Re: [Qemu-devel] [PATCH v4 2/2] Build usermode targets as PIE

Re: [Qemu-devel] [PATCH v4 2/2] Build usermode targets as PIE

[Arnaud Patard]

"Kirill A. Shutemov" <kirill@shutemov.name> writes:

Hi,

[...]

> +cat > $TMPC <<EOF
> +int main() {
> +	static __thread int i = 0;
> +	i++;
> +	return 0;
> +}
> +EOF
> +
> +if test "$user_pie" != "no" ; then
> +    if compile_prog "-fpie" "-pie -Wl,--fatal-warnings -Wl,--warn-shared-textrel"; then
> +        user_pie="yes"
> +    else
> +        if test "$user_pie" = "yes"; then
> +            echo "Toolchain has no proper PIE support"
> +            exit 1
> +        else
> +            user_pie="no"
> +        fi
> +    fi
> +fi

Unfortunately, the broken mips toolchain pass this test. When you
compile, you're getting no warning at all. Moreover, the failure is
triggered at run-time (and this test doesn't trigger it). See
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=526961 if you want
something which segfault with pie.
I don't know if there are some other non-mips toolchains with broken pie
and what's their behaviour. I hope it's crashing too...


Arnaud

Re: [Qemu-devel] [PATCH v4 2/2] Build usermode targets as PIE

[Kirill A. Shutemov]

On Fri, Sep 4, 2009 at 12:58 PM, Arnaud Patard<arnaud.patard@rtp-net.org> wrote:
> "Kirill A. Shutemov" <kirill@shutemov.name> writes:
>
> Hi,
>
> [...]
>
>> +cat > $TMPC <<EOF
>> +int main() {
>> +     static __thread int i = 0;
>> +     i++;
>> +     return 0;
>> +}
>> +EOF
>> +
>> +if test "$user_pie" != "no" ; then
>> +    if compile_prog "-fpie" "-pie -Wl,--fatal-warnings -Wl,--warn-shared-textrel"; then
>> +        user_pie="yes"
>> +    else
>> +        if test "$user_pie" = "yes"; then
>> +            echo "Toolchain has no proper PIE support"
>> +            exit 1
>> +        else
>> +            user_pie="no"
>> +        fi
>> +    fi
>> +fi
>
> Unfortunately, the broken mips toolchain pass this test. When you
> compile, you're getting no warning at all. Moreover, the failure is
> triggered at run-time (and this test doesn't trigger it). See
> http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=526961 if you want
> something which segfault with pie.
> I don't know if there are some other non-mips toolchains with broken pie
> and what's their behaviour. I hope it's crashing too...

Where can I get a mips cross-compiler with this issue to play?

[Qemu-devel] [PATCH v4 1/2] Do not link usermode targets with libhw*.a

[Kirill A. Shutemov]

Usermode targets are hardware-independed.

Signed-off-by: Kirill A. Shutemov <kirill@shutemov.name>
Acked-by: Juan Quintela <quintela@redhat.com>
---
 configure |    4 ++--
 1 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/configure b/configure
index b805f10..0d0162a 100755
--- a/configure
+++ b/configure
@@ -2173,15 +2173,15 @@ case "$target_arch2" in
       echo "KVM_CFLAGS=$kvm_cflags" >> $config_mak
     fi
 esac
-echo "HWLIB=../libhw$target_phys_bits/libqemuhw$target_phys_bits.a" >> $config_mak
 echo "TARGET_PHYS_ADDR_BITS=$target_phys_bits" >> $config_mak
-echo "subdir-$target: subdir-libhw$target_phys_bits" >> $config_host_mak
 if test "$target_bigendian" = "yes" ; then
   echo "TARGET_WORDS_BIGENDIAN=y" >> $config_mak
 fi
 if test "$target_softmmu" = "yes" ; then
   echo "CONFIG_SOFTMMU=y" >> $config_mak
   echo "LIBS+=$libs_softmmu" >> $config_mak
+  echo "HWLIB=../libhw$target_phys_bits/libqemuhw$target_phys_bits.a" >> $config_mak
+  echo "subdir-$target: subdir-libhw$target_phys_bits" >> $config_host_mak
 fi
 if test "$target_user_only" = "yes" ; then
   echo "CONFIG_USER_ONLY=y" >> $config_mak
-- 
1.6.4.2

[Qemu-devel] [PATCH v4 2/2] Build usermode targets as PIE

[Kirill A. Shutemov]

Long since, qemu on i386 has a linking hack which produces an executable
which looks like PIE, but it always has text relocations since all
object files compiled without -fpie.

