Commit Graph

883 Commits

Author SHA1 Message Date
Shivam7-1
ada8091ccc Fix heap buffer overflow in op_cksm function (#2096)
* Fix heap-buffer-overflow in op_cksm function

* Update header
2025-02-10 14:57:08 +08:00
xndcn
1ba25def8e Fix UC_HOOK_MEM on arm32 (#2091) 2025-01-26 13:28:24 +08:00
ZakDanger
d7c0497ee3 Added start in mips16 mode support, and unit test for it - on dev branch (#2089)
Co-authored-by: ZakDanger <ZakDanger@users.noreply.github.com>
2025-01-19 17:35:40 +08:00
0c512f91a1 Fix #1643
This adds an extra op to translator to allow the block hook sync pc in the very begining
2025-01-18 15:07:22 +08:00
Z. Liu
a78d690da5 configure: add <sys/timex.h> for clock_adjtime on musl (#2085)
for glibc, if _GNU_SOURCE is defined, <time.h> will include <sys/timex.h>
but not for musl, so add "#include <sys/timex.h>"

although `man clock_adjtime` said "#include <sys/timex.h>", but it won't
work for glibc w/o "#include <time.h>", I don't known why yet.

PS it seems clock_adjtime is used nowhere?

Signed-off-by: Z. Liu <zhixu.liu@gmail.com>
2025-01-14 08:47:54 +08:00
Glenn Baker
8442eb6feb qemu/tcg: fix UC_HOOK_MEM_READ on aarch64. (#2028)
* qemu/tcg: fix UC_HOOK_MEM_READ on aarch64.

Directly jump into the slow path when there is any hookmem enabled. This
fixes #1908.

Signed-off-by: Glenn Baker <glenn.baker@gmx.com>

* qemu/tcg: fix UC_HOOK_MEM_READ on ppc64.

Directly jump into the slow path when there is any hookmem enabled.

Signed-off-by: Glenn Baker <glenn.baker@gmx.com>

* qemu/tcg: check for UC_HOOK_MEM_READ_AFTER.

Use has_hookmem() helper to determine wether "slow-path" TLB read is
needed. Add this helper to x86 architecture as well so that to check for
all hookmem.

Signed-off-by: Glenn Baker <glenn.baker@gmx.com>

* qemu/tcg: factor out has_hookmem().

It's the same implementation for all architectures, so factor out
has_hookmem() into tcg_uc_has_hookmem().

Signed-off-by: Glenn Baker <glenn.baker@gmx.com>

---------

Signed-off-by: Glenn Baker <glenn.baker@gmx.com>
2025-01-04 18:48:53 +08:00
mio
2c688bae73 Remove the outdated hack to zero all code gen buffer
This shall also improve performance

Fix #2001
2025-01-04 17:05:34 +08:00
EvianZhang
e97d084aec Add more EIP syncs for x86 target memory hooks (#2064)
Co-authored-by: lazymio <mio@lazym.io>
2025-01-04 15:59:20 +08:00
mio
6974b53588 Fix #2078
We shall only go through the else branch for code_read
2025-01-04 15:57:02 +08:00
mio
fcca82bb28 Format code 2025-01-04 15:48:54 +08:00
Michael-c0de
4f417c3f11 patch multiple UC_HOOK_MEM callbacks for unaligned access (#2063)
* patch multiple UC_HOOK_MEM callbacks for unaligned access

* update test_x86.c for #2063

* update test_x86.c for build on win

---------

Co-authored-by: yaojiale2024@iscas.ac.cn <yaojiale2024@iscas.ac.cn>
Co-authored-by: lazymio <mio@lazym.io>
2024-12-29 23:24:32 +08:00
Pedro Tôrres
7737e7b436 make i386 instructions RDTSC and RDTSCP hookable (#2066)
* instruction hooks for RDTSC and RDTSCP

Signed-off-by: Pedro Tôrres <t0rr3sp3dr0@gmail.com>

* update hookable instruction list

Signed-off-by: Pedro Tôrres <t0rr3sp3dr0@gmail.com>

* test RDTSC and RDTSCP instruction hooks

Signed-off-by: Pedro Tôrres <t0rr3sp3dr0@gmail.com>

---------

Signed-off-by: Pedro Tôrres <t0rr3sp3dr0@gmail.com>
Co-authored-by: mio <mio@lazym.io>
2024-12-20 17:17:23 +08:00
mio
1cbb7b40b2 Allow have_pthread_jit_protect but not have_sprr_mrs 2024-12-20 01:04:50 +08:00
mio
a540df45a6 Only enable SPRR on physical machines 2024-12-20 00:57:19 +08:00
mio
1ad2da35e6 Fix QEMU_UNUSED_FUNC 2024-12-20 00:50:11 +08:00
13a8da8538 Check SPRR by issuing MRS 2024-12-08 14:46:28 +08:00
958ed09153 No longer need SPRR and probe it runtime 2024-12-07 23:33:34 +08:00
b0b412bc6c Only enable JIT protect support with SPRR 2024-12-07 22:35:28 +08:00
69200d4f00 Fix regression: If invalid instruction is handled, allow emulation to continue 2024-12-07 17:30:45 +08:00
3b2f54fc61 Fix regression: We should triage MIPS internal exceptions to Unicorn exceptions 2024-12-07 17:09:59 +08:00
c22651c9fe Fix regression: We should also sync npc for SPARC 2024-12-07 16:31:20 +08:00
9ec1f604dc Fix regression: Setting eflags within the hook should take effect
This add an extra compute_eflags after the hooks
2024-12-07 15:56:56 +08:00
Martin Atkins
7d8fe2ab11 riscv: Expose privilege level as pseudo-register PRIV (#1989)
Unlike some other architectures, RISC-V does not expose the current
privilege mode in any architecturally-defined register. That is intentional
to make it easier to implement virtualization in software, but a Unicorn
caller operates outside of the emulated hart and so it can and should be
able to observe and change the current privilege mode in order to properly
emulate certain behaviors of a real CPU.

The current privilege level is therefore now exposed as a new
pseudo-register using the name "priv", which matches the name of the
virtual register used by RISC-V's debug extension to allow the debugger
to read and change the privilege mode while the hart is halted. Unicorn's
use of it is conceptually similar to a debugger.

The bit encoding of this register is the same as specified in RISC-V Debug
Specification v1.0-rc3 Section 4.10.1. It's defined as a "virtual"
register exposing a subset of fields from the dcsr register, although here
it's implemented directly inside the Unicorn code because QEMU doesn't
currently have explicit support for the CSRs from the debug specification.
If it supports "dcsr" in a future release then this implementation could
change to wrap reading and writing that CSR and then projecting the "prv"
and "v" bitfields into the correct locations for the virtual register.
2024-11-11 21:09:45 +08:00
tbodt
f71bc1a115 Several bugfixes (#2049)
* Remove global variable from aarch64 tcg target

This obviously breaks trying to run two unicorn instances at once on
aarch64. It appears a similar variable had already been moved to the
state struct for i386 tcg target.

* Reenable writing to jit region while calling tb_add_jump

On arm macs, every place that writes to jit code needs to have
tb_exec_unlock called first. This is already in most necessary places,
but not this one.

* Don't forget to call restore_jit_state in uc_context_restore

Every time UC_INIT is used, restore_jit_state must be used on the return
path, or occasional assertion failures will pop up on arm macs.

* Restore pc before calling into tlb fill hook

In my application it is important to have correct pc values available
from this hook.
2024-11-04 12:53:26 +08:00
PhilippTakacs
ab23d4ceb0 Optimize Notdirty write (#2031)
* enable notdirty_write for snapshots when possible

Snapshots only happens when the priority of the memory region is smaller
then the snapshot_level. After a snapshot notdirty can be set.

* disable notdirty_write for self modifying code

When SMC access the memory region more then once the
tb must be rebuild multible times.

fixes #2029

* notdirty_write better hook check

Check all relevant memory hooks before enabling notdirty write.
This also checks if the memory hook is registered for the affected
region. So it is possible to use notdirty write and have some hooks
on different addresses.

* notdirty_write check for addr_write in snapshot case

* self modifying code clear recursive mem access

when self modifying code does unaligned memory accese sometimes
uc->size_recur_mem is changed but for notdirty write not changed back.
This causes mem_hooks to be missed. To fix this uc->size_recur_mem is
set to 0 before each cpu_exec() call.
2024-11-01 00:02:11 +08:00
mio
c42cc0fe86 More 16-bits aligned cpu state targets 2024-10-17 16:33:59 +08:00
mio
ffeddd7579 use qemu_memalign for all cpu structs
Some structs, specically CPUARMState is 16-bytes aligned.

This causes segment fault because gcc tends to vectorize

the assignment of the struct with infamous movaps tricks.

Without this patch, we fail on manylinux with 2.17 glibc

in release mode in i686.

qemu_memalign will ensure the alignment across platforms.
2024-10-17 13:50:07 +08:00
PhilippTakacs
e8ca3cbea5 Optimize memory handling (#1963)
* optimize ram block handling

Save the last element of the ram_list. This allows to
faster find where to add new elements when they are not
bigger then page size.

