1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980818283848586878889909192939495969798991001011021031041051061071081091101111121131141151161171181191201211221231241251261271281291301311321331341351361371381391401411421431441451461471481491501511521531541551561571581591601611621631641651661671681691701711721731741751761771781791801811821831841851861871881891901911921931941951961971981992002012022032042052062072082092102112122132142152162172182192202212222232242252262272282292302312322332342352362372382392402412422432442452462472482492502512522532542552562572582592602612622632642652662672682692702712722732742752762772782792802812822832842852862872882892902912922932942952962972982993003013023033043053063073083093103113123133143153163173183193203213223233243253263273283293303313323333343353363373383393403413423433443453463473483493503513523533543553563573583593603613623633643653663673683693703713723733743753763773783793803813823833843853863873883893903913923933943953963973983994004014024034044054064074084094104114124134144154164174184194204214224234244254264274284294304314324334344354364374384394404414424434444454464474484494504514524534544554564574584594604614624634644654664674684694704714724734744754764774784794804814824834844854864874884894904914924934944954964974984995005015025035045055065075085095105115125135145155165175185195205215225235245255265275285295305315325335345355365375385395405415425435445455465475485495505515525535545555565575585595605615625635645655665675685695705715725735745755765775785795805815825835845855865875885895905915925935945955965975985996006016026036046056066076086096106116126136146156166176186196206216226236246256266276286296306316326336346356366376386396406416426436446456466476486496506516526536546556566576586596606616626636646656666676686696706716726736746756766776786796806816826836846856866876886896906916926936946956966976986997007017027037047057067077087097107117127137147157167177187197207217227237247257267277287297307317327337347357367377387397407417427437447457467477487497507517527537547557567577587597607617627637647657667677687697707717727737747757767777787797807817827837847857867877887897907917927937947957967977987998008018028038048058068078088098108118128138148158168178188198208218228238248258268278288298308318328338348358368378388398408418428438448458468478488498508518528538548558568578588598608618628638648658668678688698708718728738748758768778788798808818828838848858868878888898908918928938948958968978988999009019029039049059069079089099109119129139149159169179189199209219229239249259269279289299309319329339349359369379389399409419429439449459469479489499509519529539549559569579589599609619629639649659669679689699709719729739749759769779789799809819829839849859869879889899909919929939949959969979989991000100110021003100410051006100710081009101010111012101310141015101610171018101910201021102210231024102510261027102810291030103110321033103410351036103710381039104010411042104310441045104610471048104910501051105210531054105510561057105810591060106110621063106410651066106710681069107010711072107310741075107610771078107910801081108210831084108510861087108810891090109110921093109410951096109710981099110011011102110311041105110611071108110911101111111211131114111511161117111811191120112111221123112411251126112711281129 |
- /***************************************************************************
- * ARM Stack Unwinder, Michael.McTernan.2001@cs.bris.ac.uk
- * Updated, adapted and several bug fixes on 2018 by Eduardo José Tagle
- *
- * This program is PUBLIC DOMAIN.
- * This means that there is no copyright and anyone is able to take a copy
- * for free and use it as they wish, with or without modifications, and in
- * any context, commercially or otherwise. The only limitation is that I
- * don't guarantee that the software is fit for any purpose or accept any
- * liability for it's use or misuse - this software is without warranty.
- ***************************************************************************
- * File Description: Abstract interpretation for Thumb mode.
- **************************************************************************/
-
- #if defined(__arm__) || defined(__thumb__)
-
- #define MODULE_NAME "UNWARM_THUMB"
-
- #include <stdio.h>
- #include "unwarm.h"
-
- /** Sign extend an 11 bit value.
- * This function simply inspects bit 11 of the input \a value, and if
- * set, the top 5 bits are set to give a 2's compliment signed value.
- * \param value The value to sign extend.
- * \return The signed-11 bit value stored in a 16bit data type.
