from builtins import range from future.utils import viewitems from miasm.expression.expression import ExprId, ExprInt, ExprLoc, ExprMem, \ ExprCond, ExprCompose, ExprOp, ExprAssign from miasm.ir.ir import Lifter, IRBlock, AssignBlock from miasm.arch.aarch64.arch import mn_aarch64, conds_expr, replace_regs from miasm.arch.aarch64.regs import * from miasm.core.sembuilder import SemBuilder from miasm.jitter.csts import EXCEPT_DIV_BY_ZERO, EXCEPT_INT_XX # System register for ARM64-A 8.6 system_regs = { # op0 op1 crn crm op2 (2, 0, 0, 0, 2): OSDTRRX_EL1, (2, 0, 0, 2, 0): MDCCINT_EL1, (2, 0, 0, 2, 2): MDSCR_EL1, (2, 0, 0, 3, 2): OSDTRTX_EL1, (2, 0, 0, 6, 2): OSECCR_EL1, (2, 0, 0, 0, 4): DBGBVR0_EL1, (2, 0, 0, 1, 4): DBGBVR1_EL1, (2, 0, 0, 2, 4): DBGBVR2_EL1, (2, 0, 0, 3, 4): DBGBVR3_EL1, (2, 0, 0, 4, 4): DBGBVR4_EL1, (2, 0, 0, 5, 4): DBGBVR5_EL1, (2, 0, 0, 6, 4): DBGBVR6_EL1, (2, 0, 0, 7, 4): DBGBVR7_EL1, (2, 0, 0, 8, 4): DBGBVR8_EL1, (2, 0, 0, 9, 4): DBGBVR9_EL1, (2, 0, 0, 10, 4): DBGBVR10_EL1, (2, 0, 0, 11, 4): DBGBVR11_EL1, (2, 0, 0, 12, 4): DBGBVR12_EL1, (2, 0, 0, 13, 4): DBGBVR13_EL1, (2, 0, 0, 14, 4): DBGBVR14_EL1, (2, 0, 0, 15, 4): DBGBVR15_EL1, (2, 0, 0, 0, 5): DBGBCR0_EL1, (2, 0, 0, 1, 5): DBGBCR1_EL1, (2, 0, 0, 2, 5): DBGBCR2_EL1, (2, 0, 0, 3, 5): DBGBCR3_EL1, (2, 0, 0, 4, 5): DBGBCR4_EL1, (2, 0, 0, 5, 5): DBGBCR5_EL1, (2, 0, 0, 6, 5): DBGBCR6_EL1, (2, 0, 0, 7, 5): DBGBCR7_EL1, (2, 0, 0, 8, 5): DBGBCR8_EL1, (2, 0, 0, 9, 5): DBGBCR9_EL1, (2, 0, 0, 10, 5): DBGBCR10_EL1, (2, 0, 0, 11, 5): DBGBCR11_EL1, (2, 0, 0, 12, 5): DBGBCR12_EL1, (2, 0, 0, 13, 5): DBGBCR13_EL1, (2, 0, 0, 14, 5): DBGBCR14_EL1, (2, 0, 0, 15, 5): DBGBCR15_EL1, (2, 0, 0, 0, 6): DBGWVR0_EL1, (2, 0, 0, 1, 6): DBGWVR1_EL1, (2, 0, 0, 2, 6): DBGWVR2_EL1, (2, 0, 0, 3, 6): DBGWVR3_EL1, (2, 0, 0, 4, 6): DBGWVR4_EL1, (2, 0, 0, 5, 6): DBGWVR5_EL1, (2, 0, 0, 6, 6): DBGWVR6_EL1, (2, 0, 0, 7, 6): DBGWVR7_EL1, (2, 0, 0, 8, 6): DBGWVR8_EL1, (2, 0, 0, 9, 6): DBGWVR9_EL1, (2, 0, 0, 10, 6): DBGWVR10_EL1, (2, 0, 0, 11, 6): DBGWVR11_EL1, (2, 0, 0, 12, 6): DBGWVR12_EL1, (2, 0, 0, 13, 6): DBGWVR13_EL1, (2, 0, 0, 14, 6): DBGWVR14_EL1, (2, 0, 0, 15, 6): DBGWVR15_EL1, (2, 0, 0, 0, 7): DBGWCR0_EL1, (2, 0, 0, 1, 7): DBGWCR1_EL1, (2, 0, 0, 2, 7): DBGWCR2_EL1, (2, 0, 0, 3, 7): DBGWCR3_EL1, (2, 0, 0, 4, 7): DBGWCR4_EL1, (2, 0, 0, 5, 7): DBGWCR5_EL1, (2, 0, 0, 6, 7): DBGWCR6_EL1, (2, 0, 0, 7, 7): DBGWCR7_EL1, (2, 0, 0, 8, 7): DBGWCR8_EL1, (2, 0, 0, 9, 7): DBGWCR9_EL1, (2, 0, 0, 10, 7): DBGWCR10_EL1, (2, 0, 0, 11, 7): DBGWCR11_EL1, (2, 0, 0, 12, 7): DBGWCR12_EL1, (2, 0, 0, 13, 7): DBGWCR13_EL1, (2, 0, 0, 14, 7): DBGWCR14_EL1, (2, 0, 0, 15, 7): DBGWCR15_EL1, (2, 0, 1, 0, 0): MDRAR_EL1, (2, 0, 1, 0, 4): OSLAR_EL1, (2, 0, 1, 1, 4): OSLSR_EL1, (2, 0, 1, 3, 4): OSDLR_EL1, (2, 0, 1, 4, 4): DBGPRCR_EL1, (2, 0, 7, 8, 6): DBGCLAIMSET_EL1, (2, 0, 7, 9, 6): DBGCLAIMCLR_EL1, (2, 0, 7, 14, 6): DBGAUTHSTATUS_EL1, (2, 3, 0, 1, 0): MDCCSR_EL0, (2, 3, 0, 4, 0): DBGDTR_EL0, (2, 3, 0, 5, 0): DBGDTRRX_EL0, (2, 3, 0, 5, 1): DBGDTRTX_EL0, (2, 4, 0, 7, 0): DBGVCR32_EL2, (3, 0, 0, 0, 0): MIDR_EL1, (3, 0, 0, 0, 5): MPIDR_EL1, (3, 0, 0, 0, 6): REVIDR_EL1, (3, 0, 0, 1, 0): ID_PFR0_EL1, (3, 0, 0, 1, 1): ID_PFR1_EL1, (3, 0, 0, 1, 2): ID_DFR0_EL1, (3, 0, 0, 1, 3): ID_AFR0_EL1, (3, 0, 0, 1, 4): ID_MMFR0_EL1, (3, 0, 0, 1, 5): ID_MMFR1_EL1, (3, 0, 0, 1, 6): ID_MMFR2_EL1, (3, 0, 0, 1, 7): ID_MMFR3_EL1, (3, 0, 0, 2, 0): ID_ISAR0_EL1, (3, 0, 0, 2, 1): ID_ISAR1_EL1, (3, 0, 0, 2, 2): ID_ISAR2_EL1, (3, 0, 0, 2, 3): ID_ISAR3_EL1, (3, 0, 0, 2, 4): ID_ISAR4_EL1, (3, 0, 0, 2, 5): ID_ISAR5_EL1, (3, 0, 0, 2, 6): ID_MMFR4_EL1, (3, 0, 0, 3, 0): MVFR0_EL1, (3, 0, 0, 3, 1): MVFR1_EL1, (3, 0, 0, 3, 2): MVFR2_EL1, (3, 0, 0, 3, 4): ID_PFR2_EL1, (3, 0, 0, 3, 6): ID_MMFR5_EL1, (3, 0, 0, 4, 0): ID_AA64PFR0_EL1, (3, 0, 0, 4, 1): ID_AA64PFR1_EL1, (3, 0, 0, 4, 4): ID_AA64ZFR0_EL1, (3, 0, 0, 5, 0): ID_AA64DFR0_EL1, (3, 0, 0, 5, 1): ID_AA64DFR1_EL1, (3, 0, 0, 5, 4): ID_AA64AFR0_EL1, (3, 0, 0, 5, 5): ID_AA64AFR1_EL1, (3, 0, 0, 6, 0): ID_AA64ISAR0_EL1, (3, 0, 0, 6, 1): ID_AA64ISAR1_EL1, (3, 0, 0, 7, 0): ID_AA64MMFR0_EL1, (3, 0, 0, 7, 1): ID_AA64MMFR1_EL1, (3, 0, 0, 7, 2): ID_AA64MMFR2_EL1, (3, 0, 1, 0, 0): SCRLR_EL1, (3, 0, 1, 0, 1): ACTLR_EL1, (3, 0, 1, 0, 2): CPACR_EL1, (3, 0, 1, 2, 0): ZCR_EL1, (3, 0, 1, 2, 1): TRFCR_EL1, (3, 0, 2, 0, 0): TTBR0_EL1, (3, 0, 2, 0, 1): TTBR1_EL1, (3, 0, 2, 0, 2): TCR_EL1, (3, 0, 2, 1, 0): APIAKeyLo_EL1, (3, 0, 2, 1, 1): APIAKeyHi_EL1, (3, 0, 2, 1, 2): APIBKeyLo_EL1, (3, 0, 2, 1, 3): APIBKeyHi_EL1, (3, 0, 2, 2, 0): APDAKeyLo_EL1, (3, 0, 2, 2, 1): APDAKeyHi_EL1, (3, 0, 2, 2, 2): APDBKeyLo_EL1, (3, 0, 2, 2, 3): APDBKeyHi_EL1, (3, 0, 2, 3, 0): APGAKeyLo_EL1, (3, 0, 2, 3, 1): APGAKeyHi_EL1, (3, 0, 4, 1, 0): SP_EL0, (3, 0, 4, 6, 0): ICC_PMR_EL1, # Alias ICV_PMR_EL1 (3, 0, 5, 1, 0): AFSR0_EL1, (3, 0, 5, 1, 1): AFSR1_EL1, (3, 0, 5, 2, 0): ESR_EL1, (3, 0, 5, 3, 0): ERRIDR_EL1, (3, 0, 5, 3, 1): ERRSELR_EL1, (3, 0, 5, 4, 0): ERXFR_EL1, (3, 0, 5, 4, 1): ERXCTLR_EL1, (3, 0, 5, 4, 2): ERXSTATUS_EL1, (3, 0, 5, 4, 3): ERXADDR_EL1, (3, 0, 5, 4, 4): ERXPFGF_EL1, (3, 0, 5, 4, 5): ERXPFGCTL_EL1, (3, 0, 5, 4, 6): ERXPFGCDN_EL1, (3, 0, 5, 5, 0): ERXMISC0_EL1, (3, 0, 5, 5, 1): ERXMISC1_EL1, (3, 0, 5, 5, 2): ERXMISC2_EL1, (3, 0, 5, 5, 3): ERXMISC3_EL1, (3, 0, 6, 0, 0): FAR_EL1, (3, 0, 7, 4, 0): PAR_EL1, (3, 0, 9, 9, 0): PMSCR_EL1, (3, 0, 9, 9, 2): PMSICR_EL1, (3, 0, 9, 9, 3): PMSIRR_EL1, (3, 0, 9, 9, 4): PMSFCR_EL1, (3, 0, 9, 9, 5): PMSEVFR_EL1, (3, 0, 9, 9, 6): PMSLATFR_EL1, (3, 0, 9, 9, 7): PMSIDR_EL1, (3, 0, 9, 10, 0): PMBLIMITR_EL1, (3, 0, 9, 10, 1): PMBPTR_EL1, (3, 0, 9, 10, 3): PMBSR_EL1, (3, 0, 9, 10, 7): PMBIDR_EL1, (3, 0, 9, 14, 1): PMINTENSET_EL1, (3, 0, 9, 14, 2): PMINTENCLR_EL1, (3, 0, 9, 14, 6): PMMIR_EL1, (3, 0, 10, 2, 0): MAIR_EL1, (3, 0, 10, 3, 0): AMAIR_EL1, (3, 0, 10, 4, 0): LORSA_EL1, (3, 0, 10, 4, 1): LOREA_EL1, (3, 0, 10, 4, 2): LORN_EL1, (3, 0, 10, 4, 3): LORC_EL1, (3, 0, 10, 4, 7): LORID_EL1, (3, 0, 12, 0, 0): VBAR_EL1, (3, 0, 12, 0, 1): RVBAR_EL1, (3, 0, 12, 0, 2): RMR_EL1, (3, 0, 12, 1, 0): ISR_EL1, (3, 0, 12, 1, 1): DISR_EL1, (3, 0, 12, 8, 0): ICC_IAR0_EL1, # Alias ICV_IAR0_EL1 (3, 0, 12, 8, 1): ICC_EOIR0_EL1, # Alias ICV_EOIR0_EL1 (3, 0, 12, 8, 2): ICC_HPPIR0_EL1, # Alias ICV_HPPIR0_EL1 (3, 0, 12, 8, 3): ICC_BPR0_EL1, # Alias ICV_BPR0_EL1 (3, 0, 12, 8, 4): ICC_AP0R0_EL1, # Alias ICV_AP0R0_EL1 (3, 0, 12, 8, 5): ICC_AP0R1_EL1, # Alias ICV_AP0R1_EL1 (3, 0, 12, 8, 6): ICC_AP0R2_EL1, # Alias ICV_AP0R2_EL1 (3, 0, 12, 8, 7): ICC_AP0R3_EL1, # Alias ICV_AP0R3_EL1 (3, 0, 12, 9, 0): ICC_AP1R0_EL1, # Alias ICV_AP1R0_EL1 (3, 0, 12, 9, 1): ICC_AP1R1_EL1, # Alias ICV_AP1R1_EL1 (3, 0, 12, 9, 2): ICC_AP1R2_EL1, # Alias ICV_AP1R2_EL1 (3, 0, 12, 9, 3): ICC_AP1R3_EL1, # Alias ICV_AP1R3_EL1 (3, 0, 12, 11, 1): ICC_DIR_EL1, # Alias ICV_DIR_EL1 (3, 0, 12, 11, 3): ICC_RPR_EL1, # Alias ICV_RPR_EL1 (3, 0, 