From patchwork Mon Dec 6 15:06:05 2010 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Peter Maydell X-Patchwork-Id: 74378 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from lists.gnu.org (lists.gnu.org [199.232.76.165]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client did not present a certificate) by ozlabs.org (Postfix) with ESMTPS id CB18FB7080 for ; Tue, 7 Dec 2010 02:09:12 +1100 (EST) Received: from localhost ([127.0.0.1]:58100 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.43) id 1PPcgf-0008Qq-H2 for incoming@patchwork.ozlabs.org; Mon, 06 Dec 2010 10:09:09 -0500 Received: from [140.186.70.92] (port=38887 helo=eggs.gnu.org) by lists.gnu.org with esmtp (Exim 4.43) id 1PPcdv-0007oA-Cw for qemu-devel@nongnu.org; Mon, 06 Dec 2010 10:06:20 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1PPcdt-0002IL-5R for qemu-devel@nongnu.org; Mon, 06 Dec 2010 10:06:19 -0500 Received: from mnementh.archaic.org.uk ([81.2.115.146]:29512) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1PPcds-0002Gh-Ql for qemu-devel@nongnu.org; Mon, 06 Dec 2010 10:06:17 -0500 Received: from pm215 by mnementh.archaic.org.uk with local (Exim 4.69) (envelope-from ) id 1PPcdi-0007bj-8X; Mon, 06 Dec 2010 15:06:06 +0000 From: Peter Maydell To: qemu-devel@nongnu.org Date: Mon, 6 Dec 2010 15:06:05 +0000 Message-Id: <1291647966-29220-2-git-send-email-peter.maydell@linaro.org> X-Mailer: git-send-email 1.7.1 In-Reply-To: <1291647966-29220-1-git-send-email-peter.maydell@linaro.org> References: <1291647966-29220-1-git-send-email-peter.maydell@linaro.org> X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.6 (newer, 2) Cc: Riku Voipio , Wolfgang Schildbach , Nathan Froyd Subject: [Qemu-devel] [PATCH 1/2] Fix commandline handling for ARM semihosted executables X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: qemu-devel.nongnu.org List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org Errors-To: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org From: Wolfgang Schildbach Use the copy of the command line that loader_build_argptr() sets up in guest memory as the command line to return from the ARM SYS_GET_CMDLINE semihosting call. Previously we were using a pointer to memory which had already been freed before the guest program started. This fixes https://bugs.launchpad.net/qemu/+bug/673613 . Signed-off-by: Wolfgang Schildbach Reviewed-by: Peter Maydell --- arm-semi.c | 79 +++++++++++++++++++++++++++++++++++++---------------------- 1 files changed, 49 insertions(+), 30 deletions(-) diff --git a/arm-semi.c b/arm-semi.c index 0687b03..1d5179b 100644 --- a/arm-semi.c +++ b/arm-semi.c @@ -373,45 +373,64 @@ uint32_t do_arm_semihosting(CPUState *env) #ifdef CONFIG_USER_ONLY /* Build a commandline from the original argv. */ { - char **arg = ts->info->host_argv; - int len = ARG(1); - /* lock the buffer on the ARM side */ - char *cmdline_buffer = (char*)lock_user(VERIFY_WRITE, ARG(0), len, 0); + char *arm_cmdline_buffer; + const char *host_cmdline_buffer; - if (!cmdline_buffer) - /* FIXME - should this error code be -TARGET_EFAULT ? */ - return (uint32_t)-1; + unsigned int i; + unsigned int arm_cmdline_len = ARG(1); + unsigned int host_cmdline_len = + ts->info->arg_end-ts->info->arg_start; + + if (!arm_cmdline_len || host_cmdline_len > arm_cmdline_len) { + return -1; /* not enough space to store command line */ + } - s = cmdline_buffer; - while (*arg && len > 2) { - int n = strlen(*arg); + if (!host_cmdline_len) { + /* We special-case the "empty command line" case (argc==0). + Just provide the terminating 0. */ + arm_cmdline_buffer = lock_user(VERIFY_WRITE, ARG(0), 1, 0); + arm_cmdline_buffer[0] = 0; + unlock_user(arm_cmdline_buffer, ARG(0), 1); - if (s != cmdline_buffer) { - *(s++) = ' '; - len--; - } - if (n >= len) - n = len - 1; - memcpy(s, *arg, n); - s += n; - len -= n; - arg++; + /* Adjust the commandline length argument. */ + SET_ARG(1, 0); + return 0; } - /* Null terminate the string. */ - *s = 0; - len = s - cmdline_buffer; - /* Unlock the buffer on the ARM side. */ - unlock_user(cmdline_buffer, ARG(0), len); + /* lock the buffers on the ARM side */ + arm_cmdline_buffer = + lock_user(VERIFY_WRITE, ARG(0), host_cmdline_len, 0); + host_cmdline_buffer = + lock_user(VERIFY_READ, ts->info->arg_start, + host_cmdline_len, 1); - /* Adjust the commandline length argument. */ - SET_ARG(1, len); + if (arm_cmdline_buffer && host_cmdline_buffer) + { + /* the last argument is zero-terminated; + no need for additional termination */ + memcpy(arm_cmdline_buffer, host_cmdline_buffer, + host_cmdline_len); - /* Return success if commandline fit into buffer. */ - return *arg ? -1 : 0; + /* separate arguments by white spaces */ + for (i = 0; i < host_cmdline_len-1; i++) { + if (arm_cmdline_buffer[i] == 0) { + arm_cmdline_buffer[i] = ' '; + } + } + + /* Adjust the commandline length argument. */ + SET_ARG(1, host_cmdline_len-1); + } + + /* Unlock the buffers on the ARM side. */ + unlock_user(arm_cmdline_buffer, ARG(0), host_cmdline_len); + unlock_user((void*)host_cmdline_buffer, ts->info->arg_start, 0); + + /* Return success if we could return a commandline. */ + return (arm_cmdline_buffer && host_cmdline_buffer) ? 0 : -1; } #else - return -1; + return -1; #endif case SYS_HEAPINFO: {