From d1fa22f7b45378ddb6ce4eaf04f36f6c0bf0203c Mon Sep 17 00:00:00 2001 From: Kartik Agaram Date: Wed, 22 May 2019 22:26:02 -0700 Subject: 5221 Explore using a second register for pointer dereferencing. --- html/subx/apps/handle.subx.html | 356 +++++++++++++++++++++------------------- 1 file changed, 184 insertions(+), 172 deletions(-) (limited to 'html') diff --git a/html/subx/apps/handle.subx.html b/html/subx/apps/handle.subx.html index 7e80e7e0..6b6adc69 100644 --- a/html/subx/apps/handle.subx.html +++ b/html/subx/apps/handle.subx.html @@ -23,6 +23,7 @@ a { color:inherit; } .subxTest { color: #5f8700; } .Constant { color: #008787; } .Normal { color: #000000; background-color: #c6c6c6; padding-bottom: 1px; } +.CommentedCode { color: #8a8a8a; } .subxH1Comment { color: #005faf; text-decoration: underline; } --> @@ -120,13 +121,13 @@ if ('onhashchange' in window) { 59 $new:continue: 60 # otherwise: 61 # ECX = *Next-alloc-id - 62 8b/copy 0/mod/indirect 5/rm32/.disp32 . . 1/r32/ECX Next-alloc-id/disp32 # copy *Next-alloc-id to ECX + 62 8b/copy 0/mod/indirect 5/rm32/.disp32 . . 1/r32/ECX Next-alloc-id/disp32 # copy *Next-alloc-id to ECX 63 # *EAX = *Next-alloc-id/ECX 64 89/copy 0/mod/indirect 0/rm32/EAX . . . 1/r32/ECX . . # copy ECX to *EAX 65 # out->alloc_id = *Next-alloc-id 66 89/copy 0/mod/indirect 2/rm32/EDX . . . 1/r32/ECX . . # copy ECX to *EDX 67 # increment *Next-alloc-id - 68 ff 0/subop/increment 0/mod/indirect 5/rm32/.disp32 . . . Next-alloc-id/disp32 # increment *Next-alloc-id + 68 ff 0/subop/increment 0/mod/indirect 5/rm32/.disp32 . . . Next-alloc-id/disp32 # increment *Next-alloc-id 69 $new:end: 70 # . restore registers 71 5a/pop-to-EDX @@ -154,7 +155,7 @@ if ('onhashchange' in window) { 93 # . . discard args 94 81 0/subop/add 3/mod/direct 4/rm32/ESP . . . . . 8/imm32 # add to ESP 95 # *Next-alloc-id = 0x34 - 96 c7 0/subop/copy 0/mod/indirect 5/rm32/.disp32 . . . Next-alloc-id/disp32 0x34/imm32 # copy to *Next-alloc-id + 96 c7 0/subop/copy 0/mod/indirect 5/rm32/.disp32 . . . Next-alloc-id/disp32 0x34/imm32 # copy to *Next-alloc-id 97 # var handle/ECX = {0, 0} 98 68/push 0/imm32/address 99 68/push 0/imm32/alloc-id @@ -191,14 +192,14 @@ if ('onhashchange' in window) { 130 # . . push args 131 68/push "F - test-new: next alloc id"/imm32 132 68/push 0x35/imm32 -133 ff 6/subop/push 0/mod/indirect 5/rm32/.disp32 . . . Next-alloc-id/disp32 # copy to *Next-alloc-id +133 ff 6/subop/push 0/mod/indirect 5/rm32/.disp32 . . . Next-alloc-id/disp32 # copy to *Next-alloc-id 134 # . . call 135 e8/call check-ints-equal/disp32 136 # . . discard args 137 81 0/subop/add 3/mod/direct 4/rm32/ESP . . . . . 