hw/pci-host/bonito: Avoid buffer overrun for bad LDMA/COP accesses
[qemu/ar7.git] / disas.c
blob69a6066914fa64845b606ff063ae82d6ceab7ff9
1 /* General "disassemble this chunk" code. Used for debugging. */
2 #include "config.h"
3 #include "qemu-common.h"
4 #include "disas/bfd.h"
5 #include "elf.h"
6 #include <errno.h>
8 #include "cpu.h"
9 #include "disas/disas.h"
11 typedef struct CPUDebug {
12 struct disassemble_info info;
13 CPUState *cpu;
14 } CPUDebug;
16 /* Filled in by elfload.c. Simplistic, but will do for now. */
17 struct syminfo *syminfos = NULL;
19 /* Get LENGTH bytes from info's buffer, at target address memaddr.
20 Transfer them to myaddr. */
21 int
22 buffer_read_memory(bfd_vma memaddr, bfd_byte *myaddr, int length,
23 struct disassemble_info *info)
25 if (memaddr < info->buffer_vma
26 || memaddr + length > info->buffer_vma + info->buffer_length)
27 /* Out of bounds. Use EIO because GDB uses it. */
28 return EIO;
29 memcpy (myaddr, info->buffer + (memaddr - info->buffer_vma), length);
30 return 0;
33 /* Get LENGTH bytes from info's buffer, at target address memaddr.
34 Transfer them to myaddr. */
35 static int
36 target_read_memory (bfd_vma memaddr,
37 bfd_byte *myaddr,
38 int length,
39 struct disassemble_info *info)
41 CPUDebug *s = container_of(info, CPUDebug, info);
43 cpu_memory_rw_debug(s->cpu, memaddr, myaddr, length, 0);
44 return 0;
47 /* Print an error message. We can assume that this is in response to
48 an error return from buffer_read_memory. */
49 void
50 perror_memory (int status, bfd_vma memaddr, struct disassemble_info *info)
52 if (status != EIO)
53 /* Can't happen. */
54 (*info->fprintf_func) (info->stream, "Unknown error %d\n", status);
55 else
56 /* Actually, address between memaddr and memaddr + len was
57 out of bounds. */
58 (*info->fprintf_func) (info->stream,
59 "Address 0x%" PRIx64 " is out of bounds.\n", memaddr);
62 /* This could be in a separate file, to save minuscule amounts of space
63 in statically linked executables. */
65 /* Just print the address is hex. This is included for completeness even
66 though both GDB and objdump provide their own (to print symbolic
67 addresses). */
69 void
70 generic_print_address (bfd_vma addr, struct disassemble_info *info)
72 (*info->fprintf_func) (info->stream, "0x%" PRIx64, addr);
75 /* Print address in hex, truncated to the width of a target virtual address. */
76 static void
77 generic_print_target_address(bfd_vma addr, struct disassemble_info *info)
79 uint64_t mask = ~0ULL >> (64 - TARGET_VIRT_ADDR_SPACE_BITS);
80 generic_print_address(addr & mask, info);
83 /* Print address in hex, truncated to the width of a host virtual address. */
84 static void
85 generic_print_host_address(bfd_vma addr, struct disassemble_info *info)
87 uint64_t mask = ~0ULL >> (64 - (sizeof(void *) * 8));
88 generic_print_address(addr & mask, info);
91 /* Just return the given address. */
93 int
94 generic_symbol_at_address (bfd_vma addr, struct disassemble_info *info)
96 return 1;
99 bfd_vma bfd_getl64 (const bfd_byte *addr)
101 unsigned long long v;
103 v = (unsigned long long) addr[0];
104 v |= (unsigned long long) addr[1] << 8;
105 v |= (unsigned long long) addr[2] << 16;
106 v |= (unsigned long long) addr[3] << 24;
107 v |= (unsigned long long) addr[4] << 32;
108 v |= (unsigned long long) addr[5] << 40;
109 v |= (unsigned long long) addr[6] << 48;
110 v |= (unsigned long long) addr[7] << 56;
111 return (bfd_vma) v;
114 bfd_vma bfd_getl32 (const bfd_byte *addr)
116 unsigned long v;
118 v = (unsigned long) addr[0];
119 v |= (unsigned long) addr[1] << 8;
120 v |= (unsigned long) addr[2] << 16;
121 v |= (unsigned long) addr[3] << 24;
