From mboxrd@z Thu Jan  1 00:00:00 1970
Received: from mailman by lists.gnu.org with tmda-scanned (Exim 4.43)
	id 1LXqny-0005kf-Ty
	for qemu-devel@nongnu.org; Fri, 13 Feb 2009 00:41:38 -0500
Received: from exim by lists.gnu.org with spam-scanned (Exim 4.43)
	id 1LXqnw-0005io-WB
	for qemu-devel@nongnu.org; Fri, 13 Feb 2009 00:41:38 -0500
Received: from [199.232.76.173] (port=46030 helo=monty-python.gnu.org)
	by lists.gnu.org with esmtp (Exim 4.43) id 1LXqnw-0005il-RY
	for qemu-devel@nongnu.org; Fri, 13 Feb 2009 00:41:36 -0500
Received: from mail-bw0-f205.google.com ([209.85.218.205]:44141)
	by monty-python.gnu.org with esmtp (Exim 4.60)
	(envelope-from <balrogg@gmail.com>) id 1LXqnw-0005Ur-EU
	for qemu-devel@nongnu.org; Fri, 13 Feb 2009 00:41:36 -0500
Received: by bwz1 with SMTP id 1so1589684bwz.10
	for <qemu-devel@nongnu.org>; Thu, 12 Feb 2009 21:41:34 -0800 (PST)
MIME-Version: 1.0
Date: Fri, 13 Feb 2009 06:41:34 +0100
Message-ID: <fb249edb0902122141j793ab9baja9e740a1673fa8f5@mail.gmail.com>
From: andrzej zaborowski <balrogg@gmail.com>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 7bit
Subject: [Qemu-devel] [PATCH] x86: clear NX bit from address in
	cpu_get_phys_page_debug
Reply-To: qemu-devel@nongnu.org
List-Id: qemu-devel.nongnu.org
List-Unsubscribe: <http://lists.nongnu.org/mailman/listinfo/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=unsubscribe>
List-Archive: <http://lists.gnu.org/pipermail/qemu-devel>
List-Post: <mailto:qemu-devel@nongnu.org>
List-Help: <mailto:qemu-devel-request@nongnu.org?subject=help>
List-Subscribe: <http://lists.nongnu.org/mailman/listinfo/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=subscribe>
To: "qemu-devel@nongnu.org" <qemu-devel@nongnu.org>

All bits outside of PHYS_ADDR_MASK are zeroed in
cpu_x86_handle_mmu_fault to produce the physical address, but not in
cpu_get_phys_page_debug.  The return value of
cpu_get_phys_page_debug() is directly added to phys_ram_base by users
so if the NX bit was set in the PTE, qemu will try to access outside
phys_ram_base.
(This is my interpretation of the error but I'm no expert on x86)

Cheers

--- a/target-i386/helper.c
+++ b/target-i386/helper.c
@@ -1274,7 +1274,7 @@ target_phys_addr_t
cpu_get_phys_page_debug(CPUState *env, target_ulong addr)
     }

     page_offset = (addr & TARGET_PAGE_MASK) & (page_size - 1);
-    paddr = (pte & TARGET_PAGE_MASK) + page_offset;
+    paddr = (pte & PHYS_ADDR_MASK) + page_offset;
     return paddr;
 }