4 * Copyright (C) 2004 Paul Mackerras <paulus@au.ibm.com>, IBM
6 * This program is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU General Public License
8 * as published by the Free Software Foundation; either version
9 * 2 of the License, or (at your option) any later version.
11 #include <linux/kernel.h>
12 #include <linux/kprobes.h>
13 #include <linux/ptrace.h>
14 #include <linux/prefetch.h>
15 #include <asm/sstep.h>
16 #include <asm/processor.h>
17 #include <asm/uaccess.h>
18 #include <asm/cputable.h>
20 extern char system_call_common[];
23 /* Bits in SRR1 that are copied from MSR */
24 #define MSR_MASK 0xffffffff87c0ffffUL
26 #define MSR_MASK 0x87c0ffff
30 #define XER_SO 0x80000000U
31 #define XER_OV 0x40000000U
32 #define XER_CA 0x20000000U
36 * Functions in ldstfp.S
38 extern int do_lfs(int rn, unsigned long ea);
39 extern int do_lfd(int rn, unsigned long ea);
40 extern int do_stfs(int rn, unsigned long ea);
41 extern int do_stfd(int rn, unsigned long ea);
42 extern int do_lvx(int rn, unsigned long ea);
43 extern int do_stvx(int rn, unsigned long ea);
44 extern int do_lxvd2x(int rn, unsigned long ea);
45 extern int do_stxvd2x(int rn, unsigned long ea);
49 * Emulate the truncation of 64 bit values in 32-bit mode.
51 static unsigned long truncate_if_32bit(unsigned long msr, unsigned long val)
54 if ((msr & MSR_64BIT) == 0)
61 * Determine whether a conditional branch instruction would branch.
63 static int __kprobes branch_taken(unsigned int instr, struct pt_regs *regs)
65 unsigned int bo = (instr >> 21) & 0x1f;
69 /* decrement counter */
71 if (((bo >> 1) & 1) ^ (regs->ctr == 0))
74 if ((bo & 0x10) == 0) {
75 /* check bit from CR */
76 bi = (instr >> 16) & 0x1f;
77 if (((regs->ccr >> (31 - bi)) & 1) != ((bo >> 3) & 1))
84 static long __kprobes address_ok(struct pt_regs *regs, unsigned long ea, int nb)
88 return __access_ok(ea, nb, USER_DS);
92 * Calculate effective address for a D-form instruction
94 static unsigned long __kprobes dform_ea(unsigned int instr, struct pt_regs *regs)
99 ra = (instr >> 16) & 0x1f;
100 ea = (signed short) instr; /* sign-extend */
104 return truncate_if_32bit(regs->msr, ea);
109 * Calculate effective address for a DS-form instruction
111 static unsigned long __kprobes dsform_ea(unsigned int instr, struct pt_regs *regs)
116 ra = (instr >> 16) & 0x1f;
117 ea = (signed short) (instr & ~3); /* sign-extend */
121 return truncate_if_32bit(regs->msr, ea);
123 #endif /* __powerpc64 */
126 * Calculate effective address for an X-form instruction
128 static unsigned long __kprobes xform_ea(unsigned int instr,
129 struct pt_regs *regs)
134 ra = (instr >> 16) & 0x1f;
135 rb = (instr >> 11) & 0x1f;
140 return truncate_if_32bit(regs->msr, ea);
144 * Return the largest power of 2, not greater than sizeof(unsigned long),
145 * such that x is a multiple of it.
147 static inline unsigned long max_align(unsigned long x)
149 x |= sizeof(unsigned long);
150 return x & -x; /* isolates rightmost bit */
154 static inline unsigned long byterev_2(unsigned long x)
156 return ((x >> 8) & 0xff) | ((x & 0xff) << 8);
159 static inline unsigned long byterev_4(unsigned long x)
161 return ((x >> 24) & 0xff) | ((x >> 8) & 0xff00) |
162 ((x & 0xff00) << 8) | ((x & 0xff) << 24);
166 static inline unsigned long byterev_8(unsigned long x)
168 return (byterev_4(x) << 32) | byterev_4(x >> 32);
172 static int __kprobes read_mem_aligned(unsigned long *dest, unsigned long ea,
180 err = __get_user(x, (unsigned char __user *) ea);
183 err = __get_user(x, (unsigned short __user *) ea);
186 err = __get_user(x, (unsigned int __user *) ea);
190 err = __get_user(x, (unsigned long __user *) ea);
199 static int __kprobes read_mem_unaligned(unsigned long *dest, unsigned long ea,
200 int nb, struct pt_regs *regs)
203 unsigned long x, b, c;
204 #ifdef __LITTLE_ENDIAN__
205 int len = nb; /* save a copy of the length for byte reversal */
208 /* unaligned, do this in pieces */
210 for (; nb > 0; nb -= c) {
211 #ifdef __LITTLE_ENDIAN__
214 #ifdef __BIG_ENDIAN__
219 err = read_mem_aligned(&b, ea, c);
222 x = (x << (8 * c)) + b;
225 #ifdef __LITTLE_ENDIAN__
228 *dest = byterev_2(x);
231 *dest = byterev_4(x);
235 *dest = byterev_8(x);
240 #ifdef __BIG_ENDIAN__
247 * Read memory at address ea for nb bytes, return 0 for success
248 * or -EFAULT if an error occurred.
