lazymio/unicorn
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix long-standing mips delay slot issue

Browse Source
This commit is contained in:
mio
2025-02-19 17:39:24 +08:00
parent 8a2846369c
commit 56ba3476e5
6 changed files with 139 additions and 105 deletions
Download Patch File Download Diff File Expand all files Collapse all files

163
tests/regress/tcg_liveness_analysis_bug_issue-287.py
View File

@@ -2,89 +2,88 @@
from unicorn import *
from unicorn.arm_const import *
# issue #287
# Initial Register States: R0=3, R1=24, R2=16, R3=0
#
# ----- code start -----
# CMP R0,R1,LSR#3
# SUBCS R0,R0,R1,LSR#3 # CPU flags got changed in these two instructions, and *REMEMBERED*, now NF == VF == 0
# CMP R0,#1 # CPU flags changed again, now NF == 1, VF == 0, but they are not properly *REMEMBERED*
# MOV R1,R1,LSR#4
# SUBGES R2,R2,#4 # according to the result of CMP, we should skip this op
#
# MOVGE R3,#100 # since changed flags are not *REMEMBERED* in CMP, now NF == VF == 0, which result in wrong branch
# # at the end of this code block, should R3 == 0
# ----- code end ------
#
# TCG ops are correct, plain op translation is done correctly,
# but there're In-Memory bits invisible from ops that control the host code generation.
# all these codes are in one TCG translation-block, so wrong things could happen.
# detail explanation is given on the right side.
# remember, both set_label and brcond are point to refresh the dead_temps and mem_temps states in TCG
#
# ----- TCG ops ------
# ld_i32 tmp5,env,$0xfffffffffffffff4
# movi_i32 tmp6,$0x0
# brcond_i32 tmp5,tmp6,ne,$0x0
# mov_i32 tmp5,r1 -------------------------
# movi_i32 tmp6,$0x3 |
# shr_i32 tmp5,r1,tmp6 |
# mov_i32 tmp6,r0 |
# sub_i32 NF,r0,tmp5 |
# mov_i32 ZF,NF |
# setcond_i32 CF,r0,tmp5,geu | # This part is "CMP R0,R1,LSR#3"
# xor_i32 VF,NF,r0 |-----> # and "SUBCS R0,R0,R1,LSR#3"
# xor_i32 tmp7,r0,tmp5 | # the last op in this block, set_label get a chance to refresh the TCG globals memory states,
# and_i32 VF,VF,tmp7 | # so things get back to normal states
# mov_i32 tmp6,NF | # these codes are not affected by the bug. Let's called this Part-D
# movi_i32 tmp5,$0x0 |
# brcond_i32 CF,tmp5,eq,$0x1 |
# mov_i32 tmp5,r1 |
# movi_i32 tmp6,$0x3 |
# shr_i32 tmp5,r1,tmp6 |
# mov_i32 tmp6,r0 |
# sub_i32 tmp6,r0,tmp5 |
# mov_i32 r0,tmp6 |
# set_label $0x1 -------------------------
# movi_i32 tmp5,$0x1 ----------------- # Let's called this Part-C
# mov_i32 tmp6,r0 | # NF is used as output operand again!
# sub_i32 NF,r0,tmp5 ----------------|-----> # but it is stated as Not-In-Memory,
# mov_i32 ZF,NF | # no need to sync it after calculation.
# setcond_i32 CF,r0,tmp5,geu | # the generated host code does not write NF
# xor_i32 VF,NF,r0 | # back to its memory location, hence forgot. And the CPU flags after this calculation is not changed.
# xor_i32 tmp7,r0,tmp5 | # Caution: the following SUBGES's condition check is right, even though the generated host code does not *REMEMBER* NF, it will cache the calculated result and serve SUBGES correctly
# and_i32 VF,VF,tmp7 |
# mov_i32 tmp6,NF |
# mov_i32 tmp5,r1 | # this part is "CMP R0,#1"
# movi_i32 tmp6,$0x4 | # and "MOV R1,R1,LSR#4"
# shr_i32 tmp5,r1,tmp6 | # and "SUBGES R2,R2,#4"
# mov_i32 r1,tmp5 |-----> # This is the part where problem start to arise
# xor_i32 tmp5,VF,NF |
# movi_i32 tmp6,$0x0 |
# brcond_i32 tmp5,tmp6,lt,$0x2 --------|-----> # QEMU will refresh the InMemory bit for TCG globals here, but Unicorn won't
# movi_i32 tmp5,$0x4 |
# mov_i32 tmp6,r2 | # this is the 1st bug-related op get analyzed.
# sub_i32 NF,r2,tmp5 ----------------|-----> # here, NF is an output operand, it's flagged dead
# mov_i32 ZF,NF | # and the InMemory bit is clear, tell the previous(above) ops
# setcond_i32 CF,r2,tmp5,geu | # if it is used as output operand again, do not sync it
# xor_i32 VF,NF,r2 | # so the generated host-code for previous ops will not write it back to Memory
# xor_i32 tmp7,r2,tmp5 | # Caution: the CPU flags after this calculation is also right, because the set_label is a point of refresh, make them *REMEMBERED*
# and_i32 VF,VF,tmp7 | # Let's call this Part-B
# mov_i32 tmp6,NF |
# mov_i32 r2,ZF |
# set_label $0x2 -----------------
# xor_i32 tmp5,VF,NF -----------------
# movi_i32 tmp6,$0x0 |
# brcond_i32 tmp5,tmp6,lt,$0x3 | # Let's call this Part-A
# movi_i32 tmp5,$0x64 | # if Part-B is not skipped, this part won't go wrong, because we'll check the CPU flags as the result of Part-B, it's *REMEMBERED*
# movi_i32 r3,$0x64 |-----> # but if Part-B is skipped,
# set_label $0x3 | # what should we expected? we will check the condition based on the result of Part-D!!!
# call wfi,$0x0,$0,env | # because result of Part-C is lost. this is why things go wrong.
# set_label $0x0 |
# exit_tb $0x7f6401714013 -----------------
# ###########
# ----- TCG ends ------
'''