0xc/imm32 # add to ESP 138 # clean up 139 # . *Next-alloc-id = 1 -140 c7 0/subop/copy 0/mod/indirect 5/rm32/.disp32 . . . Next-alloc-id/disp32 1/imm32 # copy to *Next-alloc-id +140 c7 0/subop/copy 0/mod/indirect 5/rm32/.disp32 . . . Next-alloc-id/disp32 1/imm32 # copy to *Next-alloc-id 141 # . epilog 142 89/copy 3/mod/direct 4/rm32/ESP . . . 5/r32/EBP . . # copy EBP to ESP 143 5d/pop-to-EBP @@ -209,7 +210,7 @@ if ('onhashchange' in window) { 148 55/push-EBP 149 89/copy 3/mod/direct 5/rm32/EBP . . . 4/r32/ESP . . # copy ESP to EBP 150 # . *Next-alloc-id = 0x34 -151 c7 0/subop/copy 0/mod/indirect 5/rm32/.disp32 . . . Next-alloc-id/disp32 0x34/imm32 # copy to *Next-alloc-id +151 c7 0/subop/copy 0/mod/indirect 5/rm32/.disp32 . . . Next-alloc-id/disp32 0x34/imm32 # copy to *Next-alloc-id 152 # define an allocation-descriptor with no space left 153 # . var ad/EAX : (address allocation-descriptor) = {0x10, 0x10} 154 68/push 0x10/imm32/limit @@ -253,14 +254,14 @@ if ('onhashchange' in window) { 192 # . . push args 193 68/push "F - test-new-failure: next alloc id"/imm32 194 68/push 0x34/imm32 -195 ff 6/subop/push 0/mod/indirect 5/rm32/.disp32 . . . Next-alloc-id/disp32 # copy to *Next-alloc-id +195 ff 6/subop/push 0/mod/indirect 5/rm32/.disp32 . . . Next-alloc-id/disp32 # copy to *Next-alloc-id 196 # . . call 197 e8/call check-ints-equal/disp32 198 # . . discard args 199 81 0/subop/add 3/mod/direct 4/rm32/ESP . . . . . 0xc/imm32 # add to ESP 200 # clean up 201 # . *Next-alloc-id = 1 -202 c7 0/subop/copy 0/mod/indirect 5/rm32/.disp32 . . . Next-alloc-id/disp32 1/imm32 # copy to *Next-alloc-id +202 c7 0/subop/copy 0/mod/indirect 5/rm32/.disp32 . . . Next-alloc-id/disp32 1/imm32 # copy to *Next-alloc-id 203 # . epilog 204 89/copy 3/mod/direct 4/rm32/ESP . . . 5/r32/EBP . . # copy EBP to ESP 205 5d/pop-to-EBP @@ -292,174 +293,185 @@ if ('onhashchange' in window) { 231 # add 4 232 05/add-to-EAX 4/imm32 233 # - } -234 # . epilog -235 89/copy 3/mod/direct 4/rm32/ESP . . . 5/r32/EBP . . # copy EBP to ESP -236 5d/pop-to-EBP -237 c3/return -238 -239 $lookup:abort: -240 # . _write(2/stderr, msg) -241 # . . push args -242 68/push "lookup failed\n"/imm32 -243 68/push 2/imm32/stderr -244 # . . call -245 e8/call _write/disp32 -246 # . . discard args -247 81 0/subop/add 3/mod/direct 4/rm32/ESP . . . . . 8/imm32 # add to ESP -248 # . syscall(exit, 1) -249 bb/copy-to-EBX 1/imm32/exit-status -250 b8/copy-to-EAX 1/imm32/exit -251 cd/syscall 0x80/imm8 -252 -253 test-lookup-success: -254 # . prolog -255 55/push-EBP -256 89/copy 3/mod/direct 5/rm32/EBP . . . 4/r32/ESP . . # copy ESP to EBP -257 # . save registers -258 # var heap/EBX : (address allocation-descriptor) = {0, 0} -259 68/push 0/imm32/limit -260 68/push 0/imm32/curr -261 89/copy 3/mod/direct 3/rm32/EBX . . . 