[PATCH v3 17/27] linux-user/nios2: Map a real kuser page

Richard Henderson posted 27 patches 4 years, 4 months ago
Maintainers: Aurelien Jarno <aurelien@aurel32.net>, Chris Wulff <crwulff@gmail.com>, "Philippe Mathieu-Daudé" <f4bug@amsat.org>, Laurent Vivier <laurent@vivier.eu>, Thomas Huth <thuth@redhat.com>, Aleksandar Rikalo <aleksandar.rikalo@syrmia.com>, Marek Vasut <marex@denx.de>, Cornelia Huck <cohuck@redhat.com>, Jiaxun Yang <jiaxun.yang@flygoat.com>
There is a newer version of this series
[PATCH v3 17/27] linux-user/nios2: Map a real kuser page
Posted by Richard Henderson 4 years, 4 months ago
The first word of page1 is data, so the whole thing
can't be implemented with emulation of addresses.

Hijack trap number 31 to implement cmpxchg.

Set default_rt_sigreturn based on the kuser page.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/nios2/target_signal.h |  3 ++
 linux-user/elfload.c             | 35 ++++++++++++++++++++++
 linux-user/nios2/cpu_loop.c      | 51 +++++++++++++++++---------------
 linux-user/nios2/signal.c        |  2 +-
 target/nios2/translate.c         |  9 ------
 5 files changed, 66 insertions(+), 34 deletions(-)

diff --git a/linux-user/nios2/target_signal.h b/linux-user/nios2/target_signal.h
index aebf749f12..fe266c4c51 100644
--- a/linux-user/nios2/target_signal.h
+++ b/linux-user/nios2/target_signal.h
@@ -19,4 +19,7 @@ typedef struct target_sigaltstack {
 
 #include "../generic/signal.h"
 
+/* Nios2 uses a fixed address on the kuser page for sigreturn. */
+#define TARGET_ARCH_HAS_SIGTRAMP_PAGE 0
+
 #endif /* NIOS2_TARGET_SIGNAL_H */
diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index 459a26ef1d..7b3a91b3ed 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -1100,6 +1100,41 @@ static void elf_core_copy_regs(target_elf_gregset_t *regs, const CPUMBState *env
 
 static void init_thread(struct target_pt_regs *regs, struct image_info *infop)
 {
+    static const uint8_t kuser_page[4 + 2 * 64] = {
+        /* __kuser_helper_version */
+        [0x00] = 0x02, 0x00, 0x00, 0x00,
+
+        /* __kuser_cmpxchg */
+        [0x04] = 0xfa, 0x6f, 0x3b, 0x00,  /* trap 31 */
+                 0x3a, 0x28, 0x00, 0xf8,  /* ret */
+
+        /* __kuser_sigtramp */
+        [0x44] = 0xc4, 0x22, 0x80, 0x00,  /* movi r2, __NR_rt_sigreturn */
+                 0x3a, 0x68, 0x3b, 0x00,  /* trap 0 */
+    };
+
+    abi_ulong pg;
+    uint8_t *ph;
+
+    pg = target_mmap(TARGET_PAGE_SIZE, TARGET_PAGE_SIZE,
+                     PROT_READ | PROT_WRITE,
+                     MAP_ANON | MAP_PRIVATE | MAP_FIXED, -1, 0);
+
+    /*
+     * If the mmap doesn't give us exactly page 1, there's nothing
+     * we can do, and it's unlikely that the program will be able
+     * to continue.  FIXME: Error out now?
+     */
+    assert(pg == TARGET_PAGE_SIZE);
+
+    ph = lock_user(VERIFY_WRITE, pg, sizeof(kuser_page), 0);
+    memcpy(ph, kuser_page, sizeof(kuser_page));
+    unlock_user(ph, pg, sizeof(kuser_page));
+    target_mprotect(TARGET_PAGE_SIZE, TARGET_PAGE_SIZE, PROT_READ | PROT_EXEC);
+
+    /* Install __kuser_sigtramp */
+    default_rt_sigreturn = TARGET_PAGE_SIZE + 0x44;
+
     regs->ea = infop->entry;
     regs->sp = infop->start_stack;
     regs->estatus = 0x3;
diff --git a/linux-user/nios2/cpu_loop.c b/linux-user/nios2/cpu_loop.c
index 246293a501..12070c8a3c 100644
--- a/linux-user/nios2/cpu_loop.c
+++ b/linux-user/nios2/cpu_loop.c
@@ -26,7 +26,6 @@
 void cpu_loop(CPUNios2State *env)
 {
     CPUState *cs = env_cpu(env);
-    Nios2CPU *cpu = NIOS2_CPU(cs);
     target_siginfo_t info;
     int trapnr, ret;
 
