Skip to content

winemu: keep kernel KUSER_SHARED_DATA readable from executed code - #322

Draft
warsang wants to merge 3 commits into
mandiant:masterfrom
warsang:draft/s1-kuser-exec-mirror
Draft

warsang wants to merge 3 commits into
mandiant:masterfrom
warsang:draft/s1-kuser-exec-mirror

Conversation

@warsang

@warsang warsang commented Sep 14, 2026

Copy link
Copy Markdown
Contributor

Draft: Unicorn QEMU truncates x86-64 guest phys to 52 bits so loads from canonical KUSER alias 0xFFFFF78000000000 fault. Mirror page at truncated exec alias, single snapshot so all views agree, skip foreign maps, batch mem_protect runs. Tests: tests/test_kernel_bootstrap.py KUSER cases (2 passed locally; 1 pre-existing failure is missing capa sample, unrelated).

Unicorn's vendored QEMU defines a 52-bit guest physical address space for x86-64 (qemu/target/i386/cpu-param.h: TARGET_PHYS_ADDR_SPACE_BITS under TARGET_X86_64) and truncates accesses resolving above it, so loads from the canonical x64 alias (0xFFFFF78000000000) fault even though the page is mapped. Mirror the page at the address executed accesses resolve to (the alias masked to 52 bits) and populate every alias with live time values.

Skip aliases that already have a mapping instead of letting a duplicate map break kernel-mode loading, and lock the mirroring behavior in with tests.
…n updates

Build the user shared data page once and write identical bytes to every alias so all views report the same time values, instead of re-reading the clock per alias.

Coalesce per-page mem_protect calls into contiguous runs of matching permissions while loading image sections.
Drop the vendored-QEMU address-space exposition above _X64_EXEC_ADDR_MASK. Behavior unchanged. KUSER bootstrap tests pass.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant