disasm.c 14 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535
  1. // SPDX-License-Identifier: GPL-2.0-only
  2. /*
  3. * several functions that help interpret ARC instructions
  4. * used for unaligned accesses, kprobes and kgdb
  5. *
  6. * Copyright (C) 2004, 2007-2010, 2011-2012 Synopsys, Inc. (www.synopsys.com)
  7. */
  8. #include <linux/types.h>
  9. #include <linux/kprobes.h>
  10. #include <linux/slab.h>
  11. #include <linux/uaccess.h>
  12. #include <asm/disasm.h>
  13. #if defined(CONFIG_KGDB) || defined(CONFIG_ARC_EMUL_UNALIGNED) || \
  14. defined(CONFIG_KPROBES)
  15. /* disasm_instr: Analyses instruction at addr, stores
  16. * findings in *state
  17. */
  18. void __kprobes disasm_instr(unsigned long addr, struct disasm_state *state,
  19. int userspace, struct pt_regs *regs, struct callee_regs *cregs)
  20. {
  21. int fieldA = 0;
  22. int fieldC = 0, fieldCisReg = 0;
  23. uint16_t word1 = 0, word0 = 0;
  24. int subopcode, is_linked, op_format;
  25. uint16_t *ins_ptr;
  26. uint16_t ins_buf[4];
  27. int bytes_not_copied = 0;
  28. memset(state, 0, sizeof(struct disasm_state));
  29. /* This fetches the upper part of the 32 bit instruction
  30. * in both the cases of Little Endian or Big Endian configurations. */
  31. if (userspace) {
  32. bytes_not_copied = copy_from_user(ins_buf,
  33. (const void __user *) addr, 8);
  34. if (bytes_not_copied > 6)
  35. goto fault;
  36. ins_ptr = ins_buf;
  37. } else {
  38. ins_ptr = (uint16_t *) addr;
  39. }
  40. word1 = *((uint16_t *)addr);
  41. state->major_opcode = (word1 >> 11) & 0x1F;
  42. /* Check if the instruction is 32 bit or 16 bit instruction */
  43. if (state->major_opcode < 0x0B) {
  44. if (bytes_not_copied > 4)
  45. goto fault;
  46. state->instr_len = 4;
  47. word0 = *((uint16_t *)(addr+2));
  48. state->words[0] = (word1 << 16) | word0;
  49. } else {
  50. state->instr_len = 2;
  51. state->words[0] = word1;
  52. }
  53. /* Read the second word in case of limm */
  54. word1 = *((uint16_t *)(addr + state->instr_len));
  55. word0 = *((uint16_t *)(addr + state->instr_len + 2));
  56. state->words[1] = (word1 << 16) | word0;
  57. switch (state->major_opcode) {
  58. case op_Bcc:
  59. state->is_branch = 1;
  60. /* unconditional branch s25, conditional branch s21 */
  61. fieldA = (IS_BIT(state->words[0], 16)) ?
  62. FIELD_s25(state->words[0]) :
  63. FIELD_s21(state->words[0]);
  64. state->delay_slot = IS_BIT(state->words[0], 5);
  65. state->target = fieldA + (addr & ~0x3);
  66. state->flow = direct_jump;
  67. break;
  68. case op_BLcc:
  69. if (IS_BIT(state->words[0], 16)) {
  70. /* Branch and Link*/
  71. /* unconditional branch s25, conditional branch s21 */
  72. fieldA = (IS_BIT(state->words[0], 17)) ?
  73. (FIELD_s25(state->words[0]) & ~0x3) :
  74. FIELD_s21(state->words[0]);
  75. state->flow = direct_call;
  76. } else {
  77. /*Branch On Compare */
  78. fieldA = FIELD_s9(state->words[0]) & ~0x3;
  79. state->flow = direct_jump;
  80. }
  81. state->delay_slot = IS_BIT(state->words[0], 5);
  82. state->target = fieldA + (addr & ~0x3);
  83. state->is_branch = 1;
  84. break;
  85. case op_LD: /* LD<zz> a,[b,s9] */
  86. state->write = 0;
  87. state->di = BITS(state->words[0], 11, 11);
  88. if (state->di)
  89. break;
  90. state->x = BITS(state->words[0], 6, 6);
  91. state->zz = BITS(state->words[0], 7, 8);
  92. state->aa = BITS(state->words[0], 9, 10);
  93. state->wb_reg = FIELD_B(state->words[0]);
  94. if (state->wb_reg == REG_LIMM) {
  95. state->instr_len += 4;
  96. state->aa = 0;
  97. state->src1 = state->words[1];
  98. } else {
  99. state->src1 = get_reg(state->wb_reg, regs, cregs);
  100. }
  101. state->src2 = FIELD_s9(state->words[0]);
  102. state->dest = FIELD_A(state->words[0]);
  103. state->pref = (state->dest == REG_LIMM);
  104. break;
  105. case op_ST:
  106. state->write = 1;
  107. state->di = BITS(state->words[0], 5, 5);
  108. if (state->di)
  109. break;
  110. state->aa = BITS(state->words[0], 3, 4);
  111. state->zz = BITS(state->words[0], 1, 2);
  112. state->src1 = FIELD_C(state->words[0]);
  113. if (state->src1 == REG_LIMM) {
  114. state->instr_len += 4;
  115. state->src1 = state->words[1];
  116. } else {
  117. state->src1 = get_reg(state->src1, regs, cregs);
  118. }
  119. state->wb_reg = FIELD_B(state->words[0]);
  120. if (state->wb_reg == REG_LIMM) {
  121. state->aa = 0;
  122. state->instr_len += 4;
  123. state->src2 = state->words[1];
  124. } else {
  125. state->src2 = get_reg(state->wb_reg, regs, cregs);
  126. }
  127. state->src3 = FIELD_s9(state->words[0]);
  128. break;
  129. case op_MAJOR_4:
  130. subopcode = MINOR_OPCODE(state->words[0]);
  131. switch (subopcode) {
  132. case 32: /* Jcc */
  133. case 33: /* Jcc.D */
  134. case 34: /* JLcc */
  135. case 35: /* JLcc.D */
  136. is_linked = 0;
  137. if (subopcode == 33 || subopcode == 35)
  138. state->delay_slot = 1;
  139. if (subopcode == 34 || subopcode == 35)
  140. is_linked = 1;
  141. fieldCisReg = 0;
  142. op_format = BITS(state->words[0], 22, 23);
  143. if (op_format == 0 || ((op_format == 3) &&
  144. (!IS_BIT(state->words[0], 5)))) {
  145. fieldC = FIELD_C(state->words[0]);
  146. if (fieldC == REG_LIMM) {
  147. fieldC = state->words[1];
  148. state->instr_len += 4;
  149. } else {
  150. fieldCisReg = 1;
  151. }
  152. } else if (op_format == 1 || ((op_format == 3)
  153. && (IS_BIT(state->words[0], 5)))) {
  154. fieldC = FIELD_C(state->words[0]);
  155. } else {
  156. /* op_format == 2 */
  157. fieldC = FIELD_s12(state->words[0]);
  158. }
  159. if (!fieldCisReg) {
  160. state->target = fieldC;
  161. state->flow = is_linked ?
  162. direct_call : direct_jump;
  163. } else {
  164. state->target = get_reg(fieldC, regs, cregs);
  165. state->flow = is_linked ?
