[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PULL 7/8] accel/tcg: Use correct test when looking in vict
From: |
Peter Maydell |
Subject: |
[Qemu-devel] [PULL 7/8] accel/tcg: Use correct test when looking in victim TLB for code |
Date: |
Mon, 16 Jul 2018 17:42:59 +0100 |
In get_page_addr_code(), we were incorrectly looking in the victim
TLB for an entry which matched the target address for reads, not
for code accesses. This meant that we could hit on a victim TLB
entry that indicated that the address was readable but not
executable, and incorrectly bypass the call to tlb_fill() which
should generate the guest MMU exception. Fix this bug.
Signed-off-by: Peter Maydell <address@hidden>
Reviewed-by: Richard Henderson <address@hidden>
Message-id: address@hidden
---
accel/tcg/cputlb.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
index 20c147d6554..2d5fb15d9a3 100644
--- a/accel/tcg/cputlb.c
+++ b/accel/tcg/cputlb.c
@@ -967,7 +967,7 @@ tb_page_addr_t get_page_addr_code(CPUArchState *env,
target_ulong addr)
index = (addr >> TARGET_PAGE_BITS) & (CPU_TLB_SIZE - 1);
mmu_idx = cpu_mmu_index(env, true);
if (unlikely(!tlb_hit(env->tlb_table[mmu_idx][index].addr_code, addr))) {
- if (!VICTIM_TLB_HIT(addr_read, addr)) {
+ if (!VICTIM_TLB_HIT(addr_code, addr)) {
tlb_fill(ENV_GET_CPU(env), addr, 0, MMU_INST_FETCH, mmu_idx, 0);
}
}
--
2.17.1
- [Qemu-devel] [PULL 0/8] target-arm queue, Peter Maydell, 2018/07/16
- [Qemu-devel] [PULL 3/8] hw/intc/arm_gic: Check interrupt number in gic_deactivate_irq(), Peter Maydell, 2018/07/16
- [Qemu-devel] [PULL 4/8] hw/intc/arm_gic: Fix handling of GICD_ITARGETSR, Peter Maydell, 2018/07/16
- [Qemu-devel] [PULL 2/8] aspeed: Implement write-1-{set, clear} for AST2500 strapping, Peter Maydell, 2018/07/16
- [Qemu-devel] [PULL 1/8] target/arm: Fix LD1W and LDFF1W (scalar plus vector), Peter Maydell, 2018/07/16
- [Qemu-devel] [PULL 5/8] hw/arm/bcm2836: Mark the bcm2836 / bcm2837 devices with user_creatable = false, Peter Maydell, 2018/07/16
- [Qemu-devel] [PULL 8/8] accel/tcg: Assert that tlb fill gave us a valid TLB entry, Peter Maydell, 2018/07/16
- [Qemu-devel] [PULL 6/8] bcm2835_aux: Swap RX and TX interrupt assignments, Peter Maydell, 2018/07/16
- [Qemu-devel] [PULL 7/8] accel/tcg: Use correct test when looking in victim TLB for code,
Peter Maydell <=
- Re: [Qemu-devel] [PULL 0/8] target-arm queue, Peter Maydell, 2018/07/17