- */
- static int32_t signExtend11(uint16_t value) {
-
- if(value & 0x400) {
- value |= 0xfffff800;
- }
-
- return value;
- }
-
- UnwResult UnwStartThumb(UnwState * const state) {
-
- bool found = false;
- uint16_t t = UNW_MAX_INSTR_COUNT;
- uint32_t lastJumpAddr = 0; // Last JUMP address, to try to detect infinite loops
- bool loopDetected = false; // If a loop was detected
-
- do {
- uint16_t instr;
-
- /* Attempt to read the instruction */
- if(!state->cb->readH(state->regData[15].v & (~0x1), &instr)) {
- return UNWIND_IREAD_H_FAIL;
- }
-
- UnwPrintd4("T %x %x %04x:", state->regData[13].v, state->regData[15].v, instr);
-
- /* Check that the PC is still on Thumb alignment */
- if(!(state->regData[15].v & 0x1)) {
- UnwPrintd1("\nError: PC misalignment\n");
- return UNWIND_INCONSISTENT;
- }
-
- /* Check that the SP and PC have not been invalidated */
- if(!M_IsOriginValid(state->regData[13].o) || !M_IsOriginValid(state->regData[15].o)) {
- UnwPrintd1("\nError: PC or SP invalidated\n");
- return UNWIND_INCONSISTENT;
- }
-
- /*
- * Detect 32bit thumb instructions
- */
- if ((instr & 0xe000) == 0xe000 && (instr & 0x1800) != 0) {
- uint16_t instr2;
-
- /* Check next address */
- state->regData[15].v += 2;
-
- /* Attempt to read the 2nd part of the instruction */
- if(!state->cb->readH(state->regData[15].v & (~0x1), &instr2)) {
- return UNWIND_IREAD_H_FAIL;
- }
-
- UnwPrintd3(" %x %04x:", state->regData[15].v, instr2);
-
- /*
- * Load/Store multiple: Only interpret
- * PUSH and POP
- */
- if ((instr & 0xfe6f) == 0xe82d) {
- bool L = (instr & 0x10) ? true : false;
- uint16_t rList = instr2;
-
- if(L) {
- uint8_t r;
-
- /* Load from memory: POP */
- UnwPrintd1("POP {Rlist}\n");
-
- /* Load registers from stack */
- for(r = 0; r < 16; r++) {
- if(rList & (0x1 << r)) {
-
- /* Read the word */
- if(!UnwMemReadRegister(state, state->regData[13].v, &state->regData[r])) {
- return UNWIND_DREAD_W_FAIL;
- }
-
- /* Alter the origin to be from the stack if it was valid */
- if(M_IsOriginValid(state->regData[r].o)) {
-
- state->regData[r].o = REG_VAL_FROM_STACK;
-
- /* If restoring the PC */
- if (r == 15) {
-
- /* The bottom bit should have been set to indicate that
- * the caller was from Thumb. This would allow return
- * by BX for interworking APCS.
- */
- if((state->regData[15].v & 0x1) == 0) {
- UnwPrintd2("Warning: Return address not to Thumb: 0x%08x\n", state->regData[15].v);
-
- /* Pop into the PC will not switch mode */
- return UNWIND_INCONSISTENT;
- }
-
- /* Store the return address */
- if(!UnwReportRetAddr(state, state->regData[15].v)) {
- return UNWIND_TRUNCATED;
- }
-
- /* Now have the return address */
- UnwPrintd2(" Return PC=%x\n", state->regData[15].v);
-
- /* Compensate for the auto-increment, which isn't needed here */
- state->regData[15].v -= 2;
-
- }
-
- } else {
-
- if (r == 15) {
- /* Return address is not valid */
- UnwPrintd1("PC popped with invalid address\n");
- return UNWIND_FAILURE;
- }
- }
-
- state->regData[13].v += 4;
-
- UnwPrintd3(" r%d = 0x%08x\n", r, state->regData[r].v);
- }
- }
- }
- else {
- int8_t r;
-
- /* Store to memory: PUSH */
- UnwPrintd1("PUSH {Rlist}");
-
- for(r = 15; r >= 0; r--) {
- if(rList & (0x1 << r)) {
- UnwPrintd4("\n r%d = 0x%08x\t; %s", r, state->regData[r].v, M_Origin2Str(state->regData[r].o));
-
- state->regData[13].v -= 4;
-
- if(!UnwMemWriteRegister(state, state->regData[13].v, &state->regData[r])) {
- return UNWIND_DWRITE_W_FAIL;
- }
- }
- }
- }
- }
- /*
- * PUSH register
- */
- else if (instr == 0xf84d && (instr2 & 0x0fff) == 0x0d04) {
- uint8_t r = instr2 >> 12;
-
- /* Store to memory: PUSH */
- UnwPrintd2("PUSH {R%d}\n", r);
- UnwPrintd4("\n r%d = 0x%08x\t; %s", r, state->regData[r].v, M_Origin2Str(state->regData[r].o));
-
- state->regData[13].v -= 4;
-
- if(!UnwMemWriteRegister(state, state->regData[13].v, &state->regData[r])) {
- return UNWIND_DWRITE_W_FAIL;
- }
- }
- /*
- * POP register
- */
- else if (instr == 0xf85d && (instr2 & 0x0fff) == 0x0b04) {
- uint8_t r = instr2 >> 12;
-
- /* Load from memory: POP */
- UnwPrintd2("POP {R%d}\n", r);
-
- /* Read the word */
- if(!UnwMemReadRegister(state, state->regData[13].v, &state->regData[r])) {
- return UNWIND_DREAD_W_FAIL;
- }
-
- /* Alter the origin to be from the stack if it was valid */
- if(M_IsOriginValid(state->regData[r].o)) {
-
- state->regData[r].o = REG_VAL_FROM_STACK;
-
- /* If restoring the PC */
- if (r == 15) {
-
- /* The bottom bit should have been set to indicate that
- * the caller was from Thumb. This would allow return
- * by BX for interworking APCS.
- */
- if((state->regData[15].v & 0x1) == 0) {
- UnwPrintd2("Warning: Return address not to Thumb: 0x%08x\n", state->regData[15].v);
-
- /* Pop into the PC will not switch mode */
- return UNWIND_INCONSISTENT;
- }
-
- /* Store the return address */
- if(!UnwReportRetAddr(state, state->regData[15].v)) {
- return UNWIND_TRUNCATED;
- }
-
- /* Now have the return address */
- UnwPrintd2(" Return PC=%x\n", state->regData[15].v);
-
- /* Compensate for the auto-increment, which isn't needed here */
- state->regData[15].v -= 2;
-
- }
-
- } else {
-
- if (r == 15) {
- /* Return address is not valid */
- UnwPrintd1("PC popped with invalid address\n");
- return UNWIND_FAILURE;
- }
- }
-
- state->regData[13].v += 4;
-
- UnwPrintd3(" r%d = 0x%08x\n", r, state->regData[r].v);
- }
- /*
- * TBB / TBH
- */
- else if ((instr & 0xfff0) == 0xe8d0 && (instr2 & 0xffe0) == 0xf000) {
- /* We are only interested in
- * the forms
- * TBB [PC, ...]
