dmaax/ladybird
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
ladybird/Userland/DevTools/UserspaceEmulator/MmapRegion.h

82 lines
2.7 KiB
C
Raw Normal View History

UserspaceEmulator: Make mmap'ed memory track read/write protection Here's the first time we get a taste of better information than the real hardware can give us: unlike x86 CPUs, we can actually support write-only memory, so now we do! While this isn't immediately useful, it's still pretty cool. :^)
2020-07-13 06:40:21 -03:00
/*
UserspaceEmulator: Implement a proper VM allocator This patch brings Kernel::RangeAllocator to UserspaceEmulator in a slightly simplified form. It supports the basic three allocation types needed by virt$mmap(): allocate_anywhere, allocate_specific, and allocate_randomized. Porting virt$mmap() and virt$munmap() to use the allocator makes UE work correctly once again. :^)
2021-02-06 19:08:51 -03:00
* Copyright (c) 2020-2021, Andreas Kling <kling@serenityos.org>
UserspaceEmulator: Make mmap'ed memory track read/write protection Here's the first time we get a taste of better information than the real hardware can give us: unlike x86 CPUs, we can actually support write-only memory, so now we do! While this isn't immediately useful, it's still pretty cool. :^)
2020-07-13 06:40:21 -03:00
*
Everything: Move to SPDX license identifiers in all files. SPDX License Identifiers are a more compact / standardized way of representing file license information. See: https://spdx.dev/resources/use/#identifiers This was done with the `ambr` search and replace tool. ambr --no-parent-ignore --key-from-file --rep-from-file key.txt rep.txt *
2021-04-22 05:24:48 -03:00
* SPDX-License-Identifier: BSD-2-Clause
UserspaceEmulator: Make mmap'ed memory track read/write protection Here's the first time we get a taste of better information than the real hardware can give us: unlike x86 CPUs, we can actually support write-only memory, so now we do! While this isn't immediately useful, it's still pretty cool. :^)
2020-07-13 06:40:21 -03:00
*/
#pragma once
#include "SoftMMU.h"
#include <sys/mman.h>
namespace UserspaceEmulator {
UserspaceEmulator: Hang malloc metadata on malloc block MmapRegions Instead of tracking known malloc blocks in a separate hash table, add an optional malloc metadata pointer to MmapRegion. This makes finding the malloc metadata for a given pointer extremely fast since it can piggyback on the page table array. :^)
2020-11-16 05:33:30 -03:00
class MallocRegionMetadata;
class MallocTracer;
UserspaceEmulator: Make Region a top-level class
2020-11-16 09:16:38 -03:00
class MmapRegion final : public Region {
UserspaceEmulator: Make mmap'ed memory track read/write protection Here's the first time we get a taste of better information than the real hardware can give us: unlike x86 CPUs, we can actually support write-only memory, so now we do! While this isn't immediately useful, it's still pretty cool. :^)
2020-07-13 06:40:21 -03:00
public:
UserspaceEmulator: Remember VM region names for MAP_ANONYMOUS For some reason we only remembered the names of MAP_FILE mmap regions.
2021-03-09 07:23:08 -03:00
static NonnullOwnPtr<MmapRegion> create_anonymous(u32 base, u32 size, u32 prot, String name);
static NonnullOwnPtr<MmapRegion> create_file_backed(u32 base, u32 size, u32 prot, int flags, int fd, off_t offset, String name);
UserspaceEmulator: Make mmap'ed memory track read/write protection Here's the first time we get a taste of better information than the real hardware can give us: unlike x86 CPUs, we can actually support write-only memory, so now we do! While this isn't immediately useful, it's still pretty cool. :^)
2020-07-13 06:40:21 -03:00
virtual ~MmapRegion() override;
UserspaceEmulator+LibX86: Start tracking uninitialized memory :^) This patch introduces the concept of shadow bits. For every byte of memory there is a corresponding shadow byte that contains metadata about that memory. Initially, the only metadata is whether the byte has been initialized or not. That's represented by the least significant shadow bit. Shadow bits travel together with regular values throughout the entire CPU and MMU emulation. There are two main helper classes to facilitate this: ValueWithShadow and ValueAndShadowReference. ValueWithShadow<T> is basically a struct { T value; T shadow; } whereas ValueAndShadowReference<T> is struct { T& value; T& shadow; }. The latter is used as a wrapper around general-purpose registers, since they can't use the plain ValueWithShadow memory as we need to be able to address individual 8-bit and 16-bit subregisters (EAX, AX, AL, AH.) Whenever a computation is made using uninitialized inputs, the result is tainted and becomes uninitialized as well. This allows us to track this state as it propagates throughout memory and registers. This patch doesn't yet keep track of tainted flags, that will be an important upcoming improvement to this. I'm sure I've messed up some things here and there, but it seems to basically work, so we have a place to start! :^)
2020-07-20 21:29:59 -03:00
virtual ValueWithShadow<u8> read8(u32 offset) override;
virtual ValueWithShadow<u16> read16(u32 offset) override;
virtual ValueWithShadow<u32> read32(u32 offset) override;
UserspaceEmulator+LibX86: Add support for 64-bit memory reads and writes (#3584) This is useful for reading and writing doubles for #3329. It is also useful for emulating 64-bit binaries. MemoryOrRegisterReference assumes that 64-bit values are always memory references since that's enough for fpu support. If we ever want to emulate 64-bit binaries, that part will need minor updating.
