1/*
2 * several functions that help interpret ARC instructions
3 * used for unaligned accesses, kprobes and kgdb
4 *
5 * Copyright (C) 2004, 2007-2010, 2011-2012 Synopsys, Inc. (www.synopsys.com)
6 *
7 * This program is free software; you can redistribute it and/or modify
8 * it under the terms of the GNU General Public License version 2 as
9 * published by the Free Software Foundation.
10 */
11
12#include <linux/types.h>
13#include <linux/kprobes.h>
14#include <linux/slab.h>
15#include <linux/uaccess.h>
16#include <asm/disasm.h>
17
18#if defined(CONFIG_KGDB) || defined(CONFIG_ARC_EMUL_UNALIGNED) || \
19	defined(CONFIG_KPROBES)
20
21/* disasm_instr: Analyses instruction at addr, stores
22 * findings in *state
23 */
24void __kprobes disasm_instr(unsigned long addr, struct disasm_state *state,
25	int userspace, struct pt_regs *regs, struct callee_regs *cregs)
26{
27	int fieldA = 0;
28	int fieldC = 0, fieldCisReg = 0;
29	uint16_t word1 = 0, word0 = 0;
30	int subopcode, is_linked, op_format;
31	uint16_t *ins_ptr;
32	uint16_t ins_buf[4];
33	int bytes_not_copied = 0;
34
35	memset(state, 0, sizeof(struct disasm_state));
36
37	/* This fetches the upper part of the 32 bit instruction
38	 * in both the cases of Little Endian or Big Endian configurations. */
39	if (userspace) {
40		bytes_not_copied = copy_from_user(ins_buf,
41						(const void __user *) addr, 8);
42		if (bytes_not_copied > 6)
43			goto fault;
44		ins_ptr = ins_buf;
45	} else {
46		ins_ptr = (uint16_t *) addr;
47	}
48
49	word1 = *((uint16_t *)addr);
50
51	state->major_opcode = (word1 >> 11) & 0x1F;
52
53	/* Check if the instruction is 32 bit or 16 bit instruction */
54	if (state->major_opcode < 0x0B) {
55		if (bytes_not_copied > 4)
56			goto fault;
57		state->instr_len = 4;
58		word0 = *((uint16_t *)(addr+2));
59		state->words[0] = (word1 << 16) | word0;
60	} else {
61		state->instr_len = 2;
62		state->words[0] = word1;
63	}
64
65	/* Read the second word in case of limm */
66	word1 = *((uint16_t *)(addr + state->instr_len));
67	word0 = *((uint16_t *)(addr + state->instr_len + 2));
68	state->words[1] = (word1 << 16) | word0;
69
70	switch (state->major_opcode) {
71	case op_Bcc:
72		state->is_branch = 1;
73
74		/* unconditional branch s25, conditional branch s21 */
75		fieldA = (IS_BIT(state->words[0], 16)) ?
76			FIELD_s25(state->words[0]) :
77			FIELD_s21(state->words[0]);
78
79		state->delay_slot = IS_BIT(state->words[0], 5);
80		state->target = fieldA + (addr & ~0x3);
81		state->flow = direct_jump;
82		break;
83
84	case op_BLcc:
85		if (IS_BIT(state->words[0], 16)) {
86			/* Branch and Link*/
87			/* unconditional branch s25, conditional branch s21 */
88			fieldA = (IS_BIT(state->words[0], 17)) ?
