cachepc-qemu

Fork of AMDESE/qemu with changes for cachepc side-channel attack
git clone https://git.sinitax.com/sinitax/cachepc-qemu
Log | Files | Refs | Submodules | LICENSE | sfeed.txt

qemu.h (12634B)


      1#ifndef QEMU_H
      2#define QEMU_H
      3
      4#include "cpu.h"
      5#include "exec/cpu_ldst.h"
      6
      7#undef DEBUG_REMAP
      8
      9#include "exec/user/abitypes.h"
     10
     11#include "syscall_defs.h"
     12#include "target_syscall.h"
     13
     14/*
     15 * This is the size of the host kernel's sigset_t, needed where we make
     16 * direct system calls that take a sigset_t pointer and a size.
     17 */
     18#define SIGSET_T_SIZE (_NSIG / 8)
     19
     20/*
     21 * This struct is used to hold certain information about the image.
     22 * Basically, it replicates in user space what would be certain
     23 * task_struct fields in the kernel
     24 */
     25struct image_info {
     26        abi_ulong       load_bias;
     27        abi_ulong       load_addr;
     28        abi_ulong       start_code;
     29        abi_ulong       end_code;
     30        abi_ulong       start_data;
     31        abi_ulong       end_data;
     32        abi_ulong       start_brk;
     33        abi_ulong       brk;
     34        abi_ulong       reserve_brk;
     35        abi_ulong       start_mmap;
     36        abi_ulong       start_stack;
     37        abi_ulong       stack_limit;
     38        abi_ulong       entry;
     39        abi_ulong       code_offset;
     40        abi_ulong       data_offset;
     41        abi_ulong       saved_auxv;
     42        abi_ulong       auxv_len;
     43        abi_ulong       arg_start;
     44        abi_ulong       arg_end;
     45        abi_ulong       arg_strings;
     46        abi_ulong       env_strings;
     47        abi_ulong       file_string;
     48        uint32_t        elf_flags;
     49        int             personality;
     50        abi_ulong       alignment;
     51
     52        /* The fields below are used in FDPIC mode.  */
     53        abi_ulong       loadmap_addr;
     54        uint16_t        nsegs;
     55        void            *loadsegs;
     56        abi_ulong       pt_dynamic_addr;
     57        abi_ulong       interpreter_loadmap_addr;
     58        abi_ulong       interpreter_pt_dynamic_addr;
     59        struct image_info *other_info;
     60
     61        /* For target-specific processing of NT_GNU_PROPERTY_TYPE_0. */
     62        uint32_t        note_flags;
     63
     64#ifdef TARGET_MIPS
     65        int             fp_abi;
     66        int             interp_fp_abi;
     67#endif
     68};
     69
     70#ifdef TARGET_I386
     71/* Information about the current linux thread */
     72struct vm86_saved_state {
     73    uint32_t eax; /* return code */
     74    uint32_t ebx;
     75    uint32_t ecx;
     76    uint32_t edx;
     77    uint32_t esi;
     78    uint32_t edi;
     79    uint32_t ebp;
     80    uint32_t esp;
     81    uint32_t eflags;
     82    uint32_t eip;
     83    uint16_t cs, ss, ds, es, fs, gs;
     84};
     85#endif
     86
     87#if defined(TARGET_ARM) && defined(TARGET_ABI32)
     88/* FPU emulator */
     89#include "nwfpe/fpa11.h"
     90#endif
     91
     92#define MAX_SIGQUEUE_SIZE 1024
     93
     94struct emulated_sigtable {
     95    int pending; /* true if signal is pending */
     96    target_siginfo_t info;
     97};
     98
     99/*
    100 * NOTE: we force a big alignment so that the stack stored after is
    101 * aligned too
    102 */
    103typedef struct TaskState {
    104    pid_t ts_tid;     /* tid (or pid) of this task */
    105#ifdef TARGET_ARM
    106# ifdef TARGET_ABI32
    107    /* FPA state */
    108    FPA11 fpa;
    109# endif
    110#endif
    111#if defined(TARGET_ARM) || defined(TARGET_RISCV)
    112    int swi_errno;
    113#endif
    114#if defined(TARGET_I386) && !defined(TARGET_X86_64)
    115    abi_ulong target_v86;
    116    struct vm86_saved_state vm86_saved_regs;
    117    struct target_vm86plus_struct vm86plus;
    118    uint32_t v86flags;
    119    uint32_t v86mask;
    120#endif
    121    abi_ulong child_tidptr;
    122#ifdef TARGET_M68K
    123    abi_ulong tp_value;
    124#endif
    125#if defined(TARGET_ARM) || defined(TARGET_M68K) || defined(TARGET_RISCV)
    126    /* Extra fields for semihosted binaries.  */
    127    abi_ulong heap_base;
    128    abi_ulong heap_limit;
    129#endif
    130    abi_ulong stack_base;
    131    int used; /* non zero if used */
    132    struct image_info *info;
    133    struct linux_binprm *bprm;
    134
    135    struct emulated_sigtable sync_signal;
    136    struct emulated_sigtable sigtab[TARGET_NSIG];
    137    /*
    138     * This thread's signal mask, as requested by the guest program.
