf;
0782 int flag;
0783
0784 if (!reg_type)
0785 continue;
0786
0787 if (reg == 13)
0788 flag = COVERAGE_SP;
0789 else if (reg == 15)
0790 flag = COVERAGE_PC;
0791 else
0792 flag = COVERAGE_ANY_REG;
0793 entry->regs &= ~(flag << i);
0794
0795 switch (reg_type) {
0796
0797 case REG_TYPE_NONE:
0798 case REG_TYPE_ANY:
0799 case REG_TYPE_SAMEAS16:
0800 break;
0801
0802 case REG_TYPE_SP:
0803 if (reg != 13)
0804 return;
0805 break;
0806
0807 case REG_TYPE_PC:
0808 if (reg != 15)
0809 return;
0810 break;
0811
0812 case REG_TYPE_NOSP:
0813 if (reg == 13)
0814 return;
0815 break;
0816
0817 case REG_TYPE_NOSPPC:
0818 case REG_TYPE_NOSPPCX:
0819 if (reg == 13 || reg == 15)
0820 return;
0821 break;
0822
0823 case REG_TYPE_NOPCWB:
0824 if (!is_writeback(insn))
0825 break;
0826 if (reg == 15) {
0827 entry->regs &= ~(COVERAGE_PCWB << i);
0828 return;
0829 }
0830 break;
0831
0832 case REG_TYPE_NOPC:
0833 case REG_TYPE_NOPCX:
0834 if (reg == 15)
0835 return;
0836 break;
0837 }
0838
0839 }
0840 }
0841
0842 static void coverage_add(kprobe_opcode_t insn)
0843 {
0844 struct coverage_entry *entry = coverage.base;
0845 struct coverage_entry *end = coverage.base + coverage.num_entries;
0846 bool matched = false;
0847 unsigned nesting = 0;
0848
0849 for (; entry < end; ++entry) {
0850 const struct decode_header *h = entry->header;
0851 enum decode_type type = h->type_regs.bits & DECODE_TYPE_MASK;
0852
0853 if (entry->nesting > nesting)
0854 continue;
0855
0856 if (entry->nesting < nesting)
0857 break;
0858
0859 if (!matched) {
0860 if ((insn & h->mask.bits) != h->value.bits)
0861 continue;
0862 entry->matched = true;
0863 }
0864
0865 switch (type) {
0866
0867 case DECODE_TYPE_TABLE:
0868 ++nesting;
0869 break;
0870
0871 case DECODE_TYPE_CUSTOM:
0872 case DECODE_TYPE_SIMULATE:
0873 case DECODE_TYPE_EMULATE:
0874 coverage_add_registers(entry, insn);
0875 return;
0876
0877 case DECODE_TYPE_OR:
0878 matched = true;
0879 break;
0880
0881 case DECODE_TYPE_REJECT:
0882 default:
0883 return;
0884 }
0885
0886 }
0887 }
0888
0889 static void coverage_end(void)
0890 {
0891 struct coverage_entry *entry = coverage.base;
0892 struct coverage_entry *end = coverage.base + coverage.num_entries;
0893
0894 for (; entry < end; ++entry) {
0895 u32 mask = entry->header->mask.bits;
0896 u32 value = entry->header->value.bits;
0897
0898 if (entry->regs) {
0899 pr_err("FAIL: Register test coverage missing for %08x %08x (%05x)\n",
0900 mask, value, entry->regs);
0901 coverage_fail = true;
0902 }
0903 if (!entry->matched) {
0904 pr_err("FAIL: Test coverage entry missing for %08x %08x\n",
0905 mask, value);
0906 coverage_fail = true;
0907 }
0908 }
0909
0910 kfree(coverage.base);
0911 }
0912
0913
0914
0915
0916
0917
0918 void __naked __kprobes_test_case_start(void)
0919 {
0920 __asm__ __volatile__ (
0921 "mov r2, sp \n\t"
0922 "bic r3, r2, #7 \n\t"
0923 "mov sp, r3 \n\t"
