* [Qemu-devel] [Bug 1163065] [NEW] target-i386 cpu_get_phys_page_debug checks bits in wrong order
@ 2013-04-02 0:21 Brendan Dolan-Gavitt
2016-11-30 15:08 ` [Qemu-devel] [Bug 1163065] " Thomas Huth
2017-01-30 4:17 ` Launchpad Bug Tracker
0 siblings, 2 replies; 3+ messages in thread
From: Brendan Dolan-Gavitt @ 2013-04-02 0:21 UTC (permalink / raw)
To: qemu-devel
Public bug reported:
In target-i386 cpu_get_phys_page_debug, the CR4_PAE bit is checked
before CR0_PG. This means that if paging is disabled but the PAE bit has
been set in CR4, cpu_get_phys_page_debug will return the wrong result
(it will try to translate the address as virtual rather than using it as
a physical address).
Although this might seem like an unusual case, it in fact happens
consistently when booting Linux on amd64 (from
linux-2.6.32.60/arch/x86/boot/compressed/head_64.S):
/* Enable PAE mode */
xorl %eax, %eax
orl $(X86_CR4_PAE), %eax
movl %eax, %cr4
[... code to set up page tables omitted ...]
/* Enter paged protected Mode, activating Long Mode */
movl $(X86_CR0_PG | X86_CR0_PE), %eax /* Enable Paging and Protected mode */
movl %eax, %cr0
The most noticeable effect of this bug is that using the disassembler
during this time will fetch the wrong data by trying to read from page
tables that aren't there. One symptom is that booting Linux amd64 with
-d in_asm will result in several "Disassembler disagrees with translator
over instruction decoding" messages.
Attached is a patch that moves the CR0_PG check to the beginning. I'm
still not 100% certain that the logic of cpu_get_phys_page_debug matches
cpu_x86_handle_mmu_fault, but it's a start.
** Affects: qemu
Importance: Undecided
Status: New
** Tags: target-i386
** Patch added: "patch that fixes the issue"
https://bugs.launchpad.net/bugs/1163065/+attachment/3613229/+files/qemu_cpu_get_phys_page_debug.patch
--
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/1163065
Title:
target-i386 cpu_get_phys_page_debug checks bits in wrong order
Status in QEMU:
New
Bug description:
In target-i386 cpu_get_phys_page_debug, the CR4_PAE bit is checked
before CR0_PG. This means that if paging is disabled but the PAE bit
has been set in CR4, cpu_get_phys_page_debug will return the wrong
result (it will try to translate the address as virtual rather than
using it as a physical address).
Although this might seem like an unusual case, it in fact happens
consistently when booting Linux on amd64 (from
linux-2.6.32.60/arch/x86/boot/compressed/head_64.S):
/* Enable PAE mode */
xorl %eax, %eax
orl $(X86_CR4_PAE), %eax
movl %eax, %cr4
[... code to set up page tables omitted ...]
/* Enter paged protected Mode, activating Long Mode */
movl $(X86_CR0_PG | X86_CR0_PE), %eax /* Enable Paging and Protected mode */
movl %eax, %cr0
The most noticeable effect of this bug is that using the disassembler
during this time will fetch the wrong data by trying to read from page
tables that aren't there. One symptom is that booting Linux amd64 with
-d in_asm will result in several "Disassembler disagrees with
translator over instruction decoding" messages.
Attached is a patch that moves the CR0_PG check to the beginning. I'm
still not 100% certain that the logic of cpu_get_phys_page_debug
matches cpu_x86_handle_mmu_fault, but it's a start.
To manage notifications about this bug go to:
https://bugs.launchpad.net/qemu/+bug/1163065/+subscriptions
^ permalink raw reply [flat|nested] 3+ messages in thread
* [Qemu-devel] [Bug 1163065] Re: target-i386 cpu_get_phys_page_debug checks bits in wrong order
2013-04-02 0:21 [Qemu-devel] [Bug 1163065] [NEW] target-i386 cpu_get_phys_page_debug checks bits in wrong order Brendan Dolan-Gavitt
@ 2016-11-30 15:08 ` Thomas Huth
2017-01-30 4:17 ` Launchpad Bug Tracker
1 sibling, 0 replies; 3+ messages in thread
From: Thomas Huth @ 2016-11-30 15:08 UTC (permalink / raw)
To: qemu-devel
Can you still reproduce this problem with the latest version of QEMU? If
so, could you please send a refreshed patch to the qemu-devel mailing
list? We do not pick up patches from the bug tracker. Thanks!