2020-09-23 15:45:43 -03:00
virtual ValueWithShadow<u64> read64(u32 offset) override;
UE+LibX86: Support bigger reads and writes
2021-04-10 18:29:32 -03:00
virtual ValueWithShadow<u128> read128(u32 offset) override;
virtual ValueWithShadow<u256> read256(u32 offset) override;
UserspaceEmulator: Make mmap'ed memory track read/write protection Here's the first time we get a taste of better information than the real hardware can give us: unlike x86 CPUs, we can actually support write-only memory, so now we do! While this isn't immediately useful, it's still pretty cool. :^)
2020-07-13 06:40:21 -03:00
UserspaceEmulator+LibX86: Start tracking uninitialized memory :^) This patch introduces the concept of shadow bits. For every byte of memory there is a corresponding shadow byte that contains metadata about that memory. Initially, the only metadata is whether the byte has been initialized or not. That's represented by the least significant shadow bit. Shadow bits travel together with regular values throughout the entire CPU and MMU emulation. There are two main helper classes to facilitate this: ValueWithShadow and ValueAndShadowReference. ValueWithShadow<T> is basically a struct { T value; T shadow; } whereas ValueAndShadowReference<T> is struct { T& value; T& shadow; }. The latter is used as a wrapper around general-purpose registers, since they can't use the plain ValueWithShadow memory as we need to be able to address individual 8-bit and 16-bit subregisters (EAX, AX, AL, AH.) Whenever a computation is made using uninitialized inputs, the result is tainted and becomes uninitialized as well. This allows us to track this state as it propagates throughout memory and registers. This patch doesn't yet keep track of tainted flags, that will be an important upcoming improvement to this. I'm sure I've messed up some things here and there, but it seems to basically work, so we have a place to start! :^)
2020-07-20 21:29:59 -03:00
virtual void write8(u32 offset, ValueWithShadow<u8>) override;
virtual void write16(u32 offset, ValueWithShadow<u16>) override;
virtual void write32(u32 offset, ValueWithShadow<u32>) override;
UserspaceEmulator+LibX86: Add support for 64-bit memory reads and writes (#3584) This is useful for reading and writing doubles for #3329. It is also useful for emulating 64-bit binaries. MemoryOrRegisterReference assumes that 64-bit values are always memory references since that's enough for fpu support. If we ever want to emulate 64-bit binaries, that part will need minor updating.
