1 /***************************************************************************
2 * Copyright (C) 2006 by Dominic Rath *
3 * Dominic.Rath@gmx.de *
5 * Copyright (C) 2008 by Hongtao Zheng *
8 * This program is free software; you can redistribute it and/or modify *
9 * it under the terms of the GNU General Public License as published by *
10 * the Free Software Foundation; either version 2 of the License, or *
11 * (at your option) any later version. *
13 * This program is distributed in the hope that it will be useful, *
14 * but WITHOUT ANY WARRANTY; without even the implied warranty of *
15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the *
16 * GNU General Public License for more details. *
18 * You should have received a copy of the GNU General Public License *
19 * along with this program; if not, write to the *
20 * Free Software Foundation, Inc., *
21 * 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. *
22 ***************************************************************************/
28 #include "arm_disassembler.h"
29 #include "arm_simulator.h"
31 #include "binarybuffer.h"
34 uint32_t arm_shift(uint8_t shift, uint32_t Rm, uint32_t shift_amount, uint8_t *carry)
36 uint32_t return_value = 0;
39 if (shift == 0x0) /* LSL */
41 if ((shift_amount > 0) && (shift_amount <= 32))
43 return_value = Rm << shift_amount;
44 *carry = Rm >> (32 - shift_amount);
46 else if (shift_amount > 32)
51 else /* (shift_amount == 0) */
56 else if (shift == 0x1) /* LSR */
58 if ((shift_amount > 0) && (shift_amount <= 32))
60 return_value = Rm >> shift_amount;
61 *carry = (Rm >> (shift_amount - 1)) & 1;
63 else if (shift_amount > 32)
68 else /* (shift_amount == 0) */
73 else if (shift == 0x2) /* ASR */
75 if ((shift_amount > 0) && (shift_amount <= 32))
77 /* right shifts of unsigned values are guaranteed to be logical (shift in zeroes)
78 * simulate an arithmetic shift (shift in signed-bit) by adding the signed-bit manually */
79 return_value = Rm >> shift_amount;
81 return_value |= 0xffffffff << (32 - shift_amount);
83 else if (shift_amount > 32)
87 return_value = 0xffffffff;
96 else /* (shift_amount == 0) */
101 else if (shift == 0x3) /* ROR */
103 if (shift_amount == 0)
109 shift_amount = shift_amount % 32;
110 return_value = (Rm >> shift_amount) | (Rm << (32 - shift_amount));
111 *carry = (return_value >> 31) & 0x1;
114 else if (shift == 0x4) /* RRX */
116 return_value = Rm >> 1;
126 uint32_t arm_shifter_operand(struct arm_sim_interface *sim, int variant, union arm_shifter_operand shifter_operand, uint8_t *shifter_carry_out)
128 uint32_t return_value;
129 int instruction_size;
131 if (sim->get_state(sim) == ARMV4_5_STATE_ARM)
132 instruction_size = 4;
134 instruction_size = 2;
136 *shifter_carry_out = sim->get_cpsr(sim, 29, 1);
138 if (variant == 0) /* 32-bit immediate */
140 return_value = shifter_operand.immediate.immediate;
142 else if (variant == 1) /* immediate shift */
144 uint32_t Rm = sim->get_reg_mode(sim, shifter_operand.immediate_shift.Rm);
146 /* adjust RM in case the PC is being read */
147 if (shifter_operand.immediate_shift.Rm == 15)
148 Rm += 2 * instruction_size;
150 return_value = arm_shift(shifter_operand.immediate_shift.shift, Rm, shifter_operand.immediate_shift.shift_imm, shifter_carry_out);
152 else if (variant == 2) /* register shift */
154 uint32_t Rm = sim->get_reg_mode(sim, shifter_operand.register_shift.Rm);
155 uint32_t Rs = sim->get_reg_mode(sim, shifter_operand.register_shift.Rs);
157 /* adjust RM in case the PC is being read */
158 if (shifter_operand.register_shift.Rm == 15)
159 Rm += 2 * instruction_size;
