1 /*
2 * Common Development and Distribution License ("CDDL"), version 1.0.
3 * You may only use this file in accordance with the terms of version
4 * 1.0 of the CDDL.
5 *
6 * A full copy of the text of the CDDL should have accompanied this
7 * source. A copy of the CDDL is also available via the Internet at
8 * http://www.illumos.org/license/CDDL.
9 */
10 /*
11 * Copyright (c) 2013, Joyent, Inc. All rights reserved.
12 */
13
14 /*
15 * This provides basic support for disassembling arm instructions. This is
16 * derived from the arm reference manual (generic), chapter A3 (ARM DDI 0100l).
17 * All instructions come in as uint32_t's.
18 */
19
20 #include <libdisasm.h>
21 #include <stdint.h>
22 #include <stdio.h>
23 #include <sys/byteorder.h>
24
25 #include "libdisasm_impl.h"
26
27 extern size_t strlcat(char *, const char *, size_t);
28
29 /*
30 * Condition code mask and shift, aka bits 28-31.
31 */
32 #define ARM_CC_MASK 0xf0000000
33 #define ARM_CC_SHIFT 28
34
35 /*
36 * First level of decoding, aka bits 25-27.
37 */
38 #define ARM_L1_DEC_MASK 0x0e000000
39 #define ARM_L1_DEC_SHIFT 25
40
41 /*
42 * Masks and values for the 0b000 l1 group
43 */
44 #define ARM_L1_0_B4_MASK 0x00000010
45 #define ARM_L1_0_B7_MASK 0x00000080
46 #define ARM_L1_0_OPMASK 0x01800000
47 #define ARM_L1_0_SPECOP 0x01000000
48 #define ARM_L1_0_SMASK 0x00100000
49 #define ARM_L1_0_ELS_MASK 0x00000060
50
51 /*
52 * Masks and values for the 0b001 l1 group.
53 */
54 #define ARM_L1_1_OPMASK 0x01800000
55 #define ARM_L1_1_SPECOP 0x01000000
56 #define ARM_L1_1_SMASK 0x00100000
57 #define ARM_L1_1_UNDEF_MASK 0x00200000
58
59 /*
60 * Masks and values for the 0b011 l1 group
61 */
62 #define ARM_L1_3_B4_MASK 0x00000010
63 #define ARM_L1_3_ARCHUN_MASK 0x01f000f0
64
65 /*
66 * Masks for the 0b111 l1 group
67 */
68 #define ARM_L1_7_COPROCMASK 0x00000010
69 #define ARM_L1_7_SWINTMASK 0x01000000
70
71 /*
72 * Masks for the data processing instructions (dpi)
73 */
74 #define ARM_DPI_OPCODE_MASK 0x01e00000
75 #define ARM_DPI_OPCODE_SHIFT 21
76 #define ARM_DPI_IBIT_MASK 0x02000000
77 #define ARM_DPI_SBIT_MASK 0x00100000
78 #define ARM_DPI_RN_MASK 0x000f0000
79 #define ARM_DPI_RN_SHIFT 16
80 #define ARM_DPI_RD_MASK 0x0000f000
81 #define ARM_DPI_RD_SHIFT 12
82 #define ARM_DPI_BIT4_MASK 0x00000010
83
84 #define ARM_DPI_IMM_ROT_MASK 0x00000f00
85 #define ARM_DPI_IMM_ROT_SHIFT 8
86 #define ARM_DPI_IMM_VAL_MASK 0x000000ff
87
88 #define ARM_DPI_IMS_SHIMM_MASK 0x00000f80
89 #define ARM_DPI_IMS_SHIMM_SHIFT 7
90 #define ARM_DPI_IMS_SHIFT_MASK 0x00000060
91 #define ARM_DPI_IMS_SHIFT_SHIFT 5
92 #define ARM_DPI_IMS_RM_MASK 0x0000000f
93
94 #define ARM_DPI_REGS_RS_MASK 0x00000f00
95 #define ARM_DPI_REGS_RS_SHIFT 8
96 #define ARM_DPI_REGS_SHIFT_MASK 0x00000060
97 #define ARM_DPI_REGS_SHIFT_SHIFT 5
98 #define ARM_DPI_REGS_RM_MASK 0x0000000f
99
100 /*
101 * Definitions for the word and byte LDR and STR instructions
102 */
103 #define ARM_LS_IBIT_MASK 0x02000000
104 #define ARM_LS_PBIT_MASK 0x01000000
105 #define ARM_LS_UBIT_MASK 0x00800000
106 #define ARM_LS_BBIT_MASK 0x00400000
107 #define ARM_LS_WBIT_MASK 0x00200000
108 #define ARM_LS_LBIT_MASK 0x00100000
109 #define ARM_LS_RN_MASK 0x000f0000
110 #define ARM_LS_RN_SHIFT 16
111 #define ARM_LS_RD_MASK 0x0000f000
112 #define ARM_LS_RD_SHIFT 12
113
114 #define ARM_LS_IMM_MASK 0x00000fff
115
116 #define ARM_LS_REG_RM_MASK 0x0000000f
117 #define ARM_LS_REG_NRM_MASK 0x00000ff0
118
119 #define ARM_LS_SCR_SIMM_MASK 0x00000f80
120 #define ARM_LS_SCR_SIMM_SHIFT 7
121 #define ARM_LS_SCR_SCODE_MASK 0x00000060
122 #define ARM_LS_SCR_SCODE_SHIFT 5
123 #define ARM_LS_SCR_RM_MASK 0x0000000f
124
125 /*
126 * Masks for the Load and Store multiple instructions.
127 */
128 #define ARM_LSM_PBIT_MASK 0x01000000
129 #define ARM_LSM_UBIT_MASK 0x00800000
130 #define ARM_LSM_SBIT_MASK 0x00400000
131 #define ARM_LSM_WBIT_MASK 0x00200000
132 #define ARM_LSM_LBIT_MASK 0x00100000
133 #define ARM_LSM_RN_MASK 0x000f0000
134 #define ARM_LSM_RN_SHIFT 16
135 #define ARM_LSM_RLIST_MASK 0x0000ffff
136 #define ARM_LSM_ADDR_MASK 0x01800000
137 #define ARM_LSM_ADDR_SHIFT 23
138
139 /*
140 * Masks for the Extended and Misc. Loads and stores. This is the extension
141 * space from figure A3-5. Most of them are handled by arm_dis_els() with the
142 * exception or swap / swap byte and load/store register exclusive which due to
143 * its nature is handled elsewhere.
144 */
145 #define ARM_ELS_SWAP_MASK 0x01b00000
146 #define ARM_ELS_SWAP_BYTE_MASK 0x00400000
147 #define ARM_ELS_IS_SWAP 0x01000000
148 #define ARM_ELS_EXCL_MASK 0x01800000
149 #define ARM_ELS_PBIT_MASK 0x01000000
150 #define ARM_ELS_UBIT_MASK 0x00800000
151 #define ARM_ELS_IBIT_MASK 0x00400000
152 #define ARM_ELS_WBIT_MASK 0x00200000
153 #define ARM_ELS_LBIT_MASK 0x00100000
154 #define ARM_ELS_SBIT_MASK 0x00000040
155 #define ARM_ELS_HBIT_MASK 0x00000020
156 #define ARM_ELS_RN_MASK 0x000f0000
157 #define ARM_ELS_RN_SHIFT 16
158 #define ARM_ELS_RD_MASK 0x0000f000
159 #define ARM_ELS_RD_SHIFT 12
160 #define ARM_ELS_UP_AM_MASK 0x00000f00
161 #define ARM_ELS_UP_AM_SHIFT 8
162 #define ARM_ELS_LOW_AM_MASK 0x0000000f
163
164 /*
165 * Multiply instruction extensino space masks and values
166 */
167 #define ARM_EMULT_UNBIT_MASK 0x00400000
168 #define ARM_EMULT_ABIT_MASK 0x00200000
169 #define ARM_EMULT_SBIT_MASK 0x00100000
170 #define ARM_EMULT_RD_MASK 0x000f0000
171 #define ARM_EMULT_RD_SHIFT 16
172 #define ARM_EMULT_RN_MASK 0x0000f000
173 #define ARM_EMULT_RN_SHIFT 12
174 #define ARM_EMULT_RS_MASK 0x00000f00
175 #define ARM_EMULT_RS_SHIFT 8
176 #define ARM_EMULT_RM_MASK 0x0000000f
177 #define ARM_EMULT_MA_MASK 0x0fc00000
178 #define ARM_EMULT_UMA_MASK 0x0ff00000
179 #define ARM_EMULT_UMA_TARG 0x00400000
180 #define ARM_EMULT_MAL_MASK 0x0f800000
181 #define ARM_EMULT_MAL_TARG 0x00800000
182
183 /*
184 * Here we have the masks and target values to indicate instructions from the
185 * Control and DSP extension space. There are a bunch of not quite related
186 * instructions, but that's okay. That's how this thing always rolls.
187 *
188 * The ARM_CDSP_STATUS_MASK and TARG do not catch the move immediate to status
189 * register. That's okay because they get handled and separated out in arm_dis.
190 */
191 #define ARM_CDSP_STATUS_MASK 0x0f9000f0
192 #define ARM_CDSP_STATUS_TARG 0x01000000
193 #define ARM_CDSP_BEX_UP_MASK 0x0ff00000 /* Branch/exchg/link instrs */
194 #define ARM_CDSP_BEX_UP_TARG 0x01200000
195 #define ARM_CDSP_BEX_LOW_MASK 0x000000f0
196 #define ARM_CDSP_BEX_NLOW_TARG 0x00000000 /* Here the target is inverse */
197 #define ARM_CDSP_CLZ_MASK 0x0ff000f0 /* Count leading zeros */
198 #define ARM_CDSP_CLZ_TARG 0x01200030
199 #define ARM_CDSP_SAT_MASK 0x0f9000f0 /* Saturating add/subtract */
200 #define ARM_CDSP_SAT_TARG 0x01000050
201 #define ARM_CDSP_BKPT_MASK 0x0ff000f0 /* Software breakpoint */
202 #define ARM_CDSP_BKPT_TARG 0x01200070
203 #define ARM_CDSP_SMUL_MASK 0x0f900090 /* Signed multiplies (type 2) */
204 #define ARM_CDSP_SMUL_TARG 0x01000080
205
206 #define ARM_CDSP_RN_MASK 0x000f0000
207 #define ARM_CDSP_RN_SHIFT 16
208 #define ARM_CDSP_RD_MASK 0x0000f000
209 #define ARM_CDSP_RD_SHIFT 12
210 #define ARM_CDSP_RS_MASK 0x00000f00
211 #define ARM_CDSP_RS_SHIFT 8
212 #define ARM_CDSP_RM_MASK 0x0000000f
213
214 #define ARM_CDSP_STATUS_RBIT 0x00400000
215 #define ARM_CDSP_MRS_MASK 0x00300000 /* Ditinguish MRS and MSR */
216 #define ARM_CDSP_MRS_TARG 0x00000000
217 #define ARM_CDSP_MSR_F_MASK 0x000f0000
218 #define ARM_CDSP_MSR_F_SHIFT 16
219 #define ARM_CDSP_MSR_RI_MASK 0x00000f00
220 #define ARM_CDSP_MSR_RI_SHIFT 8
221 #define ARM_CDSP_MSR_IMM_MASK 0x000000ff
222 #define ARM_CDSP_MSR_ISIMM_MASK 0x02000000
223
224 #define ARM_CDSP_BEX_TYPE_MASK 0x000000f0
225 #define ARM_CDSP_BEX_TYPE_SHIFT 4
226 #define ARM_CDSP_BEX_TYPE_X 1
227 #define ARM_CDSP_BEX_TYPE_J 2
228 #define ARM_CDSP_BEX_TYPE_L 3
229
230 #define ARM_CDSP_SAT_OP_MASK 0x00600000
231 #define ARM_CDSP_SAT_OP_SHIFT 21
232
233 #define ARM_CDSP_BKPT_UIMM_MASK 0x000fff00
234 #define ARM_CDSP_BKPT_UIMM_SHIFT 8
235 #define ARM_CDSP_BKPT_LIMM_MASK 0x0000000f
236
237 #define ARM_CDSP_SMUL_OP_MASK 0x00600000
238 #define ARM_CDSP_SMUL_OP_SHIFT 21
239 #define ARM_CDSP_SMUL_X_MASK 0x00000020
240 #define ARM_CDSP_SMUL_Y_MASK 0x00000040
241
242 /*
243 * Interrupt
244 */
245 #define ARM_SWI_IMM_MASK 0x00ffffff
246
247 /*
248 * Branch and Link pieces.
249 */
250 #define ARM_BRANCH_LBIT_MASK 0x01000000
251 #define ARM_BRANCH_IMM_MASK 0x00ffffff
252 #define ARM_BRANCH_SIGN_MASK 0x00800000
253 #define ARM_BRANCH_POS_SIGN 0x00ffffff
254 #define ARM_BRANCH_NEG_SIGN 0xff000000
255 #define ARM_BRANCH_SHIFT 2
256
257 /*
258 * Unconditional instructions
259 */
260 #define ARM_UNI_CPS_MASK 0x0ff10010 /* Change processor state */
261 #define ARM_UNI_CPS_TARG 0x01000000
262 #define ARM_UNI_SE_MASK 0x0fff0078 /* Set endianess */
263 #define ARM_UNI_SE_TARG 0x01010000
264 #define ARM_UNI_PLD_MASK 0x0d70f000 /* Cach preload */
265 #define ARM_UNI_PLD_TARG 0x0550f000
266 #define ARM_UNI_SRS_MASK 0x0e5f0f00 /* Save return state */
267 #define ARM_UNI_SRS_TARG 0x084d0500
268 #define ARM_UNI_RFE_MASK 0x0e500f00 /* Return from exception */
269 #define ARM_UNI_RFE_TARG 0x08100a00
270 #define ARM_UNI_BLX_MASK 0x0e000000 /* Branch with Link / Thumb */
271 #define ARM_UNI_BLX_TARG 0x0a000000
272 #define ARM_UNI_CODRT_MASK 0x0fe00000 /* double reg to coproc */
273 #define ARM_UNI_CODRT_TARG 0x0c400000
274 #define ARM_UNI_CORT_MASK 0x0f000010 /* single reg to coproc */
275 #define ARM_UNI_CORT_TARG 0x0e000010
276 #define ARM_UNI_CODP_MASK 0x0f000010 /* coproc data processing */
277 #define ARM_UNI_CODP_TARG 0x0e000000
278
279 #define ARM_UNI_CPS_IMOD_MASK 0x000c0000
280 #define ARM_UNI_CPS_IMOD_SHIFT 18
281 #define ARM_UNI_CPS_MMOD_MASK 0x00020000
282 #define ARM_UNI_CPS_A_MASK 0x00000100
283 #define ARM_UNI_CPS_I_MASK 0x00000080
284 #define ARM_UNI_CPS_F_MASK 0x00000040
285 #define ARM_UNI_CPS_MODE_MASK 0x0000001f
286
287 #define ARM_UNI_SE_BE_MASK 0x00000200
288
289 #define ARM_UNI_SRS_WBIT_MASK 0x00200000
290 #define ARM_UNI_SRS_MODE_MASK 0x0000000f
291
292 #define ARM_UNI_RFE_WBIT_MASK 0x00200000
293
294 #define ARM_UNI_BLX_IMM_MASK 0x00ffffff
295
296 /*
297 * Definitions of the ARM Media instruction extension space.
