binutils* objdump.c (visualize_jumps, color_output, extended_color_output)
(detected_jumps): New variables.
(usage): Add the new jump visualization options.
(option_values): Add new option value.
(long_options): Add the new option.
(jump_info_new, jump_info_free): New functions.
(jump_info_min_address, jump_info_max_address): Likewise.
(jump_info_end_address, jump_info_is_start_address): Likewise.
(jump_info_is_end_address, jump_info_size): Likewise.
(jump_info_unlink, jump_info_insert): Likewise.
(jump_info_add_front, jump_info_move_linked): Likewise.
(jump_info_intersect, jump_info_merge): Likewise.
(jump_info_sort, jump_info_visualize_address): Likewise.
(disassemble_jumps): New function - used to locate jumps.
(disassemble_bytes): Add ascii art generation.
(disassemble_section): Add scan to locate jumps.
(main): Parse the new visualization option.
* doc/binutils.texi: Document the new feature.
* NEWS: Mention the new feature.
opcodes * arm-dis.c (print_insn_arm): Fill in insn info fields for control
flow instructions.
(print_insn_thumb16, print_insn_thumb32): Likewise.
(print_insn): Initialize the insn info.
* i386-dis.c (print_insn): Initialize the insn info fields, and
detect jumps.
ACCL/ACCH register names are only available for ARCv2 architecture,
leading to a confusion when disassembling for any other ARC
variants. This patch is changing the default names for ACCL/ACCH to
generic r58/r59.
2012-01-13 Claudiu Zissulescu <claziss@gmail.com>
* opcode/arc-dis.c (regnames): Correct ACCL/ACCH naming, fix typo
reserved register name.
index_offset isn't set up for "sfsr", resulting in a random offset
being used when trying to disassemble the following.
.byte 0x3e, 0xf7, 0x07, 0x00
* ns32k-dis.c (Is_gen): Use strchr, add 'f'.
(print_insn_ns32k): Adjust ioffset for 'f' index_offset.
The signed integer overflow occurred when adding one to target_count
for (i = 0; i < target_count + 1; i++)
but that's the least of the worries here. target_count was long and i
int, leading to the possibility of a loop that never ended.
So to avoid this type of vulnerability, this patch uses what I believe
to be the proper types for arguments of various wasm32 opcodes, rather
than using "long" which may change in size.
gas/
* testsuite/gas/wasm32/allinsn.d: Update expected output.
opcodes/
* wasm32-dis.c (print_insn_wasm32): Localise variables. Store
result of wasm_read_leb128 in a uint64_t and check that bits
are not lost when copying to other locals. Use uint32_t for
most locals. Use PRId64 when printing int64_t.
Don't do that. Especially don't use shift counts that assume the type
being shifted is 32 bits when the type is long/unsigned long. Also
reverts part of a change I made on 2019-12-11 to tic4x_print_register
that on closer inspection turns out to be unnecessary.
include/
* opcode/tic4x.h (EXTR): Delete.
(EXTRU, EXTRS, INSERTU, INSERTS): Rewrite without zero/sign
extension using shifts. Do trim INSERTU value to specified bitfield.
opcodes/
* tic4x-dis.c (tic4x_print_register): Remove dead code.
gas/
* config/tc-tic4x.c (tic4x_operands_match): Correct tic3x trap
insertion.
* m10300-dis.c (disassemble): Move extraction of DREG, AREG, RREG,
and XRREG value earlier to avoid a shift with negative exponent.
* m10200-dis.c (disassemble): Similarly.
The disassembler change is such that in default mode we'd disassemble
the insns (for there not ebing any conflicts), but when AMD64 mode was
explicitly requested, we'd show them as "(bad)".
The fix is the additional ARRAY_SIZE test, the rest just tidies
variable types rather than adding a cast to avoid warnings.
opcodes/
* z8k-dis.c: Include libiberty.h
(instr_data_s): Make max_fetched unsigned.
(z8k_lookup_instr): Make nibl_index and tabl_index unsigned.
Don't exceed byte_info bounds.
(output_instr): Make num_bytes unsigned.
(unpack_instr): Likewise for nibl_count and loop.
