1 /***************************************************************************
2 * Copyright (C) 2006 by Dominic Rath *
3 * Dominic.Rath@gmx.de *
5 * Copyright (C) 2008 by Hongtao Zheng *
8 * This program is free software; you can redistribute it and/or modify *
9 * it under the terms of the GNU General Public License as published by *
10 * the Free Software Foundation; either version 2 of the License, or *
11 * (at your option) any later version. *
13 * This program is distributed in the hope that it will be useful, *
14 * but WITHOUT ANY WARRANTY; without even the implied warranty of *
15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the *
16 * GNU General Public License for more details. *
18 * You should have received a copy of the GNU General Public License *
19 * along with this program; if not, write to the *
20 * Free Software Foundation, Inc., *
21 * 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. *
22 ***************************************************************************/
28 #include "arm_disassembler.h"
29 #include "arm_simulator.h"
31 #include "binarybuffer.h"
34 uint32_t arm_shift(uint8_t shift
, uint32_t Rm
, uint32_t shift_amount
, uint8_t *carry
)
36 uint32_t return_value
= 0;
39 if (shift
== 0x0) /* LSL */
41 if ((shift_amount
> 0) && (shift_amount
<= 32))
43 return_value
= Rm
<< shift_amount
;
44 *carry
= Rm
>> (32 - shift_amount
);
46 else if (shift_amount
> 32)
51 else /* (shift_amount == 0) */
56 else if (shift
== 0x1) /* LSR */
58 if ((shift_amount
> 0) && (shift_amount
<= 32))
60 return_value
= Rm
>> shift_amount
;
61 *carry
= (Rm
>> (shift_amount
- 1)) & 1;
63 else if (shift_amount
> 32)
68 else /* (shift_amount == 0) */
73 else if (shift
== 0x2) /* ASR */
75 if ((shift_amount
> 0) && (shift_amount
<= 32))
77 /* right shifts of unsigned values are guaranteed to be logical (shift in zeroes)
78 * simulate an arithmetic shift (shift in signed-bit) by adding the signed-bit manually */
79 return_value
= Rm
>> shift_amount
;
81 return_value
|= 0xffffffff << (32 - shift_amount
);
83 else if (shift_amount
> 32)
87 return_value
= 0xffffffff;
96 else /* (shift_amount == 0) */
101 else if (shift
== 0x3) /* ROR */
103 if (shift_amount
== 0)
109 shift_amount
= shift_amount
% 32;
110 return_value
= (Rm
>> shift_amount
) | (Rm
<< (32 - shift_amount
));
111 *carry
= (return_value
>> 31) & 0x1;
114 else if (shift
== 0x4) /* RRX */
116 return_value
= Rm
>> 1;
126 uint32_t arm_shifter_operand(struct arm_sim_interface
*sim
, int variant
, union arm_shifter_operand shifter_operand
, uint8_t *shifter_carry_out
)
128 uint32_t return_value
;
129 int instruction_size
;
131 if (sim
->get_state(sim
) == ARMV4_5_STATE_ARM
)
132 instruction_size
= 4;
134 instruction_size
= 2;
136 *shifter_carry_out
= sim
->get_cpsr(sim
, 29, 1);
138 if (variant
== 0) /* 32-bit immediate */
140 return_value
= shifter_operand
.immediate
.immediate
;
142 else if (variant
== 1) /* immediate shift */
144 uint32_t Rm
= sim
->get_reg_mode(sim
, shifter_operand
.immediate_shift
.Rm
);
146 /* adjust RM in case the PC is being read */
147 if (shifter_operand
.immediate_shift
