From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:49521) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1WVmLl-0000NZ-PP for qemu-devel@nongnu.org; Thu, 03 Apr 2014 14:26:58 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1WVmLh-0005dD-0j for qemu-devel@nongnu.org; Thu, 03 Apr 2014 14:26:53 -0400 Received: from mail-qc0-x22d.google.com ([2607:f8b0:400d:c01::22d]:62640) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1WVmLg-0005d2-T6 for qemu-devel@nongnu.org; Thu, 03 Apr 2014 14:26:48 -0400 Received: by mail-qc0-f173.google.com with SMTP id r5so2276009qcx.4 for ; Thu, 03 Apr 2014 11:26:48 -0700 (PDT) Sender: Richard Henderson Message-ID: <533DA7E3.5010705@twiddle.net> Date: Thu, 03 Apr 2014 11:26:43 -0700 From: Richard Henderson MIME-Version: 1.0 References: <1396543508-12280-1-git-send-email-peter.maydell@linaro.org> <1396543508-12280-2-git-send-email-peter.maydell@linaro.org> In-Reply-To: <1396543508-12280-2-git-send-email-peter.maydell@linaro.org> Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Subject: Re: [Qemu-devel] [PATCH for-2.0? 1/2] page_check_range: don't bail out early after unprotecting page List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Peter Maydell , qemu-devel@nongnu.org Cc: Riku Voipio , patches@linaro.org, "Andrei E. Warkentin" On 04/03/2014 09:45 AM, Peter Maydell wrote: > From: Andrei Warkentin > > When checking a page range, if we found that a page was > made read-only by QEMU because it contained translated code, > we were incorrectly returning immediately after unprotecting > that page, rather than continuing to check the entire range, > so we might fail to unprotect pages later in the range, or > might incorrectly return a "success" result even if later > pages were not writable. > > In particular, this could cause segfaults in a case where > signals are delivered back to back on a target architecture > which uses trampoline code in the stack frame (as AArch64 > currently does). The second signal causes a segfault because > the frame cannot be written to (it was protected because > we translated and executed the restorer trampoline, and the > unprotect logic did not unprotect the whole range). > > Signed-off-by: Andrei Warkentin [PMM: expanded commit message a bit] > Signed-off-by: Peter Maydell > --- > translate-all.c | 1 - > 1 file changed, 1 deletion(-) Reviewed-by: Richard Henderson r~