12, 11, 5): ICC_SGI1R_EL1, (3, 0, 12, 11, 6): ICC_ASGI1R_EL1, (3, 0, 12, 11, 7): ICC_SGI0R_EL1, (3, 0, 12, 12, 0): ICC_IAR1_EL1, # Alias ICV_IAR1_EL1 (3, 0, 12, 12, 1): ICC_EOIR1_EL1, # Alias ICV_EOIR1_EL1 (3, 0, 12, 12, 2): ICC_HPPIR1_EL1, # Alias ICV_HPPIR1_EL1 (3, 0, 12, 12, 3): ICC_BPR1_EL1, # Alias ICV_BPR1_EL1 (3, 0, 12, 12, 4): ICC_CTLR_EL1, # Alias ICV_CTLR_EL1 (3, 0, 12, 12, 5): ICC_SRE_EL1, (3, 0, 12, 12, 6): ICC_IGRPEN0_EL1, # Alias ICV_IGRPEN0_EL1 (3, 0, 12, 12, 7): ICC_IGRPEN1_EL1, # Alias ICV_IGRPEN1_EL1 (3, 0, 13, 0, 1): CONTEXTIDR_EL1, (3, 0, 13, 0, 4): TPIDR_EL1, (3, 0, 14, 1, 0): CNTKCTL_EL1, (3, 1, 0, 0, 0): CCSIDR_EL1, (3, 1, 0, 0, 1): CLIDR_EL1, (3, 1, 0, 0, 2): CCSIDR2_EL1, (3, 1, 0, 0, 7): AIDR_EL1, (3, 2, 0, 0, 0): CSSELR_EL1, (3, 0, 0, 0, 1): CTR_EL0, (3, 3, 0, 0, 7): DCZID_EL0, (3, 3, 4, 4, 0): FPCR, (3, 3, 4, 4, 1): FPSR, (3, 3, 4, 5, 0): DSPSR_EL0, (3, 3, 4, 5, 1): DLR_EL0, (3, 4, 4, 0, 0): SPSR_EL2, (3, 4 ,4, 0, 1): ELR_EL2, (3, 4, 4, 1, 0): SP_EL1, (3, 4, 4, 3, 0): SPSR_irq, (3, 4, 4, 3, 1): SPSR_abt, (3, 4, 4, 3, 2): SPSR_und, (3, 4, 4, 3, 3): SPSR_fiq, (3, 3, 9, 12, 0): PMCR_EL0, (3, 3, 9, 12, 1): PMCNTENSET_EL0, (3, 3, 9, 12, 2): PMCNTENCLR_EL0, (3, 3, 9, 12, 3): PMOVSCLR_EL0, (3, 3, 9, 12, 4): PMSWINC_EL0, (3, 3, 9, 12, 5): PMSELR_EL0, (3, 3, 9, 12, 6): PMCEID0_EL0, (3, 3, 9, 12, 7): PMCEID1_EL0, (3, 3, 9, 13, 0): PMCCNTR_EL0, (3, 3, 9, 13, 1): PMXEVTYPER_EL0, (3, 3, 9, 13, 2): PMXEVCNTR_EL0, (3, 3, 9, 14, 0): PMUSERENR_EL0, (3, 3, 9, 14, 3): PMOVSSET_EL0, (3, 3, 13, 0, 2): TPIDR_EL0, (3, 3, 13, 0, 3): TPIDRRO_EL0, (3, 3, 13, 2, 0): AMCR_EL0, (3, 3, 13, 2, 1): AMCFGR_EL0, (3, 3, 13, 2, 2): AMCGCR_EL0, (3, 3, 13, 2, 3): AMUSERENR_EL0, (3, 3, 13, 2, 4): AMCNTENCLR0_EL0, (3, 3, 13, 2, 5): AMCNTENSET0_EL0, (3, 3, 13, 2, 6): AMCG1IDR_EL0, (3, 3, 13, 3, 0): AMCNTENCLR1_EL0, (3, 3, 13, 3, 1): AMCNTENSET1_EL0, (3, 3, 13, 4, 0): AMEVCNTR00_EL0, (3, 3, 13, 4, 1): AMEVCNTR01_EL0, (3, 3, 13, 4, 2): AMEVCNTR02_EL0, (3, 3, 13, 4, 3): AMEVCNTR03_EL0, (3, 3, 13, 4, 4): AMEVCNTR04_EL0, (3, 3, 13, 4, 5): AMEVCNTR05_EL0, (3, 3, 13, 4, 6): AMEVCNTR06_EL0, (3, 3, 13, 4, 7): AMEVCNTR07_EL0, (3, 3, 13, 5, 0): AMEVCNTR08_EL0, (3, 3, 13, 5, 1): AMEVCNTR09_EL0, (3, 3, 13, 5, 2): AMEVCNTR010_EL0, (3, 3, 13, 5, 3): AMEVCNTR011_EL0, (3, 3, 13, 5, 4): AMEVCNTR012_EL0, (3, 3, 13, 5, 5): AMEVCNTR013_EL0, (3, 3, 13, 5, 6): AMEVCNTR014_EL0, (3, 3, 13, 5, 7): AMEVCNTR015_EL0, (3, 3, 13, 6, 0): AMEVTYPER00_EL0, (3, 3, 13, 6, 1): AMEVTYPER01_EL0, (3, 3, 13, 6, 2): AMEVTYPER02_EL0, (3, 3, 13, 6, 3): AMEVTYPER03_EL0, (3, 3, 13, 6, 4): AMEVTYPER04_EL0, (3, 3, 13, 6, 5): AMEVTYPER05_EL0, (3, 3, 13, 6, 6): AMEVTYPER06_EL0, (3, 3, 13, 6, 7): AMEVTYPER07_EL0, (3, 3, 13, 7, 0): AMEVTYPER08_EL0, (3, 3, 13, 7, 1): AMEVTYPER09_EL0, (3, 3, 13, 7, 2): AMEVTYPER010_EL0, (3, 3, 13, 7, 3): AMEVTYPER011_EL0, (3, 3, 13, 7, 4): AMEVTYPER012_EL0, (3, 3, 13, 7, 5): AMEVTYPER013_EL0, (3, 3, 13, 7, 6): AMEVTYPER014_EL0, (3, 3, 13, 7, 7): AMEVTYPER015_EL0, (3, 3, 13, 12, 0): AMEVCNTR10_EL0, (3, 3, 13, 12, 1): AMEVCNTR11_EL0, (3, 3, 13, 12, 2): AMEVCNTR12_EL0, (3, 3, 13, 12, 3): AMEVCNTR13_EL0, (3, 3, 13, 12, 4): AMEVCNTR14_EL0, (3, 3, 13, 12, 5): AMEVCNTR15_EL0, (3, 3, 13, 12, 6): AMEVCNTR16_EL0, (3, 3, 13, 12, 7): AMEVCNTR17_EL0, (3, 3, 13, 13, 0): AMEVCNTR18_EL0, (3, 3, 13, 13, 1): AMEVCNTR19_EL0, (3, 3, 13, 13, 2): AMEVCNTR110_EL0, (3, 3, 13, 13, 3): AMEVCNTR111_EL0, (3, 3, 13, 13, 4): AMEVCNTR112_EL0, (3, 3, 13, 13, 5): AMEVCNTR113_EL0, (3, 3, 13, 13, 6): AMEVCNTR114_EL0, (3, 3, 13, 13, 7): AMEVCNTR115_EL0, (3, 3, 13, 14, 0): AMEVTYPER10_EL0, (3, 3, 13, 14, 1): AMEVTYPER11_EL0, (3, 3, 13, 14, 2): AMEVTYPER12_EL0, (3, 3, 13, 14, 3): AMEVTYPER13_EL0, (3, 3, 13, 14, 4): AMEVTYPER14_EL0, (3, 3, 13, 14, 5): AMEVTYPER15_EL0, (3, 3, 13, 14, 6): AMEVTYPER16_EL0, (3, 3, 13, 14, 7): AMEVTYPER17_EL0, (3, 3, 13, 15, 0): AMEVTYPER18_EL0, (3, 3, 13, 15, 1): AMEVTYPER19_EL0, (3, 3, 13, 15, 2): AMEVTYPER110_EL0, (3, 3, 13, 15, 3): AMEVTYPER111_EL0, (3, 3, 13, 15, 4): AMEVTYPER112_EL0, (3, 3, 13, 15, 5): AMEVTYPER113_EL0, (3, 3, 13, 15, 6): AMEVTYPER114_EL0, (3, 3, 13, 15, 7): AMEVTYPER115_EL0, (3, 3, 14, 0, 0): CNTFRQ_EL0, (3, 3, 14, 0, 1): CNTPCT_EL0, (3, 3, 14, 0, 2): CNTVCT_EL0, (3, 3, 14, 0, 5): CNTPCTSS_EL0, (3, 3, 14, 0, 6): CNTVCTSS_EL0, (3, 3, 14, 2, 0): CNTP_TVAL_EL0, (3, 3, 14, 2, 1): CNTP_CTL_EL0, (3, 3, 14, 2, 2): CNTP_CVAL_EL0, (3, 3, 14, 3, 0): CNTV_TVAL_EL0, (3, 3, 14, 3, 1): CNTV_CTL_EL0, (3, 3, 14, 3, 2): CNTV_CVAL_EL0, (3, 3, 14, 8, 0): PMEVCNTR0_EL0, (3, 3, 14, 8, 1): PMEVCNTR1_EL0, (3, 3, 14, 8, 2): PMEVCNTR2_EL0, (3, 3, 14, 8, 3): PMEVCNTR3_EL0, (3, 3, 14, 8, 4): PMEVCNTR4_EL0, (3, 3, 14, 8, 5): PMEVCNTR5_EL0, (3, 3, 14, 8, 6): PMEVCNTR6_EL0, (3, 3, 14, 8, 7): PMEVCNTR7_EL0, (3, 3, 14, 9, 0): PMEVCNTR8_EL0, (3, 3, 14, 9, 1): PMEVCNTR9_EL0, (3, 3, 14, 9, 2): PMEVCNTR10_EL0, (3, 3, 14, 9, 3): PMEVCNTR11_EL0, (3, 3, 14, 9, 4): PMEVCNTR12_EL0, (3, 3, 14, 9, 5): PMEVCNTR13_EL0, (3, 3, 14, 9, 6): PMEVCNTR14_EL0, (3, 3, 14, 9, 7): PMEVCNTR15_EL0, (3, 3, 14, 10, 0): PMEVCNTR16_EL0, (3, 3, 14, 10, 1): PMEVCNTR17_EL0, (3, 3, 14, 10, 2): PMEVCNTR18_EL0, (3, 3, 14, 10, 3): PMEVCNTR19_EL0, (3, 3, 14, 10, 4): PMEVCNTR20_EL0, (3, 3, 14, 10, 5): PMEVCNTR21_EL0, (3, 3, 14, 10, 6): PMEVCNTR22_EL0, (3, 3, 14, 10, 7): PMEVCNTR23_EL0, (3, 3, 14, 11, 0): PMEVCNTR24_EL0, (3, 3, 14, 11, 1): PMEVCNTR25_EL0, (3, 3, 14, 11, 2): PMEVCNTR26_EL0, (3, 3, 14, 11, 3): PMEVCNTR27_EL0, (3, 3, 14, 11, 4): PMEVCNTR28_EL0, (3, 3, 14, 11, 5): PMEVCNTR29_EL0, (3, 3, 14, 11, 6): PMEVCNTR30_EL0, (3, 3, 14, 12, 0): PMEVTYPER0_EL0, (3, 3, 14, 12, 1): PMEVTYPER1_EL0, (3, 3, 14, 12, 2): PMEVTYPER2_EL0, (3, 3, 14, 12, 3): PMEVTYPER3_EL0, (3, 3, 14, 12, 4): PMEVTYPER4_EL0, (3, 3, 14, 12, 5): PMEVTYPER5_EL0, (3, 3, 14, 12, 6): PMEVTYPER6_EL0, (3, 3, 14, 12, 7): PMEVTYPER7_EL0, (3, 3, 14, 13, 0): PMEVTYPER8_EL0, (3, 3, 14, 13, 1): PMEVTYPER9_EL0, (3, 3, 14, 13, 2): PMEVTYPER10_EL0, (3, 3, 14, 13, 3): PMEVTYPER11_EL0, (3, 3, 14, 13, 4): PMEVTYPER12_EL0, (3, 3, 14, 13, 5): PMEVTYPER13_EL0, (3, 3, 14, 13, 6): PMEVTYPER14_EL0, (3, 3, 14, 13, 7): PMEVTYPER15_EL0, (3, 3, 14, 14, 0): PMEVTYPER16_EL0, (3, 3, 14, 14, 1): PMEVTYPER17_EL0, (3, 3, 14, 14, 2): PMEVTYPER18_EL0, (3, 3, 14, 14, 3): PMEVTYPER19_EL0, (3, 3, 14, 14, 4): PMEVTYPER20_EL0, (3, 3, 14, 14, 5): PMEVTYPER21_EL0, (3, 3, 14, 14, 6): PMEVTYPER22_EL0, (3, 3, 14, 14, 7): PMEVTYPER23_EL0, (3, 3, 14, 15, 0): PMEVTYPER24_EL0, (3, 3, 14, 15, 1): PMEVTYPER25_EL0, (3, 3, 14, 15, 2): PMEVTYPER26_EL0, (3, 3, 14, 15, 3): PMEVTYPER27_EL0, (3, 3, 14, 15, 4): PMEVTYPER28_EL0, (3, 3, 14, 15, 5): PMEVTYPER29_EL0, (3, 3, 14, 15, 6): PMEVTYPER30_EL0, (3, 3, 14, 15, 7): PMCCFILTR_EL0, (3, 4, 0, 0, 0): VPIDR_EL2, (3, 4, 0, 0, 5): VMPIDR_EL2, (3, 4, 1, 0, 0): SCTLR_EL2, (3, 4, 1, 0, 5): ACTLR_EL2, (3, 4, 1, 1, 0): HCR_EL2, (3, 