1 /* 2 * several functions that help interpret ARC instructions 3 * used for unaligned accesses, kprobes and kgdb 4 * 5 * Copyright (C) 2004, 2007-2010, 2011-2012 Synopsys, Inc. (www.synopsys.com) 6 * 7 * This program is free software; you can redistribute it and/or modify 8 * it under the terms of the GNU General Public License version 2 as 9 * published by the Free Software Foundation. 10 */ 11 12 #include <linux/types.h> 13 #include <linux/kprobes.h> 14 #include <linux/slab.h> 15 #include <linux/uaccess.h> 16 #include <asm/disasm.h> 17 18 #if defined(CONFIG_KGDB) || defined(CONFIG_ARC_MISALIGN_ACCESS) || \ 19 defined(CONFIG_KPROBES) 20 21 /* disasm_instr: Analyses instruction at addr, stores 22 * findings in *state 23 */ 24 void __kprobes disasm_instr(unsigned long addr, struct disasm_state *state, 25 int userspace, struct pt_regs *regs, struct callee_regs *cregs) 26 { 27 int fieldA = 0; 28 int fieldC = 0, fieldCisReg = 0; 29 uint16_t word1 = 0, word0 = 0; 30 int subopcode, is_linked, op_format; 31 uint16_t *ins_ptr; 32 uint16_t ins_buf[4]; 33 int bytes_not_copied = 0; 34 35 memset(state, 0, sizeof(struct disasm_state)); 36 37 /* This fetches the upper part of the 32 bit instruction 38 * in both the cases of Little Endian or Big Endian configurations. */ 39 if (userspace) { 40 bytes_not_copied = copy_from_user(ins_buf, 41 (const void __user *) addr, 8); 42 if (bytes_not_copied > 6) 43 goto fault; 44 ins_ptr = ins_buf; 45 } else { 46 ins_ptr = (uint16_t *) addr; 47 } 48 49 word1 = *((uint16_t *)addr); 50 51 state->major_opcode = (word1 >> 11) & 0x1F; 52 53 /* Check if the instruction is 32 bit or 16 bit instruction */ 54 if (state->major_opcode < 0x0B) { 55 if (bytes_not_copied > 4) 56 goto fault; 57 state->instr_len = 4; 58 word0 = *((uint16_t *)(addr+2)); 59 state->words[0] = (word1 << 16) | word0; 60 } else { 61 state->instr_len = 2; 62 state->words[0] = word1; 63 } 64 65 /* Read the second word in case of limm */ 66 word1 = *((uint16_t *)(addr + state->instr_len)); 67 word0 = *((uint16_t *)(addr + state->instr_len + 2)); 68 state->words[1] = (word1 << 16) | word0; 69 70 switch (state->major_opcode) { 71 case op_Bcc: 72 state->is_branch = 1; 73 74 /* unconditional branch s25, conditional branch s21 */ 75 fieldA = (IS_BIT(state->words[0], 16)) ? 76 FIELD_s25(state->words[0]) : 77 FIELD_s21(state->words[0]); 78 79 state->delay_slot = IS_BIT(state->words[0], 5); 80 state->target = fieldA + (addr & ~0x3); 81 state->flow = direct_jump; 82 break; 83 84 case op_BLcc: 85 if (IS_BIT(state->words[0], 16)) { 86 /* Branch and Link*/ 87 /* unconditional branch s25, conditional branch s21 */ 88 fieldA = (IS_BIT(state->words[0], 17)) ? 