0924 "stmdb sp!, {r2-r11} \n\t"
0925 "sub sp, sp, #"__stringify(TEST_MEMORY_SIZE)"\n\t"
0926 "bic r0, lr, #1 @ r0 = inline data \n\t"
0927 "mov r1, sp \n\t"
0928 "bl kprobes_test_case_start \n\t"
0929 RET(r0)" \n\t"
0930 );
0931 }
0932
0933 #ifndef CONFIG_THUMB2_KERNEL
0934
0935 void __naked __kprobes_test_case_end_32(void)
0936 {
0937 __asm__ __volatile__ (
0938 "mov r4, lr \n\t"
0939 "bl kprobes_test_case_end \n\t"
0940 "cmp r0, #0 \n\t"
0941 "movne pc, r0 \n\t"
0942 "mov r0, r4 \n\t"
0943 "add sp, sp, #"__stringify(TEST_MEMORY_SIZE)"\n\t"
0944 "ldmia sp!, {r2-r11} \n\t"
0945 "mov sp, r2 \n\t"
0946 "mov pc, r0 \n\t"
0947 );
0948 }
0949
0950 #else
0951
0952 void __naked __kprobes_test_case_end_16(void)
0953 {
0954 __asm__ __volatile__ (
0955 "mov r4, lr \n\t"
0956 "bl kprobes_test_case_end \n\t"
0957 "cmp r0, #0 \n\t"
0958 "bxne r0 \n\t"
0959 "mov r0, r4 \n\t"
0960 "add sp, sp, #"__stringify(TEST_MEMORY_SIZE)"\n\t"
0961 "ldmia sp!, {r2-r11} \n\t"
0962 "mov sp, r2 \n\t"
0963 "bx r0 \n\t"
0964 );
0965 }
0966
0967 void __naked __kprobes_test_case_end_32(void)
0968 {
0969 __asm__ __volatile__ (
0970 ".arm \n\t"
0971 "orr lr, lr, #1 @ will return to Thumb code \n\t"
0972 "ldr pc, 1f \n\t"
0973 "1: \n\t"
0974 ".word __kprobes_test_case_end_16 \n\t"
0975 );
0976 }
0977
0978 #endif
0979
0980
0981 int kprobe_test_flags;
0982 int kprobe_test_cc_position;
0983
0984 static int test_try_count;
0985 static int test_pass_count;
0986 static int test_fail_count;
0987
0988 static struct pt_regs initial_regs;
0989 static struct pt_regs expected_regs;
0990 static struct pt_regs result_regs;
0991
0992 static u32 expected_memory[TEST_MEMORY_SIZE/sizeof(u32)];
0993
0994 static const char *current_title;
0995 static struct test_arg *current_args;
0996 static u32 *current_stack;
0997 static uintptr_t current_branch_target;
0998
0999 static uintptr_t current_code_start;
1000 static kprobe_opcode_t current_instruction;
1001
1002
1003 #define TEST_CASE_PASSED -1
1004 #define TEST_CASE_FAILED -2
1005
1006 static int test_case_run_count;
1007 static bool test_case_is_thumb;
1008 static int test_instance;
1009
1010 static unsigned long test_check_cc(int cc, unsigned long cpsr)
1011 {
1012 int ret = arm_check_condition(cc << 28, cpsr);
1013
1014 return (ret != ARM_OPCODE_CONDTEST_FAIL);
1015 }
1016
1017 static int is_last_scenario;
1018 static int probe_should_run;
1019 static int memory_needs_checking;
1020
1021 static unsigned long test_context_cpsr(int scenario)
1022 {
1023 unsigned long cpsr;
1024
1025 probe_should_run = 1;
1026
1027
1028 cpsr = (scenario & 0xf) << 28;
1029 cpsr |= (scenario & 0xf) << 16;
1030 cpsr |= (scenario & 0x1) << 27;
1031
1032 if (!test_case_is_thumb) {
1033
1034 int cc = current_instruction >> 28;
1035
1036 probe_should_run = test_check_cc(cc, cpsr) != 0;
1037 if (scenario == 15)
1038 is_last_scenario = true;
1039
1040 } else if (kprobe_test_flags & TEST_FLAG_NO_ITBLOCK) {
