Skip to content

Commit

Permalink
Avoid accessing guest memory directly in usermode emulation.
Browse files Browse the repository at this point in the history 
git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@1790 c046a42c-6fe2-441c-8c8c-71466251a162
  • Loading branch information
pbrook committed Mar 25, 2006
1 parent 26f69dc commit 53a5960
Show file tree
Hide file tree
Showing 15 changed files with 1,194 additions and 772 deletions.
54 changes: 37 additions & 17 deletions cpu-all.h
View file
Original file line number Diff line number Diff line change
Expand Up @@ -584,22 +584,41 @@ static inline void stfq_be_p(void *ptr, float64 v)

/* MMU memory access macros */

#if defined(CONFIG_USER_ONLY)
/* On some host systems the guest address space is reserved on the host.
* This allows the guest address space to be offset to a convenient location.
*/
//#define GUEST_BASE 0x20000000
#define GUEST_BASE 0

/* All direct uses of g2h and h2g need to go away for usermode softmmu. */
#define g2h(x) ((void *)((unsigned long)(x) + GUEST_BASE))
#define h2g(x) ((target_ulong)(x - GUEST_BASE))

#define saddr(x) g2h(x)
#define laddr(x) g2h(x)

#else /* !CONFIG_USER_ONLY */
/* NOTE: we use double casts if pointers and target_ulong have
different sizes */
#define ldub_raw(p) ldub_p((uint8_t *)(long)(p))
#define ldsb_raw(p) ldsb_p((uint8_t *)(long)(p))
#define lduw_raw(p) lduw_p((uint8_t *)(long)(p))
#define ldsw_raw(p) ldsw_p((uint8_t *)(long)(p))
#define ldl_raw(p) ldl_p((uint8_t *)(long)(p))
#define ldq_raw(p) ldq_p((uint8_t *)(long)(p))
#define ldfl_raw(p) ldfl_p((uint8_t *)(long)(p))
#define ldfq_raw(p) ldfq_p((uint8_t *)(long)(p))
#define stb_raw(p, v) stb_p((uint8_t *)(long)(p), v)
#define stw_raw(p, v) stw_p((uint8_t *)(long)(p), v)
#define stl_raw(p, v) stl_p((uint8_t *)(long)(p), v)
#define stq_raw(p, v) stq_p((uint8_t *)(long)(p), v)
#define stfl_raw(p, v) stfl_p((uint8_t *)(long)(p), v)
#define stfq_raw(p, v) stfq_p((uint8_t *)(long)(p), v)
#define saddr(x) (uint8_t *)(long)(x)
#define laddr(x) (uint8_t *)(long)(x)
#endif

#define ldub_raw(p) ldub_p(laddr((p)))
#define ldsb_raw(p) ldsb_p(laddr((p)))
#define lduw_raw(p) lduw_p(laddr((p)))
#define ldsw_raw(p) ldsw_p(laddr((p)))
#define ldl_raw(p) ldl_p(laddr((p)))
#define ldq_raw(p) ldq_p(laddr((p)))
#define ldfl_raw(p) ldfl_p(laddr((p)))
#define ldfq_raw(p) ldfq_p(laddr((p)))
#define stb_raw(p, v) stb_p(saddr((p)), v)
#define stw_raw(p, v) stw_p(saddr((p)), v)
#define stl_raw(p, v) stl_p(saddr((p)), v)
#define stq_raw(p, v) stq_p(saddr((p)), v)
#define stfl_raw(p, v) stfl_p(saddr((p)), v)
#define stfq_raw(p, v) stfq_p(saddr((p)), v)


#if defined(CONFIG_USER_ONLY)
Expand Down Expand Up @@ -648,6 +667,7 @@ static inline void stfq_be_p(void *ptr, float64 v)
#define TARGET_PAGE_MASK ~(TARGET_PAGE_SIZE - 1)
#define TARGET_PAGE_ALIGN(addr) (((addr) + TARGET_PAGE_SIZE - 1) & TARGET_PAGE_MASK)

/* ??? These should be the larger of unsigned long and target_ulong. */
extern unsigned long qemu_real_host_page_size;
extern unsigned long qemu_host_page_bits;
extern unsigned long qemu_host_page_size;
Expand All @@ -666,9 +686,9 @@ extern unsigned long qemu_host_page_mask;
#define PAGE_WRITE_ORG 0x0010

void page_dump(FILE *f);
int page_get_flags(unsigned long address);
void page_set_flags(unsigned long start, unsigned long end, int flags);
void page_unprotect_range(uint8_t *data, unsigned long data_size);
int page_get_flags(target_ulong address);
void page_set_flags(target_ulong start, target_ulong end, int flags);
void page_unprotect_range(target_ulong data, target_ulong data_size);

