emu_seam_mve.c

Go to the documentation of this file.

 
#include <capstone/capstone.h>
#include <stdio.h>
#include <string.h>
 
#include "emu_engine.h"
#include "emu_exc.h"
#include "emu_seams.h"
 
/* ============================================================================
 * Minimal MVE (Helium) emulation. The RA8D2 is Cortex-M85 (Armv8.1-M, has MVE),
 * but the closest core Unicorn offers is M33 (Armv8-M, NO MVE), so the Helium
 * instructions GCC's auto-vectoriser emits trap here as "invalid". GCC vectorises
 * the memset / struct-zero idiom with two forms, which this handles:
 *   VMOV.I32 Qd, #imm          -- set all four 32-bit lanes of Qd to imm
 *   VSTRW.32 Qd, [Rn{, #off}]  -- store the 16-byte Qd to memory (no write-back)
 * The Q registers alias the FPU D registers (Qn == D[2n]:D[2n+1]) -- the M33 core
 * has those (the firmware uses the FPU) -- so the vector state is read/written
 * through Unicorn's D registers. Any other MVE form falls through and still
 * reports as invalid, so nothing is silently mis-executed. capstone (already
 * linked, and already decoding these for the error path) provides the operands;
 * the engine handle is opened once and reused. On real silicon all of this just
 * runs natively on Helium -- this only makes the M33-based emulator faithful to it.
 * ==========================================================================*/
enum : uint32_t {
  k_mve_insn_len   = 4U,    
  k_mve_q_bytes    = 16U,   
  k_mve_lane_shift = 32U,   
  k_mve_max_run    = 4096U, 
};
static uint64_t s_mve_emulated = 0U;
static bool s_mve_nocp_handled = false;
static uint32_t s_mve_resume_pc = 0U;
static bool s_mve_resume_armed = false;
 
