miasm/arch/mep/sem.py
# Toshiba MeP-c4 - miasm instructions side effects
# Guillaume Valadon <guillaume@valadon.net>
from miasm.core.sembuilder import SemBuilder
from miasm.ir.ir import Lifter
from miasm.arch.mep.arch import mn_mep
from miasm.arch.mep.regs import PC, SP, LP, SAR, TP, RPB, RPE, RPC, EPC, NPC, \
take_jmp, in_erepeat
from miasm.arch.mep.regs import EXC, HI, LO, PSW, DEPC, DBG
from miasm.expression.expression import ExprId, ExprInt, ExprOp, TOK_EQUAL
from miasm.expression.expression import ExprAssign, ExprCond, ExprMem
from miasm.core.cpu import sign_ext
from miasm.jitter.csts import EXCEPT_DIV_BY_ZERO
from miasm.arch.mep.regs import exception_flags
def compute_s_inf(arg1, arg2):
"""Signed comparison operator"""
return ((arg1 - arg2) ^ ((arg1 ^ arg2) & ((arg1 - arg2) ^ arg1))).msb()
def compute_u_inf(x, y):
"""Unsigned comparison operator"""
result = (((x - y) ^ ((x ^ y) & ((x - y) ^ x))) ^ x ^ y).msb()
return result
def i8(value):
return ExprInt(value, 8)
def i32(value):
return ExprInt(value, 32)
# SemBuilder context
ctx = {"PC": PC, "SP": SP, "LP": LP, "SAR": SAR, "TP": TP,
"RPB": RPB, "RPE": RPE, "RPC": RPC, "EPC": EPC, "NPC": NPC,
"EXC": EXC, "HI": HI, "LO": LO, "PSW": PSW, "DEPC": DEPC, "DBG": DBG,
"exception_flags": exception_flags, "compute_s_inf": compute_s_inf,
"compute_u_inf": compute_u_inf, "take_jmp": take_jmp,
"in_erepeat": in_erepeat, "EXCEPT_DIV_BY_ZERO": EXCEPT_DIV_BY_ZERO}
sbuild = SemBuilder(ctx)
# Functions used to get an instruction IR
manual_functions = dict()
@sbuild.parse
def mep_nop():
"""Dummy instruction"""
@sbuild.parse
def mep_nop_2_args(arg1, arg2):
"""Dummy instruction with two arguments"""
### Load/Store instructions
# Register indirect addressing mode
def sb(ir, instr, reg_src, deref_dst):
"""SB - Store Byte into memory"""
# MemByte(Rm31..0) <- Rn7..0
# MemByte((ZeroExt(disp7)+TP)31..0)) <- Rn7..0
# MemByte((SignExt(disp16)+Rm)31..0) <- Rn7..0
e = []
e.append(ExprAssign(ExprMem(deref_dst.ptr, 8), reg_src[:8]))
return e, []
manual_functions["sb"] = sb
def sh(ir, instr, reg_src, deref_dst):
"""SH - Store Halfword into memory"""
# MemHword(Rm31..1||0) <- Rn15..0
# MemHword((ZeroExt((disp7)6..1||0)+TP)31..1||0)) <- Rn15..0
# MemHword((SignExt(disp16)+Rm)31..1||0) <- Rn15..0
e = []
e.append(ExprAssign(ExprMem(deref_dst.ptr & i32(0xFFFFFFFE), 16), reg_src[:16]))
return e, []
manual_functions["sh"] = sh
def sw(ir, instr, reg_src, deref_dst):
"""SW - Store Word into memory"""
# MemWord(Rm31..2||00) <- Rn31..0
# MemWord((ZeroExt((disp7)6..2||00)+SP)31..2||00)) <- Rn31..0
# MemWord((ZeroExt((disp7)6..2||00)+TP)31..2||00)) <- Rn31..0
# MemWord((SignExt(disp16)+Rm)31..2||00) <- Rn31..0
# MemWord(ZeroExt((abs24)23..2||00)) - Rn31..0
e = []
e.append(ExprAssign(ExprMem(deref_dst.ptr & i32(0xFFFFFFFC), 32), reg_src))
return e, []
manual_functions["sw"] = sw
# Without the sembuilder
#def sw(ir, instr, reg_src, deref_reg_or_imm, deref_reg=None):
