gdb/arch/arm-get-next-pcs.c

   1 /* Common code for ARM software single stepping support.
   2
   3    Copyright (C) 1988-2024 Free Software Foundation, Inc.
   4
   5    This file is part of GDB.
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License as published by
   9    the Free Software Foundation; either version 3 of the License, or
  10    (at your option) any later version.
  11
  12    This program is distributed in the hope that it will be useful,
  13    but WITHOUT ANY WARRANTY; without even the implied warranty of
  14    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15    GNU General Public License for more details.
  16
  17    You should have received a copy of the GNU General Public License
  18    along with this program.  If not, see <http://www.gnu.org/licenses/>.  */
  19
  20 #include "gdbsupport/common-regcache.h"
  21 #include "arm.h"
  22 #include "arm-get-next-pcs.h"
  23 #include "count-one-bits.h"
  24
  25 /* See arm-get-next-pcs.h.  */
  26
  27 void
  28 arm_get_next_pcs_ctor (struct arm_get_next_pcs *self,
  29                        struct arm_get_next_pcs_ops *ops,
  30                        int byte_order,
  31                        int byte_order_for_code,
  32                        int has_thumb2_breakpoint,
  33                        reg_buffer_common *regcache)
  34 {
  35   self->ops = ops;
  36   self->byte_order = byte_order;
  37   self->byte_order_for_code = byte_order_for_code;
  38   self->has_thumb2_breakpoint = has_thumb2_breakpoint;
  39   self->regcache = regcache;
  40 }
  41
  42 /* Checks for an atomic sequence of instructions beginning with a LDREX{,B,H,D}
  43    instruction and ending with a STREX{,B,H,D} instruction.  If such a sequence
  44    is found, attempt to step through it.  The end of the sequence address is
  45    added to the next_pcs list.  */
  46
  47 static std::vector<CORE_ADDR>
  48 thumb_deal_with_atomic_sequence_raw (struct arm_get_next_pcs *self)
  49 {
  50   int byte_order_for_code = self->byte_order_for_code;
  51   CORE_ADDR breaks[2] = {CORE_ADDR_MAX, CORE_ADDR_MAX};
  52   CORE_ADDR pc = regcache_read_pc (self->regcache);
  53   CORE_ADDR loc = pc;
  54   unsigned short insn1, insn2;
  55   int insn_count;
  56   int index;
  57   int last_breakpoint = 0; /* Defaults to 0 (no breakpoints placed).  */
  58   const int atomic_sequence_length = 16; /* Instruction sequence length.  */
  59   ULONGEST status, itstate;
  60
  61   /* We currently do not support atomic sequences within an IT block.  */
  62   status = regcache_raw_get_unsigned (self->regcache, ARM_PS_REGNUM);
  63   itstate = ((status >> 8) & 0xfc) | ((status >> 25) & 0x3);
  64   if (itstate & 0x0f)
  65     return {};
  66
  67   /* Assume all atomic sequences start with a ldrex{,b,h,d} instruction.  */
  68   insn1 = self->ops->read_mem_uint (loc, 2, byte_order_for_code);
  69
  70   loc += 2;
  71   if (thumb_insn_size (insn1) != 4)
  72     return {};
  73
  74   insn2 = self->ops->read_mem_uint (loc, 2, byte_order_for_code);
  75
  76   loc += 2;
  77   if (!((insn1 & 0xfff0) == 0xe850
  78         || ((insn1 & 0xfff0) == 0xe8d0 && (insn2 & 0x00c0) == 0x0040)))
  79     return {};
  80
  81   /* Assume that no atomic sequence is longer than "atomic_sequence_length"
  82      instructions.  */
  83   for (insn_count = 0; insn_count < atomic_sequence_length; ++insn_count)
  84     {
  85       insn1 = self->ops->read_mem_uint (loc, 2,byte_order_for_code);
  86       loc += 2;
  87
  88       if (thumb_insn_size (insn1) != 4)
  89         {
  90           /* Assume that there is at most one conditional branch in the
  91              atomic sequence.  If a conditional branch is found, put a
  92              breakpoint in its destination address.  */
  93           if ((insn1 & 0xf000) == 0xd000 && bits (insn1, 8, 11) != 0x0f)
  94             {
  95               if (last_breakpoint > 0)
  96                 return {}; /* More than one conditional branch found,
  97                               fallback to the standard code.  */
  98
  99               breaks[1] = loc + 2 + (sbits (insn1, 0, 7) << 1);
 100               last_breakpoint++;
 101             }
 102
 103           /* We do not support atomic sequences that use any *other*
 104              instructions but conditional branches to change the PC.
