mirror of
https://github.com/yuzu-emu/unicorn.git
synced 2025-01-22 10:41:08 +00:00
Add test case for issue 287.
This commit is contained in:
JC Yang
parent
8ef018a2cb
commit
5be70eb91b
134
tests/regress/tcg_liveness_analysis_bug_issue-287.py
Normal file
134
tests/regress/tcg_liveness_analysis_bug_issue-287.py
Normal file
|
|
@ -0,0 +1,134 @@
|
|||
from unicorn import *
|
||||
from unicorn.arm_const import *
|
||||
import binascii
|
||||
|
||||
MB = 1024 * 1024
|
||||
PAGE = 4 * 1024
|
||||
|
||||
def PrintArmRegisters(uc_emu):
|
||||
print 'R0 : '+hex(uc_emu.reg_read(UC_ARM_REG_R0))
|
||||
print 'R1 : '+hex(uc_emu.reg_read(UC_ARM_REG_R1))
|
||||
print 'R2 : '+hex(uc_emu.reg_read(UC_ARM_REG_R2))
|
||||
print 'R3 : '+hex(uc_emu.reg_read(UC_ARM_REG_R3))
|
||||
print 'R4 : '+hex(uc_emu.reg_read(UC_ARM_REG_R4))
|
||||
print 'R5 : '+hex(uc_emu.reg_read(UC_ARM_REG_R5))
|
||||
print 'R6 : '+hex(uc_emu.reg_read(UC_ARM_REG_R6))
|
||||
print 'R7 : '+hex(uc_emu.reg_read(UC_ARM_REG_R7))
|
||||
print 'R8 : '+hex(uc_emu.reg_read(UC_ARM_REG_R8))
|
||||
print 'R9 : '+hex(uc_emu.reg_read(UC_ARM_REG_R9))
|
||||
print 'R10 : '+hex(uc_emu.reg_read(UC_ARM_REG_R10))
|
||||
print 'R11 : '+hex(uc_emu.reg_read(UC_ARM_REG_R11))
|
||||
print 'R12 : '+hex(uc_emu.reg_read(UC_ARM_REG_R12))
|
||||
print 'SP : '+hex(uc_emu.reg_read(UC_ARM_REG_SP))
|
||||
print 'LR : '+hex(uc_emu.reg_read(UC_ARM_REG_LR))
|
||||
print 'PC : '+hex(uc_emu.reg_read(UC_ARM_REG_PC))
|
||||
flags = uc_emu.reg_read(UC_ARM_REG_CPSR)
|
||||
print 'carry : '+str(flags >> 29 & 0x1)
|
||||
print 'overflow : '+str(flags >> 28 & 0x1)
|
||||
print 'negative : '+str(flags >> 31 & 0x1)
|
||||
print 'zero : '+str(flags >> 30 & 0x1)
|
||||
|
||||
'''
|
||||
issue #287
|
||||
Initial Register States: R0=3, R1=24, R2=16, R3=0
|
||||
----- code start -----
|
||||
CMP R0,R1,LSR#3
|
||||
SUBCS R0,R0,R1,LSR#3 # CPU flags got changed in these two instructions, and *REMEMBERED*, now NF == VF == 0
|
||||
CMP R0,#1 # CPU flags changed again, now NF == 1, VF == 0, but they are not properly *REMEMBERED*
|
||||
MOV R1,R1,LSR#4
|
||||
SUBGES R2,R2,#4 # according to the result of CMP, we should skip this op
|
||||
|
||||
MOVGE R3,#100 # since changed flags are not *REMEMBERED* in CMP, now NF == VF == 0, which result in wrong branch
|
||||
# at the end of this code block, should R3 == 0
|
||||
----- code end ------
|
||||
|
||||
# TCG ops are correct, plain op translation is done correctly,
|
||||
# but there're In-Memory bits invisible from ops that control the host code generation.
|
||||
# all these codes are in one TCG translation-block, so wrong things could happen.
|
||||
# detail explanation is given on the right side.
|
||||
# remember, both set_label and brcond are point to refresh the dead_temps and mem_temps states in TCG
|
||||
----- TCG ops ------
|
||||
ld_i32 tmp5,env,$0xfffffffffffffff4
|
||||
movi_i32 tmp6,$0x0
|
||||
brcond_i32 tmp5,tmp6,ne,$0x0
|
||||
mov_i32 tmp5,r1 -------------------------
|
||||
movi_i32 tmp6,$0x3 |
|
||||
shr_i32 tmp5,r1,tmp6 |
|
||||
mov_i32 tmp6,r0 |
|
||||
sub_i32 NF,r0,tmp5 |
|
||||
mov_i32 ZF,NF |
|
||||
setcond_i32 CF,r0,tmp5,geu | # This part is "CMP R0,R1,LSR#3"
|
||||
xor_i32 VF,NF,r0 |-----> # and "SUBCS R0,R0,R1,LSR#3"
|
||||
xor_i32 tmp7,r0,tmp5 | # the last op in this block, set_label get a chance to refresh the TCG globals memory states,
|
||||
and_i32 VF,VF,tmp7 | # so things get back to normal states
|
||||
mov_i32 tmp6,NF | # these codes are not affected by the bug. Let's called this Part-D
|
||||
movi_i32 tmp5,$0x0 |
|
||||
brcond_i32 CF,tmp5,eq,$0x1 |
|
||||
mov_i32 tmp5,r1 |
|
||||
movi_i32 tmp6,$0x3 |
|
||||
shr_i32 tmp5,r1,tmp6 |
|
||||
mov_i32 tmp6,r0 |
|
||||
sub_i32 tmp6,r0,tmp5 |
|
||||
mov_i32 r0,tmp6 |
|
||||
set_label $0x1 -------------------------
|
||||
movi_i32 tmp5,$0x1 ----------------- # Let's called this Part-C
|
||||
mov_i32 tmp6,r0 | # NF is used as output operand again!
