|
|
|
@ -38,6 +38,8 @@ UnwResult UnwStartThumb(UnwState * const state) { |
|
|
|
|
|
|
|
bool found = false; |
|
|
|
uint16_t t = UNW_MAX_INSTR_COUNT; |
|
|
|
uint32_t lastJumpAddr = 0; // Last JUMP address, to try to detect infinite loops
|
|
|
|
bool loopDetected = false; // If a loop was detected
|
|
|
|
|
|
|
|
do { |
|
|
|
uint16_t instr; |
|
|
|
@ -61,12 +63,332 @@ UnwResult UnwStartThumb(UnwState * const state) { |
|
|
|
return UNWIND_INCONSISTENT; |
|
|
|
} |
|
|
|
|
|
|
|
/*
|
|
|
|
* Detect 32bit thumb instructions |
|
|
|
*/ |
|
|
|
if ((instr & 0xe000) == 0xe000 && (instr & 0x1800) != 0) { |
|
|
|
uint16_t instr2; |
|
|
|
|
|
|
|
/* Check next address */ |
|
|
|
state->regData[15].v += 2; |
|
|
|
|
|
|
|
/* Attempt to read the 2nd part of the instruction */ |
|
|
|
if(!state->cb->readH(state->regData[15].v & (~0x1), &instr2)) { |
|
|
|
return UNWIND_IREAD_H_FAIL; |
|
|
|
} |
|
|
|
|
|
|
|
UnwPrintd3(" %x %04x:", state->regData[15].v, instr2); |
|
|
|
|
|
|
|
/*
|
|
|
|
* Load/Store multiple: Only interpret |
|
|
|
* PUSH and POP |
|
|
|
*/ |
|
|
|
if ((instr & 0xfe6f) == 0xe82d) { |
|
|
|
bool L = (instr & 0x10) ? true : false; |
|
|
|
uint16_t rList = instr2; |
|
|
|
|
|
|
|
if(L) { |
|
|
|
uint8_t r; |
|
|
|
|
|
|
|
/* Load from memory: POP */ |
|
|
|
UnwPrintd1("POP {Rlist}\n"); |
|
|
|
|
|
|
|
/* Load registers from stack */ |
|
|
|
for(r = 0; r < 16; r++) { |
|
|
|
if(rList & (0x1 << r)) { |
|
|
|
|
|
|
|
/* Read the word */ |
|
|
|
if(!UnwMemReadRegister(state, state->regData[13].v, &state->regData[r])) { |
|
|
|
return UNWIND_DREAD_W_FAIL; |
|
|
|
} |
|
|
|
|
|
|
|
/* Alter the origin to be from the stack if it was valid */ |
|
|
|
if(M_IsOriginValid(state->regData[r].o)) { |
|
|
|
|
|
|
|
state->regData[r].o = REG_VAL_FROM_STACK; |
|
|
|
|
|
|
|
/* If restoring the PC */ |
|
|
|
if (r == 15) { |
|
|
|
|
|
|
|
/* The bottom bit should have been set to indicate that
|
|
|
|
* the caller was from Thumb. This would allow return |
|
|
|
* by BX for interworking APCS. |
|
|
|
*/ |
|
|
|
if((state->regData[15].v & 0x1) == 0) { |
|
|
|
UnwPrintd2("Warning: Return address not to Thumb: 0x%08x\n", state->regData[15].v); |
|
|
|
|
|
|
|
/* Pop into the PC will not switch mode */ |
|
|
|
return UNWIND_INCONSISTENT; |
|
|
|
} |
|
|
|
|
|
|
|
/* Store the return address */ |
|
|
|
if(!UnwReportRetAddr(state, state->regData[15].v)) { |
|
|
|
return UNWIND_TRUNCATED; |
|
|
|
} |
|
|
|
|
|
|
|
/* Now have the return address */ |
|
|
|
UnwPrintd2(" Return PC=%x\n", state->regData[15].v); |
|
|
|
|
|
|
|
/* Compensate for the auto-increment, which isn't needed here */ |
|
|
|
state->regData[15].v -= 2; |
|
|
|
|
|
|
|
} |
|
|
|
|
|
|
|
} else { |
|
|
|
|
|
|
|
if (r == 15) { |
