[gentoo-commits] proj/qemu-kvm:qemu-kvm-1.2.0-gentoo commit in: target-xtensa/

[gentoo-commits] proj/qemu-kvm:qemu-kvm-1.2.0-gentoo commit in: target-xtensa/

[Doug Goldstein]

commit:     8458950e33094f974a3b39b7ab6d45b79a118db7
Author:     Max Filippov <jcmvbkbc <AT> gmail <DOT> com>
AuthorDate: Wed Dec 19 20:04:09 2012 +0000
Commit:     Doug Goldstein <cardoe <AT> gentoo <DOT> org>
CommitDate: Sat Jan 19 03:02:08 2013 +0000
URL:        http://git.overlays.gentoo.org/gitweb/?p=proj/qemu-kvm.git;a=commit;h=8458950e

target-xtensa: fix search_pc for the last TB opcode

Zero out tcg_ctx.gen_opc_instr_start for instructions representing the
last guest opcode in the TB.

Cc: qemu-stable <AT> nongnu.org
Signed-off-by: Max Filippov <jcmvbkbc <AT> gmail.com>
Signed-off-by: Blue Swirl <blauwirbel <AT> gmail.com>
(cherry picked from commit 36f25d2537c40c6c47f4abee5d31a24863d1adf7)

---
 target-xtensa/translate.c |    6 +++++-
 1 files changed, 5 insertions(+), 1 deletions(-)

diff --git a/target-xtensa/translate.c b/target-xtensa/translate.c
index b6643eb..b418e30 100644
--- a/target-xtensa/translate.c
+++ b/target-xtensa/translate.c
@@ -2678,7 +2678,11 @@ static void gen_intermediate_code_internal(
     gen_icount_end(tb, insn_count);
     *gen_opc_ptr = INDEX_op_end;
 
-    if (!search_pc) {
+    if (search_pc) {
+        j = tcg_ctx.gen_opc_ptr - tcg_ctx.gen_opc_buf;
+        memset(tcg_ctx.gen_opc_instr_start + lj + 1, 0,
+                (j - lj) * sizeof(tcg_ctx.gen_opc_instr_start[0]));
+    } else {
         tb->size = dc.pc - pc_start;
         tb->icount = insn_count;
     }

[gentoo-commits] proj/qemu-kvm:qemu-kvm-1.2.0-gentoo commit in: target-xtensa/

[Doug Goldstein]

commit:     65f7515322e826f77ce943939b981574a2f00024
Author:     Max Filippov <jcmvbkbc <AT> gmail <DOT> com>
AuthorDate: Thu Dec 13 00:13:41 2012 +0000
Commit:     Doug Goldstein <cardoe <AT> gentoo <DOT> org>
CommitDate: Sat Jan 19 03:02:08 2013 +0000
URL:        http://git.overlays.gentoo.org/gitweb/?p=proj/qemu-kvm.git;a=commit;h=65f75153

target-xtensa: fix ITLB/DTLB page protection flags

With MMU option xtensa architecture has two TLBs: ITLB and DTLB. ITLB is
only used for code access, DTLB is only for data. However TLB entries in
both TLBs have attribute field controlling write and exec access. These
bits need to be properly masked off depending on TLB type before being
used as tlb_set_page prot argument. Otherwise the following happens:

(1) ITLB entry for some PFN gets invalidated
(2) DTLB entry for the same PFN gets updated, attributes allow code
    execution
(3) code at the page with that PFN is executed (possible due to step 2),
    entry for the TB is written into the jump cache
(4) QEMU TLB entry for the PFN gets replaced with an entry for some
    other PFN
(5) code in the TB from step 3 is executed (possible due to jump cache)
    and it accesses data, for which there's no DTLB entry, causing DTLB
    miss exception
(6) re-translation of the TB from step 5 is attempted, but there's no
    QEMU TLB entry nor xtensa ITLB entry for that PFN, which causes ITLB
    miss exception at the TB start address
(7) ITLB miss exception is handled by the guest, but execution is
    resumed from the beginning of the faulting TB (the point where ITLB
    miss occured), not from the point where DTLB miss occured, which is
    wrong.

With that fix the above scenario causes ITLB miss exception (that used
to be step 7) at step 3, right at the beginning of the TB.

Signed-off-by: Max Filippov <jcmvbkbc <AT> gmail.com>
Cc: qemu-stable <AT> nongnu.org
Signed-off-by: Blue Swirl <blauwirbel <AT> gmail.com>
(cherry picked from commit 659f807c0a700317a7a0fae7a6e6ebfe68bfbbc4)

---
 target-xtensa/helper.c |    3 ++-
 1 files changed, 2 insertions(+), 1 deletions(-)

diff --git a/target-xtensa/helper.c b/target-xtensa/helper.c
index d5bb171..b43395c 100644
--- a/target-xtensa/helper.c
+++ b/target-xtensa/helper.c
@@ -486,7 +486,8 @@ static int get_physical_addr_mmu(CPUXtensaState *env, bool update_tlb,
             INST_FETCH_PRIVILEGE_CAUSE;
     }
 
-    *access = mmu_attr_to_access(entry->attr);
+    *access = mmu_attr_to_access(entry->attr) &
+        ~(dtlb ? PAGE_EXEC : PAGE_READ | PAGE_WRITE);
     if (!is_access_granted(*access, is_write)) {
         return dtlb ?
             (is_write ?