arch/arm/probes/decode-arm.c

   1 // SPDX-License-Identifier: GPL-2.0-only
   2 /*
   3  *
   4  * arch/arm/probes/decode-arm.c
   5  *
   6  * Some code moved here from arch/arm/kernel/kprobes-arm.c
   7  *
   8  * Copyright (C) 2006, 2007 Motorola Inc.
   9  */
  10
  11 #include <linux/kernel.h>
  12 #include <linux/module.h>
  13 #include <linux/stddef.h>
  14 #include <linux/ptrace.h>
  15
  16 #include "decode.h"
  17 #include "decode-arm.h"
  18
  19 #define sign_extend(x, signbit) ((x) | (0 - ((x) & (1 << (signbit)))))
  20
  21 #define branch_displacement(insn) sign_extend(((insn) & 0xffffff) << 2, 25)
  22
  23 /*
  24  * To avoid the complications of mimicing single-stepping on a
  25  * processor without a Next-PC or a single-step mode, and to
  26  * avoid having to deal with the side-effects of boosting, we
  27  * simulate or emulate (almost) all ARM instructions.
  28  *
  29  * "Simulation" is where the instruction's behavior is duplicated in
  30  * C code.  "Emulation" is where the original instruction is rewritten
  31  * and executed, often by altering its registers.
  32  *
  33  * By having all behavior of the kprobe'd instruction completed before
  34  * returning from the kprobe_handler(), all locks (scheduler and
  35  * interrupt) can safely be released.  There is no need for secondary
  36  * breakpoints, no race with MP or preemptable kernels, nor having to
  37  * clean up resources counts at a later time impacting overall system
  38  * performance.  By rewriting the instruction, only the minimum registers
  39  * need to be loaded and saved back optimizing performance.
  40  *
  41  * Calling the insnslot_*_rwflags version of a function doesn't hurt
  42  * anything even when the CPSR flags aren't updated by the
  43  * instruction.  It's just a little slower in return for saving
  44  * a little space by not having a duplicate function that doesn't
  45  * update the flags.  (The same optimization can be said for
  46  * instructions that do or don't perform register writeback)
  47  * Also, instructions can either read the flags, only write the
  48  * flags, or read and write the flags.  To save combinations
  49  * rather than for sheer performance, flag functions just assume
  50  * read and write of flags.
  51  */
  52
  53 void __kprobes simulate_bbl(probes_opcode_t insn,
  54                 struct arch_probes_insn *asi, struct pt_regs *regs)
  55 {
  56         long iaddr = (long) regs->ARM_pc - 4;
  57         int disp  = branch_displacement(insn);
  58
  59         if (insn & (1 << 24))
  60                 regs->ARM_lr = iaddr + 4;
  61
  62         regs->ARM_pc = iaddr + 8 + disp;
  63 }
  64
  65 void __kprobes simulate_blx1(probes_opcode_t insn,
  66                 struct arch_probes_insn *asi, struct pt_regs *regs)
  67 {
  68         long iaddr = (long) regs->ARM_pc - 4;
  69         int disp = branch_displacement(insn);
  70
  71         regs->ARM_lr = iaddr + 4;
  72         regs->ARM_pc = iaddr + 8 + disp + ((insn >> 23) & 0x2);
  73         regs->ARM_cpsr |= PSR_T_BIT;
  74 }
  75
  76 void __kprobes simulate_blx2bx(probes_opcode_t insn,
  77                 struct arch_probes_insn *asi, struct pt_regs *regs)
  78 {
  79         int rm = insn & 0xf;
  80         long rmv = regs->uregs[rm];
  81
  82         if (insn & (1 << 5))
  83                 regs->ARM_lr = (long) regs->ARM_pc;
  84
  85         regs->ARM_pc = rmv & ~0x1;
  86         regs->ARM_cpsr &= ~PSR_T_BIT;
  87         if (rmv & 0x1)
  88                 regs->ARM_cpsr |= PSR_T_BIT;
  89 }
  90
  91 void __kprobes simulate_mrs(probes_opcode_t insn,
  92                 struct arch_probes_insn *asi, struct pt_regs *regs)
  93 {
  94         int rd = (insn >> 12) & 0xf;
  95         unsigned long mask = 0xf8ff03df; /* Mask out execution state */
  96         regs->uregs[rd] = regs->ARM_cpsr & mask;
  97 }
  98
  99 void __kprobes simulate_mov_ipsp(probes_opcode_t insn,
 100                 struct arch_probes_insn *asi, struct pt_regs *regs)
 101 {
 102         regs->uregs[12] = regs->uregs[13];
 103 }
 104
 105 /*
 106  * For the instruction masking and comparisons in all the "space_*"
 107  * functions below, Do _not_ rearrange the order of tests unless
 108  * you're very, very sure of what you are doing.  For the sake of
 109  * efficiency, the masks for some tests sometimes assume other test
 110  * have been done prior to them so the number of patterns to test
 111  * for an instruction set can be as broad as possible to reduce the
 112  * number of tests needed.
