Skip to content

Commit

Permalink
Merge pull request #3260 from Sonicadvance1/ender_lilies_nzcv_unittest
Browse files Browse the repository at this point in the history
unittests/ASM: Adds unittest found from Ender Lilies that crashed with NZCV
  • Loading branch information
lioncash committed Nov 8, 2023
2 parents bf147f4 + 5bdd422 commit 996a4c0
Showing 1 changed file with 49 additions and 0 deletions.
49 changes: 49 additions & 0 deletions unittests/ASM/FEX_bugs/nzcv_spill_enderlilies.asm
Original file line number Diff line number Diff line change
@@ -0,0 +1,49 @@
%ifdef CONFIG
{
"RegData": {
"RAX": "0",
"XMM0": ["0", "0"]
}
}
%endif

; FEX-Emu has a bug around NZCV flags getting spilled and filled.
; The bug comes down to NZCV actually being 32-bit but our IR incorrectly assumed that all flags were 8-bit.
; Once a spill situation happened, it would only store and reload the lower 8-bits of the NZCV flag which wasn't correct.
; This caused this code to infinite loop and read past memory and crash.

; Code found from Ender Lilies in their `sha1_block_data_order` function which is significantly longer than this snippit.
lea rsi, [rel .data_vecs]
mov rax, 1

; Break visibility
jmp loop_top
loop_top:

; Decrement counter.
dec rax

; Load rsi + 0x40 in to rbx
lea rbx, [rsi+0x40]

; Move rbx in to rsi, incrementing the pointer by 64-bytes if rax isn't zero.
cmovne rsi, rbx

; Do a sha1rnds4, which uses enough temporaries to spill NZCV which picks up a crash.
sha1rnds4 xmm0, xmm0, 0x0

; This memory access will crash once we loop too many times.
movdqu xmm0, [rsi]

; Jump back to the top
jne loop_top

hlt

.data_vecs:
dq 0, 0, 0, 0
dq 0, 0, 0, 0
dq 0, 0, 0, 0
dq 0, 0, 0, 0
dq 0, 0, 0, 0
dq 0, 0, 0, 0

0 comments on commit 996a4c0

Please sign in to comment.