From nobody Tue Feb 10 19:48:56 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Authentication-Results: mx.zohomail.com; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1585207694; cv=none; d=zohomail.com; s=zohoarc; b=eiSqUN9Q7C6qR67+wKDGw3HTwvI08imI1lTlx6X6t+iMCP/pXw/8FsKRd8qJR+yjN3oLmk750uHnrWvliKA8/XRW0NYlOqMMlY+X7Wn31+FuQyb5L+ADHRT5lTXUrluOvw7Aml8wSVPFX+zIEk3BfD9W2Ssy2SNo7+JjfsjxvCE= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1585207694; h=Content-Transfer-Encoding:Cc:Date:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:To; bh=HQcuny2i8MP7gcqKAR5NYN2iqfp4S26wayfcH9K+ABI=; b=bwO1z7dvDupO7DqRYyHRKgetOICE9RxGr1cyK7pYo4+NBhYinb/VBwJPrkGgiQWvnJ4fPkFecGOK2jOqR/+/r0AcMP3VyN5Aog3m3Y3rfHflVbCnf2gtvsbI5uUqXqkwA6B/Jh7NvwatECuAQrUfWIXAiPuQOk7+atBrwB0zzEM= ARC-Authentication-Results: i=1; mx.zohomail.com; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1585207694383336.2535191464124; Thu, 26 Mar 2020 00:28:14 -0700 (PDT) Received: from localhost ([::1]:47528 helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1jHMw1-0002fJ-6v for importer@patchew.org; Thu, 26 Mar 2020 03:28:13 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]:57164) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1jHMs9-0005Oj-Ga for qemu-devel@nongnu.org; Thu, 26 Mar 2020 03:24:14 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1jHMs7-0007u1-Nt for qemu-devel@nongnu.org; Thu, 26 Mar 2020 03:24:13 -0400 Received: from mout.kundenserver.de ([212.227.126.131]:47463) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_128_CBC_SHA1:16) (Exim 4.71) (envelope-from ) id 1jHMs7-0007ta-FQ for qemu-devel@nongnu.org; Thu, 26 Mar 2020 03:24:11 -0400 Received: from localhost.localdomain ([82.252.135.106]) by mrelayeu.kundenserver.de (mreue011 [212.227.15.167]) with ESMTPSA (Nemesis) id 1MFbFW-1j1QyO3TBu-00H9IG; Thu, 26 Mar 2020 08:23:59 +0100 From: Laurent Vivier To: qemu-devel@nongnu.org Subject: [PULL 4/6] linux-user/i386: Emulate x86_64 vsyscalls Date: Thu, 26 Mar 2020 08:23:50 +0100 Message-Id: <20200326072352.2056553-5-laurent@vivier.eu> X-Mailer: git-send-email 2.25.1 In-Reply-To: <20200326072352.2056553-1-laurent@vivier.eu> References: <20200326072352.2056553-1-laurent@vivier.eu> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Provags-ID: V03:K1:8kglLESd+xO7sx7WNgWt/6/WUjm/2oeyBFF4FIpPn5e/BBVQCmU hrvCK4Mc3QLAT4IirjnQLpW5rKs0Ksfgt3YvulxyggNlVb0D85JVE1/EWgd+2nhCgTgvcKh znHMeq0LYoU3evLl7ZCWiZit2MbV1xKcuSzWfSsUAMG+PjBK1bhfF6C1+oUoG2TGOK5Rp7r 1kVQctb8fEKXmET3x3J+w== X-UI-Out-Filterresults: notjunk:1;V03:K0:Xak3eIMbIAE=:lmHcbR4wAdCIJKbEv6ZbWJ p+WwRKacFptBD2hlylW4tFfmGxRuLxuw2+Tu+/8DTFlaEVFHCPW39zXVBgq1JDMkgx83RSAI1 vTzmXYqsKE2PuuHH19NWKf3H67sDK/gPWoNFiDaYHr2aeWZXaET+1xJfMGq8JCdDU82n2UzDA xLu3Rf160q432YtXZ3flzvM2b418mTdf+fmjGDVOjqFpabu1XKXSeX37yAumsaSnnE1Cu6qwM ctlt9rNbqJUH/45VcGExc/Kz/ltWUZaMMm91jRdxScsMPt9Sg0+Nd4bfw5vTJae66rrhrDDyh XsnmSR+hNxDOhazg/qI1X2PDnzz0POtVoDZmozHP6isse44Ah5XNwKp6v1//3pYJVfSzr1Pt6 c//AqZ7TJjxaUh5urVDSQ45K6UcqOuUWJCJhpO8qYe6juVZSF3dHAYVTkId7eq/wjGq68tjRE