4 * Copyright (C) 2004 Paul Mackerras <paulus@au.ibm.com>, IBM
6 * This program is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU General Public License
8 * as published by the Free Software Foundation; either version
9 * 2 of the License, or (at your option) any later version.
11 #include <linux/kernel.h>
12 #include <linux/kprobes.h>
13 #include <linux/ptrace.h>
14 #include <linux/prefetch.h>
15 #include <asm/sstep.h>
16 #include <asm/processor.h>
17 #include <asm/uaccess.h>
18 #include <asm/cputable.h>
20 extern char system_call_common[];
23 /* Bits in SRR1 that are copied from MSR */
24 #define MSR_MASK 0xffffffff87c0ffffUL
26 #define MSR_MASK 0x87c0ffff
30 #define XER_SO 0x80000000U
31 #define XER_OV 0x40000000U
32 #define XER_CA 0x20000000U
36 * Functions in ldstfp.S
38 extern int do_lfs(int rn, unsigned long ea);
39 extern int do_lfd(int rn, unsigned long ea);
40 extern int do_stfs(int rn, unsigned long ea);
41 extern int do_stfd(int rn, unsigned long ea);
42 extern int do_lvx(int rn, unsigned long ea);
43 extern int do_stvx(int rn, unsigned long ea);
44 extern int do_lxvd2x(int rn, unsigned long ea);
45 extern int do_stxvd2x(int rn, unsigned long ea);
49 * Emulate the truncation of 64 bit values in 32-bit mode.
51 static unsigned long truncate_if_32bit(unsigned long msr, unsigned long val)
54 if ((msr & MSR_64BIT) == 0)
61 * Determine whether a conditional branch instruction would branch.
63 static int __kprobes branch_taken(unsigned int instr, struct pt_regs *regs)
65 unsigned int bo = (instr >> 21) & 0x1f;
69 /* decrement counter */
71 if (((bo >> 1) & 1) ^ (regs->ctr == 0))
74 if ((bo & 0x10) == 0) {
75 /* check bit from CR */
76 bi = (instr >> 16) & 0x1f;
77 if (((regs->ccr >> (31 - bi)) & 1) != ((bo >> 3) & 1))
84 static long __kprobes address_ok(struct pt_regs *regs, unsigned long ea, int nb)
88 return __access_ok(ea, nb, USER_DS);
92 * Calculate effective address for a D-form instruction
94 static unsigned long __kprobes dform_ea(unsigned int instr, struct pt_regs *regs)
99 ra = (instr >> 16) & 0x1f;
100 ea = (signed short) instr; /* sign-extend */
104 return truncate_if_32bit(regs->msr, ea);
109 * Calculate effective address for a DS-form instruction
111 static unsigned long __kprobes dsform_ea(unsigned int instr, struct pt_regs *regs)
116 ra = (instr >> 16) & 0x1f;
117 ea = (signed short) (instr & ~3); /* sign-extend */
121 return truncate_if_32bit(regs->msr, ea);
123 #endif /* __powerpc64 */
126 * Calculate effective address for an X-form instruction
128 static unsigned long __kprobes xform_ea(unsigned int instr,
129 struct pt_regs *regs)
134 ra = (instr >> 16) & 0x1f;
135 rb = (instr >> 11) & 0x1f;
140 return truncate_if_32bit(regs->msr, ea);
144 * Return the largest power of 2, not greater than sizeof(unsigned long),
145 * such that x is a multiple of it.
147 static inline unsigned long max_align(unsigned long x)
149 x |= sizeof(unsigned long);
150 return x & -x; /* isolates rightmost bit */
154 static inline unsigned long byterev_2(unsigned long x)
156 return ((x >> 8) & 0xff) | ((x & 0xff) << 8);
159 static inline unsigned long byterev_4(unsigned long x)
161 return ((x >> 24) & 0xff) | ((x >> 8) & 0xff00) |
162 ((x & 0xff00) << 8) | ((x & 0xff) << 24);
166 static inline unsigned long byterev_8(unsigned long x)
168 return (byterev_4(x) << 32) | byterev_4(x >> 32);
172 static int __kprobes read_mem_aligned(unsigned long *dest, unsigned long ea,
180 err = __get_user(x, (unsigned char __user *) ea);
183 err = __get_user(x, (unsigned short __user *) ea);
186 err = __get_user(x, (unsigned int __user *) ea);
190 err = __get_user(x, (unsigned long __user *) ea);
199 static int __kprobes read_mem_unaligned(unsigned long *dest, unsigned long ea,
200 int nb, struct pt_regs *regs)
203 unsigned long x, b, c;
204 #ifdef __LITTLE_ENDIAN__
205 int len = nb; /* save a copy of the length for byte reversal */
208 /* unaligned, do this in pieces */
210 for (; nb > 0; nb -= c) {
211 #ifdef __LITTLE_ENDIAN__
214 #ifdef __BIG_ENDIAN__
219 err = read_mem_aligned(&b, ea, c);
222 x = (x << (8 * c)) + b;
225 #ifdef __LITTLE_ENDIAN__
228 *dest = byterev_2(x);
231 *dest = byterev_4(x);
235 *dest = byterev_8(x);
240 #ifdef __BIG_ENDIAN__
247 * Read memory at address ea for nb bytes, return 0 for success
248 * or -EFAULT if an error occurred.