4/r32/ESP . . # copy ESP to EBX -262 # heap = new-segment(512) -263 # . . push args -264 53/push-EBX -265 68/push 0x200/imm32 -266 # . . call -267 e8/call new-segment/disp32 -268 # . . discard args -269 81 0/subop/add 3/mod/direct 4/rm32/ESP . . . . . 8/imm32 # add to ESP -270 # var handle/ECX = {0, 0} -271 68/push 0/imm32/address -272 68/push 0/imm32/alloc-id -273 89/copy 3/mod/direct 1/rm32/ECX . . . 4/r32/ESP . . # copy ESP to ECX -274 # var old_top/EDX = heap->curr -275 8b/copy 0/mod/indirect 3/rm32/EBX . . . 2/r32/EDX . . # copy *EBX to EDX -276 # new(heap, 2, handle) -277 # . . push args -278 51/push-ECX -279 68/push 2/imm32/size -280 53/push-EBX -281 # . . call -282 e8/call new/disp32 -283 # . . discard args -284 81 0/subop/add 3/mod/direct 4/rm32/ESP . . . . . 0xc/imm32 # add to ESP -285 # EAX = lookup(handle) -286 # . . push args -287 51/push-ECX -288 # . . call -289 e8/call lookup/disp32 -290 # . . discard args -291 81 0/subop/add 3/mod/direct 4/rm32/ESP . . . . . 4/imm32 # add to ESP -292 # EAX contains old top of heap, except skipping the alloc id in the payload -293 # . check-ints-equal(EAX, old_top+4, msg) -294 # . . push args -295 68/push "F - test-lookup-success"/imm32 -296 81 0/subop/add 3/mod/direct 2/rm32/EDX . . . . . 4/imm32 # add to EDX -297 52/push-EDX -298 50/push-EAX +234 # - alternative consuming a second register { +235 #? # ECX = handle->alloc_id +236 #? 8b/copy 0/mod/indirect 0/rm32/EAX . . . 1/r32/ECX . . # copy *EAX to ECX +237 #? # EAX = handle->address (payload) +238 #? 8b/copy 1/mod/*+disp8 0/rm32/EAX . . . 0/r32/EAX 4/disp8 . # copy *(EAX+4) to EAX +239 #? # if (ECX != *EAX) abort +240 #? 39/compare 0/mod/indirect 0/rm32/EAX . . . 1/r32/ECX . . # compare *EAX and ECX +241 #? 75/jump-if-not-equal $lookup:abort/disp8 +242 #? # add 4 to EAX +243 #? 05/add-to-EAX 4/imm32 +244 # - } +245 # . epilog +246 89/copy 3/mod/direct 4/rm32/ESP . . . 5/r32/EBP . . # copy EBP to ESP +247 5d/pop-to-EBP +248 c3/return +249 +250 $lookup:abort: +251 # . _write(2/stderr, msg) +252 # . . push args +253 68/push "lookup failed\n"/imm32 +254 68/push 2/imm32/stderr +255 # . . call +256 e8/call _write/disp32 +257 # . . discard args +258 81 0/subop/add 3/mod/direct 4/rm32/ESP . . . . . 8/imm32 # add to ESP +259 # . syscall(exit, 1) +260 bb/copy-to-EBX 1/imm32/exit-status +261 b8/copy-to-EAX 1/imm32/exit +262 cd/syscall 0x80/imm8 +263 +264 test-lookup-success: +265 # . prolog +266 55/push-EBP +267 89/copy 3/mod/direct 5/rm32/EBP . . . 4/r32/ESP . . # copy ESP to EBP +268 # . save registers +269 # var heap/EBX : (address allocation-descriptor) = {0, 0} +270 68/push 0/imm32/limit +271 68/push 0/imm32/curr +272 89/copy 3/mod/direct 3/rm32/EBX . . . 4/r32/ESP . . # copy ESP to EBX +273 # heap = new-segment(512) +274 # . . push args +275 53/push-EBX +276 68/push 0x200/imm32 +277 # . . call +278 e8/call new-segment/disp32 +279 # . . discard args +280 81 0/subop/add 3/mod/direct 4/rm32/ESP . . . . . 