89 (FIELD_s25(state->words[0]) & ~0x3) : 90 FIELD_s21(state->words[0]); 91 92 state->flow = direct_call; 93 } else { 94 /*Branch On Compare */ 95 fieldA = FIELD_s9(state->words[0]) & ~0x3; 96 state->flow = direct_jump; 97 } 98 99 state->delay_slot = IS_BIT(state->words[0], 5); 100 state->target = fieldA + (addr & ~0x3); 101 state->is_branch = 1; 102 break; 103 104 case op_LD: /* LD<zz> a,[b,s9] */ 105 state->write = 0; 106 state->di = BITS(state->words[0], 11, 11); 107 if (state->di) 108 break; 109 state->x = BITS(state->words[0], 6, 6); 110 state->zz = BITS(state->words[0], 7, 8); 111 state->aa = BITS(state->words[0], 9, 10); 112 state->wb_reg = FIELD_B(state->words[0]); 113 if (state->wb_reg == REG_LIMM) { 114 state->instr_len += 4; 115 state->aa = 0; 116 state->src1 = state->words[1]; 117 } else { 118 state->src1 = get_reg(state->wb_reg, regs, cregs); 119 } 120 state->src2 = FIELD_s9(state->words[0]); 121 state->dest = FIELD_A(state->words[0]); 122 state->pref = (state->dest == REG_LIMM); 123 break; 124 125 case op_ST: 126 state->write = 1; 127 state->di = BITS(state->words[0], 5, 5); 128 if (state->di) 129 break; 130 state->aa = BITS(state->words[0], 3, 4); 131 state->zz = BITS(state->words[0], 1, 2); 132 state->src1 = FIELD_C(state->words[0]); 133 if (state->src1 == REG_LIMM) { 134 state->instr_len += 4; 135 state->src1 = state->words[1]; 136 } else { 137 state->src1 = get_reg(state->src1, regs, cregs); 138 } 139 state->wb_reg = FIELD_B(state->words[0]); 140 if (state->wb_reg == REG_LIMM) { 141 state->aa = 0; 142 state->instr_len += 4; 143 state->src2 = state->words[1]; 144 } else { 145 state->src2 = get_reg(state->wb_reg, regs, cregs); 146 } 147 state->src3 = FIELD_s9(state->words[0]); 148 break; 149 150 case op_MAJOR_4: 151 subopcode = MINOR_OPCODE(state->words[0]); 152 switch (subopcode) { 153 case 32: /* Jcc */ 154 case 33: /* Jcc.D */ 155 case 34: /* JLcc */ 156 case 35: /* JLcc.D */ 157 is_linked = 0; 158 159 if (subopcode == 33 || subopcode == 35) 160 state->delay_slot = 1; 161 162 if (subopcode == 34 || subopcode == 35) 163 is_linked = 1; 164 165 fieldCisReg = 0; 166 op_format = BITS(state->words[0], 22, 23); 167 if (op_format == 0 || ((op_format == 3) && 168 (!IS_BIT(state->words[0], 5)))) { 169 fieldC = FIELD_C(state->words[0]); 170 171 if (fieldC == REG_LIMM) { 172 fieldC = state->words[1]; 173 state->instr_len += 4; 174 } else { 175 fieldCisReg = 1; 176 } 177 } else if (op_format == 1 || ((op_format == 3) 178 && (IS_BIT(state->words[0], 5)))) { 179 fieldC = FIELD_C(state->words[0]); 180 } else { 181 /* op_format == 2 */ 182 fieldC = FIELD_s12(state->words[0]); 183 } 184 185 if (!fieldCisReg) { 186 state->target = fieldC; 187 state->flow = is_linked ? 188 direct_call : direct_jump; 189 } else { 190 state->target = get_reg(fieldC, regs, cregs); 191 state->flow = is_linked ? 192 indirect_call : indirect_jump; 193 } 194 state->is_branch = 1; 195 break; 196 197 case 40: /* LPcc */ 198 if (BITS(state->words[0], 22, 23) == 3) { 199 /* Conditional LPcc u7 */ 200 fieldC = FIELD_C(state->words[0]); 201 202 fieldC = fieldC << 1; 203 fieldC += (addr & ~0x03); 204 state->is_branch = 1; 205 state->flow = direct_jump; 206 state->target = fieldC; 207 } 208 /* For Unconditional lp, next pc is the fall through 209 * which is updated */ 210 break; 211 212 case 48 ... 