X86: remove c_rez/rcl_rez/rcr_rez special operator

7 files changed, 127 insertions, 148 deletions

diff --git a/miasm2/arch/x86/sem.py b/miasm2/arch/x86/sem.py
index 589c2eb9..93c4910a 100644
--- a/miasm2/arch/x86/sem.py
+++ b/miasm2/arch/x86/sem.py
@@ -473,21 +473,19 @@ def get_shift(dst, src):
     return shift
 
 
-def _rotate_tpl(ir, instr, dst, src, op, left=False, include_cf=False):
+def _rotate_tpl(ir, instr, dst, src, op, left=False):
     '''Template to generate a rotater with operation @op
     A temporary basic block is generated to handle 0-rotate
     @op: operation to execute
     @left (optional): indicates a left rotate if set, default is False
-    @include_cf (optional): if set, add cf to @op inputs, default is False
     '''
     # Compute results
     shifter = get_shift(dst, src)
-    extended_args = (cf.zeroExtend(dst.size),) if include_cf else ()
-    res = m2_expr.ExprOp(op, dst, shifter, *extended_args)
+    res = m2_expr.ExprOp(op, dst, shifter)
 
     # CF is computed with 1-less round than `res`
     new_cf = m2_expr.ExprOp(
-        op, dst, shifter - m2_expr.ExprInt(1, size=shifter.size), *extended_args)
+        op, dst, shifter - m2_expr.ExprInt(1, size=shifter.size))
     new_cf = new_cf.msb() if left else new_cf[:1]
 
     # OF is defined only for @b == 1
@@ -523,12 +521,49 @@ def l_ror(ir, instr, dst, src):
     return _rotate_tpl(ir, instr, dst, src, '>>>')
 
 
-def rcl(ir, instr, dst, src):
-    return _rotate_tpl(ir, instr, dst, src, '<<<c_rez', left=True, include_cf=True)
+def rotate_with_carry_tpl(ir, instr, op, dst, src):
+    # Compute results
+    shifter = get_shift(dst, src).zeroExtend(dst.size + 1)
+    result = m2_expr.ExprOp(op, m2_expr.ExprCompose(dst, cf), shifter)
+
+    new_cf = result[dst.size:dst.size +1]
+    new_dst = result[:dst.size]
+
+    result_trunc = result[:dst.size]
+    if op == '<<<':
+        of_value = result_trunc.msb() ^ new_cf
+    else:
+        of_value = (dst ^ result_trunc).msb()
+    # OF is defined only for @b == 1
+    new_of = m2_expr.ExprCond(src - m2_expr.ExprInt(1, size=src.size),
+                              m2_expr.ExprInt(0, size=of.size),
+                              of_value)
+
+
+    # Build basic blocks
+    e_do = [m2_expr.ExprAff(cf, new_cf),
+            m2_expr.ExprAff(of, new_of),
+            m2_expr.ExprAff(dst, new_dst)
+            ]
+    # Don't generate conditional shifter on constant
+    if isinstance(shifter, m2_expr.ExprInt):
+        if int(shifter) != 0:
+            return (e_do, [])
+        else:
+            return ([], [])
+    e = []
+    lbl_do = m2_expr.ExprId(ir.gen_label(), ir.IRDst.size)
+    lbl_skip = m2_expr.ExprId(ir.get_next_label(instr), ir.IRDst.size)
+    e_do.append(m2_expr.ExprAff(ir.IRDst, lbl_skip))
+    e.append(m2_expr.ExprAff(
+        ir.IRDst, m2_expr.ExprCond(shifter, lbl_do, lbl_skip)))
+    return (e, [IRBlock(lbl_do.name, [AssignBlock(e_do, instr)])])
 