298 */
299 #define ARM_MEDIA_L1_MASK 0x01800000 /* First level breakdown */
300 #define ARM_MEDIA_L1_SHIFT 23
301
302 #define ARM_MEDIA_OP1_MASK 0x00700000
303 #define ARM_MEDIA_OP1_SHIFT 20
304 #define ARM_MEDIA_OP2_MASK 0x000000e0
305 #define ARM_MEDIA_OP2_SHIFT 5
306
307 #define ARM_MEDIA_RN_MASK 0x000f0000
308 #define ARM_MEDIA_RN_SHIFT 16
309 #define ARM_MEDIA_RD_MASK 0x0000f000
310 #define ARM_MEDIA_RD_SHIFT 12
311 #define ARM_MEDIA_RS_MASK 0x00000f00
312 #define ARM_MEDIA_RS_SHIFT 8
313 #define ARM_MEDIA_RM_MASK 0x0000000f
314
315 #define ARM_MEDIA_MULT_X_MASK 0x00000020
316
317 #define ARM_MEDIA_HPACK_MASK 0x00700020 /* Halfword pack */
318 #define ARM_MEDIA_HPACK_TARG 0x00000000
319 #define ARM_MEDIA_WSAT_MASK 0x00200020 /* Word saturate */
320 #define ARM_MEDIA_WSAT_TARG 0x00200000
321 #define ARM_MEDIA_PHSAT_MASK 0x003000e0 /* Parallel halfword saturate */
322 #define ARM_MEDIA_PHSAT_TARG 0x00200020
323 #define ARM_MEDIA_REV_MASK 0x007000e0 /* Byte rev. word */
324 #define ARM_MEDIA_REV_TARG 0x00300020
325 #define ARM_MEDIA_BRPH_MASK 0x007000e0 /* Byte rev. packed halfword */
326 #define ARM_MEDIA_BRPH_TARG 0x003000a0
327 #define ARM_MEDIA_BRSH_MASK 0x007000e0 /* Byte rev. signed halfword */
328 #define ARM_MEDIA_BRSH_TARG 0x007000a0
329 #define ARM_MEDIA_SEL_MASK 0x008000e0 /* Select bytes */
330 #define ARM_MEDIA_SEL_TARG 0x000000a0
331 #define ARM_MEDIA_SZE_MASK 0x000000e0 /* Sign/zero extend */
332 #define ARM_MEDIA_SZE_TARG 0x00000030
333
334 #define ARM_MEDIA_HPACK_OP_MASK 0x00000040
335 #define ARM_MEDIA_HPACK_SHIFT_MASK 0x00000f80
336 #define ARM_MEDIA_HPACK_SHIFT_IMM 7
337
338 #define ARM_MEDIA_SAT_U_MASK 0x00400000
339 #define ARM_MEDIA_SAT_IMM_MASK 0x001f0000
340 #define ARM_MEDIA_SAT_IMM_SHIFT 16
341 #define ARM_MEDIA_SAT_SHI_MASK 0x00000f80
342 #define ARM_MEDIA_SAT_SHI_SHIFT 7
343 #define ARM_MEDIA_SAT_STYPE_MASK 0x00000040
344
345 #define ARM_MEDIA_SZE_S_MASK 0x00400000
346 #define ARM_MEDIA_SZE_OP_MASK 0x00300000
347 #define ARM_MEDIA_SZE_OP_SHIFT 20
348 #define ARM_MEDIA_SZE_ROT_MASK 0x00000c00
349 #define ARM_MEDIA_SZE_ROT_SHIFT 10
350
351 /*
352 * Definitions for coprocessor instructions
353 */
354 #define ARM_COPROC_RN_MASK 0x000f0000
355 #define ARM_COPROC_RN_SHIFT 16
356 #define ARM_COPROC_RD_MASK 0x0000f000
357 #define ARM_COPROC_RD_SHIFT 12
358 #define ARM_COPROC_RM_MASK 0x0000000f
359 #define ARM_COPROC_NUM_MASK 0x00000f00
360 #define ARM_COPROC_NUM_SHIFT 8
361
362 #define ARM_COPROC_CDP_OP1_MASK 0x00f00000
363 #define ARM_COPROC_CDP_OP1_SHIFT 20
364 #define ARM_COPROC_CDP_OP2_MASK 0x000000e0
365 #define ARM_COPROC_CDP_OP2_SHIFT 5
366
367 #define ARM_COPROC_CRT_OP1_MASK 0x00e00000
368 #define ARM_COPROC_CRT_OP1_SHIFT 21
369 #define ARM_COPROC_CRT_OP2_MASK 0x000000e0
370 #define ARM_COPROC_CRT_OP2_SHIFT 5
371 #define ARM_COPROC_CRT_DIR_MASK 0x00100000 /* MCR or MRC */
372
373 #define ARM_COPROC_DRT_MASK 0x01e00000
374 #define ARM_COPROC_DRT_TARG 0x00400000
375 #define ARM_COPROC_DRT_OP_MASK 0x000000f0
376 #define ARM_COPROC_DRT_OP_SHIFT 4
377 #define ARM_COPROC_DRT_DIR_MASK 0x00100000 /* MCRR or MRRC */
378
379 #define ARM_COPROC_LS_P_MASK 0x01000000
380 #define ARM_COPROC_LS_U_MASK 0x00800000
381 #define ARM_COPROC_LS_N_MASK 0x00400000
382 #define ARM_COPROC_LS_W_MASK 0x00200000
383 #define ARM_COPROC_LS_L_MASK 0x00100000
384 #define ARM_COPROC_LS_IMM_MASK 0x000000ff
385
386 /*
387 * This is the table of condition codes that instructions might have. Every
388 * instruction starts with a four bit code. The last two codes are special.
389 * 0b1110 is the always condition. Therefore we leave off its mneomic extension
390 * and treat it as the empty string. The condition code 0b1111 takes us to a
391 * separate series of encoded instructions and therefore we go elsewhere with
392 * them.
393 */
394 static const char *arm_cond_names[] = {
395 "EQ", /* Equal */
396 "NE", /* Not Equal */
397 "CS/HS", /* Carry set/unsigned higher or same */
398 "CC/LO", /* Carry clear/unsigned lower */
399 "MI", /* Minus/negative */
400 "PL", /* Plus/positive or zero */
401 "VS", /* Overflow */
402 "VC", /* No overflow */
403 "HI", /* Unsigned higher */
404 "LS", /* Unsigned lower or same */
405 "GE", /* Signed greater than or equal */
406 "LT", /* Signed less than */
407 "GT", /* Signed greater than */
408 "LE", /* Signed less than or equal */
409 "", /* AL - Always (unconditional) */
410 NULL /* Not a condition code */
411 };
412
413 typedef enum arm_cond_code {
414 ARM_COND_EQ, /* Equal */
415 ARM_COND_NE, /* Not Equal */
416 ARM_COND_CSHS, /* Carry set/unsigned higher or same */
417 ARM_COND_CCLO, /* Carry clear/unsigned lower */
418 ARM_COND_MI, /* Minus/negative */
419 ARM_COND_PL, /* Plus/positive or zero */
420 ARM_COND_VS, /* Overflow */
421 ARM_COND_VC, /* No overflow */
422 ARM_COND_HI, /* Unsigned higher */
423 ARM_COND_LS, /* Unsigned lower or same */
424 ARM_COND_GE, /* Signed greater than or equal */
425 ARM_COND_LT, /* Signed less than */
426 ARM_COND_GT, /* Signed greater than */
427 ARM_COND_LE, /* Signed less than or equal */
428 ARM_COND_AL, /* AL - Always (unconditional) */
429 ARM_COND_NACC /* Not a condition code */
430 } arm_cond_code_t;
431
432 /*
433 * Registers are encoded surprisingly sanely. It's a 4-bit value that indicates
434 * which register in question we're working with.
435 */
436 static const char *arm_reg_names[] = {
437 "R0",
438 "R1",
439 "R2",
440 "R3",
441 "R4",
442 "R5",
443 "R6",
444 "R7",
445 "R8",
446 "R9",
447 "R10",
448 "R11",
449 "IP", /* Alt for R12 */
450 "SP", /* Alt for R13 */
451 "LR", /* Alt for R14 */
452 "PC" /* Alt for R15 */
453 };
454
455 typedef enum arm_reg {
456 ARM_REG_R0,
457 ARM_REG_R1,
458 ARM_REG_R2,
459 ARM_REG_R3,
460 ARM_REG_R4,
461 ARM_REG_R5,
462 ARM_REG_R6,
463 ARM_REG_R7,
464 ARM_REG_R8,
465 ARM_REG_R9,
466 ARM_REG_R10,
467 ARM_REG_R11,
468 ARM_REG_R12,
469 ARM_REG_R13,
470 ARM_REG_R14,
471 ARM_REG_R15
472 } arm_reg_t;
473
474 /*
475 * Default coprocessor names
476 */
477 static const char *arm_coproc_names[] = {
478 "p0",
479 "p1",
480 "p2",
481 "p3",
482 "p4",
483 "p5",
484 "p6",
485 "p7",
486 "p8",
487 "p9",
488 "p10",
489 "p11",
490 "p12",
491 "p13",
492 "p14",
493 "p15"
494 };
495
496 /*
497 * These are the opcodes for the instructions which are considered data
498 * processing instructions.
499 */
500 static const char *arm_dpi_opnames[] = {
501 "AND", /* Logical AND */
502 "EOR", /* Logical Exclusive OR */
503 "SUB", /* Subtract */
504 "RSB", /* Reverse Subtract */
505 "ADD", /* Add */
506 "ADC", /* Add with Carry */
507 "SBC", /* Subtract with Carry */
508 "RSC", /* Reverse Subtract with Carry */
509 "TST", /* Test */
510 "TEQ", /* Test Equivalence */
511 "CMP", /* Compare */
512 "CMN", /* Compare negated */
513 "ORR", /* Logical (inclusive) OR */
514 "MOV", /* Move */
515 "BIC", /* Bit clear */
516 "MVN" /* Move not */
517 };
518
519 typedef enum arm_dpi_opcode {
520 DPI_OP_AND, /* Logical AND */
521 DPI_OP_EOR, /* Logical Exclusive OR */
522 DPI_OP_SUB, /* Subtract */
523 DPI_OP_RSB, /* Reverse Subtract */
524 DPI_OP_ADD, /* Add */
525 DPI_OP_ADC, /* Add with Carry */
526 DPI_OP_SBC, /* Subtract with Carry */
527 DPI_OP_RSC, /* Reverse Subtract with Carry */
528 DPI_OP_TST, /* Test */
529 DPI_OP_TEQ, /* Test Equivalence */
530 DPI_OP_CMP, /* Compare */
531 DPI_OP_CMN, /* Compare negated */
532 DPI_OP_ORR, /* Logical (inclusive) OR */
533 DPI_OP_MOV, /* Move */
534 DPI_OP_BIC, /* Bit clear */
535 DPI_OP_MVN /* Move not */
536 } arm_dpi_opcode_t;
537
538 const char *arm_dpi_shifts[] = {
539 "LSL", /* Logical shift left */
540 "LSR", /* Logical shift right */
541 "ASR", /* Arithmetic shift right */
542 "ROR", /* Rotate right */
543 "RRX" /* Rotate right with extend. This is a special case of ROR */
544 };
545
546 typedef enum arm_dpi_shift_code {
547 DPI_S_LSL, /* Logical shift left */
548 DPI_S_LSR, /* Logical shift right */
549 DPI_S_ASR, /* Arithmetic shift right */
550 DPI_S_ROR, /* Rotate right */
551 DPI_S_RRX, /* Rotate right with extend. Special case of ROR */
552 DPI_S_NONE /* No shift code */
553 } arm_dpi_shift_code_t;
554
555 #define ARM_DPI_SHIFTER_IMM32 0x00
556 #define ARM_DPI_SHIFTER_SIMM 0x01
557 #define ARM_DPI_SHIFTER_SREG 0x02
558
559 typedef struct arm_dpi_shifter_imm {
560 uint8_t dpisi_rot; /* Rotation amount */
561 uint8_t dpisi_imm; /* Immediate value */
562 } arm_dpi_shifter_imm_t;
563
564 typedef struct arm_dpi_shifter_simm {
565 uint8_t dpiss_imm; /* Shift value */
566 arm_dpi_shift_code_t dpiss_code; /* Shift type */
567 arm_reg_t dpiss_targ; /* Target register */
568 } arm_dpi_shifter_simm_t;
569
570 typedef struct arm_dpi_shifter_sreg {
571 arm_reg_t dpisr_val; /* reg with shift value */
572 arm_dpi_shift_code_t dpisr_code; /* Shift type */
573 arm_reg_t dpisr_targ; /* Target register */
574 } arm_dpi_shifter_sreg_t;
575
576 typedef struct arm_dpi_inst {
577 arm_dpi_opcode_t dpii_op; /* dpi opcode */
578 arm_cond_code_t dpii_cond; /* condition code */
579 int dpii_sbit; /* value of S bit */
580 arm_reg_t dpii_rn; /* first operand */
581 arm_reg_t dpii_rd; /* destination operand */
582 int dpii_stype; /* type of shifter */
583 union { /* shifter values */
584 arm_dpi_shifter_imm_t dpii_im;
585 arm_dpi_shifter_simm_t dpii_si;
586 arm_dpi_shifter_sreg_t dpii_ri;
587 } dpii_un;
588 } arm_dpi_inst_t;
589
590 /*
591 * This table contains the names of the load store multiple addressing modes.
592 * The P and U bits are supposed to be combined to index into this. You should
593 * do this by doing P << 1 | U.
594 */
595 static const char *arm_lsm_mode_names[] = {
596 "DA",
597 "IA",
598 "DB",
599 "IB"
600 };
601
602 /*
603 * The MSR field has a four bit field mask. Each bit correspons to a letter.
604 * From high to low, f, s, x, c. At least one must be specified, hence 0 is
605 * NULL. The preferred manual ordering of these is csxf.
606 */
607 static const char *arm_cdsp_msr_field_names[] = {
608 NULL,
609 "c", /* 0001 */
610 "x", /* 0010 */
611 "cx", /* 0011 */
612 "s", /* 0100 */
613 "cs", /* 0101 */
614 "sx", /* 0110 */
615 "csx", /* 0111 */
616 "f", /* 1000 */
617 "cf", /* 1001 */
618 "xf", /* 1010 */
619 "cxf", /* 1011 */
620 "sf", /* 1100 */
621 "csf", /* 1101 */
622 "sxf", /* 1110 */
623 "csxf" /* 1111 */
624 };
625
626 /*
627 * Names for specific saturating add and subtraction instructions from the
628 * extended control and dsp instructino section.