89				(FIELD_s25(state->words[0]) & ~0x3) :
90				FIELD_s21(state->words[0]);
91
92			state->flow = direct_call;
93		} else {
94			/*Branch On Compare */
95			fieldA = FIELD_s9(state->words[0]) & ~0x3;
96			state->flow = direct_jump;
97		}
98
99		state->delay_slot = IS_BIT(state->words[0], 5);
100		state->target = fieldA + (addr & ~0x3);
101		state->is_branch = 1;
102		break;
103
104	case op_LD:  /* LD<zz> a,[b,s9] */
105		state->write = 0;
106		state->di = BITS(state->words[0], 11, 11);
107		if (state->di)
108			break;
109		state->x = BITS(state->words[0], 6, 6);
110		state->zz = BITS(state->words[0], 7, 8);
111		state->aa = BITS(state->words[0], 9, 10);
112		state->wb_reg = FIELD_B(state->words[0]);
113		if (state->wb_reg == REG_LIMM) {
114			state->instr_len += 4;
115			state->aa = 0;
116			state->src1 = state->words[1];
117		} else {
118			state->src1 = get_reg(state->wb_reg, regs, cregs);
119		}
120		state->src2 = FIELD_s9(state->words[0]);
121		state->dest = FIELD_A(state->words[0]);
122		state->pref = (state->dest == REG_LIMM);
123		break;
124
125	case op_ST:
126		state->write = 1;
127		state->di = BITS(state->words[0], 5, 5);
128		if (state->di)
129			break;
130		state->aa = BITS(state->words[0], 3, 4);
131		state->zz = BITS(state->words[0], 1, 2);
132		state->src1 = FIELD_C(state->words[0]);
133		if (state->src1 == REG_LIMM) {
134			state->instr_len += 4;
135			state->src1 = state->words[1];
136		} else {
137			state->src1 = get_reg(state->src1, regs, cregs);
138		}
139		state->wb_reg = FIELD_B(state->words[0]);
140		if (state->wb_reg == REG_LIMM) {
141			state->aa = 0;
142			state->instr_len += 4;
143			state->src2 = state->words[1];
144		} else {
145			state->src2 = get_reg(state->wb_reg, regs, cregs);
146		}
147		state->src3 = FIELD_s9(state->words[0]);
148		break;
149
150	case op_MAJOR_4:
151		subopcode = MINOR_OPCODE(state->words[0]);
152		switch (subopcode) {
153		case 32:	/* Jcc */
154		case 33:	/* Jcc.D */
155		case 34:	/* JLcc */
156		case 35:	/* JLcc.D */
157			is_linked = 0;
158
159			if (subopcode == 33 || subopcode == 35)
160				state->delay_slot = 1;
161
162			if (subopcode == 34 || subopcode == 35)
163				is_linked = 1;
164
165			fieldCisReg = 0;
166			op_format = BITS(state->words[0], 22, 23);
167			if (op_format == 0 || ((op_format == 3) &&
168				(!IS_BIT(state->words[0], 5)))) {
169				fieldC = FIELD_C(state->words[0]);
170
171				if (fieldC == REG_LIMM) {
172					fieldC = state->words[1];
173					state->instr_len += 4;
174				} else {
175					fieldCisReg = 1;
176				}
177			} else if (op_format == 1 || ((op_format == 3)
178				&& (IS_BIT(state->words[0], 5)))) {
179				fieldC = FIELD_C(state->words[0]);
180			} else  {
181				/* op_format == 2 */
182				fieldC = FIELD_s12(state->words[0]);
183			}
184
185			if (!fieldCisReg) {
186				state->target = fieldC;
187				state->flow = is_linked ?
188					direct_call : direct_jump;
189			} else {
190				state->target = get_reg(fieldC, regs, cregs);
191				state->flow = is_linked ?