|
|
|
/* Return address is not valid */ |
|
|
|
UnwPrintd1("PC popped with invalid address\n"); |
|
|
|
return UNWIND_FAILURE; |
|
|
|
} |
|
|
|
} |
|
|
|
|
|
|
|
state->regData[13].v += 4; |
|
|
|
|
|
|
|
UnwPrintd3(" r%d = 0x%08x\n", r, state->regData[r].v); |
|
|
|
} |
|
|
|
} |
|
|
|
} |
|
|
|
else { |
|
|
|
int8_t r; |
|
|
|
|
|
|
|
/* Store to memory: PUSH */ |
|
|
|
UnwPrintd1("PUSH {Rlist}"); |
|
|
|
|
|
|
|
for(r = 15; r >= 0; r--) { |
|
|
|
if(rList & (0x1 << r)) { |
|
|
|
UnwPrintd4("\n r%d = 0x%08x\t; %s", r, state->regData[r].v, M_Origin2Str(state->regData[r].o)); |
|
|
|
|
|
|
|
state->regData[13].v -= 4; |
|
|
|
|
|
|
|
if(!UnwMemWriteRegister(state, state->regData[13].v, &state->regData[r])) { |
|
|
|
return UNWIND_DWRITE_W_FAIL; |
|
|
|
} |
|
|
|
} |
|
|
|
} |
|
|
|
} |
|
|
|
} |
|
|
|
/*
|
|
|
|
* PUSH register |
|
|
|
*/ |
|
|
|
else if (instr == 0xf84d && (instr2 & 0x0fff) == 0x0d04) { |
|
|
|
uint8_t r = instr2 >> 12; |
|
|
|
|
|
|
|
/* Store to memory: PUSH */ |
|
|
|
UnwPrintd2("PUSH {R%d}\n", r); |
|
|
|
UnwPrintd4("\n r%d = 0x%08x\t; %s", r, state->regData[r].v, M_Origin2Str(state->regData[r].o)); |
|
|
|
|
|
|
|
state->regData[13].v -= 4; |
|
|
|
|
|
|
|
if(!UnwMemWriteRegister(state, state->regData[13].v, &state->regData[r])) { |
|
|
|
return UNWIND_DWRITE_W_FAIL; |
|
|
|
} |
|
|
|
} |
|
|
|
/*
|
|
|
|
* POP register |
|
|
|
*/ |
|
|
|
else if (instr == 0xf85d && (instr2 & 0x0fff) == 0x0b04) { |
|
|
|
uint8_t r = instr2 >> 12; |
|
|
|
|
|
|
|
/* Load from memory: POP */ |
|
|
|
UnwPrintd2("POP {R%d}\n", r); |
|
|
|
|
|
|
|
/* Read the word */ |
|
|
|
if(!UnwMemReadRegister(state, state->regData[13].v, &state->regData[r])) { |
|
|
|
return UNWIND_DREAD_W_FAIL; |
|
|
|
} |
|
|
|
|
|
|
|
/* Alter the origin to be from the stack if it was valid */ |
|
|
|
if(M_IsOriginValid(state->regData[r].o)) { |
|
|
|
|
|
|
|
state->regData[r].o = REG_VAL_FROM_STACK; |
|
|
|
|
|
|
|
/* If restoring the PC */ |
|
|
|
if (r == 15) { |
|
|
|
|
|
|
|
/* The bottom bit should have been set to indicate that
|
|
|
|
* the caller was from Thumb. This would allow return |
|
|
|
* by BX for interworking APCS. |
|
|
|
*/ |
|
|
|
if((state->regData[15].v & 0x1) == 0) { |
|
|
|
UnwPrintd2("Warning: Return address not to Thumb: 0x%08x\n", state->regData[15].v); |
|
|
|
|
|
|
|
/* Pop into the PC will not switch mode */ |
|
|
|
return UNWIND_INCONSISTENT; |
|
|
|
} |
|
|
|
|
|
|
|
/* Store the return address */ |
|
|
|
if(!UnwReportRetAddr(state, state->regData[15].v)) { |
|
|
|
return UNWIND_TRUNCATED; |
|
|
|
} |
|
|
|
|
|
|
|
/* Now have the return address */ |
|
|
|
UnwPrintd2(" Return PC=%x\n", state->regData[15].v); |
|
|
|
|
|
|
|