* z8kgen.c (gas <opcode_entry_type>): Make noperands, length and
idx unsigned.
* z8k-opc.h: Regenerate.
gas/
* config/tc-z8k.c (md_begin): Make idx unsigned.
(get_specific): Likewise for this_index.
This patch changes the "class" of LLOCK/SCOND from "MEMORY" to
"LLOCK/SCOND" respectively. Moreover, it corrects the "data_size_mode".
These changes are necessary for GDB's atmoic sequence handler.
Signed-off-by: Shahab Vahedi <shahab@synopsys.com>
There are probably a lot more of these still here.
cpu/
* m32c.cpu (f-dsp-8-u16, f-dsp-8-s16): Rearrange to mask any sign
bits before shifting rather than masking after shifting.
(f-dsp-16-u16, f-dsp-16-s16, f-dsp-32-u16, f-dsp-32-s16): Likewise.
(f-dsp-40-u16, f-dsp-40-s16, f-dsp-48-u16, f-dsp-48-s16): Likewise.
(f-dsp-64-u16, f-dsp-8-s24): Likewise.
(f-bitbase32-16-s19-unprefixed): Avoid signed left shift.
opcodes/
* m32c-ibld.c: Regenerate.
PR 25344
* z80-dis.c (suffix): Don't use a local struct buffer copy.
Peek at next byte to prevent recursion on repeated prefix bytes.
Ensure uninitialised "mybuf" is not accessed.
(print_insn_z80): Don't zero n_fetch and n_used here,..
(print_insn_z80_buf): ..do it here instead.
According to the specification these permit the Q bit to control the
vector length operated on, and hence this bit should not already be set
in the opcode table entries (it rather needs setting dynamically). Note
how the test case output did also not match its input. Besides
correcting the test case also extend it to cover both forms.
PR 25224
bfd * Makefile.am: Add z80-elf target support.
* configure.ac: Likewise.
* targets.c: Likewise.
* config.bfd: Add z80-elf target support and new arches: ez80 and z180.
* elf32-z80.c: New file.
* archures.c: Add new z80 architectures: eZ80 and Z180.
* coffcode.h: Likewise.
* cpu-z80.c: Likewise.
* bfd-in2.h: Likewise plus additional Z80 relocations.
* coff-z80.c: Add new relocations for Z80 target and local label check.
gas * config/tc-z80.c: Add new architectures: Z180 and eZ80. Add support
for assembler code generated by SDCC. Add new relocation types. Add
z80-elf target support.
* config/tc-z80.h: Add z80-elf target support. Enable dollar local
labels. Local labels starts from ".L".
* testsuite/gas/all/fwdexp.d: Fix failure due to symbol conflict.
* testsuite/gas/all/fwdexp.s: Likewise.
* testsuite/gas/z80/suffix.d: Fix failure on ELF target.
* testsuite/gas/z80/z80.exp: Add new tests
* testsuite/gas/z80/dollar.d: New file.
* testsuite/gas/z80/dollar.s: New file.
* testsuite/gas/z80/ez80_adl_all.d: New file.
* testsuite/gas/z80/ez80_adl_all.s: New file.
* testsuite/gas/z80/ez80_adl_suf.d: New file.
* testsuite/gas/z80/ez80_isuf.s: New file.
* testsuite/gas/z80/ez80_z80_all.d: New file.
* testsuite/gas/z80/ez80_z80_all.s: New file.
* testsuite/gas/z80/ez80_z80_suf.d: New file.
* testsuite/gas/z80/r800_extra.d: New file.
* testsuite/gas/z80/r800_extra.s: New file.
* testsuite/gas/z80/r800_ii8.d: New file.
* testsuite/gas/z80/r800_z80_doc.d: New file.
* testsuite/gas/z80/z180.d: New file.
* testsuite/gas/z80/z180.s: New file.
* testsuite/gas/z80/z180_z80_doc.d: New file.
* testsuite/gas/z80/z80_doc.d: New file.
* testsuite/gas/z80/z80_doc.s: New file.
* testsuite/gas/z80/z80_ii8.d: New file.
* testsuite/gas/z80/z80_ii8.s: New file.