8/imm32 # add to ESP +281 # var handle/ECX = {0, 0} +282 68/push 0/imm32/address +283 68/push 0/imm32/alloc-id +284 89/copy 3/mod/direct 1/rm32/ECX . . . 4/r32/ESP . . # copy ESP to ECX +285 # var old_top/EDX = heap->curr +286 8b/copy 0/mod/indirect 3/rm32/EBX . . . 2/r32/EDX . . # copy *EBX to EDX +287 # new(heap, 2, handle) +288 # . . push args +289 51/push-ECX +290 68/push 2/imm32/size +291 53/push-EBX +292 # . . call +293 e8/call new/disp32 +294 # . . discard args +295 81 0/subop/add 3/mod/direct 4/rm32/ESP . . . . . 0xc/imm32 # add to ESP +296 # EAX = lookup(handle) +297 # . . push args +298 51/push-ECX 299 # . . call -300 e8/call check-ints-equal/disp32 +300 e8/call lookup/disp32 301 # . . discard args -302 81 0/subop/add 3/mod/direct 4/rm32/ESP . . . . . 0xc/imm32 # add to ESP -303 # clean up -304 # . *Next-alloc-id = 1 -305 c7 0/subop/copy 0/mod/indirect 5/rm32/.disp32 . . . Next-alloc-id/disp32 1/imm32 # copy to *Next-alloc-id -306 # write(2/stderr, "lookup succeeded\n") -307 # . . push args -308 68/push "lookup succeeded\n"/imm32 -309 68/push 2/imm32/stderr +302 81 0/subop/add 3/mod/direct 4/rm32/ESP . . . . . 4/imm32 # add to ESP +303 # EAX contains old top of heap, except skipping the alloc id in the payload +304 # . check-ints-equal(EAX, old_top+4, msg) +305 # . . push args +306 68/push "F - test-lookup-success"/imm32 +307 81 0/subop/add 3/mod/direct 2/rm32/EDX . . . . . 4/imm32 # add to EDX +308 52/push-EDX +309 50/push-EAX 310 # . . call -311 e8/call write/disp32 +311 e8/call check-ints-equal/disp32 312 # . . discard args -313 81 0/subop/add 3/mod/direct 4/rm32/ESP . . . . . 8/imm32 # add to ESP -314 # . restore registers -315 5a/pop-to-EDX -316 59/pop-to-ECX -317 # . epilog -318 89/copy 3/mod/direct 4/rm32/ESP . . . 5/r32/EBP . . # copy EBP to ESP -319 5d/pop-to-EBP -320 c3/return -321 -322 test-lookup-failure: -323 # . prolog -324 55/push-EBP -325 89/copy 3/mod/direct 5/rm32/EBP . . . 4/r32/ESP . . # copy ESP to EBP -326 # var heap/ESI : (address allocation-descriptor) = {0, 0} -327 68/push 0/imm32/limit -328 68/push 0/imm32/curr -329 89/copy 3/mod/direct 6/rm32/ESI . . . 4/r32/ESP . . # copy ESP to ESI -330 # heap = new-segment(512) -331 # . . push args -332 56/push-ESI -333 68/push 0x200/imm32 -334 # . . call -335 e8/call new-segment/disp32 -336 # . . discard args -337 81 0/subop/add 3/mod/direct 4/rm32/ESP . . . . . 8/imm32 # add to ESP -338 # var h1/ECX = {0, 0} -339 68/push 0/imm32/address -340 68/push 0/imm32/alloc-id -341 89/copy 3/mod/direct 1/rm32/ECX . . . 4/r32/ESP . . # copy ESP to ECX -342 # var old_top/EBX = heap->curr -343 8b/copy 0/mod/indirect 6/rm32/ESI . . . 