1041
1042 if (kprobe_test_cc_position) {
1043 int cc = (current_instruction >> kprobe_test_cc_position) & 0xf;
1044 probe_should_run = test_check_cc(cc, cpsr) != 0;
1045 }
1046
1047 if (scenario == 15)
1048 is_last_scenario = true;
1049
1050 } else if (kprobe_test_flags & TEST_FLAG_FULL_ITBLOCK) {
1051
1052 unsigned x = (scenario >> 4);
1053 unsigned cond_base = x % 7;
1054 unsigned mask = x / 7 + 2;
1055
1056 if (mask > 0x1f) {
1057
1058 cond_base = 7;
1059 mask = 0x4;
1060 if ((scenario & 0xf) == 0xf)
1061 is_last_scenario = true;
1062 }
1063
1064 cpsr |= cond_base << 13;
1065 cpsr |= (mask & 0x1) << 12;
1066 cpsr |= (mask & 0x2) << 10;
1067 cpsr |= (mask & 0x4) << 8;
1068 cpsr |= (mask & 0x8) << 23;
1069 cpsr |= (mask & 0x10) << 21;
1070
1071 probe_should_run = test_check_cc((cpsr >> 12) & 0xf, cpsr) != 0;
1072
1073 } else {
1074
1075 switch (scenario) {
1076 case 16:
1077 cpsr = 0x00000800;
1078 probe_should_run = 0;
1079 break;
1080 case 17:
1081 cpsr = 0xf0007800;
1082 probe_should_run = 0;
1083 break;
1084 case 18:
1085 cpsr = 0x00009800;
1086 break;
1087 case 19:
1088 cpsr = 0xf0002800;
1089 is_last_scenario = true;
1090 break;
1091 }
1092 }
1093
1094 return cpsr;
1095 }
1096
1097 static void setup_test_context(struct pt_regs *regs)
1098 {
1099 int scenario = test_case_run_count>>1;
1100 unsigned long val;
1101 struct test_arg *args;
1102 int i;
1103
1104 is_last_scenario = false;
1105 memory_needs_checking = false;
1106
1107
1108 val = (scenario & 1) ? VALM : ~VALM;
1109 for (i = 0; i < TEST_MEMORY_SIZE / sizeof(current_stack[0]); ++i)
1110 current_stack[i] = val + (i << 8);
1111
1112 if (current_branch_target)
1113 current_stack[15] = current_branch_target;
1114
1115 current_stack[13] = (u32)current_stack + 120;
1116
1117
1118 val = (scenario & 2) ? VALR : ~VALR;
1119 for (i = 0; i < 13; ++i)
1120 regs->uregs[i] = val ^ (i << 8);
1121 regs->ARM_lr = val ^ (14 << 8);
1122 regs->ARM_cpsr &= ~(APSR_MASK | PSR_IT_MASK);
1123 regs->ARM_cpsr |= test_context_cpsr(scenario);
1124
1125
1126 args = current_args;
1127 for (; args[0].type != ARG_TYPE_END; ++args)
1128 switch (args[0].type) {
1129 case ARG_TYPE_REG: {
1130 struct test_arg_regptr *arg =
1131 (struct test_arg_regptr *)args;
1132 regs->uregs[arg->reg] = arg->val;
1133 break;
1134 }
1135 case ARG_TYPE_PTR: {
1136 struct test_arg_regptr *arg =
1137 (struct test_arg_regptr *)args;
1138 regs->uregs[arg->reg] =
1139 (unsigned long)current_stack + arg->val;
1140 memory_needs_checking = true;
1141
1142
1143
1144
1145
1146 if (arg->reg == 13)
1147 regs->ARM_cpsr |= PSR_I_BIT;
1148 break;
1149 }
1150 case ARG_TYPE_MEM: {
1151 struct test_arg_mem *arg = (struct test_arg_mem *)args;
1152 current_stack[arg->index] = arg->val;
1153 break;
1154 }
1155 default:
1156 break;
1157 }
1158 }
1159
1160 struct test_probe {
1161 struct kprobe kprobe;
1162 bool registered;