* testsuite/gas/z80/z80_in_f_c.d: New file.
* testsuite/gas/z80/z80_in_f_c.s: New file.
* testsuite/gas/z80/z80_op_ii_ld.d: New file.
* testsuite/gas/z80/z80_op_ii_ld.s: New file.
* testsuite/gas/z80/z80_out_c_0.d: New file.
* testsuite/gas/z80/z80_out_c_0.s: New file.
* testsuite/gas/z80/z80_reloc.d: New file.
* testsuite/gas/z80/z80_reloc.s: New file.
* testsuite/gas/z80/z80_sli.d: New file.
* testsuite/gas/z80/z80_sli.s: New file.
ld * Makefile.am: Add new target z80-elf
* configure.tgt: Likewise.
* emultempl/z80.em: Add support for eZ80 and Z180 architectures.
* emulparams/elf32z80.sh: New file.
* emultempl/z80elf.em: Likewise.
* testsuite/ld-z80/arch_ez80_adl.d: Likewise.
* testsuite/ld-z80/arch_ez80_z80.d: Likewise.
* testsuite/ld-z80/arch_r800.d: Likewise.
* testsuite/ld-z80/arch_z180.d: Likewise.
* testsuite/ld-z80/arch_z80.d: Likewise.
* testsuite/ld-z80/comb_arch_ez80_z80.d: Likewise.
* testsuite/ld-z80/comb_arch_z180.d: Likewise.
* testsuite/ld-z80/labels.s: Likewise.
* testsuite/ld-z80/relocs.s: Likewise.
* testsuite/ld-z80/relocs_b_ez80.d: Likewise.
* testsuite/ld-z80/relocs_b_z80.d: Likewise.
* testsuite/ld-z80/relocs_f_z80.d: Likewise.
* testsuite/ld-z80/z80.exp: Likewise.
opcodes * z80-dis.c: Add support for eZ80 and Z80 instructions.
The expectation of x86-64-branch-3 for "call" / "jmp" with an obvious
direct destination to translate to an indirect _far_ branch is plain
wrong. The operand size prefix should have no effect at all on the
interpretation of the operand. The main underlying issue here is that
the Intel64 templates of the direct branches don't include Disp16, yet
various assumptions exist that it would always be there when there's
also Disp32/Disp32S, toggled by the operand size prefix (which is
being ignored by direct branches in Intel64 mode).
Along these lines it was also wrong to base the displacement width
decision solely on the operand size prefix: REX.W cancels this effect
and hence needs taking into consideration, too.
A disassembler change is needed here as well: XBEGIN was wrongly treated
the same as direct CALL/JMP, which isn't the case - the operand size
prefix does affect displacement size there, it's merely ignored when it
comes to updating [ER]IP.
In memory operand addressing, which forms of displacement are permitted
besides Disp8 is pretty clearly limited
- outside of 64-bit mode, Disp16 or Disp32 only, depending on address
size (MPX being special in not allowing Disp16),
- in 64-bit mode, Disp32s or Disp64 without address size override, and
solely Disp32 with one.
Adjust assembler and i386-gen to match this, observing that templates
already get adjusted before trying to match them against input depending
on the presence of an address size prefix.
This adjustment logic gets extended to all cases, as certain DispNN
values should also be dropped when there's no such prefix. In fact
behavior of the assembler, perhaps besides the exact diagnostics wording,
should not differ between there being templates applicable to 64-bit and
non-64-bit at the same time, or there being fully separate sets of
templates, with their DispNN settings already reduced accordingly.
This adjustment logic further gets guarded such that there wouldn't be
and Disp<N> conversion based on address size prefix when this prefix
doesn't control the width of the displacement (on branches other than
absolute ones).
These adjustments then also allow folding two MOV templates, which had
been split between 64-bit and non-64-bits variants so far.
Once in this area also
- drop the bogus DispNN from JumpByte templates, leaving just the
correct Disp8 there (compensated by i386_finalize_displacement()
now setting Disp8 on their operands),
- add the missing Disp32S to XBEGIN.
Note that the changes make it necessary to temporarily mark a test as
XFAIL; this will get taken care of by a subsequent patch. The failing
parts are entirely bogus and will get replaced.
