From: "Pavel Dovgaluk" <Pavel.Dovgaluk@ispras.ru>
References: <20141021121453.7268.529.stgit@PASHA-ISP>
	<5449299B.9070902@twiddle.net>
In-Reply-To: <5449299B.9070902@twiddle.net>
Date: Fri, 24 Oct 2014 09:24:35 +0400
Message-ID: <000901cfef4a$cdb281c0$69178540$@Dovgaluk@ispras.ru>
MIME-Version: 1.0
Content-Type: text/plain;
	charset="UTF-8"
Content-Transfer-Encoding: 7bit
Content-Language: ru
Subject: Re: [Qemu-devel] [PATCH] arm: fix TB alignment check
To: 'Richard Henderson' <rth@twiddle.net>, qemu-devel@nongnu.org
Cc: 'Leon Alrae' <leon.alrae@imgtec.com>, batuzovk@ispras.ru, maria.klimushenkova@ispras.ru, pbonzini@redhat.com, zealot351@gmail.com, alex.bennee@linaro.org

> From: Richard Henderson [mailto:rth7680@gmail.com] On Behalf Of Richard Henderson
> On 10/21/2014 05:14 AM, Pavel Dovgalyuk wrote:
> > Sometimes page faults happen during the translation of the target instructions.
> > To avoid the faults in the middle of the TB we have to stop translation at
> > the end of the page. Current implementation of ARM translation assumes that
> > instructions are aligned to their own size (4 or 2 bytes). But in thumb2 mode
> > 4-byte instruction can be aligned to 2 bytes. In some cases such an alignment
> > leads to page fault.
> > This patch adds check that allows translation of such instructions only in
> > the beginning of the TB.
> >
> > Signed-off-by: Pavel Dovgalyuk <pavel.dovgaluk@ispras.ru>
> > ---
> >  target-arm/translate.c |    3 ++-
> >  1 files changed, 2 insertions(+), 1 deletions(-)
> >
> > diff --git a/target-arm/translate.c b/target-arm/translate.c
> > index 2c0b1de..bc3a16b 100644
> > --- a/target-arm/translate.c
> > +++ b/target-arm/translate.c
> > @@ -11124,7 +11124,8 @@ static inline void gen_intermediate_code_internal(ARMCPU *cpu,
> >               !cs->singlestep_enabled &&
> >               !singlestep &&
> >               !dc->ss_active &&
> > -             dc->pc < next_page_start &&
> > +             /* +3 is for unaligned Thumb2 instructions */
> > +             dc->pc + 3 < next_page_start &&
> 
> I'd like to know more about the problem you're seeing here.
> 

The problem is coupled with the execution determinism.
Consider the following two cases:

      0x0000ffa insn0
TB1   0x0000ffc insn1
TB2   0x0000ffe insn2
      0x0001002 insn3

In different execution scenarios TB may start from address TB1 or TB2.
when the page 0x1000 is not mapped, translation of insn2 will cause an exception.
In first case exception appears after executing insn0 and in second case - after insn1.

This means that execution of the code is not deterministic and depends on
translation order.

Pavel Dovgalyuk