Re: [RFC] exec: flush CPU TB cache when breakpoint address translation fails

[Alex Bennée]

Max Filippov <address@hidden> writes:

> When a breakpoint is inserted at location for which there's currently no
> virtual to physical translation no action is taken on CPU TB cache. If a
> TB for that virtual address already exists but is not visible ATM the
> breakpoint won't be hit next time an instruction at that address will be
> executed.

So the userspace has run once but is currently paged out?

>
> Flush entire CPU TB cache when a breakpoint is set for a virtual address
> that cannot be translated to physical address.
>
> This change fixes the following workflow:
> - linux user application is running
> - a breakpoint is inserted from QEMU gdbstub for a user address that is
>   not currently present in the target CPU TLB
> - an instruction at that address is executed, but the external debugger
>   doesn't get control.
>
> Signed-off-by: Max Filippov <address@hidden>
> ---
>  exec.c | 2 ++
>  1 file changed, 2 insertions(+)
>
> diff --git a/exec.c b/exec.c
> index ffdb5185353b..918945f8097e 100644
> --- a/exec.c
> +++ b/exec.c
> @@ -1024,6 +1024,8 @@ static void breakpoint_invalidate(CPUState *cpu, 
> target_ulong pc)
>          /* Locks grabbed by tb_invalidate_phys_addr */
>          tb_invalidate_phys_addr(cpu->cpu_ases[asidx].as,
>                                  phys | (pc & ~TARGET_PAGE_MASK), attrs);
> +    } else {
> +        tb_flush(cpu);
>      }
>  }
>  #endif


-- 
Alex Bennée