122 return (bfd_vma) v;
125 bfd_vma bfd_getb32 (const bfd_byte *addr)
127 unsigned long v;
129 v = (unsigned long) addr[0] << 24;
130 v |= (unsigned long) addr[1] << 16;
131 v |= (unsigned long) addr[2] << 8;
132 v |= (unsigned long) addr[3];
133 return (bfd_vma) v;
136 bfd_vma bfd_getl16 (const bfd_byte *addr)
138 unsigned long v;
140 v = (unsigned long) addr[0];
141 v |= (unsigned long) addr[1] << 8;
142 return (bfd_vma) v;
145 bfd_vma bfd_getb16 (const bfd_byte *addr)
147 unsigned long v;
149 v = (unsigned long) addr[0] << 24;
150 v |= (unsigned long) addr[1] << 16;
151 return (bfd_vma) v;
154 static int print_insn_objdump(bfd_vma pc, disassemble_info *info,
155 const char *prefix)
157 int i, n = info->buffer_length;
158 uint8_t *buf = g_malloc(n);
160 info->read_memory_func(pc, buf, n, info);
162 for (i = 0; i < n; ++i) {
163 if (i % 32 == 0) {
164 info->fprintf_func(info->stream, "\n%s: ", prefix);
166 info->fprintf_func(info->stream, "%02x", buf[i]);
169 g_free(buf);
170 return n;
173 static int print_insn_od_host(bfd_vma pc, disassemble_info *info)
175 return print_insn_objdump(pc, info, "OBJD-H");
178 static int print_insn_od_target(bfd_vma pc, disassemble_info *info)
180 return print_insn_objdump(pc, info, "OBJD-T");
183 /* Disassemble this for me please... (debugging). 'flags' has the following
184 values:
185 i386 - 1 means 16 bit code, 2 means 64 bit code
186 ppc - bits 0:15 specify (optionally) the machine instruction set;
187 bit 16 indicates little endian.
188 other targets - unused
190 void target_disas(FILE *out, CPUState *cpu, target_ulong code,
191 target_ulong size, int flags)
193 CPUClass *cc = CPU_GET_CLASS(cpu);
194 target_ulong pc;
195 int count;
196 CPUDebug s;
198 INIT_DISASSEMBLE_INFO(s.info, out, fprintf);
200 s.cpu = cpu;
201 s.info.read_memory_func = target_read_memory;
202 s.info.buffer_vma = code;
203 s.info.buffer_length = size;
204 s.info.print_address_func = generic_print_target_address;
206 #ifdef TARGET_WORDS_BIGENDIAN
207 s.info.endian = BFD_ENDIAN_BIG;
208 #else
209 s.info.endian = BFD_ENDIAN_LITTLE;
210 #endif
212 if (cc->disas_set_info) {
213 cc->disas_set_info(cpu, &s.info);
216 #if defined(TARGET_I386)
217 if (flags == 2) {
218 s.info.mach = bfd_mach_x86_64;
219 } else if (flags == 1) {
220 s.info.mach = bfd_mach_i386_i8086;
221 } else {
222 s.info.mach = bfd_mach_i386_i386;
224 s.info.print_insn = print_insn_i386;
225 #elif defined(TARGET_SPARC)
226 s.info.print_insn = print_insn_sparc;
227 #ifdef TARGET_SPARC64
228 s.info.mach = bfd_mach_sparc_v9b;
229 #endif
230 #elif defined(TARGET_PPC)
231 if ((flags >> 16) & 1) {
232 s.info.endian = BFD_ENDIAN_LITTLE;
234 if (flags & 0xFFFF) {
235 /* If we have a precise definition of the instruction set, use it. */
236 s.info.mach = flags & 0xFFFF;
237 } else {
238 #ifdef TARGET_PPC64
239 s.info.mach = bfd_mach_ppc64;
240 #else
241 s.info.mach = bfd_mach_ppc;
242 #endif
244 s.info.disassembler_options = (char *)"any";
245 s.info.print_insn = print_insn_ppc;
246 #elif defined(TARGET_M68K)
247 s.info.print_insn = print_insn_m68k;
248 #elif defined(TARGET_MIPS)
249 #ifdef TARGET_WORDS_BIGENDIAN
250 s.info.print_insn = print_insn_big_mips;
251 #else
252 s.info.print_insn = print_insn_little_mips;
253 #endif
254 #elif defined(TARGET_SH4)
255 s.info.mach = bfd_mach_sh4;
256 s.info.print_insn = print_insn_sh;
257 #elif defined(TARGET_ALPHA)
258 s.info.mach = bfd_mach_alpha_ev6;
259 s.info.print_insn = print_insn_alpha;
260 #elif defined(TARGET_S390X)
261 s.info.mach = bfd_mach_s390_64;
262 s.info.print_insn = print_insn_s390;
263 #elif defined(TARGET_MOXIE)
264 s.info.mach = bfd_arch_moxie;