250 static int __kprobes read_mem(unsigned long *dest, unsigned long ea, int nb,
251 struct pt_regs *regs)
253 if (!address_ok(regs, ea, nb))
255 if ((ea & (nb - 1)) == 0)
256 return read_mem_aligned(dest, ea, nb);
257 return read_mem_unaligned(dest, ea, nb, regs);
260 static int __kprobes write_mem_aligned(unsigned long val, unsigned long ea,
267 err = __put_user(val, (unsigned char __user *) ea);
270 err = __put_user(val, (unsigned short __user *) ea);
273 err = __put_user(val, (unsigned int __user *) ea);
277 err = __put_user(val, (unsigned long __user *) ea);
284 static int __kprobes write_mem_unaligned(unsigned long val, unsigned long ea,
285 int nb, struct pt_regs *regs)
290 #ifdef __LITTLE_ENDIAN__
293 val = byterev_2(val);
296 val = byterev_4(val);
300 val = byterev_8(val);
305 /* unaligned or little-endian, do this in pieces */
306 for (; nb > 0; nb -= c) {
307 #ifdef __LITTLE_ENDIAN__
310 #ifdef __BIG_ENDIAN__
315 err = write_mem_aligned(val >> (nb - c) * 8, ea, c);
324 * Write memory at address ea for nb bytes, return 0 for success
325 * or -EFAULT if an error occurred.
327 static int __kprobes write_mem(unsigned long val, unsigned long ea, int nb,
328 struct pt_regs *regs)
330 if (!address_ok(regs, ea, nb))
332 if ((ea & (nb - 1)) == 0)
333 return write_mem_aligned(val, ea, nb);
334 return write_mem_unaligned(val, ea, nb, regs);
337 #ifdef CONFIG_PPC_FPU
339 * Check the address and alignment, and call func to do the actual
342 static int __kprobes do_fp_load(int rn, int (*func)(int, unsigned long),
343 unsigned long ea, int nb,
344 struct pt_regs *regs)
351 #ifdef __BIG_ENDIAN__
355 #ifdef __LITTLE_ENDIAN__
363 if (!address_ok(regs, ea, nb))
366 return (*func)(rn, ea);
367 ptr = (unsigned long) &data.ul;
368 if (sizeof(unsigned long) == 8 || nb == 4) {
369 err = read_mem_unaligned(&data.ul[0], ea, nb, regs);
371 ptr = (unsigned long)&(data.single.word);
373 /* reading a double on 32-bit */
374 err = read_mem_unaligned(&data.ul[0], ea, 4, regs);
376 err = read_mem_unaligned(&data.ul[1], ea + 4, 4, regs);
380 return (*func)(rn, ptr);
383 static int __kprobes do_fp_store(int rn, int (*func)(int, unsigned long),
384 unsigned long ea, int nb,
385 struct pt_regs *regs)
392 #ifdef __BIG_ENDIAN__
396 #ifdef __LITTLE_ENDIAN__
404 if (!address_ok(regs, ea, nb))
407 return (*func)(rn, ea);
408 ptr = (unsigned long) &data.ul[0];
409 if (sizeof(unsigned long) == 8 || nb == 4) {
411 ptr = (unsigned long)&(data.single.word);
412 err = (*func)(rn, ptr);
415 err = write_mem_unaligned(data.ul[0], ea, nb, regs);
417 /* writing a double on 32-bit */
418 err = (*func)(rn, ptr);
421 err = write_mem_unaligned(data.ul[0], ea, 4, regs);
423 err = write_mem_unaligned(data.ul[1], ea + 4, 4, regs);
429 #ifdef CONFIG_ALTIVEC
430 /* For Altivec/VMX, no need to worry about alignment */
431 static int __kprobes do_vec_load(int rn, int (*func)(int, unsigned long),
432 unsigned long ea, struct pt_regs *regs)
434 if (!address_ok(regs, ea & ~0xfUL, 16))
436 return (*func)(rn, ea);
439 static int __kprobes do_vec_store(int rn, int (*func)(int, unsigned long),
440 unsigned long ea, struct pt_regs *regs)
442 if (!address_ok(regs, ea & ~0xfUL, 16))
444 return (*func)(rn, ea);
446 #endif /* CONFIG_ALTIVEC */
449 static int __kprobes do_vsx_load(int rn, int (*func)(int, unsigned long),
450 unsigned long ea, struct pt_regs *regs)
453 unsigned long val[2];
455 if (!address_ok(regs, ea, 16))
458 return (*func)(rn, ea);
459 err = read_mem_unaligned(&val[0], ea, 8, regs);
461 err = read_mem_unaligned(&val[1], ea + 8, 8, regs);
463 err = (*func)(rn, (unsigned long) &val[0]);
467 static int __kprobes do_vsx_store(int rn, int (*func)(int, unsigned long),
468 unsigned long ea, struct pt_regs *regs)
471 unsigned long val[2];
473 if (!address_ok(regs, ea, 16))
476 return (*func)(rn, ea);
477 err = (*func)(rn, (unsigned long) &val[0]);
480 err = write_mem_unaligned(val[0], ea, 8, regs);
482 err = write_mem_unaligned(val[1], ea + 8, 8, regs);
485 #endif /* CONFIG_VSX */
487 #define __put_user_asmx(x, addr, err, op, cr) \
488 __asm__ __volatile__( \
489 "1: " op " %2,0,%3\n" \
492 ".section .fixup,\"ax\"\n" \
496 ".section __ex_table,\"a\"\n" \
497 PPC_LONG_ALIGN "\n" \
500 : "=r" (err), "=r" (cr) \
501 : "r" (x), "r" (addr), "i" (-EFAULT), "0" (err))
503 #define __get_user_asmx(x, addr, err, op) \
504 __asm__ __volatile__( \
505 "1: "op" %1,0,%2\n" \
507 ".section .fixup,\"ax\"\n" \
511 ".section __ex_table,\"a\"\n" \
512 PPC_LONG_ALIGN "\n" \
515 : "=r" (err), "=r" (x) \
516 : "r" (addr), "i" (-EFAULT), "0" (err))
518 #define __cacheop_user_asmx(addr, err, op) \
519 __asm__ __volatile__( \
522 ".section .fixup,\"ax\"\n" \
526 ".section __ex_table,\"a\"\n" \
527 PPC_LONG_ALIGN "\n" \
531 : "r" (addr), "i" (-EFAULT), "0" (err))
533 static void __kprobes set_cr0(struct pt_regs *regs, int rd)
535 long val = regs->gpr[rd];
537 regs->ccr = (regs->ccr & 0x0fffffff) | ((regs->xer >> 3) & 0x10000000);
539 if (!(regs->msr & MSR_64BIT))
543 regs->ccr |= 0x80000000;
545 regs->ccr |= 0x40000000;
547 regs->ccr |= 0x20000000;
550 static void __kprobes add_with_carry(struct pt_regs *regs, int rd,
551 unsigned long val1, unsigned long val2,
552 unsigned long carry_in)
554 unsigned long val = val1 + val2;
560 if (!(regs->msr & MSR_64BIT)) {
561 val = (unsigned int) val;
562 val1 = (unsigned int) val1;
565 if (val < val1 || (carry_in && val == val1))
568 regs->xer &= ~XER_CA;
571 static void __kprobes do_cmp_signed(struct pt_regs *regs, long v1, long v2,
574 unsigned int crval, shift;
576 crval = (regs->xer >> 31) & 1; /* get SO bit */
583 shift = (7 - crfld) * 4;
584 regs->ccr = (regs->ccr & ~(0xf << shift)) | (crval << shift);
587 static void __kprobes do_cmp_unsigned(struct pt_regs *regs, unsigned long v1,
588 unsigned long v2, int crfld)
590 unsigned int crval, shift;
592 crval = (regs->xer >> 31) & 1; /* get SO bit */
599 shift = (7 - crfld) * 4;
600 regs->ccr = (regs->ccr & ~(0xf << shift)) | (crval << shift);
603 static int __kprobes trap_compare(long v1, long v2)
613 if ((unsigned long)v1 < (unsigned long)v2)
615 else if ((unsigned long)v1 > (unsigned long)v2)
621 * Elements of 32-bit rotate and mask instructions.
