// File: /workspace/github_c_makefile_star2_O2/vusec[P]fpvi-scsb/fp_reverse_engineering/test_operands/test_operands.c
// Function: main
int main(int argc, char **argv)
{
    uint64_t x_hex, y_hex;
    
    //Ensure SSE default settings
    #ifdef x86
    _MM_SET_DENORMALS_ZERO_MODE(_MM_DENORMALS_ZERO_OFF);
    _MM_SET_FLUSH_ZERO_MODE(_MM_FLUSH_ZERO_OFF);
    #endif

    if (argc < 3)
    {
        fprintf(stderr, "Usage: %s <x> <y>\nEg: %s 0xc000e8b2c9755600 0x0004000000000000\n", argv[0], argv[0]);
        return -1;
    }
    sscanf(argv[1], "0x%lx", &x_hex);
    sscanf(argv[2], "0x%lx", &y_hex);

    /* Flush+Reload setup */
    __attribute__((aligned(4096))) size_t results[256] = {0};
    unsigned char *reloadbuffer = mmap(NULL, 256*STRIDE, PROT_READ | PROT_WRITE,
    #if defined(x86)
                                       MAP_ANONYMOUS | MAP_PRIVATE | MAP_POPULATE | MAP_HUGETLB, -1, 0);
    #elif defined(armv8)
                                       MAP_ANONYMOUS | MAP_PRIVATE | MAP_POPULATE, -1, 0);
    #else
    #error  "not supported arch"
    #endif
    
    /* Debug prints of input operands and arch result */
    double   x = *((double *)&x_hex);
    double   y = *((double *)&y_hex);
    //Get the FP architectural result of x/y
    uint64_t arch_res_hex = fp_leak_trans_res(reloadbuffer, &x_hex, &y_hex, 0);
    double   arch_res = *((double *) &arch_res_hex);

    print_double("x", x);
    print_double("y", y);
    print_double("arch_res", arch_res);

    /* Recover trans_res nibble by nibble
     * Leaking nibbles instead of bytes due to less noise
     */
    uint64_t trans_res_hex = 0;
    for(int i=0; i<16; i++)
    {
        memset(results, 0, sizeof(results));

        for(int j=0; j<ITER; j++)
        {
            flush(reloadbuffer);
            fp_leak_trans_res(reloadbuffer, &x_hex, &y_hex, i*4);
            reload(reloadbuffer, results);
        }

#if DEBUG == 1
        printf("Nibble %d:\n", i);
        print_results(results, ITER/10);
#endif
        //Reconstruct the speculative value
        uint8_t arch_nibble = (arch_res_hex>>i*4)&0xf;
        uint8_t spec_nibble = arch_nibble;

        //Arch result hit must be always be present, otherwise it means F+R is broken
        assert(results[arch_nibble] > ITER/10);
        for(int j=0; j<16; j++)
        {
            if(results[j] > ITER/10 && j != arch_nibble)
            {
                spec_nibble = j;    
            }
        }
        trans_res_hex |= ((uint64_t) spec_nibble) << (i*4);
    }
    
    double trans_res = *((double *)&trans_res_hex);
    print_double("trans_res", trans_res);

