| Age | Commit message (Collapse) | Author |
|---|
|
|
|
|
|
When loading dynamic objects, the emulator loads the interpreter,
generates an auxiliary vector and starts executing the loader.
Additionally, this commits also makes the MallocTracer and backtrace
symbolication work for dynamically loaded programs.
|
|
|
|
If a MmapRegion is file backed, we need to call mprotect on its
underlying pages.
|
|
|
|
These are getting quite hot (~4% of general emulation profile combined)
so let's just devirtualize them and turn the function calls into simple
boolean checks.
|
|
Instead of tracking known malloc blocks in a separate hash table,
add an optional malloc metadata pointer to MmapRegion.
This makes finding the malloc metadata for a given pointer extremely
fast since it can piggyback on the page table array. :^)
|
|
|
|
UE will now correctly crash when accessing an mmap memory region in
some way it's not supposed to be accessed.
|
|
This is useful for reading and writing doubles for #3329.
It is also useful for emulating 64-bit binaries.
MemoryOrRegisterReference assumes that 64-bit values are always
memory references since that's enough for fpu support. If we
ever want to emulate 64-bit binaries, that part will need minor
updating.
|
|
We don't have to be clever at all to figure out which MmapRegions are
malloc blocks, we can just mark the containing region as such when
the emulated process performs a malloc! :^)
|
|
This patch introduces the concept of shadow bits. For every byte of
memory there is a corresponding shadow byte that contains metadata
about that memory.
Initially, the only metadata is whether the byte has been initialized
or not. That's represented by the least significant shadow bit.
Shadow bits travel together with regular values throughout the entire
CPU and MMU emulation. There are two main helper classes to facilitate
this: ValueWithShadow and ValueAndShadowReference.
ValueWithShadow<T> is basically a struct { T value; T shadow; } whereas
ValueAndShadowReference<T> is struct { T& value; T& shadow; }.
The latter is used as a wrapper around general-purpose registers, since
they can't use the plain ValueWithShadow memory as we need to be able
to address individual 8-bit and 16-bit subregisters (EAX, AX, AL, AH.)
Whenever a computation is made using uninitialized inputs, the result
is tainted and becomes uninitialized as well. This allows us to track
this state as it propagates throughout memory and registers.
This patch doesn't yet keep track of tainted flags, that will be an
important upcoming improvement to this.
I'm sure I've messed up some things here and there, but it seems to
basically work, so we have a place to start! :^)
|
|
|
|
This patch introduces a "MallocTracer" to the UserspaceEmulator.
If this object is present on the Emulator, it can be notified whenever
the emulated program does a malloc() or free().
The notifications come in via a magic instruction sequence that we
embed in the LibC malloc() and free() functions. The sequence is:
"salc x2, push reg32 x2, pop reg32 x3"
The data about the malloc/free operation is in the three pushes.
We make sure the sequence is harmless when running natively.
Memory accesses on MmapRegion are then audited to see if they fall
inside a known-to-be-freed malloc chunk. If so, we complain loud
and red in the debugger output. :^)
This is very, very cool! :^)
It's also a whole lot slower than before, since now we're auditing
memory accesses against a new set of metadata. This will need to be
optimized (and running in this mode should be opt-in, perhaps even
a separate program, etc.)
|
|
MmapRegion now supports using an mmap'ed file descriptor as backing.
|
|
Here's the first time we get a taste of better information than the
real hardware can give us: unlike x86 CPUs, we can actually support
write-only memory, so now we do!
While this isn't immediately useful, it's still pretty cool. :^)
|