623 #define MASK32(mb, me) ((0xffffffffUL >> (mb)) + \
624 ((signed long)-0x80000000L >> (me)) + ((me) >= (mb)))
626 #define MASK64_L(mb) (~0UL >> (mb))
627 #define MASK64_R(me) ((signed long)-0x8000000000000000L >> (me))
628 #define MASK64(mb, me) (MASK64_L(mb) + MASK64_R(me) + ((me) >= (mb)))
629 #define DATA32(x) (((x) & 0xffffffffUL) | (((x) & 0xffffffffUL) << 32))
631 #define DATA32(x) (x)
633 #define ROTATE(x, n) ((n) ? (((x) << (n)) | ((x) >> (8 * sizeof(long) - (n)))) : (x))
636 * Decode an instruction, and execute it if that can be done just by
637 * modifying *regs (i.e. integer arithmetic and logical instructions,
638 * branches, and barrier instructions).
639 * Returns 1 if the instruction has been executed, or 0 if not.
640 * Sets *op to indicate what the instruction does.
642 int __kprobes analyse_instr(struct instruction_op *op, struct pt_regs *regs,
645 unsigned int opcode, ra, rb, rd, spr, u;
646 unsigned long int imm;
647 unsigned long int val, val2;
648 unsigned int mb, me, sh;
653 opcode = instr >> 26;
657 imm = (signed short)(instr & 0xfffc);
658 if ((instr & 2) == 0)
661 regs->nip = truncate_if_32bit(regs->msr, regs->nip);
663 regs->link = regs->nip;
664 if (branch_taken(instr, regs))
665 regs->nip = truncate_if_32bit(regs->msr, imm);
669 if ((instr & 0xfe2) == 2)
677 imm = instr & 0x03fffffc;
678 if (imm & 0x02000000)
680 if ((instr & 2) == 0)
683 regs->link = truncate_if_32bit(regs->msr, regs->nip + 4);
684 imm = truncate_if_32bit(regs->msr, imm);
688 switch ((instr >> 1) & 0x3ff) {
690 rd = (instr >> 21) & 0x1c;
691 ra = (instr >> 16) & 0x1c;
692 val = (regs->ccr >> ra) & 0xf;
693 regs->ccr = (regs->ccr & ~(0xfUL << rd)) | (val << rd);
697 case 528: /* bcctr */
699 imm = (instr & 0x400)? regs->ctr: regs->link;
700 regs->nip = truncate_if_32bit(regs->msr, regs->nip + 4);
701 imm = truncate_if_32bit(regs->msr, imm);
703 regs->link = regs->nip;
704 if (branch_taken(instr, regs))
708 case 18: /* rfid, scary */
709 if (regs->msr & MSR_PR)
714 case 150: /* isync */
720 case 129: /* crandc */
721 case 193: /* crxor */
722 case 225: /* crnand */
723 case 257: /* crand */
724 case 289: /* creqv */
725 case 417: /* crorc */
727 ra = (instr >> 16) & 0x1f;
728 rb = (instr >> 11) & 0x1f;
729 rd = (instr >> 21) & 0x1f;
730 ra = (regs->ccr >> (31 - ra)) & 1;
731 rb = (regs->ccr >> (31 - rb)) & 1;
732 val = (instr >> (6 + ra * 2 + rb)) & 1;
733 regs->ccr = (regs->ccr & ~(1UL << (31 - rd))) |
739 switch ((instr >> 1) & 0x3ff) {
743 switch ((instr >> 21) & 3) {
745 asm volatile("lwsync" : : : "memory");
747 case 2: /* ptesync */
748 asm volatile("ptesync" : : : "memory");
755 case 854: /* eieio */
763 /* Following cases refer to regs->gpr[], so we need all regs */
764 if (!FULL_REGS(regs))
767 rd = (instr >> 21) & 0x1f;
768 ra = (instr >> 16) & 0x1f;
769 rb = (instr >> 11) & 0x1f;
774 if (rd & trap_compare(regs->gpr[ra], (short) instr))
779 if (rd & trap_compare((int)regs->gpr[ra], (short) instr))
784 regs->gpr[rd] = regs->gpr[ra] * (short) instr;
789 add_with_carry(regs, rd, ~regs->gpr[ra], imm, 1);
793 imm = (unsigned short) instr;
797 val = (unsigned int) val;
799 do_cmp_unsigned(regs, val, imm, rd >> 2);
809 do_cmp_signed(regs, val, imm, rd >> 2);
814 add_with_carry(regs, rd, regs->gpr[ra], imm, 0);
817 case 13: /* addic. */
819 add_with_carry(regs, rd, regs->gpr[ra], imm, 0);
826 imm += regs->gpr[ra];
831 imm = ((short) instr) << 16;
833 imm += regs->gpr[ra];
837 case 20: /* rlwimi */
838 mb = (instr >> 6) & 0x1f;
839 me = (instr >> 1) & 0x1f;
840 val = DATA32(regs->gpr[rd]);
841 imm = MASK32(mb, me);
842 regs->gpr[ra] = (regs->gpr[ra] & ~imm) | (ROTATE(val, rb) & imm);
845 case 21: /* rlwinm */
846 mb = (instr >> 6) & 0x1f;
847 me = (instr >> 1) & 0x1f;
848 val = DATA32(regs->gpr[rd]);
