diff options
Diffstat (limited to 'linux-user')
| -rw-r--r-- | linux-user/arm-semi.c | 41 | ||||
| -rw-r--r-- | linux-user/elfload.c | 178 | ||||
| -rw-r--r-- | linux-user/ioctls.h | 2 | ||||
| -rw-r--r-- | linux-user/main.c | 58 | ||||
| -rw-r--r-- | linux-user/mmap.c | 164 | ||||
| -rw-r--r-- | linux-user/qemu.h | 141 | ||||
| -rw-r--r-- | linux-user/signal.c | 32 | ||||
| -rw-r--r-- | linux-user/syscall.c | 1118 | ||||
| -rw-r--r-- | linux-user/syscall_types.h | 3 | ||||
| -rw-r--r-- | linux-user/vm86.c | 43 |
10 files changed, 1079 insertions, 701 deletions
diff --git a/linux-user/arm-semi.c b/linux-user/arm-semi.c index 472361a478..250d5b75cc 100644 --- a/linux-user/arm-semi.c +++ b/linux-user/arm-semi.c @@ -77,20 +77,20 @@ static inline uint32_t set_swi_errno(TaskState *ts, uint32_t code) return code; } -#define ARG(x) tswap32(args[x]) +#define ARG(n) tget32(args + n * 4) uint32_t do_arm_semihosting(CPUState *env) { - uint32_t *args; + target_ulong args; char * s; int nr; uint32_t ret; TaskState *ts = env->opaque; nr = env->regs[0]; - args = (uint32_t *)env->regs[1]; + args = env->regs[1]; switch (nr) { case SYS_OPEN: - s = (char *)ARG(0); + s = (char *)g2h(ARG(0)); if (ARG(1) >= 12) return (uint32_t)-1; if (strcmp(s, ":tt") == 0) { @@ -103,18 +103,23 @@ uint32_t do_arm_semihosting(CPUState *env) case SYS_CLOSE: return set_swi_errno(ts, close(ARG(0))); case SYS_WRITEC: - /* Write to debug console. stderr is near enough. */ - return write(STDERR_FILENO, args, 1); + { + char c = tget8(args); + /* Write to debug console. stderr is near enough. */ + return write(STDERR_FILENO, &c, 1); + } case SYS_WRITE0: - s = (char *)args; - return write(STDERR_FILENO, s, strlen(s)); + s = lock_user_string(args); + ret = write(STDERR_FILENO, s, strlen(s)); + unlock_user(s, args, 0); + return ret; case SYS_WRITE: - ret = set_swi_errno(ts, write(ARG(0), (void *)ARG(1), ARG(2))); + ret = set_swi_errno(ts, write(ARG(0), g2h(ARG(1)), ARG(2))); if (ret == (uint32_t)-1) return -1; return ARG(2) - ret; case SYS_READ: - ret = set_swi_errno(ts, read(ARG(0), (void *)ARG(1), ARG(2))); + ret = set_swi_errno(ts, read(ARG(0), g2h(ARG(1)), ARG(2))); if (ret == (uint32_t)-1) return -1; return ARG(2) - ret; @@ -140,20 +145,21 @@ uint32_t do_arm_semihosting(CPUState *env) /* XXX: Not implemented. */ return -1; case SYS_REMOVE: - return set_swi_errno(ts, remove((char *)ARG(0))); + return set_swi_errno(ts, remove((char *)g2h(ARG(0)))); case SYS_RENAME: - return set_swi_errno(ts, rename((char *)ARG(0), (char *)ARG(2))); + return set_swi_errno(ts, rename((char *)g2h(ARG(0)), + (char *)g2h(ARG(2)))); case SYS_CLOCK: return clock() / (CLOCKS_PER_SEC / 100); case SYS_TIME: return set_swi_errno(ts, time(NULL)); case SYS_SYSTEM: - return set_swi_errno(ts, system((char *)ARG(0))); + return set_swi_errno(ts, system((char *)g2h(ARG(0)))); case SYS_ERRNO: return ts->swi_errno; case SYS_GET_CMDLINE: /* XXX: Not implemented. */ - s = (char *)ARG(0); + s = (char *)g2h(ARG(0)); *s = 0; return -1; case SYS_HEAPINFO: @@ -166,11 +172,11 @@ uint32_t do_arm_semihosting(CPUState *env) if (!ts->heap_limit) { long ret; - ts->heap_base = do_brk(NULL); + ts->heap_base = do_brk(0); limit = ts->heap_base + ARM_ANGEL_HEAP_SIZE; /* Try a big heap, and reduce the size if that fails. */ for (;;) { - ret = do_brk((char *)limit); + ret = do_brk(limit); if (ret != -1) break; limit = (ts->heap_base >> 1) + (limit >> 1); @@ -178,7 +184,8 @@ uint32_t do_arm_semihosting(CPUState *env) ts->heap_limit = limit; } - ptr = (uint32_t *)ARG(0); + page_unprotect_range (ARG(0), 32); + ptr = (uint32_t *)g2h(ARG(0)); ptr[0] = tswap32(ts->heap_base); ptr[1] = tswap32(ts->heap_limit); ptr[2] = tswap32(ts->stack_base); diff --git a/linux-user/elfload.c b/linux-user/elfload.c index c934fb831b..14c00852a4 100644 --- a/linux-user/elfload.c +++ b/linux-user/elfload.c @@ -97,17 +97,17 @@ static inline void init_thread(struct target_pt_regs *regs, struct image_info *i static inline void init_thread(struct target_pt_regs *regs, struct image_info *infop) { - target_long *stack = (void *)infop->start_stack; + target_long stack = infop->start_stack; memset(regs, 0, sizeof(*regs)); regs->ARM_cpsr = 0x10; if (infop->entry & 1) regs->ARM_cpsr |= CPSR_T; regs->ARM_pc = infop->entry & 0xfffffffe; regs->ARM_sp = infop->start_stack; - regs->ARM_r2 = tswapl(stack[2]); /* envp */ - regs->ARM_r1 = tswapl(stack[1]); /* argv */ + regs->ARM_r2 = tgetl(stack + 8); /* envp */ + regs->ARM_r1 = tgetl(stack + 4); /* envp */ /* XXX: it seems that r0 is zeroed after ! */ - // regs->ARM_r0 = tswapl(stack[0]); /* argc */ + // regs->ARM_r0 = tgetl(stack); /* argc */ } #define USE_ELF_CORE_DUMP @@ -202,7 +202,7 @@ do { \ _r->gpr[3] = bprm->argc; \ _r->gpr[4] = (unsigned long)++pos; \ for (; tmp != 0; pos++) \ - tmp = *pos; \ + tmp = ldl(pos); \ _r->gpr[5] = (unsigned long)pos; \ } while (0) @@ -297,7 +297,7 @@ static inline void init_thread(struct target_pt_regs *regs, struct image_info *i */ struct linux_binprm { char buf[128]; - unsigned long page[MAX_ARG_PAGES]; + void *page[MAX_ARG_PAGES]; unsigned long p; int sh_bang; int fd; @@ -427,37 +427,13 @@ static void bswap_sym(Elf32_Sym *sym) } #endif -static void * get_free_page(void) -{ - void * retval; - - /* User-space version of kernel get_free_page. Returns a page-aligned - * page-sized chunk of memory. - */ - retval = (void *)target_mmap(0, qemu_host_page_size, PROT_READ|PROT_WRITE, - MAP_PRIVATE|MAP_ANONYMOUS, -1, 0); - - if((long)retval == -1) { - perror("get_free_page"); - exit(-1); - } - else { - return(retval); - } -} - -static void free_page(void * pageaddr) -{ - target_munmap((unsigned long)pageaddr, qemu_host_page_size); -} - /* * 'copy_string()' copies argument/envelope strings from user * memory to free pages in kernel mem. These are in a format ready * to be put directly into the top of new user memory. * */ -static unsigned long copy_strings(int argc,char ** argv,unsigned long *page, +static unsigned long copy_strings(int argc,char ** argv, void **page, unsigned long p) { char *tmp, *tmp1, *pag = NULL; @@ -482,10 +458,10 @@ static unsigned long copy_strings(int argc,char ** argv,unsigned long *page, --p; --tmp; --len; if (--offset < 0) { offset = p % TARGET_PAGE_SIZE; - pag = (char *) page[p/TARGET_PAGE_SIZE]; + pag = (char *)page[p/TARGET_PAGE_SIZE]; if (!pag) { - pag = (char *)get_free_page(); - page[p/TARGET_PAGE_SIZE] = (unsigned long)pag; + pag = (char *)malloc(TARGET_PAGE_SIZE); + page[p/TARGET_PAGE_SIZE] = pag; if (!pag) return 0; } @@ -591,10 +567,20 @@ static int prepare_binprm(struct linux_binprm *bprm) } } -unsigned long setup_arg_pages(unsigned long p, struct linux_binprm * bprm, - struct image_info * info) +static inline void memcpy_to_target(target_ulong dest, const void *src, + unsigned long len) { - unsigned long stack_base, size, error; + void *host_ptr; + + host_ptr = lock_user(dest, len, 0); + memcpy(host_ptr, src, len); + unlock_user(host_ptr, dest, 1); +} + +unsigned long setup_arg_pages(target_ulong p, struct linux_binprm * bprm, + struct image_info * info) +{ + target_ulong stack_base, size, error; int i; /* Create enough stack to hold everything. If we don't use @@ -627,10 +613,10 @@ unsigned long setup_arg_pages(unsigned long p, struct linux_binprm * bprm, if (bprm->page[i]) { info->rss++; - memcpy((void *)stack_base, (void *)bprm->page[i], TARGET_PAGE_SIZE); - free_page((void *)bprm->page[i]); + memcpy_to_target(stack_base, bprm->page[i], TARGET_PAGE_SIZE); + free(bprm->page[i]); } - stack_base += TARGET_PAGE_SIZE; + stack_base += TARGET_PAGE_SIZE; } return p; } @@ -657,7 +643,6 @@ static void set_brk(unsigned long start, unsigned long end) static void padzero(unsigned long elf_bss) { unsigned long nbyte; - char * fpnt; /* XXX: this is really a hack : if the real host page size is smaller than the target page size, some pages after the end @@ -679,55 +664,57 @@ static void padzero(unsigned long elf_bss) nbyte = elf_bss & (qemu_host_page_size-1); if (nbyte) { nbyte = qemu_host_page_size - nbyte; - fpnt = (char *) elf_bss; do { - *fpnt++ = 0; + tput8(elf_bss, 0); + elf_bss++; } while (--nbyte); } } -static unsigned int * create_elf_tables(char *p, int argc, int envc, - struct elfhdr * exec, - unsigned long load_addr, - unsigned long load_bias, - unsigned long interp_load_addr, int ibcs, - struct image_info *info) + +static unsigned long create_elf_tables(target_ulong p, int argc, int envc, + struct elfhdr * exec, + unsigned long load_addr, + unsigned long load_bias, + unsigned long interp_load_addr, int ibcs, + struct image_info *info) { - target_ulong *argv, *envp; - target_ulong *sp, *csp; - target_ulong *u_platform; + target_ulong argv, envp; + target_ulong sp; + int size; + target_ulong u_platform; const char *k_platform; - int v; + const int n = sizeof(target_ulong); - /* - * Force 16 byte _final_ alignment here for generality. - */ - sp = (unsigned int *) (~15UL & (unsigned long) p); - u_platform = NULL; + sp = p; + u_platform = 0; k_platform = ELF_PLATFORM; if (k_platform) { size_t len = strlen(k_platform) + 1; - sp -= (len + sizeof(target_ulong) - 1) / sizeof(target_ulong); - u_platform = (target_ulong *)sp; - __copy_to_user(u_platform, k_platform, len); + sp -= (len + n - 1) & ~(n - 1); + u_platform = sp; + memcpy_to_target(sp, k_platform, len); } - csp = sp; - csp -= (DLINFO_ITEMS + 1) * 2; + /* + * Force 16 byte _final_ alignment here for generality. + */ + sp = sp &~ (target_ulong)15; + size = (DLINFO_ITEMS + 1) * 2; if (k_platform) - csp -= 2; + size += 2; #ifdef DLINFO_ARCH_ITEMS - csp -= DLINFO_ARCH_ITEMS*2; + size += DLINFO_ARCH_ITEMS * 2; #endif - csp -= envc+1; - csp -= argc+1; - csp -= (!ibcs ? 3 : 1); /* argc itself */ - if ((unsigned long)csp & 15UL) - sp -= ((unsigned long)csp & 15UL) / sizeof(*sp); + size += envc + argc + 2; + size += (!ibcs ? 3 : 1); /* argc itself */ + size *= n; + if (size & 15) + sp -= 16 - (size & 15); -#define NEW_AUX_ENT(id, val) \ - sp -= 2; \ - put_user (id, sp); \ - put_user (val, sp + 1) +#define NEW_AUX_ENT(id, val) do { \ + sp -= n; tputl(sp, val); \ + sp -= n; tputl(sp, id); \ + } while(0) NEW_AUX_ENT (AT_NULL, 0); /* There must be exactly DLINFO_ITEMS entries here. */ @@ -744,7 +731,7 @@ static unsigned int * create_elf_tables(char *p, int argc, int envc, NEW_AUX_ENT(AT_EGID, (target_ulong) getegid()); NEW_AUX_ENT(AT_HWCAP, (target_ulong) ELF_HWCAP); if (k_platform) - NEW_AUX_ENT(AT_PLATFORM, (target_ulong) u_platform); + NEW_AUX_ENT(AT_PLATFORM, u_platform); #ifdef ARCH_DLINFO /* * ARCH_DLINFO must come last so platform specific code can enforce @@ -754,39 +741,32 @@ static unsigned int * create_elf_tables(char *p, int argc, int envc, #endif #undef NEW_AUX_ENT - sp -= envc+1; + sp -= (envc + 1) * n; envp = sp; - sp -= argc+1; + sp -= (argc + 1) * n; argv = sp; if (!ibcs) { - put_user((target_ulong)envp,--sp); - put_user((target_ulong)argv,--sp); + sp -= n; tputl(sp, envp); + sp -= n; tputl(sp, argv); } - put_user(argc,--sp); - info->arg_start = (unsigned int)((unsigned long)p & 0xffffffff); + sp -= n; tputl(sp, argc); + info->arg_start = p; while (argc-->0) { - put_user((target_ulong)p,argv++); - do { - get_user(v, p); - p++; - } while (v != 0); + tputl(argv, p); argv += n; + p += target_strlen(p) + 1; } - put_user(0,argv); - info->arg_end = info->env_start = (unsigned int)((unsigned long)p & 0xffffffff); + tputl(argv, 0); + info->arg_end = info->env_start = p; while (envc-->0) { - put_user((target_ulong)p,envp++); - do { - get_user(v, p); - p++; - } while (v != 0); + tputl(envp, p); envp += n; + p += target_strlen(p) + 1; } - put_user(0,envp); - info->env_end = (unsigned int)((unsigned long)p & 0xffffffff); + tputl(envp, 0); + info->env_end = p; return sp; } - static unsigned long load_elf_interp(struct elfhdr * interp_elf_ex, int interpreter_fd, unsigned long *interp_load_addr) @@ -1335,8 +1315,7 @@ static int load_elf_binary(struct linux_binprm * bprm, struct target_pt_regs * r #ifdef LOW_ELF_STACK info->start_stack = bprm->p = elf_stack - 4; #endif - bprm->p = (unsigned long) - create_elf_tables((char *)bprm->p, + bprm->p = create_elf_tables(bprm->p, bprm->argc, bprm->envc, &elf_ex, @@ -1432,6 +1411,7 @@ int elf_exec(const char * filename, char ** argv, char ** envp, if(retval>=0) { retval = load_elf_binary(&bprm,regs,infop); } + if(retval>=0) { /* success. Initialize important registers */ init_thread(regs, infop); @@ -1440,7 +1420,7 @@ int elf_exec(const char * filename, char ** argv, char ** envp, /* Something went wrong, return the inode and free the argument pages*/ for (i=0 ; i<MAX_ARG_PAGES ; i++) { - free_page((void *)bprm.page[i]); + free(bprm.page[i]); } return(retval); } diff --git a/linux-user/ioctls.h b/linux-user/ioctls.h index daefaec6f9..dae3efaa97 100644 --- a/linux-user/ioctls.h +++ b/linux-user/ioctls.h @@ -55,7 +55,7 @@ IOCTL(KDMKTONE, 0, TYPE_INT) IOCTL(KDGKBTYPE, IOC_R, MK_PTR(TYPE_CHAR)) IOCTL(KDGKBENT, IOC_RW, MK_PTR(MK_STRUCT(STRUCT_kbentry))) - IOCTL(KDGKBSENT, IOC_RW, TYPE_PTRVOID) + IOCTL(KDGKBSENT, IOC_RW, MK_PTR(MK_STRUCT(STRUCT_kbsentry))) IOCTL(BLKROSET, IOC_W, MK_PTR(TYPE_INT)) IOCTL(BLKROGET, IOC_R, MK_PTR(TYPE_INT)) diff --git a/linux-user/main.c b/linux-user/main.c index 81450051bb..1f4720516d 100644 --- a/linux-user/main.c +++ b/linux-user/main.c @@ -152,21 +152,25 @@ static void write_dt(void *ptr, unsigned long addr, unsigned long limit, int flags) { unsigned int e1, e2; + uint32_t *p; e1 = (addr << 16) | (limit & 0xffff); e2 = ((addr >> 16) & 0xff) | (addr & 0xff000000) | (limit & 0x000f0000); e2 |= flags; - stl((uint8_t *)ptr, e1); - stl((uint8_t *)ptr + 4, e2); + p = ptr; + p[0] = tswapl(e1); + p[1] = tswapl(e2); } static void set_gate(void *ptr, unsigned int type, unsigned int dpl, unsigned long addr, unsigned int sel) { unsigned int e1, e2; + uint32_t *p; e1 = (addr & 0xffff) | (sel << 16); e2 = (addr & 0xffff0000) | 0x8000 | (dpl << 13) | (type << 8); - stl((uint8_t *)ptr, e1); - stl((uint8_t *)ptr + 4, e2); + p = ptr; + p[0] = tswapl(e1); + p[1] = tswapl(e2); } uint64_t gdt_table[6]; @@ -343,7 +347,7 @@ void cpu_loop(CPUARMState *env) /* we handle the FPU emulation here, as Linux */ /* we get the opcode */ - opcode = ldl_raw((uint8_t *)env->regs[15]); + opcode = tget32(env->regs[15]); if (EmulateAll(opcode, &ts->fpa, env) == 0) { info.si_signo = SIGILL; @@ -364,20 +368,20 @@ void cpu_loop(CPUARMState *env) /* system call */ if (trapnr == EXCP_BKPT) { if (env->thumb) { - insn = lduw((void *)(env->regs[15])); + insn = tget16(env->regs[15]); n = insn & 0xff; env->regs[15] += 2; } else { - insn = ldl((void *)(env->regs[15])); + insn = tget32(env->regs[15]); n = (insn & 0xf) | ((insn >> 4) & 0xff0); env->regs[15] += 4; } } else { if (env->thumb) { - insn = lduw((void *)(env->regs[15] - 2)); + insn = tget16(env->regs[15] - 2); n = insn & 0xff; } else { - insn = ldl((void *)(env->regs[15] - 4)); + insn = tget32(env->regs[15] - 4); n = insn & 0xffffff; } } @@ -475,16 +479,16 @@ static inline int get_reg_index(CPUSPARCState *env, int cwp, int index) static inline void save_window_offset(CPUSPARCState *env, int cwp1) { unsigned int i; - uint32_t *sp_ptr; + target_ulong sp_ptr; - sp_ptr = (uint32_t *)(env->regbase[get_reg_index(env, cwp1, 6)]); + sp_ptr = env->regbase[get_reg_index(env, cwp1, 6)]; #if defined(DEBUG_WIN) printf("win_overflow: sp_ptr=0x%x save_cwp=%d\n", (int)sp_ptr, cwp1); #endif for(i = 0; i < 16; i++) { - put_user(env->regbase[get_reg_index(env, cwp1, 8 + i)], sp_ptr); - sp_ptr++; + tputl(sp_ptr, env->regbase[get_reg_index(env, cwp1, 8 + i)]); + sp_ptr += sizeof(target_ulong); } } @@ -500,22 +504,21 @@ static void save_window(CPUSPARCState *env) static void restore_window(CPUSPARCState *env) { unsigned int new_wim, i, cwp1; - uint32_t *sp_ptr, reg; + target_ulong sp_ptr; new_wim = ((env->wim << 1) | (env->wim >> (NWINDOWS - 1))) & ((1LL << NWINDOWS) - 1); /* restore the invalid window */ cwp1 = (env->cwp + 1) & (NWINDOWS - 1); - sp_ptr = (uint32_t *)(env->regbase[get_reg_index(env, cwp1, 6)]); + sp_ptr = env->regbase[get_reg_index(env, cwp1, 6)]; #if defined(DEBUG_WIN) printf("win_underflow: sp_ptr=0x%x load_cwp=%d\n", (int)sp_ptr, cwp1); #endif for(i = 0; i < 16; i++) { - get_user(reg, sp_ptr); - env->regbase[get_reg_index(env, cwp1, 8 + i)] = reg; - sp_ptr++; + env->regbase[get_reg_index(env, cwp1, 8 + i)] = tgetl(sp_ptr); + sp_ptr += sizeof(target_ulong); } env->wim = new_wim; } @@ -1304,15 +1307,9 @@ void cpu_loop(CPUMIPSState *env) if (nb_args >= 5) { sp_reg = env->gpr[29]; /* these arguments are taken from the stack */ - if (get_user(arg5, (target_ulong *)(sp_reg + 16))) { - ret = -EFAULT; - goto fail; - } + arg5 = tgetl(sp_reg + 16); if (nb_args >= 6) { - if (get_user(arg6, (target_ulong *)(sp_reg + 20))) { - ret = -EFAULT; - goto fail; - } + arg6 = tgetl(sp_reg + 20); } else { arg6 = 0; } @@ -1347,8 +1344,7 @@ void cpu_loop(CPUMIPSState *env) { uint32_t insn, op; - if (get_user(insn, (uint32_t *)env->PC) < 0) - goto sigill; + insn = tget32(env->PC); op = insn >> 26; // printf("insn=%08x op=%02x\n", insn, op); /* XXX: totally dummy FP ops just to be able to launch @@ -1531,7 +1527,7 @@ int main(int argc, char **argv) fprintf(logfile, "entry 0x%08lx\n" , info->entry); } - target_set_brk((char *)info->brk); + target_set_brk(info->brk); syscall_init(); signal_init(); @@ -1566,7 +1562,7 @@ int main(int argc, char **argv) env->eip = regs->eip; /* linux interrupt setup */ - env->idt.base = (long)idt_table; + env->idt.base = h2g(idt_table); env->idt.limit = sizeof(idt_table) - 1; set_idt(0, 0); set_idt(1, 0); @@ -1591,7 +1587,7 @@ int main(int argc, char **argv) set_idt(0x80, 3); /* linux segment setup */ - env->gdt.base = (long)gdt_table; + env->gdt.base = h2g(gdt_table); env->gdt.limit = sizeof(gdt_table) - 1; write_dt(&gdt_table[__USER_CS >> 3], 0, 0xfffff, DESC_G_MASK | DESC_B_MASK | DESC_P_MASK | DESC_S_MASK | diff --git a/linux-user/mmap.c b/linux-user/mmap.c index 948f2f6b2e..0c906257b1 100644 --- a/linux-user/mmap.c +++ b/linux-user/mmap.c @@ -29,10 +29,10 @@ //#define DEBUG_MMAP -/* NOTE: all the constants are the HOST ones */ -int target_mprotect(unsigned long start, unsigned long len, int prot) +/* NOTE: all the constants are the HOST ones, but addresses are target. */ +int target_mprotect(target_ulong start, target_ulong len, int prot) { - unsigned long end, host_start, host_end, addr; + target_ulong end, host_start, host_end, addr; int prot1, ret; #ifdef DEBUG_MMAP @@ -67,7 +67,7 @@ int target_mprotect(unsigned long start, unsigned long len, int prot) } end = host_end; } - ret = mprotect((void *)host_start, qemu_host_page_size, prot1 & PAGE_BITS); + ret = mprotect(g2h(host_start), qemu_host_page_size, prot1 & PAGE_BITS); if (ret != 0) return ret; host_start += qemu_host_page_size; @@ -77,7 +77,7 @@ int target_mprotect(unsigned long start, unsigned long len, int prot) for(addr = end; addr < host_end; addr += TARGET_PAGE_SIZE) { prot1 |= page_get_flags(addr); } - ret = mprotect((void *)(host_end - qemu_host_page_size), qemu_host_page_size, + ret = mprotect(g2h(host_end - qemu_host_page_size), qemu_host_page_size, prot1 & PAGE_BITS); if (ret != 0) return ret; @@ -86,7 +86,7 @@ int target_mprotect(unsigned long start, unsigned long len, int prot) /* handle the pages in the middle */ if (host_start < host_end) { - ret = mprotect((void *)host_start, host_end - host_start, prot); + ret = mprotect(g2h(host_start), host_end - host_start, prot); if (ret != 0) return ret; } @@ -95,28 +95,31 @@ int target_mprotect(unsigned long start, unsigned long len, int prot) } /* map an incomplete host page */ -int mmap_frag(unsigned long host_start, - unsigned long start, unsigned long end, - int prot, int flags, int fd, unsigned long offset) +static int mmap_frag(target_ulong real_start, + target_ulong start, target_ulong end, + int prot, int flags, int fd, target_ulong offset) { - unsigned long host_end, ret, addr; + target_ulong real_end, ret, addr; + void *host_start; int prot1, prot_new; - host_end = host_start + qemu_host_page_size; + real_end = real_start + qemu_host_page_size; + host_start = g2h(real_start); /* get the protection of the target pages outside the mapping */ prot1 = 0; - for(addr = host_start; addr < host_end; addr++) { + for(addr = real_start; addr < real_end; addr++) { if (addr < start || addr >= end) prot1 |= page_get_flags(addr); } if (prot1 == 0) { /* no page was there, so we allocate one */ - ret = (long)mmap((void *)host_start, qemu_host_page_size, prot, + ret = (long)mmap(host_start, qemu_host_page_size, prot, flags | MAP_ANONYMOUS, -1, 0); if (ret == -1) return ret; + prot1 = prot; } prot1 &= PAGE_BITS; @@ -130,31 +133,35 @@ int mmap_frag(unsigned long host_start, /* adjust protection to be able to read */ if (!(prot1 & PROT_WRITE)) - mprotect((void *)host_start, qemu_host_page_size, prot1 | PROT_WRITE); + mprotect(host_start, qemu_host_page_size, prot1 | PROT_WRITE); /* read the corresponding file data */ - pread(fd, (void *)start, end - start, offset); + pread(fd, g2h(start), end - start, offset); /* put final protection */ if (prot_new != (prot1 | PROT_WRITE)) - mprotect((void *)host_start, qemu_host_page_size, prot_new); + mprotect(host_start, qemu_host_page_size, prot_new); } else { /* just update the protection */ if (prot_new != prot1) { - mprotect((void *)host_start, qemu_host_page_size, prot_new); + mprotect(host_start, qemu_host_page_size, prot_new); } } return 0; } /* NOTE: all the constants are the HOST ones */ -long target_mmap(unsigned long start, unsigned long len, int prot, - int flags, int fd, unsigned long offset) +long target_mmap(target_ulong start, target_ulong len, int prot, + int flags, int fd, target_ulong offset) { - unsigned long ret, end, host_start, host_end, retaddr, host_offset, host_len; + target_ulong ret, end, real_start, real_end, retaddr, host_offset, host_len; + long host_start; #if defined(__alpha__) || defined(__sparc__) || defined(__x86_64__) || \ defined(__ia64) - static unsigned long last_start = 0x40000000; + static target_ulong last_start = 0x40000000; +#elif defined(__CYGWIN__) + /* Cygwin doesn't have a whole lot of address space. */ + static target_ulong last_start = 0x18000000; #endif #ifdef DEBUG_MMAP @@ -191,45 +198,49 @@ long target_mmap(unsigned long start, unsigned long len, int prot, len = TARGET_PAGE_ALIGN(len); if (len == 0) return start; - host_start = start & qemu_host_page_mask; + real_start = start & qemu_host_page_mask; if (!(flags & MAP_FIXED)) { #if defined(__alpha__) || defined(__sparc__) || defined(__x86_64__) || \ - defined(__ia64) + defined(__ia64) || defined(__CYGWIN__) /* tell the kenel to search at the same place as i386 */ - if (host_start == 0) { - host_start = last_start; + if (real_start == 0) { + real_start = last_start; last_start += HOST_PAGE_ALIGN(len); } #endif if (qemu_host_page_size != qemu_real_host_page_size) { /* NOTE: this code is only for debugging with '-p' option */ + /* ??? Can also occur when TARGET_PAGE_SIZE > host page size. */ /* reserve a memory area */ + /* ??? This needs fixing for remapping. */ +abort(); host_len = HOST_PAGE_ALIGN(len) + qemu_host_page_size - TARGET_PAGE_SIZE; - host_start = (long)mmap((void *)host_start, host_len, PROT_NONE, + real_start = (long)mmap(g2h(real_start), host_len, PROT_NONE, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0); - if (host_start == -1) - return host_start; - host_end = host_start + host_len; - start = HOST_PAGE_ALIGN(host_start); + if (real_start == -1) + return real_start; + real_end = real_start + host_len; + start = HOST_PAGE_ALIGN(real_start); end = start + HOST_PAGE_ALIGN(len); - if (start > host_start) - munmap((void *)host_start, start - host_start); - if (end < host_end) - munmap((void *)end, host_end - end); + if (start > real_start) + munmap((void *)real_start, start - real_start); + if (end < real_end) + munmap((void *)end, real_end - end); /* use it as a fixed mapping */ flags |= MAP_FIXED; } else { /* if not fixed, no need to do anything */ host_offset = offset & qemu_host_page_mask; host_len = len + offset - host_offset; - start = (long)mmap((void *)host_start, host_len, - prot, flags, fd, host_offset); - if (start == -1) - return start; + host_start = (long)mmap(real_start ? g2h(real_start) : NULL, + host_len, prot, flags, fd, host_offset); + if (host_start == -1) + return host_start; /* update start so that it points to the file position at 'offset' */ if (!(flags & MAP_ANONYMOUS)) - start += offset - host_offset; + host_start += offset - host_offset; + start = h2g(host_start); goto the_end1; } } @@ -239,7 +250,7 @@ long target_mmap(unsigned long start, unsigned long len, int prot, return -1; } end = start + len; - host_end = HOST_PAGE_ALIGN(end); + real_end = HOST_PAGE_ALIGN(end); /* worst case: we cannot map the file because the offset is not aligned, so we read it */ @@ -257,7 +268,7 @@ long target_mmap(unsigned long start, unsigned long len, int prot, -1, 0); if (retaddr == -1) return retaddr; - pread(fd, (void *)start, len, offset); + pread(fd, g2h(start), len, offset); if (!(prot & PROT_WRITE)) { ret = target_mprotect(start, len, prot); if (ret != 0) @@ -267,40 +278,40 @@ long target_mmap(unsigned long start, unsigned long len, int prot, } /* handle the start of the mapping */ - if (start > host_start) { - if (host_end == host_start + qemu_host_page_size) { + if (start > real_start) { + if (real_end == real_start + qemu_host_page_size) { /* one single host page */ - ret = mmap_frag(host_start, start, end, + ret = mmap_frag(real_start, start, end, prot, flags, fd, offset); if (ret == -1) return ret; goto the_end1; } - ret = mmap_frag(host_start, start, host_start + qemu_host_page_size, + ret = mmap_frag(real_start, start, real_start + qemu_host_page_size, prot, flags, fd, offset); if (ret == -1) return ret; - host_start += qemu_host_page_size; + real_start += qemu_host_page_size; } /* handle the end of the mapping */ - if (end < host_end) { - ret = mmap_frag(host_end - qemu_host_page_size, - host_end - qemu_host_page_size, host_end, + if (end < real_end) { + ret = mmap_frag(real_end - qemu_host_page_size, + real_end - qemu_host_page_size, real_end, prot, flags, fd, - offset + host_end - qemu_host_page_size - start); + offset + real_end - qemu_host_page_size - start); if (ret == -1) return ret; - host_end -= qemu_host_page_size; + real_end -= qemu_host_page_size; } /* map the middle (easier) */ - if (host_start < host_end) { + if (real_start < real_end) { unsigned long offset1; if (flags & MAP_ANONYMOUS) offset1 = 0; else - offset1 = offset + host_start - start; - ret = (long)mmap((void *)host_start, host_end - host_start, + offset1 = offset + real_start - start; + ret = (long)mmap(g2h(real_start), real_end - real_start, prot, flags, fd, offset1); if (ret == -1) return ret; @@ -316,9 +327,9 @@ long target_mmap(unsigned long start, unsigned long len, int prot, return start; } -int target_munmap(unsigned long start, unsigned long len) +int target_munmap(target_ulong start, target_ulong len) { - unsigned long end, host_start, host_end, addr; + target_ulong end, real_start, real_end, addr; int prot, ret; #ifdef DEBUG_MMAP @@ -330,36 +341,36 @@ int target_munmap(unsigned long start, unsigned long len) if (len == 0) return -EINVAL; end = start + len; - host_start = start & qemu_host_page_mask; - host_end = HOST_PAGE_ALIGN(end); + real_start = start & qemu_host_page_mask; + real_end = HOST_PAGE_ALIGN(end); - if (start > host_start) { + if (start > real_start) { /* handle host page containing start */ prot = 0; - for(addr = host_start; addr < start; addr += TARGET_PAGE_SIZE) { + for(addr = real_start; addr < start; addr += TARGET_PAGE_SIZE) { prot |= page_get_flags(addr); } - if (host_end == host_start + qemu_host_page_size) { - for(addr = end; addr < host_end; addr += TARGET_PAGE_SIZE) { + if (real_end == real_start + qemu_host_page_size) { + for(addr = end; addr < real_end; addr += TARGET_PAGE_SIZE) { prot |= page_get_flags(addr); } - end = host_end; + end = real_end; } if (prot != 0) - host_start += qemu_host_page_size; + real_start += qemu_host_page_size; } - if (end < host_end) { + if (end < real_end) { prot = 0; - for(addr = end; addr < host_end; addr += TARGET_PAGE_SIZE) { + for(addr = end; addr < real_end; addr += TARGET_PAGE_SIZE) { prot |= page_get_flags(addr); } if (prot != 0) - host_end -= qemu_host_page_size; + real_end -= qemu_host_page_size; } /* unmap what we can */ - if (host_start < host_end) { - ret = munmap((void *)host_start, host_end - host_start); + if (real_start < real_end) { + ret = munmap((void *)real_start, real_end - real_start); if (ret != 0) return ret; } @@ -370,25 +381,26 @@ int target_munmap(unsigned long start, unsigned long len) /* XXX: currently, we only handle MAP_ANONYMOUS and not MAP_FIXED blocks which have been allocated starting on a host page */ -long target_mremap(unsigned long old_addr, unsigned long old_size, - unsigned long new_size, unsigned long flags, - unsigned long new_addr) +long target_mremap(target_ulong old_addr, target_ulong old_size, + target_ulong new_size, unsigned long flags, + target_ulong new_addr) { int prot; /* XXX: use 5 args syscall */ - new_addr = (long)mremap((void *)old_addr, old_size, new_size, flags); + new_addr = (long)mremap(g2h(old_addr), old_size, new_size, flags); if (new_addr == -1) return new_addr; + new_addr = h2g(new_addr); prot = page_get_flags(old_addr); page_set_flags(old_addr, old_addr + old_size, 0); page_set_flags(new_addr, new_addr + new_size, prot | PAGE_VALID); return new_addr; } -int target_msync(unsigned long start, unsigned long len, int flags) +int target_msync(target_ulong start, target_ulong len, int flags) { - unsigned long end; + target_ulong end; if (start & ~TARGET_PAGE_MASK) return -EINVAL; @@ -400,6 +412,6 @@ int target_msync(unsigned long start, unsigned long len, int flags) return 0; start &= qemu_host_page_mask; - return msync((void *)start, end - start, flags); + return msync(g2h(start), end - start, flags); } diff --git a/linux-user/qemu.h b/linux-user/qemu.h index f385a1c92b..a797c512bb 100644 --- a/linux-user/qemu.h +++ b/linux-user/qemu.h @@ -69,7 +69,7 @@ typedef struct TaskState { int swi_errno; #endif #ifdef TARGET_I386 - struct target_vm86plus_struct *target_v86; + target_ulong target_v86; struct vm86_saved_state vm86_saved_regs; struct target_vm86plus_struct vm86plus; uint32_t v86flags; @@ -84,8 +84,8 @@ extern TaskState *first_task_state; int elf_exec(const char * filename, char ** argv, char ** envp, struct target_pt_regs * regs, struct image_info *infop); -void target_set_brk(char *new_brk); -long do_brk(char *new_brk); +void target_set_brk(target_ulong new_brk); +long do_brk(target_ulong new_brk); void syscall_init(void); long do_syscall(void *cpu_env, int num, long arg1, long arg2, long arg3, long arg4, long arg5, long arg6); @@ -112,19 +112,18 @@ long do_rt_sigreturn(CPUState *env); void save_v86_state(CPUX86State *env); void handle_vm86_trap(CPUX86State *env, int trapno); void handle_vm86_fault(CPUX86State *env); -int do_vm86(CPUX86State *env, long subfunction, - struct target_vm86plus_struct * target_v86); +int do_vm86(CPUX86State *env, long subfunction, target_ulong v86_addr); #endif /* mmap.c */ -int target_mprotect(unsigned long start, unsigned long len, int prot); -long target_mmap(unsigned long start, unsigned long len, int prot, - int flags, int fd, unsigned long offset); -int target_munmap(unsigned long start, unsigned long len); -long target_mremap(unsigned long old_addr, unsigned long old_size, - unsigned long new_size, unsigned long flags, - unsigned long new_addr); -int target_msync(unsigned long start, unsigned long len, int flags); +int target_mprotect(target_ulong start, target_ulong len, int prot); +long target_mmap(target_ulong start, target_ulong len, int prot, + int flags, int fd, target_ulong offset); +int target_munmap(target_ulong start, target_ulong len); +long target_mremap(target_ulong old_addr, target_ulong old_size, + target_ulong new_size, unsigned long flags, + target_ulong new_addr); +int target_msync(target_ulong start, target_ulong len, int flags); /* user access */ @@ -133,21 +132,22 @@ int target_msync(unsigned long start, unsigned long len, int flags); #define access_ok(type,addr,size) (1) +/* NOTE get_user and put_user use host addresses. */ #define __put_user(x,ptr)\ ({\ int size = sizeof(*ptr);\ switch(size) {\ case 1:\ - stb(ptr, (typeof(*ptr))(x));\ + *(uint8_t *)(ptr) = (typeof(*ptr))(x);\ break;\ case 2:\ - stw(ptr, (typeof(*ptr))(x));\ + *(uint16_t *)(ptr) = tswap16((typeof(*ptr))(x));\ break;\ case 4:\ - stl(ptr, (typeof(*ptr))(x));\ + *(uint32_t *)(ptr) = tswap32((typeof(*ptr))(x));\ break;\ case 8:\ - stq(ptr, (typeof(*ptr))(x));\ + *(uint64_t *)(ptr) = tswap64((typeof(*ptr))(x));\ break;\ default:\ abort();\ @@ -160,16 +160,16 @@ int target_msync(unsigned long start, unsigned long len, int flags); int size = sizeof(*ptr);\ switch(size) {\ case 1:\ - x = (typeof(*ptr))ldub((void *)ptr);\ + x = (typeof(*ptr))*(uint8_t *)(ptr);\ break;\ case 2:\ - x = (typeof(*ptr))lduw((void *)ptr);\ + x = (typeof(*ptr))tswap16(*(uint16_t *)(ptr));\ break;\ case 4:\ - x = (typeof(*ptr))ldl((void *)ptr);\ + x = (typeof(*ptr))tswap32(*(uint32_t *)(ptr));\ break;\ case 8:\ - x = (typeof(*ptr))ldq((void *)ptr);\ + x = (typeof(*ptr))tswap64(*(uint64_t *)(ptr));\ break;\ default:\ abort();\ @@ -177,26 +177,6 @@ int target_msync(unsigned long start, unsigned long len, int flags); 0;\ }) -static inline unsigned long __copy_to_user(void *dst, const void *src, - unsigned long size) -{ - memcpy(dst, src, size); - return 0; -} - -static inline unsigned long __copy_from_user(void *dst, const void *src, - unsigned long size) -{ - memcpy(dst, src, size); - return 0; -} - -static inline unsigned long __clear_user(void *dst, unsigned long size) -{ - memset(dst, 0, size); - return 0; -} - #define put_user(x,ptr)\ ({\ int __ret;\ @@ -217,30 +197,77 @@ static inline unsigned long __clear_user(void *dst, unsigned long size) __ret;\ }) -static inline unsigned long copy_to_user(void *dst, const void *src, - unsigned long size) +/* Functions for accessing guest memory. The tget and tput functions + read/write single values, byteswapping as neccessary. The lock_user + gets a pointer to a contiguous area of guest memory, but does not perform + and byteswapping. lock_user may return either a pointer to the guest + memory, or a temporary buffer. */ + +/* Lock an area of guest memory into the host. If copy is true then the + host area will have the same contents as the guest. */ +static inline void *lock_user(target_ulong guest_addr, long len, int copy) { - if (access_ok(VERIFY_WRITE, dst, size)) - return __copy_to_user(dst, src, size); +#ifdef DEBUG_REMAP + void *addr; + addr = malloc(len); + if (copy) + memcpy(addr, g2h(guest_addr), len); else - return size; + memset(addr, 0, len); + return addr; +#else + return g2h(guest_addr); +#endif } -static inline unsigned long copy_from_user(void *dst, const void *src, - unsigned long size) +/* Unlock an area of guest memory. The first LEN bytes must be flushed back + to guest memory. */ +static inline void unlock_user(void *host_addr, target_ulong guest_addr, + long len) { - if (access_ok(VERIFY_READ, src, size)) - return __copy_from_user(dst, src, size); - else - return size; +#ifdef DEBUG_REMAP + if (host_addr == g2h(guest_addr)) + return; + if (len > 0) + memcpy(g2h(guest_addr), host_addr, len); + free(host_addr); +#endif } -static inline unsigned long clear_user(void *dst, unsigned long size) +/* Return the length of a string in target memory. */ +static inline int target_strlen(target_ulong ptr) { - if (access_ok(VERIFY_WRITE, dst, size)) - return __clear_user(dst, size); - else - return size; + return strlen(g2h(ptr)); +} + +/* Like lock_user but for null terminated strings. */ +static inline void *lock_user_string(target_ulong guest_addr) +{ + long len; + len = target_strlen(guest_addr) + 1; + return lock_user(guest_addr, len, 1); } +/* Helper macros for locking/ulocking a target struct. */ +#define lock_user_struct(host_ptr, guest_addr, copy) \ + host_ptr = lock_user(guest_addr, sizeof(*host_ptr), copy) +#define unlock_user_struct(host_ptr, guest_addr, copy) \ + unlock_user(host_ptr, guest_addr, (copy) ? sizeof(*host_ptr) : 0) + +#define tget8(addr) ldub(addr) +#define tput8(addr, val) stb(addr, val) +#define tget16(addr) lduw(addr) +#define tput16(addr, val) stw(addr, val) +#define tget32(addr) ldl(addr) +#define tput32(addr, val) stl(addr, val) +#define tget64(addr) ldq(addr) +#define tput64(addr, val) stq(addr, val) +#if TARGET_LONG_BITS == 64 +#define tgetl(addr) ldq(addr) +#define tputl(addr, val) stq(addr, val) +#else +#define tgetl(addr) ldl(addr) +#define tputl(addr, val) stl(addr, val) +#endif + #endif /* QEMU_H */ diff --git a/linux-user/signal.c b/linux-user/signal.c index 29933bda43..ac4b2897fe 100644 --- a/linux-user/signal.c +++ b/linux-user/signal.c @@ -135,7 +135,7 @@ void host_to_target_sigset(target_sigset_t *d, const sigset_t *s) host_to_target_sigset_internal(&d1, s); for(i = 0;i < TARGET_NSIG_WORDS; i++) - __put_user(d1.sig[i], &d->sig[i]); + d->sig[i] = tswapl(d1.sig[i]); } void target_to_host_sigset_internal(sigset_t *d, const target_sigset_t *s) @@ -168,7 +168,7 @@ void target_to_host_sigset(sigset_t *d, const target_sigset_t *s) int i; for(i = 0;i < TARGET_NSIG_WORDS; i++) - __get_user(s1.sig[i], &s->sig[i]); + s1.sig[i] = tswapl(s->sig[i]); target_to_host_sigset_internal(d, &s1); } @@ -647,7 +647,7 @@ get_sigframe(struct emulated_sigaction *ka, CPUX86State *env, size_t frame_size) ka->sa.sa_restorer) { esp = (unsigned long) ka->sa.sa_restorer; } - return (void *)((esp - frame_size) & -8ul); + return g2h((esp - frame_size) & -8ul); } static void setup_frame(int sig, struct emulated_sigaction *ka, @@ -694,7 +694,7 @@ static void setup_frame(int sig, struct emulated_sigaction *ka, goto give_sigsegv; /* Set up registers for signal handler */ - env->regs[R_ESP] = (unsigned long) frame; + env->regs[R_ESP] = h2g(frame); env->eip = (unsigned long) ka->sa._sa_handler; cpu_x86_load_seg(env, R_DS, __USER_DS); @@ -835,7 +835,7 @@ badframe: long do_sigreturn(CPUX86State *env) { - struct sigframe *frame = (struct sigframe *)(env->regs[R_ESP] - 8); + struct sigframe *frame = (struct sigframe *)g2h(env->regs[R_ESP] - 8); target_sigset_t target_set; sigset_t set; int eax, i; @@ -866,7 +866,7 @@ badframe: long do_rt_sigreturn(CPUX86State *env) { - struct rt_sigframe *frame = (struct rt_sigframe *)(env->regs[R_ESP] - 4); + struct rt_sigframe *frame = (struct rt_sigframe *)g2h(env->regs[R_ESP] - 4); sigset_t set; // stack_t st; int eax; @@ -1029,7 +1029,7 @@ get_sigframe(struct emulated_sigaction *ka, CPUState *regs, int framesize) /* * ATPCS B01 mandates 8-byte alignment */ - return (void *)((sp - framesize) & ~7); + return g2h((sp - framesize) & ~7); } static int @@ -1084,7 +1084,7 @@ setup_return(CPUState *env, struct emulated_sigaction *ka, } env->regs[0] = usig; - env->regs[13] = (target_ulong)frame; + env->regs[13] = h2g(frame); env->regs[14] = retcode; env->regs[15] = handler & (thumb ? ~1 : ~3); @@ -1130,7 +1130,7 @@ static void setup_rt_frame(int usig, struct emulated_sigaction *ka, err |= copy_siginfo_to_user(&frame->info, info); /* Clear all the bits of the ucontext we don't use. */ - err |= __clear_user(&frame->uc, offsetof(struct ucontext, uc_mcontext)); + memset(&frame->uc, 0, offsetof(struct target_ucontext, tuc_mcontext)); err |= setup_sigcontext(&frame->uc.tuc_mcontext, /*&frame->fpstate,*/ env, set->sig[0]); @@ -1202,7 +1202,7 @@ long do_sigreturn(CPUState *env) if (env->regs[13] & 7) goto badframe; - frame = (struct sigframe *)env->regs[13]; + frame = (struct sigframe *)g2h(env->regs[13]); #if 0 if (verify_area(VERIFY_READ, frame, sizeof (*frame))) @@ -1378,7 +1378,7 @@ static inline void *get_sigframe(struct emulated_sigaction *sa, CPUState *env, u sp = current->sas_ss_sp + current->sas_ss_size; } #endif - return (void *)(sp - framesize); + return g2h(sp - framesize); } static int @@ -1461,10 +1461,10 @@ static void setup_frame(int sig, struct emulated_sigaction *ka, goto sigsegv; /* 3. signal handler back-trampoline and parameters */ - env->regwptr[UREG_FP] = (target_ulong) sf; + env->regwptr[UREG_FP] = h2g(sf); env->regwptr[UREG_I0] = sig; - env->regwptr[UREG_I1] = (target_ulong) &sf->info; - env->regwptr[UREG_I2] = (target_ulong) &sf->info; + env->regwptr[UREG_I1] = h2g(&sf->info); + env->regwptr[UREG_I2] = h2g(&sf->info); /* 4. signal handler */ env->pc = (unsigned long) ka->sa._sa_handler; @@ -1473,7 +1473,7 @@ static void setup_frame(int sig, struct emulated_sigaction *ka, if (ka->sa.sa_restorer) env->regwptr[UREG_I7] = (unsigned long)ka->sa.sa_restorer; else { - env->regwptr[UREG_I7] = (unsigned long)(&(sf->insns[0]) - 2); + env->regwptr[UREG_I7] = h2g(&(sf->insns[0]) - 2); /* mov __NR_sigreturn, %g1 */ err |= __put_user(0x821020d8, &sf->insns[0]); @@ -1548,7 +1548,7 @@ long do_sigreturn(CPUState *env) target_ulong fpu_save; int err, i; - sf = (struct target_signal_frame *) env->regwptr[UREG_FP]; + sf = (struct target_signal_frame *)g2h(env->regwptr[UREG_FP]); #if 0 fprintf(stderr, "sigreturn\n"); fprintf(stderr, "sf: %x pc %x fp %x sp %x\n", sf, env->pc, env->regwptr[UREG_FP], env->regwptr[UREG_SP]); diff --git a/linux-user/syscall.c b/linux-user/syscall.c index ab7846d7ac..2b132477f0 100644 --- a/linux-user/syscall.c +++ b/linux-user/syscall.c @@ -252,44 +252,43 @@ static inline int is_error(long ret) return (unsigned long)ret >= (unsigned long)(-4096); } -static char *target_brk; -static char *target_original_brk; +static target_ulong target_brk; +static target_ulong target_original_brk; -void target_set_brk(char *new_brk) +void target_set_brk(target_ulong new_brk) { - target_brk = new_brk; - target_original_brk = new_brk; + target_original_brk = target_brk = new_brk; } -long do_brk(char *new_brk) +long do_brk(target_ulong new_brk) { - char *brk_page; + target_ulong brk_page; long mapped_addr; int new_alloc_size; if (!new_brk) - return (long)target_brk; + return target_brk; if (new_brk < target_original_brk) return -ENOMEM; - brk_page = (char *)HOST_PAGE_ALIGN((unsigned long)target_brk); + brk_page = HOST_PAGE_ALIGN(target_brk); /* If the new brk is less than this, set it and we're done... */ if (new_brk < brk_page) { target_brk = new_brk; - return (long)target_brk; + return target_brk; } /* We need to allocate more memory after the brk... */ new_alloc_size = HOST_PAGE_ALIGN(new_brk - brk_page + 1); - mapped_addr = get_errno(target_mmap((unsigned long)brk_page, new_alloc_size, + mapped_addr = get_errno(target_mmap(brk_page, new_alloc_size, PROT_READ|PROT_WRITE, MAP_ANON|MAP_FIXED|MAP_PRIVATE, 0, 0)); if (is_error(mapped_addr)) { return mapped_addr; } else { target_brk = new_brk; - return (long)target_brk; + return target_brk; } } @@ -354,9 +353,12 @@ static inline long host_to_target_clock_t(long ticks) #endif } -static inline void host_to_target_rusage(struct target_rusage *target_rusage, +static inline void host_to_target_rusage(target_ulong target_addr, const struct rusage *rusage) { + struct target_rusage *target_rusage; + + lock_user_struct(target_rusage, target_addr, 0); target_rusage->ru_utime.tv_sec = tswapl(rusage->ru_utime.tv_sec); target_rusage->ru_utime.tv_usec = tswapl(rusage->ru_utime.tv_usec); target_rusage->ru_stime.tv_sec = tswapl(rusage->ru_stime.tv_sec); @@ -375,35 +377,64 @@ static inline void host_to_target_rusage(struct target_rusage *target_rusage, target_rusage->ru_nsignals = tswapl(rusage->ru_nsignals); target_rusage->ru_nvcsw = tswapl(rusage->ru_nvcsw); target_rusage->ru_nivcsw = tswapl(rusage->ru_nivcsw); + unlock_user_struct(target_rusage, target_addr, 1); } -static inline void target_to_host_timeval(struct timeval *tv, - const struct target_timeval *target_tv) +static inline void target_to_host_timeval(struct timeval *tv, + target_ulong target_addr) { + struct target_timeval *target_tv; + + lock_user_struct(target_tv, target_addr, 1); tv->tv_sec = tswapl(target_tv->tv_sec); tv->tv_usec = tswapl(target_tv->tv_usec); + unlock_user_struct(target_tv, target_addr, 0); } -static inline void host_to_target_timeval(struct target_timeval *target_tv, +static inline void host_to_target_timeval(target_ulong target_addr, const struct timeval *tv) { + struct target_timeval *target_tv; + + lock_user_struct(target_tv, target_addr, 0); target_tv->tv_sec = tswapl(tv->tv_sec); target_tv->tv_usec = tswapl(tv->tv_usec); + unlock_user_struct(target_tv, target_addr, 1); } static long do_select(long n, - target_long *target_rfds, target_long *target_wfds, - target_long *target_efds, struct target_timeval *target_tv) + target_ulong rfd_p, target_ulong wfd_p, + target_ulong efd_p, target_ulong target_tv) { fd_set rfds, wfds, efds; fd_set *rfds_ptr, *wfds_ptr, *efds_ptr; + target_long *target_rfds, *target_wfds, *target_efds; struct timeval tv, *tv_ptr; long ret; + int ok; - rfds_ptr = target_to_host_fds(&rfds, target_rfds, n); - wfds_ptr = target_to_host_fds(&wfds, target_wfds, n); - efds_ptr = target_to_host_fds(&efds, target_efds, n); + if (rfd_p) { + target_rfds = lock_user(rfd_p, sizeof(target_long) * n, 1); + rfds_ptr = target_to_host_fds(&rfds, target_rfds, n); + } else { + target_rfds = NULL; + rfds_ptr = NULL; + } + if (wfd_p) { + target_wfds = lock_user(wfd_p, sizeof(target_long) * n, 1); + wfds_ptr = target_to_host_fds(&wfds, target_wfds, n); + } else { + target_wfds = NULL; + wfds_ptr = NULL; + } + if (efd_p) { + target_efds = lock_user(efd_p, sizeof(target_long) * n, 1); + efds_ptr = target_to_host_fds(&efds, target_efds, n); + } else { + target_efds = NULL; + efds_ptr = NULL; + } if (target_tv) { target_to_host_timeval(&tv, target_tv); @@ -412,7 +443,9 @@ static long do_select(long n, tv_ptr = NULL; } ret = get_errno(select(n, rfds_ptr, wfds_ptr, efds_ptr, tv_ptr)); - if (!is_error(ret)) { + ok = !is_error(ret); + + if (ok) { host_to_target_fds(target_rfds, rfds_ptr, n); host_to_target_fds(target_wfds, wfds_ptr, n); host_to_target_fds(target_efds, efds_ptr, n); @@ -421,25 +454,41 @@ static long do_select(long n, host_to_target_timeval(target_tv, &tv); } } + if (target_rfds) + unlock_user(target_rfds, rfd_p, ok ? sizeof(target_long) * n : 0); + if (target_wfds) + unlock_user(target_wfds, wfd_p, ok ? sizeof(target_long) * n : 0); + if (target_efds) + unlock_user(target_efds, efd_p, ok ? sizeof(target_long) * n : 0); + return ret; } static inline void target_to_host_sockaddr(struct sockaddr *addr, - struct target_sockaddr *target_addr, + target_ulong target_addr, socklen_t len) { - memcpy(addr, target_addr, len); - addr->sa_family = tswap16(target_addr->sa_family); + struct target_sockaddr *target_saddr; + + target_saddr = lock_user(target_addr, len, 1); + memcpy(addr, target_saddr, len); + addr->sa_family = tswap16(target_saddr->sa_family); + unlock_user(target_saddr, target_addr, 0); } -static inline void host_to_target_sockaddr(struct target_sockaddr *target_addr, +static inline void host_to_target_sockaddr(target_ulong target_addr, struct sockaddr *addr, socklen_t len) { - memcpy(target_addr, addr, len); - target_addr->sa_family = tswap16(addr->sa_family); + struct target_sockaddr *target_saddr; + + target_saddr = lock_user(target_addr, len, 0); + memcpy(target_saddr, addr, len); + target_saddr->sa_family = tswap16(addr->sa_family); + unlock_user(target_saddr, target_addr, len); } +/* ??? Should this also swap msgh->name? */ static inline void target_to_host_cmsg(struct msghdr *msgh, struct target_msghdr *target_msgh) { @@ -484,6 +533,7 @@ static inline void target_to_host_cmsg(struct msghdr *msgh, msgh->msg_controllen = space; } +/* ??? Should this also swap msgh->name? */ static inline void host_to_target_cmsg(struct target_msghdr *target_msgh, struct msghdr *msgh) { @@ -528,7 +578,7 @@ static inline void host_to_target_cmsg(struct target_msghdr *target_msgh, } static long do_setsockopt(int sockfd, int level, int optname, - void *optval, socklen_t optlen) + target_ulong optval, socklen_t optlen) { int val, ret; @@ -538,8 +588,7 @@ static long do_setsockopt(int sockfd, int level, int optname, if (optlen < sizeof(uint32_t)) return -EINVAL; - if (get_user(val, (uint32_t *)optval)) - return -EFAULT; + val = tget32(optval); ret = get_errno(setsockopt(sockfd, level, optname, &val, sizeof(val))); break; case SOL_IP: @@ -561,11 +610,9 @@ static long do_setsockopt(int sockfd, int level, int optname, case IP_MULTICAST_LOOP: val = 0; if (optlen >= sizeof(uint32_t)) { - if (get_user(val, (uint32_t *)optval)) - return -EFAULT; + val = tget32(optval); } else if (optlen >= 1) { - if (get_user(val, (uint8_t *)optval)) - return -EFAULT; + val = tget8(optval); } ret = get_errno(setsockopt(sockfd, level, optname, &val, sizeof(val))); break; @@ -598,8 +645,8 @@ static long do_setsockopt(int sockfd, int level, int optname, case SO_SNDTIMEO: if (optlen < sizeof(uint32_t)) return -EINVAL; - if (get_user(val, (uint32_t *)optval)) - return -EFAULT; + + val = tget32(optval); ret = get_errno(setsockopt(sockfd, level, optname, &val, sizeof(val))); break; default: @@ -615,7 +662,7 @@ static long do_setsockopt(int sockfd, int level, int optname, } static long do_getsockopt(int sockfd, int level, int optname, - void *optval, socklen_t *optlen) + target_ulong optval, target_ulong optlen) { int len, lv, val, ret; @@ -636,8 +683,7 @@ static long do_getsockopt(int sockfd, int level, int optname, case SOL_TCP: /* TCP options all take an 'int' value. */ int_case: - if (get_user(len, optlen)) - return -EFAULT; + len = tget32(optlen); if (len < 0) return -EINVAL; lv = sizeof(int); @@ -647,10 +693,11 @@ static long do_getsockopt(int sockfd, int level, int optname, val = tswap32(val); if (len > lv) len = lv; - if (copy_to_user(optval, &val, len)) - return -EFAULT; - if (put_user(len, optlen)) - return -EFAULT; + if (len == 4) + tput32(optval, val); + else + tput8(optval, val); + tput32(optlen, len); break; case SOL_IP: switch(optname) { @@ -669,8 +716,7 @@ static long do_getsockopt(int sockfd, int level, int optname, #endif case IP_MULTICAST_TTL: case IP_MULTICAST_LOOP: - if (get_user(len, optlen)) - return -EFAULT; + len = tget32(optlen); if (len < 0) return -EINVAL; lv = sizeof(int); @@ -678,20 +724,14 @@ static long do_getsockopt(int sockfd, int level, int optname, if (ret < 0) return ret; if (len < sizeof(int) && len > 0 && val >= 0 && val < 255) { - unsigned char ucval = val; len = 1; - if (put_user(len, optlen)) - return -EFAULT; - if (copy_to_user(optval,&ucval,1)) - return -EFAULT; + tput32(optlen, len); + tput8(optval, val); } else { - val = tswap32(val); if (len > sizeof(int)) len = sizeof(int); - if (put_user(len, optlen)) - return -EFAULT; - if (copy_to_user(optval, &val, len)) - return -EFAULT; + tput32(optlen, len); + tput32(optval, val); } break; default: @@ -708,25 +748,57 @@ static long do_getsockopt(int sockfd, int level, int optname, return ret; } -static long do_socketcall(int num, int32_t *vptr) +static void lock_iovec(struct iovec *vec, target_ulong target_addr, + int count, int copy) +{ + struct target_iovec *target_vec; + target_ulong base; + int i; + + target_vec = lock_user(target_addr, count * sizeof(struct target_iovec), 1); + for(i = 0;i < count; i++) { + base = tswapl(target_vec[i].iov_base); + vec[i].iov_len = tswapl(target_vec[i].iov_len); + vec[i].iov_base = lock_user(base, vec[i].iov_len, copy); + } + unlock_user (target_vec, target_addr, 0); +} + +static void unlock_iovec(struct iovec *vec, target_ulong target_addr, + int count, int copy) +{ + struct target_iovec *target_vec; + target_ulong base; + int i; + + target_vec = lock_user(target_addr, count * sizeof(struct target_iovec), 1); + for(i = 0;i < count; i++) { + base = tswapl(target_vec[i].iov_base); + unlock_user(vec[i].iov_base, base, copy ? vec[i].iov_len : 0); + } + unlock_user (target_vec, target_addr, 0); +} + +static long do_socketcall(int num, target_ulong vptr) { long ret; + const int n = sizeof(target_ulong); switch(num) { case SOCKOP_socket: { - int domain = tswap32(vptr[0]); - int type = tswap32(vptr[1]); - int protocol = tswap32(vptr[2]); + int domain = tgetl(vptr); + int type = tgetl(vptr + n); + int protocol = tgetl(vptr + 2 * n); ret = get_errno(socket(domain, type, protocol)); } break; case SOCKOP_bind: { - int sockfd = tswap32(vptr[0]); - void *target_addr = (void *)tswap32(vptr[1]); - socklen_t addrlen = tswap32(vptr[2]); + int sockfd = tgetl(vptr); + target_ulong target_addr = tgetl(vptr + n); + socklen_t addrlen = tgetl(vptr + 2 * n); void *addr = alloca(addrlen); target_to_host_sockaddr(addr, target_addr, addrlen); @@ -735,9 +807,9 @@ static long do_socketcall(int num, int32_t *vptr) break; case SOCKOP_connect: { - int sockfd = tswap32(vptr[0]); - void *target_addr = (void *)tswap32(vptr[1]); - socklen_t addrlen = tswap32(vptr[2]); + int sockfd = tgetl(vptr); + target_ulong target_addr = tgetl(vptr + n); + socklen_t addrlen = tgetl(vptr + 2 * n); void *addr = alloca(addrlen); target_to_host_sockaddr(addr, target_addr, addrlen); @@ -746,128 +818,142 @@ static long do_socketcall(int num, int32_t *vptr) break; case SOCKOP_listen: { - int sockfd = tswap32(vptr[0]); - int backlog = tswap32(vptr[1]); + int sockfd = tgetl(vptr); + int backlog = tgetl(vptr + n); ret = get_errno(listen(sockfd, backlog)); } break; case SOCKOP_accept: { - int sockfd = tswap32(vptr[0]); - void *target_addr = (void *)tswap32(vptr[1]); - uint32_t *target_addrlen = (void *)tswap32(vptr[2]); - socklen_t addrlen = tswap32(*target_addrlen); + int sockfd = tgetl(vptr); + target_ulong target_addr = tgetl(vptr + n); + target_ulong target_addrlen = tgetl(vptr + 2 * n); + socklen_t addrlen = tget32(target_addrlen); void *addr = alloca(addrlen); ret = get_errno(accept(sockfd, addr, &addrlen)); if (!is_error(ret)) { host_to_target_sockaddr(target_addr, addr, addrlen); - *target_addrlen = tswap32(addrlen); + tput32(target_addrlen, addrlen); } } break; case SOCKOP_getsockname: { - int sockfd = tswap32(vptr[0]); - void *target_addr = (void *)tswap32(vptr[1]); - uint32_t *target_addrlen = (void *)tswap32(vptr[2]); - socklen_t addrlen = tswap32(*target_addrlen); + int sockfd = tgetl(vptr); + target_ulong target_addr = tgetl(vptr + n); + target_ulong target_addrlen = tgetl(vptr + 2 * n); + socklen_t addrlen = tget32(target_addrlen); void *addr = alloca(addrlen); ret = get_errno(getsockname(sockfd, addr, &addrlen)); if (!is_error(ret)) { host_to_target_sockaddr(target_addr, addr, addrlen); - *target_addrlen = tswap32(addrlen); + tput32(target_addrlen, addrlen); } } break; case SOCKOP_getpeername: { - int sockfd = tswap32(vptr[0]); - void *target_addr = (void *)tswap32(vptr[1]); - uint32_t *target_addrlen = (void *)tswap32(vptr[2]); - socklen_t addrlen = tswap32(*target_addrlen); + int sockfd = tgetl(vptr); + target_ulong target_addr = tgetl(vptr + n); + target_ulong target_addrlen = tgetl(vptr + 2 * n); + socklen_t addrlen = tget32(target_addrlen); void *addr = alloca(addrlen); ret = get_errno(getpeername(sockfd, addr, &addrlen)); if (!is_error(ret)) { host_to_target_sockaddr(target_addr, addr, addrlen); - *target_addrlen = tswap32(addrlen); + tput32(target_addrlen, addrlen); } } break; case SOCKOP_socketpair: { - int domain = tswap32(vptr[0]); - int type = tswap32(vptr[1]); - int protocol = tswap32(vptr[2]); - int32_t *target_tab = (void *)tswap32(vptr[3]); + int domain = tgetl(vptr); + int type = tgetl(vptr + n); + int protocol = tgetl(vptr + 2 * n); + target_ulong target_tab = tgetl(vptr + 3 * n); int tab[2]; ret = get_errno(socketpair(domain, type, protocol, tab)); if (!is_error(ret)) { - target_tab[0] = tswap32(tab[0]); - target_tab[1] = tswap32(tab[1]); + tput32(target_tab, tab[0]); + tput32(target_tab + 4, tab[1]); } } break; case SOCKOP_send: { - int sockfd = tswap32(vptr[0]); - void *msg = (void *)tswap32(vptr[1]); - size_t len = tswap32(vptr[2]); - int flags = tswap32(vptr[3]); + int sockfd = tgetl(vptr); + target_ulong msg = tgetl(vptr + n); + size_t len = tgetl(vptr + 2 * n); + int flags = tgetl(vptr + 3 * n); + void *host_msg; - ret = get_errno(send(sockfd, msg, len, flags)); + host_msg = lock_user(msg, len, 1); + ret = get_errno(send(sockfd, host_msg, len, flags)); + unlock_user(host_msg, msg, 0); } break; case SOCKOP_recv: { - int sockfd = tswap32(vptr[0]); - void *msg = (void *)tswap32(vptr[1]); - size_t len = tswap32(vptr[2]); - int flags = tswap32(vptr[3]); + int sockfd = tgetl(vptr); + target_ulong msg = tgetl(vptr + n); + size_t len = tgetl(vptr + 2 * n); + int flags = tgetl(vptr + 3 * n); + void *host_msg; - ret = get_errno(recv(sockfd, msg, len, flags)); + host_msg = lock_user(msg, len, 0); + ret = get_errno(recv(sockfd, host_msg, len, flags)); + unlock_user(host_msg, msg, ret); } break; case SOCKOP_sendto: { - int sockfd = tswap32(vptr[0]); - void *msg = (void *)tswap32(vptr[1]); - size_t len = tswap32(vptr[2]); - int flags = tswap32(vptr[3]); - void *target_addr = (void *)tswap32(vptr[4]); - socklen_t addrlen = tswap32(vptr[5]); + int sockfd = tgetl(vptr); + target_ulong msg = tgetl(vptr + n); + size_t len = tgetl(vptr + 2 * n); + int flags = tgetl(vptr + 3 * n); + target_ulong target_addr = tgetl(vptr + 4 * n); + socklen_t addrlen = tgetl(vptr + 5 * n); void *addr = alloca(addrlen); + void *host_msg; + host_msg = lock_user(msg, len, 1); target_to_host_sockaddr(addr, target_addr, addrlen); - ret = get_errno(sendto(sockfd, msg, len, flags, addr, addrlen)); + ret = get_errno(sendto(sockfd, host_msg, len, flags, addr, addrlen)); + unlock_user(host_msg, msg, 0); } break; case SOCKOP_recvfrom: { - int sockfd = tswap32(vptr[0]); - void *msg = (void *)tswap32(vptr[1]); - size_t len = tswap32(vptr[2]); - int flags = tswap32(vptr[3]); - void *target_addr = (void *)tswap32(vptr[4]); - uint32_t *target_addrlen = (void *)tswap32(vptr[5]); - socklen_t addrlen = tswap32(*target_addrlen); + int sockfd = tgetl(vptr); + target_ulong msg = tgetl(vptr + n); + size_t len = tgetl(vptr + 2 * n); + int flags = tgetl(vptr + 3 * n); + target_ulong target_addr = tgetl(vptr + 4 * n); + target_ulong target_addrlen = tgetl(vptr + 5 * n); + socklen_t addrlen = tget32(target_addrlen); void *addr = alloca(addrlen); + void *host_msg; - ret = get_errno(recvfrom(sockfd, msg, len, flags, addr, &addrlen)); + host_msg = lock_user(msg, len, 0); + ret = get_errno(recvfrom(sockfd, host_msg, len, flags, addr, &addrlen)); if (!is_error(ret)) { host_to_target_sockaddr(target_addr, addr, addrlen); - *target_addrlen = tswap32(addrlen); + tput32(target_addrlen, addrlen); + unlock_user(host_msg, msg, len); + } else { + unlock_user(host_msg, msg, 0); } } break; case SOCKOP_shutdown: { - int sockfd = tswap32(vptr[0]); - int how = tswap32(vptr[1]); + int sockfd = tgetl(vptr); + int how = tgetl(vptr + n); ret = get_errno(shutdown(sockfd, how)); } @@ -876,32 +962,39 @@ static long do_socketcall(int num, int32_t *vptr) case SOCKOP_recvmsg: { int fd; + target_ulong target_msg; struct target_msghdr *msgp; struct msghdr msg; - int flags, count, i; + int flags, count; struct iovec *vec; - struct target_iovec *target_vec; - - msgp = (void *)tswap32(vptr[1]); - msg.msg_name = (void *)tswapl(msgp->msg_name); - msg.msg_namelen = tswapl(msgp->msg_namelen); + target_ulong target_vec; + int send = (num == SOCKOP_sendmsg); + + target_msg = tgetl(vptr + n); + lock_user_struct(msgp, target_msg, 1); + if (msgp->msg_name) { + msg.msg_namelen = tswap32(msgp->msg_namelen); + msg.msg_name = alloca(msg.msg_namelen); + target_to_host_sockaddr(msg.msg_name, tswapl(msgp->msg_name), + msg.msg_namelen); + } else { + msg.msg_name = NULL; + msg.msg_namelen = 0; + } msg.msg_controllen = 2 * tswapl(msgp->msg_controllen); msg.msg_control = alloca(msg.msg_controllen); msg.msg_flags = tswap32(msgp->msg_flags); count = tswapl(msgp->msg_iovlen); vec = alloca(count * sizeof(struct iovec)); - target_vec = (void *)tswapl(msgp->msg_iov); - for(i = 0;i < count; i++) { - vec[i].iov_base = (void *)tswapl(target_vec[i].iov_base); - vec[i].iov_len = tswapl(target_vec[i].iov_len); - } + target_vec = tswapl(msgp->msg_iov); + lock_iovec(vec, target_vec, count, send); msg.msg_iovlen = count; msg.msg_iov = vec; - fd = tswap32(vptr[0]); - flags = tswap32(vptr[2]); - if (num == SOCKOP_sendmsg) { + fd = tgetl(vptr); + flags = tgetl(vptr + 2 * n); + if (send) { target_to_host_cmsg(&msg, msgp); ret = get_errno(sendmsg(fd, &msg, flags)); } else { @@ -909,26 +1002,27 @@ static long do_socketcall(int num, int32_t *vptr) if (!is_error(ret)) host_to_target_cmsg(msgp, &msg); } + unlock_iovec(vec, target_vec, count, !send); } break; case SOCKOP_setsockopt: { - int sockfd = tswap32(vptr[0]); - int level = tswap32(vptr[1]); - int optname = tswap32(vptr[2]); - void *optval = (void *)tswap32(vptr[3]); - socklen_t optlen = tswap32(vptr[4]); + int sockfd = tgetl(vptr); + int level = tgetl(vptr + n); + int optname = tgetl(vptr + 2 * n); + target_ulong optval = tgetl(vptr + 3 * n); + socklen_t optlen = tgetl(vptr + 4 * n); ret = do_setsockopt(sockfd, level, optname, optval, optlen); } break; case SOCKOP_getsockopt: { - int sockfd = tswap32(vptr[0]); - int level = tswap32(vptr[1]); - int optname = tswap32(vptr[2]); - void *optval = (void *)tswap32(vptr[3]); - uint32_t *poptlen = (void *)tswap32(vptr[4]); + int sockfd = tgetl(vptr); + int level = tgetl(vptr + n); + int optname = tgetl(vptr + 2 * n); + target_ulong optval = tgetl(vptr + 3 * n); + target_ulong poptlen = tgetl(vptr + 4 * n); ret = do_getsockopt(sockfd, level, optname, optval, poptlen); } @@ -949,6 +1043,7 @@ static struct shm_region { uint32_t size; } shm_regions[N_SHM_REGIONS]; +/* ??? This only works with linear mappings. */ static long do_ipc(long call, long first, long second, long third, long ptr, long fifth) { @@ -1065,12 +1160,15 @@ IOCTLEntry ioctl_entries[] = { { 0, 0, }, }; +/* ??? Implement proper locking for ioctls. */ static long do_ioctl(long fd, long cmd, long arg) { const IOCTLEntry *ie; const argtype *arg_type; long ret; uint8_t buf_temp[MAX_STRUCT_SIZE]; + int target_size; + void *argptr; ie = ioctl_entries; for(;;) { @@ -1098,23 +1196,32 @@ static long do_ioctl(long fd, long cmd, long arg) break; case TYPE_PTR: arg_type++; + target_size = thunk_type_size(arg_type, 0); switch(ie->access) { case IOC_R: ret = get_errno(ioctl(fd, ie->host_cmd, buf_temp)); if (!is_error(ret)) { - thunk_convert((void *)arg, buf_temp, arg_type, THUNK_TARGET); + argptr = lock_user(arg, target_size, 0); + thunk_convert(argptr, buf_temp, arg_type, THUNK_TARGET); + unlock_user(argptr, arg, target_size); } break; case IOC_W: - thunk_convert(buf_temp, (void *)arg, arg_type, THUNK_HOST); + argptr = lock_user(arg, target_size, 1); + thunk_convert(buf_temp, argptr, arg_type, THUNK_HOST); + unlock_user(argptr, arg, 0); ret = get_errno(ioctl(fd, ie->host_cmd, buf_temp)); break; default: case IOC_RW: - thunk_convert(buf_temp, (void *)arg, arg_type, THUNK_HOST); + argptr = lock_user(arg, target_size, 1); + thunk_convert(buf_temp, argptr, arg_type, THUNK_HOST); + unlock_user(argptr, arg, 0); ret = get_errno(ioctl(fd, ie->host_cmd, buf_temp)); if (!is_error(ret)) { - thunk_convert((void *)arg, buf_temp, arg_type, THUNK_TARGET); + argptr = lock_user(arg, target_size, 0); + thunk_convert(argptr, buf_temp, arg_type, THUNK_TARGET); + unlock_user(argptr, arg, target_size); } break; } @@ -1338,35 +1445,41 @@ static bitmask_transtbl fcntl_flags_tbl[] = { /* NOTE: there is really one LDT for all the threads */ uint8_t *ldt_table; -static int read_ldt(void *ptr, unsigned long bytecount) +static int read_ldt(target_ulong ptr, unsigned long bytecount) { int size; + void *p; if (!ldt_table) return 0; size = TARGET_LDT_ENTRIES * TARGET_LDT_ENTRY_SIZE; if (size > bytecount) size = bytecount; - memcpy(ptr, ldt_table, size); + p = lock_user(ptr, size, 0); + /* ??? Shoudl this by byteswapped? */ + memcpy(p, ldt_table, size); + unlock_user(p, ptr, size); return size; } /* XXX: add locking support */ static int write_ldt(CPUX86State *env, - void *ptr, unsigned long bytecount, int oldmode) + target_ulong ptr, unsigned long bytecount, int oldmode) { struct target_modify_ldt_ldt_s ldt_info; + struct target_modify_ldt_ldt_s *target_ldt_info; int seg_32bit, contents, read_exec_only, limit_in_pages; int seg_not_present, useable; uint32_t *lp, entry_1, entry_2; if (bytecount != sizeof(ldt_info)) return -EINVAL; - memcpy(&ldt_info, ptr, sizeof(ldt_info)); - tswap32s(&ldt_info.entry_number); - tswapls((long *)&ldt_info.base_addr); - tswap32s(&ldt_info.limit); - tswap32s(&ldt_info.flags); + lock_user_struct(target_ldt_info, ptr, 1); + ldt_info.entry_number = tswap32(target_ldt_info->entry_number); + ldt_info.base_addr = tswapl(target_ldt_info->base_addr); + ldt_info.limit = tswap32(target_ldt_info->limit); + ldt_info.flags = tswap32(target_ldt_info->flags); + unlock_user_struct(target_ldt_info, ptr, 0); if (ldt_info.entry_number >= TARGET_LDT_ENTRIES) return -EINVAL; @@ -1389,7 +1502,7 @@ static int write_ldt(CPUX86State *env, if (!ldt_table) return -ENOMEM; memset(ldt_table, 0, TARGET_LDT_ENTRIES * TARGET_LDT_ENTRY_SIZE); - env->ldt.base = (long)ldt_table; + env->ldt.base = h2g(ldt_table); env->ldt.limit = 0xffff; } @@ -1432,7 +1545,7 @@ install: } /* specific and weird i386 syscalls */ -int do_modify_ldt(CPUX86State *env, int func, void *ptr, unsigned long bytecount) +int do_modify_ldt(CPUX86State *env, int func, target_ulong ptr, unsigned long bytecount) { int ret = -ENOSYS; @@ -1523,31 +1636,35 @@ int do_fork(CPUState *env, unsigned int flags, unsigned long newsp) return ret; } -static long do_fcntl(int fd, int cmd, unsigned long arg) +static long do_fcntl(int fd, int cmd, target_ulong arg) { struct flock fl; - struct target_flock *target_fl = (void *)arg; + struct target_flock *target_fl; long ret; - + switch(cmd) { case TARGET_F_GETLK: ret = fcntl(fd, cmd, &fl); if (ret == 0) { + lock_user_struct(target_fl, arg, 0); target_fl->l_type = tswap16(fl.l_type); target_fl->l_whence = tswap16(fl.l_whence); target_fl->l_start = tswapl(fl.l_start); target_fl->l_len = tswapl(fl.l_len); target_fl->l_pid = tswapl(fl.l_pid); + unlock_user_struct(target_fl, arg, 1); } break; case TARGET_F_SETLK: case TARGET_F_SETLKW: + lock_user_struct(target_fl, arg, 1); fl.l_type = tswap16(target_fl->l_type); fl.l_whence = tswap16(target_fl->l_whence); fl.l_start = tswapl(target_fl->l_start); fl.l_len = tswapl(target_fl->l_len); fl.l_pid = tswapl(target_fl->l_pid); + unlock_user_struct(target_fl, arg, 0); ret = fcntl(fd, cmd, &fl); break; @@ -1690,12 +1807,35 @@ static inline long target_ftruncate64(void *cpu_env, long arg1, long arg2, } #endif +static inline void target_to_host_timespec(struct timespec *host_ts, + target_ulong target_addr) +{ + struct target_timespec *target_ts; + + lock_user_struct(target_ts, target_addr, 1); + host_ts->tv_sec = tswapl(target_ts->tv_sec); + host_ts->tv_nsec = tswapl(target_ts->tv_nsec); + unlock_user_struct(target_ts, target_addr, 0); +} + +static inline void host_to_target_timespec(target_ulong target_addr, + struct timespec *host_ts) +{ + struct target_timespec *target_ts; + + lock_user_struct(target_ts, target_addr, 0); + target_ts->tv_sec = tswapl(host_ts->tv_sec); + target_ts->tv_nsec = tswapl(host_ts->tv_nsec); + unlock_user_struct(target_ts, target_addr, 1); +} + long do_syscall(void *cpu_env, int num, long arg1, long arg2, long arg3, long arg4, long arg5, long arg6) { long ret; struct stat st; struct statfs stfs; + void *p; #ifdef DEBUG gemu_log("syscall %d", num); @@ -1711,89 +1851,140 @@ long do_syscall(void *cpu_env, int num, long arg1, long arg2, long arg3, ret = 0; /* avoid warning */ break; case TARGET_NR_read: - page_unprotect_range((void *)arg2, arg3); - ret = get_errno(read(arg1, (void *)arg2, arg3)); + page_unprotect_range(arg2, arg3); + p = lock_user(arg2, arg3, 0); + ret = get_errno(read(arg1, p, arg3)); + unlock_user(p, arg2, ret); break; case TARGET_NR_write: - ret = get_errno(write(arg1, (void *)arg2, arg3)); + p = lock_user(arg2, arg3, 1); + ret = get_errno(write(arg1, p, arg3)); + unlock_user(p, arg2, 0); break; case TARGET_NR_open: - ret = get_errno(open(path((const char *)arg1), + p = lock_user_string(arg1); + ret = get_errno(open(path(p), target_to_host_bitmask(arg2, fcntl_flags_tbl), arg3)); + unlock_user(p, arg1, 0); break; case TARGET_NR_close: ret = get_errno(close(arg1)); break; case TARGET_NR_brk: - ret = do_brk((char *)arg1); + ret = do_brk(arg1); break; case TARGET_NR_fork: ret = get_errno(do_fork(cpu_env, SIGCHLD, 0)); break; case TARGET_NR_waitpid: { - int *status = (int *)arg2; - ret = get_errno(waitpid(arg1, status, arg3)); - if (!is_error(ret) && status) - tswapls((long *)&status); + int status; + ret = get_errno(waitpid(arg1, &status, arg3)); + if (!is_error(ret) && arg2) + tput32(arg2, status); } break; case TARGET_NR_creat: - ret = get_errno(creat((const char *)arg1, arg2)); + p = lock_user_string(arg1); + ret = get_errno(creat(p, arg2)); + unlock_user(p, arg1, 0); break; case TARGET_NR_link: - ret = get_errno(link((const char *)arg1, (const char *)arg2)); + { + void * p2; + p = lock_user_string(arg1); + p2 = lock_user_string(arg2); + ret = get_errno(link(p, p2)); + unlock_user(p2, arg2, 0); + unlock_user(p, arg1, 0); + } break; case TARGET_NR_unlink: - ret = get_errno(unlink((const char *)arg1)); + p = lock_user_string(arg1); + ret = get_errno(unlink(p)); + unlock_user(p, arg1, 0); break; case TARGET_NR_execve: { char **argp, **envp; int argc, envc; - uint32_t *p; + target_ulong gp; + target_ulong guest_argp; + target_ulong guest_envp; + target_ulong addr; char **q; argc = 0; - for (p = (void *)arg2; *p; p++) + guest_argp = arg2; + for (gp = guest_argp; tgetl(gp); gp++) argc++; envc = 0; - for (p = (void *)arg3; *p; p++) + guest_envp = arg3; + for (gp = guest_envp; tgetl(gp); gp++) envc++; argp = alloca((argc + 1) * sizeof(void *)); envp = alloca((envc + 1) * sizeof(void *)); - for (p = (void *)arg2, q = argp; *p; p++, q++) - *q = (void *)tswap32(*p); + for (gp = guest_argp, q = argp; ; + gp += sizeof(target_ulong), q++) { + addr = tgetl(gp); + if (!addr) + break; + *q = lock_user_string(addr); + } *q = NULL; - for (p = (void *)arg3, q = envp; *p; p++, q++) - *q = (void *)tswap32(*p); + for (gp = guest_envp, q = envp; ; + gp += sizeof(target_ulong), q++) { + addr = tgetl(gp); + if (!addr) + break; + *q = lock_user_string(addr); + } *q = NULL; - ret = get_errno(execve((const char *)arg1, argp, envp)); + p = lock_user_string(arg1); + ret = get_errno(execve(p, argp, envp)); + unlock_user(p, arg1, 0); + + for (gp = guest_argp, q = argp; *q; + gp += sizeof(target_ulong), q++) { + addr = tgetl(gp); + unlock_user(*q, addr, 0); + } + for (gp = guest_envp, q = envp; *q; + gp += sizeof(target_ulong), q++) { + addr = tgetl(gp); + unlock_user(*q, addr, 0); + } } break; case TARGET_NR_chdir: - ret = get_errno(chdir((const char *)arg1)); + p = lock_user_string(arg1); + ret = get_errno(chdir(p)); + unlock_user(p, arg1, 0); break; #ifdef TARGET_NR_time case TARGET_NR_time: { - int *time_ptr = (int *)arg1; - ret = get_errno(time((time_t *)time_ptr)); - if (!is_error(ret) && time_ptr) - tswap32s(time_ptr); + time_t host_time; + ret = get_errno(time(&host_time)); + if (!is_error(ret) && arg1) + tputl(arg1, host_time); } break; #endif case TARGET_NR_mknod: - ret = get_errno(mknod((const char *)arg1, arg2, arg3)); + p = lock_user_string(arg1); + ret = get_errno(mknod(p, arg2, arg3)); + unlock_user(p, arg1, 0); break; case TARGET_NR_chmod: - ret = get_errno(chmod((const char *)arg1, arg2)); + p = lock_user_string(arg1); + ret = get_errno(chmod(p, arg2)); + unlock_user(p, arg1, 0); break; #ifdef TARGET_NR_break case TARGET_NR_break: @@ -1813,14 +2004,15 @@ long do_syscall(void *cpu_env, int num, long arg1, long arg2, long arg3, /* need to look at the data field */ goto unimplemented; case TARGET_NR_umount: - ret = get_errno(umount((const char *)arg1)); + p = lock_user_string(arg1); + ret = get_errno(umount(p)); + unlock_user(p, arg1, 0); break; case TARGET_NR_stime: { - int *time_ptr = (int *)arg1; - if (time_ptr) - tswap32s(time_ptr); - ret = get_errno(stime((time_t *)time_ptr)); + time_t host_time; + host_time = tgetl(arg1); + ret = get_errno(stime(&host_time)); } break; case TARGET_NR_ptrace: @@ -1837,30 +2029,36 @@ long do_syscall(void *cpu_env, int num, long arg1, long arg2, long arg3, break; case TARGET_NR_utime: { - struct utimbuf tbuf, *tbuf1; - struct target_utimbuf *target_tbuf = (void *)arg2; - if (target_tbuf) { - get_user(tbuf.actime, &target_tbuf->actime); - get_user(tbuf.modtime, &target_tbuf->modtime); - tbuf1 = &tbuf; + struct utimbuf tbuf, *host_tbuf; + struct target_utimbuf *target_tbuf; + if (arg2) { + lock_user_struct(target_tbuf, arg2, 1); + tbuf.actime = tswapl(target_tbuf->actime); + tbuf.modtime = tswapl(target_tbuf->modtime); + unlock_user_struct(target_tbuf, arg2, 