diff options
author | Avi Kivity <avi@redhat.com> | 2012-03-08 18:50:18 +0200 |
---|---|---|
committer | Avi Kivity <avi@redhat.com> | 2012-03-08 18:54:20 +0200 |
commit | ce5d64c2d0aa2aaf2ef60e9af48b0bf57852470b (patch) | |
tree | 93d3de474af801c3e7dcc178fad9fbdaf0474d57 | |
parent | aa102231f09af7e5e2cc1376499991ac2ea00115 (diff) | |
download | hqemu-ce5d64c2d0aa2aaf2ef60e9af48b0bf57852470b.zip hqemu-ce5d64c2d0aa2aaf2ef60e9af48b0bf57852470b.tar.gz |
exec: fix code tlb entry misused as iotlb in get_page_addr_code()
get_page_addr_code() reads a code tlb entry, but interprets it as an
iotlb entry. This works by accident since the low bits of a RAM code
tlb entry are clear, and match a RAM iotlb entry. This accident is
about to unhappen, so fix the code to use an iotlb entry (using the
code entry with TLB_MMIO may fail if the page is a watchpoint).
Signed-off-by: Avi Kivity <avi@redhat.com>
-rw-r--r-- | exec.c | 2 |
1 files changed, 1 insertions, 1 deletions
@@ -4685,7 +4685,7 @@ tb_page_addr_t get_page_addr_code(CPUState *env1, target_ulong addr) (addr & TARGET_PAGE_MASK))) { ldub_code(addr); } - pd = env1->tlb_table[mmu_idx][page_index].addr_code & ~TARGET_PAGE_MASK; + pd = env1->iotlb[mmu_idx][page_index] & ~TARGET_PAGE_MASK; if (pd != io_mem_ram.ram_addr && pd != io_mem_rom.ram_addr && !io_mem_region[pd]->rom_device) { #if defined(TARGET_ALPHA) || defined(TARGET_MIPS) || defined(TARGET_SPARC) |