6 #include "exec/exec-all.h"
7 #include "exec/cpu_ldst.h"
11 #endif /* DEBUG_REMAP */
13 #include "exec/user/abitypes.h"
15 #include "exec/user/thunk.h"
16 #include "syscall_defs.h"
17 #include "target_syscall.h"
18 #include "exec/gdbstub.h"
20 /* This is the size of the host kernel's sigset_t, needed where we make
21 * direct system calls that take a sigset_t pointer and a size.
23 #define SIGSET_T_SIZE (_NSIG / 8)
25 /* This struct is used to hold certain information about the image.
26 * Basically, it replicates in user space what would be certain
27 * task_struct fields in the kernel
38 abi_ulong reserve_brk
;
40 abi_ulong start_stack
;
41 abi_ulong stack_limit
;
43 abi_ulong code_offset
;
44 abi_ulong data_offset
;
49 abi_ulong arg_strings
;
50 abi_ulong env_strings
;
51 abi_ulong file_string
;
56 /* The fields below are used in FDPIC mode. */
57 abi_ulong loadmap_addr
;
60 abi_ulong pt_dynamic_addr
;
61 abi_ulong interpreter_loadmap_addr
;
62 abi_ulong interpreter_pt_dynamic_addr
;
63 struct image_info
*other_info
;
71 /* Information about the current linux thread */
72 struct vm86_saved_state
{
73 uint32_t eax
; /* return code */
83 uint16_t cs
, ss
, ds
, es
, fs
, gs
;
87 #if defined(TARGET_ARM) && defined(TARGET_ABI32)
89 #include "nwfpe/fpa11.h"
92 #define MAX_SIGQUEUE_SIZE 1024
94 struct emulated_sigtable
{
95 int pending
; /* true if signal is pending */
96 target_siginfo_t info
;
99 /* NOTE: we force a big alignment so that the stack stored after is
101 typedef struct TaskState
{
102 pid_t ts_tid
; /* tid (or pid) of this task */
110 #if defined(TARGET_I386) && !defined(TARGET_X86_64)
111 abi_ulong target_v86
;
112 struct vm86_saved_state vm86_saved_regs
;
113 struct target_vm86plus_struct vm86plus
;
117 abi_ulong child_tidptr
;
121 #if defined(TARGET_ARM) || defined(TARGET_M68K)
122 /* Extra fields for semihosted binaries. */
124 abi_ulong heap_limit
;
126 abi_ulong stack_base
;
127 int used
; /* non zero if used */
128 struct image_info
*info
;
129 struct linux_binprm
*bprm
;
131 struct emulated_sigtable sync_signal
;
132 struct emulated_sigtable sigtab
[TARGET_NSIG
];
133 /* This thread's signal mask, as requested by the guest program.
134 * The actual signal mask of this thread may differ:
135 * + we don't let SIGSEGV and SIGBUS be blocked while running guest code
136 * + sometimes we block all signals to avoid races
138 sigset_t signal_mask
;
139 /* The signal mask imposed by a guest sigsuspend syscall, if we are
140 * currently in the middle of such a syscall
142 sigset_t sigsuspend_mask
;
143 /* Nonzero if we're leaving a sigsuspend and sigsuspend_mask is valid. */
146 /* Nonzero if process_pending_signals() needs to do something (either
147 * handle a pending signal or unblock signals).
148 * This flag is written from a signal handler so should be accessed via
149 * the atomic_read() and atomic_set() functions. (It is not accessed
150 * from multiple threads.)
154 /* This thread's sigaltstack, if it has one */
155 struct target_sigaltstack sigaltstack_used
;
156 } __attribute__((aligned(16))) TaskState
;
158 extern char *exec_path
;
159 void init_task_state(TaskState
*ts
);
160 void task_settid(TaskState
*);
161 void stop_all_tasks(void);
162 extern const char *qemu_uname_release
;
163 extern unsigned long mmap_min_addr
;
165 /* ??? See if we can avoid exposing so much of the loader internals. */
167 /* Read a good amount of data initially, to hopefully get all the
168 program headers loaded. */
169 #define BPRM_BUF_SIZE 1024
172 * This structure is used to hold the arguments that are
173 * used when loading binaries.
