esp: check dma length before reading scsi command(CVE-2016-4441)
[qemu/ar7.git] / linux-user / qemu.h
blob208c63eb2aa0eeb85ae62b5398faca478938d33b
1 #ifndef QEMU_H
2 #define QEMU_H
5 #include "cpu.h"
6 #include "exec/exec-all.h"
7 #include "exec/cpu_ldst.h"
9 #undef DEBUG_REMAP
10 #ifdef DEBUG_REMAP
11 #endif /* DEBUG_REMAP */
13 #include "exec/user/abitypes.h"
15 #include "exec/user/thunk.h"
16 #include "syscall_defs.h"
17 #include "target_syscall.h"
18 #include "exec/gdbstub.h"
19 #include "qemu/queue.h"
21 #define THREAD __thread
23 /* This struct is used to hold certain information about the image.
24 * Basically, it replicates in user space what would be certain
25 * task_struct fields in the kernel
27 struct image_info {
28 abi_ulong load_bias;
29 abi_ulong load_addr;
30 abi_ulong start_code;
31 abi_ulong end_code;
32 abi_ulong start_data;
33 abi_ulong end_data;
34 abi_ulong start_brk;
35 abi_ulong brk;
36 abi_ulong start_mmap;
37 abi_ulong start_stack;
38 abi_ulong stack_limit;
39 abi_ulong entry;
40 abi_ulong code_offset;
41 abi_ulong data_offset;
42 abi_ulong saved_auxv;
43 abi_ulong auxv_len;
44 abi_ulong arg_start;
45 abi_ulong arg_end;
46 uint32_t elf_flags;
47 int personality;
48 #ifdef CONFIG_USE_FDPIC
49 abi_ulong loadmap_addr;
50 uint16_t nsegs;
51 void *loadsegs;
52 abi_ulong pt_dynamic_addr;
53 struct image_info *other_info;
54 #endif
57 #ifdef TARGET_I386
58 /* Information about the current linux thread */
59 struct vm86_saved_state {
60 uint32_t eax; /* return code */
61 uint32_t ebx;
62 uint32_t ecx;
63 uint32_t edx;
64 uint32_t esi;
65 uint32_t edi;
66 uint32_t ebp;
67 uint32_t esp;
68 uint32_t eflags;
69 uint32_t eip;
70 uint16_t cs, ss, ds, es, fs, gs;
72 #endif
74 #if defined(TARGET_ARM) && defined(TARGET_ABI32)
75 /* FPU emulator */
76 #include "nwfpe/fpa11.h"
77 #endif
79 #define MAX_SIGQUEUE_SIZE 1024
81 struct sigqueue {
82 struct sigqueue *next;
83 target_siginfo_t info;
86 struct emulated_sigtable {
87 int pending; /* true if signal is pending */
88 struct sigqueue *first;
89 struct sigqueue info; /* in order to always have memory for the
90 first signal, we put it here */
93 /* NOTE: we force a big alignment so that the stack stored after is
94 aligned too */
95 typedef struct TaskState {
96 pid_t ts_tid; /* tid (or pid) of this task */
97 #ifdef TARGET_ARM
98 # ifdef TARGET_ABI32
99 /* FPA state */
100 FPA11 fpa;
101 # endif
102 int swi_errno;
103 #endif
104 #ifdef TARGET_UNICORE32
105 int swi_errno;
106 #endif
107 #if defined(TARGET_I386) && !defined(TARGET_X86_64)
108 abi_ulong target_v86;
109 struct vm86_saved_state vm86_saved_regs;
110 struct target_vm86plus_struct vm86plus;
111 uint32_t v86flags;
112 uint32_t v86mask;
113 #endif
114 abi_ulong child_tidptr;
115 #ifdef TARGET_M68K
116 int sim_syscalls;
117 abi_ulong tp_value;
118 #endif
119 #if defined(TARGET_ARM) || defined(TARGET_M68K) || defined(TARGET_UNICORE32)
120 /* Extra fields for semihosted binaries. */
121 uint32_t heap_base;
122 uint32_t heap_limit;
123 #endif
124 uint32_t stack_base;
125 int used; /* non zero if used */
126 bool sigsegv_blocked; /* SIGSEGV blocked by guest */
127 struct image_info *info;
128 struct linux_binprm *bprm;
130 struct emulated_sigtable sigtab[TARGET_NSIG];
131 struct sigqueue sigqueue_table[MAX_SIGQUEUE_SIZE]; /* siginfo queue */
132 struct sigqueue *first_free; /* first free siginfo queue entry */
133 int signal_pending; /* non zero if a signal may be pending */
134 } __attribute__((aligned(16))) TaskState;
136 extern char *exec_path;
137 void init_task_state(TaskState *ts);
138 void task_settid(TaskState *);
139 void stop_all_tasks(void);
140 extern const char *qemu_uname_release;
141 extern unsigned long mmap_min_addr;
143 /* ??? See if we can avoid exposing so much of the loader internals. */
145 /* Read a good amount of data initially, to hopefully get all the
146 program headers loaded. */
147 #define BPRM_BUF_SIZE 1024
150 * This structure is used to hold the arguments that are
151 * used when loading binaries.
