December 2016 - Wine-Devel - list.winehq.org

[v2 2/7] x86/mpx: Fail when implicit zero-displacement is used along with R/EBP

by Ricardo Neri

Section 2.2.1.2 of the Intel 64 and IA-32 Architectures Software Developer's Manual volume 2A states that when memory addressing with no explicit displacement (i.e, mod part of ModR/M is 0), a SIB byte is used and the base of the SIB byte points to (R/EBP) (i.e., base = 5), an explicit displacement of 0 must be used. Make the address decoder to return -EINVAL in such a case. Cc: Dave Hansen <dave.hansen(a)linux.intel.com> Cc: Adam Buchbinder <adam.buchbinder(a)gmail.com> Cc: Colin Ian King <colin.king(a)canonical.com> Cc: Lorenzo Stoakes <lstoakes(a)gmail.com> Cc: Qiaowei Ren <qiaowei.ren(a)intel.com> Cc: Ravi V. Shankar <ravi.v.shankar(a)intel.com> Cc: x86(a)kernel.org Signed-off-by: Ricardo Neri <ricardo.neri-calderon(a)linux.intel.com> --- arch/x86/mm/mpx.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/arch/x86/mm/mpx.c b/arch/x86/mm/mpx.c index 6a75a75..71681d0 100644 --- a/arch/x86/mm/mpx.c +++ b/arch/x86/mm/mpx.c @@ -120,6 +120,13 @@ static int get_reg_offset(struct insn *insn, struct pt_regs *regs, case REG_TYPE_BASE: regno = X86_SIB_BASE(insn->sib.value); + if (regno == 5 && X86_MODRM_RM(insn->modrm.value) == 0) { + WARN_ONCE(1, "An explicit displacement is required when %sBP used as SIB base.", + (IS_ENABLED(CONFIG_X86_64) && insn->x86_64) ? + "R13 or R" : "E"); + return -EINVAL; + } + if (X86_REX_B(insn->rex_prefix.value)) regno += 8; break; -- 2.9.3

Dec. 24, 2016

[v2 1/7] x86/mpx: Do not use SIB index if index points to R/ESP

by Ricardo Neri

Section 2.2.1.2 of the Intel 64 and IA-32 Architectures Software Developer's Manual volume 2A states that when memory addressing is used (i.e., mod part of ModR/M is not 3), a SIB byte is used and the index of the SIB byte points to the R/ESP (i.e.,index = 4), the index should not be used in the computation of the memory address. An example of such instruction could be insn -0x80(%rsp) This is represented as: [opcode] 4c 24 80 ModR/M: mod: 1, reg: 1: r/m: 4 (R/ESP) SIB 24: sc: 0, index: 100 (R/ESP), base(R/ESP): 100 Displacement -0x80 The correct address is (base) + displacement; no index is used. Care is taken to allow R12 to be used as index, which is a valid scenario. Cc: Dave Hansen <dave.hansen(a)linux.intel.com> Cc: Adam Buchbinder <adam.buchbinder(a)gmail.com> Cc: Colin Ian King <colin.king(a)canonical.com> Cc: Lorenzo Stoakes <lstoakes(a)gmail.com> Cc: Qiaowei Ren <qiaowei.ren(a)intel.com> Cc: Ravi V. Shankar <ravi.v.shankar(a)intel.com> Cc: x86(a)kernel.org Signed-off-by: Ricardo Neri <ricardo.neri-calderon(a)linux.intel.com> --- arch/x86/mm/mpx.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/arch/x86/mm/mpx.c b/arch/x86/mm/mpx.c index 324e571..6a75a75 100644 --- a/arch/x86/mm/mpx.c +++ b/arch/x86/mm/mpx.c @@ -109,6 +109,13 @@ static int get_reg_offset(struct insn *insn, struct pt_regs *regs, regno = X86_SIB_INDEX(insn->sib.value); if (X86_REX_X(insn->rex_prefix.value)) regno += 8; + /* + * If mod !=3, SP is not used as index. Check is done after + * looking at REX.X This is because R12 can be used as an + * index. + */ + if (regno == 4 && X86_MODRM_RM(insn->modrm.value) != 3) + return 0; break; case REG_TYPE_BASE: @@ -161,7 +168,10 @@ static void __user *mpx_get_addr_ref(struct insn *insn, struct pt_regs *regs) goto out_err; base = regs_get_register(regs, base_offset); - indx = regs_get_register(regs, indx_offset); + if (indx_offset) + indx = regs_get_register(regs, indx_offset); + else + indx = 0; addr = base + indx * (1 << X86_SIB_SCALE(sib)); } else { addr_offset = get_reg_offset(insn, regs, REG_TYPE_RM); -- 2.9.3