849 regs->gpr[ra] = ROTATE(val, rb) & MASK32(mb, me);
853 mb = (instr >> 6) & 0x1f;
854 me = (instr >> 1) & 0x1f;
855 rb = regs->gpr[rb] & 0x1f;
856 val = DATA32(regs->gpr[rd]);
857 regs->gpr[ra] = ROTATE(val, rb) & MASK32(mb, me);
861 imm = (unsigned short) instr;
862 regs->gpr[ra] = regs->gpr[rd] | imm;
866 imm = (unsigned short) instr;
867 regs->gpr[ra] = regs->gpr[rd] | (imm << 16);
871 imm = (unsigned short) instr;
872 regs->gpr[ra] = regs->gpr[rd] ^ imm;
876 imm = (unsigned short) instr;
877 regs->gpr[ra] = regs->gpr[rd] ^ (imm << 16);
881 imm = (unsigned short) instr;
882 regs->gpr[ra] = regs->gpr[rd] & imm;
886 case 29: /* andis. */
887 imm = (unsigned short) instr;
888 regs->gpr[ra] = regs->gpr[rd] & (imm << 16);
894 mb = ((instr >> 6) & 0x1f) | (instr & 0x20);
896 if ((instr & 0x10) == 0) {
897 sh = rb | ((instr & 2) << 4);
898 val = ROTATE(val, sh);
899 switch ((instr >> 2) & 3) {
901 regs->gpr[ra] = val & MASK64_L(mb);
904 regs->gpr[ra] = val & MASK64_R(mb);
907 regs->gpr[ra] = val & MASK64(mb, 63 - sh);
910 imm = MASK64(mb, 63 - sh);
911 regs->gpr[ra] = (regs->gpr[ra] & ~imm) |
916 sh = regs->gpr[rb] & 0x3f;
917 val = ROTATE(val, sh);
918 switch ((instr >> 1) & 7) {
920 regs->gpr[ra] = val & MASK64_L(mb);
923 regs->gpr[ra] = val & MASK64_R(mb);
930 switch ((instr >> 1) & 0x3ff) {
933 (rd & trap_compare((int)regs->gpr[ra],
934 (int)regs->gpr[rb])))
939 if (rd & trap_compare(regs->gpr[ra], regs->gpr[rb]))
944 if (regs->msr & MSR_PR)
949 case 146: /* mtmsr */
950 if (regs->msr & MSR_PR)
954 op->val = 0xffffffff & ~(MSR_ME | MSR_LE);
957 case 178: /* mtmsrd */
958 if (regs->msr & MSR_PR)
962 /* only MSR_EE and MSR_RI get changed if bit 15 set */
963 /* mtmsrd doesn't change MSR_HV, MSR_ME or MSR_LE */
964 imm = (instr & 0x10000)? 0x8002: 0xefffffffffffeffeUL;
970 regs->gpr[rd] = regs->ccr;
971 regs->gpr[rd] &= 0xffffffffUL;
974 case 144: /* mtcrf */
977 for (sh = 0; sh < 8; ++sh) {
978 if (instr & (0x80000 >> sh))
979 regs->ccr = (regs->ccr & ~imm) |
985 case 339: /* mfspr */
986 spr = ((instr >> 16) & 0x1f) | ((instr >> 6) & 0x3e0);
988 case SPRN_XER: /* mfxer */
989 regs->gpr[rd] = regs->xer;
990 regs->gpr[rd] &= 0xffffffffUL;
992 case SPRN_LR: /* mflr */
993 regs->gpr[rd] = regs->link;
995 case SPRN_CTR: /* mfctr */
996 regs->gpr[rd] = regs->ctr;
1006 case 467: /* mtspr */
1007 spr = ((instr >> 16) & 0x1f) | ((instr >> 6) & 0x3e0);
1009 case SPRN_XER: /* mtxer */
1010 regs->xer = (regs->gpr[rd] & 0xffffffffUL);
1012 case SPRN_LR: /* mtlr */
1013 regs->link = regs->gpr[rd];
1015 case SPRN_CTR: /* mtctr */
1016 regs->ctr = regs->gpr[rd];
1020 op->val = regs->gpr[rd];
1027 * Compare instructions
1030 val = regs->gpr[ra];
1031 val2 = regs->gpr[rb];
1032 #ifdef __powerpc64__
1033 if ((rd & 1) == 0) {
1034 /* word (32-bit) compare */
1039 do_cmp_signed(regs, val, val2, rd >> 2);
1043 val = regs->gpr[ra];
1044 val2 = regs->gpr[rb];
1045 #ifdef __powerpc64__
1046 if ((rd & 1) == 0) {
1047 /* word (32-bit) compare */
1048 val = (unsigned int) val;
1049 val2 = (unsigned int) val2;
1052 do_cmp_unsigned(regs, val, val2, rd >> 2);
1056 * Arithmetic instructions
1059 add_with_carry(regs, rd, ~regs->gpr[ra],
1062 #ifdef __powerpc64__
1063 case 9: /* mulhdu */
1064 asm("mulhdu %0,%1,%2" : "=r" (regs->gpr[rd]) :
1065 "r" (regs->gpr[ra]), "r" (regs->gpr[rb]));
1069 add_with_carry(regs, rd, regs->gpr[ra],
1073 case 11: /* mulhwu */
1074 asm("mulhwu %0,%1,%2" : "=r" (regs->gpr[rd]) :
1075 "r" (regs->gpr[ra]), "r" (regs->gpr[rb]));
1079 regs->gpr[rd] = regs->gpr[rb] - regs->gpr[ra];
1081 #ifdef __powerpc64__
1082 case 73: /* mulhd */
1083 asm("mulhd %0,%1,%2" : "=r" (regs->gpr[rd]) :
1084 "r" (regs->gpr[ra]), "r" (regs->gpr[rb]));
1087 case 75: /* mulhw */
1088 asm("mulhw %0,%1,%2" : "=r" (regs->gpr[rd]) :