175 struct linux_binprm
{
176 char buf
[BPRM_BUF_SIZE
] __attribute__((aligned
));
182 char * filename
; /* Name of binary */
184 int (*core_dump
)(int, const CPUArchState
*); /* coredump routine */
187 void do_init_thread(struct target_pt_regs
*regs
, struct image_info
*infop
);
188 abi_ulong
loader_build_argptr(int envc
, int argc
, abi_ulong sp
,
189 abi_ulong stringp
, int push_ptr
);
190 int loader_exec(int fdexec
, const char *filename
, char **argv
, char **envp
,
191 struct target_pt_regs
* regs
, struct image_info
*infop
,
192 struct linux_binprm
*);
194 /* Returns true if the image uses the FDPIC ABI. If this is the case,
195 * we have to provide some information (loadmap, pt_dynamic_info) such
196 * that the program can be relocated adequately. This is also useful
197 * when handling signals.
199 int info_is_fdpic(struct image_info
*info
);
201 uint32_t get_elf_eflags(int fd
);
202 int load_elf_binary(struct linux_binprm
*bprm
, struct image_info
*info
);
203 int load_flt_binary(struct linux_binprm
*bprm
, struct image_info
*info
);
205 abi_long
memcpy_to_target(abi_ulong dest
, const void *src
,
207 void target_set_brk(abi_ulong new_brk
);
208 abi_long
do_brk(abi_ulong new_brk
);
209 void syscall_init(void);
210 abi_long
do_syscall(void *cpu_env
, int num
, abi_long arg1
,
211 abi_long arg2
, abi_long arg3
, abi_long arg4
,
212 abi_long arg5
, abi_long arg6
, abi_long arg7
,
214 extern __thread CPUState
*thread_cpu
;
215 void QEMU_NORETURN
cpu_loop(CPUArchState
*env
);
216 const char *target_strerror(int err
);
217 int get_osversion(void);
218 void init_qemu_uname_release(void);
219 void fork_start(void);
220 void fork_end(int child
);
224 * @image_name: the executable being loaded
225 * @loaddr: the lowest fixed address in the executable
226 * @hiaddr: the highest fixed address in the executable
228 * Creates the initial guest address space in the host memory space.
230 * If @loaddr == 0, then no address in the executable is fixed,
231 * i.e. it is fully relocatable. In that case @hiaddr is the size
234 * This function will not return if a valid value for guest_base
235 * cannot be chosen. On return, the executable loader can expect
237 * target_mmap(loaddr, hiaddr - loaddr, ...)
241 void probe_guest_base(const char *image_name
,
242 abi_ulong loaddr
, abi_ulong hiaddr
);
244 #include "qemu/log.h"
250 * @int number: number of system call to make
251 * ...: arguments to the system call
253 * Call a system call if guest signal not pending.
254 * This has the same API as the libc syscall() function, except that it
255 * may return -1 with errno == TARGET_ERESTARTSYS if a signal was pending.
257 * Returns: the system call result, or -1 with an error code in errno
258 * (Errnos are host errnos; we rely on TARGET_ERESTARTSYS not clashing
259 * with any of the host errno values.)
262 /* A guide to using safe_syscall() to handle interactions between guest
263 * syscalls and guest signals:
265 * Guest syscalls come in two flavours:
267 * (1) Non-interruptible syscalls
269 * These are guest syscalls that never get interrupted by signals and
270 * so never return EINTR. They can be implemented straightforwardly in
271 * QEMU: just make sure that if the implementation code has to make any
272 * blocking calls that those calls are retried if they return EINTR.
273 * It's also OK to implement these with safe_syscall, though it will be
274 * a little less efficient if a signal is delivered at the 'wrong' moment.
276 * Some non-interruptible syscalls need to be handled using block_signals()
277 * to block signals for the duration of the syscall. This mainly applies
278 * to code which needs to modify the data structures used by the
279 * host_signal_handler() function and the functions it calls, including
280 * all syscalls which change the thread's signal mask.