/* Compensate for the auto-increment, which isn't needed here */ |
|
|
|
state->regData[15].v -= 2; |
|
|
|
|
|
|
|
} |
|
|
|
|
|
|
|
} else { |
|
|
|
|
|
|
|
if (r == 15) { |
|
|
|
/* Return address is not valid */ |
|
|
|
UnwPrintd1("PC popped with invalid address\n"); |
|
|
|
return UNWIND_FAILURE; |
|
|
|
} |
|
|
|
} |
|
|
|
|
|
|
|
state->regData[13].v += 4; |
|
|
|
|
|
|
|
UnwPrintd3(" r%d = 0x%08x\n", r, state->regData[r].v); |
|
|
|
} |
|
|
|
/*
|
|
|
|
* Unconditional branch |
|
|
|
*/ |
|
|
|
else if ((instr & 0xf800) == 0xf000 && (instr2 & 0xd000) == 0x9000) { |
|
|
|
uint32_t v; |
|
|
|
|
|
|
|
uint8_t S = (instr & 0x400) >> 10; |
|
|
|
uint16_t imm10 = (instr & 0x3ff); |
|
|
|
uint8_t J1 = (instr2 & 0x2000) >> 13; |
|
|
|
uint8_t J2 = (instr2 & 0x0800) >> 11; |
|
|
|
uint16_t imm11 = (instr2 & 0x7ff); |
|
|
|
|
|
|
|
uint8_t I1 = J1 ^ S ^ 1; |
|
|
|
uint8_t I2 = J2 ^ S ^ 1; |
|
|
|
uint32_t imm32 = (S << 24) | (I1 << 23) | (I2 << 22) |(imm10 << 12) | (imm11 << 1); |
|
|
|
if (S) imm32 |= 0xfe000000; |
|
|
|
|
|
|
|
UnwPrintd2("B %d \n", imm32); |
|
|
|
|
|
|
|
/* Update PC */ |
|
|
|
state->regData[15].v += imm32; |
|
|
|
|
|
|
|
/* Need to advance by a word to account for pre-fetch.
|
|
|
|
* Advance by a half word here, allowing the normal address |
|
|
|
* advance to account for the other half word. |
|
|
|
*/ |
|
|
|
state->regData[15].v += 2; |
|
|
|
|
|
|
|
/* Compute the jump address */ |
|
|
|
v = state->regData[15].v + 2; |
|
|
|
|
|
|
|
/* Display PC of next instruction */ |
|
|
|
UnwPrintd2(" New PC=%x", v); |
|
|
|
|
|
|
|
/* Did we detect an infinite loop ? */ |
|
|
|
loopDetected = lastJumpAddr == v; |
|
|
|
|
|
|
|
/* Remember the last address we jumped to */ |
|
|
|
lastJumpAddr = v; |
|
|
|
} |
|
|
|
|
|
|
|
/*
|
|
|
|
* Branch with link |
|
|
|
*/ |
|
|
|
else if ((instr & 0xf800) == 0xf000 && (instr2 & 0xd000) == 0xd000) { |
|
|
|
|
|
|
|
uint8_t S = (instr & 0x400) >> 10; |
|
|
|
uint16_t imm10 = (instr & 0x3ff); |
|
|
|
uint8_t J1 = (instr2 & 0x2000) >> 13; |
|
|
|
uint8_t J2 = (instr2 & 0x0800) >> 11; |
|
|
|
uint16_t imm11 = (instr2 & 0x7ff); |
|
|
|
|
|
|
|
uint8_t I1 = J1 ^ S ^ 1; |
|
|
|
uint8_t I2 = J2 ^ S ^ 1; |
|
|
|
uint32_t imm32 = (S << 24) | (I1 << 23) | (I2 << 22) |(imm10 << 12) | (imm11 << 1); |
|
|
|
if (S) imm32 |= 0xfe000000; |
|
|
|
|
|
|
|
UnwPrintd2("BL %d \n", imm32); |
|
|
|
|
|
|
|
/* Never taken, as we are unwinding the stack */ |
|
|
|
if (0) { |
|
|
|
|
|
|
|
/* Store return address in LR register */ |
|
|
|
state->regData[14].v = state->regData[15].v + 2; |
|
|
|
state->regData[14].o = REG_VAL_FROM_CONST; |
|
|
|
|
|
|
|
/* Update PC */ |
|
|
|
state->regData[15].v += imm32; |
|
|
|
|
|
|
|
/* Need to advance by a word to account for pre-fetch.
