diff --git a/tests/regress/tcg_liveness_analysis_bug_issue-287.py b/tests/regress/tcg_liveness_analysis_bug_issue-287.py new file mode 100644 index 00000000..4310a8cb --- /dev/null +++ b/tests/regress/tcg_liveness_analysis_bug_issue-287.py @@ -0,0 +1,134 @@ +from unicorn import * +from unicorn.arm_const import * +import binascii + +MB = 1024 * 1024 +PAGE = 4 * 1024 + +def PrintArmRegisters(uc_emu): + print 'R0 : '+hex(uc_emu.reg_read(UC_ARM_REG_R0)) + print 'R1 : '+hex(uc_emu.reg_read(UC_ARM_REG_R1)) + print 'R2 : '+hex(uc_emu.reg_read(UC_ARM_REG_R2)) + print 'R3 : '+hex(uc_emu.reg_read(UC_ARM_REG_R3)) + print 'R4 : '+hex(uc_emu.reg_read(UC_ARM_REG_R4)) + print 'R5 : '+hex(uc_emu.reg_read(UC_ARM_REG_R5)) + print 'R6 : '+hex(uc_emu.reg_read(UC_ARM_REG_R6)) + print 'R7 : '+hex(uc_emu.reg_read(UC_ARM_REG_R7)) + print 'R8 : '+hex(uc_emu.reg_read(UC_ARM_REG_R8)) + print 'R9 : '+hex(uc_emu.reg_read(UC_ARM_REG_R9)) + print 'R10 : '+hex(uc_emu.reg_read(UC_ARM_REG_R10)) + print 'R11 : '+hex(uc_emu.reg_read(UC_ARM_REG_R11)) + print 'R12 : '+hex(uc_emu.reg_read(UC_ARM_REG_R12)) + print 'SP : '+hex(uc_emu.reg_read(UC_ARM_REG_SP)) + print 'LR : '+hex(uc_emu.reg_read(UC_ARM_REG_LR)) + print 'PC : '+hex(uc_emu.reg_read(UC_ARM_REG_PC)) + flags = uc_emu.reg_read(UC_ARM_REG_CPSR) + print 'carry : '+str(flags >> 29 & 0x1) + print 'overflow : '+str(flags >> 28 & 0x1) + print 'negative : '+str(flags >> 31 & 0x1) + print 'zero : '+str(flags >> 30 & 0x1) + +''' + issue #287 + Initial Register States: R0=3, R1=24, R2=16, R3=0 + ----- code start ----- + CMP R0,R1,LSR#3 + SUBCS R0,R0,R1,LSR#3 # CPU flags got changed in these two instructions, and *REMEMBERED*, now NF == VF == 0 + CMP R0,#1 # CPU flags changed again, now NF == 1, VF == 0, but they are not properly *REMEMBERED* + MOV R1,R1,LSR#4 + SUBGES R2,R2,#4 # according to the result of CMP, we should skip this op + + MOVGE R3,#100 # since changed flags are not *REMEMBERED* in CMP, now NF == VF == 0, which result in wrong branch + # at the end of this code block, should R3 == 0 + ----- code end ------ + + # TCG ops are correct, plain op translation is done correctly, + # but there're In-Memory bits invisible from ops that control the host code generation. + # all these codes are in one TCG translation-block, so wrong things could happen. + # detail explanation is given on the right side. + # remember, both set_label and brcond are point to refresh the dead_temps and mem_temps states in TCG + ----- TCG ops ------ + ld_i32 tmp5,env,$0xfffffffffffffff4 + movi_i32 tmp6,$0x0 + brcond_i32 tmp5,tmp6,ne,$0x0 + mov_i32 tmp5,r1 ------------------------- + movi_i32 tmp6,$0x3 | + shr_i32 tmp5,r1,tmp6 | + mov_i32 tmp6,r0 | + sub_i32 NF,r0,tmp5 | + mov_i32 ZF,NF | + setcond_i32 CF,r0,tmp5,geu | # This part is "CMP R0,R1,LSR#3" + xor_i32 VF,NF,r0 |-----> # and "SUBCS R0,R0,R1,LSR#3" + xor_i32 tmp7,r0,tmp5 | # the last op in this block, set_label get a chance to refresh the TCG globals memory states, + and_i32 VF,VF,tmp7 | # so things get back to normal states + mov_i32 tmp6,NF | # these codes are not affected by the bug. Let's called this Part-D + movi_i32 tmp5,$0x0 | + brcond_i32 CF,tmp5,eq,$0x1 | + mov_i32 tmp5,r1 | + movi_i32 