 105              Fall back to standard code to avoid losing control of
 106              execution.  */
 107           else if (thumb_instruction_changes_pc (insn1))
 108             return {};
 109         }
 110       else
 111         {
 112           insn2 = self->ops->read_mem_uint (loc, 2, byte_order_for_code);
 113
 114           loc += 2;
 115
 116           /* Assume that there is at most one conditional branch in the
 117              atomic sequence.  If a conditional branch is found, put a
 118              breakpoint in its destination address.  */
 119           if ((insn1 & 0xf800) == 0xf000
 120               && (insn2 & 0xd000) == 0x8000
 121               && (insn1 & 0x0380) != 0x0380)
 122             {
 123               int sign, j1, j2, imm1, imm2;
 124               unsigned int offset;
 125
 126               sign = sbits (insn1, 10, 10);
 127               imm1 = bits (insn1, 0, 5);
 128               imm2 = bits (insn2, 0, 10);
 129               j1 = bit (insn2, 13);
 130               j2 = bit (insn2, 11);
 131
 132               offset = (sign << 20) + (j2 << 19) + (j1 << 18);
 133               offset += (imm1 << 12) + (imm2 << 1);
 134
 135               if (last_breakpoint > 0)
 136                 return {}; /* More than one conditional branch found,
 137                               fallback to the standard code.  */
 138
 139               breaks[1] = loc + offset;
 140               last_breakpoint++;
 141             }
 142
 143           /* We do not support atomic sequences that use any *other*
 144              instructions but conditional branches to change the PC.
 145              Fall back to standard code to avoid losing control of
 146              execution.  */
 147           else if (thumb2_instruction_changes_pc (insn1, insn2))
 148             return {};
 149
 150           /* If we find a strex{,b,h,d}, we're done.  */
 151           if ((insn1 & 0xfff0) == 0xe840
 152               || ((insn1 & 0xfff0) == 0xe8c0 && (insn2 & 0x00c0) == 0x0040))
 153             break;
 154         }
 155     }
 156
 157   /* If we didn't find the strex{,b,h,d}, we cannot handle the sequence.  */
 158   if (insn_count == atomic_sequence_length)
 159     return {};
 160
 161   /* Insert a breakpoint right after the end of the atomic sequence.  */
 162   breaks[0] = loc;
 163
 164   /* Check for duplicated breakpoints.  Check also for a breakpoint
 165      placed (branch instruction's destination) anywhere in sequence.  */
 166   if (last_breakpoint
 167       && (breaks[1] == breaks[0]
 168           || (breaks[1] >= pc && breaks[1] < loc)))
 169     last_breakpoint = 0;
 170
 171   std::vector<CORE_ADDR> next_pcs;
 172
 173   /* Adds the breakpoints to the list to be inserted.  */
 174   for (index = 0; index <= last_breakpoint; index++)
 175     next_pcs.push_back (MAKE_THUMB_ADDR (breaks[index]));
 176
 177   return next_pcs;
 178 }
 179
 180 /* Checks for an atomic sequence of instructions beginning with a LDREX{,B,H,D}
 181    instruction and ending with a STREX{,B,H,D} instruction.  If such a sequence
 182    is found, attempt to step through it.  The end of the sequence address is
 183    added to the next_pcs list.  */
 184
 185 static std::vector<CORE_ADDR>
 186 arm_deal_with_atomic_sequence_raw (struct arm_get_next_pcs *self)
 187 {
 188   int byte_order_for_code = self->byte_order_for_code;
 189   CORE_ADDR breaks[2] = {CORE_ADDR_MAX, CORE_ADDR_MAX};
 190   CORE_ADDR pc = regcache_read_pc (self->regcache);
 191   CORE_ADDR loc = pc;
 192   unsigned int insn;
 193   int insn_count;
 194   int index;
 195   int last_breakpoint = 0; /* Defaults to 0 (no breakpoints placed).  */
 196   const int atomic_sequence_length = 16; /* Instruction sequence length.  */
 197
 198   /* Assume all atomic sequences start with a ldrex{,b,h,d} instruction.
