1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
|
/*--------------------------------------------------------------------*/
/*--- The core dispatch loop, for jumping to a code address. ---*/
/*--- dispatch-arm-linux.S ---*/
/*--------------------------------------------------------------------*/
/*
This file is part of Valgrind, a dynamic binary instrumentation
framework.
Copyright (C) 2008-2017 Evan Geller
gaze@bea.ms
This program is free software; you can redistribute it and/or
modify it under the terms of the GNU General Public License as
published by the Free Software Foundation; either version 2 of the
License, or (at your option) any later version.
This program is distributed in the hope that it will be useful, but
WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program; if not, see <http://www.gnu.org/licenses/>.
The GNU General Public License is contained in the file COPYING.
*/
#include "pub_core_basics_asm.h"
#if defined(VGP_arm_linux)
.fpu vfp
#include "pub_core_dispatch_asm.h"
#include "pub_core_transtab_asm.h"
#include "libvex_guest_offsets.h" /* for OFFSET_arm_R* */
/*------------------------------------------------------------*/
/*--- ---*/
/*--- The dispatch loop. VG_(disp_run_translations) is ---*/
/*--- used to run all translations, ---*/
/*--- including no-redir ones. ---*/
/*--- ---*/
/*------------------------------------------------------------*/
/*----------------------------------------------------*/
/*--- Entry and preamble (set everything up) ---*/
/*----------------------------------------------------*/
/* signature:
void VG_(disp_run_translations)( UWord* two_words,
void* guest_state,
Addr host_addr );
*/
.text
.global VG_(disp_run_translations)
VG_(disp_run_translations):
/* r0 holds two_words
r1 holds guest_state
r2 holds host_addr
*/
/* The number of regs in this list needs to be even, in
order to keep the stack 8-aligned. */
push {r0, r3, r4, r5, r6, r7, r8, r9, r10, r11, r12, lr}
/* set FPSCR to vex-required default value */
mov r4, #0
fmxr fpscr, r4
/* Set up the guest state pointer */
mov r8, r1
/* and jump into the code cache. Chained translations in
the code cache run, until for whatever reason, they can't
continue. When that happens, the translation in question
will jump (or call) to one of the continuation points
VG_(cp_...) below. */
bx r2
/* NOTREACHED */
/*----------------------------------------------------*/
/*--- Postamble and exit. ---*/
/*----------------------------------------------------*/
postamble:
/* At this point, r1 and r2 contain two
words to be returned to the caller. r1
holds a TRC value, and r2 optionally may
hold another word (for CHAIN_ME exits, the
address of the place to patch.) */
/* We're leaving. Check that nobody messed with
FPSCR in ways we don't expect. */
fmrx r4, fpscr
bic r4, #0xF8000000 /* mask out NZCV and QC */
bic r4, #0x0000009F /* mask out IDC,IXC,UFC,OFC,DZC,IOC */
cmp r4, #0
beq remove_frame /* we're OK */
/* otherwise we have an invariant violation */
movw r1, #VG_TRC_INVARIANT_FAILED
movw r2, #0
/* fall through */
remove_frame:
/* Restore int regs, including importantly r0 (two_words) */
pop {r0, r3, r4, r5, r6, r7, r8, r9, r10, r11, r12, lr}
/* Stash return values */
str r1, [r0, #0]
str r2, [r0, #4]
bx lr
/*----------------------------------------------------*/
/*--- Continuation points ---*/
/*----------------------------------------------------*/
/* ------ Chain me to slow entry point ------ */
.global VG_(disp_cp_chain_me_to_slowEP)
VG_(disp_cp_chain_me_to_slowEP):
/* We got called. The return address indicates
where the patching needs to happen. Collect
the return address and, exit back to C land,
handing the caller the pair (Chain_me_S, RA) */
mov r1, #VG_TRC_CHAIN_ME_TO_SLOW_EP
mov r2, lr
/* 4 = movw r12, lo16(disp_cp_chain_me_to_slowEP)
4 = movt r12, hi16(disp_cp_chain_me_to_slowEP)
4 = blx r12 */
sub r2, r2, #4+4+4
b postamble
/* ------ Chain me to fast entry point ------ */
.global VG_(disp_cp_chain_me_to_fastEP)
VG_(disp_cp_chain_me_to_fastEP):
/* We got called. The return address indicates
where the patching needs to happen. Collect
the return address and, exit back to C land,
handing the caller the pair (Chain_me_F, RA) */
mov r1, #VG_TRC_CHAIN_ME_TO_FAST_EP
mov r2, lr
/* 4 = movw r12, lo16(disp_cp_chain_me_to_fastEP)
4 = movt r12, hi16(disp_cp_chain_me_to_fastEP)
4 = blx r12 */
sub r2, r2, #4+4+4
b postamble
/* ------ Indirect but boring jump ------ */
.global VG_(disp_cp_xindir)
VG_(disp_cp_xindir):
/* Where are we going? */
ldr r0, [r8, #OFFSET_arm_R15T]
/* stats only */
movw r4, #:lower16:VG_(stats__n_xIndirs_32)
movt r4, #:upper16:VG_(stats__n_xIndirs_32)
ldr r5, [r4, #0]
add r5, r5, #1
str r5, [r4, #0]
// LIVE: r8 (guest state ptr), r0 (guest address to go to).
