From nobody Tue Feb 10 23:00:45 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) client-ip=208.118.235.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Authentication-Results: mx.zohomail.com; spf=pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists.gnu.org (lists.gnu.org [208.118.235.17]) by mx.zohomail.com with SMTPS id 1507819049198459.2213110549677; Thu, 12 Oct 2017 07:37:29 -0700 (PDT) Received: from localhost ([::1]:45870 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1e2ebp-0000n2-CC for importer@patchew.org; Thu, 12 Oct 2017 10:37:13 -0400 Received: from eggs.gnu.org ([2001:4830:134:3::10]:43622) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1e2eaZ-0000EW-ME for qemu-devel@nongnu.org; Thu, 12 Oct 2017 10:35:56 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1e2eaY-0002GQ-Jj for qemu-devel@nongnu.org; Thu, 12 Oct 2017 10:35:55 -0400 Received: from mx1.redhat.com ([209.132.183.28]:44232) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1e2eaY-0002GB-BT for qemu-devel@nongnu.org; Thu, 12 Oct 2017 10:35:54 -0400 Received: from smtp.corp.redhat.com (int-mx06.intmail.prod.int.phx2.redhat.com [10.5.11.16]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id 69150C0828BA; Thu, 12 Oct 2017 14:35:53 +0000 (UTC) Received: from donizetti.redhat.com (ovpn-116-77.ams2.redhat.com [10.36.116.77]) by smtp.corp.redhat.com (Postfix) with ESMTP id 9EE5B5C88D; Thu, 12 Oct 2017 14:35:52 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mx1.redhat.com 69150C0828BA Authentication-Results: ext-mx07.extmail.prod.ext.phx2.redhat.com; dmarc=none (p=none dis=none) header.from=redhat.com Authentication-Results: ext-mx07.extmail.prod.ext.phx2.redhat.com; spf=fail smtp.mailfrom=pbonzini@redhat.com From: Paolo Bonzini To: qemu-devel@nongnu.org Date: Thu, 12 Oct 2017 16:35:48 +0200 Message-Id: <20171012143548.18581-3-pbonzini@redhat.com> In-Reply-To: <20171012143548.18581-1-pbonzini@redhat.com> References: <20171012143548.18581-1-pbonzini@redhat.com> X-Scanned-By: MIMEDefang 2.79 on 10.5.11.16 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.31]); Thu, 12 Oct 2017 14:35:53 +0000 (UTC) X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] [fuzzy] X-Received-From: 209.132.183.28 Subject: [Qemu-devel] [PATCH 2/2] target/i386: trap on instructions longer than >15 bytes X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: richard.henderson@linaro.org Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: "Qemu-devel" X-ZohoMail: RSF_0 Z_629925259 SPT_0 Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Besides being more correct, arbitrarily long instruction allow the generation of a translation block that spans three pages. This confuses the generator and even allows ring 3 code to poison the translation block cache and inject code into other processes that are in guest ring 3. This is an improved (and more invasive) fix for the bug fixed in commit 30663fd ("tcg/i386: Check the size of instruction being translated", 2017-03-24). In addition to being more precise (and generating the right exception, which is #GP rather than #UD), it distinguishes better between page faults and too long instructions, as shown by this test case: #include #include #include int main() { char *x =3D mmap(NULL, 8192, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_ANON, -1, 0); memset(x, 0x66, 4096); x[4096] =3D 0x90; x[4097] =3D 0xc3; char *i =3D x + 4096 - 15; mprotect(x + 4096, 4096, PROT_READ|PROT_WRITE); ((void(*)(void)) i) (); } ... which produces a #GP without the mprotect, and a #PF with it. Signed-off-by: Paolo Bonzini Reviewed-by: Richard Henderson --- target/i386/translate.c | 29 ++++++++++++++++++++++------- 1 file changed, 22 insertions(+), 7 deletions(-) diff --git a/target/i386/translate.c b/target/i386/translate.c index 4a938c21a0..5f24a2de3c 100644 --- a/target/i386/translate.c +++ b/target/i386/translate.c @@ -136,6 +136,7 @@ typedef struct DisasContext { int cpuid_ext3_features; int cpuid_7_0_ebx_features; int cpuid_xsave_features; + sigjmp_buf jmpbuf; } DisasContext; =20 static void gen_eob(DisasContext *s); @@ -1863,11 +1864,27 @@ static void gen_shifti(DisasContext *s1, int op, TC= GMemOp ot, int d, int c) } } =20 +#define X86_MAX_INSN_LENGTH 15 + static uint64_t advance_pc(CPUX86State *env, DisasContext *s, int num_byte= s) { uint64_t pc =3D s->pc; =20 s->pc +=3D num_bytes; + if (unlikely(s->pc - s->pc_start > X86_MAX_INSN_LENGTH)) { + /* If the instruction's 16th byte is on a different page than the = 1st, a + * page fault on the second page wins over the general protection = fault + * caused by the instruction being too long. + * This can happen even if the operand is only one byte long! + */ + if (((s->pc - 1) ^ (pc - 1)) & TARGET_PAGE_MASK) { + volatile uint8_t unused =3D + cpu_ldub_code(env, (s->pc - 1) & TARGET_PAGE_MASK); + (void) unused; + } + siglongjmp(s->jmpbuf, 1); + } + return pc; } =20 @@ -4463,14 +4480,12 @@ static target_ulong disas_insn(DisasContext *s, CPU= State *cpu) s->rip_offset =3D 0; /* for relative ip address */ s->vex_l =3D 0; s->vex_v =3D 0; - next_byte: - /* x86 has an upper limit of 15 bytes for an instruction. Since we - * do not want to decode and generate IR for an illegal - * instruction, the following check limits the instruction size to - * 25 bytes: 14 prefix + 1 opc + 6 (modrm+sib+ofs) + 4 imm */ - if (s->pc - pc_start > 14) { - goto illegal_op; + if (sigsetjmp(s->jmpbuf, 0) !=3D 0) { + gen_exception(s, EXCP0D_GPF, pc_start - s->cs_base); + return s->pc; } + + next_byte: b =3D x86_ldub_code(env, s); /* Collect prefixes. */ switch (b) { --=20 2.14.2