629 */
630 static const char *arm_cdsp_sat_opnames[] = {
631 "ADD",
632 "SUB",
633 "DADD",
634 "DSUB"
635 };
636
637 static const char *arm_padd_p_names[] = {
638 NULL, /* 000 */
639 "S", /* 001 */
640 "Q", /* 010 */
641 "SH", /* 011 */
642 NULL, /* 100 */
643 "U", /* 101 */
644 "UQ", /* 110 */
645 "UH", /* 111 */
646 };
647
648 static const char *arm_padd_i_names[] = {
649 "ADD16", /* 000 */
650 "ADDSUBX", /* 001 */
651 "SUBADDX", /* 010 */
652 "SUB16", /* 011 */
653 "ADD8", /* 100 */
654 NULL, /* 101 */
655 NULL, /* 110 */
656 "SUB8", /* 111 */
657 };
658
659 static const char *arm_extend_rot_names[] = {
660 "", /* 0b00, ROR #0 */
661 ", ROR #8", /* 0b01 */
662 ", ROR #16", /* 0b10 */
663 ", ROR #24" /* 0b11 */
664 };
665
666 /*
667 * There are sixteen data processing instructions (dpi). They come in a few
668 * different forms which are based on whether immediate values are used and
669 * whether or not some special purpose shifting is done. We use this one entry
670 * point to cover all the different types.
671 *
672 * From the ARM arch manual:
673 *
674 * <opcode1>{<cond>}{S} <Rd>,<shifter>
675 * <opcode1> := MOV | MVN
676 * <opcode2>{<cond>} <Rn>,<shifter>
677 * <opcode2> := CMP, CMN, TST, TEQ
678 * <opcode3>{<cond>{S} <Rd>,<Rn>, <shifter>
679 * <opcode3> := ADD | SUB | RSB | ADC | SBC | RSC | AND | BIC | EOR | ORR
680 *
681 * 31 - 28|27 26 |25 | 24-21 |20 | 19-16 | 15-12 | 11 - 0
682 * [ cond | 0 0 | I | opcode | S | Rn | Rd | shifter ]
683 *
684 * I bit: Determines whether shifter_operand is immediate or register based
685 * S bit: Determines whether or not the insn updates condition codes
686 * Rn: First source operand register
687 * Rd: Destination register
688 * shifter: Specifies the second operand
689 *
690 * There are three primary encodings:
691 *
692 * 32-bit immediate
693 * 31 - 28|27 26|25 |24-21 |20|19-16| 15-12|11 - 8 |7 - 0
694 * [ cond | 0 0| 1 |opcode| S|Rn | Rd |rotate_imm|immed_8 ]
695 *
696 * Immediate shifts
697 * 31 - 28|27 26|25 |24-21 |20|19-16|15-12|11 - 7 |6 5 |4|3-0
698 * [ cond | 0 0| 0 |opcode| S|Rn |Rd |shift_imm|shift|0|Rm ]
699 *
700 * Register shifts
701 * 31 - 28|27 26|25 |24-21 |20|19-16|15-12|11 - 8|7|6 5 |4|3-0
702 * [ cond | 0 0| 0 |opcode| S|Rn |Rd |Rs |0|shift|1|Rm ]
703 *
704 * There are four different kinds of shifts that work with both immediate and
705 * register shifts:
706 * o Logical shift left 0b00 (LSL)
707 * o Logical shift right 0b01 (LSR)
708 * o Arithmetic shift right 0b10 (ASR)
709 * o Rotate right 0b11 (ROR)
710 * There is one special shift which only works with immediate shift format:
711 * o If shift_imm = 0 and shift = 0b11, then it is a rotate right with extend
712 * (RRX)
713 *
714 * Finally there is one special indication for no shift. An immediate shift
715 * whose shift_imm = shift = 0. This is a shortcut to a direct value from the
716 * register.
717 *
718 * While processing this, we first build up all the information into the
719 * arm_dpi_inst_t and then from there we go and print out the format based on
720 * the opcode and shifter. As per the rough grammar above we have to print
721 * different sets of instructions in different ways.
722 */
723 static int
724 arm_dis_dpi(uint32_t in, arm_cond_code_t cond, char *buf, size_t buflen)
725 {
726 arm_dpi_inst_t dpi_inst;
727 int ibit, bit4;
728 size_t len;
729
730 dpi_inst.dpii_op = (in & ARM_DPI_OPCODE_MASK) >> ARM_DPI_OPCODE_SHIFT;
731 dpi_inst.dpii_cond = cond;
732 dpi_inst.dpii_rn = (in & ARM_DPI_RN_MASK) >> ARM_DPI_RN_SHIFT;
733 dpi_inst.dpii_rd = (in & ARM_DPI_RD_MASK) >> ARM_DPI_RD_SHIFT;
734 dpi_inst.dpii_sbit = in & ARM_DPI_SBIT_MASK;
735
736 ibit = in & ARM_DPI_IBIT_MASK;
737 bit4 = in & ARM_DPI_BIT4_MASK;
738
739 if (ibit) {
740 /* 32-bit immediate */
741 dpi_inst.dpii_stype = ARM_DPI_SHIFTER_IMM32;
742 dpi_inst.dpii_un.dpii_im.dpisi_rot = (in &
743 ARM_DPI_IMM_ROT_MASK) >> ARM_DPI_IMM_ROT_SHIFT;
744 dpi_inst.dpii_un.dpii_im.dpisi_imm = in & ARM_DPI_IMM_VAL_MASK;
745 } else if (bit4) {
746 /* Register shift */
747 dpi_inst.dpii_stype = ARM_DPI_SHIFTER_SREG;
748 dpi_inst.dpii_un.dpii_ri.dpisr_val = (in &
749 ARM_DPI_REGS_RS_MASK) >> ARM_DPI_REGS_RS_SHIFT;
750 dpi_inst.dpii_un.dpii_ri.dpisr_targ = in &
751 ARM_DPI_REGS_RM_MASK;
752 dpi_inst.dpii_un.dpii_ri.dpisr_code = in &
753 ARM_DPI_REGS_SHIFT_MASK >> ARM_DPI_REGS_SHIFT_SHIFT;
754 } else {
755 /* Immediate shift */
756 dpi_inst.dpii_stype = ARM_DPI_SHIFTER_SIMM;
757 dpi_inst.dpii_un.dpii_si.dpiss_imm = (in &
758 ARM_DPI_IMS_SHIMM_MASK) >> ARM_DPI_IMS_SHIMM_SHIFT;
759 dpi_inst.dpii_un.dpii_si.dpiss_code = (in &
760 ARM_DPI_IMS_SHIFT_MASK) >> ARM_DPI_IMS_SHIFT_SHIFT;
761 dpi_inst.dpii_un.dpii_si.dpiss_targ = in & ARM_DPI_IMS_RM_MASK;
762 if (dpi_inst.dpii_un.dpii_si.dpiss_code == DPI_S_ROR &&
763 dpi_inst.dpii_un.dpii_si.dpiss_imm == 0)
764 dpi_inst.dpii_un.dpii_si.dpiss_code = DPI_S_RRX;
765
766 if (dpi_inst.dpii_un.dpii_si.dpiss_code == DPI_S_LSL &&
767 dpi_inst.dpii_un.dpii_si.dpiss_imm == 0)
768 dpi_inst.dpii_un.dpii_si.dpiss_code = DPI_S_NONE;
769 }
770
771 /*
772 * Print everything before the shifter based on the instruction
773 */
774 switch (dpi_inst.dpii_op) {
775 case DPI_OP_MOV:
776 case DPI_OP_MVN:
777 len = snprintf(buf, buflen, "%s%s%s %s",
778 arm_dpi_opnames[dpi_inst.dpii_op],
779 arm_cond_names[dpi_inst.dpii_cond],
780 dpi_inst.dpii_sbit != 0 ? "S" : "",
781 arm_reg_names[dpi_inst.dpii_rd]);
782 break;
783 case DPI_OP_CMP:
784 case DPI_OP_CMN:
785 case DPI_OP_TST:
786 case DPI_OP_TEQ:
787 len = snprintf(buf, buflen, "%s%s %s",
788 arm_dpi_opnames[dpi_inst.dpii_op],
789 arm_cond_names[dpi_inst.dpii_cond],
790 arm_reg_names[dpi_inst.dpii_rn]);
791 break;
792 default:
793 len = snprintf(buf, buflen,
794 "%s%s%s %s, %s", arm_dpi_opnames[dpi_inst.dpii_op],
795 arm_cond_names[dpi_inst.dpii_cond],
796 dpi_inst.dpii_sbit != 0 ? "S" : "",
797 arm_reg_names[dpi_inst.dpii_rd],
798 arm_reg_names[dpi_inst.dpii_rn]);
799 break;
800 }
801
802 if (len >= buflen)
803 return (-1);
804 buflen -= len;
805 buf += len;
806
807 /*
808 * Print the shifter as appropriate
809 */
810 switch (dpi_inst.dpii_stype) {
811 case ARM_DPI_SHIFTER_IMM32:
812 len = snprintf(buf, buflen, ", #%d, %d",
813 dpi_inst.dpii_un.dpii_im.dpisi_imm,
814 dpi_inst.dpii_un.dpii_im.dpisi_rot);
815 break;
816 case ARM_DPI_SHIFTER_SIMM:
817 if (dpi_inst.dpii_un.dpii_si.dpiss_code == DPI_S_NONE) {
818 len = snprintf(buf, buflen, ", %s",
819 arm_reg_names[dpi_inst.dpii_un.dpii_si.dpiss_targ]);
820 break;
821 }
822 if (dpi_inst.dpii_un.dpii_si.dpiss_code == DPI_S_RRX) {
823 len = snprintf(buf, buflen, ", %s RRX",
824 arm_reg_names[dpi_inst.dpii_un.dpii_si.dpiss_targ]);
825 break;
826 }
827 len = snprintf(buf, buflen, ", %s, %s #%d",
828 arm_reg_names[dpi_inst.dpii_un.dpii_si.dpiss_targ],
829 arm_dpi_shifts[dpi_inst.dpii_un.dpii_si.dpiss_code],
830 dpi_inst.dpii_un.dpii_si.dpiss_imm);
831 break;
832 case ARM_DPI_SHIFTER_SREG:
833 len = snprintf(buf, buflen, ", %s, %s %s",
834 arm_reg_names[dpi_inst.dpii_un.dpii_ri.dpisr_targ],
835 arm_dpi_shifts[dpi_inst.dpii_un.dpii_ri.dpisr_code],
836 arm_reg_names[dpi_inst.dpii_un.dpii_ri.dpisr_val]);
837 break;
838 }
839
840 return (len < buflen ? 0 : -1);
841 }
842
843 /*
844 * This handles the byte and word size loads and stores. It does not handle the
845 * multi-register loads or the 'extra' ones. The instruction has the generic
846 * form off:
847 *
848 * 31 - 28|27 26 |25|24|23|22|21|20|19-16|15-12|11 - 0
849 * [ cond | 0 0 |I |P |U |B |W |L | Rn | Rd |mode_specific]
850 *
851 * Here the bits mean the following:
852 *
853 * Rn: The base register used by the addressing mode
854 * Rd: The register to load to or store from
855 * L bit: If L==1 then a load, else store
856 * B bit: If B==1 then work on a byte, else a 32-bit word
857 *
858 * The remaining pieces determine the mode we are operating in:
859 * I bit: If 0 use immediate offsets, otherwise if 1 used register based offsets
860 * P bit: If 0 use post-indexed addressing. If 1, indexing mode is either offset
861 * addessing or pre-indexed addressing based on the W bit.
862 * U bit: If 1, offset is added to base, if 0 offset is subtracted from base
863 * W bit: This bits interpretation varies based on the P bit. If P is zero then
864 * W indicates whether a normal memory access is performed or if a read
865 * from user memory is performed (W = 1).
866 * If P is 1 then then when W = 0 the base register is not updated and
867 * when W = 1 the calculated address is written back to the base
868 * register.
869 *
870 * Based on these combinations there are a total of nine different operating
871 * modes, though not every LDR and STR variant can reach them all.
872 */
873 static int
874 arm_dis_ldstr(uint32_t in, char *buf, size_t buflen)
875 {
876 arm_cond_code_t cc;
877 arm_reg_t rd, rn, rm;
878 int ibit, pbit, ubit, bbit, wbit, lbit;
879 arm_dpi_shift_code_t sc;
880 uint8_t simm;
881 size_t len;
882
883 cc = (in & ARM_CC_MASK) >> ARM_CC_SHIFT;
884 ibit = in & ARM_LS_IBIT_MASK;
885 pbit = in & ARM_LS_PBIT_MASK;
886 ubit = in & ARM_LS_UBIT_MASK;
887 bbit = in & ARM_LS_BBIT_MASK;
888 wbit = in & ARM_LS_WBIT_MASK;
889 lbit = in & ARM_LS_LBIT_MASK;
890 rd = (in & ARM_LS_RD_MASK) >> ARM_LS_RD_SHIFT;
891 rn = (in & ARM_LS_RN_MASK) >> ARM_LS_RN_SHIFT;
892
893 len = snprintf(buf, buflen, "%s%s%s%s %s, ", lbit != 0 ? "LDR" : "STR",
894 arm_cond_names[cc], bbit != 0 ? "B" : "",
895 (pbit == 0 && wbit != 0) ? "T" : "",
896 arm_reg_names[rd]);
897 if (len >= buflen)
898 return (-1);
899
900 /* Figure out the specifics of the encoding for the rest */
901 if (ibit == 0 && pbit != 0) {
902 /*
903 * This is the immediate offset mode (A5.2.2). That means that
904 * we have something of the form [ <Rn>, #+/-<offset_12> ]. All
905 * of the mode specific bits contribute to offset_12. We also
906 * handle the pre-indexed version (A5.2.5) which depends on the
907 * wbit being set.
908 */
909 len += snprintf(buf + len, buflen - len, "[%s, #%s%d]%s",
910 arm_reg_names[rn], ubit != 0 ? "" : "-",
911 in & ARM_LS_IMM_MASK, wbit != 0 ? "!" : "");
912 } else if (ibit != 0 && pbit != 0) {
913 /*
914 * This handles A5.2.2, A5.2.3, A5.2.6, and A5.2.7. We can have
915 * one of two options. If the non-rm bits (11-4) are all zeros
916 * then we have a special case of a register offset is just
917 * being added. Otherwise we have a scaled register offset where
918 * the shift code matters.
