portugalfuturista/rizin
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
rizin/test/db/analysis/hexagon
Rot127 fb6efca4b5
[Hexagon] RzIL uplifiting (#3837) 
Uplift Hexagon architecture to RzIL

The general structure is, that every (sub-)instruction has a getter for it's RzIL code.
Calling the getter will return the RzIL operation.
If RzIL for an instruction is requested, the plugin makes a decision. Because Hexagon only executes whole instruction packets. If the instruction is not the last instruction in a packet, it will simply return `EMPTY()`. If the RzIL for the last instruction in a packet is requested, it will get the RzIL operations for all instructions in the packet, shuffles them into the correct execution order (according to some rules) and returns the complete operation for the packet.

The RzIL code was entirely generated with the [rzil-compiler](https://github.com/Rot127/rzil-compiler/), using the semantic definition of the [QEMU Hexagon module](https://github.com/qemu/qemu/tree/master/target/hexagon).

Currently successful compile instructions (and tested):
```
[*] 1581/1733 standard instructions compiled.
[*] 431/643 HVX instructions compiled.
[*] In total: 2012/2376 instructions compiled.
```

It was tested with:
- (Semantic tests) `rz-tracetest` against the execution trace of the QEMU Hexagon test binaries.
- (Bug free and semi-semtantic test) Adding tests which simply execute the test binaries to ensure leak and segfault free execution. Also it is executed until a certain instruction is reached (end of `main` or `loc.pass` symbol), partially testing it executes correctly.

For the uplifting several changes and modernization had to be made:

- Enhance consistency of decoding
  - Allow to disassemble an instruction without copying the result. This is used if the given buffer of instruction bytes is larger than one instruction width. In this case, as many instructions as the buffer can hold are disassembled and buffered for later.
  - Generally enhance buffering of instructions.
  - Allow to mark a packet as valid before it is completely decoded (in case we know it must be valid, e.g. if it is a jump target of a valid packet).
- Fix (hopefully) all memory leaks of the Hexagon plugin.
- Changes to register getters, because RzIL needs finer control to translate alias or explicit register names to their real register.
  - Getter for register name is now done by table, so for future distinction between DSP version we can just select another table.
  - Translation functions from register alias or explicit name to their real register.
  - Each operand contains now it's variable ID (e.g. `d` for register `Rd`) as in the ISA (for mapping in the RzIL code).
- Ease debugging by tracking in more precision, if an instruction is added to a stale, active or new packet.
- Add registers `C20` - `C29` (not yet present in LLVM)
- Some renaming to make the code more readable.
2024-03-22 07:24:56 +00:00

1436 lines
29 KiB
Text
Raw Blame History

NAME=hexagon jumps
FILE=bins/elf/analysis/hexagon-hello-loop
CMDS=<<EOF
b 0x100000
e analysis.jmp.cref=true
s sym.main
aaa
afx
EOF
EXPECT=<<EOF
c 0x00005124 -> 0x00005128 ? jump 0x5128
c 0x00005130 -> 0x00005134 [ if (P0) jump:nt 0x5154
c 0x00005130 -> 0x00005154 [ if (P0) jump:nt 0x5154
c 0x00005134 -> 0x00005138 [ jump 0x5138
C 0x00005138 -> 0x000050e0 [ call sym.pHello
C 0x0000513c -> 0x000050f8 [ call sym.pWorld
c 0x00005140 -> 0x00005144 [ jump 0x5144
c 0x00005150 -> 0x00005128 [ jump 0x5128
EOF
RUN
NAME=hexagon immext
FILE=bins/elf/analysis/hexagon-hello-loop
CMDS=<<EOF
b 0x100000
s 0x000050e4
pi 2
s 0x0000539c
pi 4
EOF
EXPECT=<<EOF
? immext(##0xb0c0)
? R0 = ##loc._MSG_BASE
? immext(##0xd180)
? R2 = ##0xd1ac
? immext(##0xfe105000)
? R3 = ##-0x1efb000
