[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PATCH] translate-all: Bugfix for user-mode self-modifying
From: |
Stanislav Shmarov |
Subject: |
[Qemu-devel] [PATCH] translate-all: Bugfix for user-mode self-modifying code in 2 page long TB |
Date: |
Tue, 5 Jul 2016 13:45:11 +0300 |
In user-mode emulation Translation Block can consist of 2 guest pages.
In that case QEMU also mprotects 2 host pages that are dedicated for
guest memory, containing instructions. QEMU detects self-modifying code
with SEGFAULT signal processing.
In case if instruction in 1st page is modifying memory of 2nd
page (or vice versa) QEMU will mark 2nd page with PAGE_WRITE,
invalidate TB, generate new TB contatining 1 guest instruction and
exit to CPU loop. QEMU won't call mprotect, and new TB will cause
same SEGFAULT. Page will have both PAGE_WRITE_ORG and PAGE_WRITE
flags, so QEMU will handle the signal as guest binary problem,
and exit with guest SEGFAULT.
Solution is retranslate TB before marking pages as PAGE_WRITE,
and remove protection with mprotect on second SEGFAULT.
Signed-off-by: Stanislav Shmarov <address@hidden>
---
translate-all.c | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
diff --git a/translate-all.c b/translate-all.c
index eaa95e4..1e2ac84 100644
--- a/translate-all.c
+++ b/translate-all.c
@@ -2022,11 +2022,7 @@ int page_unprotect(target_ulong address, uintptr_t pc)
prot = 0;
for (addr = host_start ; addr < host_end ; addr += TARGET_PAGE_SIZE) {
- p = page_find(addr >> TARGET_PAGE_BITS);
- p->flags |= PAGE_WRITE;
- prot |= p->flags;
-
- /* and since the content will be modified, we must invalidate
+ /* Since the content will be modified, we must invalidate
the corresponding translated code. */
if (tb_invalidate_phys_page(addr, pc)) {
mmap_unlock();
@@ -2035,6 +2031,10 @@ int page_unprotect(target_ulong address, uintptr_t pc)
#ifdef DEBUG_TB_CHECK
tb_invalidate_check(addr);
#endif
+
+ p = page_find(addr >> TARGET_PAGE_BITS);
+ p->flags |= PAGE_WRITE;
+ prot |= p->flags;
}
mprotect((void *)g2h(host_start), qemu_host_page_size,
prot & PAGE_BITS);
--
1.9.3
- [Qemu-devel] [PATCH] translate-all: Bugfix for user-mode self-modifying code in 2 page long TB,
Stanislav Shmarov <=