# """SW - store Word into memory.
#
# Note: there are three variants to get the memory address:
# - from a register
# - relatively to SP
# - relatively to TP"""
#
# if isinstance(deref_reg_or_imm, ExprMem):
# # MemWord(Rm31..2||00) <- Rn31..0
# dst = deref_reg_or_imm
#
# elif isinstance(deref_reg_or_imm, ExprInt) and deref_reg:
# # MemWord((ZeroExt((disp7)6..2||00)+SP)31..2||00)) <- Rn31..0
# # MemWord((ZeroExt((disp7)6..2||00)+TP)31..2||00)) <- Rn31..0
#
# imm = deref_reg_or_imm.zeroExtend(32)
# dst = ExprMem(ExprOp("+", imm, deref_reg.arg))
#
# return [ExprAssign(dst, reg_src)], []
def lb(ir, instr, reg_dst, deref_dst):
"""LB - Load Byte from memory"""
# Rn <- SignExt(MemByte(Rm31..0))
# Rn <- SignExt(MemByte((ZeroExt(disp7)+TP)31..0))
# Rn <- SignExt(MemByte((SignExt(disp16)+Rm)31..0)
e = []
e.append(ExprAssign(reg_dst, ExprMem(deref_dst.ptr, 8).signExtend(32)))
return e, []
manual_functions["lb"] = lb
def lh(ir, instr, reg_dst, deref_dst):
"""LH - Load Halfword from memory"""
# Rn <- SignExt(MemHword(Rm31..1||0))
# Rn <- SignExt(MemHword((ZeroExt((disp7)6..1||0)+TP)31..1||0)
# Rn <- SignExt(MemHword((SignExt(disp16)+Rm)31..1||0))
e = []
e.append(ExprAssign(reg_dst, ExprMem(deref_dst.ptr & i32(0xFFFFFFFE), 16).signExtend(32)))
return e, []
manual_functions["lh"] = lh
def lw(ir, instr, reg_dst, deref_dst):
"""LW - Load Word from memory"""
# Rn <- MemWord(Rm31..2||00)
# Rn <- MemWord((ZeroExt((disp7)6..2||00)+TP)31..2||00)
# Rn <- MemWord((SignExt(disp16)+Rm)31..2||00)
# Rn <- MemWord(ZeroExt((abs24)23..2||00))
e = []
e.append(ExprAssign(reg_dst, ExprMem(deref_dst.ptr & i32(0xFFFFFFFC), 32)))
return e, []
manual_functions["lw"] = lw
def lbu(ir, instr, reg_dst, deref_dst):
"""LBU - Load an unsigned Byte from memory"""
# Rn <- ZeroExt(MemByte(Rm31..0))
# Rn <- ZeroExt(MemByte((ZeroExt(disp7)+TP)31..0))
# Rn <- ZeroExt(MemByte((SignExt(disp16)+Rm)31..0))
e = []
e.append(ExprAssign(reg_dst, ExprMem(deref_dst.ptr, 8).zeroExtend(32)))
return e, []
manual_functions["lbu"] = lbu
def lhu(ir, instr, reg_dst, deref_dst):
"""LHU - Load an unsigned Halfword from memory"""
# Rn <- ZeroExt(MemHword(Rm31..1||0))
# Rn <- ZeroExt(MemHword((SignExt(disp16)+Rm)31..1||0))
# Rn <- ZeroExt(MemHword((ZeroExt((disp7)6..1||0)+TP)31..1||0))
e = []
e.append(ExprAssign(reg_dst, ExprMem(deref_dst.ptr & i32(0xFFFFFFFE), 16).zeroExtend(32)))
return e, []
manual_functions["lhu"] = lhu
### Byte/Halfword extension instructions
@sbuild.parse
def extb(reg):
"""EXTB - Sign extend a byte"""
# Rn <- SignExt(Rn7..0)
reg = reg[:8].signExtend(32)
@sbuild.parse
def exth(reg):
"""EXTH - Sign extend a word"""
# Rn <- ZeroExt(Rn15..0)
reg = reg[:16].signExtend(32)
@sbuild.parse
def extub(reg):
"""EXUTB - Zero extend a byte"""
# Rn <- SignExt(Rn7..0)
reg = reg[:8].zeroExtend(32)
@sbuild.parse
def extuh(reg):
"""EXTUH - Zero extend a word"""
# Rn <- ZeroExt(Rn15..0)
reg = reg[:16].zeroExtend(32)
### Shift amount manipulation instructions
#@sbuild.parse
#def ssarb(deref_reg):
### Move instructions
@sbuild.parse
def mov(reg, value):
"""MOV - Copy 'value' to a register. The three alternatives are handled."""
# Rn <- Rm
# Rn <- SignExt(imm8)
# Rn <- SignExt(imm16)
reg = value.signExtend(32)
@sbuild.parse
def movu(reg, value):
"""MOV - Copy 'value' to a register. The two alternatives are handled."""
# Rn[0-7] <- ZeroExt(imm24)
# Rn <- ZeroExt(imm16)
reg = value.zeroExtend(32)
@sbuild.parse
def movh(reg, imm16):
"""MOVH - Copy a shifted imm16 to a register."""
# Rn <- imm16 <<16
reg = imm16.zeroExtend(32) << i32(16)
### Arithmetic instructions
def add3(ir, instr, reg_dst, reg_src, reg_or_imm):
"""ADD3 - Add two register and store the result to a register, or
add a register and an immediate and store the result to a register"""
if isinstance(reg_or_imm, ExprId):
# Rl <- Rn + Rm
result = ExprOp("+", reg_src, reg_or_imm)
else:
# Rn <- Rm + SignExt(imm16)
value = int(reg_or_imm)
result = ExprOp("+", reg_src, ExprInt(value, 32))
return [ExprAssign(reg_dst, result)], []
manual_functions["add3"] = add3
@sbuild.parse
def add(arg1, arg2):
"""ADD - Add a register and an immediate."""
# Rn <- Rn + SignExt(imm6)
arg1 = arg1 + arg2.signExtend(32)
@sbuild.parse
def advck3(r0, rn, rm):
"""ADVCK3 - Check addition overflow."""
# if(Overflow(Rn+Rm)) R0<-1 else R0<-0 (Signed)
r0 = i32(1) if compute_u_inf(i64(0xFFFFFFFF), rn.zeroExtend(64) + rm.zeroExtend(64)) else i32(0)
@sbuild.parse
def sub(reg1, reg2):
"""SUB - Subtract one register to another."""
