create_tests.js 10 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424
  1. #!/usr/bin/env node
  2. "use strict";
  3. // number of tests per instruction
  4. const NO_TESTS = 1;
  5. const assert = require("assert").strict;
  6. const fs = require("fs");
  7. const encodings = require("../../gen/x86_table.js");
  8. const Prand = require("./prand.js");
  9. generate_tests();
  10. function generate_tests()
  11. {
  12. const build_folder = __dirname + "/build/";
  13. try
  14. {
  15. fs.mkdirSync(build_folder);
  16. }
  17. catch(e)
  18. {
  19. if(e.code !== "EEXIST")
  20. {
  21. throw e;
  22. }
  23. }
  24. for(const op of encodings)
  25. {
  26. const configurations = [
  27. { mem: 0, size: 16, },
  28. { mem: 0, size: 32, },
  29. { mem: 1, size: 16, },
  30. { mem: 1, size: 32, },
  31. ];
  32. let i = 0;
  33. for(const config of configurations)
  34. {
  35. for(let nth_test = 0; nth_test < NO_TESTS; nth_test++)
  36. {
  37. if(nth_test > 0 && op.opcode === 0x8D)
  38. {
  39. // is already tested exhaustively in first run
  40. continue;
  41. }
  42. for(const code of create_nasm(op, config, nth_test))
  43. {
  44. const filename = "gen_" + format_opcode(op.opcode) + "_" + (op.fixed_g || 0) + "_" + i + ".asm";
  45. const dirname = build_folder + filename;
  46. let old_code = undefined;
  47. try
  48. {
  49. old_code = fs.readFileSync(dirname, { encoding: "ascii" });
  50. }
  51. catch(e)
  52. {
  53. }
  54. if(old_code !== code)
  55. {
  56. console.log("Creating %s", filename);
  57. fs.writeFileSync(dirname, code);
  58. }
  59. i++;
  60. }
  61. }
  62. }
  63. }
  64. }
  65. function format_opcode(n)
  66. {
  67. let x = n.toString(16);
  68. return (x.length === 1 || x.length === 3) ? "0" + x : x;
  69. }
  70. function create_nasm_modrm_combinations_16()
  71. {
  72. let result = [];
  73. for(let modrm = 0; modrm < 0xC0; modrm++)
  74. {
  75. let mod = modrm >> 6;
  76. let rm = modrm & 7;
  77. let has_imm8 = mod === 1;
  78. let has_imm16 = mod === 2 || rm === 6 && mod === 0;
  79. assert(!has_imm8 || !has_imm16);
  80. let line = ["db " + modrm];
  81. if(has_imm8) line.push("db 9ah");
  82. if(has_imm16) line.push("dw 9a1fh");
  83. result.push(line);
  84. }
  85. return result;
  86. }
  87. function create_nasm_modrm_combinations_32()
  88. {
  89. let result = [];
  90. let sample_sib_bytes = [0x05, 0x65, 0xAD, 0xCD, 0x20, 0xFF];
  91. let exhaustive_sib_bytes = [];
  92. for(let sib = 0; sib < 0x100; sib++) exhaustive_sib_bytes.push(sib);
  93. for(let modrm = 0; modrm < 0xC0; modrm++)
  94. {
  95. let mod = modrm >> 6;
  96. let reg = modrm >> 3 & 7;
  97. let rm = modrm & 7;
  98. let has_imm8 = mod === 1;
  99. let has_imm32 = mod === 2 || rm === 5 && mod === 0;
  100. let has_sib = rm === 4;
  101. assert(!has_imm8 || !has_imm32);
  102. if(has_sib)
  103. {
  104. // avoid generating an excessive number of tests
  105. let sib_bytes = reg === 0 ? exhaustive_sib_bytes : sample_sib_bytes;
  106. for(let sib of sib_bytes)
  107. {
  108. let line = ["db " + modrm, "db " + sib];
  109. if(has_imm8) line.push("db 9ah");
  110. if(has_imm32 || mod === 0 && (sib & 7) === 5) line.push("dd 9a1fbcdeh");
  111. result.push(line);
  112. }
  113. }