issue #287
Initial Register States: R0=3, R1=24, R2=16, R3=0
----- code start -----
CMP R0,R1,LSR#3
SUBCS R0,R0,R1,LSR#3 # CPU flags got changed in these two instructions, and *REMEMBERED*, now NF == VF == 0
CMP R0,#1 # CPU flags changed again, now NF == 1, VF == 0, but they are not properly *REMEMBERED*
MOV R1,R1,LSR#4
SUBGES R2,R2,#4 # according to the result of CMP, we should skip this op
MOVGE R3,#100 # since changed flags are not *REMEMBERED* in CMP, now NF == VF == 0, which result in wrong branch
# at the end of this code block, should R3 == 0
----- code end ------
# TCG ops are correct, plain op translation is done correctly,
# but there're In-Memory bits invisible from ops that control the host code generation.
# all these codes are in one TCG translation-block, so wrong things could happen.
# detail explanation is given on the right side.
# remember, both set_label and brcond are point to refresh the dead_temps and mem_temps states in TCG
----- TCG ops ------
ld_i32 tmp5,env,$0xfffffffffffffff4
movi_i32 tmp6,$0x0
brcond_i32 tmp5,tmp6,ne,$0x0
mov_i32 tmp5,r1 -------------------------
movi_i32 tmp6,$0x3 |
shr_i32 tmp5,r1,tmp6 |
mov_i32 tmp6,r0 |
sub_i32 NF,r0,tmp5 |
mov_i32 ZF,NF |
setcond_i32 CF,r0,tmp5,geu | # This part is "CMP R0,R1,LSR#3"
xor_i32 VF,NF,r0 |-----> # and "SUBCS R0,R0,R1,LSR#3"
xor_i32 tmp7,r0,tmp5 | # the last op in this block, set_label get a chance to refresh the TCG globals memory states,
and_i32 VF,VF,tmp7 | # so things get back to normal states
mov_i32 tmp6,NF | # these codes are not affected by the bug. Let's called this Part-D
movi_i32 tmp5,$0x0 |
brcond_i32 CF,tmp5,eq,$0x1 |
mov_i32 tmp5,r1 |
movi_i32 tmp6,$0x3 |
shr_i32 tmp5,r1,tmp6 |
mov_i32 tmp6,r0 |
sub_i32 tmp6,r0,tmp5 |
mov_i32 r0,tmp6 |
set_label $0x1 -------------------------
movi_i32 tmp5,$0x1 ----------------- # Let's called this Part-C
mov_i32 tmp6,r0 | # NF is used as output operand again!
sub_i32 NF,r0,tmp5 ----------------|-----> # but it is stated as Not-In-Memory,
mov_i32 ZF,NF | # no need to sync it after calculation.
setcond_i32 CF,r0,tmp5,geu | # the generated host code does not write NF
xor_i32 VF,NF,r0 | # back to its memory location, hence forgot. And the CPU flags after this calculation is not changed.
xor_i32 tmp7,r0,tmp5 | # Caution: the following SUBGES's condition check is right, even though the generated host code does not *REMEMBER* NF, it will cache the calculated result and serve SUBGES correctly
and_i32 VF,VF,tmp7 |
mov_i32 tmp6,NF |
mov_i32 tmp5,r1 | # this part is "CMP R0,#1"
movi_i32 tmp6,$0x4 | # and "MOV R1,R1,LSR#4"
shr_i32 tmp5,r1,tmp6 | # and "SUBGES R2,R2,#4"
mov_i32 r1,tmp5 |-----> # This is the part where problem start to arise
xor_i32 tmp5,VF,NF |
movi_i32 tmp6,$0x0 |
brcond_i32 tmp5,tmp6,lt,$0x2 --------|-----> # QEMU will refresh the InMemory bit for TCG globals here, but Unicorn won't
movi_i32 tmp5,$0x4 |
mov_i32 tmp6,r2 | # this is the 1st bug-related op get analyzed.
sub_i32 NF,r2,tmp5 ----------------|-----> # here, NF is an output operand, it's flagged dead
mov_i32 ZF,NF | # and the InMemory bit is clear, tell the previous(above) ops
setcond_i32 CF,r2,tmp5,geu | # if it is used as output operand again, do not sync it
xor_i32 VF,NF,r2 | # so the generated host-code for previous ops will not write it back to Memory
xor_i32 tmp7,r2,tmp5 | # Caution: the CPU flags after this calculation is also right, because the set_label is a point of refresh, make them *REMEMBERED*
and_i32 VF,VF,tmp7 | # Let's call this Part-B
mov_i32 tmp6,NF |
mov_i32 r2,ZF |
set_label $0x2 -----------------
xor_i32 tmp5,VF,NF -----------------
movi_i32 tmp6,$0x0 |
brcond_i32 tmp5,tmp6,lt,$0x3 | # Let's call this Part-A
movi_i32 tmp5,$0x64 | # if Part-B is not skipped, this part won't go wrong, because we'll check the CPU flags as the result of Part-B, it's *REMEMBERED*
movi_i32 r3,$0x64 |-----> # but if Part-B is skipped,
set_label $0x3 | # what should we expected? we will check the condition based on the result of Part-D!!!
call wfi,$0x0,$0,env | # because result of Part-C is lost. this is why things go wrong.
set_label $0x0 |
exit_tb $0x7f6401714013 -----------------
###########
----- TCG ends ------
'''
CODE = (
b'\xa1\x01\x50\xe1' # cmp r0, r1, lsr #3