RvA0HBFueRQrhQZHwztwiWrfOS2nqiT8l9P2S4CxmYK0qQ/Vs6QxO+/dhqEZ8jQKwjGg74Jg8 Y4pRvdiCEBYetNA/xDOYQK1dwELc8g6XvUbcF19uE2BH3hZbzafK0+BM/6pS4g5fCh8OcXl91 UE6KmRWJ7qaGO//AON1ggopybNDsYAMbkUZTqtupqujkv8KzLyLl13t/ActnpW/s2GPsSO2sT h9zZWcfCelJEYZWA47EtqU0cgG+Ub1gmFWIme/clk7jPt3iWuAbHTJ3f5NM8rbQ5qnOd1qFyl ZLzWeaJJj2r+nqcXPqkTseYJoL9SXt40lAV5F9oBhBhuxfRV3ko5pgQFp1ZNpwNOVxP5D5If6 E402ecTHvLHaznWAYu+VQ2vhv1i/v0R/23siC8Js0mtxuhUIeRItfnGHRfBGqSyQSceoS2W X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] X-Received-From: 212.227.126.131 X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Paolo Bonzini , Riku Voipio , Richard Henderson , Laurent Vivier Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: "Qemu-devel" Content-Type: text/plain; charset="utf-8" From: Richard Henderson Notice the magic page during translate, much like we already do for the arm32 commpage. At runtime, raise an exception to return cpu_loop for emulation. Reviewed-by: Paolo Bonzini Signed-off-by: Richard Henderson Message-Id: <20200213032223.14643-4-richard.henderson@linaro.org> Signed-off-by: Laurent Vivier --- linux-user/i386/cpu_loop.c | 108 +++++++++++++++++++++++++++++++++++++ target/i386/cpu.h | 7 +++ target/i386/translate.c | 14 ++++- 3 files changed, 128 insertions(+), 1 deletion(-) diff --git a/linux-user/i386/cpu_loop.c b/linux-user/i386/cpu_loop.c index e217cca5ee1e..70cde417e605 100644 --- a/linux-user/i386/cpu_loop.c +++ b/linux-user/i386/cpu_loop.c @@ -92,6 +92,109 @@ static void gen_signal(CPUX86State *env, int sig, int c= ode, abi_ptr addr) queue_signal(env, info.si_signo, QEMU_SI_FAULT, &info); } =20 +#ifdef TARGET_X86_64 +static bool write_ok_or_segv(CPUX86State *env, abi_ptr addr, size_t len) +{ + /* + * For all the vsyscalls, NULL means "don't write anything" not + * "write it at address 0". + */ + if (addr =3D=3D 0 || access_ok(VERIFY_WRITE, addr, len)) { + return true; + } + + env->error_code =3D PG_ERROR_W_MASK | PG_ERROR_U_MASK; + gen_signal(env, TARGET_SIGSEGV, TARGET_SEGV_MAPERR, addr); + return false; +} + +/* + * Since v3.1, the kernel traps and emulates the vsyscall page. + * Entry points other than the official generate SIGSEGV. + */ +static void emulate_vsyscall(CPUX86State *env) +{ + int syscall; + abi_ulong ret; + uint64_t caller; + + /* + * Validate the entry point. We have already validated the page + * during translation to get here; now verify the offset. + */ + switch (env->eip & ~TARGET_PAGE_MASK) { + case 0x000: + syscall =3D TARGET_NR_gettimeofday; + break; + case 0x400: + syscall =3D TARGET_NR_time; + break; + case 0x800: + syscall =3D TARGET_NR_getcpu; + break; + default: + goto sigsegv; + } + + /* + * Validate the return address. + * Note that the kernel treats this the same as an invalid entry point. + */ + if (get_user_u64(caller, env->regs[R_ESP])) { + goto sigsegv; + } + + /* + * Validate the the pointer arguments. + */ + switch (syscall) { + case TARGET_NR_gettimeofday: + if (!write_ok_or_segv(env, env->regs[R_EDI], + sizeof(struct target_timeval)) || + !write_ok_or_segv(env, env->regs[R_ESI], + sizeof(struct