  166. indirect_call : indirect_jump;
  167. }
  168. state->is_branch = 1;
  169. break;
  170. case 40: /* LPcc */
  171. if (BITS(state->words[0], 22, 23) == 3) {
  172. /* Conditional LPcc u7 */
  173. fieldC = FIELD_C(state->words[0]);
  174. fieldC = fieldC << 1;
  175. fieldC += (addr & ~0x03);
  176. state->is_branch = 1;
  177. state->flow = direct_jump;
  178. state->target = fieldC;
  179. }
  180. /* For Unconditional lp, next pc is the fall through
  181. * which is updated */
  182. break;
  183. case 48 ... 55: /* LD a,[b,c] */
  184. state->di = BITS(state->words[0], 15, 15);
  185. if (state->di)
  186. break;
  187. state->x = BITS(state->words[0], 16, 16);
  188. state->zz = BITS(state->words[0], 17, 18);
  189. state->aa = BITS(state->words[0], 22, 23);
  190. state->wb_reg = FIELD_B(state->words[0]);
  191. if (state->wb_reg == REG_LIMM) {
  192. state->instr_len += 4;
  193. state->src1 = state->words[1];
  194. } else {
  195. state->src1 = get_reg(state->wb_reg, regs,
  196. cregs);
  197. }
  198. state->src2 = FIELD_C(state->words[0]);
  199. if (state->src2 == REG_LIMM) {
  200. state->instr_len += 4;
  201. state->src2 = state->words[1];
  202. } else {
  203. state->src2 = get_reg(state->src2, regs,
  204. cregs);
  205. }
  206. state->dest = FIELD_A(state->words[0]);
  207. if (state->dest == REG_LIMM)
  208. state->pref = 1;
  209. break;
  210. case 10: /* MOV */
  211. /* still need to check for limm to extract instr len */
  212. /* MOV is special case because it only takes 2 args */
  213. switch (BITS(state->words[0], 22, 23)) {
  214. case 0: /* OP a,b,c */
  215. if (FIELD_C(state->words[0]) == REG_LIMM)
  216. state->instr_len += 4;
  217. break;
  218. case 1: /* OP a,b,u6 */
  219. break;
  220. case 2: /* OP b,b,s12 */
  221. break;
  222. case 3: /* OP.cc b,b,c/u6 */
  223. if ((!IS_BIT(state->words[0], 5)) &&
  224. (FIELD_C(state->words[0]) == REG_LIMM))
  225. state->instr_len += 4;
  226. break;
  227. }
  228. break;
  229. default:
  230. /* Not a Load, Jump or Loop instruction */
  231. /* still need to check for limm to extract instr len */
  232. switch (BITS(state->words[0], 22, 23)) {
  233. case 0: /* OP a,b,c */
  234. if ((FIELD_B(state->words[0]) == REG_LIMM) ||
  235. (FIELD_C(state->words[0]) == REG_LIMM))
  236. state->instr_len += 4;
  237. break;
  238. case 1: /* OP a,b,u6 */
  239. break;
  240. case 2: /* OP b,b,s12 */
  241. break;
  242. case 3: /* OP.cc b,b,c/u6 */
  243. if ((!IS_BIT(state->words[0], 5)) &&
  244. ((FIELD_B(state->words[0]) == REG_LIMM) ||
  245. (FIELD_C(state->words[0]) == REG_LIMM)))
  246. state->instr_len += 4;
  247. break;
  248. }
  249. break;
  250. }
  251. break;
  252. /* 16 Bit Instructions */
  253. case op_LD_ADD: /* LD_S|LDB_S|LDW_S a,[b,c] */
  254. state->zz = BITS(state->words[0], 3, 4);
  255. state->src1 = get_reg(FIELD_S_B(state->words[0]), regs, cregs);
  256. state->src2 = get_reg(FIELD_S_C(state->words[0]), regs, cregs);
  257. state->dest = FIELD_S_A(state->words[0]);
  258. break;
  259. case op_ADD_MOV_CMP:
  260. /* check for limm, ignore mov_s h,b (== mov_s 0,b) */
  261. if ((BITS(state->words[0], 3, 4) < 3) &&
  262. (FIELD_S_H(state->words[0]) == REG_LIMM))
  263. state->instr_len += 4;
  264. break;
  265. case op_S:
  266. subopcode = BITS(state->words[0], 5, 7);
  267. switch (subopcode) {
  268. case 0: /* j_s */
  269. case 1: /* j_s.d */
  270. case 2: /* jl_s */
  271. case 3: /* jl_s.d */
  272. state->target = get_reg(FIELD_S_B(state->words[0]),
  273. regs, cregs);
  274. state->delay_slot = subopcode & 1;
  275. state->flow = (subopcode >= 2) ?