250 static int __kprobes read_mem(unsigned long *dest, unsigned long ea, int nb,
251 struct pt_regs *regs)
253 if (!address_ok(regs, ea, nb))
255 if ((ea & (nb - 1)) == 0)
256 return read_mem_aligned(dest, ea, nb);
257 return read_mem_unaligned(dest, ea, nb, regs);
260 static int __kprobes write_mem_aligned(unsigned long val, unsigned long ea,
267 err = __put_user(val, (unsigned char __user *) ea);
270 err = __put_user(val, (unsigned short __user *) ea);
273 err = __put_user(val, (unsigned int __user *) ea);
277 err = __put_user(val, (unsigned long __user *) ea);
284 static int __kprobes write_mem_unaligned(unsigned long val, unsigned long ea,
285 int nb, struct pt_regs *regs)
290 #ifdef __LITTLE_ENDIAN__
293 val = byterev_2(val);
296 val = byterev_4(val);
300 val = byterev_8(val);
305 /* unaligned or little-endian, do this in pieces */
306 for (; nb > 0; nb -= c) {
307 #ifdef __LITTLE_ENDIAN__
310 #ifdef __BIG_ENDIAN__
315 err = write_mem_aligned(val >> (nb - c) * 8, ea, c);
324 * Write memory at address ea for nb bytes, return 0 for success
325 * or -EFAULT if an error occurred.
327 static int __kprobes write_mem(unsigned long val, unsigned long ea, int nb,
328 struct pt_regs *regs)
330 if (!address_ok(regs, ea, nb))
332 if ((ea & (nb - 1)) == 0)
333 return write_mem_aligned(val, ea, nb);
334 return write_mem_unaligned(val, ea, nb, regs);
337 #ifdef CONFIG_PPC_FPU
339 * Check the address and alignment, and call func to do the actual
342 static int __kprobes do_fp_load(int rn, int (*func)(int, unsigned long),
343 unsigned long ea, int nb,
344 struct pt_regs *regs)
351 #ifdef __BIG_ENDIAN__
355 #ifdef __LITTLE_ENDIAN__
363 if (!address_ok(regs, ea, nb))
366 return (*func)(rn, ea);
367 ptr = (unsigned long) &data.ul;
368 if (sizeof(unsigned long) == 8 || nb == 4) {
369 err = read_mem_unaligned(&data.ul[0], ea, nb, regs);
371 ptr = (unsigned long)&(data.single.word);
373 /* reading a double on 32-bit */
374 err = read_mem_unaligned(&data.ul[0], ea, 4, regs);
376 err = read_mem_unaligned(&data.ul[1], ea + 4, 4, regs);
380 return (*func)(rn, ptr);
383 static int __kprobes do_fp_store(int rn, int (*func)(int, unsigned long),
384 unsigned long ea, int nb,
385 struct pt_regs *regs)
392 #ifdef __BIG_ENDIAN__
396 #ifdef __LITTLE_ENDIAN__
404 if (!address_ok(regs, ea, nb))
407 return (*func)(rn, ea);
408 ptr = (unsigned long) &data.ul[0];
409 if (sizeof(unsigned long) == 8 || nb == 4) {
411 ptr = (unsigned long)&(data.single.word);
412 err = (*func)(rn, ptr);
415 err = write_mem_unaligned(data.ul[0], ea, nb, regs);
417 /* writing a double on 32-bit */
418 err = (*func)(rn, ptr);
421 err = write_mem_unaligned(data.ul[0], ea, 4, regs);
423 err = write_mem_unaligned(data.ul[1], ea + 4, 4, regs);
429 #ifdef CONFIG_ALTIVEC
430 /* For Altivec/VMX, no need to worry about alignment */
431 static int __kprobes do_vec_load(int rn, int (*func)(int, unsigned long),
432 unsigned long ea, struct pt_regs *regs)
434 if (!address_ok(regs, ea & ~0xfUL, 16))
436 return (*func)(rn, ea);
439 static int __kprobes do_vec_store(int rn, int (*func)(int, unsigned long),
440 unsigned long ea, struct pt_regs *regs)
442 if (!address_ok(regs, ea & ~0xfUL, 16))
444 return (*func)(rn, ea);
446 #endif /* CONFIG_ALTIVEC */
449 static int __kprobes do_vsx_load(int rn, int (*func)(int, unsigned long),
450 unsigned long ea, struct pt_regs *regs)
453 unsigned long val[2];
455 if (!address_ok(regs, ea, 16))
458 return (*func)(rn, ea);
459 err = read_mem_unaligned(&val[0], ea, 8, regs);
461 err = read_mem_unaligned(&val[1], ea + 8, 8, regs);
463 err = (*func)(rn, (unsigned long) &val[0]);
467 static int __kprobes do_vsx_store(int rn, int (*func)(int, unsigned long),
468 unsigned long ea, struct pt_regs *regs)
471 unsigned long val[2];
473 if (!address_ok(regs, ea, 16))
476 return (*func)(rn, ea);
477 err = (*func)(rn, (unsigned long) &val[0]);
480 err = write_mem_unaligned(val[0], ea, 8, regs);
482 err = write_mem_unaligned(val[1], ea + 8, 8, regs);
485 #endif /* CONFIG_VSX */
487 #define __put_user_asmx(x, addr, err, op, cr) \
488 __asm__ __volatile__( \
489 "1: " op " %2,0,%3\n" \
492 ".section .fixup,\"ax\"\n" \
496 ".section __ex_table,\"a\"\n" \
497 PPC_LONG_ALIGN "\n" \
500 : "=r" (err), "=r" (cr) \
501 : "r" (x), "r" (addr), "i" (-EFAULT), "0" (err))
503 #define __get_user_asmx(x, addr, err, op) \
504 __asm__ __volatile__( \
505 "1: "op" %1,0,%2\n" \
507 ".section .fixup,\"ax\"\n" \
511 ".section __ex_table,\"a\"\n" \
512 PPC_LONG_ALIGN "\n" \
515 : "=r" (err), "=r" (x) \
516 : "r" (addr), "i" (-EFAULT), "0" (err))
518 #define __cacheop_user_asmx(addr, err, op) \
519 __asm__ __volatile__( \
522 ".section .fixup,\"ax\"\n" \
526 ".section __ex_table,\"a\"\n" \
527 PPC_LONG_ALIGN "\n" \
531 : "r" (addr), "i" (-EFAULT), "0" (err))
533 static void __kprobes set_cr0(struct pt_regs *regs, int rd)
535 long val = regs->gpr[rd];
537 regs->ccr = (regs->ccr & 0x0fffffff) | ((regs->xer >> 3) & 0x10000000);
539 if (!(regs->msr & MSR_64BIT))
543 regs->ccr |= 0x80000000;
545 regs->ccr |= 0x40000000;
547 regs->ccr |= 0x20000000;
550 static void __kprobes add_with_carry(struct pt_regs *regs, int rd,
551 unsigned long val1, unsigned long val2,
552 unsigned long carry_in)
554 unsigned long val = val1 + val2;
560 if (!(regs->msr & MSR_64BIT)) {
561 val = (unsigned int) val;
562 val1 = (unsigned int) val1;
565 if (val < val1 || (carry_in && val == val1))
568 regs->xer &= ~XER_CA;
571 static void __kprobes do_cmp_signed(struct pt_regs *regs, long v1, long v2,
574 unsigned int crval, shift;
576 crval = (regs->xer >> 31) & 1; /* get SO bit */
583 shift = (7 - crfld) * 4;
584 regs->ccr = (regs->ccr & ~(0xf << shift)) | (crval << shift);
587 static void __kprobes do_cmp_unsigned(struct pt_regs *regs, unsigned long v1,
588 unsigned long v2, int crfld)
590 unsigned int crval, shift;
592 crval = (regs->xer >> 31) & 1; /* get SO bit */
599 shift = (7 - crfld) * 4;
600 regs->ccr = (regs->ccr & ~(0xf << shift)) | (crval << shift);
603 static int __kprobes trap_compare(long v1, long v2)
613 if ((unsigned long)v1 < (unsigned long)v2)
615 else if ((unsigned long)v1 > (unsigned long)v2)
621 * Elements of 32-bit rotate and mask instructions.