    139     * The actual signal mask of this thread may differ:
    140     *  + we don't let SIGSEGV and SIGBUS be blocked while running guest code
    141     *  + sometimes we block all signals to avoid races
    142     */
    143    sigset_t signal_mask;
    144    /*
    145     * The signal mask imposed by a guest sigsuspend syscall, if we are
    146     * currently in the middle of such a syscall
    147     */
    148    sigset_t sigsuspend_mask;
    149    /* Nonzero if we're leaving a sigsuspend and sigsuspend_mask is valid. */
    150    int in_sigsuspend;
    151
    152    /*
    153     * Nonzero if process_pending_signals() needs to do something (either
    154     * handle a pending signal or unblock signals).
    155     * This flag is written from a signal handler so should be accessed via
    156     * the qatomic_read() and qatomic_set() functions. (It is not accessed
    157     * from multiple threads.)
    158     */
    159    int signal_pending;
    160
    161    /* This thread's sigaltstack, if it has one */
    162    struct target_sigaltstack sigaltstack_used;
    163} __attribute__((aligned(16))) TaskState;
    164
    165abi_long do_brk(abi_ulong new_brk);
    166
    167/* user access */
    168
    169#define VERIFY_READ  PAGE_READ
    170#define VERIFY_WRITE (PAGE_READ | PAGE_WRITE)
    171
    172static inline bool access_ok_untagged(int type, abi_ulong addr, abi_ulong size)
    173{
    174    if (size == 0
    175        ? !guest_addr_valid_untagged(addr)
    176        : !guest_range_valid_untagged(addr, size)) {
    177        return false;
    178    }
    179    return page_check_range((target_ulong)addr, size, type) == 0;
    180}
    181
    182static inline bool access_ok(CPUState *cpu, int type,
    183                             abi_ulong addr, abi_ulong size)
    184{
    185    return access_ok_untagged(type, cpu_untagged_addr(cpu, addr), size);
    186}
    187
    188/* NOTE __get_user and __put_user use host pointers and don't check access.
    189   These are usually used to access struct data members once the struct has
    190   been locked - usually with lock_user_struct.  */
    191
    192/*
    193 * Tricky points:
    194 * - Use __builtin_choose_expr to avoid type promotion from ?:,
    195 * - Invalid sizes result in a compile time error stemming from
    196 *   the fact that abort has no parameters.
    197 * - It's easier to use the endian-specific unaligned load/store
    198 *   functions than host-endian unaligned load/store plus tswapN.
    199 * - The pragmas are necessary only to silence a clang false-positive
    200 *   warning: see https://bugs.llvm.org/show_bug.cgi?id=39113 .