- * TBH [PC, ..., LSL #1]
- * as those are used by the C compiler to implement
- * the switch clauses
- */
- uint8_t rn = instr & 0xf;
- uint8_t rm = instr2 & 0xf;
- bool H = (instr2 & 0x10) ? true : false;
-
- UnwPrintd5("TB%c [r%d,r%d%s]\n", H ? 'H' : 'B', rn, rm, H ? ",LSL #1" : "");
-
- // We are only interested if the RN is the PC. Let's choose the 1st destination
- if (rn == 15) {
- if (H) {
- uint16_t rv;
- if(!state->cb->readH((state->regData[15].v & (~1)) + 2, &rv)) {
- return UNWIND_DREAD_H_FAIL;
- }
- state->regData[15].v += rv * 2;
- } else {
- uint8_t rv;
- if(!state->cb->readB((state->regData[15].v & (~1)) + 2, &rv)) {
- return UNWIND_DREAD_B_FAIL;
- }
- state->regData[15].v += rv * 2;
- }
- }
- }
- /*
- * Unconditional branch
- */
- else if ((instr & 0xf800) == 0xf000 && (instr2 & 0xd000) == 0x9000) {
- uint32_t v;
-
- uint8_t S = (instr & 0x400) >> 10;
- uint16_t imm10 = (instr & 0x3ff);
- uint8_t J1 = (instr2 & 0x2000) >> 13;
- uint8_t J2 = (instr2 & 0x0800) >> 11;
- uint16_t imm11 = (instr2 & 0x7ff);
-
- uint8_t I1 = J1 ^ S ^ 1;
- uint8_t I2 = J2 ^ S ^ 1;
- uint32_t imm32 = (S << 24) | (I1 << 23) | (I2 << 22) |(imm10 << 12) | (imm11 << 1);
- if (S) imm32 |= 0xfe000000;
-
- UnwPrintd2("B %d \n", imm32);
-
- /* Update PC */
- state->regData[15].v += imm32;
-
- /* Need to advance by a word to account for pre-fetch.
- * Advance by a half word here, allowing the normal address
- * advance to account for the other half word.
- */
- state->regData[15].v += 2;
-
- /* Compute the jump address */
- v = state->regData[15].v + 2;
-
- /* Display PC of next instruction */
- UnwPrintd2(" New PC=%x", v);
-
- /* Did we detect an infinite loop ? */
- loopDetected = lastJumpAddr == v;
-
- /* Remember the last address we jumped to */
- lastJumpAddr = v;
- }
-
- /*
- * Branch with link
- */
- else if ((instr & 0xf800) == 0xf000 && (instr2 & 0xd000) == 0xd000) {
-
- uint8_t S = (instr & 0x400) >> 10;
- uint16_t imm10 = (instr & 0x3ff);
- uint8_t J1 = (instr2 & 0x2000) >> 13;
- uint8_t J2 = (instr2 & 0x0800) >> 11;
- uint16_t imm11 = (instr2 & 0x7ff);
-
- uint8_t I1 = J1 ^ S ^ 1;
- uint8_t I2 = J2 ^ S ^ 1;
- uint32_t imm32 = (S << 24) | (I1 << 23) | (I2 << 22) |(imm10 << 12) | (imm11 << 1);
- if (S) imm32 |= 0xfe000000;
-
- UnwPrintd2("BL %d \n", imm32);
-
- /* Never taken, as we are unwinding the stack */
- if (0) {
-
- /* Store return address in LR register */
- state->regData[14].v = state->regData[15].v + 2;
- state->regData[14].o = REG_VAL_FROM_CONST;
-
- /* Update PC */
- state->regData[15].v += imm32;
-
- /* Need to advance by a word to account for pre-fetch.
- * Advance by a half word here, allowing the normal address
- * advance to account for the other half word.
- */
- state->regData[15].v += 2;
-
- /* Display PC of next instruction */
- UnwPrintd2(" Return PC=%x", state->regData[15].v);
-
- /* Report the return address, including mode bit */
- if(!UnwReportRetAddr(state, state->regData[15].v)) {
- return UNWIND_TRUNCATED;
- }
-
- /* Determine the new mode */
- if(state->regData[15].v & 0x1) {
- /* Branching to THUMB */
-
- /* Account for the auto-increment which isn't needed */
- state->regData[15].v -= 2;
- }
- else {
- /* Branch to ARM */
- return UnwStartArm(state);
- }
- }
- }
-
- /*
- * Conditional branches. Usually not taken, unless infinite loop is detected
- */
- else if ((instr & 0xf800) == 0xf000 && (instr2 & 0xd000) == 0x8000) {
-
- uint8_t S = (instr & 0x400) >> 10;
- uint16_t imm6 = (instr & 0x3f);
- uint8_t J1 = (instr2 & 0x2000) >> 13;
- uint8_t J2 = (instr2 & 0x0800) >> 11;
- uint16_t imm11 = (instr2 & 0x7ff);
-
- uint8_t I1 = J1 ^ S ^ 1;
- uint8_t I2 = J2 ^ S ^ 1;
- uint32_t imm32 = (S << 20) | (I1 << 19) | (I2 << 18) |(imm6 << 12) | (imm11 << 1);
- if (S) imm32 |= 0xffe00000;
-
- UnwPrintd2("Bcond %d\n", imm32);
-
- /* Take the jump only if a loop is detected */
- if (loopDetected) {
-
- /* Update PC */
- state->regData[15].v += imm32;
-
- /* Need to advance by a word to account for pre-fetch.
