disassembler.c   [plain text]

/*
 * Copyright (c) 2017 Apple Inc. All rights reserved.
 *
 * Disassemblers for ARM (arm), Thumb (thumb16), and Thumb2 (thumb32).
 *
 * Each disassembly begins with a call to dtrace_decode_arm or dtrace_decode_thumb. The thumb
 * decoder will then call dtrace_decode_thumb16 or dtrace_decode_thumb32 as appropriate.
 *
 * The respective disassembly functions are all of the form {arm,thumb16,thumb32}_type. They
 * follow the ordering and breakdown in the ARMv7 Architecture Reference Manual.
 */

#include  <sys/fasttrap_isa.h>

#define BITS(x, n, mask) (((x) >> (n)) & (mask))

static uint32_t
thumb32_instword_to_arm(uint16_t hw1, uint16_t hw2)
{
	return (hw1 << 16) | hw2;
}

int dtrace_decode_arm(uint32_t instr);
int dtrace_decode_thumb(uint32_t instr);

/*
 * VFP decoder - shared between ARM and THUMB32 mode
 */

static
int
vfp_struct_loadstore(uint32_t instr)
{
	if (ARM_RM(instr) != REG_PC && ARM_RN(instr) != REG_PC) {
		return FASTTRAP_T_COMMON;
	}

	return FASTTRAP_T_INV;
}

static
int
vfp_64transfer(uint32_t instr)
{
	/* These instructions all use RD and RN */
	if (ARM_RD(instr) != REG_PC && ARM_RN(instr) != REG_PC) {
		return FASTTRAP_T_COMMON;
	}

	return FASTTRAP_T_INV;
}

static
int
vfp_transfer(uint32_t instr)
{
	/* These instructions all use RD only */
	if (ARM_RD(instr) != REG_PC) {
		return FASTTRAP_T_COMMON;
	}

	return FASTTRAP_T_INV;
}

static
int
vfp_loadstore(uint32_t instr)
{
	int opcode = BITS(instr, 20, 0x1F);

	/* Instrument VLDR */
	if ((opcode & 0x13) == 0x11 && ARM_RN(instr) == REG_PC) {
		return FASTTRAP_T_VLDR_PC_IMMED;
	}

	/* These instructions all use RN only */
	if (ARM_RN(instr) != REG_PC) {
		return FASTTRAP_T_COMMON;
	}

	return FASTTRAP_T_INV;
}

/*
 * ARM decoder
 */

static
int
arm_unconditional_misc(uint32_t instr)
{
	int op = BITS(instr, 20, 0x7F);

	if ((op & 0x60) == 0x20) {
		/* VFP data processing uses its own registers */
		return FASTTRAP_T_COMMON;
	}

	if ((op & 0x71) == 0x40) {
		return vfp_struct_loadstore(instr);
	}

	return FASTTRAP_T_INV;
}

static
int
arm_unconditional(uint32_t instr)
{
	if (BITS(instr, 27, 0x1) == 0) {
		return arm_unconditional_misc(instr);
	}

	/* The rest are privileged or BL/BLX, do not instrument */

	/* Do not need to instrument BL/BLX either, see comment in arm_misc(uint32_t) */

	return FASTTRAP_T_INV;
}

static
int
arm_syscall_coproc(uint32_t instr)
{
	/* Instrument any VFP data processing instructions, ignore the rest */

	int op1 = BITS(instr, 20, 0x3F), coproc = BITS(instr, 8, 0xF), op = BITS(instr, 4, 0x1);

	if ((op1 & 0x3E) == 0 || (op1 & 0x30) == 0x30) {
		/* Undefined or swi */
		return FASTTRAP_T_INV;
	}

	if ((coproc & 0xE) == 0xA) {
		/* VFP instruction */

		if ((op1 & 0x20) == 0 && (op1 & 0x3A) != 0) {
			return vfp_loadstore(instr);
		}

		if ((op1 & 0x3E) == 0x04) {
			return vfp_64transfer(instr);
		}

		if ((op1 & 0x30) == 0x20) {
			/* VFP data processing or 8, 16, or 32 bit move between ARM reg and VFP reg */
			if (op == 0) {
				/* VFP data processing uses its own registers */
				return FASTTRAP_T_COMMON;
			} else {
				return vfp_transfer(instr);
			}
		}
	}

	return FASTTRAP_T_INV;
}

static
int
arm_branch_link_blockdata(uint32_t instr)
{
	int branch = BITS(instr, 25, 0x1), link = BITS(instr, 24, 0x1), op = BITS(instr, 20, 0x1F), uses_pc = BITS(instr, 15, 0x1), uses_lr = BITS(instr, 14, 0x1);

	if (branch == 1) {
		if (link == 0) {
			return FASTTRAP_T_B_COND;
		}
		return FASTTRAP_T_INV;
	} else {
		/* Only emulate a use of the pc if it's a return from function: ldmia sp!, { ... pc } */
		if (op == 0x0B && ARM_RN(instr) == REG_SP && uses_pc == 1) {
			return FASTTRAP_T_LDM_PC;
		}

