答复: Two questions abo ut RF bit in Rflags

Hi Stanislav,

 

Thank you so much for your quick response.

Your answer is very useful to me.

 

I am still a little confused about your description below.

 

If there is a code breakpoint in the page, the page will not be allowed to
stream through direct access and prefetch() will be called after each
instruction.

 

Could you give more detail on this. As I know, prefech() is called only if
the execution cross the page or invalidate_prefetch_q() set the window to 0.


How does Bochs make prefetch() be called after each instruction?

 

Thanks,

Cliff

 

发件人: Stanislav Shwartsman [mailto:[email protected]] 
发送时间: 2018年1月16日 13:05
收件人: '刘冬华' <[email protected]>;
[email protected]
抄送: 'Bowei, Zhang' <[email protected]>; [email protected];
[email protected]; 'Guanhua Li' <[email protected]>;
[email protected]; [email protected]; '温冀烨'
<[email protected]>
主题: RE: [Bochs-developers] Two questions about RF bit in Rflags

 

Hi,

 

You can see the RF flag from the other side.

It can’t be checked by software too easily, only when pushed to the stack
by exception or by PUSHF.

And normally (after each successfully execution instruction) RF will be 0.

So Bochs maintains RF as always zero and only attempts to set it to ‘1 when
it is required:

 

When calling an event handler, Intel 64 and IA-32 processors establish the
value of the RF flag in the EFLAGS image

pushed on the stack:

* For any fault-class exception except a debug exception generated in
response to an instruction breakpoint, the

value pushed for RF is 1.

* For any interrupt arriving after any iteration of a repeated string
instruction but the last iteration, the value

pushed for RF is 1.

* For any trap-class exception generated by any iteration of a repeated
string instruction but the last iteration,

the value pushed for RF is 1.

 

It is not done 100% correct yet (i.e. some conditions might be missing) but
most common cases are handled.

 

Q1:  As SDM described, RF flag is cleared after the check for code
breakpoint for each instruction. 

      Could you tell me what Bochs does on this? I haven’t find how Bochs
implements this feature. Did I miss anything?

 

The code breakpoint handling is done on the prefetch().

 

  if (hwbreakpoint_check(laddr, BX_HWDebugInstruction,
BX_HWDebugInstruction)) {

    signal_event(BX_EVENT_CODE_BREAKPOINT_ASSIST);

    if (! interrupts_inhibited(BX_INHIBIT_DEBUG)) {

       // The next instruction could already hit a code breakpoint but

       // async_event won't take effect immediatelly.

       // Check if the next executing instruction hits code breakpoint

 

       // check only if not fetching page cross instruction

       // this check is 32-bit wrap safe as well

       if (EIP == (Bit32u) BX_CPU_THIS_PTR prev_rip) {

         Bit32u dr6_bits = code_breakpoint_match(laddr);

         if (dr6_bits & BX_DEBUG_TRAP_HIT) {

           BX_ERROR(("#DB: x86 code breakpoint catched"));

           BX_CPU_THIS_PTR debug_trap |= dr6_bits;

           exception(BX_DB_EXCEPTION, 0);

         }

       }

    }

  }

  else {

    clear_event(BX_EVENT_CODE_BREAKPOINT_ASSIST);

  }

 

Normally, when there is no code breakpoint set in the page nobody will even
try to check for it during the page execution.

If there is a code breakpoint in the page, the page will not be allowed to
stream through direct access and prefetch() will be called after each
instruction.

 

Stanislav

 

From: 刘冬华 [ <mailto:[email protected]> mailto:[email protected]] 
Sent: Tuesday, 16 January 2018 4:28
To:  <mailto:[email protected]> bochs-developers@lists.
sourceforge.net
Cc: Bowei, Zhang < <mailto:[email protected]>
[email protected]>;  <mailto:[email protected]>
[email protected];  <mailto:[email protected]> [email protected];
'Guanhua Li' < <mailto:[email protected]> [email protected]>;
<mailto:[email protected]> [email protected];
<mailto:[email protected]> [email protected]; '温冀烨' <
<mailto:[email protected]> [email protected]>
Subject: [Bochs-developers] Two questions about RF bit in Rflags

 

Hi,

 

 

The Bochs is amazing software and I am a fan of yours.

 

I am studying the code related to RF bit. Here I have two questions about
setting and clearing RF bit to consult you.

And my questions are based on 17.3.1.1 in SDM said as below.

 

All Intel 64 and IA-32 processors manage the RF flag as follows. The RF Flag
is cleared at the start of the instruction

after the check for code breakpoint, CS limit violation and FP exceptions.
Task Switches and IRETD/IRETQ instructions

transfer the RF image from the TSS/stack to the EFLAGS register.

When calling an event handler, Intel 64 and IA-32 processors establish the
value of the RF flag in the EFLAGS image

pushed on the stack:

* For any fault-class exception except a debug exception generated in
response to an instruction breakpoint, the

value pushed for RF is 1.

* For any interrupt arriving after any iteration of a repeated string
instruction but the last iteration, the value

pushed for RF is 1.

* For any trap-class exception generated by any iteration of a repeated
string instruction but the last iteration,

the value pushed for RF is 1.

 

 

My questions:

 

Q1:  As SDM described, RF flag is cleared after the check for code
breakpoint for each instruction. 

      Could you tell me what Bochs does on this? I haven’t find how Bochs
implements this feature. Did I miss anything?

 

 

Q2:  As SDM described, the value pushed for RF is 1 on the conditions above
(red part).

      Could you tell me how Bochs handles this scenario? 

I haven’t find any actions to set RF in bochs code except fault-class
exception.

 

 

Thanks,

Cliff

------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, Slashdot.org! http://sdm.link/slashdot

_______________________________________________
bochs-developers mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/bochs-developers