A way to call arbitrary function using uctypes?

[Plaque-fcc]

My friend is trying MicroPython the hard way and wants me to convey his message (question, or a request for comments):

Hello!
I'm using MicroPython on RISCV RV32I (/micropython/ports/qemu/)
I was looking for a way to call arbitrary function using uctypes, but unfortunately found nothing
So I decided to write my own code to do so

class ModuleFromString(object):
    def __init__(self, code):
        self.__dict2__ = {}
        exec(code, self.__dict2__)

    def __getattr__(self, key):
        return self.__dict2__[key]

class ASM(ModuleFromString): pass

ASM = ASM(
"""
import uctypes
import struct
import machine

RA =  1
SP =  2
T0 =  5
A0 = 10
A1 = 11

code = []

def check_range(vmin, v, vmax):
    assert v >= vmin
    assert v <= vmax

def lui(r, v):
    check_range(0, r, 31)
    check_range(0, v, 0xFFFFF)
    code.append(55 | (r << 7) | (v << 12))

def addi(rd, rs, v):
    check_range(0, rd, 31)
    check_range(0, rs, 31)
    check_range(-0x800, v, 0x7FF)
    if v < 0: v += 0x1000
    code.append(19 | (rd << 7) | (rs << 15) | (v << 20))

def li(r, v):
    check_range(0, r, 31)
    check_range(0, v, 0xFFFFFFFF)

    if v <= 0x7FF:
        addi(r, 0, v)
        return

    a = v >> 12
    b = v & 0xFFF

    if b == 0:
        lui(r, a)
        return

    if b & 0x800:
        a = (a + 1) & 0xFFFFF
        b -= 0x1000

    lui(r, a)
    addi(r, r, b)

def lw(rd, rs, v = 0):
    check_range(0, rd, 31)
    check_range(0, rs, 31)
    check_range(-0x800, v, 0x7FF)
    if v < 0: v += 0x1000
    code.append(3 | (rd << 7) | (2 << 12) | (rs << 15) | (v << 20))

def sw(rd, rs, v = 0):
    check_range(0, rd, 31)
    check_range(0, rs, 31)
    check_range(-0x800, v, 0x7FF)
    if v < 0: v += 0x1000
    code.append(35 | ((v & 0x1F) << 7) | (2 << 12) | (rs << 15) | (rd << 20) | ((v & 0xFE0) << 20))

def jalr(rd, rs, v = 0):
    check_range(0, rd, 31)
    check_range(0, rs, 31)
    check_range(-0x800, v, 0x7FF)
    if v < 0: v += 0x1000
    code.append(103 | (rd << 7) | (rs << 15) | (v << 20))

def addressof(x):
    return uctypes.addressof(x) & 0xFFFFFFFF

def call_func(addr, ret, *args):
    check_range(0, addr, 0xFFFFFFFF)
    check_range(0, ret, 2)
    check_range(0, len(args), 8)

    del code[:]

    for i, v in enumerate(args):
        li(A0 + i, v)

    if ret:
        retbuf = bytearray(8)

        addi(SP, SP, -16)
        sw(RA, SP, 12)
        li(RA, addr)
        jalr(RA, RA)

        li(RA, addressof(retbuf))
        sw(A0, RA)

        if ret == 2:
            sw(A1, RA, 4)

        lw(RA, SP, 12)
        addi(SP, SP, 16)
        jalr(0, RA)

    else:
        li(T0, addr)
        jalr(0, T0)

    c = struct.pack('<%uI' % (len(code),), *code)
    del code[:]

    m = machine.mem32
    f = machine.idle
    a = id(f) + 4

    orig = m[a]
    m[a] = addressof(c)
    f()
    m[a] = orig

    if ret == 2:
        return struct.unpack('<Q',  retbuf)[0]

    if ret == 1:
        return struct.unpack('<2I', retbuf)[0]
""")

def main():
    # Extracted from "riscv32-unknown-elf-readelf --syms micropython.elf"
    puts   = 0x80026c58
    strlen = 0x8002730c
    memcpy = 0x80027208

    txt  = b'Hello, world'
    txtA = ASM.addressof(txt)

    ASM.call_func(puts, 0, txtA)

    L = len(txt)
    L2 = ASM.call_func(strlen, 1, txtA)
    print(L == L2)

    tmp  = bytearray(L)
    tmpA = ASM.addressof(tmp)
    ASM.call_func(memcpy, 0, tmpA, txtA, L)
    print(txt == tmp)

main()

[agatti]

You may want to take a look at #15714, which lets you write your own inline assembler stubs and use those to call functions at arbitrary addresses. You'd still have to perform the argument marshalling/unmarshalling, but it's still better than nothing.