		/* stmia sp!, { ... lr } doesn't touch the pc, but it is very common, so special case it */
		if (op == 0x12 && ARM_RN(instr) == REG_SP && uses_lr == 1) {
			return FASTTRAP_T_STM_LR;
		}

		if (ARM_RN(instr) != REG_PC && uses_pc == 0) {
			return FASTTRAP_T_COMMON;
		}
	}

	return FASTTRAP_T_INV;
}

static
int
arm_signed_multiplies(uint32_t instr)
{
	int op1 = BITS(instr, 20, 0x7), op2 = BITS(instr, 5, 0x7);

	/* smlald, smlsld, smmls use RD in addition to RM, RS, and RN */
	if ((op1 == 0x4 && (op2 & 0x4) == 0) || (op1 == 0x5 && (op2 & 0x6) == 0x6)) {
		if (ARM_RD(instr) == REG_PC) {
			return FASTTRAP_T_INV;
		}
	}

	if (ARM_RM(instr) != REG_PC && ARM_RS(instr) != REG_PC && ARM_RN(instr) != REG_PC) {
		return FASTTRAP_T_COMMON;
	}

	return FASTTRAP_T_INV;
}

static
int
arm_pack_unpack_sat_reversal(uint32_t instr)
{
	int op1 = BITS(instr, 20, 0x7), op2 = BITS(instr, 5, 0x7);

	/* pkh, sel use RN in addition to RD and RM */
	if ((op1 == 0 && (op2 & 0x1) == 0) || (op1 == 0 && op2 == 0x5)) {
		if (ARM_RN(instr) == REG_PC) {
			return FASTTRAP_T_INV;
		}
	}

	if (ARM_RM(instr) != REG_PC && ARM_RD(instr) != REG_PC) {
		return FASTTRAP_T_COMMON;
	}

	return FASTTRAP_T_INV;
}

static
int
arm_parallel_addsub_unsigned(uint32_t instr)
{
	if (ARM_RM(instr) != REG_PC && ARM_RD(instr) != REG_PC && ARM_RN(instr) != REG_PC) {
		return FASTTRAP_T_COMMON;
	}

	return FASTTRAP_T_INV;
}

static
int
arm_parallel_addsub_signed(uint32_t instr)
{
	if (ARM_RM(instr) != REG_PC && ARM_RD(instr) != REG_PC && ARM_RN(instr) != REG_PC) {
		return FASTTRAP_T_COMMON;
	}

	return FASTTRAP_T_INV;
}

static
int
arm_media(uint32_t instr)
{
	int op1 = BITS(instr, 20, 0x1F), op2 = BITS(instr, 5, 0x7);

	if ((op1 & 0x1C) == 0) {
		return arm_parallel_addsub_signed(instr);
	}

	if ((op1 & 0x1C) == 0x04) {
		return arm_parallel_addsub_unsigned(instr);
	}

	if ((op1 & 0x18) == 0x08) {
		return arm_pack_unpack_sat_reversal(instr);
	}

	if ((op1 & 0x18) == 0x10) {
		return arm_signed_multiplies(instr);
	}

	if (op1 == 0x1F && op2 == 0x7) {
		/* Undefined instruction */
		return FASTTRAP_T_INV;
	}

	if (op1 == 0x18 && op2 == 0) {
		/* usad8 usada8 */
		/* The registers are named differently in the reference manual for this instruction
		 * but the following positions are correct */

		if (ARM_RM(instr) != REG_PC && ARM_RS(instr) != REG_PC && ARM_RN(instr) != REG_PC) {
			return FASTTRAP_T_COMMON;
		}

		return FASTTRAP_T_INV;
	}

	if ((op1 & 0x1E) == 0x1C && (op2 & 0x3) == 0) {
		/* bfc bfi */
		if (ARM_RD(instr) != REG_PC) {
			return FASTTRAP_T_COMMON;
		}

		return FASTTRAP_T_INV;
	}

	if (((op1 & 0x1E) == 0x1A || (op1 & 0x1E) == 0x1E) && ((op2 & 0x3) == 0x2)) {
		/* sbfx ubfx */
		if (ARM_RM(instr) != REG_PC && ARM_RD(instr) != REG_PC) {
			return FASTTRAP_T_COMMON;
		}

		return FASTTRAP_T_INV;
	}

	return FASTTRAP_T_INV;
}

static
int
arm_loadstore_wordbyte(uint32_t instr)
{
	/* Instrument PC relative load with immediate, ignore any other uses of the PC */
	int R = BITS(instr, 25, 0x1), L = BITS(instr, 20, 0x1);

	if (R == 1) {
		/* Three register load/store */
		if (ARM_RM(instr) != REG_PC && ARM_RD(instr) != REG_PC && ARM_RN(instr) != REG_PC) {
			return FASTTRAP_T_COMMON;
		}
	} else {
		/* Immediate load/store, but still do not support ldr pc, [pc...] */
		if (L == 1 && ARM_RN(instr) == REG_PC && ARM_RD(instr) != REG_PC) {
			return FASTTRAP_T_LDR_PC_IMMED;
		}

		if (ARM_RD(instr) != REG_PC && ARM_RN(instr) != REG_PC) {
			return FASTTRAP_T_COMMON;
		}
	}