 113  */
 114
 115 static const union decode_item arm_1111_table[] = {
 116         /* Unconditional instructions                                   */
 117
 118         /* memory hint          1111 0100 x001 xxxx xxxx xxxx xxxx xxxx */
 119         /* PLDI (immediate)     1111 0100 x101 xxxx xxxx xxxx xxxx xxxx */
 120         /* PLDW (immediate)     1111 0101 x001 xxxx xxxx xxxx xxxx xxxx */
 121         /* PLD (immediate)      1111 0101 x101 xxxx xxxx xxxx xxxx xxxx */
 122         DECODE_SIMULATE (0xfe300000, 0xf4100000, PROBES_PRELOAD_IMM),
 123
 124         /* memory hint          1111 0110 x001 xxxx xxxx xxxx xxx0 xxxx */
 125         /* PLDI (register)      1111 0110 x101 xxxx xxxx xxxx xxx0 xxxx */
 126         /* PLDW (register)      1111 0111 x001 xxxx xxxx xxxx xxx0 xxxx */
 127         /* PLD (register)       1111 0111 x101 xxxx xxxx xxxx xxx0 xxxx */
 128         DECODE_SIMULATE (0xfe300010, 0xf6100000, PROBES_PRELOAD_REG),
 129
 130         /* BLX (immediate)      1111 101x xxxx xxxx xxxx xxxx xxxx xxxx */
 131         DECODE_SIMULATE (0xfe000000, 0xfa000000, PROBES_BRANCH_IMM),
 132
 133         /* CPS                  1111 0001 0000 xxx0 xxxx xxxx xx0x xxxx */
 134         /* SETEND               1111 0001 0000 0001 xxxx xxxx 0000 xxxx */
 135         /* SRS                  1111 100x x1x0 xxxx xxxx xxxx xxxx xxxx */
 136         /* RFE                  1111 100x x0x1 xxxx xxxx xxxx xxxx xxxx */
 137
 138         /* Coprocessor instructions... */
 139         /* MCRR2                1111 1100 0100 xxxx xxxx xxxx xxxx xxxx */
 140         /* MRRC2                1111 1100 0101 xxxx xxxx xxxx xxxx xxxx */
 141         /* LDC2                 1111 110x xxx1 xxxx xxxx xxxx xxxx xxxx */
 142         /* STC2                 1111 110x xxx0 xxxx xxxx xxxx xxxx xxxx */
 143         /* CDP2                 1111 1110 xxxx xxxx xxxx xxxx xxx0 xxxx */
 144         /* MCR2                 1111 1110 xxx0 xxxx xxxx xxxx xxx1 xxxx */
 145         /* MRC2                 1111 1110 xxx1 xxxx xxxx xxxx xxx1 xxxx */
 146
 147         /* Other unallocated instructions...                            */
 148         DECODE_END
 149 };
 150
 151 static const union decode_item arm_cccc_0001_0xx0____0xxx_table[] = {
 152         /* Miscellaneous instructions                                   */
 153
 154         /* MRS cpsr             cccc 0001 0000 xxxx xxxx xxxx 0000 xxxx */
 155         DECODE_SIMULATEX(0x0ff000f0, 0x01000000, PROBES_MRS,
 156                                                  REGS(0, NOPC, 0, 0, 0)),
 157
 158         /* BX                   cccc 0001 0010 xxxx xxxx xxxx 0001 xxxx */
 159         DECODE_SIMULATE (0x0ff000f0, 0x01200010, PROBES_BRANCH_REG),
 160
 161         /* BLX (register)       cccc 0001 0010 xxxx xxxx xxxx 0011 xxxx */
 162         DECODE_SIMULATEX(0x0ff000f0, 0x01200030, PROBES_BRANCH_REG,
 163                                                  REGS(0, 0, 0, 0, NOPC)),
 164
 165         /* CLZ                  cccc 0001 0110 xxxx xxxx xxxx 0001 xxxx */
 166         DECODE_EMULATEX (0x0ff000f0, 0x01600010, PROBES_CLZ,
 167                                                  REGS(0, NOPC, 0, 0, NOPC)),
 168
 169         /* QADD                 cccc 0001 0000 xxxx xxxx xxxx 0101 xxxx */
 170         /* QSUB                 cccc 0001 0010 xxxx xxxx xxxx 0101 xxxx */
 171         /* QDADD                cccc 0001 0100 xxxx xxxx xxxx 0101 xxxx */
 172         /* QDSUB                cccc 0001 0110 xxxx xxxx xxxx 0101 xxxx */
 173         DECODE_EMULATEX (0x0f9000f0, 0x01000050, PROBES_SATURATING_ARITHMETIC,
 174                                                  REGS(NOPC, NOPC, 0, 0, NOPC)),
 175
 176         /* BXJ                  cccc 0001 0010 xxxx xxxx xxxx 0010 xxxx */
 177         /* MSR                  cccc 0001 0x10 xxxx xxxx xxxx 0000 xxxx */
 178         /* MRS spsr             cccc 0001 0100 xxxx xxxx xxxx 0000 xxxx */
 179         /* BKPT                 1110 0001 0010 xxxx xxxx xxxx 0111 xxxx */
 180         /* SMC                  cccc 0001 0110 xxxx xxxx xxxx 0111 xxxx */
 181         /* And unallocated instructions...                              */
 182         DECODE_END
 183 };
 184
 185 static const union decode_item arm_cccc_0001_0xx0____1xx0_table[] = {
 186         /* Halfword multiply and multiply-accumulate                    */
 187
 188         /* SMLALxy              cccc 0001 0100 xxxx xxxx xxxx 1xx0 xxxx */
 189         DECODE_EMULATEX (0x0ff00090, 0x01400080, PROBES_MUL1,
 190                                                  REGS(NOPC, NOPC, NOPC, 0, NOPC)),
 191
 192         /* SMULWy               cccc 0001 0010 xxxx xxxx xxxx 1x10 xxxx */
 193         DECODE_OR       (0x0ff000b0, 0x012000a0),
 194         /* SMULxy               cccc 0001 0110 xxxx xxxx xxxx 1xx0 xxxx */
 195         DECODE_EMULATEX (0x0ff00090, 0x01600080, PROBES_MUL2,
 196                                                  REGS(NOPC, 0, NOPC, 0, NOPC)),
 197
 198         /* SMLAxy               cccc 0001 0000 xxxx xxxx xxxx 1xx0 xxxx */
 199         DECODE_OR       (0x0ff00090, 0x01000080),