|
||||
sub_i32 NF,r0,tmp5 ----------------|-----> # but it is stated as Not-In-Memory,
|
||||
mov_i32 ZF,NF | # no need to sync it after calculation.
|
||||
setcond_i32 CF,r0,tmp5,geu | # the generated host code does not write NF
|
||||
xor_i32 VF,NF,r0 | # back to its memory location, hence forgot. And the CPU flags after this calculation is not changed.
|
||||
xor_i32 tmp7,r0,tmp5 | # Caution: the following SUBGES's condition check is right, even though the generated host code does not *REMEMBER* NF, it will cache the calculated result and serve SUBGES correctly
|
||||
and_i32 VF,VF,tmp7 |
|
||||
mov_i32 tmp6,NF |
|
||||
mov_i32 tmp5,r1 | # this part is "CMP R0,#1"
|
||||
movi_i32 tmp6,$0x4 | # and "MOV R1,R1,LSR#4"
|
||||
shr_i32 tmp5,r1,tmp6 | # and "SUBGES R2,R2,#4"
|
||||
mov_i32 r1,tmp5 |-----> # This is the part where problem start to arise
|
||||
xor_i32 tmp5,VF,NF |
|
||||
movi_i32 tmp6,$0x0 |
|
||||
brcond_i32 tmp5,tmp6,lt,$0x2 --------|-----> # QEMU will refresh the InMemory bit for TCG globals here, but Unicorn won't
|
||||
movi_i32 tmp5,$0x4 |
|
||||
mov_i32 tmp6,r2 | # this is the 1st bug-related op get analyzed.
|
||||
sub_i32 NF,r2,tmp5 ----------------|-----> # here, NF is an output operand, it's flagged dead
|
||||
mov_i32 ZF,NF | # and the InMemory bit is clear, tell the previous(above) ops
|
||||
setcond_i32 CF,r2,tmp5,geu | # if it is used as output operand again, do not sync it
|
||||
xor_i32 VF,NF,r2 | # so the generated host-code for previous ops will not write it back to Memory
|
||||
xor_i32 tmp7,r2,tmp5 | # Caution: the CPU flags after this calculation is also right, because the set_label is a point of refresh, make them *REMEMBERED*
|
||||
and_i32 VF,VF,tmp7 | # Let's call this Part-B
|
||||
mov_i32 tmp6,NF |
|
||||
mov_i32 r2,ZF |
|
||||
set_label $0x2 -----------------
|
||||
xor_i32 tmp5,VF,NF -----------------
|
||||
movi_i32 tmp6,$0x0 |
|
||||
brcond_i32 tmp5,tmp6,lt,$0x3 | # Let's call this Part-A
|
||||
movi_i32 tmp5,$0x64 | # if Part-B is not skipped, this part won't go wrong, because we'll check the CPU flags as the result of Part-B, it's *REMEMBERED*
|
||||
movi_i32 r3,$0x64 |-----> # but if Part-B is skipped,
|
||||
set_label $0x3 | # what should we expected? we will check the condition based on the result of Part-D!!!
|
||||
call wfi,$0x0,$0,env | # because result of Part-C is lost. this is why things go wrong.
|
||||
set_label $0x0 |
|
||||
exit_tb $0x7f6401714013 -----------------
|
||||
###########
|
||||
----- TCG ends ------
|
||||
'''
|
||||
|
||||
TestCode = b'\xa1\x01\x50\xe1\xa1\x01\x40\x20\x01\x00\x50\xe3\x21\x12\xa0\xe1\x04\x20\x52\xa2\x64\x30\xa0\xa3'
|
||||
|
||||
def UseUcToEmulate():
|
||||
try:
|
||||
uc_emu = Uc(UC_ARCH_ARM, UC_MODE_ARM)
|
||||
#if LoadCode(uc_emu, 2*MB, 0x9004):
|
||||
uc_emu.mem_map(0, 2*MB)
|
||||
uc_emu.reg_write(UC_ARM_REG_SP, 0x40000)
|
||||
uc_emu.reg_write(UC_ARM_REG_R0, 3)
|
||||
uc_emu.reg_write(UC_ARM_REG_R1, 24)
|
||||
uc_emu.reg_write(UC_ARM_REG_R2, 16)
|
||||
uc_emu.mem_write(0, TestCode)
|
||||
uc_emu.emu_start(0, 24)
|
||||
PrintArmRegisters(uc_emu)
|
||||
|
||||
except UcError as e:
|
||||
print("ERROR: %s" % e)
|
||||
PrintArmRegisters(uc_emu)
|
||||
|
||||
|
||||
UseUcToEmulate()
|
||||
Loading…
Reference in a new issue