#define SINGLE_CPU_DEFINES
#ifdef SINGLE_CPU_DEFINES
Expand Down
10 changes: 5 additions & 5 deletions cpu-exec.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -913,7 +913,7 @@ static inline int handle_cpu_signal(unsigned long pc, unsigned long address,
pc, address, is_write, *(unsigned long *)old_set);
#endif
/* XXX: locking issue */
if (is_write && page_unprotect(address, pc, puc)) {
if (is_write && page_unprotect(h2g(address), pc, puc)) {
return 1;
}

Expand Down Expand Up @@ -964,7 +964,7 @@ static inline int handle_cpu_signal(unsigned long pc, unsigned long address,
pc, address, is_write, *(unsigned long *)old_set);
#endif
/* XXX: locking issue */
if (is_write && page_unprotect(address, pc, puc)) {
if (is_write && page_unprotect(h2g(address), pc, puc)) {
return 1;
}
/* see if it is an MMU fault */
Expand Down Expand Up @@ -1000,7 +1000,7 @@ static inline int handle_cpu_signal(unsigned long pc, unsigned long address,
pc, address, is_write, *(unsigned long *)old_set);
#endif
/* XXX: locking issue */
if (is_write && page_unprotect(address, pc, puc)) {
if (is_write && page_unprotect(h2g(address), pc, puc)) {
return 1;
}
/* see if it is an MMU fault */
Expand Down Expand Up @@ -1036,7 +1036,7 @@ static inline int handle_cpu_signal(unsigned long pc, unsigned long address,
pc, address, is_write, *(unsigned long *)old_set);
#endif
/* XXX: locking issue */
if (is_write && page_unprotect(address, pc, puc)) {
if (is_write && page_unprotect(h2g(address), pc, puc)) {
return 1;
}

Expand Down Expand Up @@ -1086,7 +1086,7 @@ static inline int handle_cpu_signal(unsigned long pc, unsigned long address,
pc, address, is_write, *(unsigned long *)old_set);
#endif
/* XXX: locking issue */
if (is_write && page_unprotect(address, pc, puc)) {
if (is_write && page_unprotect(h2g(address), pc, puc)) {
return 1;
}

Expand Down
2 changes: 1 addition & 1 deletion exec-all.h
View file
Original file line number Diff line number Diff line change
Expand Up @@ -93,7 +93,7 @@ int cpu_restore_state_copy(struct TranslationBlock *tb,
void *puc);
void cpu_resume_from_signal(CPUState *env1, void *puc);
void cpu_exec_init(CPUState *env);
int page_unprotect(unsigned long address, unsigned long pc, void *puc);
int page_unprotect(target_ulong address, unsigned long pc, void *puc);
void tb_invalidate_phys_page_range(target_ulong start, target_ulong end,
int is_cpu_write_access);
void tb_invalidate_page_range(target_ulong start, target_ulong end);
Expand Down
58 changes: 37 additions & 21 deletions exec.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -34,6 +34,9 @@

#include "cpu.h"
#include "exec-all.h"
#if defined(CONFIG_USER_ONLY)
#include <qemu.h>
#endif

//#define DEBUG_TB_INVALIDATE
//#define DEBUG_FLUSH
Expand Down Expand Up @@ -810,7 +813,7 @@ static void tb_invalidate_phys_page(target_ulong addr,

/* add the tb in the target page and protect it if necessary */
static inline void tb_alloc_page(TranslationBlock *tb,
unsigned int n, unsigned int page_addr)
unsigned int n, target_ulong page_addr)
{
PageDesc *p;
TranslationBlock *last_first_tb;
Expand All @@ -826,23 +829,30 @@ static inline void tb_alloc_page(TranslationBlock *tb,

#if defined(CONFIG_USER_ONLY)
if (p->flags & PAGE_WRITE) {
unsigned long host_start, host_end, addr;
target_ulong addr;
PageDesc *p2;
int prot;

