emu_seam_longshift.c

Go to the documentation of this file.

 
#include <stdio.h>
#include <string.h>
 
#include "emu_elf.h"
#include "emu_elf_source_internal.h"
#include "emu_engine.h"
#include "emu_exc.h"
#include "emu_host_io_internal.h"
#include "emu_seams.h"
 
/* Armv8.1-M long-shift family (LSLL / LSRL / ASRL), both the immediate form
 * (`lsll r4, r5, #7`) and the register form (`lsll r0, r1, ip`).
 *
 * Encoding (T1, two halfwords, little-endian), verified by assembling every
 * member with `arm-none-eabi-as -march=armv8.1-m.main+mve` and reading back the
 * bytes -- the family is dense and three neighbouring groups alias it:
 *
 *   hw1 = 0xEA5n, where n[3:1] = RdaLo (always an EVEN register) and
 *                       n[0]   = 1 selects the SATURATING/ROUNDING subfamily
 *                                (UQSHLL / URSHRL / SRSHRL / SQSHLL /
 *                                 UQRSHLL / SQRSHRL)
 *   hw2[11:8] = RdaHi, except 0b1111 which selects the 32-bit (non-long)
 *                      UQRSHL / SQRSHR
 *   hw2[3:0]  = 0b1111 -> immediate form, imm5 = hw2[14:12]:hw2[7:6]
 *                         (imm5 == 0 encodes a shift of 32)
 *             = 0b1101 -> register form, Rm = hw2[15:12], hw2[7:6] == 0
 *   op = hw2[5:4] (00 = LSLL, 01 = LSRL, 10 = ASRL)
 *
 * The two exclusions matter and are not cosmetic. `uqshll r0, r1, #7` encodes
 * as EA51 11CF: it shares the immediate form's 0b1111 tail and its op field, so
 * a decoder that masks the low FOUR bits of hw1 as RdaLo (as this one once did)
 * accepts it as `lsll r1, r1, #7` and computes an unsaturated shift into the
 * wrong register -- silently wrong 64-bit arithmetic, which is the exact defect
 * this seam exists to prevent. Likewise `uqrshl r0, r2` (EA50 2F0D) has the
 * register form's 0b1101 tail and a clear hw1[0], and is excluded only by its
 * RdaHi == 0b1111. Both subfamilies are therefore rejected here and reported at
 * install time rather than emulated approximately. */
typedef enum : uint32_t {
  k_lsh_hw1_mask     = 0xFFF0U, 
  k_lsh_hw1_match    = 0xEA50U, 
  k_lsh_hw1_sat_bit  = 0x0001U, 
  k_lsh_rdalo_mask   = 0x000EU, 
  k_lsh_hw2_lo_mask  = 0x000FU, 
  k_lsh_tail_imm     = 0x000FU, 
  k_lsh_tail_reg     = 0x000DU, 
  k_lsh_op_shift     = 4U,      
  k_lsh_op_mask      = 0x3U,    
  k_lsh_op_lsll      = 0U,      
  k_lsh_op_lsrl      = 1U,      
  k_lsh_op_asrl      = 2U,      
  k_lsh_rdahi_shift  = 8U,      
  k_lsh_rdahi_wide   = 0x0FU,   
  k_lsh_rm_shift     = 12U,     
  k_lsh_reg_zero_msk = 0x00C0U, 
  k_lsh_imm3_shift   = 12U,     
  k_lsh_imm3_mask    = 0x7U,    
  k_lsh_imm2_shift   = 6U,      
  k_lsh_imm2_mask    = 0x3U,    
  k_lsh_imm3_to_imm5 = 2U,      
  k_lsh_word_bits    = 32U,     
  k_lsh_pair_bits    = 64U,     
  k_lsh_amount_mask  = 0xFFU,   
  k_lsh_amount_wrap  = 0x100U,  
  k_lsh_amount_sign  = 0x80U,   
  k_lsh_insn_len     = 4U,      
} long_shift_t;

typedef struct {
  uint32_t rdalo;  
  uint32_t rdahi;  
  uint32_t op;     
  bool     by_reg; 
  uint32_t rm;     
  uint32_t imm;    
} long_shift_insn_t;