.Rm
== 15)
148 Rm
+= 2 * instruction_size
;
150 return_value
= arm_shift(shifter_operand
.immediate_shift
.shift
, Rm
, shifter_operand
.immediate_shift
.shift_imm
, shifter_carry_out
);
152 else if (variant
== 2) /* register shift */
154 uint32_t Rm
= sim
->get_reg_mode(sim
, shifter_operand
.register_shift
.Rm
);
155 uint32_t Rs
= sim
->get_reg_mode(sim
, shifter_operand
.register_shift
.Rs
);
157 /* adjust RM in case the PC is being read */
158 if (shifter_operand
.register_shift
.Rm
== 15)
159 Rm
+= 2 * instruction_size
;
161 return_value
= arm_shift(shifter_operand
.immediate_shift
.shift
, Rm
, Rs
, shifter_carry_out
);
165 LOG_ERROR("BUG: shifter_operand.variant not 0, 1 or 2");
166 return_value
= 0xffffffff;
172 int pass_condition(uint32_t cpsr
, uint32_t opcode
)
174 switch ((opcode
& 0xf0000000) >> 28)
177 if (cpsr
& 0x40000000)
182 if (!(cpsr
& 0x40000000))
187 if (cpsr
& 0x20000000)
192 if (!(cpsr
& 0x20000000))
197 if (cpsr
& 0x80000000)
202 if (!(cpsr
& 0x80000000))
207 if (cpsr
& 0x10000000)
212 if (!(cpsr
& 0x10000000))
217 if ((cpsr
& 0x20000000) && !(cpsr
& 0x40000000))
222 if (!(cpsr
& 0x20000000) || (cpsr
& 0x40000000))
227 if (((cpsr
& 0x80000000) && (cpsr
& 0x10000000))
228 || (!(cpsr
& 0x80000000) && !(cpsr
& 0x10000000)))
233 if (((cpsr
& 0x80000000) && !(cpsr
& 0x10000000))
234 || (!(cpsr
& 0x80000000) && (cpsr
& 0x10000000)))
239 if (!(cpsr
& 0x40000000) &&
240 (((cpsr
& 0x80000000) && (cpsr
& 0x10000000))
241 || (!(cpsr
& 0x80000000) && !(cpsr
& 0x10000000))))
246 if ((cpsr
& 0x40000000) ||
247 ((cpsr
& 0x80000000) && !(cpsr
& 0x10000000))
248 || (!(cpsr
& 0x80000000) && (cpsr
& 0x10000000)))
258 LOG_ERROR("BUG: should never get here");
262 int thumb_pass_branch_condition(uint32_t cpsr
, uint16_t opcode
)
264 return pass_condition(cpsr
, (opcode
& 0x0f00) << 20);
267 /* simulate a single step (if possible)
268 * if the dry_run_pc argument is provided, no state is changed,
269 * but the new pc is stored in the variable pointed at by the argument
271 int arm_simulate_step_core(target_t
*target
, uint32_t *dry_run_pc
, struct arm_sim_interface
*sim
)
273 uint32_t current_pc
= sim
->get_reg(sim
, 15);
274 arm_instruction_t instruction
;
275 int instruction_size
;
276 int retval
= ERROR_OK
;
278 if (sim
->get_state(sim
) == ARMV4_5_STATE_ARM
)
282 /* get current instruction, and identify it */
283 if ((retval
= target_read_u32(target
, current_pc
, &opcode
)) != ERROR_OK
)
287 if ((retval
= arm_evaluate_opcode(opcode
, current_pc
, &instruction
)) != ERROR_OK
)
291 instruction_size
= 4;
293 /* check condition code (for all instructions) */
294 if (!pass_condition(sim
->get_cpsr(sim
, 0, 32), opcode
))
298 *dry_run_pc
= current_pc
+ instruction_size
;
302 sim
->set_reg(sim
, 15, current_pc
+ instruction_size
);
312 retval
= target_read_u16(target
, current_pc
, &opcode
);
313 if (retval
!= ERROR_OK
)
315 retval
= thumb_evaluate_opcode(opcode
, current_pc
, &instruction
);
316 if (retval
!= ERROR_OK
)
318 instruction_size
= 2;
320 /* check condition code (only for branch (1) instructions) */
321 if ((opcode
& 0xf000) == 0xd000 &&