+def rcl(ir, instr, dst, src):
+    return rotate_with_carry_tpl(ir, instr, '<<<', dst, src)
 
 def rcr(ir, instr, dst, src):
-    return _rotate_tpl(ir, instr, dst, src, '>>>c_rez', include_cf=True)
+    return rotate_with_carry_tpl(ir, instr, '>>>', dst, src)
 
 
 def _shift_tpl(op, ir, instr, a, b, c=None, op_inv=None, left=False,
diff --git a/miasm2/expression/simplifications_common.py b/miasm2/expression/simplifications_common.py
index f045830e..ba938db5 100644
--- a/miasm2/expression/simplifications_common.py
+++ b/miasm2/expression/simplifications_common.py
@@ -48,11 +48,11 @@ def simp_cst_propagation(e_s, expr):
                 tmp2 = mod_size2uint[int2.arg.size](int2.arg)
                 out = mod_size2uint[int1.arg.size](tmp1 >> tmp2)
             elif op_name == '>>>':
-                out = (int1.arg >> (int2.arg % int2.size) |
-                     int1.arg << ((int1.size - int2.arg) % int2.size))
+                shifter = int2.arg % int2.size
+                out = (int1.arg >> shifter) | (int1.arg << (int2.size - shifter))
             elif op_name == '<<<':
-                out = (int1.arg << (int2.arg % int2.size) |
-                     int1.arg >> ((int1.size - int2.arg) % int2.size))
+                shifter = int2.arg % int2.size
+                out = (int1.arg << shifter) | (int1.arg >> (int2.size - shifter))
             elif op_name == '/':
                 out = int1.arg / int2.arg
             elif op_name == '%':
@@ -320,38 +320,6 @@ def simp_cst_propagation(e_s, expr):
                 args.append(ExprOp(op_name, *arg))
             return ExprCompose(*args)
 
-    # <<<c_rez, >>>c_rez
-    if op_name in [">>>c_rez", "<<<c_rez"]:
-        assert len(args) == 3
-        dest, rounds, carry_flag = args
-        # Skipped if rounds is 0
-        if rounds.is_int(0):
-            return dest
-        elif all(arg.is_int() for arg in args):
-            # The expression can be resolved
-            tmp = int(dest)
-            carry_flag = int(carry_flag)
-            size = dest.size
-            tmp_count = (int(rounds) &
-                         (0x3f if size == 64 else 0x1f)) % (size + 1)
-            if op_name == ">>>c_rez":
-                while tmp_count != 0:
-                    tmp_cf = tmp & 1;
-                    tmp = (tmp >> 1) + (carry_flag << (size - 1))
-                    carry_flag = tmp_cf
-                    tmp_count -= 1
-                    tmp &= int(dest.mask)
-            elif op_name == "<<<c_rez":
-                while tmp_count != 0:
-                    tmp_cf = (tmp >> (size - 1)) & 1
-                    tmp = (tmp << 1) + carry_flag
-                    carry_flag = tmp_cf
-                    tmp_count -= 1
-                    tmp &= int(dest.mask)
-            else:
-                raise RuntimeError("Unknown operation: %s" % op_name)
-            return ExprInt(tmp, size=dest.size)
-
     return ExprOp(op_name, *args)
 
 
diff --git a/miasm2/ir/translators/C.py b/miasm2/ir/translators/C.py
index 7a3080ca..95502a15 100644
--- a/miasm2/ir/translators/C.py
+++ b/miasm2/ir/translators/C.py
@@ -17,9 +17,6 @@ class TranslatorC(Translator):
     dct_rot = {'<<<': 'rot_left',
                '>>>': 'rot_right',
                }
-    dct_rotc = {'<<<c_rez': 'rcl_rez_op',
-                '>>>c_rez': 'rcr_rez_op',
-                }
 
 
     def from_ExprId(self, expr):
@@ -118,14 +115,6 @@ class TranslatorC(Translator):
             else:
                 raise NotImplementedError('Unknown op: %r' % expr.op)
 
