[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PATCH 11/21] target-xtensa: fix ITLB/DTLB page protection
From: |
Michael Roth |
Subject: |
[Qemu-devel] [PATCH 11/21] target-xtensa: fix ITLB/DTLB page protection flags |
Date: |
Wed, 16 Jan 2013 10:49:13 -0600 |
From: Max Filippov <address@hidden>
With MMU option xtensa architecture has two TLBs: ITLB and DTLB. ITLB is
only used for code access, DTLB is only for data. However TLB entries in
both TLBs have attribute field controlling write and exec access. These
bits need to be properly masked off depending on TLB type before being
used as tlb_set_page prot argument. Otherwise the following happens:
(1) ITLB entry for some PFN gets invalidated
(2) DTLB entry for the same PFN gets updated, attributes allow code
execution
(3) code at the page with that PFN is executed (possible due to step 2),
entry for the TB is written into the jump cache
(4) QEMU TLB entry for the PFN gets replaced with an entry for some
other PFN
(5) code in the TB from step 3 is executed (possible due to jump cache)
and it accesses data, for which there's no DTLB entry, causing DTLB
miss exception
(6) re-translation of the TB from step 5 is attempted, but there's no
QEMU TLB entry nor xtensa ITLB entry for that PFN, which causes ITLB
miss exception at the TB start address
(7) ITLB miss exception is handled by the guest, but execution is
resumed from the beginning of the faulting TB (the point where ITLB
miss occured), not from the point where DTLB miss occured, which is
wrong.
With that fix the above scenario causes ITLB miss exception (that used
to be step 7) at step 3, right at the beginning of the TB.
Signed-off-by: Max Filippov <address@hidden>
Cc: address@hidden
Signed-off-by: Blue Swirl <address@hidden>
(cherry picked from commit 659f807c0a700317a7a0fae7a6e6ebfe68bfbbc4)
Signed-off-by: Michael Roth <address@hidden>
---
target-xtensa/helper.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/target-xtensa/helper.c b/target-xtensa/helper.c
index d94bae2..7fa9ecc 100644
--- a/target-xtensa/helper.c
+++ b/target-xtensa/helper.c
@@ -486,7 +486,8 @@ static int get_physical_addr_mmu(CPUXtensaState *env, bool
update_tlb,
INST_FETCH_PRIVILEGE_CAUSE;
}
- *access = mmu_attr_to_access(entry->attr);
+ *access = mmu_attr_to_access(entry->attr) &
+ ~(dtlb ? PAGE_EXEC : PAGE_READ | PAGE_WRITE);
if (!is_access_granted(*access, is_write)) {
return dtlb ?
(is_write ?
--
1.7.9.5
- [Qemu-devel] Patch Round-up for stable 1.3.1, freeze Monday, Michael Roth, 2013/01/16
- [Qemu-devel] [PATCH 01/21] Fix semaphores fallback code, Michael Roth, 2013/01/16
- [Qemu-devel] [PATCH 02/21] Disable semaphores fallback code for OpenBSD, Michael Roth, 2013/01/16
- [Qemu-devel] [PATCH 03/21] Fix off-by-1 error in RAM migration code, Michael Roth, 2013/01/16
- [Qemu-devel] [PATCH 04/21] migration: Fix madvise breakage if host and guest have different page sizes, Michael Roth, 2013/01/16
- [Qemu-devel] [PATCH 05/21] target-mips: Fix incorrect code and test for INSV, Michael Roth, 2013/01/16
- [Qemu-devel] [PATCH 06/21] target-mips: Fix incorrect shift for SHILO and SHILOV, Michael Roth, 2013/01/16
- [Qemu-devel] [PATCH 07/21] vfio-pci: Don't use kvm_irqchip_in_kernel, Michael Roth, 2013/01/16
- [Qemu-devel] [PATCH 11/21] target-xtensa: fix ITLB/DTLB page protection flags,
Michael Roth <=
- [Qemu-devel] [PATCH 12/21] qxl: save qemu_create_displaysurface_from result, Michael Roth, 2013/01/16
- [Qemu-devel] [PATCH 10/21] pixman: fix vnc tight png/jpeg support, Michael Roth, 2013/01/16
- [Qemu-devel] [PATCH 08/21] seabios: update to e8a76b0f225bba5ba9d63ab227e0a37b3beb1059, Michael Roth, 2013/01/16
- [Qemu-devel] [PATCH 13/21] qxl+vnc: register a vm state change handler for dummy spice_server, Michael Roth, 2013/01/16
- [Qemu-devel] [PATCH 15/21] migration: fix migration_bitmap leak, Michael Roth, 2013/01/16
- [Qemu-devel] [PATCH 16/21] buffered_file: do not send more than s->bytes_xfer bytes per tick, Michael Roth, 2013/01/16
- [Qemu-devel] [PATCH 20/21] vfio-pci: Loosen sanity checks to allow future features, Michael Roth, 2013/01/16
- [Qemu-devel] [PATCH 21/21] raw-posix: fix bdrv_aio_ioctl, Michael Roth, 2013/01/16
- [Qemu-devel] [PATCH 09/21] Update seabios to a810e4e72a0d42c7bc04eda57382f8e019add901, Michael Roth, 2013/01/16
- [Qemu-devel] [PATCH 19/21] pci-assign: Enable MSIX on device to match guest, Michael Roth, 2013/01/16