mirror of
https://github.com/pound-emu/ballistic.git
synced 2026-01-31 01:15:21 +01:00
260 lines
17 KiB
XML
260 lines
17 KiB
XML
<?xml version="1.0" encoding="utf-8"?>
|
|
<?xml-stylesheet type="text/xsl" encoding="UTF-8" href="iform.xsl" version="1.0"?>
|
|
<!DOCTYPE instructionsection PUBLIC "-//ARM//DTD instructionsection //EN" "iform-p.dtd">
|
|
<!-- Copyright (c) 2010-2022 Arm Limited or its affiliates. All rights reserved. -->
|
|
<!-- This document is Non-Confidential. This document may only be used and distributed in accordance with the terms of the agreement entered into by Arm and the party that Arm delivered this document to. -->
|
|
|
|
<instructionsection id="BRA" title="BRAA, BRAAZ, BRAB, BRABZ -- A64" type="instruction">
|
|
<docvars>
|
|
<docvar key="instr-class" value="general" />
|
|
<docvar key="isa" value="A64" />
|
|
</docvars>
|
|
<heading>BRAA, BRAAZ, BRAB, BRABZ</heading>
|
|
<desc>
|
|
<brief>
|
|
<para>Branch to Register, with pointer authentication</para>
|
|
</brief>
|
|
<authored>
|
|
<para>Branch to Register, with pointer authentication. This instruction authenticates the address in the general-purpose register that is specified by <syntax><Xn></syntax>, using a modifier and the specified key, and branches to the authenticated address.</para>
|
|
<para>The modifier is:</para>
|
|
<list type="unordered">
|
|
<listitem><content>In the general-purpose register or stack pointer that is specified by <syntax><Xm|SP></syntax> for <instruction>BRAA</instruction> and <instruction>BRAB</instruction>.</content></listitem>
|
|
<listitem><content>The value zero, for <instruction>BRAAZ</instruction> and <instruction>BRABZ</instruction>.</content></listitem>
|
|
</list>
|
|
<para>Key A is used for <instruction>BRAA</instruction> and <instruction>BRAAZ</instruction>. Key B is used for <instruction>BRAB</instruction> and <instruction>BRABZ</instruction>.</para>
|
|
<para>If the authentication passes, the PE continues execution at the target of the branch. For information on behavior if the authentication fails, see <xref>Faulting on pointer authentication</xref>.</para>
|
|
<para>The authenticated address is not written back to the general-purpose register.</para>
|
|
</authored>
|
|
</desc>
|
|
<alias_list howmany="0"></alias_list>
|
|
<classes>
|
|
<iclass name="Integer" oneof="1" id="iclass_general" no_encodings="4" isa="A64">
|
|
<docvars>
|
|
<docvar key="instr-class" value="general" />
|
|
<docvar key="isa" value="A64" />
|
|
</docvars>
|
|
<iclassintro count="4"></iclassintro>
|
|
<arch_variants>
|
|
<arch_variant name="ARMv8.3" feature="FEAT_PAuth" />
|
|
</arch_variants>
|
|
<regdiagram form="32" psname="aarch64/instrs/branch/unconditional/register" tworows="1">
|
|
<box hibit="31" width="7" settings="7">
|
|
<c>1</c>
|
|
<c>1</c>
|
|
<c>0</c>
|
|
<c>1</c>
|
|
<c>0</c>
|
|
<c>1</c>
|
|
<c>1</c>
|
|
</box>
|
|
<box hibit="24" name="Z" usename="1">
|
|
<c></c>
|
|
</box>
|
|
<box hibit="23" name="opc[2:1]" settings="1">
|
|
<c>0</c>
|
|
</box>
|
|
<box hibit="22" width="2" name="op" usename="1" settings="2" psbits="xx">
|
|
<c>0</c>
|
|
<c>0</c>
|
|
</box>
|
|
<box hibit="20" width="5" name="op2" settings="5">
|
|
<c>1</c>
|
|
<c>1</c>
|
|
<c>1</c>
|
|
<c>1</c>
|
|
<c>1</c>
|
|
</box>
|
|
<box hibit="15" width="4" name="op3[5:2]" settings="4">
|
|
<c>0</c>
|