# Rn <- Rn - Rm
reg1 = reg1 - reg2
def sbvck3(ir, instr, r0, rn, rm):
"""SBVCK3 - Check subtraction overflow"""
# if(Overflow(Rn-Rm)) R0<-1 else R0<-0 (Signed)
# Subtract registers
reg_sub = ExprOp("+", rn, rm)
# Get the register storing the highest value
max_rn_rm = ExprCond(ExprOp(">", rn, rm), rn, rm)
# Check for an overflow
overflow_test = ExprOp(">", reg_sub, max_rn_rm)
# Return the result
condition = ExprCond(overflow_test, ExprInt(1, 32), ExprInt(0, 32))
return [ExprAssign(r0, condition)], []
manual_functions["sbvck3"] = sbvck3
@sbuild.parse
def neg(reg1, reg2):
"""NEG - Negate one register."""
# Rn <- - Rm
reg1 = - reg2
@sbuild.parse
def slt3(r0, rn, rm_or_imm5):
"""SLT3 - Set on less than (signed)."""
# if (Rn<Rm) R0<-1 else R0<-0 (Signed)
# if (Rn<ZeroExt(imm5)) R0<-1 else R0<-0(Signed)
r0 = i32(1) if compute_s_inf(rn, rm_or_imm5.signExtend(32)) else i32(0)
if False:
rm_ext = rm_or_imm5
# Mask sign bits
sign_mask = i32(0x80000000)
sign_rn = rn & sign_mask
sign_rm = rm_ext & sign_mask
# Check if both numbers are positive or negative
are_both_neg = sign_rn & sign_rm
are_both_pos = ~(sign_rn & sign_rm) >> i32(31)
# rn is positive and rm negative, return 1
r0_mixed = i32(1) if sign_rn else i32(0)
# rn & rm are both positives, test and return 1 or 0
r0_pos = (i32(1) if "<"(rn, rm_ext) else i32(0)) if are_both_pos else r0_mixed
# rn & rm are both negatives, test and return 0 or 1
r0 = (i32(0) if "<"(rn, rm_ext) else i32(1)) if are_both_neg else r0_pos
@sbuild.parse
def sltu3(r0, rn, rm_or_imm5):
"""SLTU3 - Set on less than (unsigned)."""
# if (Rn<Rm) R0<-1 else R0<-0 (Unsigned)
# if (Rn<ZeroExt(imm5)) R0<-1 else R0<-0(Unsigned)
r0 = i32(1) if compute_u_inf(rn, rm_or_imm5) else i32(0)
@sbuild.parse
def sl1ad3(r0, rn, rm):
"""SL1AD3 - Shift a register one bit left, then add another one."""
# R0 <- (Rn<<1) + Rm
r0 = (rn << i32(1)) + rm
@sbuild.parse
def sl2ad3(r0, rn, rm):
"""SL2AD3 - Shift a register two bits left, then add another one."""
# R0 <- (Rn<<2) + Rm
r0 = (rn << i32(2)) + rm
### Logical instructions
@sbuild.parse
def logical_or(rn, rm):
"""OR - Logical OR between two registers."""
# Rn <- Rn or Rm
rn = rn | rm
manual_functions["or"] = logical_or
@sbuild.parse
def logical_and(rn, rm):
"""AND - Logical AND between two registers."""
# Rn <- Rn and Rm
rn = rn & rm
manual_functions["and"] = logical_and
@sbuild.parse
def xor(rn, rm):
"""XOR - Logical XOR between two registers."""
# Rn <- Rn xor Rm
rn = rn ^ rm
@sbuild.parse
def nor(rn, rm):
"""NOR - Logical NOR between two registers."""
# Rn <- Rn nor Rm
rn = ~ (rn | rm)
@sbuild.parse
def or3(rn, rm, imm16):
"""OR3 - Logical OR between a register and an immediate"""
# Rn <- Rm or ZeroExt(imm16)
rn = rm | imm16
@sbuild.parse
def and3(rn, rm, imm16):
"""AND3 - Logical AND between a register and an immediate"""
# Rn <- Rm and ZeroExt(imm16)
rn = rm & imm16
@sbuild.parse
def xor3(rn, rm, imm16):
"""XOR3 - Logical XOR between a register and an immediate"""
# Rn <- Rm xor ZeroExt(imm16)
rn = rm ^ imm16
### Shift instruction
@sbuild.parse
def sra(rn, rm_or_imm5):
"""SRA - Shift Right signed"""
# Rn <- (Signed) Rn >> Rm4..0
# Rn <- (Signed) Rn >> imm5
# Unsigned result
shift_u = rn >> rm_or_imm5
# Signed result
shift_mask = i32(32) - rm_or_imm5
mask = (i32(0xFFFFFFFF) >> shift_mask) << shift_mask
shift_s = shift_u | mask
rn = shift_s if rn.msb() else shift_u
@sbuild.parse
def srl(rn, rm_or_imm5):
"""SRL - Shift Right unsigned."""
# Rn <- (Unsigned) Rn >> Rm4..0
# Rn <- (Unsigned) Rn >> imm5
rn = rn >> rm_or_imm5
@sbuild.parse
def sll(rn, rm_or_imm5):
"""SLL - Shift Left unsigned."""
# Rn <- (Unsigned) Rn >> Rm4..0
# Rn <- (Unsigned) Rn << imm5
rn = rn << rm_or_imm5
@sbuild.parse
def sll3(r0, rn, imm5):
"""SLL3 - Shift Left unsigned, with 3 arguments."""
# R0 <- (Unsigned) Rn << imm5
r0 = rn << imm5
@sbuild.parse
def fsft(rn, rm):
"""FSFT - Funnel shift."""