 200         /* SMLAWy               cccc 0001 0010 xxxx xxxx xxxx 1x00 xxxx */
 201         DECODE_EMULATEX (0x0ff000b0, 0x01200080, PROBES_MUL2,
 202                                                  REGS(NOPC, NOPC, NOPC, 0, NOPC)),
 203
 204         DECODE_END
 205 };
 206
 207 static const union decode_item arm_cccc_0000_____1001_table[] = {
 208         /* Multiply and multiply-accumulate                             */
 209
 210         /* MUL                  cccc 0000 0000 xxxx xxxx xxxx 1001 xxxx */
 211         /* MULS                 cccc 0000 0001 xxxx xxxx xxxx 1001 xxxx */
 212         DECODE_EMULATEX (0x0fe000f0, 0x00000090, PROBES_MUL2,
 213                                                  REGS(NOPC, 0, NOPC, 0, NOPC)),
 214
 215         /* MLA                  cccc 0000 0010 xxxx xxxx xxxx 1001 xxxx */
 216         /* MLAS                 cccc 0000 0011 xxxx xxxx xxxx 1001 xxxx */
 217         DECODE_OR       (0x0fe000f0, 0x00200090),
 218         /* MLS                  cccc 0000 0110 xxxx xxxx xxxx 1001 xxxx */
 219         DECODE_EMULATEX (0x0ff000f0, 0x00600090, PROBES_MUL2,
 220                                                  REGS(NOPC, NOPC, NOPC, 0, NOPC)),
 221
 222         /* UMAAL                cccc 0000 0100 xxxx xxxx xxxx 1001 xxxx */
 223         DECODE_OR       (0x0ff000f0, 0x00400090),
 224         /* UMULL                cccc 0000 1000 xxxx xxxx xxxx 1001 xxxx */
 225         /* UMULLS               cccc 0000 1001 xxxx xxxx xxxx 1001 xxxx */
 226         /* UMLAL                cccc 0000 1010 xxxx xxxx xxxx 1001 xxxx */
 227         /* UMLALS               cccc 0000 1011 xxxx xxxx xxxx 1001 xxxx */
 228         /* SMULL                cccc 0000 1100 xxxx xxxx xxxx 1001 xxxx */
 229         /* SMULLS               cccc 0000 1101 xxxx xxxx xxxx 1001 xxxx */
 230         /* SMLAL                cccc 0000 1110 xxxx xxxx xxxx 1001 xxxx */
 231         /* SMLALS               cccc 0000 1111 xxxx xxxx xxxx 1001 xxxx */
 232         DECODE_EMULATEX (0x0f8000f0, 0x00800090, PROBES_MUL1,
 233                                                  REGS(NOPC, NOPC, NOPC, 0, NOPC)),
 234
 235         DECODE_END
 236 };
 237
 238 static const union decode_item arm_cccc_0001_____1001_table[] = {
 239         /* Synchronization primitives                                   */
 240
 241 #if __LINUX_ARM_ARCH__ < 6
 242         /* Deprecated on ARMv6 and may be UNDEFINED on v7               */
 243         /* SMP/SWPB             cccc 0001 0x00 xxxx xxxx xxxx 1001 xxxx */
 244         DECODE_EMULATEX (0x0fb000f0, 0x01000090, PROBES_SWP,
 245                                                  REGS(NOPC, NOPC, 0, 0, NOPC)),
 246 #endif
 247         /* LDREX/STREX{,D,B,H}  cccc 0001 1xxx xxxx xxxx xxxx 1001 xxxx */
 248         /* And unallocated instructions...                              */
 249         DECODE_END
 250 };
 251
 252 static const union decode_item arm_cccc_000x_____1xx1_table[] = {
 253         /* Extra load/store instructions                                */
 254
 255         /* STRHT                cccc 0000 xx10 xxxx xxxx xxxx 1011 xxxx */
 256         /* ???                  cccc 0000 xx10 xxxx xxxx xxxx 11x1 xxxx */
 257         /* LDRHT                cccc 0000 xx11 xxxx xxxx xxxx 1011 xxxx */
 258         /* LDRSBT               cccc 0000 xx11 xxxx xxxx xxxx 1101 xxxx */
 259         /* LDRSHT               cccc 0000 xx11 xxxx xxxx xxxx 1111 xxxx */
 260         DECODE_REJECT   (0x0f200090, 0x00200090),
 261
 262         /* LDRD/STRD lr,pc,{... cccc 000x x0x0 xxxx 111x xxxx 1101 xxxx */
 263         DECODE_REJECT   (0x0e10e0d0, 0x0000e0d0),
 264
 265         /* LDRD (register)      cccc 000x x0x0 xxxx xxxx xxxx 1101 xxxx */
 266         /* STRD (register)      cccc 000x x0x0 xxxx xxxx xxxx 1111 xxxx */
 267         DECODE_EMULATEX (0x0e5000d0, 0x000000d0, PROBES_LDRSTRD,
 268                                                  REGS(NOPCWB, NOPCX, 0, 0, NOPC)),
 269
 270         /* LDRD (immediate)     cccc 000x x1x0 xxxx xxxx xxxx 1101 xxxx */
 271         /* STRD (immediate)     cccc 000x x1x0 xxxx xxxx xxxx 1111 xxxx */
 272         DECODE_EMULATEX (0x0e5000d0, 0x004000d0, PROBES_LDRSTRD,
 273                                                  REGS(NOPCWB, NOPCX, 0, 0, 0)),
 274
 275         /* STRH (register)      cccc 000x x0x0 xxxx xxxx xxxx 1011 xxxx */
 276         DECODE_EMULATEX (0x0e5000f0, 0x000000b0, PROBES_STORE_EXTRA,
 277                                                  REGS(NOPCWB, NOPC, 0, 0, NOPC)),
 278
 279         /* LDRH (register)      cccc 000x x0x1 xxxx xxxx xxxx 1011 xxxx */
 280         /* LDRSB (register)     cccc 000x x0x1 xxxx xxxx xxxx 1101 xxxx */
 281         /* LDRSH (register)     cccc 000x x0x1 xxxx xxxx xxxx 1111 xxxx */
 282         DECODE_EMULATEX (0x0e500090, 0x00100090, PROBES_LOAD_EXTRA,
 283                                                  REGS(NOPCWB, NOPC, 0, 0, NOPC)),
 284
 285         /* STRH (immediate)     cccc 000x x1x0 xxxx xxxx xxxx 1011 xxxx */
 286         DECODE_EMULATEX (0x0e5000f0, 0x004000b0, PROBES_STORE_EXTRA,
 287                                                  REGS(NOPCWB, NOPC, 0, 0, 0)),