|
<c>0</c>
|
|
<c>0</c>
|
|
<c>0</c>
|
|
</box>
|
|
<box hibit="11" name="A" usename="1" settings="1" psbits="x">
|
|
<c>1</c>
|
|
</box>
|
|
<box hibit="10" name="M" usename="1">
|
|
<c></c>
|
|
</box>
|
|
<box hibit="9" width="5" name="Rn" usename="1">
|
|
<c colspan="5"></c>
|
|
</box>
|
|
<box hibit="4" width="5" name="Rm" usename="1">
|
|
<c colspan="5"></c>
|
|
</box>
|
|
</regdiagram>
|
|
<encoding name="BRAAZ_64_branch_reg" oneofinclass="4" oneof="4" label="Key A, zero modifier" bitdiffs="Z == 0 && M == 0 && Rm == 11111">
|
|
<docvars>
|
|
<docvar key="instr-class" value="general" />
|
|
<docvar key="isa" value="A64" />
|
|
<docvar key="loadstore-bra" value="key-a-zmod" />
|
|
<docvar key="mnemonic" value="BRAAZ" />
|
|
</docvars>
|
|
<box hibit="24" width="1" name="Z">
|
|
<c>0</c>
|
|
</box>
|
|
<box hibit="10" width="1" name="M">
|
|
<c>0</c>
|
|
</box>
|
|
<box hibit="4" width="5" name="Rm">
|
|
<c>1</c>
|
|
<c>1</c>
|
|
<c>1</c>
|
|
<c>1</c>
|
|
<c>1</c>
|
|
</box>
|
|
<asmtemplate><text>BRAAZ </text><a link="sa_xn" hover="64-bit general-purpose register holding address to be branched to (field "Rn")"><Xn></a></asmtemplate>
|
|
</encoding>
|
|
<encoding name="BRAA_64P_branch_reg" oneofinclass="4" oneof="4" label="Key A, register modifier" bitdiffs="Z == 1 && M == 0">
|
|
<docvars>
|
|
<docvar key="instr-class" value="general" />
|
|
<docvar key="isa" value="A64" />
|
|
<docvar key="loadstore-bra" value="key-a-regmod" />
|
|
<docvar key="mnemonic" value="BRAA" />
|
|
</docvars>
|
|
<box hibit="24" width="1" name="Z">
|
|
<c>1</c>
|
|
</box>
|
|
<box hibit="10" width="1" name="M">
|
|
<c>0</c>
|
|
</box>
|
|
<asmtemplate><text>BRAA </text><a link="sa_xn" hover="64-bit general-purpose register holding address to be branched to (field "Rn")"><Xn></a><text>, </text><a link="sa_xm_sp" hover="64-bit general-purpose source register or SP holding modifier (field "Rm")"><Xm|SP></a></asmtemplate>
|
|
</encoding>
|
|
<encoding name="BRABZ_64_branch_reg" oneofinclass="4" oneof="4" label="Key B, zero modifier" bitdiffs="Z == 0 && M == 1 && Rm == 11111">
|
|
<docvars>
|
|
<docvar key="instr-class" value="general" />
|
|
<docvar key="isa" value="A64" />
|
|
<docvar key="loadstore-bra" value="key-b-zmod" />
|
|
<docvar key="mnemonic" value="BRABZ" />
|
|
</docvars>
|
|
<box hibit="24" width="1" name="Z">
|
|
<c>0</c>
|
|
</box>
|
|
<box hibit="10" width="1" name="M">
|
|
<c>1</c>
|
|
</box>
|
|
<box hibit="4" width="5" name="Rm">
|
|
<c>1</c>
|
|
<c>1</c>
|
|
<c>1</c>
|
|
<c>1</c>
|
|
<c>1</c>
|
|
</box>
|
|
<asmtemplate><text>BRABZ </text><a link="sa_xn" hover="64-bit general-purpose register holding address to be branched to (field "Rn")"><Xn></a></asmtemplate>
|
|
</encoding>
|
|
<encoding name="BRAB_64P_branch_reg" oneofinclass="4" oneof="4" label="Key B, register modifier" bitdiffs="Z == 1 && M == 1">
|
|
<docvars>
|
|
<docvar key="instr-class" value="general" />
|
|
<docvar key="isa" value="A64" />
|
|
<docvar key="loadstore-bra" value="key-b-regmod" />
|
|
<docvar key="mnemonic" value="BRAB" />
|
|
</docvars>
|
|
<box hibit="24" width="1" name="Z">
|
|
<c>1</c>
|
|
</box>
|
|
<box hibit="10" width="1" name="M">
|
|
<c>1</c>
|
|
</box>
|
|