* d30v-dis.c (extract_value): Make num param a uint64_t, constify
oper. Use unsigned vars.
(print_insn): Make num var uint64_t. Constify oper and remove now
unnecessary casts on extract_value calls.
(print_insn_d30v): Use unsigned vars. Adjust printf formats.
PR 25281
* sh-dis.c (print_insn_ddt): Properly check validity of MOVX_NOPY
and MOVY_NOPX insns. For invalid cases include 0xf000 in the word
printed. Print .word in more cases.
This patch prevents print_insn_mode recursing into another index mode
byte, which if repeated enough times will overflow private.the_buffer
and scribble over other memory.
* vax-dis.c (print_insn_mode): Stop index mode recursion.
fadd, fmul, and fdiv are now, by ISO/IEC TS 18661-3:2015, defined to
refer to functions from the runtime subsystem.
PR 25277
* microblaze-opcm.h (enum microblaze_instr): Prefix fadd, fmul and
fdiv with "mbi_".
* microblaze-opc.h (opcodes): Adjust to suit.
The arc fix in create_map avoiding signed overflow by casting an
unsigned char to unsigned int before shifting, shows one of the
dangers of blinding doing that. The problem in this case was that the
variable storing the value, newAuxRegister->address, was a long.
Using the unsigned cast meant that the 32-bit value was zero extended
when long is 64 bits. Previously we had a sign extension. Net result
was that comparisons in arcExtMap_auxRegName didn't match. Of course,
I could have cast the 32-bit unsigned value back to signed before
storing in a long, but it's neater to just use an unsigned int for the
address.
opcodes/
* alpha-opc.c (OP): Avoid signed overflow.
* arm-dis.c (print_insn): Likewise.
* mcore-dis.c (print_insn_mcore): Likewise.
* pj-dis.c (get_int): Likewise.
* ppc-opc.c (EBD15, EBD15BI): Likewise.
* score7-dis.c (s7_print_insn): Likewise.
* tic30-dis.c (print_insn_tic30): Likewise.
* v850-opc.c (insert_SELID): Likewise.
* vax-dis.c (print_insn_vax): Likewise.
* arc-ext.c (create_map): Likewise.
(struct ExtAuxRegister): Make "address" field unsigned int.
(arcExtMap_auxRegName): Pass unsigned address.
(dump_ARC_extmap): Adjust.
* arc-ext.h (arcExtMap_auxRegName): Update prototype.
I'm flying blind here, not having an s+core s3 insn set reference,
but this seems reasonably obvious from what is done by the assembler.
s3_do16_rpop does some mixing of imm and reg values to place in the
rpop reg field, but I'm not going to try to fix the disassembly
there.
* score-dis.c (print_insn_score16): Move rpush/rpop imm field
value adjustment so that it doesn't affect reg field too.
The ubsan complaint is fixed by the SBM change, with similar possible
complaints fixed by the EXTRACT change. The rest is just cleanup.
include/
* opcode/crx.h (inst <match>): Make unsigned int.
opcodes/
* crx-dis.c (EXTRACT, SBM): Avoid signed overflow.
(get_number_of_operands, getargtype, getbits, getregname),
(getcopregname, getprocregname, gettrapstring, getcinvstring),
(getregliststring, get_word_at_PC, get_words_at_PC, build_mask),
(powerof2, match_opcode, make_instruction, print_arguments),
(print_arg): Delete forward declarations, moving static to..
(getregname, getcopregname, getregliststring): ..these definitions.
(build_mask): Return unsigned int mask.
(match_opcode): Use unsigned int vars.
Note that using 1u in N32_BIT makes all of N32_BIT, __MASK, __MF, __GF
and __SEXT evaluate as unsigned int (the latter three when when their
v arg is int or smaller). This would be a problem if assigning the
result to a bfd_vma, long, or other type wider than an int since the
__SEXT result would be zero extended to the wider type. Fortunately
nds32 target code doesn't use wider types unnecessarily.
include/
* opcode/nds32.h (N32_BIT): Define using 1u.
(__SEXT): Use __MASK and N32_BIT.
