vmxnet3: validate interrupt indices read on migration

[qemu.git] / cputlb.c

diff --git a/cputlb.c b/cputlb.c
index 977c0ca59d3c527941084fc255ed10b5185d6b32..7bd3573025a247f1de8ecf9a234d0fdd1905aee9 100644 (file)
--- a/cputlb.c
+++ b/cputlb.c
@@ -26,6 +26,7 @@
 #include "exec/cputlb.h"
 
 #include "exec/memory-internal.h"
 #include "exec/cputlb.h"
 
 #include "exec/memory-internal.h"

+#include "exec/ram_addr.h"

 
 //#define DEBUG_TLB
 //#define DEBUG_TLB_CHECK
 
 //#define DEBUG_TLB
 //#define DEBUG_TLB_CHECK


@@ -33,13 +34,6 @@
 /* statistics */
 int tlb_flush_count;
 
 /* statistics */
 int tlb_flush_count;
 

-static const CPUTLBEntry s_cputlb_empty_entry = {
-    .addr_read  = -1,
-    .addr_write = -1,
-    .addr_code  = -1,
-    .addend     = -1,
-};
-

 /* NOTE:
  * If flush_global is true (the usual case), flush all tlb entries.
  * If flush_global is false, flush (at least) all tlb entries not
 /* NOTE:
  * If flush_global is true (the usual case), flush all tlb entries.
  * If flush_global is false, flush (at least) all tlb entries not


@@ -52,10 +46,9 @@ static const CPUTLBEntry s_cputlb_empty_entry = {
  * entries from the TLB at any time, so flushing more entries than
  * required is only an efficiency issue, not a correctness issue.
  */
  * entries from the TLB at any time, so flushing more entries than
  * required is only an efficiency issue, not a correctness issue.
  */

-void tlb_flush(CPUArchState *env, int flush_global)
+void tlb_flush(CPUState *cpu, int flush_global)

 {
 {

-    CPUState *cpu = ENV_GET_CPU(env);
-    int i;
+    CPUArchState *env = cpu->env_ptr;

 
 #if defined(DEBUG_TLB)
     printf("tlb_flush:\n");
 
 #if defined(DEBUG_TLB)
     printf("tlb_flush:\n");


@@ -64,15 +57,8 @@ void tlb_flush(CPUArchState *env, int flush_global)
        links while we are modifying them */
     cpu->current_tb = NULL;
 
        links while we are modifying them */
     cpu->current_tb = NULL;
 

-    for (i = 0; i < CPU_TLB_SIZE; i++) {
-        int mmu_idx;
-
-        for (mmu_idx = 0; mmu_idx < NB_MMU_MODES; mmu_idx++) {
-            env->tlb_table[mmu_idx][i] = s_cputlb_empty_entry;
-        }
-    }
-
-    memset(env->tb_jmp_cache, 0, TB_JMP_CACHE_SIZE * sizeof (void *));
+    memset(env->tlb_table, -1, sizeof(env->tlb_table));
+    memset(cpu->tb_jmp_cache, 0, sizeof(cpu->tb_jmp_cache));

 
     env->tlb_flush_addr = -1;
     env->tlb_flush_mask = 0;
 
     env->tlb_flush_addr = -1;
     env->tlb_flush_mask = 0;


@@ -87,13 +73,13 @@ static inline void tlb_flush_entry(CPUTLBEntry *tlb_entry, target_ulong addr)
                  (TARGET_PAGE_MASK | TLB_INVALID_MASK)) ||
         addr == (tlb_entry->addr_code &
                  (TARGET_PAGE_MASK | TLB_INVALID_MASK))) {
                  (TARGET_PAGE_MASK | TLB_INVALID_MASK)) ||
         addr == (tlb_entry->addr_code &
                  (TARGET_PAGE_MASK | TLB_INVALID_MASK))) {

-        *tlb_entry = s_cputlb_empty_entry;
+        memset(tlb_entry, -1, sizeof(*tlb_entry));

     }
 }
 
     }
 }
 

-void tlb_flush_page(CPUArchState *env, target_ulong addr)
+void tlb_flush_page(CPUState *cpu, target_ulong addr)

 {
 {

-    CPUState *cpu = ENV_GET_CPU(env);
+    CPUArchState *env = cpu->env_ptr;

     int i;
     int mmu_idx;
 
     int i;
     int mmu_idx;
 