 199      Note that we do not currently support conditionally executed atomic
 200      instructions.  */
 201   insn = self->ops->read_mem_uint (loc, 4, byte_order_for_code);
 202
 203   loc += 4;
 204   if ((insn & 0xff9000f0) != 0xe1900090)
 205     return {};
 206
 207   /* Assume that no atomic sequence is longer than "atomic_sequence_length"
 208      instructions.  */
 209   for (insn_count = 0; insn_count < atomic_sequence_length; ++insn_count)
 210     {
 211       insn = self->ops->read_mem_uint (loc, 4, byte_order_for_code);
 212
 213       loc += 4;
 214
 215       /* Assume that there is at most one conditional branch in the atomic
 216          sequence.  If a conditional branch is found, put a breakpoint in
 217          its destination address.  */
 218       if (bits (insn, 24, 27) == 0xa)
 219         {
 220           if (last_breakpoint > 0)
 221             return {}; /* More than one conditional branch found, fallback
 222                           to the standard single-step code.  */
 223
 224           breaks[1] = BranchDest (loc - 4, insn);
 225           last_breakpoint++;
 226         }
 227
 228       /* We do not support atomic sequences that use any *other* instructions
 229          but conditional branches to change the PC.  Fall back to standard
 230          code to avoid losing control of execution.  */
 231       else if (arm_instruction_changes_pc (insn))
 232         return {};
 233
 234       /* If we find a strex{,b,h,d}, we're done.  */
 235       if ((insn & 0xff9000f0) == 0xe1800090)
 236         break;
 237     }
 238
 239   /* If we didn't find the strex{,b,h,d}, we cannot handle the sequence.  */
 240   if (insn_count == atomic_sequence_length)
 241     return {};
 242
 243   /* Insert a breakpoint right after the end of the atomic sequence.  */
 244   breaks[0] = loc;
 245
 246   /* Check for duplicated breakpoints.  Check also for a breakpoint
 247      placed (branch instruction's destination) anywhere in sequence.  */
 248   if (last_breakpoint
 249       && (breaks[1] == breaks[0]
 250           || (breaks[1] >= pc && breaks[1] < loc)))
 251     last_breakpoint = 0;
 252
 253   std::vector<CORE_ADDR> next_pcs;
 254
 255   /* Adds the breakpoints to the list to be inserted.  */
 256   for (index = 0; index <= last_breakpoint; index++)
 257     next_pcs.push_back (breaks[index]);
 258
 259   return next_pcs;
 260 }
 261
 262 /* Find the next possible PCs for thumb mode.  */
 263
 264 static std::vector<CORE_ADDR>
 265 thumb_get_next_pcs_raw (struct arm_get_next_pcs *self)
 266 {
 267   int byte_order = self->byte_order;
 268   int byte_order_for_code = self->byte_order_for_code;
 269   reg_buffer_common *regcache = self->regcache;
 270   CORE_ADDR pc = regcache_read_pc (self->regcache);
 271   unsigned long pc_val = ((unsigned long) pc) + 4;      /* PC after prefetch */
 272   unsigned short inst1;
 273   CORE_ADDR nextpc = pc + 2;            /* Default is next instruction.  */
 274   ULONGEST status, itstate;
 275   std::vector<CORE_ADDR> next_pcs;
 276
 277   nextpc = MAKE_THUMB_ADDR (nextpc);
 278   pc_val = MAKE_THUMB_ADDR (pc_val);
 279
 280   inst1 = self->ops->read_mem_uint (pc, 2, byte_order_for_code);
 281
 282   /* Thumb-2 conditional execution support.  There are eight bits in
 283      the CPSR which describe conditional execution state.  Once
 284      reconstructed (they're in a funny order), the low five bits
 285      describe the low bit of the condition for each instruction and
 286      how many instructions remain.  The high three bits describe the
 287      base condition.  One of the low four bits will be set if an IT
 288      block is active.  These bits read as zero on earlier
 289      processors.  */
 290   status = regcache_raw_get_unsigned (regcache, ARM_PS_REGNUM);
 291   itstate = ((status >> 8) & 0xfc) | ((status >> 25) & 0x3);
 292
 293   /* If-Then handling.  On GNU/Linux, where this routine is used, we
 294      use an undefined instruction as a breakpoint.  Unlike BKPT, IT
 295      can disable execution of the undefined instruction.  So we might
 296      miss the breakpoint if we set it on a skipped conditional
 297      instruction.  Because conditional instructions can change the
 298      flags, affecting the execution of further instructions, we may
 299      need to set two breakpoints.  */
 300
 301   if (self->has_thumb2_breakpoint)
 302     {
 303       if ((inst1 & 0xff00) == 0xbf00 && (inst1 & 0x000f) != 0)
 304         {
 305           /* An IT instruction.  Because this instruction does not
 306              modify the flags, we can accurately predict the next
 307              executed instruction.  */
 308           itstate = inst1 & 0x00ff;
 309           pc += thumb_insn_size (inst1);
 310
 311           while (itstate != 0 && ! condition_true (itstate >> 4, status))
 312             {
 313               inst1 = self->ops->read_mem_uint (pc, 2,byte_order_for_code);
 314               pc += thumb_insn_size (inst1);
 315               itstate = thumb_advance_itstate (itstate);
 316             }
 317
 318           next_pcs.push_back (MAKE_THUMB_ADDR (pc));
 319           return next_pcs;
 320         }
 321       else if (itstate != 0)
 322         {
 323           /* We are in a conditional block.  Check the condition.  */
 324           if (! condition_true (itstate >> 4, status))
 325             {
 326               /* Advance to the next executed instruction.  */
 327               pc += thumb_insn_size (inst1);
 328               itstate = thumb_advance_itstate (itstate);
 329
 330               while (itstate != 0 && ! condition_true (itstate >> 4, status))
 331                 {
 332                   inst1 = self->ops->read_mem_uint (pc, 2, byte_order_for_code);
 333
 334                   pc += thumb_insn_size (inst1);
 335                   itstate = thumb_advance_itstate (itstate);
 336                 }
 337
 338               next_pcs.push_back (MAKE_THUMB_ADDR (pc));
 339               return next_pcs;
 340             }
 341           else if ((itstate & 0x0f) == 0x08)
 342             {
 343               /* This is the last instruction of the conditional
 344                  block, and it is executed.  We can handle it normally
 345                  because the following instruction is not conditional,
 346                  and we must handle it normally because it is
 347                  permitted to branch.  Fall through.  */
 348             }
 349           else
 350             {
 351               int cond_negated;
 352
 353               /* There are conditional instructions after this one.