(N32_IMMS): Remove duplicate mask.
opcodes/
* nds32-dis.c (print_insn16, print_insn32): Remove forward decls.
(struct objdump_disasm_info): Delete.
(nds32_parse_audio_ext, nds32_parse_opcode): Cast result of
N32_IMMS to unsigned before shifting left.
Commit 8c9b417187 didn't remove a glaring left shift of a number
that had just been sign extended.
* moxie-dis.c (INST2OFFSET): Don't left shift a signed value.
(print_insn_moxie): Remove unnecessary cast.
This is
*cst = (data[0] << 24) + (data[1] << 16) + (data[2] << 8) + data[3];
data is unsigned char which promotes to int.
* h8300-dis.c (extract_immediate): Avoid signed overflow.
(bfd_h8_disassemble): Likewise.
In the following buf is an unsigned char array, so elements are
promoted to int before arithmetic operations.
if (dis_info.info->endian == BFD_ENDIAN_BIG)
while (n--)
val |= buf[n] << (n*8);
else
for (i = 0; i < n; i++)
val |= buf[i] << (i*8);
* csky-dis.c (csky_chars_to_number): Rewrite. Avoid signed
overflow when collecting bytes of a number.
This was the following in print_with_operands
case 4:
number
= buffer[2] + buffer[3] * 256 + buffer[4] * 65536
+ buffer[5] * 0x1000000;
and buffer[5] * 0x1000000 can indeed overflow. So to fix this we need
to use unsigned arithmetic where overflow semantics are specified.
But number is a long, and the expression is int which will be sign
extended to long. If we make the expression unsigned it will be zero
extended. So make number an int32_t and rearrange a little for some
of the places that need fixing.
* cris-dis.c (print_with_operands): Avoid signed integer
overflow when collecting bytes of a 32-bit integer.
This was:
unsigned long mask = SBM (instruction->match_bits);
with
#define SBM(offs) ((((1 << (32 - offs)) -1) << (offs)))
Well, there are a couple of problems. Firstly, the expression uses
int values (1 rather than 1u or 1ul) resulting in the ubsan error, and
secondly, a zero offs will result in a 32-bit shift which is undefined
if ints are only 32 bits.
* cr16-dis.c (EXTRACT, SBM): Rewrite.
(cr16_match_opcode): Delete duplicate bcond test.
This was the following in fmtconst_val, x is unsigned int.
x = SIGNEXTEND (x, constant_formats[cf].nbits);
Problem is, the SIGNEXTEND macro assumed its arg was a long and sign
extended by shifting left then shifting right, and didn't cast the
arg. So don't do the silly shift thing. It's not guaranteed to work
anyway according to the C standard. ">>" might do a logical shift
even if its args are signed.
* bfin-dis.c (HOST_LONG_WORD_SIZE, XFIELD): Delete.
(SIGNBIT): New.
(MASKBITS, SIGNEXTEND): Rewrite.
(fmtconst): Don't use ? expression now that SIGNEXTEND uses
unsigned arithmetic, instead assign result of SIGNEXTEND back
to x.
(fmtconst_val): Use 1u in shift expression.
When operand->bits is 32, the following results in UB.
value = (insn >> operand->shift) & ((1 << operand->bits) - 1);
* arc-dis.c (find_format_from_table): Use ull constant when
shifting by up to 32.
Assembling this to an object and trying to disassemble results in
objdump -d looping forever.
.inst 0x45205120
PR 25270
* aarch64-dis.c (aarch64_decode_variant_using_iclass): Return
false when field is zero for sve_size_tsz_bhs.
Two places in epiphany_cgen_extract_operand, "value" is a long.
value = ((((value) << (1))) + (pc));
cpu/
* epiphany.cpu (f-simm8, f-simm24): Use multiply rather than
shift left to avoid UB on left shift of negative values.
opcodes/
* epiphany-ibld.c: Regenerate.
ppc-dis.c used a global struct whenever malloc failed to provide the
eight bytes of memory necessary for struct dis_private. Which is
quite ridiculous. If that malloc failed there is zero chance some
other malloc won't fail too.
* ppc-dis.c (private): Delete variable.