161 return_value = arm_shift(shifter_operand.immediate_shift.shift, Rm, Rs, shifter_carry_out);
165 LOG_ERROR("BUG: shifter_operand.variant not 0, 1 or 2");
166 return_value = 0xffffffff;
172 int pass_condition(uint32_t cpsr, uint32_t opcode)
174 switch ((opcode & 0xf0000000) >> 28)
177 if (cpsr & 0x40000000)
182 if (!(cpsr & 0x40000000))
187 if (cpsr & 0x20000000)
192 if (!(cpsr & 0x20000000))
197 if (cpsr & 0x80000000)
202 if (!(cpsr & 0x80000000))
207 if (cpsr & 0x10000000)
212 if (!(cpsr & 0x10000000))
217 if ((cpsr & 0x20000000) && !(cpsr & 0x40000000))
222 if (!(cpsr & 0x20000000) || (cpsr & 0x40000000))
227 if (((cpsr & 0x80000000) && (cpsr & 0x10000000))
228 || (!(cpsr & 0x80000000) && !(cpsr & 0x10000000)))
233 if (((cpsr & 0x80000000) && !(cpsr & 0x10000000))
234 || (!(cpsr & 0x80000000) && (cpsr & 0x10000000)))
239 if (!(cpsr & 0x40000000) &&
240 (((cpsr & 0x80000000) && (cpsr & 0x10000000))
241 || (!(cpsr & 0x80000000) && !(cpsr & 0x10000000))))
246 if ((cpsr & 0x40000000) ||
247 ((cpsr & 0x80000000) && !(cpsr & 0x10000000))
248 || (!(cpsr & 0x80000000) && (cpsr & 0x10000000)))
258 LOG_ERROR("BUG: should never get here");
262 int thumb_pass_branch_condition(uint32_t cpsr, uint16_t opcode)
264 return pass_condition(cpsr, (opcode & 0x0f00) << 20);
267 /* simulate a single step (if possible)
268 * if the dry_run_pc argument is provided, no state is changed,
269 * but the new pc is stored in the variable pointed at by the argument
271 int arm_simulate_step_core(target_t *target, uint32_t *dry_run_pc, struct arm_sim_interface *sim)
273 uint32_t current_pc = sim->get_reg(sim, 15);
274 arm_instruction_t instruction;
275 int instruction_size;
276 int retval = ERROR_OK;
278 if (sim->get_state(sim) == ARMV4_5_STATE_ARM)
282 /* get current instruction, and identify it */
283 if ((retval = target_read_u32(target, current_pc, &opcode)) != ERROR_OK)
287 if ((retval = arm_evaluate_opcode(opcode, current_pc, &instruction)) != ERROR_OK)
291 instruction_size = 4;
293 /* check condition code (for all instructions) */
294 if (!pass_condition(sim->get_cpsr(sim, 0, 32), opcode))
298 *dry_run_pc = current_pc + instruction_size;
302 sim->set_reg(sim, 15, current_pc + instruction_size);
312 retval = target_read_u16(target, current_pc, &opcode);
313 if (retval != ERROR_OK)
315 retval = thumb_evaluate_opcode(opcode, current_pc, &instruction);
316 if (retval != ERROR_OK)
318 instruction_size = 2;
320 /* check condition code (only for branch (1) instructions) */
321 if ((opcode & 0xf000) == 0xd000 &&
322 !thumb_pass_branch_condition(sim->get_cpsr(sim, 0, 32), opcode))
326 *dry_run_pc = current_pc + instruction_size;
330 sim->set_reg(sim, 15, current_pc + instruction_size);
336 /* Deal with 32-bit BL/BLX */
337 if ((opcode & 0xf800) == 0xf000) {
338 uint32_t high = instruction.info.b_bl_bx_blx.target_address;
339 retval = target_read_u16(target, current_pc+2, &opcode);
340 if (retval != ERROR_OK)
342 retval = thumb_evaluate_opcode(opcode, current_pc, &instruction);
343 if (retval != ERROR_OK)
345 instruction.info.b_bl_bx_blx.target_address += high;
349 /* examine instruction type */
351 /* branch instructions */
352 if ((instruction.type >= ARM_B) && (instruction.type <= ARM_BLX))
356 if (instruction.info.b_bl_bx_blx.reg_operand == -1)
358 target = instruction.info.b_bl_bx_blx.target_address;
362 target = sim->get_reg_mode(sim, instruction.info.b_bl_bx_blx.reg_operand);
363 if (instruction.info.b_bl_bx_blx.reg_operand == 15)
365 target += 2 * instruction_size;
371 *dry_run_pc = target & ~1;
376 if (instruction.type == ARM_B)
378 sim->set_reg(sim, 15, target);