	return FASTTRAP_T_INV;
}

static
int
arm_saturating(uint32_t instr)
{
	if (ARM_RM(instr) != REG_PC && ARM_RD(instr) != REG_PC && ARM_RN(instr) != REG_PC) {
		return FASTTRAP_T_COMMON;
	}

	return FASTTRAP_T_INV;
}

static
int
arm_misc(uint32_t instr)
{
	int op = BITS(instr, 21, 0x3), __unused op1 = BITS(instr, 16, 0xF), op2 = BITS(instr, 4, 0x7);

	if (op2 == 1 && op == 1) {
		return FASTTRAP_T_BX_REG;
	}

	/* We do not need to emulate BLX for entry/return probes; if we eventually support full offset
	 * tracing, then we will. This is because BLX overwrites the link register, so a function that
	 * can execute this as its first instruction is a special function indeed.
	 */

	if (op2 == 0x5) {
		return arm_saturating(instr);
	}

	return FASTTRAP_T_INV;
}

static
int
arm_msr_hints(__unused uint32_t instr)
{
	/* These deal with the psr, not instrumented */

	return FASTTRAP_T_INV;
}

static
int
arm_sync_primitive(__unused uint32_t instr)
{
	/* TODO will instrumenting these interfere with any kernel usage of these instructions? */
	/* Don't instrument for now */

	return FASTTRAP_T_INV;
}

static
int
arm_extra_loadstore_unpriv(uint32_t instr)
{
	int op = BITS(instr, 20, 0x1), __unused op2 = BITS(instr, 5, 0x3), immed = BITS(instr, 22, 0x1);

	if (op == 0 && (op2 & 0x2) == 0x2) {
		/* Unpredictable or undefined */
		return FASTTRAP_T_INV;
	}

	if (immed == 1) {
		if (ARM_RD(instr) != REG_PC && ARM_RN(instr) != REG_PC) {
			return FASTTRAP_T_COMMON;
		}
	} else {
		if (ARM_RM(instr) != REG_PC && ARM_RD(instr) != REG_PC && ARM_RN(instr) != REG_PC) {
			return FASTTRAP_T_COMMON;
		}
	}

	return FASTTRAP_T_INV;
}

static
int
arm_extra_loadstore(uint32_t instr)
{
	int op1 = BITS(instr, 20, 0x1F);

	/* There are two variants, and we do not instrument either of them that use the PC */

	if ((op1 & 0x4) == 0) {
		/* Variant 1, register */
		if (ARM_RM(instr) != REG_PC && ARM_RD(instr) != REG_PC && ARM_RN(instr) != REG_PC) {
			return FASTTRAP_T_COMMON;
		}
	} else {
		/* Variant 2, immediate */
		if (ARM_RD(instr) != REG_PC && ARM_RN(instr) != REG_PC) {
			return FASTTRAP_T_COMMON;
		}
	}

	return FASTTRAP_T_INV;
}

static
int
arm_halfword_multiply(uint32_t instr)
{
	/* Not all multiply instructions use all four registers. The ones that don't should have those
	 * register locations set to 0, so we can test them anyway.
	 */

	if (ARM_RN(instr) != REG_PC && ARM_RD(instr) != REG_PC && ARM_RS(instr) != REG_PC && ARM_RM(instr) != REG_PC) {
		return FASTTRAP_T_COMMON;
	}

	return FASTTRAP_T_INV;
}

static
int
arm_multiply(uint32_t instr)
{
	/* Not all multiply instructions use all four registers. The ones that don't should have those
	 * register locations set to 0, so we can test them anyway.
	 */

	if (ARM_RN(instr) != REG_PC && ARM_RD(instr) != REG_PC && ARM_RS(instr) != REG_PC && ARM_RM(instr) != REG_PC) {
		return FASTTRAP_T_COMMON;
	}

	return FASTTRAP_T_INV;
}

static
int
arm_dataproc_immed(uint32_t instr)
{
	/* All these instructions are either two registers, or one register and have 0 where the other reg would be used */
	if (ARM_RN(instr) != REG_PC && ARM_RD(instr) != REG_PC) {
		return FASTTRAP_T_COMMON;
	}

	return FASTTRAP_T_INV;
}

static
int
arm_dataproc_regshift(uint32_t instr)
{
	/* All these instructions are either four registers, or three registers and have 0 where there last reg would be used */
	if (ARM_RN(instr) != REG_PC && ARM_RD(instr) != REG_PC && ARM_RS(instr) != REG_PC && ARM_RM(instr) != REG_PC) {
		return FASTTRAP_T_COMMON;
	}

	return FASTTRAP_T_INV;
}

static
int
arm_dataproc_reg(uint32_t instr)
{
	int op1 = BITS(instr, 20, 0x1F), op2 = BITS(instr, 7, 0x1F), op3 = BITS(instr, 5, 0x3);

	if (op1 == 0x11 || op1 == 0x13 || op1 == 0x15 || op1 == 0x17) {
		/* These are comparison flag setting instructions and do not have RD */
		if (ARM_RN(instr) != REG_PC && ARM_RM(instr) != REG_PC) {
			return FASTTRAP_T_COMMON;
		}

		return FASTTRAP_T_INV;
	}

	/* The rest can, in theory, write or use the PC. The only one we instrument is mov pc, reg.
	 * movs pc, reg is a privileged instruction so we don't instrument that variant. The s bit
	 * is bit 0 of op1 and should be zero.
	 */
	if (op1 == 0x1A && op2 == 0 && op3 == 0 && ARM_RD(instr) == REG_PC) {
		return FASTTRAP_T_MOV_PC_REG;
	}