282 * (2) Interruptible syscalls
284 * These are guest syscalls that can be interrupted by signals and
285 * for which we need to either return EINTR or arrange for the guest
286 * syscall to be restarted. This category includes both syscalls which
287 * always restart (and in the kernel return -ERESTARTNOINTR), ones
288 * which only restart if there is no handler (kernel returns -ERESTARTNOHAND
289 * or -ERESTART_RESTARTBLOCK), and the most common kind which restart
290 * if the handler was registered with SA_RESTART (kernel returns
291 * -ERESTARTSYS). System calls which are only interruptible in some
292 * situations (like 'open') also need to be handled this way.
294 * Here it is important that the host syscall is made
295 * via this safe_syscall() function, and *not* via the host libc.
296 * If the host libc is used then the implementation will appear to work
297 * most of the time, but there will be a race condition where a
298 * signal could arrive just before we make the host syscall inside libc,
299 * and then then guest syscall will not correctly be interrupted.
300 * Instead the implementation of the guest syscall can use the safe_syscall
301 * function but otherwise just return the result or errno in the usual
302 * way; the main loop code will take care of restarting the syscall
305 * (If the implementation needs to make multiple host syscalls this is
306 * OK; any which might really block must be via safe_syscall(); for those
307 * which are only technically blocking (ie which we know in practice won't
308 * stay in the host kernel indefinitely) it's OK to use libc if necessary.
309 * You must be able to cope with backing out correctly if some safe_syscall
310 * you make in the implementation returns either -TARGET_ERESTARTSYS or
313 * block_signals() cannot be used for interruptible syscalls.
316 * How and why the safe_syscall implementation works:
318 * The basic setup is that we make the host syscall via a known
319 * section of host native assembly. If a signal occurs, our signal
320 * handler checks the interrupted host PC against the addresse of that
321 * known section. If the PC is before or at the address of the syscall
322 * instruction then we change the PC to point at a "return
323 * -TARGET_ERESTARTSYS" code path instead, and then exit the signal handler
324 * (causing the safe_syscall() call to immediately return that value).
325 * Then in the main.c loop if we see this magic return value we adjust
326 * the guest PC to wind it back to before the system call, and invoke
327 * the guest signal handler as usual.
329 * This winding-back will happen in two cases:
330 * (1) signal came in just before we took the host syscall (a race);
331 * in this case we'll take the guest signal and have another go
332 * at the syscall afterwards, and this is indistinguishable for the
333 * guest from the timing having been different such that the guest
334 * signal really did win the race
335 * (2) signal came in while the host syscall was blocking, and the
336 * host kernel decided the syscall should be restarted;
337 * in this case we want to restart the guest syscall also, and so
338 * rewinding is the right thing. (Note that "restart" semantics mean
339 * "first call the signal handler, then reattempt the syscall".)
340 * The other situation to consider is when a signal came in while the
341 * host syscall was blocking, and the host kernel decided that the syscall
342 * should not be restarted; in this case QEMU's host signal handler will
343 * be invoked with the PC pointing just after the syscall instruction,
344 * with registers indicating an EINTR return; the special code in the
345 * handler will not kick in, and we will return EINTR to the guest as
348 * Notice that we can leave the host kernel to make the decision for
349 * us about whether to do a restart of the syscall or not; we do not
350 * need to check SA_RESTART flags in QEMU or distinguish the various
351 * kinds of restartability.
353 #ifdef HAVE_SAFE_SYSCALL
354 /* The core part of this function is implemented in assembly */
355 extern long safe_syscall_base(int *pending
, long number
, ...);
357 #define safe_syscall(...) \
360 int *psp_ = &((TaskState *)thread_cpu->opaque)->signal_pending; \
361 ret_ = safe_syscall_base(psp_, __VA_ARGS__); \
362 if (is_error(ret_)) { \
371 /* Fallback for architectures which don't yet provide a safe-syscall assembly
372 * fragment; note that this is racy!
373 * This should go away when all host architectures have been updated.
