aboutsummaryrefslogtreecommitdiff
path: root/linux-user
AgeCommit message (Collapse)AuthorFilesLines
2023-08-31accel/tcg: spelling fixesMichael Tokarev2-3/+3
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru> Message-ID: <20230823065335.1919380-18-mjt@tls.msk.ru> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Message-ID: <20230823065335.1919380-19-mjt@tls.msk.ru> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2023-08-23linux-user/elfload: Enable vxe2 on s390xIlya Leoshkevich1-0/+1
The vxe2 hwcap is not set for programs running in linux-user, but is set by a Linux kernel running in softmmu. Add it to the former. Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com> Message-Id: <20230804233748.218935-2-iii@linux.ibm.com> Reviewed-by: David Hildenbrand <david@redhat.com> Reviewed-by: Claudio Fontana <cfontana@suse.de> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Thomas Huth <thuth@redhat.com>
2023-08-09linux-user: Fix openat() emulation to correctly detect accesses to /procHelge Deller1-1/+12
In qemu we catch accesses to files like /proc/cpuinfo or /proc/net/route and return to the guest contents which would be visible on a real system (instead what the host would show). This patch fixes a bug, where for example the accesses cat /proc////cpuinfo or cd /proc && cat cpuinfo will not be recognized by qemu and where qemu will wrongly show the contents of the host's /proc/cpuinfo file. Signed-off-by: Helge Deller <deller@gmx.de> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> Message-Id: <20230803214450.647040-2-deller@gmx.de> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2023-08-09linux-user: Use ARRAY_SIZE with bitmask_transtblRichard Henderson2-18/+12
Rather than using a zero tuple to end the table, use a macro to apply ARRAY_SIZE and pass that on to the convert functions. This fixes two bugs in which the conversion functions required that both the target and host masks be non-zero in order to continue, rather than require both target and host masks be zero in order to terminate. This affected mmap_flags_tbl when the host does not support all of the flags we wish to convert (e.g. MAP_UNINITIALIZED). Mapping these flags to zero is good enough, and matches how the kernel ignores bits that are unknown. Fixes: 4b840f96 ("linux-user: Populate more bits in mmap_flags_tbl") Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2023-08-09linux-user: Split out do_mmapRichard Henderson1-17/+73
New function that rejects unsupported map types and flags. In 4b840f96 we should not have accepted MAP_SHARED_VALIDATE without actually validating the rest of the flags. Fixes: 4b840f96 ("linux-user: Populate more bits in mmap_flags_tbl") Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2023-08-08Merge tag 'pull-lu-20230808' of https://gitlab.com/rth7680/qemu into stagingRichard Henderson26-386/+687
linux-user: Adjust guest image layout vs reserved_va linux-user: Do not adjust image mapping for host page size linux-user: Adjust initial brk when interpreter is close to executable util/selfmap: Rewrite using qemu/interval-tree.h linux-user: Rewrite probe_guest_base # -----BEGIN PGP SIGNATURE----- # # iQFRBAABCgA7FiEEekgeeIaLTbaoWgXAZN846K9+IV8FAmTSrp4dHHJpY2hhcmQu # aGVuZGVyc29uQGxpbmFyby5vcmcACgkQZN846K9+IV9lTQf/W/Tbd6CFnZpVE8Sb # BPrhdmo+x6Jftt1Ha66b/4xnasX7DuVaI1ECDh4CQQKIOh9A4LETx6ue9/UGi4vT # Fe4UrrJcAjt/CPaZhwXniJM9CvEnw1gkl3AgKAtZOBEConuPnkTiSWjySmCt3T4r # EGQxDe0HLpWYavNtvyywak/sEbwOD4hNAunFpJB6PLZ+KEoCDZwtcQdl55kg5bIt # WBMgUSXnWhC45t+26OcSDeHovqxHoA647H10T0y0U6bNVkW0tRW51xCTvHt+iDyR # s8UOCe1Q+w8F18fN68HIWBJ6NCzUts/AmQrWwc/MWiK1z91/ht5mlKAuNYnoZ6jH # htCSEA== # =ERAI # -----END PGP SIGNATURE----- # gpg: Signature made Tue 08 Aug 2023 02:07:42 PM PDT # gpg: using RSA key 