623 #define MASK32(mb, me) ((0xffffffffUL >> (mb)) + \
624 ((signed long)-0x80000000L >> (me)) + ((me) >= (mb)))
626 #define MASK64_L(mb) (~0UL >> (mb))
627 #define MASK64_R(me) ((signed long)-0x8000000000000000L >> (me))
628 #define MASK64(mb, me) (MASK64_L(mb) + MASK64_R(me) + ((me) >= (mb)))
629 #define DATA32(x) (((x) & 0xffffffffUL) | (((x) & 0xffffffffUL) << 32))
631 #define DATA32(x) (x)
633 #define ROTATE(x, n) ((n) ? (((x) << (n)) | ((x) >> (8 * sizeof(long) - (n)))) : (x))
636 * Decode an instruction, and execute it if that can be done just by
637 * modifying *regs (i.e. integer arithmetic and logical instructions,
638 * branches, and barrier instructions).
639 * Returns 1 if the instruction has been executed, or 0 if not.
640 * Sets *op to indicate what the instruction does.
642 int __kprobes analyse_instr(struct instruction_op *op, struct pt_regs *regs,
645 unsigned int opcode, ra, rb, rd, spr, u;
646 unsigned long int imm;
647 unsigned long int val, val2;
648 unsigned int mb, me, sh;
653 opcode = instr >> 26;
657 imm = (signed short)(instr & 0xfffc);
658 if ((instr & 2) == 0)
661 regs->nip = truncate_if_32bit(regs->msr, regs->nip);
663 regs->link = regs->nip;
664 if (branch_taken(instr, regs))
665 regs->nip = truncate_if_32bit(regs->msr, imm);
669 if ((instr & 0xfe2) == 2)
677 imm = instr & 0x03fffffc;
678 if (imm & 0x02000000)
680 if ((instr & 2) == 0)
683 regs->link = truncate_if_32bit(regs->msr, regs->nip + 4);
684 imm = truncate_if_32bit(regs->msr, imm);
688 switch ((instr >> 1) & 0x3ff) {
690 rd = (instr >> 21) & 0x1c;
691 ra = (instr >> 16) & 0x1c;
692 val = (regs->ccr >> ra) & 0xf;
693 regs->ccr = (regs->ccr & ~(0xfUL << rd)) | (val << rd);
697 case 528: /* bcctr */
699 imm = (instr & 0x400)? regs->ctr: regs->link;
700 regs->nip = truncate_if_32bit(regs->msr, regs->nip + 4);
701 imm = truncate_if_32bit(regs->msr, imm);
703 regs->link = regs->nip;
704 if (branch_taken(instr, regs))
708 case 18: /* rfid, scary */
709 if (regs->msr & MSR_PR)
714 case 150: /* isync */
720 case 129: /* crandc */
721 case 193: /* crxor */
722 case 225: /* crnand */
723 case 257: /* crand */
724 case 289: /* creqv */
725 case 417: /* crorc */
727 ra = (instr >> 16) & 0x1f;
728 rb = (instr >> 11) & 0x1f;
729 rd = (instr >> 21) & 0x1f;
730 ra = (regs->ccr >> (31 - ra)) & 1;
731 rb = (regs->ccr >> (31 - rb)) & 1;
732 val = (instr >> (6 + ra * 2 + rb)) & 1;
733 regs->ccr = (regs->ccr & ~(1UL << (31 - rd))) |
739 switch ((instr >> 1) & 0x3ff) {
743 switch ((instr >> 21) & 3) {
745 asm volatile("lwsync" : : : "memory");
747 case 2: /* ptesync */
748 asm volatile("ptesync" : : : "memory");
755 case 854: /* eieio */
763 /* Following cases refer to regs->gpr[], so we need all regs */
764 if (!FULL_REGS(regs))
767 rd = (instr >> 21) & 0x1f;
768 ra = (instr >> 16) & 0x1f;
769 rb = (instr >> 11) & 0x1f;
774 if (rd & trap_compare(regs->gpr[ra], (short) instr))
779 if (rd & trap_compare((int)regs->gpr[ra], (short) instr))
784 regs->gpr[rd] = regs->gpr[ra] * (short) instr;
789 add_with_carry(regs, rd, ~regs->gpr[ra], imm, 1);
793 imm = (unsigned short) instr;
797 val = (unsigned int) val;
799 do_cmp_unsigned(regs, val, imm, rd >> 2);
809 do_cmp_signed(regs, val, imm, rd >> 2);
814 add_with_carry(regs, rd, regs->gpr[ra], imm, 0);
817 case 13: /* addic. */
819 add_with_carry(regs, rd, regs->gpr[ra], imm, 0);
826 imm += regs->gpr[ra];
831 imm = ((short) instr) << 16;
833 imm += regs->gpr[ra];
837 case 20: /* rlwimi */
838 mb = (instr >> 6) & 0x1f;
839 me = (instr >> 1) & 0x1f;
840 val = DATA32(regs->gpr[rd]);
841 imm = MASK32(mb, me);
842 regs->gpr[ra] = (regs->gpr[ra] & ~imm) | (ROTATE(val, rb) & imm);
845 case 21: /* rlwinm */
846 mb = (instr >> 6) & 0x1f;
847 me = (instr >> 1) & 0x1f;
848 val = DATA32(regs->gpr[rd]);
