From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:46581) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1WGlJY-0005IK-Ph for qemu-devel@nongnu.org; Fri, 21 Feb 2014 03:18:41 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1WGlJP-0001Yp-3U for qemu-devel@nongnu.org; Fri, 21 Feb 2014 03:18:32 -0500 Received: from e7.ny.us.ibm.com ([32.97.182.137]:44984) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1WGlJO-0001Yh-SF for qemu-devel@nongnu.org; Fri, 21 Feb 2014 03:18:23 -0500 Received: from /spool/local by e7.ny.us.ibm.com with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted for from ; Fri, 21 Feb 2014 03:18:22 -0500 From: Michael Roth Date: Fri, 21 Feb 2014 02:16:56 -0600 Message-Id: <1392970647-21528-21-git-send-email-mdroth@linux.vnet.ibm.com> In-Reply-To: <1392970647-21528-1-git-send-email-mdroth@linux.vnet.ibm.com> References: <1392970647-21528-1-git-send-email-mdroth@linux.vnet.ibm.com> Subject: [Qemu-devel] [PATCH 20/51] x86: only allow real mode to access 32bit without LMA List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: lersek@redhat.com, qemu-stable@nongnu.org, Petar.Jovanovic@imgtec.com From: Alexander Graf When we're running in non-64bit mode with qemu-system-x86_64 we can still end up with virtual addresses that are above the 32bit boundary if a segment offset is set up. GNU Hurd does exactly that. It sets the segment offset to 0x80000000 and puts its EIP value to 0x8xxxxxxx to access low memory. This doesn't hit us when we enable paging, as there we just mask away the unused bits. But with real mode, we assume that vaddr == paddr which is wrong in this case. Real hardware wraps the virtual address around at the 32bit boundary. So let's do the same. This fixes booting GNU Hurd in qemu-system-x86_64 for me. Reported-by: Michael Tokarev Signed-off-by: Alexander Graf Reviewed-by: Richard Henderson Signed-off-by: Michael Tokarev (cherry picked from commit 33dfdb56f2f3c8686d218395b871ec12fd5bf30b) Signed-off-by: Michael Roth --- target-i386/helper.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/target-i386/helper.c b/target-i386/helper.c index 7c196ff..ed965d6 100644 --- a/target-i386/helper.c +++ b/target-i386/helper.c @@ -531,6 +531,12 @@ int cpu_x86_handle_mmu_fault(CPUX86State *env, target_ulong addr, if (!(env->cr[0] & CR0_PG_MASK)) { pte = addr; +#ifdef TARGET_X86_64 + if (!(env->hflags & HF_LMA_MASK)) { + /* Without long mode we can only address 32bits in real mode */ + pte = (uint32_t)pte; + } +#endif virt_addr = addr & TARGET_PAGE_MASK; prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC; page_size = 4096; -- 1.7.9.5