1163 int hit;
1164 };
1165
1166 static void unregister_test_probe(struct test_probe *probe)
1167 {
1168 if (probe->registered) {
1169 unregister_kprobe(&probe->kprobe);
1170 probe->kprobe.flags = 0;
1171 }
1172 probe->registered = false;
1173 }
1174
1175 static int register_test_probe(struct test_probe *probe)
1176 {
1177 int ret;
1178
1179 if (probe->registered)
1180 BUG();
1181
1182 ret = register_kprobe(&probe->kprobe);
1183 if (ret >= 0) {
1184 probe->registered = true;
1185 probe->hit = -1;
1186 }
1187 return ret;
1188 }
1189
1190 static int __kprobes
1191 test_before_pre_handler(struct kprobe *p, struct pt_regs *regs)
1192 {
1193 container_of(p, struct test_probe, kprobe)->hit = test_instance;
1194 return 0;
1195 }
1196
1197 static void __kprobes
1198 test_before_post_handler(struct kprobe *p, struct pt_regs *regs,
1199 unsigned long flags)
1200 {
1201 setup_test_context(regs);
1202 initial_regs = *regs;
1203 initial_regs.ARM_cpsr &= ~PSR_IGNORE_BITS;
1204 }
1205
1206 static int __kprobes
1207 test_case_pre_handler(struct kprobe *p, struct pt_regs *regs)
1208 {
1209 container_of(p, struct test_probe, kprobe)->hit = test_instance;
1210 return 0;
1211 }
1212
1213 static int __kprobes
1214 test_after_pre_handler(struct kprobe *p, struct pt_regs *regs)
1215 {
1216 struct test_arg *args;
1217
1218 if (container_of(p, struct test_probe, kprobe)->hit == test_instance)
1219 return 0;
1220
1221 result_regs = *regs;
1222
1223
1224 result_regs.ARM_cpsr &= ~PSR_IGNORE_BITS;
1225 for (args = current_args; args[0].type != ARG_TYPE_END; ++args)
1226 if (args[0].type == ARG_TYPE_REG_MASKED) {
1227 struct test_arg_regptr *arg =
1228 (struct test_arg_regptr *)args;
1229 result_regs.uregs[arg->reg] &= arg->val;
1230 }
1231
1232
1233 regs->ARM_sp = (unsigned long)current_stack;
1234
1235 regs->ARM_cpsr &= ~PSR_I_BIT;
1236
1237 container_of(p, struct test_probe, kprobe)->hit = test_instance;
1238 return 0;
1239 }
1240
1241 static struct test_probe test_before_probe = {
1242 .kprobe.pre_handler = test_before_pre_handler,
1243 .kprobe.post_handler = test_before_post_handler,
1244 };
1245
1246 static struct test_probe test_case_probe = {
1247 .kprobe.pre_handler = test_case_pre_handler,
1248 };
1249
1250 static struct test_probe test_after_probe = {
1251 .kprobe.pre_handler = test_after_pre_handler,
1252 };
1253
1254 static struct test_probe test_after2_probe = {
1255 .kprobe.pre_handler = test_after_pre_handler,
1256 };
1257
1258 static void test_case_cleanup(void)
1259 {
1260 unregister_test_probe(&test_before_probe);
1261 unregister_test_probe(&test_case_probe);
1262 unregister_test_probe(&test_after_probe);
1263 unregister_test_probe(&test_after2_probe);
1264 }
1265
1266 static void print_registers(struct pt_regs *regs)
1267 {
1268 pr_err("r0 %08lx | r1 %08lx | r2 %08lx | r3 %08lx\n",
1269 regs->ARM_r0, regs->ARM_r1, regs->ARM_r2, regs->ARM_r3);