	/* Any instruction at this point is a three register instruction or two register instruction with RN = 0 */
	if (ARM_RN(instr) != REG_PC && ARM_RD(instr) != REG_PC && ARM_RM(instr) != REG_PC) {
		return FASTTRAP_T_COMMON;
	}

	return FASTTRAP_T_INV;
}

static
int
arm_dataproc_misc(uint32_t instr)
{
	int op = BITS(instr, 25, 0x1), op1 = BITS(instr, 20, 0x1F), op2 = BITS(instr, 4, 0xF);

	if (op == 0) {
		if ((op1 & 0x19) != 0x10 && (op2 & 0x1) == 0) {
			return arm_dataproc_reg(instr);
		}

		if ((op1 & 0x19) != 0x10 && (op2 & 0x9) == 0x1) {
			return arm_dataproc_regshift(instr);
		}

		if ((op1 & 0x19) == 0x10 && (op2 & 0x8) == 0) {
			return arm_misc(instr);
		}

		if ((op1 & 0x19) == 0x19 && (op2 & 0x9) == 0x8) {
			return arm_halfword_multiply(instr);
		}

		if ((op1 & 0x10) == 0 && op2 == 0x9) {
			return arm_multiply(instr);
		}

		if ((op1 & 0x10) == 0x10 && op2 == 0x9) {
			return arm_sync_primitive(instr);
		}

		if ((op1 & 0x12) != 0x02 && (op2 == 0xB || (op2 & 0xD) == 0xD)) {
			return arm_extra_loadstore(instr);
		}

		if ((op1 & 0x12) == 0x02 && (op2 == 0xB || (op2 & 0xD) == 0xD)) {
			return arm_extra_loadstore_unpriv(instr);
		}
	} else {
		if ((op1 & 0x19) != 0x10) {
			return arm_dataproc_immed(instr);
		}

		if (op1 == 0x10) {
			/* 16 bit immediate load (mov (immed)) [encoding A2] */
			if (ARM_RD(instr) != REG_PC) {
				return FASTTRAP_T_COMMON;
			}

			return FASTTRAP_T_INV;
		}

		if (op1 == 0x14) {
			/* high halfword 16 bit immediate load (movt) [encoding A1] */
			if (ARM_RD(instr) != REG_PC) {
				return FASTTRAP_T_COMMON;
			}

			return FASTTRAP_T_INV;
		}

		if ((op1 & 0x1B) == 0x12) {
			return arm_msr_hints(instr);
		}
	}

	return FASTTRAP_T_INV;
}

int
dtrace_decode_arm(uint32_t instr)
{
	int cond = BITS(instr, 28, 0xF), op1 = BITS(instr, 25, 0x7), op = BITS(instr, 4, 0x1);

	if (cond == 0xF) {
		return arm_unconditional(instr);
	}

	if ((op1 & 0x6) == 0) {
		return arm_dataproc_misc(instr);
	}

	if (op1 == 0x2) {
		return arm_loadstore_wordbyte(instr);
	}

	if (op1 == 0x3 && op == 0) {
		return arm_loadstore_wordbyte(instr);
	}

	if (op1 == 0x3 && op == 1) {
		return arm_media(instr);
	}

	if ((op1 & 0x6) == 0x4) {
		return arm_branch_link_blockdata(instr);
	}

	if ((op1 & 0x6) == 0x6) {
		return arm_syscall_coproc(instr);
	}

	return FASTTRAP_T_INV;
}


/*
 * Thumb 16-bit decoder
 */

static
int
thumb16_cond_supervisor(uint16_t instr)
{
	int opcode = BITS(instr, 8, 0xF);

	if ((opcode & 0xE) != 0xE) {
		return FASTTRAP_T_B_COND;
	}

	return FASTTRAP_T_INV;
}

static
int
thumb16_misc(uint16_t instr)
{
	int opcode = BITS(instr, 5, 0x7F);

	if ((opcode & 0x70) == 0x30 || (opcode & 0x70) == 0x70) {
		/* setend, cps, breakpoint, or if-then, not instrumentable */
		return FASTTRAP_T_INV;
	} else if ((opcode & 0x78) == 0x28) {
		/* Doesn't modify pc, but this happens a lot so make this a special case for emulation */
		return FASTTRAP_T_PUSH_LR;
	} else if ((opcode & 0x78) == 0x68) {
		return FASTTRAP_T_POP_PC;
	} else if ((opcode & 0x28) == 0x08) {
		return FASTTRAP_T_CB_N_Z;
	}

