From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:40654) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1bKNr5-0003hf-IA for qemu-devel@nongnu.org; Tue, 05 Jul 2016 06:45:28 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1bKNr1-0002rs-Jw for qemu-devel@nongnu.org; Tue, 05 Jul 2016 06:45:27 -0400 Received: from mail-lf0-x243.google.com ([2a00:1450:4010:c07::243]:35135) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1bKNr1-0002rc-Ba for qemu-devel@nongnu.org; Tue, 05 Jul 2016 06:45:23 -0400 Received: by mail-lf0-x243.google.com with SMTP id w130so19345687lfd.2 for ; Tue, 05 Jul 2016 03:45:22 -0700 (PDT) From: Stanislav Shmarov Date: Tue, 5 Jul 2016 13:45:11 +0300 Message-Id: <1467715511-868127-1-git-send-email-snarpix@gmail.com> Subject: [Qemu-devel] [PATCH] translate-all: Bugfix for user-mode self-modifying code in 2 page long TB List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: Paolo Bonzini , Peter Crosthwaite , Richard Henderson , Stanislav Shmarov In user-mode emulation Translation Block can consist of 2 guest pages. In that case QEMU also mprotects 2 host pages that are dedicated for guest memory, containing instructions. QEMU detects self-modifying code with SEGFAULT signal processing. In case if instruction in 1st page is modifying memory of 2nd page (or vice versa) QEMU will mark 2nd page with PAGE_WRITE, invalidate TB, generate new TB contatining 1 guest instruction and exit to CPU loop. QEMU won't call mprotect, and new TB will cause same SEGFAULT. Page will have both PAGE_WRITE_ORG and PAGE_WRITE flags, so QEMU will handle the signal as guest binary problem, and exit with guest SEGFAULT. Solution is retranslate TB before marking pages as PAGE_WRITE, and remove protection with mprotect on second SEGFAULT. Signed-off-by: Stanislav Shmarov --- translate-all.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/translate-all.c b/translate-all.c index eaa95e4..1e2ac84 100644 --- a/translate-all.c +++ b/translate-all.c @@ -2022,11 +2022,7 @@ int page_unprotect(target_ulong address, uintptr_t pc) prot = 0; for (addr = host_start ; addr < host_end ; addr += TARGET_PAGE_SIZE) { - p = page_find(addr >> TARGET_PAGE_BITS); - p->flags |= PAGE_WRITE; - prot |= p->flags; - - /* and since the content will be modified, we must invalidate + /* Since the content will be modified, we must invalidate the corresponding translated code. */ if (tb_invalidate_phys_page(addr, pc)) { mmap_unlock(); @@ -2035,6 +2031,10 @@ int page_unprotect(target_ulong address, uintptr_t pc) #ifdef DEBUG_TB_CHECK tb_invalidate_check(addr); #endif + + p = page_find(addr >> TARGET_PAGE_BITS); + p->flags |= PAGE_WRITE; + prot |= p->flags; } mprotect((void *)g2h(host_start), qemu_host_page_size, prot & PAGE_BITS); -- 1.9.3