1270 pr_err("r4 %08lx | r5 %08lx | r6 %08lx | r7 %08lx\n",
1271 regs->ARM_r4, regs->ARM_r5, regs->ARM_r6, regs->ARM_r7);
1272 pr_err("r8 %08lx | r9 %08lx | r10 %08lx | r11 %08lx\n",
1273 regs->ARM_r8, regs->ARM_r9, regs->ARM_r10, regs->ARM_fp);
1274 pr_err("r12 %08lx | sp %08lx | lr %08lx | pc %08lx\n",
1275 regs->ARM_ip, regs->ARM_sp, regs->ARM_lr, regs->ARM_pc);
1276 pr_err("cpsr %08lx\n", regs->ARM_cpsr);
1277 }
1278
1279 static void print_memory(u32 *mem, size_t size)
1280 {
1281 int i;
1282 for (i = 0; i < size / sizeof(u32); i += 4)
1283 pr_err("%08x %08x %08x %08x\n", mem[i], mem[i+1],
1284 mem[i+2], mem[i+3]);
1285 }
1286
1287 static size_t expected_memory_size(u32 *sp)
1288 {
1289 size_t size = sizeof(expected_memory);
1290 int offset = (uintptr_t)sp - (uintptr_t)current_stack;
1291 if (offset > 0)
1292 size -= offset;
1293 return size;
1294 }
1295
1296 static void test_case_failed(const char *message)
1297 {
1298 test_case_cleanup();
1299
1300 pr_err("FAIL: %s\n", message);
1301 pr_err("FAIL: Test %s\n", current_title);
1302 pr_err("FAIL: Scenario %d\n", test_case_run_count >> 1);
1303 }
1304
1305 static unsigned long next_instruction(unsigned long pc)
1306 {
1307 #ifdef CONFIG_THUMB2_KERNEL
1308 if ((pc & 1) &&
1309 !is_wide_instruction(__mem_to_opcode_thumb16(*(u16 *)(pc - 1))))
1310 return pc + 2;
1311 else
1312 #endif
1313 return pc + 4;
1314 }
1315
1316 static uintptr_t __used kprobes_test_case_start(const char **title, void *stack)
1317 {
1318 struct test_arg *args;
1319 struct test_arg_end *end_arg;
1320 unsigned long test_code;
1321
1322 current_title = *title++;
1323 args = (struct test_arg *)title;
1324 current_args = args;
1325 current_stack = stack;
1326
1327 ++test_try_count;
1328
1329 while (args->type != ARG_TYPE_END)
1330 ++args;
1331 end_arg = (struct test_arg_end *)args;
1332
1333 test_code = (unsigned long)(args + 1);
1334
1335 test_case_is_thumb = end_arg->flags & ARG_FLAG_THUMB;
1336 if (test_case_is_thumb)
1337 test_code |= 1;
1338
1339 current_code_start = test_code;
1340
1341 current_branch_target = 0;
1342 if (end_arg->branch_offset != end_arg->end_offset)
1343 current_branch_target = test_code + end_arg->branch_offset;
1344
1345 test_code += end_arg->code_offset;
1346 test_before_probe.kprobe.addr = (kprobe_opcode_t *)test_code;
1347
1348 test_code = next_instruction(test_code);
1349 test_case_probe.kprobe.addr = (kprobe_opcode_t *)test_code;
1350
1351 if (test_case_is_thumb) {
1352 u16 *p = (u16 *)(test_code & ~1);
1353 current_instruction = __mem_to_opcode_thumb16(p[0]);
1354 if (is_wide_instruction(current_instruction)) {
1355 u16 instr2 = __mem_to_opcode_thumb16(p[1]);
1356 current_instruction = __opcode_thumb32_compose(current_instruction, instr2);
1357 }
1358 } else {
1359 current_instruction = __mem_to_opcode_arm(*(u32 *)test_code);
1360 }
1361
1362 if (current_title[0] == '.')