-        elif len(expr.args) == 3 and expr.op in self.dct_rotc:
-            return '(%s(%s, %s, %s, %s) &0x%x)' % (self.dct_rotc[expr.op],
-                                                   expr.args[0].size,
-                                                   self.from_expr(expr.args[0]),
-                                                   self.from_expr(expr.args[1]),
-                                                   self.from_expr(expr.args[2]),
-                                                   size2mask(expr.args[0].size))
-
         elif len(expr.args) >= 3 and expr.is_associative():  # ?????
             oper = ['(%s&0x%x)' % (self.from_expr(arg), size2mask(arg.size))
                     for arg in expr.args]
@@ -144,7 +133,17 @@ class TranslatorC(Translator):
     def from_ExprCompose(self, expr):
         out = []
         # XXX check mask for 64 bit & 32 bit compat
-        dst_cast = "uint%d_t" % expr.size
+        if expr.size in [8, 16, 32, 64, 128]:
+            size = expr.size
+        else:
+            # Uncommon expression size
+            size = expr.size
+            next_power = 1
+            while next_power <= size:
+                next_power <<= 1
+            size = next_power
+
+        dst_cast = "uint%d_t" % size
         for index, arg in expr.iter_args():
             out.append("(((%s)(%s & 0x%X)) << %d)" % (dst_cast,
                                                       self.from_expr(arg),
diff --git a/miasm2/jitter/llvmconvert.py b/miasm2/jitter/llvmconvert.py
index 65c6aa07..9796b265 100644
--- a/miasm2/jitter/llvmconvert.py
+++ b/miasm2/jitter/llvmconvert.py
@@ -223,24 +223,6 @@ class LLVMContext_JIT(LLVMContext):
         itype = LLVMType.IntType(64)
         fc = {"llvm.ctpop.i8": {"ret": i8,
                                 "args": [i8]},
-              "rot_left": {"ret": itype,
-                           "args": [itype,
-                                    itype,
-                                    itype]},
-              "rot_right": {"ret": itype,
-                            "args": [itype,
-                                     itype,
-                                     itype]},
-              "rcr_rez_op": {"ret": itype,
-                             "args": [itype,
-                                      itype,
-                                      itype,
-                                      itype]},
-              "rcl_rez_op": {"ret": itype,
-                             "args": [itype,
-                                      itype,
-                                      itype,
-                                      itype]},
               "x86_bsr": {"ret": itype,
                           "args": [itype,
                                    itype]},
@@ -391,11 +373,7 @@ class LLVMFunction():
     op_translate = {'cpuid': 'cpuid',
     }
     ## Add the size as first argument
-    op_translate_with_size = {'<<<': 'rot_left',
-                              '>>>': 'rot_right',
-                              '<<<c_rez': 'rcl_rez_op',
-                              '>>>c_rez': 'rcr_rez_op',
-                              'bsr': 'x86_bsr',
+    op_translate_with_size = {'bsr': 'x86_bsr',
                               'bsf': 'x86_bsf',
     }
     ## Add the size as suffix
@@ -790,6 +768,30 @@ class LLVMFunction():
                 self.update_cache(expr, ret)
                 return ret
 
+
+            if op in ['<<<', '>>>']:
+                assert len(expr.args) == 2
+                # First compute rotation modulus size
+                count = self.add_ir(expr.args[1])
+                value = self.add_ir(expr.args[0])
+                itype = LLVMType.IntType(expr.size)
+                expr_size = itype(expr.size)
+
+                shift = builder.urem(count, expr_size)
+                shift_inv = builder.sub(expr_size, shift)
+
+                if op == '<<<':
+                    part_a = builder.shl(value, shift)
+                    part_b = builder.lshr(value, shift_inv)
+                else:
+                    part_a = builder.lshr(value, shift)
+                    part_b = builder.shl(value, shift_inv)
+                ret = builder.or_(part_a, part_b)
+                self.update_cache(expr, ret)
+                return ret
+
+
+
             if op in ["int_16_to_double", "int_32_to_double", "int_64_to_double",
                       "mem_16_to_double", "mem_32_to_double", "mem_64_to_double"]:
                 arg = self.add_ir(expr.args[0])
diff --git a/miasm2/jitter/vm_mngr.c b/miasm2/jitter/vm_mngr.c
index 353ef514..3c324a08 100644
--- a/miasm2/jitter/vm_mngr.c
+++ b/miasm2/jitter/vm_mngr.c
@@ -760,21 +760,34 @@ uint64_t rot_left(uint64_t size, uint64_t a, uint64_t b)
 {
     uint64_t tmp;
 
