]> git.proxmox.com Git - qemu.git/blob - user-exec.c
fw_cfg: Splash image loader can overrun a stack variable, fix
[qemu.git] / user-exec.c
1 /*
2 * User emulator execution
3 *
4 * Copyright (c) 2003-2005 Fabrice Bellard
5 *
6 * This library is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU Lesser General Public
8 * License as published by the Free Software Foundation; either
9 * version 2 of the License, or (at your option) any later version.
10 *
11 * This library is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
14 * Lesser General Public License for more details.
15 *
16 * You should have received a copy of the GNU Lesser General Public
17 * License along with this library; if not, see <http://www.gnu.org/licenses/>.
18 */
19 #include "config.h"
20 #include "cpu.h"
21 #include "disas/disas.h"
22 #include "tcg.h"
23
24 #undef EAX
25 #undef ECX
26 #undef EDX
27 #undef EBX
28 #undef ESP
29 #undef EBP
30 #undef ESI
31 #undef EDI
32 #undef EIP
33 #include <signal.h>
34 #ifdef __linux__
35 #include <sys/ucontext.h>
36 #endif
37
38 //#define DEBUG_SIGNAL
39
40 static void exception_action(CPUArchState *env1)
41 {
42 #if defined(TARGET_I386)
43 raise_exception_err(env1, env1->exception_index, env1->error_code);
44 #else
45 cpu_loop_exit(env1);
46 #endif
47 }
48
49 /* exit the current TB from a signal handler. The host registers are
50 restored in a state compatible with the CPU emulator
51 */
52 void cpu_resume_from_signal(CPUArchState *env1, void *puc)
53 {
54 #ifdef __linux__
55 struct ucontext *uc = puc;
56 #elif defined(__OpenBSD__)
57 struct sigcontext *uc = puc;
58 #endif
59
60 if (puc) {
61 /* XXX: use siglongjmp ? */
62 #ifdef __linux__
63 #ifdef __ia64
64 sigprocmask(SIG_SETMASK, (sigset_t *)&uc->uc_sigmask, NULL);
65 #else
66 sigprocmask(SIG_SETMASK, &uc->uc_sigmask, NULL);
67 #endif
68 #elif defined(__OpenBSD__)
69 sigprocmask(SIG_SETMASK, &uc->sc_mask, NULL);
70 #endif
71 }
72 env1->exception_index = -1;
73 longjmp(env1->jmp_env, 1);
74 }
75
76 /* 'pc' is the host PC at which the exception was raised. 'address' is
77 the effective address of the memory exception. 'is_write' is 1 if a
78 write caused the exception and otherwise 0'. 'old_set' is the
79 signal set which should be restored */
80 static inline int handle_cpu_signal(uintptr_t pc, unsigned long address,
81 int is_write, sigset_t *old_set,
82 void *puc)
83 {
84 int ret;
85
86 #if defined(DEBUG_SIGNAL)
87 qemu_printf("qemu: SIGSEGV pc=0x%08lx address=%08lx w=%d oldset=0x%08lx\n",
88 pc, address, is_write, *(unsigned long *)old_set);
89 #endif
90 /* XXX: locking issue */
91 if (is_write && h2g_valid(address)
92 && page_unprotect(h2g(address), pc, puc)) {
93 return 1;
94 }
95
96 /* see if it is an MMU fault */
