From patchwork Tue Mar 17 15:50:42 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Laurent Vivier X-Patchwork-Id: 184626 Delivered-To: patch@linaro.org Received: by 2002:a92:1f12:0:0:0:0:0 with SMTP id i18csp4307951ile; Tue, 17 Mar 2020 08:57:17 -0700 (PDT) X-Google-Smtp-Source: ADFU+vs6fEnhL4BLvM/2kN2UMRL4f1/4eURT2YMdFdZHxwgIftxbO0Xa31sDk/V1tOp+Eyo6vsp8 X-Received: by 2002:ac8:48c7:: with SMTP id l7mr6129531qtr.174.1584460636894; Tue, 17 Mar 2020 08:57:16 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1584460636; cv=none; d=google.com; s=arc-20160816; b=kc5ox1SHHJX2mTCZ1w6ZDI894Zh7nMImucuFnDPAjex7ZVQkDkJOy6oM+RvHfSsGIF BQ4Gr5Sn6hoLZyO+YqEg6RlnnCfmR5dat+EFjxzvxgZ3AUGczhgtPH15s4L+lQhP2gO+ gkjJZqT/pz37YIBrH2ZKd/5hMxX8eMkEsVOimmEJXRwdGtUMy+VdDmdNWROZfVcenLE1 oneTLV7qYMfd/5uubb+4u3DrGktj5JcEFD69gsI+z79TD13GiraecYIulUN9C7yYB/r9 fmXpqsdPHvpV+cwc9597yfdN3zMV4KAVclFr7d1VxrF/f+gx2mFVOh3eq3ot1pUP+xLA 8DYw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=sender:errors-to:cc:list-subscribe:list-help:list-post:list-archive :list-unsubscribe:list-id:precedence:content-transfer-encoding :mime-version:references:in-reply-to:message-id:date:subject:to:from; bh=qae13QCl6LvvdWjCWFnu8ACk2rYjiYm9QTECpCB+OHM=; b=kPTcnm3oejz1xUFeCCQbnJy0F08ZBX4ZwqGCY5Cf38L37raUMaujYBFeF5WPuDiPTz wPfx4TNq9vwi3ulXV/gfqeDOFDmGTI2XiaaywUUvZoQBEhdN0PpJUP9wKq2d+0av9Br2 mZsWuwES27QhBN+8yJlQkXN2+d17pkXvYY0ocRkTlMm65mlvjCape8BUs17pQfwlIGFm synYWbNLLrFi+CJp8EDD7zoMhcgOkyeevFN/8fh4HP+UmBZcT4ThC761lX4mErbZWpk0 GcE+6lxHDTIBxZl3Jz9ymTJwwh6hVm5OJYFj6OBVDK8tSZL+xVMlWAnLLjpvWbhcW+mp A68Q== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Return-Path: Received: from lists.gnu.org (lists.gnu.org. [209.51.188.17]) by mx.google.com with ESMTPS id c15si1945042qvo.45.2020.03.17.08.57.16 for (version=TLS1_2 cipher=ECDHE-RSA-CHACHA20-POLY1305 bits=256/256); Tue, 17 Mar 2020 08:57:16 -0700 (PDT) Received-SPF: pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; Authentication-Results: mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Received: from localhost ([::1]:35386 helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1jEEah-0008Ej-Uy for patch@linaro.org; Tue, 17 Mar 2020 11:57:15 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]:37012) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1jEEVL-0004nt-5X for qemu-devel@nongnu.org; Tue, 17 Mar 2020 11:51:47 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1jEEVJ-0007El-8s for qemu-devel@nongnu.org; Tue, 17 Mar 2020 11:51:43 -0400 Received: from mout.kundenserver.de ([217.72.192.73]:35129) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_128_CBC_SHA1:16) (Exim 4.71) (envelope-from ) id 1jEEVI-000790-Q4 for qemu-devel@nongnu.org; Tue, 17 Mar 2020 11:51:41 -0400 Received: from localhost.localdomain ([78.238.229.36]) by mrelayeu.kundenserver.de (mreue109 [212.227.15.183]) with ESMTPSA (Nemesis) id 1MtwQk-1jYwAz1bHY-00uIMC; Tue, 17 Mar 2020 16:51:25 +0100 From: Laurent Vivier To: qemu-devel@nongnu.org Subject: [PULL v2 03/37] linux-user/i386: Emulate x86_64 vsyscalls Date: Tue, 17 Mar 2020 16:50:42 +0100 Message-Id: <20200317155116.1227513-4-laurent@vivier.eu> X-Mailer: git-send-email 2.24.1 In-Reply-To: <20200317155116.1227513-1-laurent@vivier.eu> References: <20200317155116.1227513-1-laurent@vivier.eu> MIME-Version: 1.0 X-Provags-ID: V03:K1:DisN5QYBYT8eockwvbUcXgNGzPf6AdrGQRK32k0reebOjW2gdeA