2012-05-18 10:36:15 +02:00
|
|
|
From 99eac32372c3bee2d801f20e377de23d09e7a25e Mon Sep 17 00:00:00 2001
|
2012-05-07 12:08:51 +02:00
|
|
|
From: Alexander Graf <agraf@suse.de>
|
|
|
|
Date: Mon, 7 May 2012 11:23:02 +0200
|
|
|
|
Subject: [PATCH] linux-user: Fix stale tbs after mmap
|
|
|
|
|
|
|
|
If we execute linux-user code that does the following:
|
|
|
|
|
|
|
|
* A = mmap()
|
|
|
|
* execute code in A
|
|
|
|
* munmap(A)
|
|
|
|
* B = mmap(), but mmap returns the same address as A
|
|
|
|
* execute code in B
|
|
|
|
|
|
|
|
we end up executing a stale cached tb that contains translated code
|
|
|
|
from A, while we want new code from B.
|
|
|
|
|
|
|
|
This patch adds a TB flush for mmap'ed regions, before we return them,
|
|
|
|
avoiding the whole issue.
|
|
|
|
|
|
|
|
Reported-by: Peter Maydell <peter.maydell@linaro.org>
|
|
|
|
Signed-off-by: Alexander Graf <agraf@suse.de>
|
2012-05-15 14:58:40 +02:00
|
|
|
[AF: Adapted to cputlb split-out]
|
2012-05-07 12:08:51 +02:00
|
|
|
---
|
2012-05-07 13:09:11 +02:00
|
|
|
exec-all.h | 2 ++
|
|
|
|
exec.c | 17 +++++++++++++++++
|
2012-05-07 12:08:51 +02:00
|
|
|
linux-user/mmap.c | 2 ++
|
2012-05-07 13:09:11 +02:00
|
|
|
3 files changed, 21 insertions(+), 0 deletions(-)
|
2012-05-07 12:08:51 +02:00
|
|
|
|
2012-05-07 13:09:11 +02:00
|
|
|
diff --git a/exec-all.h b/exec-all.h
|
2012-05-15 14:58:40 +02:00
|
|
|
index c1b7e1f..9bda7f7 100644
|
2012-05-07 13:09:11 +02:00
|
|
|
--- a/exec-all.h
|
|
|
|
+++ b/exec-all.h
|
2012-05-15 14:58:40 +02:00
|
|
|
@@ -96,6 +96,8 @@ void QEMU_NORETURN cpu_loop_exit(CPUArchState *env1);
|
|
|
|
int page_unprotect(target_ulong address, uintptr_t pc, void *puc);
|
2012-05-07 13:09:11 +02:00
|
|
|
void tb_invalidate_phys_page_range(tb_page_addr_t start, tb_page_addr_t end,
|
|
|
|
int is_cpu_write_access);
|
|
|
|
+void tb_invalidate_phys_range(tb_page_addr_t start, tb_page_addr_t end,
|
|
|
|
+ int is_cpu_write_access);
|
|
|
|
#if !defined(CONFIG_USER_ONLY)
|
2012-05-15 14:58:40 +02:00
|
|
|
/* cputlb.c */
|
|
|
|
void tlb_flush_page(CPUArchState *env, target_ulong addr);
|
2012-05-07 13:09:11 +02:00
|
|
|
diff --git a/exec.c b/exec.c
|
2012-05-15 14:58:40 +02:00
|
|
|
index 14b1074..9ba4409 100644
|
2012-05-07 13:09:11 +02:00
|
|
|
--- a/exec.c
|
|
|
|
+++ b/exec.c
|
2012-05-15 14:58:40 +02:00
|
|
|
@@ -1077,6 +1077,23 @@ TranslationBlock *tb_gen_code(CPUArchState *env,
|
2012-05-07 13:09:11 +02:00
|
|
|
return tb;
|
|
|
|
}
|
|
|
|
|
|
|
|
+/*
|
|
|
|
+ * invalidate all TBs which intersect with the target physical pages
|
|
|
|
+ * starting in range [start;end[. NOTE: start and end may refer to
|
|
|
|
+ * different physical pages. 'is_cpu_write_access' should be true if called
|
|
|
|
+ * from a real cpu write access: the virtual CPU will exit the current
|
|
|
|
+ * TB if code is modified inside this TB.
|
|
|
|
+ */
|
|
|
|
+void tb_invalidate_phys_range(tb_page_addr_t start, tb_page_addr_t end,
|
|
|
|
+ int is_cpu_write_access)
|
|
|
|
+{
|
|
|
|
+ while (start < end) {
|
|
|
|
+ tb_invalidate_phys_page_range(start, end, is_cpu_write_access);
|
|
|
|
+ start &= TARGET_PAGE_MASK;
|
|
|
|
+ start += TARGET_PAGE_SIZE;
|
|
|
|
+ }
|
|
|
|
+}
|
|
|
|
+
|
|
|
|
/* invalidate all TBs which intersect with the target physical page
|
|
|
|
starting in range [start;end[. NOTE: start and end must refer to
|
|
|
|
the same physical page. 'is_cpu_write_access' should be true if called
|
2012-05-07 12:08:51 +02:00
|
|
|
diff --git a/linux-user/mmap.c b/linux-user/mmap.c
|
2012-05-15 14:58:40 +02:00
|
|
|
index 2a1e4a1..e3fb6b5 100644
|
2012-05-07 12:08:51 +02:00
|
|
|
--- a/linux-user/mmap.c
|
|
|
|
+++ b/linux-user/mmap.c
|
|
|
|
@@ -587,6 +587,7 @@ abi_long target_mmap(abi_ulong start, abi_ulong len, int prot,
|
|
|
|
page_dump(stdout);
|
|
|
|
printf("\n");
|
|
|
|
#endif
|
2012-05-07 13:09:11 +02:00
|
|
|
+ tb_invalidate_phys_range(start, start + len, 0);
|
2012-05-07 12:08:51 +02:00
|
|
|
mmap_unlock();
|
|
|
|
return start;
|
|
|
|
fail:
|
|
|
|
@@ -768,6 +769,7 @@ abi_long target_mremap(abi_ulong old_addr, abi_ulong old_size,
|
|
|
|
page_set_flags(old_addr, old_addr + old_size, 0);
|
|
|
|
page_set_flags(new_addr, new_addr + new_size, prot | PAGE_VALID);
|
|
|
|
}
|
2012-05-07 13:09:11 +02:00
|
|
|
+ tb_invalidate_phys_range(new_addr, new_addr + new_size, 0);
|
2012-05-07 12:08:51 +02:00
|
|
|
mmap_unlock();
|
|
|
|
return new_addr;
|
|
|
|
}
|