	/* All other instructions work on low regs only and are instrumentable */
	return FASTTRAP_T_COMMON;
}

static
int
thumb16_loadstore_single(__unused uint16_t instr)
{
	/* These all access the low registers or SP only */
	return FASTTRAP_T_COMMON;
}

static
int
thumb16_data_special_and_branch(uint16_t instr)
{
	int opcode = BITS(instr, 6, 0xF);

	if (opcode == 0x4) {
		/* Unpredictable */
		return FASTTRAP_T_INV;
	} else if ((opcode & 0xC) == 0xC) {
		/* bx or blx */
		/* Only instrument the bx */
		if ((opcode & 0x2) == 0) {
			return FASTTRAP_T_BX_REG;
		}
		return FASTTRAP_T_INV;
	} else {
		/* Data processing on high registers, only instrument mov pc, reg */
		if ((opcode & 0xC) == 0x8 && THUMB16_HRD(instr) == REG_PC) {
			return FASTTRAP_T_CPY_PC;
		}

		if (THUMB16_HRM(instr) != REG_PC && THUMB16_HRD(instr) != REG_PC) {
			return FASTTRAP_T_COMMON;
		}
	}

	return FASTTRAP_T_INV;
}

static
int
thumb16_data_proc(__unused uint16_t instr)
{
	/* These all access the low registers only */
	return FASTTRAP_T_COMMON;
}

static
int
thumb16_shift_addsub_move_compare(__unused uint16_t instr)
{
	/* These all access the low registers only */
	return FASTTRAP_T_COMMON;
}

static
int
dtrace_decode_thumb16(uint16_t instr)
{
	int opcode = BITS(instr, 10, 0x3F);

	if ((opcode & 0x30) == 0) {
		return thumb16_shift_addsub_move_compare(instr);
	}

	if (opcode == 0x10) {
		return thumb16_data_proc(instr);
	}

	if (opcode == 0x11) {
		return thumb16_data_special_and_branch(instr);
	}

	if ((opcode & 0x3E) == 0x12) {
		/* ldr (literal) */
		return FASTTRAP_T_LDR_PC_IMMED;
	}

	if ((opcode & 0x3C) == 0x14 || (opcode & 0x38) == 0x18 || (opcode & 0x38) == 0x20) {
		return thumb16_loadstore_single(instr);
	}

	if ((opcode & 0x3E) == 0x28) {
		/* adr, uses the pc */
		return FASTTRAP_T_INV;
	}

	if ((opcode & 0x3E) == 0x2A) {
		/* add (sp plus immediate) */
		return FASTTRAP_T_COMMON;
	}

	if ((opcode & 0x3C) == 0x2C) {
		return thumb16_misc(instr);
	}

	if ((opcode & 0x3E) == 0x30) {
		/* stm - can't access high registers */
		return FASTTRAP_T_COMMON;
	}

	if ((opcode & 0x3E) == 0x32) {
		/* ldm - can't access high registers */
		return FASTTRAP_T_COMMON;
	}

	if ((opcode & 0x3C) == 0x34) {
		return thumb16_cond_supervisor(instr);
	}

	if ((opcode & 0x3E) == 0x38) {
		/* b unconditional */
		return FASTTRAP_T_B_UNCOND;
	}

	return FASTTRAP_T_INV;
}

/*
 * Thumb 32-bit decoder
 */

static
int
thumb32_coproc(uint16_t instr1, uint16_t instr2)
{
	/* Instrument any VFP data processing instructions, ignore the rest */

	int op1 = BITS(instr1, 4, 0x3F), coproc = BITS(instr2, 8, 0xF), op = BITS(instr2, 4, 0x1);

	if ((op1 & 0x3E) == 0) {
		/* Undefined */
		return FASTTRAP_T_INV;
	}

	if ((coproc & 0xE) == 0xA || (op1 & 0x30) == 0x30) {
		/* VFP instruction */
		uint32_t instr = thumb32_instword_to_arm(instr1, instr2);

		if ((op1 & 0x30) == 0x30) {
			/* VFP data processing uses its own registers */
			return FASTTRAP_T_COMMON;
		}

		if ((op1 & 0x3A) == 0x02 || (op1 & 0x38) == 0x08 || (op1 & 0x30) == 0x10) {
			return vfp_loadstore(instr);
		}

		if ((op1 & 0x3E) == 0x04) {
			return vfp_64transfer(instr);
		}

		if ((op1 & 0x30) == 0x20) {
			/* VFP data processing or 8, 16, or 32 bit move between ARM reg and VFP reg */
			if (op == 0) {
				/* VFP data processing uses its own registers */
				return FASTTRAP_T_COMMON;
			} else {
				return vfp_transfer(instr);
			}
		}
	}

	return FASTTRAP_T_INV;
}

static
int
thumb32_longmultiply(uint16_t instr1, uint16_t instr2)
{
	int op1 = BITS(instr1, 4, 0x7), op2 = BITS(instr2, 4, 0xF);