2020-09-23 15:45:43 -03:00
virtual void write64(u32 offset, ValueWithShadow<u64>) override;
UE+LibX86: Support bigger reads and writes
2021-04-10 18:29:32 -03:00
virtual void write128(u32 offset, ValueWithShadow<u128>) override;
virtual void write256(u32 offset, ValueWithShadow<u256>) override;
UserspaceEmulator: Make mmap'ed memory track read/write protection Here's the first time we get a taste of better information than the real hardware can give us: unlike x86 CPUs, we can actually support write-only memory, so now we do! While this isn't immediately useful, it's still pretty cool. :^)
2020-07-13 06:40:21 -03:00
UserspaceEmulator: Add virtual data()/shadow_data() accessors to Region
2020-11-15 13:53:36 -03:00
virtual u8* data() override { return m_data; }
virtual u8* shadow_data() override { return m_shadow_data; }
UserspaceEmulator: Make mmap'ed memory track read/write protection Here's the first time we get a taste of better information than the real hardware can give us: unlike x86 CPUs, we can actually support write-only memory, so now we do! While this isn't immediately useful, it's still pretty cool. :^)
2020-07-13 06:40:21 -03:00
UserspaceEmulator: Mark mmap regions as malloc blocks when mallocing We don't have to be clever at all to figure out which MmapRegions are malloc blocks, we can just mark the containing region as such when the emulated process performs a malloc! :^)
2020-08-01 04:13:45 -03:00
bool is_malloc_block() const { return m_malloc; }
void set_malloc(bool b) { m_malloc = b; }
UserspaceEmulator: Catch use-after-frees by tracking malloc/free :^) This patch introduces a "MallocTracer" to the UserspaceEmulator. If this object is present on the Emulator, it can be notified whenever the emulated program does a malloc() or free(). The notifications come in via a magic instruction sequence that we embed in the LibC malloc() and free() functions. The sequence is: "salc x2, push reg32 x2, pop reg32 x3" The data about the malloc/free operation is in the three pushes. We make sure the sequence is harmless when running natively. Memory accesses on MmapRegion are then audited to see if they fall inside a known-to-be-freed malloc chunk. If so, we complain loud and red in the debugger output. :^) This is very, very cool! :^) It's also a whole lot slower than before, since now we're auditing memory accesses against a new set of metadata. This will need to be optimized (and running in this mode should be opt-in, perhaps even a separate program, etc.)
2020-07-15 16:46:50 -03:00
UserspaceEmulator: Enable splitting regions at arbitrary points This is not yet useful in and of itself, but enables the feature in the next commit.
2021-03-07 18:37:38 -03:00
NonnullOwnPtr<MmapRegion> split_at(VirtualAddress);
int prot() const
{
return (is_readable() ? PROT_READ : 0) | (is_writable() ? PROT_WRITE : 0) | (is_executable() ? PROT_EXEC : 0);
}
UserspaceEmulator: Update memory protection of underlying pages If a MmapRegion is file backed, we need to call mprotect on its underlying pages.
2020-11-23 17:38:29 -03:00
void set_prot(int prot);
UserspaceEmulator: Honor the read/write/execute bits in mmap regions UE will now correctly crash when accessing an mmap memory region in some way it's not supposed to be accessed.
2020-11-14 11:13:50 -03:00
UserspaceEmulator: Hang malloc metadata on malloc block MmapRegions Instead of tracking known malloc blocks in a separate hash table, add an optional malloc metadata pointer to MmapRegion. This makes finding the malloc metadata for a given pointer extremely fast since it can piggyback on the page table array. :^)
2020-11-16 05:33:30 -03:00
MallocRegionMetadata* malloc_metadata() { return m_malloc_metadata; }
void set_malloc_metadata(Badge<MallocTracer>, NonnullOwnPtr<MallocRegionMetadata> metadata) { m_malloc_metadata = move(metadata); }
Everywhere: Run clang-format
2022-04-01 14:58:27 -03:00
String const& name() const { return m_name; }
UserspaceEmulator: Make symbolication work when .text isn't the first ... segment This happens with binaries build with Clang or with a custom linker script. If this is the case, offsets should be calculated not from the base address of `.text`, but from the first section loaded for the library. This commit moves all UserspaceEmulator symbolication into a common helper function and fixes a FIXME.
2021-07-28 12:18:43 -03:00
String lib_name() const
{
if (m_name.contains("Loader.so"sv))
return "Loader.so";
auto const maybe_separator = m_name.find(':');
if (!maybe_separator.has_value())
return {};
return m_name.substring(0, *maybe_separator);
}
UserspaceEmulator: Prefix MmapRegions' name with '(UE)' When printing a backtrace, each library's base address is found by walking through all memory regions in the coredump, and selecting the address of the first region whose name begins with the library's soname. This is done to support the Clang toolchain, where .text is not at offset 0. However, because the libraries loaded by the emulated process used the same names, we could not distinguish those with the ones used by UserspaceEmulator, so the backtrace ended up being garbage. Using the libraries mapped by UE would not be a sufficient, as the running application could ask for other libraries too, and doing away with setting names would make debugging issues within UE code more difficult.
2021-08-14 05:56:40 -03:00
void set_name(String name);
UserspaceEmulator: Support dynamically loaded programs When loading dynamic objects, the emulator loads the interpreter, generates an auxiliary vector and starts executing the loader. Additionally, this commits also makes the MallocTracer and backtrace symbolication work for dynamically loaded programs.