/* force the host page as non writable (writes will have a
page fault + mprotect overhead) */
host_start = page_addr & qemu_host_page_mask;
host_end = host_start + qemu_host_page_size;
page_addr &= qemu_host_page_mask;
prot = 0;
for(addr = host_start; addr < host_end; addr += TARGET_PAGE_SIZE)
prot |= page_get_flags(addr);
mprotect((void *)host_start, qemu_host_page_size,
for(addr = page_addr; addr < page_addr + qemu_host_page_size;
addr += TARGET_PAGE_SIZE) {

p2 = page_find (addr >> TARGET_PAGE_BITS);
if (!p2)
continue;
prot |= p2->flags;
p2->flags &= ~PAGE_WRITE;
page_get_flags(addr);
}
mprotect(g2h(page_addr), qemu_host_page_size,
(prot & PAGE_BITS) & ~PAGE_WRITE);
#ifdef DEBUG_TB_INVALIDATE
printf("protecting code page: 0x%08lx\n",
host_start);
page_addr);
#endif
p->flags &= ~PAGE_WRITE;
}
#else
/* if some code is already present, then the pages are already
Expand Down Expand Up @@ -1546,7 +1556,7 @@ int tlb_set_page_exec(CPUState *env, target_ulong vaddr,

/* called from signal handler: invalidate the code and unprotect the
page. Return TRUE if the fault was succesfully handled. */
int page_unprotect(unsigned long addr, unsigned long pc, void *puc)
int page_unprotect(target_ulong addr, unsigned long pc, void *puc)
{
#if !defined(CONFIG_SOFTMMU)
VirtPageDesc *vp;
Expand Down Expand Up @@ -1645,7 +1655,7 @@ void page_dump(FILE *f)
}
}

int page_get_flags(unsigned long address)
int page_get_flags(target_ulong address)
{
PageDesc *p;

Expand All @@ -1658,10 +1668,10 @@ int page_get_flags(unsigned long address)
/* modify the flags of a page and invalidate the code if
necessary. The flag PAGE_WRITE_ORG is positionned automatically
depending on PAGE_WRITE */
void page_set_flags(unsigned long start, unsigned long end, int flags)
void page_set_flags(target_ulong start, target_ulong end, int flags)
{
PageDesc *p;
unsigned long addr;
target_ulong addr;

start = start & TARGET_PAGE_MASK;
end = TARGET_PAGE_ALIGN(end);
Expand All @@ -1684,11 +1694,11 @@ void page_set_flags(unsigned long start, unsigned long end, int flags)

/* called from signal handler: invalidate the code and unprotect the
page. Return TRUE if the fault was succesfully handled. */
int page_unprotect(unsigned long address, unsigned long pc, void *puc)
int page_unprotect(target_ulong address, unsigned long pc, void *puc)
{
unsigned int page_index, prot, pindex;
PageDesc *p, *p1;
unsigned long host_start, host_end, addr;
target_ulong host_start, host_end, addr;

host_start = address & qemu_host_page_mask;
page_index = host_start >> TARGET_PAGE_BITS;
Expand All @@ -1707,7 +1717,7 @@ int page_unprotect(unsigned long address, unsigned long pc, void *puc)
if (prot & PAGE_WRITE_ORG) {
pindex = (address - host_start) >> TARGET_PAGE_BITS;
if (!(p1[pindex].flags & PAGE_WRITE)) {
mprotect((void *)host_start, qemu_host_page_size,
mprotect((void *)g2h(host_start), qemu_host_page_size,
(prot & PAGE_BITS) | PAGE_WRITE);
p1[pindex].flags |= PAGE_WRITE;
/* and since the content will be modified, we must invalidate
Expand All @@ -1723,11 +1733,12 @@ int page_unprotect(unsigned long address, unsigned long pc, void *puc)
}

/* call this function when system calls directly modify a memory area */
void page_unprotect_range(uint8_t *data, unsigned long data_size)
/* ??? This should be redundant now we have lock_user. */
void page_unprotect_range(target_ulong data, target_ulong data_size)
{
unsigned long start, end, addr;
target_ulong start, end, addr;

start = (unsigned long)data;
start = data;
end = start + data_size;
start &= TARGET_PAGE_MASK;
end = TARGET_PAGE_ALIGN(end);
Expand Down Expand Up @@ -1932,6 +1943,7 @@ void cpu_physical_memory_rw(target_phys_addr_t addr, uint8_t *buf,
{
int l, flags;
target_ulong page;
void * p;

while (len > 0) {
page = addr & TARGET_PAGE_MASK;
Expand All @@ -1944,11 +1956,15 @@ void cpu_physical_memory_rw(target_phys_addr_t addr, uint8_t *buf,
if (is_write) {
if (!(flags & PAGE_WRITE))
return;
memcpy((uint8_t *)addr, buf, len);
p = lock_user(addr, len, 0);
memcpy(p, buf, len);
unlock_user(p, addr, len);
} else {
if (!(flags & PAGE_READ))
return;
memcpy(buf, (uint8_t *)addr, len);
p = lock_user(addr, len, 1);
memcpy(buf, p, len);
unlock_user(p, addr, 0);
}
len -= l;
buf += l;
Expand Down
41 changes: 24 additions & 17 deletions linux-user/arm-semi.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -77,20 +77,20 @@ static inline uint32_t set_swi_errno(TaskState *ts, uint32_t code)
return code;
}