Dec. 24, 2016

[v2 0/7] x86: enable User-Mode Instruction Prevention

by Ricardo Neri

This is v2 of my first submission done a while ago[1]. I apologize for the delay. User-Mode Instruction Prevention (UMIP) is a security feature present in new Intel Processors. If enabled, it prevents the execution of certain instructions if the Current Privilege Level (CPL) is greater than 0. If these instructions were executed while in CPL > 0, user space applications could have access to system-wide settings such as the global and local descriptor tables, the segment selectors to the current task state and the local descriptor table. These are the instructions covered by UMIP: * SGDT - Store Global Descriptor Table * SIDT - Store Interrupt Descriptor Table * SLDT - Store Local Descriptor Table * SMSW - Store Machine Status Word * STR - Store Task Register If any of these instructions is executed with CPL > 0, a general protection exception is issued when UMIP is enabled. There is a caveat, however. Certain applications rely on some of these instructions to function. An example of this are applications that use WineHQ[2]. For instance, these applications rely on sidt returning a non- accesible memory location[3]. During the discussions, it was proposed that the fault could be relied to the user-space and perform the emulation in user-mode. However, this would break existing applications until, for instance, they update to a new WineHQ version. However, this approach would require UMIP to be disabled by default. The concensus in this forum is to always enable it. This patchset initially treated tasks running in virtual-8086 mode as a special case. However, I received clarification that DOSEMU[4] does not support applications that use these instructions. It relies on WineHQ for this[4]. Furthermore, the applications for which the concern was raised run in protected mode [3]. This version keeps UMIP enabled at all times and by default. If a general protection fault caused by the instructions protected by UMIP is detected, such fault will be fixed-up by returning dummy values as follows: * SGDT and SIDT return a base address to a dummy location in kernel memory and a limit of 0. * STR, SLDT returns 0 as the segment selector. This seems OK since we are providing a dummy value as the base address of the global descriptor table. * SMSW returns 0. Lastly, I found very useful the code for Intel MPX (Memory Protection Extensions) used to parse opcodes and the memory locations contained in the general purpose registers when used as operands. I put some of this code in a separate file that both MPX and UMIP can access and avoid code duplication. While here, I fixed two small bugs that I found in the MPX implementation. The code that I used to test the emulated instructions can be found in [6]. [1]. https://lwn.net/Articles/705877/ [2]. https://www.winehq.org/ [3]. https://www.winehq.org/pipermail/wine-devel/2016-November/115320.html [4]. http://www.dosemu.org/ [5]. http://marc.info/?l=linux-kernel&m=147876798717927&w=2 [6]. https://github.com/01org/luv-yocto/tree/rneri/umip/meta-luv/recipes-core/um… Thanks and BR, Ricardo Cc: Andy Lutomirski <luto(a)kernel.org> Cc: Andrew Morton <akpm(a)linux-foundation.org> Cc: Borislav Petkov <bp(a)suse.de> Cc: Brian Gerst <brgerst(a)gmail.com> Cc: Chen Yucong <slaoub(a)gmail.com> Cc: Chris Metcalf <cmetcalf(a)mellanox.com> Cc: Dave Hansen <dave.hansen(a)linux.intel.com> Cc: Fenghua Yu <fenghua.yu(a)intel.com> Cc: Huang Rui <ray.huang(a)amd.com> Cc: Jiri Slaby <jslaby(a)suse.cz> Cc: Jonathan Corbet <corbet(a)lwn.net> Cc: Michael S. Tsirkin <mst(a)redhat.com> Cc: Paul Gortmaker <paul.gortmaker(a)windriver.com> Cc: Peter Zijlstra <peterz(a)infradead.org> Cc: Ravi V. Shankar <ravi.v.shankar(a)intel.com> Cc: Vlastimil Babka <vbabka(a)suse.cz> Cc: Shuah Khan <shuah(a)kernel.org> Cc: Paolo Bonzini <pbonzini(a)redhat.com> Cc: Liang Z Li <liang.z.li(a)intel.com> Cc: x86(a)kernel.org Cc: linux-msdos(a)vger.kernel.org Changes since V1: * Virtual-8086 mode tasks are not treated in a special manner. All code for this purpose was removed. * Instead of attempting to disable UMIP during a context switch or when entering virtual-8086 mode, UMIP remains enabled all the time. General protection faults that occur are fixed-up by returning dummy values as detailed above. * Removed umip= kernel parameter in favor of using clearcpuid=514 to disable UMIP. * Removed selftests designed to detect the absence of SIGSEGV signals when running in virtual-8086 mode. * Reused code from MPX to decode instructions operands. For this purpose code was put in a common location. * Fixed two bugs in MPX code that decodes operands. Ricardo Neri (7): x86/mpx: Do not use SIB index if index points to R/ESP x86/mpx: Fail when implicit zero-displacement is used along with R/EBP x86/mpx, x86/insn: Relocate insn util functions to a new insn-utils x86/cpufeature: Add User-Mode Instruction Prevention definitions x86: Add emulation code for UMIP instructions x86/traps: Fixup general protection faults caused by UMIP x86: Enable User-Mode Instruction Prevention arch/x86/Kconfig | 10 ++ arch/x86/include/asm/cpufeatures.h | 1 + arch/x86/include/asm/disabled-features.h | 8 +- arch/x86/include/asm/insn.h | 6 + arch/x86/include/asm/umip.h | 16 +++ arch/x86/include/uapi/asm/processor-flags.h | 2 + arch/x86/kernel/Makefile | 1 + arch/x86/kernel/cpu/common.c | 16 ++- arch/x86/kernel/traps.c | 4 + arch/x86/kernel/umip.c | 170 ++++++++++++++++++++++++++++ arch/x86/lib/Makefile | 2 +- arch/x86/lib/insn-utils.c | 148 ++++++++++++++++++++++++ arch/x86/mm/mpx.c | 119 +------------------ 13 files changed, 382 insertions(+), 121 deletions(-) create mode 100644 arch/x86/include/asm/umip.h create mode 100644 arch/x86/kernel/umip.c create mode 100644 arch/x86/lib/insn-utils.c -- 2.9.3