7A481E78868B4DB6A85A05C064DF38E8AF7E215F # gpg: issuer "richard.henderson@linaro.org" # gpg: Good signature from "Richard Henderson <richard.henderson@linaro.org>" [ultimate] * tag 'pull-lu-20230808' of https://gitlab.com/rth7680/qemu: linux-user: Rewrite non-fixed probe_guest_base linux-user: Rewrite fixed probe_guest_base linux-user: Consolidate guest bounds check in probe_guest_base linux-user: Remove duplicate CPU_LOG_PAGE from probe_guest_base util/selfmap: Rewrite using qemu/interval-tree.h linux-user: Use zero_bss for PT_LOAD with no file contents too linux-user: Do not adjust zero_bss for host page size linux-user: Do not adjust image mapping for host page size linux-user: Adjust initial brk when interpreter is close to executable linux-user: Use elf_et_dyn_base for ET_DYN with interpreter linux-user: Use MAP_FIXED_NOREPLACE for initial image mmap linux-user: Define ELF_ET_DYN_BASE in $guest/target_mman.h linux-user: Define TASK_UNMAPPED_BASE in $guest/target_mman.h linux-user: Adjust task_unmapped_base for reserved_va Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2023-08-08linux-user: Rewrite non-fixed probe_guest_baseRichard Henderson1-181/+100
Use pgb_addr_set to probe for all of the guest addresses, not just the main executable. Handle the identity map specially and separately from the search. If /proc/self/maps is available, utilize the full power of the interval tree search, rather than a linear search through the address list. If /proc/self/maps is not available, increase the skip between probes so that we do not probe every single page of the host address space. Choose 1 MiB for 32-bit hosts (max 4k probes) and 1 GiB for 64-bit hosts (possibly a large number of probes, but the large step makes it more likely to find empty space quicker). Tested-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2023-08-08linux-user: Rewrite fixed probe_guest_baseRichard Henderson1-27/+161
Create a set of subroutines to collect a set of guest addresses, all of which must be mappable on the host. Use this within the renamed pgb_fixed subroutine to validate the user's choice of guest_base specified by the -B command-line option. Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2023-08-08linux-user: Consolidate guest bounds check in probe_guest_baseRichard Henderson1-33/+17
The three sets of checks are identical, logically. Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2023-08-08linux-user: Remove duplicate CPU_LOG_PAGE from probe_guest_baseRichard Henderson1-19/+0
The proper logging for probe_guest_base is in the main function. There is no need to duplicate that in the subroutines. Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2023-08-08util/selfmap: Rewrite using qemu/interval-tree.hRichard Henderson2-12/+17
We will want to be able to search the set of mappings. For this patch, the two users iterate the tree in order. Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2023-08-08linux-user: Use zero_bss for PT_LOAD with no file contents tooRichard Henderson1-21/+8
If p_filesz == 0, then vaddr_ef == vaddr. We can reuse the code in zero_bss rather than incompletely duplicating it in load_elf_image. Tested-by: Helge Deller <deller@gmx.de> Reviewed-by: Helge Deller <deller@gmx.de> Reviewed-by: Akihiko Odaki <akihiko.odaki@daynix.com> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2023-08-08linux-user: Do not adjust zero_bss for host page sizeRichard Henderson1-39/+30
Rely on target_mmap to handle guest vs host page size mismatch. Tested-by: Helge Deller <deller@gmx.de> Reviewed-by: Helge Deller <deller@gmx.de> Reviewed-by: Akihiko Odaki <akihiko.odaki@daynix.com> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2023-08-08linux-user: Do not adjust image mapping for host page sizeRichard Henderson1-13/+4