1089 "r" (regs->gpr[ra]), "r" (regs->gpr[rb]));
1093 regs->gpr[rd] = -regs->gpr[ra];
1096 case 136: /* subfe */
1097 add_with_carry(regs, rd, ~regs->gpr[ra], regs->gpr[rb],
1098 regs->xer & XER_CA);
1101 case 138: /* adde */
1102 add_with_carry(regs, rd, regs->gpr[ra], regs->gpr[rb],
1103 regs->xer & XER_CA);
1106 case 200: /* subfze */
1107 add_with_carry(regs, rd, ~regs->gpr[ra], 0L,
1108 regs->xer & XER_CA);
1111 case 202: /* addze */
1112 add_with_carry(regs, rd, regs->gpr[ra], 0L,
1113 regs->xer & XER_CA);
1116 case 232: /* subfme */
1117 add_with_carry(regs, rd, ~regs->gpr[ra], -1L,
1118 regs->xer & XER_CA);
1120 #ifdef __powerpc64__
1121 case 233: /* mulld */
1122 regs->gpr[rd] = regs->gpr[ra] * regs->gpr[rb];
1125 case 234: /* addme */
1126 add_with_carry(regs, rd, regs->gpr[ra], -1L,
1127 regs->xer & XER_CA);
1130 case 235: /* mullw */
1131 regs->gpr[rd] = (unsigned int) regs->gpr[ra] *
1132 (unsigned int) regs->gpr[rb];
1136 regs->gpr[rd] = regs->gpr[ra] + regs->gpr[rb];
1138 #ifdef __powerpc64__
1139 case 457: /* divdu */
1140 regs->gpr[rd] = regs->gpr[ra] / regs->gpr[rb];
1143 case 459: /* divwu */
1144 regs->gpr[rd] = (unsigned int) regs->gpr[ra] /
1145 (unsigned int) regs->gpr[rb];
1147 #ifdef __powerpc64__
1148 case 489: /* divd */
1149 regs->gpr[rd] = (long int) regs->gpr[ra] /
1150 (long int) regs->gpr[rb];
1153 case 491: /* divw */
1154 regs->gpr[rd] = (int) regs->gpr[ra] /
1155 (int) regs->gpr[rb];
1160 * Logical instructions
1162 case 26: /* cntlzw */
1163 asm("cntlzw %0,%1" : "=r" (regs->gpr[ra]) :
1164 "r" (regs->gpr[rd]));
1166 #ifdef __powerpc64__
1167 case 58: /* cntlzd */
1168 asm("cntlzd %0,%1" : "=r" (regs->gpr[ra]) :
1169 "r" (regs->gpr[rd]));
1173 regs->gpr[ra] = regs->gpr[rd] & regs->gpr[rb];
1177 regs->gpr[ra] = regs->gpr[rd] & ~regs->gpr[rb];
1181 regs->gpr[ra] = ~(regs->gpr[rd] | regs->gpr[rb]);
1185 regs->gpr[ra] = ~(regs->gpr[rd] ^ regs->gpr[rb]);
1189 regs->gpr[ra] = regs->gpr[rd] ^ regs->gpr[rb];
1193 regs->gpr[ra] = regs->gpr[rd] | ~regs->gpr[rb];
1197 regs->gpr[ra] = regs->gpr[rd] | regs->gpr[rb];
1200 case 476: /* nand */
1201 regs->gpr[ra] = ~(regs->gpr[rd] & regs->gpr[rb]);
1204 case 922: /* extsh */
1205 regs->gpr[ra] = (signed short) regs->gpr[rd];
1208 case 954: /* extsb */
1209 regs->gpr[ra] = (signed char) regs->gpr[rd];
1211 #ifdef __powerpc64__
1212 case 986: /* extsw */
1213 regs->gpr[ra] = (signed int) regs->gpr[rd];
1218 * Shift instructions
1221 sh = regs->gpr[rb] & 0x3f;
1223 regs->gpr[ra] = (regs->gpr[rd] << sh) & 0xffffffffUL;
1229 sh = regs->gpr[rb] & 0x3f;
1231 regs->gpr[ra] = (regs->gpr[rd] & 0xffffffffUL) >> sh;
1236 case 792: /* sraw */
1237 sh = regs->gpr[rb] & 0x3f;
1238 ival = (signed int) regs->gpr[rd];
1239 regs->gpr[ra] = ival >> (sh < 32 ? sh : 31);
1240 if (ival < 0 && (sh >= 32 || (ival & ((1ul << sh) - 1)) != 0))
1241 regs->xer |= XER_CA;
1243 regs->xer &= ~XER_CA;
1246 case 824: /* srawi */
1248 ival = (signed int) regs->gpr[rd];
1249 regs->gpr[ra] = ival >> sh;
1250 if (ival < 0 && (ival & ((1ul << sh) - 1)) != 0)
1251 regs->xer |= XER_CA;
1253 regs->xer &= ~XER_CA;
1256 #ifdef __powerpc64__
1258 sh = regs->gpr[rb] & 0x7f;
1260 regs->gpr[ra] = regs->gpr[rd] << sh;
1266 sh = regs->gpr[rb] & 0x7f;
1268 regs->gpr[ra] = regs->gpr[rd] >> sh;
1273 case 794: /* srad */
1274 sh = regs->gpr[rb] & 0x7f;
1275 ival = (signed long int) regs->gpr[rd];
1276 regs->gpr[ra] = ival >> (sh < 64 ? sh : 63);
1277 if (ival < 0 && (sh >= 64 || (ival & ((1ul << sh) - 1)) != 0))
1278 regs->xer |= XER_CA;
1280 regs->xer &= ~XER_CA;
1283 case 826: /* sradi with sh_5 = 0 */
1284 case 827: /* sradi with sh_5 = 1 */
1285 sh = rb | ((instr & 2) << 4);
1286 ival = (signed long int) regs->gpr[rd];
1287 regs->gpr[ra] = ival >> sh;
1288 if (ival < 0 && (ival & ((1ul << sh) - 1)) != 0)