919 */
920 rm = in & ARM_LS_REG_RM_MASK;
921 len += snprintf(buf + len, buflen - len, "[%s, %s%s",
922 arm_reg_names[rn], ubit != 0 ? "" : "-",
923 arm_reg_names[rm]);
924 if (len >= buflen)
925 return (-1);
926 if ((in & ARM_LS_REG_NRM_MASK) != 0) {
927 simm = (in & ARM_LS_SCR_SIMM_MASK) >>
928 ARM_LS_SCR_SIMM_SHIFT;
929 sc = (in & ARM_LS_SCR_SCODE_MASK) >>
930 ARM_LS_SCR_SCODE_SHIFT;
931
932 if (simm == 0 && sc == DPI_S_ROR)
933 sc = DPI_S_RRX;
934
935 len += snprintf(buf + len, buflen - len, "%s",
936 arm_dpi_shifts[sc]);
937 if (len >= buflen)
938 return (-1);
939 if (sc != DPI_S_RRX) {
940 len += snprintf(buf + len, buflen - len, " #%d",
941 simm);
942 if (len >= buflen)
943 return (-1);
944 }
945 }
946 len += snprintf(buf + len, buflen - len, "]%s",
947 wbit != 0 ? "!" : "");
948 } else if (ibit == 0 && pbit == 0 && wbit == 0) {
949 /* A5.2.8 immediate post-indexed */
950 len += snprintf(buf + len, buflen - len, "[%s], #%s%d",
951 arm_reg_names[rn], ubit != 0 ? "" : "-",
952 in & ARM_LS_IMM_MASK);
953 } else if (ibit != 0 && pbit == 0 && wbit == 0) {
954 /* A5.2.9 and A5.2.10 */
955 rm = in & ARM_LS_REG_RM_MASK;
956 len += snprintf(buf + len, buflen - len, "[%s], %s%s",
957 arm_reg_names[rn], ubit != 0 ? "" : "-",
958 arm_reg_names[rm]);
959 if ((in & ARM_LS_REG_NRM_MASK) != 0) {
960 simm = (in & ARM_LS_SCR_SIMM_MASK) >>
961 ARM_LS_SCR_SIMM_SHIFT;
962 sc = (in & ARM_LS_SCR_SCODE_MASK) >>
963 ARM_LS_SCR_SCODE_SHIFT;
964
965 if (simm == 0 && sc == DPI_S_ROR)
966 sc = DPI_S_RRX;
967
968 len += snprintf(buf + len, buflen - len, "%s",
969 arm_dpi_shifts[sc]);
970 if (len >= buflen)
971 return (-1);
972 if (sc != DPI_S_RRX)
973 len += snprintf(buf + len, buflen - len,
974 " #%d", simm);
975 }
976 }
977
978 return (len < buflen ? 0 : -1);
979 }
980
981 /*
982 * This handles load and store multiple instructions. The general format is as
983 * follows:
984 *
985 * 31 - 28|27 26 25|24|23|22|21|20|19-16|15-0
986 * [ cond | 1 0 0 |P |U |S |W |L | Rn | register set
987 *
988 * The register set has one bit per register. If a bit is set it indicates that
989 * register and if it is not set then it indicates that the register is not
990 * included in this.
991 *
992 * S bit: If the instruction is a LDM and we load the PC, the S == 1 tells us to
993 * load the CPSR from SPSR after the other regs are loaded. If the instruction
994 * is a STM or LDM without touching the PC it indicates that if we are
995 * privileged we should send the banked registers.
996 *
997 * L bit: Where this is a load or store. Load is active high.
998 *
999 * P bit: If P == 0 then Rn is included in the memory region transfers and its
1000 * location is dependent on the U bit. It is at the top (U == 0) or bottom (U ==
1001 * 1). If P == 1 then it is excluded and lies one word beyond the top (U == 0)
1002 * or bottom based on the U bit.
1003 *
1004 * U bit: If U == 1 then the transfer is made upwards and if U == 0 then the
1005 * transfer is made downwards.
1006 *
1007 * W bit: If set then we incremet the base register after the transfer. It is
1008 * modified by 4 times the number of registers in the list. If the U bit is
1009 * positive then that value is added to Rn otherwise it is subtracted.
1010 *
1011 * The overal layout for this is
1012 * (LDM|STM){<cond>}<addressing mode> Rn{!}, <registers>{^}. Here the ! is based
1013 * on having the W bit set. The ^ bit depends on whether S is set or not.
1014 *
1015 * There are four normal addressing modes: IA, IB, DA, DB. There are also
1016 * corresponding stack addressing modes that exist. However we have no way of
1017 * knowing which are the ones being used, therefore we are going to default to
1018 * the non-stack versions which are listed as the primary.
1019 *
1020 * Finally the last useful bit is how the registers list is specified. It is a
1021 * comma separated list inside of { }. However, a user may separate a contiguous
1022 * range by the use of a -, eg. R0 - R4. However, it is impossible for us to map
1023 * back directly to what the user did. So for now, we punt on second down and
1024 * instead just list each indidvidual register rather than attempt a joining
1025 * routine.
1026 */
1027 static int
1028 arm_dis_ldstr_multi(uint32_t in, char *buf, size_t buflen)
1029 {
1030 int sbit, wbit, lbit, ii, cont;
1031 uint16_t regs, addr_mode;
1032 arm_reg_t rn;
1033 arm_cond_code_t cc;
1034 size_t len;
1035
1036 cc = (in & ARM_CC_MASK) >> ARM_CC_SHIFT;
1037 sbit = in & ARM_LSM_SBIT_MASK;
1038 wbit = in & ARM_LSM_WBIT_MASK;
1039 lbit = in & ARM_LSM_LBIT_MASK;
1040 rn = (in & ARM_LSM_RN_MASK) >> ARM_LSM_RN_SHIFT;
1041 regs = in & ARM_LSM_RLIST_MASK;
1042 addr_mode = (in & ARM_LSM_ADDR_MASK) >> ARM_LSM_ADDR_SHIFT;
1043
1044 len = snprintf(buf, buflen, "%s%s%s %s%s, { ",
1045 lbit != 0 ? "LDM" : "STM",
1046 arm_cond_names[cc],
1047 arm_lsm_mode_names[addr_mode],
1048 arm_reg_names[rn],
1049 wbit != 0 ? "!" : "");
1050
1051 cont = 0;
1052 for (ii = 0; ii < 16; ii++) {
1053 if (!(regs & (1 << ii)))
1054 continue;
1055
1056 len += snprintf(buf + len, buflen - len, "%s%s",
1057 cont > 0 ? ", " : "", arm_reg_names[ii]);
1058 if (len >= buflen)
1059 return (-1);
1060 cont++;
1061 }
1062
1063 len += snprintf(buf + len, buflen - len, " }%s", sbit != 0 ? "^" : "");
1064 return (len >= buflen ? -1 : 0);
1065 }
1066
1067 /*
1068 * Here we need to handle miscillaneous loads and stores. This is used to load
1069 * and store signed and unsigned half words. To load a signed byte. And to load
1070 * and store double words. There is no specific store routines for signed bytes
1071 * and halfwords as they are supposed to use the SRB and STRH. There are two
1072 * primary encodings this time. The general case looks like:
1073 *
1074 * 31 - 28|27 - 25|24|23|22|21|20|19-16|15-12|11-8 |7|6|5|4|3-0
1075 * [ cond | 0 |P |U |I |W |L | Rn | Rd |amode|1|S|H|1|amode ]
1076 *
1077 * The I, P, U, and W bits specify the addressing mode.
1078 * The L, S, and H bits describe the type and size.
1079 * Rn: The base register used by the addressing mode
1080 * Rd: The register to load to or store from
1081 *
1082 * The other bits specifically mean:
1083 * I bit: If set to one the address specific pieces are immediate. Otherwise
1084 * they aren't.
1085 * P bit: If P is 0 used post-indexed addressing. If P is 1 its behavior is
1086 * based on the value of W.
1087 * U bit: If U is one the offset is added to the base otherwise subtracted
1088 * W bit: When P is one a value of W == 1 says that the resulting memory address
1089 * should be written back to the base register. The base register isn't touched
1090 * when W is zero.
1091 *
1092 * The L, S, and H bits combine in the following table:
1093 *
1094 * L | S | H | Meaning
1095 * -------------------
1096 * 0 | 0 | 1 | store halfword
1097 * 0 | 1 | 0 | load doubleword
1098 * 0 | 1 | 1 | store doubleword
1099 * 1 | 0 | 1 | load unsigned half word
1100 * 1 | 1 | 0 | load signed byte
1101 * 1 | 1 | 1 | load signed halfword
1102 *
1103 * The final format of this is:
1104 * LDR|STR{<cond>}H|SH|SB|D <rd>, address_mode
1105 */
1106 static int
1107 arm_dis_els(uint32_t in, char *buf, size_t buflen)
1108 {
1109 arm_cond_code_t cc;
1110 arm_reg_t rn, rd;
1111 const char *iname, *suffix;
1112 int lbit, sbit, hbit, pbit, ubit, ibit, wbit;
1113 uint8_t imm;
1114 size_t len;
1115
1116 lbit = in & ARM_ELS_LBIT_MASK;
1117 sbit = in & ARM_ELS_SBIT_MASK;
1118 hbit = in & ARM_ELS_SBIT_MASK;
1119
1120 if (lbit || (sbit && hbit == 0))
1121 iname = "LDR";
1122 else
1123 iname = "STR";
1124
1125 if (sbit == 0 && hbit)
1126 suffix = "H";
1127 else if (lbit == 0)
1128 suffix = "D";
1129 else if (sbit && hbit == 0)
1130 suffix = "SB";
1131 else if (sbit && hbit)
1132 suffix = "SH";
1133
1134 cc = (in & ARM_CC_MASK) >> ARM_CC_SHIFT;
1135 rn = (in & ARM_ELS_RN_MASK) >> ARM_ELS_RN_SHIFT;
1136 rd = (in & ARM_ELS_RD_MASK) >> ARM_ELS_RD_SHIFT;
1137
1138 len = snprintf(buf, buflen, "%s%s%s %s, ", iname, arm_cond_names[cc],
1139 suffix, arm_reg_names[rd]);
1140 if (len >= buflen)
1141 return (-1);
1142
1143 pbit = in & ARM_ELS_PBIT_MASK;
1144 ubit = in & ARM_ELS_UBIT_MASK;
1145 ibit = in & ARM_ELS_IBIT_MASK;
1146 wbit = in & ARM_ELS_WBIT_MASK;
1147
1148 if (pbit && ibit) {
1149 /* Handle A5.3.2 and A5.3.4 immediate offset and pre-indexed */
1150 /* Bits 11-8 form the upper 4 bits of imm */
1151 imm = (in & ARM_ELS_UP_AM_MASK) >> (ARM_ELS_UP_AM_SHIFT - 4);
1152 imm |= in & ARM_ELS_LOW_AM_MASK;
1153 len += snprintf(buf + len, buflen - len, "[%s, #%s%d]%s",
1154 arm_reg_names[rn],
1155 ubit != 0 ? "" : "-", imm,
1156 wbit != 0 ? "!" : "");
1157 } else if (pbit && ibit == 0) {
1158 /* Handle A5.3.3 and A5.3.5 register offset and pre-indexed */
1159 len += snprintf(buf + len, buflen - len, "[%s %s%s]%s",
1160 arm_reg_names[rn],
1161 ubit != 0 ? "" : "-",
1162 arm_reg_names[in & ARM_ELS_LOW_AM_MASK],
1163 wbit != 0 ? "!" : "");
1164 } else if (pbit == 0 && ibit) {
1165 /* A5.3.6 Immediate post-indexed */
1166 /* Bits 11-8 form the upper 4 bits of imm */
1167 imm = (in & ARM_ELS_UP_AM_MASK) >> (ARM_ELS_UP_AM_SHIFT - 4);
1168 imm |= in & ARM_ELS_LOW_AM_MASK;
1169 len += snprintf(buf + len, buflen - len, "[%s], #%s%d",
1170 arm_reg_names[rn], ubit != 0 ? "" : "-", imm);
1171 } else if (pbit == 0 && ibit == 0) {
1172 /* Handle A 5.3.7 Register post-indexed */
1173 len += snprintf(buf + len, buflen - len, "[%s], %s%s",
1174 arm_reg_names[rn], ubit != 0 ? "" : "-",
1175 arm_reg_names[in & ARM_ELS_LOW_AM_MASK]);
1176 }
1177
1178 return (len >= buflen ? -1 : 0);
1179 }
1180
1181 /*
1182 * Handle SWP and SWPB out of the extra loads/stores extensions.
1183 */
1184 static int
1185 arm_dis_swap(uint32_t in, char *buf, size_t buflen)
1186 {
1187 arm_cond_code_t cc;
1188 arm_reg_t rn, rd, rm;
1189
1190 cc = (in & ARM_CC_MASK) >> ARM_CC_SHIFT;
1191 rn = (in & ARM_ELS_RN_MASK) >> ARM_ELS_RN_SHIFT;
1192 rd = (in & ARM_ELS_RD_MASK) >> ARM_ELS_RD_SHIFT;
1193 rm = in & ARM_ELS_RN_MASK;
1194
1195 if (snprintf(buf, buflen, "SWP%s%s %s, %s, [%s]",
1196 arm_cond_names[cc],
1197 (in & ARM_ELS_SWAP_BYTE_MASK) ? "B" : "",
1198 arm_reg_names[rd], arm_reg_names[rm], arm_reg_names[rn]) >=
1199 buflen)
1200 return (-1);
1201
1202 return (0);
1203 }
1204
1205 /*
1206 * Handle LDREX and STREX out of the extra loads/stores extensions.
1207 */
1208 static int
1209 arm_dis_lsexcl(uint32_t in, char *buf, size_t buflen)
1210 {
1211 arm_cond_code_t cc;
1212 arm_reg_t rn, rd, rm;
1213 int lbit;
1214 size_t len;
1215
1216 cc = (in & ARM_CC_MASK) >> ARM_CC_SHIFT;
1217 rn = (in & ARM_ELS_RN_MASK) >> ARM_ELS_RN_SHIFT;
1218 rd = (in & ARM_ELS_RD_MASK) >> ARM_ELS_RD_SHIFT;
1219 rm = in & ARM_ELS_RN_MASK;
1220 lbit = in & ARM_ELS_LBIT_MASK;
1221
1222 len = snprintf(buf, buflen, "%s%sEX %s, ",
1223 lbit != 0 ? "LDR" : "STR",
1224 arm_cond_names[cc], arm_reg_names[rd]);
1225 if (len >= buflen)
1226 return (-1);
1227
1228 if (lbit)
1229 len += snprintf(buf + len, buflen - len, "[%s]",
1230 arm_reg_names[rn]);
1231 else
1232 len += snprintf(buf + len, buflen - len, "%s, [%s]",
1233 arm_reg_names[rm], arm_reg_names[rn]);
1234 return (len >= buflen ? -1 : 0);
1235 }
1236
1237 /*
1238 * This is designed to handle the multiplication instruction extension space.
1239 * Note that this doesn't actually cover all of the multiplication instructions
1240 * available in ARM, but all of the ones that are in this space. This includes
1241 * the following instructions:
1242 *
1243 *
1244 * There are three basic encoding formats:
1245 *
1246 * Multipy (acc):
1247 * 31 - 28|27 - 24|23|22|21|20|19-16|15-12|11-8 |7|6|5|4|3-0
1248 * [ cond | 0 |0 |0 | A |S |Rn | Rd |Rs |1|0|0|1|Rm ]
1249 *
1250 * Unsigned multipy acc acc long
1251 * 31 - 28|27 - 24|23|22|21|20|19-16|15-12|11-8 |7|6|5|4|3-0
1252 * [ cond | 0 |0 |1 |0 |0 |RdHi |RdLo |Rs |1|0|0|1|Rm ]
1253 *
1254 * Multiply (acc) long:
1255 * 31 - 28|27 - 24|23|22|21|20|19-16|15-12|11-8 |7|6|5|4|3-0
1256 * [ cond | 0 |1 |Un|A |S |RdHi| RdLo |Rs |1|0|0|1|Rm ]
1257 *
1258 * A bit: Accumulate
1259 * Un bit: Unsigned is active low, signed is active high
1260 * S bit: Indicates whethere the status register should be updated.
1261 *
1262 * MLA(S) and MUL(S) make up the first type of instructions.
1263 * UMAAL makes up the second group.
1264 * (U|S)MULL(S), (U|S)MLAL(S), Make up the third.