 354                  If this instruction modifies the flags, then we can
 355                  not predict what the next executed instruction will
 356                  be.  Fortunately, this instruction is architecturally
 357                  forbidden to branch; we know it will fall through.
 358                  Start by skipping past it.  */
 359               pc += thumb_insn_size (inst1);
 360               itstate = thumb_advance_itstate (itstate);
 361
 362               /* Set a breakpoint on the following instruction.  */
 363               gdb_assert ((itstate & 0x0f) != 0);
 364               next_pcs.push_back (MAKE_THUMB_ADDR (pc));
 365
 366               cond_negated = (itstate >> 4) & 1;
 367
 368               /* Skip all following instructions with the same
 369                  condition.  If there is a later instruction in the IT
 370                  block with the opposite condition, set the other
 371                  breakpoint there.  If not, then set a breakpoint on
 372                  the instruction after the IT block.  */
 373               do
 374                 {
 375                   inst1 = self->ops->read_mem_uint (pc, 2, byte_order_for_code);
 376                   pc += thumb_insn_size (inst1);
 377                   itstate = thumb_advance_itstate (itstate);
 378                 }
 379               while (itstate != 0 && ((itstate >> 4) & 1) == cond_negated);
 380
 381               next_pcs.push_back (MAKE_THUMB_ADDR (pc));
 382
 383               return next_pcs;
 384             }
 385         }
 386     }
 387   else if (itstate & 0x0f)
 388     {
 389       /* We are in a conditional block.  Check the condition.  */
 390       int cond = itstate >> 4;
 391
 392       if (! condition_true (cond, status))
 393         {
 394           /* Advance to the next instruction.  All the 32-bit
 395              instructions share a common prefix.  */
 396           next_pcs.push_back (MAKE_THUMB_ADDR (pc + thumb_insn_size (inst1)));
 397         }
 398
 399       return next_pcs;
 400
 401       /* Otherwise, handle the instruction normally.  */
 402     }
 403
 404   if ((inst1 & 0xff00) == 0xbd00)       /* pop {rlist, pc} */
 405     {
 406       CORE_ADDR sp;
 407
 408       /* Fetch the saved PC from the stack.  It's stored above
 409          all of the other registers.  */
 410       unsigned long offset
 411         = count_one_bits (bits (inst1, 0, 7)) * ARM_INT_REGISTER_SIZE;
 412       sp = regcache_raw_get_unsigned (regcache, ARM_SP_REGNUM);
 413       nextpc = self->ops->read_mem_uint (sp + offset, 4, byte_order);
 414     }
 415   else if ((inst1 & 0xf000) == 0xd000)  /* conditional branch */
 416     {
 417       unsigned long cond = bits (inst1, 8, 11);
 418       if (cond == 0x0f)  /* 0x0f = SWI */
 419         {
 420           nextpc = self->ops->syscall_next_pc (self);
 421         }
 422       else if (cond != 0x0f && condition_true (cond, status))
 423         nextpc = pc_val + (sbits (inst1, 0, 7) << 1);
 424     }
 425   else if ((inst1 & 0xf800) == 0xe000)  /* unconditional branch */
 426     {
 427       nextpc = pc_val + (sbits (inst1, 0, 10) << 1);
 428     }
 429   else if (thumb_insn_size (inst1) == 4) /* 32-bit instruction */
 430     {
 431       unsigned short inst2;
 432       inst2 = self->ops->read_mem_uint (pc + 2, 2, byte_order_for_code);
 433
 434       /* Default to the next instruction.  */
 435       nextpc = pc + 4;
 436       nextpc = MAKE_THUMB_ADDR (nextpc);
 437
 438       if ((inst1 & 0xf800) == 0xf000 && (inst2 & 0x8000) == 0x8000)
 439         {
 440           /* Branches and miscellaneous control instructions.  */
 441
 442           if ((inst2 & 0x1000) != 0 || (inst2 & 0xd001) == 0xc000)