- * Advance by a half word here, allowing the normal address
- * advance to account for the other half word.
- */
- state->regData[15].v += 2;
-
- /* Display PC of next instruction */
- UnwPrintd2(" New PC=%x", state->regData[15].v + 2);
- }
- }
- /*
- * PC-relative load
- * LDR Rd,[PC, #+/-imm]
- */
- else if((instr & 0xff7f) == 0xf85f) {
- uint8_t rt = (instr2 & 0xf000) >> 12;
- uint8_t imm12 = (instr2 & 0x0fff);
- bool A = (instr & 0x80) ? true : false;
- uint32_t address;
-
- /* Compute load address, adding a word to account for prefetch */
- address = (state->regData[15].v & (~0x3)) + 4;
- if (A) address += imm12;
- else address -= imm12;
-
- UnwPrintd4("LDR r%d,[PC #%c0x%08x]", rt, A?'+':'-', address);
-
- if(!UnwMemReadRegister(state, address, &state->regData[rt])) {
- return UNWIND_DREAD_W_FAIL;
- }
- }
- /*
- * LDR immediate.
- * We are only interested when destination is PC.
- * LDR Rt,[Rn , #n]
- */
- else if ((instr & 0xfff0) == 0xf8d0) {
- uint8_t rn = (instr & 0xf);
- uint8_t rt = (instr2 & 0xf000) >> 12;
- uint16_t imm12 = (instr2 & 0xfff);
-
- /* If destination is PC and we don't know the source value, then fail */
- if (!M_IsOriginValid(state->regData[rn].o)) {
- state->regData[rt].o = state->regData[rn].o;
- } else {
- uint32_t address = state->regData[rn].v + imm12;
- if(!UnwMemReadRegister(state, address, &state->regData[rt])) {
- return UNWIND_DREAD_W_FAIL;
- }
- }
- }
- /*
- * LDR immediate
- * We are only interested when destination is PC.
- * LDR Rt,[Rn , #-n]
- * LDR Rt,[Rn], #+/-n]
- * LDR Rt,[Rn, #+/-n]!
- */
- else if ((instr & 0xfff0) == 0xf850 && (instr2 & 0x0800) == 0x0800) {
- uint8_t rn = (instr & 0xf);
- uint8_t rt = (instr2 & 0xf000) >> 12;
- uint16_t imm8 = (instr2 & 0xff);
- bool P = (instr2 & 0x400) ? true : false;
- bool U = (instr2 & 0x200) ? true : false;
- bool W = (instr2 & 0x100) ? true : false;
-
- if (!M_IsOriginValid(state->regData[rn].o)) {
- state->regData[rt].o = state->regData[rn].o;
- } else {
- uint32_t offaddress = state->regData[rn].v + imm8;
- if (U) offaddress += imm8;
- else offaddress -= imm8;
-
- uint32_t address;
- if (P) {
- address = offaddress;
- } else {
- address = state->regData[rn].v;
- }
-
- if(!UnwMemReadRegister(state, address, &state->regData[rt])) {
- return UNWIND_DREAD_W_FAIL;
- }
-
- if (W) {
- state->regData[rn].v = offaddress;
- }
- }
- }
- /*
- * LDR (register).