/* ---------------------------------------------------------------------------
 * MVE contiguous load/store family (VLDRB/VLDRH/VLDRW, VSTRB/VSTRH/VSTRW with
 * an immediate offset or post-index write-back), serviced from the NoCP
 * UsageFault.
 *
 * Armv8.1-M reallocates coprocessor space 0b1110 / 0b1111 to MVE, so this
 * family reuses the legacy STC/LDC encodings byte for byte. `arm-none-eabi-as
 * -march=armv8.1-m.main+mve` assembles `stc p15, c7, [r0, #196]` and
 * `vstrw.32 q3, [r0, #196]` to the SAME word ED80 7F31, and objdump
 * `-m armv8.1-m.main` renders that word as the MVE form. capstone renders it as
 * the legacy `stc p15`, so this family must never be decoded through capstone --
 * the fields below are taken straight from the encoding.
 *
 * Unicorn's M33 implements neither MVE nor coprocessor 14/15, so it does NOT
 * trap these as invalid instructions: it raises a NoCP UsageFault (QEMU
 * EXCP_NOCP, reported as int_no 17) through UC_HOOK_INTR with PC still at the
 * faulting instruction. Verified against libunicorn standalone: on a cold
 * engine the invalid-instruction hook is never called for any form in this
 * family, so the NoCP fault is the only way in.
 *
 * That covers the FIRST instruction of a run. Servicing it means writing PC and
 * calling `uc_emu_stop` from inside the interrupt hook, and once that has
 * happened the NEXT instruction of the same run arrives at the
 * invalid-instruction hook instead -- also verified standalone, with two
 * consecutive `vstrw.32`. GCC emits exactly such runs (the struct-zero idiom),
 * so BOTH arrival paths are wired to the same decode via ::internal_mve_mem_try: the
 * NoCP hook through ::emu_mve_nocp_emulate, and the invalid-instruction
 * dispatcher through ::emulate_mve. Wiring only one of them leaves every run
 * of two or more MVE accesses faulting on its second instruction.
 *
 * Field layout, confirmed by assembling each form and reading the bytes back:
 *   hw1 = 1110 110P 0 U W L Rn   (P=1 offset, P=0 post-index; bit6 is 0)
 *   hw2 = Qd[2:0] 1 1 1 1 size[1:0] imm7
 * with size 0b00 byte (imm7 scaled by 1), 0b01 halfword (by 2), 0b10 word
 * (by 4) and 0b11 unallocated. Every form transfers the whole 16-byte vector;
 * `size` sets the lane width and the immediate scale only, so for a contiguous
 * little-endian access the data movement is a plain 16-byte copy.
 *
 * Aliasing: the single- and double-precision FP stores share hw1 exactly and
 * differ only in hw2[11:9] -- `vstr s14, [r0, #196]` is ED80 7A31 and
 * `vstr d7, [r0, #196]` is ED80 7B31, both hw2[12:9] == 0b1101 / 0b1010.
 * Unicorn executes both natively and correctly, so the hw2[12:9] == 0b1111
 * guard is load-bearing: widening it would hijack working FP stores and turn
 * them into silent 16-byte writes.
 * ===========================================================================
 */
typedef enum : uint32_t {
  k_mve_mem_h1_mask  = 0xFF40U, 
  k_mve_mem_h1_val   = 0xED00U, 
  k_mve_mem_h1_post  = 0xEC00U, 
  k_mve_mem_h2_mask  = 0x1E00U, 
  k_mve_mem_h2_val   = 0x1E00U, 
  k_mve_mem_bit_u    = 0x0080U, 
  k_mve_mem_bit_w    = 0x0020U, 
  k_mve_mem_bit_l    = 0x0010U, 
  k_mve_mem_size_sh  = 7U,      
  k_mve_mem_size_msk = 0x3U,    
  k_mve_mem_sz_byte  = 0U,      
  k_mve_mem_sz_half  = 1U,      
  k_mve_mem_sz_word  = 2U,      
  k_mve_mem_scl_byte = 1U,      
  k_mve_mem_scl_half = 2U,      
  k_mve_mem_scl_word = 4U,      
  k_mve_qd_shift     = 13U,     
  k_mve_qd_mask      = 0x7U,    
  k_mve_rn_mask      = 0xFU,    
  k_mve_imm7_mask    = 0x7FU,   
} mve_mem_field_t;

typedef struct {
  uint32_t qd;    
  uint32_t rn;    
  uint32_t off;   
  bool     load;  
  bool     wback; 
  bool     add;   
  bool     post;  
} mve_mem_op_t;

RA8_INTERNAL static bool internal_mve_mem_decode(uint16_t hw1, uint16_t hw2, mve_mem_op_t* op)
{
  const uint16_t h1_family = hw1 & (uint16_t)k_mve_mem_h1_mask;
  if (((h1_family != (uint16_t)k_mve_mem_h1_val) && (h1_family != (uint16_t)k_mve_mem_h1_post)) ||
      ((hw2 & (uint16_t)k_mve_mem_h2_mask) != (uint16_t)k_mve_mem_h2_val)) {
    return false;
  }
  const uint32_t size =
    ((uint32_t)hw2 >> (uint32_t)k_mve_mem_size_sh) & (uint32_t)k_mve_mem_size_msk;
  uint32_t scale;
  switch (size) {
    case (uint32_t)k_mve_mem_sz_byte:
      scale = (uint32_t)k_mve_mem_scl_byte;
      break;
    case (uint32_t)k_mve_mem_sz_half:
      scale = (uint32_t)k_mve_mem_scl_half;
      break;
    case (uint32_t)k_mve_mem_sz_word:
      scale = (uint32_t)k_mve_mem_scl_word;
      break;
    default:
      return false; /* size 0b11 is unallocated -- never emulate it. */
  }
  op->qd    = ((uint32_t)hw2 >> (uint32_t)k_mve_qd_shift) & (uint32_t)k_mve_qd_mask;
  op->rn    = (uint32_t)hw1 & (uint32_t)k_mve_rn_mask;
  op->off   = ((uint32_t)hw2 & (uint32_t)k_mve_imm7_mask) * scale;
  op->load  = (hw1 & (uint16_t)k_mve_mem_bit_l) != 0U;
  op->wback = (hw1 & (uint16_t)k_mve_mem_bit_w) != 0U;
  op->add   = (hw1 & (uint16_t)k_mve_mem_bit_u) != 0U;
  op->post  = h1_family == (uint16_t)k_mve_mem_h1_post;
  return true;
}