322 !thumb_pass_branch_condition(sim
->get_cpsr(sim
, 0, 32), opcode
))
326 *dry_run_pc
= current_pc
+ instruction_size
;
330 sim
->set_reg(sim
, 15, current_pc
+ instruction_size
);
336 /* Deal with 32-bit BL/BLX */
337 if ((opcode
& 0xf800) == 0xf000) {
338 uint32_t high
= instruction
.info
.b_bl_bx_blx
.target_address
;
339 retval
= target_read_u16(target
, current_pc
+2, &opcode
);
340 if (retval
!= ERROR_OK
)
342 retval
= thumb_evaluate_opcode(opcode
, current_pc
, &instruction
);
343 if (retval
!= ERROR_OK
)
345 instruction
.info
.b_bl_bx_blx
.target_address
+= high
;
349 /* examine instruction type */
351 /* branch instructions */
352 if ((instruction
.type
>= ARM_B
) && (instruction
.type
<= ARM_BLX
))
356 if (instruction
.info
.b_bl_bx_blx
.reg_operand
== -1)
358 target
= instruction
.info
.b_bl_bx_blx
.target_address
;
362 target
= sim
->get_reg_mode(sim
, instruction
.info
.b_bl_bx_blx
.reg_operand
);
363 if (instruction
.info
.b_bl_bx_blx
.reg_operand
== 15)
365 target
+= 2 * instruction_size
;
371 *dry_run_pc
= target
& ~1;
376 if (instruction
.type
== ARM_B
)
378 sim
->set_reg(sim
, 15, target
);
380 else if (instruction
.type
== ARM_BL
)
382 uint32_t old_pc
= sim
->get_reg(sim
, 15);
383 int T
= (sim
->get_state(sim
) == ARMV4_5_STATE_THUMB
);
384 sim
->set_reg_mode(sim
, 14, old_pc
+ 4 + T
);
385 sim
->set_reg(sim
, 15, target
);
387 else if (instruction
.type
== ARM_BX
)
391 sim
->set_state(sim
, ARMV4_5_STATE_THUMB
);
395 sim
->set_state(sim
, ARMV4_5_STATE_ARM
);
397 sim
->set_reg(sim
, 15, target
& 0xfffffffe);
399 else if (instruction
.type
== ARM_BLX
)
401 uint32_t old_pc
= sim
->get_reg(sim
, 15);
402 int T
= (sim
->get_state(sim
) == ARMV4_5_STATE_THUMB
);
403 sim
->set_reg_mode(sim
, 14, old_pc
+ 4 + T
);
407 sim
->set_state(sim
, ARMV4_5_STATE_THUMB
);
411 sim
->set_state(sim
, ARMV4_5_STATE_ARM
);
413 sim
->set_reg(sim
, 15, target
& 0xfffffffe);
419 /* data processing instructions, except compare instructions (CMP, CMN, TST, TEQ) */
420 else if (((instruction
.type
>= ARM_AND
) && (instruction
.type
<= ARM_RSC
))
421 || ((instruction
.type
>= ARM_ORR
) && (instruction
.type
<= ARM_MVN
)))
423 uint32_t Rd
, Rn
, shifter_operand
;
424 uint8_t C
= sim
->get_cpsr(sim
, 29, 1);
428 /* ARM_MOV and ARM_MVN does not use Rn */
429 if ((instruction
.type
!= ARM_MOV
) && (instruction
.type
!= ARM_MVN
))
430 Rn
= sim
->get_reg_mode(sim
, instruction
.info
.data_proc
.Rn
);
434 shifter_operand
= arm_shifter_operand(sim
, instruction
.info
.data_proc
.variant
, instruction
.info
.data_proc
.shifter_operand
, &carry_out
);
436 /* adjust Rn in case the PC is being read */
437 if (instruction
.info
.data_proc
.Rn
== 15)
438 Rn
+= 2 * instruction_size
;
440 if (instruction
.type
== ARM_AND
)
441 Rd
= Rn
& shifter_operand
;
442 else if (instruction
.type
== ARM_EOR
)
443 Rd
= Rn
^ shifter_operand
;
444 else if (instruction
.type
== ARM_SUB
)
445 Rd
= Rn
- shifter_operand
;
446 else if (instruction
.type
== ARM_RSB
)
447 Rd
= shifter_operand
- Rn
;
448 else if (instruction
.type
== ARM_ADD
)
449 Rd
= Rn
+ shifter_operand
;
450 else if (instruction
.type
