From mboxrd@z Thu Jan  1 00:00:00 1970
Received: from mailman by lists.gnu.org with tmda-scanned (Exim 4.43)
	id 1KJTfb-0007YF-J9
	for qemu-devel@nongnu.org; Thu, 17 Jul 2008 09:37:19 -0400
Received: from exim by lists.gnu.org with spam-scanned (Exim 4.43)
	id 1KJTfb-0007Xr-68
	for qemu-devel@nongnu.org; Thu, 17 Jul 2008 09:37:19 -0400
Received: from [199.232.76.173] (port=57872 helo=monty-python.gnu.org)
	by lists.gnu.org with esmtp (Exim 4.43) id 1KJTfa-0007Xm-QJ
	for qemu-devel@nongnu.org; Thu, 17 Jul 2008 09:37:18 -0400
Received: from mail.codesourcery.com ([65.74.133.4]:50734)
	by monty-python.gnu.org with esmtps
	(TLS-1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.60)
	(envelope-from <paul@codesourcery.com>) id 1KJTfa-0006uL-9K
	for qemu-devel@nongnu.org; Thu, 17 Jul 2008 09:37:18 -0400
From: Paul Brook <paul@codesourcery.com>
Subject: Re: [Qemu-devel] [RFC][PATCH] x86: CS limit checks
Date: Thu, 17 Jul 2008 14:37:13 +0100
References: <487F3393.3040609@siemens.com>
	<200807171317.42420.paul@codesourcery.com>
	<487F45AB.6070906@siemens.com>
In-Reply-To: <487F45AB.6070906@siemens.com>
MIME-Version: 1.0
Content-Type: text/plain;
  charset="iso-8859-15"
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
Message-Id: <200807171437.13717.paul@codesourcery.com>
Reply-To: qemu-devel@nongnu.org
List-Id: qemu-devel.nongnu.org
List-Unsubscribe: <http://lists.nongnu.org/mailman/listinfo/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=unsubscribe>
List-Archive: <http://lists.gnu.org/pipermail/qemu-devel>
List-Post: <mailto:qemu-devel@nongnu.org>
List-Help: <mailto:qemu-devel-request@nongnu.org?subject=help>
List-Subscribe: <http://lists.nongnu.org/mailman/listinfo/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=subscribe>
To: qemu-devel@nongnu.org
Cc: Jan Kiszka <jan.kiszka@siemens.com>

On Thursday 17 July 2008, Jan Kiszka wrote:
> Paul Brook wrote:
> > On Thursday 17 July 2008, Jan Kiszka wrote:
> >> +    if (s->pc < s->cs_base || s->pc - s->cs_base > s->cs_limit) {
> >> +        /* At least some of the opcode fetches violate the CS limit.
> >> +           Overwrite the generated code with a GPF raising one. */
> >> +        gen_opc_ptr = gen_opc_start;
> >> +        gen_opparam_ptr = gen_opparam_start;
> >> +        gen_exception(s, EXCP0D_GPF, pc_start - s->cs_base);
> >> +    }
> >
> > I'm fairly sure this is wrong. The TB may fault before it gets to the end
> > of the segment. Likewise if the instruction spanning the limit happens to
> > be an illegal op you will generate the wrong kind of exception.
>
> What a pity, it looked so easy. OK, will think about those aspects
> again. BTW, what happens when the translator hits an unresolvable
> address and faults?

Looks like that's also broken.  In practice I guess a page fault occuring 
early is usually less harmful than a GPF.

Paul