xref: /openbmc/qemu/linux-user/uaccess.c (revision 1f2355f5)
1 /* User memory access */
2 #include "qemu/osdep.h"
3 #include "qemu/cutils.h"
4 
5 #include "qemu.h"
6 #include "user-internals.h"
7 
lock_user(int type,abi_ulong guest_addr,ssize_t len,bool copy)8 void *lock_user(int type, abi_ulong guest_addr, ssize_t len, bool copy)
9 {
10     void *host_addr;
11 
12     guest_addr = cpu_untagged_addr(thread_cpu, guest_addr);
13     if (!access_ok_untagged(type, guest_addr, len)) {
14         return NULL;
15     }
16     host_addr = g2h_untagged(guest_addr);
17 #ifdef CONFIG_DEBUG_REMAP
18     if (copy) {
19         host_addr = g_memdup(host_addr, len);
20     } else {
21         host_addr = g_malloc0(len);
22     }
23 #endif
24     return host_addr;
25 }
26 
27 #ifdef CONFIG_DEBUG_REMAP
unlock_user(void * host_ptr,abi_ulong guest_addr,ssize_t len)28 void unlock_user(void *host_ptr, abi_ulong guest_addr, ssize_t len)
29 {
30     void *host_ptr_conv;
31 
32     if (!host_ptr) {
33         return;
34     }
35     host_ptr_conv = g2h(thread_cpu, guest_addr);
36     if (host_ptr == host_ptr_conv) {
37         return;
38     }
39     if (len > 0) {
40         memcpy(host_ptr_conv, host_ptr, len);
41     }
42     g_free(host_ptr);
43 }
44 #endif
45 
lock_user_string(abi_ulong guest_addr)46 void *lock_user_string(abi_ulong guest_addr)
47 {
48     ssize_t len = target_strlen(guest_addr);
49     if (len < 0) {
50         return NULL;
51     }
52     return lock_user(VERIFY_READ, guest_addr, len + 1, 1);
53 }
54 
55 /* copy_from_user() and copy_to_user() are usually used to copy data
56  * buffers between the target and host.  These internally perform
57  * locking/unlocking of the memory.
58  */
copy_from_user(void * hptr,abi_ulong gaddr,ssize_t len)59 int copy_from_user(void *hptr, abi_ulong gaddr, ssize_t len)
60 {
61     int ret = 0;
62     void *ghptr = lock_user(VERIFY_READ, gaddr, len, 1);
63 
64     if (ghptr) {
65         memcpy(hptr, ghptr, len);
66         unlock_user(ghptr, gaddr, 0);
67     } else {
68         ret = -TARGET_EFAULT;
69     }
70     return ret;
71 }
72 
copy_to_user(abi_ulong gaddr,void * hptr,ssize_t len)73 int copy_to_user(abi_ulong gaddr, void *hptr, ssize_t len)
74 {
75     int ret = 0;
76     void *ghptr = lock_user(VERIFY_WRITE, gaddr, len, 0);
77 
78     if (ghptr) {
79         memcpy(ghptr, hptr, len);
80         unlock_user(ghptr, gaddr, len);
81     } else {
82         ret = -TARGET_EFAULT;
83     }
84 
85     return ret;
86 }
87 
88 /* Return the length of a string in target memory or -TARGET_EFAULT if
89    access error  */
target_strlen(abi_ulong guest_addr1)90 ssize_t target_strlen(abi_ulong guest_addr1)
91 {
92     uint8_t *ptr;
93     abi_ulong guest_addr;
94     size_t max_len, len;
95 
96     guest_addr = guest_addr1;
97     for(;;) {
98         max_len = TARGET_PAGE_SIZE - (guest_addr & ~TARGET_PAGE_MASK);
99         ptr = lock_user(VERIFY_READ, guest_addr, max_len, 1);
100         if (!ptr)
101             return -TARGET_EFAULT;
102         len = qemu_strnlen((const char *)ptr, max_len);
103         unlock_user(ptr, guest_addr, 0);
104         guest_addr += len;
105         /* we don't allow wrapping or integer overflow */
106         if (guest_addr == 0 || (guest_addr - guest_addr1) > 0x7fffffff) {
107             return -TARGET_EFAULT;
108         }
109         if (len != max_len) {
110             break;
111         }
112     }
113     return guest_addr - guest_addr1;
114 }
115