  276. direct_call : indirect_jump;
  277. break;
  278. case 7:
  279. switch (BITS(state->words[0], 8, 10)) {
  280. case 4: /* jeq_s [blink] */
  281. case 5: /* jne_s [blink] */
  282. case 6: /* j_s [blink] */
  283. case 7: /* j_s.d [blink] */
  284. state->delay_slot = (subopcode == 7);
  285. state->flow = indirect_jump;
  286. state->target = get_reg(31, regs, cregs);
  287. default:
  288. break;
  289. }
  290. default:
  291. break;
  292. }
  293. break;
  294. case op_LD_S: /* LD_S c, [b, u7] */
  295. state->src1 = get_reg(FIELD_S_B(state->words[0]), regs, cregs);
  296. state->src2 = FIELD_S_u7(state->words[0]);
  297. state->dest = FIELD_S_C(state->words[0]);
  298. break;
  299. case op_LDB_S:
  300. case op_STB_S:
  301. /* no further handling required as byte accesses should not
  302. * cause an unaligned access exception */
  303. state->zz = 1;
  304. break;
  305. case op_LDWX_S: /* LDWX_S c, [b, u6] */
  306. state->x = 1;
  307. fallthrough;
  308. case op_LDW_S: /* LDW_S c, [b, u6] */
  309. state->zz = 2;
  310. state->src1 = get_reg(FIELD_S_B(state->words[0]), regs, cregs);
  311. state->src2 = FIELD_S_u6(state->words[0]);
  312. state->dest = FIELD_S_C(state->words[0]);
  313. break;
  314. case op_ST_S: /* ST_S c, [b, u7] */
  315. state->write = 1;
  316. state->src1 = get_reg(FIELD_S_C(state->words[0]), regs, cregs);
  317. state->src2 = get_reg(FIELD_S_B(state->words[0]), regs, cregs);
  318. state->src3 = FIELD_S_u7(state->words[0]);
  319. break;
  320. case op_STW_S: /* STW_S c,[b,u6] */
  321. state->write = 1;
  322. state->zz = 2;
  323. state->src1 = get_reg(FIELD_S_C(state->words[0]), regs, cregs);
  324. state->src2 = get_reg(FIELD_S_B(state->words[0]), regs, cregs);
  325. state->src3 = FIELD_S_u6(state->words[0]);
  326. break;
  327. case op_SP: /* LD_S|LDB_S b,[sp,u7], ST_S|STB_S b,[sp,u7] */
  328. /* note: we are ignoring possibility of:
  329. * ADD_S, SUB_S, PUSH_S, POP_S as these should not
  330. * cause unaliged exception anyway */
  331. state->write = BITS(state->words[0], 6, 6);
  332. state->zz = BITS(state->words[0], 5, 5);
  333. if (state->zz)
  334. break; /* byte accesses should not come here */
  335. if (!state->write) {
  336. state->src1 = get_reg(28, regs, cregs);
  337. state->src2 = FIELD_S_u7(state->words[0]);
  338. state->dest = FIELD_S_B(state->words[0]);
  339. } else {
  340. state->src1 = get_reg(FIELD_S_B(state->words[0]), regs,
  341. cregs);
  342. state->src2 = get_reg(28, regs, cregs);
  343. state->src3 = FIELD_S_u7(state->words[0]);
  344. }
  345. break;
  346. case op_GP: /* LD_S|LDB_S|LDW_S r0,[gp,s11/s9/s10] */
  347. /* note: ADD_S r0, gp, s11 is ignored */
  348. state->zz = BITS(state->words[0], 9, 10);
  349. state->src1 = get_reg(26, regs, cregs);
  350. state->src2 = state->zz ? FIELD_S_s10(state->words[0]) :
  351. FIELD_S_s11(state->words[0]);
  352. state->dest = 0;
  353. break;
  354. case op_Pcl: /* LD_S b,[pcl,u10] */
  355. state->src1 = regs->ret & ~3;
  356. state->src2 = FIELD_S_u10(state->words[0]);
  357. state->dest = FIELD_S_B(state->words[0]);
  358. break;
  359. case op_BR_S:
  360. state->target = FIELD_S_s8(state->words[0]) + (addr & ~0x03);
  361. state->flow = direct_jump;
  362. state->is_branch = 1;
  363. break;
  364. case op_B_S:
  365. fieldA = (BITS(state->words[0], 9, 10) == 3) ?