55: /* LD a,[b,c] */ 213 state->di = BITS(state->words[0], 15, 15); 214 if (state->di) 215 break; 216 state->x = BITS(state->words[0], 16, 16); 217 state->zz = BITS(state->words[0], 17, 18); 218 state->aa = BITS(state->words[0], 22, 23); 219 state->wb_reg = FIELD_B(state->words[0]); 220 if (state->wb_reg == REG_LIMM) { 221 state->instr_len += 4; 222 state->src1 = state->words[1]; 223 } else { 224 state->src1 = get_reg(state->wb_reg, regs, 225 cregs); 226 } 227 state->src2 = FIELD_C(state->words[0]); 228 if (state->src2 == REG_LIMM) { 229 state->instr_len += 4; 230 state->src2 = state->words[1]; 231 } else { 232 state->src2 = get_reg(state->src2, regs, 233 cregs); 234 } 235 state->dest = FIELD_A(state->words[0]); 236 if (state->dest == REG_LIMM) 237 state->pref = 1; 238 break; 239 240 case 10: /* MOV */ 241 /* still need to check for limm to extract instr len */ 242 /* MOV is special case because it only takes 2 args */ 243 switch (BITS(state->words[0], 22, 23)) { 244 case 0: /* OP a,b,c */ 245 if (FIELD_C(state->words[0]) == REG_LIMM) 246 state->instr_len += 4; 247 break; 248 case 1: /* OP a,b,u6 */ 249 break; 250 case 2: /* OP b,b,s12 */ 251 break; 252 case 3: /* OP.cc b,b,c/u6 */ 253 if ((!IS_BIT(state->words[0], 5)) && 254 (FIELD_C(state->words[0]) == REG_LIMM)) 255 state->instr_len += 4; 256 break; 257 } 258 break; 259 260 261 default: 262 /* Not a Load, Jump or Loop instruction */ 263 /* still need to check for limm to extract instr len */ 264 switch (BITS(state->words[0], 22, 23)) { 265 case 0: /* OP a,b,c */ 266 if ((FIELD_B(state->words[0]) == REG_LIMM) || 267 (FIELD_C(state->words[0]) == REG_LIMM)) 268 state->instr_len += 4; 269 break; 270 case 1: /* OP a,b,u6 */ 271 break; 272 case 2: /* OP b,b,s12 */ 273 break; 274 case 3: /* OP.cc b,b,c/u6 */ 275 if ((!IS_BIT(state->words[0], 5)) && 276 ((FIELD_B(state->words[0]) == REG_LIMM) || 277 (FIELD_C(state->words[0]) == REG_LIMM))) 278 state->instr_len += 4; 279 break; 280 } 281 break; 282 } 283 break; 284 285 /* 16 Bit Instructions */ 286 case op_LD_ADD: /* LD_S|LDB_S|LDW_S a,[b,c] */ 287 state->zz = BITS(state->words[0], 3, 4); 288 state->src1 = get_reg(FIELD_S_B(state->words[0]), regs, cregs); 289 state->src2 = get_reg(FIELD_S_C(state->words[0]), regs, cregs); 290 state->dest = FIELD_S_A(state->words[0]); 291 break; 292 293 case op_ADD_MOV_CMP: 294 /* check for limm, ignore mov_s h,b (== mov_s 0,b) */ 295 if ((BITS(state->words[0], 3, 4) < 3) && 296 (FIELD_S_H(state->words[0]) == REG_LIMM)) 297 state->instr_len += 4; 298 break; 299 300 case op_S: 301 subopcode = BITS(state->words[0], 5, 7); 302 switch (subopcode) { 303 case 0: /* j_s */ 304 case 1: /* j_s.d */ 305 case 2: /* jl_s */ 306 case 3: /* jl_s.d */ 307 state->target = get_reg(FIELD_S_B(state->words[0]), 308 regs, cregs); 309 state->delay_slot = subopcode & 1; 310 state->flow = (subopcode >= 2) ? 