89 lines
3.2 KiB
Diff
89 lines
3.2 KiB
Diff
From 43526150fac8e7d36739e948cb3ca2f433e4e607 Mon Sep 17 00:00:00 2001
|
|
From: Alexander Graf <agraf@suse.de>
|
|
Date: Mon, 7 May 2012 11:23:02 +0200
|
|
Subject: [PATCH] linux-user: Fix stale tbs after mmap
|
|
|
|
If we execute linux-user code that does the following:
|
|
|
|
* A = mmap()
|
|
* execute code in A
|
|
* munmap(A)
|
|
* B = mmap(), but mmap returns the same address as A
|
|
* execute code in B
|
|
|
|
we end up executing a stale cached tb that contains translated code
|
|
from A, while we want new code from B.
|
|
|
|
This patch adds a TB flush for mmap'ed regions, before we return them,
|
|
avoiding the whole issue.
|
|
|
|
Reported-by: Peter Maydell <peter.maydell@linaro.org>
|
|
Signed-off-by: Alexander Graf <agraf@suse.de>
|
|
---
|
|
exec-all.h | 2 ++
|
|
exec.c | 17 +++++++++++++++++
|
|
linux-user/mmap.c | 2 ++
|
|
3 files changed, 21 insertions(+), 0 deletions(-)
|
|
|
|
diff --git a/exec-all.h b/exec-all.h
|
|
index c211242..7fcd76f 100644
|
|
--- a/exec-all.h
|
|
+++ b/exec-all.h
|
|
@@ -96,6 +96,8 @@ void QEMU_NORETURN cpu_loop_exit(CPUState *env1);
|
|
int page_unprotect(target_ulong address, unsigned long pc, void *puc);
|
|
void tb_invalidate_phys_page_range(tb_page_addr_t start, tb_page_addr_t end,
|
|
int is_cpu_write_access);
|
|
+void tb_invalidate_phys_range(tb_page_addr_t start, tb_page_addr_t end,
|
|
+ int is_cpu_write_access);
|
|
void tlb_flush_page(CPUState *env, target_ulong addr);
|
|
void tlb_flush(CPUState *env, int flush_global);
|
|
#if !defined(CONFIG_USER_ONLY)
|
|
diff --git a/exec.c b/exec.c
|
|
index e71a82d..532b00c 100644
|
|
--- a/exec.c
|
|
+++ b/exec.c
|
|
@@ -1016,6 +1016,23 @@ TranslationBlock *tb_gen_code(CPUState *env,
|
|
return tb;
|
|
}
|
|
|
|
+/*
|
|
+ * invalidate all TBs which intersect with the target physical pages
|
|
+ * starting in range [start;end[. NOTE: start and end may refer to
|
|
+ * different physical pages. 'is_cpu_write_access' should be true if called
|
|
+ * from a real cpu write access: the virtual CPU will exit the current
|
|
+ * TB if code is modified inside this TB.
|
|
+ */
|
|
+void tb_invalidate_phys_range(tb_page_addr_t start, tb_page_addr_t end,
|
|
+ int is_cpu_write_access)
|
|
+{
|
|
+ while (start < end) {
|
|
+ tb_invalidate_phys_page_range(start, end, is_cpu_write_access);
|
|
+ start &= TARGET_PAGE_MASK;
|
|
+ start += TARGET_PAGE_SIZE;
|
|
+ }
|
|
+}
|
|
+
|
|
/* invalidate all TBs which intersect with the target physical page
|
|
starting in range [start;end[. NOTE: start and end must refer to
|
|
the same physical page. 'is_cpu_write_access' should be true if called
|
|
diff --git a/linux-user/mmap.c b/linux-user/mmap.c
|
|
index 2620f88..3611deb 100644
|
|
--- a/linux-user/mmap.c
|
|
+++ b/linux-user/mmap.c
|
|
@@ -587,6 +587,7 @@ abi_long target_mmap(abi_ulong start, abi_ulong len, int prot,
|
|
page_dump(stdout);
|
|
printf("\n");
|
|
#endif
|
|
+ tb_invalidate_phys_range(start, start + len, 0);
|
|
mmap_unlock();
|
|
return start;
|
|
fail:
|
|
@@ -768,6 +769,7 @@ abi_long target_mremap(abi_ulong old_addr, abi_ulong old_size,
|
|
page_set_flags(old_addr, old_addr + old_size, 0);
|
|
page_set_flags(new_addr, new_addr + new_size, prot | PAGE_VALID);
|
|
}
|
|
+ tb_invalidate_phys_range(new_addr, new_addr + new_size, 0);
|
|
mmap_unlock();
|
|
return new_addr;
|
|
}
|