RA8_INTERNAL static bool
internal_long_shift_decode(uint16_t hw1, uint16_t hw2, long_shift_insn_t* out)
{
  if ((hw1 & (uint16_t)k_lsh_hw1_mask) != (uint16_t)k_lsh_hw1_match) {
    return false;
  }
  if ((hw1 & (uint16_t)k_lsh_hw1_sat_bit) != 0U) {
    return false; /* UQSHLL / URSHRL / SRSHRL / SQSHLL / UQRSHLL / SQRSHRL. */
  }
  const uint32_t op = ((uint32_t)hw2 >> (uint32_t)k_lsh_op_shift) & (uint32_t)k_lsh_op_mask;
  if (op > (uint32_t)k_lsh_op_asrl) {
    return false; /* op == 0b11 is reserved -- not a long shift. */
  }
  const uint32_t rdahi = ((uint32_t)hw2 >> (uint32_t)k_lsh_rdahi_shift) & (uint32_t)k_lo4_mask;
  if (rdahi == (uint32_t)k_lsh_rdahi_wide) {
    return false; /* UQRSHL / SQRSHR -- the 32-bit, non-long forms. */
  }
  const uint32_t tail = (uint32_t)hw2 & (uint32_t)k_lsh_hw2_lo_mask;
  *out                = (long_shift_insn_t){
    .rdalo = (uint32_t)hw1 & (uint32_t)k_lsh_rdalo_mask,
    .rdahi = rdahi,
    .op    = op,
  };
  if (tail == (uint32_t)k_lsh_tail_imm) {
    const uint32_t imm3 = ((uint32_t)hw2 >> (uint32_t)k_lsh_imm3_shift) & (uint32_t)k_lsh_imm3_mask;
    const uint32_t imm2 = ((uint32_t)hw2 >> (uint32_t)k_lsh_imm2_shift) & (uint32_t)k_lsh_imm2_mask;
    const uint32_t imm5 = (imm3 << (uint32_t)k_lsh_imm3_to_imm5) | imm2;
    out->imm            = (imm5 == 0U) ? (uint32_t)k_lsh_word_bits : imm5;
    return true;
  }
  if (tail == (uint32_t)k_lsh_tail_reg) {
    if (((uint32_t)hw2 & (uint32_t)k_lsh_reg_zero_msk) != 0U) {
      return false; /* hw2[7:6] must be zero in the register form. */
    }
    if (out->op == (uint32_t)k_lsh_op_lsrl) {
      return false; /* no LSRL register form exists in the ISA. */
    }
    out->by_reg = true;
    out->rm     = ((uint32_t)hw2 >> (uint32_t)k_lsh_rm_shift) & (uint32_t)k_lo4_mask;
    return true;
  }
  return false;
}

RA8_INTERNAL static int32_t internal_long_shift_amount(uc_engine* uc, const long_shift_insn_t* insn)
{
  if (!insn->by_reg) {
    return (int32_t)insn->imm;
  }
  uint32_t rm = 0U;
  (void)uc_reg_read(uc, k_arm_reg_id[insn->rm], &rm);
  const uint32_t byte = rm & (uint32_t)k_lsh_amount_mask;
  if ((byte & (uint32_t)k_lsh_amount_sign) != 0U) {
    return (int32_t)byte - (int32_t)k_lsh_amount_wrap;
  }
  return (int32_t)byte;
}

RA8_INTERNAL static uint64_t internal_long_shift_apply(uint64_t val, uint32_t op, int32_t shift)
{
  uint32_t left = (op == (uint32_t)k_lsh_op_lsll) ? 1U : 0U;
  int32_t  n    = shift;
  if (n < 0) {
    n    = -n;
    left = (left != 0U) ? 0U : 1U;
  }
  const bool arith = (op == (uint32_t)k_lsh_op_asrl);
  if (n >= (int32_t)k_lsh_pair_bits) {
    if (left != 0U) {
      return 0U;
    }
    return arith ? (uint64_t)((int64_t)val >> ((int32_t)k_lsh_pair_bits - 1)) : 0U;
  }
  if (left != 0U) {
    return val << (uint32_t)n;
  }
  return arith ? (uint64_t)((int64_t)val >> (uint32_t)n) : (val >> (uint32_t)n);
}

enum : uint32_t {
  k_lsh_sites_max = 4096U, 
  k_lsh_hooks_max = 8192U, 
};

static uint32_t s_lsh_sites[k_lsh_sites_max];
static uint32_t s_lsh_site_count;
static uc_hook s_lsh_hooks[k_lsh_hooks_max];

typedef struct {
  bool     active; 
  uint32_t at;     
  uint32_t rdalo;  
  uint32_t rdahi;  
  uint32_t lo;     
  uint32_t hi;     
  uint32_t nzcv;   
} long_shift_pending_t;

enum : uint32_t {
  k_lsh_pending_max = 8U, 
};

static long_shift_pending_t s_lsh_pending[k_lsh_pending_max];