97 ret = cpu_handle_mmu_fault(cpu_single_env, address, is_write,
98 MMU_USER_IDX);
99 if (ret < 0) {
100 return 0; /* not an MMU fault */
101 }
102 if (ret == 0) {
103 return 1; /* the MMU fault was handled without causing real CPU fault */
104 }
105 /* now we have a real cpu fault */
106 cpu_restore_state(cpu_single_env, pc);
107
108 /* we restore the process signal mask as the sigreturn should
109 do it (XXX: use sigsetjmp) */
110 sigprocmask(SIG_SETMASK, old_set, NULL);
111 exception_action(cpu_single_env);
112
113 /* never comes here */
114 return 1;
115 }
116
117 #if defined(__i386__)
118
119 #if defined(__APPLE__)
120 #include <sys/ucontext.h>
121
122 #define EIP_sig(context) (*((unsigned long *)&(context)->uc_mcontext->ss.eip))
123 #define TRAP_sig(context) ((context)->uc_mcontext->es.trapno)
124 #define ERROR_sig(context) ((context)->uc_mcontext->es.err)
125 #define MASK_sig(context) ((context)->uc_sigmask)
126 #elif defined(__NetBSD__)
127 #include <ucontext.h>
128
129 #define EIP_sig(context) ((context)->uc_mcontext.__gregs[_REG_EIP])
130 #define TRAP_sig(context) ((context)->uc_mcontext.__gregs[_REG_TRAPNO])
131 #define ERROR_sig(context) ((context)->uc_mcontext.__gregs[_REG_ERR])
132 #define MASK_sig(context) ((context)->uc_sigmask)
133 #elif defined(__FreeBSD__) || defined(__DragonFly__)
134 #include <ucontext.h>
135
136 #define EIP_sig(context) (*((unsigned long *)&(context)->uc_mcontext.mc_eip))
137 #define TRAP_sig(context) ((context)->uc_mcontext.mc_trapno)
138 #define ERROR_sig(context) ((context)->uc_mcontext.mc_err)
139 #define MASK_sig(context) ((context)->uc_sigmask)
140 #elif defined(__OpenBSD__)
141 #define EIP_sig(context) ((context)->sc_eip)
142 #define TRAP_sig(context) ((context)->sc_trapno)
143 #define ERROR_sig(context) ((context)->sc_err)
144 #define MASK_sig(context) ((context)->sc_mask)
145 #else
146 #define EIP_sig(context) ((context)->uc_mcontext.gregs[REG_EIP])
147 #define TRAP_sig(context) ((context)->uc_mcontext.gregs[REG_TRAPNO])
148 #define ERROR_sig(context) ((context)->uc_mcontext.gregs[REG_ERR])
149 #define MASK_sig(context) ((context)->uc_sigmask)
150 #endif
151
152 int cpu_signal_handler(int host_signum, void *pinfo,
153 void *puc)
154 {
155 siginfo_t *info = pinfo;
156 #if defined(__NetBSD__) || defined(__FreeBSD__) || defined(__DragonFly__)
157 ucontext_t *uc = puc;
158 #elif defined(__OpenBSD__)
159 struct sigcontext *uc = puc;
160 #else
161 struct ucontext *uc = puc;
162 #endif
163 unsigned long pc;
164 int trapno;
165
166 #ifndef REG_EIP
167 /* for glibc 2.1 */
168 #define REG_EIP EIP
169 #define REG_ERR ERR
170 #define REG_TRAPNO TRAPNO
171 #endif
172 pc = EIP_sig(uc);
173 trapno = TRAP_sig(uc);
174 return handle_cpu_signal(pc, (unsigned long)info->si_addr,
175 trapno == 0xe ?