<asmtemplate><text>BRAB </text><a link="sa_xn" hover="64-bit general-purpose register holding address to be branched to (field "Rn")"><Xn></a><text>, </text><a link="sa_xm_sp" hover="64-bit general-purpose source register or SP holding modifier (field "Rm")"><Xm|SP></a></asmtemplate>
|
|
</encoding>
|
|
<ps_section howmany="1">
|
|
<ps name="aarch64/instrs/branch/unconditional/register" mylink="aarch64.instrs.branch.unconditional.register" enclabels="" sections="1" secttype="noheading">
|
|
<pstext mayhavelinks="1" section="Decode" rep_section="decode">integer n = <a link="impl-shared.UInt.1" file="shared_pseudocode.xml" hover="function: integer UInt(bits(N) x)">UInt</a>(Rn);
|
|
<a link="BranchType" file="shared_pseudocode.xml" hover="enumeration BranchType { BranchType_DIRCALL, BranchType_INDCALL, BranchType_ERET, BranchType_DBGEXIT, BranchType_RET, BranchType_DIR, BranchType_INDIR, BranchType_EXCEPTION, BranchType_TMFAIL, BranchType_RESET, BranchType_UNKNOWN}">BranchType</a> branch_type;
|
|
integer m = <a link="impl-shared.UInt.1" file="shared_pseudocode.xml" hover="function: integer UInt(bits(N) x)">UInt</a>(Rm);
|
|
boolean pac = (A == '1');
|
|
boolean use_key_a = (M == '0');
|
|
boolean source_is_sp = ((Z == '1') && (m == 31));
|
|
|
|
if !pac && m != 0 then
|
|
UNDEFINED;
|
|
elsif pac && !<a link="impl-aarch64.HavePACExt.0" file="shared_pseudocode.xml" hover="function: boolean HavePACExt()">HavePACExt</a>() then
|
|
UNDEFINED;
|
|
|
|
case op of
|
|
when '00' branch_type = <a link="BranchType_INDIR" file="shared_pseudocode.xml" hover="enumeration BranchType { BranchType_DIRCALL, BranchType_INDCALL, BranchType_ERET, BranchType_DBGEXIT, BranchType_RET, BranchType_DIR, BranchType_INDIR, BranchType_EXCEPTION, BranchType_TMFAIL, BranchType_RESET, BranchType_UNKNOWN}">BranchType_INDIR</a>;
|
|
when '01' branch_type = <a link="BranchType_INDCALL" file="shared_pseudocode.xml" hover="enumeration BranchType { BranchType_DIRCALL, BranchType_INDCALL, BranchType_ERET, BranchType_DBGEXIT, BranchType_RET, BranchType_DIR, BranchType_INDIR, BranchType_EXCEPTION, BranchType_TMFAIL, BranchType_RESET, BranchType_UNKNOWN}">BranchType_INDCALL</a>;
|
|
when '10' branch_type = <a link="BranchType_RET" file="shared_pseudocode.xml" hover="enumeration BranchType { BranchType_DIRCALL, BranchType_INDCALL, BranchType_ERET, BranchType_DBGEXIT, BranchType_RET, BranchType_DIR, BranchType_INDIR, BranchType_EXCEPTION, BranchType_TMFAIL, BranchType_RESET, BranchType_UNKNOWN}">BranchType_RET</a>;
|
|
otherwise UNDEFINED;
|
|
|
|
if pac then
|
|
if Z == '0' && m != 31 then
|
|
UNDEFINED;
|
|
|
|
if branch_type == <a link="BranchType_RET" file="shared_pseudocode.xml" hover="enumeration BranchType { BranchType_DIRCALL, BranchType_INDCALL, BranchType_ERET, BranchType_DBGEXIT, BranchType_RET, BranchType_DIR, BranchType_INDIR, BranchType_EXCEPTION, BranchType_TMFAIL, BranchType_RESET, BranchType_UNKNOWN}">BranchType_RET</a> then
|
|
if n != 31 then UNDEFINED;
|
|
n = 30;
|
|
source_is_sp = TRUE;</pstext>
|
|
</ps>
|
|
</ps_section>
|
|
</iclass>
|
|
</classes>
|
|
<explanations scope="all">
|
|
<explanation enclist="BRAA_64P_branch_reg, BRAAZ_64_branch_reg, BRAB_64P_branch_reg, BRABZ_64_branch_reg" symboldefcount="1">
|
|
<symbol link="sa_xn"><Xn></symbol>
|
|
<account encodedin="Rn">
|
|
<intro>
|
|
<para>Is the 64-bit name of the general-purpose register holding the address to be branched to, encoded in the "Rn" field.</para>
|
|
</intro>
|
|