# Rn <- ((Rn||Rm)<<SAR5..0)63..32
# Note: lowest Rm bits are discarded
sar = SAR[:5].zeroExtend(32)
tmp_rn = rn << sar # Shift Rn
tmp_rm = rm >> (i32(32) - sar) # Shift Rm in the reverse order
rn = tmp_rn | tmp_rm # Concatenate registers
## Branch/Jump instructions
@sbuild.parse
def bra(disp12):
"""BRA - Branch to an address."""
# PC <- PC + SignExt((disp12)11..1||0)
dst = disp12
PC = dst
take_jmp = ExprInt(1, 32)
ir.IRDst = dst
@sbuild.parse
def beqz(reg_test, disp8):
"""BEQZ - Branch if the register stores zero."""
# if(Rn==0) PC <- PC +SignExt((disp8)7..1||0)
dst = ExprLoc(ir.get_next_break_loc_key(instr), 32) if reg_test else disp8
take_jmp = ExprInt(0, 32) if reg_test else ExprInt(1, 32)
PC = dst
ir.IRDst = dst
@sbuild.parse
def bnez(reg_test, disp8):
"""BNEZ - Branch if the register does not store zero."""
# if(Rn!=0) PC <- PC + SignExt((disp8)7..1||0)
dst = disp8 if reg_test else ExprLoc(ir.get_next_break_loc_key(instr), 32)
take_jmp = ExprInt(1, 32) if reg_test else ExprInt(0, 32)
PC = dst
ir.IRDst = dst
@sbuild.parse
def beqi(reg_test, imm4, disp16):
"""BEQI - Branch if the register stores imm4."""
# if(Rn==ZeroExt(imm4)) PC <- PC +SignExt((disp17)16..1||0)
dst = ExprLoc(ir.get_next_break_loc_key(instr), 32) if (reg_test - imm4) else disp16
take_jmp = ExprInt(0, 32) if (reg_test - imm4) else ExprInt(1, 32)
PC = dst
ir.IRDst = dst
@sbuild.parse
def bnei(reg_test, imm4, disp16):
"""BNEI - Branch if the register does not store imm4."""
# if(Rn!=ZeroExt(imm4)) PC <- PC+SignExt((disp17)16..1||0)
dst = disp16 if (reg_test - imm4) else ExprLoc(ir.get_next_break_loc_key(instr), 32)
take_jmp = ExprInt(1, 32) if (reg_test - imm4) else ExprInt(0, 32)
PC = dst
ir.IRDst = dst
@sbuild.parse
def blti(reg_test, imm4, disp16):
"""BLTI - Branch if the register is lower than imm4."""
# if(Rn< ZeroExt(imm4)) PC <- PC +SignExt((disp17)16..1||0) - (Signed comparison)
dst = disp16 if compute_s_inf(reg_test, imm4) else ExprLoc(ir.get_next_break_loc_key(instr), 32)
take_jmp = ExprInt(1, 32) if compute_s_inf(reg_test, imm4) else ExprInt(0, 32)
PC = dst
ir.IRDst = dst
@sbuild.parse
def bgei(reg_test, imm4, disp16):
"""BGEI - Branch if the register is greater or equal to imm4."""
# if(Rn>=ZeroExt(imm4)) PC <- PC +SignExt((disp17)16..1||0) - (Signed comparison)
cond = i32(1) if ExprOp(TOK_EQUAL, reg_test, imm4) else compute_s_inf(imm4, reg_test).zeroExtend(32)
dst = disp16 if cond else ExprLoc(ir.get_next_break_loc_key(instr), 32)
take_jmp = ExprInt(1, 32) if cond else ExprInt(0, 32)
PC = dst
ir.IRDst = dst
@sbuild.parse
def beq(rn, rm, disp16):
"""BEQ - Branch if the two registers are equal."""
# if(Rn==Rm) PC <- PC +SignExt((disp17)16..1||0)
dst = ExprLoc(ir.get_next_break_loc_key(instr), 32) if (rn - rm) else disp16
take_jmp = ExprInt(0, 32) if (rn - rm) else ExprInt(1, 32)
PC = dst
ir.IRDst = dst
@sbuild.parse
def bne(rn, rm, disp16):
"""BNE - Branch if the two registers are not equal."""
# if(Rn!=Rm) PC <- PC +SignExt((disp17)16..1||0)
dst = disp16 if (rn - rm) else ExprLoc(ir.get_next_break_loc_key(instr), 32)
take_jmp = ExprInt(1, 32) if (rn - rm) else ExprInt(0, 32)
PC = dst
ir.IRDst = dst
@sbuild.parse
def bsr(disp):
"""BSR - Branch to an address, and store the return address."""
# 16-bit variant: LP <- PC + 2; PC <- PC +SignExt((disp12)11..1||0)
# 32-bit variant: LP <- PC + 4; PC <- PC +SignExt((disp24)23..1||0)
# Set LP
LP = ExprLoc(ir.get_next_break_loc_key(instr), 32)
take_jmp = ExprInt(1, 32)
# Set PC according to the immediate size
dst = disp
PC = dst
ir.IRDst = dst
def jmp(ir, instr, reg_or_imm):
"""JMP - Change PC to a register content or an immediate.
Note: the behavior in VLIW mode is not implemented"""
take_jmp = ExprInt(1, 32)
if isinstance(reg_or_imm, ExprId):
# PC <- Rm31..1||0
new_PC = ExprAssign(PC, reg_or_imm)
else:
# PC <- PC31..28||0000||(target24)23..1||0
new_PC = ExprAssign(PC, ExprOp("+", ExprOp("&", PC, ExprInt(0xF0000000, 32)), reg_or_imm))
return [new_PC, ExprAssign(ir.IRDst, new_PC)], []
manual_functions["jmp"] = jmp
@sbuild.parse
def jsr(reg):
"""JSR - Jump to the register, and store the return address."""
