forked from FEX-Emu/FEX
-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
unittests/ASM: Implements a unit test for FEX-Emu#3478
This unit test recreates the error condition that FEX-Emu#3478 causes. With a string operation that is a backwards copy then the optimization will read past the end of the page and result in a crash. Seemingly only happens with backwards string operations, but test forward and backward in this test.
- Loading branch information
1 parent
e33a76a
commit 0d33dac
Showing
1 changed file
with
65 additions
and
0 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,65 @@ | ||
%ifdef CONFIG | ||
{ | ||
"MemoryRegions": { | ||
"0xf0000000": "4096", | ||
"0xf1000000": "4096" | ||
} | ||
} | ||
%endif | ||
|
||
; FEX-Emu had a bug where a backwards repeating string operation would read past the end of a mapped page. | ||
; This was encountered in https://github.com/FEX-Emu/FEX/pull/3478. | ||
; To ensure we don't read past a page with `rep stos` and `rep movs`, map two disparate pages and copy the entire page. | ||
; If FEX tries reading past the ends of either then it will fault. | ||
%macro do_rep_op 2 | ||
jmp %%1 | ||
%%1: | ||
|
||
cld | ||
mov rax, r13 | ||
mov rdi, r14 | ||
mov rsi, r15 | ||
mov rcx, (4096 / %2) | ||
rep %1 | ||
%endmacro | ||
|
||
%macro do_backward_rep_op 2 | ||
jmp %%1 | ||
%%1: | ||
|
||
std | ||
mov rax, r13 | ||
mov rdi, r14 | ||
mov rsi, r15 | ||
add rdi, (4096 - %2) | ||
add rsi, (4096 - %2) | ||
mov rcx, (4096 / %2) | ||
rep %1 | ||
%endmacro | ||
|
||
mov r15, 0xf000_0000 | ||
mov r14, 0xf100_0000 | ||
mov r13, 0x41424344454647 | ||
|
||
do_rep_op stosb, 1 | ||
do_rep_op stosw, 2 | ||
do_rep_op stosd, 4 | ||
do_rep_op stosq, 8 | ||
|
||
do_backward_rep_op stosb, 1 | ||
do_backward_rep_op stosw, 2 | ||
do_backward_rep_op stosd, 4 | ||
do_backward_rep_op stosq, 8 | ||
|
||
do_rep_op movsb, 1 | ||
do_rep_op movsw, 2 | ||
do_rep_op movsd, 4 | ||
do_rep_op movsq, 8 | ||
|
||
do_backward_rep_op movsb, 1 | ||
do_backward_rep_op movsw, 2 | ||
do_backward_rep_op movsd, 4 | ||
do_backward_rep_op movsq, 8 | ||
|
||
hlt | ||
|