1289 regs->xer |= XER_CA;
1291 regs->xer &= ~XER_CA;
1293 #endif /* __powerpc64__ */
1296 * Cache instructions
1298 case 54: /* dcbst */
1299 op->type = MKOP(CACHEOP, DCBST, 0);
1300 op->ea = xform_ea(instr, regs);
1304 op->type = MKOP(CACHEOP, DCBF, 0);
1305 op->ea = xform_ea(instr, regs);
1308 case 246: /* dcbtst */
1309 op->type = MKOP(CACHEOP, DCBTST, 0);
1310 op->ea = xform_ea(instr, regs);
1314 case 278: /* dcbt */
1315 op->type = MKOP(CACHEOP, DCBTST, 0);
1316 op->ea = xform_ea(instr, regs);
1320 case 982: /* icbi */
1321 op->type = MKOP(CACHEOP, ICBI, 0);
1322 op->ea = xform_ea(instr, regs);
1332 op->update_reg = ra;
1334 op->val = regs->gpr[rd];
1335 u = (instr >> 20) & UPDATE;
1340 op->ea = xform_ea(instr, regs);
1341 switch ((instr >> 1) & 0x3ff) {
1342 case 20: /* lwarx */
1343 op->type = MKOP(LARX, 0, 4);
1346 case 150: /* stwcx. */
1347 op->type = MKOP(STCX, 0, 4);
1350 #ifdef __powerpc64__
1351 case 84: /* ldarx */
1352 op->type = MKOP(LARX, 0, 8);
1355 case 214: /* stdcx. */
1356 op->type = MKOP(STCX, 0, 8);
1361 op->type = MKOP(LOAD, u, 8);
1366 case 55: /* lwzux */
1367 op->type = MKOP(LOAD, u, 4);
1371 case 119: /* lbzux */
1372 op->type = MKOP(LOAD, u, 1);
1375 #ifdef CONFIG_ALTIVEC
1377 case 359: /* lvxl */
1378 if (!(regs->msr & MSR_VEC))
1380 op->type = MKOP(LOAD_VMX, 0, 16);
1383 case 231: /* stvx */
1384 case 487: /* stvxl */
1385 if (!(regs->msr & MSR_VEC))
1387 op->type = MKOP(STORE_VMX, 0, 16);
1389 #endif /* CONFIG_ALTIVEC */
1391 #ifdef __powerpc64__
1392 case 149: /* stdx */
1393 case 181: /* stdux */
1394 op->type = MKOP(STORE, u, 8);
1398 case 151: /* stwx */
1399 case 183: /* stwux */
1400 op->type = MKOP(STORE, u, 4);
1403 case 215: /* stbx */
1404 case 247: /* stbux */
1405 op->type = MKOP(STORE, u, 1);
1408 case 279: /* lhzx */
1409 case 311: /* lhzux */
1410 op->type = MKOP(LOAD, u, 2);
1413 #ifdef __powerpc64__
1414 case 341: /* lwax */
1415 case 373: /* lwaux */
1416 op->type = MKOP(LOAD, SIGNEXT | u, 4);
1420 case 343: /* lhax */
1421 case 375: /* lhaux */
1422 op->type = MKOP(LOAD, SIGNEXT | u, 2);
1425 case 407: /* sthx */
1426 case 439: /* sthux */
1427 op->type = MKOP(STORE, u, 2);
1430 #ifdef __powerpc64__
1431 case 532: /* ldbrx */
1432 op->type = MKOP(LOAD, BYTEREV, 8);
1436 case 533: /* lswx */
1437 op->type = MKOP(LOAD_MULTI, 0, regs->xer & 0x7f);
1440 case 534: /* lwbrx */
1441 op->type = MKOP(LOAD, BYTEREV, 4);
1444 case 597: /* lswi */
1446 rb = 32; /* # bytes to load */
1447 op->type = MKOP(LOAD_MULTI, 0, rb);
1450 op->ea = truncate_if_32bit(regs->msr,
1454 #ifdef CONFIG_PPC_FPU
1455 case 535: /* lfsx */
1456 case 567: /* lfsux */
1457 if (!(regs->msr & MSR_FP))
1459 op->type = MKOP(LOAD_FP, u, 4);
1462 case 599: /* lfdx */
1463 case 631: /* lfdux */
1464 if (!(regs->msr & MSR_FP))
1466 op->type = MKOP(LOAD_FP, u, 8);
1469 case 663: /* stfsx */
1470 case 695: /* stfsux */
1471 if (!(regs->msr & MSR_FP))
1473 op->type = MKOP(STORE_FP, u, 4);
1476 case 727: /* stfdx */
1477 case 759: /* stfdux */
1478 if (!(regs->msr & MSR_FP))
1480 op->type = MKOP(STORE_FP, u, 8);
1484 #ifdef __powerpc64__
1485 case 660: /* stdbrx */
1486 op->type = MKOP(STORE, BYTEREV, 8);
1487 op->val = byterev_8(regs->gpr[rd]);
1491 case 661: /* stswx */
1492 op->type = MKOP(STORE_MULTI, 0, regs->xer & 0x7f);
1495 case 662: /* stwbrx */
1496 op->type = MKOP(STORE, BYTEREV, 4);
1497 op->val = byterev_4(regs->gpr[rd]);
1502 rb = 32; /* # bytes to store */
1503 op->type = MKOP(STORE_MULTI, 0, rb);
1506 op->ea = truncate_if_32bit(regs->msr,
1510 case 790: /* lhbrx */
1511 op->type = MKOP(LOAD, BYTEREV, 2);
1514 case 918: /* sthbrx */
1515 op->type = MKOP(STORE, BYTEREV, 2);
1516 op->val = byterev_2(regs->gpr[rd]);
1520 case 844: /* lxvd2x */
1521 case 876: /* lxvd2ux */