# LP <- PC + 2; PC <- Rm31..1||0
LP = ExprLoc(ir.get_next_break_loc_key(instr), 32)
take_jmp = ExprInt(1, 32)
PC = reg
ir.IRDst = reg
@sbuild.parse
def ret():
"""RET - Return from a function call.
Note: the behavior in VLIW mode is not implemented"""
# PC <- LP31..1||0
dst = LP
PC = dst
ir.IRDst = dst
# Repeat instructions
@sbuild.parse
def repeat(rn, disp17):
"""REPEAT - This instruction repeats an instruction block. It sets the RPB,
RPE and RPC control registers."""
# RPB <- pc+4 // Repeat Begin
RPB = PC + i32(4)
# RPE <- pc+SignExt((disp17)16..1||0)) // Repeat End
RPE = PC + i32(int(disp17) & 0xFFFFFFFE)
# RPC <- Rn
RPC = rn
in_erepeat = ExprInt(0, 32)
@sbuild.parse
def erepeat(disp17):
"""EREPEAT - This instruction repeats an instruction block. It sets the RPB
and RPE control registers. To distinguish from the repeat instruction,
the least significant bit in the RPE register (ELR) is set to 1."""
# RPB <- pc+4 // Repeat Begin
RPB = PC + i32(4)
# RPE <- pc+SignExt((disp17)16..1||1)) (EREPEAT)
RPE = PC + i32(int(disp17) + 1)
# RPC <- undefined
in_erepeat = ExprInt(1, 32)
## Control Instructions
@sbuild.parse
def stc(reg, control_reg):
"""STC - Copy a general-purpose register into a control register."""
# ControlReg(imm5) <- Rn
control_reg = reg
@sbuild.parse
def ldc(reg, control_reg):
"""LDC - Copy a control register into a general-purpose register."""
# Rn <- ControlReg(imm5)
reg = control_reg
@sbuild.parse
def di():
"""DI - Disable Interrupt"""
# PSW.IEC<-0
PSW = PSW & i32(0xFFFFFFFE) # PSW.IEC: bit 0
@sbuild.parse
def ei():
"""EI - Enable Interrupt"""
# PSW.IEC<-1
PSW = PSW ^ i32(0b1) # PSW.IEC: bit 0
@sbuild.parse
def reti():
"""RETI - Return from the exception/interrupt handler.
Note: the behavior in VLIW mode is not implemented"""
#if (PSW.NMI==1) {
# PC <- NPC31..1 || 0; PSW.NMI<-0;
#} else {
# PC <- EPC31..1 || 0;
# PSW.UMC <- PSW.UMP; PSW.IEC <- PSW.IEP
#}
# PSW.NMI == bit 9
NMI_mask = i32(1 << 9)
# PSW.UMP == bit 3
# PSW.IEP == bit 1
UMP_IEP_mask = i32((1 << 3) ^ (1 << 1))
# PSW.UMC == bit 2
# PSW.IEC == bit 0
UMC_IEC_mask = (PSW & UMP_IEP_mask) >> i32(1)
# Get PSW.NMI
PSW_NMI = (PSW & NMI_mask) >> i32(9)
# Set PC
dst = NPC & i32(0xFFFFFFFE) if PSW_NMI else EPC & i32(0xFFFFFFFE)
PC = dst
# Set flags
PSW = PSW ^ NMI_mask if PSW_NMI else PSW ^ UMC_IEC_mask
ir.IRDst = dst
@sbuild.parse
def swi(imm2):
"""SWI - Software Interrupt"""
# if(imm2==0) EXC.SIP0 <- 1
# else if (imm2==1) EXC.SIP1 <- 1
# else if (imm2==2) EXC.SIP2 <- 1
# else if (imm2==3) EXC.SIP3 <- 1
# EXC.SIP0 == bit 4
# EXC.SIP1 == bit 5
# EXC.SIP2 == bit 6
# EXC.SIP3 == bit 7
EXC = EXC ^ (i32(1) << (i32(4) + imm2))
# Note: the following instructions can't be implemented
manual_functions["halt"] = mep_nop
manual_functions["sleep"] = mep_nop
manual_functions["break"] = mep_nop
manual_functions["syncm"] = mep_nop
manual_functions["stcb"] = mep_nop_2_args
manual_functions["ldcb"] = mep_nop_2_args
### Bit manipulation instruction option
def bsetm(ir, instr, rm_deref, imm3):
"""BSETM - Bit Set Memory"""
# MemByte(Rm) <- MemByte(Rm) or (1<<imm3)
e = []
e.append(ExprAssign(ExprMem(rm_deref.ptr, 8), ExprOp("|", ExprMem(rm_deref.ptr, 8), (i8(1) << imm3[:8]))))
return e, []
manual_functions["bsetm"] = bsetm
def bclrm(ir, instr, rm_deref, imm3):
"""BCLRM - Bit Clear Memory"""
# MemByte(Rm) <- MemByte(Rm) and ~(1<<imm3)
e = []
shift = ExprOp("<<", i8(1), imm3[:8])
e.append(ExprAssign(ExprMem(rm_deref.ptr, 8), ExprOp("&", ExprMem(rm_deref.ptr, 8), shift.__invert__())))
return e, []
manual_functions["bclrm"] = bclrm
def bnotm(ir, instr, rm_deref, imm3):
"""BNOTM - Bit Not Memory"""
# MemByte(Rm) <- MemByte(Rm) xor (1<<imm3)
e = []
e.append(ExprAssign(ExprMem(rm_deref.ptr, 8), ExprOp("^", ExprMem(rm_deref.ptr, 8), (i8(1) << imm3[:8]))))
return e, []
manual_functions["bnotm"] = bnotm