RA8_INTERNAL static void internal_mve_mem_exec(uc_engine* uc, const mve_mem_op_t* op)
{
  uint32_t base = 0U;
  (void)uc_reg_read(uc, k_arm_reg_id[op->rn], &base);
  const uint32_t adjusted = op->add ? (base + op->off) : (base - op->off);
  const uint32_t addr     = op->post ? base : adjusted;
  const int      d_lo     = (int)UC_ARM_REG_D0 + (int)(2U * op->qd);
  uint8_t        buf[k_mve_q_bytes];
  uint64_t       lo = 0U;
  uint64_t       hi = 0U;
  if (op->load) {
    (void)emu_mem_read(uc, (uint64_t)addr, buf, (size_t)k_mve_q_bytes);
    (void)memcpy(&lo, buf, sizeof(lo));
    (void)memcpy(&hi, buf + sizeof(lo), sizeof(hi));
    (void)uc_reg_write(uc, d_lo, &lo);
    (void)uc_reg_write(uc, d_lo + 1, &hi);
  } else {
    (void)uc_reg_read(uc, d_lo, &lo);
    (void)uc_reg_read(uc, d_lo + 1, &hi);
    (void)memcpy(buf, &lo, sizeof(lo));
    (void)memcpy(buf + sizeof(lo), &hi, sizeof(hi));
    (void)emu_mem_write(uc, (uint64_t)addr, buf, (size_t)k_mve_q_bytes);
  }
  if (op->wback) {
    (void)uc_reg_write(uc, k_arm_reg_id[op->rn], &adjusted);
  }
}

RA8_INTERNAL static bool internal_mve_mem_try(uc_engine* uc, const uint8_t code[4])
{
  const uint16_t hw1 = (uint16_t)(code[0] | ((uint16_t)code[1] << (uint16_t)k_byte_bits));
  const uint16_t hw2 = (uint16_t)(code[2] | ((uint16_t)code[3] << (uint16_t)k_byte_bits));
  mve_mem_op_t   op  = {};
  if (!internal_mve_mem_decode(hw1, hw2, &op)) {
    return false;
  }
  internal_mve_mem_exec(uc, &op);
  return true;
}

RA8_INTERNAL static int internal_mve_q_d(unsigned int qreg, bool high)
{
  const unsigned int idx = qreg - (unsigned int)ARM_REG_Q0; /* Q index 0..7. */
  return (int)UC_ARM_REG_D0 + (int)(2U * idx) + (high ? 1 : 0);
}

RA8_INTERNAL static bool internal_mve_exec_one(uc_engine* uc, const cs_insn* insn)
{
  const cs_arm* d     = &insn->detail->arm;
  const bool    op0_q = (d->op_count == 2) && (d->operands[0].type == ARM_OP_REG) &&
                        (d->operands[0].reg >= ARM_REG_Q0) && (d->operands[0].reg <= ARM_REG_Q7);
  if (!op0_q) {
    return false;
  }
  /* VMOV.I32 Qd, #imm -> replicate the 32-bit immediate into all four lanes. */
  if ((insn->id == ARM_INS_VMOV) && (d->operands[1].type == ARM_OP_IMM) &&
      (strstr(insn->mnemonic, ".i32") != nullptr)) {
    const uint32_t imm  = (uint32_t)d->operands[1].imm;
    const uint64_t pair = ((uint64_t)imm << (uint64_t)k_mve_lane_shift) | (uint64_t)imm;
    (void)uc_reg_write(uc, internal_mve_q_d(d->operands[0].reg, false), &pair);
    (void)uc_reg_write(uc, internal_mve_q_d(d->operands[0].reg, true), &pair);
    return true;
  }
  return false;
}