@@ -73,6 +72,32 @@ void cpu_loop(CPUNios2State *env)
                 force_sig_fault(TARGET_SIGILL, TARGET_ILL_ILLTRP,
                                 env->regs[R_PC]);
                 break;
+
+            case 31: /* QEMU specific, for __kuser_cmpxchg */
+                {
+                    abi_ptr g = env->regs[4];
+                    uint32_t *h, n, o;
+
+                    if (g & 0x3) {
+                        force_sig_fault(TARGET_SIGBUS, TARGET_BUS_ADRALN, g);
+                        break;
+                    }
+                    ret = page_get_flags(g);
+                    if (!(ret & PAGE_VALID)) {
+                        force_sig_fault(TARGET_SIGSEGV, TARGET_SEGV_MAPERR, g);
+                        break;
+                    }
+                    if (!(ret & PAGE_READ) || !(ret & PAGE_WRITE)) {
+                        force_sig_fault(TARGET_SIGSEGV, TARGET_SEGV_ACCERR, g);
+                        break;
+                    }
+                    h = g2h(cs, g);
+                    o = env->regs[5];
+                    n = env->regs[6];
+                    env->regs[2] = qatomic_cmpxchg(h, o, n) - o;
+                    env->regs[R_PC] += 4;
+                }
+                break;
             }
             break;
 
@@ -83,29 +108,7 @@ void cpu_loop(CPUNios2State *env)
             queue_signal(env, info.si_signo, QEMU_SI_FAULT, &info);
             break;
         case 0xaa:
-            switch (env->regs[R_PC]) {
-            /*case 0x1000:*/  /* TODO:__kuser_helper_version */
-            case 0x1004:      /* __kuser_cmpxchg */
-                start_exclusive();
-                if (env->regs[4] & 0x3) {
-                    goto kuser_fail;
-                }
-                ret = get_user_u32(env->regs[2], env->regs[4]);
-                if (ret) {
-                    end_exclusive();
-                    goto kuser_fail;
-                }
-                env->regs[2] -= env->regs[5];
-                if (env->regs[2] == 0) {
-                    put_user_u32(env->regs[6], env->regs[4]);
-                }
-                end_exclusive();
-                env->regs[R_PC] = env->regs[R_RA];
-                break;
-            /*case 0x1040:*/  /* TODO:__kuser_sigtramp */
-            default:
-                ;
-kuser_fail:
+            {
                 info.si_signo = TARGET_SIGSEGV;
                 info.si_errno = 0;
                 /* TODO: check env->error_code */
diff --git a/linux-user/nios2/signal.c b/linux-user/nios2/signal.c
index a77e8a40f4..c9a235ded5 100644
--- a/linux-user/nios2/signal.c
+++ b/linux-user/nios2/signal.c
@@ -177,7 +177,7 @@ void setup_rt_frame(int sig, struct target_sigaction *ka,
 
     /* Set up to return from userspace; jump to fixed address sigreturn
        trampoline on kuser page.  */
-    env->regs[R_RA] = (unsigned long) (0x1044);
+    env->regs[R_RA] = default_rt_sigreturn;
 
     /* Set up registers for signal handler */
     env->regs[R_SP] = (unsigned long) frame;
diff --git a/target/nios2/translate.c b/target/nios2/translate.c
index 485b487665..77706dd805 100644
--- a/target/nios2/translate.c
+++ b/target/nios2/translate.c
@@ -795,15 +795,6 @@ static void nios2_tr_translate_insn(DisasContextBase *dcbase, CPUState *cs)
     dc->base.pc_next = pc + 4;
 
     /* Decode an instruction */
-
-#if defined(CONFIG_USER_ONLY)
-    /* FIXME: Is this needed ? */
-    if (pc >= 0x1000 && pc < 0x2000) {
-        t_gen_helper_raise_exception(dc, 0xaa);
-        return;
-    }
-#endif
-
     code = cpu_ldl_code(env, pc);
     op = get_opcode(code);
 
-- 
2.25.1


Re: [PATCH v3 17/27] linux-user/nios2: Map a real kuser page
Posted by Peter Maydell 4 years, 4 months ago
On Fri, 24 Sept 2021 at 17:59, Richard Henderson
<richard.henderson@linaro.org> wrote:
>
> The first word of page1 is data, so the whole thing
> can't be implemented with emulation of addresses.
>
> Hijack trap number 31 to implement cmpxchg.