-    b = b&0x3F;
+    b = b & 0x3F;
     b %= size;
     switch(size){
 	    case 8:
-		    tmp = (a << b) | ((a&0xFF) >> (size-b));
-		    return tmp&0xff;
+		    tmp = (a << b) | ((a & 0xFF) >> (size - b));
+		    return tmp & 0xFF;
 	    case 16:
-		    tmp = (a << b) | ((a&0xFFFF) >> (size-b));
-		    return tmp&0xffff;
+		    tmp = (a << b) | ((a & 0xFFFF) >> (size - b));
+		    return tmp & 0xFFFF;
 	    case 32:
-		    tmp = (a << b) | ((a&0xFFFFFFFF) >> (size-b));
-		    return tmp&0xffffffff;
+		    tmp = (a << b) | ((a & 0xFFFFFFFF) >> (size - b));
+		    return tmp & 0xFFFFFFFF;
 	    case 64:
-		    tmp = (a << b) | ((a&0xFFFFFFFFFFFFFFFF) >> (size-b));
-		    return tmp&0xFFFFFFFFFFFFFFFF;
+		    tmp = (a << b) | ((a&0xFFFFFFFFFFFFFFFF) >> (size - b));
+		    return tmp & 0xFFFFFFFFFFFFFFFF;
+
+	    /* Support cases for rcl */
+	    case 9:
+		    tmp = (a << b) | ((a & 0x1FF) >> (size - b));
+		    return tmp & 0x1FF;
+	    case 17:
+		    tmp = (a << b) | ((a & 0x1FFFF) >> (size - b));
+		    return tmp & 0x1FFFF;
+	    case 33:
+		    tmp = (a << b) | ((a & 0x1FFFFFFFF) >> (size - b));
+		    return tmp & 0x1FFFFFFFF;
+	    /* TODO XXX: support rcl in 64 bit mode */
+
 	    default:
 		    fprintf(stderr, "inv size in rotleft %"PRIX64"\n", size);
 		    exit(EXIT_FAILURE);
@@ -785,64 +798,40 @@ uint64_t rot_right(uint64_t size, uint64_t a, uint64_t b)
 {
     uint64_t tmp;
 
-    b = b&0x3F;
+    b = b & 0x3F;
     b %= size;
     switch(size){
 	    case 8:
-		    tmp = ((a&0xFF) >> b) | (a << (size-b));
-		    return tmp&0xff;
+		    tmp = ((a & 0xFF) >> b) | (a << (size - b));
+		    return tmp & 0xff;
 	    case 16:
-		    tmp = ((a&0xFFFF) >> b) | (a << (size-b));
-		    return tmp&0xffff;
+		    tmp = ((a & 0xFFFF) >> b) | (a << (size - b));
+		    return tmp & 0xFFFF;
 	    case 32:
-		    tmp = ((a&0xFFFFFFFF) >> b) | (a << (size-b));
-		    return tmp&0xffffffff;
+		    tmp = ((a & 0xFFFFFFFF) >> b) | (a << (size - b));
+		    return tmp & 0xFFFFFFFF;
 	    case 64:
-		    tmp = ((a&0xFFFFFFFFFFFFFFFF) >> b) | (a << (size-b));
-		    return tmp&0xFFFFFFFFFFFFFFFF;
+		    tmp = ((a & 0xFFFFFFFFFFFFFFFF) >> b) | (a << (size - b));
+		    return tmp & 0xFFFFFFFFFFFFFFFF;
+
+	    /* Support cases for rcr */
+	    case 9:
+		    tmp = ((a & 0x1FF) >> b) | (a << (size - b));
+		    return tmp & 0x1FF;
+	    case 17:
+		    tmp = ((a & 0x1FFFF) >> b) | (a << (size - b));
+		    return tmp & 0x1FFFF;
+	    case 33:
+		    tmp = ((a & 0x1FFFFFFFF) >> b) | (a << (size - b));
+		    return tmp & 0x1FFFFFFFF;
+	    /* TODO XXX: support rcr in 64 bit mode */
+
 	    default:
 		    fprintf(stderr, "inv size in rotright %"PRIX64"\n", size);
 		    exit(EXIT_FAILURE);
     }
 }
 