311 direct_call : indirect_jump; 312 break; 313 case 7: 314 switch (BITS(state->words[0], 8, 10)) { 315 case 4: /* jeq_s [blink] */ 316 case 5: /* jne_s [blink] */ 317 case 6: /* j_s [blink] */ 318 case 7: /* j_s.d [blink] */ 319 state->delay_slot = (subopcode == 7); 320 state->flow = indirect_jump; 321 state->target = get_reg(31, regs, cregs); 322 default: 323 break; 324 } 325 default: 326 break; 327 } 328 break; 329 330 case op_LD_S: /* LD_S c, [b, u7] */ 331 state->src1 = get_reg(FIELD_S_B(state->words[0]), regs, cregs); 332 state->src2 = FIELD_S_u7(state->words[0]); 333 state->dest = FIELD_S_C(state->words[0]); 334 break; 335 336 case op_LDB_S: 337 case op_STB_S: 338 /* no further handling required as byte accesses should not 339 * cause an unaligned access exception */ 340 state->zz = 1; 341 break; 342 343 case op_LDWX_S: /* LDWX_S c, [b, u6] */ 344 state->x = 1; 345 /* intentional fall-through */ 346 347 case op_LDW_S: /* LDW_S c, [b, u6] */ 348 state->zz = 2; 349 state->src1 = get_reg(FIELD_S_B(state->words[0]), regs, cregs); 350 state->src2 = FIELD_S_u6(state->words[0]); 351 state->dest = FIELD_S_C(state->words[0]); 352 break; 353 354 case op_ST_S: /* ST_S c, [b, u7] */ 355 state->write = 1; 356 state->src1 = get_reg(FIELD_S_C(state->words[0]), regs, cregs); 357 state->src2 = get_reg(FIELD_S_B(state->words[0]), regs, cregs); 358 state->src3 = FIELD_S_u7(state->words[0]); 359 break; 360 361 case op_STW_S: /* STW_S c,[b,u6] */ 362 state->write = 1; 363 state->zz = 2; 364 state->src1 = get_reg(FIELD_S_C(state->words[0]), regs, cregs); 365 state->src2 = get_reg(FIELD_S_B(state->words[0]), regs, cregs); 366 state->src3 = FIELD_S_u6(state->words[0]); 367 break; 368 369 case op_SP: /* LD_S|LDB_S b,[sp,u7], ST_S|STB_S b,[sp,u7] */ 370 /* note: we are ignoring possibility of: 371 * ADD_S, SUB_S, PUSH_S, POP_S as these should not 372 * cause unaliged exception anyway */ 373 state->write = BITS(state->words[0], 6, 6); 374 state->zz = BITS(state->words[0], 5, 5); 375 if (state->zz) 376 break; /* byte accesses should not come here */ 377 if (!state->write) { 378 state->src1 = get_reg(28, regs, cregs); 379 state->src2 = FIELD_S_u7(state->words[0]); 380 state->dest = FIELD_S_B(state->words[0]); 381 } else { 382 state->src1 = get_reg(FIELD_S_B(state->words[0]), regs, 383 cregs); 384 state->src2 = get_reg(28, regs, cregs); 385 state->src3 = FIELD_S_u7(state->words[0]); 386 } 387 break; 388 389 case op_GP: /* LD_S|LDB_S|LDW_S r0,[gp,s11/s9/s10] */ 390 /* note: ADD_S r0, gp, s11 is ignored */ 391 state->zz = BITS(state->words[0], 9, 10); 392 state->src1 = get_reg(26, regs, cregs); 393 state->src2 = state->zz ? FIELD_S_s10(state->words[0]) : 394 FIELD_S_s11(state->words[0]); 395 state->dest = 0; 396 break; 397 398 case op_Pcl: /* LD_S b,[pcl,u10] */ 399 state->src1 = regs->ret & ~3; 400 state->src2 = FIELD_S_u10(state->words[0]); 401 state->dest = FIELD_S_B(state->words[0]); 402 break; 403 404 case op_BR_S: 405 state->target = FIELD_S_s8(state->words[0]) + (addr & ~0x03); 406 state->flow = direct_jump; 407 state->is_branch = 1; 408 break; 409 410 case op_B_S: 411 fieldA = (BITS(state->words[0], 9, 10) == 3) ? 