4, 1, 1, 1): MDCR_EL2, (3, 4, 1, 1, 2): CPTR_EL2, (3, 4, 1, 1, 3): HSTR_EL2, (3, 4, 1, 1, 4): HFGRTR_EL2, (3, 4, 1, 1, 5): HFGWTR_EL2, (3, 4, 1, 1, 6): HFGITR_EL2, (3, 4, 1, 1, 7): HACR_EL2, (3, 4, 1, 2, 0): ZCR_EL2, (3, 4, 1, 2, 1): TRFCR_EL2, (3, 4, 1, 3, 1): SDER32_EL2, (3, 4, 2, 0, 0): TTBR0_EL2, (3, 4, 2, 0, 2): TCR_EL2, (3, 4, 2, 1, 0): VTTBR_EL2, (3, 4, 2, 1, 2): VTCR_EL2, (3, 4, 2, 2, 0): VNCR_EL2, (3, 4, 2, 6, 0): VSTTBR_EL2, (3, 4, 2, 6, 2): VSTCR_EL2, (3, 4, 3, 0, 0): DACR32_EL2, (3, 4, 3, 1, 4): HDFGRTR_EL2, (3, 4, 3, 1, 5): HDFGWTR_EL2, (3, 4, 3, 1, 6): HAFGRTR_EL2, (3, 4, 5, 0, 1): IFSR32_EL2, (3, 4, 5, 1, 0): AFSR0_EL2, (3, 4, 5, 1, 1): AFSR1_EL2, (3, 4, 5, 2, 0): ESR_EL2, (3, 4, 5, 2, 3): VSESR_EL2, (3, 4, 5, 3, 0): FPEXC32_EL2, (3, 4, 6, 0, 0): FAR_EL2, (3, 4, 6, 0, 4): HPFAR_EL2, (3, 4, 9, 9, 0): PMSCR_EL2, (3, 4, 10, 2, 0): MAIR_EL2, (3, 4, 10, 3, 0): AMAIR_EL2, (3, 4, 12, 0, 0): VBAR_EL2, (3, 4, 12, 0, 1): RVBAR_EL2, (3, 4, 12, 0, 2): RMR_EL2, (3, 4, 12, 1, 1): VDISR_EL2, (3, 4, 12, 8, 0): ICH_AP0R0_EL2, (3, 4, 12, 8, 1): ICH_AP0R1_EL2, (3, 4, 12, 8, 2): ICH_AP0R2_EL2, (3, 4, 12, 8, 3): ICH_AP0R3_EL2, (3, 4, 12, 9, 0): ICH_AP1R0_EL2, (3, 4, 12, 9, 1): ICH_AP1R1_EL2, (3, 4, 12, 9, 2): ICH_AP1R2_EL2, (3, 4, 12, 9, 3): ICH_AP1R3_EL2, (3, 4, 12, 9, 5): ICC_SRE_EL2, (3, 4, 12, 11, 0): ICH_HCR_EL2, (3, 4, 12, 11, 1): ICH_VTR_EL2, (3, 4, 12, 11, 2): ICH_MISR_EL2, (3, 4, 12, 11, 3): ICH_EISR_EL2, (3, 4, 12, 11, 5): ICH_ELRSR_EL2, (3, 4, 12, 11, 7): ICH_VMCR_EL2, (3, 4, 12, 12, 0): ICH_LR0_EL2, (3, 4, 12, 12, 1): ICH_LR1_EL2, (3, 4, 12, 12, 2): ICH_LR2_EL2, (3, 4, 12, 12, 3): ICH_LR3_EL2, (3, 4, 12, 12, 4): ICH_LR4_EL2, (3, 4, 12, 12, 5): ICH_LR5_EL2, (3, 4, 12, 12, 6): ICH_LR6_EL2, (3, 4, 12, 12, 7): ICH_LR7_EL2, (3, 4, 12, 13, 0): ICH_LR8_EL2, (3, 4, 12, 13, 1): ICH_LR9_EL2, (3, 4, 12, 13, 2): ICH_LR10_EL2, (3, 4, 12, 13, 3): ICH_LR11_EL2, (3, 4, 12, 13, 4): ICH_LR12_EL2, (3, 4, 12, 13, 5): ICH_LR13_EL2, (3, 4, 12, 13, 6): ICH_LR14_EL2, (3, 4, 12, 13, 7): ICH_LR15_EL2, (3, 4, 13, 0, 1): CONTEXTIDR_EL2, (3, 4, 13, 0, 2): TPIDR_EL2, (3, 4, 13, 8, 0): AMEVCNTVOFF00_EL2, (3, 4, 13, 8, 1): AMEVCNTVOFF01_EL2, (3, 4, 13, 8, 2): AMEVCNTVOFF02_EL2, (3, 4, 13, 8, 3): AMEVCNTVOFF03_EL2, (3, 4, 13, 8, 4): AMEVCNTVOFF04_EL2, (3, 4, 13, 8, 5): AMEVCNTVOFF05_EL2, (3, 4, 13, 8, 6): AMEVCNTVOFF06_EL2, (3, 4, 13, 8, 7): AMEVCNTVOFF07_EL2, (3, 4, 13, 9, 0): AMEVCNTVOFF08_EL2, (3, 4, 13, 9, 1): AMEVCNTVOFF09_EL2, (3, 4, 13, 9, 2): AMEVCNTVOFF010_EL2, (3, 4, 13, 9, 3): AMEVCNTVOFF011_EL2, (3, 4, 13, 9, 4): AMEVCNTVOFF012_EL2, (3, 4, 13, 9, 5): AMEVCNTVOFF013_EL2, (3, 4, 13, 9, 6): AMEVCNTVOFF014_EL2, (3, 4, 13, 9, 7): AMEVCNTVOFF015_EL2, (3, 4, 13, 10, 0): AMEVCNTVOFF10_EL2, (3, 4, 13, 10, 1): AMEVCNTVOFF11_EL2, (3, 4, 13, 10, 2): AMEVCNTVOFF12_EL2, (3, 4, 13, 10, 3): AMEVCNTVOFF13_EL2, (3, 4, 13, 10, 4): AMEVCNTVOFF14_EL2, (3, 4, 13, 10, 5): AMEVCNTVOFF15_EL2, (3, 4, 13, 10, 6): AMEVCNTVOFF16_EL2, (3, 4, 13, 10, 7): AMEVCNTVOFF17_EL2, (3, 4, 13, 11, 0): AMEVCNTVOFF18_EL2, (3, 4, 13, 11, 1): AMEVCNTVOFF19_EL2, (3, 4, 13, 11, 2): AMEVCNTVOFF110_EL2, (3, 4, 13, 11, 3): AMEVCNTVOFF111_EL2, (3, 4, 13, 11, 4): AMEVCNTVOFF112_EL2, (3, 4, 13, 11, 5): AMEVCNTVOFF113_EL2, (3, 4, 13, 11, 6): AMEVCNTVOFF114_EL2, (3, 4, 13, 11, 7): AMEVCNTVOFF115_EL2, (3, 4, 14, 0, 3): CNTVOFF_EL2, (3, 4, 14, 0, 6): CNTPOFF_EL2, (3, 4, 14, 1, 0): CNTHCTL_EL2, (3, 4, 14, 2, 0): CNTHP_TVAL_EL2, (3, 4, 14, 2, 1): CNTHP_CTL_EL2, (3, 4, 14, 2, 2): CNTHP_CVAL_EL2, (3, 4, 14, 3, 0): CNTHV_TVAL_EL2, (3, 4, 14, 3, 1): CNTHV_CTL_EL2, (3, 4, 14, 3, 2): CNTHV_CVAL_EL2, (3, 4, 14, 4, 0): CNTHVS_TVAL_EL2, (3, 4, 14, 4, 1): CNTHVS_CTL_EL2, (3, 4, 14, 4, 2): CNTHVS_CVAL_EL2, (3, 4, 14, 5, 0): CNTHPS_TVAL_EL2, (3, 4, 14, 5, 1): CNTHPS_CTL_EL2, (3, 4, 14, 5, 2): CNTHPS_CVAL_EL2, # Aliases for *_EL02 *_EL12 # see page 2864 of "Arm Architecture Reference Manual Armv8, # for Armv8-A architecture profile" Release 31 March 2020 (3, 5, 1, 0, 0): SCTLR_EL1, (3, 5, 1, 0, 2): CPACR_EL1, (3, 5, 1, 2, 0): ZCR_EL1, (3, 5, 1, 2, 1): TRFCR_EL1, (3, 5, 2, 0, 0): TTBR0_EL1, (3, 5, 2, 0, 1): TTBR1_EL1, (3, 5, 2, 0, 2): TCR_EL1, (3, 5, 4, 0, 0): SPSR_EL1, (3, 5, 4, 0, 1): ELR_EL1, (3, 5, 5, 1, 0): AFSR0_EL1, (3, 5, 5, 1, 1): AFSR1_EL1, (3, 5, 5, 2, 0): ESR_EL1, (3, 5, 6, 0, 0): FAR_EL1, (3, 5, 9, 9, 0): PMSCR_EL1, (3, 5, 10, 2, 0): MAIR_EL1, (3, 5, 10, 3, 0): AMAIR_EL1, (3, 5, 12, 0, 0): VBAR_EL1, (3, 5, 13, 0, 0): CONTEXTIDR_EL1, (3, 5, 14, 1, 0): CNTKCTL_EL1, (3, 5, 14, 2, 0): CNTP_TVAL_EL0, (3, 5, 14, 2, 1): CNTP_CTL_EL0, (3, 5, 14, 2, 2): CNTP_CVAL_EL0, (3, 5, 14, 3, 0): CNTV_TVAL_EL0, (3, 5, 14, 3, 1): CNTV_CTL_EL0, (3, 5, 14, 3, 2): CNTV_CVAL_EL0, # End of aliases (3, 6, 1, 0, 0): SCTLR_EL3, (3, 6, 1, 0, 1): ACTLR_EL3, (3, 6, 1, 1, 0): SCR_EL3, (3, 6, 1, 1, 1): SDER32_EL3, (3, 6, 1, 1, 2): CPTR_EL3, (3, 6, 1, 2, 0): ZCR_EL3, (3, 6, 1, 3, 1): MDCR_EL3, (3, 6, 2, 0, 0): TTBR0_EL3, (3, 6, 2, 0, 2): TCR_EL3, (3, 6, 4, 0, 0): SPSR_EL3, (3, 6, 4, 0, 1): ELR_EL3, (3, 6, 4, 1, 0): SP_EL2, (3, 6, 5, 1, 0): AFSR0_EL3, (3, 6, 5, 1, 1): AFSR1_EL3, (3, 6, 5, 2, 0): ESR_EL3, (3, 6, 6, 0, 0): FAR_EL3, (3, 6, 10, 2, 0): MAIR_EL3, (3, 6, 10, 3, 0): AMAIR_EL3, (3, 6, 12, 0, 0): VBAR_EL3, (3, 6, 12, 0, 1): RVBAR_EL3, (3, 6, 12, 0, 2): RMR_EL3, (3, 6, 12, 12, 4): ICC_CTLR_EL3, (3, 6, 12, 12, 5): ICC_SRE_EL3, (3, 6, 12, 12, 7): ICC_IGRPEN1_EL3, (3, 6, 13, 0, 2): TPIDR_EL3, (3, 7, 14, 2, 0): CNTPS_TVAL_EL1, (3, 7, 14, 2, 1): CNTPS_CTL_EL1, (3, 7, 14, 2, 2): CNTPS_CVAL_EL1, } # CPSR: N Z C V def update_flag_zf(a): return [ExprAssign(zf, ExprOp("FLAG_EQ", a))] def update_flag_zf_eq(a, b): return [ExprAssign(zf, ExprOp("FLAG_EQ_CMP", a, b))] def update_flag_nf(arg): return [ ExprAssign( nf, ExprOp("FLAG_SIGN_SUB", arg, ExprInt(0, arg.size)) ) ] def update_flag_zn(a): e = [] e += update_flag_zf(a) e += update_flag_nf(a) return e def check_ops_msb(a, b, c): if not a or not b or not c or a != b or a != c: raise ValueError('bad ops size %s %s %s' % (a, b, c)) def update_flag_add_cf(op1, op2): "Compute cf in @op1 + @op2" return [ExprAssign(cf, ExprOp("FLAG_ADD_CF", op1, op2))] def update_flag_add_of(op1, op2): "Compute of in @op1 + @op2" return [ExprAssign(of, ExprOp("FLAG_ADD_OF", op1, op2))] def update_flag_sub_cf(op1, op2): "Compote CF in @op1 - @op2" return [ExprAssign(cf, ExprOp("FLAG_SUB_CF", op1, op2) ^ ExprInt(1, 1))] def update_flag_sub_of(op1, op2): "Compote OF in @op1 - @op2" return [ExprAssign(of, ExprOp("FLAG_SUB_OF", op1, op2))] def update_flag_arith_add_co(arg1, arg2): e = [] e += update_flag_add_cf(arg1, arg2) e += update_flag_add_of(arg1, arg2) return e def update_flag_arith_add_zn(arg1, arg2): """ Compute zf and nf flags for (arg1 + arg2) """ e = [] e += update_flag_zf_eq(arg1, -arg2) e += [ExprAssign(nf, ExprOp("FLAG_SIGN_SUB", arg1, -arg2))] return e def