849 regs->gpr[ra] = ROTATE(val, rb) & MASK32(mb, me);
853 mb = (instr >> 6) & 0x1f;
854 me = (instr >> 1) & 0x1f;
855 rb = regs->gpr[rb] & 0x1f;
856 val = DATA32(regs->gpr[rd]);
857 regs->gpr[ra] = ROTATE(val, rb) & MASK32(mb, me);
861 imm = (unsigned short) instr;
862 regs->gpr[ra] = regs->gpr[rd] | imm;
866 imm = (unsigned short) instr;
867 regs->gpr[ra] = regs->gpr[rd] | (imm << 16);
871 imm = (unsigned short) instr;
872 regs->gpr[ra] = regs->gpr[rd] ^ imm;
876 imm = (unsigned short) instr;
877 regs->gpr[ra] = regs->gpr[rd] ^ (imm << 16);
881 imm = (unsigned short) instr;
882 regs->gpr[ra] = regs->gpr[rd] & imm;
886 case 29: /* andis. */
887 imm = (unsigned short) instr;
888 regs->gpr[ra] = regs->gpr[rd] & (imm << 16);
894 mb = ((instr >> 6) & 0x1f) | (instr & 0x20);
896 if ((instr & 0x10) == 0) {
897 sh = rb | ((instr & 2) << 4);
898 val = ROTATE(val, sh);
899 switch ((instr >> 2) & 3) {
901 regs->gpr[ra] = val & MASK64_L(mb);
904 regs->gpr[ra] = val & MASK64_R(mb);
907 regs->gpr[ra] = val & MASK64(mb, 63 - sh);
910 imm = MASK64(mb, 63 - sh);
911 regs->gpr[ra] = (regs->gpr[ra] & ~imm) |
916 sh = regs->gpr[rb] & 0x3f;
917 val = ROTATE(val, sh);
918 switch ((instr >> 1) & 7) {
920 regs->gpr[ra] = val & MASK64_L(mb);
923 regs->gpr[ra] = val & MASK64_R(mb);
928 break; /* illegal instruction */
931 switch ((instr >> 1) & 0x3ff) {
934 (rd & trap_compare((int)regs->gpr[ra],
935 (int)regs->gpr[rb])))
940 if (rd & trap_compare(regs->gpr[ra], regs->gpr[rb]))
945 if (regs->msr & MSR_PR)
950 case 146: /* mtmsr */
951 if (regs->msr & MSR_PR)
955 op->val = 0xffffffff & ~(MSR_ME | MSR_LE);
958 case 178: /* mtmsrd */
959 if (regs->msr & MSR_PR)
963 /* only MSR_EE and MSR_RI get changed if bit 15 set */
964 /* mtmsrd doesn't change MSR_HV, MSR_ME or MSR_LE */
965 imm = (instr & 0x10000)? 0x8002: 0xefffffffffffeffeUL;
971 regs->gpr[rd] = regs->ccr;
972 regs->gpr[rd] &= 0xffffffffUL;
975 case 144: /* mtcrf */
978 for (sh = 0; sh < 8; ++sh) {
979 if (instr & (0x80000 >> sh))
980 regs->ccr = (regs->ccr & ~imm) |
986 case 339: /* mfspr */
987 spr = ((instr >> 16) & 0x1f) | ((instr >> 6) & 0x3e0);
989 case SPRN_XER: /* mfxer */
990 regs->gpr[rd] = regs->xer;
991 regs->gpr[rd] &= 0xffffffffUL;
993 case SPRN_LR: /* mflr */
994 regs->gpr[rd] = regs->link;
996 case SPRN_CTR: /* mfctr */
997 regs->gpr[rd] = regs->ctr;
1007 case 467: /* mtspr */
1008 spr = ((instr >> 16) & 0x1f) | ((instr >> 6) & 0x3e0);
1010 case SPRN_XER: /* mtxer */
1011 regs->xer = (regs->gpr[rd] & 0xffffffffUL);
1013 case SPRN_LR: /* mtlr */
1014 regs->link = regs->gpr[rd];
1016 case SPRN_CTR: /* mtctr */
1017 regs->ctr = regs->gpr[rd];
1021 op->val = regs->gpr[rd];
1028 * Compare instructions
1031 val = regs->gpr[ra];
1032 val2 = regs->gpr[rb];
1033 #ifdef __powerpc64__
1034 if ((rd & 1) == 0) {
1035 /* word (32-bit) compare */
1040 do_cmp_signed(regs, val, val2, rd >> 2);
1044 val = regs->gpr[ra];
1045 val2 = regs->gpr[rb];
1046 #ifdef __powerpc64__
1047 if ((rd & 1) == 0) {
1048 /* word (32-bit) compare */
1049 val = (unsigned int) val;
1050 val2 = (unsigned int) val2;
1053 do_cmp_unsigned(regs, val, val2, rd >> 2);
1057 * Arithmetic instructions
1060 add_with_carry(regs, rd, ~regs->gpr[ra],
1063 #ifdef __powerpc64__
1064 case 9: /* mulhdu */
1065 asm("mulhdu %0,%1,%2" : "=r" (regs->gpr[rd]) :
1066 "r" (regs->gpr[ra]), "r" (regs->gpr[rb]));
1070 add_with_carry(regs, rd, regs->gpr[ra],
1074 case 11: /* mulhwu */
1075 asm("mulhwu %0,%1,%2" : "=r" (regs->gpr[rd]) :
1076 "r" (regs->gpr[ra]), "r" (regs->gpr[rb]));
1080 regs->gpr[rd] = regs->gpr[rb] - regs->gpr[ra];
1082 #ifdef __powerpc64__
1083 case 73: /* mulhd */
1084 asm("mulhd %0,%1,%2" : "=r" (regs->gpr[rd]) :
1085 "r" (regs->gpr[ra]), "r" (regs->gpr[rb]));
1088 case 75: /* mulhw */
1089 asm("mulhw %0,%1,%2" : "=r" (regs->gpr[rd]) :