1265 */
1266 static int
1267 arm_dis_extmul(uint32_t in, char *buf, size_t buflen)
1268 {
1269 arm_cond_code_t cc;
1270 arm_reg_t rd, rn, rs, rm;
1271 size_t len;
1272
1273 /*
1274 * RdHi is equal to rd here. RdLo is equal to Rn here.
1275 */
1276 rd = (in & ARM_EMULT_RD_MASK) >> ARM_EMULT_RD_SHIFT;
1277 rn = (in & ARM_EMULT_RN_MASK) >> ARM_EMULT_RN_SHIFT;
1278 rs = (in & ARM_EMULT_RS_MASK) >> ARM_EMULT_RS_SHIFT;
1279 rm = in & ARM_EMULT_RM_MASK;
1280
1281 cc = (in & ARM_CC_MASK) >> ARM_CC_SHIFT;
1282
1283 if ((in & ARM_EMULT_MA_MASK) == 0) {
1284 if (in & ARM_EMULT_ABIT_MASK) {
1285 len = snprintf(buf, buflen, "MLA%s%s %s, %s, %s, %s",
1286 arm_cond_names[cc],
1287 (in & ARM_EMULT_SBIT_MASK) ? "S" : "",
1288 arm_reg_names[rd], arm_reg_names[rm],
1289 arm_reg_names[rs], arm_reg_names[rs]);
1290 } else {
1291 len = snprintf(buf, buflen, "MUL%s%s %s, %s, %s",
1292 arm_cond_names[cc],
1293 (in & ARM_EMULT_SBIT_MASK) ? "S" : "",
1294 arm_reg_names[rd], arm_reg_names[rm],
1295 arm_reg_names[rs]);
1296
1297 }
1298 } else if ((in & ARM_EMULT_UMA_MASK) == ARM_EMULT_UMA_TARG) {
1299 len = snprintf(buf, buflen, "UMAAL%s %s, %s, %s, %s",
1300 arm_cond_names[cc], arm_reg_names[rn], arm_reg_names[rd],
1301 arm_reg_names[rm], arm_reg_names[rs]);
1302 } else if ((in & ARM_EMULT_MAL_MASK) == ARM_EMULT_MAL_TARG) {
1303 len = snprintf(buf, buflen, "%s%s%s%s %s, %s, %s, %s",
1304 (in & ARM_EMULT_UNBIT_MASK) ? "S" : "U",
1305 (in & ARM_EMULT_ABIT_MASK) ? "MLAL" : "MULL",
1306 arm_cond_names[cc],
1307 (in & ARM_EMULT_SBIT_MASK) ? "S" : "",
1308 arm_reg_names[rn], arm_reg_names[rd], arm_reg_names[rm],
1309 arm_reg_names[rs]);
1310 } else {
1311 /* Not a supported instruction in this space */
1312 return (-1);
1313 }
1314 return (len >= buflen ? -1 : 0);
1315 }
1316
1317 /*
1318 * Here we handle the three different cases of moving to and from the various
1319 * status registers in both register mode and in immediate mode.
1320 */
1321 static int
1322 arm_dis_status_regs(uint32_t in, char *buf, size_t buflen)
1323 {
1324 arm_cond_code_t cc;
1325 arm_reg_t rd, rm;
1326 uint8_t field;
1327 int imm;
1328 size_t len;
1329
1330 cc = (in & ARM_CC_MASK) >> ARM_CC_SHIFT;
1331
1332 if ((in & ARM_CDSP_MRS_MASK) == ARM_CDSP_MRS_TARG) {
1333 rd = (in & ARM_CDSP_RD_MASK) >> ARM_CDSP_RD_SHIFT;
1334 if (snprintf(buf, buflen, "MRS%s %s, %s", arm_cond_names[cc],
1335 arm_reg_names[rd],
1336 (in & ARM_CDSP_STATUS_RBIT) != 0 ? "SPSR" : "CPSR") >=
1337 buflen)
1338 return (-1);
1339 return (0);
1340 }
1341
1342 field = (in & ARM_CDSP_MSR_F_MASK) >> ARM_CDSP_MSR_F_SHIFT;
1343 len = snprintf(buf, buflen, "MSR%s %s_%s, ", arm_cond_names[cc],
1344 (in & ARM_CDSP_STATUS_RBIT) != 0 ? "SPSR" : "CPSR",
1345 arm_cdsp_msr_field_names[field]);
1346 if (len >= buflen)
1347 return (-1);
1348
1349 if (in & ARM_CDSP_MSR_ISIMM_MASK) {
1350 imm = in & ARM_CDSP_MSR_IMM_MASK;
1351 imm <<= (in & ARM_CDSP_MSR_RI_MASK) >> ARM_CDSP_MSR_RI_SHIFT;
1352 len += snprintf(buf + len, buflen - len, "#%d", imm);
1353 } else {
1354 rm = in & ARM_CDSP_RM_MASK;
1355 len += snprintf(buf + len, buflen - len, "%s",
1356 arm_reg_names[rm]);
1357 }
1358
1359 return (len >= buflen ? -1 : 0);
1360 }
1361
1362 /*
1363 * Here we need to handle the Control And DSP instruction extension space. This
1364 * consists of several different instructions. Unlike other extension spaces
1365 * there isn't as much tha tis similar here as there is stuff that is different.
1366 * Oh well, that's a part of life. Instead we do a little bit of additional
1367 * parsing here.
1368 *
1369 * The first group that we separate out are the instructions that interact with
1370 * the status registers. Those are handled in their own function.
1371 */
1372 static int
1373 arm_dis_cdsp_ext(uint32_t in, char *buf, size_t buflen)
1374 {
1375 uint16_t imm, op;
1376 arm_cond_code_t cc;
1377 arm_reg_t rd, rm, rn, rs;
1378 size_t len;
1379
1380 if ((in & ARM_CDSP_STATUS_MASK) == ARM_CDSP_STATUS_TARG)
1381 return (arm_dis_status_regs(in, buf, buflen));
1382
1383 cc = (in & ARM_CC_MASK) >> ARM_CC_SHIFT;
1384
1385 /*
1386 * This gets the Branch/exchange as well as the Branch and link/exchange
1387 * pieces. These generally also transform the instruction set into
1388 * something we can't actually disassemble. Here the lower mask and
1389 * target is the opposite. eg. the target bits are not what we want.
1390 */
1391 if ((in & ARM_CDSP_BEX_UP_MASK) == ARM_CDSP_BEX_UP_TARG &&
1392 (in & ARM_CDSP_BEX_LOW_MASK) != ARM_CDSP_BEX_NLOW_TARG) {
1393 rm = in & ARM_CDSP_RM_MASK;
1394 imm = (in & ARM_CDSP_BEX_TYPE_MASK) >> ARM_CDSP_BEX_TYPE_SHIFT;
1395 if (snprintf(buf, buflen, "B%s%s %s",
1396 imm == ARM_CDSP_BEX_TYPE_X ? "X" :
1397 imm == ARM_CDSP_BEX_TYPE_J ? "XJ" : "LX",
1398 arm_cond_names[cc], arm_reg_names[rm]) >= buflen)
1399 return (-1);
1400 return (0);
1401 }
1402
1403 /* Count leading zeros */
1404 if ((in & ARM_CDSP_CLZ_MASK) == ARM_CDSP_CLZ_TARG) {
1405 rd = (in & ARM_CDSP_RD_MASK) >> ARM_CDSP_RD_SHIFT;
1406 rm = in & ARM_CDSP_RM_MASK;
1407 if (snprintf(buf, buflen, "CLZ%s %s, %s", arm_cond_names[cc],
1408 arm_reg_names[rd], arm_reg_names[rm]) >= buflen)
1409 return (-1);
1410 return (0);
1411 }
1412
1413 if ((in & ARM_CDSP_SAT_MASK) == ARM_CDSP_SAT_TARG) {
1414 rd = (in & ARM_CDSP_RD_MASK) >> ARM_CDSP_RD_SHIFT;
1415 rn = (in & ARM_CDSP_RN_MASK) >> ARM_CDSP_RN_SHIFT;
1416 rm = in & ARM_CDSP_RM_MASK;
1417 imm = (in & ARM_CDSP_SAT_OP_MASK) >> ARM_CDSP_SAT_OP_SHIFT;
1418 if (snprintf(buf, buflen, "Q%s%s %s, %s, %s",
1419 arm_cdsp_sat_opnames[imm], arm_cond_names[cc],
1420 arm_reg_names[rd], arm_reg_names[rm],
1421 arm_reg_names[rn]) >= buflen)
1422 return (-1);
1423 return (0);
1424 }
1425
1426 /*
1427 * Breakpoint instructions are a bit different. While they are in the
1428 * conditional instruction namespace, they actually aren't defined to
1429 * take a condition. That's just how it rolls. The breakpoint is a
1430 * 16-bit value. The upper 12 bits are stored together and the lower
1431 * four together.
1432 */
1433 if ((in & ARM_CDSP_BKPT_MASK) == ARM_CDSP_BKPT_TARG) {
1434 if (cc != ARM_COND_NACC)
1435 return (-1);
1436 imm = (in & ARM_CDSP_BKPT_UIMM_MASK) >>
1437 ARM_CDSP_BKPT_UIMM_SHIFT;
1438 imm <<= 4;
1439 imm |= (in & ARM_CDSP_BKPT_LIMM_MASK);
1440 if (snprintf(buf, buflen, "BKPT %d", imm) >= buflen)
1441 return (1);
1442 return (0);
1443 }
1444
1445 /*
1446 * Here we need to handle another set of multiplies. Specifically the
1447 * Signed multiplies. This is SMLA<x><y>, SMLAW<y>, SMULW<y>,
1448 * SMLAL<x><y>, SMUL<x><y>. These instructions all follow the form:
1449 *
1450 * 31 - 28|27-25|24|23|22-21|20|19-16|15-12|11 - 8|7|6|5|4|3-0
1451 * [ cond | 0 | 1| 0| op. | 0|Rn |Rd |Rs |1|y|x|0|Rm ]
1452 *
1453 * If x is one a T is used for that part of the name. Otherwise a B is.
1454 * The same holds true for y.
1455 *
1456 * These instructions map to the following opcodes:
1457 * SMLA<x><y>: 00,
1458 * SMLAW<y>: 01 and x is zero,
1459 * SMULW<y>: 01 and x is one ,
1460 * SMLAL<x><y>: 10,
1461 * SMUL<xy><y>: 11
1462 */
1463 if ((in & ARM_CDSP_SMUL_MASK) == ARM_CDSP_SMUL_TARG) {
1464 rd = (in & ARM_CDSP_RD_MASK) >> ARM_CDSP_RD_SHIFT;
1465 rn = (in & ARM_CDSP_RN_MASK) >> ARM_CDSP_RN_SHIFT;
1466 rs = (in & ARM_CDSP_RS_MASK) >> ARM_CDSP_RS_SHIFT;
1467 rm = in & ARM_CDSP_RM_MASK;
1468 op = (in & ARM_CDSP_SMUL_OP_MASK) >> ARM_CDSP_SMUL_OP_SHIFT;
1469
1470 switch (op) {
1471 case 0:
1472 len = snprintf(buf, buflen, "SMLA%s%s%s %s, %s, %s, %s",
1473 (in & ARM_CDSP_SMUL_X_MASK) != 0 ? "T" : "B",
1474 (in & ARM_CDSP_SMUL_Y_MASK) != 0 ? "T" : "B",
1475 arm_cond_names[cc], arm_reg_names[rd],
1476 arm_reg_names[rm], arm_reg_names[rs],
1477 arm_reg_names[rn]);
1478 break;
1479 case 1:
1480 if (in & ARM_CDSP_SMUL_X_MASK) {
1481 len = snprintf(buf, buflen,
1482 "SMULW%s%s %s, %s, %s",
1483 (in & ARM_CDSP_SMUL_Y_MASK) != 0 ? "T" :
1484 "B", arm_cond_names[cc], arm_reg_names[rd],
1485 arm_reg_names[rm], arm_reg_names[rs]);
1486 } else {
1487 len = snprintf(buf, buflen,
1488 "SMLAW%s%s %s, %s, %s %s",
1489 (in & ARM_CDSP_SMUL_Y_MASK) != 0 ? "T" :
1490 "B", arm_cond_names[cc], arm_reg_names[rd],
1491 arm_reg_names[rm], arm_reg_names[rs],
1492 arm_reg_names[rn]);
1493 }
1494 break;
1495 case 2:
1496 len = snprintf(buf, buflen,
1497 "SMLAL%s%s%s %s, %s, %s, %s",
1498 (in & ARM_CDSP_SMUL_X_MASK) != 0 ? "T" : "B",
1499 (in & ARM_CDSP_SMUL_Y_MASK) != 0 ? "T" : "B",
1500 arm_cond_names[cc], arm_reg_names[rd],
1501 arm_reg_names[rn], arm_reg_names[rm],
1502 arm_reg_names[rs]);
1503 break;
1504 case 3:
1505 len = snprintf(buf, buflen, "SMUL%s%s%s %s, %s, %s",
1506 (in & ARM_CDSP_SMUL_X_MASK) != 0 ? "T" : "B",
1507 (in & ARM_CDSP_SMUL_Y_MASK) != 0 ? "T" : "B",
1508 arm_cond_names[cc], arm_reg_names[rd],
1509 arm_reg_names[rm], arm_reg_names[rs]);
1510 break;
1511 default:
1512 return (-1);
1513 }
1514 return (len >= buflen ? -1 : 0);
1515 }
1516
1517 /*
1518 * If we got here then this is some other instructin we don't know
1519 * about in the instruction extensino space.
1520 */
1521 return (-1);
1522 }
1523
1524 /*
1525 * Coprocessor double register transfers
1526 *
1527 * MCRR:
1528 * 31 - 28|27-25|24|23|22|21|20|19-16|15-12|11-8|7-4|3-0
1529 * [ cond |1 1 0| 0| 0| 1| 0| 0| Rn | Rd |cp #|op |CRm
1530 *
1531 * MRRC:
1532 * 31 - 28|27-25|24|23|22|21|20|19-16|15-12|11-8|7-4|3-0
1533 * [ cond |1 1 0| 0| 0| 1| 0| 1| Rn | Rd |cp #|op |CRm
1534 *
1535 */
1536 static int
1537 arm_dis_coproc_drt(uint32_t in, char *buf, size_t buflen)
1538 {
1539 arm_cond_code_t cc;
1540 arm_reg_t rd, rn, rm;
1541 uint8_t coproc, op;
1542 const char *ccn;
1543 size_t len;
1544
1545 cc = (in & ARM_CC_MASK) >> ARM_CC_SHIFT;
1546 coproc = (in & ARM_COPROC_NUM_MASK) >> ARM_COPROC_NUM_SHIFT;
1547 rn = (in & ARM_COPROC_RN_MASK) >> ARM_COPROC_RN_SHIFT;
1548 rd = (in & ARM_COPROC_RD_MASK) >> ARM_COPROC_RD_SHIFT;
1549 rm = in & ARM_COPROC_RM_MASK;
1550 op = (in & ARM_COPROC_DRT_OP_MASK) >> ARM_COPROC_DRT_OP_SHIFT;
1551
1552 if (cc == ARM_COND_NACC)
1553 ccn = "2";
1554 else
1555 ccn = arm_cond_names[cc];
1556
1557 len = snprintf(buf, buflen, "%s%s %s, #%d, %s, %s, C%s",
1558 (in & ARM_COPROC_DRT_DIR_MASK) != 0 ? "MRRC" : "MCRR",
1559 ccn, arm_coproc_names[coproc], op, arm_reg_names[rd],
1560 arm_reg_names[rn], arm_reg_names[rm]);
1561 return (len >= buflen ? -1 : 0);
1562 }
1563
1564 /*
1565 * This serves as both the entry point for the normal load and stores as well as
1566 * the double register transfers (MCRR and MRCC). If it is a register transfer
1567 * then we quickly send it off.