- * We are interested in the form
- * ldr Rt, [Rn, Rm, lsl #x]
- * Where Rt is PC, Rn value is known, Rm is not known or unknown
- */
- else if ((instr & 0xfff0) == 0xf850 && (instr2 & 0x0fc0) == 0x0000) {
- uint8_t rn = (instr & 0xf);
- uint8_t rt = (instr2 & 0xf000) >> 12;
- uint8_t rm = (instr2 & 0xf);
- uint8_t imm2 = (instr2 & 0x30) >> 4;
-
- if (!M_IsOriginValid(state->regData[rn].o) ||
- !M_IsOriginValid(state->regData[rm].o)) {
-
- /* If Rt is PC, and Rn is known, then do an exception and assume
- Rm equals 0 => This takes the first case in a switch() */
- if (rt == 15 && M_IsOriginValid(state->regData[rn].o)) {
- uint32_t address = state->regData[rn].v;
- if(!UnwMemReadRegister(state, address, &state->regData[rt])) {
- return UNWIND_DREAD_W_FAIL;
- }
- } else {
- /* Propagate unknown value */
- state->regData[rt].o = state->regData[rn].o;
- }
- } else {
- uint32_t address = state->regData[rn].v + (state->regData[rm].v << imm2);
- if(!UnwMemReadRegister(state, address, &state->regData[rt])) {
- return UNWIND_DREAD_W_FAIL;
- }
- }
- }
- else {
- UnwPrintd1("???? (32)");
-
- /* Unknown/undecoded. May alter some register, so invalidate file */
- UnwInvalidateRegisterFile(state->regData);
- }
- /* End of thumb 32bit code */
-
- }
- /* Format 1: Move shifted register
- * LSL Rd, Rs, #Offset5
- * LSR Rd, Rs, #Offset5
- * ASR Rd, Rs, #Offset5
- */
- else if((instr & 0xe000) == 0x0000 && (instr & 0x1800) != 0x1800) {
- bool signExtend;
- uint8_t op = (instr & 0x1800) >> 11;
- uint8_t offset5 = (instr & 0x07c0) >> 6;
- uint8_t rs = (instr & 0x0038) >> 3;
- uint8_t rd = (instr & 0x0007);
-
- switch(op) {
- case 0: /* LSL */
- UnwPrintd6("LSL r%d, r%d, #%d\t; r%d %s", rd, rs, offset5, rs, M_Origin2Str(state->regData[rs].o));
- state->regData[rd].v = state->regData[rs].v << offset5;
- state->regData[rd].o = state->regData[rs].o;
- state->regData[rd].o |= REG_VAL_ARITHMETIC;
- break;
-
- case 1: /* LSR */
- UnwPrintd6("LSR r%d, r%d, #%d\t; r%d %s", rd, rs, offset5, rs, M_Origin2Str(state->regData[rs].o));
- state->regData[rd].v = state->regData[rs].v >> offset5;
- state->regData[rd].o = state->regData[rs].o;
- state->regData[rd].o |= REG_VAL_ARITHMETIC;
- break;
-
- case 2: /* ASR */
- UnwPrintd6("ASL r%d, r%d, #%d\t; r%d %s", rd, rs, offset5, rs, M_Origin2Str(state->regData[rs].o));
-
- signExtend = (state->regData[rs].v & 0x8000) ? true : false;
- state->regData[rd].v = state->regData[rs].v >> offset5;
- if(signExtend) {
- state->regData[rd].v |= 0xffffffff << (32 - offset5);
- }
- state->regData[rd].o = state->regData[rs].o;
- state->regData[rd].o |= REG_VAL_ARITHMETIC;
- break;
- }
- }
- /* Format 2: add/subtract
- * ADD Rd, Rs, Rn
- * ADD Rd, Rs, #Offset3
- * SUB Rd, Rs, Rn
- * SUB Rd, Rs, #Offset3
- */
- else if((instr & 0xf800) == 0x1800) {
- bool I = (instr & 0x0400) ? true : false;
- bool op = (instr & 0x0200) ? true : false;
- uint8_t rn = (instr & 0x01c0) >> 6;
- uint8_t rs = (instr & 0x0038) >> 3;
- uint8_t rd = (instr & 0x0007);
-
- /* Print decoding */
- UnwPrintd6("%s r%d, r%d, %c%d\t;",op ? "SUB" : "ADD",rd, rs,I ? '#' : 'r',rn);
- UnwPrintd5("r%d %s, r%d %s",rd, M_Origin2Str(state->regData[rd].o),rs, M_Origin2Str(state->regData[rs].o));
- if(!I) {
-
- UnwPrintd3(", r%d %s", rn, M_Origin2Str(state->regData[rn].o));
-
- /* Perform calculation */
- if(op) {
- state->regData[rd].v = state->regData[rs].v - state->regData[rn].v;
- }
- else {
- state->regData[rd].v = state->regData[rs].v + state->regData[rn].v;
- }
-
- /* Propagate the origin */
- if(M_IsOriginValid(state->regData[rs].o) &&
- M_IsOriginValid(state->regData[rn].o)) {
- state->regData[rd].o = state->regData[rs].o;
- state->regData[rd].o |= REG_VAL_ARITHMETIC;
- }
- else {
- state->regData[rd].o = REG_VAL_INVALID;
- }
- }
- else {
- /* Perform calculation */
- if(op) {
- state->regData[rd].v = state->regData[rs].v - rn;
- }
- else {
- state->regData[rd].v = state->regData[rs].v + rn;
- }
-
- /* Propagate the origin */
- state->regData[rd].o = state->regData[rs].o;
- state->regData[rd].o |= REG_VAL_ARITHMETIC;
- }
- }
- /* Format 3: move/compare/add/subtract immediate
- * MOV Rd, #Offset8
- * CMP Rd, #Offset8
- * ADD Rd, #Offset8
- * SUB Rd, #Offset8
- */
- else if((instr & 0xe000) == 0x2000) {
-
- uint8_t op = (instr & 0x1800) >> 11;