31 is used -- it's "breakpoint". We need to pick something else...

>
> Set default_rt_sigreturn based on the kuser page.
>
> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
> ---
>  linux-user/nios2/target_signal.h |  3 ++
>  linux-user/elfload.c             | 35 ++++++++++++++++++++++
>  linux-user/nios2/cpu_loop.c      | 51 +++++++++++++++++---------------
>  linux-user/nios2/signal.c        |  2 +-
>  target/nios2/translate.c         |  9 ------
>  5 files changed, 66 insertions(+), 34 deletions(-)
>
> diff --git a/linux-user/nios2/target_signal.h b/linux-user/nios2/target_signal.h
> index aebf749f12..fe266c4c51 100644
> --- a/linux-user/nios2/target_signal.h
> +++ b/linux-user/nios2/target_signal.h
> @@ -19,4 +19,7 @@ typedef struct target_sigaltstack {
>
>  #include "../generic/signal.h"
>
> +/* Nios2 uses a fixed address on the kuser page for sigreturn. */
> +#define TARGET_ARCH_HAS_SIGTRAMP_PAGE 0
> +
>  #endif /* NIOS2_TARGET_SIGNAL_H */
> diff --git a/linux-user/elfload.c b/linux-user/elfload.c
> index 459a26ef1d..7b3a91b3ed 100644
> --- a/linux-user/elfload.c
> +++ b/linux-user/elfload.c
> @@ -1100,6 +1100,41 @@ static void elf_core_copy_regs(target_elf_gregset_t *regs, const CPUMBState *env
>
>  static void init_thread(struct target_pt_regs *regs, struct image_info *infop)
>  {
> +    static const uint8_t kuser_page[4 + 2 * 64] = {
> +        /* __kuser_helper_version */
> +        [0x00] = 0x02, 0x00, 0x00, 0x00,
> +
> +        /* __kuser_cmpxchg */
> +        [0x04] = 0xfa, 0x6f, 0x3b, 0x00,  /* trap 31 */
> +                 0x3a, 0x28, 0x00, 0xf8,  /* ret */
> +
> +        /* __kuser_sigtramp */
> +        [0x44] = 0xc4, 0x22, 0x80, 0x00,  /* movi r2, __NR_rt_sigreturn */
> +                 0x3a, 0x68, 0x3b, 0x00,  /* trap 0 */
> +    };
> +
> +    abi_ulong pg;
> +    uint8_t *ph;
> +
> +    pg = target_mmap(TARGET_PAGE_SIZE, TARGET_PAGE_SIZE,
> +                     PROT_READ | PROT_WRITE,
> +                     MAP_ANON | MAP_PRIVATE | MAP_FIXED, -1, 0);
> +
> +    /*
> +     * If the mmap doesn't give us exactly page 1, there's nothing
> +     * we can do, and it's unlikely that the program will be able
> +     * to continue.  FIXME: Error out now?
> +     */
> +    assert(pg == TARGET_PAGE_SIZE);

Shouldn't we be doing this via the probe_guest_base machinery
the way we do for the Arm commpage ?

> +
> +    ph = lock_user(VERIFY_WRITE, pg, sizeof(kuser_page), 0);
> +    memcpy(ph, kuser_page, sizeof(kuser_page));
> +    unlock_user(ph, pg, sizeof(kuser_page));
> +    target_mprotect(TARGET_PAGE_SIZE, TARGET_PAGE_SIZE, PROT_READ | PROT_EXEC);
> +
> +    /* Install __kuser_sigtramp */
> +    default_rt_sigreturn = TARGET_PAGE_SIZE + 0x44;
> +
>      regs->ea = infop->entry;
>      regs->sp = infop->start_stack;
>      regs->estatus = 0x3;

-- PMM

Re: [PATCH v3 17/27] linux-user/nios2: Map a real kuser page
Posted by Richard Henderson 4 years, 4 months ago
On 9/27/21 9:26 AM, Peter Maydell wrote:
>> +    /*
>> +     * If the mmap doesn't give us exactly page 1, there's nothing
>> +     * we can do, and it's unlikely that the program will be able
>> +     * to continue.  FIXME: Error out now?
>> +     */
>> +    assert(pg == TARGET_PAGE_SIZE);
> 
> Shouldn't we be doing this via the probe_guest_base machinery
> the way we do for the Arm commpage ?

Well, maybe.  Though the Arm commpage continues to not work.

https://gitlab.com/qemu-project/qemu/-/issues/633
https://gitlab.com/qemu-project/qemu/-/issues/447

But you're right, this could just as easily error out on a 32-bit host.


r~