The best was to solve the issue is to build a true PIE.

v4:
  - Add test for toolchain if it has proper PIE support

v3:
  - One more pice of the hack was removed
  - Description updated

v2:
  - Add configure options do enable/disable PIE for usermode targets.
    Disabling can be useful if you build uswing toolchain which has
    broken PIE support. PIE for usermode targets enabled by default.

Signed-off-by: Kirill A. Shutemov <kirill@shutemov.name>
---
 Makefile          |   10 +---------
 Makefile.target   |   19 +++++++++++++++----
 configure         |   49 ++++++++++++++++++++++++++++++++++++++-----------
 linux-user/main.c |   26 --------------------------
 4 files changed, 54 insertions(+), 50 deletions(-)

diff --git a/Makefile b/Makefile
index bdac9b3..634ea81 100644
--- a/Makefile
+++ b/Makefile
@@ -39,8 +39,6 @@ subdir-%:
 	$(call quiet-command,$(MAKE) $(SUBDIR_MAKEFLAGS) -C $* V="$(V)" TARGET_DIR="$*/" all,)
 
 $(filter %-softmmu,$(SUBDIR_RULES)): libqemu_common.a
-$(filter %-user,$(SUBDIR_RULES)): libqemu_user.a
-
 
 ROMSUBDIR_RULES=$(patsubst %,romsubdir-%, $(ROMS))
 romsubdir-%:
@@ -74,7 +72,7 @@ block-obj-y +=  $(addprefix block/, $(block-nested-y))
 # CPUs and machines.
 
 obj-y = $(block-obj-y)
-obj-y += readline.o console.o host-utils.o
+obj-y += readline.o console.o
 
 obj-y += irq.o ptimer.o
 obj-y += i2c.o smbus.o smbus_eeprom.o max7310.o max111x.o wm8750.o
@@ -161,12 +159,6 @@ bt-host.o: QEMU_CFLAGS += $(BLUEZ_CFLAGS)
 
 libqemu_common.a: $(obj-y)
 
-#######################################################################
-# user-obj-y is code used by qemu userspace emulation
-user-obj-y = cutils.o cache-utils.o path.o envlist.o host-utils.o
-
-libqemu_user.a: $(user-obj-y)
-
 ######################################################################
 
 qemu-img.o: qemu-img-cmds.h
diff --git a/Makefile.target b/Makefile.target
index f7d1919..f738617 100644
--- a/Makefile.target
+++ b/Makefile.target
@@ -31,7 +31,7 @@ all: $(PROGS)
 
 #########################################################
 # cpu emulator library
-libobj-y = exec.o translate-all.o cpu-exec.o translate.o
+libobj-y = exec.o translate-all.o cpu-exec.o translate.o host-utils.o
 libobj-y += tcg/tcg.o tcg/tcg-runtime.o
 libobj-$(CONFIG_SOFTFLOAT) += fpu/softfloat.o
 libobj-$(CONFIG_NOSOFTFLOAT) += fpu/softfloat-native.o
@@ -80,9 +80,9 @@ ifdef CONFIG_LINUX_USER
 
 VPATH+=:$(SRC_PATH)/linux-user:$(SRC_PATH)/linux-user/$(TARGET_ABI_DIR)
 QEMU_CFLAGS+=-I$(SRC_PATH)/linux-user -I$(SRC_PATH)/linux-user/$(TARGET_ABI_DIR)
-
 obj-y = main.o syscall.o strace.o mmap.o signal.o thunk.o \
       elfload.o linuxload.o uaccess.o gdbstub.o gdbstub-xml.o
+obj-y += envlist.o path.o
 
 obj-$(TARGET_HAS_BFLT) += flatload.o
 obj-$(TARGET_HAS_ELFLOAD32) += elfload32.o
@@ -98,7 +98,7 @@ obj-arm-y += arm-semi.o
 