176 (ERROR_sig(uc) >> 1) & 1 : 0,
177 &MASK_sig(uc), puc);
178 }
179
180 #elif defined(__x86_64__)
181
182 #ifdef __NetBSD__
183 #define PC_sig(context) _UC_MACHINE_PC(context)
184 #define TRAP_sig(context) ((context)->uc_mcontext.__gregs[_REG_TRAPNO])
185 #define ERROR_sig(context) ((context)->uc_mcontext.__gregs[_REG_ERR])
186 #define MASK_sig(context) ((context)->uc_sigmask)
187 #elif defined(__OpenBSD__)
188 #define PC_sig(context) ((context)->sc_rip)
189 #define TRAP_sig(context) ((context)->sc_trapno)
190 #define ERROR_sig(context) ((context)->sc_err)
191 #define MASK_sig(context) ((context)->sc_mask)
192 #elif defined(__FreeBSD__) || defined(__DragonFly__)
193 #include <ucontext.h>
194
195 #define PC_sig(context) (*((unsigned long *)&(context)->uc_mcontext.mc_rip))
196 #define TRAP_sig(context) ((context)->uc_mcontext.mc_trapno)
197 #define ERROR_sig(context) ((context)->uc_mcontext.mc_err)
198 #define MASK_sig(context) ((context)->uc_sigmask)
199 #else
200 #define PC_sig(context) ((context)->uc_mcontext.gregs[REG_RIP])
201 #define TRAP_sig(context) ((context)->uc_mcontext.gregs[REG_TRAPNO])
202 #define ERROR_sig(context) ((context)->uc_mcontext.gregs[REG_ERR])
203 #define MASK_sig(context) ((context)->uc_sigmask)
204 #endif
205
206 int cpu_signal_handler(int host_signum, void *pinfo,
207 void *puc)
208 {
209 siginfo_t *info = pinfo;
210 unsigned long pc;
211 #if defined(__NetBSD__) || defined(__FreeBSD__) || defined(__DragonFly__)
212 ucontext_t *uc = puc;
213 #elif defined(__OpenBSD__)
214 struct sigcontext *uc = puc;
215 #else
216 struct ucontext *uc = puc;
217 #endif
218
219 pc = PC_sig(uc);
220 return handle_cpu_signal(pc, (unsigned long)info->si_addr,
221 TRAP_sig(uc) == 0xe ?
222 (ERROR_sig(uc) >> 1) & 1 : 0,
223 &MASK_sig(uc), puc);
224 }
225
226 #elif defined(_ARCH_PPC)
227
228 /***********************************************************************
229 * signal context platform-specific definitions
230 * From Wine
231 */
232 #ifdef linux
233 /* All Registers access - only for local access */
234 #define REG_sig(reg_name, context) \
235 ((context)->uc_mcontext.regs->reg_name)
236 /* Gpr Registers access */
237 #define GPR_sig(reg_num, context) REG_sig(gpr[reg_num], context)
238 /* Program counter */
239 #define IAR_sig(context) REG_sig(nip, context)
240 /* Machine State Register (Supervisor) */
241 #define MSR_sig(context) REG_sig(msr, context)
242 /* Count register */
243 #define CTR_sig(context) REG_sig(ctr, context)
244 /* User's integer exception register */
245 #define XER_sig(context) REG_sig(xer, context)
246 /* Link register */
247 #define LR_sig(context) REG_sig(link, context)
248 /* Condition register */
249 #define CR_sig(context) REG_sig(ccr, context)
250
251 /* Float Registers access */
252 #define FLOAT_sig(reg_num, context) \
253 (((double *)((char *)((context)->uc_mcontext.regs + 48 * 4)))[reg_num])
254 #define FPSCR_sig(context) \
255 (*(int *)((char *)((context)->uc_mcontext.regs + (48 + 32 * 2) * 4)))
256 /* Exception Registers access */
257 #define DAR_sig(context) REG_sig(dar, context)
258 #define DSISR_sig(context) REG_sig(dsisr, context)
259 #define TRAP_sig(context) REG_sig(trap, context)
260 #endif /* linux */
261
262 #if defined(__FreeBSD__) || defined(__FreeBSD_kernel__)
263 #include <ucontext.h>
264 #define IAR_sig(context) ((context)->uc_mcontext.mc_srr0)
265 #define MSR_sig(context) ((context)->uc_mcontext.mc_srr1)
266 #define CTR_sig(context) ((context)->uc_mcontext.mc_ctr)
267 #define XER_sig(context) ((context)->uc_mcontext.mc_xer)