1363 verbose("%s\n", current_title);
1364 else
1365 verbose("%s\t@ %0*x\n", current_title,
1366 test_case_is_thumb ? 4 : 8,
1367 current_instruction);
1368
1369 test_code = next_instruction(test_code);
1370 test_after_probe.kprobe.addr = (kprobe_opcode_t *)test_code;
1371
1372 if (kprobe_test_flags & TEST_FLAG_NARROW_INSTR) {
1373 if (!test_case_is_thumb ||
1374 is_wide_instruction(current_instruction)) {
1375 test_case_failed("expected 16-bit instruction");
1376 goto fail;
1377 }
1378 } else {
1379 if (test_case_is_thumb &&
1380 !is_wide_instruction(current_instruction)) {
1381 test_case_failed("expected 32-bit instruction");
1382 goto fail;
1383 }
1384 }
1385
1386 coverage_add(current_instruction);
1387
1388 if (end_arg->flags & ARG_FLAG_UNSUPPORTED) {
1389 if (register_test_probe(&test_case_probe) < 0)
1390 goto pass;
1391 test_case_failed("registered probe for unsupported instruction");
1392 goto fail;
1393 }
1394
1395 if (end_arg->flags & ARG_FLAG_SUPPORTED) {
1396 if (register_test_probe(&test_case_probe) >= 0)
1397 goto pass;
1398 test_case_failed("couldn't register probe for supported instruction");
1399 goto fail;
1400 }
1401
1402 if (register_test_probe(&test_before_probe) < 0) {
1403 test_case_failed("register test_before_probe failed");
1404 goto fail;
1405 }
1406 if (register_test_probe(&test_after_probe) < 0) {
1407 test_case_failed("register test_after_probe failed");
1408 goto fail;
1409 }
1410 if (current_branch_target) {
1411 test_after2_probe.kprobe.addr =
1412 (kprobe_opcode_t *)current_branch_target;
1413 if (register_test_probe(&test_after2_probe) < 0) {
1414 test_case_failed("register test_after2_probe failed");
1415 goto fail;
1416 }
1417 }
1418
1419
1420 test_case_run_count = 0;
1421 ++test_instance;
1422 return current_code_start;
1423 pass:
1424 test_case_run_count = TEST_CASE_PASSED;
1425 return (uintptr_t)test_after_probe.kprobe.addr;
1426 fail:
1427 test_case_run_count = TEST_CASE_FAILED;
1428 return (uintptr_t)test_after_probe.kprobe.addr;
1429 }
1430
1431 static bool check_test_results(void)
1432 {
1433 size_t mem_size = 0;
1434 u32 *mem = 0;
1435
1436 if (memcmp(&expected_regs, &result_regs, sizeof(expected_regs))) {
1437 test_case_failed("registers differ");
1438 goto fail;
1439 }
1440
1441 if (memory_needs_checking) {
1442 mem = (u32 *)result_regs.ARM_sp;
1443 mem_size = expected_memory_size(mem);
1444 if (memcmp(expected_memory, mem, mem_size)) {
1445 test_case_failed("test memory differs");
1446 goto fail;
1447 }
1448 }
1449
1450 return true;
1451
1452 fail:
1453 pr_err("initial_regs:\n");
1454 print_registers(&initial_regs);
1455 pr_err("expected_regs:\n");
1456 print_registers(&expected_regs);
1457 pr_err("result_regs:\n");
1458 print_registers(&result_regs);
1459
1460 if (mem) {
1461 pr_err("expected_memory:\n");
1462 print_memory(expected_memory, mem_size);
1463 pr_err("result_memory:\n");
1464 print_memory(mem, mem_size);
1465 }
1466
1467 return false;
1468 }
1469
1470 static uintptr_t __used kprobes_test_case_end(void)
1471 {
1472 if (test_case_run_count < 0) {
1473 if (test_case_run_count == TEST_CASE_PASSED)
1474
1475 goto pass;
1476 else
1477
1478 goto fail;
1479 }
1480
1481 if (test_before_probe.hit != test_instance) {
1482 test_case_failed("test_before_handler not run");
1483 goto fail;
1484 }
1485
1486 if (test_after_probe.hit != test_instance &&
1487 test_after2_probe.hit != test_instance) {
1488 test_case_failed("test_after_handler not run");
1489 goto fail;
1490 }
1491
1492
1493
1494
1495
1496
1497 if ((test_case_run_count & 1) == 0) {
1498
1499 u32 *mem = (u32 *)result_regs.ARM_sp;
