cpu-exec: Fix direct jump to TB spanning page

It is not safe to make a direct jump to a TB spanning two pages in
system emulation because the mapping for the second page can get changed
but we don't take care of direct jumps in this case.

However in user mode emulation, this is not the case because there's
only static address translation and TBs are always invalidated properly.

Backports commit c88c67e58b61618a904d2333ceebefc3c852d32e from qemu
This commit is contained in:
Sergey Fedorov 2018-02-24 03:24:40 -05:00 committed by Lioncash
parent 9c04a28bd2
commit 3a9c5e7509
No known key found for this signature in database
GPG key ID: 4E3C3CC1031BA9C7

View file

@ -169,6 +169,15 @@ static inline TranslationBlock *tb_find_fast(CPUState *cpu,
*last_tb = NULL; *last_tb = NULL;
cpu->tb_flushed = false; cpu->tb_flushed = false;
} }
#ifndef CONFIG_USER_ONLY
/* We don't take care of direct jumps when address mapping changes in
* system emulation. So it's not safe to make a direct jump to a TB
* spanning two pages because the mapping for the second page can change.
*/
if (tb->page_addr[1] != -1) {
*last_tb = NULL;
}
#endif
/* See if we can patch the calling TB. */ /* See if we can patch the calling TB. */
if (*last_tb && !qemu_loglevel_mask(CPU_LOG_TB_NOCHAIN)) { if (*last_tb && !qemu_loglevel_mask(CPU_LOG_TB_NOCHAIN)) {
tb_add_jump(*last_tb, tb_exit, tb); tb_add_jump(*last_tb, tb_exit, tb);