153 struct linux_binprm {
154 char buf[BPRM_BUF_SIZE] __attribute__((aligned));
155 abi_ulong p;
156 int fd;
157 int e_uid, e_gid;
158 int argc, envc;
159 char **argv;
160 char **envp;
161 char * filename; /* Name of binary */
162 int (*core_dump)(int, const CPUArchState *); /* coredump routine */
165 void do_init_thread(struct target_pt_regs *regs, struct image_info *infop);
166 abi_ulong loader_build_argptr(int envc, int argc, abi_ulong sp,
167 abi_ulong stringp, int push_ptr);
168 int loader_exec(int fdexec, const char *filename, char **argv, char **envp,
169 struct target_pt_regs * regs, struct image_info *infop,
170 struct linux_binprm *);
172 int load_elf_binary(struct linux_binprm *bprm, struct image_info *info);
173 int load_flt_binary(struct linux_binprm *bprm, struct image_info *info);
175 abi_long memcpy_to_target(abi_ulong dest, const void *src,
176 unsigned long len);
177 void target_set_brk(abi_ulong new_brk);
178 abi_long do_brk(abi_ulong new_brk);
179 void syscall_init(void);
180 abi_long do_syscall(void *cpu_env, int num, abi_long arg1,
181 abi_long arg2, abi_long arg3, abi_long arg4,
182 abi_long arg5, abi_long arg6, abi_long arg7,
183 abi_long arg8);
184 void gemu_log(const char *fmt, ...) GCC_FMT_ATTR(1, 2);
185 extern THREAD CPUState *thread_cpu;
186 void cpu_loop(CPUArchState *env);
187 char *target_strerror(int err);
188 int get_osversion(void);
189 void init_qemu_uname_release(void);
190 void fork_start(void);
191 void fork_end(int child);
193 /* Creates the initial guest address space in the host memory space using
194 * the given host start address hint and size. The guest_start parameter
195 * specifies the start address of the guest space. guest_base will be the
196 * difference between the host start address computed by this function and
197 * guest_start. If fixed is specified, then the mapped address space must
198 * start at host_start. The real start address of the mapped memory space is
199 * returned or -1 if there was an error.
201 unsigned long init_guest_space(unsigned long host_start,
202 unsigned long host_size,
203 unsigned long guest_start,
204 bool fixed);
206 #include "qemu/log.h"
208 /* syscall.c */
209 int host_to_target_waitstatus(int status);
211 /* strace.c */
212 void print_syscall(int num,
213 abi_long arg1, abi_long arg2, abi_long arg3,
214 abi_long arg4, abi_long arg5, abi_long arg6);
215 void print_syscall_ret(int num, abi_long arg1);
216 extern int do_strace;
218 /* signal.c */
219 void process_pending_signals(CPUArchState *cpu_env);
220 void signal_init(void);
221 int queue_signal(CPUArchState *env, int sig, target_siginfo_t *info);
222 void host_to_target_siginfo(target_siginfo_t *tinfo, const siginfo_t *info);
223 void target_to_host_siginfo(siginfo_t *info, const target_siginfo_t *tinfo);
224 int target_to_host_signal(int sig);
225 int host_to_target_signal(int sig);
226 long do_sigreturn(CPUArchState *env);
227 long do_rt_sigreturn(CPUArchState *env);
228 abi_long do_sigaltstack(abi_ulong uss_addr, abi_ulong uoss_addr, abi_ulong sp);
229 int do_sigprocmask(int how, const sigset_t *set, sigset_t *oldset);
231 #ifdef TARGET_I386
232 /* vm86.c */
233 void save_v86_state(CPUX86State *env);
234 void handle_vm86_trap(CPUX86State *env, int trapno);
235 void handle_vm86_fault(CPUX86State *env);
236 int do_vm86(CPUX86State *env, long subfunction, abi_ulong v86_addr);
237 #elif defined(TARGET_SPARC64)
238 void sparc64_set_context(CPUSPARCState *env);
239 void sparc64_get_context(CPUSPARCState *env);
240 #endif
242 /* mmap.c */
243 int target_mprotect(abi_ulong start, abi_ulong len, int prot);
244 abi_long target_mmap(abi_ulong start, abi_ulong len, int prot,
245 int flags, int fd, abi_ulong offset);
246 int target_munmap(abi_ulong start, abi_ulong len);
247 abi_long target_mremap(abi_ulong old_addr, abi_ulong old_size,
248 abi_ulong new_size, unsigned long flags,
249 abi_ulong new_addr);
250 int target_msync(abi_ulong start, abi_ulong len, int flags);
251 extern unsigned long last_brk;
252 extern abi_ulong mmap_next_start;
253 abi_ulong mmap_find_vma(abi_ulong, abi_ulong);
254 void cpu_list_lock(void);
255 void cpu_list_unlock(void);
256 void mmap_fork_start(void);
257 void mmap_fork_end(int child);
259 /* main.c */
260 extern unsigned long guest_stack_size;
262 /* user access */
264 #define VERIFY_READ 0
265 #define VERIFY_WRITE 1 /* implies read access */
267 static inline int access_ok(int type, abi_ulong addr, abi_ulong size)
269 return page_check_range((target_ulong)addr, size,
270 (type == VERIFY_READ) ? PAGE_READ : (PAGE_READ | PAGE_WRITE)) == 0;
273 /* NOTE __get_user and __put_user use host pointers and don't check access.
