Merge remote-tracking branch 'upstream/develop' into develop

Author: Rjected

.semgrepignore

@@ -18,6 +18,7 @@ tests/
 # Semgrep-action log folder
 .semgrep_logs/
 
+op-chain-ops/script/testdata
 
 packages/*/node_modules
 packages/*/test

cannon/mipsevm/exec/mips_instructions.go

@@ -153,7 +153,8 @@ func ExecuteMipsInstruction(insn, opcode, fun, rs, rt, mem uint32) uint32 {
 		case 0x06: // srlv
 			return rt >> (rs & 0x1F)
 		case 0x07: // srav
-			return SignExtend(rt>>rs, 32-rs)
+			shamt := rs & 0x1F
+			return SignExtend(rt>>shamt, 32-shamt)
 		// functs in range [0x8, 0x1b] are handled specially by other functions
 		case 0x08: // jr
 			return rs

cannon/mipsevm/exec/mips_syscalls.go

@@ -9,6 +9,7 @@ import (
 
 	"github.com/ethereum-optimism/optimism/cannon/mipsevm"
 	"github.com/ethereum-optimism/optimism/cannon/mipsevm/memory"
+	"github.com/ethereum-optimism/optimism/cannon/mipsevm/program"
 )
 
 // Syscall codes
@@ -132,7 +133,6 @@ const (
 // Other constants
 const (
 	SchedQuantum = 100_000
-	BrkStart     = 0x40000000
 )
 
 func GetSyscallArgs(registers *[32]uint32) (syscallNum, a0, a1, a2, a3 uint32) {
@@ -158,6 +158,12 @@ func HandleSysMmap(a0, a1, heap uint32) (v0, v1, newHeap uint32) {
 		v0 = heap
 		//fmt.Printf("mmap heap 0x%x size 0x%x\n", v0, sz)
 		newHeap += sz
+		// Fail if new heap exceeds memory limit, newHeap overflows around to low memory, or sz overflows
+		if newHeap > program.HEAP_END || newHeap < heap || sz < a1 {
+			v0 = SysErrorSignal
+			v1 = MipsEINVAL
+			return v0, v1, heap
+		}
 	} else {
 		v0 = a0
 		//fmt.Printf("mmap hint 0x%x size 0x%x\n", v0, sz)

cannon/mipsevm/multithreaded/mips.go

@@ -10,6 +10,7 @@ import (
 
 	"github.com/ethereum-optimism/optimism/cannon/mipsevm"
 	"github.com/ethereum-optimism/optimism/cannon/mipsevm/exec"
+	"github.com/ethereum-optimism/optimism/cannon/mipsevm/program"
 )
 
 func (m *InstrumentedState) handleSyscall() error {
@@ -26,7 +27,7 @@ func (m *InstrumentedState) handleSyscall() error {
 		v0, v1, newHeap = exec.HandleSysMmap(a0, a1, m.state.Heap)
 		m.state.Heap = newHeap
 	case exec.SysBrk:
-		v0 = exec.BrkStart
+		v0 = program.PROGRAM_BREAK
 	case exec.SysClone: // clone
 		// a0 = flag bitmask, a1 = stack pointer
 		if exec.ValidCloneFlags != a0 {

cannon/mipsevm/program/load.go

@@ -9,7 +9,11 @@ import (
 	"github.com/ethereum-optimism/optimism/cannon/mipsevm"
 )
 
-const HEAP_START = 0x05000000
+const (
+	HEAP_START    = 0x05_00_00_00
+	HEAP_END      = 0x60_00_00_00
+	PROGRAM_BREAK = 0x40_00_00_00
+)
 
 type CreateInitialFPVMState[T mipsevm.FPVMState] func(pc, heapStart uint32) T
 

cannon/mipsevm/singlethreaded/mips.go

@@ -5,6 +5,7 @@ import (
 	"github.com/ethereum/go-ethereum/common/hexutil"
 
 	"github.com/ethereum-optimism/optimism/cannon/mipsevm/exec"
+	"github.com/ethereum-optimism/optimism/cannon/mipsevm/program"
 )
 
 func (m *InstrumentedState) handleSyscall() error {
@@ -20,7 +21,7 @@ func (m *InstrumentedState) handleSyscall() error {
 		v0, v1, newHeap = exec.HandleSysMmap(a0, a1, m.state.Heap)
 		m.state.Heap = newHeap
 	case exec.SysBrk:
-		v0 = exec.BrkStart
+		v0 = program.PROGRAM_BREAK
 	case exec.SysClone: // clone (not supported)
 		v0 = 1
 	case exec.SysExitGroup:

cannon/mipsevm/tests/evm_test.go

@@ -5,6 +5,7 @@ import (
 	"io"
 	"os"
 	"path"
+	"strings"
 	"testing"
 	"time"
 