update_flag_arith_sub_co(arg1, arg2): """ Compute cf and of flags for (arg1 - arg2) """ e = [] e += update_flag_sub_cf(arg1, arg2) e += update_flag_sub_of(arg1, arg2) return e def update_flag_arith_sub_zn(arg1, arg2): """ Compute zf and nf flags for (arg1 - arg2) """ e = [] e += update_flag_zf_eq(arg1, arg2) e += [ExprAssign(nf, ExprOp("FLAG_SIGN_SUB", arg1, arg2))] return e def update_flag_zfaddwc_eq(arg1, arg2, arg3): return [ExprAssign(zf, ExprOp("FLAG_EQ_ADDWC", arg1, arg2, arg3))] def update_flag_zfsubwc_eq(arg1, arg2, arg3): return [ExprAssign(zf, ExprOp("FLAG_EQ_SUBWC", arg1, arg2, arg3))] def update_flag_arith_addwc_zn(arg1, arg2, arg3): """ Compute znp flags for (arg1 + arg2 + cf) """ e = [] e += update_flag_zfaddwc_eq(arg1, arg2, arg3) e += [ExprAssign(nf, ExprOp("FLAG_SIGN_ADDWC", arg1, arg2, arg3))] return e def update_flag_arith_subwc_zn(arg1, arg2, arg3): """ Compute znp flags for (arg1 - (arg2 + cf)) """ e = [] e += update_flag_zfsubwc_eq(arg1, arg2, arg3) e += [ExprAssign(nf, ExprOp("FLAG_SIGN_SUBWC", arg1, arg2, arg3))] return e def update_flag_addwc_cf(op1, op2, op3): "Compute cf in @res = @op1 + @op2 + @op3" return [ExprAssign(cf, ExprOp("FLAG_ADDWC_CF", op1, op2, op3))] def update_flag_addwc_of(op1, op2, op3): "Compute of in @res = @op1 + @op2 + @op3" return [ExprAssign(of, ExprOp("FLAG_ADDWC_OF", op1, op2, op3))] def update_flag_arith_addwc_co(arg1, arg2, arg3): e = [] e += update_flag_addwc_cf(arg1, arg2, arg3) e += update_flag_addwc_of(arg1, arg2, arg3) return e def update_flag_subwc_cf(op1, op2, op3): "Compute cf in @res = @op1 + @op2 + @op3" return [ExprAssign(cf, ExprOp("FLAG_SUBWC_CF", op1, op2, op3) ^ ExprInt(1, 1))] def update_flag_subwc_of(op1, op2, op3): "Compute of in @res = @op1 + @op2 + @op3" return [ExprAssign(of, ExprOp("FLAG_SUBWC_OF", op1, op2, op3))] def update_flag_arith_subwc_co(arg1, arg2, arg3): e = [] e += update_flag_subwc_cf(arg1, arg2, arg3) e += update_flag_subwc_of(arg1, arg2, arg3) return e cond2expr = {'EQ': ExprOp("CC_EQ", zf), 'NE': ExprOp("CC_NE", zf), 'CS': ExprOp("CC_U>=", cf ^ ExprInt(1, 1)), # inv cf 'CC': ExprOp("CC_U<", cf ^ ExprInt(1, 1)), # inv cf 'MI': ExprOp("CC_NEG", nf), 'PL': ExprOp("CC_POS", nf), 'VS': ExprOp("CC_sOVR", of), 'VC': ExprOp("CC_sNOOVR", of), 'HI': ExprOp("CC_U>", cf ^ ExprInt(1, 1), zf), # inv cf 'LS': ExprOp("CC_U<=", cf ^ ExprInt(1, 1), zf), # inv cf 'GE': ExprOp("CC_S>=", nf, of), 'LT': ExprOp("CC_S<", nf, of), 'GT': ExprOp("CC_S>", nf, of, zf), 'LE': ExprOp("CC_S<=", nf, of, zf), 'AL': ExprInt(1, 1), 'NV': ExprInt(0, 1) } def extend_arg(dst, arg): if not isinstance(arg, ExprOp): return arg op, (reg, shift) = arg.op, arg.args if op == "SXTB": base = reg[:8].signExtend(dst.size) op = "<<" elif op == "SXTH": base = reg[:16].signExtend(dst.size) op = "<<" elif op == 'SXTW': base = reg[:32].signExtend(dst.size) op = "<<" elif op == "SXTX": base = reg.signExtend(dst.size) op = "<<" elif op == "UXTB": base = reg[:8].zeroExtend(dst.size) op = "<<" elif op == "UXTH": base = reg[:16].zeroExtend(dst.size) op = "<<" elif op == 'UXTW': base = reg[:32].zeroExtend(dst.size) op = "<<" elif op == "UXTX": base = reg.zeroExtend(dst.size) op = "<<" elif op in ['<<', '>>', '<>', '<<<', '>>>']: base = reg.zeroExtend(dst.size) else: raise NotImplementedError('Unknown shifter operator') out = ExprOp(op, base, (shift.zeroExtend(dst.size) & ExprInt(dst.size - 1, dst.size))) return out # SemBuilder context ctx = {"PC": PC, "LR": LR, "nf": nf, "zf": zf, "cf": cf, "of": of, "cond2expr": cond2expr, "extend_arg": extend_arg, "ExprId":ExprId, "exception_flags": exception_flags, "interrupt_num": interrupt_num, "EXCEPT_DIV_BY_ZERO": EXCEPT_DIV_BY_ZERO, "EXCEPT_INT_XX": EXCEPT_INT_XX, } sbuild = SemBuilder(ctx) # instruction definition ############## @sbuild.parse def add(arg1, arg2, arg3): arg1 = arg2 + extend_arg(arg2, arg3) @sbuild.parse def sub(arg1, arg2, arg3): arg1 = arg2 - extend_arg(arg2, arg3) @sbuild.parse def neg(arg1, arg2): arg1 = - arg2 @sbuild.parse def and_l(arg1, arg2, arg3): arg1 = arg2 & extend_arg(arg2, arg3) @sbuild.parse def eor(arg1, arg2, arg3): arg1 = arg2 ^ extend_arg(arg2, arg3) @sbuild.parse def eon(arg1, arg2, arg3): arg1 = arg2 ^ (~extend_arg(arg2, arg3)) @sbuild.parse def orr(arg1, arg2, arg3): arg1 = arg2 | extend_arg(arg2, arg3) @sbuild.parse def orn(arg1, arg2, arg3): arg1 = arg2 | (~extend_arg(arg2, arg3)) @sbuild.parse def bic(arg1, arg2, arg3): arg1 = arg2 & (~extend_arg(arg2, arg3)) def bics(ir, instr, arg1, arg2, arg3): e = [] tmp1, tmp2 = arg2, (~extend_arg(arg2, arg3)) res = tmp1 & tmp2 e += [ExprAssign(zf, ExprOp('FLAG_EQ_AND', tmp1, tmp2))] e += update_flag_nf(res) e.append(ExprAssign(arg1, res)) return e, [] @sbuild.parse def mvn(arg1, arg2): arg1 = (~extend_arg(arg1, arg2)) def adds(ir, instr, arg1, arg2, arg3): e = [] arg3 = extend_arg(arg2, arg3) res = arg2 + arg3 e += update_flag_arith_add_zn(arg2, arg3) e += update_flag_arith_add_co(arg2, arg3) e.append(ExprAssign(arg1, res)) return e, [] def subs(ir, instr, arg1, arg2, arg3): e = [] arg3 = extend_arg(arg2, arg3) res = arg2 - arg3 e += update_flag_arith_sub_zn(arg2, arg3) e += update_flag_arith_sub_co(arg2, arg3) e.append(ExprAssign(arg1, res)) return e, [] def cmp(ir, instr, arg1, arg2): e = [] arg2 = extend_arg(arg1, arg2) e += update_flag_arith_sub_zn(arg1, arg2) e += update_flag_arith_sub_co(arg1, arg2) return e, [] def cmn(ir, instr, arg1, arg2): e = [] arg2 = extend_arg(arg1, arg2) e += update_flag_arith_add_zn(arg1, arg2) e += update_flag_arith_add_co(arg1, arg2) return e, [] def ands(ir, instr, arg1, arg2, arg3): e = [] arg3 = extend_arg(arg2, arg3) res = arg2 & arg3 e += [ExprAssign(zf, ExprOp('FLAG_EQ_AND', arg2, arg3))] e += update_flag_nf(res) e.append(ExprAssign(arg1, res)) return e, [] def tst(ir, instr, arg1, arg2): e = [] arg2 = extend_arg(arg1, arg2) res = arg1 & arg2 e += [ExprAssign(zf, ExprOp('FLAG_EQ_AND', arg1, arg2))] e += update_flag_nf(res) return e, [] @sbuild.parse def lsl(arg1, arg2, arg3): arg1 = arg2 << (arg3 & ExprInt(arg3.size - 1, arg3.size)) @sbuild.parse def lsr(arg1, arg2, arg3): arg1 = arg2 >> (arg3 & ExprInt(arg3.size - 1, arg3.size)) @sbuild.parse def asr(arg1, arg2, arg3): arg1 = ExprOp( 'a>>', arg2, (arg3 & ExprInt(arg3.size - 1, arg3.size))) @sbuild.parse def mov(arg1, arg2): arg1 = arg2 def movk(ir, instr, arg1, arg2): e = [] if isinstance(arg2, ExprOp): assert(arg2.op == 'slice_at' and isinstance(arg2.args[0], ExprInt) and isinstance(arg2.args[1], ExprInt)) value, shift = int(arg2.args[0]), int(arg2.args[1]) e.append( ExprAssign(arg1[shift:shift + 16], ExprInt(value, 16))) else: e.append(ExprAssign(arg1[:16], ExprInt(int(arg2), 16))) return e, [] @sbuild.parse def movz(arg1, arg2): arg1 = arg2 @sbuild.parse def movn(arg1, arg2): arg1 = ~arg2 @sbuild.parse def bl(arg1): PC = arg1 ir.IRDst = arg1 LR = ExprInt(instr.offset + instr.l, 64) @sbuild.parse def csel(arg1, arg2, arg3, arg4): cond_expr = cond2expr[arg4.name] arg1 = arg2 if cond_expr else arg3 def ccmp(ir, instr, arg1, arg2, arg3, arg4): e = [] if(arg2.is_int()): arg2=ExprInt(int(arg2),arg1.size) default_nf = arg3[0:1] default_zf = arg3[1:2] default_cf = arg3[2:3] default_of = arg3[3:4] cond_expr = cond2expr[arg4.name] res = arg1 - arg2 new_nf = nf new_zf = update_flag_zf(res)[0].src new_cf = update_flag_sub_cf(arg1, arg2)[0].src new_of = update_flag_sub_of(arg1, arg2)[0].src e.append(ExprAssign(nf, ExprCond(cond_expr, new_nf, default_nf))) e.append(ExprAssign(zf, ExprCond(cond_expr, new_zf, default_zf))) e.append(ExprAssign(cf, ExprCond(cond_expr, new_cf, default_cf))) e.append(ExprAssign(of, ExprCond(cond_expr, new_of, default_of))) return e, [] def csinc(ir, instr, arg1, arg2, arg3, arg4): e = [] cond_expr = cond2expr[arg4.name] e.append( ExprAssign( arg1, ExprCond( cond_expr, arg2, arg3 + ExprInt(1, arg3.size) ) ) ) return e, [] def csinv(ir, instr, arg1, arg2, arg3, arg4): e = [] cond_expr = cond2expr[arg4.name] e.append( ExprAssign( arg1, ExprCond( cond_expr, arg2, ~arg3) ) ) return e, [] def csneg(ir, instr, arg1, arg2, arg3, arg4): e = [] cond_expr = cond2expr[arg4.name] e.append( ExprAssign( arg1, ExprCond( cond_expr, arg2, -arg3) ) ) return e, [] def cset(ir, instr, arg1, arg2): e = [] cond_expr = cond2expr[arg2.name] e.append( ExprAssign( arg1, ExprCond( cond_expr, ExprInt(1, arg1.size), ExprInt(0, arg1.size) ) ) ) return e, [] def csetm(ir, instr, arg1, arg2): e = [] cond_expr = cond2expr[arg2.name] e.append( ExprAssign( arg1, ExprCond( cond_expr, ExprInt(-1, arg1.size), ExprInt(0, arg1.size) ) ) ) return e, [] def get_mem_access(mem): updt = None if isinstance(mem, ExprOp): if mem.op == 'preinc': if len(mem.args) == 1: addr = mem.args[0] else: addr = mem.args[0] + mem.args[1] elif mem.op == 'segm': base = mem.args[0] op, (reg, shift) = mem.args[1].op, mem.args[1].args if op == 'SXTW': off = reg.signExtend(base.size) << shift.zeroExtend(base.size) addr = base + off elif op == 'UXTW': off = reg.zeroExtend(base.size) << shift.zeroExtend(base.size) addr = base + off elif op == 'LSL': if isinstance(shift, ExprInt) and int(shift) == 0: addr = base + reg.zeroExtend(base.size) else: addr = base + \ (reg.zeroExtend(base.size) << shift.zeroExtend(base.size)) else: raise NotImplementedError('bad op') elif mem.op == "postinc": addr, off = mem.args updt = ExprAssign(addr, addr + off) elif mem.op == "preinc_wb": base, off = mem.args addr = base + off updt = ExprAssign(base, base + off) else: raise NotImplementedError('bad op') else: raise NotImplementedError('bad op') return addr, updt def ldr(ir, instr, arg1, arg2): e = [] addr, updt = get_mem_access(arg2) e.append(ExprAssign(arg1, ExprMem(addr, arg1.size))) if updt: e.append(updt) return e, [] def ldr_size(ir, instr, arg1, arg2, size): e = [] addr, updt = get_mem_access(arg2) e.append( ExprAssign(arg1, ExprMem(addr, size).zeroExtend(arg1.size))) if updt: e.append(updt) return e, [] def ldrb(ir, instr, arg1, arg2): return ldr_size(ir, instr, arg1, arg2, 8) def ldrh(ir, instr, arg1, arg2): return ldr_size(ir, instr, arg1, arg2, 16) def ldrs_size(ir, instr, arg1, arg2, size): e = [] addr, updt = get_mem_access(arg2) e.append( ExprAssign(arg1, ExprMem(addr, size).signExtend(arg1.size))) if updt: e.append(updt) return e, [] def ldrsb(ir, instr, arg1, arg2): return ldrs_size(ir, instr, arg1, arg2, 8) def ldrsh(ir, instr, arg1, arg2): return ldrs_size(ir, instr, arg1, arg2, 16) def ldrsw(ir, instr, arg1, arg2): return ldrs_size(ir, instr, arg1, arg2, 32) def ldaxrb(ir, instr, arg1, arg2): # TODO XXX no memory lock implemented assert arg2.is_op('preinc') assert len(arg2.args) == 1 ptr = arg2.args[0] e = [] e.append(ExprAssign(arg1, ExprMem(ptr, 8).zeroExtend(arg1.size))) return e, [] def ldxr(ir, instr, arg1, arg2): # TODO XXX no memory lock implemented assert arg2.is_op('preinc') assert len(arg2.args) == 1 ptr = arg2.args[0] e = [] e.append(ExprAssign(arg1, ExprMem(ptr, arg1.size).zeroExtend(arg1.size))) return e, [] def stlxr(ir, instr, arg1, arg2, arg3): assert arg3.is_op('preinc') assert len(arg3.args) == 1 ptr = arg3.args[0] e = [] e.append(ExprAssign(ExprMem(ptr, arg2.size), arg2)) # TODO XXX here, force update success e.append(ExprAssign(arg1, ExprInt(0, arg1.size))) return e, [] def stlxrb(ir, instr, arg1, arg2, arg3): assert arg3.is_op('preinc') assert len(arg3.args) == 1 ptr = arg3.args[0] e = [] e.append(ExprAssign(ExprMem(ptr, 8), arg2[:8])) # TODO XXX here, force update success e.append(ExprAssign(arg1, ExprInt(0, arg1.size))) return e, [] def stlrb(ir, instr, arg1, arg2): ptr = arg2.args[0] e = [] e.append(ExprAssign(ExprMem(ptr, 8), arg1[:8])) return e, [] def l_str(ir, instr, arg1, arg2): e = [] addr, updt = get_mem_access(arg2) e.append(ExprAssign(ExprMem(addr, arg1.size), arg1)) if updt: e.append(updt) return e, [] def strb(ir, instr, arg1, arg2): e = [] addr, updt = get_mem_access(arg2) e.append(ExprAssign(ExprMem(addr, 8), arg1[:8])) if updt: e.append(updt) return e, [] def strh(ir, instr, arg1, arg2): e = [] addr, updt = get_mem_access(arg2) e.append(ExprAssign(ExprMem(addr, 16), arg1[:16])) if updt: e.append(updt) return e, [] def stp(ir, instr, arg1, arg2, arg3): e = [] addr, updt = get_mem_access(arg3) e.append(ExprAssign(ExprMem(addr, arg1.size), arg1)) e.append( ExprAssign(ExprMem(addr + ExprInt(arg1.size // 8, addr.size), arg2.size), arg2)) if updt: e.append(updt) return e, [] def ldp(ir, instr, arg1, arg2, arg3): e = [] addr, updt = get_mem_access(arg3) e.append(ExprAssign(arg1, ExprMem(addr, arg1.size))) e.append( ExprAssign(arg2, ExprMem(addr + ExprInt(arg1.size // 8, addr.size), arg2.size))) if updt: e.append(updt) return e, [] def sbfm(ir, instr, arg1, arg2, arg3, arg4): e = [] rim, sim = int(arg3), int(arg4) + 1 if sim > rim: res = arg2[rim:sim].signExtend(arg1.size) else: shift = ExprInt(arg2.size - rim, arg2.size) res = (arg2[:sim].signExtend(arg1.size) << shift) e.append(ExprAssign(arg1, res)) return e, [] def ubfm(ir, instr, arg1, arg2, arg3, arg4): e = [] rim, sim = int(arg3), int(arg4) + 1 if sim != arg1.size - 1 and rim == sim: # Simple case: lsl value = int(rim) assert value < arg1.size e.append(ExprAssign(arg1, arg2 << (ExprInt(arg1.size - value, arg2.size)))) return e, [] if sim == arg1.size: # Simple case: lsr value = int(rim) assert value < arg1.size e.append(ExprAssign(arg1, arg2 >> (ExprInt(value, arg2.size)))) return e, [] if sim > rim: res = arg2[rim:sim].zeroExtend(arg1.size) else: shift = ExprInt(arg2.size - rim, arg2.size) res = (arg2[:sim].zeroExtend(arg1.size) << shift) e.append(ExprAssign(arg1, res)) return e, [] def bfm(ir, instr, arg1, arg2, arg3, arg4): e = [] rim, sim = int(arg3), int(arg4) + 1 if sim > rim: res = arg2[rim:sim] e.append(ExprAssign(arg1[:sim-rim], res)) else: shift_i = arg2.size - rim shift = ExprInt(shift_i, arg2.size) res = arg2[:sim] e.append(ExprAssign(arg1[shift_i:shift_i+sim], res)) return e, [] def mrs(ir, insr, arg1, arg2, arg3, arg4, arg5, arg6): e = [] if arg2.is_int(3) and arg3.is_int(3) and arg4.is_id("c4") and arg5.is_id("c2") and arg6.is_int(0): out = [] out.append(ExprInt(0x0, 28)) out.append(of) out.append(cf) out.append(zf) out.append(nf) e.append(ExprAssign(arg1, ExprCompose(*out).zeroExtend(arg1.size))) elif arg1.is_int(3) and arg2.is_int(3) and arg3.is_id("c4") and arg4.is_id("c2") and arg5.is_int(7): out = [] out.append(ExprInt(0x0, 38)) out.append(tco) e.append(ExprAssign(arg1, ExprCompose(*out).zeroExtend(arg1.size))) elif arg1.is_int(3) and arg2.is_int(3) and arg3.is_id("c4") and arg4.is_id("c2") and arg5.is_int(0): out = [] out.append(ExprInt(0x0, 39)) out.append(dit) e.append(ExprAssign(arg1, ExprCompose(*out).zeroExtend(arg1.size))) elif arg1.is_int(3) and arg2.is_int(0) and arg3.is_id("c4") and arg4.is_id("c2") and arg5.is_int(4): out = [] out.append(ExprInt(0x0, 40)) out.append(uao) e.append(ExprAssign(arg1, ExprCompose(*out).zeroExtend(arg1.size))) elif arg1.is_int(3) and arg2.is_int(0) and arg3.is_id("c4") and arg4.is_id("c2") and arg5.is_int(3): out = [] out.append(ExprInt(0x0, 41)) out.append(pan) e.append(ExprAssign(arg1, ExprCompose(*out).zeroExtend(arg1.size))) elif arg1.is_int(3) and arg2.is_int(3) and arg3.is_id("c4") and arg4.is_id("c2") and arg5.is_int(6): out = [] out.append(ExprInt(0x0, 51)) out.append(ssbs) e.append(ExprAssign(arg1, ExprCompose(*out).zeroExtend(arg1.size))) elif arg1.is_int(3) and arg2.is_int(3) and arg3.is_id("c4") and arg4.is_id("c2") and arg5.is_int(1): out = [] out.append(ExprInt(0x0, 54)) out.append(df) out.append(af) out.append(iff) out.append(ff) e.append(ExprAssign(arg1, ExprCompose(*out).zeroExtend(arg1.size))) elif arg1.is_int(3) and arg2.is_int(0) and arg3.is_id("c4") and arg4.is_id("c2") and arg5.is_int(2): out = [] out.append(ExprInt(0x0, 60)) out.append(cur_el) e.append(ExprAssign(arg1, ExprCompose(*out).zeroExtend(arg1.size))) elif arg1.is_int(3) and arg2.is_int(0) and arg3.is_id("c4") and arg4.is_id("c2") and arg5.is_int(0): out = [] out.append(ExprInt(0x0, 63)) out.append(spsel) e.append(ExprAssign(arg1, ExprCompose(*out).zeroExtend(arg1.size))) else: sreg = (int(arg2), int(arg3), int(str(arg4)[1:]), int(str(arg5)[1:]), int(arg6)) if sreg in system_regs: e.append(ExprAssign(arg1, system_regs[sreg])) else: raise NotImplementedError("Unknown system register: %d %d %s %s %d" % (int(arg2), int(arg3), str(arg4), str(arg5), int(arg6))) return e, [] def msr(ir, instr, arg1, arg2, arg3, arg4, arg5, arg6): e = [] if arg1.is_int(3) and arg2.is_int(3) and arg3.is_id("c4") and arg4.is_id("c2") and arg5.is_int(0): e.append(ExprAssign(nf, arg6[31:32])) e.append(ExprAssign(zf, arg6[30:31])) e.append(ExprAssign(cf, arg6[29:30])) e.append(ExprAssign(of, arg6[28:29])) elif arg1.is_int(3) and arg2.is_int(3) and arg3.is_id("c4") and arg4.is_id("c2") and arg5.is_int(7): e.append(ExprAssign(tco, arg6[25:26])) elif arg1.is_int(3) and arg2.is_int(3) and arg3.is_id("c4") and arg4.is_id("c2") and arg5.is_int(0): e.append(ExprAssign(dit, arg6[24:25])) elif arg1.is_int(3) and arg2.is_int(0) and arg3.is_id("c4") and arg4.is_id("c2") and arg5.is_int(4): e.append(ExprAssign(uao, arg6[23:24])) elif arg1.is_int(3) and arg2.is_int(0) and arg3.is_id("c4") and arg4.is_id("c2") and arg5.is_int(3): e.append(ExprAssign(pan, arg6[22:23])) elif arg1.is_int(3) and arg2.is_int(3) and arg3.is_id("c4") and arg4.is_id("c2") and arg5.is_int(6): e.append(ExprAssign(ssbs, arg6[12:13])) elif arg1.is_int(3) and arg2.is_int(3) and arg3.is_id("c4") and arg4.is_id("c2") and arg5.is_int(1): e.append(ExprAssign(df, arg6[9:10])) e.append(ExprAssign(af, arg6[8:9])) e.append(ExprAssign(iff, arg6[7:8])) e.append(ExprAssign(ff, arg6[6:7])) elif arg1.is_int(3) and arg2.is_int(0) and arg3.is_id("c4") and arg4.is_id("c2") and arg5.is_int(2): e.append(ExprAssign(cur_el, arg6[2:4])) elif arg1.is_int(3) and arg2.is_int(0) and arg3.is_id("c4") and arg4.is_id("c2") and arg5.is_int(0): e.append(ExprAssign(spsel, arg6[0:1])) else: sreg = (int(arg1), int(arg2), int(str(arg3)[1:]), int(str(arg4)[1:]), int(arg5)) if sreg in system_regs: e.append(ExprAssign(system_regs[sreg], arg6)) else: raise NotImplementedError("Unknown system register: %d %d %s %s %d" % (int(arg1), int(arg2), str(arg3), str(arg4), int(arg5))) return e, [] def adc(ir, instr, arg1, arg2, arg3): arg3 = extend_arg(arg2, arg3) e = [] r = arg2 + arg3 + cf.zeroExtend(arg3.size) e.append(ExprAssign(arg1, r)) return e, [] def adcs(ir, instr, arg1, arg2, arg3): arg3 = extend_arg(arg2, arg3) e = [] r = arg2 + arg3 + cf.zeroExtend(arg3.size) e.append(ExprAssign(arg1, r)) e += update_flag_arith_addwc_zn(arg2, arg3, cf) e += update_flag_arith_addwc_co(arg2, arg3, cf) return e, [] def sbc(ir, instr, arg1, arg2, arg3): arg3 = extend_arg(arg2, arg3) e = [] r = arg2 - (arg3 + (~cf).zeroExtend(arg3.size)) e.append(ExprAssign(arg1, r)) return e, [] def sbcs(ir, instr, arg1, arg2, arg3): arg3 = extend_arg(arg2, arg3) e = [] r = arg2 - (arg3 + (~cf).zeroExtend(arg3.size)) e.append(ExprAssign(arg1, r)) e += update_flag_arith_subwc_zn(arg2, arg3, ~cf) e += update_flag_arith_subwc_co(arg2, arg3, ~cf) return e, [] @sbuild.parse def madd(arg1, arg2, arg3, arg4): arg1 = arg2 * arg3 + arg4 @sbuild.parse def msub(arg1, arg2, arg3, arg4): arg1 = arg4 - (arg2 * arg3) @sbuild.parse def udiv(arg1, arg2, arg3): if arg3: arg1 = ExprOp('udiv', arg2, arg3) else: exception_flags = ExprInt(EXCEPT_DIV_BY_ZERO, exception_flags.size) @sbuild.parse def sdiv(arg1, arg2, arg3): if arg3: arg1 = ExprOp('sdiv', arg2, arg3) else: exception_flags = ExprInt(EXCEPT_DIV_BY_ZERO, exception_flags.size) @sbuild.parse def smaddl(arg1, arg2, arg3, arg4): arg1 = arg2.signExtend(arg1.size) * arg3.signExtend(arg1.size) + arg4 @sbuild.parse def cbz(arg1, arg2): dst = ExprLoc(ir.get_next_loc_key(instr), 64) if arg1 else arg2 PC = dst ir.IRDst = dst @sbuild.parse def cbnz(arg1, arg2): dst = arg2 if arg1 else ExprLoc(ir.get_next_loc_key(instr), 64) PC = dst ir.IRDst = dst @sbuild.parse def tbz(arg1, arg2, arg3): bitmask = ExprInt(1, arg1.size) << arg2 dst = ExprLoc( ir.get_next_loc_key(instr), 64 ) if arg1 & bitmask else arg3 PC = dst ir.IRDst = dst @sbuild.parse def tbnz(arg1, arg2, arg3): bitmask = ExprInt(1, arg1.size) << arg2 dst = arg3 if arg1 & bitmask else ExprLoc( ir.get_next_loc_key(instr), 64 ) PC = dst ir.IRDst = dst @sbuild.parse def b_ne(arg1): cond = cond2expr['NE'] dst = arg1 if cond else ExprLoc(ir.get_next_loc_key(instr), 64) PC = dst ir.IRDst = dst @sbuild.parse def b_eq(arg1): cond = cond2expr['EQ'] dst = arg1 if cond else ExprLoc(ir.get_next_loc_key(instr), 64) PC = dst ir.IRDst = dst @sbuild.parse def b_ge(arg1): cond = cond2expr['GE'] dst = arg1 if cond else ExprLoc(ir.get_next_loc_key(instr), 64) PC = dst ir.IRDst = dst @sbuild.parse def b_mi(arg1): cond = cond2expr['MI'] dst = arg1 if cond else ExprLoc(ir.get_next_loc_key(instr), 64) PC = dst ir.IRDst = dst @sbuild.parse def b_pl(arg1): cond = cond2expr['PL'] dst = arg1 if cond else ExprLoc(ir.get_next_loc_key(instr), 64) PC = dst ir.IRDst = dst @sbuild.parse def b_gt(arg1): cond = cond2expr['GT'] dst = arg1 if cond else ExprLoc(ir.get_next_loc_key(instr), 64) PC = dst ir.IRDst = dst @sbuild.parse def b_cc(arg1): cond = cond2expr['CC'] dst = arg1 if cond else ExprLoc(ir.get_next_loc_key(instr), 64) PC = dst ir.IRDst = dst @sbuild.parse def b_cs(arg1): cond = cond2expr['CS'] dst = arg1 if cond else ExprLoc(ir.get_next_loc_key(instr), 64) PC = dst ir.IRDst = dst @sbuild.parse def b_hi(arg1): cond = cond2expr['HI'] dst = arg1 if cond else ExprLoc(ir.get_next_loc_key(instr), 64) PC = dst ir.IRDst = dst @sbuild.parse def b_le(arg1): cond = cond2expr['LE'] dst = arg1 if cond else ExprLoc(ir.get_next_loc_key(instr), 64) PC = dst ir.IRDst = dst @sbuild.parse def b_ls(arg1): cond = cond2expr['LS'] dst = arg1 if cond else ExprLoc(ir.get_next_loc_key(instr), 64) PC = dst ir.IRDst = dst @sbuild.parse def b_lt(arg1): cond = cond2expr['LT'] dst = arg1 if cond else ExprLoc(ir.get_next_loc_key(instr), 64) PC = dst ir.IRDst = dst @sbuild.parse def ret(arg1): PC = arg1 ir.IRDst = arg1 @sbuild.parse def adrp(arg1, arg2): arg1 = (PC & ExprInt(0xfffffffffffff000, 64)) + arg2 @sbuild.parse def adr(arg1, arg2): arg1 = PC + arg2 @sbuild.parse def b(arg1): PC = arg1 ir.IRDst = arg1 @sbuild.parse def br(arg1): PC = arg1 ir.IRDst = arg1 @sbuild.parse def blr(arg1): PC = arg1 ir.IRDst = arg1 LR = ExprLoc(ir.get_next_loc_key(instr), 64) @sbuild.parse def nop(): """Do nothing""" @sbuild.parse def dsb(arg1): """Data Synchronization Barrier""" @sbuild.parse def isb(arg1): """Instruction Synchronization Barrier""" @sbuild.parse def dmb(arg1): """Data Memory Barrier""" @sbuild.parse def tlbi(arg1, arg2, arg3, arg4): """TLB invalidate operation""" @sbuild.parse def clrex(arg1): """Clear the local monitor of the executing PE""" @sbuild.parse def ic(arg1, arg2, arg3, arg4): """Instruction/Data cache operation""" def rev(ir, instr, arg1, arg2): out = [] for i in range(0, arg2.size, 8): out.append(arg2[i:i+8]) out.reverse() e = [] result = ExprCompose(*out) e.append(ExprAssign(arg1, result)) return e, [] def rev16(ir, instr, arg1, arg2): out = [] for i in range(0, arg2.size // 8): index = (i & ~1) + (1 - (i & 1)) out.append(arg2[index * 8:(index + 1) * 8]) e = [] result = ExprCompose(*out) e.append(ExprAssign(arg1, result)) return e, [] @sbuild.parse def extr(arg1, arg2, arg3, arg4): compose = ExprCompose(arg2, arg3) arg1 = compose[int(arg4):int(arg4)+arg1.size] @sbuild.parse def svc(arg1): exception_flags = ExprInt(EXCEPT_INT_XX, exception_flags.size) interrupt_num = ExprInt(int(arg1), interrupt_num.size) def fmov(ir, instr, arg1, arg2): if arg2.is_int(): # Transform int to signed floating-point constant with 3-bit exponent # and normalized 4 bits of precision # VFPExpandImm() of ARM Architecture Reference Manual imm8 = int(arg2) N = arg1.size assert N in [32, 64] E = 8 if N == 32 else 11 F = N - E - 1; # sign = imm8<7>; sign = (imm8 >> 7) & 1; # exp = NOT(imm8<6>):Replicate(imm8<6>,E-3):imm8<5:4>; exp = (((imm8 >> 6) & 1) ^ 1) << (E - 3 + 2) if (imm8 >> 6) & 1: tmp = (1 << (E - 3)) - 1 else: tmp = 0 exp |= tmp << 2 exp |= (imm8 >> 4) & 3 # frac = imm8<3:0>:Zeros(F-4); frac = (imm8 & 0xf) << (F - 4) value = frac value |= exp << (4 + F - 4) value |= sign << (4 + F - 4 + 1 + E - 3 + 2) arg2 = ExprInt(value, N) e = [ExprAssign(arg1, arg2)] return e, [] def fadd(ir, instr, arg1, arg2, arg3): e = [] e.append(ExprAssign(arg1, ExprOp('fadd', arg2, arg3))) return e, [] def fsub(ir, instr, arg1, arg2, arg3): e = [] e.append(ExprAssign(arg1, ExprOp('fsub', arg2, arg3))) return e, [] def fmul(ir, instr, arg1, arg2, arg3): e = [] e.append(ExprAssign(arg1, ExprOp('fmul', arg2, arg3))) return e, [] def fdiv(ir, instr, arg1, arg2, arg3): e = [] e.append(ExprAssign(arg1, ExprOp('fdiv', arg2, arg3))) return e, [] def fabs(ir, instr, arg1, arg2): e = [] e.append(ExprAssign(arg1, ExprOp('fabs', arg2))) return e, [] def fmadd(ir, instr, arg1, arg2, arg3, arg4): e = [] e.append( ExprAssign( arg1, ExprOp( 'fadd', arg4, ExprOp('fmul', arg2, arg3) ) ) ) return e, [] def fmsub(ir, instr, arg1, arg2, arg3, arg4): e = [] e.append( ExprAssign( arg1, ExprOp( 'fsub', arg4, ExprOp('fmul', arg2, arg3) ) ) ) return e, [] def fcvt(ir, instr, arg1, arg2): # XXX TODO: rounding e = [] src = ExprOp('fpconvert_fp%d' % arg1.size, arg2) e.append(ExprAssign(arg1, src)) return e, [] def scvtf(ir, instr, arg1, arg2): # XXX TODO: rounding e = [] src = ExprOp('sint_to_fp', arg2) if arg1.size != src.size: src = ExprOp('fpconvert_fp%d' % arg1.size, src) e.append(ExprAssign(arg1, src)) return e, [] def ucvtf(ir, instr, arg1, arg2): # XXX TODO: rounding e = [] src = ExprOp('uint_to_fp', arg2) if arg1.size != src.size: src = ExprOp('fpconvert_fp%d' % arg1.size, src) e.append(ExprAssign(arg1, src)) return e, [] def fcvtzs(ir, instr, arg1, arg2): # XXX TODO: rounding e = [] e.append( ExprAssign( arg1, ExprOp('fp_to_sint%d' % arg1.size, ExprOp('fpround_towardszero', arg2) ) ) ) return e, [] def fcvtzu(ir, instr, arg1, arg2): # XXX TODO: rounding e = [] e.append( ExprAssign( arg1, ExprOp('fp_to_uint%d' % arg1.size, ExprOp('fpround_towardszero', arg2) ) ) ) return e, [] def fcmpe(ir, instr, arg1, arg2): e = [] e.append( ExprAssign( nf, ExprOp('fcom_c0', arg1, arg2) ) ) e.append( ExprAssign( cf, ~ExprOp('fcom_c0', arg1, arg2) ) ) e.append( ExprAssign( zf, ExprOp('fcom_c3', arg1, arg2) ) ) e.append(ExprAssign(of, ExprInt(0, 1))) return e, [] def clz(ir, instr, arg1, arg2): e = [] e.append(ExprAssign(arg1, ExprOp('cntleadzeros', arg2))) return e, [] def casp(ir, instr, arg1, arg2, arg3): # XXX TODO: memory barrier e = [] if arg1.size == 32: regs = gpregs32_expr else: regs = gpregs64_expr index1 = regs.index(arg1) index2 = regs.index(arg2) # TODO endianness comp_value = ExprCompose(regs[index1], regs[index1 + 1]) new_value = ExprCompose(regs[index2], regs[index2 + 1]) assert arg3.is_op('preinc') ptr = arg3.args[0] data = ExprMem(ptr, comp_value.size) loc_store = ExprLoc(ir.loc_db.add_location(), ir.IRDst.size) loc_do = ExprLoc(ir.loc_db.add_location(), ir.IRDst.size) loc_next = ExprLoc(ir.get_next_loc_key(instr), ir.IRDst.size) e.append(ExprAssign(ir.IRDst, ExprCond(ExprOp("FLAG_EQ_CMP", data, comp_value), loc_do, loc_store))) e_store = [] e_store.append(ExprAssign(data, new_value)) e_store.append(ExprAssign(ir.IRDst, loc_do)) blk_store = IRBlock(ir.loc_db, loc_store.loc_key, [AssignBlock(e_store, instr)]) e_do = [] e_do.append(ExprAssign(regs[index1], data[:data.size // 2])) e_do.append(ExprAssign(regs[index1 + 1], data[data.size // 2:])) e_do.append(ExprAssign(ir.IRDst, loc_next)) blk_do = IRBlock(ir.loc_db, loc_do.loc_key, [AssignBlock(e_do, instr)]) return e, [blk_store, blk_do] @sbuild.parse def umaddl(arg1, arg2, arg3, arg4): arg1 = arg2.zeroExtend(arg1.size) * arg3.zeroExtend(arg1.size) + arg4 @sbuild.parse def umsubbl(arg1, arg2, arg3, arg4): arg1 = arg2.zeroExtend(arg1.size) * arg3.zeroExtend(arg1.size) + arg4 @sbuild.parse def umull(arg1, arg2, arg3): arg1 = (arg2.zeroExtend(64) * arg3.zeroExtend(64)) @sbuild.parse def umulh(arg1, arg2, arg3): arg1 = (arg2.zeroExtend(128) * arg3.zeroExtend(128))[64:] @sbuild.parse def smulh(arg1, arg2, arg3): arg1 = (arg2.signExtend(128) * arg3.signExtend(128))[64:] @sbuild.parse def smull(arg1, arg2, arg3): arg1 = (arg2.signExtend(64) * arg3.signExtend(64))[64:] def ldsmax(ir, instr, arg1, arg2, arg3): # XXX TODO: memory barrier # TODO: byte and halfword comparisons e = [] if arg1.size == 32: regs = gpregs32_expr zero_reg = WZR else: regs = gpregs64_expr zero_reg = XZR # TODO endianness # Label for path that updates memory value # Jumps to loc_do after loc_exchange = ExprLoc(ir.loc_db.add_location(), ir.IRDst.size) # Label for storing old value into destination register loc_no_exchange = ExprLoc(ir.loc_db.add_location(), ir.IRDst.size) # Label for location after ldsmax instruction loc_next = ExprLoc(ir.get_next_loc_key(instr), ir.IRDst.size) dest_reg = arg1 comp_value = arg2 mem_index = arg3.args[0] data = ExprMem(mem_index, comp_value.size) subs(ir, instr, zero_reg, comp_value, data) gt_cond = cond2expr['GT'] cond = ExprCond(gt_cond, loc_exchange, loc_no_exchange) e.append(ExprAssign(ir.IRDst, cond)) e_exchange = [] e_exchange.append(ExprAssign(dest_reg, data)) e_exchange.append(ExprAssign(data, comp_value)) e_exchange.append(ExprAssign(ir.IRDst, loc_next)) blk_exchange = IRBlock(ir.loc_db, loc_exchange.loc_key, [AssignBlock(e_exchange, instr)]) e_no_exchange = [] e_exchange.append(ExprAssign(dest_reg, data)) e_no_exchange.append(ExprAssign(ir.IRDst, loc_next)) blk_no_exchange = IRBlock(ir.loc_db, loc_no_exchange.loc_key, [AssignBlock(e_no_exchange, instr)]) return e, [blk_exchange, blk_no_exchange] mnemo_func = sbuild.functions mnemo_func.update({ 'and': and_l, 'adds': adds, 'ands': ands, 'tst': tst, 'subs': subs, 'cmp': cmp, 'cmn': cmn, 'movk': movk, 'ccmp': ccmp, 'csinc': csinc, 'csinv': csinv, 'csneg': csneg, 'cset': cset, 'csetm': csetm, 'b.ne': b_ne, 'b.eq': b_eq, 'b.ge': b_ge, 'b.mi': b_mi, 'b.pl': b_pl, 'b.gt': b_gt, 'b.cc': b_cc, 'b.cs': b_cs, 'b.hi': b_hi, 'b.le': b_le, 'b.ls': b_ls, 'b.lt': b_lt, 'bics': bics, 'ret': ret, 'stp': stp, 'ldp': ldp, 'ldr': ldr, 'ldrb': ldrb, 'ldrh': ldrh, 'ldur': ldr, 'ldurb': ldrb, 'ldursb': ldrsb, 'ldurh': ldrh, 'ldursh': ldrsh, 'ldursw': ldrsw, 'ldrsb': ldrsb, 'ldrsh': ldrsh, 'ldrsw': ldrsw, 'ldar': ldr, # TODO memory barrier 'ldarb': ldrb, 'ldaxrb': ldaxrb, 'stlxrb': stlxrb, 'stlr': l_str, # TODO memory barrier 'stlrb': stlrb, 'stlxr': stlxr, 'ldxr': ldxr, 'str': l_str, 'strb': strb, 'strh': strh, 'stur': l_str, 'sturb': strb, 'sturh': strh, 'bfm': bfm, 'sbfm': sbfm, 'ubfm': ubfm, 'extr': extr, 'rev': rev, 'rev16': rev16, 'msr': msr, 'mrs': mrs, 'adc': adc, 'adcs': adcs, 'sbc': sbc, 'sbcs': sbcs, 'fmov': fmov, 'fadd': fadd, 'fsub': fsub, 'fmul': fmul, 'fdiv': fdiv, 'fabs': fabs, 'fmadd': fmadd, 'fmsub': fmsub, 'fcvt': fcvt, 'scvtf': scvtf, 'ucvtf': ucvtf, 'fcvtzs': fcvtzs, 'fcvtzu': fcvtzu, 'fcmpe': fcmpe, 'clz': clz, # XXX TODO: memory barrier 'casp':casp, 'caspl':casp, 'caspa':casp, 'caspal':casp, 'yield': nop, 'isb': isb, 'dsb': dsb, 'dmb': dmb, 'tlbi': tlbi, 'clrex': clrex, 'ic': ic, # TODO: other synchronization variants 'ldsmaxb': ldsmax, 'ldsmaxh': ldsmax, 'ldsmaxw': ldsmax, 'ldsmax': ldsmax, }) def get_mnemo_expr(ir, instr, *args): if not instr.name.lower() in mnemo_func: raise NotImplementedError('unknown mnemo %s' % instr) instr, extra_ir = mnemo_func[instr.name.lower()](ir, instr, *args) return instr, extra_ir class aarch64info(object): mode = "aarch64" # offset class Lifter_Aarch64l(Lifter): def __init__(self, loc_db): Lifter.__init__(self, mn_aarch64, "l", loc_db) self.pc = PC self.sp = SP self.IRDst = ExprId('IRDst', 64) self.addrsize = 64 def get_ir(self, instr): args = instr.args if len(args) and isinstance(args[-1], ExprOp): if (args[-1].op in ['<<', '>>', '<>', '<<<', '>>>'] and isinstance(args[-1].args[-1], ExprId)): args[-1] = ExprOp(args[-1].op, args[-1].args[0], args[-1].args[-1][:8].zeroExtend(32)) instr_ir, extra_ir = get_mnemo_expr(self, instr, *args) self.mod_pc(instr, instr_ir, extra_ir) instr_ir, extra_ir = self.del_dst_zr(instr, instr_ir, extra_ir) return instr_ir, extra_ir def expr_fix_regs_for_mode(self, e): return e.replace_expr(replace_regs) def expraff_fix_regs_for_mode(self, e): dst = self.expr_fix_regs_for_mode(e.dst) src = self.expr_fix_regs_for_mode(e.src) return ExprAssign(dst, src) def irbloc_fix_regs_for_mode(self, irblock, mode=64): irs = [] for assignblk in irblock: new_assignblk = dict(assignblk) for dst, src in viewitems(assignblk): del(new_assignblk[dst]) # Special case for 64 bits: # If destination is a 32 bit reg, zero extend the 64 bit reg if (isinstance(dst, ExprId) and dst.size == 32 and dst in replace_regs): src = src.zeroExtend(64) dst = replace_regs[dst].arg dst = self.expr_fix_regs_for_mode(dst) src = self.expr_fix_regs_for_mode(src) new_assignblk[dst] = src irs.append(AssignBlock(new_assignblk, assignblk.instr)) return IRBlock(self.loc_db, irblock.loc_key, irs) def mod_pc(self, instr, instr_ir, extra_ir): "Replace PC by the instruction's offset" cur_offset = ExprInt(instr.offset, 64) pc_fixed = {self.pc: cur_offset} for i, expr in enumerate(instr_ir): dst, src = expr.dst, expr.src if dst != self.pc: dst = dst.replace_expr(pc_fixed) src = src.replace_expr(pc_fixed) instr_ir[i] = ExprAssign(dst, src) for idx, irblock in enumerate(extra_ir): extra_ir[idx] = irblock.modify_exprs(lambda expr: expr.replace_expr(pc_fixed) \ if expr != self.pc else expr, lambda expr: expr.replace_expr(pc_fixed)) def del_dst_zr(self, instr, instr_ir, extra_ir): "Writes to zero register are discarded" regs_to_fix = [WZR, XZR] instr_ir = [expr for expr in instr_ir if expr.dst not in regs_to_fix] new_irblocks = [] for irblock in extra_ir: irs = [] for assignblk in irblock: new_dsts = { dst:src for dst, src in viewitems(assignblk) if dst not in regs_to_fix } irs.append(AssignBlock(new_dsts, assignblk.instr)) new_irblocks.append(IRBlock(self.loc_db, irblock.loc_key, irs)) return instr_ir, new_irblocks class Lifter_Aarch64b(Lifter_Aarch64l): def __init__(self, loc_db): Lifter.__init__(self, mn_aarch64, "b", loc_db) self.pc = PC self.sp = SP self.IRDst = ExprId('IRDst', 64) self.addrsize = 64