Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Frontend: Disallow cross-page branches in multiblock #4270

Merged
merged 1 commit into from
Jan 20, 2025

Conversation

bylaws
Copy link
Collaborator

@bylaws bylaws commented Jan 12, 2025

This avoids both the generation of multiblocks that cover massive spans of guest code, which causes issues for both SMC and context reconstruction and attempting to decode branch targets in unmapped memory regions.

Once support for querying mappings from the FEX frontend is in place this limit could be increased if necessary, but this seems fine for now.

@neobrain
Copy link
Member

which causes issues for both SMC and context reconstruction and attempting to decode branch targets in unmapped memory regions.

What are these issues?

Once support for querying mappings from the FEX frontend is in place

Why is this needed for increasing the limit? Couldn't we equally well constrain to a neighborhood of N pages around the multiblock entrypoint or prevent following non-local jumps?

@bylaws
Copy link
Collaborator Author

bylaws commented Jan 13, 2025

which causes issues for both SMC and context reconstruction and attempting to decode branch targets in unmapped memory regions.

What are these issues?
Overflow of the rip offset in the reconstruction metadata, I had initially thought there were others but it seems just that due to how smc pages are handled?

Once support for querying mappings from the FEX frontend is in place

Why is this needed for increasing the limit? Couldn't we equally well constrain to a neighborhood of N pages around the multiblock entrypoint or prevent following non-local jumps?

The page after the entrypoint could be unmapped for example (ubisoft games hit this), limiting jumps to within a page means that doesn't end up causing issues as we don't start accidentally exploring code in the unmapped page. But if we had explicit handling for unmapped blocks this limit could safely be increased as then hitting an unmapped block could be safely handled and end the multiblock rather than crashing fex.

This avoids both the generation of multiblocks that cover massive spans
of guest code, which causes issues for both context reconstruction
overflowing the RIP offset and attempting to decode branch targets
in unmapped memory regions.

Once support for querying mappings from the FEX frontend is in place this
limit could be increased if necessary, but this seems fine for now.
Copy link
Member

@neobrain neobrain left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for the additional background!

Further context from Discord is that these Ubisoft titles apparently map one single page of a larger block of code, hence "cutting off" the control flow graph.

@neobrain neobrain merged commit 3b8c368 into FEX-Emu:main Jan 20, 2025
12 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants