From dcd86148e23509fb2cedeb5ac38c20763b71141f Mon Sep 17 00:00:00 2001 From: Helge Deller Date: Thu, 27 Oct 2022 08:58:37 +0200 Subject: [PATCH 1/4] linux-user/hppa: Detect glibc ABORT_INSTRUCTION and EXCP_BREAK handler The glibc on the hppa platform uses the "iitlbp %r0,(%sr0, %r0)" assembler instruction as ABORT_INSTRUCTION. If this (in userspace context) illegal assembler statement is found, dump the registers and report the failure to userspace the same way as the Linux kernel on physical hardware. For other illegal instructions report TARGET_ILL_ILLOPC instead of TARGET_ILL_ILLOPN as si_code. Additionally add the missing EXCP_BREAK exception handler which occurs when the "break x,y" assembler instruction is executed and report EXCP_ASSIST traps. Signed-off-by: Helge Deller Message-Id: Signed-off-by: Laurent Vivier --- linux-user/hppa/cpu_loop.c | 19 ++++++++++++++----- 1 file changed, 14 insertions(+), 5 deletions(-) diff --git a/linux-user/hppa/cpu_loop.c b/linux-user/hppa/cpu_loop.c index 1ef3b46191..8ab1335106 100644 --- a/linux-user/hppa/cpu_loop.c +++ b/linux-user/hppa/cpu_loop.c @@ -147,15 +147,20 @@ void cpu_loop(CPUHPPAState *env) force_sig_fault(TARGET_SIGSEGV, TARGET_SEGV_MAPERR, env->iaoq_f); break; case EXCP_ILL: - EXCP_DUMP(env, "qemu: got CPU exception 0x%x - aborting\n", trapnr); - force_sig_fault(TARGET_SIGILL, TARGET_ILL_ILLOPN, env->iaoq_f); + EXCP_DUMP(env, "qemu: EXCP_ILL exception %#x\n", trapnr); + force_sig_fault(TARGET_SIGILL, TARGET_ILL_ILLOPC, env->iaoq_f); break; case EXCP_PRIV_OPR: - EXCP_DUMP(env, "qemu: got CPU exception 0x%x - aborting\n", trapnr); - force_sig_fault(TARGET_SIGILL, TARGET_ILL_PRVOPC, env->iaoq_f); + /* check for glibc ABORT_INSTRUCTION "iitlbp %r0,(%sr0, %r0)" */ + EXCP_DUMP(env, "qemu: EXCP_PRIV_OPR exception %#x\n", trapnr); + if (env->cr[CR_IIR] == 0x04000000) { + force_sig_fault(TARGET_SIGILL, TARGET_ILL_ILLOPC, env->iaoq_f); + } else { + force_sig_fault(TARGET_SIGILL, TARGET_ILL_PRVOPC, env->iaoq_f); + } break; case EXCP_PRIV_REG: - EXCP_DUMP(env, "qemu: got CPU exception 0x%x - aborting\n", trapnr); + EXCP_DUMP(env, "qemu: EXCP_PRIV_REG exception %#x\n", trapnr); force_sig_fault(TARGET_SIGILL, TARGET_ILL_PRVREG, env->iaoq_f); break; case EXCP_OVERFLOW: @@ -167,6 +172,10 @@ void cpu_loop(CPUHPPAState *env) case EXCP_ASSIST: force_sig_fault(TARGET_SIGFPE, 0, env->iaoq_f); break; + case EXCP_BREAK: + EXCP_DUMP(env, "qemu: EXCP_BREAK exception %#x\n", trapnr); + force_sig_fault(TARGET_SIGTRAP, TARGET_TRAP_BRKPT, env->iaoq_f & ~3); + break; case EXCP_DEBUG: force_sig_fault(TARGET_SIGTRAP, TARGET_TRAP_BRKPT, env->iaoq_f); break; From af804f39cc7d3e0bed1c20c414cb43c1662c4465 Mon Sep 17 00:00:00 2001 From: Helge Deller Date: Tue, 25 Oct 2022 04:34:14 +0200 Subject: [PATCH 2/4] linux-user: Add close_range() syscall Signed-off-by: Helge Deller Reviewed-by: Richard Henderson Message-Id: Signed-off-by: Laurent Vivier --- linux-user/strace.list | 3 +++ linux-user/syscall.c | 19 +++++++++++++++++++ 2 files changed, 22 insertions(+) diff --git a/linux-user/strace.list b/linux-user/strace.list index 3df2184580..cd995e5d56 100644 --- a/linux-user/strace.list +++ b/linux-user/strace.list @@ -103,6 +103,9 @@ #ifdef TARGET_NR_close { TARGET_NR_close, "close" , "%s(%d)", NULL, NULL }, #endif +#ifdef TARGET_NR_close_range +{ TARGET_NR_close_range, "close_range" , "%s(%u,%u,%u)", NULL, NULL }, +#endif #ifdef TARGET_NR_connect { TARGET_NR_connect, "connect" , "%s(%d,%#x,%d)", NULL, NULL }, #endif diff --git a/linux-user/syscall.c b/linux-user/syscall.c index 8402c1399d..8b18adfba8 