 288
 289         /* LDRH (immediate)     cccc 000x x1x1 xxxx xxxx xxxx 1011 xxxx */
 290         /* LDRSB (immediate)    cccc 000x x1x1 xxxx xxxx xxxx 1101 xxxx */
 291         /* LDRSH (immediate)    cccc 000x x1x1 xxxx xxxx xxxx 1111 xxxx */
 292         DECODE_EMULATEX (0x0e500090, 0x00500090, PROBES_LOAD_EXTRA,
 293                                                  REGS(NOPCWB, NOPC, 0, 0, 0)),
 294
 295         DECODE_END
 296 };
 297
 298 static const union decode_item arm_cccc_000x_table[] = {
 299         /* Data-processing (register)                                   */
 300
 301         /* <op>S PC, ...        cccc 000x xxx1 xxxx 1111 xxxx xxxx xxxx */
 302         DECODE_REJECT   (0x0e10f000, 0x0010f000),
 303
 304         /* MOV IP, SP           1110 0001 1010 0000 1100 0000 0000 1101 */
 305         DECODE_SIMULATE (0xffffffff, 0xe1a0c00d, PROBES_MOV_IP_SP),
 306
 307         /* TST (register)       cccc 0001 0001 xxxx xxxx xxxx xxx0 xxxx */
 308         /* TEQ (register)       cccc 0001 0011 xxxx xxxx xxxx xxx0 xxxx */
 309         /* CMP (register)       cccc 0001 0101 xxxx xxxx xxxx xxx0 xxxx */
 310         /* CMN (register)       cccc 0001 0111 xxxx xxxx xxxx xxx0 xxxx */
 311         DECODE_EMULATEX (0x0f900010, 0x01100000, PROBES_DATA_PROCESSING_REG,
 312                                                  REGS(ANY, 0, 0, 0, ANY)),
 313
 314         /* MOV (register)       cccc 0001 101x xxxx xxxx xxxx xxx0 xxxx */
 315         /* MVN (register)       cccc 0001 111x xxxx xxxx xxxx xxx0 xxxx */
 316         DECODE_EMULATEX (0x0fa00010, 0x01a00000, PROBES_DATA_PROCESSING_REG,
 317                                                  REGS(0, ANY, 0, 0, ANY)),
 318
 319         /* AND (register)       cccc 0000 000x xxxx xxxx xxxx xxx0 xxxx */
 320         /* EOR (register)       cccc 0000 001x xxxx xxxx xxxx xxx0 xxxx */
 321         /* SUB (register)       cccc 0000 010x xxxx xxxx xxxx xxx0 xxxx */
 322         /* RSB (register)       cccc 0000 011x xxxx xxxx xxxx xxx0 xxxx */
 323         /* ADD (register)       cccc 0000 100x xxxx xxxx xxxx xxx0 xxxx */
 324         /* ADC (register)       cccc 0000 101x xxxx xxxx xxxx xxx0 xxxx */
 325         /* SBC (register)       cccc 0000 110x xxxx xxxx xxxx xxx0 xxxx */
 326         /* RSC (register)       cccc 0000 111x xxxx xxxx xxxx xxx0 xxxx */
 327         /* ORR (register)       cccc 0001 100x xxxx xxxx xxxx xxx0 xxxx */
 328         /* BIC (register)       cccc 0001 110x xxxx xxxx xxxx xxx0 xxxx */
 329         DECODE_EMULATEX (0x0e000010, 0x00000000, PROBES_DATA_PROCESSING_REG,
 330                                                  REGS(ANY, ANY, 0, 0, ANY)),
 331
 332         /* TST (reg-shift reg)  cccc 0001 0001 xxxx xxxx xxxx 0xx1 xxxx */
 333         /* TEQ (reg-shift reg)  cccc 0001 0011 xxxx xxxx xxxx 0xx1 xxxx */
 334         /* CMP (reg-shift reg)  cccc 0001 0101 xxxx xxxx xxxx 0xx1 xxxx */
 335         /* CMN (reg-shift reg)  cccc 0001 0111 xxxx xxxx xxxx 0xx1 xxxx */
 336         DECODE_EMULATEX (0x0f900090, 0x01100010, PROBES_DATA_PROCESSING_REG,
 337                                                  REGS(NOPC, 0, NOPC, 0, NOPC)),
 338
 339         /* MOV (reg-shift reg)  cccc 0001 101x xxxx xxxx xxxx 0xx1 xxxx */
 340         /* MVN (reg-shift reg)  cccc 0001 111x xxxx xxxx xxxx 0xx1 xxxx */
 341         DECODE_EMULATEX (0x0fa00090, 0x01a00010, PROBES_DATA_PROCESSING_REG,
 342                                                  REGS(0, NOPC, NOPC, 0, NOPC)),
 343
 344         /* AND (reg-shift reg)  cccc 0000 000x xxxx xxxx xxxx 0xx1 xxxx */
 345         /* EOR (reg-shift reg)  cccc 0000 001x xxxx xxxx xxxx 0xx1 xxxx */
 346         /* SUB (reg-shift reg)  cccc 0000 010x xxxx xxxx xxxx 0xx1 xxxx */
 347         /* RSB (reg-shift reg)  cccc 0000 011x xxxx xxxx xxxx 0xx1 xxxx */
 348         /* ADD (reg-shift reg)  cccc 0000 100x xxxx xxxx xxxx 0xx1 xxxx */
 349         /* ADC (reg-shift reg)  cccc 0000 101x xxxx xxxx xxxx 0xx1 xxxx */
 350         /* SBC (reg-shift reg)  cccc 0000 110x xxxx xxxx xxxx 0xx1 xxxx */
 351         /* RSC (reg-shift reg)  cccc 0000 111x xxxx xxxx xxxx 0xx1 xxxx */
 352         /* ORR (reg-shift reg)  cccc 0001 100x xxxx xxxx xxxx 0xx1 xxxx */
 353         /* BIC (reg-shift reg)  cccc 0001 110x xxxx xxxx xxxx 0xx1 xxxx */
 354         DECODE_EMULATEX (0x0e000090, 0x00000010, PROBES_DATA_PROCESSING_REG,
 355                                                  REGS(NOPC, NOPC, NOPC, 0, NOPC)),
 356
 357         DECODE_END
 358 };
 359
 360 static const union decode_item arm_cccc_001x_table[] = {
 361         /* Data-processing (immediate)                                  */
 362
 363         /* MOVW                 cccc 0011 0000 xxxx xxxx xxxx xxxx xxxx */
 364         /* MOVT                 cccc 0011 0100 xxxx xxxx xxxx xxxx xxxx */
 365         DECODE_EMULATEX (0x0fb00000, 0x03000000, PROBES_MOV_HALFWORD,
 366                                                  REGS(0, NOPC, 0, 0, 0)),
 367
 368         /* YIELD                cccc 0011 0010 0000 xxxx xxxx 0000 0001 */
 369         DECODE_OR       (0x0fff00ff, 0x03200001),