Remove TARGET_ELF_EXEC_PAGESIZE, and 3 other TARGET_ELF_PAGE* macros based off of that. Rely on target_mmap to handle guest vs host page size mismatch. Tested-by: Helge Deller <deller@gmx.de> Reviewed-by: Helge Deller <deller@gmx.de> Reviewed-by: Akihiko Odaki <akihiko.odaki@daynix.com> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2023-08-08linux-user: Adjust initial brk when interpreter is close to executableHelge Deller2-37/+15
While we attempt to load a ET_DYN executable far away from TASK_UNMAPPED_BASE, we are not completely in control of the address space layout. If the interpreter lands close to the executable, leaving insufficient heap space, move brk. Tested-by: Helge Deller <deller@gmx.de> Signed-off-by: Helge Deller <deller@gmx.de> [rth: Re-order after ELF_ET_DYN_BASE patch so that we do not "temporarily break" tsan, and also to minimize the changes required. Remove image_info.reserve_brk as unused.] Reviewed-by: Akihiko Odaki <akihiko.odaki@daynix.com> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2023-08-08linux-user: Use elf_et_dyn_base for ET_DYN with interpreterRichard Henderson1-2/+25
Follow the lead of the linux kernel in fs/binfmt_elf.c, in which an ET_DYN executable which uses an interpreter (usually a PIE executable) is loaded away from where the interpreter itself will be loaded. Tested-by: Helge Deller <deller@gmx.de> Reviewed-by: Helge Deller <deller@gmx.de> Reviewed-by: Akihiko Odaki <akihiko.odaki@daynix.com> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2023-08-08linux-user: Use MAP_FIXED_NOREPLACE for initial image mmapRichard Henderson1-3/+6
Use this as extra protection for the guest mapping over any qemu host mappings. Tested-by: Helge Deller <deller@gmx.de> Reviewed-by: Helge Deller <deller@gmx.de> Reviewed-by: Akihiko Odaki <akihiko.odaki@daynix.com> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2023-08-08linux-user: Define ELF_ET_DYN_BASE in $guest/target_mman.hRichard Henderson23-2/+106
Copy each guest kernel's default value, then bound it against reserved_va or the host address space. Tested-by: Helge Deller <deller@gmx.de> Reviewed-by: Helge Deller <deller@gmx.de> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2023-08-08linux-user: Define TASK_UNMAPPED_BASE in $guest/target_mman.hRichard Henderson21-14/+167
Provide default values that are as close as possible to the values used by the guest's kernel. Tested-by: Helge Deller <deller@gmx.de> Reviewed-by: Helge Deller <deller@gmx.de> Reviewed-by: Akihiko Odaki <akihiko.odaki@daynix.com> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2023-08-08linux-user: Adjust task_unmapped_base for reserved_vaRichard Henderson3-16/+64
Ensure that the chosen values for mmap_next_start and task_unmapped_base are within the guest address space. Tested-by: Helge Deller <deller@gmx.de> Reviewed-by: Akihiko Odaki <akihiko.odaki@daynix.com> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2023-08-08linux-user: cleanup unused linux-user/include/host directoriesPaolo Bonzini3-194/+138
Alpha and 31-bit s390 lack the assembly fragment to handle signals occurring at the same time as system calls, so they cannot run linux-user emulation anymore. Drop the host-signal.h files for them. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Acked-by: Ilya Leoshkevich <iii@linux.ibm.com> Reviewed-by: Michael Tokarev <mjt@tls.msk.ru> Tested-by: Ilya Leoshkevich <iii@linux.ibm.com> Tested-by: Michael Tokarev <mjt@tls.msk.ru> Message-ID: <20230808120303.585509-3-pbonzini@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2023-08-08configure: fix detection for x32 linux-userPaolo Bonzini1-1/+0
