| Message ID | 20210924165926.752809-18-richard.henderson@linaro.org |
|---|---|
| State | New |
| Headers | show |
| Series | linux-user: Move signal trampolines to new page | expand |
On Fri, 24 Sept 2021 at 17:59, Richard Henderson <richard.henderson@linaro.org> wrote: > > The first word of page1 is data, so the whole thing > can't be implemented with emulation of addresses. > > Hijack trap number 31 to implement cmpxchg. 31 is used -- it's "breakpoint". We need to pick something else... > > Set default_rt_sigreturn based on the kuser page. > > Signed-off-by: Richard Henderson <richard.henderson@linaro.org> > --- > linux-user/nios2/target_signal.h | 3 ++ > linux-user/elfload.c | 35 ++++++++++++++++++++++ > linux-user/nios2/cpu_loop.c | 51 +++++++++++++++++--------------- > linux-user/nios2/signal.c | 2 +- > target/nios2/translate.c | 9 ------ > 5 files changed, 66 insertions(+), 34 deletions(-) > > diff --git a/linux-user/nios2/target_signal.h b/linux-user/nios2/target_signal.h > index aebf749f12..fe266c4c51 100644 > --- a/linux-user/nios2/target_signal.h > +++ b/linux-user/nios2/target_signal.h > @@ -19,4 +19,7 @@ typedef struct target_sigaltstack { > > #include "../generic/signal.h" > > +/* Nios2 uses a fixed address on the kuser page for sigreturn. */ > +#define TARGET_ARCH_HAS_SIGTRAMP_PAGE 0 > + > #endif /* NIOS2_TARGET_SIGNAL_H */ > diff --git a/linux-user/elfload.c b/linux-user/elfload.c > index 459a26ef1d..7b3a91b3ed 100644 > --- a/linux-user/elfload.c > +++ b/linux-user/elfload.c > @@ -1100,6 +1100,41 @@ static void elf_core_copy_regs(target_elf_gregset_t *regs, const CPUMBState *env > > static void init_thread(struct target_pt_regs *regs, struct image_info *infop) > { > + static const uint8_t kuser_page[4 + 2 * 64] = { > + /* __kuser_helper_version */ > + [0x00] = 0x02, 0x00, 0x00, 0x00, > + > + /* __kuser_cmpxchg */ > + [0x04] = 0xfa, 0x6f, 0x3b, 0x00, /* trap 31 */ > + 0x3a, 0x28, 0x00, 0xf8, /* ret */ > + > + /* __kuser_sigtramp */ > + [0x44] = 0xc4, 0x22, 0x80, 0x00, /* movi r2, __NR_rt_sigreturn */ > + 0x3a, 0x68, 0x3b, 0x00, /* trap 0 */ > + }; > + > + abi_ulong pg; > + uint8_t *ph; > + > + pg = target_mmap(TARGET_PAGE_SIZE, TARGET_PAGE_SIZE, > + PROT_READ | PROT_WRITE, > + MAP_ANON | MAP_PRIVATE | MAP_FIXED, -1, 0); > + > + /* > + * If the mmap doesn't give us exactly page 1, there's nothing > + * we can do, and it's unlikely that the program will be able > + * to continue. FIXME: Error out now? > + */ > + assert(pg == TARGET_PAGE_SIZE); Shouldn't we be doing this via the probe_guest_base machinery the way we do for the Arm commpage ? > + > + ph = lock_user(VERIFY_WRITE, pg, sizeof(kuser_page), 0); > + memcpy(ph, kuser_page, sizeof(kuser_page)); > + unlock_user(ph, pg, sizeof(kuser_page)); > + target_mprotect(TARGET_PAGE_SIZE, TARGET_PAGE_SIZE, PROT_READ | PROT_EXEC); > + > + /* Install __kuser_sigtramp */ > + default_rt_sigreturn = TARGET_PAGE_SIZE + 0x44; > + > regs->ea = infop->entry; > regs->sp = infop->start_stack; > regs->estatus = 0x3; -- PMM