@@ -107,7 +93,7 @@ void tlb_flush_page(CPUArchState *env, target_ulong addr)
                TARGET_FMT_lx "/" TARGET_FMT_lx ")\n",
                env->tlb_flush_addr, env->tlb_flush_mask);
 #endif
                TARGET_FMT_lx "/" TARGET_FMT_lx ")\n",
                env->tlb_flush_addr, env->tlb_flush_mask);
 #endif

-        tlb_flush(env, 1);
+        tlb_flush(cpu, 1);

         return;
     }
     /* must reset current TB so that interrupts cannot modify the
         return;
     }
     /* must reset current TB so that interrupts cannot modify the


@@ -120,24 +106,23 @@ void tlb_flush_page(CPUArchState *env, target_ulong addr)
         tlb_flush_entry(&env->tlb_table[mmu_idx][i], addr);
     }
 
         tlb_flush_entry(&env->tlb_table[mmu_idx][i], addr);
     }
 

-    tb_flush_jmp_cache(env, addr);
+    tb_flush_jmp_cache(cpu, addr);

 }
 
 /* update the TLBs so that writes to code in the virtual page 'addr'
    can be detected */
 void tlb_protect_code(ram_addr_t ram_addr)
 {
 }
 
 /* update the TLBs so that writes to code in the virtual page 'addr'
    can be detected */
 void tlb_protect_code(ram_addr_t ram_addr)
 {

-    cpu_physical_memory_reset_dirty(ram_addr,
-                                    ram_addr + TARGET_PAGE_SIZE,
-                                    CODE_DIRTY_FLAG);
+    cpu_physical_memory_reset_dirty(ram_addr, TARGET_PAGE_SIZE,
+                                    DIRTY_MEMORY_CODE);

 }
 
 /* update the TLB so that writes in physical page 'phys_addr' are no longer
    tested for self modifying code */
 }
 
 /* update the TLB so that writes in physical page 'phys_addr' are no longer
    tested for self modifying code */

-void tlb_unprotect_code_phys(CPUArchState *env, ram_addr_t ram_addr,
+void tlb_unprotect_code_phys(CPUState *cpu, ram_addr_t ram_addr,

                              target_ulong vaddr)
 {
                              target_ulong vaddr)
 {

-    cpu_physical_memory_set_dirty_flags(ram_addr, CODE_DIRTY_FLAG);
+    cpu_physical_memory_set_dirty_flag(ram_addr, DIRTY_MEMORY_CODE);

 }
 
 static bool tlb_is_dirty_ram(CPUTLBEntry *tlbe)
 }
 
 static bool tlb_is_dirty_ram(CPUTLBEntry *tlbe)


@@ -169,27 +154,12 @@ static inline ram_addr_t qemu_ram_addr_from_host_nofail(void *ptr)
     return ram_addr;
 }
 
     return ram_addr;
 }
 

-static inline void tlb_update_dirty(CPUTLBEntry *tlb_entry)
-{
-    ram_addr_t ram_addr;
-    void *p;
-
-    if (tlb_is_dirty_ram(tlb_entry)) {
-        p = (void *)(uintptr_t)((tlb_entry->addr_write & TARGET_PAGE_MASK)
-            + tlb_entry->addend);
-        ram_addr = qemu_ram_addr_from_host_nofail(p);
-        if (!cpu_physical_memory_is_dirty(ram_addr)) {
-            tlb_entry->addr_write |= TLB_NOTDIRTY;
-        }
-    }
-}
-

 void cpu_tlb_reset_dirty_all(ram_addr_t start1, ram_addr_t length)
 {
     CPUState *cpu;
     CPUArchState *env;
 
 void cpu_tlb_reset_dirty_all(ram_addr_t start1, ram_addr_t length)
 {
     CPUState *cpu;
     CPUArchState *env;
 

-    for (cpu = first_cpu; cpu != NULL; cpu = cpu->next_cpu) {
+    CPU_FOREACH(cpu) {

         int mmu_idx;
 
         env = cpu->env_ptr;
         int mmu_idx;
 
         env = cpu->env_ptr;


@@ -251,10 +221,11 @@ static void tlb_add_large_page(CPUArchState *env, target_ulong vaddr,
 /* Add a new TLB entry. At most one entry for a given virtual address
    is permitted. Only a single TARGET_PAGE_SIZE region is mapped, the
    supplied size is only used by tlb_flush_page.  */
 /* Add a new TLB entry. At most one entry for a given virtual address
    is permitted. Only a single TARGET_PAGE_SIZE region is mapped, the
    supplied size is only used by tlb_flush_page.  */