tmp6,$0x3 | + shr_i32 tmp5,r1,tmp6 | + mov_i32 tmp6,r0 | + sub_i32 tmp6,r0,tmp5 | + mov_i32 r0,tmp6 | + set_label $0x1 ------------------------- + movi_i32 tmp5,$0x1 ----------------- # Let's called this Part-C + mov_i32 tmp6,r0 | # NF is used as output operand again! + sub_i32 NF,r0,tmp5 ----------------|-----> # but it is stated as Not-In-Memory, + mov_i32 ZF,NF | # no need to sync it after calculation. + setcond_i32 CF,r0,tmp5,geu | # the generated host code does not write NF + xor_i32 VF,NF,r0 | # back to its memory location, hence forgot. And the CPU flags after this calculation is not changed. + xor_i32 tmp7,r0,tmp5 | # Caution: the following SUBGES's condition check is right, even though the generated host code does not *REMEMBER* NF, it will cache the calculated result and serve SUBGES correctly + and_i32 VF,VF,tmp7 | + mov_i32 tmp6,NF | + mov_i32 tmp5,r1 | # this part is "CMP R0,#1" + movi_i32 tmp6,$0x4 | # and "MOV R1,R1,LSR#4" + shr_i32 tmp5,r1,tmp6 | # and "SUBGES R2,R2,#4" + mov_i32 r1,tmp5 |-----> # This is the part where problem start to arise + xor_i32 tmp5,VF,NF | + movi_i32 tmp6,$0x0 | + brcond_i32 tmp5,tmp6,lt,$0x2 --------|-----> # QEMU will refresh the InMemory bit for TCG globals here, but Unicorn won't + movi_i32 tmp5,$0x4 | + mov_i32 tmp6,r2 | # this is the 1st bug-related op get analyzed. + sub_i32 NF,r2,tmp5 ----------------|-----> # here, NF is an output operand, it's flagged dead + mov_i32 ZF,NF | # and the InMemory bit is clear, tell the previous(above) ops + setcond_i32 CF,r2,tmp5,geu | # if it is used as output operand again, do not sync it + xor_i32 VF,NF,r2 | # so the generated host-code for previous ops will not write it back to Memory + xor_i32 tmp7,r2,tmp5 | # Caution: the CPU flags after this calculation is also right, because the set_label is a point of refresh, make them *REMEMBERED* + and_i32 VF,VF,tmp7 | # Let's call this Part-B + mov_i32 tmp6,NF | + mov_i32 r2,ZF | + set_label $0x2 ----------------- + xor_i32 tmp5,VF,NF ----------------- + movi_i32 tmp6,$0x0 | + brcond_i32 tmp5,tmp6,lt,$0x3 | # Let's call this Part-A + movi_i32 tmp5,$0x64 | # if Part-B is not skipped, this part won't go wrong, because we'll check the CPU flags as the result of Part-B, it's *REMEMBERED* + movi_i32 r3,$0x64 |-----> # but if Part-B is skipped, + set_label $0x3 | # what should we expected? we will check the condition based on the result of Part-D!!! + call wfi,$0x0,$0,env | # because result of Part-C is lost. this is why things go wrong. + set_label $0x0 | + exit_tb $0x7f6401714013 ----------------- + ########### + ----- TCG ends ------ +''' + +TestCode = b'\xa1\x01\x50\xe1\xa1\x01\x40\x20\x01\x00\x50\xe3\x21\x12\xa0\xe1\x04\x20\x52\xa2\x64\x30\xa0\xa3' + +def UseUcToEmulate(): + try: + uc_emu = Uc(UC_ARCH_ARM, UC_MODE_ARM) + #if LoadCode(uc_emu, 2*MB, 0x9004): + uc_emu.mem_map(0, 2*MB) + uc_emu.reg_write(UC_ARM_REG_SP, 0x40000) + uc_emu.reg_write(UC_ARM_REG_R0, 3) + uc_emu.reg_write(UC_ARM_REG_R1, 24) + uc_emu.reg_write(UC_ARM_REG_R2, 16) + uc_emu.mem_write(0, TestCode) + uc_emu.emu_start(0, 24) + PrintArmRegisters(uc_emu) + + except UcError as e: + print("ERROR: %s" % e) + PrintArmRegisters(uc_emu) + + +UseUcToEmulate()