192					indirect_call : indirect_jump;
193			}
194			state->is_branch = 1;
195			break;
196
197		case 40:	/* LPcc */
198			if (BITS(state->words[0], 22, 23) == 3) {
199				/* Conditional LPcc u7 */
200				fieldC = FIELD_C(state->words[0]);
201
202				fieldC = fieldC << 1;
203				fieldC += (addr & ~0x03);
204				state->is_branch = 1;
205				state->flow = direct_jump;
206				state->target = fieldC;
207			}
208			/* For Unconditional lp, next pc is the fall through
209			 * which is updated */
210			break;
211
212		case 48 ... 55:	/* LD a,[b,c] */
213			state->di = BITS(state->words[0], 15, 15);
214			if (state->di)
215				break;
216			state->x = BITS(state->words[0], 16, 16);
217			state->zz = BITS(state->words[0], 17, 18);
218			state->aa = BITS(state->words[0], 22, 23);
219			state->wb_reg = FIELD_B(state->words[0]);
220			if (state->wb_reg == REG_LIMM) {
221				state->instr_len += 4;
222				state->src1 = state->words[1];
223			} else {
224				state->src1 = get_reg(state->wb_reg, regs,
225						cregs);
226			}
227			state->src2 = FIELD_C(state->words[0]);
228			if (state->src2 == REG_LIMM) {
229				state->instr_len += 4;
230				state->src2 = state->words[1];
231			} else {
232				state->src2 = get_reg(state->src2, regs,
233					cregs);
234			}
235			state->dest = FIELD_A(state->words[0]);
236			if (state->dest == REG_LIMM)
237				state->pref = 1;
238			break;
239
240		case 10:	/* MOV */
241			/* still need to check for limm to extract instr len */
242			/* MOV is special case because it only takes 2 args */
243			switch (BITS(state->words[0], 22, 23)) {
244			case 0: /* OP a,b,c */
245				if (FIELD_C(state->words[0]) == REG_LIMM)
246					state->instr_len += 4;
247				break;
248			case 1: /* OP a,b,u6 */
249				break;
250			case 2: /* OP b,b,s12 */
251				break;
252			case 3: /* OP.cc b,b,c/u6 */
253				if ((!IS_BIT(state->words[0], 5)) &&
254				    (FIELD_C(state->words[0]) == REG_LIMM))
255					state->instr_len += 4;
256				break;
257			}
258			break;
259
260
261		default:
262			/* Not a Load, Jump or Loop instruction */
263			/* still need to check for limm to extract instr len */
264			switch (BITS(state->words[0], 22, 23)) {
265			case 0: /* OP a,b,c */
266				if ((FIELD_B(state->words[0]) == REG_LIMM) ||
267				    (FIELD_C(state->words[0]) == REG_LIMM))
268					state->instr_len += 4;
269				break;
270			case 1: /* OP a,b,u6 */
271				break;
272			case 2: /* OP b,b,s12 */
273				break;
274			case 3: /* OP.cc b,b,c/u6 */
275				if ((!IS_BIT(state->words[0], 5)) &&
276				   ((FIELD_B(state->words[0]) == REG_LIMM) ||
277				    (FIELD_C(state->words[0]) == REG_LIMM)))
278					state->instr_len += 4;
279				break;
280			}
281			break;
282		}
283		break;
284
285	/* 16 Bit Instructions */
286	case op_LD_ADD: /* LD_S|LDB_S|LDW_S a,[b,c] */
287		state->zz = BITS(state->words[0], 3, 4);
288		state->src1 = get_reg(FIELD_S_B(state->words[0]), regs, cregs);
289		state->src2 = get_reg(FIELD_S_C(state->words[0]), regs, cregs);
290		state->dest = FIELD_S_A(state->words[0]);
291		break;
292
293	case op_ADD_MOV_CMP:
294		/* check for limm, ignore mov_s h,b (== mov_s 0,b) */
295		if ((BITS(state->words[0], 3, 4) < 3) &&
296		    (FIELD_S_H(state->words[0]) == REG_LIMM))
297			state->instr_len += 4;
298		break;
299
300	case op_S:
301		subopcode = BITS(state->words[0], 5, 7);
302		switch (subopcode) {
303		case 0:	/* j_s */
304		case 1:	/* j_s.d */
305		case 2:	/* jl_s */
306		case 3:	/* jl_s.d */
307			state->target = get_reg(FIELD_S_B(state->words[0]),
308						regs, cregs);
309			state->delay_slot = subopcode & 1;
310			state->flow = (subopcode >= 2) ?