target_timezone))) { + return; + } + break; + case TARGET_NR_time: + if (!write_ok_or_segv(env, env->regs[R_EDI], sizeof(abi_long))) { + return; + } + break; + case TARGET_NR_getcpu: + if (!write_ok_or_segv(env, env->regs[R_EDI], sizeof(uint32_t)) || + !write_ok_or_segv(env, env->regs[R_ESI], sizeof(uint32_t))) { + return; + } + break; + default: + g_assert_not_reached(); + } + + /* + * Perform the syscall. None of the vsyscalls should need restarting. + */ + ret =3D do_syscall(env, syscall, env->regs[R_EDI], env->regs[R_ESI], + env->regs[R_EDX], env->regs[10], env->regs[8], + env->regs[9], 0, 0); + g_assert(ret !=3D -TARGET_ERESTARTSYS); + g_assert(ret !=3D -TARGET_QEMU_ESIGRETURN); + if (ret =3D=3D -TARGET_EFAULT) { + goto sigsegv; + } + env->regs[R_EAX] =3D ret; + + /* Emulate a ret instruction to leave the vsyscall page. */ + env->eip =3D caller; + env->regs[R_ESP] +=3D 8; + return; + + sigsegv: + /* Like force_sig(SIGSEGV). */ + gen_signal(env, TARGET_SIGSEGV, TARGET_SI_KERNEL, 0); +} +#endif + void cpu_loop(CPUX86State *env) { CPUState *cs =3D env_cpu(env); @@ -141,6 +244,11 @@ void cpu_loop(CPUX86State *env) env->regs[R_EAX] =3D ret; } break; +#endif +#ifdef TARGET_X86_64 + case EXCP_VSYSCALL: + emulate_vsyscall(env); + break; #endif case EXCP0B_NOSEG: case EXCP0C_STACK: diff --git a/target/i386/cpu.h b/target/i386/cpu.h index 49ecc23104c9..9af1b0c12e8e 100644 --- a/target/i386/cpu.h +++ b/target/i386/cpu.h @@ -1003,6 +1003,7 @@ typedef uint64_t FeatureWordArray[FEATURE_WORDS]; =20 #define EXCP_VMEXIT 0x100 /* only for system emulation */ #define EXCP_SYSCALL 0x101 /* only for user emulation */ +#define EXCP_VSYSCALL 0x102 /* only for user emulation */ =20 /* i386-specific interrupt pending bits. */ #define CPU_INTERRUPT_POLL CPU_INTERRUPT_TGT_EXT_1 @@ -2218,4 +2219,10 @@ static inline bool hyperv_feat_enabled(X86CPU *cpu, = int feat) return !!(cpu->hyperv_features & BIT(feat)); } =20 +#if defined(TARGET_X86_64) && \ + defined(CONFIG_USER_ONLY) && \ + defined(CONFIG_LINUX) +# define TARGET_VSYSCALL_PAGE (UINT64_C(-10) << 20) +#endif + #endif /* I386_CPU_H */ diff --git a/target/i386/translate.c b/target/i386/translate.c index d9af8f4078b3..5e5dbb41b0ce 100644 --- a/target/i386/translate.c +++ b/target/i386/translate.c @@ -8555,7 +8555,19 @@ static bool i386_tr_breakpoint_check(DisasContextBas= e *dcbase, CPUState *cpu, static void i386_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu) { DisasContext *dc =3D container_of(dcbase, DisasContext, base); - target_ulong pc_next =3D disas_insn(dc, cpu); + target_ulong pc_next; + +#ifdef TARGET_VSYSCALL_PAGE + /* + * Detect entry into the vsyscall page and invoke the syscall. + */ + if ((dc->base.pc_next & TARGET_PAGE_MASK) =3D=3D TARGET_VSYSCALL_PAGE)= { + gen_exception(dc, EXCP_VSYSCALL, dc->base.pc_next); + return; + } +#endif + + pc_next =3D disas_insn(dc, cpu); =20 if (dc->tf || (dc->base.tb->flags & HF_INHIBIT_IRQ_MASK)) { /* if single step mode, we generate only one instruction and --=20 2.25.1