** Changed in: qemu
Status: New => Incomplete
--
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/1163065
Title:
target-i386 cpu_get_phys_page_debug checks bits in wrong order
Status in QEMU:
Incomplete
Bug description:
In target-i386 cpu_get_phys_page_debug, the CR4_PAE bit is checked
before CR0_PG. This means that if paging is disabled but the PAE bit
has been set in CR4, cpu_get_phys_page_debug will return the wrong
result (it will try to translate the address as virtual rather than
using it as a physical address).
Although this might seem like an unusual case, it in fact happens
consistently when booting Linux on amd64 (from
linux-2.6.32.60/arch/x86/boot/compressed/head_64.S):
/* Enable PAE mode */
xorl %eax, %eax
orl $(X86_CR4_PAE), %eax
movl %eax, %cr4
[... code to set up page tables omitted ...]
/* Enter paged protected Mode, activating Long Mode */
movl $(X86_CR0_PG | X86_CR0_PE), %eax /* Enable Paging and Protected mode */
movl %eax, %cr0
The most noticeable effect of this bug is that using the disassembler
during this time will fetch the wrong data by trying to read from page
tables that aren't there. One symptom is that booting Linux amd64 with
-d in_asm will result in several "Disassembler disagrees with
translator over instruction decoding" messages.
Attached is a patch that moves the CR0_PG check to the beginning. I'm
still not 100% certain that the logic of cpu_get_phys_page_debug
matches cpu_x86_handle_mmu_fault, but it's a start.
To manage notifications about this bug go to:
https://bugs.launchpad.net/qemu/+bug/1163065/+subscriptions
^ permalink raw reply [flat|nested] 3+ messages in thread
* [Qemu-devel] [Bug 1163065] Re: target-i386 cpu_get_phys_page_debug checks bits in wrong order
2013-04-02 0:21 [Qemu-devel] [Bug 1163065] [NEW] target-i386 cpu_get_phys_page_debug checks bits in wrong order Brendan Dolan-Gavitt
2016-11-30 15:08 ` [Qemu-devel] [Bug 1163065] " Thomas Huth
@ 2017-01-30 4:17 ` Launchpad Bug Tracker
1 sibling, 0 replies; 3+ messages in thread
From: Launchpad Bug Tracker @ 2017-01-30 4:17 UTC (permalink / raw)
To: qemu-devel
[Expired for QEMU because there has been no activity for 60 days.]
** Changed in: qemu
Status: Incomplete => Expired
--
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/1163065
Title:
target-i386 cpu_get_phys_page_debug checks bits in wrong order
Status in QEMU:
Expired
Bug description:
In target-i386 cpu_get_phys_page_debug, the CR4_PAE bit is checked
before CR0_PG. This means that if paging is disabled but the PAE bit
has been set in CR4, cpu_get_phys_page_debug will return the wrong
result (it will try to translate the address as virtual rather than
using it as a physical address).
Although this might seem like an unusual case, it in fact happens
consistently when booting Linux on amd64 (from
linux-2.6.32.60/arch/x86/boot/compressed/head_64.S):
/* Enable PAE mode */
xorl %eax, %eax
orl $(X86_CR4_PAE), %eax
movl %eax, %cr4
[... code to set up page tables omitted ...]
/* Enter paged protected Mode, activating Long Mode */
movl $(X86_CR0_PG | X86_CR0_PE), %eax /* Enable Paging and Protected mode */
movl %eax, %cr0
The most noticeable effect of this bug is that using the disassembler
during this time will fetch the wrong data by trying to read from page
tables that aren't there. One symptom is that booting Linux amd64 with
-d in_asm will result in several "Disassembler disagrees with
translator over instruction decoding" messages.
Attached is a patch that moves the CR0_PG check to the beginning. I'm
still not 100% certain that the logic of cpu_get_phys_page_debug
matches cpu_x86_handle_mmu_fault, but it's a start.
To manage notifications about this bug go to:
https://bugs.launchpad.net/qemu/+bug/1163065/+subscriptions
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2017-01-30 4:30 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2013-04-02 0:21 [Qemu-devel] [Bug 1163065] [NEW] target-i386 cpu_get_phys_page_debug checks bits in wrong order Brendan Dolan-Gavitt
2016-11-30 15:08 ` [Qemu-devel] [Bug 1163065] " Thomas Huth
2017-01-30 4:17 ` Launchpad Bug Tracker
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.