x32 uses the same signal handling fragments as x86_64, since host_arch is set to x86_64 when Meson runs. Remove the unnecessary forwarder and set the host_arch variable properly in configure. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Acked-by: Ilya Leoshkevich <iii@linux.ibm.com> Reviewed-by: Michael Tokarev <mjt@tls.msk.ru> Tested-by: Ilya Leoshkevich <iii@linux.ibm.com> Tested-by: Michael Tokarev <mjt@tls.msk.ru> Message-ID: <20230808120303.585509-2-pbonzini@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2023-08-06linux-user: Remove last_brkRichard Henderson2-3/+0
This variable is unused. Reviewed-by: Helge Deller <deller@gmx.de> Reviewed-by: Akihiko Odaki <akihiko.odaki@daynix.com> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2023-08-06linux-user: Properly set image_info.brk in flatloadRichard Henderson3-4/+1
The heap starts at "brk" not "start_brk". With this fixed, image_info.start_brk is unused and may be removed. Tested-by: Helge Deller <deller@gmx.de> Reviewed-by: Helge Deller <deller@gmx.de> Reviewed-by: Akihiko Odaki <akihiko.odaki@daynix.com> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2023-08-06linux-user: Do not align brk with host page sizeAkihiko Odaki2-44/+14
do_brk() minimizes calls into target_mmap() by aligning the address with host page size, which is potentially larger than the target page size. However, the current implementation of this optimization has two bugs: - The start of brk is rounded up with the host page size while brk advertises an address aligned with the target page size as the beginning of brk. This makes the beginning of brk unmapped. - Content clearing after mapping is flawed. The size to clear is specified as HOST_PAGE_ALIGN(brk_page) - brk_page, but brk_page is aligned with the host page size so it is always zero. This optimization actually has no practical benefit. It makes difference when brk() is called multiple times with values in a range of the host page size. However, sophisticated memory allocators try to avoid to make such frequent brk() calls. For example, glibc 2.37 calls brk() to shrink the heap only when there is a room more than 128 KiB. It is rare to have a page size larger than 128 KiB if it happens. Let's remove the optimization to fix the bugs and make the code simpler. Fixes: 86f04735ac ("linux-user: Fix brk() to release pages") Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1616 Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com> Message-Id: <20230802071754.14876-7-akihiko.odaki@daynix.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2023-08-06linux-user: Do nothing if too small brk is specifiedAkihiko Odaki1-3/+3
Linux 6.4.7 does nothing when a value smaller than the initial brk is specified. Fixes: 86f04735ac ("linux-user: Fix brk() to release pages") Reviewed-by: Helge Deller <deller@gmx.de> Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com> Message-Id: <20230802071754.14876-6-akihiko.odaki@daynix.com> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2023-08-06linux-user: Use MAP_FIXED_NOREPLACE for do_brk()Akihiko Odaki1-13/+2
MAP_FIXED_NOREPLACE can ensure the mapped address is fixed without concerning that the new mapping overwrites something else. Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com> Message-Id: <20230802071754.14876-5-akihiko.odaki@daynix.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2023-08-06linux-user: Do not call get_errno() in do_brk()Akihiko Odaki1-3/+3
Later the returned value is compared with -1, and negated errno is not expected. Fixes: 00faf08c95 ("linux-user: Don't use MAP_FIXED in do_brk()") Reviewed-by: Helge Deller <deller@gmx.de> Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com> Message-Id: <20230802071754.14876-4-akihiko.odaki@daynix.com> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2023-08-06linux-user: Fix MAP_FIXED_NOREPLACE on old kernelsAkihiko Odaki1-5/+17
