AArch64 CCMP keeps the old N flag when the condition holds #1563

"""AArch64 CCMP with its condition TRUE: NZCV must be AddWithCarry(op1, NOT(op2), 1) flags (Arm ARM CCMP Operation).
Runs each instruction in miasm's SymbolicExecutionEngine and the python jitter; expected flags are computed from the
AddWithCarry pseudocode. Then runs `cmp x0,#0; ccmp x1,x2,#0,eq; cset w0,lt` (clang -O2 for `a == 0 && b < c`)."""
import sys
from miasm.analysis.machine import Machine
from miasm.core.locationdb import LocationDB
from miasm.expression.expression import ExprInt, ExprId
from miasm.ir.symbexec import SymbolicExecutionEngine
from miasm.jitter.csts import PAGE_READ, PAGE_WRITE, PAGE_EXEC
import miasm.arch.aarch64.regs as R

m = Machine("aarch64l")
FLAGS = (R.nf, R.zf, R.cf, R.of)

def add_with_carry(x, y, carry, n):  # Arm shared pseudocode AddWithCarry, flags only
    mask = (1 << n) - 1
    sint = lambda v: v - (1 << n) if v >> (n - 1) else v
    usum = x + y + carry; ssum = sint(x) + sint(y) + carry; res = usum & mask
    return "%d%d%d%d" % (res >> (n - 1), res == 0, res != usum, sint(res) != ssum)

def symb(code, regs, nzcv):
    ldb = LocationDB(); lifter = m.lifter(ldb)
    st = {R.gpregs64_expr[i]: ExprInt(regs.get(i, 0), 64) for i in range(31)}
    st.update({f: ExprInt(int(b), 1) for f, b in zip(FLAGS, nzcv)})
    se = SymbolicExecutionEngine(lifter, st)
    for i in range(0, len(code), 4):
        ins = m.mn.dis(code[i:i + 4], "l"); ins.offset = 0x1000 + i
        ircfg = lifter.new_ircfg(); lifter.add_instr_to_ircfg(ins, ircfg)
        se.run_block_at(ircfg, ldb.get_offset_location(ins.offset))
    return se

def jit_python(code, regs, nzcv):
    j = m.jitter(LocationDB(), "python")
    j.vm.add_memory_page(0x1000, PAGE_READ | PAGE_WRITE | PAGE_EXEC, code + bytes.fromhex("000020d4"))
    j.cpu.X1, j.cpu.X2 = regs[1], regs[2]
    j.cpu.nf, j.cpu.zf, j.cpu.cf, j.cpu.of = (int(b) for b in nzcv)
    j.add_breakpoint(0x1000 + len(code), lambda jit: False); j.run(0x1000)
    return "%d%d%d%d" % (j.cpu.nf, j.cpu.zf, j.cpu.cf, j.cpu.of)

# word, x1, x2 (or imm5), NZCV before, datasize; every condition below holds
CASES = [("200042fa", 0x0, 0x1, "0100", 64),
         ("2000427a", 0x7fffffff, 0x80000000, "0100", 32),
         ("28e042fa", 0x2, 0x1, "1000", 64),
         ("200845fa", 0x3, 0x5, "0100", 64),
         ("20a0427a", 0x1, 0x2, "0100", 32)]
bad = 0
for hx, x1, x2, nzcv, n in CASES:
    code = bytes.fromhex(hx); ins = m.mn.dis(code, "l")
    want = add_with_carry(x1, ~x2 & ((1 << n) - 1), 1, n)
    se = symb(code, {1: x1, 2: x2}, nzcv)
    got_s = "".join(str(int(se.eval_expr(f))) for f in FLAGS)
    got_p = jit_python(code, {1: x1, 2: x2}, nzcv)
    ok = got_s == want and got_p == want; bad |= not ok
    print("%-26s x1=%#x op2=%#x NZCV before=%s: spec %s  symb %s  python-jit %s  %s"
          % (ins, x1, x2, nzcv, want, got_s, got_p, "OK" if ok else "WRONG"))

code = bytes.fromhex("1f0000f1" "200042fa" "e0a79f1a")  # cmp x0,#0; ccmp x1,x2,#0,eq; cset w0,lt
w0 = int(symb(code, {0: 0, 1: 1, 2: 2}, "0000").eval_expr(R.gpregs64_expr[0]))
ok = w0 == 1; bad |= not ok
print("cmp/ccmp/cset lt, a=0 b=1 c=2: spec w0=1  symb w0=%d  %s" % (w0, "OK" if ok else "WRONG"))
lifter = m.lifter(LocationDB())
st = {R.gpregs64_expr[0]: ExprInt(0, 64), R.gpregs64_expr[1]: ExprId("b", 64), R.gpregs64_expr[2]: ExprId("c", 64)}
st.update({f: ExprInt(0, 1) for f in FLAGS})
ldb = LocationDB(); lifter = m.lifter(ldb); se = SymbolicExecutionEngine(lifter, st)
for i in range(3):
    ins = m.mn.dis(code[4 * i:4 * i + 4], "l"); ins.offset = 0x1000 + 4 * i
    ircfg = lifter.new_ircfg(); lifter.add_instr_to_ircfg(ins, ircfg)
    se.run_block_at(ircfg, ldb.get_offset_location(ins.offset))
print("  symbolic b, c (a=0): w0 =", se.eval_expr(R.gpregs64_expr[0]))
print("RESULT: %s" % ("CCMP N flag differs from the Arm ARM (exit 1)" if bad else "conforms (exit 0)"))
sys.exit(1 if bad else 0)