yuzu/unicorn
1
0
Fork 0
mirror of https://github.com/yuzu-emu/unicorn.git synced 2024-12-23 14:45:48 +00:00
Code Issues Packages Projects Releases Wiki Activity
unicorn/qemu
History
Paolo Bonzini 7dd4afd8d9
target/i386: trap on instructions longer than >15 bytes 
Besides being more correct, arbitrarily long instruction allow the
generation of a translation block that spans three pages. This
confuses the generator and even allows ring 3 code to poison the
translation block cache and inject code into other processes that are
in guest ring 3.

This is an improved (and more invasive) fix for commit 30663fd ("tcg/i386:
Check the size of instruction being translated", 2017-03-24). In addition
to being more precise (and generating the right exception, which is #GP
rather than #UD), it distinguishes better between page faults and too long
instructions, as shown by this test case:

int main()
{
char *x = mmap(NULL, 8192, PROT_READ|PROT_WRITE|PROT_EXEC,
MAP_PRIVATE|MAP_ANON, -1, 0);
memset(x, 0x66, 4096);
x[4096] = 0x90;
x[4097] = 0xc3;
char *i = x + 4096 - 15;
mprotect(x + 4096, 4096, PROT_READ|PROT_WRITE);
((void(*)(void)) i) ();
}

... which produces a #GP without the mprotect, and a #PF with it.

Backports commit b066c5375737ad0d630196dab2a2b329515a1d00 from qemu
2018-03-05 04:12:28 -05:00
..
accel target/arm: [tcg] Port to generic translation framework 2018-03-04 20:28:06 -05:00
crypto crypto: Clean up includes 2018-02-19 00:47:40 -05:00
default-configs arm64eb: add support for ARM64 big endian. 2017-04-24 23:30:01 +08:00
docs docs: clarify memory region lifecycle 2018-02-12 15:11:21 -05:00
fpu softfloat: define floatx80_round() 2018-03-03 20:57:27 -05:00
hw mips: replace cpu_mips_init() with cpu_generic_init() 2018-03-05 00:49:10 -05:00
include qom: add helper macro DEFINE_TYPES() 2018-03-05 03:51:54 -05:00
qapi qapi: add explicit null to string input and output visitors 2018-03-03 20:32:50 -05:00
qobject qnum: add uint type 2018-03-03 18:37:56 -05:00
qom qom: introduce type_register_static_array() 2018-03-05 03:49:50 -05:00
scripts scripts: use build_ prefix for string not piped through cgen() 2018-03-03 22:11:28 -05:00
target target/i386: trap on instructions longer than >15 bytes 2018-03-05 04:12:28 -05:00
tcg tcg/mips: delete commented out extern keyword 2018-03-05 03:24:25 -05:00
util bitmap: provide to_le/from_le helpers 2018-03-05 01:11:13 -05:00
aarch64.h target/arm: Implement BLXNS 2018-03-05 03:31:59 -05:00
aarch64eb.h target/arm: Implement BLXNS 2018-03-05 03:31:59 -05:00
accel.c clean-up: removed duplicate #includes 2018-02-28 08:51:56 -05:00
arm.h target/arm: Implement BLXNS 2018-03-05 03:31:59 -05:00
armeb.h target/arm: Implement BLXNS 2018-03-05 03:31:59 -05:00
atomic_template.h tcg: Add atomic128 helpers 2018-02-27 21:43:48 -05:00
CODING_STYLE import 2015-08-21 15:04:50 +08:00
configure configure: Drop AIX host support 2018-03-04 21:32:40 -05:00
COPYING import 2015-08-21 15:04:50 +08:00
COPYING.LIB import 2015-08-21 15:04:50 +08:00
cpu-exec-common.c tcg: Add EXCP_ATOMIC 2018-02-27 11:57:58 -05:00
cpu-exec.c exec-all: extract tb->tc_* into a separate struct tc_tb 2018-03-05 02:57:22 -05:00
cpus.c tcg: handle EXCP_ATOMIC exception for system emulation 2018-03-02 09:56:43 -05:00
cputlb.c cputlb: Support generating CPU exceptions on memory transaction failures 2018-03-04 13:14:50 -05:00
exec.c memory: Open code FlatView rendering 2018-03-04 02:06:48 -05:00
gen_all_header.sh arm64eb: add support for ARM64 big endian. 2017-04-24 23:30:01 +08:00
glib_compat.c qapi: Improve qobject input visitor error reporting 2018-03-02 12:05:53 -05:00
HACKING import 2015-08-21 15:04:50 +08:00
header_gen.py target/arm: Implement BLXNS 2018-03-05 03:31:59 -05:00
ioport.c hw: remove pio_addr_t 2018-02-24 02:43:16 -05:00
LICENSE import 2015-08-21 15:04:50 +08:00
m68k.h target/arm: Implement BLXNS 2018-03-05 03:31:59 -05:00
Makefile Makefile: Add a FORCE target 2018-02-24 17:03:51 -05:00
Makefile.objs tcg: Add atomic helpers 2018-02-27 15:57:47 -05:00
Makefile.target tcg: Add generic translation framework 2018-03-04 14:31:16 -05:00
memory.c memory: avoid a name clash with access macro 2018-03-05 01:13:01 -05:00
memory_ldst.inc.c exec: introduce memory_ldst.inc.c 2018-03-01 09:59:34 -05:00
memory_mapping.c include/qemu/osdep.h: Don't include qapi/error.h 2018-02-21 23:08:18 -05:00
mips.h target/arm: Implement BLXNS 2018-03-05 03:31:59 -05:00
mips64.h target/arm: Implement BLXNS 2018-03-05 03:31:59 -05:00
mips64el.h target/arm: Implement BLXNS 2018-03-05 03:31:59 -05:00
mipsel.h target/arm: Implement BLXNS 2018-03-05 03:31:59 -05:00
powerpc.h target/arm: Implement BLXNS 2018-03-05 03:31:59 -05:00
qapi-schema.json qapi: Update scripts to commit 01b2ffcedd94ad7b42bc870e4c6936c87ad03429 2018-03-03 18:32:12 -05:00
qemu-timer.c timer/cpus: fix some typos and update some comments 2018-02-25 23:21:57 -05:00
rules.mak rules.mak: Don't extract libs from .mo-libs in link command 2018-02-26 02:08:03 -05:00
softmmu_template.h cputlb: Support generating CPU exceptions on memory transaction failures 2018-03-04 13:14:50 -05:00
sparc.h target/arm: Implement BLXNS 2018-03-05 03:31:59 -05:00
sparc64.h target/arm: Implement BLXNS 2018-03-05 03:31:59 -05:00
tcg-runtime.c exec-all: extract tb->tc_* into a separate struct tc_tb 2018-03-05 02:57:22 -05:00
translate-all.c tcg: Fix off-by-one in assert in page_set_flags 2018-03-05 03:53:14 -05:00
translate-all.h translate-all.c: Compute L1 page table properties at runtime 2018-02-26 11:46:58 -05:00
translate-common.c exec: Clean up includes 2018-02-19 00:49:55 -05:00
unicorn_common.h qom/cpu: Add MemoryRegion property 2018-02-18 21:54:50 -05:00
VERSION import 2015-08-21 15:04:50 +08:00
vl.c util: add cacheinfo 2018-03-03 16:58:28 -05:00
vl.h import 2015-08-21 15:04:50 +08:00
x86_64.h target/arm: Implement BLXNS 2018-03-05 03:31:59 -05:00