// File: /workspace/github_c_makefile_star2_O3/vusec[P]fpvi-scsb/fp_reverse_engineering/test_operands/test_operands.c
// Function: main
int main(int argc, char **argv)
{
    uint64_t x_hex, y_hex;
    
    //Ensure SSE default settings
    #ifdef x86
    _MM_SET_DENORMALS_ZERO_MODE(_MM_DENORMALS_ZERO_OFF);
    _MM_SET_FLUSH_ZERO_MODE(_MM_FLUSH_ZERO_OFF);
    #endif

    if (argc < 3)
    {
        fprintf(stderr, "Usage: %s <x> <y>\nEg: %s 0xc000e8b2c9755600 0x0004000000000000\n", argv[0], argv[0]);
        return -1;
    }
    sscanf(argv[1], "0x%lx", &x_hex);
    sscanf(argv[2], "0x%lx", &y_hex);

    /* Flush+Reload setup */
    __attribute__((aligned(4096))) size_t results[256] = {0};
    unsigned char *reloadbuffer = mmap(NULL, 256*STRIDE, PROT_READ | PROT_WRITE,
    #if defined(x86)
                                       MAP_ANONYMOUS | MAP_PRIVATE | MAP_POPULATE | MAP_HUGETLB, -1, 0);
    #elif defined(armv8)
                                       MAP_ANONYMOUS | MAP_PRIVATE | MAP_POPULATE, -1, 0);
    #else
    #error  "not supported arch"
    #endif
    
    /* Debug prints of input operands and arch result */
    double   x = *((double *)&x_hex);
    double   y = *((double *)&y_hex);
    //Get the FP architectural result of x/y
    uint64_t arch_res_hex = fp_leak_trans_res(reloadbuffer, &x_hex, &y_hex, 0);
    double   arch_res = *((double *) &arch_res_hex);

    print_double("x", x);
    print_double("y", y);
    print_double("arch_res", arch_res);

    /* Recover trans_res nibble by nibble
     * Leaking nibbles instead of bytes due to less noise
     */
    uint64_t trans_res_hex = 0;
    for(int i=0; i<16; i++)
    {
        memset(results, 0, sizeof(results));

        for(int j=0; j<ITER; j++)
        {
            flush(reloadbuffer);
            fp_leak_trans_res(reloadbuffer, &x_hex, &y_hex, i*4);
            reload(reloadbuffer, results);
        }

#if DEBUG == 1
        printf("Nibble %d:\n", i);
        print_results(results, ITER/10);
#endif
        //Reconstruct the speculative value
        uint8_t arch_nibble = (arch_res_hex>>i*4)&0xf;
        uint8_t spec_nibble = arch_nibble;

        //Arch result hit must be always be present, otherwise it means F+R is broken
        assert(results[arch_nibble] > ITER/10);
        for(int j=0; j<16; j++)
        {
            if(results[j] > ITER/10 && j != arch_nibble)
            {
                spec_nibble = j;    
            }
        }
        trans_res_hex |= ((uint64_t) spec_nibble) << (i*4);
    }
    
    double trans_res = *((double *)&trans_res_hex);
    print_double("trans_res", trans_res);

