From: Laurent Vivier <laurent@vivier.eu>
To: Andreas Krebbel <krebbel@linux.ibm.com>
Cc: qemu-s390x@nongnu.org, qemu-devel@nongnu.org,
David Hildenbrand <david@redhat.com>
Subject: Re: [PATCH 1/1] linux-user/s390x: Apply h2g to address of sigreturn stub
Date: Wed, 24 Mar 2021 14:06:03 +0100 [thread overview]
Message-ID: <dfdad0d0-4b1c-d2e8-04c5-e6a2dbebe5b2@vivier.eu> (raw)
In-Reply-To: <3d64f14f-58a4-7cc3-a069-f7ed1172d038@linux.ibm.com>
Le 24/03/2021 à 12:26, Andreas Krebbel a écrit :
> On 3/24/21 11:28 AM, Laurent Vivier wrote:
>> Le 24/03/2021 à 10:17, David Hildenbrand a écrit :
>>> On 24.03.21 09:51, Andreas Krebbel wrote:
>>>> The sigreturn SVC is put onto the stack by the emulation code. Hence
>>>> the address of it should not be subject to guest_base transformation
>>>> when fetching it.
>>>>
>>>> The fix applies h2g to the address when writing it into the return
>>>> address register to nullify the transformation applied to it later.
>>>>
>>>> Note: This only caused problems if Qemu has been built with
>>>> --disable-pie (as it is in distros nowadays). Otherwise guest_base
>>>> defaults to 0 hiding the actual problem.
>>>>
>>>> Signed-off-by: Andreas Krebbel <krebbel@linux.ibm.com>
>>>> ---
>>>> linux-user/s390x/signal.c | 4 ++--
>>>> 1 file changed, 2 insertions(+), 2 deletions(-)
>>>>
>>>> diff --git a/linux-user/s390x/signal.c b/linux-user/s390x/signal.c
>>>> index ecfa2a14a9..1412376958 100644
>>>> --- a/linux-user/s390x/signal.c
>>>> +++ b/linux-user/s390x/signal.c
>>>> @@ -152,7 +152,7 @@ void setup_frame(int sig, struct target_sigaction *ka,
>>>> env->regs[14] = (unsigned long)
>>>> ka->sa_restorer | PSW_ADDR_AMODE;
>>>> } else {
>>>> - env->regs[14] = (frame_addr + offsetof(sigframe, retcode))
>>>> + env->regs[14] = h2g(frame_addr + offsetof(sigframe, retcode))
>>>> | PSW_ADDR_AMODE;
>>
>> Well, it really doesn't sound good as frame_addr is a guest address (and sa_restorer is too)
>
> I would expect the sa_restorer address to actually point into the guest code section.
yes, it does. like frame_addr. The host address is frame, see:
if (!lock_user_struct(VERIFY_WRITE, frame, frame_addr, 0)) {
goto give_sigsegv;
}
So frame = g2h(frame_addr)
This line put the address of the next instruction to execute (guest address space):
env->regs[14] = (frame_addr + offsetof(sigframe, retcode))
| PSW_ADDR_AMODE;
This line put at this address the NR_sigreturn syscall (but __put_user() uses host address):
__put_user(S390_SYSCALL_OPCODE | TARGET_NR_sigreturn,
(uint16_t *)(frame->retcode));
In theory:
frame_addr + offsetof(sigframe, retcode) == h2g(frame->retcode)
So the next instruction executed after this function is the sigreturn() syscall.
I think the problem is elsewhere.
But I don't see what is the problem you are trying to solve.
>
>>
>> Where is the code that does the g2h() you want to nullify?
>
> That's on the code path which usually fetches instructions from memory. In cpu_lduw_code called via:
>
> s390x_tr_translate_insn->translate_one->extract_insn->ld_code2->cpu_lduw_code
cpu_lduw_code() takes a guest a address and needs to translate it to host address. We need the g2h()
here because we have a guest address.
>
>
> Btw. Power also uses h2g while setting up the trampoline address:
>
> ...
> save_user_regs(env, mctx);
> encode_trampoline(TARGET_NR_rt_sigreturn, trampptr);
>
> /* The kernel checks for the presence of a VDSO here. We don't
> emulate a vdso, so use a sigreturn system call. */
> env->lr = (target_ulong) h2g(trampptr);
> ...
But here, it's correct because trampptr is an host address:
trampptr = &rt_sf->trampoline[0];
Thanks,
Laurent
next prev parent reply other threads:[~2021-03-24 13:07 UTC|newest]
Thread overview: 11+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-03-24 8:51 [PATCH 1/1] linux-user/s390x: Apply h2g to address of sigreturn stub Andreas Krebbel
2021-03-24 9:17 ` David Hildenbrand
2021-03-24 10:28 ` Laurent Vivier
2021-03-24 11:26 ` Andreas Krebbel
2021-03-24 13:06 ` Laurent Vivier [this message]
2021-03-24 14:14 ` Andreas Krebbel
2021-03-24 14:34 ` Richard Henderson
2021-03-24 15:34 ` Laurent Vivier
2021-03-24 15:55 ` [PATCH v2] linux-user/s390x: Use the guest pointer for the " Andreas Krebbel
2021-03-24 17:53 ` Laurent Vivier
2021-03-24 18:48 ` Andreas Krebbel
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=dfdad0d0-4b1c-d2e8-04c5-e6a2dbebe5b2@vivier.eu \
--to=laurent@vivier.eu \
--cc=david@redhat.com \
--cc=krebbel@linux.ibm.com \
--cc=qemu-devel@nongnu.org \
--cc=qemu-s390x@nongnu.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).