| 1 | /* User memory access */ |
| 2 | #include "qemu/osdep.h" |
| 3 | #include "qemu/cutils.h" |
| 4 | |
| 5 | #include "qemu.h" |
| 6 | #include "user-internals.h" |
| 7 | |
| 8 | void *lock_user(int type, abi_ulong guest_addr, ssize_t len, bool copy) |
| 9 | { |
| 10 | void *host_addr; |
| 11 | |
| 12 | guest_addr = cpu_untagged_addr(thread_cpu, guest_addr); |
| 13 | if (!access_ok_untagged(type, guest_addr, len)) { |
| 14 | return NULL; |
| 15 | } |
| 16 | host_addr = g2h_untagged(guest_addr); |
| 17 | #ifdef CONFIG_DEBUG_REMAP |
| 18 | if (copy) { |
| 19 | host_addr = g_memdup(host_addr, len); |
| 20 | } else { |
| 21 | host_addr = g_malloc0(len); |
| 22 | } |
| 23 | #endif |
| 24 | return host_addr; |
| 25 | } |
| 26 | |
| 27 | #ifdef CONFIG_DEBUG_REMAP |
| 28 | void unlock_user(void *host_ptr, abi_ulong guest_addr, ssize_t len) |
| 29 | { |
| 30 | void *host_ptr_conv; |
| 31 | |
| 32 | if (!host_ptr) { |
| 33 | return; |
| 34 | } |
| 35 | host_ptr_conv = g2h(thread_cpu, guest_addr); |
| 36 | if (host_ptr == host_ptr_conv) { |
| 37 | return; |
| 38 | } |
| 39 | if (len > 0) { |
| 40 | memcpy(host_ptr_conv, host_ptr, len); |
| 41 | } |
| 42 | g_free(host_ptr); |
| 43 | } |
| 44 | #endif |
| 45 | |
| 46 | void *lock_user_string(abi_ulong guest_addr) |
| 47 | { |
| 48 | ssize_t len = target_strlen(guest_addr); |
| 49 | if (len < 0) { |
| 50 | return NULL; |
| 51 | } |
| 52 | return lock_user(VERIFY_READ, guest_addr, len + 1, 1); |
| 53 | } |
| 54 | |
| 55 | /* copy_from_user() and copy_to_user() are usually used to copy data |
| 56 | * buffers between the target and host. These internally perform |
| 57 | * locking/unlocking of the memory. |
| 58 | */ |
| 59 | int copy_from_user(void *hptr, abi_ulong gaddr, ssize_t len) |
| 60 | { |
| 61 | int ret = 0; |
| 62 | void *ghptr = lock_user(VERIFY_READ, gaddr, len, 1); |
| 63 | |
| 64 | if (ghptr) { |
| 65 | memcpy(hptr, ghptr, len); |
| 66 | unlock_user(ghptr, gaddr, 0); |
| 67 | } else { |
| 68 | ret = -TARGET_EFAULT; |
| 69 | } |
| 70 | return ret; |
| 71 | } |
| 72 | |
| 73 | int copy_to_user(abi_ulong gaddr, void *hptr, ssize_t len) |
| 74 | { |
| 75 | int ret = 0; |
| 76 | void *ghptr = lock_user(VERIFY_WRITE, gaddr, len, 0); |
| 77 | |
| 78 | if (ghptr) { |
| 79 | memcpy(ghptr, hptr, len); |
| 80 | unlock_user(ghptr, gaddr, len); |
| 81 | } else { |
| 82 | ret = -TARGET_EFAULT; |
| 83 | } |
| 84 | |
| 85 | return ret; |
| 86 | } |
| 87 | |
| 88 | /* Return the length of a string in target memory or -TARGET_EFAULT if |
| 89 | access error */ |
| 90 | ssize_t target_strlen(abi_ulong guest_addr1) |
| 91 | { |
| 92 | uint8_t *ptr; |
| 93 | abi_ulong guest_addr; |
| 94 | size_t max_len, len; |
| 95 | |
| 96 | guest_addr = guest_addr1; |
| 97 | for(;;) { |
| 98 | max_len = TARGET_PAGE_SIZE - (guest_addr & ~TARGET_PAGE_MASK); |
| 99 | ptr = lock_user(VERIFY_READ, guest_addr, max_len, 1); |
| 100 | if (!ptr) |
| 101 | return -TARGET_EFAULT; |
| 102 | len = strnlen((const char *)ptr, max_len); |
| 103 | unlock_user(ptr, guest_addr, 0); |
| 104 | guest_addr += len; |
| 105 | /* we don't allow wrapping or integer overflow */ |
| 106 | if (guest_addr == 0 || (guest_addr - guest_addr1) > 0x7fffffff) { |
| 107 | return -TARGET_EFAULT; |
| 108 | } |
| 109 | if (len != max_len) { |
| 110 | break; |
| 111 | } |
| 112 | } |
| 113 | return guest_addr - guest_addr1; |
| 114 | } |