#define ARG(x) tswap32(args[x])
#define ARG(n) tget32(args + n * 4)
uint32_t do_arm_semihosting(CPUState *env)
{
uint32_t *args;
target_ulong args;
char * s;
int nr;
uint32_t ret;
TaskState *ts = env->opaque;

nr = env->regs[0];
args = (uint32_t *)env->regs[1];
args = env->regs[1];
switch (nr) {
case SYS_OPEN:
s = (char *)ARG(0);
s = (char *)g2h(ARG(0));
if (ARG(1) >= 12)
return (uint32_t)-1;
if (strcmp(s, ":tt") == 0) {
Expand All @@ -103,18 +103,23 @@ uint32_t do_arm_semihosting(CPUState *env)
case SYS_CLOSE:
return set_swi_errno(ts, close(ARG(0)));
case SYS_WRITEC:
/* Write to debug console. stderr is near enough. */
return write(STDERR_FILENO, args, 1);
{
char c = tget8(args);
/* Write to debug console. stderr is near enough. */
return write(STDERR_FILENO, &c, 1);
}
case SYS_WRITE0:
s = (char *)args;
return write(STDERR_FILENO, s, strlen(s));
s = lock_user_string(args);
ret = write(STDERR_FILENO, s, strlen(s));
unlock_user(s, args, 0);
return ret;
case SYS_WRITE:
ret = set_swi_errno(ts, write(ARG(0), (void *)ARG(1), ARG(2)));
ret = set_swi_errno(ts, write(ARG(0), g2h(ARG(1)), ARG(2)));
if (ret == (uint32_t)-1)
return -1;
return ARG(2) - ret;
case SYS_READ:
ret = set_swi_errno(ts, read(ARG(0), (void *)ARG(1), ARG(2)));
ret = set_swi_errno(ts, read(ARG(0), g2h(ARG(1)), ARG(2)));
if (ret == (uint32_t)-1)
return -1;
return ARG(2) - ret;
Expand All @@ -140,20 +145,21 @@ uint32_t do_arm_semihosting(CPUState *env)
/* XXX: Not implemented. */
return -1;
case SYS_REMOVE:
return set_swi_errno(ts, remove((char *)ARG(0)));
return set_swi_errno(ts, remove((char *)g2h(ARG(0))));
case SYS_RENAME:
return set_swi_errno(ts, rename((char *)ARG(0), (char *)ARG(2)));
return set_swi_errno(ts, rename((char *)g2h(ARG(0)),
(char *)g2h(ARG(2))));
case SYS_CLOCK:
return clock() / (CLOCKS_PER_SEC / 100);
case SYS_TIME:
return set_swi_errno(ts, time(NULL));
case SYS_SYSTEM:
return set_swi_errno(ts, system((char *)ARG(0)));
return set_swi_errno(ts, system((char *)g2h(ARG(0))));
case SYS_ERRNO:
return ts->swi_errno;
case SYS_GET_CMDLINE:
/* XXX: Not implemented. */
s = (char *)ARG(0);
s = (char *)g2h(ARG(0));
*s = 0;
return -1;
case SYS_HEAPINFO:
Expand All @@ -166,19 +172,20 @@ uint32_t do_arm_semihosting(CPUState *env)
if (!ts->heap_limit) {
long ret;

ts->heap_base = do_brk(NULL);
ts->heap_base = do_brk(0);
limit = ts->heap_base + ARM_ANGEL_HEAP_SIZE;
/* Try a big heap, and reduce the size if that fails. */
for (;;) {
ret = do_brk((char *)limit);
ret = do_brk(limit);
if (ret != -1)
break;
limit = (ts->heap_base >> 1) + (limit >> 1);
}
ts->heap_limit = limit;
}

ptr = (uint32_t *)ARG(0);
page_unprotect_range (ARG(0), 32);
ptr = (uint32_t *)g2h(ARG(0));
ptr[0] = tswap32(ts->heap_base);
ptr[1] = tswap32(ts->heap_limit);
ptr[2] = tswap32(ts->stack_base);
Expand Down
Loading

0 comments on commit 53a5960

Please sign in to comment.