// We use 6 temporaries:
// r6 (to point at the relevant FastCacheSet),
// r1, r2, r3 (scratch, for swapping entries within a set)
// r4, r5 (other scratch)
/* Try a fast lookup in the translation cache. This is pretty much
a handcoded version of VG_(lookupInFastCache). */
// Compute r6 = VG_TT_FAST_HASH(guest)
lsr r6, r0, #1 // g1 = guest >> 1
eor r6, r6, r6, LSR #VG_TT_FAST_BITS // (g1 >> VG_TT_FAST_BITS) ^ g1
ubfx r6, r6, #0, #VG_TT_FAST_BITS // setNo
// Compute r6 = &VG_(tt_fast)[r6]
movw r4, #:lower16:VG_(tt_fast)
movt r4, #:upper16:VG_(tt_fast)
add r6, r4, r6, LSL #VG_FAST_CACHE_SET_BITS // &VG_(tt_fast)[setNo]
// LIVE: r8 (guest state ptr), r0 (guest addr), r6 (cache set)
// try way 0
ldr r4, [r6, #FCS_g0] // .guest0
ldr r5, [r6, #FCS_h0] // .host0
cmp r4, r0 // cmp against .guest0
bne 1f
// hit at way 0
// goto .host0
bx r5
/*NOTREACHED*/
1: // try way 1
ldr r4, [r6, #FCS_g1]
cmp r4, r0 // cmp against .guest1
bne 2f
// hit at way 1; swap upwards
ldr r1, [r6, #FCS_g0] // r1 = old .guest0
ldr r2, [r6, #FCS_h0] // r2 = old .host0
ldr r3, [r6, #FCS_h1] // r3 = old .host1
str r0, [r6, #FCS_g0] // new .guest0 = guest
str r3, [r6, #FCS_h0] // new .host0 = old .host1
str r1, [r6, #FCS_g1] // new .guest1 = old .guest0
str r2, [r6, #FCS_h1] // new .host1 = old .host0
// stats only
movw r4, #:lower16:VG_(stats__n_xIndir_hits1_32)
movt r4, #:upper16:VG_(stats__n_xIndir_hits1_32)
ldr r5, [r4, #0]
add r5, r5, #1
str r5, [r4, #0]
// goto old .host1 a.k.a. new .host0
bx r3
/*NOTREACHED*/
2: // try way 2
ldr r4, [r6, #FCS_g2]
cmp r4, r0 // cmp against .guest2
bne 3f
// hit at way 2; swap upwards
ldr r1, [r6, #FCS_g1]
ldr r2, [r6, #FCS_h1]
ldr r3, [r6, #FCS_h2]
str r0, [r6, #FCS_g1]
str r3, [r6, #FCS_h1]
str r1, [r6, #FCS_g2]
str r2, [r6, #FCS_h2]
// stats only
movw r4, #:lower16:VG_(stats__n_xIndir_hits2_32)
movt r4, #:upper16:VG_(stats__n_xIndir_hits2_32)
ldr r5, [r4, #0]
add r5, r5, #1
str r5, [r4, #0]
// goto old .host2 a.k.a. new .host1
bx r3
/*NOTREACHED*/
3: // try way 3
ldr r4, [r6, #FCS_g3]
cmp r4, r0 // cmp against .guest3
bne 4f
// hit at way 3; swap upwards
ldr r1, [r6, #FCS_g2]
ldr r2, [r6, #FCS_h2]
ldr r3, [r6, #FCS_h3]
str r0, [r6, #FCS_g2]
str r3, [r6, #FCS_h2]
str r1, [r6, #FCS_g3]
str r2, [r6, #FCS_h3]
// stats only
movw r4, #:lower16:VG_(stats__n_xIndir_hits3_32)
movt r4, #:upper16:VG_(stats__n_xIndir_hits3_32)
ldr r5, [r4, #0]
add r5, r5, #1
str r5, [r4, #0]
// goto old .host3 a.k.a. new .host2
bx r3
/*NOTREACHED*/
4: // fast lookup failed
movw r4, #:lower16:VG_(stats__n_xIndir_misses_32)
movt r4, #:upper16:VG_(stats__n_xIndir_misses_32)
ldr r5, [r4, #0]
add r5, r5, #1
str r5, [r4, #0]
mov r1, #VG_TRC_INNER_FASTMISS
mov r2, #0
b postamble
/* ------ Assisted jump ------ */
.global VG_(disp_cp_xassisted)
VG_(disp_cp_xassisted):
/* r8 contains the TRC */
mov r1, r8
mov r2, #0
b postamble
/* ------ Event check failed ------ */
.global VG_(disp_cp_evcheck_fail)
VG_(disp_cp_evcheck_fail):
mov r1, #VG_TRC_INNER_COUNTERZERO
mov r2, #0
b postamble
.size VG_(disp_run_translations), .-VG_(disp_run_translations)
#endif // defined(VGP_arm_linux)
/* Let the linker know we don't need an executable stack */
MARK_STACK_NO_EXEC
/*--------------------------------------------------------------------*/
/*--- end dispatch-arm-linux.S ---*/
/*--------------------------------------------------------------------*/
|