380 else if (instruction.type == ARM_BL)
382 uint32_t old_pc = sim->get_reg(sim, 15);
383 int T = (sim->get_state(sim) == ARMV4_5_STATE_THUMB);
384 sim->set_reg_mode(sim, 14, old_pc + 4 + T);
385 sim->set_reg(sim, 15, target);
387 else if (instruction.type == ARM_BX)
391 sim->set_state(sim, ARMV4_5_STATE_THUMB);
395 sim->set_state(sim, ARMV4_5_STATE_ARM);
397 sim->set_reg(sim, 15, target & 0xfffffffe);
399 else if (instruction.type == ARM_BLX)
401 uint32_t old_pc = sim->get_reg(sim, 15);
402 int T = (sim->get_state(sim) == ARMV4_5_STATE_THUMB);
403 sim->set_reg_mode(sim, 14, old_pc + 4 + T);
407 sim->set_state(sim, ARMV4_5_STATE_THUMB);
411 sim->set_state(sim, ARMV4_5_STATE_ARM);
413 sim->set_reg(sim, 15, target & 0xfffffffe);
419 /* data processing instructions, except compare instructions (CMP, CMN, TST, TEQ) */
420 else if (((instruction.type >= ARM_AND) && (instruction.type <= ARM_RSC))
421 || ((instruction.type >= ARM_ORR) && (instruction.type <= ARM_MVN)))
423 uint32_t Rd, Rn, shifter_operand;
424 uint8_t C = sim->get_cpsr(sim, 29, 1);
428 /* ARM_MOV and ARM_MVN does not use Rn */
429 if ((instruction.type != ARM_MOV) && (instruction.type != ARM_MVN))
430 Rn = sim->get_reg_mode(sim, instruction.info.data_proc.Rn);
434 shifter_operand = arm_shifter_operand(sim, instruction.info.data_proc.variant, instruction.info.data_proc.shifter_operand, &carry_out);
436 /* adjust Rn in case the PC is being read */
437 if (instruction.info.data_proc.Rn == 15)
438 Rn += 2 * instruction_size;
440 if (instruction.type == ARM_AND)
441 Rd = Rn & shifter_operand;
442 else if (instruction.type == ARM_EOR)
443 Rd = Rn ^ shifter_operand;
444 else if (instruction.type == ARM_SUB)
445 Rd = Rn - shifter_operand;
446 else if (instruction.type == ARM_RSB)
447 Rd = shifter_operand - Rn;
448 else if (instruction.type == ARM_ADD)
449 Rd = Rn + shifter_operand;
450 else if (instruction.type == ARM_ADC)
451 Rd = Rn + shifter_operand + (C & 1);
452 else if (instruction.type == ARM_SBC)
453 Rd = Rn - shifter_operand - (C & 1) ? 0 : 1;
454 else if (instruction.type == ARM_RSC)
455 Rd = shifter_operand - Rn - (C & 1) ? 0 : 1;
456 else if (instruction.type == ARM_ORR)
457 Rd = Rn | shifter_operand;
458 else if (instruction.type == ARM_BIC)
459 Rd = Rn & ~(shifter_operand);
460 else if (instruction.type == ARM_MOV)
461 Rd = shifter_operand;
462 else if (instruction.type == ARM_MVN)
463 Rd = ~shifter_operand;
465 LOG_WARNING("unhandled instruction type");
469 if (instruction.info.data_proc.Rd == 15)
470 *dry_run_pc = Rd & ~1;
472 *dry_run_pc = current_pc + instruction_size;
478 if (instruction.info.data_proc.Rd == 15) {
479 sim->set_reg_mode(sim, 15, Rd & ~1);
481 sim->set_state(sim, ARMV4_5_STATE_THUMB);
483 sim->set_state(sim, ARMV4_5_STATE_ARM);
486 sim->set_reg_mode(sim, instruction.info.data_proc.Rd, Rd);
487 LOG_WARNING("no updating of flags yet");
490 /* compare instructions (CMP, CMN, TST, TEQ) */
491 else if ((instruction.type >= ARM_TST) && (instruction.type <= ARM_CMN))
495 *dry_run_pc = current_pc + instruction_size;
500 LOG_WARNING("no updating of flags yet");
503 /* load register instructions */
504 else if ((instruction.type >= ARM_LDR) && (instruction.type <= ARM_LDRSH))
506 uint32_t load_address = 0, modified_address = 0, load_value;
507 uint32_t Rn = sim->get_reg_mode(sim, instruction.info.load_store.Rn);
509 /* adjust Rn in case the PC is being read */
510 if (instruction.info.load_store.Rn == 15)
511 Rn += 2 * instruction_size;
513 if (instruction.info.load_store.offset_mode == 0)
515 if (instruction.info.load_store.U)
516 modified_address = Rn + instruction.info.load_store.offset.offset;
