From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mailman by lists.gnu.org with tmda-scanned (Exim 4.43) id 1KJW4Y-0000Di-2o for qemu-devel@nongnu.org; Thu, 17 Jul 2008 12:11:14 -0400 Received: from exim by lists.gnu.org with spam-scanned (Exim 4.43) id 1KJW4W-0000DV-Gz for qemu-devel@nongnu.org; Thu, 17 Jul 2008 12:11:13 -0400 Received: from [199.232.76.173] (port=52775 helo=monty-python.gnu.org) by lists.gnu.org with esmtp (Exim 4.43) id 1KJW4W-0000DS-8N for qemu-devel@nongnu.org; Thu, 17 Jul 2008 12:11:12 -0400 Received: from gecko.sbs.de ([194.138.37.40]:18515) by monty-python.gnu.org with esmtps (TLS-1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.60) (envelope-from ) id 1KJW4V-0007eu-6a for qemu-devel@nongnu.org; Thu, 17 Jul 2008 12:11:11 -0400 Message-ID: <487F6F0F.4010507@siemens.com> Date: Thu, 17 Jul 2008 18:10:55 +0200 From: Jan Kiszka MIME-Version: 1.0 Subject: Re: [Qemu-devel] [RFC][PATCH] x86: CS limit checks References: <487F3393.3040609@siemens.com> <200807171317.42420.paul@codesourcery.com> <487F45AB.6070906@siemens.com> <200807171437.13717.paul@codesourcery.com> In-Reply-To: <200807171437.13717.paul@codesourcery.com> Content-Type: text/plain; charset=ISO-8859-15 Content-Transfer-Encoding: 7bit Reply-To: qemu-devel@nongnu.org List-Id: qemu-devel.nongnu.org List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Paul Brook Cc: qemu-devel@nongnu.org Paul Brook wrote: > On Thursday 17 July 2008, Jan Kiszka wrote: >> Paul Brook wrote: >>> On Thursday 17 July 2008, Jan Kiszka wrote: >>>> + if (s->pc < s->cs_base || s->pc - s->cs_base > s->cs_limit) { >>>> + /* At least some of the opcode fetches violate the CS limit. >>>> + Overwrite the generated code with a GPF raising one. */ >>>> + gen_opc_ptr = gen_opc_start; >>>> + gen_opparam_ptr = gen_opparam_start; >>>> + gen_exception(s, EXCP0D_GPF, pc_start - s->cs_base); >>>> + } >>> I'm fairly sure this is wrong. The TB may fault before it gets to the end >>> of the segment. Likewise if the instruction spanning the limit happens to >>> be an illegal op you will generate the wrong kind of exception. >> What a pity, it looked so easy. OK, will think about those aspects >> again. BTW, what happens when the translator hits an unresolvable >> address and faults? > > Looks like that's also broken. In practice I guess a page fault occuring > early is usually less harmful than a GPF. To me it looks like as if the generator can so far raise a PF prematurely when it steps on an invalid code address while building a new TB. This probably has to fix the same way as the limit check is realized: by injecting an exception (PF or GP) into the generated code at the correct PC. Hmm, the PF-during-translation issue is probably not just limited to x86... Jan -- Siemens AG, Corporate Technology, CT SE 2 Corporate Competence Center Embedded Linux