[Qemu-devel] Cooperative BBL execution due to binary translation

[Qemu-devel] Cooperative BBL execution due to binary translation

[felix.matenaar@rwth-aachen]

Hi *,

I have the following question regarding qemu binary translation of
target-i386 (and maybe other targets):

As far as I understood the code, when a basic block is executed, there
is no event which can interrupt the execution until the bbl reaches its
end and the control flow is then back at qemu. Is this right? Stumbled
over this when asking me why basic blocks are sometimes divided even if
there is no branch in it.

If so, is the reason for this that some application like that could
cause timing problems:

c = get_executable_memory(1Gb)
set(c, OPCODE_NOP, sizeof c)
jmp_into c

Regards,
    Felix

Re: [Qemu-devel] Cooperative BBL execution due to binary translation

[Blue Swirl]

On Sun, Oct 16, 2011 at 2:19 AM, felix.matenaar@rwth-aachen
<felix.matenaar@rwth-aachen.de> wrote:
> Hi *,
>
> I have the following question regarding qemu binary translation of
> target-i386 (and maybe other targets):
>
> As far as I understood the code, when a basic block is executed, there
> is no event which can interrupt the execution until the bbl reaches its
> end and the control flow is then back at qemu. Is this right? Stumbled
> over this when asking me why basic blocks are sometimes divided even if
> there is no branch in it.
>
> If so, is the reason for this that some application like that could
> cause timing problems:
>
> c = get_executable_memory(1Gb)
> set(c, OPCODE_NOP, sizeof c)
> jmp_into c

Not really, we don't care very much about such timing problems.
Translation is limited so that the intermediate buffer does not
overflow, also page boundaries may not be crossed. If an instruction
may cause a fault, it will terminate the block.

Re: [Qemu-devel] Cooperative BBL execution due to binary translation

[Avi Kivity]

On 10/16/2011 02:06 PM, Blue Swirl wrote:
> >
> > c = get_executable_memory(1Gb)
> > set(c, OPCODE_NOP, sizeof c)
> > jmp_into c
>
> Not really, we don't care very much about such timing problems.
> Translation is limited so that the intermediate buffer does not
> overflow, also page boundaries may not be crossed. If an instruction
> may cause a fault, it will terminate the block.

On x86 an instruction may cross page boundary.  So an instruction that
begins in one page may be interpreted differently depending on the
contents of the second page.  But I see that the code handles it cleverly.

-- 
error compiling committee.c: too many arguments to function