Re: [Qemu-devel] [patch] Fix arm self-modifying code

[Lennert Buytenhek]

On Mon, Aug 02, 2004 at 01:29:58AM +0100, Paul Brook wrote:

> The patch adds the signal handling necessary to make arm self-modifying
> code work. You'll notice it looks remarkably similar to the sparc routine :)
> 
> This should fix the "uncaught target signal 11" crash people have
> been seeing.

OK.. I made two 'hello world' binaries with these toolchains:
- armv5te-redhat-linux, gcc 3.3.3, glibc 2.3.2
- arm-unknown-linux-gnu, gcc 2.95.3, glibc 2.1.3

They both fail with 'uncaught target signal 11' when run under latest
qemu plus your patch.

The arm-unknown-linux-gnu binary shows something really strange:

% ./qemu-arm ./hi-gcc-2.95.3-glibc-2.1.3
qemu: uncaught target signal 11 (Segmentation fault) - exiting
% setarch i686 ./qemu-arm ./hi-gcc-2.95.3-glibc-2.1.3
hi!
% 

So, then I backed out your patch from qemu, running a vanilla qemu
from CVS.  Same result -- crash when run directly, and works when
run under setarch i686.

(I'm on Fedora Core 2.)

So then I grab strace, and see these differences (old vs. new) during
startup:

-old_mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 
0xf7030000
+old_mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 
0x55001000

and:

-old_mmap(NULL, 528384, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) 
= 0xf6faf000
-mprotect(0xf702f000, 4096, PROT_NONE)   = 0
-munmap(0xf7030000, 4096)                = 0
+old_mmap(NULL, 528384, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) 
= 0x55002000
+mprotect(0x55082000, 4096, PROT_NONE)   = 0
+munmap(0x55001000, 4096)                = 0

Perhaps qemu-arm can't deal with 4G-split kernels?

(The setarch i686 trick doesn't work for the armv5te-redhat-linux
binary, though.)


--L