From mboxrd@z Thu Jan  1 00:00:00 1970
Received: from mailman by lists.gnu.org with tmda-scanned (Exim 4.43)
	id 1GZ81S-0001OI-B0
	for qemu-devel@nongnu.org; Sun, 15 Oct 2006 11:35:30 -0400
Received: from exim by lists.gnu.org with spam-scanned (Exim 4.43)
	id 1GZ81Q-0001Hk-2n
	for qemu-devel@nongnu.org; Sun, 15 Oct 2006 11:35:29 -0400
Received: from [199.232.76.173] (helo=monty-python.gnu.org)
	by lists.gnu.org with esmtp (Exim 4.43) id 1GZ81P-0001Fy-MH
	for qemu-devel@nongnu.org; Sun, 15 Oct 2006 11:35:27 -0400
Received: from [84.96.92.56] (helo=smTp.neuf.fr)
	by monty-python.gnu.org with esmtp (Exim 4.52) id 1GZ8AK-0008RZ-Fk
	for qemu-devel@nongnu.org; Sun, 15 Oct 2006 11:44:40 -0400
Received: from [86.73.70.178] by sp604003mt.gpm.neuf.ld
	(Sun Java System Messaging Server 6.2-5.05 (built Feb 16 2006))
	with ESMTP id <0J760003WOM4NVU0@sp604003mt.gpm.neuf.ld> for
	qemu-devel@nongnu.org; Sun, 15 Oct 2006 17:34:52 +0200 (CEST)
Date: Sun, 15 Oct 2006 17:35:45 +0200
From: Fabrice Bellard <fabrice@bellard.org>
Subject: Re: [Qemu-devel] qemu-0.8.2 i386 -kernel hangs when gdt and idt are
	zero length
In-reply-to: <45310975.8020704@BitWagon.com>
Message-id: <45325551.4070300@bellard.org>
MIME-version: 1.0
Content-type: text/plain; charset=us-ascii; format=flowed
Content-transfer-encoding: 7BIT
References: <45310975.8020704@BitWagon.com>
Reply-To: qemu-devel@nongnu.org
List-Id: qemu-devel.nongnu.org
List-Unsubscribe: <http://lists.nongnu.org/mailman/listinfo/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=unsubscribe>
List-Archive: <http://lists.gnu.org/pipermail/qemu-devel>
List-Post: <mailto:qemu-devel@nongnu.org>
List-Help: <mailto:qemu-devel-request@nongnu.org?subject=help>
List-Subscribe: <http://lists.nongnu.org/mailman/listinfo/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=subscribe>
To: qemu-devel@nongnu.org

John Reiser wrote:
> Hi,
> 
> Under qemu-0.8.2 when emulating i386 -kernel in protected mode,
> and if both the idt and gdt have length zero, then trying
> to load a segment register loops for a very long time.
> 
> 	cli
> 	lidtl  empty_idt
> 	lgdtl  empty_gdt  # %cs info persists in internal registers
> 	movl $0x18,%eax
> 	movl %eax,%ds  # qemu-0.8.2 hangs here
> 
> 	.data
>   empty_idt:
> 	.short 0  # length is zero
> 	.long 0
>   empty_gdt:
> 	.short 0  # length is zero
> 	.long 0
> 
> Because the gdt has length 0, then the descriptor for segment
> 0x18>>3 does not exist in memory.  The Intel manual claims the
> hardware gives "#GP(selector)" fault for loading the segment
> register when the selector index is not within limits, but
> delivery of the exception depends on the idt.  When the idt
> also has zero length, then real hardware enters double-fault
> territory (perhaps triple-fault?) and shuts down.
> 
> It would be nice if qemu emulation detected such a situation,
> then issued an informative message, in addition to
> looping forever as an "emulation" of hardware shutdown.

The first step could be to avoid the infinite loop in the CPU code (it 
prevents exiting the main loop and it is a serious bug).

Emulating double faults could be done, but it is not my priority yet.

Perhaps adding a counter to indicate the number of recursions in the 
interrupt code could suffice to monitor the shutdown conditions.

Regards,

Fabrice.