@@ -18,6 +19,7 @@ import (
 	"github.com/ethereum-optimism/optimism/cannon/mipsevm/exec"
 	"github.com/ethereum-optimism/optimism/cannon/mipsevm/memory"
 	"github.com/ethereum-optimism/optimism/cannon/mipsevm/multithreaded"
+	"github.com/ethereum-optimism/optimism/cannon/mipsevm/program"
 	"github.com/ethereum-optimism/optimism/cannon/mipsevm/singlethreaded"
 	"github.com/ethereum-optimism/optimism/cannon/mipsevm/testutil"
 )
@@ -48,6 +50,7 @@ func TestEVM(t *testing.T) {
 			oracle := testutil.SelectOracleFixture(t, f.Name())
 			// Short-circuit early for exit_group.bin
 			exitGroup := f.Name() == "exit_group.bin"
+			expectPanic := strings.HasSuffix(f.Name(), "panic.bin")
 
 			evm := testutil.NewMIPSEVM(contracts, addrs)
 			evm.SetTracer(tracer)
@@ -66,6 +69,17 @@ func TestEVM(t *testing.T) {
 
 			goState := singlethreaded.NewInstrumentedState(state, oracle, os.Stdout, os.Stderr, nil)
 
+			// Catch panics and check if they are expected
+			defer func() {
+				if r := recover(); r != nil {
+					if expectPanic {
+						// Success
+					} else {
+						t.Errorf("unexpected panic: %v", r)
+					}
+				}
+			}()
+
 			for i := 0; i < 1000; i++ {
 				curStep := goState.GetState().GetStep()
 				if goState.GetState().GetPC() == testutil.EndAddr {
@@ -90,6 +104,8 @@ func TestEVM(t *testing.T) {
 				require.NotEqual(t, uint32(testutil.EndAddr), goState.GetState().GetPC(), "must not reach end")
 				require.True(t, goState.GetState().GetExited(), "must set exited state")
 				require.Equal(t, uint8(1), goState.GetState().GetExitCode(), "must exit with 1")
+			} else if expectPanic {
+				require.NotEqual(t, uint32(testutil.EndAddr), goState.GetState().GetPC(), "must not reach end")
 			} else {
 				require.Equal(t, uint32(testutil.EndAddr), state.Cpu.PC, "must reach end")
 				// inspect test result
@@ -193,6 +209,88 @@ func TestEVMSingleStep(t *testing.T) {
 	}
 }
 