The man page states: > Note that older kernels which do not recognize the MAP_FIXED_NOREPLACE > flag will typically (upon detecting a collision with a preexisting > mapping) fall back to a “non-MAP_FIXED” type of behavior: they will > return an address that is different from the requested address. > Therefore, backward-compatible software should check the returned > address against the requested address. https://man7.org/linux/man-pages/man2/mmap.2.html Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com> Message-Id: <20230802071754.14876-3-akihiko.odaki@daynix.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2023-08-06linux-user: Unset MAP_FIXED_NOREPLACE for hostAkihiko Odaki1-5/+20
Passing MAP_FIXED_NOREPLACE to host will fail for reserved_va because the address space is reserved with mmap. Replace it with MAP_FIXED in that case. Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com> Message-Id: <20230802071754.14876-2-akihiko.odaki@daynix.com> [rth: Expand inline commentary.] Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2023-08-06linux-user/elfload: Set V in ELF_HWCAP for RISC-VNathan Egge1-1/+2
Set V bit for hwcap if misa is set. Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1793 Signed-off-by: Nathan Egge <negge@xiph.org> Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com> Tested-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com> Message-Id: <20230803131424.40744-1-negge@xiph.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2023-07-31linux-user/armeb: Fix __kernel_cmpxchg() for armebHelge Deller1-2/+7
Commit 7f4f0d9ea870 ("linux-user/arm: Implement __kernel_cmpxchg with host atomics") switched to use qatomic_cmpxchg() to swap a word with the memory content, but missed to endianess-swap the oldval and newval values when emulating an armeb CPU, which expects words to be stored in big endian in the guest memory. The bug can be verified with qemu >= v7.0 on any little-endian host, when starting the armeb binary of the upx program, which just hangs without this patch. Cc: qemu-stable@nongnu.org Signed-off-by: Helge Deller <deller@gmx.de> Reported-by: "Markus F.X.J. Oberhumer" <markus@oberhumer.com> Reported-by: John Reiser <jreiser@BitWagon.com> Closes: https://github.com/upx/upx/issues/687 Message-Id: <ZMQVnqY+F+5sTNFd@p100> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2023-07-24Merge tag 'pull-revert-armhf-brk-fix' of https://gitlab.com/mjt0k/qemu into ↵Peter Maydell1-7/+0
staging Revert "linux-user: Fix qemu-arm to run static armhf binaries" # -----BEGIN PGP SIGNATURE----- # # iQFDBAABCAAtFiEEe3O61ovnosKJMUsicBtPaxppPlkFAmS8Cj4PHG1qdEB0bHMu # bXNrLnJ1AAoJEHAbT2saaT5ZLdsH/A7uTAODHopQnUGySPpHAT9uPjf6A21eZnnE # MAcd3w+iEnrleJbpSftaZfKBKEUEN/vPPXg8nfCxhtfvgWUoHlglR3EoeTU+viFG # cW7YO2LG9EbITL62uWDM6blVJzh7OHq+IjUf9xYuErnpREyXMvmGGAlRRjAN2yUz # 3TMQ35JBNuSay2hwvC12jj4AqsmCEFBxvUiJkrrQTFeCVa+Gj/A9xoH7NWSrkW5F # YE1qIfc2lCQFuWag3+Iag1PtTmj4oeW2LmLCJpxc75XnRqcl7MKK2mNhNJ012kun # YZtySEG35t4x4Pyf11dhydtv4fbe5K+L0OjMf444zzEcW7TJ840= # =Cp7j # -----END PGP SIGNATURE----- # gpg: Signature made Sat 22 Jul 2023 17:56:30 BST # gpg: using RSA key 7B73BAD68BE7A2C289314B22701B4F6B1A693E59 # gpg: issuer "mjt@tls.msk.ru" # gpg: Good signature from "Michael Tokarev <mjt@tls.msk.ru>" [full] # gpg: aka "Michael Tokarev <mjt@corpit.ru>" [full] # gpg: aka "Michael Tokarev <mjt@debian.org>" [full] # Primary key fingerprint: 6EE1 95D1 886E 8FFB 810D 4324 457C E0A0 8044 65C5 # Subkey fingerprint: 7B73 BAD6 8BE7 A2C2 8931 4B22 701B 4F6B 1A69 3E59 * tag 'pull-revert-armhf-brk-fix' of https://gitlab.com/mjt0k/qemu: Revert "linux-user: Fix qemu-arm to run static armhf binaries" Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2023-07-23include/exec: Add WITH_MMAP_LOCK_GUARDRichard Henderson1-0/+1
Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2023-07-22Revert "linux-user: Fix qemu-arm to run static armhf binaries"Michael Tokarev1-7/+0
This reverts commit 518f32221af759a29500ac172c4c857bef142067. It is causing similar segfaults at least on aarch64, ppc64el and s390x. Let's revert this one for now and analyze what's going on later. Reopens: https://bugs.debian.org/1040981 Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2023-07-20Merge tag 'linux-user-brk-fixes-pull-request' of ↵Peter Maydell3-13/+66
https://github.com/hdeller/qemu-hppa into staging linux-user: brk() syscall fixes and armhf static binary fix Commit 86f04735ac ("linux-user: Fix brk() to release pages") introduced the possibility for userspace applications to reduce memory footprint by calling brk() with a lower address and as such free up memory, the same way as the Linux kernel allows on physical machines. This change introduced some failures for applications with errors like - accesing bytes above the brk heap address on the same page, - freeing memory below the initial brk address, and introduced a behaviour which isn't done by the kernel (e.g. zeroing memory above brk). This patch series fixes those issues and has been tested with existing programs (e.g. upx). Additionally one patch fixes running static armhf executables (e.g. fstype) which was broken since qemu-8.0. Changes in v2: - dropped patch to revert d28b3c90cfad ("linux-user: Make sure initial brk(0) is page-aligned") - rephrased some commit messages - fixed Cc email addresses, added new ones - added R-b tags Helge # -----BEGIN PGP SIGNATURE----- # # iHUEABYKAB0WIQS86RI+GtKfB8BJu973ErUQojoPXwUCZLgGswAKCRD3ErUQojoP # XwkUAQCKb/lkI3IYxiqO48rVyHtLPtkXd+WttFpeZ076p73LTgD+IEpHZL4WV1Rw # 4+eqW9vswjZwp1xm9bItLdnP2hkyUgI= # =K3Va # -----END PGP SIGNATURE----- # gpg: Signature made Wed 19 Jul 2023 16:52:19 BST # gpg: using EDDSA key BCE9123E1AD29F07C049BBDEF712B510A23A0F5F # gpg: Good signature from "Helge Deller <deller@gmx.de>" [unknown] # gpg: aka "Helge Deller <deller@kernel.org>" [unknown] # gpg: WARNING: This key is not certified with a trusted signature! # gpg: There is no indication that the signature belongs to the owner. # Primary key fingerprint: 4544 8228 2CD9 10DB EF3D 25F8 3E5F 3D04 A7A2 4603 # Subkey fingerprint: BCE9 123E 1AD2 9F07 C049 BBDE F712 B510 A23A 0F5F * tag 'linux-user-brk-fixes-pull-request' of https://github.com/hdeller/qemu-hppa: linux-user: Fix qemu-arm to run static armhf binaries linux-user: Fix strace output for old_mmap linux-user: Fix signed math overflow in brk() syscall linux-user: Prohibit brk() to to shrink below initial heap address linux-user: Fix qemu brk() to not zero bytes on current page Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2023-07-18linux-user: Fix qemu-arm to run static armhf binariesHelge Deller1-0/+7
qemu-user crashes immediately when running static binaries on the armhf architecture. The problem is the memory layout where the executable is loaded before the interpreter library, in which case the reserved brk region clashes with the interpreter code and is released before qemu tries to start the program. At load time qemu calculates a brk value for interpreter and executable each. The fix is to choose the higher one of both. Signed-off-by: Helge Deller <deller@gmx.de> Cc: Andreas Schwab <schwab@suse.de> Cc: qemu-stable@nongnu.org Reported-by: Venkata.Pyla@toshiba-tsip.com Closes: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1040981
2023-07-18linux-user: Fix strace output for old_mmapHelge Deller1-4/+45
The old_mmap syscall (e.g. on i386) hands over the parameters in a struct. Adjust the strace output to print the correct values. Signed-off-by: Helge Deller <deller@gmx.de> Reported-by: John Reiser <jreiser@BitWagon.com> Closes: https://gitlab.com/qemu-project/qemu/-/issues/1760