 443             {
 444               /* B, BL, BLX.  */
 445               int j1, j2, imm1, imm2;
 446
 447               imm1 = sbits (inst1, 0, 10);
 448               imm2 = bits (inst2, 0, 10);
 449               j1 = bit (inst2, 13);
 450               j2 = bit (inst2, 11);
 451
 452               unsigned long offset = ((imm1 << 12) + (imm2 << 1));
 453               offset ^= ((!j2) << 22) | ((!j1) << 23);
 454
 455               nextpc = pc_val + offset;
 456               /* For BLX make sure to clear the low bits.  */
 457               if (bit (inst2, 12) == 0)
 458                 nextpc = nextpc & 0xfffffffc;
 459             }
 460           else if (inst1 == 0xf3de && (inst2 & 0xff00) == 0x3f00)
 461             {
 462               /* SUBS PC, LR, #imm8.  */
 463               nextpc = regcache_raw_get_unsigned (regcache, ARM_LR_REGNUM);
 464               nextpc -= inst2 & 0x00ff;
 465             }
 466           else if ((inst2 & 0xd000) == 0x8000 && (inst1 & 0x0380) != 0x0380)
 467             {
 468               /* Conditional branch.  */
 469               if (condition_true (bits (inst1, 6, 9), status))
 470                 {
 471                   int sign, j1, j2, imm1, imm2;
 472
 473                   sign = sbits (inst1, 10, 10);
 474                   imm1 = bits (inst1, 0, 5);
 475                   imm2 = bits (inst2, 0, 10);
 476                   j1 = bit (inst2, 13);
 477                   j2 = bit (inst2, 11);
 478
 479                   unsigned long offset
 480                     = (sign << 20) + (j2 << 19) + (j1 << 18);
 481                   offset += (imm1 << 12) + (imm2 << 1);
 482
 483                   nextpc = pc_val + offset;
 484                 }
 485             }
 486         }
 487       else if ((inst1 & 0xfe50) == 0xe810)
 488         {
 489           /* Load multiple or RFE.  */
 490           int rn, offset, load_pc = 1;
 491
 492           rn = bits (inst1, 0, 3);
 493           if (bit (inst1, 7) && !bit (inst1, 8))
 494             {
 495               /* LDMIA or POP */
 496               if (!bit (inst2, 15))
 497                 load_pc = 0;
 498               offset = count_one_bits (inst2) * 4 - 4;
 499             }
 500           else if (!bit (inst1, 7) && bit (inst1, 8))
 501             {
 502               /* LDMDB */
 503               if (!bit (inst2, 15))
 504                 load_pc = 0;
 505               offset = -4;
 506             }
 507           else if (bit (inst1, 7) && bit (inst1, 8))
 508             {
 509               /* RFEIA */
 510               offset = 0;
 511             }
 512           else if (!bit (inst1, 7) && !bit (inst1, 8))
 513             {
 514               /* RFEDB */
 515               offset = -8;
 516             }
 517           else
 518             load_pc = 0;
 519
 520           if (load_pc)
 521             {
 522               CORE_ADDR addr = regcache_raw_get_unsigned (regcache, rn);
 523               nextpc = self->ops->read_mem_uint (addr + offset, 4, byte_order);
 524             }
 525         }
 526       else if ((inst1 & 0xffef) == 0xea4f && (inst2 & 0xfff0) == 0x0f00)
 527         {
 528           /* MOV PC or MOVS PC.  */
 529           nextpc = regcache_raw_get_unsigned (regcache, bits (inst2, 0, 3));
 530           nextpc = MAKE_THUMB_ADDR (nextpc);
 531         }
 532       else if ((inst1 & 0xff70) == 0xf850 && (inst2 & 0xf000) == 0xf000)
 533         {
 534           /* LDR PC.  */
 535           CORE_ADDR base;
 536           int rn, load_pc = 1;
 537
 538           rn = bits (inst1, 0, 3);
 539           base = regcache_raw_get_unsigned (regcache, rn);
 540           if (rn == ARM_PC_REGNUM)
