[Qemu-devel] [PATCH 0/1] possible fix for hw breakpoint crash on x86 32bit host

[Jason Wessel <jason.wessel@windriver.com>]

The aim of this patch is to either fix the problem or at least
describe the circumstances around the crash using a 32 bit x86 linux
host with a 32 bit linux guest making use of hw breakpoints.

I had also seen the same problem reported here:

https://bugs.launchpad.net/qemu/+bug/501177


---- running qemu in gdb with a linux kernel as the guest ----
kgdbts:RUN hw breakpoint test
[New Thread 0xb7f1d700 (LWP 31553)]

Program received signal SIGSEGV, Segmentation fault.
raise_interrupt (intno=1, is_int=0, error_code=0, next_eip_addend=0)
    at /ord-lpggp11/jwessel/git/qemu/target-i386/op_helper.c:1335
1335        env->exception_index = intno;
(gdb) info address env
Symbol "env" is a variable in register ebp.
(gdb) bt
#0  raise_interrupt (intno=1, is_int=0, error_code=0, next_eip_addend=0)
    at /ord-lpggp11/jwessel/git/qemu/target-i386/op_helper.c:1335
#1  0x081380b7 in raise_exception (exception_index=1)
    at /ord-lpggp11/jwessel/git/qemu/target-i386/op_helper.c:1351
#2  0x0814db6e in breakpoint_handler (env=0x9ed8b50)
    at /ord-lpggp11/jwessel/git/qemu/target-i386/helper.c:1551
#3  0x080e1643 in cpu_x86_exec (env1=0x9ed8b50)
    at /ord-lpggp11/jwessel/git/qemu/cpu-exec.c:206
#4  0x08053af9 in main (argc=0, argv=0x0, envp=Cannot access memory at address 0x8
)
    at /ord-lpggp11/jwessel/git/qemu/vl.c:3816
(gdb) 

I concluded that env points to the ebp register and it only has a
valid value while executing from the generated code context.  I
created another function to pass in the valid version of env in order
to set ebp in preparation to eventually execute a longjmp() via the
raise_exception().

It is not clear that this is the right way to fix the problem, but it
does allow the guest hw breakpoint tests to work correctly on a 32 bit
and 64 bit x86 linux host.

If there is a better way to solve this, please let me know.

Thanks,
Jason.

---
Jason Wessel (1):
      target-i386: fix crash on x86 32bit linux host with hw breakpoint exceptions

 target-i386/exec.h      |    1 +
 target-i386/helper.c    |    6 +++---
 target-i386/op_helper.c |    5 +++++
 3 files changed, 9 insertions(+), 3 deletions(-)