311				direct_call : indirect_jump;
312			break;
313		case 7:
314			switch (BITS(state->words[0], 8, 10)) {
315			case 4:	/* jeq_s [blink] */
316			case 5:	/* jne_s [blink] */
317			case 6:	/* j_s [blink] */
318			case 7:	/* j_s.d [blink] */
319				state->delay_slot = (subopcode == 7);
320				state->flow = indirect_jump;
321				state->target = get_reg(31, regs, cregs);
322			default:
323				break;
324			}
325		default:
326			break;
327		}
328		break;
329
330	case op_LD_S:	/* LD_S c, [b, u7] */
331		state->src1 = get_reg(FIELD_S_B(state->words[0]), regs, cregs);
332		state->src2 = FIELD_S_u7(state->words[0]);
333		state->dest = FIELD_S_C(state->words[0]);
334		break;
335
336	case op_LDB_S:
337	case op_STB_S:
338		/* no further handling required as byte accesses should not
339		 * cause an unaligned access exception */
340		state->zz = 1;
341		break;
342
343	case op_LDWX_S:	/* LDWX_S c, [b, u6] */
344		state->x = 1;
345		/* intentional fall-through */
346
347	case op_LDW_S:	/* LDW_S c, [b, u6] */
348		state->zz = 2;
349		state->src1 = get_reg(FIELD_S_B(state->words[0]), regs, cregs);
350		state->src2 = FIELD_S_u6(state->words[0]);
351		state->dest = FIELD_S_C(state->words[0]);
352		break;
353
354	case op_ST_S:	/* ST_S c, [b, u7] */
355		state->write = 1;
356		state->src1 = get_reg(FIELD_S_C(state->words[0]), regs, cregs);
357		state->src2 = get_reg(FIELD_S_B(state->words[0]), regs, cregs);
358		state->src3 = FIELD_S_u7(state->words[0]);
359		break;
360
361	case op_STW_S:	/* STW_S c,[b,u6] */
362		state->write = 1;
363		state->zz = 2;
364		state->src1 = get_reg(FIELD_S_C(state->words[0]), regs, cregs);
365		state->src2 = get_reg(FIELD_S_B(state->words[0]), regs, cregs);
366		state->src3 = FIELD_S_u6(state->words[0]);
367		break;
368
369	case op_SP:	/* LD_S|LDB_S b,[sp,u7], ST_S|STB_S b,[sp,u7] */
370		/* note: we are ignoring possibility of:
371		 * ADD_S, SUB_S, PUSH_S, POP_S as these should not
372		 * cause unaliged exception anyway */
373		state->write = BITS(state->words[0], 6, 6);
374		state->zz = BITS(state->words[0], 5, 5);
375		if (state->zz)
376			break;	/* byte accesses should not come here */
377		if (!state->write) {
378			state->src1 = get_reg(28, regs, cregs);
379			state->src2 = FIELD_S_u7(state->words[0]);
380			state->dest = FIELD_S_B(state->words[0]);
381		} else {
382			state->src1 = get_reg(FIELD_S_B(state->words[0]), regs,
383					cregs);
384			state->src2 = get_reg(28, regs, cregs);
385			state->src3 = FIELD_S_u7(state->words[0]);
386		}
387		break;
388
389	case op_GP:	/* LD_S|LDB_S|LDW_S r0,[gp,s11/s9/s10] */
390		/* note: ADD_S r0, gp, s11 is ignored */
391		state->zz = BITS(state->words[0], 9, 10);
392		state->src1 = get_reg(26, regs, cregs);
393		state->src2 = state->zz ? FIELD_S_s10(state->words[0]) :
394			FIELD_S_s11(state->words[0]);
395		state->dest = 0;
396		break;
397
398	case op_Pcl:	/* LD_S b,[pcl,u10] */
399		state->src1 = regs->ret & ~3;
400		state->src2 = FIELD_S_u10(state->words[0]);
401		state->dest = FIELD_S_B(state->words[0]);
402		break;
403
404	case op_BR_S:
405		state->target = FIELD_S_s8(state->words[0]) + (addr & ~0x03);
406		state->flow = direct_jump;
407		state->is_branch = 1;
408		break;
409
410	case op_B_S:
411		fieldA = (BITS(state->words[0], 9, 10) == 3) ?