+func TestEVM_MMap(t *testing.T) {
+	contracts, addrs := testContractsSetup(t)
+	var tracer *tracing.Hooks
+
+	cases := []struct {
+		name         string
+		heap         uint32
+		address      uint32
+		size         uint32
+		shouldFail   bool
+		expectedHeap uint32
+	}{
+		{name: "Increment heap by max value", heap: program.HEAP_START, address: 0, size: ^uint32(0), shouldFail: true},
+		{name: "Increment heap to 0", heap: program.HEAP_START, address: 0, size: ^uint32(0) - program.HEAP_START + 1, shouldFail: true},
+		{name: "Increment heap to previous page", heap: program.HEAP_START, address: 0, size: ^uint32(0) - program.HEAP_START - memory.PageSize + 1, shouldFail: true},
+		{name: "Increment max page size", heap: program.HEAP_START, address: 0, size: ^uint32(0) & ^uint32(memory.PageAddrMask), shouldFail: true},
+		{name: "Increment max page size from 0", heap: 0, address: 0, size: ^uint32(0) & ^uint32(memory.PageAddrMask), shouldFail: true},
+		{name: "Increment heap at limit", heap: program.HEAP_END, address: 0, size: 1, shouldFail: true},
+		{name: "Increment heap to limit", heap: program.HEAP_END - memory.PageSize, address: 0, size: 1, shouldFail: false, expectedHeap: program.HEAP_END},
+		{name: "Increment heap within limit", heap: program.HEAP_END - 2*memory.PageSize, address: 0, size: 1, shouldFail: false, expectedHeap: program.HEAP_END - memory.PageSize},
+		{name: "Request specific address", heap: program.HEAP_START, address: 0x50_00_00_00, size: 0, shouldFail: false, expectedHeap: program.HEAP_START},
+	}
+
+	for _, c := range cases {
+		t.Run(c.name, func(t *testing.T) {
+			state := singlethreaded.CreateEmptyState()
+			state.Heap = c.heap
+			state.Memory.SetMemory(state.GetPC(), syscallInsn)
+			state.Registers = testutil.RandomRegisters(77)
+			state.Registers[2] = exec.SysMmap
+			state.Registers[4] = c.address
+			state.Registers[5] = c.size
+			step := state.Step
+
+			expectedRegisters := state.Registers
+			expectedHeap := state.Heap
+			expectedMemoryRoot := state.Memory.MerkleRoot()
+			if c.shouldFail {
+				expectedRegisters[2] = exec.SysErrorSignal
+				expectedRegisters[7] = exec.MipsEINVAL
+			} else {
+				expectedHeap = c.expectedHeap
+				if c.address == 0 {
+					expectedRegisters[2] = state.Heap
+					expectedRegisters[7] = 0
+				} else {
+					expectedRegisters[2] = c.address
+					expectedRegisters[7] = 0
+				}
+			}
+
+			us := singlethreaded.NewInstrumentedState(state, nil, os.Stdout, os.Stderr, nil)
+			stepWitness, err := us.Step(true)
+			require.NoError(t, err)
+
+			// Check expectations
+			require.Equal(t, step+1, state.Step)
+			require.Equal(t, expectedHeap, state.Heap)
+			require.Equal(t, expectedRegisters, state.Registers)
+			require.Equal(t, expectedMemoryRoot, state.Memory.MerkleRoot())
+			require.Equal(t, common.Hash{}, state.PreimageKey)
+			require.Equal(t, uint32(0), state.PreimageOffset)
+			require.Equal(t, uint32(4), state.Cpu.PC)
+			require.Equal(t, uint32(8), state.Cpu.NextPC)
+			require.Equal(t, uint32(0), state.Cpu.HI)
+			require.Equal(t, uint32(0), state.Cpu.LO)
+			require.Equal(t, false, state.Exited)
+			require.Equal(t, uint8(0), state.ExitCode)
+			require.Equal(t, hexutil.Bytes(nil), state.LastHint)
+
+			evm := testutil.NewMIPSEVM(contracts, addrs)
+			evm.SetTracer(tracer)
+			testutil.LogStepFailureAtCleanup(t, evm)
+
+			evmPost := evm.Step(t, stepWitness, step, singlethreaded.GetStateHashFn())
+			goPost, _ := us.GetState().EncodeWitness()
+			require.Equal(t, hexutil.Bytes(goPost).String(), hexutil.Bytes(evmPost).String(),
+				"mipsevm produced different state than EVM")
+		})
+	}
+}
+
 func TestEVMSysWriteHint(t *testing.T) {
 	contracts, addrs := testContractsSetup(t)
 	var tracer *tracing.Hooks

cannon/mipsevm/tests/fuzz_evm_test.go

@@ -14,6 +14,7 @@ import (
 	"github.com/ethereum-optimism/optimism/cannon/mipsevm"
 	"github.com/ethereum-optimism/optimism/cannon/mipsevm/exec"
 	"github.com/ethereum-optimism/optimism/cannon/mipsevm/memory"
+	"github.com/ethereum-optimism/optimism/cannon/mipsevm/program"
 	"github.com/ethereum-optimism/optimism/cannon/mipsevm/singlethreaded"
 	"github.com/ethereum-optimism/optimism/cannon/mipsevm/testutil"
 	preimage "github.com/ethereum-optimism/optimism/op-preimage"
@@ -45,7 +46,7 @@ func FuzzStateSyscallBrk(f *testing.F) {
 		state.Memory.SetMemory(pc, syscallInsn)
 		preStateRoot := state.Memory.MerkleRoot()
 		expectedRegisters := state.Registers
-		expectedRegisters[2] = 0x4000_0000
+		expectedRegisters[2] = program.PROGRAM_BREAK
 