- uint8_t rd = (instr & 0x0700) >> 8;
- uint8_t offset8 = (instr & 0x00ff);
-
- switch(op) {
- case 0: /* MOV */
- UnwPrintd3("MOV r%d, #0x%x", rd, offset8);
- state->regData[rd].v = offset8;
- state->regData[rd].o = REG_VAL_FROM_CONST;
- break;
-
- case 1: /* CMP */
- /* Irrelevant to unwinding */
- UnwPrintd1("CMP ???");
- break;
-
- case 2: /* ADD */
- UnwPrintd5("ADD r%d, #0x%x\t; r%d %s", rd, offset8, rd, M_Origin2Str(state->regData[rd].o));
- state->regData[rd].v += offset8;
- state->regData[rd].o |= REG_VAL_ARITHMETIC;
- break;
-
- case 3: /* SUB */
- UnwPrintd5("SUB r%d, #0x%d\t; r%d %s", rd, offset8, rd, M_Origin2Str(state->regData[rd].o));
- state->regData[rd].v -= offset8;
- state->regData[rd].o |= REG_VAL_ARITHMETIC;
- break;
- }
- }
- /* Format 4: ALU operations
- * AND Rd, Rs
- * EOR Rd, Rs
- * LSL Rd, Rs
- * LSR Rd, Rs
- * ASR Rd, Rs
- * ADC Rd, Rs
- * SBC Rd, Rs
- * ROR Rd, Rs
- * TST Rd, Rs
- * NEG Rd, Rs
- * CMP Rd, Rs
- * CMN Rd, Rs
- * ORR Rd, Rs
- * MUL Rd, Rs
- * BIC Rd, Rs
- * MVN Rd, Rs
- */
- else if((instr & 0xfc00) == 0x4000) {
- uint8_t op = (instr & 0x03c0) >> 6;
- uint8_t rs = (instr & 0x0038) >> 3;
- uint8_t rd = (instr & 0x0007);
-
- #if defined(UNW_DEBUG)
- static const char * const mnu[16] = {
- "AND", "EOR", "LSL", "LSR",
- "ASR", "ADC", "SBC", "ROR",
- "TST", "NEG", "CMP", "CMN",
- "ORR", "MUL", "BIC", "MVN" };
- #endif
- /* Print the mnemonic and registers */
- switch(op) {
- case 0: /* AND */
- case 1: /* EOR */
- case 2: /* LSL */
- case 3: /* LSR */
- case 4: /* ASR */
- case 7: /* ROR */
- case 9: /* NEG */
- case 12: /* ORR */
- case 13: /* MUL */
- case 15: /* MVN */
- UnwPrintd8("%s r%d ,r%d\t; r%d %s, r%d %s",mnu[op],rd, rs, rd, M_Origin2Str(state->regData[rd].o), rs, M_Origin2Str(state->regData[rs].o));
- break;
-
- case 5: /* ADC */
- case 6: /* SBC */
- UnwPrintd4("%s r%d, r%d", mnu[op], rd, rs);
- break;
-
- case 8: /* TST */
- case 10: /* CMP */
- case 11: /* CMN */
- /* Irrelevant to unwinding */
- UnwPrintd2("%s ???", mnu[op]);
- break;
-
- case 14: /* BIC */
- UnwPrintd5("r%d ,r%d\t; r%d %s", rd, rs, rs, M_Origin2Str(state->regData[rs].o));
- break;
- }
-
- /* Perform operation */
- switch(op) {
- case 0: /* AND */
- state->regData[rd].v &= state->regData[rs].v;
- break;
-
- case 1: /* EOR */
- state->regData[rd].v ^= state->regData[rs].v;
- break;
-
- case 2: /* LSL */
- state->regData[rd].v <<= state->regData[rs].v;
- break;
-
- case 3: /* LSR */
- state->regData[rd].v >>= state->regData[rs].v;
- break;
-
- case 4: /* ASR */
- if(state->regData[rd].v & 0x80000000) {
- state->regData[rd].v >>= state->regData[rs].v;
- state->regData[rd].v |= 0xffffffff << (32 - state->regData[rs].v);
- }
- else {
- state->regData[rd].v >>= state->regData[rs].v;
- }
-
- break;
-
- case 5: /* ADC */
- case 6: /* SBC */
- case 8: /* TST */
- case 10: /* CMP */
- case 11: /* CMN */
- break;
-
- case 7: /* ROR */
- state->regData[rd].v = (state->regData[rd].v >> state->regData[rs].v) |
- (state->regData[rd].v << (32 - state->regData[rs].v));
- break;
-
- case 9: /* NEG */
- state->regData[rd].v = -state->regData[rs].v;
- break;
-
- case 12: /* ORR */
- state->regData[rd].v |= state->regData[rs].v;
- break;
-
- case 13: /* MUL */
- state->regData[rd].v *= state->regData[rs].v;
- break;
-
- case 14: /* BIC */
- state->regData[rd].v &= ~state->regData[rs].v;
- break;
-
- case 15: /* MVN */
- state->regData[rd].v = ~state->regData[rs].v;
- break;
- }
-
- /* Propagate data origins */
- switch(op) {
- case 0: /* AND */
- case 1: /* EOR */
- case 2: /* LSL */
- case 3: /* LSR */
- case 4: /* ASR */
- case 7: /* ROR */
- case 12: /* ORR */
- case 13: /* MUL */
- case 14: /* BIC */
- if(M_IsOriginValid(state->regData[rd].o) && M_IsOriginValid(state->regData[rs].o)) {
- state->regData[rd].o = state->regData[rs].o;
- state->regData[rd].o |= REG_VAL_ARITHMETIC;
- }
- else {
- state->regData[rd].o = REG_VAL_INVALID;
- }
- break;
-
- case 5: /* ADC */
- case 6: /* SBC */
- /* C-bit not tracked */
- state->regData[rd].o = REG_VAL_INVALID;
- break;
-
- case 8: /* TST */
- case 10: /* CMP */
- case 11: /* CMN */
- /* Nothing propagated */
- break;
-
- case 9: /* NEG */
- case 15: /* MVN */
- state->regData[rd].o = state->regData[rs].o;
- state->regData[rd].o |= REG_VAL_ARITHMETIC;