 370         /* SEV                  cccc 0011 0010 0000 xxxx xxxx 0000 0100 */
 371         DECODE_EMULATE  (0x0fff00ff, 0x03200004, PROBES_SEV),
 372         /* NOP                  cccc 0011 0010 0000 xxxx xxxx 0000 0000 */
 373         /* WFE                  cccc 0011 0010 0000 xxxx xxxx 0000 0010 */
 374         /* WFI                  cccc 0011 0010 0000 xxxx xxxx 0000 0011 */
 375         DECODE_SIMULATE (0x0fff00fc, 0x03200000, PROBES_WFE),
 376         /* DBG                  cccc 0011 0010 0000 xxxx xxxx ffff xxxx */
 377         /* unallocated hints    cccc 0011 0010 0000 xxxx xxxx xxxx xxxx */
 378         /* MSR (immediate)      cccc 0011 0x10 xxxx xxxx xxxx xxxx xxxx */
 379         DECODE_REJECT   (0x0fb00000, 0x03200000),
 380
 381         /* <op>S PC, ...        cccc 001x xxx1 xxxx 1111 xxxx xxxx xxxx */
 382         DECODE_REJECT   (0x0e10f000, 0x0210f000),
 383
 384         /* TST (immediate)      cccc 0011 0001 xxxx xxxx xxxx xxxx xxxx */
 385         /* TEQ (immediate)      cccc 0011 0011 xxxx xxxx xxxx xxxx xxxx */
 386         /* CMP (immediate)      cccc 0011 0101 xxxx xxxx xxxx xxxx xxxx */
 387         /* CMN (immediate)      cccc 0011 0111 xxxx xxxx xxxx xxxx xxxx */
 388         DECODE_EMULATEX (0x0f900000, 0x03100000, PROBES_DATA_PROCESSING_IMM,
 389                                                  REGS(ANY, 0, 0, 0, 0)),
 390
 391         /* MOV (immediate)      cccc 0011 101x xxxx xxxx xxxx xxxx xxxx */
 392         /* MVN (immediate)      cccc 0011 111x xxxx xxxx xxxx xxxx xxxx */
 393         DECODE_EMULATEX (0x0fa00000, 0x03a00000, PROBES_DATA_PROCESSING_IMM,
 394                                                  REGS(0, ANY, 0, 0, 0)),
 395
 396         /* AND (immediate)      cccc 0010 000x xxxx xxxx xxxx xxxx xxxx */
 397         /* EOR (immediate)      cccc 0010 001x xxxx xxxx xxxx xxxx xxxx */
 398         /* SUB (immediate)      cccc 0010 010x xxxx xxxx xxxx xxxx xxxx */
 399         /* RSB (immediate)      cccc 0010 011x xxxx xxxx xxxx xxxx xxxx */
 400         /* ADD (immediate)      cccc 0010 100x xxxx xxxx xxxx xxxx xxxx */
 401         /* ADC (immediate)      cccc 0010 101x xxxx xxxx xxxx xxxx xxxx */
 402         /* SBC (immediate)      cccc 0010 110x xxxx xxxx xxxx xxxx xxxx */
 403         /* RSC (immediate)      cccc 0010 111x xxxx xxxx xxxx xxxx xxxx */
 404         /* ORR (immediate)      cccc 0011 100x xxxx xxxx xxxx xxxx xxxx */
 405         /* BIC (immediate)      cccc 0011 110x xxxx xxxx xxxx xxxx xxxx */
 406         DECODE_EMULATEX (0x0e000000, 0x02000000, PROBES_DATA_PROCESSING_IMM,
 407                                                  REGS(ANY, ANY, 0, 0, 0)),
 408
 409         DECODE_END
 410 };
 411
 412 static const union decode_item arm_cccc_0110_____xxx1_table[] = {
 413         /* Media instructions                                           */
 414
 415         /* SEL                  cccc 0110 1000 xxxx xxxx xxxx 1011 xxxx */
 416         DECODE_EMULATEX (0x0ff000f0, 0x068000b0, PROBES_SATURATE,
 417                                                  REGS(NOPC, NOPC, 0, 0, NOPC)),
 418
 419         /* SSAT                 cccc 0110 101x xxxx xxxx xxxx xx01 xxxx */
 420         /* USAT                 cccc 0110 111x xxxx xxxx xxxx xx01 xxxx */
 421         DECODE_OR(0x0fa00030, 0x06a00010),
 422         /* SSAT16               cccc 0110 1010 xxxx xxxx xxxx 0011 xxxx */
 423         /* USAT16               cccc 0110 1110 xxxx xxxx xxxx 0011 xxxx */
 424         DECODE_EMULATEX (0x0fb000f0, 0x06a00030, PROBES_SATURATE,
 425                                                  REGS(0, NOPC, 0, 0, NOPC)),
 426
 427         /* REV                  cccc 0110 1011 xxxx xxxx xxxx 0011 xxxx */
 428         /* REV16                cccc 0110 1011 xxxx xxxx xxxx 1011 xxxx */
 429         /* RBIT                 cccc 0110 1111 xxxx xxxx xxxx 0011 xxxx */
 430         /* REVSH                cccc 0110 1111 xxxx xxxx xxxx 1011 xxxx */
 431         DECODE_EMULATEX (0x0fb00070, 0x06b00030, PROBES_REV,
 432                                                  REGS(0, NOPC, 0, 0, NOPC)),
 433
 434         /* ???                  cccc 0110 0x00 xxxx xxxx xxxx xxx1 xxxx */
 435         DECODE_REJECT   (0x0fb00010, 0x06000010),
 436         /* ???                  cccc 0110 0xxx xxxx xxxx xxxx 1011 xxxx */
 437         DECODE_REJECT   (0x0f8000f0, 0x060000b0),
 438         /* ???                  cccc 0110 0xxx xxxx xxxx xxxx 1101 xxxx */
 439         DECODE_REJECT   (0x0f8000f0, 0x060000d0),
 440         /* SADD16               cccc 0110 0001 xxxx xxxx xxxx 0001 xxxx */
 441         /* SADDSUBX             cccc 0110 0001 xxxx xxxx xxxx 0011 xxxx */
 442         /* SSUBADDX             cccc 0110 0001 xxxx xxxx xxxx 0101 xxxx */
 443         /* SSUB16               cccc 0110 0001 xxxx xxxx xxxx 0111 xxxx */
 444         /* SADD8                cccc 0110 0001 xxxx xxxx xxxx 1001 xxxx */
 445         /* SSUB8                cccc 0110 0001 xxxx xxxx xxxx 1111 xxxx */
 446         /* QADD16               cccc 0110 0010 xxxx xxxx xxxx 0001 xxxx */
 447         /* QADDSUBX             cccc 0110 0010 xxxx xxxx xxxx 0011 xxxx */