268 #define LR_sig(context) ((context)->uc_mcontext.mc_lr)
269 #define CR_sig(context) ((context)->uc_mcontext.mc_cr)
270 /* Exception Registers access */
271 #define DAR_sig(context) ((context)->uc_mcontext.mc_dar)
272 #define DSISR_sig(context) ((context)->uc_mcontext.mc_dsisr)
273 #define TRAP_sig(context) ((context)->uc_mcontext.mc_exc)
274 #endif /* __FreeBSD__|| __FreeBSD_kernel__ */
275
276 #ifdef __APPLE__
277 #include <sys/ucontext.h>
278 typedef struct ucontext SIGCONTEXT;
279 /* All Registers access - only for local access */
280 #define REG_sig(reg_name, context) \
281 ((context)->uc_mcontext->ss.reg_name)
282 #define FLOATREG_sig(reg_name, context) \
283 ((context)->uc_mcontext->fs.reg_name)
284 #define EXCEPREG_sig(reg_name, context) \
285 ((context)->uc_mcontext->es.reg_name)
286 #define VECREG_sig(reg_name, context) \
287 ((context)->uc_mcontext->vs.reg_name)
288 /* Gpr Registers access */
289 #define GPR_sig(reg_num, context) REG_sig(r##reg_num, context)
290 /* Program counter */
291 #define IAR_sig(context) REG_sig(srr0, context)
292 /* Machine State Register (Supervisor) */
293 #define MSR_sig(context) REG_sig(srr1, context)
294 #define CTR_sig(context) REG_sig(ctr, context)
295 /* Link register */
296 #define XER_sig(context) REG_sig(xer, context)
297 /* User's integer exception register */
298 #define LR_sig(context) REG_sig(lr, context)
299 /* Condition register */
300 #define CR_sig(context) REG_sig(cr, context)
301 /* Float Registers access */
302 #define FLOAT_sig(reg_num, context) \
303 FLOATREG_sig(fpregs[reg_num], context)
304 #define FPSCR_sig(context) \
305 ((double)FLOATREG_sig(fpscr, context))
306 /* Exception Registers access */
307 /* Fault registers for coredump */
308 #define DAR_sig(context) EXCEPREG_sig(dar, context)
309 #define DSISR_sig(context) EXCEPREG_sig(dsisr, context)
310 /* number of powerpc exception taken */
311 #define TRAP_sig(context) EXCEPREG_sig(exception, context)
312 #endif /* __APPLE__ */
313
314 int cpu_signal_handler(int host_signum, void *pinfo,
315 void *puc)
316 {
317 siginfo_t *info = pinfo;
318 #if defined(__FreeBSD__) || defined(__FreeBSD_kernel__)
319 ucontext_t *uc = puc;
320 #else
321 struct ucontext *uc = puc;
322 #endif
323 unsigned long pc;
324 int is_write;
325
326 pc = IAR_sig(uc);
327 is_write = 0;
328 #if 0
329 /* ppc 4xx case */
330 if (DSISR_sig(uc) & 0x00800000) {
331 is_write = 1;
332 }
333 #else
334 if (TRAP_sig(uc) != 0x400 && (DSISR_sig(uc) & 0x02000000)) {
335 is_write = 1;
336 }
337 #endif
338 return handle_cpu_signal(pc, (unsigned long)info->si_addr,
339 is_write, &uc->uc_sigmask, puc);
340 }
341
342 #elif defined(__alpha__)
343
344 int cpu_signal_handler(int host_signum, void *pinfo,
345 void *puc)
346 {
347 siginfo_t *info = pinfo;
348 struct ucontext *uc = puc;
349 uint32_t *pc = uc->uc_mcontext.sc_pc;
350 uint32_t insn = *pc;
351 int is_write = 0;
352
353 /* XXX: need kernel patch to get write flag faster */
354 switch (insn >> 26) {
355 case 0x0d: /* stw */
356 case 0x0e: /* stb */
357 case 0x0f: /* stq_u */
358 case 0x24: /* stf */
359 case 0x25: /* stg */
360 case 0x26: /* sts */
361 case 0x27: /* stt */
362 case 0x2c: /* stl */
363 case 0x2d: /* stq */
364 case 0x2e: /* stl_c */
365 case 0x2f: /* stq_c */
366 is_write = 1;
367 }
368
369 return handle_cpu_signal(pc, (unsigned long)info->si_addr,
370 is_write, &uc->uc_sigmask, puc);
371 }
372 #elif defined(__sparc__)
373
374 int cpu_signal_handler(int host_signum, void *pinfo,
375 void *puc)
376 {
377 siginfo_t *info = pinfo;
378 int is_write;
379 uint32_t insn;
380 #if !defined(__arch64__) || defined(CONFIG_SOLARIS)