	if ((op1 == 1 && op2 == 0xF) || (op1 == 0x3 && op2 == 0xF)) {
		/* Three register instruction */
		if (THUMB32_RM(instr1, instr2) != REG_PC && THUMB32_RD(instr1, instr2) != REG_PC && THUMB32_RN(instr1, instr2) != REG_PC) {
			return FASTTRAP_T_COMMON;
		}
	} else {
		/* Four register instruction */
		if (THUMB32_RM(instr1, instr2) != REG_PC && THUMB32_RD(instr1, instr2) != REG_PC &&
		    THUMB32_RT(instr1, instr2) != REG_PC && THUMB32_RN(instr1, instr2) != REG_PC) {
			return FASTTRAP_T_COMMON;
		}
	}

	return FASTTRAP_T_INV;
}

static
int
thumb32_multiply(uint16_t instr1, uint16_t instr2)
{
	int op1 = BITS(instr1, 4, 0x7), op2 = BITS(instr2, 4, 0x3);

	if ((op1 == 0 && op2 == 1) || (op1 == 0x6 && (op2 & 0x2) == 0)) {
		if (THUMB32_RT(instr1, instr2) == REG_PC) {
			return FASTTRAP_T_INV;
		}
	}

	if (THUMB32_RM(instr1, instr2) != REG_PC && THUMB32_RD(instr1, instr2) != REG_PC && THUMB32_RN(instr1, instr2) != REG_PC) {
		return FASTTRAP_T_COMMON;
	}

	return FASTTRAP_T_INV;
}

static
int
thumb32_misc(uint16_t instr1, uint16_t instr2)
{
	if (THUMB32_RM(instr1, instr2) != REG_PC && THUMB32_RD(instr1, instr2) != REG_PC && THUMB32_RN(instr1, instr2) != REG_PC) {
		return FASTTRAP_T_COMMON;
	}

	return FASTTRAP_T_INV;
}

static
int
thumb32_parallel_addsub_unsigned(uint16_t instr1, uint16_t instr2)
{
	if (THUMB32_RM(instr1, instr2) != REG_PC && THUMB32_RD(instr1, instr2) != REG_PC && THUMB32_RN(instr1, instr2) != REG_PC) {
		return FASTTRAP_T_COMMON;
	}

	return FASTTRAP_T_INV;
}

static
int
thumb32_parallel_addsub_signed(uint16_t instr1, uint16_t instr2)
{
	if (THUMB32_RM(instr1, instr2) != REG_PC && THUMB32_RD(instr1, instr2) != REG_PC && THUMB32_RN(instr1, instr2) != REG_PC) {
		return FASTTRAP_T_COMMON;
	}

	return FASTTRAP_T_INV;
}

static
int
thumb32_dataproc_reg(uint16_t instr1, uint16_t instr2)
{
	int op1 = BITS(instr1, 4, 0xF), op2 = BITS(instr2, 4, 0xF);

	if (((0 <= op1) && (op1 <= 5)) && (op2 & 0x8) == 0x8) {
		if (THUMB32_RM(instr1, instr2) != REG_PC && THUMB32_RD(instr1, instr2) != REG_PC) {
			return FASTTRAP_T_COMMON;
		}
	}

	if ((op1 & 0x8) == 0 && op2 == 0) {
		if (THUMB32_RM(instr1, instr2) != REG_PC && THUMB32_RD(instr1, instr2) != REG_PC && THUMB32_RN(instr1, instr2) != REG_PC) {
			return FASTTRAP_T_COMMON;
		}
	}

	if ((op1 & 0x8) == 0x8 && (op2 & 0xC) == 0) {
		return thumb32_parallel_addsub_signed(instr1, instr2);
	}

	if ((op1 & 0x8) == 0x8 && (op2 & 0xC) == 0x4) {
		return thumb32_parallel_addsub_unsigned(instr1, instr2);
	}

	if ((op1 & 0xC) == 0x8 && (op2 & 0xC) == 0x8) {
		return thumb32_misc(instr1, instr2);
	}

	return FASTTRAP_T_INV;
}

static
int
thumb32_dataproc_regshift(uint16_t instr1, uint16_t instr2)
{
	int op = BITS(instr1, 5, 0xF), S = BITS(instr1, 4, 0x1);

	if (op == 0 || op == 0x4 || op == 0x8 || op == 0xD) {
		/* These become test instructions if S is 1 and Rd is PC, otherwise they are data instructions. */
		if (S == 1) {
			if (THUMB32_RM(instr1, instr2) != REG_PC && THUMB32_RN(instr1, instr2) != REG_PC) {
				return FASTTRAP_T_COMMON;
			}
		} else {
			if (THUMB32_RM(instr1, instr2) != REG_PC && THUMB32_RD(instr1, instr2) != REG_PC &&
			    THUMB32_RN(instr1, instr2) != REG_PC) {
				return FASTTRAP_T_COMMON;
			}
		}
	} else if (op == 0x2 || op == 0x3) {
		/* These become moves if RN is PC, otherwise they are data insts. We don't instrument mov pc, reg here */
		if (THUMB32_RM(instr1, instr2) != REG_PC && THUMB32_RD(instr1, instr2) != REG_PC) {
			return FASTTRAP_T_COMMON;
		}
	} else {
		/* Normal three register instruction */
		if (THUMB32_RM(instr1, instr2) != REG_PC && THUMB32_RD(instr1, instr2) != REG_PC && THUMB32_RN(instr1, instr2) != REG_PC) {
			return FASTTRAP_T_COMMON;
		}
	}

	return FASTTRAP_T_INV;
}

static
int
thumb32_store_single(uint16_t instr1, uint16_t instr2)
{
	int op1 = BITS(instr1, 5, 0x7), op2 = BITS(instr2, 6, 0x3F);