== ARM_ADC
)
451 Rd
= Rn
+ shifter_operand
+ (C
& 1);
452 else if (instruction
.type
== ARM_SBC
)
453 Rd
= Rn
- shifter_operand
- (C
& 1) ? 0 : 1;
454 else if (instruction
.type
== ARM_RSC
)
455 Rd
= shifter_operand
- Rn
- (C
& 1) ? 0 : 1;
456 else if (instruction
.type
== ARM_ORR
)
457 Rd
= Rn
| shifter_operand
;
458 else if (instruction
.type
== ARM_BIC
)
459 Rd
= Rn
& ~(shifter_operand
);
460 else if (instruction
.type
== ARM_MOV
)
461 Rd
= shifter_operand
;
462 else if (instruction
.type
== ARM_MVN
)
463 Rd
= ~shifter_operand
;
465 LOG_WARNING("unhandled instruction type");
469 if (instruction
.info
.data_proc
.Rd
== 15)
470 *dry_run_pc
= Rd
& ~1;
472 *dry_run_pc
= current_pc
+ instruction_size
;
478 if (instruction
.info
.data_proc
.Rd
== 15) {
479 sim
->set_reg_mode(sim
, 15, Rd
& ~1);
481 sim
->set_state(sim
, ARMV4_5_STATE_THUMB
);
483 sim
->set_state(sim
, ARMV4_5_STATE_ARM
);
486 sim
->set_reg_mode(sim
, instruction
.info
.data_proc
.Rd
, Rd
);
487 LOG_WARNING("no updating of flags yet");
490 /* compare instructions (CMP, CMN, TST, TEQ) */
491 else if ((instruction
.type
>= ARM_TST
) && (instruction
.type
<= ARM_CMN
))
495 *dry_run_pc
= current_pc
+ instruction_size
;
500 LOG_WARNING("no updating of flags yet");
503 /* load register instructions */
504 else if ((instruction
.type
>= ARM_LDR
) && (instruction
.type
<= ARM_LDRSH
))
506 uint32_t load_address
= 0, modified_address
= 0, load_value
;
507 uint32_t Rn
= sim
->get_reg_mode(sim
, instruction
.info
.load_store
.Rn
);
509 /* adjust Rn in case the PC is being read */
510 if (instruction
.info
.load_store
.Rn
== 15)
511 Rn
+= 2 * instruction_size
;
513 if (instruction
.info
.load_store
.offset_mode
== 0)
515 if (instruction
.info
.load_store
.U
)
516 modified_address
= Rn
+ instruction
.info
.load_store
.offset
.offset
;
518 modified_address
= Rn
- instruction
.info
.load_store
.offset
.offset
;
520 else if (instruction
.info
.load_store
.offset_mode
== 1)
523 uint32_t Rm
= sim
->get_reg_mode(sim
, instruction
.info
.load_store
.offset
.reg
.Rm
);
524 uint8_t shift
= instruction
.info
.load_store
.offset
.reg
.shift
;
525 uint8_t shift_imm
= instruction
.info
.load_store
.offset
.reg
.shift_imm
;
526 uint8_t carry
= sim
->get_cpsr(sim
, 29, 1);
528 offset
= arm_shift(shift
, Rm
, shift_imm
, &carry
);
530 if (instruction
.info
.load_store
.U
)
531 modified_address
= Rn
+ offset
;
533 modified_address
= Rn
- offset
;
537 LOG_ERROR("BUG: offset_mode neither 0 (offset) nor 1 (scaled register)");
540 if (instruction
.info
.load_store
.index_mode
== 0)
543 * we load from the modified address, but don't change the base address register */
544 load_address
= modified_address
;
545 modified_address
= Rn
;
547 else if (instruction
.info
.load_store
.index_mode
== 1)
550 * we load from the modified address, and write it back to the base address register */
551 load_address
= modified_address
;
553 else if (instruction
.info
.load_store
.index_mode
== 2)
556 * we load from the unmodified address, and write the modified address back */
560 if ((!dry_run_pc
) || (instruction
.info
.load_store
.Rd
== 15))
