Commit graph

651 commits

Author SHA1 Message Date
Andreas Kling
3dc1c80958 UserspaceEmulator: Print the number of bytes leaked on exit :^) 2020-07-16 19:21:45 +02:00
Andreas Kling
c13da77e85 UserspaceEmulator: Add TLS regions to reachability checking 2020-07-16 19:21:45 +02:00
Andreas Kling
1dcc21d32e UserspaceEmulator: Include malloc/free backtraces in UAF logs :^)
When catching a use-after-free, we now also print out the backtraces
for where the memory was allocated, and for where it was freed.

This will be extremely helpful for debugging.
2020-07-16 19:21:45 +02:00
Andreas Kling
dd68370efc UserspaceEmulator: Put the memory reachability logging behind a macro 2020-07-16 19:21:45 +02:00
Andreas Kling
441918be7e UserspaceEmulator: Capture backtraces of malloc/free events
This lets us show backtraces for each leaked mallocation in the leak
report at the end. :^)
2020-07-16 19:21:45 +02:00
Andreas Kling
f6584bfc36 UserspaceEmulator: Implement very basic leak checking :^)
Upon exit, the emulator will now print a leak report of any malloc
allocations that are still live and don't have pointers to their base
address anywhere in either another live mallocation, or in one of the
non-malloc-block memory regions.

Note that the malloc-block memory region check is not fully functional
and this will work even better once we get that fixed.

This is pretty cool. :^)
2020-07-16 19:21:45 +02:00
Andreas Kling
7e13244238 UserspaceEmulator: Add ways to check if a Region is stack/mmap 2020-07-16 19:21:45 +02:00
Andreas Kling
9f1221c785 UserspaceEmulator: Implement the ROL/ROR/RCL/RCR instructions 2020-07-16 19:21:45 +02:00
Andreas Kling
897af8b4f7 UserspaceEmulator: Implement more SHLD/SHRD variants 2020-07-16 19:21:45 +02:00
Andreas Kling
db1929e3ff UserspaceEmulator: Make the shift/rotate instructions more generic 2020-07-16 19:21:45 +02:00
Tom
65a11fb5f9 LibGUI: Add InputBox::show with required parent window argument
Similar to MessageBox::show, this encourages passing in a window.
2020-07-16 16:10:21 +02:00
Tom
27bd2eab22 LibWeb: Require parent window argument for MessageBox
Since the vast majority of message boxes should be modal, require
the parent window to be passed in, which can be nullptr for the
rare case that they don't. By it being the first argument, the
default arguments also don't need to be explicitly stated in most
cases, and it encourages passing in a parent window handle.

Fix up several message boxes that should have been modal.
2020-07-16 16:10:21 +02:00
Tom
6568765e8f LibGUI: Add parent window argument to FilePicker functions
Since FilePicker almost always should be modal, add the parent
window as mandatory first argument.
2020-07-16 16:10:21 +02:00
Andreas Kling
acfae91032 UserspaceEmulator: Fix incorrect SALC behavior
As @tzoz pointed out, SALC should set AL to 0xff when CF=1, not 0x01.

Fixes #2819.
2020-07-16 00:50:55 +02:00
Andreas Kling
323ec4c2ca UserspaceEmulator: Let's say "Use-after-free" instead of "UAF"
I don't know why I went with the compact format here.
2020-07-16 00:50:55 +02:00
Andreas Kling
67cdbe1925 UserspaceEmulator: Cache the location and size of "malloc" and "free"
This allows us to quickly skip some auditing checks while we're inside
malloc/free themselves.
2020-07-16 00:24:11 +02:00
Andreas Kling
c7cf87c9f8 UserspaceEmulator: Don't complain about free(nullptr) 2020-07-15 23:53:58 +02:00
Andreas Kling
33e3e8d63d UserspaceEmulator: Add the getrandom() syscall 2020-07-15 23:44:51 +02:00
Andreas Kling
1873b8f3e4 UserspaceEmulator: Fix bogus use of "errno" in shbuf related syscalls
When we're making direct syscalls, there's no "errno" involved.
Thanks to Sergey for spotting these.
2020-07-15 23:43:38 +02:00
Andreas Kling
092f643119 UserspaceEmulator: Log invalid and double free() calls :^)
We can easily catch free() on never-malloced addresses, as well as
double calls to free() on the same address, so let's do it!
2020-07-15 23:25:20 +02:00
Andreas Kling
c314292319 UserspaceEmulator: Catch use-after-frees by tracking malloc/free :^)
This patch introduces a "MallocTracer" to the UserspaceEmulator.
If this object is present on the Emulator, it can be notified whenever
the emulated program does a malloc() or free().