1500 expected_regs = result_regs;
1501 memcpy(expected_memory, mem, expected_memory_size(mem));
1502
1503
1504 if (register_test_probe(&test_case_probe) < 0) {
1505 test_case_failed("register test_case_probe failed");
1506 goto fail;
1507 }
1508 } else {
1509
1510 if (probe_should_run == 1) {
1511 if (test_case_probe.hit != test_instance) {
1512 test_case_failed("test_case_handler not run");
1513 goto fail;
1514 }
1515 } else if (probe_should_run == 0) {
1516 if (test_case_probe.hit == test_instance) {
1517 test_case_failed("test_case_handler ran");
1518 goto fail;
1519 }
1520 }
1521
1522
1523 unregister_test_probe(&test_case_probe);
1524
1525 if (!check_test_results())
1526 goto fail;
1527
1528 if (is_last_scenario)
1529 goto pass;
1530 }
1531
1532
1533 ++test_case_run_count;
1534 ++test_instance;
1535 return current_code_start;
1536 fail:
1537 ++test_fail_count;
1538 goto end;
1539 pass:
1540 ++test_pass_count;
1541 end:
1542 test_case_cleanup();
1543 return 0;
1544 }
1545
1546
1547
1548
1549
1550
1551 static int run_test_cases(void (*tests)(void), const union decode_item *table)
1552 {
1553 int ret;
1554
1555 pr_info(" Check decoding tables\n");
1556 ret = table_test(table);
1557 if (ret)
1558 return ret;
1559
1560 pr_info(" Run test cases\n");
1561 ret = coverage_start(table);
1562 if (ret)
1563 return ret;
1564
1565 tests();
1566
1567 coverage_end();
1568 return 0;
1569 }
1570
1571
1572 static int __init run_all_tests(void)
1573 {
1574 int ret = 0;
1575
1576 pr_info("Beginning kprobe tests...\n");
1577
1578 #ifndef CONFIG_THUMB2_KERNEL
1579
1580 pr_info("Probe ARM code\n");
1581 ret = run_api_tests(arm_func);
1582 if (ret)
1583 goto out;
1584
1585 pr_info("ARM instruction simulation\n");
1586 ret = run_test_cases(kprobe_arm_test_cases, probes_decode_arm_table);
1587 if (ret)
1588 goto out;
1589
1590 #else
1591
1592 pr_info("Probe 16-bit Thumb code\n");
1593 ret = run_api_tests(thumb16_func);
1594 if (ret)
1595 goto out;
1596
1597 pr_info("Probe 32-bit Thumb code, even halfword\n");
1598 ret = run_api_tests(thumb32even_func);
1599 if (ret)
1600 goto out;
1601
1602 pr_info("Probe 32-bit Thumb code, odd halfword\n");
1603 ret = run_api_tests(thumb32odd_func);
1604 if (ret)
1605 goto out;
1606
1607 pr_info("16-bit Thumb instruction simulation\n");
1608 ret = run_test_cases(kprobe_thumb16_test_cases,
1609 probes_decode_thumb16_table);
1610 if (ret)
1611 goto out;
1612
1613 pr_info("32-bit Thumb instruction simulation\n");
1614 ret = run_test_cases(kprobe_thumb32_test_cases,
1615 probes_decode_thumb32_table);
1616 if (ret)
1617 goto out;
1618 #endif
1619
1620 pr_info("Total instruction simulation tests=%d, pass=%d fail=%d\n",
1621 test_try_count, test_pass_count, test_fail_count);
1622 if (test_fail_count) {
1623 ret = -EINVAL;
1624 goto out;
1625 }
1626
1627 #if BENCHMARKING
1628 pr_info("Benchmarks\n");
1629 ret = run_benchmarks();
1630 if (ret)
1631 goto out;
1632 #endif
1633
1634 #if __LINUX_ARM_ARCH__ >= 7
1635
1636 if (coverage_fail) {
1637 pr_err("FAIL: Test coverage checks failed\n");
1638 ret = -EINVAL;
1639 goto out;
1640 }
1641 #endif
1642
1643 out:
1644 if (ret == 0)
1645 ret = tests_failed;
1646 if (ret == 0)
1647 pr_info("Finished kprobe tests OK\n");
1648 else
1649 pr_err("kprobe tests failed\n");
1650
1651 return ret;
1652 }
1653
1654
1655
1656
1657
1658
1659 #ifdef MODULE
1660
1661 static void __exit kprobe_test_exit(void)
1662 {
1663 }
1664
1665 module_init(run_all_tests)
1666 module_exit(kprobe_test_exit)
1667 MODULE_LICENSE("GPL");
1668
1669 #else
1670
1671 late_initcall(run_all_tests);
1672
1673 #endif