> From: Richard Henderson [mailto:rth7...@gmail.com] On Behalf Of Richard
> Henderson
> On 10/21/2014 05:14 AM, Pavel Dovgalyuk wrote:
> > Sometimes page faults happen during the translation of the target
> > instructions.
> > To avoid the faults in the middle of the TB we have to stop translation at
> > the end of the page. Current implementation of ARM translation assumes that
> > instructions are aligned to their own size (4 or 2 bytes). But in thumb2
> > mode
> > 4-byte instruction can be aligned to 2 bytes. In some cases such an
> > alignment
> > leads to page fault.
> > This patch adds check that allows translation of such instructions only in
> > the beginning of the TB.
> >
> > Signed-off-by: Pavel Dovgalyuk <pavel.dovga...@ispras.ru>
> > ---
> > target-arm/translate.c | 3 ++-
> > 1 files changed, 2 insertions(+), 1 deletions(-)
> >
> > diff --git a/target-arm/translate.c b/target-arm/translate.c
> > index 2c0b1de..bc3a16b 100644
> > --- a/target-arm/translate.c
> > +++ b/target-arm/translate.c
> > @@ -11124,7 +11124,8 @@ static inline void
> > gen_intermediate_code_internal(ARMCPU *cpu,
> > !cs->singlestep_enabled &&
> > !singlestep &&
> > !dc->ss_active &&
> > - dc->pc < next_page_start &&
> > + /* +3 is for unaligned Thumb2 instructions */
> > + dc->pc + 3 < next_page_start &&
>
> I'd like to know more about the problem you're seeing here.
>
The problem is coupled with the execution determinism.
Consider the following two cases:
0x0000ffa insn0
TB1 0x0000ffc insn1
TB2 0x0000ffe insn2
0x0001002 insn3
In different execution scenarios TB may start from address TB1 or TB2.
when the page 0x1000 is not mapped, translation of insn2 will cause an
exception.
In first case exception appears after executing insn0 and in second case -
after insn1.
This means that execution of the code is not deterministic and depends on
translation order.
Pavel Dovgalyuk