|
|
|
|
* Advance by a half word here, allowing the normal address |
|
|
|
* advance to account for the other half word. |
|
|
|
*/ |
|
|
|
state->regData[15].v += 2; |
|
|
|
|
|
|
|
/* Display PC of next instruction */ |
|
|
|
UnwPrintd2(" Return PC=%x", state->regData[15].v); |
|
|
|
|
|
|
|
/* Report the return address, including mode bit */ |
|
|
|
if(!UnwReportRetAddr(state, state->regData[15].v)) { |
|
|
|
return UNWIND_TRUNCATED; |
|
|
|
} |
|
|
|
|
|
|
|
/* Determine the new mode */ |
|
|
|
if(state->regData[15].v & 0x1) { |
|
|
|
/* Branching to THUMB */ |
|
|
|
|
|
|
|
/* Account for the auto-increment which isn't needed */ |
|
|
|
state->regData[15].v -= 2; |
|
|
|
} |
|
|
|
else { |
|
|
|
/* Branch to ARM */ |
|
|
|
return UnwStartArm(state); |
|
|
|
} |
|
|
|
} |
|
|
|
} |
|
|
|
|
|
|
|
/*
|
|
|
|
* Conditional branches. Usually not taken, unless infinite loop is detected |
|
|
|
*/ |
|
|
|
else if ((instr & 0xf800) == 0xf000 && (instr2 & 0xd000) == 0x8000) { |
|
|
|
|
|
|
|
uint8_t S = (instr & 0x400) >> 10; |
|
|
|
uint16_t imm6 = (instr & 0x3f); |
|
|
|
uint8_t J1 = (instr2 & 0x2000) >> 13; |
|
|
|
uint8_t J2 = (instr2 & 0x0800) >> 11; |
|
|
|
uint16_t imm11 = (instr2 & 0x7ff); |
|
|
|
|
|
|
|
uint8_t I1 = J1 ^ S ^ 1; |
|
|
|
uint8_t I2 = J2 ^ S ^ 1; |
|
|
|
uint32_t imm32 = (S << 20) | (I1 << 19) | (I2 << 18) |(imm6 << 12) | (imm11 << 1); |
|
|
|
if (S) imm32 |= 0xffe00000; |
|
|
|
|
|
|
|
UnwPrintd2("Bcond %d\n", imm32); |
|
|
|
|
|
|
|
/* Take the jump only if a loop is detected */ |
|
|
|
if (loopDetected) { |
|
|
|
|
|
|
|
/* Update PC */ |
|
|
|
state->regData[15].v += imm32; |
|
|
|
|
|
|
|
/* Need to advance by a word to account for pre-fetch.
|
|
|
|
* Advance by a half word here, allowing the normal address |
|
|
|
* advance to account for the other half word. |
|
|
|
*/ |
|
|
|
state->regData[15].v += 2; |
|
|
|
|
|
|
|
/* Display PC of next instruction */ |
|
|
|
UnwPrintd2(" New PC=%x", state->regData[15].v + 2); |
|
|
|
} |
|
|
|
} |
|
|
|
else { |
|
|
|
UnwPrintd1("???? (32)"); |
|
|
|
|
|
|
|
/* Unknown/undecoded. May alter some register, so invalidate file */ |
|
|
|
UnwInvalidateRegisterFile(state->regData); |
|
|
|
} |
|
|
|
/* End of thumb 32bit code */ |
|
|
|
|
|
|
|
} |
|
|
|
/* Format 1: Move shifted register
|
|
|
|
* LSL Rd, Rs, #Offset5 |
|
|
|
* LSR Rd, Rs, #Offset5 |
|
|
|
* ASR Rd, Rs, #Offset5 |
|
|
|
*/ |
|
|
|
if((instr & 0xe000) == 0x0000 && (instr & 0x1800) != 0x1800) { |
|
|
|
else if((instr & 0xe000) == 0x0000 && (instr & 0x1800) != 0x1800) { |
|
|
|
bool signExtend; |
|
|
|
uint8_t op = (instr & 0x1800) >> 11; |
|
|
|
uint8_t offset5 = (instr & 0x07c0) >> 6; |
|
|
|
@ -355,8 +677,8 @@ UnwResult UnwStartThumb(UnwState * const state) { |
|
|
|
} |
|
|
|
/* Format 5: Hi register operations/branch exchange
|
|
|
|
* ADD Rd, Hs |
|
|
|
* ADD Hd, Rs |
|
|
|
* ADD Hd, Hs |
|
|
|
* CMP Hd, Rs |