274 These are usually used to access struct data members once the struct has
275 been locked - usually with lock_user_struct. */
277 /* Tricky points:
278 - Use __builtin_choose_expr to avoid type promotion from ?:,
279 - Invalid sizes result in a compile time error stemming from
280 the fact that abort has no parameters.
281 - It's easier to use the endian-specific unaligned load/store
282 functions than host-endian unaligned load/store plus tswapN. */
284 #define __put_user_e(x, hptr, e) \
285 (__builtin_choose_expr(sizeof(*(hptr)) == 1, stb_p, \
286 __builtin_choose_expr(sizeof(*(hptr)) == 2, stw_##e##_p, \
287 __builtin_choose_expr(sizeof(*(hptr)) == 4, stl_##e##_p, \
288 __builtin_choose_expr(sizeof(*(hptr)) == 8, stq_##e##_p, abort)))) \
289 ((hptr), (x)), (void)0)
291 #define __get_user_e(x, hptr, e) \
292 ((x) = (typeof(*hptr))( \
293 __builtin_choose_expr(sizeof(*(hptr)) == 1, ldub_p, \
294 __builtin_choose_expr(sizeof(*(hptr)) == 2, lduw_##e##_p, \
295 __builtin_choose_expr(sizeof(*(hptr)) == 4, ldl_##e##_p, \
296 __builtin_choose_expr(sizeof(*(hptr)) == 8, ldq_##e##_p, abort)))) \
297 (hptr)), (void)0)
299 #ifdef TARGET_WORDS_BIGENDIAN
300 # define __put_user(x, hptr) __put_user_e(x, hptr, be)
301 # define __get_user(x, hptr) __get_user_e(x, hptr, be)
302 #else
303 # define __put_user(x, hptr) __put_user_e(x, hptr, le)
304 # define __get_user(x, hptr) __get_user_e(x, hptr, le)
305 #endif
307 /* put_user()/get_user() take a guest address and check access */
308 /* These are usually used to access an atomic data type, such as an int,
309 * that has been passed by address. These internally perform locking
310 * and unlocking on the data type.