562 if ((retval
= target_read_u32(target
, load_address
, &load_value
)) != ERROR_OK
)
570 if (instruction
.info
.load_store
.Rd
== 15)
571 *dry_run_pc
= load_value
& ~1;
573 *dry_run_pc
= current_pc
+ instruction_size
;
578 if ((instruction
.info
.load_store
.index_mode
== 1) ||
579 (instruction
.info
.load_store
.index_mode
== 2))
581 sim
->set_reg_mode(sim
, instruction
.info
.load_store
.Rn
, modified_address
);
584 if (instruction
.info
.load_store
.Rd
== 15) {
585 sim
->set_reg_mode(sim
, 15, load_value
& ~1);
587 sim
->set_state(sim
, ARMV4_5_STATE_THUMB
);
589 sim
->set_state(sim
, ARMV4_5_STATE_ARM
);
592 sim
->set_reg_mode(sim
, instruction
.info
.load_store
.Rd
, load_value
);
595 /* load multiple instruction */
596 else if (instruction
.type
== ARM_LDM
)
599 uint32_t Rn
= sim
->get_reg_mode(sim
, instruction
.info
.load_store_multiple
.Rn
);
600 uint32_t load_values
[16];
603 for (i
= 0; i
< 16; i
++)
605 if (instruction
.info
.load_store_multiple
.register_list
& (1 << i
))
609 switch (instruction
.info
.load_store_multiple
.addressing_mode
)
611 case 0: /* Increment after */
614 case 1: /* Increment before */
617 case 2: /* Decrement after */
618 Rn
= Rn
- (bits_set
* 4) + 4;
620 case 3: /* Decrement before */
621 Rn
= Rn
- (bits_set
* 4);
625 for (i
= 0; i
< 16; i
++)
627 if (instruction
.info
.load_store_multiple
.register_list
& (1 << i
))
629 if ((!dry_run_pc
) || (i
== 15))
631 target_read_u32(target
, Rn
, &load_values
[i
]);
639 if (instruction
.info
.load_store_multiple
.register_list
& 0x8000)
641 *dry_run_pc
= load_values
[15] & ~1;
647 enum armv4_5_mode mode
= sim
->get_mode(sim
);
650 if (instruction
.info
.load_store_multiple
.S
)
652 if (instruction
.info
.load_store_multiple
.register_list
& 0x8000)
655 mode
= ARMV4_5_MODE_USR
;
658 for (i
= 0; i
< 16; i
++)
660 if (instruction
.info
.load_store_multiple
.register_list
& (1 << i
))
663 uint32_t val
= load_values
[i
];
664 sim
->set_reg_mode(sim
, i
, val
& ~1);
666 sim
->set_state(sim
, ARMV4_5_STATE_THUMB
);
668 sim
->set_state(sim
, ARMV4_5_STATE_ARM
);
670 sim
->set_reg_mode(sim
, i
, load_values
[i
]);
677 uint32_t spsr
= sim
->get_reg_mode(sim
, 16);
678 sim
->set_reg(sim
, ARMV4_5_CPSR
, spsr
);
681 /* base register writeback */
682 if (instruction
.info
.load_store_multiple
.W
)
683 sim
->set_reg_mode(sim
, instruction
.info
.load_store_multiple
.Rn
, Rn
);
685 if (instruction
.info
.load_store_multiple
.register_list
& 0x8000)
689 /* store multiple instruction */
690 else if (instruction
.type
== ARM_STM
)
696 /* STM wont affect PC (advance by instruction size */
700 uint32_t Rn
= sim
->get_reg_mode(sim
, instruction
.info
.load_store_multiple
.Rn
);
702 enum armv4_5_mode mode
= sim
->get_mode(sim
);
704 for (i
= 0; i
< 16; i
++)
706 if (instruction
.info
.load_store_multiple
.register_list
& (1 << i
))
710 if (instruction
.info
.load_store_multiple
.S
)
712 mode
= ARMV4_5_MODE_USR
;
715 switch (instruction
.info
.load_store_multiple
.addressing_mode
)
717 case 0: /* Increment after */
720 case 1: /* Increment before */
723 case 2: /* Decrement after */
724 Rn
= Rn
- (bits_set