  114. else
  115. {
  116. let line = ["db " + modrm];
  117. if(has_imm8) line.push("db 9ah");
  118. if(has_imm32) line.push("dd 9a1fbcdeh");
  119. result.push(line);
  120. }
  121. }
  122. return result;
  123. }
  124. function create_nasm(op, config, nth_test)
  125. {
  126. if(op.prefix || op.skip)
  127. {
  128. return [];
  129. }
  130. if(config.mem ? op.skip_mem : op.skip_reg)
  131. {
  132. // Not supported by test
  133. return [];
  134. }
  135. if(!op.e)
  136. {
  137. if(config.mem)
  138. {
  139. // doesn't use memory, don't test both
  140. return [];
  141. }
  142. }
  143. if(!op.os)
  144. {
  145. if(config.size === 16)
  146. {
  147. // equivalent to 32-bit version, don't test both
  148. return [];
  149. }
  150. }
  151. const op_rand = new Prand(op.opcode + nth_test * 0x10000);
  152. const size = (op.os || op.opcode % 2 === 1) ? config.size : 8;
  153. const is_modrm = op.e || op.fixed_g !== undefined;
  154. const codes = [];
  155. for(let reg of ["eax", "ecx", "edx", "ebx", "ebp", "esi", "edi"])
  156. {
  157. let rand = op_rand.next();
  158. codes.push("mov " + reg + ", " + rand);
  159. }
  160. if(!op.is_fpu) // generate random mmx registers
  161. {
  162. codes.push("sub esp, 8");
  163. for(let i = 0; i < 8; i++)
  164. {
  165. codes.push("mov dword [esp], " + op_rand.next());
  166. codes.push("mov dword [esp + 4], " + op_rand.next());
  167. codes.push("movq mm" + i + ", [esp]");
  168. }
  169. codes.push("add esp, 8");
  170. }
  171. else // generate random fpu registers
  172. {
  173. codes.push("finit");
  174. codes.push("sub esp, 8");
  175. for(let i = 0; i < 8; i++)
  176. {
  177. codes.push("mov dword [esp], " + op_rand.next());
  178. codes.push("mov dword [esp + 4], " + op_rand.next());
  179. codes.push("fld qword [esp]");
  180. }
  181. for(let i = 0; i < 4; i++) // half full stack
  182. {
  183. codes.push("fstp qword [esp]");
  184. }
  185. codes.push("add esp, 8");
  186. }
  187. if(true) // generate random xmm registers
  188. {
  189. codes.push("sub esp, 16");
  190. for(let i = 0; i < 8; i++)
  191. {
  192. codes.push("mov dword [esp], " + op_rand.next());
  193. codes.push("mov dword [esp + 4], " + op_rand.next());
  194. codes.push("mov dword [esp + 8], " + op_rand.next());
  195. codes.push("mov dword [esp + 12], " + op_rand.next());
  196. codes.push("movdqu xmm" + i + ", [esp]");
  197. }
  198. codes.push("add esp, 16");
  199. }
  200. if(true) // generate random stack memory
  201. {
  202. for(let i = 0; i < 8; i++)
  203. {
  204. codes.push("sub esp, 4");
  205. codes.push("mov dword [esp], " + op_rand.next());
  206. }
  207. }
  208. codes.push("push dword " + (op_rand.next() & ~(1 << 8 | 1 << 9)));
  209. codes.push("popf");
  210. if(true)
  211. {
  212. // generate random flags using arithmatic instruction
  213. // not well-distributed, but can trigger bugs in lazy flag calculation
  214. if(true)
  215. {
  216. // rarely sets zero flag, other flags mostly well-distributed
  217. codes.push("add al, ah");
  218. }
  219. else
  220. {
  221. // always sets zero flag
  222. codes.push("sub al, al");
  223. }
  224. }
  225. if(op.is_string)
  226. {
  227. codes.push("mov ecx, 3");
  228. codes.push("mov edi, (120000h-16)");