 448         /* QSUBADDX             cccc 0110 0010 xxxx xxxx xxxx 0101 xxxx */
 449         /* QSUB16               cccc 0110 0010 xxxx xxxx xxxx 0111 xxxx */
 450         /* QADD8                cccc 0110 0010 xxxx xxxx xxxx 1001 xxxx */
 451         /* QSUB8                cccc 0110 0010 xxxx xxxx xxxx 1111 xxxx */
 452         /* SHADD16              cccc 0110 0011 xxxx xxxx xxxx 0001 xxxx */
 453         /* SHADDSUBX            cccc 0110 0011 xxxx xxxx xxxx 0011 xxxx */
 454         /* SHSUBADDX            cccc 0110 0011 xxxx xxxx xxxx 0101 xxxx */
 455         /* SHSUB16              cccc 0110 0011 xxxx xxxx xxxx 0111 xxxx */
 456         /* SHADD8               cccc 0110 0011 xxxx xxxx xxxx 1001 xxxx */
 457         /* SHSUB8               cccc 0110 0011 xxxx xxxx xxxx 1111 xxxx */
 458         /* UADD16               cccc 0110 0101 xxxx xxxx xxxx 0001 xxxx */
 459         /* UADDSUBX             cccc 0110 0101 xxxx xxxx xxxx 0011 xxxx */
 460         /* USUBADDX             cccc 0110 0101 xxxx xxxx xxxx 0101 xxxx */
 461         /* USUB16               cccc 0110 0101 xxxx xxxx xxxx 0111 xxxx */
 462         /* UADD8                cccc 0110 0101 xxxx xxxx xxxx 1001 xxxx */
 463         /* USUB8                cccc 0110 0101 xxxx xxxx xxxx 1111 xxxx */
 464         /* UQADD16              cccc 0110 0110 xxxx xxxx xxxx 0001 xxxx */
 465         /* UQADDSUBX            cccc 0110 0110 xxxx xxxx xxxx 0011 xxxx */
 466         /* UQSUBADDX            cccc 0110 0110 xxxx xxxx xxxx 0101 xxxx */
 467         /* UQSUB16              cccc 0110 0110 xxxx xxxx xxxx 0111 xxxx */
 468         /* UQADD8               cccc 0110 0110 xxxx xxxx xxxx 1001 xxxx */
 469         /* UQSUB8               cccc 0110 0110 xxxx xxxx xxxx 1111 xxxx */
 470         /* UHADD16              cccc 0110 0111 xxxx xxxx xxxx 0001 xxxx */
 471         /* UHADDSUBX            cccc 0110 0111 xxxx xxxx xxxx 0011 xxxx */
 472         /* UHSUBADDX            cccc 0110 0111 xxxx xxxx xxxx 0101 xxxx */
 473         /* UHSUB16              cccc 0110 0111 xxxx xxxx xxxx 0111 xxxx */
 474         /* UHADD8               cccc 0110 0111 xxxx xxxx xxxx 1001 xxxx */
 475         /* UHSUB8               cccc 0110 0111 xxxx xxxx xxxx 1111 xxxx */
 476         DECODE_EMULATEX (0x0f800010, 0x06000010, PROBES_MMI,
 477                                                  REGS(NOPC, NOPC, 0, 0, NOPC)),
 478
 479         /* PKHBT                cccc 0110 1000 xxxx xxxx xxxx x001 xxxx */
 480         /* PKHTB                cccc 0110 1000 xxxx xxxx xxxx x101 xxxx */
 481         DECODE_EMULATEX (0x0ff00030, 0x06800010, PROBES_PACK,
 482                                                  REGS(NOPC, NOPC, 0, 0, NOPC)),
 483
 484         /* ???                  cccc 0110 1001 xxxx xxxx xxxx 0111 xxxx */
 485         /* ???                  cccc 0110 1101 xxxx xxxx xxxx 0111 xxxx */
 486         DECODE_REJECT   (0x0fb000f0, 0x06900070),
 487
 488         /* SXTB16               cccc 0110 1000 1111 xxxx xxxx 0111 xxxx */
 489         /* SXTB                 cccc 0110 1010 1111 xxxx xxxx 0111 xxxx */
 490         /* SXTH                 cccc 0110 1011 1111 xxxx xxxx 0111 xxxx */
 491         /* UXTB16               cccc 0110 1100 1111 xxxx xxxx 0111 xxxx */
 492         /* UXTB                 cccc 0110 1110 1111 xxxx xxxx 0111 xxxx */
 493         /* UXTH                 cccc 0110 1111 1111 xxxx xxxx 0111 xxxx */
 494         DECODE_EMULATEX (0x0f8f00f0, 0x068f0070, PROBES_EXTEND,
 495                                                  REGS(0, NOPC, 0, 0, NOPC)),
 496
 497         /* SXTAB16              cccc 0110 1000 xxxx xxxx xxxx 0111 xxxx */
 498         /* SXTAB                cccc 0110 1010 xxxx xxxx xxxx 0111 xxxx */
 499         /* SXTAH                cccc 0110 1011 xxxx xxxx xxxx 0111 xxxx */
 500         /* UXTAB16              cccc 0110 1100 xxxx xxxx xxxx 0111 xxxx */
 501         /* UXTAB                cccc 0110 1110 xxxx xxxx xxxx 0111 xxxx */
 502         /* UXTAH                cccc 0110 1111 xxxx xxxx xxxx 0111 xxxx */
 503         DECODE_EMULATEX (0x0f8000f0, 0x06800070, PROBES_EXTEND_ADD,
 504                                                  REGS(NOPCX, NOPC, 0, 0, NOPC)),
 505
 506         DECODE_END
 507 };
 508
 509 static const union decode_item arm_cccc_0111_____xxx1_table[] = {
 510         /* Media instructions                                           */
 511
 512         /* UNDEFINED            cccc 0111 1111 xxxx xxxx xxxx 1111 xxxx */
 513         DECODE_REJECT   (0x0ff000f0, 0x07f000f0),
 514
 515         /* SMLALD               cccc 0111 0100 xxxx xxxx xxxx 00x1 xxxx */
 516         /* SMLSLD               cccc 0111 0100 xxxx xxxx xxxx 01x1 xxxx */
 517         DECODE_EMULATEX (0x0ff00090, 0x07400010, PROBES_MUL_ADD_LONG,
 518                                                  REGS(NOPC, NOPC, NOPC, 0, NOPC)),
 519
 520         /* SMUAD                cccc 0111 0000 xxxx 1111 xxxx 00x1 xxxx */
 521         /* SMUSD                cccc 0111 0000 xxxx 1111 xxxx 01x1 xxxx */
 522         DECODE_OR       (0x0ff0f090, 0x0700f010),