1568 * LDC:
1569 * 31 - 28|27-25|24|23|22|21|20|19-16|15-12|11 - 8|7 - 0
1570 * [ cond |1 1 0| P| U| N| W| L| Rn | CRd | cp # | off ]
1571 *
1572 * STC:
1573 * 31 - 28|27-25|24|23|22|21|20|19-16|15-12|11 - 8|7 - 0
1574 * [ cond |1 1 0| P| U| N| W| L| Rn | CRd | cp # | off ]
1575 *
1576 * Here the bits mean:
1577 *
1578 * P bit: If P is zero, it is post-indexed or unindexed based on W. If P is 1
1579 * then it is offset-addressing or pre-indexed based on W again.
1580 *
1581 * U bit: If U is positive then the offset if added, subtracted otherwise.. Note
1582 * that if P is zero and W is zero, U must be one.
1583 *
1584 * N bit: If set that means that we have a Long size, this bit is set by the L
1585 * suffix, not to be confused with the L bit.
1586 *
1587 * W bit: If W is one then the memory address is written back to the base
1588 * register. Further W = 0 and P = 0 is unindexed addressing. W = 1, P = 0 is
1589 * post-indexed. W = 0, P = 1 is offset addressing and W = 1, P = 1 is
1590 * pre-indexed.
1591 */
1592 static int
1593 arm_dis_coproc_lsdrt(uint32_t in, char *buf, size_t buflen)
1594 {
1595 arm_cond_code_t cc;
1596 arm_reg_t rn, rd;
1597 uint8_t coproc;
1598 uint32_t imm;
1599 int pbit, ubit, nbit, wbit, lbit;
1600 const char *ccn;
1601 size_t len;
1602
1603 if ((in & ARM_COPROC_DRT_MASK) == ARM_COPROC_DRT_TARG)
1604 return (arm_dis_coproc_drt(in, buf, buflen));
1605
1606 cc = (in & ARM_CC_MASK) >> ARM_CC_SHIFT;
1607 coproc = (in & ARM_COPROC_NUM_MASK) >> ARM_COPROC_NUM_SHIFT;
1608 rn = (in & ARM_COPROC_RN_MASK) >> ARM_COPROC_RN_SHIFT;
1609 rd = (in & ARM_COPROC_RD_MASK) >> ARM_COPROC_RD_SHIFT;
1610 imm = in & ARM_COPROC_LS_IMM_MASK;
1611
1612 pbit = in & ARM_COPROC_LS_P_MASK;
1613 ubit = in & ARM_COPROC_LS_U_MASK;
1614 nbit = in & ARM_COPROC_LS_N_MASK;
1615 wbit = in & ARM_COPROC_LS_W_MASK;
1616 lbit = in & ARM_COPROC_LS_L_MASK;
1617
1618 if (cc == ARM_COND_NACC)
1619 ccn = "2";
1620 else
1621 ccn = arm_cond_names[cc];
1622
1623 len = snprintf(buf, buflen, "%s%s%s %s, C%s, ",
1624 lbit != 0 ? "LDC" : "STC", ccn, nbit != 0 ? "L" : "",
1625 arm_coproc_names[coproc], arm_reg_names[rd]);
1626 if (len >= buflen)
1627 return (-1);
1628
1629 if (pbit != 0) {
1630 imm *= 4;
1631 len += snprintf(buf + len, buflen - len, "[%s, #%s%d]%s",
1632 arm_reg_names[rn],
1633 ubit != 0 ? "" : "-", imm,
1634 wbit != 0 ? "!" : "");
1635 } else if (wbit != 0) {
1636 imm *= 4;
1637 len += snprintf(buf + len, buflen - len, "[%s], #%s%d",
1638 arm_reg_names[rn], ubit != 0 ? "" : "-", imm);
1639 } else {
1640 len += snprintf(buf + len, buflen - len, "[%s], { %d }",
1641 arm_reg_names[rn], imm);
1642 }
1643 return (len >= buflen ? -1 : 0);
1644 }
1645
1646 /*
1647 * Here we tell a coprocessor to do data processing
1648 *
1649 * CDP:
1650 * 31 - 28|27 - 24|23-20|19-16|15-12|11 - 8|7 - 5|4|3-0
1651 * [ cond |1 1 1 0| op_1| CRn | CRd | cp # | op_2|0|CRm ]
1652 */
1653 static int
1654 arm_dis_coproc_dp(uint32_t in, char *buf, size_t buflen)
1655 {
1656 arm_cond_code_t cc;
1657 arm_reg_t rn, rd, rm;
1658 uint8_t op1, op2, coproc;
1659 const char *ccn;
1660
1661 cc = (in & ARM_CC_MASK) >> ARM_CC_SHIFT;
1662 coproc = (in & ARM_COPROC_NUM_MASK) >> ARM_COPROC_NUM_SHIFT;
1663 rn = (in & ARM_COPROC_RN_MASK) >> ARM_COPROC_RN_SHIFT;
1664 rd = (in & ARM_COPROC_RD_MASK) >> ARM_COPROC_RD_SHIFT;
1665 rm = in & ARM_COPROC_RM_MASK;
1666 op1 = (in & ARM_COPROC_CDP_OP1_MASK) >> ARM_COPROC_CDP_OP1_SHIFT;
1667 op2 = (in & ARM_COPROC_CDP_OP2_MASK) >> ARM_COPROC_CDP_OP2_SHIFT;
1668
1669 /*
1670 * This instruction is valid with the undefined condition code. When it
1671 * does that, the instruction is intead CDP2 as opposed to CDP.
1672 */
1673 if (cc == ARM_COND_NACC)
1674 ccn = "2";
1675 else
1676 ccn = arm_cond_names[cc];
1677
1678 if (snprintf(buf, buflen, "CDP%s %s, #%d, C%s, C%s, C%s, #%d", ccn,
1679 arm_coproc_names[coproc], op1, arm_reg_names[rd],
1680 arm_reg_names[rn], arm_reg_names[rm], op2) >= buflen)
1681 return (-1);
1682
1683 return (0);
1684 }
1685
1686 /*
1687 * Here we handle coprocesser single register transfers.
1688 *
1689 * MCR:
1690 * 31 - 28|27 - 24|23-21|20|19-16|15-12|11 - 8|7 - 5|4|3-0
1691 * [ cond |1 1 1 0| op_1| 0| CRn | Rd | cp # | op_2|1|CRm ]
1692 *
1693 * MRC:
1694 * 31 - 28|27 - 24|23-21|20|19-16|15-12|11 - 8|7 - 5|4|3-0
1695 * [ cond |1 1 1 0| op_1| 1| CRn | Rd | cp # | op_2|1|CRm ]
1696 */
1697 static int
1698 arm_dis_coproc_rt(uint32_t in, char *buf, size_t buflen)
1699 {
1700 arm_cond_code_t cc;
1701 arm_reg_t rn, rd, rm;
1702 uint8_t op1, op2, coproc;
1703 const char *ccn;
1704 size_t len;
1705
1706 cc = (in & ARM_CC_MASK) >> ARM_CC_SHIFT;
1707 coproc = (in & ARM_COPROC_NUM_MASK) >> ARM_COPROC_NUM_SHIFT;
1708 rn = (in & ARM_COPROC_RN_MASK) >> ARM_COPROC_RN_SHIFT;
1709 rd = (in & ARM_COPROC_RD_MASK) >> ARM_COPROC_RD_SHIFT;
1710 rm = in & ARM_COPROC_RM_MASK;
1711 op1 = (in & ARM_COPROC_CRT_OP1_MASK) >> ARM_COPROC_CRT_OP1_SHIFT;
1712 op2 = (in & ARM_COPROC_CRT_OP2_MASK) >> ARM_COPROC_CRT_OP2_SHIFT;
1713
1714 if (cc == ARM_COND_NACC)
1715 ccn = "2";
1716 else
1717 ccn = arm_cond_names[cc];
1718
1719 len = snprintf(buf, buflen, "%s%s %s, #%d, %s, C%s, C%s",
1720 (in & ARM_COPROC_CRT_DIR_MASK) != 0 ? "MRC" : "MCR", ccn,
1721 arm_coproc_names[coproc], op1, arm_reg_names[rd],
1722 arm_reg_names[rn], arm_reg_names[rm]);
1723 if (len >= buflen)
1724 return (-1);
1725
1726 if (op2 != 0)
1727 if (snprintf(buf + len, buflen - len, ", #%d", op2) >=
1728 buflen - len)
1729 return (-1);
1730 return (0);
1731 }
1732
1733 /*
1734 * Here we handle the set of unconditional instructions.
1735 */
1736 static int
1737 arm_dis_uncond_insn(uint32_t in, char *buf, size_t buflen)
1738 {
1739 int imm, sc;
1740 arm_reg_t rn, rm;
1741 size_t len;
1742
1743 /*
1744 * The CPS instruction is a bit complicated. It has the following big
1745 * pattern which maps to a few different ways to use it:
1746 *
1747 *
1748 * 31-28|27-25|24|23-20|19-18|17 |16|15-9|8|7|6|5|4-0
1749 * 1 | 0 | 1| 0 |imod|mmod| 0|SBZ |A|I|F|0|mode
1750 *
1751 * CPS<effect> <iflags> {, #<mode> }
1752 * CPS #<mode>
1753 *
1754 * effect: determines what to do with the A, I, F interrupt bits in the
1755 * CPSR. effect is encoded in the imod field. It is either enable
1756 * interrupts 0b10 or disable interrupts 0b11. Recall that interrupts
1757 * are active low in the CPSR. If effect is not specified then this is
1758 * strictly a mode change which is required.
1759 *
1760 * A, I, F: If effect is specified then the bits which are high are
1761 * modified by the instruction.
1762 *
1763 * mode: Specifies a mode to change to. mmod will be 1 if mode is set.
1764 *
1765 */
1766 if ((in & ARM_UNI_CPS_MASK) == ARM_UNI_CPS_TARG) {
1767 imm = (in & ARM_UNI_CPS_IMOD_MASK) > ARM_UNI_CPS_IMOD_SHIFT;
1768
1769 /* Ob01 is not a valid value for the imod */
1770 if (imm == 1)
1771 return (-1);
1772
1773 if (imm != 0)
1774 len = snprintf(buf, buflen, "CPS%s %s%s%s%s",
1775 imm == 2 ? "IE" : "ID",
1776 (in & ARM_UNI_CPS_A_MASK) ? "a" : "",
1777 (in & ARM_UNI_CPS_I_MASK) ? "i" : "",
1778 (in & ARM_UNI_CPS_F_MASK) ? "f" : "",
1779 (in & ARM_UNI_CPS_MMOD_MASK) ? " ," : "");
1780 else
1781 len = snprintf(buf, buflen, "CPS ");
1782 if (len >= buflen)
1783 return (-1);
1784
1785 if (in & ARM_UNI_CPS_MMOD_MASK)
1786 if (snprintf(buf + len, buflen - len, "#%d",
1787 in & ARM_UNI_CPS_MODE_MASK) >= buflen - len)
1788 return (-1);
1789 return (0);
1790 }
1791
1792 if ((in & ARM_UNI_SE_MASK) == ARM_UNI_SE_TARG) {
1793 if (snprintf(buf, buflen, "SETEND %s",
1794 (in & ARM_UNI_SE_BE_MASK) ? "BE" : "LE") >= buflen)
1795 return (-1);
1796 return (0);
1797 }
1798
1799 /*
1800 * The cache preload is like a load, but it has a much simpler set of
1801 * constraints. The only valid bits that you can transform are the I and
1802 * the U bits. We have to use pre-indexed addressing. This means that we
1803 * only have the U bit and the I bit. See arm_dis_ldstr for a full
1804 * explanation of what's happening here.
1805 */
1806 if ((in & ARM_UNI_PLD_MASK) == ARM_UNI_PLD_TARG) {
1807 rn = (in & ARM_LS_RN_MASK) >> ARM_LS_RN_SHIFT;
1808 if ((in & ARM_LS_IBIT_MASK) == 0) {
1809 if (snprintf(buf, buflen, "PLD [%s, #%s%d",
1810 arm_reg_names[rn],
1811 (in & ARM_LS_UBIT_MASK) != 0 ? "" : "-",
1812 in & ARM_LS_IMM_MASK) >= buflen)
1813 return (-1);
1814 return (0);
1815 }
1816
1817 rm = in & ARM_LS_REG_RM_MASK;
1818 len = snprintf(buf, buflen, "PLD [%s, %s%s", arm_reg_names[rn],
1819 (in & ARM_LS_UBIT_MASK) != 0 ? "" : "-",
1820 arm_reg_names[rm]);
1821 if (len >= buflen)
1822 return (-1);
1823
1824 if ((in & ARM_LS_REG_NRM_MASK) != 0) {
1825 imm = (in & ARM_LS_SCR_SIMM_MASK) >>
1826 ARM_LS_SCR_SIMM_SHIFT;
1827 sc = (in & ARM_LS_SCR_SCODE_MASK) >>
1828 ARM_LS_SCR_SCODE_SHIFT;
1829
1830 if (imm == 0 && sc == DPI_S_ROR)
1831 sc = DPI_S_RRX;
1832
1833 len += snprintf(buf + len, buflen - len, "%s",
1834 arm_dpi_shifts[sc]);
1835 if (len >= buflen)
1836 return (-1);
1837 if (sc != DPI_S_RRX) {
1838 len += snprintf(buf + len, buflen - len,
1839 " #%d", imm);
1840 if (len >= buflen)
1841 return (-1);
1842 }
1843 }
1844 if (snprintf(buf + len, buflen - len, "]") >= buflen - len)
1845 return (-1);
1846 return (0);
1847 }
1848
1849 /*
1850 * This is a special case of STM, but it works across chip modes.
1851 */
1852 if ((in & ARM_UNI_SRS_MASK) == ARM_UNI_SRS_TARG) {
1853 imm = (in & ARM_LSM_ADDR_MASK) >> ARM_LSM_ADDR_SHIFT;
1854 if (snprintf(buf, buflen, "SRS%s #%d%s",
1855 arm_lsm_mode_names[imm],
1856 in & ARM_UNI_SRS_MODE_MASK,
1857 (in & ARM_UNI_SRS_WBIT_MASK) != 0 ? "!" : "") >= buflen)
1858 return (-1);
1859 return (0);
1860 }
1861
1862 /*
1863 * RFE is a return from exception instruction that is similar to the LDM
1864 * and STM, but a bit different.
