qemu/semihosting/uaccess.c
Richard Henderson 3d5e2b4f26 semihosting: Simplify softmmu_lock_user_string
We are not currently bounding the search to the 1024 bytes
that we allocated, possibly overrunning the buffer.
Use softmmu_strlen_user to find the length and allocate the
correct size from the beginning.

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2022-06-28 04:35:06 +05:30

92 lines
2.3 KiB
C

/*
* Helper routines to provide target memory access for semihosting
* syscalls in system emulation mode.
*
* Copyright (c) 2007 CodeSourcery.
*
* This code is licensed under the GPL
*/
#include "qemu/osdep.h"
#include "exec/exec-all.h"
#include "semihosting/softmmu-uaccess.h"
void *softmmu_lock_user(CPUArchState *env, target_ulong addr,
target_ulong len, bool copy)
{
void *p = malloc(len);
if (p && copy) {
if (cpu_memory_rw_debug(env_cpu(env), addr, p, len, 0)) {
free(p);
p = NULL;
}
}
return p;
}
ssize_t softmmu_strlen_user(CPUArchState *env, target_ulong addr)
{
int mmu_idx = cpu_mmu_index(env, false);
size_t len = 0;
while (1) {
size_t left_in_page;
int flags;
void *h;
/* Find the number of bytes remaining in the page. */
left_in_page = TARGET_PAGE_SIZE - (addr & ~TARGET_PAGE_MASK);
flags = probe_access_flags(env, addr, MMU_DATA_LOAD,
mmu_idx, true, &h, 0);
if (flags & TLB_INVALID_MASK) {
return -1;
}
if (flags & TLB_MMIO) {
do {
uint8_t c;
if (cpu_memory_rw_debug(env_cpu(env), addr, &c, 1, 0)) {
return -1;
}
if (c == 0) {
return len;
}
addr++;
len++;
if (len > INT32_MAX) {
return -1;
}
} while (--left_in_page != 0);
} else {
char *p = memchr(h, 0, left_in_page);
if (p) {
len += p - (char *)h;
return len <= INT32_MAX ? (ssize_t)len : -1;
}
addr += left_in_page;
len += left_in_page;
if (len > INT32_MAX) {
return -1;
}
}
}
}
char *softmmu_lock_user_string(CPUArchState *env, target_ulong addr)
{
ssize_t len = softmmu_strlen_user(env, addr);
if (len < 0) {
return NULL;
}
return softmmu_lock_user(env, addr, len + 1, true);
}
void softmmu_unlock_user(CPUArchState *env, void *p,
target_ulong addr, target_ulong len)
{
if (len) {
cpu_memory_rw_debug(env_cpu(env), addr, p, len, 1);
}
free(p);
}