def btstm(ir, instr, r0, rm_deref, imm3):
"""BTSTM - Bit Test Memory"""
# R0 <- ZeroExt( MemByte(Rm) and (1<<imm3) )
e = []
e.append(ExprAssign(r0, ExprOp("&", ExprMem(rm_deref.ptr, 8), i8(1) << imm3[:8]).zeroExtend(32)))
return e, []
manual_functions["btstm"] = btstm
def tas(ir, instr, rn, rm_deref):
"""TAS - Load And Set"""
# temp <- Rm; Rn <- ZeroExt(MemByte(temp)); MemByte(temp) <- 1
e = []
temp = rm_deref
e.append(ExprAssign(rn, ExprMem(temp.ptr, 8).zeroExtend(32)))
e.append(ExprAssign(ExprMem(temp.ptr, 8), i8(1)))
return e, []
manual_functions["tas"] = tas
### Data cache option
# Note: the following instruction can't be implemented
manual_functions["cache"] = mep_nop_2_args
### 32-bit multiply instruction option
@sbuild.parse
def mul(rn, rm):
"""MUL - Signed 32-bit multiplication"""
# HI||LO <- Rn * Rm (Signed)
result = rn.signExtend(64) * rm.signExtend(64) # expand registers size
HI = result[32:64]
LO = result[:32]
@sbuild.parse
def mulu(rn, rm):
"""MUL - Unsigned 32-bit multiplication"""
# HI||LO <- Rn * Rm (Unsigned)
result = rn.zeroExtend(64) * rm.zeroExtend(64) # expand registers size
HI = result[32:64]
LO = result[0:32]
@sbuild.parse
def mulr(rn, rm):
"""MULR - Signed 32-bit multiplication & store LO in Rn"""
# HI||LO <- Rn * Rm; Rn <- LO (Signed)
result = rn.signExtend(64) * rm.signExtend(64) # expand registers size
HI = result[32:64]
LO = result[:32]
rn = result[:32]
@sbuild.parse
def mulru(rn, rm):
"""MULRU - Unsigned 32-bit multiplication & store LO in Rn"""
# HI||LO <- Rn * Rm; Rn <- LO (Unsigned)
result = rn.zeroExtend(64) * rm.zeroExtend(64) # expand registers size
HI = result[32:64]
LO = result[:32]
rn = result[:32]
@sbuild.parse
def madd(rn, rm):
"""MADD - Signed 32-bit multiplication, adding results to HI & LO registers"""
# HI||LO <- HI||LO + Rn*Rm (Signed)
result = (HI << i32(32)).signExtend(64) + LO.signExtend(64) + rn.signExtend(64) * rm.signExtend(64) # expand registers size
HI = result[32:64]
LO = result[:32]
@sbuild.parse
def maddu(rn, rm):
"""MADDU - Unsigned 32-bit multiplication, adding results to HI & LO registers"""
# HI||LO <- HI||LO + Rn*Rm (Unsigned)
result = (HI << i32(32)).zeroExtend(64) + LO.zeroExtend(64) + rn.zeroExtend(64) * rm.zeroExtend(64) # expand registers size
HI = result[32:64]
LO = result[:32]
@sbuild.parse
def maddr(rn, rm):
"""MADDR - Signed 32-bit multiplication, adding results to HI & LO registers & storing LO in Rn"""
# HI||LO <- HI||LO + Rn*Rm; Rn <- LO (Signed)
result = (HI << i32(32)).signExtend(64) + LO.signExtend(64) + rn.signExtend(64) * rm.signExtend(64) # expand registers size
HI = result[32:64]
LO = result[:32]
rn = result[:32]
@sbuild.parse
def maddru(rn, rm):
"""MADDRU - Unsigned 32-bit multiplication, adding results to HI & LO registers & storing LO in Rn"""
# HI||LO <- HI||LO + Rn*Rm; Rn <- LO (Unsigned)
result = (HI << i32(32)).zeroExtend(64) + LO.zeroExtend(64) + rn.zeroExtend(64) * rm.zeroExtend(64) # expand registers size
HI = result[32:64]
LO = result[:32]
rn = result[:32]
### 32-bit divide instruction option
@sbuild.parse
def div(rn, rm):
"""DIV - Signed division"""
# LO <- Rn / Rm, HI <- Rn % Rm (Signed)
# Mask sign bits
sign_mask = i32(0x80000000)
sign_rn = rn & sign_mask
sign_rm = rm & sign_mask
# Check if both numbers are positive or negative
are_both_neg = sign_rn & sign_rm
are_both_pos = ExprCond(
are_both_neg - sign_mask,
ExprInt(0, are_both_neg.size),
ExprInt(1, are_both_neg.size)
)
# Invert both numbers
rn_inv = ~rn + i32(1)
rm_inv = ~rm + i32(1)
# Used to delay the arithmetic computations
tmp_rm = rm if rm else i32(1)
tmp_rm_inv = rm_inv if rm_inv else i32(1)
# Results if only rn, or rm is negative
LO_rn_neg = (~(rn_inv // tmp_rm) + i32(1)) if sign_rn else (~(rn // tmp_rm_inv) + i32(1))
HI_rn_neg = (~(rn_inv % tmp_rm) + i32(1)) if sign_rn else (~(rn % tmp_rm_inv) + i32(1))