EOF
RUN
NAME=hexagon immediate search
FILE=bins/elf/analysis/hexagon-hello-loop
CMDS=<<EOF
b 0x100000
aar
/ai 0xdead
/ai 0xbeef
/ai -8
/ai 0x1c00
/ai 0xffffff40 0xffffffff
EOF
EXPECT=<<EOF
0x00000b80 # 4: [ R0.h = #0xdead
0x00000b84 # 4: [ R0.l = #0xbeef
0x00001e68 # 4: [ R4.l = #0xbeef
0x0000342c # 4: | if (!P3) memh(R23++#-0x8) = R11.h
0x0000511c # 4: [ R2 = add(FP,##-0x8)
0x00005128 # 4: [ R2 = memw(FP+##-0x8)
0x00005144 # 4: [ R2 = memw(FP+##-0x8)
0x0000514c # 4: [ memw(FP+##-0x8) = R2
0x0000564c # 4: \ R2 = memw(R0+##-0x8)
0x00005654 # 4: \ if (P0.new) R17 = add(R16,##-0x8)
0x00005740 # 4: \ R17 = and(R2,##-0x8)
0x00005840 # 4: / R4 = add(R2,##-0x8)
0x00005970 # 4: \ if (P2.new) R2 = add(R2,##-0x8)
0x000059d0 # 4: \ R1 = and(R1,##-0x8)
0x00005c88 # 4: | if (P0.new) R2 = add(R2,##-0x8)
0x00005d00 # 4: | if (P0.new) R2 = add(R2,##-0x8)
0x00006394 # 4: [ R4 = and(R4,##-0x8)
0x000063f8 # 4: [ R4 = and(R4,##-0x8)
0x0000641c # 4: [ R4 = and(R4,##-0x8)
0x00006510 # 4: [ R4 = and(R4,##-0x8)
0x00006534 # 4: [ R4 = and(R4,##-0x8)
0x00007134 # 4: | R3 = mux(P0,##-0x4,#-0x8)
0x0000747c # 4: \ R2 = add(R2,##-0x8)
0x00007ee0 # 4: / R17 = add(R17,##-0x8)
0x00008484 # 4: \ R2 = add(R16,add(R2,##-0x8))
0x0000848c # 4: / R2 = add(R2,##-0x8)
0x00008500 # 4: \ memd(R2+##-0x8) = R1:0
0x00008598 # 4: \ memd(R2+##-0x8) = R1:0
0x000087b8 # 4: \ memd(R3+##-0x8) = R1:0
0x00009b64 # 4: [ R2 = memw(R18+##-0x8)
0x0000afd8 # 4: / R3 = and(R3,##-0x8)
0x00000aac # 4: / immext(##0x1c00)
0x00000ab4 # 4: | immext(##0x1c00)
0x00000b44 # 4: / immext(##0x1c00)
0x00005170 # 4: / immext(##0x1c00)
0x00005178 # 4: | immext(##0x1c00)
0x00005180 # 4: / immext(##0x1c00)
0x000060e4 # 4: / immext(##0xffffffc0)
0x000060e8 # 4: | R2 = add(R2,add(R3,##-0x30))
0x000061e4 # 4: / immext(##0xffffffc0)
0x000061e8 # 4: | R2 = add(R2,add(R3,##-0x30))
0x00006264 # 4: / immext(##0xffffffc0)
0x00006268 # 4: | R2 = add(R2,add(R3,##-0x30))
0x00007140 # 4: | immext(##0xffffffc0)
0x00007144 # 4: | R0 = add(##0xfffffffa,mpyi(R2,#0x6))
0x00009684 # 4: | immext(##0xffffff40)
0x00009688 # 4: \ memh(R0+#0x0) = ##-0x81
EOF
RUN
NAME=hexagon extended immediate search
FILE=bins/elf/analysis/hexagon-hello-loop
BROKEN=1
CMDS=<<EOF
b 0x100000
aar
/ai sym.sys_TLSFreeAll
/ai sym.coredump
EOF
EXPECT=<<EOF
0x000051d4 # 4: ? R1 = ##0x5410
0x00000b70 # 4: ? jump sym.coredump
0x00000b7c # 4: ? jump sym.coredump
0x00000b8c # 4: ? jump sym.coredump
0x00000f48 # 4: ? jump sym.coredump
0x000051f0 # 4: ? R28 = ##sym.coredump
EOF
RUN
NAME=hexagon extended immediates
FILE==
CMDS=<<EOF
wx 00c0007fc045e401834080491ae24220
e asm.arch=hexagon
e analysis.arch=hexagon
pi 4
EOF
EXPECT=<<EOF
? nop
/ immext(##0x1e417000)
| R3 = memw(GP+##0x1e417004)
\ if (!cmp.eq(R3.new,R2)) jump:t 0x38
EOF
RUN
NAME=hexagon hardware loop simple
FILE==
CMDS=<<EOF
wx 12c03e6388c0006900c0007f0080007f00c0007f
e asm.arch=hexagon
e analysis.arch=hexagon
pi 5
EOF
EXPECT=<<EOF
? PKTCOUNT = LR:FP
[ loop0(0x8,#0x10)
[ nop
/ nop
\ nop < endloop0
EOF
RUN
NAME=hexagon hardware loop nested I
FILE==
CMDS=<<EOF
wx 00c0007f0bc0006900404d850040000076d09b9a0ac020690040007f07407c700040000087c40aab048063700080007f00c0007f
e asm.arch=hexagon
e analysis.arch=hexagon
pi 13
EOF
EXPECT=<<EOF
? nop
[ loop0(0x8,#0x3)
/ P0 = R13
| immext(##0x0)
\ R23:22 = memb_fifo(R27=##0x3)
[ loop1(0x18,#0x2)
/ nop
| R7 = R28
| immext(##0x0)
\ memb(R10=##0x7) = R4
/ R4 = R3
| nop
\ nop < endloop01
EOF
RUN
NAME=hexagon hardware loop nested II
FILE==
CMDS=<<EOF
wx 00c0007f0bc0206900404d850040000076d09b9a00c000580ac0006907807c7000c0007f044063700080007f00c0007f
e asm.arch=hexagon
e analysis.arch=hexagon
pi 12
EOF
EXPECT=<<EOF
? nop
[ loop1(0x8,#0x3)
/ P0 = R13
| immext(##0x0)
\ R23:22 = memb_fifo(R27=##0x3)
[ jump 0x14
[ loop0(0x1c,#0x2)
/ R7 = R28