	/* Do not support any use of the pc yet */
	if ((op1 == 0 || op1 == 1 || op1 == 2) && (op2 & 0x20) == 0) {
		/* str (register) uses RM */
		if (THUMB32_RM(instr1, instr2) == REG_PC) {
			return FASTTRAP_T_INV;
		}
	}

	if (THUMB32_RT(instr1, instr2) != REG_PC && THUMB32_RN(instr1, instr2) != REG_PC) {
		return FASTTRAP_T_COMMON;
	}

	return FASTTRAP_T_INV;
}

static
int
thumb32_loadbyte_memhint(uint16_t instr1, uint16_t instr2)
{
	int op1 = BITS(instr1, 7, 0x3), __unused op2 = BITS(instr2, 6, 0x3F);

	/* Do not support any use of the pc yet */
	if ((op1 == 0 || op1 == 0x2) && THUMB32_RM(instr1, instr2) == REG_PC) {
		return FASTTRAP_T_INV;
	}

	if (THUMB32_RT(instr1, instr2) != REG_PC && THUMB32_RN(instr1, instr2) != REG_PC) {
		return FASTTRAP_T_COMMON;
	}

	return FASTTRAP_T_INV;
}

static
int
thumb32_loadhalfword_memhint(uint16_t instr1, uint16_t instr2)
{
	int op1 = BITS(instr1, 7, 0x3), op2 = BITS(instr2, 6, 0x3F);

	/* Do not support any use of the PC yet */
	if (op1 == 0 && op2 == 0 && THUMB32_RM(inst1, instr2) == REG_PC) {
		return FASTTRAP_T_INV;
	}

	if (THUMB32_RT(instr1, instr2) != REG_PC && THUMB32_RN(instr1, instr2) != REG_PC) {
		return FASTTRAP_T_COMMON;
	}

	return FASTTRAP_T_INV;
}

static
int
thumb32_loadword(uint16_t instr1, uint16_t instr2)
{
	int op1 = BITS(instr1, 7, 0x3), op2 = BITS(instr2, 6, 0x3F);

	if ((op1 & 0x2) == 0 && THUMB32_RN(instr1, instr2) == REG_PC && THUMB32_RT(instr1, instr2) != REG_PC) {
		return FASTTRAP_T_LDR_PC_IMMED;
	}

	if (op1 == 0 && op2 == 0) {
		/* ldr (register) uses an additional reg */
		if (THUMB32_RM(instr1, instr2) == REG_PC) {
			return FASTTRAP_T_INV;
		}
	}

	if (THUMB32_RT(instr1, instr2) != REG_PC && THUMB32_RN(instr1, instr2) != REG_PC) {
		return FASTTRAP_T_COMMON;
	}

	return FASTTRAP_T_INV;
}

static
int
thumb32_loadstore_double_exclusive_table(__unused uint16_t instr1, __unused uint16_t instr2)
{
	/* Don't instrument any of these */

	return FASTTRAP_T_INV;
}

static
int
thumb32_loadstore_multiple(uint16_t instr1, uint16_t instr2)
{
	int op = BITS(instr1, 7, 0x3), L = BITS(instr1, 4, 0x1), uses_pc = BITS(instr2, 15, 0x1), uses_lr = BITS(instr2, 14, 0x1);

	if (op == 0 || op == 0x3) {
		/* Privileged instructions: srs, rfe */
		return FASTTRAP_T_INV;
	}

	/* Only emulate a use of the pc if it's a return from function: ldmia sp!, { ... pc }, aka pop { ... pc } */
	if (op == 0x1 && L == 1 && THUMB32_RN(instr1, instr2) == REG_SP && uses_pc == 1) {
		return FASTTRAP_T_LDM_PC;
	}

	/* stmia sp!, { ... lr }, aka push { ... lr } doesn't touch the pc, but it is very common, so special case it */
	if (op == 0x2 && L == 0 && THUMB32_RN(instr1, instr2) == REG_SP && uses_lr == 1) {
		return FASTTRAP_T_STM_LR;
	}

	if (THUMB32_RN(instr1, instr2) != REG_PC && uses_pc == 0) {
		return FASTTRAP_T_COMMON;
	}

	return FASTTRAP_T_INV;
}

static
int
thumb32_misc_control(__unused uint16_t instr1, __unused uint16_t instr2)
{
	/* Privileged, and instructions dealing with ThumbEE */
	return FASTTRAP_T_INV;
}

static
int
thumb32_cps_hints(__unused uint16_t instr1, __unused uint16_t instr2)
{
	/* Privileged */
	return FASTTRAP_T_INV;
}

static
int
thumb32_b_misc_control(uint16_t instr1, uint16_t instr2)
{
	int op = BITS(instr1, 4, 0x7F), op1 = BITS(instr2, 12, 0x7), __unused op2 = BITS(instr2, 8, 0xF);