    return 0;
}

// Assembly:
pushq %rbp
movq %rsp, %rbp
pushq %r15
pushq %r14
pushq %r13
pushq %r12
pushq %rbx
andq $-0x1000, %rsp          # imm = 0xF000
subq $0x2000, %rsp           # imm = 0x2000
stmxcsr 0xfdc(%rsp)
movl 0xfdc(%rsp), %eax
andl $-0x41, %eax
movl %eax, 0xfd8(%rsp)
ldmxcsr 0xfd8(%rsp)
stmxcsr 0xfd4(%rsp)
movl $0xffff7fff, %eax       # imm = 0xFFFF7FFF
andl 0xfd4(%rsp), %eax
movl %eax, 0xfd0(%rsp)
ldmxcsr 0xfd0(%rsp)
movq %rsi, %r14
cmpl $0x2, %edi
jle 0x153f
movq 0x8(%r14), %rdi
leaq 0xdae(%rip), %r15       # 0x20c8
xorl %r12d, %r12d
leaq 0xff8(%rsp), %rbx
movq %r15, %rsi
movq %rbx, %rdx
xorl %eax, %eax
callq 0x1080
movq 0x10(%r14), %rdi
leaq 0xff0(%rsp), %r14
movq %r15, %rsi
movq %r14, %rdx
xorl %eax, %eax
callq 0x1080
movl $0x80000, %esi          # imm = 0x80000
xorl %edi, %edi
movl $0x3, %edx
movl $0x48022, %ecx          # imm = 0x48022
movl $0xffffffff, %r8d       # imm = 0xFFFFFFFF
xorl %r9d, %r9d
callq 0x1030
movq %rax, %r15
movsd (%rbx), %xmm0
movsd %xmm0, 0xfe0(%rsp)
movsd (%r14), %xmm0
movsd %xmm0, 0xfc8(%rsp)
movq %rax, %rdi
movq %rbx, %rsi
movq %r14, %rdx
xorl %ecx, %ecx
callq 0x1570
movq %rax, 0xfe8(%rsp)
movq %rax, 0xfc0(%rsp)
leaq 0xd1d(%rip), %rdi       # 0x20cc
movsd 0xfe0(%rsp), %xmm0
callq 0x122f
leaq 0xd0a(%rip), %rdi       # 0x20ce
movsd 0xfc8(%rsp), %xmm0
callq 0x122f
leaq 0xcf7(%rip), %rdi       # 0x20d0
movsd 0xfc0(%rsp), %xmm0
callq 0x122f
xorl %eax, %eax
movq %rax, 0xfc0(%rsp)
movl $0x800, %edx            # imm = 0x800
leaq 0x1000(%rsp), %rdi
xorl %esi, %esi
callq 0x1060
movq %r12, 0xfc8(%rsp)
leaq (,%r12,4), %r13
xorl %r12d, %r12d
xorl %eax, %eax
leaq (%r15,%rax), %rcx
clflush (%rcx)
addq $0x800, %rax            # imm = 0x800
cmpq $0x80000, %rax          # imm = 0x80000
jne 0x141a
mfence
movq %r15, %rdi
movq %rbx, %rsi
movq %r14, %rdx
movq %r13, %rcx
callq 0x1570
mfence
movl $0xd, %edi
movzbl %dil, %r8d
movl %r8d, %r9d
shll $0xb, %r9d
rdtscp
movq %rdx, %rsi
shlq $0x20, %rsi
orq %rax, %rsi
movb (%r15,%r9), %al
rdtscp
shlq $0x20, %rdx
orq %rax, %rdx
subq %rsi, %rdx
cmpq $0x9f, %rdx
ja 0x1485
incq 0x1000(%rsp,%r8,8)
addq $0xa7, %rdi
cmpq $0xa70d, %rdi           # imm = 0xA70D
jne 0x144b
incl %r12d
cmpl $0x3e8, %r12d           # imm = 0x3E8
jne 0x1418
movq 0xfe8(%rsp), %rax
movl %r13d, %ecx
shrq %cl, %rax
movl %eax, %ecx
andl $0xf, %ecx
cmpq $0x65, 0x1000(%rsp,%rcx,8)
jb 0x154e
movl %eax, %ecx
andb $0xf, %cl
andl $0xf, %eax
xorl %edx, %edx
movq 0xfc8(%rsp), %r12
cmpq %rdx, %rax
movzbl %cl, %esi
movl %edx, %ecx
cmovel %esi, %ecx
cmpq $0x65, 0x1000(%rsp,%rdx,8)
cmovbl %esi, %ecx
incq %rdx
cmpq $0x10, %rdx
jne 0x14d9
movzbl %cl, %eax
movl %r13d, %ecx
shlq %cl, %rax
movq 0xfc0(%rsp), %rcx
orq %rax, %rcx
movq %rcx, %rax
incq %r12
cmpq $0x10, %r12
jne 0x13e9
movq %rax, %xmm0
leaq 0xbf6(%rip), %rdi       # 0x211f
callq 0x122f
xorl %eax, %eax
leaq -0x28(%rbp), %rsp
popq %rbx
popq %r12
popq %r13
popq %r14
popq %r15
popq %rbp
retq
movq %r14, %rdi
callq 0x10b0
movl $0xffffffff, %eax       # imm = 0xFFFFFFFF
jmp 0x1530
leaq 0xb84(%rip), %rdi       # 0x20d9
leaq 0xb9c(%rip), %rsi       # 0x20f8
leaq 0xba5(%rip), %rcx       # 0x2108
movl $0x66, %edx
callq 0x1050
nopl (%rax)