- break;
- }
- }
- /* Format 5: Hi register operations/branch exchange
- * ADD Rd, Hs
- * CMP Hd, Rs
- * MOV Hd, Hs
- */
- else if((instr & 0xfc00) == 0x4400) {
- uint8_t op = (instr & 0x0300) >> 8;
- bool h1 = (instr & 0x0080) ? true: false;
- bool h2 = (instr & 0x0040) ? true: false;
- uint8_t rhs = (instr & 0x0038) >> 3;
- uint8_t rhd = (instr & 0x0007);
-
- /* Adjust the register numbers */
- if(h2)
- rhs += 8;
- if(h1)
- rhd += 8;
-
- switch(op) {
- case 0: /* ADD */
- UnwPrintd5("ADD r%d, r%d\t; r%d %s", rhd, rhs, rhs, M_Origin2Str(state->regData[rhs].o));
- state->regData[rhd].v += state->regData[rhs].v;
- state->regData[rhd].o = state->regData[rhs].o;
- state->regData[rhd].o |= REG_VAL_ARITHMETIC;
- break;
-
- case 1: /* CMP */
- /* Irrelevant to unwinding */
- UnwPrintd1("CMP ???");
- break;
-
- case 2: /* MOV */
- UnwPrintd5("MOV r%d, r%d\t; r%d %s", rhd, rhs, rhd, M_Origin2Str(state->regData[rhs].o));
- state->regData[rhd].v = state->regData[rhs].v;
- state->regData[rhd].o = state->regData[rhd].o;
- break;
-
- case 3: /* BX */
- UnwPrintd4("BX r%d\t; r%d %s\n", rhs, rhs, M_Origin2Str(state->regData[rhs].o));
-
- /* Only follow BX if the data was from the stack or BX LR */
- if(rhs == 14 || state->regData[rhs].o == REG_VAL_FROM_STACK) {
- UnwPrintd2(" Return PC=0x%x\n", state->regData[rhs].v & (~0x1));
-
- /* Report the return address, including mode bit */
- if(!UnwReportRetAddr(state, state->regData[rhs].v)) {
- return UNWIND_TRUNCATED;
- }
-
- /* Update the PC */
- state->regData[15].v = state->regData[rhs].v;
-
- /* Determine the new mode */
- if(state->regData[rhs].v & 0x1) {
- /* Branching to THUMB */
-
- /* Account for the auto-increment which isn't needed */
- state->regData[15].v -= 2;
- }
- else {
- /* Branch to ARM */
- return UnwStartArm(state);
- }
- }
- else {
- UnwPrintd4("\nError: BX to invalid register: r%d = 0x%x (%s)\n", rhs, state->regData[rhs].o, M_Origin2Str(state->regData[rhs].o));
- return UNWIND_FAILURE;
- }
- }
- }
- /* Format 9: PC-relative load
- * LDR Rd,[PC, #imm]
- */
- else if((instr & 0xf800) == 0x4800) {
- uint8_t rd = (instr & 0x0700) >> 8;
- uint8_t word8 = (instr & 0x00ff);
- uint32_t address;
-
- /* Compute load address, adding a word to account for prefetch */
- address = (state->regData[15].v & (~0x3)) + 4 + (word8 << 2);
-
- UnwPrintd3("LDR r%d, 0x%08x", rd, address);
-
- if(!UnwMemReadRegister(state, address, &state->regData[rd])) {
- return UNWIND_DREAD_W_FAIL;
- }
- }
- /* Format 13: add offset to Stack Pointer
- * ADD sp,#+imm
- * ADD sp,#-imm
- */
- else if((instr & 0xff00) == 0xB000) {
- uint8_t value = (instr & 0x7f) * 4;
-
- /* Check the negative bit */
- if((instr & 0x80) != 0) {
- UnwPrintd2("SUB sp,#0x%x", value);
- state->regData[13].v -= value;
- }
- else {
- UnwPrintd2("ADD sp,#0x%x", value);
- state->regData[13].v += value;
- }
- }
- /* Format 14: push/pop registers
- * PUSH {Rlist}
- * PUSH {Rlist, LR}
- * POP {Rlist}
- * POP {Rlist, PC}
- */
- else if((instr & 0xf600) == 0xb400) {
- bool L = (instr & 0x0800) ? true : false;
- bool R = (instr & 0x0100) ? true : false;
- uint8_t rList = (instr & 0x00ff);
-
- if(L) {
- uint8_t r;
-
- /* Load from memory: POP */
- UnwPrintd2("POP {Rlist%s}\n", R ? ", PC" : "");
-
- for(r = 0; r < 8; r++) {
- if(rList & (0x1 << r)) {
-
- /* Read the word */
- if(!UnwMemReadRegister(state, state->regData[13].v, &state->regData[r])) {
- return UNWIND_DREAD_W_FAIL;
- }
-
- /* Alter the origin to be from the stack if it was valid */
- if(M_IsOriginValid(state->regData[r].o)) {
- state->regData[r].o = REG_VAL_FROM_STACK;
- }
-
- state->regData[13].v += 4;
-
- UnwPrintd3(" r%d = 0x%08x\n", r, state->regData[r].v);
- }
- }
-
- /* Check if the PC is to be popped */
- if(R) {
- /* Get the return address */
- if(!UnwMemReadRegister(state, state->regData[13].v, &state->regData[15])) {
- return UNWIND_DREAD_W_FAIL;
- }
-
- /* Alter the origin to be from the stack if it was valid */
- if(!M_IsOriginValid(state->regData[15].o)) {
- /* Return address is not valid */
- UnwPrintd1("PC popped with invalid address\n");
- return UNWIND_FAILURE;
- }
- else {
- /* The bottom bit should have been set to indicate that
- * the caller was from Thumb. This would allow return
- * by BX for interworking APCS.