\ nop < endloop0
/ R4 = R3
| nop
\ nop < endloop1
EOF
RUN
NAME=hexagon undocumented hardware loop
FILE==
CMDS=<<EOF
wx 04c0947c20410069414041752240017543c00175838003b055314420
e asm.arch=hexagon
e analysis.arch=hexagon
pi 7
EOF
EXPECT=<<EOF
? R5:4 = combine(#0x0,##0x28)
/ loop0(0x14,#0x4)
| P1 = cmp.gt(R1,##0x2)
| P2 = cmp.eq(R1,##0x1)
\ P3 = cmp.eq(R1,##0x2)
/ R3 = add(R3,##0x4)
\ R4 = add(R4,##0x4) ; R5 = add(R5,#1) < endloop0
EOF
RUN
NAME=hexagon Nt.new register
FILE==
CMDS=<<EOF
wx ffffffff20400078e15f1076e25f107601d6bda120400078e15f1076e25f107601d4bda120400078e15f1076e25f107601d2bda1e15f107620400078e25f107601d4bda1fd5f10760040007fe25f107601d6bda1044411f30ae24221cc7fff59024402f300d2a3a103406070004d2f0c0040007800d4bda103406070004d2f0c0040007800d2bda1174d2f0c004400787140000000d2bda10340607000400078004d2f0c00d2bda10340607000400078004d2f0c00d4bda1
e asm.arch=hexagon
e analysis.arch=hexagon
pi 46
EOF
EXPECT=<<EOF
? invalid
/ R0 = ##0x1
| R1 = and(R16,##0xff)
| R2 = and(R16,##0xff)
\ memw(SP+##0x4) = R0.new
/ R0 = ##0x1
| R1 = and(R16,##0xff)
| R2 = and(R16,##0xff)
\ memw(SP+##0x4) = R1.new
/ R0 = ##0x1
| R1 = and(R16,##0xff)
| R2 = and(R16,##0xff)
\ memw(SP+##0x4) = R2.new
/ R1 = and(R16,##0xff)
| R0 = ##0x1
| R2 = and(R16,##0xff)
\ memw(SP+##0x4) = R0.new
/ SP = and(R16,##0xff)
| nop
| R2 = and(R16,##0xff)
\ memw(SP+##0x4) = SP.new
/ R4 = add(R17,R4)
\ if (!cmp.gtu(R4.new,R2)) jump:t 0x68
/ jump 0xfffffff4
| R2 = add(R2,R4)
\ memw(R3+##0x0) = R2.new
/ R3 = R0
| immext(##0xc2f34000)
| R0 = ##-0x3d0cc000
\ memw(SP+##0x0) = R3.new
/ R3 = R0
| immext(##0xc2f34000)
| R0 = ##-0x3d0cc000
\ memw(SP+##0x0) = R0.new
/ immext(##0xc2f345c0)
| R0 = ##-0x3d0cba20
| immext(##0x1c40)
\ memw(SP+##0x1c40) = R0.new
/ R3 = R0
| R0 = ##0x0
| immext(##0xc2f34000)
\ memw(SP+##-0x3d0cc000) = R0.new
/ R3 = R0
| R0 = ##0x0
| immext(##0xc2f34000)
\ memw(SP+##-0x3d0cc000) = R3.new
EOF
RUN
NAME=hexagon hash prefix
FILE==
CMDS=<<EOF
wx 00c0007f0bc0006900404d850040000076d09b9a0ac020690040007f07407c700040000087c40aab048063700080007f00c0007f
e asm.arch=hexagon
e analysis.arch=hexagon
e plugins.hexagon.imm.hash=false
pi 13
EOF
EXPECT=<<EOF
? nop
[ loop0(0x8,0x3)
/ P0 = R13
| immext(0x0)
\ R23:22 = memb_fifo(R27=0x3)
[ loop1(0x18,0x2)
/ nop
| R7 = R28
| immext(0x0)
\ memb(R10=0x7) = R4
/ R4 = R3
| nop
\ nop < endloop01
EOF
RUN
NAME=hexagon negative immediates without sign
FILE=bins/elf/analysis/hexagon-hello-loop
CMDS=<<EOF
b 0x100000
aar
e plugins.hexagon.imm.sign=false
/ai -8
/ai 0xffffff40 0xffffffff
EOF
EXPECT=<<EOF
0x0000342c # 4: | if (!P3) memh(R23++#0xfffffff8) = R11.h
0x0000511c # 4: [ R2 = add(FP,##0xfffffff8)
0x00005128 # 4: [ R2 = memw(FP+##0xfffffff8)
0x00005144 # 4: [ R2 = memw(FP+##0xfffffff8)
0x0000514c # 4: [ memw(FP+##0xfffffff8) = R2
0x0000564c # 4: \ R2 = memw(R0+##0xfffffff8)
0x00005654 # 4: \ if (P0.new) R17 = add(R16,##0xfffffff8)
0x00005740 # 4: \ R17 = and(R2,##0xfffffff8)
0x00005840 # 4: / R4 = add(R2,##0xfffffff8)
0x00005970 # 4: \ if (P2.new) R2 = add(R2,##0xfffffff8)
0x000059d0 # 4: \ R1 = and(R1,##0xfffffff8)
0x00005c88 # 4: | if (P0.new) R2 = add(R2,##0xfffffff8)
0x00005d00 # 4: | if (P0.new) R2 = add(R2,##0xfffffff8)
0x00006394 # 4: [ R4 = and(R4,##0xfffffff8)
0x000063f8 # 4: [ R4 = and(R4,##0xfffffff8)
0x0000641c # 4: [ R4 = and(R4,##0xfffffff8)
0x00006510 # 4: [ R4 = and(R4,##0xfffffff8)
0x00006534 # 4: [ R4 = and(R4,##0xfffffff8)
0x00007134 # 4: | R3 = mux(P0,##0xfffffffc,#0xfffffff8)
0x0000747c # 4: \ R2 = add(R2,##0xfffffff8)
0x00007ee0 # 4: / R17 = add(R17,##0xfffffff8)
0x00008484 # 4: \ R2 = add(R16,add(R2,##0xfffffff8))
0x0000848c # 4: / R2 = add(R2,##0xfffffff8)
0x00008500 # 4: \ memd(R2+##0xfffffff8) = R1:0
0x00008598 # 4: \ memd(R2+##0xfffffff8) = R1:0
0x000087b8 # 4: \ memd(R3+##0xfffffff8) = R1:0
