[Qemu-devel] page fault during ins

* [Qemu-devel] page fault during ins
@ 2004-12-13 14:52 Piotras
  2004-12-14 21:40 ` Fabrice Bellard
  0 siblings, 1 reply; 9+ messages in thread
From: Piotras @ 2004-12-13 14:52 UTC (permalink / raw)
  To: qemu-devel

[-- Attachment #1: Type: text/plain, Size: 566 bytes --]

Hi!

The current implementation of ins (Input from Port to String) is 
not-restartable. If page fault occurs during write, the port read 
is redone and for some devices this may give unexpected results.

This is different from what real CPU does. From my tests with 
Pentium II it seems that the CPU first makes sure that data can 
be written, and then issue IO read. I'm attaching my test program 
-- it may do harm to your system, so be very careful. The test 
assumes that there is a CDROM connected as master to second 
IDE controller (hdc).

Regards,

Piotrek

[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #2: test-ide.c --]
[-- Type: text/x-csrc; name="test-ide.c", Size: 919 bytes --]

#include <sys/io.h>
#include <sys/mman.h>
#include <signal.h>
#include <stdio.h>
#include <stdint.h>

uint16_t *data;

void segv()
{
    printf("SEGV\n");
    data = mmap(data, 4096, PROT_READ | PROT_WRITE,
                MAP_PRIVATE | MAP_ANONYMOUS | MAP_FIXED, -1, 0);
    if (data == MAP_FAILED) {
        exit(1);
    }
}

int main()
{
    int i;
    unsigned char v;

    data = mmap(0, 4096, PROT_NONE,
                MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
    if (data == MAP_FAILED) {
        exit(1);
    }
    signal(SIGSEGV, segv);

    iopl(3);

    do {
        v = inb(0x0177);
    } while ((v & 0xc0) != 0x40);
    outb(0x00, 0x0176);
    outb(0xa1, 0x0177);
    do {
        v = inb(0x0177);
    } while ((v & 0x08) != 0x08);
    insw(0x0170, data, 256);
    for(i = 0; i < 256; ++ i) {
        printf("%04x%c", data[i], (i % 8 != 7)? ' ': '\n');
    }
}

^ permalink raw reply	[flat|nested] 9+ messages in thread