emu_seam_div0.c

Go to the documentation of this file.

 
#include <stdio.h>
#include <string.h>
 
#include "emu_elf.h"
#include "emu_elf_source_internal.h"
#include "emu_engine.h"
#include "emu_exc.h"
#include "emu_host_io_internal.h"
#include "emu_seams.h"

static bool s_div0_fault;

static uint32_t s_div0_fault_pc;

static uint64_t s_div0_traps;
 
/*
 * =============================================================================
 * Divide-by-zero UsageFault (CCR.DIV_0_TRP) -- CPU-model seam.
 *
 * Unicorn's Cortex-M core executes UDIV/SDIV with the Arm default divide-by-zero
 * result (quotient 0) and never raises the UsageFault that real Armv7-M/Armv8-M
 * silicon takes when CCR.DIV_0_TRP is set. ra8_emulator closes that gap by scanning
 * the image for every UDIV/SDIV site and -- only after the firmware sets
 * CCR.DIV_0_TRP (watched via on_scb_ctrl_write) -- overwriting those sites with an
 * undefined instruction (UDF). Each divide then traps through the already-armed
 * ::on_invalid_insn hook into ::emulate_div0_patched, which either takes a decoded
 * UsageFault (divisor zero) or emulates the divide in software (::internal_div0_quotient)
 * and continues. Patching -- rather than a per-site UC_HOOK_CODE -- is the point:
 * a code hook disables Unicorn's engine-wide block chaining and would roughly
 * quarter throughput for ANY busy firmware that arms the trap, whereas the invalid
 * hook has no such cost. A firmware that never opts in keeps its native divides
 * and pays nothing. Faithful in both directions: no faked trap, no masked one.
 * =============================================================================
 */

static const uint8_t s_k_div0_udf[k_div0_insn_len] = {
  (uint8_t)k_div0_udf_b0,
  (uint8_t)k_div0_udf_b1,
  0U,
  (uint8_t)k_div0_udf_b3,
};

typedef struct {
  uint32_t va;  
  uint16_t hw1; 
  uint16_t hw2; 
} div0_site_t;

enum : uint32_t {
  k_div0_sites_max = 4096U, 
};
static div0_site_t s_div0_site[k_div0_sites_max]; 
static uint32_t    s_div0_site_n;                 
static bool        s_div0_armed;                  

RA8_INTERNAL static bool internal_udiv_sdiv_decode(uint16_t  hw1,
                                                   uint16_t  hw2,
                                                   uint32_t* out_rn,
                                                   uint32_t* out_rd,
                                                   uint32_t* out_rm,
                                                   bool*     out_signed)
{
  if ((out_rn == nullptr) || (out_rd == nullptr) || (out_rm == nullptr) ||
      (out_signed == nullptr)) {
    return false;
  }
  const bool is_udiv = ((uint32_t)hw1 & (uint32_t)k_div0_hw1_mask) == (uint32_t)k_div0_hw1_udiv;
  const bool is_sdiv = ((uint32_t)hw1 & (uint32_t)k_div0_hw1_mask) == (uint32_t)k_div0_hw1_sdiv;
  if (!is_udiv && !is_sdiv) {
    return false;
  }
  if (((uint32_t)hw2 & (uint32_t)k_div0_hw2_mask) != (uint32_t)k_div0_hw2_fixed) {
    return false;
  }
  const uint32_t rn = (uint32_t)hw1 & (uint32_t)k_div0_reg_mask;
  const uint32_t rd = ((uint32_t)hw2 >> (uint32_t)k_div0_rd_shift) & (uint32_t)k_div0_reg_mask;
  const uint32_t rm = (uint32_t)hw2 & (uint32_t)k_div0_reg_mask;
  /* d/n/m == SP or PC is UNPREDICTABLE for UDIV/SDIV: never a real divide, so
   * this window is a false positive straddling two instructions. Reject it so
   * the arming pass does not overwrite executed code with UDF. */
  if ((rn == (uint32_t)k_div0_reg_sp) || (rn == (uint32_t)k_div0_reg_pc) ||
      (rd == (uint32_t)k_div0_reg_sp) || (rd == (uint32_t)k_div0_reg_pc) ||
      (rm == (uint32_t)k_div0_reg_sp) || (rm == (uint32_t)k_div0_reg_pc)) {
    return false;
  }
  *out_rn     = rn;
  *out_rd     = rd;
  *out_rm     = rm;
  *out_signed = is_sdiv;
  return true;
}