 523         /* SMMUL                cccc 0111 0101 xxxx 1111 xxxx 00x1 xxxx */
 524         DECODE_OR       (0x0ff0f0d0, 0x0750f010),
 525         /* USAD8                cccc 0111 1000 xxxx 1111 xxxx 0001 xxxx */
 526         DECODE_EMULATEX (0x0ff0f0f0, 0x0780f010, PROBES_MUL_ADD,
 527                                                  REGS(NOPC, 0, NOPC, 0, NOPC)),
 528
 529         /* SMLAD                cccc 0111 0000 xxxx xxxx xxxx 00x1 xxxx */
 530         /* SMLSD                cccc 0111 0000 xxxx xxxx xxxx 01x1 xxxx */
 531         DECODE_OR       (0x0ff00090, 0x07000010),
 532         /* SMMLA                cccc 0111 0101 xxxx xxxx xxxx 00x1 xxxx */
 533         DECODE_OR       (0x0ff000d0, 0x07500010),
 534         /* USADA8               cccc 0111 1000 xxxx xxxx xxxx 0001 xxxx */
 535         DECODE_EMULATEX (0x0ff000f0, 0x07800010, PROBES_MUL_ADD,
 536                                                  REGS(NOPC, NOPCX, NOPC, 0, NOPC)),
 537
 538         /* SMMLS                cccc 0111 0101 xxxx xxxx xxxx 11x1 xxxx */
 539         DECODE_EMULATEX (0x0ff000d0, 0x075000d0, PROBES_MUL_ADD,
 540                                                  REGS(NOPC, NOPC, NOPC, 0, NOPC)),
 541
 542         /* SBFX                 cccc 0111 101x xxxx xxxx xxxx x101 xxxx */
 543         /* UBFX                 cccc 0111 111x xxxx xxxx xxxx x101 xxxx */
 544         DECODE_EMULATEX (0x0fa00070, 0x07a00050, PROBES_BITFIELD,
 545                                                  REGS(0, NOPC, 0, 0, NOPC)),
 546
 547         /* BFC                  cccc 0111 110x xxxx xxxx xxxx x001 1111 */
 548         DECODE_EMULATEX (0x0fe0007f, 0x07c0001f, PROBES_BITFIELD,
 549                                                  REGS(0, NOPC, 0, 0, 0)),
 550
 551         /* BFI                  cccc 0111 110x xxxx xxxx xxxx x001 xxxx */
 552         DECODE_EMULATEX (0x0fe00070, 0x07c00010, PROBES_BITFIELD,
 553                                                  REGS(0, NOPC, 0, 0, NOPCX)),
 554
 555         DECODE_END
 556 };
 557
 558 static const union decode_item arm_cccc_01xx_table[] = {
 559         /* Load/store word and unsigned byte                            */
 560
 561         /* LDRB/STRB pc,[...]   cccc 01xx x0xx xxxx xxxx xxxx xxxx xxxx */
 562         DECODE_REJECT   (0x0c40f000, 0x0440f000),
 563
 564         /* STRT                 cccc 01x0 x010 xxxx xxxx xxxx xxxx xxxx */
 565         /* LDRT                 cccc 01x0 x011 xxxx xxxx xxxx xxxx xxxx */
 566         /* STRBT                cccc 01x0 x110 xxxx xxxx xxxx xxxx xxxx */
 567         /* LDRBT                cccc 01x0 x111 xxxx xxxx xxxx xxxx xxxx */
 568         DECODE_REJECT   (0x0d200000, 0x04200000),
 569
 570         /* STR (immediate)      cccc 010x x0x0 xxxx xxxx xxxx xxxx xxxx */
 571         /* STRB (immediate)     cccc 010x x1x0 xxxx xxxx xxxx xxxx xxxx */
 572         DECODE_EMULATEX (0x0e100000, 0x04000000, PROBES_STORE,
 573                                                  REGS(NOPCWB, ANY, 0, 0, 0)),
 574
 575         /* LDR (immediate)      cccc 010x x0x1 xxxx xxxx xxxx xxxx xxxx */
 576         /* LDRB (immediate)     cccc 010x x1x1 xxxx xxxx xxxx xxxx xxxx */
 577         DECODE_EMULATEX (0x0e100000, 0x04100000, PROBES_LOAD,
 578                                                  REGS(NOPCWB, ANY, 0, 0, 0)),
 579
 580         /* STR (register)       cccc 011x x0x0 xxxx xxxx xxxx xxxx xxxx */
 581         /* STRB (register)      cccc 011x x1x0 xxxx xxxx xxxx xxxx xxxx */
 582         DECODE_EMULATEX (0x0e100000, 0x06000000, PROBES_STORE,
 583                                                  REGS(NOPCWB, ANY, 0, 0, NOPC)),
 584
 585         /* LDR (register)       cccc 011x x0x1 xxxx xxxx xxxx xxxx xxxx */
 586         /* LDRB (register)      cccc 011x x1x1 xxxx xxxx xxxx xxxx xxxx */
 587         DECODE_EMULATEX (0x0e100000, 0x06100000, PROBES_LOAD,
 588                                                  REGS(NOPCWB, ANY, 0, 0, NOPC)),
 589
 590         DECODE_END
 591 };
 592
 593 static const union decode_item arm_cccc_100x_table[] = {
 594         /* Block data transfer instructions                             */
 595
 596         /* LDM                  cccc 100x x0x1 xxxx xxxx xxxx xxxx xxxx */
 597         /* STM                  cccc 100x x0x0 xxxx xxxx xxxx xxxx xxxx */
 598         DECODE_CUSTOM   (0x0e400000, 0x08000000, PROBES_LDMSTM),
 599
 600         /* STM (user registers) cccc 100x x1x0 xxxx xxxx xxxx xxxx xxxx */
 601         /* LDM (user registers) cccc 100x x1x1 xxxx 0xxx xxxx xxxx xxxx */
 602         /* LDM (exception ret)  cccc 100x x1x1 xxxx 1xxx xxxx xxxx xxxx */
 603         DECODE_END
 604 };
 605
 606 const union decode_item probes_decode_arm_table[] = {
 607         /*
 608          * Unconditional instructions
 609          *                      1111 xxxx xxxx xxxx xxxx xxxx xxxx xxxx
 610          */
 611         DECODE_TABLE    (0xf0000000, 0xf0000000, arm_1111_table),
 612
 613         /*
 614          * Miscellaneous instructions
 615          *                      cccc 0001 0xx0 xxxx xxxx xxxx 0xxx xxxx
 616          */