3/r32/EBX . . # copy *ESI to EBX -344 # first allocation, to h1 -345 # . new(heap, 2, h1) -346 # . . push args -347 51/push-ECX -348 68/push 2/imm32/size -349 56/push-ESI -350 # . . call -351 e8/call new/disp32 -352 # . . discard args -353 81 0/subop/add 3/mod/direct 4/rm32/ESP . . . . . 0xc/imm32 # add to ESP -354 # reset heap->curr to mimic reclamation -355 89/copy 0/mod/indirect 6/rm32/ESI . . . 3/r32/EBX . . # copy EBX to *ESI -356 # second allocation that returns the same address as the first -357 # var h2/EDX = {0, 0} -358 68/push 0/imm32/address -359 68/push 0/imm32/alloc-id -360 89/copy 3/mod/direct 2/rm32/EDX . . . 4/r32/ESP . . # copy ESP to EDX -361 # . new(heap, 2, h2) -362 # . . push args -363 52/push-EDX -364 68/push 2/imm32/size -365 56/push-ESI -366 # . . call -367 e8/call new/disp32 -368 # . . discard args -369 81 0/subop/add 3/mod/direct 4/rm32/ESP . . . . . 0xc/imm32 # add to ESP -370 # check-ints-equal(h1->address, h2->address, msg) -371 # . . push args -372 68/push "F - test-lookup-failure"/imm32 -373 ff 6/subop/push 1/mod/*+disp8 2/rm32/ECX . . . . 4/disp8 . # push *(EDX+4) -374 ff 6/subop/push 1/mod/*+disp8 1/rm32/ECX . . . . 4/disp8 . # push *(ECX+4) -375 # . . call -376 e8/call check-ints-equal/disp32 -377 # . . discard args -378 81 0/subop/add 3/mod/direct 4/rm32/ESP . . . . . 0xc/imm32 # add to ESP -379 # lookup(h1) should crash -380 # . . push args -381 51/push-ECX -382 # . . call -383 e8/call lookup/disp32 -384 # should never get past this point -385 # . . discard args -386 81 0/subop/add 3/mod/direct 4/rm32/ESP . . . . . 4/imm32 # add to ESP -387 # clean up -388 # . *Next-alloc-id = 1 -389 c7 0/subop/copy 0/mod/indirect 5/rm32/.disp32 . . . Next-alloc-id/disp32 1/imm32 # copy to *Next-alloc-id -390 # . epilog -391 89/copy 3/mod/direct 4/rm32/ESP . . . 5/r32/EBP . . # copy EBP to ESP -392 5d/pop-to-EBP -393 c3/return -394 -395 == data -396 -397 # Monotonically increasing counter for calls to 'new' -398 Next-alloc-id: -399 1/imm32 -400 -401 # . . vim:nowrap:textwidth=0 +313 81 0/subop/add 3/mod/direct 4/rm32/ESP . . . . . 0xc/imm32 # add to ESP +314 # clean up +315 # . *Next-alloc-id = 1 +316 c7 0/subop/copy 0/mod/indirect 5/rm32/.disp32 . . . Next-alloc-id/disp32 1/imm32 # copy to *Next-alloc-id +317 # write(2/stderr, "lookup succeeded\n") +318 # . . push args +319 68/push "lookup succeeded\n"/imm32 +320 68/push 2/imm32/stderr +321 # . . call +322 e8/call write/disp32 +323 # . . discard args +324 81 0/subop/add 3/mod/direct 4/rm32/ESP . . . . . 8/imm32 # add to ESP +325 # . restore registers +326 5a/pop-to-EDX +327 59/pop-to-ECX +328 # . epilog +329 89/copy 3/mod/direct 4/rm32/ESP . . . 5/r32/EBP . . # copy EBP to ESP +330 5d/pop-to-EBP +331 c3/return +332 +333 test-lookup-failure: +334 # . prolog +335 55/push-EBP +336 89/copy 3/mod/direct 5/rm32/EBP . . . 