target-arm: fix LDMIA bug on page boundary

Submitted by 오유연 on April 24, 2011, 2:47 p.m.

Details

Message ID 22217409.4971303656477646.JavaMail.weblogic@epml25
State New
Headers show

Commit Message

오유연 April 24, 2011, 2:47 p.m.
When consecutive memory locations are on page boundary, a base register may be
loaded before page fault occurs. After page fault handling, it losts the memory
location information. To solve this problem, loading a base register has to put back.

Signed-off-by: Yuyeon Oh <yuyeon.oh@samsung.com>

---
 target-arm/translate.c |   18 +++++++++++++-----
 1 files changed, 13 insertions(+), 5 deletions(-)

-- 
1.7.4.msysgit.0

Comments

Peter Maydell April 24, 2011, 3:25 p.m.
2011/4/24 오유연 <yuyeon.oh@samsung.com>:
> When consecutive memory locations are on page boundary, a base register may be
> loaded before page fault occurs. After page fault handling, it losts the memory
> location information. To solve this problem, loading a base register has to put back.

Thanks for finding this. I agree the fix is required, but I think I'd
prefer it if the thumb code for this case handled it in the same way
the disas_arm_insn() code does:

   loaded_base = 0;
   TCGV_UNUSED(loaded_var);
  [...]
       tmp = gen_ld32(addr, IS_USER(s));
       if (i == 15) {
           gen_bx(s, tmp);
       } else if (i == rn) {
           loaded_var = tmp;
           loaded_base = 1;
       } else {
           store_reg(s, i, tmp);
       }
 [...]
  if (loaded_base) {
      store_reg(s, rn, loaded_var);
  }

-- PMM

Patch hide | download patch | download mbox

diff --git a/target-arm/translate.c b/target-arm/translate.c
index e1bda57..61eb4d5 100644
--- a/target-arm/translate.c
+++ b/target-arm/translate.c
@@ -7984,11 +7984,16 @@  static int disas_thumb2_insn(CPUState *env, DisasContext *s, uint16_t insn_hw1)
                         continue;
                     if (insn & (1 << 20)) {
                         /* Load.  */
-                        tmp = gen_ld32(addr, IS_USER(s));
-                        if (i == 15) {
-                            gen_bx(s, tmp);
-                        } else {
-                            store_reg(s, i, tmp);
+                        if (i == rn) {
+                            tmp2 = gen_ld32(addr, IS_USER(s));
+                        }
+                        else {
+                            tmp = gen_ld32(addr, IS_USER(s));
+                            if (i == 15) {
+                                gen_bx(s, tmp);
+                            } else {
+                                store_reg(s, i, tmp);
+                            }
                         }
                     } else {
                         /* Store.  */
@@ -7997,6 +8002,9 @@  static int disas_thumb2_insn(CPUState *env, DisasContext *s, uint16_t insn_hw1)
                     }
                     tcg_gen_addi_i32(addr, addr, 4);
                 }
+                if ((insn & (1 << 20)) && (insn & (1 << rn))) {
+                    store_reg(s, rn, tmp2);
+                }
                 if (insn & (1 << 21)) {
                     /* Base register writeback.  */
                     if (insn & (1 << 24)) {