0); + host_tbuf = &tbuf; } else { - tbuf1 = NULL; + host_tbuf = NULL; } - ret = get_errno(utime((const char *)arg1, tbuf1)); + p = lock_user_string(arg1); + ret = get_errno(utime(p, host_tbuf)); + unlock_user(p, arg1, 0); } break; case TARGET_NR_utimes: { - struct target_timeval *target_tvp = (struct target_timeval *)arg2; struct timeval *tvp, tv[2]; - if (target_tvp) { - target_to_host_timeval(&tv[0], &target_tvp[0]); - target_to_host_timeval(&tv[1], &target_tvp[1]); + if (arg2) { + target_to_host_timeval(&tv[0], arg2); + target_to_host_timeval(&tv[1], + arg2 + sizeof (struct target_timeval)); tvp = tv; } else { tvp = NULL; } - ret = get_errno(utimes((const char *)arg1, tvp)); + p = lock_user_string(arg1); + ret = get_errno(utimes(p, tvp)); + unlock_user(p, arg1, 0); } break; #ifdef TARGET_NR_stty @@ -1872,7 +2070,9 @@ long do_syscall(void *cpu_env, int num, long arg1, long arg2, long arg3, goto unimplemented; #endif case TARGET_NR_access: - ret = get_errno(access((const char *)arg1, arg2)); + p = lock_user_string(arg1); + ret = get_errno(access(p, arg2)); + unlock_user(p, arg1, 0); break; case TARGET_NR_nice: ret = get_errno(nice(arg1)); @@ -1889,33 +2089,45 @@ long do_syscall(void *cpu_env, int num, long arg1, long arg2, long arg3, ret = get_errno(kill(arg1, arg2)); break; case TARGET_NR_rename: - ret = get_errno(rename((const char *)arg1, (const char *)arg2)); + { + void *p2; + p = lock_user_string(arg1); + p2 = lock_user_string(arg2); + ret = get_errno(rename(p, p2)); + unlock_user(p2, arg2, 0); + unlock_user(p, arg1, 0); + } break; case TARGET_NR_mkdir: - ret = get_errno(mkdir((const char *)arg1, arg2)); + p = lock_user_string(arg1); + ret = get_errno(mkdir(p, arg2)); + unlock_user(p, arg1, 0); break; case TARGET_NR_rmdir: - ret = get_errno(rmdir((const char *)arg1)); + p = lock_user_string(arg1); + ret = get_errno(rmdir(p)); + unlock_user(p, arg1, 0); break; case TARGET_NR_dup: ret = get_errno(dup(arg1)); break; case TARGET_NR_pipe: { - int *pipe_ptr = (int *)arg1; - ret = get_errno(pipe(pipe_ptr)); + int host_pipe[2]; + ret = get_errno(pipe(host_pipe)); if (!is_error(ret)) { - tswap32s(&pipe_ptr[0]); - tswap32s(&pipe_ptr[1]); + tput32(arg1, host_pipe[0]); + tput32(arg1 + 4, host_pipe[1]); } } break; case TARGET_NR_times: { - struct target_tms *tmsp = (void *)arg1; + struct target_tms *tmsp; struct tms tms; ret = get_errno(times(&tms)); - if (tmsp) { + if (arg1) { + tmsp = lock_user(arg1, sizeof(struct target_tms), 0); tmsp->tms_utime = tswapl(host_to_target_clock_t(tms.tms_utime)); tmsp->tms_stime = tswapl(host_to_target_clock_t(tms.tms_stime)); tmsp->tms_cutime = tswapl(host_to_target_clock_t(tms.tms_cutime)); @@ -1935,7 +2147,9 @@ long do_syscall(void *cpu_env, int num, long arg1, long arg2, long arg3, case TARGET_NR_acct: goto unimplemented; case TARGET_NR_umount2: - ret = get_errno(umount2((const char *)arg1, arg2)); + p = lock_user_string(arg1); + ret = get_errno(umount2(p, arg2)); + unlock_user(p, arg1, 0); break; #ifdef TARGET_NR_lock case TARGET_NR_lock: @@ -1966,7 +2180,9 @@ long do_syscall(void *cpu_env, int num, long arg1, long arg2, long arg3, ret = get_errno(umask(arg1)); break; case TARGET_NR_chroot: - ret = get_errno(chroot((const char *)arg1)); + p = lock_user_string(arg1); + ret = get_errno(chroot(p)); + unlock_user(p, arg1, 0); break; case TARGET_NR_ustat: goto unimplemented; @@ -1984,29 +2200,49 @@ long do_syscall(void *cpu_env, int num, long arg1, long arg2, long arg3, break; case TARGET_NR_sigaction: { - struct target_old_sigaction *old_act = (void *)arg2; - struct target_old_sigaction *old_oact = (void *)arg3; + struct target_old_sigaction *old_act; struct target_sigaction act, oact, *pact; - if (old_act) { + if (arg2) { + lock_user_struct(old_act, arg2, 1); act._sa_handler = old_act->_sa_handler; target_siginitset(&act.sa_mask, old_act->sa_mask); act.sa_flags = old_act->sa_flags; act.sa_restorer = old_act->sa_restorer; + unlock_user_struct(old_act, arg2, 0); pact = &act; } else { pact = NULL; } ret = get_errno(do_sigaction(arg1, pact, &oact)); - if (!is_error(ret) && old_oact) { - old_oact->_sa_handler = oact._sa_handler; - old_oact->sa_mask = oact.sa_mask.sig[0]; - old_oact->sa_flags = oact.sa_flags; - old_oact->sa_restorer = oact.sa_restorer; + if (!is_error(ret) && arg3) { + lock_user_struct(old_act, arg3, 0); + old_act->_sa_handler = oact._sa_handler; + old_act->sa_mask = oact.sa_mask.sig[0]; + old_act->sa_flags = oact.sa_flags; + old_act->sa_restorer = oact.sa_restorer; + unlock_user_struct(old_act, arg3, 1); } } break; case TARGET_NR_rt_sigaction: - ret = get_errno(do_sigaction(arg1, (void *)arg2, (void *)arg3)); + { + struct target_sigaction *act; + struct target_sigaction *oact; + + if (arg2) + lock_user_struct(act, arg2, 1); + else + act = NULL; + if (arg3) + lock_user_struct(oact, arg3, 0); + else + oact = NULL; + ret = get_errno(do_sigaction(arg1, act, oact)); + if (arg2) + unlock_user_struct(act, arg2, 0); + if (arg3) + unlock_user_struct(oact, arg3, 1); + } break; case TARGET_NR_sgetmask: { @@ -2033,9 +2269,8 @@ long do_syscall(void *cpu_env, int num, long arg1, long arg2, long arg3, { int how = arg1; sigset_t set, oldset, *set_ptr; - target_ulong *pset = (void *)arg2, *poldset = (void *)arg3; - if (pset) { + if (arg2) { switch(how) { case TARGET_SIG_BLOCK: how = SIG_BLOCK; @@ -2050,15 +2285,19 @@ long do_syscall(void *cpu_env, int num, long arg1, long arg2, long arg3, ret = -EINVAL; goto fail; } - target_to_host_old_sigset(&set, pset); + p = lock_user(arg2, sizeof(target_sigset_t), 1); + target_to_host_old_sigset(&set, p); + unlock_user(p, arg2, 0); set_ptr = &set; } else { how = 0; set_ptr = NULL; } ret = get_errno(sigprocmask(arg1, set_ptr, &oldset)); - if (!is_error(ret) && poldset) { - host_to_target_old_sigset(poldset, &oldset); + if (!is_error(ret) && arg3) { + p = lock_user(arg3, sizeof(target_sigset_t), 0); + host_to_target_old_sigset(p, &oldset); + unlock_user(p, arg3, sizeof(target_sigset_t)); } } break; @@ -2066,10 +2305,8 @@ long do_syscall(void *cpu_env, int num, long arg1, long arg2, long arg3, { int how = arg1; sigset_t set, oldset, *set_ptr; - target_sigset_t *pset = (void *)arg2; - target_sigset_t *poldset = (void *)arg3; - if (pset) { + if (arg2) { switch(how) { case TARGET_SIG_BLOCK: how = SIG_BLOCK; @@ -2084,15 +2321,19 @@ long do_syscall(void *cpu_env, int num, long arg1, long arg2, long arg3, ret = -EINVAL; goto fail; } - target_to_host_sigset(&set, pset); + p = lock_user(arg2, sizeof(target_sigset_t), 1); + target_to_host_sigset(&set, p); + unlock_user(p, arg2, 0); set_ptr = &set; } else { how = 0; set_ptr = NULL; } ret = get_errno(sigprocmask(how, set_ptr, &oldset)); - if (!is_error(ret) && poldset) { - host_to_target_sigset(poldset, &oldset); + if (!is_error(ret) && arg3) { + p = lock_user(arg3, sizeof(target_sigset_t), 0); + host_to_target_sigset(p, &oldset); + unlock_user(p, arg3, sizeof(target_sigset_t)); } } break; @@ -2101,7 +2342,9 @@ long do_syscall(void *cpu_env, int num, long arg1, long arg2, long arg3, sigset_t set; ret = get_errno(sigpending(&set)); if (!is_error(ret)) { - host_to_target_old_sigset((target_ulong *)arg1, &set); + p = lock_user(arg1, sizeof(target_sigset_t), 0); + host_to_target_old_sigset(p, &set); + unlock_user(p, arg1, sizeof(target_sigset_t)); } } break; @@ -2110,51 +2353,59 @@ long do_syscall(void *cpu_env, int num, long arg1, long arg2, long arg3, sigset_t set; ret = get_errno(sigpending(&set)); if (!is_error(ret)) { - host_to_target_sigset((target_sigset_t *)arg1, &set); + p = lock_user(arg1, sizeof(target_sigset_t), 0); + host_to_target_sigset(p, &set); + unlock_user(p, arg1, sizeof(target_sigset_t)); } } break; case TARGET_NR_sigsuspend: { sigset_t set; - target_to_host_old_sigset(&set, (target_ulong *)arg1); + p = lock_user(arg1, sizeof(target_sigset_t), 1); + target_to_host_old_sigset(&set, p); + unlock_user(p, arg1, 0); ret = get_errno(sigsuspend(&set)); } break; case TARGET_NR_rt_sigsuspend: { sigset_t set; - target_to_host_sigset(&set, (target_sigset_t *)arg1); + p = lock_user(arg1, sizeof(target_sigset_t), 1); + target_to_host_sigset(&set, p); + unlock_user(p, arg1, 0); ret = get_errno(sigsuspend(&set)); } break; case TARGET_NR_rt_sigtimedwait: { - target_sigset_t *target_set = (void *)arg1; - target_siginfo_t *target_uinfo = (void *)arg2; - struct target_timespec *target_uts = (void *)arg3; sigset_t set; struct timespec uts, *puts; siginfo_t uinfo; - target_to_host_sigset(&set, target_set); - if (target_uts) { + p = lock_user(arg1, sizeof(target_sigset_t), 1); + target_to_host_sigset(&set, p); + unlock_user(p, arg1, 0); + if (arg3) { puts = &uts; - puts->tv_sec = tswapl(target_uts->tv_sec); - puts->tv_nsec = tswapl(target_uts->tv_nsec); + target_to_host_timespec(puts, arg3); } else { puts = NULL; } ret = get_errno(sigtimedwait(&set, &uinfo, puts)); - if (!is_error(ret) && target_uinfo) { - host_to_target_siginfo(target_uinfo, &uinfo); + if (!is_error(ret) && arg2) { + p = lock_user(arg2, sizeof(target_sigset_t), 0); + host_to_target_siginfo(p, &uinfo); + unlock_user(p, arg2, sizeof(target_sigset_t)); } } break; case TARGET_NR_rt_sigqueueinfo: { siginfo_t uinfo; - target_to_host_siginfo(&uinfo, (target_siginfo_t *)arg3); + p = lock_user(arg3, sizeof(target_sigset_t), 1); + target_to_host_siginfo(&uinfo, p); + unlock_user(p, arg1, 0); ret = get_errno(sys_rt_sigqueueinfo(arg1, arg2, &uinfo)); } break; @@ -2167,16 +2418,20 @@ long do_syscall(void *cpu_env, int num, long arg1, long arg2, long arg3, ret = do_rt_sigreturn(cpu_env); break; case TARGET_NR_sethostname: - ret = get_errno(sethostname((const char *)arg1, arg2)); + p = lock_user_string(arg1); + ret = get_errno(sethostname(p, arg2)); + unlock_user(p, arg1, 0); break; case TARGET_NR_setrlimit: { /* XXX: convert resource ? */ int resource = arg1; - struct target_rlimit *target_rlim = (void *)arg2; + struct target_rlimit *target_rlim; struct rlimit rlim; + lock_user_struct(target_rlim, arg2, 1); rlim.rlim_cur = tswapl(target_rlim->rlim_cur); rlim.rlim_max = tswapl(target_rlim->rlim_max); + unlock_user_struct(target_rlim, arg2, 0); ret = get_errno(setrlimit(resource, &rlim)); } break; @@ -2184,72 +2439,91 @@ long do_syscall(void *cpu_env, int num, long arg1, long arg2, long arg3, { /* XXX: convert resource ? */ int resource = arg1; - struct target_rlimit *target_rlim = (void *)arg2; + struct target_rlimit *target_rlim; struct rlimit rlim; ret = get_errno(getrlimit(resource, &rlim)); if (!is_error(ret)) { - target_rlim->rlim_cur = tswapl(rlim.rlim_cur); - target_rlim->rlim_max = tswapl(rlim.rlim_max); + lock_user_struct(target_rlim, arg2, 0); + rlim.rlim_cur = tswapl(target_rlim->rlim_cur); + rlim.rlim_max = tswapl(target_rlim->rlim_max); + unlock_user_struct(target_rlim, arg2, 1); } } break; case TARGET_NR_getrusage: { struct rusage rusage; - struct target_rusage *target_rusage = (void *)arg2; ret = get_errno(getrusage(arg1, &rusage)); if (!is_error(ret)) { - host_to_target_rusage(target_rusage, &rusage); + host_to_target_rusage(arg2, &rusage); } } break; case TARGET_NR_gettimeofday: { - struct target_timeval *target_tv = (void *)arg1; struct timeval tv; ret = get_errno(gettimeofday(&tv, NULL)); if (!is_error(ret)) { - host_to_target_timeval(target_tv, &tv); + host_to_target_timeval(arg1, &tv); } } break; case TARGET_NR_settimeofday: { - struct target_timeval *target_tv = (void *)arg1; struct timeval tv; - target_to_host_timeval(&tv, target_tv); + target_to_host_timeval(&tv, arg1); ret = get_errno(settimeofday(&tv, NULL)); } break; #ifdef TARGET_NR_select case TARGET_NR_select: { - struct target_sel_arg_struct *sel = (void *)arg1; - sel->n = tswapl(sel->n); - sel->inp = tswapl(sel->inp); - sel->outp = tswapl(sel->outp); - sel->exp = tswapl(sel->exp); - sel->tvp = tswapl(sel->tvp); - ret = do_select(sel->n, (void *)sel->inp, (void *)sel->outp, - (void *)sel->exp, (void *)sel->tvp); + struct target_sel_arg_struct *sel; + target_ulong inp, outp, exp, tvp; + long nsel; + + lock_user_struct(sel, arg1, 1); + nsel = tswapl(sel->n); + inp = tswapl(sel->inp); + outp = tswapl(sel->outp); + exp = tswapl(sel->exp); + tvp = tswapl(sel->tvp); + unlock_user_struct(sel, arg1, 0); + ret = do_select(nsel, inp, outp, exp, tvp); } break; #endif case TARGET_NR_symlink: - ret = get_errno(symlink((const char *)arg1, (const char *)arg2)); + { + void *p2; + p = lock_user_string(arg1); + p2 = lock_user_string(arg2); + ret = get_errno(symlink(p, p2)); + unlock_user(p2, arg2, 0); + unlock_user(p, arg1, 0); + } break; #ifdef TARGET_NR_oldlstat case TARGET_NR_oldlstat: goto unimplemented; #endif case TARGET_NR_readlink: - ret = get_errno(readlink(path((const char *)arg1), (char *)arg2, arg3)); + { + void *p2; + p = lock_user_string(arg1); + p2 = lock_user(arg2, arg3, 0); + ret = get_errno(readlink(path(p), p2, arg3)); + unlock_user(p2, arg2, ret); + unlock_user(p, arg1, 0); + } break; case TARGET_NR_uselib: goto unimplemented; case TARGET_NR_swapon: - ret = get_errno(swapon((const char *)arg1, arg2)); + p = lock_user_string(arg1); + ret = get_errno(swapon(p, arg2)); + unlock_user(p, arg1, 0); break; case TARGET_NR_reboot: goto unimplemented; @@ -2258,14 +2532,16 @@ long do_syscall(void *cpu_env, int num, long arg1, long arg2, long arg3, case TARGET_NR_mmap: #if defined(TARGET_I386) || defined(TARGET_ARM) { - uint32_t v1, v2, v3, v4, v5, v6, *vptr; - vptr = (uint32_t *)arg1; - v1 = tswap32(vptr[0]); - v2 = tswap32(vptr[1]); - v3 = tswap32(vptr[2]); - v4 = tswap32(vptr[3]); - v5 = tswap32(vptr[4]); - v6 = tswap32(vptr[5]); + target_ulong *v; + target_ulong v1, v2, v3, v4, v5, v6; + v = lock_user(arg1, 6 * sizeof(target_ulong), 1); + v1 = tswapl(v[0]); + v2 = tswapl(v[1]); + v3 = tswapl(v[2]); + v4 = tswapl(v[3]); + v5 = tswapl(v[4]); + v6 = tswapl(v[5]); + unlock_user(v, arg1, 0); ret = get_errno(target_mmap(v1, v2, v3, target_to_host_bitmask(v4, mmap_flags_tbl), v5, v6)); @@ -2299,14 +2575,15 @@ long do_syscall(void *cpu_env, int num, long arg1, long arg2, long arg3, case TARGET_NR_mremap: ret = get_errno(target_mremap(arg1, arg2, arg3, arg4, arg5)); break; + /* ??? msync/mlock/munlock are broken for softmmu. */ case TARGET_NR_msync: - ret = get_errno(msync((void *)arg1, arg2, arg3)); + ret = get_errno(msync(g2h(arg1), arg2, arg3)); break; case TARGET_NR_mlock: - ret = get_errno(mlock((void *)arg1, arg2)); + ret = get_errno(mlock(g2h(arg1), arg2)); break; case TARGET_NR_munlock: - ret = get_errno(munlock((void *)arg1, arg2)); + ret = get_errno(munlock(g2h(arg1), arg2)); break; case TARGET_NR_mlockall: ret = get_errno(mlockall(arg1)); @@ -2315,7 +2592,9 @@ long do_syscall(void *cpu_env, int num, long arg1, long arg2, long arg3, ret = get_errno(munlockall()); break; case TARGET_NR_truncate: - ret = get_errno(truncate((const char *)arg1, arg2)); + p = lock_user_string(arg1); + ret = get_errno(truncate(p, arg2)); + unlock_user(p, arg1, 0); break; case TARGET_NR_ftruncate: ret = get_errno(ftruncate(arg1, arg2)); @@ -2334,11 +2613,15 @@ long do_syscall(void *cpu_env, int num, long arg1, long arg2, long arg3, goto unimplemented; #endif case TARGET_NR_statfs: - ret = get_errno(statfs(path((const char *)arg1), &stfs)); + p = lock_user_string(arg1); + ret = get_errno(statfs(path(p), &stfs)); + unlock_user(p, arg1, 0); convert_statfs: if (!is_error(ret)) { - struct target_statfs *target_stfs = (void *)arg2; + struct target_statfs *target_stfs; + lock_user_struct(target_stfs, arg2, 0); + /* ??? put_user is probably wrong. */ put_user(stfs.f_type, &target_stfs->f_type); put_user(stfs.f_bsize, &target_stfs->f_bsize); put_user(stfs.f_blocks, &target_stfs->f_blocks); @@ -2348,6 +2631,7 @@ long do_syscall(void *cpu_env, int num, long arg1, long arg2, long arg3, put_user(stfs.f_ffree, &target_stfs->f_ffree); put_user(stfs.f_fsid.