0x00009b64 # 4: [ R2 = memw(R18+##0xfffffff8)
0x0000afd8 # 4: / R3 = and(R3,##0xfffffff8)
0x000060e4 # 4: / immext(##0xffffffc0)
0x000060e8 # 4: | R2 = add(R2,add(R3,##0xffffffd0))
0x000061e4 # 4: / immext(##0xffffffc0)
0x000061e8 # 4: | R2 = add(R2,add(R3,##0xffffffd0))
0x00006264 # 4: / immext(##0xffffffc0)
0x00006268 # 4: | R2 = add(R2,add(R3,##0xffffffd0))
0x00007140 # 4: | immext(##0xffffffc0)
0x00007144 # 4: | R0 = add(##0xfffffffa,mpyi(R2,#0x6))
0x00009684 # 4: | immext(##0xffffff40)
0x00009688 # 4: \ memh(R0+#0x0) = ##0xffffff7f
EOF
RUN
NAME=hexagon analysis.jmp.after endloop
FILE==
CMDS=<<EOF
e asm.arch=hexagon
e analysis.arch=hexagon
e analysis.jmp.cref=true
wx 0ec4057608c00f60464a0cc2034175f208c6c0ab0c8a0bf52ae6c19b464e86c3
af
aar
pd 8
EOF
EXPECT=<<EOF
/ fcn.00000000();
| 0x00000000 ? R14 = and(R5,##0x20)
| ,=< 0x00000004 [ loop0(0x8,R15)
| | ; CODE XREFS from fcn.00000000 @ 0x4, 0x18
| .`-> 0x00000008 / R7:6 = valignb(R11:10,R13:12,P2)
| : 0x0000000c | P3 = cmp.gtu(R21,R1)
| : 0x00000010 \ memd(R0++#0x8) = R7:6
| : 0x00000014 / R13:12 = combine(R11,R10)
| `==< 0x00000018 \ if (P3) R11:10 = memd(R1++#0x8) < endloop0
| 0x0000001c / R7:6 = lsr(R7:6,R14)
EOF
RUN
NAME=hexagon analysis.jmp.after conditional jumpr
FILE==
CMDS=<<EOF
e asm.arch=hexagon
e analysis.arch=hexagon
wx 11400275114001f20e4021f1e0c282752943028c00417f53e34b82750ec22ef102478e8500c001940242636b027f427446ea005c3260
af
pd 0xd
EOF
EXPECT=<<EOF
/ fcn.00000000();
| 0x00000000 ? P1 = !cmp.eq(R2,##0x0)
| 0x00000004 ? P1 = !cmp.eq(R1,R0)
| 0x00000008 ? R14 = or(R1,R0)
| 0x0000000c ? P0 = cmp.gtu(R2,##0x17)
| 0x00000010 / R9 = lsr(R2,#0x3)
| 0x00000014 | if (!P1) jumpr:nt LR
| 0x00000018 | P3 = cmp.gtu(R2,##0x5f)
| 0x0000001c \ R14 = or(R14,R2)
| 0x00000020 / P2 = bitsclr(R14,#0x7)
| 0x00000024 \ dcfetch(R1+#0x0)
| 0x00000028 / P2 = and(P2,!P3)
| 0x0000002c | if (P2.new) R2 = add(R2,##-0x8)
| ,=< 0x00000030 \ if (P2.new) jump:nt 0x2b4
EOF
RUN
NAME=hexagon analysis.trap.after
FILE==
CMDS=<<EOF
e asm.arch=hexagon
e analysis.arch=hexagon
e analysis.trap.after=true
wx 104300000244804920c00224201cf4eb2846005a110800e82446005a01410078082c002ca0c2007801c0707000c0005402c0607000406270001f0c3e00c09f5202c00078
af
pd 0x12
EOF
EXPECT=<<EOF
/ fcn.00000000();
| 0x00000000 ? immext(##0xc400)
| 0x00000004 ? R2 = memw(GP+##0xc420)
| ,=< 0x00000008 ? if (cmp.eq(R2.new,#0x0)) jump:nt 0x40
| | 0x0000000c [ memd(R29+#-0x10) = R17:16 ; allocframe(#0x10)
| | 0x00000010 / call 0xc60
| | 0x00000014 \ memw(R29+#0x0) = R0 ; memw(R29+#0x4) = R1
| | 0x00000018 / call 0xc60
| | 0x0000001c | R1 = ##0x8
| | 0x00000020 \ R0 = add(R29,#0x0) ; R16 = add(R29,#0x0)
| | 0x00000024 [ R0 = ##0x15
| | 0x00000028 [ R1 = R16
| | 0x0000002c [ trap0(#0x0)
| | 0x00000030 [ R2 = R0
| | 0x00000034 / R0 = R2
| | 0x00000038 \ R17:16 = memd(R29+#0x8) ; deallocframe
| | 0x0000003c [ jumpr LR
| `-> 0x00000040 [ R2 = ##0x0
\ 0x00000044 [ invalid
EOF
RUN
NAME=hexagon reg alias on first disassembled instruction
FILE=bins/elf/analysis/hexagon-hello-loop
CMDS=<<EOF
aaa
s main
pd 1
EOF
EXPECT=<<EOF
; CALL XREF from sym.__libc_start_main @ 0x5e98
/ int main(int argc, char **argv, char **envp);
| ; arg int argc @ R0
| 0x00005110 ? allocframe(SP,#0x8):raw
EOF
RUN
NAME=hexagon basic block graph
FILE=bins/elf/analysis/hexagon-hello-loop
CMDS=<<EOF
aaa
s main
agf
EOF
EXPECT=<<EOF
.---------------------------------------------------.
| 0x5110 |
| ; CALL XREF from sym.__libc_start_main @ 0x5e98 |
| int main(int argc, char **argv, char **envp); |
| ; arg int argc @ R0 |
| ? allocframe(SP,#0x8):raw |
| [ R2 = add(FP,##-0x4) |
| [ memw(R2+#0x0) = ##0x0 |
| [ R2 = add(FP,##-0x8) |
| [ memw(R2+#0x0) = ##0x0 |
| [ jump 0x5128 |
`---------------------------------------------------'
v
|
'------.