312 #define put_user(x, gaddr, target_type) \
313 ({ \
314 abi_ulong __gaddr = (gaddr); \
315 target_type *__hptr; \
316 abi_long __ret = 0; \
317 if ((__hptr = lock_user(VERIFY_WRITE, __gaddr, sizeof(target_type), 0))) { \
318 __put_user((x), __hptr); \
319 unlock_user(__hptr, __gaddr, sizeof(target_type)); \
320 } else \
321 __ret = -TARGET_EFAULT; \
322 __ret; \
325 #define get_user(x, gaddr, target_type) \
326 ({ \
327 abi_ulong __gaddr = (gaddr); \
328 target_type *__hptr; \
329 abi_long __ret = 0; \
330 if ((__hptr = lock_user(VERIFY_READ, __gaddr, sizeof(target_type), 1))) { \
331 __get_user((x), __hptr); \
332 unlock_user(__hptr, __gaddr, 0); \
333 } else { \
334 /* avoid warning */ \
335 (x) = 0; \
336 __ret = -TARGET_EFAULT; \
338 __ret; \
341 #define put_user_ual(x, gaddr) put_user((x), (gaddr), abi_ulong)
342 #define put_user_sal(x, gaddr) put_user((x), (gaddr), abi_long)
343 #define put_user_u64(x, gaddr) put_user((x), (gaddr), uint64_t)
344 #define put_user_s64(x, gaddr) put_user((x), (gaddr), int64_t)
345 #define put_user_u32(x, gaddr) put_user((x), (gaddr), uint32_t)
346 #define put_user_s32(x, gaddr) put_user((x), (gaddr), int32_t)
347 #define put_user_u16(x, gaddr) put_user((x), (gaddr), uint16_t)
348 #define put_user_s16(x, gaddr) put_user((x), (gaddr), int16_t)
349 #define put_user_u8(x, gaddr) put_user((x), (gaddr), uint8_t)
350 #define put_user_s8(x, gaddr) put_user((x), (gaddr), int8_t)
352 #define get_user_ual(x, gaddr) get_user((x), (gaddr), abi_ulong)
353 #define get_user_sal(x, gaddr) get_user((x), (gaddr), abi_long)
354 #define get_user_u64(x, gaddr) get_user((x), (gaddr), uint64_t)
355 #define get_user_s64(x, gaddr) get_user((x), (gaddr), int64_t)
356 #define get_user_u32(x, gaddr) get_user((x), (gaddr), uint32_t)
357 #define get_user_s32(x, gaddr) get_user((x), (gaddr), int32_t)
358 #define get_user_u16(x, gaddr) get_user((x), (gaddr), uint16_t)
359 #define get_user_s16(x, gaddr) get_user((x), (gaddr), int16_t)
360 #define get_user_u8(x, gaddr) get_user((x), (gaddr), uint8_t)
361 #define get_user_s8(x, gaddr) get_user((x), (gaddr), int8_t)
363 /* copy_from_user() and copy_to_user() are usually used to copy data
364 * buffers between the target and host. These internally perform
365 * locking/unlocking of the memory.
367 abi_long copy_from_user(void *hptr, abi_ulong gaddr, size_t len);
368 abi_long copy_to_user(abi_ulong gaddr, void *hptr, size_t len);
370 /* Functions for accessing guest memory. The tget and tput functions
371 read/write single values, byteswapping as necessary. The lock_user function
372 gets a pointer to a contiguous area of guest memory, but does not perform
373 any byteswapping. lock_user may return either a pointer to the guest
374 memory, or a temporary buffer. */
376 /* Lock an area of guest memory into the host. If copy is true then the
377 host area will have the same contents as the guest. */
378 static inline void *lock_user(int type, abi_ulong guest_addr, long len, int copy)
380 if (!access_ok(type, guest_addr, len))
381 return NULL;
382 #ifdef DEBUG_REMAP
384 void *addr;
385 addr = malloc(len);
386 if (copy)
387 memcpy(addr, g2h(guest_addr), len);
388 else
389 memset(addr, 0, len);
390 return addr;
392 #else
393 return g2h(guest_addr);
394 #endif
397 /* Unlock an area of guest memory. The first LEN bytes must be
398 flushed back to guest memory. host_ptr = NULL is explicitly
399 allowed and does nothing. */
400 static inline void unlock_user(void *host_ptr, abi_ulong guest_addr,
401 long len)
404 #ifdef DEBUG_REMAP
405 if (!host_ptr)
406 return;
407 if (host_ptr == g2h(guest_addr))
408 return;
409 if (len > 0)
410 memcpy(g2h(guest_addr), host_ptr, len);
411 free(host_ptr);
412 #endif
415 /* Return the length of a string in target memory or -TARGET_EFAULT if
416 access error. */
417 abi_long target_strlen(abi_ulong gaddr);
419 /* Like lock_user but for null terminated strings. */
420 static inline void *lock_user_string(abi_ulong guest_addr)
422 abi_long len;
423 len = target_strlen(guest_addr);
424 if (len < 0)
425 return NULL;
426 return lock_user(VERIFY_READ, guest_addr, (long)(len + 1), 1);
429 /* Helper macros for locking/unlocking a target struct. */
430 #define lock_user_struct(type, host_ptr, guest_addr, copy) \
431 (host_ptr = lock_user(type, guest_addr, sizeof(*host_ptr), copy))
432 #define unlock_user_struct(host_ptr, guest_addr, copy) \
433 unlock_user(host_ptr, guest_addr, (copy) ? sizeof(*host_ptr) : 0)
435 #include <pthread.h>
437 /* Include target-specific struct and function definitions;
438 * they may need access to the target-independent structures
439 * above, so include them last.
441 #include "target_cpu.h"
442 #include "target_signal.h"
443 #include "target_structs.h"
445 #endif /* QEMU_H */