 obj-m68k-y += m68k-sim.o m68k-semi.o
 
-ARLIBS=../libqemu_user.a libqemu.a
+ARLIBS=libqemu.a
 endif #CONFIG_LINUX_USER
 
 #########################################################
@@ -116,6 +116,7 @@ LIBS+=-lmx
 
 obj-y = main.o commpage.o machload.o mmap.o signal.o syscall.o thunk.o \
         gdbstub.o gdbstub-xml.o
+obj-y += envlist.o path.o
 
 obj-i386-y += ioport-user.o
 
@@ -133,13 +134,23 @@ QEMU_CFLAGS+=-I$(SRC_PATH)/bsd-user -I$(SRC_PATH)/bsd-user/$(TARGET_ARCH)
 
 obj-y = main.o bsdload.o elfload.o mmap.o signal.o strace.o syscall.o \
         gdbstub.o gdbstub-xml.o uaccess.o
+obj-y += envlist.o path.o
 
 obj-i386-y += ioport-user.o
 
-ARLIBS=libqemu.a ../libqemu_user.a
+ARLIBS=libqemu.a
 
 endif #CONFIG_BSD_USER
 
+ifdef CONFIG_USER_ONLY
+# hack to compile with -fpie for *-user targets
+obj-y += cutils-user.o cache-utils-user.o
+cutils-user.c cache-utils-user.c:
+	@echo "  LN	$(TARGET_DIR)$@"
+	@ln -s $(SRC_PATH)/$(@:%-user.c=%.c) $@
+endif
+
+
 #########################################################
 # System emulator target
 ifdef CONFIG_SOFTMMU
diff --git a/configure b/configure
index 0d0162a..4a6a9fb 100755
--- a/configure
+++ b/configure
@@ -221,6 +221,7 @@ kerneldir=""
 aix="no"
 blobs="yes"
 pkgversion=""
+user_pie=""
 
 # OS specific
 if check_define __linux__ ; then
@@ -498,6 +499,10 @@ for opt do
   ;;
   --disable-guest-base) guest_base="no"
   ;;
+  --enable-user-pie) user_pie="yes"
+  ;;
+  --disable-user-pie) user_pie="no"
+  ;;
   --enable-uname-release=*) uname_release="$optarg"
   ;;
   --sparc_cpu=*)
@@ -672,6 +677,8 @@ echo "  --disable-bsd-user       disable all BSD usermode emulation targets"
 echo "  --enable-guest-base      enable GUEST_BASE support for usermode"
 echo "                           emulation targets"
 echo "  --disable-guest-base     disable GUEST_BASE support"
+echo "  --enable-user-pie        build usermode emulation targets as PIE"
+echo "  --disable-user-pie       do not build usermode emulation targets as PIE"
 echo "  --fmod-lib               path to FMOD library"
 echo "  --fmod-inc               path to FMOD includes"
 echo "  --oss-lib                path to OSS library"
@@ -1538,6 +1545,29 @@ elif compile_prog "" "-lrt" ; then
   LIBS="-lrt $LIBS"
 fi
 
+##########################################
+# Can toolchain generate proper PIE
+cat > $TMPC <<EOF
+int main() {
+	static __thread int i = 0;
+	i++;
+	return 0;
+}
+EOF
+
+if test "$user_pie" != "no" ; then
+    if compile_prog "-fpie" "-pie -Wl,--fatal-warnings -Wl,--warn-shared-textrel"; then
+        user_pie="yes"
+    else
+        if test "$user_pie" = "yes"; then
+            echo "Toolchain has no proper PIE support"
+            exit 1
+        else
+            user_pie="no"
+        fi
+    fi
+fi
+
 # Determine what linker flags to use to force archive inclusion
 check_linker_flags()
 {
@@ -1678,6 +1708,7 @@ echo "Documentation     $docs"
 echo "uname -r          $uname_release"
 echo "NPTL support      $nptl"
 echo "GUEST_BASE        $guest_base"
+echo "PIE user targets  $user_pie"
 echo "vde support       $vde"
 echo "IO thread         $io_thread"
 echo "Linux AIO support $linux_aio"
@@ -2302,6 +2333,12 @@ if test "$target_softmmu" = "yes" ; then
   esac
 fi
 