25
tests/unit/test_mips.c
View File

@@ -101,22 +101,29 @@ static void test_mips_stop_delay_slot_from_qiling(void)
{
uc_engine *uc;
// 24 06 00 03 addiu $a2, $zero, 3
// 10 a6 00 79 beq $a1, $a2, 0x47c8da4
// 10 a6 00 79 beq $a1, $a2, 0x1e8
// 30 42 00 fc andi $v0, $v0, 0xfc
// 10 40 00 32 beqz $v0, 0x47c8c90
// 24 ab ff da addiu $t3, $a1, -0x26
// 2d 62 00 02 sltiu $v0, $t3, 2
// 10 40 00 32 beqz $v0, 0x47c8c9c
// 00 00 00 00 nop
char code[] =
"\x24\x06\x00\x03\x10\xa6\x00\x79\x30\x42\x00\xfc";
"\x24\x06\x00\x03\x10\xa6\x00\x79\x30\x42\x00\xfc\x10\x40\x00\x32\x24\xab\xff\xda\x2d\x62\x00\x02\x10\x40\x00\x32\x00\x00\x00\x00";
uint32_t r_pc = 0x0;
uint32_t r_a2 = 1;
uint32_t r_v0 = 0xff;
uint32_t r_a1 = 0x3;
uc_common_setup(&uc, UC_ARCH_MIPS, UC_MODE_MIPS32 | UC_MODE_BIG_ENDIAN,
code, sizeof(code) - 1);
OK(uc_reg_write(uc, UC_MIPS_REG_A2, &r_a2));
OK(uc_emu_start(uc, code_start, code_start + sizeof(code) - 1, 0, 2));
OK(uc_reg_write(uc, UC_MIPS_REG_V0, &r_v0));
OK(uc_reg_write(uc, UC_MIPS_REG_A1, &r_a1));
OK(uc_emu_start(uc, code_start, code_start + sizeof(code) + 16, 0, 2));
OK(uc_reg_read(uc, UC_MIPS_REG_PC, &r_pc));
TEST_CHECK(r_pc == code_start + 12);
OK(uc_reg_read(uc, UC_MIPS_REG_V0, &r_v0));
TEST_CHECK(r_pc == code_start + 4 + 0x1e8);
TEST_CHECK(r_v0 == 0xfc);
OK(uc_close(uc));
}