[PATCH 1/2] linux-user: Implement finer grained madivse() syscall

[PATCH 1/2] linux-user: Implement finer grained madivse() syscall

[Helge Deller]

From: Helge Deller <deller@gmx.de>

Although most madvise() values are hints, some are important and are
checked by userspace, especially by security-relevant applications like
BoringSLL.  So, return -EINVAL for those functions which we don't emulate.

Signed-off-by: Helge Deller <deller@gmx.de>
Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3489
---
 linux-user/mmap.c | 32 +++++++++++++++++++++++++++++++-
 1 file changed, 31 insertions(+), 1 deletion(-)

diff --git a/linux-user/mmap.c b/linux-user/mmap.c
index b4b7b3e5cc..50916c29a5 100644
--- a/linux-user/mmap.c
+++ b/linux-user/mmap.c
@@ -1282,7 +1282,7 @@ abi_long target_madvise(abi_ulong start, abi_ulong len_in, int advice)
     case TARGET_MADV_KEEPONFORK:    /* parisc */
         advice = MADV_KEEPONFORK;
         break;
-    /* we do not care about the other MADV_xxx values yet */
+    /* all other MADV_xxx values are the same across architectures */
     }
 
     /*
@@ -1307,6 +1307,19 @@ abi_long target_madvise(abi_ulong start, abi_ulong len_in, int advice)
      */
     mmap_lock();
     switch (advice) {
+    case MADV_NORMAL:
+    case MADV_RANDOM:
+    case MADV_SEQUENTIAL:
+    case MADV_WILLNEED:
+    case MADV_DOFORK:
+    case MADV_FREE:
+    case MADV_COLD:
+    case MADV_PAGEOUT:
+        ret = 0; /* OK */
+        break;
+    case MADV_REMOVE:
+        ret = -EOPNOTSUPP;
+        break;
     case MADV_DONTDUMP:
         page_set_flags(start, start + len - 1, PAGE_DONTDUMP, 0);
         break;
@@ -1324,6 +1337,23 @@ abi_long target_madvise(abi_ulong start, abi_ulong len_in, int advice)
                 page_reset_target_data(start, start + len - 1);
             }
         }
+        break;
+    case MADV_DONTFORK:
+    case MADV_MERGEABLE:
+    case MADV_UNMERGEABLE:
+    case MADV_HWPOISON:
+    case MADV_HUGEPAGE:
+    case MADV_NOHUGEPAGE:
+    case MADV_COLLAPSE:
+    case MADV_POPULATE_READ:
+    case MADV_POPULATE_WRITE:
+    case -1:    /* BoringSSL uses -1 to check if the environment is broken */
+        ret = -EINVAL;
+        break;
+    default:
+        qemu_log_mask(LOG_UNIMP, "Unhandled madvise(%d) call.\n", advice);
+        ret = -EINVAL; /* not yet known advise */
+        break;
     }
     mmap_unlock();
 
-- 
2.54.0

[PATCH 2/2] linux-user: Fix loading static ARM cortex-m55 binaries

[Helge Deller]

From: Helge Deller <deller@gmx.de>

Static built ARM binaries for Cortex-m55 may have been linked to have
their load address at address 0 (because they are effectively a
bare-metal image). When qemu-user is running as non-root user and will
try to mmap() a host address at 0 (which is smaller than mmap_min_addr
according to /proc/sys/vm/mmap_min_addr), it will fail with EPERM and as
such loading those guest program will fail.

Fix pgb_addr_set() to always return false if the guest_loaddr <
mmap_min_addr, that way a valdid guest_base address will be calculated
and the EPERM can be avoided.

Signed-off-by: Helge Deller <deller@gmx.de>
Suggested-by: Peter Maydell <peter.maydell@linaro.org>
Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/1890
---
 linux-user/elfload.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index 0e757787d2..77e0526996 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -866,7 +866,7 @@ static bool pgb_addr_set(PGBAddrs *ga, abi_ulong guest_loaddr,
         if (LO_COMMPAGE != -1 && LO_COMMPAGE < mmap_min_addr) {
             return false;
         }
-        if (guest_loaddr != 0 && guest_loaddr < mmap_min_addr) {
+        if (guest_loaddr < mmap_min_addr) {
             return false;
         }
     }
-- 
2.54.0

Re: [PATCH 2/2] linux-user: Fix loading static ARM cortex-m55 binaries

[Richard Henderson]

On 5/26/26 07:50, Helge Deller wrote:
> From: Helge Deller <deller@gmx.de>
> 
> Static built ARM binaries for Cortex-m55 may have been linked to have
> their load address at address 0 (because they are effectively a
> bare-metal image). When qemu-user is running as non-root user and will
> try to mmap() a host address at 0 (which is smaller than mmap_min_addr
> according to /proc/sys/vm/mmap_min_addr), it will fail with EPERM and as
> such loading those guest program will fail.
> 
> Fix pgb_addr_set() to always return false if the guest_loaddr <
> mmap_min_addr, that way a valdid guest_base address will be calculated
> and the EPERM can be avoided.
> 
> Signed-off-by: Helge Deller <deller@gmx.de>
> Suggested-by: Peter Maydell <peter.maydell@linaro.org>
> Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/1890
> ---
>   linux-user/elfload.c | 2 +-
>   1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/linux-user/elfload.c b/linux-user/elfload.c
> index 0e757787d2..77e0526996 100644
> --- a/linux-user/elfload.c
> +++ b/linux-user/elfload.c
> @@ -866,7 +866,7 @@ static bool pgb_addr_set(PGBAddrs *ga, abi_ulong guest_loaddr,
>           if (LO_COMMPAGE != -1 && LO_COMMPAGE < mmap_min_addr) {
>               return false;
>           }
> -        if (guest_loaddr != 0 && guest_loaddr < mmap_min_addr) {
> +        if (guest_loaddr < mmap_min_addr) {
>               return false;
>           }
>       }

Nack for ET_DYN aka PIE binaries.


r~

Re: [PATCH 1/2] linux-user: Implement finer grained madivse() syscall

[Richard Henderson]

On 5/26/26 07:50, Helge Deller wrote:
> From: Helge Deller<deller@gmx.de>
> 
> Although most madvise() values are hints, some are important and are
> checked by userspace, especially by security-relevant applications like
> BoringSLL.  So, return -EINVAL for those functions which we don't emulate.
> 
> Signed-off-by: Helge Deller<deller@gmx.de>
> Resolves:https://gitlab.com/qemu-project/qemu/-/work_items/3489
> ---
>   linux-user/mmap.c | 32 +++++++++++++++++++++++++++++++-
>   1 file changed, 31 insertions(+), 1 deletion(-)

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>

r~