Dec. 24, 2016

Re: [PATCH] mscoree: Free argument buffer on error (Coverity)

by Vincent Povirk

I'm out visiting family and don't have access to a machine that can build or run Wine. I'll be able to do reviews again next year. FWIW, by purely visual inspection this looks fine to me.

Dec. 22, 2016

Re: [PATCH] msvcrt: Pass WCHAR strings to MessageBoxIndirectW.

by Nikolay Sivov

On Thu, 22 Dec 2016 14:38:19 -0700 Alex Henrie <alexhenrie24(a)gmail.com> wrote: > Cc: Piotr Caban <piotr(a)codeweavers.com> > Cc: Nikolay Sivov <bunglehead(a)gmail.com> > > Fixes https://bugs.winehq.org/show_bug.cgi?id=42057 > > I figured this would be a good time to get rid of the misleading > Hungarian notation and move the string into the single function that > uses it. > > v2: Switch to WCHAR type. > > Signed-off-by: Alex Henrie <alexhenrie24(a)gmail.com> > --- > dlls/msvcrt/exit.c | 10 +++++----- > 1 file changed, 5 insertions(+), 5 deletions(-) > > diff --git a/dlls/msvcrt/exit.c b/dlls/msvcrt/exit.c > index 9ba0891806..ad5a78d54d 100644 > --- a/dlls/msvcrt/exit.c > +++ b/dlls/msvcrt/exit.c > @@ -41,8 +41,6 @@ typedef struct MSVCRT__onexit_table_t > MSVCRT__onexit_t *_end; > } MSVCRT__onexit_table_t; > > -static const char szMsgBoxTitle[] = "Wine C++ Runtime Library"; > - > extern int MSVCRT_app_type; > extern MSVCRT_wchar_t *MSVCRT__wpgmptr; > > @@ -112,10 +110,12 @@ void CDECL MSVCRT__exit(int exitcode) > /* Print out an error message with an option to debug */ > static void DoMessageBoxW(const MSVCRT_wchar_t *lead, const MSVCRT_wchar_t *message) > { > - static const MSVCRT_wchar_t message_format[] = {'%','s','\n','\n','P','r','o','g','r','a','m',':',' ','%','s','\n', > + static const WCHAR message_format[] = {'%','s','\n','\n','P','r','o','g','r','a','m',':',' ','%','s','\n', > '%','s','\n','\n','P','r','e','s','s',' ','O','K',' ','t','o',' ','e','x','i','t',' ','t','h','e',' ', > 'p','r','o','g','r','a','m',',',' ','o','r',' ','C','a','n','c','e','l',' ','t','o',' ','s','t','a','r','t',' ', > 't','h','e',' ','W','i','n','e',' ','d','e','b','b','u','g','e','r','.','\n',0}; > + static const WCHAR title[] = > + {'W','i','n','e',' ','C','+','+',' ','R','u','n','t','i','m','e',' ','L','i','b','r','a','r','y',0}; 'message_format' is used with MSVCRT__snwprintf, so it should be wchar_t strictly speaking. > > MSGBOXPARAMSW msgbox; > MSVCRT_wchar_t text[2048]; Another existing bug is wrong buffer length here: --- MSVCRT__snwprintf(text,sizeof(text),message_format, lead, MSVCRT__wpgmptr, message); --- Could be a separate patch I guess. > @@ -126,8 +126,8 @@ static void