100644 --- a/linux-user/syscall.c +++ b/linux-user/syscall.c @@ -364,6 +364,13 @@ _syscall3(int,sys_syslog,int,type,char*,bufp,int,len) #ifdef __NR_exit_group _syscall1(int,exit_group,int,error_code) #endif +#if defined(__NR_close_range) && defined(TARGET_NR_close_range) +#define __NR_sys_close_range __NR_close_range +_syscall3(int,sys_close_range,int,first,int,last,int,flags) +#ifndef CLOSE_RANGE_CLOEXEC +#define CLOSE_RANGE_CLOEXEC (1U << 2) +#endif +#endif #if defined(__NR_futex) _syscall6(int,sys_futex,int *,uaddr,int,op,int,val, const struct timespec *,timeout,int *,uaddr2,int,val3) @@ -8756,6 +8763,18 @@ static abi_long do_syscall1(CPUArchState *cpu_env, int num, abi_long arg1, case TARGET_NR_close: fd_trans_unregister(arg1); return get_errno(close(arg1)); +#if defined(__NR_close_range) && defined(TARGET_NR_close_range) + case TARGET_NR_close_range: + ret = get_errno(sys_close_range(arg1, arg2, arg3)); + if (ret == 0 && !(arg3 & CLOSE_RANGE_CLOEXEC)) { + abi_long fd, maxfd; + maxfd = MIN(arg2, target_fd_max); + for (fd = arg1; fd < maxfd; fd++) { + fd_trans_unregister(fd); + } + } + return ret; +#endif case TARGET_NR_brk: return do_brk(arg1); From 8b95210fcb2330dd3b682ff3a5a734881baa8bef Mon Sep 17 00:00:00 2001 From: Helge Deller Date: Mon, 24 Oct 2022 22:45:44 +0200 Subject: [PATCH 3/4] linux-user: Add strace output for timer_settime64() syscall Add missing timer_settime64() strace output and specify format for timer_settime(). Signed-off-by: Helge Deller Message-Id: Signed-off-by: Laurent Vivier --- linux-user/strace.list | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/linux-user/strace.list b/linux-user/strace.list index cd995e5d56..3a898e2532 100644 --- a/linux-user/strace.list +++ b/linux-user/strace.list @@ -1534,7 +1534,10 @@ { TARGET_NR_timer_gettime, "timer_gettime" , NULL, NULL, NULL }, #endif #ifdef TARGET_NR_timer_settime -{ TARGET_NR_timer_settime, "timer_settime" , NULL, NULL, NULL }, +{ TARGET_NR_timer_settime, "timer_settime" , "%s(%d,%d,%p,%p)", NULL, NULL }, +#endif +#ifdef TARGET_NR_timer_settime64 +{ TARGET_NR_timer_settime64, "timer_settime64" , "%s(%d,%d,%p,%p)", NULL, NULL }, #endif #ifdef TARGET_NR_timerfd { TARGET_NR_timerfd, "timerfd" , NULL, NULL, NULL }, From 16c81dd563b94e9392a578ccf5aa762d01e8f165 Mon Sep 17 00:00:00 2001 From: Icenowy Zheng Date: Fri, 28 Oct 2022 16:12:20 +0800 Subject: [PATCH 4/4] linux-user: always translate cmsg when recvmsg It's possible that a message contains both normal payload and ancillary data in the same message, and even if no ancillary data is available this information should be passed to the target, otherwise the target cmsghdr will be left uninitialized and the target is going to access uninitialized memory if it expects cmsg. Always call the function that translate cmsg when recvmsg, because that function should be empty-cmsg-safe (it creates an empty cmsg in the target). Signed-off-by: Icenowy Zheng Reviewed-by: Laurent Vivier Message-Id: <20221028081220.1604244-1-uwu@icenowy.me> Signed-off-by: Laurent Vivier --- linux-user/syscall.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/linux-user/syscall.c b/linux-user/syscall.c index 8b18adfba8..24b25759be 100644 --- a/linux-user/syscall.c +++ b/linux-user/syscall.c @@ -3353,7 +3353,8 @@ static abi_long do_sendrecvmsg_locked(int fd, struct target_msghdr *msgp, if (fd_trans_host_to_target_data(fd)) { ret = fd_trans_host_to_target_data(fd)(msg.msg_iov->iov_base, MIN(msg.msg_iov->iov_len, len)); - } else { + } + if (!is_error(ret)) { ret = host_to_target_cmsg(msgp, &msg); } if (!is_error(ret)) {