(get_powerpc_dialect): Don't segfault on NULL info->private_data.
(powerpc_init_dialect): Don't use global private.
This, at the assembler level, is just a "brace" feature covering both
AES and SHA2. Hence there's no need for it to have a separate feature
flag, freeing up a bit for future re-use. Along these lines there are
also a number of dead definitions/variables in the opcode table file.
Since we accept these without suffix / operand size specifier, we should
also do so with one. (The fact that we unilaterally accept these, other
than far branches, rather than limiting them to Intel64 mode, will be
taken care of later on.)
Also take the opportunity and make sure "lfs <reg>, tbyte ptr <mem>"
et al get rejected outside of 64-bit mode. This became broken by
dc2be329b9 ("i386: Only check suffix in instruction mnemonic").
Furthermore cover lgdt et al in the Intel syntax handling as well, which
continued to work after said commit just by coincidence.
Test also memory operands with operand size specifier, which was broken
prior to dc2be329b9 ("i386: Only check suffix in instruction
mnemonic"), due to the template not permitting any suffixes. Note that
this uncovered a disassembler issue, which is being fixed here as well.
Insns permitting only GPR operands (and hence implicit sizing when
there's no suffix) don't ever have their DefaultSize attribute
inspected, so it shouldn't be there in the first place.
Additionally XBEGIN is like JMP, not CALL, and hence shouldn't be
converted to 32-bit operand size in .code16gcc mode. While the same is
true for SYSRET, it permitting more than one suffix makes it FLDENV-
like, and hence rather than dropping the attribute, for now add it to
the exclusion list to avoid it getting an operand size prefix emitted
in .code16gcc mode. (This will be dealt with later, perhaps together
with FLDENV and friends.)
This patch changes the CRC extension to use the core feature bits instead
of the coproc/fpu feature bits.
CRC is not an fpu feature and it causes issues with the new fpu reset
patch (f439988037). CRC can be set using
the '.arch_extension' directive, which sets bits in the coproc bitfield. When
a '.fpu' directive is encountered, the CRC feature bit gets removed and
there is no way to set it back using '.fpu'.
With this patch, CRC will be marked in the feature core bits, which prevents
it from getting removed when setting/changing the fpu options.
gas/ChangeLog:
* config/tc-arm.c (arm_ext_crc): New.
(crc_ext_armv8): Remove.
(insns): Rename crc_ext_armv8 to arm_ext_crc.
(arm_cpus): Replace CRC_EXT_ARMV8 with ARM_EXT2_CRC.
(armv8a_ext_table, armv8r_ext_table,
arm_option_extension_value_table): Redefine the crc
extension in terms of ARM_EXT2_CRC.
* gas/testsuite/gas/arm/crc-ext.s: New.
* gas/testsuite/gas/arm/crc-ext.d: New.
include/ChangeLog:
* opcode/arm.h (ARM_EXT2_CRC): New extension feature
to replace CRC_EXT_ARMV8.
(CRC_EXT_ARMV8): Remove and mark bit as unused.
(ARM_ARCH_V8A_CRC, ARM_ARCH_V8_1A, ARM_ARCH_V8_2A,
ARM_ARCH_V8_3A, ARM_ARCH_V8_4A, ARM_ARCH_V8_5A,
ARM_ARCH_V8_6A): Redefine using ARM_EXT2_CRC instead of
CRC_EXT_ARMV8.
opcodes/ChangeLog:
* opcodes/arm-dis.c (arm_opcodes, thumb32_opcodes):
Change the coproc CRC conditions to use the extension
feature set, second word, base on ARM_EXT2_CRC.
The Cpu64 forms are no different in their attributes except for the CPU
flags; there's no need to key these off of anything other than
CpuSYSCALL even for the 64-bit forms. Dropping these improves the
diagnostic on SYSRETQ used in 32-bit code from "unsupported instruction
`sysret'" to "invalid instruction suffix for `sysret'".
Thomas Troeger
Claudiu Zissulescu
Alan Modra
Nick Clifton
Sergey Belyashov
Jan Beulich
Shahab Vahedi
Dr N.W. Filardo
Mihail Ionescu