From: Ilya Leoshkevich <iii@linux.ibm.com>
To: "Laurent Vivier" <laurent@vivier.eu>,
"Eduardo Habkost" <eduardo@habkost.net>,
"Marcel Apfelbaum" <marcel.apfelbaum@gmail.com>,
"Philippe Mathieu-Daudé" <f4bug@amsat.org>,
"Yanan Wang" <wangyanan55@huawei.com>,
"Richard Henderson" <richard.henderson@linaro.org>,
"Paolo Bonzini" <pbonzini@redhat.com>,
"David Hildenbrand" <david@redhat.com>,
"Peter Maydell" <peter.maydell@linaro.org>
Cc: qemu-devel@nongnu.org, qemu-s390x@nongnu.org,
Christian Borntraeger <borntraeger@linux.ibm.com>,
Ilya Leoshkevich <iii@linux.ibm.com>
Subject: [PATCH v4 0/5] linux-user: Fix siginfo_t contents when jumping to non-readable pages
Date: Thu, 11 Aug 2022 11:55:29 +0200 [thread overview]
Message-ID: <20220811095534.241224-1-iii@linux.ibm.com> (raw)
Hi,
I noticed that when we get a SEGV due to jumping to non-readable
memory, sometimes si_addr and program counter in siginfo_t are slightly
off. I tracked this down to the assumption that translators stop before
the end of a page, while in reality they may stop right after it.
Patch 1 fixes a minor invalidation issue, which may prevent SEGV from
happening altogether.
Patch 2 introduces a helper function.
Patches 3-4 fix the main issue on x86_64 and s390x. Many other
architectures have fixed-size instructions and are not affected.
Patch 5 adds tests.
Best regards,
Ilya
v1: https://lists.gnu.org/archive/html/qemu-devel/2022-08/msg00822.html
v1 -> v2: Fix individual translators instead of translator_loop
(Peter).
v2: https://lists.gnu.org/archive/html/qemu-devel/2022-08/msg01079.html
v2 -> v3: Peek at the next instruction on s390x (Richard).
Undo more on i386 (Richard).
Check PAGE_EXEC, not PAGE_READ (Peter, Richard).
v3: https://lists.gnu.org/archive/html/qemu-devel/2022-08/msg01306.html
v3 -> v4: Improve the commit message in patch 1 to better reflect what
exactly is being fixed there.
Factor out the is_same_page() patch (Richard).
Do not touch the common code in the i386 fix (Richard).
Ilya Leoshkevich (5):
accel/tcg: Invalidate translations when clearing PAGE_EXEC
accel/tcg: Introduce is_same_page()
target/s390x: Make translator stop before the end of a page
target/i386: Make translator stop before the end of a page
tests/tcg: Test siginfo_t contents when jumping to non-readable pages
accel/tcg/translate-all.c | 17 ++--
include/exec/translator.h | 10 +++
target/i386/tcg/translate.c | 25 +++++-
target/s390x/tcg/translate.c | 15 +++-
tests/tcg/multiarch/noexec.h | 114 ++++++++++++++++++++++++
tests/tcg/s390x/Makefile.target | 1 +
tests/tcg/s390x/noexec.c | 145 +++++++++++++++++++++++++++++++
tests/tcg/x86_64/Makefile.target | 3 +-
tests/tcg/x86_64/noexec.c | 116 +++++++++++++++++++++++++
9 files changed, 435 insertions(+), 11 deletions(-)
create mode 100644 tests/tcg/multiarch/noexec.h
create mode 100644 tests/tcg/s390x/noexec.c
create mode 100644 tests/tcg/x86_64/noexec.c
--
2.37.1
next reply other threads:[~2022-08-11 9:57 UTC|newest]
Thread overview: 10+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-08-11 9:55 Ilya Leoshkevich [this message]
2022-08-11 9:55 ` [PATCH v4 1/5] accel/tcg: Invalidate translations when clearing PAGE_EXEC Ilya Leoshkevich
2022-08-11 9:55 ` [PATCH v4 2/5] accel/tcg: Introduce is_same_page() Ilya Leoshkevich
2022-08-11 16:59 ` Richard Henderson
2022-08-11 9:55 ` [PATCH v4 3/5] target/s390x: Make translator stop before the end of a page Ilya Leoshkevich
2022-08-11 16:59 ` Richard Henderson
2022-08-11 9:55 ` [PATCH v4 4/5] target/i386: " Ilya Leoshkevich
2022-08-11 16:58 ` Richard Henderson
2022-08-11 17:22 ` Richard Henderson
2022-08-11 9:55 ` [PATCH v4 5/5] tests/tcg: Test siginfo_t contents when jumping to non-readable pages Ilya Leoshkevich
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20220811095534.241224-1-iii@linux.ibm.com \
--to=iii@linux.ibm.com \
--cc=borntraeger@linux.ibm.com \
--cc=david@redhat.com \
--cc=eduardo@habkost.net \
--cc=f4bug@amsat.org \
--cc=laurent@vivier.eu \
--cc=marcel.apfelbaum@gmail.com \
--cc=pbonzini@redhat.com \
--cc=peter.maydell@linaro.org \
--cc=qemu-devel@nongnu.org \
--cc=qemu-s390x@nongnu.org \
--cc=richard.henderson@linaro.org \
--cc=wangyanan55@huawei.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.