[Top][All Lists]
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] sha1sum segfaults on x86_64 target / i386 host
From: |
Aurelien Jarno |
Subject: |
[Qemu-devel] sha1sum segfaults on x86_64 target / i386 host |
Date: |
Tue, 22 Sep 2009 17:49:49 +0200 |
User-agent: |
Mutt/1.5.18 (2008-05-17) |
Hi,
In qemu 0.10.X, sha1sum or gnupg segfault (both user and system mode)
when used on i386 host / x86_64 target.
This has been fixed in trunk by the following commit.
| commit 8cd6345d00a25ffa8828bce31154c88f76fb7fc6
| Author: malc <address@hidden>
| Date: Thu Apr 2 22:54:35 2009 +0000
|
| Immediate versions of ro[lr]
|
| git-svn-id: svn://svn.savannah.nongnu.org/qemu/address@hidden
c046a42c-6fe2-441c-8c8c-71466251a162
Actually I am not really convinced it has been fixed, I really think the
bug is still present, but not triggerable anymore this way.
It looks like very long translation are not stopped correctly. This part
of code looks suspicious:
/* if too long translation, stop generation too */
if (gen_opc_ptr >= gen_opc_end ||
(pc_ptr - pc_start) >= (TARGET_PAGE_SIZE - 32) ||
num_insns >= max_insns) {
gen_jmp_im(pc_ptr - dc->cs_base);
gen_eob(dc);
break;
}
If I understand correctly, when the end of the buffer is reached, the
translation is stopped, but some more opc are added by gen_jmp_im()
and gen_eob().
OTOH, on MIPS the following code leaves some space at the end of the
buffer for a few more opc:
/* Leave some spare opc slots for branch handling. */
gen_opc_end = gen_opc_buf + OPC_MAX_SIZE - 16;
Applying the same changes to the x86_64 target fixes the bug. However, I
am not sure it is fully correct. Any comment?
Regards,
Aurelien
--
Aurelien Jarno GPG: 1024D/F1BCDB73
address@hidden http://www.aurel32.net
- [Qemu-devel] sha1sum segfaults on x86_64 target / i386 host,
Aurelien Jarno <=