-void tlb_set_page(CPUArchState *env, target_ulong vaddr,
+void tlb_set_page(CPUState *cpu, target_ulong vaddr,

                   hwaddr paddr, int prot,
                   int mmu_idx, target_ulong size)
 {
                   hwaddr paddr, int prot,
                   int mmu_idx, target_ulong size)
 {

+    CPUArchState *env = cpu->env_ptr;

     MemoryRegionSection *section;
     unsigned int index;
     target_ulong address;
     MemoryRegionSection *section;
     unsigned int index;
     target_ulong address;


@@ -269,7 +240,7 @@ void tlb_set_page(CPUArchState *env, target_ulong vaddr,
     }
 
     sz = size;
     }
 
     sz = size;

-    section = address_space_translate_for_iotlb(&address_space_memory, paddr,
+    section = address_space_translate_for_iotlb(cpu->as, paddr,

                                                 &xlat, &sz);
     assert(sz >= TARGET_PAGE_SIZE);
 
                                                 &xlat, &sz);
     assert(sz >= TARGET_PAGE_SIZE);
 


@@ -290,7 +261,7 @@ void tlb_set_page(CPUArchState *env, target_ulong vaddr,
     }
 
     code_address = address;
     }
 
     code_address = address;

-    iotlb = memory_region_section_get_iotlb(env, section, vaddr, paddr, xlat,
+    iotlb = memory_region_section_get_iotlb(cpu, section, vaddr, paddr, xlat,

                                             prot, &address);
 
     index = (vaddr >> TARGET_PAGE_BITS) & (CPU_TLB_SIZE - 1);
                                             prot, &address);
 
     index = (vaddr >> TARGET_PAGE_BITS) & (CPU_TLB_SIZE - 1);


@@ -314,7 +285,8 @@ void tlb_set_page(CPUArchState *env, target_ulong vaddr,
             /* Write access calls the I/O callback.  */
             te->addr_write = address | TLB_MMIO;
         } else if (memory_region_is_ram(section->mr)
             /* Write access calls the I/O callback.  */
             te->addr_write = address | TLB_MMIO;
         } else if (memory_region_is_ram(section->mr)

-                   && !cpu_physical_memory_is_dirty(section->mr->ram_addr + xlat)) {
+                   && cpu_physical_memory_is_clean(section->mr->ram_addr
+                                                   + xlat)) {

             te->addr_write = address | TLB_NOTDIRTY;
         } else {
             te->addr_write = address;
             te->addr_write = address | TLB_NOTDIRTY;
         } else {
             te->addr_write = address;


@@ -334,6 +306,7 @@ tb_page_addr_t get_page_addr_code(CPUArchState *env1, target_ulong addr)
     int mmu_idx, page_index, pd;
     void *p;
     MemoryRegion *mr;
     int mmu_idx, page_index, pd;
     void *p;
     MemoryRegion *mr;

+    CPUState *cpu = ENV_GET_CPU(env1);

 
     page_index = (addr >> TARGET_PAGE_BITS) & (CPU_TLB_SIZE - 1);
     mmu_idx = cpu_mmu_index(env1);
 
     page_index = (addr >> TARGET_PAGE_BITS) & (CPU_TLB_SIZE - 1);
     mmu_idx = cpu_mmu_index(env1);


@@ -342,15 +315,14 @@ tb_page_addr_t get_page_addr_code(CPUArchState *env1, target_ulong addr)
         cpu_ldub_code(env1, addr);
     }
     pd = env1->iotlb[mmu_idx][page_index] & ~TARGET_PAGE_MASK;
         cpu_ldub_code(env1, addr);
     }
     pd = env1->iotlb[mmu_idx][page_index] & ~TARGET_PAGE_MASK;

-    mr = iotlb_to_region(pd);
+    mr = iotlb_to_region(cpu->as, pd);

     if (memory_region_is_unassigned(mr)) {
     if (memory_region_is_unassigned(mr)) {

-        CPUState *cpu = ENV_GET_CPU(env1);

         CPUClass *cc = CPU_GET_CLASS(cpu);
 
         if (cc->do_unassigned_access) {
             cc->do_unassigned_access(cpu, addr, false, true, 0, 4);
         } else {
         CPUClass *cc = CPU_GET_CLASS(cpu);
 
         if (cc->do_unassigned_access) {
             cc->do_unassigned_access(cpu, addr, false, true, 0, 4);
         } else {

-            cpu_abort(env1, "Trying to execute code outside RAM or ROM at 0x"
+            cpu_abort(cpu, "Trying to execute code outside RAM or ROM at 0x"

                       TARGET_FMT_lx "\n", addr);
         }
     }
                       TARGET_FMT_lx "\n", addr);
         }
     }