2023-07-18linux-user: Fix signed math overflow in brk() syscallHelge Deller1-2/+3
Fix the math overflow when calculating the new_malloc_size. new_host_brk_page and brk_page are unsigned integers. If userspace reduces the heap, new_host_brk_page is lower than brk_page which results in a huge positive number (but should actually be negative). Fix it by adding a proper check and as such make the code more readable. Signed-off-by: Helge Deller <deller@gmx.de> Tested-by: "Markus F.X.J. Oberhumer" <markus@oberhumer.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Fixes: 86f04735ac ("linux-user: Fix brk() to release pages") Cc: qemu-stable@nongnu.org Buglink: https://github.com/upx/upx/issues/683
2023-07-18linux-user: Prohibit brk() to to shrink below initial heap addressHelge Deller1-1/+7
Since commit 86f04735ac ("linux-user: Fix brk() to release pages") it's possible for userspace applications to reduce their memory footprint by calling brk() with a lower address and free up memory. Before that commit guest heap memory was never unmapped. But the Linux kernel prohibits to reduce brk() below the initial memory address which is set at startup by the set_brk() function in binfmt_elf.c. Such a range check was missed in commit 86f04735ac. This patch adds the missing check by storing the initial brk value in initial_target_brk and verify any new brk addresses against that value. Tested with the i386 upx binary from https://github.com/upx/upx/releases/download/v4.0.2/upx-4.0.2-i386_linux.tar.xz Signed-off-by: Helge Deller <deller@gmx.de> Tested-by: "Markus F.X.J. Oberhumer" <markus@oberhumer.com> Fixes: 86f04735ac ("linux-user: Fix brk() to release pages") Cc: qemu-stable@nongnu.org Buglink: https://github.com/upx/upx/issues/683
2023-07-18linux-user: Fix qemu brk() to not zero bytes on current pageHelge Deller1-6/+4
The qemu brk() implementation is too aggressive and cleans remaining bytes on the current page above the last brk address. But some existing applications are buggy and read/write bytes above their current heap address. On a phyiscal machine this does not trigger a runtime error as long as the access happens on the same page. Additionally the Linux kernel allocates only full pages and does no zeroing on already allocated pages, even if the brk address is lowered. Fix qemu to behave the same way as the kernel does. Do not touch already allocated pages, and - when running with different page sizes of guest and host - zero out only those memory areas where the host page size is bigger than the guest page size. Signed-off-by: Helge Deller <deller@gmx.de> Tested-by: "Markus F.X.J. Oberhumer" <markus@oberhumer.com> Fixes: 86f04735ac ("linux-user: Fix brk() to release pages") Cc: qemu-stable@nongnu.org Buglink: https://github.com/upx/upx/issues/683
2023-07-18linux-user/elfload: Fix /proc/cpuinfo features: on s390xIlya Leoshkevich1-19/+22
elf_hwcap_str() takes a bit number, but compares it for equality with the HWCAP_S390_* masks. This causes /proc/cpuinfo to display incorrect hwcaps. Fix by introducing the HWCAP_S390_NR_* constants and using them in elf_hwcap_str() instead of the HWCAP_S390_*. While at it, add the missing nnpa, pcimio and sie hwcaps from the latest kernel. Output before: features : esan3 zarch stfle msa Output after: features : esan3 zarch stfle msa ldisp eimm etf3eh highgprs vx vxe Fixes: e19807bee357 ("linux-user/elfload: Introduce elf_hwcap_str() on s390x") Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com> Message-Id: <20230627151356.273259-1-iii@linux.ibm.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Thomas Huth <thuth@redhat.com>
2023-07-17linux-user: Remove pointless NULL check in clock_adjtime handlingPeter Maydell1-7/+5