  366. FIELD_S_s7(state->words[0]) :
  367. FIELD_S_s10(state->words[0]);
  368. state->target = fieldA + (addr & ~0x03);
  369. state->flow = direct_jump;
  370. state->is_branch = 1;
  371. break;
  372. case op_BL_S:
  373. state->target = FIELD_S_s13(state->words[0]) + (addr & ~0x03);
  374. state->flow = direct_call;
  375. state->is_branch = 1;
  376. break;
  377. default:
  378. break;
  379. }
  380. if (bytes_not_copied <= (8 - state->instr_len))
  381. return;
  382. fault: state->fault = 1;
  383. }
  384. long __kprobes get_reg(int reg, struct pt_regs *regs,
  385. struct callee_regs *cregs)
  386. {
  387. long *p;
  388. if (reg <= 12) {
  389. p = &regs->r0;
  390. return p[-reg];
  391. }
  392. if (cregs && (reg <= 25)) {
  393. p = &cregs->r13;
  394. return p[13-reg];
  395. }
  396. if (reg == 26)
  397. return regs->r26;
  398. if (reg == 27)
  399. return regs->fp;
  400. if (reg == 28)
  401. return regs->sp;
  402. if (reg == 31)
  403. return regs->blink;
  404. return 0;
  405. }
  406. void __kprobes set_reg(int reg, long val, struct pt_regs *regs,
  407. struct callee_regs *cregs)
  408. {
  409. long *p;
  410. switch (reg) {
  411. case 0 ... 12:
  412. p = &regs->r0;
  413. p[-reg] = val;
  414. break;
  415. case 13 ... 25:
  416. if (cregs) {
  417. p = &cregs->r13;
  418. p[13-reg] = val;
  419. }
  420. break;
  421. case 26:
  422. regs->r26 = val;
  423. break;
  424. case 27:
  425. regs->fp = val;
  426. break;
  427. case 28:
  428. regs->sp = val;
  429. break;
  430. case 31:
  431. regs->blink = val;
  432. break;
  433. default:
  434. break;
  435. }
  436. }
  437. /*
  438. * Disassembles the insn at @pc and sets @next_pc to next PC (which could be
  439. * @pc +2/4/6 (ARCompact ISA allows free intermixing of 16/32 bit insns).
  440. *
  441. * If @pc is a branch
  442. * -@tgt_if_br is set to branch target.
  443. * -If branch has delay slot, @next_pc updated with actual next PC.
  444. */
  445. int __kprobes disasm_next_pc(unsigned long pc, struct pt_regs *regs,
  446. struct callee_regs *cregs,
  447. unsigned long *next_pc, unsigned long *tgt_if_br)
  448. {
  449. struct disasm_state instr;
  450. memset(&instr, 0, sizeof(struct disasm_state));
  451. disasm_instr(pc, &instr, 0, regs, cregs);
  452. *next_pc = pc + instr.instr_len;
  453. /* Instruction with possible two targets branch, jump and loop */
  454. if (instr.is_branch)
  455. *tgt_if_br = instr.target;
  456. /* For the instructions with delay slots, the fall through is the
  457. * instruction following the instruction in delay slot.
  458. */
  459. if (instr.delay_slot) {
  460. struct disasm_state instr_d;
  461. disasm_instr(*next_pc, &instr_d, 0, regs, cregs);
  462. *next_pc += instr_d.instr_len;
  463. }
  464. /* Zero Overhead Loop - end of the loop */
  465. if (!(regs->status32 & STATUS32_L) && (*next_pc == regs->lp_end)
  466. && (regs->lp_count > 1)) {
  467. *next_pc = regs->lp_start;
  468. }
  469. return instr.is_branch;
  470. }
  471. #endif /* CONFIG_KGDB || CONFIG_ARC_EMUL_UNALIGNED || CONFIG_KPROBES */