On 9/27/21 9:26 AM, Peter Maydell wrote: >> + /* >> + * If the mmap doesn't give us exactly page 1, there's nothing >> + * we can do, and it's unlikely that the program will be able >> + * to continue. FIXME: Error out now? >> + */ >> + assert(pg == TARGET_PAGE_SIZE); > > Shouldn't we be doing this via the probe_guest_base machinery > the way we do for the Arm commpage ? Well, maybe. Though the Arm commpage continues to not work. https://gitlab.com/qemu-project/qemu/-/issues/633 https://gitlab.com/qemu-project/qemu/-/issues/447 But you're right, this could just as easily error out on a 32-bit host. r~
diff --git a/linux-user/nios2/target_signal.h b/linux-user/nios2/target_signal.h index aebf749f12..fe266c4c51 100644 --- a/linux-user/nios2/target_signal.h +++ b/linux-user/nios2/target_signal.h @@ -19,4 +19,7 @@ typedef struct target_sigaltstack { #include "../generic/signal.h" +/* Nios2 uses a fixed address on the kuser page for sigreturn. */ +#define TARGET_ARCH_HAS_SIGTRAMP_PAGE 0 + #endif /* NIOS2_TARGET_SIGNAL_H */ diff --git a/linux-user/elfload.c b/linux-user/elfload.c index 459a26ef1d..7b3a91b3ed 100644 --- a/linux-user/elfload.c +++ b/linux-user/elfload.c @@ -1100,6 +1100,41 @@ static void elf_core_copy_regs(target_elf_gregset_t *regs, const CPUMBState *env static void init_thread(struct target_pt_regs *regs, struct image_info *infop) { + static const uint8_t kuser_page[4 + 2 * 64] = { + /* __kuser_helper_version */ + [0x00] = 0x02, 0x00, 0x00, 0x00, + + /* __kuser_cmpxchg */ + [0x04] = 0xfa, 0x6f, 0x3b, 0x00, /* trap 31 */ + 0x3a, 0x28, 0x00, 0xf8, /* ret */ + + /* __kuser_sigtramp */ + [0x44] = 0xc4, 0x22, 0x80, 0x00, /* movi r2, __NR_rt_sigreturn */ + 0x3a, 0x68, 0x3b, 0x00, /* trap 0 */ + }; + + abi_ulong pg; + uint8_t *ph; + + pg = target_mmap(TARGET_PAGE_SIZE, TARGET_PAGE_SIZE, + PROT_READ | PROT_WRITE, + MAP_ANON | MAP_PRIVATE | MAP_FIXED, -1, 0); + + /* + * If the mmap doesn't give us exactly page 1, there's nothing + * we can do, and it's unlikely that the program will be able + * to continue. FIXME: Error out now? + */ + assert(pg == TARGET_PAGE_SIZE); + + ph = lock_user(VERIFY_WRITE, pg, sizeof(kuser_page), 0); + memcpy(ph, kuser_page, sizeof(kuser_page)); + unlock_user(ph, pg, sizeof(kuser_page)); + target_mprotect(TARGET_PAGE_SIZE, TARGET_PAGE_SIZE, PROT_READ | PROT_EXEC); + + /* Install __kuser_sigtramp */ + default_rt_sigreturn = TARGET_PAGE_SIZE + 0x44; + regs->ea = infop->entry; regs->sp = infop->start_stack; regs->estatus = 0x3; diff --git a/linux-user/nios2/cpu_loop.c b/linux-user/nios2/cpu_loop.c index 246293a501..12070c8a3c 100644 --- a/linux-user/nios2/cpu_loop.c +++ b/linux-user/nios2/cpu_loop.c @@ -26,7 +26,6 @@ void cpu_loop(CPUNios2State *env) { CPUState *cs = env_cpu(env); - Nios2CPU *cpu = NIOS2_CPU(cs); target_siginfo_t info; int trapnr, ret; @@ -73,6 +72,32 @@ void cpu_loop(CPUNios2State *env) force_sig_fault(TARGET_SIGILL, TARGET_ILL_ILLTRP, env->regs[R_PC]); break; + + case 31: /* QEMU specific, for __kuser_cmpxchg */ + { + abi_ptr g = env->regs[4]; + uint32_t *h, n, o; + + if (g & 0x3) { + force_sig_fault(TARGET_SIGBUS, TARGET_BUS_ADRALN, g); + break; + } + ret = page_get_flags(g); + if (!