From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mailman by lists.gnu.org with tmda-scanned (Exim 4.43) id 1LwJdx-0004FL-FZ for qemu-devel@nongnu.org; Tue, 21 Apr 2009 13:20:25 -0400 Received: from exim by lists.gnu.org with spam-scanned (Exim 4.43) id 1LwJdv-0004Et-Ha for qemu-devel@nongnu.org; Tue, 21 Apr 2009 13:20:24 -0400 Received: from [199.232.76.173] (port=42459 helo=monty-python.gnu.org) by lists.gnu.org with esmtp (Exim 4.43) id 1LwJdv-0004Eq-8k for qemu-devel@nongnu.org; Tue, 21 Apr 2009 13:20:23 -0400 Received: from fe01x03-cgp.akado.ru ([77.232.31.164]:60335 helo=akado.ru) by monty-python.gnu.org with esmtp (Exim 4.60) (envelope-from ) id 1LwJdt-0006MA-Vw for qemu-devel@nongnu.org; Tue, 21 Apr 2009 13:20:22 -0400 Date: Tue, 21 Apr 2009 21:20:13 +0400 (MSD) From: malc Subject: Re: [Qemu-devel] multi-bytes nop and 64bits In-Reply-To: <1240295938.9112.3529.camel@localhost> Message-ID: References: <1240249899.9112.2867.camel@localhost> <1240295938.9112.3529.camel@localhost> MIME-Version: 1.0 Content-Type: MULTIPART/MIXED; BOUNDARY="33734824-439896264-1240334413=:2238" List-Id: qemu-devel.nongnu.org List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Mark Karpeles Cc: qemu-devel@nongnu.org This message is in MIME format. The first part should be readable text, while the remaining parts are likely unreadable without MIME-aware tools. --33734824-439896264-1240334413=:2238 Content-Type: TEXT/PLAIN; charset=koi8-r Content-Transfer-Encoding: QUOTED-PRINTABLE On Tue, 21 Apr 2009, Mark Karpeles wrote: > Hi, >=20 > Le mardi 21 avril 2009 =FF=FF 02:10 +0400, malc a =FF=FFcrit : > > On Mon, 20 Apr 2009, Mark Karpeles wrote: > > > As seen by qemu (QEMU PC emulator version 0.10.1): > > >=20 > > > 0x0000000000201000: (bad) > > > 0x0000000000201002: add %bpl,%cl > > > 0x0000000000201005: sub %edx,0x0(%rcx) > > > 0x0000000000201008: add %al,(%rax) > > > 0x000000000020100a: add %al,(%rax) > > > (The code after this line is not meant to be executed, it's read-only > > > data, and so the system will crash) > > The disassembler is disconnected from the main translation engine, so > > what you see (produced by the older version of i386 disassmbler from > > GNU binutils) might not be what QEMU actually translates/executes. To > > be sure use gdbstub and recent GDB to see, hopefully, more coherent vie= w. >=20 > Oh my... I checked more and tried running this without the qemu debug > mode "in_asm", and it's working indeed. > So, in_asm will decompile memory until it reaches a "stop" operation > (ret, %cr3 changed, etc), however if it doesn't reach such an operation > it will continue reading memory. >=20 > I wasn't expecting this bug because the fact it was continuing to read > memory caused a page-fault which was catched by the kernel I'm writing. > I never though the debugger could trigger stuff like OS pagefaults (and > of course it was happening with %rip exactly pointing to a long nop, > that's why I wasn't understanding the origin of the page fault). >=20 > Maybe this could be added to some documentation: "If guest OS crashes > because of a page fault on a long nop operation, try disabling in_asm > debugging mode". I think fixing disassembler is a better idea, disas.c:target_disas is clearly broken, since: void target_disas(FILE *out, target_ulong code, target_ulong size, int=20 flags) { =2E.. for (pc =3D code; size > 0; pc +=3D count, size -=3D count) { So here size is unsigned and as such the stop condition can only become true when translator and disassembler have the same idea how they decode instructions (which was clearly not the case for hint_nop). =20 > Or maybe this debugging mode could be fixed to handle long nops? This > debugging mode is really helpful to understand what happened during a > crash, and for people writing their own kernel (like me) it's a life > savior. >=20 > I had a look at qemu's decompiler (an old version of i386-dec.c from > gdb), and "fixed" it to support nopl correctly (and at least avoid > weird crashes). >=20 > Patch: > http://ookoo.org/svn/snip/qemu-0.10.1-nopl-fix.patch I'm not intimately familiar with binutils' disasm but it looks correct save for the fact that hint_nop take M and not Ev as operand, which might be irrelevant for disassembler though... > Anyway thanks for the tip, you just saved me more days of head > scratching. You are welcome.. --=20 mailto:av1474@comtv.ru --33734824-439896264-1240334413=:2238--