.----------------------.
| | |
| .-----------------------------------------.
| | 0x5128 |
| | ; CODE XREFS from main @ 0x5124, 0x5150 |
| | [ R2 = memw(FP+##-0x8) |
| | [ P0 = cmp.gt(R2,##0x2) |
| | [ if (P0) jump:nt 0x5154 |
| `-----------------------------------------'
| t f
| | |
| .---------------' |
| | '-----------------------.
| | |
|.------------------------------------. .-----------------.
|| 0x5154 | | 0x5134 |
|| ; DATA XREF from main @ 0x5130 | | [ jump 0x5138 |
|| ? R0 = ##0x0 | `-----------------'
|| [ LR:FP = dealloc_return(FP):raw | v
|`------------------------------------' |
| |
| |
| .---------------'
| |
| .--------------------------------.
| | 0x5138 |
| | ; CODE XREF from main @ 0x5134 |
| | [ call sym.pHello |
| | [ call sym.pWorld |
| | [ jump 0x5144 |
| `--------------------------------'
| v
| |
| |
| .--------------------------------.
| | 0x5144 |
| | ; CODE XREF from main @ 0x5140 |
| | [ R2 = memw(FP+##-0x8) |
| | [ R2 = add(R2,##0x1) |
| | [ memw(FP+##-0x8) = R2 |
| | [ jump 0x5128 |
| `--------------------------------'
| v
| |
`------------------------------'
EOF
RUN
NAME=hexagon basic block cond return
FILE=bins/elf/analysis/hexagon-hello-loop
CMDS=<<EOF
aaa
s sym.thread_join
pd 12
EOF
EXPECT=<<EOF
/ sym.thread_join();
| 0x00005200 ? R1 = HTID
| 0x00005204 ? R3 = ##0x1
| 0x00005208 [ R1 = asl(R3,R1)
| 0x0000520c [ R1 = sub(##-0x1,R1)
| 0x00005210 [ R0 = and(R0,R1)
| 0x00005214 [ R0 = combine(R0.l,R0.l)
| ; CODE XREF from sym.thread_join @ 0x5228
| .-> 0x00005218 [ R2 = MODECTL
| : 0x0000521c [ R2 = and(R0,R2)
| : 0x00005220 [ P0 = cmp.eq(R2,#0x0) ; if (P0.new) jumpr:nt R31
| : 0x00005224 [ pause(#0x1)
\ `=< 0x00005228 [ jump 0x5218
\ 0x0000522c [ nop
EOF
RUN
NAME=hexagon basic block treat invalid as return
FILE=bins/elf/analysis/hexagon-hello-loop
CMDS=<<EOF
e analysis.jmp.cref=true
e analysis.trap.after=true
e asm.pcalign=4
e plugins.hexagon.imm.sign=false
aaa
s sym.sys_deinit_tls
pd 11
EOF
EXPECT=<<EOF
/ sym.sys_deinit_tls();
| 0x00005344 ? R2 = UGP
| 0x00005348 / immext(##loc.CoreDump) ; 0x1100
| 0x0000534c | R3 = memw(GP+##loc._TLSEnd) ; 0x1110
| 0x00005350 | immext(##loc.CoreDump) ; 0x1100
| 0x00005354 \ R4 = memw(GP+##loc._TLSStart) ; 0x1108
| 0x00005358 [ R2 = sub(R2,R3)
| ,=< 0x0000535c / jump sym.free
| | 0x00005360 \ R0 = add(R2,R4)
\ | 0x00005364 [ invalid
| 0x00005368 [ invalid
| 0x0000536c [ invalid
EOF
RUN
NAME=hexagon last instr. is endloop branch.
FILE=bins/elf/analysis/hexagon-hello-loop
CMDS=<<EOF
e analysis.jmp.cref=true
aaa
s 0x00005abc
pd 22
EOF
EXPECT=<<EOF
| ,=< 0x00005abc ? if (P3) jump:nt 0x5b1c
| | ; CODE XREF from sym.memcpy @ 0x5abc
| ,==< 0x00005ac0 / loop0(0x5acc,R4)
| || 0x00005ac4 | P0 = cmp.gtu(R4,##0x1)
| || 0x00005ac8 \ R8 = R4
| || ; CODE XREFS from sym.memcpy @ 0x5ac0, 0x5b10
| .`--> 0x00005acc / if (P0) R17 = add(R17,##0x20)
| : | 0x00005ad0 \ dcfetch(R5+#0x0)
| : | 0x00005ad4 / P3 = cmp.eq(R4,R8)
| : | 0x00005ad8 \ dczeroa(R17)
| : | 0x00005adc / R5:4 = vaddw(R5:4,R15:14)
| : | 0x00005ae0 | R19:18 = valignb(R11:10,R13:12,P2)
| : | 0x00005ae4 | R13:12 = memd(R1++#0x8)
| : | 0x00005ae8 \ if (!P3) memd(R0++#0x8) = R19:18
| : | 0x00005aec / R7:6 = valignb(R13:12,R11:10,P2)
| : | 0x00005af0 | R11:10 = memd(R1++#0x8)
| : | 0x00005af4 \ memd(R0++#0x8) = R7:6
| : | 0x00005af8 / R19:18 = valignb(R11:10,R13:12,P2)
| : | 0x00005afc | R13:12 = memd(R1++#0x8)
| : | 0x00005b00 \ memd(R0++#0x8) = R19:18
| : | 0x00005b04 / R7:6 = valignb(R13:12,R11:10,P2)
| : | 0x00005b08 | P0 = cmp.gtu(R4,##0x1)
| : | 0x00005b0c | R11:10 = memd(R1++#0x8)
| `===< 0x00005b10 \ memd(R0++#0x8) = R7:6 < endloop0
EOF
RUN
NAME=hexagon multiple endloop refs.