# Results if both numbers are positive
LO_pos = rn // tmp_rm if are_both_pos else LO_rn_neg
HI_pos = rn % tmp_rm if are_both_pos else HI_rn_neg
# Results if both numbers are negative
LO_neg = rn_inv // tmp_rm_inv if are_both_neg else LO_pos
HI_neg = rn_inv % tmp_rm_inv if are_both_neg else HI_pos
# Results if rm is equal to zero
LO = LO_neg if rm else LO
HI = HI_neg if rm else HI
exception_flags = i32(0) if rm else i32(EXCEPT_DIV_BY_ZERO)
@sbuild.parse
def divu(rn, rm):
"""DIVU - Unsigned division"""
# LO <- Rn / Rm, HI <- Rn % Rm (Unsigned)
tmp_rm = rm if rm else i32(1) # used to delay the arithmetic computations
LO = rn // tmp_rm if rm else LO
HI = rn % tmp_rm if rm else HI
exception_flags = i32(0) if rm else i32(EXCEPT_DIV_BY_ZERO)
### Debug function option
@sbuild.parse
def dret():
"""DRET - Debug Exception Return"""
# PC <- DEPC; DBG.DM <- 0
PC = DEPC
DBG = DBG & i32(0xFFFFBFFF) # DBG.DM: bit 15
@sbuild.parse
def dbreak():
"""DBREAK - Debug break"""
# The DBG.DBP bit becomes 1
DBG = DBG ^ i32(0b10) # DBG.DBP: bit 2
### Leading zero instruction option
@sbuild.parse
def ldz(rn, rm):
"""LDZ - Count Leading Zeroes
Note: this implementation is readable, yet slow. Each bit are tested
individually, and the results are propagated to other bits.
Here is the commented implementation for 4-bit integers:
rm = 0b0001
# Invert the value
reversed_rm = ~rm
-> reversed_rm = 0b1110
# Test bits individually
b3 = (reversed_rm & i32(2**3)) >> i32(3) if reversed_rm else i32(0)
-> b3 = (0b1110 & 0b1000 >> 3) = 1
b2 = (reversed_rm & i32(2**2)) >> i32(2) if b3 else i32(0)
-> b2 = (0b1110 & 0b0100 >> 2) = 1
b1 = (reversed_rm & i32(2**1)) >> i32(1) if b2 else i32(0)
-> b1 = (0b1110 & 0b0010 >> 1) = 1
b0 = (reversed_rm & i32(2**0)) >> i32(0) if b1 else i32(0)
-> b0 = (0b1110 & 0b0001 >> 0) = 0
# Sum all partial results
rn = b3 + b2 + b1 + b0
-> rn = 1 + 1 + 1 + 0 = 3
"""
# Rn <- LeadingZeroDetect(Rm)
# Invert the value
reversed_rm = ~rm
# Test bits individually
b31 = (reversed_rm & i32(2**31)) >> i32(31) if reversed_rm else i32(0)
b30 = (reversed_rm & i32(2**30)) >> i32(30) if b31 else i32(0)
b29 = (reversed_rm & i32(2**29)) >> i32(29) if b30 else i32(0)
b28 = (reversed_rm & i32(2**28)) >> i32(28) if b29 else i32(0)
b27 = (reversed_rm & i32(2**27)) >> i32(27) if b28 else i32(0)
b26 = (reversed_rm & i32(2**26)) >> i32(26) if b27 else i32(0)
b25 = (reversed_rm & i32(2**25)) >> i32(25) if b26 else i32(0)
b24 = (reversed_rm & i32(2**24)) >> i32(24) if b25 else i32(0)
b23 = (reversed_rm & i32(2**23)) >> i32(23) if b24 else i32(0)
b22 = (reversed_rm & i32(2**22)) >> i32(22) if b23 else i32(0)
b21 = (reversed_rm & i32(2**21)) >> i32(21) if b22 else i32(0)
b20 = (reversed_rm & i32(2**20)) >> i32(20) if b21 else i32(0)
b19 = (reversed_rm & i32(2**19)) >> i32(19) if b20 else i32(0)
b18 = (reversed_rm & i32(2**18)) >> i32(18) if b19 else i32(0)
b17 = (reversed_rm & i32(2**17)) >> i32(17) if b18 else i32(0)
b16 = (reversed_rm & i32(2**16)) >> i32(16) if b17 else i32(0)
b15 = (reversed_rm & i32(2**15)) >> i32(15) if b16 else i32(0)
b14 = (reversed_rm & i32(2**14)) >> i32(14) if b15 else i32(0)
b13 = (reversed_rm & i32(2**13)) >> i32(13) if b14 else i32(0)
b12 = (reversed_rm & i32(2**12)) >> i32(12) if b13 else i32(0)
b11 = (reversed_rm & i32(2**11)) >> i32(11) if b12 else i32(0)
b10 = (reversed_rm & i32(2**10)) >> i32(10) if b11 else i32(0)
b09 = (reversed_rm & i32(2 ** 9)) >> i32(9) if b10 else i32(0)
b08 = (reversed_rm & i32(2 ** 8)) >> i32(8) if b09 else i32(0)
b07 = (reversed_rm & i32(2 ** 7)) >> i32(7) if b08 else i32(0)
b06 = (reversed_rm & i32(2 ** 6)) >> i32(6) if b07 else i32(0)
b05 = (reversed_rm & i32(2 ** 5)) >> i32(5) if b06 else i32(0)
b04 = (reversed_rm & i32(2 ** 4)) >> i32(4) if b05 else i32(0)
b03 = (reversed_rm & i32(2 ** 3)) >> i32(3) if b04 else i32(0)
