[Qemu-devel] [PATCH] cpu-exec: Fix direct jump to TB spanning page

* [Qemu-devel] [PATCH] cpu-exec: Fix direct jump to TB spanning page
@ 2016-05-16 13:13 Sergey Fedorov
  2016-05-16 13:49 ` Richard Henderson
  2016-05-16 14:43 ` Max Filippov
  0 siblings, 2 replies; 6+ messages in thread
From: Sergey Fedorov @ 2016-05-16 13:13 UTC (permalink / raw)
  To: qemu-devel
  Cc: Alex Bennée, Sergey Fedorov, Sergey Fedorov, Paolo Bonzini,
	Peter Crosthwaite, Richard Henderson

From: Sergey Fedorov <serge.fdrv@gmail.com>

It is not safe to make a direct jump to a TB spanning two pages in
system emulation because the mapping for the second page can get changed
but we don't take care of direct jumps in this case.

However in user mode emulation, this is not the case because there's
only static address translation and TBs are always invalidated properly.

Fixes: 5b053a4a2827 ("tcg: Clean up direct block chaining safety checks")

Reported-by: Max Filippov <jcmvbkbc@gmail.com>
Signed-off-by: Sergey Fedorov <serge.fdrv@gmail.com>
Signed-off-by: Sergey Fedorov <sergey.fedorov@linaro.org>
---
 cpu-exec.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/cpu-exec.c b/cpu-exec.c
index 14df1aacf42a..ec2364df624d 100644
--- a/cpu-exec.c
+++ b/cpu-exec.c
@@ -344,6 +344,15 @@ static inline TranslationBlock *tb_find_fast(CPUState *cpu,
         *last_tb = NULL;
         cpu->tb_flushed = false;
     }
+#ifndef CONFIG_USER_ONLY
+    /* We don't take care of direct jumps when address mapping changes in
+     * system emulation. So it's not safe to make a direct jump to a TB
+     * spanning two pages because the mapping for the second page can change.
+     */
+    if (tb->page_addr[1] != -1) {
+        *last_tb = NULL;
+    }
+#endif
     /* See if we can patch the calling TB. */
     if (*last_tb && !qemu_loglevel_mask(CPU_LOG_TB_NOCHAIN)) {
         tb_add_jump(*last_tb, tb_exit, tb);
-- 
1.9.1

^ permalink raw reply related	[flat|nested] 6+ messages in thread