 541             {
 542               base = (base + 4) & ~(CORE_ADDR) 0x3;
 543               if (bit (inst1, 7))
 544                 base += bits (inst2, 0, 11);
 545               else
 546                 base -= bits (inst2, 0, 11);
 547             }
 548           else if (bit (inst1, 7))
 549             base += bits (inst2, 0, 11);
 550           else if (bit (inst2, 11))
 551             {
 552               if (bit (inst2, 10))
 553                 {
 554                   if (bit (inst2, 9))
 555                     base += bits (inst2, 0, 7);
 556                   else
 557                     base -= bits (inst2, 0, 7);
 558                 }
 559             }
 560           else if ((inst2 & 0x0fc0) == 0x0000)
 561             {
 562               int shift = bits (inst2, 4, 5), rm = bits (inst2, 0, 3);
 563               base += regcache_raw_get_unsigned (regcache, rm) << shift;
 564             }
 565           else
 566             /* Reserved.  */
 567             load_pc = 0;
 568
 569           if (load_pc)
 570             nextpc
 571               = self->ops->read_mem_uint (base, 4, byte_order);
 572         }
 573       else if ((inst1 & 0xfff0) == 0xe8d0 && (inst2 & 0xfff0) == 0xf000)
 574         {
 575           /* TBB.  */
 576           CORE_ADDR tbl_reg, table, offset, length;
 577
 578           tbl_reg = bits (inst1, 0, 3);
 579           if (tbl_reg == 0x0f)
 580             table = pc + 4;  /* Regcache copy of PC isn't right yet.  */
 581           else
 582             table = regcache_raw_get_unsigned (regcache, tbl_reg);
 583
 584           offset = regcache_raw_get_unsigned (regcache, bits (inst2, 0, 3));
 585           length = 2 * self->ops->read_mem_uint (table + offset, 1, byte_order);
 586           nextpc = pc_val + length;
 587         }
 588       else if ((inst1 & 0xfff0) == 0xe8d0 && (inst2 & 0xfff0) == 0xf010)
 589         {
 590           /* TBH.  */
 591           CORE_ADDR tbl_reg, table, offset, length;
 592
 593           tbl_reg = bits (inst1, 0, 3);
 594           if (tbl_reg == 0x0f)
 595             table = pc + 4;  /* Regcache copy of PC isn't right yet.  */
 596           else
 597             table = regcache_raw_get_unsigned (regcache, tbl_reg);
 598
 599           offset = 2 * regcache_raw_get_unsigned (regcache, bits (inst2, 0, 3));
 600           length = 2 * self->ops->read_mem_uint (table + offset, 2, byte_order);
 601           nextpc = pc_val + length;
 602         }
 603     }
 604   else if ((inst1 & 0xff00) == 0x4700)  /* bx REG, blx REG */
 605     {
 606       if (bits (inst1, 3, 6) == 0x0f)
 607         nextpc = UNMAKE_THUMB_ADDR (pc_val);
 608       else
 609         nextpc = regcache_raw_get_unsigned (regcache, bits (inst1, 3, 6));
 610     }
 611   else if ((inst1 & 0xff87) == 0x4687)  /* mov pc, REG */
 612     {
 613       if (bits (inst1, 3, 6) == 0x0f)
 614         nextpc = pc_val;
 615       else
 616         nextpc = regcache_raw_get_unsigned (regcache, bits (inst1, 3, 6));
 617
 618       nextpc = MAKE_THUMB_ADDR (nextpc);
 619     }
 620   else if ((inst1 & 0xf500) == 0xb100)
 621     {
 622       /* CBNZ or CBZ.  */
 623       int imm = (bit (inst1, 9) << 6) + (bits (inst1, 3, 7) << 1);
 624       ULONGEST reg = regcache_raw_get_unsigned (regcache, bits (inst1, 0, 2));
 625
 626       if (bit (inst1, 11) && reg != 0)
 627         nextpc = pc_val + imm;
 628       else if (!bit (inst1, 11) && reg == 0)
 629         nextpc = pc_val + imm;
 630     }
 631
 632   next_pcs.push_back (nextpc);
 633
 634   return next_pcs;
 635 }
 636
 637 /* Get the raw next possible addresses.  PC in next_pcs is the current program
 638    counter, which is assumed to be executing in ARM mode.