</account>
|
|
</explanation>
|
|
<explanation enclist="BRAA_64P_branch_reg, BRAB_64P_branch_reg" symboldefcount="1">
|
|
<symbol link="sa_xm_sp"><Xm|SP></symbol>
|
|
<account encodedin="Rm">
|
|
<intro>
|
|
<para>Is the 64-bit name of the general-purpose source register or stack pointer holding the modifier, encoded in the "Rm" field.</para>
|
|
</intro>
|
|
</account>
|
|
</explanation>
|
|
</explanations>
|
|
<ps_section howmany="1">
|
|
<ps name="aarch64/instrs/branch/unconditional/register" mylink="execute" enclabels="" sections="1" secttype="Operation">
|
|
<pstext mayhavelinks="1" section="Execute" rep_section="execute"><a link="GCSInstruction" file="shared_pseudocode.xml" hover="enumeration GCSInstruction { GCSInstType_PRET, GCSInstType_POPM, GCSInstType_PRETAA, GCSInstType_PRETAB, GCSInstType_SS1, GCSInstType_SS2, GCSInstType_POPCX, GCSInstType_POPX }">GCSInstruction</a> inst_type;
|
|
bits(64) target = <a link="impl-aarch64.X.read.2" file="shared_pseudocode.xml" hover="accessor: bits(width) X[integer n, integer width]">X</a>[n, 64];
|
|
boolean auth_then_branch = TRUE;
|
|
|
|
if pac then
|
|
bits(64) modifier = if source_is_sp then <a link="impl-aarch64.SP.read.0" file="shared_pseudocode.xml" hover="accessor: bits(64) SP[]">SP</a>[] else <a link="impl-aarch64.X.read.2" file="shared_pseudocode.xml" hover="accessor: bits(width) X[integer n, integer width]">X</a>[m, 64];
|
|
|
|
if use_key_a then
|
|
target = <a link="impl-aarch64.AuthIA.3" file="shared_pseudocode.xml" hover="function: bits(64) AuthIA(bits(64) x, bits(64) y, boolean is_combined)">AuthIA</a>(target, modifier, auth_then_branch);
|
|
else
|
|
target = <a link="impl-aarch64.AuthIB.3" file="shared_pseudocode.xml" hover="function: bits(64) AuthIB(bits(64) x, bits(64) y, boolean is_combined)">AuthIB</a>(target, modifier, auth_then_branch);
|
|
|
|
if branch_type == <a link="BranchType_RET" file="shared_pseudocode.xml" hover="enumeration BranchType { BranchType_DIRCALL, BranchType_INDCALL, BranchType_ERET, BranchType_DBGEXIT, BranchType_RET, BranchType_DIR, BranchType_INDIR, BranchType_EXCEPTION, BranchType_TMFAIL, BranchType_RESET, BranchType_UNKNOWN}">BranchType_RET</a> && <a link="impl-shared.HaveGCS.0" file="shared_pseudocode.xml" hover="function: boolean HaveGCS()">HaveGCS</a>() && <a link="impl-aarch64.GCSPCREnabled.1" file="shared_pseudocode.xml" hover="function: boolean GCSPCREnabled(bits(2) el)">GCSPCREnabled</a>(PSTATE.EL) then
|
|
if !pac then
|
|
inst_type = <a link="GCSInstType_PRET" file="shared_pseudocode.xml" hover="enumeration GCSInstruction { GCSInstType_PRET, GCSInstType_POPM, GCSInstType_PRETAA, GCSInstType_PRETAB, GCSInstType_SS1, GCSInstType_SS2, GCSInstType_POPCX, GCSInstType_POPX }">GCSInstType_PRET</a>;
|
|
else
|
|
if use_key_a then
|
|
inst_type = <a link="GCSInstType_PRETAA" file="shared_pseudocode.xml" hover="enumeration GCSInstruction { GCSInstType_PRET, GCSInstType_POPM, GCSInstType_PRETAA, GCSInstType_PRETAB, GCSInstType_SS1, GCSInstType_SS2, GCSInstType_POPCX, GCSInstType_POPX }">GCSInstType_PRETAA</a>;
|
|
else
|
|
inst_type = <a link="GCSInstType_PRETAB" file="shared_pseudocode.xml" hover="enumeration GCSInstruction { GCSInstType_PRET, GCSInstType_POPM, GCSInstType_PRETAA, GCSInstType_PRETAB, GCSInstType_SS1, GCSInstType_SS2, GCSInstType_POPCX, GCSInstType_POPX }">GCSInstType_PRETAB</a>;