-
-unsigned int rcl_rez_op(unsigned int size, unsigned int a, unsigned int b, unsigned int cf)
-{
-    uint64_t tmp;
-    uint64_t tmp_count;
-    uint64_t tmp_cf;
-
-    tmp = a;
-    // TODO 64bit mode
-    tmp_count = (b & 0x1f) % (size + 1);
-    while (tmp_count != 0) {
-	    tmp_cf = (tmp >> (size - 1)) & 1;
-	    tmp = (tmp << 1) + cf;
-	    cf = tmp_cf;
-	    tmp_count -= 1;
-    }
-    return tmp;
-}
-
-unsigned int rcr_rez_op(unsigned int size, unsigned int a, unsigned int b, unsigned int cf)
-{
-    uint64_t tmp;
-    uint64_t tmp_count;
-    uint64_t tmp_cf;
-
-    tmp = a;
-    // TODO 64bit mode
-    tmp_count = (b & 0x1f) % (size + 1);
-    while (tmp_count != 0) {
-	    tmp_cf = tmp & 1;
-	    tmp = (tmp >> 1) + (cf << (size - 1));
-	    cf = tmp_cf;
-	    tmp_count -= 1;
-    }
-    return tmp;
-}
-
 unsigned int x86_bsr(uint64_t size, uint64_t src)
 {
 	uint64_t i;
diff --git a/miasm2/jitter/vm_mngr.h b/miasm2/jitter/vm_mngr.h
index 7d126d0a..71ecc246 100644
--- a/miasm2/jitter/vm_mngr.h
+++ b/miasm2/jitter/vm_mngr.h
@@ -216,8 +216,6 @@ unsigned int umul16_hi(unsigned short a, unsigned short b);
 
 uint64_t rot_left(uint64_t size, uint64_t a, uint64_t b);
 uint64_t rot_right(uint64_t size, uint64_t a, uint64_t b);
-unsigned int rcl_rez_op(unsigned int size, unsigned int a, unsigned int b, unsigned int cf);
-unsigned int rcr_rez_op(unsigned int size, unsigned int a, unsigned int b, unsigned int cf);
 
 
 #define UDIV(sizeA)						\
diff --git a/test/expression/simplifications.py b/test/expression/simplifications.py
index 1e8e73ba..8923cb3e 100644
--- a/test/expression/simplifications.py
+++ b/test/expression/simplifications.py
@@ -297,18 +297,6 @@ to_test = [(ExprInt(1, 32) - ExprInt(1, 32), ExprInt(0, 32)),
     (expr_cmps(ExprInt(-10, 32), ExprInt(-5, 32)),
      ExprInt(0, 1)),
 
-    (ExprOp("<<<c_rez", i1, i0, i0),
-     i1),
-    (ExprOp("<<<c_rez", i1, i1, i0),
-     ExprInt(2, 32)),
-    (ExprOp("<<<c_rez", i1, i1, i1),
-     ExprInt(3, 32)),
-    (ExprOp(">>>c_rez", icustom, i0, i0),
-     icustom),
-    (ExprOp(">>>c_rez", icustom, i1, i0),
-     ExprInt(0x91A2B3C, 32)),
-    (ExprOp(">>>c_rez", icustom, i1, i1),
-     ExprInt(0x891A2B3C, 32)),
     (ExprOp("idiv", ExprInt(0x0123, 16), ExprInt(0xfffb, 16))[:8],
      ExprInt(0xc6, 8)),
     (ExprOp("imod", ExprInt(0x0123, 16), ExprInt(0xfffb, 16))[:8],