unittests: Adds 32-bit tests for signed displacement wraparound

A bit meta since it needs to JIT some minor code but easy enough.
Ensures something like #1517 won't happen again.
This commit is contained in:
Ryan Houdek 2022-01-14 01:47:20 -08:00
parent 8b8cda9b80
commit e817f5d98c
6 changed files with 277 additions and 0 deletions

View File

@ -0,0 +1,44 @@
%ifdef CONFIG
{
"RegData": {
"RAX": "0x41424344"
},
"Mode": "32BIT"
}
%endif
; Tests for 32-bit signed displacement wrapping
; Testing for underflow specifically
; Will crash or hit the code we emit to memory
; We map ten pages to 0xe000'0000
; Generate a mov eax + hlt over there first
; 0xb8'44'43'42'41: mov eax, 0x41424344
; 0xf4: hlt
mov ebx, 0xe0000000
mov al, 0xb8
mov byte [ebx], al
mov eax, 0x41424344
mov dword [ebx + 1], eax
mov al, 0xf4
mov byte [ebx + 5], al
; Do a jump dance to stop multiblock from trying to optimize
; Otherwise it will JIT code from 0xe000'0000 before written
lea ebx, [rel next]
jmp ebx
next:
; Move temp to eax to overwrite
mov eax, 0
; Setup esp
mov esp, 0xe0001000
; This is dependent on where it is in the code!
call -0x20000000
; Definitely wrong if we hit here
mov eax, -1
hlt

View File

@ -0,0 +1,50 @@
%ifdef CONFIG
{
"RegData": {
"RAX": "0x41424344"
},
"Mode": "32BIT"
}
%endif
; Tests for 32-bit signed displacement wrapping
; Testing for overflow specifically
; Will crash or hit the code we emit to memory
; We map ten pages to 0xe000'0000
; Generate a call 0x11000 over there
; 0xe8'fb'0f'01'20 : call 0x11000
; 0xf4: hlt - Just in case
mov ebx, 0xe0000000
mov al, 0xe8
mov byte [ebx], al
mov eax, 0x20010ffb
mov dword [ebx + 1], eax
mov al, 0xf4
mov byte [ebx + 5], al
; Do a jump dance to stop multiblock from trying to optimize
; Otherwise it will JIT code from 0xe000'0000 before written
lea ebx, [rel next]
jmp ebx
next:
; Move temp to eax to overwrite
mov eax, 0
; Setup esp
mov esp, 0xe0001000
; This is dependent on where it is in the code!
call -0x20000000
; Definitely wrong if we hit here
mov eax, -1
hlt
; This is where the JIT code will land
align 0x1000
mov eax, 0x41424344
hlt

View File

@ -0,0 +1,41 @@
%ifdef CONFIG
{
"RegData": {
"RAX": "0x41424344"
},
"Mode": "32BIT"
}
%endif
; Tests for 32-bit signed displacement wrapping
; Testing for underflow specifically
; Will crash or hit the code we emit to memory
; We map ten pages to 0xe000'0000
; Generate a mov eax + hlt over there first
; 0xb8'44'43'42'41: mov eax, 0x41424344
; 0xf4: hlt
mov ebx, 0xe0000000
mov al, 0xb8
mov byte [ebx], al
mov eax, 0x41424344
mov dword [ebx + 1], eax
mov al, 0xf4
mov byte [ebx + 5], al
; Do a jump dance to stop multiblock from trying to optimize
; Otherwise it will JIT code from 0xe000'0000 before written
lea ebx, [rel next]
jmp ebx
next:
; Move temp to eax to overwrite
mov eax, 0
; This is dependent on where it is in the code!
jmp -0x20000000
; Definitely wrong if we hit here
mov eax, -1
hlt

View File

@ -0,0 +1,48 @@
%ifdef CONFIG
{
"RegData": {
"RAX": "0x41424344"
},
"Mode": "32BIT"
}
%endif
; Tests for 32-bit signed displacement wrapping
; Testing for overflow specifically
; Will crash or hit the code we emit to memory
; We map ten pages to 0xe000'0000
; Generate a jmp 0x11000 over there
; 0xe9'fb'0f'01'20 : jmp 0x11000
; 0xf4: hlt - Just in case
mov ebx, 0xe0000000
mov al, 0xe9
mov byte [ebx], al
mov eax, 0x20010ffb
mov dword [ebx + 1], eax
mov al, 0xf4
mov byte [ebx + 5], al
; Do a jump dance to stop multiblock from trying to optimize
; Otherwise it will JIT code from 0xe000'0000 before written
lea ebx, [rel next]
jmp ebx
next:
; Move temp to eax to overwrite
mov eax, 0
; This is dependent on where it is in the code!
jmp -0x20000000
; Definitely wrong if we hit here
mov eax, -1
hlt
; This is where the JIT code will land
align 0x1000
mov eax, 0x41424344
hlt

View File

@ -0,0 +1,44 @@
%ifdef CONFIG
{
"RegData": {
"RAX": "0x41424344"
},
"Mode": "32BIT"
}
%endif
; Tests for 32-bit signed displacement wrapping
; Testing for underflow specifically
; Will crash or hit the code we emit to memory
; We map ten pages to 0xe000'0000
; Generate a mov eax + hlt over there first
; 0xb8'44'43'42'41: mov eax, 0x41424344
; 0xf4: hlt
mov ebx, 0xe0000000
mov al, 0xb8
mov byte [ebx], al
mov eax, 0x41424344
mov dword [ebx + 1], eax
mov al, 0xf4
mov byte [ebx + 5], al
; Do a jump dance to stop multiblock from trying to optimize
; Otherwise it will JIT code from 0xe000'0000 before written
lea ebx, [rel next]
jmp ebx
next:
; Move temp to eax to overwrite
mov eax, 0
; Clear the lower flags so the branch gets taken
sahf
; This is dependent on where it is in the code!
jnb -0x20000000
; Definitely wrong if we hit here
mov eax, -1
hlt

View File

@ -0,0 +1,50 @@
%ifdef CONFIG
{
"RegData": {
"RAX": "0x41424344"
},
"Mode": "32BIT"
}
%endif
; Tests for 32-bit signed displacement wrapping
; Testing for overflow specifically
; Will crash or hit the code we emit to memory
; We map ten pages to 0xe000'0000
; Generate a call 0x11000 over there
; 0x0f'83'fa'0f'01'20 : jnb 0x11000
; 0xf4: hlt - Just in case
mov ebx, 0xe0000000
mov ax, 0x830f
mov word [ebx], ax
mov eax, 0x20010ffa
mov dword [ebx + 2], eax
mov al, 0xf4
mov byte [ebx + 6], al
; Do a jump dance to stop multiblock from trying to optimize
; Otherwise it will JIT code from 0xe000'0000 before written
lea ebx, [rel next]
jmp ebx
next:
; Move temp to eax to overwrite
mov eax, 0
; Clear the lower flags so the branch gets taken
sahf
; This is dependent on where it is in the code!
jnb -0x20000000
; Definitely wrong if we hit here
mov eax, -1
hlt
; This is where the JIT code will land
align 0x1000
mov eax, 0x41424344
hlt