1522 if (!(regs->msr & MSR_VSX))
1524 op->reg = rd | ((instr & 1) << 5);
1525 op->type = MKOP(LOAD_VSX, u, 16);
1528 case 972: /* stxvd2x */
1529 case 1004: /* stxvd2ux */
1530 if (!(regs->msr & MSR_VSX))
1532 op->reg = rd | ((instr & 1) << 5);
1533 op->type = MKOP(STORE_VSX, u, 16);
1536 #endif /* CONFIG_VSX */
1542 op->type = MKOP(LOAD, u, 4);
1543 op->ea = dform_ea(instr, regs);
1548 op->type = MKOP(LOAD, u, 1);
1549 op->ea = dform_ea(instr, regs);
1554 op->type = MKOP(STORE, u, 4);
1555 op->ea = dform_ea(instr, regs);
1560 op->type = MKOP(STORE, u, 1);
1561 op->ea = dform_ea(instr, regs);
1566 op->type = MKOP(LOAD, u, 2);
1567 op->ea = dform_ea(instr, regs);
1572 op->type = MKOP(LOAD, SIGNEXT | u, 2);
1573 op->ea = dform_ea(instr, regs);
1578 op->type = MKOP(STORE, u, 2);
1579 op->ea = dform_ea(instr, regs);
1584 break; /* invalid form, ra in range to load */
1585 op->type = MKOP(LOAD_MULTI, 0, 4 * (32 - rd));
1586 op->ea = dform_ea(instr, regs);
1590 op->type = MKOP(STORE_MULTI, 0, 4 * (32 - rd));
1591 op->ea = dform_ea(instr, regs);
1594 #ifdef CONFIG_PPC_FPU
1597 if (!(regs->msr & MSR_FP))
1599 op->type = MKOP(LOAD_FP, u, 4);
1600 op->ea = dform_ea(instr, regs);
1605 if (!(regs->msr & MSR_FP))
1607 op->type = MKOP(LOAD_FP, u, 8);
1608 op->ea = dform_ea(instr, regs);
1612 case 53: /* stfsu */
1613 if (!(regs->msr & MSR_FP))
1615 op->type = MKOP(STORE_FP, u, 4);
1616 op->ea = dform_ea(instr, regs);
1620 case 55: /* stfdu */
1621 if (!(regs->msr & MSR_FP))
1623 op->type = MKOP(STORE_FP, u, 8);
1624 op->ea = dform_ea(instr, regs);
1628 #ifdef __powerpc64__
1629 case 58: /* ld[u], lwa */
1630 op->ea = dsform_ea(instr, regs);
1631 switch (instr & 3) {
1633 op->type = MKOP(LOAD, 0, 8);
1636 op->type = MKOP(LOAD, UPDATE, 8);
1639 op->type = MKOP(LOAD, SIGNEXT, 4);
1644 case 62: /* std[u] */
1645 op->ea = dsform_ea(instr, regs);
1646 switch (instr & 3) {
1648 op->type = MKOP(STORE, 0, 8);
1651 op->type = MKOP(STORE, UPDATE, 8);
1655 #endif /* __powerpc64__ */
1670 regs->nip = truncate_if_32bit(regs->msr, regs->nip + 4);
1674 op->type = INTERRUPT | 0x700;
1675 op->val = SRR1_PROGPRIV;
1679 op->type = INTERRUPT | 0x700;
1680 op->val = SRR1_PROGTRAP;
1683 #ifdef CONFIG_PPC_FPU
1685 op->type = INTERRUPT | 0x800;
1689 #ifdef CONFIG_ALTIVEC
1691 op->type = INTERRUPT | 0xf20;
1697 op->type = INTERRUPT | 0xf40;
1701 EXPORT_SYMBOL_GPL(analyse_instr);
1704 * For PPC32 we always use stwu with r1 to change the stack pointer.
1705 * So this emulated store may corrupt the exception frame, now we
1706 * have to provide the exception frame trampoline, which is pushed
1707 * below the kprobed function stack. So we only update gpr[1] but
1708 * don't emulate the real store operation. We will do real store
1709 * operation safely in exception return code by checking this flag.
1711 static __kprobes int handle_stack_update(unsigned long ea, struct pt_regs *regs)
1715 * Check if we will touch kernel stack overflow
1717 if (ea - STACK_INT_FRAME_SIZE <= current->thread.ksp_limit) {
1718 printk(KERN_CRIT "Can't kprobe this since kernel stack would overflow.\n");
1721 #endif /* CONFIG_PPC32 */
1723 * Check if we already set since that means we'll
1724 * lose the previous value.
1726 WARN_ON(test_thread_flag(TIF_EMULATE_STACK_STORE));
1727 set_thread_flag(TIF_EMULATE_STACK_STORE);
1731 static __kprobes void do_signext(unsigned long *valp, int size)
1735 *valp = (signed short) *valp;
1738 *valp = (signed int) *valp;
1743 static __kprobes void do_byterev(unsigned long *valp, int size)
1747 *valp = byterev_2(*valp);
1750 *valp = byterev_4(*valp);
1752 #ifdef __powerpc64__
1754 *valp = byterev_8(*valp);
1761 * Emulate instructions that cause a transfer of control,
1762 * loads and stores, and a few other instructions.