265 s.info.print_insn = print_insn_moxie;
266 #elif defined(TARGET_LM32)
267 s.info.mach = bfd_mach_lm32;
268 s.info.print_insn = print_insn_lm32;
269 #endif
270 if (s.info.print_insn == NULL) {
271 s.info.print_insn = print_insn_od_target;
274 for (pc = code; size > 0; pc += count, size -= count) {
275 fprintf(out, "0x" TARGET_FMT_lx ": ", pc);
276 count = s.info.print_insn(pc, &s.info);
277 #if 0
279 int i;
280 uint8_t b;
281 fprintf(out, " {");
282 for(i = 0; i < count; i++) {
283 target_read_memory(pc + i, &b, 1, &s.info);
284 fprintf(out, " %02x", b);
286 fprintf(out, " }");
288 #endif
289 fprintf(out, "\n");
290 if (count < 0)
291 break;
292 if (size < count) {
293 fprintf(out,
294 "Disassembler disagrees with translator over instruction "
295 "decoding\n"
296 "Please report this to qemu-devel@nongnu.org\n");
297 break;
302 /* Disassemble this for me please... (debugging). */
303 void disas(FILE *out, void *code, unsigned long size)
305 uintptr_t pc;
306 int count;
307 CPUDebug s;
308 int (*print_insn)(bfd_vma pc, disassemble_info *info) = NULL;
310 INIT_DISASSEMBLE_INFO(s.info, out, fprintf);
311 s.info.print_address_func = generic_print_host_address;
313 s.info.buffer = code;
314 s.info.buffer_vma = (uintptr_t)code;
315 s.info.buffer_length = size;
317 #ifdef HOST_WORDS_BIGENDIAN
318 s.info.endian = BFD_ENDIAN_BIG;
319 #else
320 s.info.endian = BFD_ENDIAN_LITTLE;
321 #endif
322 #if defined(CONFIG_TCG_INTERPRETER)
323 print_insn = print_insn_tci;
324 #elif defined(__i386__)
325 s.info.mach = bfd_mach_i386_i386;
326 print_insn = print_insn_i386;
327 #elif defined(__x86_64__)
328 s.info.mach = bfd_mach_x86_64;
329 print_insn = print_insn_i386;
330 #elif defined(_ARCH_PPC)
331 s.info.disassembler_options = (char *)"any";
332 print_insn = print_insn_ppc;
333 #elif defined(__aarch64__) && defined(CONFIG_ARM_A64_DIS)
334 print_insn = print_insn_arm_a64;
335 #elif defined(__alpha__)
336 print_insn = print_insn_alpha;
337 #elif defined(__sparc__)
338 print_insn = print_insn_sparc;
339 s.info.mach = bfd_mach_sparc_v9b;
340 #elif defined(__arm__)
341 print_insn = print_insn_arm;
342 #elif defined(__MIPSEB__)
343 print_insn = print_insn_big_mips;
344 #elif defined(__MIPSEL__)
345 print_insn = print_insn_little_mips;
346 #elif defined(__m68k__)
347 print_insn = print_insn_m68k;
348 #elif defined(__s390__)
349 print_insn = print_insn_s390;
350 #elif defined(__hppa__)
351 print_insn = print_insn_hppa;
352 #elif defined(__ia64__)
353 print_insn = print_insn_ia64;
354 #endif
355 if (print_insn == NULL) {
356 print_insn = print_insn_od_host;
358 for (pc = (uintptr_t)code; size > 0; pc += count, size -= count) {
359 fprintf(out, "0x%08" PRIxPTR ": ", pc);
360 count = print_insn(pc, &s.info);
361 fprintf(out, "\n");
362 if (count < 0)
363 break;
367 /* Look up symbol for debugging purpose. Returns "" if unknown. */
368 const char *lookup_symbol(target_ulong orig_addr)
370 const char *symbol = "";
371 struct syminfo *s;
373 for (s = syminfos; s; s = s->next) {
374 symbol = s->lookup_symbol(s, orig_addr);
375 if (symbol[0] != '\0') {
376 break;
380 return symbol;
383 #if !defined(CONFIG_USER_ONLY)
385 #include "monitor/monitor.h"
387 static int monitor_disas_is_physical;
389 static int
390 monitor_read_memory (bfd_vma memaddr, bfd_byte *myaddr, int length,
391 struct disassemble_info *info)
393 CPUDebug *s = container_of(info, CPUDebug, info);
395 if (monitor_disas_is_physical) {
396 cpu_physical_memory_read(memaddr, myaddr, length);
397 } else {
398 cpu_memory_rw_debug(s->cpu, memaddr, myaddr, length, 0);
400 return 0;
403 static int GCC_FMT_ATTR(2, 3)
404 monitor_fprintf(FILE *stream, const char *fmt, ...)