1865 */
1866 if ((in & ARM_UNI_RFE_MASK) == ARM_UNI_RFE_TARG) {
1867 imm = (in & ARM_LSM_ADDR_MASK) >> ARM_LSM_ADDR_SHIFT;
1868 rn = (in & ARM_LS_RN_MASK) >> ARM_LS_RN_SHIFT;
1869 if (snprintf(buf, buflen, "RFE%s %s%s", arm_lsm_mode_names[imm],
1870 arm_reg_names[rn],
1871 (in & ARM_UNI_RFE_WBIT_MASK) != 0 ? "!" : "") >= buflen)
1872 return (-1);
1873 return (0);
1874 }
1875
1876 if ((in & ARM_UNI_BLX_MASK) == ARM_UNI_BLX_TARG) {
1877 if (snprintf(buf, buflen, "BLX %d",
1878 in & ARM_UNI_BLX_IMM_MASK) >= buflen)
1879 return (-1);
1880 return (0);
1881 }
1882
1883 if ((in & ARM_UNI_CODRT_MASK) == ARM_UNI_CODRT_TARG) {
1884 return (arm_dis_coproc_lsdrt(in, buf, buflen));
1885 }
1886
1887 if ((in & ARM_UNI_CORT_MASK) == ARM_UNI_CORT_TARG) {
1888 return (arm_dis_coproc_rt(in, buf, buflen));
1889 }
1890
1891 if ((in & ARM_UNI_CODP_MASK) == ARM_UNI_CORT_TARG) {
1892 return (arm_dis_coproc_dp(in, buf, buflen));
1893 }
1894
1895 /*
1896 * An undefined or illegal instruction
1897 */
1898 return (-1);
1899 }
1900
1901 /*
1902 * Disassemble B and BL instructions. The instruction is given a 24-bit two's
1903 * complement value as an offset address. This value gets sign extended to 30
1904 * bits and then shifted over two bits. This is then added to the PC + 8. So,
1905 * instead of dispalying an absolute address, we're going to display the delta
1906 * that the instruction has instead.
1907 */
1908 static int
1909 arm_dis_branch(dis_handle_t *dhp, uint32_t in, char *buf, size_t buflen)
1910 {
1911 uint32_t addr;
1912 arm_cond_code_t cc;
1913 size_t len;
1914
1915 cc = (in & ARM_CC_MASK) >> ARM_CC_SHIFT;
1916 addr = in & ARM_BRANCH_IMM_MASK;
1917 if (in & ARM_BRANCH_SIGN_MASK)
1918 addr |= ARM_BRANCH_NEG_SIGN;
1919 else
1920 addr &= ARM_BRANCH_POS_SIGN;
1921 addr <<= 2;
1922 if ((len = snprintf(buf, buflen, "B%s%s %d",
1923 (in & ARM_BRANCH_LBIT_MASK) != 0 ? "L" : "",
1924 arm_cond_names[cc], (int)addr)) >= buflen)
1925 return (-1);
1926
1927 /* Per the ARM manuals, we have to account for the extra 8 bytes here */
1928 if (dhp->dh_lookup(dhp->dh_data, dhp->dh_addr + (int)addr + 8, NULL, 0,
1929 NULL, NULL) == 0) {
1930 len += snprintf(buf + len, buflen - len, "\t<");
1931 if (len >= buflen)
1932 return (-1);
1933 dhp->dh_lookup(dhp->dh_data, dhp->dh_addr + (int)addr + 8,
1934 buf + len, buflen - len, NULL, NULL);
1935 strlcat(buf, ">", buflen);
1936 }
1937
1938 return (0);
1939 }
1940
1941 /*
1942 * There are six instructions that are covered here: ADD16, ADDSUBX, SUBADDX,
1943 * SUB16, ADD8, and SUB8. They can hae the following variations: S, Q, SH, U,
1944 * UQ, and UH. It has two differnt sets of bits to determine the opcode: 22-20
1945 * and then 7-5.
1946 *
1947 * These instructions have the general form of:
1948 *
1949 * 31 - 28|27-25|24|23|22-20|19-16|15-12|11 - 8|7-5|4|3-0
1950 * [ cond |0 1 1| 0| 0| opP |Rn |Rd |SBO |opI|1|Rm ]
1951 *
1952 * Here we use opP to refer to the prefix of the instruction, eg. S, Q, etc.
1953 * Where as opI refers to which instruction it is, eg. ADD16, ADD8, etc. We use
1954 * string tables for both of these in arm_padd_p_names and arm_padd_i_names. If
1955 * there is an empty entry that means that the instruction in question doesn't
1956 * exist.
1957 */
1958 static int
1959 arm_dis_padd(uint32_t in, char *buf, size_t buflen)
1960 {
1961 arm_reg_t rn, rd, rm;
1962 arm_cond_code_t cc;
1963 uint8_t opp, opi;
1964 const char *pstr, *istr;
1965
1966 opp = (in & ARM_MEDIA_OP1_MASK) >> ARM_MEDIA_OP1_SHIFT;
1967 opi = (in & ARM_MEDIA_OP2_MASK) >> ARM_MEDIA_OP2_SHIFT;
1968
1969 pstr = arm_padd_p_names[opp];
1970 istr = arm_padd_i_names[opi];
1971
1972 if (pstr == NULL || istr == NULL)
1973 return (-1);
1974
1975 cc = (in & ARM_CC_MASK) >> ARM_CC_SHIFT;
1976 rn = (in & ARM_MEDIA_RN_MASK) >> ARM_MEDIA_RN_SHIFT;
1977 rd = (in & ARM_MEDIA_RD_MASK) >> ARM_MEDIA_RD_SHIFT;
1978 rm = in & ARM_MEDIA_RM_MASK;
1979
1980 if (snprintf(buf, buflen, "%s%%s %s, %s, %s", pstr, istr,
1981 arm_cond_names[cc], arm_reg_names[rd], arm_reg_names[rn],
1982 arm_reg_names[rm]) >= buflen)
1983 return (-1);
1984 return (0);
1985 }
1986
1987 /*
1988 * Disassemble the extend instructions from ARMv6. There are six instructions:
1989 *
1990 * XTAB16, XTAB, XTAH, XTB16, XTB, XTFH. These can exist with one of the
1991 * following prefixes: S, U. The opcode exists in bits 22-20. We have the
1992 * following rules from there:
1993 *
1994 * If bit 22 is one then we are using the U prefix, otherwise the S prefix. Then
1995 * we have the following opcode maps in the lower two bits:
1996 * XTAB16 00 iff Rn != 0xf
1997 * XTAB 10 iff Rn != 0xf
1998 * XTAH 11 iff Rn != 0xf
1999 * XTB16 00 iff Rn = 0xf
2000 * XTB 10 iff Rn = 0xf
2001 * XTH 11 iff Rn = 0xf
2002 */
2003 static int
2004 arm_dis_extend(uint32_t in, char *buf, size_t buflen)
2005 {
2006 uint8_t op, rot;
2007 int sbit;
2008 arm_cond_code_t cc;
2009 arm_reg_t rn, rm, rd;
2010 const char *opn;
2011 size_t len;
2012
2013
2014 rn = (in & ARM_MEDIA_RN_MASK) >> ARM_MEDIA_RN_SHIFT;
2015 rd = (in & ARM_MEDIA_RD_MASK) >> ARM_MEDIA_RD_SHIFT;
2016 rm = in & ARM_MEDIA_RM_MASK;
2017 op = (in & ARM_MEDIA_SZE_OP_MASK) >> ARM_MEDIA_SZE_OP_SHIFT;
2018 rot = (in & ARM_MEDIA_SZE_ROT_MASK) >> ARM_MEDIA_SZE_ROT_SHIFT;
2019 sbit = in & ARM_MEDIA_SZE_S_MASK;
2020 cc = (in & ARM_CC_MASK) >> ARM_CC_SHIFT;
2021
2022 switch (op) {
2023 case 0x0:
2024 opn = rn == ARM_REG_R15 ? "XTAB16" : "XTB16";
2025 break;
2026 case 0x2:
2027 opn = rn == ARM_REG_R15 ? "XTAB" : "XTB";
2028 break;
2029 case 0x3:
2030 opn = rn == ARM_REG_R15 ? "XTAH" : "XTH";
2031 break;
2032 default:
2033 return (-1);
2034 break;
2035 }
2036
2037 if (rn == ARM_REG_R15) {
2038 len = snprintf(buf, buflen, "%s%s%s %s, %s",
2039 sbit != 0 ? "U" : "S",
2040 opn, arm_cond_names[cc], arm_reg_names[rd],
2041 arm_reg_names[rn]);
2042 } else {
2043 len = snprintf(buf, buflen, "%s%s%s %s, %s, %s",
2044 sbit != 0 ? "U" : "S",
2045 opn, arm_cond_names[cc], arm_reg_names[rd],
2046 arm_reg_names[rn], arm_reg_names[rm]);
2047 }
2048
2049 if (len >= buflen)
2050 return (-1);
2051
2052 if (snprintf(buf + len, buflen - len, "%s",
2053 arm_extend_rot_names[rot]) >= buflen - len)
2054 return (-1);
2055 return (0);
2056 }
2057
2058 /*
2059 * The media instructions and extensions can be divided into different groups of
2060 * instructions. We first use bits 23 and 24 to figure out where to send it. We
2061 * call this group of bits the l1 mask.
2062 */
2063 static int
2064 arm_dis_media(uint32_t in, char *buf, size_t buflen)
2065 {
2066 uint8_t l1, op1, op2;
2067 arm_cond_code_t cc;
2068 arm_reg_t rd, rn, rs, rm;
2069 int xbit;
2070 size_t len;
2071
2072 cc = (in & ARM_CC_MASK) >> ARM_CC_SHIFT;
2073 l1 = (in & ARM_MEDIA_L1_MASK) >> ARM_MEDIA_L1_SHIFT;
2074 switch (l1) {
2075 case 0x0:
2076 return (arm_dis_padd(in, buf, buflen));
2077 break;
2078 case 0x1:
2079 if ((in & ARM_MEDIA_HPACK_MASK) == ARM_MEDIA_HPACK_TARG) {
2080 rn = (in & ARM_MEDIA_RN_MASK) >> ARM_MEDIA_RN_SHIFT;
2081 rd = (in & ARM_MEDIA_RD_MASK) >> ARM_MEDIA_RD_SHIFT;
2082 rm = in & ARM_MEDIA_RM_MASK;
2083 op1 = (in & ARM_MEDIA_HPACK_SHIFT_MASK) >>
2084 ARM_MEDIA_HPACK_SHIFT_IMM;
2085 len = snprintf(buf, buflen, "%s%s %s, %s, %s",
2086 (in & ARM_MEDIA_HPACK_OP_MASK) != 0 ?
2087 "PKHTB" : "PKHBT", arm_cond_names[cc],
2088 arm_reg_names[rd], arm_reg_names[rn],
2089 arm_reg_names[rd]);
2090 if (len >= buflen)
2091 return (-1);
2092
2093 if (op1 != 0) {
2094 if (in & ARM_MEDIA_HPACK_OP_MASK)
2095 len += snprintf(buf + len, buflen - len,
2096 ", ASR %d", op1);
2097 else
2098 len += snprintf(buf + len, buflen - len,
2099 ", LSL %d", op1);
2100 }
2101 return (len >= buflen ? -1 : 0);
2102 }
2103
2104 if ((in & ARM_MEDIA_WSAT_MASK) == ARM_MEDIA_WSAT_TARG) {
2105 rd = (in & ARM_MEDIA_RD_MASK) >> ARM_MEDIA_RD_SHIFT;
2106 rm = in & ARM_MEDIA_RM_MASK;
2107 op1 = (in & ARM_MEDIA_SAT_IMM_MASK) >>
2108 ARM_MEDIA_SAT_IMM_SHIFT;
2109 op2 = (in & ARM_MEDIA_SAT_SHI_MASK) >>
2110 ARM_MEDIA_SAT_SHI_SHIFT;
2111 len = snprintf(buf, buflen, "%s%s %s, #%d, %s",
2112 (in & ARM_MEDIA_SAT_U_MASK) != 0 ? "USAT" : "SSAT",
2113 arm_cond_names[cc], arm_reg_names[rd], op1,
2114 arm_reg_names[rm]);
2115
2116 if (len >= buflen)
2117 return (-1);
2118
2119 /*
2120 * The shift is optional in the assembler and encoded as
2121 * LSL 0. However if we get ASR 0, that means ASR #32.
2122 * An ARM_MEDIA_SAT_STYPE_MASK of 0 is LSL, 1 is ASR.
2123 */
2124 if (op2 != 0 || (in & ARM_MEDIA_SAT_STYPE_MASK) == 1) {
2125 if (op2 == 0)
2126 op2 = 32;
2127 if (snprintf(buf + len, buflen - len,
2128 ", %s #%d",
2129 (in & ARM_MEDIA_SAT_STYPE_MASK) != 0 ?
2130 "ASR" : "LSL", op2) >= buflen - len)
2131 return (-1);
2132 }
2133 return (0);
2134 }
2135
2136 if ((in & ARM_MEDIA_PHSAT_MASK) == ARM_MEDIA_PHSAT_TARG) {
2137 rd = (in & ARM_MEDIA_RD_MASK) >> ARM_MEDIA_RD_SHIFT;
2138 rm = in & ARM_MEDIA_RM_MASK;
2139 op1 = (in & ARM_MEDIA_RN_MASK) >> ARM_MEDIA_RN_SHIFT;
2140 if (snprintf(buf, buflen, "%s%s %s, #%d, %s",
2141 (in & ARM_MEDIA_SAT_U_MASK) != 0 ?
2142 "USAT16" : "SSAT16",
2143 arm_cond_names[cc], arm_reg_names[rd], op1,
2144 arm_reg_names[rm]) >= buflen)
2145 return (-1);
2146 return (0);
2147 }
2148
2149 if ((in & ARM_MEDIA_REV_MASK) == ARM_MEDIA_REV_TARG) {
2150 rd = (in & ARM_MEDIA_RD_MASK) >> ARM_MEDIA_RD_SHIFT;
2151 rm = in & ARM_MEDIA_RM_MASK;
2152 if (snprintf(buf, buflen, "REV%s %s, %s",
2153 arm_cond_names[cc], arm_reg_names[rd],
2154 arm_reg_names[rd]) >= buflen)
2155 return (-1);
2156 return (0);
2157 }
2158
2159 if ((in & ARM_MEDIA_BRPH_MASK) == ARM_MEDIA_BRPH_TARG) {
2160 rd = (in & ARM_MEDIA_RD_MASK) >> ARM_MEDIA_RD_SHIFT;
2161 rm = in & ARM_MEDIA_RM_MASK;
2162 if (snprintf(buf, buflen, "REV16%s %s, %s",
2163 arm_cond_names[cc], arm_reg_names[rd],
2164 arm_reg_names[rd]) >= buflen)
2165 return (-1);
2166 return (0);
2167 }
2168
2169 if ((in & ARM_MEDIA_BRSH_MASK) == ARM_MEDIA_BRSH_TARG) {
2170 rd = (in & ARM_MEDIA_RD_MASK) >> ARM_MEDIA_RD_SHIFT;
2171 rm = in & ARM_MEDIA_RM_MASK;
2172 if (snprintf(buf, buflen, "REVSH%s %s, %s",
2173 arm_cond_names[cc], arm_reg_names[rd],
2174 arm_reg_names[rd]) >= buflen)
2175 return (-1);
2176 return (0);
2177 }
2178
2179 if ((in & ARM_MEDIA_SEL_MASK) == ARM_MEDIA_SEL_TARG) {
2180 rn = (in & ARM_MEDIA_RN_MASK) >> ARM_MEDIA_RN_SHIFT;
2181 rd = (in & ARM_MEDIA_RD_MASK) >> ARM_MEDIA_RD_SHIFT;
2182 rm = in & ARM_MEDIA_RM_MASK;
2183 if (snprintf(buf, buflen, "SEL%s %s, %s, %s",
2184 arm_cond_names[cc], arm_reg_names[rd],
2185 arm_reg_names[rn], arm_reg_names[rm]) >= buflen)
2186 return (-1);
2187 return (0);
2188 }
2189
2190 if ((in & ARM_MEDIA_SZE_MASK) == ARM_MEDIA_SZE_TARG)
2191 return (arm_dis_extend(in, buf, buflen));
2192 /* Unknown instruction */
2193 return (-1);
2194 break;
2195 case 0x2:
2196 /*
2197 * This consists of the following multiply instructions:
2198 * SMLAD, SMLSD, SMLALD, SMUAD, and SMUSD.