1090 "r" (regs->gpr[ra]), "r" (regs->gpr[rb]));
1094 regs->gpr[rd] = -regs->gpr[ra];
1097 case 136: /* subfe */
1098 add_with_carry(regs, rd, ~regs->gpr[ra], regs->gpr[rb],
1099 regs->xer & XER_CA);
1102 case 138: /* adde */
1103 add_with_carry(regs, rd, regs->gpr[ra], regs->gpr[rb],
1104 regs->xer & XER_CA);
1107 case 200: /* subfze */
1108 add_with_carry(regs, rd, ~regs->gpr[ra], 0L,
1109 regs->xer & XER_CA);
1112 case 202: /* addze */
1113 add_with_carry(regs, rd, regs->gpr[ra], 0L,
1114 regs->xer & XER_CA);
1117 case 232: /* subfme */
1118 add_with_carry(regs, rd, ~regs->gpr[ra], -1L,
1119 regs->xer & XER_CA);
1121 #ifdef __powerpc64__
1122 case 233: /* mulld */
1123 regs->gpr[rd] = regs->gpr[ra] * regs->gpr[rb];
1126 case 234: /* addme */
1127 add_with_carry(regs, rd, regs->gpr[ra], -1L,
1128 regs->xer & XER_CA);
1131 case 235: /* mullw */
1132 regs->gpr[rd] = (unsigned int) regs->gpr[ra] *
1133 (unsigned int) regs->gpr[rb];
1137 regs->gpr[rd] = regs->gpr[ra] + regs->gpr[rb];
1139 #ifdef __powerpc64__
1140 case 457: /* divdu */
1141 regs->gpr[rd] = regs->gpr[ra] / regs->gpr[rb];
1144 case 459: /* divwu */
1145 regs->gpr[rd] = (unsigned int) regs->gpr[ra] /
1146 (unsigned int) regs->gpr[rb];
1148 #ifdef __powerpc64__
1149 case 489: /* divd */
1150 regs->gpr[rd] = (long int) regs->gpr[ra] /
1151 (long int) regs->gpr[rb];
1154 case 491: /* divw */
1155 regs->gpr[rd] = (int) regs->gpr[ra] /
1156 (int) regs->gpr[rb];
1161 * Logical instructions
1163 case 26: /* cntlzw */
1164 asm("cntlzw %0,%1" : "=r" (regs->gpr[ra]) :
1165 "r" (regs->gpr[rd]));
1167 #ifdef __powerpc64__
1168 case 58: /* cntlzd */
1169 asm("cntlzd %0,%1" : "=r" (regs->gpr[ra]) :
1170 "r" (regs->gpr[rd]));
1174 regs->gpr[ra] = regs->gpr[rd] & regs->gpr[rb];
1178 regs->gpr[ra] = regs->gpr[rd] & ~regs->gpr[rb];
1182 regs->gpr[ra] = ~(regs->gpr[rd] | regs->gpr[rb]);
1186 regs->gpr[ra] = ~(regs->gpr[rd] ^ regs->gpr[rb]);
1190 regs->gpr[ra] = regs->gpr[rd] ^ regs->gpr[rb];
1194 regs->gpr[ra] = regs->gpr[rd] | ~regs->gpr[rb];
1198 regs->gpr[ra] = regs->gpr[rd] | regs->gpr[rb];
1201 case 476: /* nand */
1202 regs->gpr[ra] = ~(regs->gpr[rd] & regs->gpr[rb]);
1205 case 922: /* extsh */
1206 regs->gpr[ra] = (signed short) regs->gpr[rd];
1209 case 954: /* extsb */
1210 regs->gpr[ra] = (signed char) regs->gpr[rd];
1212 #ifdef __powerpc64__
1213 case 986: /* extsw */
1214 regs->gpr[ra] = (signed int) regs->gpr[rd];
1219 * Shift instructions
1222 sh = regs->gpr[rb] & 0x3f;
1224 regs->gpr[ra] = (regs->gpr[rd] << sh) & 0xffffffffUL;
1230 sh = regs->gpr[rb] & 0x3f;
1232 regs->gpr[ra] = (regs->gpr[rd] & 0xffffffffUL) >> sh;
1237 case 792: /* sraw */
1238 sh = regs->gpr[rb] & 0x3f;
1239 ival = (signed int) regs->gpr[rd];
1240 regs->gpr[ra] = ival >> (sh < 32 ? sh : 31);
1241 if (ival < 0 && (sh >= 32 || (ival & ((1ul << sh) - 1)) != 0))
1242 regs->xer |= XER_CA;
1244 regs->xer &= ~XER_CA;
1247 case 824: /* srawi */
1249 ival = (signed int) regs->gpr[rd];
1250 regs->gpr[ra] = ival >> sh;
1251 if (ival < 0 && (ival & ((1ul << sh) - 1)) != 0)
1252 regs->xer |= XER_CA;
1254 regs->xer &= ~XER_CA;
1257 #ifdef __powerpc64__
1259 sh = regs->gpr[rb] & 0x7f;
1261 regs->gpr[ra] = regs->gpr[rd] << sh;
1267 sh = regs->gpr[rb] & 0x7f;
1269 regs->gpr[ra] = regs->gpr[rd] >> sh;
1274 case 794: /* srad */
1275 sh = regs->gpr[rb] & 0x7f;
1276 ival = (signed long int) regs->gpr[rd];
1277 regs->gpr[ra] = ival >> (sh < 64 ? sh : 63);
1278 if (ival < 0 && (sh >= 64 || (ival & ((1ul << sh) - 1)) != 0))
1279 regs->xer |= XER_CA;
1281 regs->xer &= ~XER_CA;
1284 case 826: /* sradi with sh_5 = 0 */
1285 case 827: /* sradi with sh_5 = 1 */
1286 sh = rb | ((instr & 2) << 4);
1287 ival = (signed long int) regs->gpr[rd];
1288 regs->gpr[ra] = ival >> sh;