412			FIELD_S_s7(state->words[0]) :
413			FIELD_S_s10(state->words[0]);
414		state->target = fieldA + (addr & ~0x03);
415		state->flow = direct_jump;
416		state->is_branch = 1;
417		break;
418
419	case op_BL_S:
420		state->target = FIELD_S_s13(state->words[0]) + (addr & ~0x03);
421		state->flow = direct_call;
422		state->is_branch = 1;
423		break;
424
425	default:
426		break;
427	}
428
429	if (bytes_not_copied <= (8 - state->instr_len))
430		return;
431
432fault:	state->fault = 1;
433}
434
435long __kprobes get_reg(int reg, struct pt_regs *regs,
436		       struct callee_regs *cregs)
437{
438	long *p;
439
440	if (reg <= 12) {
441		p = &regs->r0;
442		return p[-reg];
443	}
444
445	if (cregs && (reg <= 25)) {
446		p = &cregs->r13;
447		return p[13-reg];
448	}
449
450	if (reg == 26)
451		return regs->r26;
452	if (reg == 27)
453		return regs->fp;
454	if (reg == 28)
455		return regs->sp;
456	if (reg == 31)
457		return regs->blink;
458
459	return 0;
460}
461
462void __kprobes set_reg(int reg, long val, struct pt_regs *regs,
463		struct callee_regs *cregs)
464{
465	long *p;
466
467	switch (reg) {
468	case 0 ... 12:
469		p = &regs->r0;
470		p[-reg] = val;
471		break;
472	case 13 ... 25:
473		if (cregs) {
474			p = &cregs->r13;
475			p[13-reg] = val;
476		}
477		break;
478	case 26:
479		regs->r26 = val;
480		break;
481	case 27:
482		regs->fp = val;
483		break;
484	case 28:
485		regs->sp = val;
486		break;
487	case 31:
488		regs->blink = val;
489		break;
490	default:
491		break;
492	}
493}
494
495/*
496 * Disassembles the insn at @pc and sets @next_pc to next PC (which could be
497 * @pc +2/4/6 (ARCompact ISA allows free intermixing of 16/32 bit insns).
498 *
499 * If @pc is a branch
500 *	-@tgt_if_br is set to branch target.
501 *	-If branch has delay slot, @next_pc updated with actual next PC.
502 */
503int __kprobes disasm_next_pc(unsigned long pc, struct pt_regs *regs,
504			     struct callee_regs *cregs,
505			     unsigned long *next_pc, unsigned long *tgt_if_br)
506{
507	struct disasm_state instr;
508
509	memset(&instr, 0, sizeof(struct disasm_state));
510	disasm_instr(pc, &instr, 0, regs, cregs);
511
512	*next_pc = pc + instr.instr_len;
513
514	/* Instruction with possible two targets branch, jump and loop */
515	if (instr.is_branch)
516		*tgt_if_br = instr.target;
517
518	/* For the instructions with delay slots, the fall through is the
519	 * instruction following the instruction in delay slot.
520	 */
521	 if (instr.delay_slot) {
522		struct disasm_state instr_d;
523
524		disasm_instr(*next_pc, &instr_d, 0, regs, cregs);
525
526		*next_pc += instr_d.instr_len;
527	 }
528
529	 /* Zero Overhead Loop - end of the loop */
530	if (!(regs->status32 & STATUS32_L) && (*next_pc == regs->lp_end)
531		&& (regs->lp_count > 1)) {
532		*next_pc = regs->lp_start;
533	}
534
535	return instr.is_branch;
536}
537
538#endif /* CONFIG_KGDB || CONFIG_ARC_EMUL_UNALIGNED || CONFIG_KPROBES */
539