    return 0;
}

// Assembly:
pushq %rbp
movq %rsp, %rbp
pushq %r15
pushq %r14
pushq %r13
pushq %r12
pushq %rbx
andq $-0x1000, %rsp          # imm = 0xF000
subq $0x2000, %rsp           # imm = 0x2000
stmxcsr 0xfdc(%rsp)
movl 0xfdc(%rsp), %eax
andl $-0x41, %eax
movl %eax, 0xfd8(%rsp)
ldmxcsr 0xfd8(%rsp)
stmxcsr 0xfd4(%rsp)
movl $0xffff7fff, %eax       # imm = 0xFFFF7FFF
andl 0xfd4(%rsp), %eax
movl %eax, 0xfd0(%rsp)
ldmxcsr 0xfd0(%rsp)
movq %rsi, %r14
cmpl $0x2, %edi
jle 0x1523
movq 0x8(%r14), %rdi
leaq 0xdd5(%rip), %r15       # 0x20c8
xorl %r13d, %r13d
leaq 0xff0(%rsp), %rbx
movq %r15, %rsi
movq %rbx, %rdx
xorl %eax, %eax
callq 0x1080
movq 0x10(%r14), %rdi
leaq 0xff8(%rsp), %r12
movq %r15, %rsi
movq %r12, %rdx
xorl %eax, %eax
callq 0x1080
pushq $0x3
popq %rdx
pushq $-0x1
popq %r8
movl $0x80000, %esi          # imm = 0x80000
xorl %edi, %edi
movl $0x48022, %ecx          # imm = 0x48022
xorl %r9d, %r9d
callq 0x1030
movq %rax, %r15
movsd (%rbx), %xmm0
movsd %xmm0, 0xfe0(%rsp)
movsd (%r12), %xmm0
movsd %xmm0, 0xfc8(%rsp)
movq %rax, %rdi
movq %rbx, %rsi
movq %r12, %r14
movq %r12, %rdx
xorl %ecx, %ecx
callq 0x1564
movq %rax, 0xfe8(%rsp)
movq %rax, 0xfc0(%rsp)
leaq 0xd44(%rip), %rdi       # 0x20cc
movsd 0xfe0(%rsp), %xmm0
callq 0x1208
leaq 0xd31(%rip), %rdi       # 0x20ce
movsd 0xfc8(%rsp), %xmm0
callq 0x1208
leaq 0xd1e(%rip), %rdi       # 0x20d0
movsd 0xfc0(%rsp), %xmm0
callq 0x1208
pushq $0xd
popq %r12
xorl %eax, %eax
cmpq $0x10, %r13
je 0x1501
movq %rax, 0xfc0(%rsp)
xorl %ebx, %ebx
movl $0x800, %edx            # imm = 0x800
leaq 0x1000(%rsp), %rdi
xorl %esi, %esi
callq 0x1060
movq %r13, 0xfc8(%rsp)
leaq (,%r13,4), %r13
cmpl $0x3e8, %ebx            # imm = 0x3E8
je 0x1495
xorl %eax, %eax
cmpq $0x80000, %rax          # imm = 0x80000
je 0x1423
leaq (%r15,%rax), %rcx
clflush (%rcx)
addq $0x800, %rax            # imm = 0x800
jmp 0x140c
mfence
movq %r15, %rdi
leaq 0xff0(%rsp), %rsi
movq %r14, %rdx
movq %r13, %rcx
callq 0x1564
mfence
movq %r12, %rdi
cmpq $0xa70d, %rdi           # imm = 0xA70D
je 0x148e
movzbl %dil, %r8d
movl %r8d, %r9d
shll $0xb, %r9d
rdtscp
movq %rdx, %rsi
shlq $0x20, %rsi
orq %rax, %rsi
movb (%r15,%r9), %al
rdtscp
shlq $0x20, %rdx
orq %rax, %rdx
subq %rsi, %rdx
cmpq $0x9f, %rdx
ja 0x1485
incq 0x1000(%rsp,%r8,8)
addq $0xa7, %rdi
jmp 0x1442
incl %ebx
jmp 0x13fe
movq 0xfe8(%rsp), %rdx
movl %r13d, %ecx
shrq %cl, %rdx
movl %edx, %eax
andl $0xf, %eax
movl %eax, %ecx
cmpq $0x65, 0x1000(%rsp,%rcx,8)
jb 0x1546
andb $0xf, %dl
xorl %ecx, %ecx
movzbl %dl, %esi
cmpq $0x10, %rcx
je 0x14e0
cmpq %rcx, %rax
movl %ecx, %edx
cmovel %esi, %edx
cmpq $0x65, 0x1000(%rsp,%rcx,8)
cmovbl %esi, %edx
incq %rcx
jmp 0x14be
movl %r13d, %ecx
shlq %cl, %rsi
movq 0xfc0(%rsp), %rax
orq %rsi, %rax
movq 0xfc8(%rsp), %r13
incq %r13
jmp 0x13c6
movq %rax, %xmm0
leaq 0xc12(%rip), %rdi       # 0x211f
callq 0x1208
xorl %eax, %eax
leaq -0x28(%rbp), %rsp
popq %rbx
popq %r12
popq %r13
popq %r14
popq %r15
popq %rbp
retq
movq 0x2ace(%rip), %rax      # 0x3ff8
movq (%rax), %rdi
movq (%r14), %rcx
leaq 0xb51(%rip), %rsi       # 0x2088
movq %rcx, %rdx
xorl %eax, %eax
callq 0x1070
pushq $-0x1
popq %rax
jmp 0x1514
leaq 0xb8c(%rip), %rdi       # 0x20d9
leaq 0xba4(%rip), %rsi       # 0x20f8
leaq 0xbad(%rip), %rcx       # 0x2108
pushq $0x66
popq %rdx
callq 0x1050
nop