1289 if (ival < 0 && (ival & ((1ul << sh) - 1)) != 0)
1290 regs->xer |= XER_CA;
1292 regs->xer &= ~XER_CA;
1294 #endif /* __powerpc64__ */
1297 * Cache instructions
1299 case 54: /* dcbst */
1300 op->type = MKOP(CACHEOP, DCBST, 0);
1301 op->ea = xform_ea(instr, regs);
1305 op->type = MKOP(CACHEOP, DCBF, 0);
1306 op->ea = xform_ea(instr, regs);
1309 case 246: /* dcbtst */
1310 op->type = MKOP(CACHEOP, DCBTST, 0);
1311 op->ea = xform_ea(instr, regs);
1315 case 278: /* dcbt */
1316 op->type = MKOP(CACHEOP, DCBTST, 0);
1317 op->ea = xform_ea(instr, regs);
1321 case 982: /* icbi */
1322 op->type = MKOP(CACHEOP, ICBI, 0);
1323 op->ea = xform_ea(instr, regs);
1333 op->update_reg = ra;
1335 op->val = regs->gpr[rd];
1336 u = (instr >> 20) & UPDATE;
1341 op->ea = xform_ea(instr, regs);
1342 switch ((instr >> 1) & 0x3ff) {
1343 case 20: /* lwarx */
1344 op->type = MKOP(LARX, 0, 4);
1347 case 150: /* stwcx. */
1348 op->type = MKOP(STCX, 0, 4);
1351 #ifdef __powerpc64__
1352 case 84: /* ldarx */
1353 op->type = MKOP(LARX, 0, 8);
1356 case 214: /* stdcx. */
1357 op->type = MKOP(STCX, 0, 8);
1362 op->type = MKOP(LOAD, u, 8);
1367 case 55: /* lwzux */
1368 op->type = MKOP(LOAD, u, 4);
1372 case 119: /* lbzux */
1373 op->type = MKOP(LOAD, u, 1);
1376 #ifdef CONFIG_ALTIVEC
1378 case 359: /* lvxl */
1379 if (!(regs->msr & MSR_VEC))
1381 op->type = MKOP(LOAD_VMX, 0, 16);
1384 case 231: /* stvx */
1385 case 487: /* stvxl */
1386 if (!(regs->msr & MSR_VEC))
1388 op->type = MKOP(STORE_VMX, 0, 16);
1390 #endif /* CONFIG_ALTIVEC */
1392 #ifdef __powerpc64__
1393 case 149: /* stdx */
1394 case 181: /* stdux */
1395 op->type = MKOP(STORE, u, 8);
1399 case 151: /* stwx */
1400 case 183: /* stwux */
1401 op->type = MKOP(STORE, u, 4);
1404 case 215: /* stbx */
1405 case 247: /* stbux */
1406 op->type = MKOP(STORE, u, 1);
1409 case 279: /* lhzx */
1410 case 311: /* lhzux */
1411 op->type = MKOP(LOAD, u, 2);
1414 #ifdef __powerpc64__
1415 case 341: /* lwax */
1416 case 373: /* lwaux */
1417 op->type = MKOP(LOAD, SIGNEXT | u, 4);
1421 case 343: /* lhax */
1422 case 375: /* lhaux */
1423 op->type = MKOP(LOAD, SIGNEXT | u, 2);
1426 case 407: /* sthx */
1427 case 439: /* sthux */
1428 op->type = MKOP(STORE, u, 2);
1431 #ifdef __powerpc64__
1432 case 532: /* ldbrx */
1433 op->type = MKOP(LOAD, BYTEREV, 8);
1437 case 533: /* lswx */
1438 op->type = MKOP(LOAD_MULTI, 0, regs->xer & 0x7f);
1441 case 534: /* lwbrx */
1442 op->type = MKOP(LOAD, BYTEREV, 4);
1445 case 597: /* lswi */
1447 rb = 32; /* # bytes to load */
1448 op->type = MKOP(LOAD_MULTI, 0, rb);
1451 op->ea = truncate_if_32bit(regs->msr,
1455 #ifdef CONFIG_PPC_FPU
1456 case 535: /* lfsx */
1457 case 567: /* lfsux */
1458 if (!(regs->msr & MSR_FP))
1460 op->type = MKOP(LOAD_FP, u, 4);
1463 case 599: /* lfdx */
1464 case 631: /* lfdux */
1465 if (!(regs->msr & MSR_FP))
1467 op->type = MKOP(LOAD_FP, u, 8);
1470 case 663: /* stfsx */
1471 case 695: /* stfsux */
1472 if (!(regs->msr & MSR_FP))
1474 op->type = MKOP(STORE_FP, u, 4);
1477 case 727: /* stfdx */
1478 case 759: /* stfdux */
1479 if (!(regs->msr & MSR_FP))
1481 op->type = MKOP(STORE_FP, u, 8);
1485 #ifdef __powerpc64__
1486 case 660: /* stdbrx */
1487 op->type = MKOP(STORE, BYTEREV, 8);
1488 op->val = byterev_8(regs->gpr[rd]);
1492 case 661: /* stswx */
1493 op->type = MKOP(STORE_MULTI, 0, regs->xer & 0x7f);
1496 case 662: /* stwbrx */
1497 op->type = MKOP(STORE, BYTEREV, 4);
1498 op->val = byterev_4(regs->gpr[rd]);
1503 rb = 32; /* # bytes to store */
1504 op->type = MKOP(STORE_MULTI, 0, rb);
1507 op->ea = truncate_if_32bit(regs->msr,
1511 case 790: /* lhbrx */
1512 op->type = MKOP(LOAD, BYTEREV, 2);
1515 case 918: /* sthbrx */
1516 op->type = MKOP(STORE, BYTEREV, 2);
1517 op->val = byterev_2(regs->gpr[rd]);
1521 case 844: /* lxvd2x */