2020-11-23 15:00:35 -03:00
UserspaceEmulator: Make mmap'ed memory track read/write protection Here's the first time we get a taste of better information than the real hardware can give us: unlike x86 CPUs, we can actually support write-only memory, so now we do! While this isn't immediately useful, it's still pretty cool. :^)
2020-07-13 06:40:21 -03:00
private:
UserspaceEmulator: Convert backing storage from malloc to mmap This saves a few bytes for each guest-mmaped region, especially since these are likely to be page-aligned.
2021-03-07 17:39:06 -03:00
MmapRegion(u32 base, u32 size, int prot, u8* data, u8* shadow_data);
UserspaceEmulator: Add basic support for memory-mapped files MmapRegion now supports using an mmap'ed file descriptor as backing.
2020-07-13 06:58:58 -03:00
UserspaceEmulator: Make mmap'ed memory track read/write protection Here's the first time we get a taste of better information than the real hardware can give us: unlike x86 CPUs, we can actually support write-only memory, so now we do! While this isn't immediately useful, it's still pretty cool. :^)
2020-07-13 06:40:21 -03:00
u8* m_data { nullptr };
UserspaceEmulator+LibX86: Start tracking uninitialized memory :^) This patch introduces the concept of shadow bits. For every byte of memory there is a corresponding shadow byte that contains metadata about that memory. Initially, the only metadata is whether the byte has been initialized or not. That's represented by the least significant shadow bit. Shadow bits travel together with regular values throughout the entire CPU and MMU emulation. There are two main helper classes to facilitate this: ValueWithShadow and ValueAndShadowReference. ValueWithShadow<T> is basically a struct { T value; T shadow; } whereas ValueAndShadowReference<T> is struct { T& value; T& shadow; }. The latter is used as a wrapper around general-purpose registers, since they can't use the plain ValueWithShadow memory as we need to be able to address individual 8-bit and 16-bit subregisters (EAX, AX, AL, AH.) Whenever a computation is made using uninitialized inputs, the result is tainted and becomes uninitialized as well. This allows us to track this state as it propagates throughout memory and registers. This patch doesn't yet keep track of tainted flags, that will be an important upcoming improvement to this. I'm sure I've messed up some things here and there, but it seems to basically work, so we have a place to start! :^)
2020-07-20 21:29:59 -03:00
u8* m_shadow_data { nullptr };
UserspaceEmulator: Add basic support for memory-mapped files MmapRegion now supports using an mmap'ed file descriptor as backing.
2020-07-13 06:58:58 -03:00
bool m_file_backed { false };
UserspaceEmulator: Mark mmap regions as malloc blocks when mallocing We don't have to be clever at all to figure out which MmapRegions are malloc blocks, we can just mark the containing region as such when the emulated process performs a malloc! :^)
2020-08-01 04:13:45 -03:00
bool m_malloc { false };
UserspaceEmulator: Hang malloc metadata on malloc block MmapRegions Instead of tracking known malloc blocks in a separate hash table, add an optional malloc metadata pointer to MmapRegion. This makes finding the malloc metadata for a given pointer extremely fast since it can piggyback on the page table array. :^)
2020-11-16 05:33:30 -03:00
OwnPtr<MallocRegionMetadata> m_malloc_metadata;
UserspaceEmulator: Support the name argument in mmap for file backed mappings
2020-11-27 10:45:49 -03:00
String m_name;
UserspaceEmulator: Make mmap'ed memory track read/write protection Here's the first time we get a taste of better information than the real hardware can give us: unlike x86 CPUs, we can actually support write-only memory, so now we do! While this isn't immediately useful, it's still pretty cool. :^)
2020-07-13 06:40:21 -03:00
};
UserspaceEmulator: Add fast-path for is<MmapRegion>() Don't use default RTTI for these since they are performance-sensitive.
2021-03-09 11:17:15 -03:00
template<>
inline bool Region::fast_is<MmapRegion>() const { return m_mmap; }
UserspaceEmulator: Make mmap'ed memory track read/write protection Here's the first time we get a taste of better information than the real hardware can give us: unlike x86 CPUs, we can actually support write-only memory, so now we do! While this isn't immediately useful, it's still pretty cool. :^)
2020-07-13 06:40:21 -03:00
}
Reference in a new issue Copy permalink