x6n8k1RUr8G0HPWq2HK4EKeG+nWCfVXG9uw9F9f1RgbFV/Hso4F5hwqotf6KFuXm76XS5Ew CGxw0ZZcTeCQjTonO7w1vF4E7MdM+y7bKNuUCmWtWHl3GHGQlKQBaH9qYbXi+d0gev102fY JJLHNuyfVG5lYZq2LrwcQ== X-UI-Out-Filterresults: notjunk:1; V03:K0:7gu1KM9ArR4=:aFIDNMVxLSntpsgLRg1feU 8/gZG7oPcGkWGUz+ezelScIn+volkCP5xwpnmKlBR3H4Ry7QA6drZ8UlRF5sN6xzfYs+IG/y8 Ns5rWOb5IxjE0rvAgCeB83gL9wxrbcUQspcgC0ZADHKhx3aECuIrySP0MZHy7jbGHJ6R0wbaM YPAJkcbtc/CiRWnIU/PjbdEWotpAFNYjzXxT1QuKDWgaq3sKJB1soeSXJ6zSf0+cCZ3B6yjqO L9op5xLLzaHP83sIOQdeKlOuklygDYWxrTUOH3uQkoXFkm1/FFouerRadnNO49YqHRrjehmeP TqaIMmCFTH8cP8laomi4r2kXx/MuPapSwDAr+hXWQmxwmBqC5py117Ab9Is8Rcj16i5tbaVcc oMS7xER/snBOTguhV62V78lFhm+M6UV5rePoN2UnI60T8y6qfhUa62NEusNfUK+7mGpdnrhkF 7zBKLvlK7oJRzjd8kh+HnK6a3GpYJ6WKY4CHWIo8ye5dyITr5OQFv1zTjuKWR6rXfjK0umxYh G1fs7ryjak608kTHG9kxAHfCJs7j/uSTEmjSdjpVRkeoK0+4LEEmjx3vjoEla3r7fJ3AdX5GB mjQFBFnOM0OQbD48URp2Kb7Tr3W97YnGPeAPtpWCF+nFeCbOn6Lh36E292G5/JP6LlP3VEoWV GbLPeie+qc5040byRTVsyI/U/b88K015AgSIam1xxGnehuR5NqL18NnsGBbfzcWlrZkn+xtTQ 5zh7HI45nYqxLpZxdMMQ62fgWaeLT0jeTUgW8OeSbi6DXLOyENnFuheYGfeJ4g+uyylREoepr OE9k3X9Mv7hMW2z1tHm9lv3Ne2vHMAP85zUTGKDX/I/0V2fnY2vpevqTa+CNEauin22Yq9I X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] X-Received-From: 217.72.192.73 X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Paolo Bonzini , Riku Voipio , Richard Henderson , Laurent Vivier Errors-To: qemu-devel-bounces+patch=linaro.org@nongnu.org Sender: "Qemu-devel" From: Richard Henderson Notice the magic page during translate, much like we already do for the arm32 commpage. At runtime, raise an exception to return cpu_loop for emulation. Reviewed-by: Paolo Bonzini Signed-off-by: Richard Henderson Message-Id: <20200213032223.14643-4-richard.henderson@linaro.org> Signed-off-by: Laurent Vivier --- linux-user/i386/cpu_loop.c | 108 +++++++++++++++++++++++++++++++++++++ target/i386/cpu.h | 7 +++ target/i386/translate.c | 14 ++++- 3 files changed, 128 insertions(+), 1 deletion(-) -- 2.24.1 diff --git a/linux-user/i386/cpu_loop.c b/linux-user/i386/cpu_loop.c index e217cca5ee1e..70cde417e605 100644 --- a/linux-user/i386/cpu_loop.c +++ b/linux-user/i386/cpu_loop.c @@ -92,6 +92,109 @@ static void gen_signal(CPUX86State *env, int sig, int code, abi_ptr addr) queue_signal(env, info.si_signo, QEMU_SI_FAULT, &info); } +#ifdef TARGET_X86_64 +static bool write_ok_or_segv(CPUX86State *env, abi_ptr addr, size_t len) +{ + /* + * For all the vsyscalls, NULL means "don't write anything" not + * "write it at address 0". + */ + if (addr == 0 || access_ok(VERIFY_WRITE, addr, len)) { + return true; + } + + env->error_code = PG_ERROR_W_MASK | PG_ERROR_U_MASK; + gen_signal(env, TARGET_SIGSEGV, TARGET_SEGV_MAPERR, addr); + return false; +} + +/* + * Since v3.1, the kernel traps and emulates the vsyscall page. + * Entry points other than the official generate SIGSEGV. + */ +static void emulate_vsyscall(CPUX86State *env) +{ + int syscall; + abi_ulong ret; + uint64_t caller; + + /* + * Validate the entry point. We have already validated the page + * during translation to get here; now verify the offset. + */ + switch (env->eip & ~TARGET_PAGE_MASK) { + case 0x000: + syscall = TARGET_NR_gettimeofday; + break; + case 0x400: + syscall = TARGET_NR_time; + break; + case 0x800: + syscall = TARGET_NR_getcpu; + break; + default: + goto sigsegv; + } + + /* + * Validate the