FILE=bins/elf/analysis/hexagon-hello-loop
CMDS=<<EOF
e analysis.jmp.cref=true
e analysis.trap.after=true
aaa
s 0x00008df4
axt
EOF
EXPECT=<<EOF
sym._Mbtowcx 0x8df0 [CODE] ? loop0(0x8df4,R2)
sym._Mbtowcx 0x8e3c [CODE] ? R6 = ##0x1 ; R7 = add(R7,#1)
sym._Mbtowcx 0x8e54 [CODE] ? R6 = ##0x2 ; R7 = add(R7,#1)
sym._Mbtowcx 0x8e70 [CODE] ? R6 = ##0x3 ; R7 = add(R7,#1)
sym._Mbtowcx 0x8e98 [CODE] ? nop
EOF
RUN
NAME=hexagon continue analysis after unmapped jumps
FILE==
CMDS=<<EOF
wx 9852730118c00058824700e010406070
e asm.arch=hexagon
e analysis.arch=hexagon
af
pd 4
EOF
EXPECT=<<EOF
/ fcn.00000000();
| 0x00000000 ? immext(##0x1734a600)
| ,=< 0x00000004 ? jump 0x1734a60c
| | 0x00000008 / R2 = +mpyi(R0,##0x3c)
| | 0x0000000c | R16 = R0
EOF
RUN
NAME=hexagon string search
FILE==
CMDS=<<EOF
e asm.sub.varmin=0
e asm.arch=hexagon
e analysis.arch=hexagon
e analysis.strings=true
wx 81c100781cc0513c00c09f5257686572652069732057616c6c793f0054686572652069732057616c6c792100
aar
pd 2
fs strings
fl
EOF
EXPECT=<<EOF
0x00000000 ? R1 = ##str.Where_is_Wally ; 0xc ; "Where is Wally?"
0x00000004 [ memw(R17+#0x0) = ##str.There_is_Wally ; 0x1c ; "There is Wally!"
0x0000000c 16 str.Where_is_Wally
0x0000001c 16 str.There_is_Wally
EOF
RUN
NAME=hexagon objdump like assembly
FILE==
CMDS=<<EOF
wx 00c0007f0bc0006900404d850040000076d09b9a0ac020690040007f07407c700040000087c40aab048063700080007f00c0007f00c0007f0bc0206900404d850040000076d09b9a00c000580ac0006907807c7000c0007f044063700080007f00c0007f
e asm.arch=hexagon
e analysis.arch=hexagon
e plugins.hexagon.sdk=true
pi 25
EOF
EXPECT=<<EOF
? nop
{ loop0(0x8,#0x3) }
{ P0 = R13
immext(##0x0)
R23:22 = memb_fifo(R27=##0x3) }
{ loop1(0x18,#0x2) }
{ nop
R7 = R28
immext(##0x0)
memb(R10=##0x7) = R4 }
{ R4 = R3
nop
nop }:endloop01
{ nop }
{ loop1(0x3c,#0x3) }
{ P0 = R13
immext(##0x0)
R23:22 = memb_fifo(R27=##0x3) }
{ jump 0x48 }
{ loop0(0x50,#0x2) }
{ R7 = R28
nop }:endloop0
{ R4 = R3
nop
nop }:endloop1
EOF
RUN
NAME=hexagon regs
FILE=
CMDS=<<EOF
e asm.arch=hexagon
arp~[0-1]
EOF
EXPECT=<<EOF
PC C9
SP R29
BP R30
LR R31
SR C8
SN R0
A0 R0
A1 R1
A2 R2
A3 R3
A4 R4
A5 R5
R0 R0
R1 R1
ctr C0
ctr C0_tmp
ctr C1
ctr C1_tmp
ctr C2
ctr C2_tmp
ctr C3
ctr C3_tmp
ctr C4
ctr C4_tmp
ctr C5
ctr C5_tmp
ctr C6
ctr C6_tmp
ctr C7
ctr C7_tmp
ctr C8
ctr C8_tmp
ctr C9
ctr C9_tmp
ctr C10
ctr C10_tmp
ctr C11
ctr C11_tmp
ctr C12
ctr C12_tmp
ctr C13
ctr C13_tmp
ctr C14
ctr C14_tmp
ctr C15
ctr C15_tmp
ctr C16
ctr C16_tmp
ctr C17
ctr C17_tmp
ctr C18
ctr C18_tmp
ctr C19
ctr C19_tmp
ctr C20
ctr C20_tmp
ctr C21
ctr C21_tmp
ctr C22
ctr C22_tmp
ctr C23
ctr C23_tmp
ctr C24
ctr C24_tmp
ctr C25
ctr C25_tmp
ctr C26
ctr C26_tmp
ctr C27
ctr C27_tmp
ctr C28
ctr C28_tmp
ctr C29
ctr C29_tmp
ctr C30
ctr C30_tmp
ctr C31
ctr C31_tmp
ctr C1:0
ctr C1:0_tmp
ctr C3:2
ctr C3:2_tmp
ctr C5:4
ctr C5:4_tmp
ctr C7:6
ctr C7:6_tmp
ctr C9:8
ctr C9:8_tmp
ctr C11:10
ctr C11:10_tmp
ctr C13:12
ctr C13:12_tmp
ctr C15:14
ctr C15:14_tmp
ctr C17:16
ctr C17:16_tmp
ctr C19:18
ctr C19:18_tmp
ctr C21:20
ctr C21:20_tmp
ctr C23:22
ctr C23:22_tmp
ctr C25:24
ctr C25:24_tmp
ctr C27:26
ctr C27:26_tmp
ctr C29:28
ctr C29:28_tmp
ctr C31:30
ctr C31:30_tmp
gpr R1:0
gpr R1:0_tmp
gpr R3:2
gpr R3:2_tmp
gpr R5:4
gpr R5:4_tmp
gpr R7:6
gpr R7:6_tmp
gpr R9:8
gpr R9:8_tmp
gpr R11:10
gpr R11:10_tmp
gpr R13:12
gpr R13:12_tmp
gpr R15:14
gpr R15:14_tmp