518 modified_address = Rn - instruction.info.load_store.offset.offset;
520 else if (instruction.info.load_store.offset_mode == 1)
523 uint32_t Rm = sim->get_reg_mode(sim, instruction.info.load_store.offset.reg.Rm);
524 uint8_t shift = instruction.info.load_store.offset.reg.shift;
525 uint8_t shift_imm = instruction.info.load_store.offset.reg.shift_imm;
526 uint8_t carry = sim->get_cpsr(sim, 29, 1);
528 offset = arm_shift(shift, Rm, shift_imm, &carry);
530 if (instruction.info.load_store.U)
531 modified_address = Rn + offset;
533 modified_address = Rn - offset;
537 LOG_ERROR("BUG: offset_mode neither 0 (offset) nor 1 (scaled register)");
540 if (instruction.info.load_store.index_mode == 0)
543 * we load from the modified address, but don't change the base address register */
544 load_address = modified_address;
545 modified_address = Rn;
547 else if (instruction.info.load_store.index_mode == 1)
550 * we load from the modified address, and write it back to the base address register */
551 load_address = modified_address;
553 else if (instruction.info.load_store.index_mode == 2)
556 * we load from the unmodified address, and write the modified address back */
560 if ((!dry_run_pc) || (instruction.info.load_store.Rd == 15))
562 if ((retval = target_read_u32(target, load_address, &load_value)) != ERROR_OK)
570 if (instruction.info.load_store.Rd == 15)
571 *dry_run_pc = load_value & ~1;
573 *dry_run_pc = current_pc + instruction_size;
578 if ((instruction.info.load_store.index_mode == 1) ||
579 (instruction.info.load_store.index_mode == 2))
581 sim->set_reg_mode(sim, instruction.info.load_store.Rn, modified_address);
584 if (instruction.info.load_store.Rd == 15) {
585 sim->set_reg_mode(sim, 15, load_value & ~1);
587 sim->set_state(sim, ARMV4_5_STATE_THUMB);
589 sim->set_state(sim, ARMV4_5_STATE_ARM);
592 sim->set_reg_mode(sim, instruction.info.load_store.Rd, load_value);
595 /* load multiple instruction */
596 else if (instruction.type == ARM_LDM)
599 uint32_t Rn = sim->get_reg_mode(sim, instruction.info.load_store_multiple.Rn);
600 uint32_t load_values[16];
603 for (i = 0; i < 16; i++)
605 if (instruction.info.load_store_multiple.register_list & (1 << i))
609 switch (instruction.info.load_store_multiple.addressing_mode)
611 case 0: /* Increment after */
614 case 1: /* Increment before */
617 case 2: /* Decrement after */
618 Rn = Rn - (bits_set * 4) + 4;
620 case 3: /* Decrement before */
621 Rn = Rn - (bits_set * 4);
625 for (i = 0; i < 16; i++)
627 if (instruction.info.load_store_multiple.register_list & (1 << i))
629 if ((!dry_run_pc) || (i == 15))
631 target_read_u32(target, Rn, &load_values[i]);
639 if (instruction.info.load_store_multiple.register_list & 0x8000)
641 *dry_run_pc = load_values[15] & ~1;
647 enum armv4_5_mode mode = sim->get_mode(sim);
650 if (instruction.info.load_store_multiple.S)
652 if (instruction.info.load_store_multiple.register_list & 0x8000)
655 mode = ARMV4_5_MODE_USR;
658 for (i = 0; i < 16; i++)
660 if (instruction.info.load_store_multiple.register_list & (1 << i))
663 uint32_t val = load_values[i];
664 sim->set_reg_mode(sim, i, val & ~1);
666 sim->set_state(sim, ARMV4_5_STATE_THUMB);
668 sim->set_state(sim, ARMV4_5_STATE_ARM);
670 sim->set_reg_mode(sim, i, load_values[i]);
677 uint32_t spsr = sim->get_reg_mode(sim, 16);
678 sim->set_reg(sim, ARMV4_5_CPSR, spsr);
681 /* base register writeback */
682 if (instruction.info.load_store_multiple.W)
683 sim->set_reg_mode(sim, instruction.info.load_store_multiple.Rn, Rn);
685 if (instruction.info.load_store_multiple.register_list & 0x8000)