The notifications come in via a magic instruction sequence that we
embed in the LibC malloc() and free() functions. The sequence is:

    "salc x2, push reg32 x2, pop reg32 x3"

The data about the malloc/free operation is in the three pushes.
We make sure the sequence is harmless when running natively.

Memory accesses on MmapRegion are then audited to see if they fall
inside a known-to-be-freed malloc chunk. If so, we complain loud
and red in the debugger output. :^)

This is very, very cool! :^)

It's also a whole lot slower than before, since now we're auditing
memory accesses against a new set of metadata. This will need to be
optimized (and running in this mode should be opt-in, perhaps even
a separate program, etc.)
2020-07-15 23:25:20 +02:00
Andreas Kling
c8b496162d UserspaceEmulator: Add some more syscalls :^)
Here's set_process_icon(), gettimeofday() and clock_gettime().
2020-07-15 18:47:45 +02:00
Andreas Kling
feebe3f42e UserspaceEmulator: Add partial support for the SHLD/SHRD instructions
We don't support all the addressing modes yet, but it won't be very
hard to add the rest of them when needed.
2020-07-15 18:47:45 +02:00
Andreas Kling
2da44dba44 UserspaceEmulator: Add support for shared buffers (shbuf)
We track these separately from regular mmap() regions, as they have
slightly different behaviors.
2020-07-15 18:47:45 +02:00
Andreas Kling
0ce4d3e942 UserspaceEmulator: Dump backtrace on FPU instruction 2020-07-15 18:47:45 +02:00
Andreas Kling
76b2a2789b UserspaceEmulator: Implement MUL_RM32 2020-07-15 18:47:45 +02:00
Andreas Kling
029fe56d69 UserspaceEmulator: Implement the 32-bit BSWAP instruction :^) 2020-07-15 18:47:45 +02:00
Andreas Kling
339f12e8a2 UserspaceEmulator: Implement an assortment of system calls
Here goes mkdir(), unlink(), socket(), getsockopt(), fchmod()
bind(), connect(), listen(), select() and recvfrom().

They're not perfect but they seem to work. :^)
2020-07-15 18:47:45 +02:00
Andreas Kling
0781868092 UserspaceEmulator: Implement IDIV_RM32 2020-07-15 13:42:15 +02:00
Andreas Kling
400a252720 UserspaceEmulator: Implement the CBW/CDQ/CWD/CWDE instructions 2020-07-15 13:42:15 +02:00
Andreas Kling
6a926a8c61 LibX86+UserspaceEmulator: Don't store a32 in MemoryOrRegisterReference
The a32 bit tells us whether a memory address is 32-bit or not.
We already have this information in Instruction, so just plumb that
around instead of double-caching the bit.
2020-07-15 13:42:15 +02:00
Sergey Bugaev
e12b591509 UserspaceEmulator: Implement virt$pipe() 2020-07-15 13:41:46 +02:00
thankyouverycool
b2783a234a LibGUI: Use enum for TextEditor modes & add new DisplayOnly mode
Adds a new, more restrictive read-only state to TextEditor which
forbids copying, selecting, editor cursors, and context menus.
Provides a unique appearance on focus which accomodates ComboBox
widgets. All TextEditor modes are now accessed by enum and
set_mode() which sets the editor to Editable, ReadOnly or
DisplayOnly. Updates applications still using set_readonly().
2020-07-15 13:19:44 +02:00
Andreas Kling
ef84865c8c LibX86+UserspaceEmulator: Devirtualize and inline more instruction code
Use some template hacks to force GCC to inline more of the instruction
decoding stuff into the UserspaceEmulator main execution loop.