gpr R17:16
gpr R17:16_tmp
gpr R19:18
gpr R19:18_tmp
gpr R21:20
gpr R21:20_tmp
gpr R23:22
gpr R23:22_tmp
gpr R25:24
gpr R25:24_tmp
gpr R27:26
gpr R27:26_tmp
gpr R29:28
gpr R29:28_tmp
gpr R31:30
gpr R31:30_tmp
gpr G0
gpr G0_tmp
gpr G1
gpr G1_tmp
gpr G2
gpr G2_tmp
gpr G3
gpr G3_tmp
gpr G4
gpr G4_tmp
gpr G5
gpr G5_tmp
gpr G6
gpr G6_tmp
gpr G7
gpr G7_tmp
gpr G8
gpr G8_tmp
gpr G9
gpr G9_tmp
gpr G10
gpr G10_tmp
gpr G11
gpr G11_tmp
gpr G12
gpr G12_tmp
gpr G13
gpr G13_tmp
gpr G14
gpr G14_tmp
gpr G15
gpr G15_tmp
gpr G16
gpr G16_tmp
gpr G17
gpr G17_tmp
gpr G18
gpr G18_tmp
gpr G19
gpr G19_tmp
gpr G20
gpr G20_tmp
gpr G21
gpr G21_tmp
gpr G22
gpr G22_tmp
gpr G23
gpr G23_tmp
gpr G24
gpr G24_tmp
gpr G25
gpr G25_tmp
gpr G26
gpr G26_tmp
gpr G27
gpr G27_tmp
gpr G28
gpr G28_tmp
gpr G29
gpr G29_tmp
gpr G30
gpr G30_tmp
gpr G31
gpr G31_tmp
gpr G1:0
gpr G1:0_tmp
gpr G3:2
gpr G3:2_tmp
gpr G5:4
gpr G5:4_tmp
gpr G7:6
gpr G7:6_tmp
gpr G9:8
gpr G9:8_tmp
gpr G11:10
gpr G11:10_tmp
gpr G13:12
gpr G13:12_tmp
gpr G15:14
gpr G15:14_tmp
gpr G17:16
gpr G17:16_tmp
gpr G19:18
gpr G19:18_tmp
gpr G21:20
gpr G21:20_tmp
gpr G23:22
gpr G23:22_tmp
gpr G25:24
gpr G25:24_tmp
gpr G27:26
gpr G27:26_tmp
gpr G29:28
gpr G29:28_tmp
gpr G31:30
gpr G31:30_tmp
vcc Q0
vcc Q0_tmp
vcc Q1
vcc Q1_tmp
vcc Q2
vcc Q2_tmp
vcc Q3
vcc Q3_tmp
vc V3:0
vc V3:0_tmp
vc V7:4
vc V7:4_tmp
vc V11:8
vc V11:8_tmp
vc V15:12
vc V15:12_tmp
vc V19:16
vc V19:16_tmp
vc V23:20
vc V23:20_tmp
vc V27:24
vc V27:24_tmp
vc V31:28
vc V31:28_tmp
vc V0
vc V0_tmp
vc V1
vc V1_tmp
vc V2
vc V2_tmp
vc V3
vc V3_tmp
vc V4
vc V4_tmp
vc V5
vc V5_tmp
vc V6
vc V6_tmp
vc V7
vc V7_tmp
vc V8
vc V8_tmp
vc V9
vc V9_tmp
vc V10
vc V10_tmp
vc V11
vc V11_tmp
vc V12
vc V12_tmp
vc V13
vc V13_tmp
vc V14
vc V14_tmp
vc V15
vc V15_tmp
vc V16
vc V16_tmp
vc V17
vc V17_tmp
vc V18
vc V18_tmp
vc V19
vc V19_tmp
vc V20
vc V20_tmp
vc V21
vc V21_tmp
vc V22
vc V22_tmp
vc V23
vc V23_tmp
vc V24
vc V24_tmp
vc V25
vc V25_tmp
vc V26
vc V26_tmp
vc V27
vc V27_tmp
vc V28
vc V28_tmp
vc V29
vc V29_tmp
vc V30
vc V30_tmp
vc V31
vc V31_tmp
vc V1:0
vc V1:0_tmp
vc V3:2
vc V3:2_tmp
vc V5:4
vc V5:4_tmp
vc V7:6
vc V7:6_tmp
vc V9:8
vc V9:8_tmp
vc V11:10
vc V11:10_tmp
vc V13:12
vc V13:12_tmp
vc V15:14
vc V15:14_tmp
vc V17:16
vc V17:16_tmp
vc V19:18
vc V19:18_tmp
vc V21:20
vc V21:20_tmp
vc V23:22
vc V23:22_tmp
vc V25:24
vc V25:24_tmp
vc V27:26
vc V27:26_tmp
vc V29:28
vc V29:28_tmp
vc V31:30
vc V31:30_tmp
gpr R0
gpr R0_tmp
gpr R1
gpr R1_tmp
gpr R2
gpr R2_tmp
gpr R3
gpr R3_tmp
gpr R4
gpr R4_tmp
gpr R5
gpr R5_tmp
gpr R6
gpr R6_tmp
gpr R7
gpr R7_tmp
gpr R8
gpr R8_tmp
gpr R9
gpr R9_tmp
gpr R10
gpr R10_tmp
gpr R11
gpr R11_tmp
gpr R12
gpr R12_tmp
gpr R13
gpr R13_tmp
gpr R14
gpr R14_tmp
gpr R15
gpr R15_tmp
gpr R16
gpr R16_tmp
gpr R17
gpr R17_tmp
gpr R18
gpr R18_tmp
gpr R19
gpr R19_tmp
gpr R20
gpr R20_tmp
gpr R21
gpr R21_tmp
gpr R22
gpr R22_tmp
gpr R23
gpr R23_tmp
gpr R24
gpr R24_tmp
gpr R25
gpr R25_tmp
gpr R26
gpr R26_tmp
gpr R27
gpr R27_tmp
gpr R28
gpr R28_tmp
gpr R29
gpr R29_tmp
gpr R30
gpr R30_tmp
gpr R31
gpr R31_tmp
ctr P0
ctr P0_tmp
ctr P1
ctr P1_tmp
ctr P2
ctr P2_tmp
ctr P3
ctr P3_tmp
sys S0
sys S0_tmp
sys S1
sys S1_tmp
sys S2
sys S2_tmp
sys S3
sys S3_tmp
sys S4
sys S4_tmp
sys S5
sys S5_tmp
sys S6
sys S6_tmp
sys S7
sys S7_tmp
sys S8
sys S8_tmp
sys S9
sys S9_tmp
sys S10
sys S10_tmp
sys S11
sys S11_tmp