375 #define safe_syscall syscall
380 int host_to_target_waitstatus(int status
);
383 void print_syscall(int num
,
384 abi_long arg1
, abi_long arg2
, abi_long arg3
,
385 abi_long arg4
, abi_long arg5
, abi_long arg6
);
386 void print_syscall_ret(int num
, abi_long arg1
);
388 * print_taken_signal:
389 * @target_signum: target signal being taken
390 * @tinfo: target_siginfo_t which will be passed to the guest for the signal
392 * Print strace output indicating that this signal is being taken by the guest,
393 * in a format similar to:
394 * --- SIGSEGV {si_signo=SIGSEGV, si_code=SI_KERNEL, si_addr=0} ---
396 void print_taken_signal(int target_signum
, const target_siginfo_t
*tinfo
);
399 void process_pending_signals(CPUArchState
*cpu_env
);
400 void signal_init(void);
401 int queue_signal(CPUArchState
*env
, int sig
, int si_type
,
402 target_siginfo_t
*info
);
403 void host_to_target_siginfo(target_siginfo_t
*tinfo
, const siginfo_t
*info
);
404 void target_to_host_siginfo(siginfo_t
*info
, const target_siginfo_t
*tinfo
);
405 int target_to_host_signal(int sig
);
406 int host_to_target_signal(int sig
);
407 long do_sigreturn(CPUArchState
*env
);
408 long do_rt_sigreturn(CPUArchState
*env
);
409 abi_long
do_sigaltstack(abi_ulong uss_addr
, abi_ulong uoss_addr
, abi_ulong sp
);
410 int do_sigprocmask(int how
, const sigset_t
*set
, sigset_t
*oldset
);
411 abi_long
do_swapcontext(CPUArchState
*env
, abi_ulong uold_ctx
,
412 abi_ulong unew_ctx
, abi_long ctx_size
);
414 * block_signals: block all signals while handling this guest syscall
416 * Block all signals, and arrange that the signal mask is returned to
417 * its correct value for the guest before we resume execution of guest code.
418 * If this function returns non-zero, then the caller should immediately
419 * return -TARGET_ERESTARTSYS to the main loop, which will take the pending
420 * signal and restart execution of the syscall.
421 * If block_signals() returns zero, then the caller can continue with
422 * emulation of the system call knowing that no signals can be taken
423 * (and therefore that no race conditions will result).
424 * This should only be called once, because if it is called a second time
425 * it will always return non-zero. (Think of it like a mutex that can't
426 * be recursively locked.)
427 * Signals will be unblocked again by process_pending_signals().
429 * Return value: non-zero if there was a pending signal, zero if not.
431 int block_signals(void); /* Returns non zero if signal pending */
435 void save_v86_state(CPUX86State
*env
);
436 void handle_vm86_trap(CPUX86State
*env
, int trapno
);
437 void handle_vm86_fault(CPUX86State
*env
);
438 int do_vm86(CPUX86State
*env
, long subfunction
, abi_ulong v86_addr
);
439 #elif defined(TARGET_SPARC64)
440 void sparc64_set_context(CPUSPARCState
*env
);
441 void sparc64_get_context(CPUSPARCState
*env
);
445 int target_mprotect(abi_ulong start
, abi_ulong len
, int prot
);
446 abi_long
target_mmap(abi_ulong start
, abi_ulong len
, int prot
,
447 int flags
, int fd
, abi_ulong offset
);
448 int target_munmap(abi_ulong start
, abi_ulong len
);
449 abi_long
target_mremap(abi_ulong old_addr
, abi_ulong old_size
,
450 abi_ulong new_size
, unsigned long flags
,
452 extern unsigned long last_brk
;
453 extern abi_ulong mmap_next_start
;
454 abi_ulong
mmap_find_vma(abi_ulong
, abi_ulong
, abi_ulong
);
455 void mmap_fork_start(void);
456 void mmap_fork_end(int child
);
459 extern unsigned long guest_stack_size
;
463 #define VERIFY_READ 0
464 #define VERIFY_WRITE 1 /* implies read access */
466 static inline int access_ok(int type
, abi_ulong addr
, abi_ulong size
)
468 return guest_addr_valid(addr
) &&
469 (size
== 0 || guest_addr_valid(addr
+ size
- 1)) &&
470 page_check_range((target_ulong
)addr
, size
,
471 (type
== VERIFY_READ
) ? PAGE_READ
: (PAGE_READ
| PAGE_WRITE
)) == 0;
474 /* NOTE __get_user and __put_user use host pointers and don't check access.
475 These are usually used to access struct data members once the struct has
476 been locked - usually with lock_user_struct. */
480 * - Use __builtin_choose_expr to avoid type promotion from ?:,
481 * - Invalid sizes result in a compile time error stemming from
482 * the fact that abort has no parameters.
