From patchwork Wed Jul 6 07:54:28 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Stanislav Shmarov X-Patchwork-Id: 9215657 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id BFED1607D9 for ; Wed, 6 Jul 2016 07:57:52 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id B226928760 for ; Wed, 6 Jul 2016 07:57:52 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id A6BDF28763; Wed, 6 Jul 2016 07:57:52 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=2.0 tests=BAYES_00, DKIM_ADSP_CUSTOM_MED, DKIM_SIGNED, FREEMAIL_FROM, RCVD_IN_DNSWL_HI, T_DKIM_INVALID autolearn=ham version=3.3.1 Received: from lists.gnu.org (lists.gnu.org [208.118.235.17]) (using TLSv1 with cipher AES256-SHA (256/256 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id 4DC1F28760 for ; Wed, 6 Jul 2016 07:57:52 +0000 (UTC) Received: from localhost ([::1]:59878 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1bKhiR-0003nG-K2 for patchwork-qemu-devel@patchwork.kernel.org; Wed, 06 Jul 2016 03:57:51 -0400 Received: from eggs.gnu.org ([2001:4830:134:3::10]:56387) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1bKhiC-0003mE-88 for qemu-devel@nongnu.org; Wed, 06 Jul 2016 03:57:38 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1bKhi9-0007hR-2Z for qemu-devel@nongnu.org; Wed, 06 Jul 2016 03:57:36 -0400 Received: from mail-lf0-x242.google.com ([2a00:1450:4010:c07::242]:33034) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1bKhi8-0007hC-Qi for qemu-devel@nongnu.org; Wed, 06 Jul 2016 03:57:33 -0400 Received: by mail-lf0-x242.google.com with SMTP id l188so21657846lfe.0 for ; Wed, 06 Jul 2016 00:57:32 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=from:to:cc:subject:date:message-id; bh=D3aQ/HpByp1n22XlNuVtxq1JHWxp6XrWG51F3MSQrWE=; b=MZnxx6XWqHFoUowQ87dtjj51qlBPM9yhtAT9y2TjxbWZs/Ixxg0PX+IuGdIq5RXuoj IXKB4D54oH2HjXMJGNZJAJHnVGujNw3DiJrLyH2bo5X3RCDfXddEKsnTAeo53camENDi +X1YCty87bj55P9p5GO07SECwmSuWf3aYYqPLoO2AHf+ssPKquLVd+M3rYvNTQs4R9Cu nrYwFjGlMRXlTHdsw9Vq4tbDqZqv8arBTbx958NOnqHxOKMpY9i2zwDwtSqgaxOkziup G2fDVHlu0q8hbFTRwuCLIaEjRB++irFBzX+9g5r79csnKQ8PjgckrSdXSXEvgugidaVh e45A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:from:to:cc:subject:date:message-id; bh=D3aQ/HpByp1n22XlNuVtxq1JHWxp6XrWG51F3MSQrWE=; b=OJSCVBGTzD1R/2LmFSu2TYcnj8dJDWuXaB9szuCEbF9owk3jBhWyE0sBdCEh23EtfL cTw6N2yvxRXQIc9FkSc+NN+Elt4z09yzLKuUFMN/qnARv8mmDoKNJvgh57WXqw1kIL60 5o630wMQOLoA130ePLYbRvFPgYrZmvSt3E3Fp32OxtHF8zAoA0FrlcmGq9GqVQCAgCiI G+P2mQd1Z/XvkJHF9o8rDwm6nEvXz82TJL1CbPUZrHqg2woEIHkNIxfvsUJ4Fy+QpifI 4SzdDZQ01keFJnx22U9ReAdVsq1N4fnpwPU7DbIEdbF80VszVeeXyesg418ftBZuGwfN yn3A== X-Gm-Message-State: ALyK8tIjweoKDbAUKQ+TP+jN6iJuaw2Ghl90seQ0/QV4mmiNi3GE8Fehoe2lRwn4A+74+Q== X-Received: by 10.25.89.8 with SMTP id n8mr4710201lfb.225.1467791851755; Wed, 06 Jul 2016 00:57:31 -0700 (PDT) Received: from mlogin26.smware.local ([213.243.91.10]) by smtp.gmail.com with ESMTPSA id 39sm632127lja.37.2016.07.06.00.57.30 (version=TLS1_2 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Wed, 06 Jul 2016 00:57:30 -0700 (PDT) From: Stanislav Shmarov To: qemu-devel@nongnu.org Date: Wed, 6 Jul 2016 10:54:28 +0300 Message-Id: <1467791668-2937838-1-git-send-email-snarpix@gmail.com> X-Mailer: git-send-email 1.9.3 X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] X-Received-From: 2a00:1450:4010:c07::242 Subject: [Qemu-devel] [PATCH v2] translate-all: Bugfix for user-mode self-modifying code in 2 page long TB X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Paolo Bonzini , Sergey Fedorov , Richard Henderson , Stanislav Shmarov , Peter Crosthwaite Errors-To: qemu-devel-bounces+patchwork-qemu-devel=patchwork.kernel.org@nongnu.org Sender: "Qemu-devel" X-Virus-Scanned: ClamAV using ClamSMTP In user-mode emulation Translation Block can consist of 2 guest pages. In that case QEMU also mprotects 2 host pages that are dedicated for guest memory, containing instructions. QEMU detects self-modifying code with SEGFAULT signal processing. In case if instruction in 1st page is modifying memory of 2nd page (or vice versa) QEMU will mark 2nd page with PAGE_WRITE, invalidate TB, generate new TB contatining 1 guest instruction and exit to CPU loop. QEMU won't call mprotect, and new TB will cause same SEGFAULT. Page will have both PAGE_WRITE_ORG and PAGE_WRITE flags, so QEMU will handle the signal as guest binary problem, and exit with guest SEGFAULT. Solution is retranslate TB before marking pages as PAGE_WRITE, and remove protection with mprotect on second SEGFAULT. Signed-off-by: Stanislav Shmarov Reviewed-by: Sergey Fedorov --- v2: Moved setting PAGE_WRITE flag to separte loop, to cover cases, pointed by Sergey Fedorov. translate-all.c | 17 +++++++++++------ 1 file changed, 11 insertions(+), 6 deletions(-) diff --git a/translate-all.c b/translate-all.c index eaa95e4..fb3743f 100644 --- a/translate-all.c +++ b/translate-all.c @@ -2020,13 +2020,8 @@ int page_unprotect(target_ulong address, uintptr_t pc) host_start = address & qemu_host_page_mask; host_end = host_start + qemu_host_page_size; - prot = 0; for (addr = host_start ; addr < host_end ; addr += TARGET_PAGE_SIZE) { - p = page_find(addr >> TARGET_PAGE_BITS); - p->flags |= PAGE_WRITE; - prot |= p->flags; - - /* and since the content will be modified, we must invalidate + /* Since the content will be modified, we must invalidate the corresponding translated code. */ if (tb_invalidate_phys_page(addr, pc)) { mmap_unlock(); @@ -2036,6 +2031,16 @@ int page_unprotect(target_ulong address, uintptr_t pc) tb_invalidate_check(addr); #endif } + + /* If we got here, current TB have been retranslated (in case of + * self-modifying code), now it's safe to remove page protection. + */ + prot = 0; + for (addr = host_start ; addr < host_end ; addr += TARGET_PAGE_SIZE) { + p = page_find(addr >> TARGET_PAGE_BITS); + p->flags |= PAGE_WRITE; + prot |= p->flags; + } mprotect((void *)g2h(host_start), qemu_host_page_size, prot & PAGE_BITS);