    201 * - gcc has bugs in its _Pragma() support in some versions, eg
    202 *   https://gcc.gnu.org/bugzilla/show_bug.cgi?id=83256 -- so we only
    203 *   include the warning-suppression pragmas for clang
    204 */
    205#if defined(__clang__) && __has_warning("-Waddress-of-packed-member")
    206#define PRAGMA_DISABLE_PACKED_WARNING                                   \
    207    _Pragma("GCC diagnostic push");                                     \
    208    _Pragma("GCC diagnostic ignored \"-Waddress-of-packed-member\"")
    209
    210#define PRAGMA_REENABLE_PACKED_WARNING          \
    211    _Pragma("GCC diagnostic pop")
    212
    213#else
    214#define PRAGMA_DISABLE_PACKED_WARNING
    215#define PRAGMA_REENABLE_PACKED_WARNING
    216#endif
    217
    218#define __put_user_e(x, hptr, e)                                            \
    219    do {                                                                    \
    220        PRAGMA_DISABLE_PACKED_WARNING;                                      \
    221        (__builtin_choose_expr(sizeof(*(hptr)) == 1, stb_p,                 \
    222        __builtin_choose_expr(sizeof(*(hptr)) == 2, stw_##e##_p,            \
    223        __builtin_choose_expr(sizeof(*(hptr)) == 4, stl_##e##_p,            \
    224        __builtin_choose_expr(sizeof(*(hptr)) == 8, stq_##e##_p, abort))))  \
    225            ((hptr), (x)), (void)0);                                        \
    226        PRAGMA_REENABLE_PACKED_WARNING;                                     \
    227    } while (0)
    228
    229#define __get_user_e(x, hptr, e)                                            \
    230    do {                                                                    \
    231        PRAGMA_DISABLE_PACKED_WARNING;                                      \
    232        ((x) = (typeof(*hptr))(                                             \
    233        __builtin_choose_expr(sizeof(*(hptr)) == 1, ldub_p,                 \
    234        __builtin_choose_expr(sizeof(*(hptr)) == 2, lduw_##e##_p,           \
    235        __builtin_choose_expr(sizeof(*(hptr)) == 4, ldl_##e##_p,            \
    236        __builtin_choose_expr(sizeof(*(hptr)) == 8, ldq_##e##_p, abort))))  \
    237            (hptr)), (void)0);                                              \
    238        PRAGMA_REENABLE_PACKED_WARNING;                                     \
    239    } while (0)
    240
    241
    242#ifdef TARGET_WORDS_BIGENDIAN
    243# define __put_user(x, hptr)  __put_user_e(x, hptr, be)
    244# define __get_user(x, hptr)  __get_user_e(x, hptr, be)
    245#else
    246# define __put_user(x, hptr)  __put_user_e(x, hptr, le)
    247# define __get_user(x, hptr)  __get_user_e(x, hptr, le)
    248#endif
    249
    250/* put_user()/get_user() take a guest address and check access */
    251/* These are usually used to access an atomic data type, such as an int,
    252 * that has been passed by address.  These internally perform locking
    253 * and unlocking on the data type.
    254 */
    255#define put_user(x, gaddr, target_type)					\
    256({									\
    257    abi_ulong __gaddr = (gaddr);					\
    258    target_type *__hptr;						\
    259    abi_long __ret = 0;							\
    260    if ((__hptr = lock_user(VERIFY_WRITE, __gaddr, sizeof(target_type), 0))) { \
    261        __put_user((x), __hptr);				\
    262        unlock_user(__hptr, __gaddr, sizeof(target_type));		\
    263    } else								\
    264        __ret = -TARGET_EFAULT;						\
    265    __ret;								\
    266})
    267
    268#define get_user(x, gaddr, target_type)					\
    269({									\
    270    abi_ulong __gaddr = (gaddr);					\
    271    target_type *__hptr;						\
    272    abi_long __ret = 0;							\
    273    if ((__hptr = lock_user(VERIFY_READ, __gaddr, sizeof(target_type), 1))) { \