This is my last optimization for today, and we've gone from ~60 seconds
when running "UserspaceEmulator UserspaceEmulator id" to ~8 seconds :^)
2020-07-13 21:00:51 +02:00
Andreas Kling
f608b9d89a UserspaceEmulator: Mark some generic instructions ALWAYS_INLINE :^) 2020-07-13 20:47:45 +02:00
Andreas Kling
2f81c20002 UserspaceEmulator: Move the SoftCPU stream virtuals to the header
They don't actually get inlined yet, but at least this devirtualizes
them which is nice.
2020-07-13 20:41:48 +02:00
Andreas Kling
a27473cbc2 UserspaceEmulator+LibX86: Turn on -O3 optimization for emulation code
Since this code is performance-sensitive, let's have the compiler do
whatever it can to help us with the most important files.

This yields a ~8% speedup.
2020-07-13 20:23:00 +02:00
Andreas Kling
8656835935 UserspaceEmulator: Add a very simple instruction fetch cache
To avoid MMU region lookup on every single instruction fetch, we now
cache a raw pointer to the current instruction. This gets automatically
invalidated when we jump somewhere, but as long as we're executing
sequentially, instruction fetches will hit the cache and bypass all
the region lookup stuff.

This is about a ~2x speedup. :^)
2020-07-13 20:14:14 +02:00
Andreas Kling
a83fe7f82d UserspaceEmulator: Add the POPFD instruction
I'm not sure the mask I'm using here is completely correct, but it's
not terribly important since we're a userspace-only emulator anyway.
2020-07-13 13:50:22 +02:00
Andreas Kling
dba6f9b24b UserspaceEmulator: Add the NOT instruction (with bonus: NOP!) 2020-07-13 13:50:22 +02:00
Andreas Kling
5ecbfd8451 UserspaceEmulator: Add the STC/CLC and STD/CLD instructions 2020-07-13 13:50:22 +02:00
Andreas Kling
9f293054e8 UserspaceEmulator: Implement the ADC instruction 2020-07-13 13:50:22 +02:00
Andreas Kling
6230c60296 UserspaceEmulator: Make SBB actually respect the SoftCPU carry flag
We were forgetting to set the host CPU's carry flag before executing
the SBB instruction. This made the result a bit unpredictable. :^)
2020-07-13 13:50:22 +02:00
Andreas Kling
a9f92e5d75 UserspaceEmulator: Remove an unnecessary step in some instructions
We don't need to move the result of shifts around like this, we can
just use inline assembly outputs to make it end up in the right place.
2020-07-13 13:50:22 +02:00
Andreas Kling
80d3306840 UserspaceEmulator: Fix wrong ESI/EDI step sizes in MOVSW and MOVSD 2020-07-13 13:50:22 +02:00
Andreas Kling
e0580e2975 UserspaceEmulator: Add some more syscalls
We can now unmap mapped memory, among other things. This is all very
ad-hoc as I'm trying to run UserspaceEmulator inside itself. :^)
2020-07-13 13:50:22 +02:00
Andreas Kling
9b6464010f UserspaceEmulator: Add basic support for memory-mapped files
MmapRegion now supports using an mmap'ed file descriptor as backing.
2020-07-13 13:50:22 +02:00
Andreas Kling
63d3f5d19b UserspaceEmulator: Implement the PUSHFD instruction 2020-07-13 13:50:22 +02:00
Andreas Kling
f6ad5edab0 UserspaceEmulator: Make mmap'ed memory track read/write protection
Here's the first time we get a taste of better information than the
real hardware can give us: unlike x86 CPUs, we can actually support
write-only memory, so now we do!

While this isn't immediately useful, it's still pretty cool. :^)
2020-07-13 13:50:22 +02:00
Andreas Kling
27c1690504 UserspaceEmulator: Pass arguments through to emulated process
Ultimately we'll want to support passing some options to the emulator
as well, but for now just pass all arguments (except argv[0] of course)
through to the emulated process.

This is still not perfect, but slightly better than what we had before.
2020-07-13 13:50:22 +02:00