Wrap eip

src/rust/codegen.rs

@@ -24,6 +24,19 @@ pub fn gen_get_eip(builder: &mut WasmBuilder) {
     builder.load_fixed_i32(global_pointers::instruction_pointer as u32);
 }
 
+pub fn escape_if_could_wrap_ip(ctx: &mut JitContext, start_addr: u32, stop_addr: u32) {
+    gen_get_eip(ctx.builder);
+    ctx.builder.const_i32((stop_addr - start_addr) as i32);
+    ctx.builder.add_i32();
+    gen_get_eip(ctx.builder);
+    ctx.builder.xor_i32();
+    ctx.builder.const_i32(!0xFFFF);
+    ctx.builder.and_i32(); // xor will be 0 iff high parts are equal iff won't wrap
+    ctx.builder.const_i32(0);
+    ctx.builder.ne_i32();
+    ctx.builder.br_if(ctx.exit_label);
+}
+
 pub fn gen_set_eip_to_after_current_instruction(ctx: &mut JitContext) {
     ctx.builder
         .const_i32(global_pointers::instruction_pointer as i32);

src/rust/cpu/cpu.rs

@@ -321,6 +321,16 @@ pub struct Code {
     pub state_table: [u16; 0x1000],
 }
 
+pub fn increment_instruction_pointer(eip: i32, delta: i32, is_asize_32: bool) -> i32 {
+    if !is_asize_32 {
+        let offset = eip.wrapping_sub(get_seg_cs()) & 0xFFFF;
+        eip.wrapping_add((offset.wrapping_add(delta) & 0xFFFF) - offset)
+    }
+    else {
+        eip.wrapping_add(delta)
+    }
+}
+
 pub static mut tlb_data: [i32; 0x100000] = [0; 0x100000];
 pub static mut tlb_code: [Option<ptr::NonNull<Code>>; 0x100000] = [None; 0x100000];
 
@@ -2363,7 +2373,7 @@ pub unsafe fn read_imm8() -> OrPageFault<i32> {
     }
     dbg_assert!(!memory::in_mapped_range((*eip_phys ^ eip) as u32));
     let data8 = *memory::mem8.offset((*eip_phys ^ eip) as isize) as i32;
-    *instruction_pointer = eip + 1;
+    *instruction_pointer = increment_instruction_pointer(eip, 1, is_asize_32());
     return Ok(data8);
 }
 
@@ -2380,7 +2390,8 @@ pub unsafe fn read_imm16() -> OrPageFault<i32> {
     }
     else {
         let data16 = memory::read16((*eip_phys ^ *instruction_pointer) as u32);
-        *instruction_pointer = *instruction_pointer + 2;
+        *instruction_pointer =
+            increment_instruction_pointer(*instruction_pointer, 2, is_asize_32());
         return Ok(data16);
     };
 }
@@ -2394,7 +2405,8 @@ pub unsafe fn read_imm32s() -> OrPageFault<i32> {
     }
     else {
         let data32 = memory::read32s((*eip_phys ^ *instruction_pointer) as u32);
-        *instruction_pointer = *instruction_pointer + 4;
+        *instruction_pointer =
+            increment_instruction_pointer(*instruction_pointer, 4, is_asize_32());
         return Ok(data32);
     };
 }
@@ -3084,7 +3096,8 @@ unsafe fn jit_run_interpreted(mut phys_addr: u32) {
         i += 1;
         let start_eip = *instruction_pointer;
         let opcode = *memory::mem8.offset(phys_addr as isize) as i32;
-        *instruction_pointer += 1;
+        *instruction_pointer =
+            increment_instruction_pointer(*instruction_pointer, 1, is_asize_32());
         dbg_assert!(*prefixes == 0);
         run_instruction(opcode | (*is_32 as i32) << 8);
         dbg_assert!(*prefixes == 0);

src/rust/cpu/misc_instr.rs

@@ -92,9 +92,7 @@ pub unsafe fn test_nl() -> bool { return !test_l(); }
 pub unsafe fn test_nle() -> bool { return !test_le(); }
 
 pub unsafe fn jmp_rel16(rel16: i32) {
-    let cs_offset = get_seg_cs();
-    // limit ip to 16 bit
-    *instruction_pointer = cs_offset + (*instruction_pointer - cs_offset + rel16 & 0xFFFF);
+    *instruction_pointer = increment_instruction_pointer(*instruction_pointer, rel16, false);
 }
 pub unsafe fn jmpcc16(condition: bool, imm16: i32) {
     if condition {

src/rust/jit.rs

@@ -2039,6 +2039,10 @@ fn jit_generate_basic_block(ctx: &mut JitContext, block: &BasicBlock) {
     let last_instruction_addr = block.last_instruction_addr;
     let stop_addr = block.end_addr;
 
+    if !ctx.cpu.asize_32() {
+        codegen::escape_if_could_wrap_ip(ctx, start_addr, stop_addr);
+    }
+
     // First iteration of do-while assumes the caller confirms this condition
     dbg_assert!(!is_near_end_of_page(start_addr));