return address. + * Note that the kernel treats this the same as an invalid entry point. + */ + if (get_user_u64(caller, env->regs[R_ESP])) { + goto sigsegv; + } + + /* + * Validate the the pointer arguments. + */ + switch (syscall) { + case TARGET_NR_gettimeofday: + if (!write_ok_or_segv(env, env->regs[R_EDI], + sizeof(struct target_timeval)) || + !write_ok_or_segv(env, env->regs[R_ESI], + sizeof(struct target_timezone))) { + return; + } + break; + case TARGET_NR_time: + if (!write_ok_or_segv(env, env->regs[R_EDI], sizeof(abi_long))) { + return; + } + break; + case TARGET_NR_getcpu: + if (!write_ok_or_segv(env, env->regs[R_EDI], sizeof(uint32_t)) || + !write_ok_or_segv(env, env->regs[R_ESI], sizeof(uint32_t))) { + return; + } + break; + default: + g_assert_not_reached(); + } + + /* + * Perform the syscall. None of the vsyscalls should need restarting. + */ + ret = do_syscall(env, syscall, env->regs[R_EDI], env->regs[R_ESI], + env->regs[R_EDX], env->regs[10], env->regs[8], + env->regs[9], 0, 0); + g_assert(ret != -TARGET_ERESTARTSYS); + g_assert(ret != -TARGET_QEMU_ESIGRETURN); + if (ret == -TARGET_EFAULT) { + goto sigsegv; + } + env->regs[R_EAX] = ret; + + /* Emulate a ret instruction to leave the vsyscall page. */ + env->eip = caller; + env->regs[R_ESP] += 8; + return; + + sigsegv: + /* Like force_sig(SIGSEGV). */ + gen_signal(env, TARGET_SIGSEGV, TARGET_SI_KERNEL, 0); +} +#endif + void cpu_loop(CPUX86State *env) { CPUState *cs = env_cpu(env); @@ -141,6 +244,11 @@ void cpu_loop(CPUX86State *env) env->regs[R_EAX] = ret; } break; +#endif +#ifdef TARGET_X86_64 + case EXCP_VSYSCALL: + emulate_vsyscall(env); + break; #endif case EXCP0B_NOSEG: case EXCP0C_STACK: diff --git a/target/i386/cpu.h b/target/i386/cpu.h index 08b4422f36bd..39be555db3da 100644 --- a/target/i386/cpu.h +++ b/target/i386/cpu.h @@ -1001,6 +1001,7 @@ typedef uint64_t FeatureWordArray[FEATURE_WORDS]; #define EXCP_VMEXIT 0x100 /* only for system emulation */ #define EXCP_SYSCALL 0x101 /* only for user emulation */ +#define EXCP_VSYSCALL 0x102 /* only for user emulation */ /* i386-specific interrupt pending bits. */ #define CPU_INTERRUPT_POLL CPU_INTERRUPT_TGT_EXT_1 @@ -2215,4 +2216,10 @@ static inline bool hyperv_feat_enabled(X86CPU *cpu, int feat) return !!(cpu->hyperv_features & BIT(feat)); } +#if defined(TARGET_X86_64) && \ + defined(CONFIG_USER_ONLY) && \ + defined(CONFIG_LINUX) +# define TARGET_VSYSCALL_PAGE (UINT64_C(-10) << 20) +#endif + #endif /* I386_CPU_H */ diff --git a/target/i386/translate.c b/target/i386/translate.c index d9af8f4078b3..5e5dbb41b0ce 100644 --- a/target/i386/translate.c +++ b/target/i386/translate.c @@ -8555,7 +8555,19 @@ static bool i386_tr_breakpoint_check(DisasContextBase *dcbase, CPUState *cpu, static void i386_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu) { DisasContext *dc = container_of(dcbase, DisasContext, base); - target_ulong pc_next = disas_insn(dc, cpu); + target_ulong pc_next; + +#ifdef TARGET_VSYSCALL_PAGE + /* + * Detect entry into the vsyscall page and invoke the syscall. + */ + if ((dc->base.pc_next & TARGET_PAGE_MASK) == TARGET_VSYSCALL_PAGE) { + gen_exception(dc, EXCP_VSYSCALL, dc->base.pc_next); + return; + } +#endif + + pc_next = disas_insn(dc, cpu); if (dc->tf || (dc->base.tb->flags & HF_INHIBIT_IRQ_MASK)) { /* if single step mode, we generate only one instruction and