2199 *
2200 * SMLAD and SMUAD encoding are the same, switch on Rn == R15
2201 * 22-20 are 000 7-6 are 00
2202 * SMLSD and SMUSD encoding are the same, switch on Rn == R15
2203 * 22-20 are 000 7-6 are 01
2204 * SMLALD: 22-20 are 100 7-6 are 00
2205 */
2206 rn = (in & ARM_MEDIA_RN_MASK) >> ARM_MEDIA_RN_SHIFT;
2207 rd = (in & ARM_MEDIA_RD_MASK) >> ARM_MEDIA_RD_SHIFT;
2208 rs = (in & ARM_MEDIA_RS_MASK) >> ARM_MEDIA_RS_SHIFT;
2209 rm = in & ARM_MEDIA_RM_MASK;
2210 op1 = (in & ARM_MEDIA_OP1_MASK) >> ARM_MEDIA_OP1_SHIFT;
2211 op2 = (in & ARM_MEDIA_OP2_MASK) >> ARM_MEDIA_OP2_SHIFT;
2212 xbit = in & ARM_MEDIA_MULT_X_MASK;
2213
2214 if (op1 == 0x0) {
2215 if (op2 != 0x0 && op2 != 0x1)
2216 return (-1);
2217 if (rn == ARM_REG_R15) {
2218 len = snprintf(buf, buflen, "%s%s%s %s, %s, %s",
2219 op2 != 0 ? "SMUSD" : "SMUAD",
2220 xbit != 0 ? "X" : "X",
2221 arm_cond_names[cc], arm_reg_names[rd],
2222 arm_reg_names[rm], arm_reg_names[rs]);
2223 } else {
2224 len = snprintf(buf, buflen,
2225 "%s%s%s %s, %s, %s, %s",
2226 op2 != 0 ? "SMLSD" : "SMLAD",
2227 xbit != 0 ? "X" : "",
2228 arm_cond_names[cc], arm_reg_names[rd],
2229 arm_reg_names[rm], arm_reg_names[rs],
2230 arm_reg_names[rn]);
2231
2232 }
2233 } else if (op1 == 0x8) {
2234 if (op2 != 0x0)
2235 return (-1);
2236 len = snprintf(buf, buflen, "SMLALD%s%s %s, %s, %s, %s",
2237 xbit != 0 ? "X" : "",
2238 arm_cond_names[cc], arm_reg_names[rn],
2239 arm_reg_names[rd], arm_reg_names[rm],
2240 arm_reg_names[rs]);
2241 } else
2242 return (-1);
2243
2244 return (len >= buflen ? -1 : 0);
2245 break;
2246 case 0x3:
2247 /*
2248 * Here we handle USAD8 and USADA8. The main difference is the
2249 * presence of RN. USAD8 is defined as having a value of rn that
2250 * is not r15. If it is r15, then instead it is USADA8.
2251 */
2252 if ((in & ARM_MEDIA_OP1_MASK) != 0)
2253 return (-1);
2254 if ((in & ARM_MEDIA_OP2_MASK) != 0)
2255 return (-1);
2256
2257 cc = (in & ARM_CC_MASK) >> ARM_CC_SHIFT;
2258 rn = (in & ARM_MEDIA_RN_MASK) >> ARM_MEDIA_RN_SHIFT;
2259 rd = (in & ARM_MEDIA_RD_MASK) >> ARM_MEDIA_RD_SHIFT;
2260 rs = (in & ARM_MEDIA_RS_MASK) >> ARM_MEDIA_RS_SHIFT;
2261 rm = in & ARM_MEDIA_RM_MASK;
2262
2263 if (rn != ARM_REG_R15)
2264 len = snprintf(buf, buflen, "USADA8%s %s, %s, %s, %s",
2265 arm_cond_names[cc], arm_reg_names[rd],
2266 arm_reg_names[rm], arm_reg_names[rs],
2267 arm_reg_names[rn]);
2268 else
2269 len = snprintf(buf, buflen, "USAD8%s %s, %s, %s",
2270 arm_cond_names[cc], arm_reg_names[rd],
2271 arm_reg_names[rm], arm_reg_names[rs]);
2272 return (len >= buflen ? -1 : 0);
2273 break;
2274 default:
2275 return (-1);
2276 }
2277 }
2278
2279 /*
2280 * Each instruction in the ARM instruction set is a uint32_t and in our case is
2281 * LE. The upper four bits determine the condition code. If the conditoin code
2282 * is undefined then we know to immediately jump there. Otherwise we go use the
2283 * next three bits to determine where we should go next and how to further
2284 * process the instruction in question. The ARM instruction manual doesn't
2285 * define this field so we're going to call it the L1_DEC or level 1 decoding
2286 * from which it will have to be further subdivided into the specific
2287 * instruction groupings that we care about.
2288 */
2289 static int
2290 arm_dis(dis_handle_t *dhp, uint32_t in, char *buf, size_t buflen)
2291 {
2292 uint8_t l1;
2293 arm_cond_code_t cc;
2294
2295 cc = (in & ARM_CC_MASK) >> ARM_CC_SHIFT;
2296
2297 if (cc == ARM_COND_NACC)
2298 return (arm_dis_uncond_insn(in, buf, buflen));
2299
2300 l1 = (in & ARM_L1_DEC_MASK) >> ARM_L1_DEC_SHIFT;
2301
2302 switch (l1) {
2303 case 0x0:
2304 /*
2305 * The l0 group is a bit complicated. We have several different
2306 * groups of instructions to consider. The first question is
2307 * whether bit 4 is zero or not. If it is, then we have a data
2308 * processing immediate shift unless the opcode and + S bits
2309 * (24-20) is of the form 0b10xx0.
2310 *
2311 * When bit 4 is 1, we have to then also look at bit 7. If bit
2312 * 7 is one then we know that this is the class of multiplies /
2313 * extra load/stores. If bit 7 is zero then we have the same
2314 * opcode games as we did above.
2315 */
2316 if (in & ARM_L1_0_B4_MASK) {
2317 if (in & ARM_L1_0_B7_MASK) {
2318 /*
2319 * Both the multiplication extensions and the
2320 * load and store extensions live in this
2321 * region. The load and store extensions can be
2322 * identified by having at least one of bits 5
2323 * and 6 set. The exceptions to this are the
2324 * SWP and SWPB instructions and the exclusive
2325 * load and store instructions which, unlike the
2326 * multiplication instructions. These have
2327 * specific values for the bits in the range of
2328 * 20-24.
2329 */
2330 if ((in & ARM_L1_0_ELS_MASK) != 0)
2331 /* Extra loads/stores */
2332 return (arm_dis_els(in, buf, buflen));
2333 if ((in & ARM_ELS_SWAP_MASK) == ARM_ELS_IS_SWAP)
2334 return (arm_dis_swap(in, buf, buflen));
2335 if ((in & ARM_ELS_EXCL_MASK) ==
2336 ARM_ELS_EXCL_MASK)
2337 return (arm_dis_lsexcl(in, buf,
2338 buflen));
2339 /* Multiplication instruction extension A3-3. */
2340 return (arm_dis_extmul(in, buf, buflen));
2341 }
2342 if ((in & ARM_L1_0_OPMASK) == ARM_L1_0_SPECOP &&
2343 !(in & ARM_L1_0_SMASK)) {
2344 /* Misc. Instructions A3-4 */
2345 return (arm_dis_cdsp_ext(in, buf, buflen));
2346 } else {
2347 /* data processing register shift */
2348 return (arm_dis_dpi(in, cc, buf, buflen));
2349 }
2350 } else {
2351 if ((in & ARM_L1_0_OPMASK) == ARM_L1_0_SPECOP &&
2352 !(in & ARM_L1_0_SMASK))
2353 /* Misc. Instructions A3-4 */
2354 return (arm_dis_cdsp_ext(in, buf, buflen));
2355 else {
2356 /* Data processing immediate shift */
2357 return (arm_dis_dpi(in, cc, buf, buflen));
2358 }
2359 }
2360 break;
2361 case 0x1:
2362 /*
2363 * In l1 group 0b001 there are a few ways to tell things apart.
2364 * We are directed to first look at bits 20-24. Data processing
2365 * immediate has a 4 bit opcode 24-21 followed by an S bit. We
2366 * know it is not a data processing immediate if we have
2367 * something of the form 0b10xx0.
2368 */
2369 if ((in & ARM_L1_1_OPMASK) == ARM_L1_1_SPECOP &&
2370 !(in & ARM_L1_1_SMASK)) {
2371 if (in & ARM_L1_1_UNDEF_MASK) {
2372 /* Undefined instructions */
2373 return (-1);
2374 } else {
2375 /* Move immediate to status register */
2376 return (arm_dis_status_regs(in, buf, buflen));
2377 }
2378 } else {
2379 /* Data processing immedaite */
2380 return (arm_dis_dpi(in, cc, buf, buflen));
2381 }
2382 break;
2383 case 0x2:
2384 /* Load/store Immediate offset */
2385 return (arm_dis_ldstr(in, buf, buflen));
2386 break;
2387 case 0x3:
2388 /*
2389 * Like other sets we use the 4th bit to make an intial
2390 * determination. If it is zero then this is a load/store
2391 * register offset class instruction. Following that we have a
2392 * specical mask of 0x01f000f0 to determine whether this is an
2393 * architecturally undefined instruction type or not.
2394 *
2395 * The architecturally undefined are parts of the current name
2396 * space that just aren't used, but could be used at some point
2397 * in the future. For now though, it's an invalid op code.
2398 */
2399 if (in & ARM_L1_3_B4_MASK) {
2400 if ((in & ARM_L1_3_ARCHUN_MASK) ==
2401 ARM_L1_3_ARCHUN_MASK) {
2402 /* Architecturally undefined */
2403 return (-1);
2404 } else {
2405 /* Media instructions */
2406 return (arm_dis_media(in, buf, buflen));
2407 }
2408 } else {
2409 /* Load/store register offset */
2410 return (arm_dis_ldstr(in, buf, buflen));
2411 }
2412 break;
2413 case 0x4:
2414 /* Load/store multiple */
2415 return (arm_dis_ldstr_multi(in, buf, buflen));
2416 break;
2417 case 0x5:
2418 /* Branch and Branch with link */
2419 return (arm_dis_branch(dhp, in, buf, buflen));
2420 break;
2421 case 0x6:
2422 /* coprocessor load/store && double register transfers */
2423 return (arm_dis_coproc_lsdrt(in, buf, buflen));
2424 break;
2425 case 0x7:
2426 /*
2427 * In l1 group 0b111 you can determine the three groups using
2428 * the following logic. If the next bit after the l1 group (bit
2429 * 24) is one than you know that it is a software interrupt.
2430 * Otherwise it is one of the coprocessor instructions.
2431 * Furthermore you can tell apart the data processing from the
2432 * register transfers based on bit 4. If it is zero then it is
2433 * a data processing instruction, otherwise it is a register
2434 * transfer.
2435 */
2436 if (in & ARM_L1_7_SWINTMASK) {
2437 /*
2438 * The software interrupt is pretty straightforward. The
2439 * lower 24 bits are the interrupt number. It's also
2440 * valid for it to run with a condition code.
2441 */
2442 if (snprintf(buf, buflen, "SWI%s %d",
2443 arm_cond_names[cc],
2444 in & ARM_SWI_IMM_MASK) >= buflen)
2445 return (-1);
2446 return (0);
2447 } else if (in & ARM_L1_7_COPROCMASK) {
2448 /* coprocessor register transfers */
2449 return (arm_dis_coproc_rt(in, buf, buflen));
2450 } else {
2451 /* coprocessor data processing */
2452 return (arm_dis_coproc_dp(in, buf, buflen));
2453 }
2454 break;
2455 }
2456
2457 return (-1);
2458 }
2459
2460 static int
2461 dis_arm_supports_flags(int flags)
2462 {
2463 int archflags = flags & DIS_ARCH_MASK;
2464
2465 return (archflags == DIS_ARM);
2466 }
2467
2468 /*ARGSUSED*/
2469 static int
2470 dis_arm_handle_attach(dis_handle_t *dhp)
2471 {
2472 return (0);
2473 }
2474
2475 /*ARGSUSED*/
2476 static void
2477 dis_arm_handle_detach(dis_handle_t *dhp)
2478 {
2479 }
2480
2481 static int
2482 dis_arm_disassemble(dis_handle_t *dhp, uint64_t addr, char *buf, size_t buflen)
2483 {
2484 uint32_t in;
2485
2486 buf[0] = '\0';
2487 dhp->dh_addr = addr;
2488 if (dhp->dh_read(dhp->dh_data, addr, &in, sizeof (in)) !=
2489 sizeof (in))
2490 return (-1);
2491
2492 /* Translate in case we're on sparc? */
2493 in = LE_32(in);
2494
2495 return (arm_dis(dhp, in, buf, buflen));
2496 }
2497
2498 /*
2499 * This is simple in a non Thumb world. If and when we do enter a world where we
2500 * support thumb instructions, then this becomes far less than simple.
2501 */
2502 /*ARGSUSED*/
2503 static uint64_t
2504 dis_arm_previnstr(dis_handle_t *dhp, uint64_t pc, int n)
2505 {
2506 if (n <= 0)
2507 return (pc);
2508
2509 return (pc - n*4);
2510 }
2511
2512 /*
2513 * If and when we support thumb, then this value should probably become two.
2514 * However, it varies based on whether or not a given instruction is in thumb
2515 * mode.
2516 */
2517 /*ARGSUSED*/
2518 static int
2519 dis_arm_min_instrlen(dis_handle_t *dhp)
2520 {
2521 return (4);
2522 }
2523
2524 /*
2525 * Regardless of thumb, this value does not change.
2526 */
2527 /*ARGSUSED*/
2528 static int
2529 dis_arm_max_instrlen(dis_handle_t *dhp)
2530 {
2531 return (4);
2532 }
2533
2534 /* ARGSUSED */
2535 static int
2536 dis_arm_instrlen(dis_handle_t *dhp, uint64_t pc)
2537 {
2538 return (4);
2539 }
2540
2541 dis_arch_t dis_arch_arm = {
2542 dis_arm_supports_flags,
2543 dis_arm_handle_attach,
2544 dis_arm_handle_detach,
2545 dis_arm_disassemble,
2546 dis_arm_previnstr,
2547 dis_arm_min_instrlen,
2548 dis_arm_max_instrlen,
2549 dis_arm_instrlen
2550 };