yuzu-emu/unicorn
1
0
Fork 0
mirror of https://github.com/yuzu-emu/unicorn.git synced 2024-10-19 23:38:23 +02:00
Code Issues Packages Projects Releases Wiki Activity

target/i386: trap on instructions longer than >15 bytes

Browse Source 
Besides being more correct, arbitrarily long instruction allow the
generation of a translation block that spans three pages. This
confuses the generator and even allows ring 3 code to poison the
translation block cache and inject code into other processes that are
in guest ring 3.

This is an improved (and more invasive) fix for commit 30663fd ("tcg/i386:
Check the size of instruction being translated", 2017-03-24). In addition
to being more precise (and generating the right exception, which is #GP
rather than #UD), it distinguishes better between page faults and too long
instructions, as shown by this test case:

int main()
{
char *x = mmap(NULL, 8192, PROT_READ|PROT_WRITE|PROT_EXEC,
MAP_PRIVATE|MAP_ANON, -1, 0);
memset(x, 0x66, 4096);
x[4096] = 0x90;
x[4097] = 0xc3;
char *i = x + 4096 - 15;
mprotect(x + 4096, 4096, PROT_READ|PROT_WRITE);
((void(*)(void)) i) ();
}

... which produces a #GP without the mprotect, and a #PF with it.

Backports commit b066c5375737ad0d630196dab2a2b329515a1d00 from qemu
This commit is contained in:
Paolo Bonzini 2018-03-05 04:12:24 -05:00 committed by Lioncash
parent 44f87a8fbf
commit 7dd4afd8d9
No known key found for this signature in database
GPG Key ID: 4E3C3CC1031BA9C7
1 changed files with 22 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

29
qemu/target/i386/translate.c
View File

@ -113,6 +113,7 @@ typedef struct DisasContext {
int cpuid_ext3_features; int cpuid_ext3_features;
int cpuid_7_0_ebx_features; int cpuid_7_0_ebx_features;
int cpuid_xsave_features; int cpuid_xsave_features;
sigjmp_buf jmpbuf;
struct uc_struct *uc; struct uc_struct *uc;
// Unicorn // Unicorn
@ -2117,11 +2118,27 @@ static void gen_shifti(DisasContext *s, int op, TCGMemOp ot, int d, int c)
} }
} }
#define X86_MAX_INSN_LENGTH 15
static uint64_t advance_pc(CPUX86State *env, DisasContext *s, int num_bytes) static uint64_t advance_pc(CPUX86State *env, DisasContext *s, int num_bytes)
{ {
uint64_t pc = s->pc; uint64_t pc = s->pc;
s->pc += num_bytes; s->pc += num_bytes;
if (unlikely(s->pc - s->pc_start > X86_MAX_INSN_LENGTH)) {
/* If the instruction's 16th byte is on a different page than the 1st, a
* page fault on the second page wins over the general protection fault
* caused by the instruction being too long.
* This can happen even if the operand is only one byte long!
*/
if (((s->pc - 1) ^ (pc - 1)) & TARGET_PAGE_MASK) {
volatile uint8_t unused =
cpu_ldub_code(env, (s->pc - 1) & TARGET_PAGE_MASK);
(void) unused;
}
siglongjmp(s->jmpbuf, 1);
}
return pc; return pc;
} }
@ -5094,14 +5111,12 @@ static target_ulong disas_insn(DisasContext *s, CPUState *cpu)
s->rip_offset = 0; /* for relative ip address */ s->rip_offset = 0; /* for relative ip address */
s->vex_l = 0; s->vex_l = 0;
s->vex_v = 0; s->vex_v = 0;
next_byte: if (sigsetjmp(s->jmpbuf, 0) != 0) {
/* x86 has an upper limit of 15 bytes for an instruction. Since we gen_exception(s, EXCP0D_GPF, pc_start - s->cs_base);
* do not want to decode and generate IR for an illegal return s->pc;
* instruction, the following check limits the instruction size to
* 25 bytes: 14 prefix + 1 opc + 6 (modrm+sib+ofs) + 4 imm */
if (s->pc - pc_start > 14) {
goto illegal_op;
} }
next_byte:
b = x86_ldub_code(env, s); b = x86_ldub_code(env, s);
/* Collect prefixes. */ /* Collect prefixes. */
switch (b) { switch (b) {