381 uint32_t *regs = (uint32_t *)(info + 1);
382 void *sigmask = (regs + 20);
383 /* XXX: is there a standard glibc define ? */
384 unsigned long pc = regs[1];
385 #else
386 #ifdef __linux__
387 struct sigcontext *sc = puc;
388 unsigned long pc = sc->sigc_regs.tpc;
389 void *sigmask = (void *)sc->sigc_mask;
390 #elif defined(__OpenBSD__)
391 struct sigcontext *uc = puc;
392 unsigned long pc = uc->sc_pc;
393 void *sigmask = (void *)(long)uc->sc_mask;
394 #endif
395 #endif
396
397 /* XXX: need kernel patch to get write flag faster */
398 is_write = 0;
399 insn = *(uint32_t *)pc;
400 if ((insn >> 30) == 3) {
401 switch ((insn >> 19) & 0x3f) {
402 case 0x05: /* stb */
403 case 0x15: /* stba */
404 case 0x06: /* sth */
405 case 0x16: /* stha */
406 case 0x04: /* st */
407 case 0x14: /* sta */
408 case 0x07: /* std */
409 case 0x17: /* stda */
410 case 0x0e: /* stx */
411 case 0x1e: /* stxa */
412 case 0x24: /* stf */
413 case 0x34: /* stfa */
414 case 0x27: /* stdf */
415 case 0x37: /* stdfa */
416 case 0x26: /* stqf */
417 case 0x36: /* stqfa */
418 case 0x25: /* stfsr */
419 case 0x3c: /* casa */
420 case 0x3e: /* casxa */
421 is_write = 1;
422 break;
423 }
424 }
425 return handle_cpu_signal(pc, (unsigned long)info->si_addr,
426 is_write, sigmask, NULL);
427 }
428
429 #elif defined(__arm__)
430
431 int cpu_signal_handler(int host_signum, void *pinfo,
432 void *puc)
433 {
434 siginfo_t *info = pinfo;
435 struct ucontext *uc = puc;
436 unsigned long pc;
437 int is_write;
438
439 #if defined(__GLIBC__) && (__GLIBC__ < 2 || (__GLIBC__ == 2 && __GLIBC_MINOR__ <= 3))
440 pc = uc->uc_mcontext.gregs[R15];
441 #else
442 pc = uc->uc_mcontext.arm_pc;
443 #endif
444 /* XXX: compute is_write */
445 is_write = 0;
446 return handle_cpu_signal(pc, (unsigned long)info->si_addr,
447 is_write,
448 &uc->uc_sigmask, puc);
449 }
450
451 #elif defined(__mc68000)
452
453 int cpu_signal_handler(int host_signum, void *pinfo,
454 void *puc)
455 {
456 siginfo_t *info = pinfo;
457 struct ucontext *uc = puc;
458 unsigned long pc;
459 int is_write;
460
461 pc = uc->uc_mcontext.gregs[16];
462 /* XXX: compute is_write */
463 is_write = 0;
464 return handle_cpu_signal(pc, (unsigned long)info->si_addr,
465 is_write,
466 &uc->uc_sigmask, puc);
467 }
468
469 #elif defined(__ia64)
470
471 #ifndef __ISR_VALID
472 /* This ought to be in <bits/siginfo.h>... */
473 # define __ISR_VALID 1
474 #endif
475
476 int cpu_signal_handler(int host_signum, void *pinfo, void *puc)
477 {
478 siginfo_t *info = pinfo;
479 struct ucontext *uc = puc;
480 unsigned long ip;
481 int is_write = 0;
482
483 ip = uc->uc_mcontext.sc_ip;
484 switch (host_signum) {
485 case SIGILL:
486 case SIGFPE:
487 case SIGSEGV:
488 case SIGBUS:
489 case SIGTRAP:
490 if (info->si_code && (info->si_segvflags & __ISR_VALID)) {
491 /* ISR.W (write-access) is bit 33: */
492 is_write = (info->si_isr >> 33) & 1;
493 }
494 break;
495
496 default:
497 break;
498 }
499 return handle_cpu_signal(ip, (unsigned long)info->si_addr,
500 is_write,
501 (sigset_t *)&uc->uc_sigmask, puc);
502 }
503
504 #elif defined(__s390__)
505
506 int cpu_signal_handler(int host_signum, void *pinfo,
507 void *puc)
508 {
509 siginfo_t *info = pinfo;
510 struct ucontext *uc = puc;
511 unsigned long pc;
512 uint16_t *pinsn;
513 int is_write = 0;
514
515 pc = uc->uc_mcontext.psw.addr;
516
517 /* ??? On linux, the non-rt signal handler has 4 (!) arguments instead
518 of the normal 2 arguments. The 3rd argument contains the "int_code"
519 from the hardware which does in fact contain the is_write value.