483 * - It's easier to use the endian-specific unaligned load/store
484 * functions than host-endian unaligned load/store plus tswapN.
485 * - The pragmas are necessary only to silence a clang false-positive
486 * warning: see https://bugs.llvm.org/show_bug.cgi?id=39113 .
487 * - gcc has bugs in its _Pragma() support in some versions, eg
488 * https://gcc.gnu.org/bugzilla/show_bug.cgi?id=83256 -- so we only
489 * include the warning-suppression pragmas for clang
491 #if defined(__clang__) && __has_warning("-Waddress-of-packed-member")
492 #define PRAGMA_DISABLE_PACKED_WARNING \
493 _Pragma("GCC diagnostic push"); \
494 _Pragma("GCC diagnostic ignored \"-Waddress-of-packed-member\"")
496 #define PRAGMA_REENABLE_PACKED_WARNING \
497 _Pragma("GCC diagnostic pop")
500 #define PRAGMA_DISABLE_PACKED_WARNING
501 #define PRAGMA_REENABLE_PACKED_WARNING
504 #define __put_user_e(x, hptr, e) \
506 PRAGMA_DISABLE_PACKED_WARNING; \
507 (__builtin_choose_expr(sizeof(*(hptr)) == 1, stb_p, \
508 __builtin_choose_expr(sizeof(*(hptr)) == 2, stw_##e##_p, \
509 __builtin_choose_expr(sizeof(*(hptr)) == 4, stl_##e##_p, \
510 __builtin_choose_expr(sizeof(*(hptr)) == 8, stq_##e##_p, abort)))) \
511 ((hptr), (x)), (void)0); \
512 PRAGMA_REENABLE_PACKED_WARNING; \
515 #define __get_user_e(x, hptr, e) \
517 PRAGMA_DISABLE_PACKED_WARNING; \
518 ((x) = (typeof(*hptr))( \
519 __builtin_choose_expr(sizeof(*(hptr)) == 1, ldub_p, \
520 __builtin_choose_expr(sizeof(*(hptr)) == 2, lduw_##e##_p, \
521 __builtin_choose_expr(sizeof(*(hptr)) == 4, ldl_##e##_p, \
522 __builtin_choose_expr(sizeof(*(hptr)) == 8, ldq_##e##_p, abort)))) \
524 PRAGMA_REENABLE_PACKED_WARNING; \
528 #ifdef TARGET_WORDS_BIGENDIAN
529 # define __put_user(x, hptr) __put_user_e(x, hptr, be)
530 # define __get_user(x, hptr) __get_user_e(x, hptr, be)
532 # define __put_user(x, hptr) __put_user_e(x, hptr, le)
533 # define __get_user(x, hptr) __get_user_e(x, hptr, le)
536 /* put_user()/get_user() take a guest address and check access */
537 /* These are usually used to access an atomic data type, such as an int,
538 * that has been passed by address. These internally perform locking
539 * and unlocking on the data type.
541 #define put_user(x, gaddr, target_type) \
543 abi_ulong __gaddr = (gaddr); \
544 target_type *__hptr; \
545 abi_long __ret = 0; \
546 if ((__hptr = lock_user(VERIFY_WRITE, __gaddr, sizeof(target_type), 0))) { \
547 __put_user((x), __hptr); \
548 unlock_user(__hptr, __gaddr, sizeof(target_type)); \
550 __ret = -TARGET_EFAULT; \
554 #define get_user(x, gaddr, target_type) \
556 abi_ulong __gaddr = (gaddr); \
557 target_type *__hptr; \
558 abi_long __ret = 0; \
559 if ((__hptr = lock_user(VERIFY_READ, __gaddr, sizeof(target_type), 1))) { \
560 __get_user((x), __hptr); \
561 unlock_user(__hptr, __gaddr, 0); \
563 /* avoid warning */ \
565 __ret = -TARGET_EFAULT; \
570 #define put_user_ual(x, gaddr) put_user((x), (gaddr), abi_ulong)
571 #define put_user_sal(x, gaddr) put_user((x), (gaddr), abi_long)
572 #define put_user_u64(x, gaddr) put_user((x), (gaddr), uint64_t)
573 #define put_user_s64(x, gaddr) put_user((x), (gaddr), int64_t)
574 #define put_user_u32(x, gaddr) put_user((x), (gaddr), uint32_t)
575 #define put_user_s32(x, gaddr) put_user((x), (gaddr), int32_t)
576 #define put_user_u16(x, gaddr) put_user((x), (gaddr), uint16_t)