4/r32/ESP . . # copy ESP to EBP +337 # var heap/ESI : (address allocation-descriptor) = {0, 0} +338 68/push 0/imm32/limit +339 68/push 0/imm32/curr +340 89/copy 3/mod/direct 6/rm32/ESI . . . 4/r32/ESP . . # copy ESP to ESI +341 # heap = new-segment(512) +342 # . . push args +343 56/push-ESI +344 68/push 0x200/imm32 +345 # . . call +346 e8/call new-segment/disp32 +347 # . . discard args +348 81 0/subop/add 3/mod/direct 4/rm32/ESP . . . . . 8/imm32 # add to ESP +349 # var h1/ECX = {0, 0} +350 68/push 0/imm32/address +351 68/push 0/imm32/alloc-id +352 89/copy 3/mod/direct 1/rm32/ECX . . . 4/r32/ESP . . # copy ESP to ECX +353 # var old_top/EBX = heap->curr +354 8b/copy 0/mod/indirect 6/rm32/ESI . . . 3/r32/EBX . . # copy *ESI to EBX +355 # first allocation, to h1 +356 # . new(heap, 2, h1) +357 # . . push args +358 51/push-ECX +359 68/push 2/imm32/size +360 56/push-ESI +361 # . . call +362 e8/call new/disp32 +363 # . . discard args +364 81 0/subop/add 3/mod/direct 4/rm32/ESP . . . . . 0xc/imm32 # add to ESP +365 # reset heap->curr to mimic reclamation +366 89/copy 0/mod/indirect 6/rm32/ESI . . . 3/r32/EBX . . # copy EBX to *ESI +367 # second allocation that returns the same address as the first +368 # var h2/EDX = {0, 0} +369 68/push 0/imm32/address +370 68/push 0/imm32/alloc-id +371 89/copy 3/mod/direct 2/rm32/EDX . . . 4/r32/ESP . . # copy ESP to EDX +372 # . new(heap, 2, h2) +373 # . . push args +374 52/push-EDX +375 68/push 2/imm32/size +376 56/push-ESI +377 # . . call +378 e8/call new/disp32 +379 # . . discard args +380 81 0/subop/add 3/mod/direct 4/rm32/ESP . . . . . 0xc/imm32 # add to ESP +381 # check-ints-equal(h1->address, h2->address, msg) +382 # . . push args +383 68/push "F - test-lookup-failure"/imm32 +384 ff 6/subop/push 1/mod/*+disp8 2/rm32/ECX . . . . 4/disp8 . # push *(EDX+4) +385 ff 6/subop/push 1/mod/*+disp8 1/rm32/ECX . . . . 4/disp8 . # push *(ECX+4) +386 # . . call +387 e8/call check-ints-equal/disp32 +388 # . . discard args +389 81 0/subop/add 3/mod/direct 4/rm32/ESP . . . . . 0xc/imm32 # add to ESP +390 # lookup(h1) should crash +391 # . . push args +392 51/push-ECX +393 # . . call +394 e8/call lookup/disp32 +395 # should never get past this point +396 # . . discard args +397 81 0/subop/add 3/mod/direct 4/rm32/ESP . . . . . 4/imm32 # add to ESP +398 # clean up +399 # . *Next-alloc-id = 1 +400 c7 0/subop/copy 0/mod/indirect 5/rm32/.disp32 . . . Next-alloc-id/disp32 1/imm32 # copy to *Next-alloc-id +401 # . epilog +402 89/copy 3/mod/direct 4/rm32/ESP . . . 5/r32/EBP . . # copy EBP to ESP +403 5d/pop-to-EBP +404 c3/return +405 +406 == data +407 +408 # Monotonically increasing counter for calls to 'new' +409 Next-alloc-id: +410 1/imm32 +411 +412 # . . vim:nowrap:textwidth=0 -- cgit 1.4.1-2-gfad0