|
|
target = <a link="impl-aarch64.LoadCheckGCSRecord.2" file="shared_pseudocode.xml" hover="function: bits(64) LoadCheckGCSRecord(bits(64) vaddress, GCSInstruction gcsinst_type)">LoadCheckGCSRecord</a>(target, inst_type);
|
|
<a link="impl-aarch64.SetCurrentGCSPointer.1" file="shared_pseudocode.xml" hover="function: SetCurrentGCSPointer(bits(64) ptr)">SetCurrentGCSPointer</a>(<a link="impl-aarch64.GetCurrentGCSPointer.0" file="shared_pseudocode.xml" hover="function: bits(64) GetCurrentGCSPointer()">GetCurrentGCSPointer</a>() + 8);
|
|
|
|
if branch_type == <a link="BranchType_INDCALL" file="shared_pseudocode.xml" hover="enumeration BranchType { BranchType_DIRCALL, BranchType_INDCALL, BranchType_ERET, BranchType_DBGEXIT, BranchType_RET, BranchType_DIR, BranchType_INDIR, BranchType_EXCEPTION, BranchType_TMFAIL, BranchType_RESET, BranchType_UNKNOWN}">BranchType_INDCALL</a> then
|
|
if <a link="impl-shared.HaveGCS.0" file="shared_pseudocode.xml" hover="function: boolean HaveGCS()">HaveGCS</a>() && <a link="impl-aarch64.GCSPCREnabled.1" file="shared_pseudocode.xml" hover="function: boolean GCSPCREnabled(bits(2) el)">GCSPCREnabled</a>(PSTATE.EL) then
|
|
<a link="impl-aarch64.AddGCSRecord.1" file="shared_pseudocode.xml" hover="function: AddGCSRecord(bits(64) vaddress)">AddGCSRecord</a>(<a link="impl-aarch64.PC.read.0" file="shared_pseudocode.xml" hover="accessor: bits(64) PC[]">PC</a>[] + 4);
|
|
<a link="impl-aarch64.X.write.2" file="shared_pseudocode.xml" hover="accessor: X[integer n, integer width] = bits(width) value">X</a>[30, 64] = <a link="impl-aarch64.PC.read.0" file="shared_pseudocode.xml" hover="accessor: bits(64) PC[]">PC</a>[] + 4;
|
|
|
|
// Value in BTypeNext will be used to set PSTATE.BTYPE
|
|
case branch_type of
|
|
when <a link="BranchType_INDIR" file="shared_pseudocode.xml" hover="enumeration BranchType { BranchType_DIRCALL, BranchType_INDCALL, BranchType_ERET, BranchType_DBGEXIT, BranchType_RET, BranchType_DIR, BranchType_INDIR, BranchType_EXCEPTION, BranchType_TMFAIL, BranchType_RESET, BranchType_UNKNOWN}">BranchType_INDIR</a> // BR, BRAA, BRAB, BRAAZ, BRABZ
|
|
if InGuardedPage then
|
|
if n == 16 || n == 17 then
|
|
BTypeNext = '01';
|
|
else
|
|
BTypeNext = '11';
|
|
else
|
|
BTypeNext = '01';
|
|
when <a link="BranchType_INDCALL" file="shared_pseudocode.xml" hover="enumeration BranchType { BranchType_DIRCALL, BranchType_INDCALL, BranchType_ERET, BranchType_DBGEXIT, BranchType_RET, BranchType_DIR, BranchType_INDIR, BranchType_EXCEPTION, BranchType_TMFAIL, BranchType_RESET, BranchType_UNKNOWN}">BranchType_INDCALL</a> // BLR, BLRAA, BLRAB, BLRAAZ, BLRABZ
|
|
BTypeNext = '10';
|
|
when <a link="BranchType_RET" file="shared_pseudocode.xml" hover="enumeration BranchType { BranchType_DIRCALL, BranchType_INDCALL, BranchType_ERET, BranchType_DBGEXIT, BranchType_RET, BranchType_DIR, BranchType_INDIR, BranchType_EXCEPTION, BranchType_TMFAIL, BranchType_RESET, BranchType_UNKNOWN}">BranchType_RET</a> // RET, RETAA, RETAB
|
|
BTypeNext = '00';
|
|
|
|
boolean branch_conditional = FALSE;
|
|
<a link="impl-shared.BranchTo.3" file="shared_pseudocode.xml" hover="function: BranchTo(bits(N) target, BranchType branch_type, boolean branch_conditional)">BranchTo</a>(target, branch_type, branch_conditional);</pstext>
|
|
</ps>
|
|
</ps_section>
|
|
</instructionsection>
|