b02 = (reversed_rm & i32(2 ** 2)) >> i32(2) if b03 else i32(0)
b01 = (reversed_rm & i32(2 ** 1)) >> i32(1) if b02 else i32(0)
b00 = (reversed_rm & i32(2 ** 0)) >> i32(0) if b01 else i32(0)
# Sum all partial results
rn = b31 + b30 + b29 + b28 + b27 + b26 + b25 + b24 + b23 + b22 + b21 + b20 \
+ b19 + b18 + b17 + b16 + b15 + b14 + b13 + b12 + b11 + b10 + b09 + b08 \
+ b07 + b06 + b05 + b04 + b03 + b02 + b01 + b00
### Coprocessor option
# Note: these instructions are implemented when needed
# SWCP - Store Word to memory from a coprocessor register
# MemWord(Rm31..2||00) <- CRn 31..0
manual_functions["swcp"] = sw
# LWCP - Load Word from memory to a coprocessor register
# CRn <- MemWord(Rm31..2||00)
manual_functions["lwcp"] = lw
def smcp(ir, instr, reg_src, deref_dst):
"""SMCP - Store Word to memory from a coprocessor register"""
# MemDword(Rm31..3||000) <- CRn
e = []
e.append(ExprAssign(ExprMem(deref_dst.ptr & i32(0xFFFFFFF8), 32), reg_src))
return e, []
manual_functions["smcp"] = smcp
def lmcp(ir, instr, reg_dst, deref_src):
"""LMCP - Load Word from memory to a coprocessor register"""
# CRn <- MemDword(Rm31..3||000)
e = []
e.append(ExprAssign(reg_dst, ExprMem(deref_src.ptr & i32(0xFFFFFFF8), 32)))
return e, []
manual_functions["lmcp"] = lmcp
def swcpi(ir, instr, reg_src, deref_dst):
"""SWCPI - Store Word to memory, and increment the address"""
# MemWord(Rm31..2||00) <- CRn 31..0; Rm<-Rm+4
e = []
e.append(ExprAssign(ExprMem(deref_dst.ptr & i32(0xFFFFFFFC), 32), reg_src))
e.append(ExprAssign(deref_dst.ptr, deref_dst.ptr + i32(4)))
return e, []
manual_functions["swcpi"] = swcpi
def lwcpi(ir, instr, reg_dst, deref_src):
"""LWCPI - Load Word from memory, and increment the address"""
# CRn <- MemWord(Rm31..2||00); Rm<-Rm+4
e = []
e.append(ExprAssign(reg_dst, ExprMem(deref_src.ptr & i32(0xFFFFFFFC), 32)))
e.append(ExprAssign(deref_src.ptr, deref_src.ptr + i32(4)))
return e, []
manual_functions["lwcpi"] = lwcpi
def smcpi(ir, instr, reg_src, deref_dst):
"""SMCPI - Store Word to memory, and increment the address"""
# MemDword(Rm31..3||000) <- CRn; Rm<-Rm+8
e = []
e.append(ExprAssign(ExprMem(deref_dst.ptr & i32(0xFFFFFFF8), 32), reg_src))
e.append(ExprAssign(deref_dst.ptr, deref_dst.ptr + i32(8)))
return e, []
manual_functions["smcpi"] = smcpi
def lmcpi(ir, instr, reg_dst, deref_src):
"""LMCPI - Load Word from memory, and increment the address"""
# CRn <- MemDword(Rm31..3||000); Rm<-Rm+8
e = []
e.append(ExprAssign(reg_dst, ExprMem(deref_src.ptr & i32(0xFFFFFFFC), 32)))
e.append(ExprAssign(deref_src.ptr, deref_src.ptr + i32(8)))
return e, []
manual_functions["lmcpi"] = lmcpi
### IR MeP definitions
def get_mnemo_expr(ir, instr, *args):
"""Simplify getting the IR from a miasm instruction."""
if instr.name.lower() in sbuild.functions:
mnemo_func = sbuild.functions[instr.name.lower()]
else:
mnemo_func = manual_functions[instr.name.lower()]
ir, extra_ir = mnemo_func(ir, instr, *args)
return ir, extra_ir
class Lifter_MEPb(Lifter):
"""Toshiba MeP miasm IR - Big Endian
It transforms an instructon into an IR.
"""
addrsize = 32
def __init__(self, loc_db):
Lifter.__init__(self, mn_mep, "b", loc_db)
self.pc = mn_mep.getpc()
self.sp = mn_mep.getsp()
self.IRDst = ExprId("IRDst", 32)
def get_ir(self, instr):
"""Get the IR from a miasm instruction."""
instr_ir, extra_ir = get_mnemo_expr(self, instr, *instr.args)
return instr_ir, extra_ir
def get_next_break_loc_key(self, instr):
"""Returns a new label that identifies where the instruction is going.
Note: it eases linking IR blocks
"""
l = self.loc_db.get_or_create_offset_location(instr.offset + instr.l)
return l
class Lifter_MEPl(Lifter_MEPb):
"""Toshiba MeP miasm IR - Little Endian"""
def __init__(self, loc_db):
Lifter.__init__(self, mn_mep, "l", loc_db)
self.pc = mn_mep.getpc()
self.sp = mn_mep.getsp()
self.IRDst = ExprId("IRDst", 32)