    274        __get_user((x), __hptr);				\
    275        unlock_user(__hptr, __gaddr, 0);				\
    276    } else {								\
    277        /* avoid warning */						\
    278        (x) = 0;							\
    279        __ret = -TARGET_EFAULT;						\
    280    }									\
    281    __ret;								\
    282})
    283
    284#define put_user_ual(x, gaddr) put_user((x), (gaddr), abi_ulong)
    285#define put_user_sal(x, gaddr) put_user((x), (gaddr), abi_long)
    286#define put_user_u64(x, gaddr) put_user((x), (gaddr), uint64_t)
    287#define put_user_s64(x, gaddr) put_user((x), (gaddr), int64_t)
    288#define put_user_u32(x, gaddr) put_user((x), (gaddr), uint32_t)
    289#define put_user_s32(x, gaddr) put_user((x), (gaddr), int32_t)
    290#define put_user_u16(x, gaddr) put_user((x), (gaddr), uint16_t)
    291#define put_user_s16(x, gaddr) put_user((x), (gaddr), int16_t)
    292#define put_user_u8(x, gaddr)  put_user((x), (gaddr), uint8_t)
    293#define put_user_s8(x, gaddr)  put_user((x), (gaddr), int8_t)
    294
    295#define get_user_ual(x, gaddr) get_user((x), (gaddr), abi_ulong)
    296#define get_user_sal(x, gaddr) get_user((x), (gaddr), abi_long)
    297#define get_user_u64(x, gaddr) get_user((x), (gaddr), uint64_t)
    298#define get_user_s64(x, gaddr) get_user((x), (gaddr), int64_t)
    299#define get_user_u32(x, gaddr) get_user((x), (gaddr), uint32_t)
    300#define get_user_s32(x, gaddr) get_user((x), (gaddr), int32_t)
    301#define get_user_u16(x, gaddr) get_user((x), (gaddr), uint16_t)
    302#define get_user_s16(x, gaddr) get_user((x), (gaddr), int16_t)
    303#define get_user_u8(x, gaddr)  get_user((x), (gaddr), uint8_t)
    304#define get_user_s8(x, gaddr)  get_user((x), (gaddr), int8_t)
    305
    306/* copy_from_user() and copy_to_user() are usually used to copy data
    307 * buffers between the target and host.  These internally perform
    308 * locking/unlocking of the memory.
    309 */
    310int copy_from_user(void *hptr, abi_ulong gaddr, ssize_t len);
    311int copy_to_user(abi_ulong gaddr, void *hptr, ssize_t len);
    312
    313/* Functions for accessing guest memory.  The tget and tput functions
    314   read/write single values, byteswapping as necessary.  The lock_user function
    315   gets a pointer to a contiguous area of guest memory, but does not perform
    316   any byteswapping.  lock_user may return either a pointer to the guest
    317   memory, or a temporary buffer.  */
    318
    319/* Lock an area of guest memory into the host.  If copy is true then the
    320   host area will have the same contents as the guest.  */
    321void *lock_user(int type, abi_ulong guest_addr, ssize_t len, bool copy);
    322
    323/* Unlock an area of guest memory.  The first LEN bytes must be
    324   flushed back to guest memory. host_ptr = NULL is explicitly
    325   allowed and does nothing. */
    326#ifndef DEBUG_REMAP
    327static inline void unlock_user(void *host_ptr, abi_ulong guest_addr,
    328                               ssize_t len)
    329{
    330    /* no-op */
    331}
    332#else
    333void unlock_user(void *host_ptr, abi_ulong guest_addr, ssize_t len);
    334#endif
    335
    336/* Return the length of a string in target memory or -TARGET_EFAULT if
    337   access error. */
    338ssize_t target_strlen(abi_ulong gaddr);
    339
    340/* Like lock_user but for null terminated strings.  */
    341void *lock_user_string(abi_ulong guest_addr);
    342
    343/* Helper macros for locking/unlocking a target struct.  */
    344#define lock_user_struct(type, host_ptr, guest_addr, copy)	\
    345    (host_ptr = lock_user(type, guest_addr, sizeof(*host_ptr), copy))
    346#define unlock_user_struct(host_ptr, guest_addr, copy)		\
    347    unlock_user(host_ptr, guest_addr, (copy) ? sizeof(*host_ptr) : 0)
    348
    349#endif /* QEMU_H */