	if ((op1 & 0x5) == 0) {
		if ((op & 0x38) != 0x38) {
			return FASTTRAP_T_B_COND;
		}

		if (op == 0x3A) {
			return thumb32_cps_hints(instr1, instr2);
		}

		if (op == 0x3B) {
			return thumb32_misc_control(instr1, instr2);
		}
	}

	if ((op1 & 0x5) == 1) {
		return FASTTRAP_T_B_UNCOND;
	}

	return FASTTRAP_T_INV;
}

static
int
thumb32_dataproc_plain_immed(uint16_t instr1, uint16_t instr2)
{
	int op = BITS(instr1, 4, 0x1F);

	if (op == 0x04 || op == 0x0C || op == 0x16) {
		/* mov, movt, bfi, bfc */
		/* These use only RD */
		if (THUMB32_RD(instr1, instr2) != REG_PC) {
			return FASTTRAP_T_COMMON;
		}
	} else {
		if (THUMB32_RD(instr1, instr2) != REG_PC && THUMB32_RN(instr1, instr2) != REG_PC) {
			return FASTTRAP_T_COMMON;
		}
	}

	return FASTTRAP_T_INV;
}

static
int
thumb32_dataproc_mod_immed(uint16_t instr1, uint16_t instr2)
{
	int op = BITS(instr1, 5, 0xF), S = BITS(instr1, 4, 0x1);

	if (op == 0x2 || op == 0x3) {
		/* These allow REG_PC in RN, but it doesn't mean use the PC! */
		if (THUMB32_RD(instr1, instr2) != REG_PC) {
			return FASTTRAP_T_COMMON;
		}
	}

	if (op == 0 || op == 0x4 || op == 0x8 || op == 0xD) {
		/* These are test instructions, if the sign bit is set and RD is the PC. */
		if (S && THUMB32_RD(instr1, instr2) == REG_PC) {
			return FASTTRAP_T_COMMON;
		}
	}

	if (THUMB32_RD(instr1, instr2) != REG_PC && THUMB32_RN(instr1, instr2) != REG_PC) {
		return FASTTRAP_T_COMMON;
	}

	return FASTTRAP_T_INV;
}

static
int
dtrace_decode_thumb32(uint16_t instr1, uint16_t instr2)
{
	int op1 = BITS(instr1, 11, 0x3), op2 = BITS(instr1, 4, 0x7F), op = BITS(instr2, 15, 0x1);

	if (op1 == 0x1) {
		if ((op2 & 0x64) == 0) {
			return thumb32_loadstore_multiple(instr1, instr2);
		}

		if ((op2 & 0x64) == 0x04) {
			return thumb32_loadstore_double_exclusive_table(instr1, instr2);
		}

		if ((op2 & 0x60) == 0x20) {
			return thumb32_dataproc_regshift(instr1, instr2);
		}

		if ((op2 & 0x40) == 0x40) {
			return thumb32_coproc(instr1, instr2);
		}
	}

	if (op1 == 0x2) {
		if ((op2 & 0x20) == 0 && op == 0) {
			return thumb32_dataproc_mod_immed(instr1, instr2);
		}

		if ((op2 & 0x20) == 0x20 && op == 0) {
			return thumb32_dataproc_plain_immed(instr1, instr2);
		}

		if (op == 1) {
			return thumb32_b_misc_control(instr1, instr2);
		}
	}

	if (op1 == 0x3) {
		if ((op2 & 0x71) == 0) {
			return thumb32_store_single(instr1, instr2);
		}

		if ((op2 & 0x71) == 0x10) {
			return vfp_struct_loadstore(thumb32_instword_to_arm(instr1, instr2));
		}

		if ((op2 & 0x67) == 0x01) {
			return thumb32_loadbyte_memhint(instr1, instr2);
		}

		if ((op2 & 0x67) == 0x03) {
			return thumb32_loadhalfword_memhint(instr1, instr2);
		}

		if ((op2 & 0x67) == 0x05) {
			return thumb32_loadword(instr1, instr2);
		}

		if ((op2 & 0x67) == 0x07) {
			/* Undefined instruction */
			return FASTTRAP_T_INV;
		}

		if ((op2 & 0x70) == 0x20) {
			return thumb32_dataproc_reg(instr1, instr2);
		}

		if ((op2 & 0x78) == 0x30) {
			return thumb32_multiply(instr1, instr2);
		}

		if ((op2 & 0x78) == 0x38) {
			return thumb32_longmultiply(instr1, instr2);
		}

		if ((op2 & 0x40) == 0x40) {
			return thumb32_coproc(instr1, instr2);
		}
	}

	return FASTTRAP_T_INV;
}

int
dtrace_decode_thumb(uint32_t instr)
{
	uint16_t* pInstr = (uint16_t*) &instr;
	uint16_t hw1 = pInstr[0], hw2 = pInstr[1];

	int size = BITS(hw1, 11, 0x1F);

	if (size == 0x1D || size == 0x1E || size == 0x1F) {
		return dtrace_decode_thumb32(hw1, hw2);
	} else {
		return dtrace_decode_thumb16(hw1);
	}
}