RA8_INTERNAL static uint32_t internal_div0_quotient(uint32_t vn, uint32_t vm, bool is_signed)
{
  if (vm == 0U) {
    return 0U; /* Arm default when DIV_0_TRP is clear. */
  }
  if (!is_signed) {
    return vn / vm;
  }
  if ((vn == (uint32_t)k_div0_int32_min) && ((int32_t)vm == -1)) {
    return (uint32_t)k_div0_int32_min; /* Arm SDIV overflow: INT32_MIN / -1 = INT32_MIN. */
  }
  return (uint32_t)((int32_t)vn / (int32_t)vm);
}

bool emulate_div0_patched(uc_engine* uc, uint32_t pc, const uint8_t code[4])
{
  (void)code;
  const div0_site_t* site = nullptr;
  for (uint32_t i = 0U; i < s_div0_site_n; i++) {
    if (s_div0_site[i].va == pc) {
      site = &s_div0_site[i];
      break;
    }
  }
  if (site == nullptr) {
    return false; /* not an armed divide -- let the other invalid-insn handlers try. */
  }
  uint32_t rn   = 0U;
  uint32_t rd   = 0U;
  uint32_t rm   = 0U;
  bool     sign = false;
  if (!internal_udiv_sdiv_decode(site->hw1, site->hw2, &rn, &rd, &rm, &sign)) {
    return false; /* a tracked non-divide (scan false-positive): not ours to service. */
  }
  uint32_t vn = 0U;
  uint32_t vm = 0U;
  (void)uc_reg_read(uc, k_arm_reg_id[rn], &vn);
  (void)uc_reg_read(uc, k_arm_reg_id[rm], &vm);
  const uint32_t ccr = rd32(uc, (uint64_t)k_scb_ccr);
  if ((vm == 0U) && ((ccr & (uint32_t)k_ccr_div_0_trp) != 0U)) {
    s_div0_fault    = true;
    s_div0_fault_pc = pc; /* stacked PC == the divide, as real hardware does.          */
    return true;          /* PC left at the site; the run loop synthesises UsageFault. */
  }
  const uint32_t q = internal_div0_quotient(vn, vm, sign);
  (void)uc_reg_write(uc, k_arm_reg_id[rd], &q);
  uint32_t next = pc + (uint32_t)k_div0_insn_len;
  (void)uc_reg_write(uc, UC_ARM_REG_PC, &next);
  /* Emulating one divide consumes no modelled time: mark the stop a zero-time
   * seam relaunch so the inner run loop re-enters at `next` WITHOUT advancing
   * SysTick or charging an outer chunk (like on_sdmmc_read_block). Without this,
   * a divide in a hot loop (e.g. ra8_keycache_put's modulo hashing) charges one
   * of the 40000 chunks per execution, exhausting the budget mid-render. The
   * zero-divisor trap path above returns earlier and is handled by the
   * s_div0_fault branch, which is already zero-time. */
  emu_seam_request_relaunch();
  return true;
}

void div0_patch_sites(uc_engine* uc)
{
  if (s_div0_armed) {
    return;
  }
  for (uint32_t i = 0U; i < s_div0_site_n; i++) {
    (void)emu_mem_write(uc, (uint64_t)s_div0_site[i].va, s_k_div0_udf, sizeof(s_k_div0_udf));
  }
  s_div0_armed = true;
  (void)priv_emu_io_errf("  div-0 seam: CCR.DIV_0_TRP set -- patched %u UDIV/SDIV site(s)\n",
                         (unsigned)s_div0_site_n);
}