* save ram_list freed

this keeps the optimization for find_ram_offset() intact after snapshot
restore.

* cow only clear the tlb of affected pages

* update flatview when possible

Building each flatview new when the memory has changed is quite
expensive when many MemoryRegions are used. This is an issue when using
snapshots.

* update benchmark for new api

* save flatview in context

this avoids rebuilding the flatview when restore a context.

* init context flatview with zero

* address_space_dispatch_clear remove subpage with higher priority

* docutemnt the options for UC_CTL_CONTEXT_MODE

Specialy stress that with UC_CTL_CONTEXT_MEMORY it is not possible to
use the context with a different unicorn object.
2024-10-16 21:51:13 +08:00
0886e53572 Format code 2024-10-06 23:32:16 +08:00
851914c8d0 Fix segfault if tlb is flushed in the hooks 2024-10-06 23:31:46 +08:00
mio
05e29b4507 Implement UC_ARM64_REG_WSP 2024-10-02 16:03:59 +08:00
mio
d30ba77c71 Refine warning 2024-10-02 16:03:58 +08:00
mio
9f935f505e Revert previous break changes that return UC_ERR_ARG for non-existing registers
But print a warning instead
2024-10-02 16:03:58 +08:00
elicn
ff06b145e1 Fix I0-7 registers write 2024-09-30 18:52:37 +03:00
elicn
9af1df6543 Add read and write support for i386 ZMM0-31 2024-09-28 22:17:06 +03:00
elicn
5164dbd609 Add read and write support for i386 YMM8-31 2024-09-28 22:16:45 +03:00
elicn
e3675162ba Add read and write support for i386 XMM16-31 2024-09-28 22:15:00 +03:00
elicn
6cb9bfe5c0 Avoid updating CR3 when writing CR1 and CR2 2024-09-28 22:11:54 +03:00
elicn
433bb163d9 Add read and write cases for i386 CR8 2024-09-28 22:11:01 +03:00
mio
d87791329f Add a cmake option 2024-09-21 22:16:02 +08:00
mio
80f0898740 Merge remote-tracking branch 'bits/revive-qemu-logs' into dev 2024-09-21 22:09:07 +08:00
mio
920d076e51 Remove page-collection-locs 2024-09-21 22:03:44 +08:00
mio
6cc7e1d431 Also only reset if hooks are installed 2024-09-21 21:52:38 +08:00
mio
8816883bb3 Fix TLB for snapshots 2024-09-21 21:49:01 +08:00
mio
2cd227f804 Update symbols for tlb_reset_dirty_by_vaddr 2024-09-21 20:54:24 +08:00
mio
8f74405031 Update symbols 2024-09-21 20:51:35 +08:00
Andrei Warkentin
d01035767e notdirty_write: fix store-related performance problems
Every store would always cause the tb_invalidate_phys_page_fast path to be invoked,
amounting to a 40x slowdown of stores compared to loads.

Change this code to only worry about TB invalidation for regions marked as
executable (i.e. emulated executable).

Even without uc_set_native_thunks, this change fixes most of the performance
issues seen with thunking to native calls.

Signed-off-by: Andrei Warkentin <andrei.warkentin@intel.com>
2024-09-21 20:50:43 +08:00
9427f0a553 Merge pull request #1991 from apparentlymart/b-riscv-invalidinsn-pcadj
riscv: Invalid 32-bit instruction should not decrement pc
2024-09-21 18:26:59 +08:00
mio
a5fa548049 Fix qemu_vfree implementation on MINGW
Also correctly release bounce.buffer
2024-09-21 17:58:15 +08:00
Jose Martins
58f1a612e8 target/riscv: fix wfi exception behavior
The wfi exception trigger behavior should take into account user mode,
hstatus.vtw, and the fact the an wfi might raise different types of
exceptions depending on various factors:

If supervisor mode is not present:

- an illegal instruction exception should be generated if user mode
executes and wfi instruction and mstatus.tw = 1.

If supervisor mode is present:

- when a wfi instruction is executed, an illegal exception should be triggered
if either the current mode is user or the mode is supervisor and mstatus.tw is
set.

Plus, if the hypervisor extensions are enabled:

- a virtual instruction exception should be raised when a wfi is executed from
virtual-user or virtual-supervisor and hstatus.vtw is set.

Signed-off-by: Jose Martins <josemartins90@gmail.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20210420213656.85148-1-josemartins90@gmail.com
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2024-09-03 13:44:55 -07:00