(ret & PAGE_VALID)) { + force_sig_fault(TARGET_SIGSEGV, TARGET_SEGV_MAPERR, g); + break; + } + if (!(ret & PAGE_READ) || !(ret & PAGE_WRITE)) { + force_sig_fault(TARGET_SIGSEGV, TARGET_SEGV_ACCERR, g); + break; + } + h = g2h(cs, g); + o = env->regs[5]; + n = env->regs[6]; + env->regs[2] = qatomic_cmpxchg(h, o, n) - o; + env->regs[R_PC] += 4; + } + break; } break; @@ -83,29 +108,7 @@ void cpu_loop(CPUNios2State *env) queue_signal(env, info.si_signo, QEMU_SI_FAULT, &info); break; case 0xaa: - switch (env->regs[R_PC]) { - /*case 0x1000:*/ /* TODO:__kuser_helper_version */ - case 0x1004: /* __kuser_cmpxchg */ - start_exclusive(); - if (env->regs[4] & 0x3) { - goto kuser_fail; - } - ret = get_user_u32(env->regs[2], env->regs[4]); - if (ret) { - end_exclusive(); - goto kuser_fail; - } - env->regs[2] -= env->regs[5]; - if (env->regs[2] == 0) { - put_user_u32(env->regs[6], env->regs[4]); - } - end_exclusive(); - env->regs[R_PC] = env->regs[R_RA]; - break; - /*case 0x1040:*/ /* TODO:__kuser_sigtramp */ - default: - ; -kuser_fail: + { info.si_signo = TARGET_SIGSEGV; info.si_errno = 0; /* TODO: check env->error_code */ diff --git a/linux-user/nios2/signal.c b/linux-user/nios2/signal.c index a77e8a40f4..c9a235ded5 100644 --- a/linux-user/nios2/signal.c +++ b/linux-user/nios2/signal.c @@ -177,7 +177,7 @@ void setup_rt_frame(int sig, struct target_sigaction *ka, /* Set up to return from userspace; jump to fixed address sigreturn trampoline on kuser page. */ - env->regs[R_RA] = (unsigned long) (0x1044); + env->regs[R_RA] = default_rt_sigreturn; /* Set up registers for signal handler */ env->regs[R_SP] = (unsigned long) frame; diff --git a/target/nios2/translate.c b/target/nios2/translate.c index 485b487665..77706dd805 100644 --- a/target/nios2/translate.c +++ b/target/nios2/translate.c @@ -795,15 +795,6 @@ static void nios2_tr_translate_insn(DisasContextBase *dcbase, CPUState *cs) dc->base.pc_next = pc + 4; /* Decode an instruction */ - -#if defined(CONFIG_USER_ONLY) - /* FIXME: Is this needed ? */ - if (pc >= 0x1000 && pc < 0x2000) { - t_gen_helper_raise_exception(dc, 0xaa); - return; - } -#endif - code = cpu_ldl_code(env, pc); op = get_opcode(code);
The first word of page1 is data, so the whole thing can't be implemented with emulation of addresses. Hijack trap number 31 to implement cmpxchg. Set default_rt_sigreturn based on the kuser page. Signed-off-by: Richard Henderson <richard.henderson@linaro.org> --- linux-user/nios2/target_signal.h | 3 ++ linux-user/elfload.c | 35 ++++++++++++++++++++++ linux-user/nios2/cpu_loop.c | 51 +++++++++++++++++--------------- linux-user/nios2/signal.c | 2 +- target/nios2/translate.c | 9 ------ 5 files changed, 66 insertions(+), 34 deletions(-) -- 2.25.1