RA8_INTERNAL static bool internal_div0_scan_segment(const elf_exec_segment_t* seg, void* ctx)
{
  (void)ctx;
  enum : size_t {
    k_div0_scan_scratch = 4096U, 
  };
  uint8_t  bytes[k_div0_scan_scratch];
  uint32_t base = 0U;
  while ((base + (uint32_t)k_div0_insn_len) <= seg->filesz) {
    const uint32_t left   = seg->filesz - base;
    const size_t   length = (left < sizeof(bytes)) ? (size_t)left : sizeof(bytes);
    emu_elf_view_t view   = {};
    if (priv_emu_elf_read(seg->source,
                          (uint64_t)seg->offset + base,
                          length,
                          bytes,
                          sizeof(bytes),
                          &view)
          .status != k_emu_elf_io_ok) {
      return false;
    }
    for (size_t local = 0U; (local + k_div0_insn_len) <= length; local += 2U) {
      const uint8_t* p    = &bytes[local];
      const uint16_t hw1  = (uint16_t)(p[0] | ((uint16_t)p[1] << 8));
      const uint16_t hw2  = (uint16_t)(p[2] | ((uint16_t)p[3] << 8));
      uint32_t       rn   = 0U;
      uint32_t       rd   = 0U;
      uint32_t       rm   = 0U;
      bool           sign = false;
      if (!internal_udiv_sdiv_decode(hw1, hw2, &rn, &rd, &rm, &sign)) {
        continue;
      }
      if (s_div0_site_n >= (uint32_t)k_div0_sites_max) {
        (void)priv_emu_io_errf("  div-0 seam: site cap %u reached\n", (unsigned)k_div0_sites_max);
        return false;
      }
      s_div0_site[s_div0_site_n] =
        (div0_site_t){.va = seg->vaddr + base + (uint32_t)local, .hw1 = hw1, .hw2 = hw2};
      s_div0_site_n++;
    }
    if (length == left) {
      break;
    }
    base += (uint32_t)length - 2U;
  }
  return true;
}

void div0_seam_install(const emu_elf_source_t* elf)
{
  s_div0_site_n = 0U;
  s_div0_armed  = false;
  (void)elf_foreach_exec_segment(elf, internal_div0_scan_segment, nullptr);
  /* The CCR write that arms these sites is caught by on_scb_ctrl_write; arming
   * overwrites each with UDF so its execution traps through on_invalid_insn. */
  if (s_div0_site_n > 0U) {
    (void)priv_emu_io_errf("  div-0 seam: %u UDIV/SDIV site(s) tracked; armed on CCR.DIV_0_TRP\n",
                           (unsigned)s_div0_site_n);
  }
}

void div0_synth_usagefault(uc_engine* uc, uint32_t vtor_base)
{
  const uint32_t cfsr = rd32(uc, (uint64_t)k_scb_cfsr) | (uint32_t)k_div0_cfsr_divzero;
  wr32(uc, (uint64_t)k_scb_cfsr, cfsr);
  const uint32_t fault_pc = emu_div0_fault_pc();
  (void)uc_reg_write(uc, UC_ARM_REG_PC, &fault_pc);
  const uint32_t handler = exc_vector(uc, vtor_base, (uint32_t)k_exc_usagefault);
  if (handler != 0U) {
    emu_div0_count_trap();
    exc_enter(uc, (uint32_t)k_exc_usagefault, handler);
  }
}

bool emu_div0_fault_pending(void)
{
  return s_div0_fault;
}

void emu_div0_clear_fault(void)
{
  s_div0_fault = false;
}

uint32_t emu_div0_fault_pc(void)
{
  return s_div0_fault_pc;
}

void emu_div0_count_trap(void)
{
  s_div0_traps++;
}

void emu_div0_disarm(void)
{
  s_div0_armed = false;
}