1763 * Returns 1 if the step was emulated, 0 if not,
1764 * or -1 if the instruction is one that should not be stepped,
1765 * such as an rfid, or a mtmsrd that would clear MSR_RI.
1767 int __kprobes emulate_step(struct pt_regs *regs, unsigned int instr)
1769 struct instruction_op op;
1775 r = analyse_instr(&op, regs, instr);
1780 size = GETSIZE(op.type);
1781 switch (op.type & INSTR_TYPE_MASK) {
1783 if (!address_ok(regs, op.ea, 8))
1785 switch (op.type & CACHEOP_MASK) {
1787 __cacheop_user_asmx(op.ea, err, "dcbst");
1790 __cacheop_user_asmx(op.ea, err, "dcbf");
1794 prefetchw((void *) op.ea);
1798 prefetch((void *) op.ea);
1801 __cacheop_user_asmx(op.ea, err, "icbi");
1809 if (regs->msr & MSR_LE)
1811 if (op.ea & (size - 1))
1812 break; /* can't handle misaligned */
1814 if (!address_ok(regs, op.ea, size))
1819 __get_user_asmx(val, op.ea, err, "lwarx");
1822 __get_user_asmx(val, op.ea, err, "ldarx");
1828 regs->gpr[op.reg] = val;
1832 if (regs->msr & MSR_LE)
1834 if (op.ea & (size - 1))
1835 break; /* can't handle misaligned */
1837 if (!address_ok(regs, op.ea, size))
1842 __put_user_asmx(op.val, op.ea, err, "stwcx.", cr);
1845 __put_user_asmx(op.val, op.ea, err, "stdcx.", cr);
1851 regs->ccr = (regs->ccr & 0x0fffffff) |
1853 ((regs->xer >> 3) & 0x10000000);
1857 if (regs->msr & MSR_LE)
1859 err = read_mem(®s->gpr[op.reg], op.ea, size, regs);
1861 if (op.type & SIGNEXT)
1862 do_signext(®s->gpr[op.reg], size);
1863 if (op.type & BYTEREV)
1864 do_byterev(®s->gpr[op.reg], size);
1868 #ifdef CONFIG_PPC_FPU
1870 if (regs->msr & MSR_LE)
1873 err = do_fp_load(op.reg, do_lfs, op.ea, size, regs);
1875 err = do_fp_load(op.reg, do_lfd, op.ea, size, regs);
1878 #ifdef CONFIG_ALTIVEC
1880 if (regs->msr & MSR_LE)
1882 err = do_vec_load(op.reg, do_lvx, op.ea & ~0xfUL, regs);
1887 if (regs->msr & MSR_LE)
1889 err = do_vsx_load(op.reg, do_lxvd2x, op.ea, regs);
1893 if (regs->msr & MSR_LE)
1896 for (i = 0; i < size; i += 4) {
1900 err = read_mem(®s->gpr[rd], op.ea, nb, regs);
1903 if (nb < 4) /* left-justify last bytes */
1904 regs->gpr[rd] <<= 32 - 8 * nb;
1911 if (regs->msr & MSR_LE)
1913 if ((op.type & UPDATE) && size == sizeof(long) &&
1914 op.reg == 1 && op.update_reg == 1 &&
1915 !(regs->msr & MSR_PR) &&
1916 op.ea >= regs->gpr[1] - STACK_INT_FRAME_SIZE) {
1917 err = handle_stack_update(op.ea, regs);
1920 err = write_mem(op.val, op.ea, size, regs);
1923 #ifdef CONFIG_PPC_FPU
1925 if (regs->msr & MSR_LE)
1928 err = do_fp_store(op.reg, do_stfs, op.ea, size, regs);
1930 err = do_fp_store(op.reg, do_stfd, op.ea, size, regs);
1933 #ifdef CONFIG_ALTIVEC
1935 if (regs->msr & MSR_LE)
1937 err = do_vec_store(op.reg, do_stvx, op.ea & ~0xfUL, regs);
1942 if (regs->msr & MSR_LE)
1944 err = do_vsx_store(op.reg, do_stxvd2x, op.ea, regs);
1948 if (regs->msr & MSR_LE)
1951 for (i = 0; i < size; i += 4) {
1952 val = regs->gpr[rd];
1957 val >>= 32 - 8 * nb;
1958 err = write_mem(val, op.ea, nb, regs);
1967 regs->gpr[op.reg] = regs->msr & MSR_MASK;
1971 val = regs->gpr[op.reg];
1972 if ((val & MSR_RI) == 0)
1973 /* can't step mtmsr[d] that would clear MSR_RI */
1975 /* here op.val is the mask of bits to change */
1976 regs->msr = (regs->msr & ~op.val) | (val & op.val);
1980 case SYSCALL: /* sc */
1982 * N.B. this uses knowledge about how the syscall
1983 * entry code works. If that is changed, this will
1984 * need to be changed also.
1986 if (regs->gpr[0] == 0x1ebe &&
1987 cpu_has_feature(CPU_FTR_REAL_LE)) {
1988 regs->msr ^= MSR_LE;
1991 regs->gpr[9] = regs->gpr[13];
1992 regs->gpr[10] = MSR_KERNEL;
1993 regs->gpr[11] = regs->nip + 4;
1994 regs->gpr[12] = regs->msr & MSR_MASK;
1995 regs->gpr[13] = (unsigned long) get_paca();
1996 regs->nip = (unsigned long) &system_call_common;
1997 regs->msr = MSR_KERNEL;
2009 if (op.type & UPDATE)
2010 regs->gpr[op.update_reg] = op.ea;
2013 regs->nip = truncate_if_32bit(regs->msr, regs->nip + 4);