55a7cb144d
We set up TLB entries in tlb_set_page_with_attrs(), where we have some logic for determining whether the TLB entry is considered to be RAM-backed, and thus has a valid addend field. When we look at the TLB entry in get_page_addr_code(), we use different logic for determining whether to treat the page as RAM-backed and use the addend field. This is confusing, and in fact buggy, because the code in tlb_set_page_with_attrs() correctly decides that rom_device memory regions not in romd mode are not RAM-backed, but the code in get_page_addr_code() thinks they are RAM-backed. This typically results in "Bad ram pointer" assertion if the guest tries to execute from such a memory region. Fix this by making get_page_addr_code() just look at the TLB_MMIO bit in the code_address field of the TLB, which tlb_set_page_with_attrs() sets if and only if the addend field is not valid for code execution. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 20180713150945.12348-1-peter.maydell@linaro.org |
||
|---|---|---|
| .. | ||
| atomic_template.h | ||
| cpu-exec-common.c | ||
| cpu-exec.c | ||
| cputlb.c | ||
| Makefile.objs | ||
| softmmu_template.h | ||
| tcg-all.c | ||
| tcg-runtime-gvec.c | ||
| tcg-runtime.c | ||
| tcg-runtime.h | ||
| trace-events | ||
| translate-all.c | ||
| translate-all.h | ||
| translator.c | ||
| user-exec-stub.c | ||
| user-exec.c | ||