In the code for TARGET_NR_clock_adjtime, we set the pointer phtx to the address of the local variable htx. This means it can never be NULL, but later in the code we check it for NULL anyway. Coverity complains about this (CID 1507683) because the NULL check comes after a call to clock_adjtime() that assumes it is non-NULL. Since phtx is always &htx, and is used only in three places, it's not really necessary. Remove it, bringing the code structure in to line with that for TARGET_NR_clock_adjtime64, which already uses a simple '&htx' when it wants a pointer to 'htx'. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20230623144410.1837261-1-peter.maydell@linaro.org
2023-07-15linux-user/arm: Do not allocate a commpage at all for M-profile CPUsPhilippe Mathieu-Daudé1-4/+17
Since commit fbd3c4cff6 ("linux-user/arm: Mark the commpage executable") executing bare-metal (linked with rdimon.specs) cortex-M code fails as: $ qemu-arm -cpu cortex-m3 ~/hello.exe.m3 qemu-arm: ../../accel/tcg/user-exec.c:492: page_set_flags: Assertion `last <= GUEST_ADDR_MAX' failed. Aborted (core dumped) Commit 4f5c67f8df ("linux-user/arm: Take more care allocating commpage") already took care of not allocating a commpage for M-profile CPUs, however it had to be reverted as commit 6cda41daa2. Re-introduce the M-profile fix from commit 4f5c67f8df. Fixes: fbd3c4cff6 ("linux-user/arm: Mark the commpage executable") Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1755 Reported-by: Christophe Lyon <christophe.lyon@linaro.org> Suggested-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Anton Johansson <anjo@rev.ng> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20230711153408.68389-1-philmd@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2023-07-15linux-user: Drop uint and ulongJuan Quintela1-4/+4
These are types not used anymore anywhere else. Signed-off-by: Juan Quintela <quintela@redhat.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Laurent Vivier <laurent@vivier.eu> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-id: <20230511085056.13809-1-quintela@redhat.com> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2023-07-15linux-user: Simplify target_madviseRichard Henderson1-15/+4
The trivial length 0 check can be moved up, simplifying some of the other cases. The end < start test is handled by guest_range_valid_untagged. Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20230707204054.8792-27-richard.henderson@linaro.org>
2023-07-15linux-user: Remove can_passthrough_madviseRichard Henderson1-21/+3
Use page_check_range instead, which uses the interval tree instead of checking each page individually. Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20230707204054.8792-26-richard.henderson@linaro.org>
2023-07-15accel/tcg: Return bool from page_check_rangeRichard Henderson2-2/+2
Replace the 0/-1 result with true/false. Invert the sense of the test of all callers. Document the function. Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20230707204054.8792-25-richard.henderson@linaro.org>
2023-07-15linux-user: Simplify target_munmapRichard Henderson1-43/+4
All of the guest to host page adjustment is handled by mmap_reserve_or_unmap; there is no need to duplicate that. There are no failure modes for munmap after alignment and guest address range have been validated. Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20230707204054.8792-23-richard.henderson@linaro.org>
2023-07-15linux-user: Rename mmap_reserve to mmap_reserve_or_unmapRichard Henderson1-13/+16
If !reserved_va, munmap instead and assert success. Update all callers. Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20230707204054.8792-22-richard.henderson@linaro.org>
generated by cgit v1.1 at 2024-08-19 03:19:25 +0000