* 4) + 4;
726 case 3: /* Decrement before */
727 Rn
= Rn
- (bits_set
* 4);
731 for (i
= 0; i
< 16; i
++)
733 if (instruction
.info
.load_store_multiple
.register_list
& (1 << i
))
735 target_write_u32(target
, Rn
, sim
->get_reg_mode(sim
, i
));
740 /* base register writeback */
741 if (instruction
.info
.load_store_multiple
.W
)
742 sim
->set_reg_mode(sim
, instruction
.info
.load_store_multiple
.Rn
, Rn
);
746 else if (!dry_run_pc
)
748 /* the instruction wasn't handled, but we're supposed to simulate it
750 LOG_ERROR("Unimplemented instruction, could not simulate it.");
756 *dry_run_pc
= current_pc
+ instruction_size
;
761 sim
->set_reg(sim
, 15, current_pc
+ instruction_size
);
767 static uint32_t armv4_5_get_reg(struct arm_sim_interface
*sim
, int reg
)
769 armv4_5_common_t
*armv4_5
= (armv4_5_common_t
*)sim
->user_data
;
771 return buf_get_u32(armv4_5
->core_cache
->reg_list
[reg
].value
, 0, 32);
774 static void armv4_5_set_reg(struct arm_sim_interface
*sim
, int reg
, uint32_t value
)
776 armv4_5_common_t
*armv4_5
= (armv4_5_common_t
*)sim
->user_data
;
778 buf_set_u32(armv4_5
->core_cache
->reg_list
[reg
].value
, 0, 32, value
);
781 static uint32_t armv4_5_get_reg_mode(struct arm_sim_interface
*sim
, int reg
)
783 armv4_5_common_t
*armv4_5
= (armv4_5_common_t
*)sim
->user_data
;
785 return buf_get_u32(ARMV4_5_CORE_REG_MODE(armv4_5
->core_cache
, armv4_5
->core_mode
, reg
).value
, 0, 32);
788 static void armv4_5_set_reg_mode(struct arm_sim_interface
*sim
, int reg
, uint32_t value
)
790 armv4_5_common_t
*armv4_5
= (armv4_5_common_t
*)sim
->user_data
;
792 buf_set_u32(ARMV4_5_CORE_REG_MODE(armv4_5
->core_cache
, armv4_5
->core_mode
, reg
).value
, 0, 32, value
);
795 static uint32_t armv4_5_get_cpsr(struct arm_sim_interface
*sim
, int pos
, int bits
)
797 armv4_5_common_t
*armv4_5
= (armv4_5_common_t
*)sim
->user_data
;
799 return buf_get_u32(armv4_5
->core_cache
->reg_list
[ARMV4_5_CPSR
].value
, pos
, bits
);
802 static enum armv4_5_state
armv4_5_get_state(struct arm_sim_interface
*sim
)
804 armv4_5_common_t
*armv4_5
= (armv4_5_common_t
*)sim
->user_data
;
806 return armv4_5
->core_state
;
809 static void armv4_5_set_state(struct arm_sim_interface
*sim
, enum armv4_5_state mode
)
811 armv4_5_common_t
*armv4_5
= (armv4_5_common_t
*)sim
->user_data
;
813 armv4_5
->core_state
= mode
;
817 static enum armv4_5_mode
armv4_5_get_mode(struct arm_sim_interface
*sim
)
819 armv4_5_common_t
*armv4_5
= (armv4_5_common_t
*)sim
->user_data
;
821 return armv4_5
->core_mode
;
826 int arm_simulate_step(target_t
*target
, uint32_t *dry_run_pc
)
828 struct armv4_5_common_s
*armv4_5
= target_to_armv4_5(target
);
829 struct arm_sim_interface sim
;
831 sim
.user_data
= armv4_5
;
832 sim
.get_reg
= &armv4_5_get_reg
;
833 sim
.set_reg
= &armv4_5_set_reg
;
834 sim
.get_reg_mode
= &armv4_5_get_reg_mode
;
835 sim
.set_reg_mode
= &armv4_5_set_reg_mode
;
836 sim
.get_cpsr
= &armv4_5_get_cpsr
;
837 sim
.get_mode
= &armv4_5_get_mode
;
838 sim
.get_state
= &armv4_5_get_state
;
839 sim
.set_state
= &armv4_5_set_state
;
841 return arm_simulate_step_core(target
, dry_run_pc
, &sim
);