RA8_INTERNAL static csh* internal_mve_capstone(void)
{
  static csh  s_cs;
  static bool s_cs_ok = false;
  if (!s_cs_ok) {
    if (cs_open(CS_ARCH_ARM, (cs_mode)(CS_MODE_THUMB | CS_MODE_MCLASS), &s_cs) != CS_ERR_OK) {
      return nullptr;
    }
    (void)cs_option(s_cs, CS_OPT_DETAIL, CS_OPT_ON);
    s_cs_ok = true;
  }
  return &s_cs;
}

bool emulate_mve(uc_engine* uc, uint32_t pc0, const uint8_t code0[4])
{
  csh* cs = internal_mve_capstone();
  if (cs == nullptr) {
    return false;
  }
  uint32_t pc = pc0;
  uint8_t  code[4];
  (void)memcpy(code, code0, sizeof(code));
  uint32_t handled = 0U;
  while (handled < (uint32_t)k_mve_max_run) {
    /* Contiguous load/store first: capstone renders this family as a legacy
     * `stc p15`, so it must be decoded from the raw encoding, not through the
     * disassembler below. */
    if (internal_mve_mem_try(uc, code)) {
      handled++;
      pc += (uint32_t)k_mve_insn_len;
      if (emu_mem_read(uc, (uint64_t)pc, code, sizeof(code)) != UC_ERR_OK) {
        break;
      }
      continue;
    }
    cs_insn*     insn = nullptr;
    const size_t n    = cs_disasm(*cs, code, (size_t)k_mve_insn_len, pc, 1, &insn);
    if (n != 1U) {
      break;
    }
    const bool ok = internal_mve_exec_one(uc, &insn[0]);
    cs_free(insn, n);
    if (!ok) {
      break; /* first non-MVE (valid) instruction -- relaunch resumes here. */
    }
    handled++;
    pc += (uint32_t)k_mve_insn_len;
    if (emu_mem_read(uc, (uint64_t)pc, code, sizeof(code)) != UC_ERR_OK) {
      break;
    }
  }
  if (handled > 0U) {
    (void)uc_reg_write(uc, UC_ARM_REG_PC, &pc);
    s_mve_emulated += handled;
  }
  return handled > 0U;
}
 
bool emu_mve_nocp_emulate(uc_engine* uc, uint32_t pc)
{
  uint8_t code[k_mve_insn_len] = {};
  if (emu_mem_read(uc, (uint64_t)pc, code, sizeof(code)) != UC_ERR_OK) {
    return false;
  }
  if (!internal_mve_mem_try(uc, code)) {
    return false;
  }
  const uint32_t next = pc + (uint32_t)k_mve_insn_len;
  (void)uc_reg_write(uc, UC_ARM_REG_PC, &next);
  s_mve_emulated++;
  s_mve_nocp_handled = true;
  s_mve_resume_pc    = next;
  s_mve_resume_armed = true;
  return true;
}
 
bool emu_mve_nocp_spurious(uint32_t pc)
{
  const bool armed   = s_mve_resume_armed;
  s_mve_resume_armed = false;
  if (!armed || (pc != s_mve_resume_pc)) {
    return false;
  }
  s_mve_nocp_handled = true; /* make the run loop relaunch here. */
  return true;
}

bool emu_mve_nocp_take(void)
{
  const bool hit     = s_mve_nocp_handled;
  s_mve_nocp_handled = false;
  return hit;
}

uint64_t emu_mve_emulated_count(void)
{
  return s_mve_emulated;
}