sys S12
sys S12_tmp
sys S13
sys S13_tmp
sys S14
sys S14_tmp
sys S15
sys S15_tmp
sys S16
sys S16_tmp
sys S17
sys S17_tmp
sys S18
sys S18_tmp
sys S19
sys S19_tmp
sys S20
sys S20_tmp
sys S21
sys S21_tmp
sys S22
sys S22_tmp
sys S23
sys S23_tmp
sys S24
sys S24_tmp
sys S25
sys S25_tmp
sys S26
sys S26_tmp
sys S27
sys S27_tmp
sys S28
sys S28_tmp
sys S29
sys S29_tmp
sys S30
sys S30_tmp
sys S31
sys S31_tmp
sys S32
sys S32_tmp
sys S33
sys S33_tmp
sys S34
sys S34_tmp
sys S35
sys S35_tmp
sys S36
sys S36_tmp
sys S37
sys S37_tmp
sys S38
sys S38_tmp
sys S39
sys S39_tmp
sys S40
sys S40_tmp
sys S41
sys S41_tmp
sys S42
sys S42_tmp
sys S43
sys S43_tmp
sys S44
sys S44_tmp
sys S45
sys S45_tmp
sys S46
sys S46_tmp
sys S47
sys S47_tmp
sys S48
sys S48_tmp
sys S49
sys S49_tmp
sys S50
sys S50_tmp
sys S51
sys S51_tmp
sys S52
sys S52_tmp
sys S53
sys S53_tmp
sys S54
sys S54_tmp
sys S55
sys S55_tmp
sys S56
sys S56_tmp
sys S57
sys S57_tmp
sys S58
sys S58_tmp
sys S59
sys S59_tmp
sys S60
sys S60_tmp
sys S61
sys S61_tmp
sys S62
sys S62_tmp
sys S63
sys S63_tmp
sys S64
sys S64_tmp
sys S65
sys S65_tmp
sys S66
sys S66_tmp
sys S67
sys S67_tmp
sys S68
sys S68_tmp
sys S69
sys S69_tmp
sys S70
sys S70_tmp
sys S71
sys S71_tmp
sys S72
sys S72_tmp
sys S73
sys S73_tmp
sys S74
sys S74_tmp
sys S75
sys S75_tmp
sys S76
sys S76_tmp
sys S77
sys S77_tmp
sys S78
sys S78_tmp
sys S79
sys S79_tmp
sys S80
sys S80_tmp
sys S1:0
sys S1:0_tmp
sys S3:2
sys S3:2_tmp
sys S5:4
sys S5:4_tmp
sys S7:6
sys S7:6_tmp
sys S9:8
sys S9:8_tmp
sys S11:10
sys S11:10_tmp
sys S13:12
sys S13:12_tmp
sys S15:14
sys S15:14_tmp
sys S17:16
sys S17:16_tmp
sys S19:18
sys S19:18_tmp
sys S21:20
sys S21:20_tmp
sys S23:22
sys S23:22_tmp
sys S25:24
sys S25:24_tmp
sys S27:26
sys S27:26_tmp
sys S29:28
sys S29:28_tmp
sys S31:30
sys S31:30_tmp
sys S33:32
sys S33:32_tmp
sys S35:34
sys S35:34_tmp
sys S37:36
sys S37:36_tmp
sys S39:38
sys S39:38_tmp
sys S41:40
sys S41:40_tmp
sys S43:42
sys S43:42_tmp
sys S45:44
sys S45:44_tmp
sys S47:46
sys S47:46_tmp
sys S49:48
sys S49:48_tmp
sys S51:50
sys S51:50_tmp
sys S53:52
sys S53:52_tmp
sys S55:54
sys S55:54_tmp
sys S57:56
sys S57:56_tmp
sys S59:58
sys S59:58_tmp
sys S61:60
sys S61:60_tmp
sys S63:62
sys S63:62_tmp
sys S65:64
sys S65:64_tmp
sys S67:66
sys S67:66_tmp
sys S69:68
sys S69:68_tmp
sys S71:70
sys S71:70_tmp
sys S73:72
sys S73:72_tmp
sys S75:74
sys S75:74_tmp
sys S77:76
sys S77:76_tmp
sys S79:78
sys S79:78_tmp
EOF
RUN
NAME=hexagon relocation tests I
FILE=bins/elf/hexagon/relocs
CMDS=<<EOF
pi 30
s loc.r_hex_32
px 16~[1-8]
EOF
EXPECT=<<EOF
? nop
[ nop
[ nop
[ nop
[ jump 0x8000038
[ if (P0) jump:nt loc.test_sym
[ loop1(loc.test_sym,#0x0)
[ R0.l = #0x34
[ R0.h = #0x800
[ if (R0!=#0) jump:nt loc.test_sym
[ R0 = #0x0 ; jump loc.test_sym
/ immext(##0xffffffc0)
\ jump loc.test_sym
/ immext(##segment.ehdr)
\ R0 = ##loc.test_sym
/ immext(##0xffffffc0)
\ jump loc.test_sym
/ immext(##0xffffff80)
\ if (P0) jump:nt loc.test_sym
/ immext(##0xffffff80)
\ loop1(loc.test_sym,#0x0)
[ jump loc.test_sym
/ immext(##0xffffff80)
\ R0 = ##0xffffffa8 ; R1 = R1
/ immext(##segment.ehdr)
\ R0 = ##loc.test_sym
/ immext(##segment.ehdr)
\ R0 = ##loc.test_sym
/ immext(##segment.ehdr)
\ R0 = memw(R0+##loc.test_sym)
offset - 0 1 2 3 4 5
3400 0008 3400 0000 3400 0000 7cff ffff
EOF
RUN
Reference in a new issue View git blame Copy permalink