 617         DECODE_TABLE    (0x0f900080, 0x01000000, arm_cccc_0001_0xx0____0xxx_table),
 618
 619         /*
 620          * Halfword multiply and multiply-accumulate
 621          *                      cccc 0001 0xx0 xxxx xxxx xxxx 1xx0 xxxx
 622          */
 623         DECODE_TABLE    (0x0f900090, 0x01000080, arm_cccc_0001_0xx0____1xx0_table),
 624
 625         /*
 626          * Multiply and multiply-accumulate
 627          *                      cccc 0000 xxxx xxxx xxxx xxxx 1001 xxxx
 628          */
 629         DECODE_TABLE    (0x0f0000f0, 0x00000090, arm_cccc_0000_____1001_table),
 630
 631         /*
 632          * Synchronization primitives
 633          *                      cccc 0001 xxxx xxxx xxxx xxxx 1001 xxxx
 634          */
 635         DECODE_TABLE    (0x0f0000f0, 0x01000090, arm_cccc_0001_____1001_table),
 636
 637         /*
 638          * Extra load/store instructions
 639          *                      cccc 000x xxxx xxxx xxxx xxxx 1xx1 xxxx
 640          */
 641         DECODE_TABLE    (0x0e000090, 0x00000090, arm_cccc_000x_____1xx1_table),
 642
 643         /*
 644          * Data-processing (register)
 645          *                      cccc 000x xxxx xxxx xxxx xxxx xxx0 xxxx
 646          * Data-processing (register-shifted register)
 647          *                      cccc 000x xxxx xxxx xxxx xxxx 0xx1 xxxx
 648          */
 649         DECODE_TABLE    (0x0e000000, 0x00000000, arm_cccc_000x_table),
 650
 651         /*
 652          * Data-processing (immediate)
 653          *                      cccc 001x xxxx xxxx xxxx xxxx xxxx xxxx
 654          */
 655         DECODE_TABLE    (0x0e000000, 0x02000000, arm_cccc_001x_table),
 656
 657         /*
 658          * Media instructions
 659          *                      cccc 011x xxxx xxxx xxxx xxxx xxx1 xxxx
 660          */
 661         DECODE_TABLE    (0x0f000010, 0x06000010, arm_cccc_0110_____xxx1_table),
 662         DECODE_TABLE    (0x0f000010, 0x07000010, arm_cccc_0111_____xxx1_table),
 663
 664         /*
 665          * Load/store word and unsigned byte
 666          *                      cccc 01xx xxxx xxxx xxxx xxxx xxxx xxxx
 667          */
 668         DECODE_TABLE    (0x0c000000, 0x04000000, arm_cccc_01xx_table),
 669
 670         /*
 671          * Block data transfer instructions
 672          *                      cccc 100x xxxx xxxx xxxx xxxx xxxx xxxx
 673          */
 674         DECODE_TABLE    (0x0e000000, 0x08000000, arm_cccc_100x_table),
 675
 676         /* B                    cccc 1010 xxxx xxxx xxxx xxxx xxxx xxxx */
 677         /* BL                   cccc 1011 xxxx xxxx xxxx xxxx xxxx xxxx */
 678         DECODE_SIMULATE (0x0e000000, 0x0a000000, PROBES_BRANCH),
 679
 680         /*
 681          * Supervisor Call, and coprocessor instructions
 682          */
 683
 684         /* MCRR                 cccc 1100 0100 xxxx xxxx xxxx xxxx xxxx */
 685         /* MRRC                 cccc 1100 0101 xxxx xxxx xxxx xxxx xxxx */
 686         /* LDC                  cccc 110x xxx1 xxxx xxxx xxxx xxxx xxxx */
 687         /* STC                  cccc 110x xxx0 xxxx xxxx xxxx xxxx xxxx */
 688         /* CDP                  cccc 1110 xxxx xxxx xxxx xxxx xxx0 xxxx */
 689         /* MCR                  cccc 1110 xxx0 xxxx xxxx xxxx xxx1 xxxx */
 690         /* MRC                  cccc 1110 xxx1 xxxx xxxx xxxx xxx1 xxxx */
 691         /* SVC                  cccc 1111 xxxx xxxx xxxx xxxx xxxx xxxx */
 692         DECODE_REJECT   (0x0c000000, 0x0c000000),
 693
 694         DECODE_END
 695 };
 696 #ifdef CONFIG_ARM_KPROBES_TEST_MODULE
 697 EXPORT_SYMBOL_GPL(probes_decode_arm_table);
 698 #endif
 699
 700 static void __kprobes arm_singlestep(probes_opcode_t insn,
 701                 struct arch_probes_insn *asi, struct pt_regs *regs)
 702 {
 703         regs->ARM_pc += 4;
 704         asi->insn_handler(insn, asi, regs);
 705 }
 706
 707 /* Return:
 708  *   INSN_REJECTED     If instruction is one not allowed to kprobe,
 709  *   INSN_GOOD         If instruction is supported and uses instruction slot,
 710  *   INSN_GOOD_NO_SLOT If instruction is supported but doesn't use its slot.
 711  *
 712  * For instructions we don't want to kprobe (INSN_REJECTED return result):
 713  *   These are generally ones that modify the processor state making
 714  *   them "hard" to simulate such as switches processor modes or
 715  *   make accesses in alternate modes.  Any of these could be simulated
 716  *   if the work was put into it, but low return considering they
 717  *   should also be very rare.
 718  */
 719 enum probes_insn __kprobes
 720 arm_probes_decode_insn(probes_opcode_t insn, struct arch_probes_insn *asi,
 721                        bool emulate, const union decode_action *actions,
 722                        const struct decode_checker *checkers[])
 723 {
 724         asi->insn_singlestep = arm_singlestep;
 725         asi->insn_check_cc = probes_condition_checks[insn>>28];
 726         return probes_decode_insn(insn, asi, probes_decode_arm_table, false,
 727                                   emulate, actions, checkers);
 728 }