520 The rt signal handler, as far as I can tell, does not give this value
521 at all. Not that we could get to it from here even if it were. */
522 /* ??? This is not even close to complete, since it ignores all
523 of the read-modify-write instructions. */
524 pinsn = (uint16_t *)pc;
525 switch (pinsn[0] >> 8) {
526 case 0x50: /* ST */
527 case 0x42: /* STC */
528 case 0x40: /* STH */
529 is_write = 1;
530 break;
531 case 0xc4: /* RIL format insns */
532 switch (pinsn[0] & 0xf) {
533 case 0xf: /* STRL */
534 case 0xb: /* STGRL */
535 case 0x7: /* STHRL */
536 is_write = 1;
537 }
538 break;
539 case 0xe3: /* RXY format insns */
540 switch (pinsn[2] & 0xff) {
541 case 0x50: /* STY */
542 case 0x24: /* STG */
543 case 0x72: /* STCY */
544 case 0x70: /* STHY */
545 case 0x8e: /* STPQ */
546 case 0x3f: /* STRVH */
547 case 0x3e: /* STRV */
548 case 0x2f: /* STRVG */
549 is_write = 1;
550 }
551 break;
552 }
553 return handle_cpu_signal(pc, (unsigned long)info->si_addr,
554 is_write, &uc->uc_sigmask, puc);
555 }
556
557 #elif defined(__mips__)
558
559 int cpu_signal_handler(int host_signum, void *pinfo,
560 void *puc)
561 {
562 siginfo_t *info = pinfo;
563 struct ucontext *uc = puc;
564 greg_t pc = uc->uc_mcontext.pc;
565 int is_write;
566
567 /* XXX: compute is_write */
568 is_write = 0;
569 return handle_cpu_signal(pc, (unsigned long)info->si_addr,
570 is_write, &uc->uc_sigmask, puc);
571 }
572
573 #elif defined(__hppa__)
574
575 int cpu_signal_handler(int host_signum, void *pinfo,
576 void *puc)
577 {
578 siginfo_t *info = pinfo;
579 struct ucontext *uc = puc;
580 unsigned long pc = uc->uc_mcontext.sc_iaoq[0];
581 uint32_t insn = *(uint32_t *)pc;
582 int is_write = 0;
583
584 /* XXX: need kernel patch to get write flag faster. */
585 switch (insn >> 26) {
586 case 0x1a: /* STW */
587 case 0x19: /* STH */
588 case 0x18: /* STB */
589 case 0x1b: /* STWM */
590 is_write = 1;
591 break;
592
593 case 0x09: /* CSTWX, FSTWX, FSTWS */
594 case 0x0b: /* CSTDX, FSTDX, FSTDS */
595 /* Distinguish from coprocessor load ... */
596 is_write = (insn >> 9) & 1;
597 break;
598
599 case 0x03:
600 switch ((insn >> 6) & 15) {
601 case 0xa: /* STWS */
602 case 0x9: /* STHS */
603 case 0x8: /* STBS */
604 case 0xe: /* STWAS */
605 case 0xc: /* STBYS */
606 is_write = 1;
607 }
608 break;
609 }
610
611 return handle_cpu_signal(pc, (unsigned long)info->si_addr,
612 is_write, &uc->uc_sigmask, puc);
613 }
614
615 #else
616
617 #error host CPU specific signal handler needed
618
619 #endif