+if test "$target_user_only" = "yes" -a "$static" = "no" -a \
+	"$user_pie" = "yes" ; then
+  cflags="-fpie $cflags"
+  ldflags="-pie $ldflags"
+fi
+
 if test "$target_softmmu" = "yes" -a \( \
         "$TARGET_ARCH" = "microblaze" -o \
         "$TARGET_ARCH" = "cris" \) ; then
@@ -2323,16 +2360,6 @@ fi
 linker_script="-Wl,-T../config-host.ld -Wl,-T,\$(SRC_PATH)/\$(ARCH).ld"
 if test "$target_linux_user" = "yes" -o "$target_bsd_user" = "yes" ; then
   case "$ARCH" in
-  i386)
-    if test "$gprof" = "yes" -o "$static" = "yes" ; then
-      ldflags="$linker_script $ldflags"
-    else
-      # WARNING: this LDFLAGS is _very_ tricky : qemu is an ELF shared object
-      # that the kernel ELF loader considers as an executable. I think this
-      # is the simplest way to make it self virtualizable!
-      ldflags="-Wl,-shared $ldflags"
-    fi
-    ;;
   sparc)
     # -static is used to avoid g1/g3 usage by the dynamic linker
     ldflags="$linker_script -static $ldflags"
@@ -2340,7 +2367,7 @@ if test "$target_linux_user" = "yes" -o "$target_bsd_user" = "yes" ; then
   ia64)
     ldflags="-Wl,-G0 $linker_script -static $ldflags"
     ;;
-  x86_64|ppc|ppc64|s390|sparc64|alpha|arm|m68k|mips|mips64)
+  i386|x86_64|ppc|ppc64|s390|sparc64|alpha|arm|m68k|mips|mips64)
     ldflags="$linker_script $ldflags"
     ;;
   esac
diff --git a/linux-user/main.c b/linux-user/main.c
index a628c01..81a1ada 100644
--- a/linux-user/main.c
+++ b/linux-user/main.c
@@ -48,32 +48,6 @@ int have_guest_base;
 static const char *interp_prefix = CONFIG_QEMU_PREFIX;
 const char *qemu_uname_release = CONFIG_UNAME_RELEASE;
 
-#if defined(__i386__) && !defined(CONFIG_STATIC)
-/* Force usage of an ELF interpreter even if it is an ELF shared
-   object ! */
-const char interp[] __attribute__((section(".interp"))) = "/lib/ld-linux.so.2";
-#endif
-
-/* for recent libc, we add these dummy symbols which are not declared
-   when generating a linked object (bug in ld ?) */
-#if (__GLIBC__ > 2 || (__GLIBC__ == 2 && __GLIBC_MINOR__ >= 3)) && !defined(CONFIG_STATIC)
-asm(".globl __preinit_array_start\n"
-    ".globl __preinit_array_end\n"
-    ".globl __init_array_start\n"
-    ".globl __init_array_end\n"
-    ".globl __fini_array_start\n"
-    ".globl __fini_array_end\n"
-    ".section \".rodata\"\n"
-    "__preinit_array_start:\n"
-    "__preinit_array_end:\n"
-    "__init_array_start:\n"
-    "__init_array_end:\n"
-    "__fini_array_start:\n"
-    "__fini_array_end:\n"
-    ".long 0\n"
-    ".previous\n");
-#endif
-
 /* XXX: on x86 MAP_GROWSDOWN only works if ESP <= address + 32, so
    we allocate a bigger stack. Need a better solution, for example
    by remapping the process stack directly at the right place */
-- 
1.6.4.2

Re: [Qemu-devel] [PATCH v4 2/2] Build usermode targets as PIE

[Arnaud Patard]

"Kirill A. Shutemov" <kirill@shutemov.name> writes:
Hi,

>> Unfortunately, the broken mips toolchain pass this test. When you
>> compile, you're getting no warning at all. Moreover, the failure is
>> triggered at run-time (and this test doesn't trigger it). See
>> http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=526961 if you want
>> something which segfault with pie.
>> I don't know if there are some other non-mips toolchains with broken pie
>> and what's their behaviour. I hope it's crashing too...
>
> Where can I get a mips cross-compiler with this issue to play?

No, sorry. I'm building mips stuff only natively. Fortunately, this is a
toolchain bug so this should be reproductible if you use qemu to emulate
a mips box running debian for mipsel.


Arnaud