689 /* store multiple instruction */
690 else if (instruction.type == ARM_STM)
696 /* STM wont affect PC (advance by instruction size */
700 uint32_t Rn = sim->get_reg_mode(sim, instruction.info.load_store_multiple.Rn);
702 enum armv4_5_mode mode = sim->get_mode(sim);
704 for (i = 0; i < 16; i++)
706 if (instruction.info.load_store_multiple.register_list & (1 << i))
710 if (instruction.info.load_store_multiple.S)
712 mode = ARMV4_5_MODE_USR;
715 switch (instruction.info.load_store_multiple.addressing_mode)
717 case 0: /* Increment after */
720 case 1: /* Increment before */
723 case 2: /* Decrement after */
724 Rn = Rn - (bits_set * 4) + 4;
726 case 3: /* Decrement before */
727 Rn = Rn - (bits_set * 4);
731 for (i = 0; i < 16; i++)
733 if (instruction.info.load_store_multiple.register_list & (1 << i))
735 target_write_u32(target, Rn, sim->get_reg_mode(sim, i));
740 /* base register writeback */
741 if (instruction.info.load_store_multiple.W)
742 sim->set_reg_mode(sim, instruction.info.load_store_multiple.Rn, Rn);
746 else if (!dry_run_pc)
748 /* the instruction wasn't handled, but we're supposed to simulate it
750 LOG_ERROR("Unimplemented instruction, could not simulate it.");
756 *dry_run_pc = current_pc + instruction_size;
761 sim->set_reg(sim, 15, current_pc + instruction_size);
767 static uint32_t armv4_5_get_reg(struct arm_sim_interface *sim, int reg)
769 armv4_5_common_t *armv4_5 = (armv4_5_common_t *)sim->user_data;
771 return buf_get_u32(armv4_5->core_cache->reg_list[reg].value, 0, 32);
774 static void armv4_5_set_reg(struct arm_sim_interface *sim, int reg, uint32_t value)
776 armv4_5_common_t *armv4_5 = (armv4_5_common_t *)sim->user_data;
778 buf_set_u32(armv4_5->core_cache->reg_list[reg].value, 0, 32, value);
781 static uint32_t armv4_5_get_reg_mode(struct arm_sim_interface *sim, int reg)
783 armv4_5_common_t *armv4_5 = (armv4_5_common_t *)sim->user_data;
785 return buf_get_u32(ARMV4_5_CORE_REG_MODE(armv4_5->core_cache, armv4_5->core_mode, reg).value, 0, 32);
788 static void armv4_5_set_reg_mode(struct arm_sim_interface *sim, int reg, uint32_t value)
790 armv4_5_common_t *armv4_5 = (armv4_5_common_t *)sim->user_data;
792 buf_set_u32(ARMV4_5_CORE_REG_MODE(armv4_5->core_cache, armv4_5->core_mode, reg).value, 0, 32, value);
795 static uint32_t armv4_5_get_cpsr(struct arm_sim_interface *sim, int pos, int bits)
797 armv4_5_common_t *armv4_5 = (armv4_5_common_t *)sim->user_data;
799 return buf_get_u32(armv4_5->core_cache->reg_list[ARMV4_5_CPSR].value, pos, bits);
802 static enum armv4_5_state armv4_5_get_state(struct arm_sim_interface *sim)
804 armv4_5_common_t *armv4_5 = (armv4_5_common_t *)sim->user_data;
806 return armv4_5->core_state;
809 static void armv4_5_set_state(struct arm_sim_interface *sim, enum armv4_5_state mode)
811 armv4_5_common_t *armv4_5 = (armv4_5_common_t *)sim->user_data;
813 armv4_5->core_state = mode;
817 static enum armv4_5_mode armv4_5_get_mode(struct arm_sim_interface *sim)
819 armv4_5_common_t *armv4_5 = (armv4_5_common_t *)sim->user_data;
821 return armv4_5->core_mode;
826 int arm_simulate_step(target_t *target, uint32_t *dry_run_pc)
828 armv4_5_common_t *armv4_5 = target->arch_info;
830 struct arm_sim_interface sim;
832 sim.user_data=armv4_5;
833 sim.get_reg=&armv4_5_get_reg;
834 sim.set_reg=&armv4_5_set_reg;
835 sim.get_reg_mode=&armv4_5_get_reg_mode;
836 sim.set_reg_mode=&armv4_5_set_reg_mode;
837 sim.get_cpsr=&armv4_5_get_cpsr;
838 sim.get_mode=&armv4_5_get_mode;
839 sim.get_state=&armv4_5_get_state;
840 sim.set_state=&armv4_5_set_state;
842 return arm_simulate_step_core(target, dry_run_pc, &sim);