577 #define put_user_s16(x, gaddr) put_user((x), (gaddr), int16_t)
578 #define put_user_u8(x, gaddr) put_user((x), (gaddr), uint8_t)
579 #define put_user_s8(x, gaddr) put_user((x), (gaddr), int8_t)
581 #define get_user_ual(x, gaddr) get_user((x), (gaddr), abi_ulong)
582 #define get_user_sal(x, gaddr) get_user((x), (gaddr), abi_long)
583 #define get_user_u64(x, gaddr) get_user((x), (gaddr), uint64_t)
584 #define get_user_s64(x, gaddr) get_user((x), (gaddr), int64_t)
585 #define get_user_u32(x, gaddr) get_user((x), (gaddr), uint32_t)
586 #define get_user_s32(x, gaddr) get_user((x), (gaddr), int32_t)
587 #define get_user_u16(x, gaddr) get_user((x), (gaddr), uint16_t)
588 #define get_user_s16(x, gaddr) get_user((x), (gaddr), int16_t)
589 #define get_user_u8(x, gaddr) get_user((x), (gaddr), uint8_t)
590 #define get_user_s8(x, gaddr) get_user((x), (gaddr), int8_t)
592 /* copy_from_user() and copy_to_user() are usually used to copy data
593 * buffers between the target and host. These internally perform
594 * locking/unlocking of the memory.
596 abi_long
copy_from_user(void *hptr
, abi_ulong gaddr
, size_t len
);
597 abi_long
copy_to_user(abi_ulong gaddr
, void *hptr
, size_t len
);
599 /* Functions for accessing guest memory. The tget and tput functions
600 read/write single values, byteswapping as necessary. The lock_user function
601 gets a pointer to a contiguous area of guest memory, but does not perform
602 any byteswapping. lock_user may return either a pointer to the guest
603 memory, or a temporary buffer. */
605 /* Lock an area of guest memory into the host. If copy is true then the
606 host area will have the same contents as the guest. */
607 static inline void *lock_user(int type
, abi_ulong guest_addr
, long len
, int copy
)
609 if (!access_ok(type
, guest_addr
, len
))
614 addr
= g_malloc(len
);
616 memcpy(addr
, g2h(guest_addr
), len
);
618 memset(addr
, 0, len
);
622 return g2h(guest_addr
);
626 /* Unlock an area of guest memory. The first LEN bytes must be
627 flushed back to guest memory. host_ptr = NULL is explicitly
628 allowed and does nothing. */
629 static inline void unlock_user(void *host_ptr
, abi_ulong guest_addr
,
636 if (host_ptr
== g2h(guest_addr
))
639 memcpy(g2h(guest_addr
), host_ptr
, len
);
644 /* Return the length of a string in target memory or -TARGET_EFAULT if
646 abi_long
target_strlen(abi_ulong gaddr
);
648 /* Like lock_user but for null terminated strings. */
649 static inline void *lock_user_string(abi_ulong guest_addr
)
652 len
= target_strlen(guest_addr
);
655 return lock_user(VERIFY_READ
, guest_addr
, (long)(len
+ 1), 1);
658 /* Helper macros for locking/unlocking a target struct. */
659 #define lock_user_struct(type, host_ptr, guest_addr, copy) \
660 (host_ptr = lock_user(type, guest_addr, sizeof(*host_ptr), copy))
661 #define unlock_user_struct(host_ptr, guest_addr, copy) \
662 unlock_user(host_ptr, guest_addr, (copy) ? sizeof(*host_ptr) : 0)
666 static inline int is_error(abi_long ret
)
668 return (abi_ulong
)ret
>= (abi_ulong
)(-4096);
672 * preexit_cleanup: housekeeping before the guest exits
675 * code: the exit code
677 void preexit_cleanup(CPUArchState
*env
, int code
);
679 /* Include target-specific struct and function definitions;
680 * they may need access to the target-independent structures
681 * above, so include them last.
683 #include "target_cpu.h"
684 #include "target_structs.h"