__val[0], &target_stfs->f_fsid); put_user(stfs.f_namelen, &target_stfs->f_namelen); + unlock_user_struct(target_stfs, arg2, 1); } break; case TARGET_NR_fstatfs: @@ -2355,11 +2639,15 @@ long do_syscall(void *cpu_env, int num, long arg1, long arg2, long arg3, goto convert_statfs; #ifdef TARGET_NR_statfs64 case TARGET_NR_statfs64: - ret = get_errno(statfs(path((const char *)arg1), &stfs)); + p = lock_user_string(arg1); + ret = get_errno(statfs(path(p), &stfs)); + unlock_user(p, arg1, 0); convert_statfs64: if (!is_error(ret)) { - struct target_statfs64 *target_stfs = (void *)arg3; - + struct target_statfs64 *target_stfs; + + lock_user_struct(target_stfs, arg3, 0); + /* ??? put_user is probably wrong. */ put_user(stfs.f_type, &target_stfs->f_type); put_user(stfs.f_bsize, &target_stfs->f_bsize); put_user(stfs.f_blocks, &target_stfs->f_blocks); @@ -2369,6 +2657,7 @@ long do_syscall(void *cpu_env, int num, long arg1, long arg2, long arg3, put_user(stfs.f_ffree, &target_stfs->f_ffree); put_user(stfs.f_fsid.__val[0], &target_stfs->f_fsid); put_user(stfs.f_namelen, &target_stfs->f_namelen); + unlock_user_struct(target_stfs, arg3, 0); } break; case TARGET_NR_fstatfs64: @@ -2380,60 +2669,63 @@ long do_syscall(void *cpu_env, int num, long arg1, long arg2, long arg3, goto unimplemented; #endif case TARGET_NR_socketcall: - ret = do_socketcall(arg1, (int32_t *)arg2); + ret = do_socketcall(arg1, arg2); break; case TARGET_NR_syslog: goto unimplemented; case TARGET_NR_setitimer: { - struct target_itimerval *target_value = (void *)arg2; - struct target_itimerval *target_ovalue = (void *)arg3; struct itimerval value, ovalue, *pvalue; - if (target_value) { + if (arg2) { pvalue = &value; target_to_host_timeval(&pvalue->it_interval, - &target_value->it_interval); + arg2); target_to_host_timeval(&pvalue->it_value, - &target_value->it_value); + arg2 + sizeof(struct target_timeval)); } else { pvalue = NULL; } ret = get_errno(setitimer(arg1, pvalue, &ovalue)); - if (!is_error(ret) && target_ovalue) { - host_to_target_timeval(&target_ovalue->it_interval, + if (!is_error(ret) && arg3) { + host_to_target_timeval(arg3, &ovalue.it_interval); - host_to_target_timeval(&target_ovalue->it_value, + host_to_target_timeval(arg3 + sizeof(struct target_timeval), &ovalue.it_value); } } break; case TARGET_NR_getitimer: { - struct target_itimerval *target_value = (void *)arg2; struct itimerval value; ret = get_errno(getitimer(arg1, &value)); - if (!is_error(ret) && target_value) { - host_to_target_timeval(&target_value->it_interval, + if (!is_error(ret) && arg2) { + host_to_target_timeval(arg2, &value.it_interval); - host_to_target_timeval(&target_value->it_value, + host_to_target_timeval(arg2 + sizeof(struct target_timeval), &value.it_value); } } break; case TARGET_NR_stat: - ret = get_errno(stat(path((const char *)arg1), &st)); + p = lock_user_string(arg1); + ret = get_errno(stat(path(p), &st)); + unlock_user(p, arg1, 0); goto do_stat; case TARGET_NR_lstat: - ret = get_errno(lstat(path((const char *)arg1), &st)); + p = lock_user_string(arg1); + ret = get_errno(lstat(path(p), &st)); + unlock_user(p, arg1, 0); goto do_stat; case TARGET_NR_fstat: { ret = get_errno(fstat(arg1, &st)); do_stat: if (!is_error(ret)) { - struct target_stat *target_st = (void *)arg2; + struct target_stat *target_st; + + lock_user_struct(target_st, arg2, 0); target_st->st_dev = tswap16(st.st_dev); target_st->st_ino = tswapl(st.st_ino); #if defined(TARGET_PPC) @@ -2453,6 +2745,7 @@ long do_syscall(void *cpu_env, int num, long arg1, long arg2, long arg3, target_st->target_st_atime = tswapl(st.st_atime); target_st->target_st_mtime = tswapl(st.st_mtime); target_st->target_st_ctime = tswapl(st.st_ctime); + unlock_user_struct(target_st, arg2, 1); } } break; @@ -2479,9 +2772,9 @@ long do_syscall(void *cpu_env, int num, long arg1, long arg2, long arg3, case TARGET_NR_wait4: { int status; - target_long *status_ptr = (void *)arg2; + target_long status_ptr = arg2; struct rusage rusage, *rusage_ptr; - struct target_rusage *target_rusage = (void *)arg4; + target_ulong target_rusage = arg4; if (target_rusage) rusage_ptr = &rusage; else @@ -2489,7 +2782,7 @@ long do_syscall(void *cpu_env, int num, long arg1, long arg2, long arg3, ret = get_errno(wait4(arg1, &status, arg3, rusage_ptr)); if (!is_error(ret)) { if (status_ptr) - *status_ptr = tswap32(status); + tputl(status_ptr, status); if (target_rusage) { host_to_target_rusage(target_rusage, &rusage); } @@ -2497,15 +2790,19 @@ long do_syscall(void *cpu_env, int num, long arg1, long arg2, long arg3, } break; case TARGET_NR_swapoff: - ret = get_errno(swapoff((const char *)arg1)); + p = lock_user_string(arg1); + ret = get_errno(swapoff(p)); + unlock_user(p, arg1, 0); break; case TARGET_NR_sysinfo: { - struct target_sysinfo *target_value = (void *)arg1; + struct target_sysinfo *target_value; struct sysinfo value; ret = get_errno(sysinfo(&value)); - if (!is_error(ret) && target_value) + if (!is_error(ret) && arg1) { + /* ??? __put_user is probably wrong. */ + lock_user_struct(target_value, arg1, 0); __put_user(value.uptime, &target_value->uptime); __put_user(value.loads[0], &target_value->loads[0]); __put_user(value.loads[1], &target_value->loads[1]); @@ -2520,6 +2817,7 @@ long do_syscall(void *cpu_env, int num, long arg1, long arg2, long arg3, __put_user(value.totalhigh, &target_value->totalhigh); __put_user(value.freehigh, &target_value->freehigh); __put_user(value.mem_unit, &target_value->mem_unit); + unlock_user_struct(target_value, arg1, 1); } } break; @@ -2540,30 +2838,33 @@ long do_syscall(void *cpu_env, int num, long arg1, long arg2, long arg3, break; #endif case TARGET_NR_setdomainname: - ret = get_errno(setdomainname((const char *)arg1, arg2)); + p = lock_user_string(arg1); + ret = get_errno(setdomainname(p, arg2)); + unlock_user(p, arg1, 0); break; case TARGET_NR_uname: /* no need to transcode because we use the linux syscall */ { struct new_utsname * buf; - buf = (struct new_utsname *)arg1; + lock_user_struct(buf, arg1, 0); ret = get_errno(sys_uname(buf)); if (!is_error(ret)) { /* Overrite the native machine name with whatever is being emulated. */ strcpy (buf->machine, UNAME_MACHINE); } + unlock_user_struct(buf, arg1, 1); } break; #ifdef TARGET_I386 case TARGET_NR_modify_ldt: - ret = get_errno(do_modify_ldt(cpu_env, arg1, (void *)arg2, arg3)); + ret = get_errno(do_modify_ldt(cpu_env, arg1, arg2, arg3)); break; case TARGET_NR_vm86old: goto unimplemented; case TARGET_NR_vm86: - ret = do_vm86(cpu_env, arg1, (void *)arg2); + ret = do_vm86(cpu_env, arg1, arg2); break; #endif case TARGET_NR_adjtimex: @@ -2594,20 +2895,21 @@ long do_syscall(void *cpu_env, int num, long arg1, long arg2, long arg3, { #if defined (__x86_64__) ret = get_errno(lseek(arg1, ((uint64_t )arg2 << 32) | arg3, arg5)); - *(int64_t *)arg4 = ret; + tput64(arg4, ret); #else int64_t res; ret = get_errno(_llseek(arg1, arg2, arg3, &res, arg5)); - *(int64_t *)arg4 = tswap64(res); + tput64(arg4, res); #endif } break; case TARGET_NR_getdents: #if TARGET_LONG_SIZE != 4 + goto unimplemented; #warning not supported #elif TARGET_LONG_SIZE == 4 && HOST_LONG_SIZE == 8 { - struct target_dirent *target_dirp = (void *)arg2; + struct target_dirent *target_dirp; struct dirent *dirp; long count = arg3; @@ -2625,6 +2927,7 @@ long do_syscall(void *cpu_env, int num, long arg1, long arg2, long arg3, count1 = 0; de = dirp; + target_dirp = lock_user(arg2, count, 0); tde = target_dirp; while (len > 0) { reclen = de->d_reclen; @@ -2644,13 +2947,15 @@ long do_syscall(void *cpu_env, int num, long arg1, long arg2, long arg3, } ret = count1; } + unlock_user(target_dirp, arg2, ret); free(dirp); } #else { - struct dirent *dirp = (void *)arg2; + struct dirent *dirp; long count = arg3; + dirp = lock_user(arg2, count, 0); ret = get_errno(sys_getdents(arg1, dirp, count)); if (!is_error(ret)) { struct dirent *de; @@ -2668,14 +2973,16 @@ long do_syscall(void *cpu_env, int num, long arg1, long arg2, long arg3, len -= reclen; } } + unlock_user(dirp, arg2, ret); } #endif break; #ifdef TARGET_NR_getdents64 case TARGET_NR_getdents64: { - struct dirent64 *dirp = (void *)arg2; + struct dirent64 *dirp; long count = arg3; + dirp = lock_user(arg2, count, 0); ret = get_errno(sys_getdents64(arg1, dirp, count)); if (!is_error(ret)) { struct dirent64 *de; @@ -2693,21 +3000,22 @@ long do_syscall(void *cpu_env, int num, long arg1, long arg2, long arg3, len -= reclen; } } + unlock_user(dirp, arg2, ret); } break; #endif /* TARGET_NR_getdents64 */ case TARGET_NR__newselect: - ret = do_select(arg1, (void *)arg2, (void *)arg3, (void *)arg4, - (void *)arg5); + ret = do_select(arg1, arg2, arg3, arg4, arg5); break; case TARGET_NR_poll: { - struct target_pollfd *target_pfd = (void *)arg1; + struct target_pollfd *target_pfd; unsigned int nfds = arg2; int timeout = arg3; struct pollfd *pfd; unsigned int i; + target_pfd = lock_user(arg1, sizeof(struct target_pollfd) * nfds, 1); pfd = alloca(sizeof(struct pollfd) * nfds); for(i = 0; i < nfds; i++) { pfd[i].fd = tswap32(target_pfd[i].fd); @@ -2718,7 +3026,10 @@ long do_syscall(void *cpu_env, int num, long arg1, long arg2, long arg3, for(i = 0; i < nfds; i++) { target_pfd[i].revents = tswap16(pfd[i].revents); } + ret += nfds * (sizeof(struct target_pollfd) + - sizeof(struct pollfd)); } + unlock_user(target_pfd, arg1, ret); } break; case TARGET_NR_flock: @@ -2729,31 +3040,23 @@ long do_syscall(void *cpu_env, int num, long arg1, long arg2, long arg3, case TARGET_NR_readv: { int count = arg3; - int i; struct iovec *vec; - struct target_iovec *target_vec = (void *)arg2; vec = alloca(count * sizeof(struct iovec)); - for(i = 0;i < count; i++) { - vec[i].iov_base = (void *)tswapl(target_vec[i].iov_base); - vec[i].iov_len = tswapl(target_vec[i].iov_len); - } + lock_iovec(vec, arg2, count, 0); ret = get_errno(readv(arg1, vec, count)); + unlock_iovec(vec, arg2, count, 1); } break; case TARGET_NR_writev: { int count = arg3; - int i; struct iovec *vec; - struct target_iovec *target_vec = (void *)arg2; vec = alloca(count * sizeof(struct iovec)); - for(i = 0;i < count; i++) { - vec[i].iov_base = (void *)tswapl(target_vec[i].iov_base); - vec[i].iov_len = tswapl(target_vec[i].iov_len); - } + lock_iovec(vec, arg2, count, 1); ret = get_errno(writev(arg1, vec, count)); + unlock_iovec(vec, arg2, count, 0); } break; case TARGET_NR_getsid: @@ -2768,27 +3071,34 @@ long do_syscall(void *cpu_env, int num, long arg1, long arg2, long arg3, return -ENOTDIR; case TARGET_NR_sched_setparam: { - struct sched_param *target_schp = (void *)arg2; + struct sched_param *target_schp; struct sched_param schp; + + lock_user_struct(target_schp, arg2, 1); schp.sched_priority = tswap32(target_schp->sched_priority); + unlock_user_struct(target_schp, arg2, 0); ret = get_errno(sched_setparam(arg1, &schp)); } break; case TARGET_NR_sched_getparam: { - struct sched_param *target_schp = (void *)arg2; + struct sched_param *target_schp; struct sched_param schp; ret = get_errno(sched_getparam(arg1, &schp)); if (!is_error(ret)) { + lock_user_struct(target_schp, arg2, 0); target_schp->sched_priority = tswap32(schp.sched_priority); + unlock_user_struct(target_schp, arg2, 1); } } break; case TARGET_NR_sched_setscheduler: { - struct sched_param *target_schp = (void *)arg3; + struct sched_param *target_schp; struct sched_param schp; + lock_user_struct(target_schp, arg3, 1); schp.sched_priority = tswap32(target_schp->sched_priority); + unlock_user_struct(target_schp, arg3, 0); ret = get_errno(sched_setscheduler(arg1, arg2, &schp)); } break; @@ -2806,26 +3116,20 @@ long do_syscall(void *cpu_env, int num, long arg1, long arg2, long arg3, break; case TARGET_NR_sched_rr_get_interval: { - struct target_timespec *target_ts = (void *)arg2; struct timespec ts; ret = get_errno(sched_rr_get_interval(arg1, &ts)); if (!is_error(ret)) { - target_ts->tv_sec = tswapl(ts.tv_sec); - target_ts->tv_nsec = tswapl(ts.tv_nsec); + host_to_target_timespec(arg2, &ts); } } break; case TARGET_NR_nanosleep: { - struct target_timespec *target_req = (void *)arg1; - struct target_timespec *target_rem = (void *)arg2; struct timespec req, rem; - req.tv_sec = tswapl(target_req->tv_sec); - req.tv_nsec = tswapl(target_req->tv_nsec); + target_to_host_timespec(&req, arg1); ret = get_errno(nanosleep(&req, &rem)); - if (is_error(ret) && target_rem) { - target_rem->tv_sec = tswapl(rem.tv_sec); - target_rem->tv_nsec = tswapl(rem.tv_nsec); + if (is_error(ret) && arg2) { + host_to_target_timespec(arg2, &rem); } } break; @@ -2837,15 +3141,21 @@ long do_syscall(void *cpu_env, int num, long arg1, long arg2, long arg3, goto unimplemented; #ifdef TARGET_NR_pread case TARGET_NR_pread: - page_unprotect_range((void *)arg2, arg3); - ret = get_errno(pread(arg1, (void *)arg2, arg3, arg4)); + page_unprotect_range(arg2, arg3); + p = lock_user(arg2, arg3, 0); + ret = get_errno(pread(arg1, p, arg3, arg4)); + unlock_user(p, arg2, ret); break; case TARGET_NR_pwrite: - ret = get_errno(pwrite(arg1, (void *)arg2, arg3, arg4)); + p = lock_user(arg2, arg3, 1); + ret = get_errno(pwrite(arg1, p, arg3, arg4)); + unlock_user(p, arg2, 0); break; #endif case TARGET_NR_getcwd: - ret = get_errno(sys_getcwd1((char *)arg1, arg2)); + p = lock_user(arg1, arg2, 0); + ret = get_errno(sys_getcwd1(p, arg2)); + unlock_user(p, arg1, ret); break; case TARGET_NR_capget: goto unimplemented; @@ -2874,16 +3184,20 @@ long do_syscall(void *cpu_env, int num, long arg1, long arg2, long arg3, struct rlimit rlim; ret = get_errno(getrlimit(arg1, &rlim)); if (!is_error(ret)) { - struct target_rlimit *target_rlim = (void *)arg2; + struct target_rlimit *target_rlim; + lock_user_struct(target_rlim, arg2, 0); target_rlim->rlim_cur = tswapl(rlim.rlim_cur); target_rlim->rlim_max = tswapl(rlim.rlim_max); + unlock_user_struct(target_rlim, arg2, 1); } break; } #endif #ifdef TARGET_NR_truncate64 case TARGET_NR_truncate64: - ret = target_truncate64(cpu_env, (const char *)arg1, arg2, arg3, arg4); + p = lock_user_string(arg1); + ret = target_truncate64(cpu_env, p, arg2, arg3, arg4); + unlock_user(p, arg1, 0); break; #endif #ifdef TARGET_NR_ftruncate64 @@ -2893,12 +3207,16 @@ long do_syscall(void *cpu_env, int num, long arg1, long arg2, long arg3, #endif #ifdef TARGET_NR_stat64 case TARGET_NR_stat64: - ret = get_errno(stat(path((const char *)arg1), &st)); + p = lock_user_string(arg1); + ret = get_errno(stat(path(p), &st)); + unlock_user(p, arg1, 0); goto do_stat64; #endif #ifdef TARGET_NR_lstat64 case TARGET_NR_lstat64: - ret = get_errno(lstat(path((const char *)arg1), &st)); + p = lock_user_string(arg1); + ret = get_errno(lstat(path(p), &st)); + unlock_user(p, arg1, 0); goto do_stat64; #endif #ifdef TARGET_NR_fstat64 @@ -2909,8 +3227,10 @@ long do_syscall(void *cpu_env, int num, long arg1, long arg2, long arg3, if (!is_error(ret)) { #ifdef TARGET_ARM if (((CPUARMState *)cpu_env)->eabi) { - struct target_eabi_stat64 *target_st = (void *)arg2; + struct target_eabi_stat64 *target_st; + lock_user_struct(target_st, arg2, 1); memset(target_st, 0, sizeof(struct target_eabi_stat64)); + /* put_user is probably wrong. */ put_user(st.st_dev, &target_st->st_dev); put_user(st.st_ino, &target_st->st_ino); #ifdef TARGET_STAT64_HAS_BROKEN_ST_INO @@ -2928,11 +3248,14 @@ long do_syscall(void *cpu_env, int num, long arg1, long arg2, long arg3, put_user(st.st_atime, &target_st->target_st_atime); put_user(st.st_mtime, &target_st->target_st_mtime); put_user(st.st_ctime, &target_st->target_st_ctime); + unlock_user_struct(target_st, arg2, 0); } else #endif { - struct target_stat64 *target_st = (void *)arg2; + struct target_stat64 *target_st; + lock_user_struct(target_st, arg2, 1); memset(target_st, 0, sizeof(struct target_stat64)); + /* ??? put_user is probably wrong. */ put_user(st.st_dev, &target_st->st_dev); put_user(st.st_ino, &target_st->st_ino); #ifdef TARGET_STAT64_HAS_BROKEN_ST_INO @@ -2950,6 +3273,7 @@ long do_syscall(void *cpu_env, int num, long arg1, long arg2, long arg3, put_user(st.st_atime, &target_st->target_st_atime); put_user(st.st_mtime, &target_st->target_st_mtime); put_user(st.st_ctime, &target_st->target_st_ctime); + unlock_user_struct(target_st, arg2, 0); } } } @@ -2957,7 +3281,9 @@ long do_syscall(void *cpu_env, int num, long arg1, long arg2, long arg3, #endif #ifdef USE_UID16 case TARGET_NR_lchown: - ret = get_errno(lchown((const char *)arg1, low2highuid(arg2), low2highgid(arg3))); + p = lock_user_string(arg1); + ret = get_errno(lchown(p, low2highuid(arg2), low2highgid(arg3))); + unlock_user(p, arg1, 0); break; case TARGET_NR_getuid: ret = get_errno(high2lowuid(getuid())); @@ -2980,28 +3306,32 @@ long do_syscall(void *cpu_env, int num, long arg1, long arg2, long arg3, case TARGET_NR_getgroups: { int gidsetsize = arg1; - uint16_t *target_grouplist = (void *)arg2; + uint16_t *target_grouplist; gid_t *grouplist; int i; grouplist = alloca(gidsetsize * sizeof(gid_t)); ret = get_errno(getgroups(gidsetsize, grouplist)); if (!is_error(ret)) { + target_grouplist = lock_user(arg2, gidsetsize * 2, 0); for(i = 0;i < gidsetsize; i++) target_grouplist[i] = tswap16(grouplist[i]); + unlock_user(target_grouplist, arg2, gidsetsize * 2); } } break; case TARGET_NR_setgroups: { int gidsetsize = arg1; - uint16_t *target_grouplist = (void *)arg2; + uint16_t *target_grouplist; gid_t *grouplist; int i; grouplist = alloca(gidsetsize * sizeof(gid_t)); + target_grouplist = lock_user(arg2, gidsetsize * 2, 1); for(i = 0;i < gidsetsize; i++) grouplist[i] = tswap16(target_grouplist[i]); + unlock_user(target_grouplist, arg2, 0); ret = get_errno(setgroups(gidsetsize, grouplist)); } break; @@ -3018,12 +3348,12 @@ long do_syscall(void *cpu_env, int num, long arg1, long arg2, long arg3, #ifdef TARGET_NR_getresuid case TARGET_NR_getresuid: { - int ruid, euid, suid; + uid_t ruid, euid, suid; ret = get_errno(getresuid(&ruid, &euid, &suid)); if (!is_error(ret)) { - *(uint16_t *)arg1 = tswap16(high2lowuid(ruid)); - *(uint16_t *)arg2 = tswap16(high2lowuid(euid)); - *(uint16_t *)arg3 = tswap16(high2lowuid(suid)); + tput16(arg1, tswap16(high2lowuid(ruid))); + tput16(arg2, tswap16(high2lowuid(euid))); + tput16(arg3, tswap16(high2lowuid(suid))); } } break; @@ -3038,18 +3368,20 @@ long do_syscall(void *cpu_env, int num, long arg1, long arg2, long arg3, #ifdef TARGET_NR_getresgid case TARGET_NR_getresgid: { - int rgid, egid, sgid; + gid_t rgid, egid, sgid; ret = get_errno(getresgid(&rgid, &egid, &sgid)); if (!is_error(ret)) { - *(uint16_t *)arg1 = tswap16(high2lowgid(rgid)); - *(uint16_t *)arg2 = tswap16(high2lowgid(egid)); - *(uint16_t *)arg3 = tswap16(high2lowgid(sgid)); + tput16(arg1, tswap16(high2lowgid(rgid))); + tput16(arg2, tswap16(high2lowgid(egid))); + tput16(arg3, tswap16(high2lowgid(sgid))); } } break; #endif case TARGET_NR_chown: - ret = get_errno(chown((const char *)arg1, low2highuid(arg2), low2highgid(arg3))); + p = lock_user_string(arg1); + ret = get_errno(chown(p, low2highuid(arg2), low2highgid(arg3))); + unlock_user(p, arg1, 0); break; case TARGET_NR_setuid: ret = get_errno(setuid(low2highuid(arg1))); @@ -3067,7 +3399,9 @@ long do_syscall(void *cpu_env, int num, long arg1, long arg2, long arg3, #ifdef TARGET_NR_lchown32 case TARGET_NR_lchown32: - ret = get_errno(lchown((const char *)arg1, arg2, arg3)); + p = lock_user_string(arg1); + ret = get_errno(lchown(p, arg2, arg3)); + unlock_user(p, arg1, 0); break; #endif #ifdef TARGET_NR_getuid32 @@ -3104,15 +3438,17 @@ long do_syscall(void *cpu_env, int num, long arg1, long arg2, long arg3, case TARGET_NR_getgroups32: { int gidsetsize = arg1; - uint32_t *target_grouplist = (void *)arg2; + uint32_t *target_grouplist; gid_t *grouplist; int i; grouplist = alloca(gidsetsize * sizeof(gid_t)); ret = get_errno(getgroups(gidsetsize, grouplist)); if (!is_error(ret)) { + target_grouplist = lock_user(arg2, gidsetsize * 4, 0); for(i = 0;i < gidsetsize; i++) - put_user(grouplist[i], &target_grouplist[i]); + target_grouplist[i] = tswap32(grouplist[i]); + unlock_user(target_grouplist, arg2, gidsetsize * 4); } } break; @@ -3121,13 +3457,15 @@ long do_syscall(void *cpu_env, int num, long arg1, long arg2, long arg3, case TARGET_NR_setgroups32: { int gidsetsize = arg1; - uint32_t *target_grouplist = (void *)arg2; + uint32_t *target_grouplist; gid_t *grouplist; int i; grouplist = alloca(gidsetsize * sizeof(gid_t)); + target_grouplist = lock_user(arg2, gidsetsize * 4, 1); for(i = 0;i < gidsetsize; i++) - get_user(grouplist[i], &target_grouplist[i]); + grouplist[i] = tswap32(target_grouplist[i]); + unlock_user(target_grouplist, arg2, 0); ret = get_errno(setgroups(gidsetsize, grouplist)); } break; @@ -3145,12 +3483,12 @@ long do_syscall(void *cpu_env, int num, long arg1, long arg2, long arg3, #ifdef TARGET_NR_getresuid32 case TARGET_NR_getresuid32: { - int ruid, euid, suid; + uid_t ruid, euid, suid; ret = get_errno(getresuid(&ruid, &euid, &suid)); if (!is_error(ret)) { - *(uint32_t *)arg1 = tswap32(ruid); - *(uint32_t *)arg2 = tswap32(euid); - *(uint32_t *)arg3 = tswap32(suid); + tput32(arg1, tswap32(ruid)); + tput32(arg2, tswap32(euid)); + tput32(arg3, tswap32(suid)); } } break; @@ -3163,19 +3501,21 @@ long do_syscall(void *cpu_env, int num, long arg1, long arg2, long arg3, #ifdef TARGET_NR_getresgid32 case TARGET_NR_getresgid32: { - int rgid, egid, sgid; + gid_t rgid, egid, sgid; ret = get_errno(getresgid(&rgid, &egid, &sgid)); if (!is_error(ret)) { - *(uint32_t *)arg1 = tswap32(rgid); - *(uint32_t *)arg2 = tswap32(egid); - *(uint32_t *)arg3 = tswap32(sgid); + tput32(arg1, tswap32(rgid)); + tput32(arg2, tswap32(egid)); + tput32(arg3, tswap32(sgid)); } } break; #endif #ifdef TARGET_NR_chown32 case TARGET_NR_chown32: - ret = get_errno(chown((const char *)arg1, arg2, arg3)); + p = lock_user_string(arg1); + ret = get_errno(chown(p, arg2, arg3)); + unlock_user(p, arg1, 0); break; #endif #ifdef TARGET_NR_setuid32 @@ -3213,9 +3553,9 @@ long do_syscall(void *cpu_env, int num, long arg1, long arg2, long arg3, case TARGET_NR_fcntl64: { struct flock64 fl; - struct target_flock64 *target_fl = (void *)arg3; + struct target_flock64 *target_fl; #ifdef TARGET_ARM - struct target_eabi_flock64 *target_efl = (void *)arg3; + struct target_eabi_flock64 *target_efl; #endif switch(arg2) { @@ -3224,19 +3564,23 @@ long do_syscall(void *cpu_env, int num, long arg1, long arg2, long arg3, if (ret == 0) { #ifdef TARGET_ARM if (((CPUARMState *)cpu_env)->eabi) { + lock_user_struct(target_efl, arg3, 0); target_efl->l_type = tswap16(fl.l_type); target_efl->l_whence = tswap16(fl.l_whence); target_efl->l_start = tswap64(fl.l_start); target_efl->l_len = tswap64(fl.l_len); target_efl->l_pid = tswapl(fl.l_pid); + unlock_user_struct(target_efl, arg3, 1); } else #endif { + lock_user_struct(target_fl, arg3, 0); target_fl->l_type = tswap16(fl.l_type); target_fl->l_whence = tswap16(fl.l_whence); target_fl->l_start = tswap64(fl.l_start); target_fl->l_len = tswap64(fl.l_len); target_fl->l_pid = tswapl(fl.l_pid); + unlock_user_struct(target_fl, arg3, 1); } } break; @@ -3245,19 +3589,23 @@ long do_syscall(void *cpu_env, int num, long arg1, long arg2, long arg3, case F_SETLKW64: #ifdef TARGET_ARM if (((CPUARMState *)cpu_env)->eabi) { + lock_user_struct(target_efl, arg3, 1); fl.l_type = tswap16(target_efl->l_type); fl.l_whence = tswap16(target_efl->l_whence); fl.l_start = tswap64(target_efl->l_start); fl.l_len = tswap64(target_efl->l_len); fl.l_pid = tswapl(target_efl->l_pid); + unlock_user_struct(target_efl, arg3, 0); } else #endif { + lock_user_struct(target_fl, arg3, 1); fl.l_type = tswap16(target_fl->l_type); fl.l_whence = tswap16(target_fl->l_whence); fl.l_start = tswap64(target_fl->l_start); fl.l_len = tswap64(target_fl->l_len); fl.l_pid = tswapl(target_fl->l_pid); + unlock_user_struct(target_fl, arg3, 0); } ret = get_errno(fcntl(arg1, arg2, &fl)); break; diff --git a/linux-user/syscall_types.h b/linux-user/syscall_types.h index 4db47da0f7..308da48573 100644 --- a/linux-user/syscall_types.h +++ b/linux-user/syscall_types.h @@ -68,6 +68,9 @@ STRUCT(dirent, STRUCT(kbentry, TYPE_CHAR, TYPE_CHAR, TYPE_SHORT) +STRUCT(kbsentry, + TYPE_CHAR, MK_ARRAY(TYPE_CHAR, 512)) + STRUCT(audio_buf_info, TYPE_INT, TYPE_INT, TYPE_INT, TYPE_INT) diff --git a/linux-user/vm86.c b/linux-user/vm86.c index 360d52592d..b28eea60d4 100644 --- a/linux-user/vm86.c +++ b/linux-user/vm86.c @@ -62,25 +62,28 @@ static inline unsigned int vm_getl(uint8_t *segptr, unsigned int reg16) void save_v86_state(CPUX86State *env) { TaskState *ts = env->opaque; + struct target_vm86plus_struct * target_v86; + lock_user_struct(target_v86, ts->target_v86, 0); /* put the VM86 registers in the userspace register structure */ - ts->target_v86->regs.eax = tswap32(env->regs[R_EAX]); - ts->target_v86->regs.ebx = tswap32(env->regs[R_EBX]); - ts->target_v86->regs.ecx = tswap32(env->regs[R_ECX]); - ts->target_v86->regs.edx = tswap32(env->regs[R_EDX]); - ts->target_v86->regs.esi = tswap32(env->regs[R_ESI]); - ts->target_v86->regs.edi = tswap32(env->regs[R_EDI]); - ts->target_v86->regs.ebp = tswap32(env->regs[R_EBP]); - ts->target_v86->regs.esp = tswap32(env->regs[R_ESP]); - ts->target_v86->regs.eip = tswap32(env->eip); - ts->target_v86->regs.cs = tswap16(env->segs[R_CS].selector); - ts->target_v86->regs.ss = tswap16(env->segs[R_SS].selector); - ts->target_v86->regs.ds = tswap16(env->segs[R_DS].selector); - ts->target_v86->regs.es = tswap16(env->segs[R_ES].selector); - ts->target_v86->regs.fs = tswap16(env->segs[R_FS].selector); - ts->target_v86->regs.gs = tswap16(env->segs[R_GS].selector); + target_v86->regs.eax = tswap32(env->regs[R_EAX]); + target_v86->regs.ebx = tswap32(env->regs[R_EBX]); + target_v86->regs.ecx = tswap32(env->regs[R_ECX]); + target_v86->regs.edx = tswap32(env->regs[R_EDX]); + target_v86->regs.esi = tswap32(env->regs[R_ESI]); + target_v86->regs.edi = tswap32(env->regs[R_EDI]); + target_v86->regs.ebp = tswap32(env->regs[R_EBP]); + target_v86->regs.esp = tswap32(env->regs[R_ESP]); + target_v86->regs.eip = tswap32(env->eip); + target_v86->regs.cs = tswap16(env->segs[R_CS].selector); + target_v86->regs.ss = tswap16(env->segs[R_SS].selector); + target_v86->regs.ds = tswap16(env->segs[R_DS].selector); + target_v86->regs.es = tswap16(env->segs[R_ES].selector); + target_v86->regs.fs = tswap16(env->segs[R_FS].selector); + target_v86->regs.gs = tswap16(env->segs[R_GS].selector); set_flags(env->eflags, ts->v86flags, VIF_MASK | ts->v86mask); - ts->target_v86->regs.eflags = tswap32(env->eflags); + target_v86->regs.eflags = tswap32(env->eflags); + unlock_user_struct(target_v86, ts->target_v86, 1); #ifdef DEBUG_VM86 fprintf(logfile, "save_v86_state: eflags=%08x cs:ip=%04x:%04x\n", env->eflags, env->segs[R_CS].selector, env->eip); @@ -378,10 +381,10 @@ void handle_vm86_fault(CPUX86State *env) } } -int do_vm86(CPUX86State *env, long subfunction, - struct target_vm86plus_struct * target_v86) +int do_vm86(CPUX86State *env, long subfunction, target_ulong vm86_addr) { TaskState *ts = env->opaque; + struct target_vm86plus_struct * target_v86; int ret; switch (subfunction) { @@ -402,7 +405,6 @@ int do_vm86(CPUX86State *env, long subfunction, goto out; } - ts->target_v86 = target_v86; /* save current CPU regs */ ts->vm86_saved_regs.eax = 0; /* default vm86 syscall return code */ ts->vm86_saved_regs.ebx = env->regs[R_EBX]; @@ -421,6 +423,8 @@ int do_vm86(CPUX86State *env, long subfunction, ts->vm86_saved_regs.fs = env->segs[R_FS].selector; ts->vm86_saved_regs.gs = env->segs[R_GS].selector; + ts->target_v86 = vm86_addr; + lock_user_struct(target_v86, vm86_addr, 1); /* build vm86 CPU state */ ts->v86flags = tswap32(target_v86->regs.eflags); env->eflags = (env->eflags & ~SAFE_MASK) | @@ -465,6 +469,7 @@ int do_vm86(CPUX86State *env, long subfunction, ts->vm86plus.vm86plus.flags = tswapl(target_v86->vm86plus.flags); memcpy(&ts->vm86plus.vm86plus.vm86dbg_intxxtab, target_v86->vm86plus.vm86dbg_intxxtab, 32); + unlock_user_struct(target_v86, vm86_addr, 0); #ifdef DEBUG_VM86 fprintf(logfile, "do_vm86: cs:ip=%04x:%04x\n", |