DoMessageBoxW(const MSVCRT_wchar_t *lead, const MSVCRT_wchar_t *mess > msgbox.cbSize = sizeof(msgbox); > msgbox.hwndOwner = GetActiveWindow(); > msgbox.hInstance = 0; > - msgbox.lpszText = (LPCWSTR)text; > - msgbox.lpszCaption = (LPCWSTR)szMsgBoxTitle; > + msgbox.lpszText = text; > + msgbox.lpszCaption = title; What I meant is that you can remove 'text' cast without changing its type. > msgbox.dwStyle = MB_OKCANCEL|MB_ICONERROR; > msgbox.lpszIcon = NULL; > msgbox.dwContextHelpId = 0;

Dec. 22, 2016

Re: [PATCH] msvcrt: Pass wide char caption string to MessageBoxIndirectW.

by Nikolay Sivov

On Thu, 22 Dec 2016 14:20:26 -0700 Alex Henrie <alexhenrie24(a)gmail.com> wrote: > Cc: Piotr Caban <piotr(a)codeweavers.com> > > Fixes https://bugs.winehq.org/show_bug.cgi?id=42057 > > I figured this would be a good time to get rid of the misleading > Hungarian notation and move the string into the single function that > uses it. > > Signed-off-by: Alex Henrie <alexhenrie24(a)gmail.com> > --- > dlls/msvcrt/exit.c | 6 +++--- > 1 file changed, 3 insertions(+), 3 deletions(-) > > diff --git a/dlls/msvcrt/exit.c b/dlls/msvcrt/exit.c > index 9ba0891806..3bfcd15967 100644 > --- a/dlls/msvcrt/exit.c > +++ b/dlls/msvcrt/exit.c > @@ -41,8 +41,6 @@ typedef struct MSVCRT__onexit_table_t > MSVCRT__onexit_t *_end; > } MSVCRT__onexit_table_t; > > -static const char szMsgBoxTitle[] = "Wine C++ Runtime Library"; > - > extern int MSVCRT_app_type; > extern MSVCRT_wchar_t *MSVCRT__wpgmptr; > > @@ -116,6 +114,8 @@ static void DoMessageBoxW(const MSVCRT_wchar_t *lead, const MSVCRT_wchar_t *mess > '%','s','\n','\n','P','r','e','s','s',' ','O','K',' ','t','o',' ','e','x','i','t',' ','t','h','e',' ', > 'p','r','o','g','r','a','m',',',' ','o','r',' ','C','a','n','c','e','l',' ','t','o',' ','s','t','a','r','t',' ', > 't','h','e',' ','W','i','n','e',' ','d','e','b','b','u','g','e','r','.','\n',0}; > + static const MSVCRT_wchar_t title[] = > + {'W','i','n','e',' ','C','+','+',' ','R','u','n','t','i','m','e',' ','L','i','b','r','a','r','y',0}; I think this should be WCHAR, because it will be used with regular API. > > MSGBOXPARAMSW msgbox; > MSVCRT_wchar_t text[2048]; > @@ -127,7 +127,7 @@ static void DoMessageBoxW(const MSVCRT_wchar_t *lead, const MSVCRT_wchar_t *mess > msgbox.hwndOwner = GetActiveWindow(); > msgbox.hInstance = 0; > msgbox.lpszText = (LPCWSTR)text; > - msgbox.lpszCaption = (LPCWSTR)szMsgBoxTitle; > + msgbox.lpszCaption = (LPCWSTR)title; Looks like these two casts could be removed. > msgbox.dwStyle = MB_OKCANCEL|MB_ICONERROR; > msgbox.lpszIcon = NULL; > msgbox.dwContextHelpId = 0;