  229. codes.push("mov esi, (120000h-20)");
  230. }
  231. if(size === 16)
  232. {
  233. codes.push("db 66h ; 16 bit");
  234. }
  235. let opcode = op.opcode;
  236. if(opcode === 0x8D)
  237. {
  238. // special case: lea: generate 16-bit addressing and all modrm combinations
  239. assert(is_modrm);
  240. codes.push([].concat(
  241. create_nasm_modrm_combinations_16().map(lines => ["db 67h", "db 8dh"].concat(lines).join("\n")),
  242. create_nasm_modrm_combinations_32().map(lines => ["db 8dh"].concat(lines).join("\n"))
  243. ));
  244. }
  245. else
  246. {
  247. assert(opcode < 0x1000000);
  248. if(opcode >= 0x10000)
  249. {
  250. let c = opcode >> 16;
  251. assert(c === 0x66 || c === 0xF3 || c === 0xF2);
  252. codes.push("db " + c);
  253. opcode &= ~0xFF0000;
  254. }
  255. if(opcode >= 0x100)
  256. {
  257. let c = opcode >> 8;
  258. assert(c === 0x0F || c === 0xF2 || c === 0xF3, "Expected 0F, F2, or F3 prefix, got " + c.toString(16));
  259. codes.push("db " + c);
  260. opcode &= ~0xFF00;
  261. }
  262. codes.push("db " + opcode);
  263. if(is_modrm)
  264. {
  265. let g = 7; // edi / di / bh
  266. if(op.fixed_g !== undefined)
  267. {
  268. g = op.fixed_g;
  269. }
  270. if(config.mem)
  271. {
  272. const e = 0x04; // [esp]
  273. const sib = 0x24;
  274. codes.push("db " + (e | g << 3));
  275. codes.push("db " + sib);
  276. }
  277. else
  278. {
  279. const es = op.is_fpu ? [0, 1, 2, 3, 4, 5, 6, 7] : [
  280. 2 // edx
  281. ];
  282. const modrm_bytes = es.map(e => "db " + (0xC0 | g << 3 | e));
  283. codes.push(modrm_bytes);
  284. }
  285. }
  286. }
  287. if(op.opcode === 0xC8) // special case: enter
  288. {
  289. codes.push("dw 8h");
  290. codes.push("db 0h");
  291. }
  292. else if(op.imm8 || op.imm8s || op.imm16 || op.imm1632 || op.imm32 || op.immaddr)
  293. {
  294. if(op.imm8 || op.imm8s)
  295. {
  296. codes.push("db 12h");
  297. }
  298. else
  299. {
  300. if(op.immaddr)
  301. {
  302. // immaddr: depends on address size
  303. // generate valid pointer into bss section
  304. codes.push("dd (120000h-16)");
  305. }
  306. else
  307. {
  308. assert(op.imm1632 || op.imm16 || op.imm32);
  309. if(op.imm1632 && size === 16 || op.imm16)
  310. {
  311. codes.push("dw 34cdh");
  312. }
  313. else
  314. {
  315. assert(op.imm1632 && size === 32 || op.imm32);
  316. codes.push("dd 1234abcdh");
  317. }
  318. }
  319. }
  320. }
  321. if(op.mask_flags)
  322. {
  323. codes.push(
  324. "pushf",
  325. "and dword [esp], ~" + op.mask_flags,
  326. "popf"
  327. );
  328. }
  329. return all_combinations(codes).map(c => {
  330. return (
  331. "global _start\n" +
  332. '%include "header.inc"\n\n' +
  333. c.join("\n") + "\n" +
  334. '%include "footer.inc"\n'
  335. );
  336. });
  337. }
  338. function all_combinations(xs)
  339. {
  340. let result = [xs];
  341. for(let i = 0; i < xs.length; i++)
  342. {
  343. let x = xs[i];
  344. if(x instanceof Array)
  345. {
  346. let new_result = [];
  347. for(let r of result)
  348. {
  349. for(let x_ of x)
  350. {
  351. r = r.slice();
  352. r[i] = x_;
  353. new_result.push(r);
  354. }
  355. }
  356. result = new_result;
  357. }
  358. }
  359. return result;
  360. }