406 va_list ap;
407 va_start(ap, fmt);
408 monitor_vprintf((Monitor *)stream, fmt, ap);
409 va_end(ap);
410 return 0;
413 /* Disassembler for the monitor.
414 See target_disas for a description of flags. */
415 void monitor_disas(Monitor *mon, CPUState *cpu,
416 target_ulong pc, int nb_insn, int is_physical, int flags)
418 CPUClass *cc = CPU_GET_CLASS(cpu);
419 int count, i;
420 CPUDebug s;
422 INIT_DISASSEMBLE_INFO(s.info, (FILE *)mon, monitor_fprintf);
424 s.cpu = cpu;
425 monitor_disas_is_physical = is_physical;
426 s.info.read_memory_func = monitor_read_memory;
427 s.info.print_address_func = generic_print_target_address;
429 s.info.buffer_vma = pc;
431 #ifdef TARGET_WORDS_BIGENDIAN
432 s.info.endian = BFD_ENDIAN_BIG;
433 #else
434 s.info.endian = BFD_ENDIAN_LITTLE;
435 #endif
437 if (cc->disas_set_info) {
438 cc->disas_set_info(cpu, &s.info);
441 #if defined(TARGET_I386)
442 if (flags == 2) {
443 s.info.mach = bfd_mach_x86_64;
444 } else if (flags == 1) {
445 s.info.mach = bfd_mach_i386_i8086;
446 } else {
447 s.info.mach = bfd_mach_i386_i386;
449 s.info.print_insn = print_insn_i386;
450 #elif defined(TARGET_ALPHA)
451 s.info.print_insn = print_insn_alpha;
452 #elif defined(TARGET_SPARC)
453 s.info.print_insn = print_insn_sparc;
454 #ifdef TARGET_SPARC64
455 s.info.mach = bfd_mach_sparc_v9b;
456 #endif
457 #elif defined(TARGET_PPC)
458 if (flags & 0xFFFF) {
459 /* If we have a precise definition of the instruction set, use it. */
460 s.info.mach = flags & 0xFFFF;
461 } else {
462 #ifdef TARGET_PPC64
463 s.info.mach = bfd_mach_ppc64;
464 #else
465 s.info.mach = bfd_mach_ppc;
466 #endif
468 if ((flags >> 16) & 1) {
469 s.info.endian = BFD_ENDIAN_LITTLE;
471 s.info.print_insn = print_insn_ppc;
472 #elif defined(TARGET_M68K)
473 s.info.print_insn = print_insn_m68k;
474 #elif defined(TARGET_MIPS)
475 #ifdef TARGET_WORDS_BIGENDIAN
476 s.info.print_insn = print_insn_big_mips;
477 #else
478 s.info.print_insn = print_insn_little_mips;
479 #endif
480 #elif defined(TARGET_SH4)
481 s.info.mach = bfd_mach_sh4;
482 s.info.print_insn = print_insn_sh;
483 #elif defined(TARGET_S390X)
484 s.info.mach = bfd_mach_s390_64;
485 s.info.print_insn = print_insn_s390;
486 #elif defined(TARGET_MOXIE)
487 s.info.mach = bfd_arch_moxie;
488 s.info.print_insn = print_insn_moxie;
489 #elif defined(TARGET_LM32)
490 s.info.mach = bfd_mach_lm32;
491 s.info.print_insn = print_insn_lm32;
492 #endif
493 if (!s.info.print_insn) {
494 monitor_printf(mon, "0x" TARGET_FMT_lx
495 ": Asm output not supported on this arch\n", pc);
496 return;
499 for(i = 0; i < nb_insn; i++) {
500 monitor_printf(mon, "0x" TARGET_FMT_lx ": ", pc);
501 count = s.info.print_insn(pc, &s.info);
502 monitor_printf(mon, "\n");
503 if (count < 0)
504 break;
505 pc += count;
508 #endif