RA8_INTERNAL static long_shift_pending_t* internal_long_shift_slot(uint32_t at, bool want_active)
{
  for (uint32_t i = 0U; i < (uint32_t)k_lsh_pending_max; i++) {
    if (s_lsh_pending[i].active && (s_lsh_pending[i].at == at)) {
      return &s_lsh_pending[i];
    }
  }
  if (want_active) {
    return nullptr;
  }
  for (uint32_t i = 0U; i < (uint32_t)k_lsh_pending_max; i++) {
    if (!s_lsh_pending[i].active) {
      return &s_lsh_pending[i];
    }
  }
  return nullptr;
}

RA8_INTERNAL static bool internal_long_shift_is_site(uint32_t addr)
{
  for (uint32_t i = 0U; i < s_lsh_site_count; i++) {
    if (s_lsh_sites[i] == addr) {
      return true;
    }
  }
  return false;
}

RA8_INTERNAL static void internal_long_shift_begin(uc_engine* uc, uint32_t address)
{
  uint8_t code[k_lsh_insn_len] = {};
  if (emu_mem_read(uc, address, code, sizeof(code)) != UC_ERR_OK) {
    return;
  }
  const uint16_t    hw1  = (uint16_t)(code[0] | ((uint16_t)code[1] << (uint16_t)k_byte_bits));
  const uint16_t    hw2  = (uint16_t)(code[2] | ((uint16_t)code[3] << (uint16_t)k_byte_bits));
  long_shift_insn_t insn = {};
  if (!internal_long_shift_decode(hw1, hw2, &insn)) {
    return; /* scan false-positive at a never-executed address: leave it alone. */
  }
  uint32_t lo = 0U;
  uint32_t hi = 0U;
  (void)uc_reg_read(uc, k_arm_reg_id[insn.rdalo], &lo);
  (void)uc_reg_read(uc, k_arm_reg_id[insn.rdahi], &hi);
  const uint64_t val = ((uint64_t)hi << (uint64_t)k_lsh_word_bits) | (uint64_t)lo;
  const uint64_t res =
    internal_long_shift_apply(val, insn.op, internal_long_shift_amount(uc, &insn));
  uint32_t nzcv = 0U;
  (void)uc_reg_read(uc, UC_ARM_REG_APSR_NZCV, &nzcv);
  const uint32_t        at   = address + (uint32_t)k_lsh_insn_len;
  long_shift_pending_t* slot = internal_long_shift_slot(at, false);
  if (slot == nullptr) {
    return; /* table full: leave the core's (wrong) ORRS result rather than
             * write back against the wrong instruction. Unreachable in practice
             * -- it needs k_lsh_pending_max nested interrupts inside the
             * one-instruction window. */
  }
  *slot = (long_shift_pending_t){
    .active = true,
    .at     = at,
    .rdalo  = insn.rdalo,
    .rdahi  = insn.rdahi,
    .lo     = (uint32_t)res,
    .hi     = (uint32_t)(res >> (uint64_t)k_lsh_word_bits),
    .nzcv   = nzcv,
  };
}

RA8_INTERNAL static void internal_long_shift_commit(uc_engine* uc, long_shift_pending_t* slot)
{
  (void)uc_reg_write(uc, k_arm_reg_id[slot->rdalo], &slot->lo);
  (void)uc_reg_write(uc, k_arm_reg_id[slot->rdahi], &slot->hi);
  (void)uc_reg_write(uc, UC_ARM_REG_APSR_NZCV, &slot->nzcv);
  slot->active = false;
}

RA8_INTERNAL static void
internal_on_long_shift(uc_engine* uc, uint64_t address, uint32_t size, void* user)
{
  (void)size;
  (void)user;
  const uint32_t        pc   = (uint32_t)address;
  long_shift_pending_t* slot = internal_long_shift_slot(pc, true);
  if (slot != nullptr) {
    internal_long_shift_commit(uc, slot);
  }
  if (internal_long_shift_is_site(pc)) {
    internal_long_shift_begin(uc, pc);
  }
}
 
bool emulate_long_shift_reg(uc_engine* uc, uint32_t pc, const uint8_t code[4])
{
  const uint16_t    hw1  = (uint16_t)(code[0] | ((uint16_t)code[1] << (uint16_t)k_byte_bits));
  const uint16_t    hw2  = (uint16_t)(code[2] | ((uint16_t)code[3] << (uint16_t)k_byte_bits));
  long_shift_insn_t insn = {};
  if (!internal_long_shift_decode(hw1, hw2, &insn) || !insn.by_reg) {
    return false; /* not ours: the immediate form never traps, it mis-executes. */
  }
  uint32_t lo = 0U;
  uint32_t hi = 0U;
  (void)uc_reg_read(uc, k_arm_reg_id[insn.rdalo], &lo);
  (void)uc_reg_read(uc, k_arm_reg_id[insn.rdahi], &hi);
  const uint64_t val = ((uint64_t)hi << (uint64_t)k_lsh_word_bits) | (uint64_t)lo;
  const uint64_t res =
    internal_long_shift_apply(val, insn.op, internal_long_shift_amount(uc, &insn));
  lo = (uint32_t)res;
  hi = (uint32_t)(res >> (uint64_t)k_lsh_word_bits);
  (void)uc_reg_write(uc, k_arm_reg_id[insn.rdalo], &lo);
  (void)uc_reg_write(uc, k_arm_reg_id[insn.rdahi], &hi);
  uint32_t next = pc + (uint32_t)k_lsh_insn_len;
  (void)uc_reg_write(uc, UC_ARM_REG_PC, &next);
  return true;
}

typedef struct {
  uc_engine* uc;      
  uint32_t   n_hooks; 
} long_shift_scan_t;

