From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:57415) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1XJUEY-00075I-Mh for qemu-devel@nongnu.org; Mon, 18 Aug 2014 17:13:03 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1XJUEP-0007tV-Kc for qemu-devel@nongnu.org; Mon, 18 Aug 2014 17:12:54 -0400 Received: from mail-wg0-x230.google.com ([2a00:1450:400c:c00::230]:60737) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1XJUEP-0007tL-EV for qemu-devel@nongnu.org; Mon, 18 Aug 2014 17:12:45 -0400 Received: by mail-wg0-f48.google.com with SMTP id x13so5516446wgg.31 for ; Mon, 18 Aug 2014 14:12:44 -0700 (PDT) Sender: Paolo Bonzini Message-ID: <53F26C48.7040904@redhat.com> Date: Mon, 18 Aug 2014 23:12:40 +0200 From: Paolo Bonzini MIME-Version: 1.0 References: <5FAD0382C1B6944A908C8A46AB12DA9D03E1EB@LLE2K10-MBX02.mitll.ad.local> <53EE7214.9000603@redhat.com> <9BA52E25-E3BF-42FF-B080-86B7926D8B80@ll.mit.edu> <53F03BCC.705@redhat.com> <53F239D1.6070001@twiddle.net> <98E51B30-6FC2-42D3-A5D2-6504B0B6472D@ll.mit.edu> In-Reply-To: <98E51B30-6FC2-42D3-A5D2-6504B0B6472D@ll.mit.edu> Content-Type: text/plain; charset=windows-1252 Content-Transfer-Encoding: 8bit Subject: Re: [Qemu-devel] QEMU, self-modifying code, and Windows 7 64-bit (no KVM) List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: "Hulin, Patrick - 0559 - MITLL" , Richard Henderson Cc: "qemu-devel@nongnu.org" Il 18/08/2014 19:47, Hulin, Patrick - 0559 - MITLL ha scritto: >> We'll have done the page for the first byte at the top of >> helper_{le,be}_{ld,st}_name. When we discover it's an unaligned >> access, we should load and check the pte for the second page. We >> might have to shuffle those two tests around, since in theory the >> second page could be I/O mapped and we'd want to pass off the >> whole access to io_mem_*. >> >> Since two adjacent pages can't conflict in our direct-mapped TLB, >> we can then safely pass off the work to secondary helpers without >> fear the first TLB entry will be flushed. > > This isn’t about cross-page writes, although that might make fixing > the problem a little tricky. The issue occurs with two adjacent TBs > on the same page: because the individual writes are split up and done > in reverse order, writes (and reads) off the back of the current TB > happen twice. In the case of an xor this means the original xor gets > undone, which is what breaks in Windows 7. If you fill the TLB beforehand as suggested by Richard, you can reverse again the direction of the "for" loop. This should hopefully fix your bug. Of course if the write is not cross-page, there's no need to do the TLB pre-fill. Thanks for the test case! Paolo