412 FIELD_S_s7(state->words[0]) : 413 FIELD_S_s10(state->words[0]); 414 state->target = fieldA + (addr & ~0x03); 415 state->flow = direct_jump; 416 state->is_branch = 1; 417 break; 418 419 case op_BL_S: 420 state->target = FIELD_S_s13(state->words[0]) + (addr & ~0x03); 421 state->flow = direct_call; 422 state->is_branch = 1; 423 break; 424 425 default: 426 break; 427 } 428 429 if (bytes_not_copied <= (8 - state->instr_len)) 430 return; 431 432 fault: state->fault = 1; 433 } 434 435 long __kprobes get_reg(int reg, struct pt_regs *regs, 436 struct callee_regs *cregs) 437 { 438 long *p; 439 440 if (reg <= 12) { 441 p = ®s->r0; 442 return p[-reg]; 443 } 444 445 if (cregs && (reg <= 25)) { 446 p = &cregs->r13; 447 return p[13-reg]; 448 } 449 450 if (reg == 26) 451 return regs->r26; 452 if (reg == 27) 453 return regs->fp; 454 if (reg == 28) 455 return regs->sp; 456 if (reg == 31) 457 return regs->blink; 458 459 return 0; 460 } 461 462 void __kprobes set_reg(int reg, long val, struct pt_regs *regs, 463 struct callee_regs *cregs) 464 { 465 long *p; 466 467 switch (reg) { 468 case 0 ... 12: 469 p = ®s->r0; 470 p[-reg] = val; 471 break; 472 case 13 ... 25: 473 if (cregs) { 474 p = &cregs->r13; 475 p[13-reg] = val; 476 } 477 break; 478 case 26: 479 regs->r26 = val; 480 break; 481 case 27: 482 regs->fp = val; 483 break; 484 case 28: 485 regs->sp = val; 486 break; 487 case 31: 488 regs->blink = val; 489 break; 490 default: 491 break; 492 } 493 } 494 495 /* 496 * Disassembles the insn at @pc and sets @next_pc to next PC (which could be 497 * @pc +2/4/6 (ARCompact ISA allows free intermixing of 16/32 bit insns). 498 * 499 * If @pc is a branch 500 * -@tgt_if_br is set to branch target. 501 * -If branch has delay slot, @next_pc updated with actual next PC. 502 */ 503 int __kprobes disasm_next_pc(unsigned long pc, struct pt_regs *regs, 504 struct callee_regs *cregs, 505 unsigned long *next_pc, unsigned long *tgt_if_br) 506 { 507 struct disasm_state instr; 508 509 memset(&instr, 0, sizeof(struct disasm_state)); 510 disasm_instr(pc, &instr, 0, regs, cregs); 511 512 *next_pc = pc + instr.instr_len; 513 514 /* Instruction with possible two targets branch, jump and loop */ 515 if (instr.is_branch) 516 *tgt_if_br = instr.target; 517 518 /* For the instructions with delay slots, the fall through is the 519 * instruction following the instruction in delay slot. 520 */ 521 if (instr.delay_slot) { 522 struct disasm_state instr_d; 523 524 disasm_instr(*next_pc, &instr_d, 0, regs, cregs); 525 526 *next_pc += instr_d.instr_len; 527 } 528 529 /* Zero Overhead Loop - end of the loop */ 530 if (!(regs->status32 & STATUS32_L) && (*next_pc == regs->lp_end) 531 && (regs->lp_count > 1)) { 532 *next_pc = regs->lp_start; 533 } 534 535 return instr.is_branch; 536 } 537 538 #endif /* CONFIG_KGDB || CONFIG_ARC_MISALIGN_ACCESS || CONFIG_KPROBES */ 539