mirror of
https://github.com/RGBCube/serenity
synced 2025-05-18 18:35:06 +00:00

This patch introduces a "MallocTracer" to the UserspaceEmulator. If this object is present on the Emulator, it can be notified whenever the emulated program does a malloc() or free(). The notifications come in via a magic instruction sequence that we embed in the LibC malloc() and free() functions. The sequence is: "salc x2, push reg32 x2, pop reg32 x3" The data about the malloc/free operation is in the three pushes. We make sure the sequence is harmless when running natively. Memory accesses on MmapRegion are then audited to see if they fall inside a known-to-be-freed malloc chunk. If so, we complain loud and red in the debugger output. :^) This is very, very cool! :^) It's also a whole lot slower than before, since now we're auditing memory accesses against a new set of metadata. This will need to be optimized (and running in this mode should be opt-in, perhaps even a separate program, etc.)
173 lines
5.2 KiB
C++
173 lines
5.2 KiB
C++
/*
|
|
* Copyright (c) 2020, Andreas Kling <kling@serenityos.org>
|
|
* All rights reserved.
|
|
*
|
|
* Redistribution and use in source and binary forms, with or without
|
|
* modification, are permitted provided that the following conditions are met:
|
|
*
|
|
* 1. Redistributions of source code must retain the above copyright notice, this
|
|
* list of conditions and the following disclaimer.
|
|
*
|
|
* 2. Redistributions in binary form must reproduce the above copyright notice,
|
|
* this list of conditions and the following disclaimer in the documentation
|
|
* and/or other materials provided with the distribution.
|
|
*
|
|
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
|
|
* AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
|
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
|
|
* DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
|
|
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
|
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
|
|
* SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
|
|
* CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
|
|
* OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
|
|
* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
|
*/
|
|
|
|
#include "MmapRegion.h"
|
|
#include "Emulator.h"
|
|
#include <sys/mman.h>
|
|
|
|
namespace UserspaceEmulator {
|
|
|
|
NonnullOwnPtr<MmapRegion> MmapRegion::create_anonymous(u32 base, u32 size, u32 prot)
|
|
{
|
|
auto region = adopt_own(*new MmapRegion(base, size, prot));
|
|
region->m_file_backed = false;
|
|
region->m_data = (u8*)calloc(1, size);
|
|
return region;
|
|
}
|
|
|
|
NonnullOwnPtr<MmapRegion> MmapRegion::create_file_backed(u32 base, u32 size, u32 prot, int flags, int fd, off_t offset)
|
|
{
|
|
auto region = adopt_own(*new MmapRegion(base, size, prot));
|
|
region->m_file_backed = true;
|
|
region->m_data = (u8*)mmap(nullptr, size, prot, flags, fd, offset);
|
|
ASSERT(region->m_data != MAP_FAILED);
|
|
return region;
|
|
}
|
|
|
|
MmapRegion::MmapRegion(u32 base, u32 size, int prot)
|
|
: Region(base, size)
|
|
, m_prot(prot)
|
|
{
|
|
}
|
|
|
|
MmapRegion::~MmapRegion()
|
|
{
|
|
if (m_file_backed)
|
|
munmap(m_data, size());
|
|
else
|
|
free(m_data);
|
|
}
|
|
|
|
bool MmapRegion::is_malloc_block() const
|
|
{
|
|
// FIXME: This is obviously incomplete!
|
|
// We should somehow know which mmap regions are malloc blocks.
|
|
return !m_file_backed;
|
|
}
|
|
|
|
u8 MmapRegion::read8(FlatPtr offset)
|
|
{
|
|
if (!is_readable()) {
|
|
warn() << "8-bit read from unreadable MmapRegion @ " << (const void*)(base() + offset);
|
|
Emulator::the().dump_backtrace();
|
|
TODO();
|
|
}
|
|
|
|
if (is_malloc_block()) {
|
|
if (auto* tracer = Emulator::the().malloc_tracer())
|
|
tracer->audit_read(base() + offset, 1);
|
|
}
|
|
|
|
ASSERT(offset < size());
|
|
return *reinterpret_cast<const u8*>(m_data + offset);
|
|
}
|
|
|
|
u16 MmapRegion::read16(u32 offset)
|
|
{
|
|
if (!is_readable()) {
|
|
warn() << "16-bit from unreadable MmapRegion @ " << (const void*)(base() + offset);
|
|
Emulator::the().dump_backtrace();
|
|
TODO();
|
|
}
|
|
|
|
if (is_malloc_block()) {
|
|
if (auto* tracer = Emulator::the().malloc_tracer())
|
|
tracer->audit_read(base() + offset, 2);
|
|
}
|
|
|
|
ASSERT(offset + 1 < size());
|
|
return *reinterpret_cast<const u16*>(m_data + offset);
|
|
}
|
|
|
|
u32 MmapRegion::read32(u32 offset)
|
|
{
|
|
if (!is_readable()) {
|
|
warn() << "32-bit read from unreadable MmapRegion @ " << (const void*)(base() + offset);
|
|
Emulator::the().dump_backtrace();
|
|
TODO();
|
|
}
|
|
|
|
if (is_malloc_block()) {
|
|
if (auto* tracer = Emulator::the().malloc_tracer())
|
|
tracer->audit_read(base() + offset, 4);
|
|
}
|
|
|
|
ASSERT(offset + 3 < size());
|
|
return *reinterpret_cast<const u32*>(m_data + offset);
|
|
}
|
|
|
|
void MmapRegion::write8(u32 offset, u8 value)
|
|
{
|
|
if (!is_writable()) {
|
|
warn() << "8-bit write to unreadable MmapRegion @ " << (const void*)(base() + offset);
|
|
Emulator::the().dump_backtrace();
|
|
TODO();
|
|
}
|
|
|
|
if (is_malloc_block()) {
|
|
if (auto* tracer = Emulator::the().malloc_tracer())
|
|
tracer->audit_write(base() + offset, 1);
|
|
}
|
|
|
|
ASSERT(offset < size());
|
|
*reinterpret_cast<u8*>(m_data + offset) = value;
|
|
}
|
|
|
|
void MmapRegion::write16(u32 offset, u16 value)
|
|
{
|
|
if (!is_writable()) {
|
|
warn() << "16-bit write to unreadable MmapRegion @ " << (const void*)(base() + offset);
|
|
Emulator::the().dump_backtrace();
|
|
TODO();
|
|
}
|
|
|
|
if (is_malloc_block()) {
|
|
if (auto* tracer = Emulator::the().malloc_tracer())
|
|
tracer->audit_write(base() + offset, 2);
|
|
}
|
|
|
|
ASSERT(offset + 1 < size());
|
|
*reinterpret_cast<u16*>(m_data + offset) = value;
|
|
}
|
|
|
|
void MmapRegion::write32(u32 offset, u32 value)
|
|
{
|
|
if (!is_writable()) {
|
|
warn() << "32-bit write to unreadable MmapRegion @ " << (const void*)(base() + offset);
|
|
Emulator::the().dump_backtrace();
|
|
TODO();
|
|
}
|
|
|
|
if (is_malloc_block()) {
|
|
if (auto* tracer = Emulator::the().malloc_tracer())
|
|
tracer->audit_write(base() + offset, 4);
|
|
}
|
|
|
|
ASSERT(offset + 3 < size());
|
|
*reinterpret_cast<u32*>(m_data + offset) = value;
|
|
}
|
|
|
|
}
|