From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:52457) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1bKW4h-00017s-Nx for qemu-devel@nongnu.org; Tue, 05 Jul 2016 15:32:05 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1bKW4d-0005Ex-29 for qemu-devel@nongnu.org; Tue, 05 Jul 2016 15:32:03 -0400 Received: from mail-lf0-x244.google.com ([2a00:1450:4010:c07::244]:34888) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1bKW4c-0005EZ-PU for qemu-devel@nongnu.org; Tue, 05 Jul 2016 15:31:58 -0400 Received: by mail-lf0-x244.google.com with SMTP id w130so20570855lfd.2 for ; Tue, 05 Jul 2016 12:31:58 -0700 (PDT) References: <1467715511-868127-1-git-send-email-snarpix@gmail.com> From: Sergey Fedorov Message-ID: <577C0B2C.8010906@gmail.com> Date: Tue, 5 Jul 2016 22:31:56 +0300 MIME-Version: 1.0 In-Reply-To: <1467715511-868127-1-git-send-email-snarpix@gmail.com> Content-Type: text/plain; charset=windows-1252 Content-Transfer-Encoding: 7bit Subject: Re: [Qemu-devel] [PATCH] translate-all: Bugfix for user-mode self-modifying code in 2 page long TB List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Stanislav Shmarov , qemu-devel@nongnu.org Cc: Paolo Bonzini , Richard Henderson , Peter Crosthwaite On 05/07/16 13:45, Stanislav Shmarov wrote: > In user-mode emulation Translation Block can consist of 2 guest pages. > In that case QEMU also mprotects 2 host pages that are dedicated for > guest memory, containing instructions. QEMU detects self-modifying code > with SEGFAULT signal processing. > > In case if instruction in 1st page is modifying memory of 2nd > page (or vice versa) QEMU will mark 2nd page with PAGE_WRITE, > invalidate TB, generate new TB contatining 1 guest instruction and > exit to CPU loop. QEMU won't call mprotect, and new TB will cause > same SEGFAULT. Page will have both PAGE_WRITE_ORG and PAGE_WRITE > flags, so QEMU will handle the signal as guest binary problem, > and exit with guest SEGFAULT. > > Solution is retranslate TB before marking pages as PAGE_WRITE, > and remove protection with mprotect on second SEGFAULT. > > Signed-off-by: Stanislav Shmarov > --- > translate-all.c | 10 +++++----- > 1 file changed, 5 insertions(+), 5 deletions(-) > > diff --git a/translate-all.c b/translate-all.c > index eaa95e4..1e2ac84 100644 > --- a/translate-all.c > +++ b/translate-all.c > @@ -2022,11 +2022,7 @@ int page_unprotect(target_ulong address, uintptr_t pc) > > prot = 0; > for (addr = host_start ; addr < host_end ; addr += TARGET_PAGE_SIZE) { > - p = page_find(addr >> TARGET_PAGE_BITS); > - p->flags |= PAGE_WRITE; > - prot |= p->flags; > - > - /* and since the content will be modified, we must invalidate > + /* Since the content will be modified, we must invalidate > the corresponding translated code. */ > if (tb_invalidate_phys_page(addr, pc)) { > mmap_unlock(); > @@ -2035,6 +2031,10 @@ int page_unprotect(target_ulong address, uintptr_t pc) > #ifdef DEBUG_TB_CHECK > tb_invalidate_check(addr); > #endif > + > + p = page_find(addr >> TARGET_PAGE_BITS); > + p->flags |= PAGE_WRITE; > + prot |= p->flags; I'm afraid you need to do this even later, out of the loop for guest pages, to ensure that mprotect() will be eventually called. That will require a separate loop through all the guest pages which make up the host page. Kind regards, Sergey > } > mprotect((void *)g2h(host_start), qemu_host_page_size, > prot & PAGE_BITS);