RA8_INTERNAL static bool internal_install_seg_hooks(long_shift_scan_t* scan,
                                                    const uint8_t*     bytes,
                                                    size_t             length,
                                                    uint32_t           vaddr)
{
  for (size_t off = 0U; (off + k_lsh_insn_len) <= length; off += 2U) {
    const uint8_t*    p    = &bytes[off];
    const uint16_t    hw1  = (uint16_t)(p[0] | ((uint16_t)p[1] << (uint16_t)k_byte_bits));
    const uint16_t    hw2  = (uint16_t)(p[2] | ((uint16_t)p[3] << (uint16_t)k_byte_bits));
    long_shift_insn_t insn = {};
    if (!internal_long_shift_decode(hw1, hw2, &insn)) {
      continue;
    }
    if (insn.by_reg) {
      /* The register form aliases to ORRS with Rm == SP, which the core refuses
       * outright, so it arrives as a real undefined-instruction trap and is
       * serviced by ::emulate_long_shift_reg off the seam dispatch chain. Only
       * the immediate form -- which aliases to an ORRS the core happily
       * MIS-EXECUTES -- has to be intercepted here. */
      continue;
    }
    if (scan->n_hooks >= (uint32_t)k_lsh_sites_max) {
      (void)priv_emu_io_errf("  long-shift seam: site cap %u reached\n", (unsigned)k_lsh_sites_max);
      return false;
    }
    const uint64_t va             = (uint64_t)vaddr + off;
    const uint64_t tail           = va + (uint64_t)k_lsh_insn_len;
    s_lsh_sites[s_lsh_site_count] = (uint32_t)va;
    s_lsh_site_count++;
    (void)uc_hook_add(scan->uc,
                      &s_lsh_hooks[(size_t)scan->n_hooks * 2U],
                      UC_HOOK_CODE,
                      (void*)internal_on_long_shift,
                      nullptr,
                      va,
                      va);
    (void)uc_hook_add(scan->uc,
                      &s_lsh_hooks[((size_t)scan->n_hooks * 2U) + 1U],
                      UC_HOOK_CODE,
                      (void*)internal_on_long_shift,
                      nullptr,
                      tail,
                      tail);
    scan->n_hooks++;
  }
  return true;
}

RA8_INTERNAL static bool internal_long_shift_segment(const elf_exec_segment_t* segment,
                                                     void*                     opaque)
{
  enum : size_t {
    k_lsh_scan_scratch = 4096U, 
  };
  long_shift_scan_t* const scan = (long_shift_scan_t*)opaque;
  uint8_t                  bytes[k_lsh_scan_scratch];
  uint32_t                 base = 0U;
  while ((base + (uint32_t)k_lsh_insn_len) <= segment->filesz) {
    const uint32_t left   = segment->filesz - base;
    const size_t   length = (left < sizeof(bytes)) ? (size_t)left : sizeof(bytes);
    emu_elf_view_t view   = {};
    if (priv_emu_elf_read(segment->source,
                          (uint64_t)segment->offset + base,
                          length,
                          bytes,
                          sizeof(bytes),
                          &view)
            .status != k_emu_elf_io_ok ||
        !internal_install_seg_hooks(scan, bytes, length, segment->vaddr + base)) {
      return false;
    }
    if (length == left) {
      break;
    }
    base += (uint32_t)length - 2U;
  }
  return true;
}

void long_shift_seam_install(uc_engine* uc, const emu_elf_source_t* elf)
{
  if (elf == nullptr) {
    return;
  }
  s_lsh_site_count = 0U;
  (void)memset(s_lsh_pending, 0, sizeof(s_lsh_pending));
  long_shift_scan_t scan = {.uc = uc};
  (void)elf_foreach_exec_segment(elf, internal_long_shift_segment, &scan);
  if (scan.n_hooks > 0U) {
    (void)priv_emu_io_errf("  long-shift seam: emulating %u Armv8.1-M LSLL/LSRL/ASRL site(s)\n",
                           (unsigned)scan.n_hooks);
  }
}