|
|
|
* MOV Hd, Hs |
|
|
|
*/ |
|
|
|
else if((instr & 0xfc00) == 0x4400) { |
|
|
|
uint8_t op = (instr & 0x0300) >> 8; |
|
|
|
@ -371,11 +693,6 @@ UnwResult UnwStartThumb(UnwState * const state) { |
|
|
|
if(h1) |
|
|
|
rhd += 8; |
|
|
|
|
|
|
|
if(op != 3 && !h1 && !h2) { |
|
|
|
UnwPrintd1("\nError: h1 or h2 must be set for ADD, CMP or MOV\n"); |
|
|
|
return UNWIND_ILLEGAL_INSTR; |
|
|
|
} |
|
|
|
|
|
|
|
switch(op) { |
|
|
|
case 0: /* ADD */ |
|
|
|
UnwPrintd5("ADD r%d, r%d\t; r%d %s", rhd, rhs, rhs, M_Origin2Str(state->regData[rhs].o)); |
|
|
|
@ -407,6 +724,10 @@ UnwResult UnwStartThumb(UnwState * const state) { |
|
|
|
return UNWIND_TRUNCATED; |
|
|
|
} |
|
|
|
|
|
|
|
/* Store return address in LR register */ |
|
|
|
state->regData[14].v = state->regData[15].v + 2; |
|
|
|
state->regData[14].o = REG_VAL_FROM_CONST; |
|
|
|
|
|
|
|
/* Update the PC */ |
|
|
|
state->regData[15].v = state->regData[rhs].v; |
|
|
|
|
|
|
|
@ -570,10 +891,42 @@ UnwResult UnwStartThumb(UnwState * const state) { |
|
|
|
} |
|
|
|
} |
|
|
|
} |
|
|
|
|
|
|
|
/*
|
|
|
|
* Conditional branches |
|
|
|
* Bcond |
|
|
|
*/ |
|
|
|
else if((instr & 0xf000) == 0xd000) { |
|
|
|
int32_t branchValue = (instr & 0xff); |
|
|
|
if (branchValue & 0x80) branchValue |= 0xffffff00; |
|
|
|
|
|
|
|
/* Branch distance is twice that specified in the instruction. */ |
|
|
|
branchValue *= 2; |
|
|
|
|
|
|
|
UnwPrintd2("Bcond %d \n", branchValue); |
|
|
|
|
|
|
|
/* Only take the branch if a loop was detected */ |
|
|
|
if (loopDetected) { |
|
|
|
|
|
|
|
/* Update PC */ |
|
|
|
state->regData[15].v += branchValue; |
|
|
|
|
|
|
|
/* Need to advance by a word to account for pre-fetch.
|
|
|
|
* Advance by a half word here, allowing the normal address |
|
|
|
* advance to account for the other half word. |
|
|
|
*/ |
|
|
|
state->regData[15].v += 2; |
|
|
|
|
|
|
|
/* Display PC of next instruction */ |
|
|
|
UnwPrintd2(" New PC=%x", state->regData[15].v + 2); |
|
|
|
} |
|
|
|
} |
|
|
|
|
|
|
|
/* Format 18: unconditional branch
|
|
|
|
* B label |
|
|
|
*/ |
|
|
|
else if((instr & 0xf800) == 0xe000) { |
|
|
|
uint32_t v; |
|
|
|
int16_t branchValue = signExtend11(instr & 0x07ff); |
|
|
|
|
|
|
|
/* Branch distance is twice that specified in the instruction. */ |
|
|
|
@ -590,9 +943,17 @@ UnwResult UnwStartThumb(UnwState * const state) { |
|
|
|
*/ |
|
|
|
state->regData[15].v += 2; |
|
|
|
|
|
|
|
/* Compute the jump address */ |
|
|
|
v = state->regData[15].v + 2; |
|
|
|
|
|
|
|
/* Display PC of next instruction */ |
|
|
|
UnwPrintd2(" New PC=%x", state->regData[15].v + 2); |
|
|
|
UnwPrintd2(" New PC=%x", v); |
|
|
|
|
|
|
|
/* Did we detect an infinite loop ? */ |
|
|
|
loopDetected = lastJumpAddr == v; |
|
|
|
|
|
|
|
/* Remember the last address we jumped to */ |
|
|
|
lastJumpAddr = v; |
|
|
|
} |
|
|
|
else { |
|
|
|
UnwPrintd1("????"); |
|
|
|
|
etagle
6 years ago