 639
 640    The values returned have the execution state of the next instruction
 641    encoded in it.  Use IS_THUMB_ADDR () to see whether the instruction is
 642    in Thumb-State, and gdbarch_addr_bits_remove () to get the plain memory
 643    address in GDB and arm_addr_bits_remove in GDBServer.  */
 644
 645 static std::vector<CORE_ADDR>
 646 arm_get_next_pcs_raw (struct arm_get_next_pcs *self)
 647 {
 648   int byte_order = self->byte_order;
 649   int byte_order_for_code = self->byte_order_for_code;
 650   unsigned long pc_val;
 651   unsigned long this_instr = 0;
 652   unsigned long status;
 653   CORE_ADDR nextpc;
 654   reg_buffer_common *regcache = self->regcache;
 655   CORE_ADDR pc = regcache_read_pc (regcache);
 656   std::vector<CORE_ADDR> next_pcs;
 657
 658   pc_val = (unsigned long) pc;
 659   this_instr = self->ops->read_mem_uint (pc, 4, byte_order_for_code);
 660
 661   status = regcache_raw_get_unsigned (regcache, ARM_PS_REGNUM);
 662   nextpc = (CORE_ADDR) (pc_val + 4);    /* Default case */
 663
 664   if (bits (this_instr, 28, 31) == INST_NV)
 665     switch (bits (this_instr, 24, 27))
 666       {
 667       case 0xa:
 668       case 0xb:
 669         {
 670           /* Branch with Link and change to Thumb.  */
 671           nextpc = BranchDest (pc, this_instr);
 672           nextpc |= bit (this_instr, 24) << 1;
 673           nextpc = MAKE_THUMB_ADDR (nextpc);
 674           break;
 675         }
 676       case 0xc:
 677       case 0xd:
 678       case 0xe:
 679         /* Coprocessor register transfer.  */
 680         if (bits (this_instr, 12, 15) == 15)
 681           error (_("Invalid update to pc in instruction"));
 682         break;
 683       }
 684   else if (condition_true (bits (this_instr, 28, 31), status))
 685     {
 686       switch (bits (this_instr, 24, 27))
 687         {
 688         case 0x0:
 689         case 0x1:                       /* data processing */
 690         case 0x2:
 691         case 0x3:
 692           {
 693             unsigned long operand1, operand2, result = 0;
 694             unsigned long rn;
 695             int c;
 696
 697             if (bits (this_instr, 12, 15) != 15)
 698               break;
 699
 700             if (bits (this_instr, 22, 25) == 0
 701                 && bits (this_instr, 4, 7) == 9)        /* multiply */
 702               error (_("Invalid update to pc in instruction"));
 703
 704             /* BX <reg>, BLX <reg> */
 705             if (bits (this_instr, 4, 27) == 0x12fff1
 706                 || bits (this_instr, 4, 27) == 0x12fff3)
 707               {
 708                 rn = bits (this_instr, 0, 3);
 709                 nextpc = ((rn == ARM_PC_REGNUM)
 710                           ? (pc_val + 8)
 711                           : regcache_raw_get_unsigned (regcache, rn));
 712
 713                 next_pcs.push_back (nextpc);
 714                 return next_pcs;
 715               }
 716
 717             /* Multiply into PC.  */
 718             c = (status & FLAG_C) ? 1 : 0;
 719             rn = bits (this_instr, 16, 19);
 720             operand1 = ((rn == ARM_PC_REGNUM)
 721                         ? (pc_val + 8)
 722                         : regcache_raw_get_unsigned (regcache, rn));
 723
 724             if (bit (this_instr, 25))
 725               {
 726                 unsigned long immval = bits (this_instr, 0, 7);
 727                 unsigned long rotate = 2 * bits (this_instr, 8, 11);
 728                 operand2 = ((immval >> rotate) | (immval << (32 - rotate)))
 729                   & 0xffffffff;
 730               }
 731             else                /* operand 2 is a shifted register.  */
 732               operand2 = shifted_reg_val (regcache, this_instr, c,
 733                                           pc_val, status);
 734
 735             switch (bits (this_instr, 21, 24))
 736               {
 737               case 0x0: /*and */
 738                 result = operand1 & operand2;
 739                 break;
 740
 741               case 0x1: /*eor */
 742                 result = operand1 ^ operand2;
 743                 break;
 744
 745               case 0x2: /*sub */
 746                 result = operand1 - operand2;
 747                 break;
 748
 749               case 0x3: /*rsb */
 750                 result = operand2 - operand1;
 751                 break;
 752
 753               case 0x4: /*add */
 754                 result = operand1 + operand2;
 755                 break;
 756
 757               case 0x5: /*adc */
 758                 result = operand1 + operand2 + c;
 759                 break;
 760
 761               case 0x6: /*sbc */
 762                 result = operand1 - operand2 + c;
 763                 break;
 764
 765               case 0x7: /*rsc */
 766                 result = operand2 - operand1 + c;
 767                 break;
 768
 769               case 0x8:
 770               case 0x9:
 771               case 0xa:
 772               case 0xb: /* tst, teq, cmp, cmn */
 773                 result = (unsigned long) nextpc;
 774                 break;
 775
 776               case 0xc: /*orr */
 777                 result = operand1 | operand2;
 778                 break;
 779
 780               case 0xd: /*mov */
 781                 /* Always step into a function.  */