 		goState := singlethreaded.NewInstrumentedState(state, nil, os.Stdout, os.Stderr, nil)
 		stepWitness, err := goState.Step(true)
@@ -127,7 +128,14 @@ func FuzzStateSyscallClone(f *testing.F) {
 func FuzzStateSyscallMmap(f *testing.F) {
 	contracts, addrs := testContractsSetup(f)
 	step := uint64(0)
-	f.Fuzz(func(t *testing.T, addr uint32, siz uint32, heap uint32) {
+
+	// Add special cases for large memory allocation
+	f.Add(uint32(0), uint32(0x1000), uint32(program.HEAP_END), int64(1))
+	f.Add(uint32(0), uint32(1<<31), uint32(program.HEAP_START), int64(2))
+	// Check edge case - just within bounds
+	f.Add(uint32(0), uint32(0x1000), uint32(program.HEAP_END-4096), int64(3))
+
+	f.Fuzz(func(t *testing.T, addr uint32, siz uint32, heap uint32, seed int64) {
 		state := &singlethreaded.State{
 			Cpu: mipsevm.CpuScalars{
 				PC:     0,
@@ -139,11 +147,14 @@ func FuzzStateSyscallMmap(f *testing.F) {
 			ExitCode:       0,
 			Exited:         false,
 			Memory:         memory.NewMemory(),
-			Registers:      [32]uint32{2: exec.SysMmap, 4: addr, 5: siz},
+			Registers:      testutil.RandomRegisters(seed),
 			Step:           step,
 			PreimageOffset: 0,
 		}
 		state.Memory.SetMemory(0, syscallInsn)
+		state.Registers[2] = exec.SysMmap
+		state.Registers[4] = addr
+		state.Registers[5] = siz
 		preStateRoot := state.Memory.MerkleRoot()
 		preStateRegisters := state.Registers
 
@@ -152,32 +163,42 @@ func FuzzStateSyscallMmap(f *testing.F) {
 		require.NoError(t, err)
 		require.False(t, stepWitness.HasPreimage())
 
-		require.Equal(t, uint32(4), state.Cpu.PC)
-		require.Equal(t, uint32(8), state.Cpu.NextPC)
-		require.Equal(t, uint32(0), state.Cpu.LO)
-		require.Equal(t, uint32(0), state.Cpu.HI)
-		require.Equal(t, uint8(0), state.ExitCode)
-		require.Equal(t, false, state.Exited)
-		require.Equal(t, preStateRoot, state.Memory.MerkleRoot())
-		require.Equal(t, uint64(1), state.Step)
-		require.Equal(t, common.Hash{}, state.PreimageKey)
-		require.Equal(t, uint32(0), state.PreimageOffset)
+		var expectedHeap uint32
+		expectedRegisters := preStateRegisters
 		if addr == 0 {
-			expectedRegisters := preStateRegisters
-			expectedRegisters[2] = heap
-			require.Equal(t, expectedRegisters, state.Registers)
 			sizAlign := siz
 			if sizAlign&memory.PageAddrMask != 0 { // adjust size to align with page size
 				sizAlign = siz + memory.PageSize - (siz & memory.PageAddrMask)
 			}
-			require.Equal(t, uint32(heap+sizAlign), state.Heap)
+			newHeap := heap + sizAlign
+			if newHeap > program.HEAP_END || newHeap < heap || sizAlign < siz {
+				expectedHeap = heap
+				expectedRegisters[2] = exec.SysErrorSignal
+				expectedRegisters[7] = exec.MipsEINVAL
+			} else {
+				expectedRegisters[2] = heap
+				expectedRegisters[7] = 0 // no error
+				expectedHeap = heap + sizAlign
+			}
 		} else {
-			expectedRegisters := preStateRegisters
 			expectedRegisters[2] = addr
-			require.Equal(t, expectedRegisters, state.Registers)
-			require.Equal(t, uint32(heap), state.Heap)
+			expectedRegisters[7] = 0 // no error
+			expectedHeap = heap
 		}
 
+		require.Equal(t, uint32(4), state.Cpu.PC)
+		require.Equal(t, uint32(8), state.Cpu.NextPC)
+		require.Equal(t, uint32(0), state.Cpu.LO)
+		require.Equal(t, uint32(0), state.Cpu.HI)
+		require.Equal(t, preStateRoot, state.Memory.MerkleRoot())
+		require.Equal(t, uint64(1), state.Step)
+		require.Equal(t, common.Hash{}, state.PreimageKey)
+		require.Equal(t, uint32(0), state.PreimageOffset)
+		require.Equal(t, expectedHeap, state.Heap)
+		require.Equal(t, uint8(0), state.ExitCode)
+		require.Equal(t, false, state.Exited)
+		require.Equal(t, expectedRegisters, state.Registers)
+
 		evm := testutil.NewMIPSEVM(contracts, addrs)
 		evmPost := evm.Step(t, stepWitness, step, singlethreaded.GetStateHashFn())
 		goPost, _ := goState.GetState().EncodeWitness()