1522 case 876: /* lxvd2ux */
1523 if (!(regs->msr & MSR_VSX))
1525 op->reg = rd | ((instr & 1) << 5);
1526 op->type = MKOP(LOAD_VSX, u, 16);
1529 case 972: /* stxvd2x */
1530 case 1004: /* stxvd2ux */
1531 if (!(regs->msr & MSR_VSX))
1533 op->reg = rd | ((instr & 1) << 5);
1534 op->type = MKOP(STORE_VSX, u, 16);
1537 #endif /* CONFIG_VSX */
1543 op->type = MKOP(LOAD, u, 4);
1544 op->ea = dform_ea(instr, regs);
1549 op->type = MKOP(LOAD, u, 1);
1550 op->ea = dform_ea(instr, regs);
1555 op->type = MKOP(STORE, u, 4);
1556 op->ea = dform_ea(instr, regs);
1561 op->type = MKOP(STORE, u, 1);
1562 op->ea = dform_ea(instr, regs);
1567 op->type = MKOP(LOAD, u, 2);
1568 op->ea = dform_ea(instr, regs);
1573 op->type = MKOP(LOAD, SIGNEXT | u, 2);
1574 op->ea = dform_ea(instr, regs);
1579 op->type = MKOP(STORE, u, 2);
1580 op->ea = dform_ea(instr, regs);
1585 break; /* invalid form, ra in range to load */
1586 op->type = MKOP(LOAD_MULTI, 0, 4 * (32 - rd));
1587 op->ea = dform_ea(instr, regs);
1591 op->type = MKOP(STORE_MULTI, 0, 4 * (32 - rd));
1592 op->ea = dform_ea(instr, regs);
1595 #ifdef CONFIG_PPC_FPU
1598 if (!(regs->msr & MSR_FP))
1600 op->type = MKOP(LOAD_FP, u, 4);
1601 op->ea = dform_ea(instr, regs);
1606 if (!(regs->msr & MSR_FP))
1608 op->type = MKOP(LOAD_FP, u, 8);
1609 op->ea = dform_ea(instr, regs);
1613 case 53: /* stfsu */
1614 if (!(regs->msr & MSR_FP))
1616 op->type = MKOP(STORE_FP, u, 4);
1617 op->ea = dform_ea(instr, regs);
1621 case 55: /* stfdu */
1622 if (!(regs->msr & MSR_FP))
1624 op->type = MKOP(STORE_FP, u, 8);
1625 op->ea = dform_ea(instr, regs);
1629 #ifdef __powerpc64__
1630 case 58: /* ld[u], lwa */
1631 op->ea = dsform_ea(instr, regs);
1632 switch (instr & 3) {
1634 op->type = MKOP(LOAD, 0, 8);
1637 op->type = MKOP(LOAD, UPDATE, 8);
1640 op->type = MKOP(LOAD, SIGNEXT, 4);
1645 case 62: /* std[u] */
1646 op->ea = dsform_ea(instr, regs);
1647 switch (instr & 3) {
1649 op->type = MKOP(STORE, 0, 8);
1652 op->type = MKOP(STORE, UPDATE, 8);
1656 #endif /* __powerpc64__ */
1671 regs->nip = truncate_if_32bit(regs->msr, regs->nip + 4);
1675 op->type = INTERRUPT | 0x700;
1676 op->val = SRR1_PROGPRIV;
1680 op->type = INTERRUPT | 0x700;
1681 op->val = SRR1_PROGTRAP;
1684 #ifdef CONFIG_PPC_FPU
1686 op->type = INTERRUPT | 0x800;
1690 #ifdef CONFIG_ALTIVEC
1692 op->type = INTERRUPT | 0xf20;
1698 op->type = INTERRUPT | 0xf40;
1702 EXPORT_SYMBOL_GPL(analyse_instr);
1705 * For PPC32 we always use stwu with r1 to change the stack pointer.
1706 * So this emulated store may corrupt the exception frame, now we
1707 * have to provide the exception frame trampoline, which is pushed
1708 * below the kprobed function stack. So we only update gpr[1] but
1709 * don't emulate the real store operation. We will do real store
1710 * operation safely in exception return code by checking this flag.
1712 static __kprobes int handle_stack_update(unsigned long ea, struct pt_regs *regs)
1716 * Check if we will touch kernel stack overflow
1718 if (ea - STACK_INT_FRAME_SIZE <= current->thread.ksp_limit) {
1719 printk(KERN_CRIT "Can't kprobe this since kernel stack would overflow.\n");
1722 #endif /* CONFIG_PPC32 */
1724 * Check if we already set since that means we'll
1725 * lose the previous value.
1727 WARN_ON(test_thread_flag(TIF_EMULATE_STACK_STORE));
1728 set_thread_flag(TIF_EMULATE_STACK_STORE);
1732 static __kprobes void do_signext(unsigned long *valp, int size)
1736 *valp = (signed short) *valp;
1739 *valp = (signed int) *valp;
1744 static __kprobes void do_byterev(unsigned long *valp, int size)
1748 *valp = byterev_2(*valp);
1751 *valp = byterev_4(*valp);
1753 #ifdef __powerpc64__
1755 *valp = byterev_8(*valp);
1762 * Emulate instructions that cause a transfer of control,
1763 * loads and stores, and a few other instructions.
