Patchwork target-arm: fix LDMIA bug on page boundary

login
register
mail settings
Submitter 오유연
Date April 24, 2011, 2:47 p.m.
Message ID <22217409.4971303656477646.JavaMail.weblogic@epml25>
Download mbox | patch
Permalink /patch/92662/
State New
Headers show

Comments

오유연 - April 24, 2011, 2:47 p.m.
When consecutive memory locations are on page boundary, a base register may be
loaded before page fault occurs. After page fault handling, it losts the memory
location information. To solve this problem, loading a base register has to put back.

Signed-off-by: Yuyeon Oh <yuyeon.oh@samsung.com>

---
 target-arm/translate.c |   18 +++++++++++++-----
 1 files changed, 13 insertions(+), 5 deletions(-)

-- 
1.7.4.msysgit.0
Peter Maydell - April 24, 2011, 3:25 p.m.
2011/4/24 오유연 <yuyeon.oh@samsung.com>:
> When consecutive memory locations are on page boundary, a base register may be
> loaded before page fault occurs. After page fault handling, it losts the memory
> location information. To solve this problem, loading a base register has to put back.

Thanks for finding this. I agree the fix is required, but I think I'd
prefer it if the thumb code for this case handled it in the same way
the disas_arm_insn() code does:

   loaded_base = 0;
   TCGV_UNUSED(loaded_var);
  [...]
       tmp = gen_ld32(addr, IS_USER(s));
       if (i == 15) {
           gen_bx(s, tmp);
       } else if (i == rn) {
           loaded_var = tmp;
           loaded_base = 1;
       } else {
           store_reg(s, i, tmp);
       }
 [...]
  if (loaded_base) {
      store_reg(s, rn, loaded_var);
  }

-- PMM

Patch

diff --git a/target-arm/translate.c b/target-arm/translate.c

index e1bda57..61eb4d5 100644

--- a/target-arm/translate.c

+++ b/target-arm/translate.c

@@ -7984,11 +7984,16 @@  static int disas_thumb2_insn(CPUState *env, DisasContext *s, uint16_t insn_hw1)

                         continue;
                     if (insn & (1 << 20)) {
                         /* Load.  */
-                        tmp = gen_ld32(addr, IS_USER(s));

-                        if (i == 15) {

-                            gen_bx(s, tmp);

-                        } else {

-                            store_reg(s, i, tmp);

+                        if (i == rn) {

+                            tmp2 = gen_ld32(addr, IS_USER(s));

+                        }

+                        else {

+                            tmp = gen_ld32(addr, IS_USER(s));

+                            if (i == 15) {

+                                gen_bx(s, tmp);

+                            } else {

+                                store_reg(s, i, tmp);

+                            }

                         }
                     } else {
                         /* Store.  */
@@ -7997,6 +8002,9 @@  static int disas_thumb2_insn(CPUState *env, DisasContext *s, uint16_t insn_hw1)

                     }
                     tcg_gen_addi_i32(addr, addr, 4);
                 }
+                if ((insn & (1 << 20)) && (insn & (1 << rn))) {

+                    store_reg(s, rn, tmp2);

+                }

                 if (insn & (1 << 21)) {
                     /* Base register writeback.  */
                     if (insn & (1 << 24)) {