Dec. 22, 2016

Re: [PATCH 2/2] user32: Send WM_NCPAINT and WM_ERASEBKGND when window is shown and add tests

by Fabian Maurer

On Thursday, December 22, 2016 2:17:57 PM CET Marvin wrote: > While running your changed tests on Windows, I think I found new failures. > Being a bot and all I'm not very good at pattern recognition, so I might be > wrong, but could you please double-check? Seems to be the same, I can't confirm these issues. Ran the test again, and they disappeared. Probably not related to my changes.

Dec. 22, 2016

Re: [PATCH 1/2] user32: Fix WM_NCPAINT for windows crossing screen boarders and add tests

by Fabian Maurer

On Thursday, December 22, 2016 2:10:35 PM CET Marvin wrote: > While running your changed tests on Windows, I think I found new failures. > Being a bot and all I'm not very good at pattern recognition, so I might be > wrong, but could you please double-check? Not sure these are related, I couldn't reproduce. Seems to be random, but not by my patches.

Dec. 22, 2016

Re: [PATCH 2/2] user32: Send WM_NCPAINT and WM_ERASEBKGND when window is shown and add tests

by Marvin

Hi, While running your changed tests on Windows, I think I found new failures. Being a bot and all I'm not very good at pattern recognition, so I might be wrong, but could you please double-check? Full results can be found at https://testbot.winehq.org/JobDetails.pl?Key=27468 Your paranoid android. === w7u (32 bit msg) === msg.c:9126: Test failed: did not get zero count as expected (1). msg.c:9129: Test failed: did not get one count as expected (2). msg.c:9133: Test failed: killing replaced timer did not work (2). msg.c:9146: Test failed: did not get expected count for minimum timeout (12 != ~100). === w7pro64 (64 bit msg) === msg.c:12258: Test failed: 56: ShowWindow(SW_SHOWNOACTIVATE): 5: in msg 0x0047 expecting wParam 0x8170 got 0x1803 msg.c:12258: Test failed: 56: ShowWindow(SW_SHOWNOACTIVATE): 6: the msg 0x0003 was expected, but got msg 0x0009 instead msg.c:12258: Test failed: 56: ShowWindow(SW_SHOWNOACTIVATE): 7: the msg 0x0005 was expected, but got msg 0x0047 instead msg.c:12258: Test failed: 56: ShowWindow(SW_SHOWNOACTIVATE): 13: the msg sequence is not complete: expected 0000 - actual 0003

Dec. 22, 2016

Re: [PATCH 1/2] user32: Fix WM_NCPAINT for windows crossing screen boarders and add tests

by Marvin

Hi, While running your changed tests on Windows, I think I found new failures. Being a bot and all I'm not very good at pattern recognition, so I might be wrong, but could you please double-check? Full results can be found at https://testbot.winehq.org/JobDetails.pl?Key=27467 Your paranoid android. === w7pro64 (64 bit msg) === msg.c:12156: Test failed: 54: ShowWindow(SW_MINIMIZE): 4: in msg 0x0047 expecting wParam 0x8170 got 0x1803 msg.c:12156: Test failed: 54: ShowWindow(SW_MINIMIZE): 5: the msg 0x0003 was expected, but got msg 0x0047 instead msg.c:12156: Test failed: 54: ShowWindow(SW_MINIMIZE): 6: the msg 0x0005 was expected, but got msg 0x0003 instead msg.c:12156: Test failed: 54: ShowWindow(SW_MINIMIZE): 7: the msg sequence is not complete: expected 0000 - actual 0005

Dec. 22, 2016