1764 * Returns 1 if the step was emulated, 0 if not,
1765 * or -1 if the instruction is one that should not be stepped,
1766 * such as an rfid, or a mtmsrd that would clear MSR_RI.
1768 int __kprobes emulate_step(struct pt_regs *regs, unsigned int instr)
1770 struct instruction_op op;
1776 r = analyse_instr(&op, regs, instr);
1781 size = GETSIZE(op.type);
1782 switch (op.type & INSTR_TYPE_MASK) {
1784 if (!address_ok(regs, op.ea, 8))
1786 switch (op.type & CACHEOP_MASK) {
1788 __cacheop_user_asmx(op.ea, err, "dcbst");
1791 __cacheop_user_asmx(op.ea, err, "dcbf");
1795 prefetchw((void *) op.ea);
1799 prefetch((void *) op.ea);
1802 __cacheop_user_asmx(op.ea, err, "icbi");
1810 if (regs->msr & MSR_LE)
1812 if (op.ea & (size - 1))
1813 break; /* can't handle misaligned */
1815 if (!address_ok(regs, op.ea, size))
1820 __get_user_asmx(val, op.ea, err, "lwarx");
1822 #ifdef __powerpc64__
1824 __get_user_asmx(val, op.ea, err, "ldarx");
1831 regs->gpr[op.reg] = val;
1835 if (regs->msr & MSR_LE)
1837 if (op.ea & (size - 1))
1838 break; /* can't handle misaligned */
1840 if (!address_ok(regs, op.ea, size))
1845 __put_user_asmx(op.val, op.ea, err, "stwcx.", cr);
1847 #ifdef __powerpc64__
1849 __put_user_asmx(op.val, op.ea, err, "stdcx.", cr);
1856 regs->ccr = (regs->ccr & 0x0fffffff) |
1858 ((regs->xer >> 3) & 0x10000000);
1862 if (regs->msr & MSR_LE)
1864 err = read_mem(®s->gpr[op.reg], op.ea, size, regs);
1866 if (op.type & SIGNEXT)
1867 do_signext(®s->gpr[op.reg], size);
1868 if (op.type & BYTEREV)
1869 do_byterev(®s->gpr[op.reg], size);
1873 #ifdef CONFIG_PPC_FPU
1875 if (regs->msr & MSR_LE)
1878 err = do_fp_load(op.reg, do_lfs, op.ea, size, regs);
1880 err = do_fp_load(op.reg, do_lfd, op.ea, size, regs);
1883 #ifdef CONFIG_ALTIVEC
1885 if (regs->msr & MSR_LE)
1887 err = do_vec_load(op.reg, do_lvx, op.ea & ~0xfUL, regs);
1892 if (regs->msr & MSR_LE)
1894 err = do_vsx_load(op.reg, do_lxvd2x, op.ea, regs);
1898 if (regs->msr & MSR_LE)
1901 for (i = 0; i < size; i += 4) {
1905 err = read_mem(®s->gpr[rd], op.ea, nb, regs);
1908 if (nb < 4) /* left-justify last bytes */
1909 regs->gpr[rd] <<= 32 - 8 * nb;
1916 if (regs->msr & MSR_LE)
1918 if ((op.type & UPDATE) && size == sizeof(long) &&
1919 op.reg == 1 && op.update_reg == 1 &&
1920 !(regs->msr & MSR_PR) &&
1921 op.ea >= regs->gpr[1] - STACK_INT_FRAME_SIZE) {
1922 err = handle_stack_update(op.ea, regs);
1925 err = write_mem(op.val, op.ea, size, regs);
1928 #ifdef CONFIG_PPC_FPU
1930 if (regs->msr & MSR_LE)
1933 err = do_fp_store(op.reg, do_stfs, op.ea, size, regs);
1935 err = do_fp_store(op.reg, do_stfd, op.ea, size, regs);
1938 #ifdef CONFIG_ALTIVEC
1940 if (regs->msr & MSR_LE)
1942 err = do_vec_store(op.reg, do_stvx, op.ea & ~0xfUL, regs);
1947 if (regs->msr & MSR_LE)
1949 err = do_vsx_store(op.reg, do_stxvd2x, op.ea, regs);
1953 if (regs->msr & MSR_LE)
1956 for (i = 0; i < size; i += 4) {
1957 val = regs->gpr[rd];
1962 val >>= 32 - 8 * nb;
1963 err = write_mem(val, op.ea, nb, regs);
1972 regs->gpr[op.reg] = regs->msr & MSR_MASK;
1976 val = regs->gpr[op.reg];
1977 if ((val & MSR_RI) == 0)
1978 /* can't step mtmsr[d] that would clear MSR_RI */
1980 /* here op.val is the mask of bits to change */
1981 regs->msr = (regs->msr & ~op.val) | (val & op.val);
1985 case SYSCALL: /* sc */
1987 * N.B. this uses knowledge about how the syscall
1988 * entry code works. If that is changed, this will
1989 * need to be changed also.
1991 if (regs->gpr[0] == 0x1ebe &&
1992 cpu_has_feature(CPU_FTR_REAL_LE)) {
1993 regs->msr ^= MSR_LE;
1996 regs->gpr[9] = regs->gpr[13];
1997 regs->gpr[10] = MSR_KERNEL;
1998 regs->gpr[11] = regs->nip + 4;
1999 regs->gpr[12] = regs->msr & MSR_MASK;
2000 regs->gpr[13] = (unsigned long) get_paca();
2001 regs->nip = (unsigned long) &system_call_common;
2002 regs->msr = MSR_KERNEL;
2014 if (op.type & UPDATE)
2015 regs->gpr[op.update_reg] = op.ea;
2018 regs->nip = truncate_if_32bit(regs->msr, regs->nip + 4);