 782                 result = operand2;
 783                 break;
 784
 785               case 0xe: /*bic */
 786                 result = operand1 & ~operand2;
 787                 break;
 788
 789               case 0xf: /*mvn */
 790                 result = ~operand2;
 791                 break;
 792               }
 793               nextpc = self->ops->addr_bits_remove (self, result);
 794             break;
 795           }
 796
 797         case 0x4:
 798         case 0x5:               /* data transfer */
 799         case 0x6:
 800         case 0x7:
 801           if (bits (this_instr, 25, 27) == 0x3 && bit (this_instr, 4) == 1)
 802             {
 803               /* Media instructions and architecturally undefined
 804                  instructions.  */
 805               break;
 806             }
 807
 808           if (bit (this_instr, 20))
 809             {
 810               /* load */
 811               if (bits (this_instr, 12, 15) == 15)
 812                 {
 813                   /* rd == pc */
 814                   unsigned long rn;
 815                   unsigned long base;
 816
 817                   if (bit (this_instr, 22))
 818                     error (_("Invalid update to pc in instruction"));
 819
 820                   /* byte write to PC */
 821                   rn = bits (this_instr, 16, 19);
 822                   base = ((rn == ARM_PC_REGNUM)
 823                           ? (pc_val + 8)
 824                           : regcache_raw_get_unsigned (regcache, rn));
 825
 826                   if (bit (this_instr, 24))
 827                     {
 828                       /* pre-indexed */
 829                       int c = (status & FLAG_C) ? 1 : 0;
 830                       unsigned long offset =
 831                       (bit (this_instr, 25)
 832                        ? shifted_reg_val (regcache, this_instr, c,
 833                                           pc_val, status)
 834                        : bits (this_instr, 0, 11));
 835
 836                       if (bit (this_instr, 23))
 837                         base += offset;
 838                       else
 839                         base -= offset;
 840                     }
 841                   nextpc
 842                     = (CORE_ADDR) self->ops->read_mem_uint ((CORE_ADDR) base,
 843                                                             4, byte_order);
 844                 }
 845             }
 846           break;
 847
 848         case 0x8:
 849         case 0x9:               /* block transfer */
 850           if (bit (this_instr, 20))
 851             {
 852               /* LDM */
 853               if (bit (this_instr, 15))
 854                 {
 855                   /* loading pc */
 856                   int offset = 0;
 857                   CORE_ADDR rn_val_offset = 0;
 858                   unsigned long rn_val
 859                     = regcache_raw_get_unsigned (regcache,
 860                                                  bits (this_instr, 16, 19));
 861
 862                   if (bit (this_instr, 23))
 863                     {
 864                       /* up */
 865                       unsigned long reglist = bits (this_instr, 0, 14);
 866                       offset = count_one_bits_l (reglist) * 4;
 867                       if (bit (this_instr, 24))         /* pre */
 868                         offset += 4;
 869                     }
 870                   else if (bit (this_instr, 24))
 871                     offset = -4;
 872
 873                   rn_val_offset = rn_val + offset;
 874                   nextpc = (CORE_ADDR) self->ops->read_mem_uint (rn_val_offset,
 875                                                                  4, byte_order);
 876                 }
 877             }
 878           break;
 879
 880         case 0xb:               /* branch & link */
 881         case 0xa:               /* branch */
 882           {
 883             nextpc = BranchDest (pc, this_instr);
 884             break;
 885           }
 886
 887         case 0xc:
 888         case 0xd:
 889         case 0xe:               /* coproc ops */
 890           break;
 891         case 0xf:               /* SWI */
 892           {
 893             nextpc = self->ops->syscall_next_pc (self);
 894           }
 895           break;
 896
 897         default:
 898           error (_("Bad bit-field extraction"));
 899           return next_pcs;
 900         }
 901     }
 902
 903   next_pcs.push_back (nextpc);
 904
 905   return next_pcs;
 906 }
 907
 908 /* See arm-get-next-pcs.h.  */
 909
 910 std::vector<CORE_ADDR>
 911 arm_get_next_pcs (struct arm_get_next_pcs *self)
 912 {
 913   std::vector<CORE_ADDR> next_pcs;
 914
 915   if (self->ops->is_thumb (self))
 916     {
 917       next_pcs = thumb_deal_with_atomic_sequence_raw (self);
 918       if (next_pcs.empty ())
 919         next_pcs = thumb_get_next_pcs_raw (self);
 920     }
 921   else
 922     {
 923       next_pcs = arm_deal_with_atomic_sequence_raw (self);
 924       if (next_pcs.empty ())
 925         next_pcs = arm_get_next_pcs_raw (self);
 926     }
 927
 928   if (self->ops->fixup != NULL)
 929     {
 930       for (CORE_ADDR &pc_ref : next_pcs)
 931         pc_ref = self->ops->fixup (self, pc_ref);
 932     }
 933
 934   return next_pcs;
 935 }