- */
- if((state->regData[15].v & 0x1) == 0) {
- UnwPrintd2("Warning: Return address not to Thumb: 0x%08x\n", state->regData[15].v);
-
- /* Pop into the PC will not switch mode */
- return UNWIND_INCONSISTENT;
- }
-
- /* Store the return address */
- if(!UnwReportRetAddr(state, state->regData[15].v)) {
- return UNWIND_TRUNCATED;
- }
-
- /* Now have the return address */
- UnwPrintd2(" Return PC=%x\n", state->regData[15].v);
-
- /* Update the pc */
- state->regData[13].v += 4;
-
- /* Compensate for the auto-increment, which isn't needed here */
- state->regData[15].v -= 2;
- }
- }
- }
- else {
- int8_t r;
-
- /* Store to memory: PUSH */
- UnwPrintd2("PUSH {Rlist%s}", R ? ", LR" : "");
-
- /* Check if the LR is to be pushed */
- if(R) {
- UnwPrintd3("\n lr = 0x%08x\t; %s", state->regData[14].v, M_Origin2Str(state->regData[14].o));
-
- state->regData[13].v -= 4;
-
- /* Write the register value to memory */
- if(!UnwMemWriteRegister(state, state->regData[13].v, &state->regData[14])) {
- return UNWIND_DWRITE_W_FAIL;
- }
- }
-
- for(r = 7; r >= 0; r--) {
- if(rList & (0x1 << r)) {
- UnwPrintd4("\n r%d = 0x%08x\t; %s", r, state->regData[r].v, M_Origin2Str(state->regData[r].o));
-
- state->regData[13].v -= 4;
-
- if(!UnwMemWriteRegister(state, state->regData[13].v, &state->regData[r])) {
- return UNWIND_DWRITE_W_FAIL;
- }
- }
- }
- }
- }
-
- /*
- * Conditional branches
- * Bcond
- */
- else if((instr & 0xf000) == 0xd000) {
- int32_t branchValue = (instr & 0xff);
- if (branchValue & 0x80) branchValue |= 0xffffff00;
-
- /* Branch distance is twice that specified in the instruction. */
- branchValue *= 2;
-
- UnwPrintd2("Bcond %d \n", branchValue);
-
- /* Only take the branch if a loop was detected */
- if (loopDetected) {
-
- /* Update PC */
- state->regData[15].v += branchValue;
-
- /* Need to advance by a word to account for pre-fetch.
- * Advance by a half word here, allowing the normal address
- * advance to account for the other half word.
- */
- state->regData[15].v += 2;
-
- /* Display PC of next instruction */
- UnwPrintd2(" New PC=%x", state->regData[15].v + 2);
- }
- }
-
- /* Format 18: unconditional branch
- * B label
- */
- else if((instr & 0xf800) == 0xe000) {
- uint32_t v;
- int32_t branchValue = signExtend11(instr & 0x07ff);
-
- /* Branch distance is twice that specified in the instruction. */
- branchValue *= 2;
-
- UnwPrintd2("B %d \n", branchValue);
-
- /* Update PC */
- state->regData[15].v += branchValue;
-
- /* Need to advance by a word to account for pre-fetch.
- * Advance by a half word here, allowing the normal address
- * advance to account for the other half word.
- */
- state->regData[15].v += 2;
-
- /* Compute the jump address */
- v = state->regData[15].v + 2;
-
- /* Display PC of next instruction */
- UnwPrintd2(" New PC=%x", v);
-
- /* Did we detect an infinite loop ? */
- loopDetected = lastJumpAddr == v;
-
- /* Remember the last address we jumped to */
- lastJumpAddr = v;
- }
- else {
- UnwPrintd1("????");
-
- /* Unknown/undecoded. May alter some register, so invalidate file */
- UnwInvalidateRegisterFile(state->regData);
- }
-
- UnwPrintd1("\n");
-
- /* Should never hit the reset vector */
- if(state->regData[15].v == 0)
- return UNWIND_RESET;
-
- /* Check next address */
- state->regData[15].v += 2;
-
- /* Garbage collect the memory hash (used only for the stack) */
- UnwMemHashGC(state);
-
- t--;
- if(t == 0)
- return UNWIND_EXHAUSTED;
-
- } while(!found);
-
- return UNWIND_SUCCESS;
- }
-
- #endif
|