From: Sven Schnelle Date: Mon, 11 Mar 2019 19:15:53 +0000 (+0100) Subject: target/hppa: fix TLB handling for page 0 X-Git-Tag: v4.0.0-rc0~27^2~8 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=0b49c3398851622ead40c7e1fc3144d3187123fd;p=thirdparty%2Fqemu.git target/hppa: fix TLB handling for page 0 Assume the following sequence: pitlbe r0(sr0,r0) iitlba r4,(sr0,r0) ldil L%3000000,r5 iitlbp r5,(sr0,r0) This will purge the whole TLB and add an entry for page 0. However the current TLB implementation in helper_iitlba() will store to the last empty TLB entry, while helper_iitlbp() will write to the first empty entry. That is because an empty entry will match address 0 in helper_iitlba() Signed-off-by: Sven Schnelle Message-Id: <20190311191602.25796-3-svens@stackframe.org> Reviewed-by: Richard Henderson Signed-off-by: Richard Henderson --- diff --git a/target/hppa/mem_helper.c b/target/hppa/mem_helper.c index aecf3075f6b..648b94cc127 100644 --- a/target/hppa/mem_helper.c +++ b/target/hppa/mem_helper.c @@ -242,11 +242,13 @@ void HELPER(itlba)(CPUHPPAState *env, target_ulong addr, target_ureg reg) /* Zap any old entries covering ADDR; notice empty entries on the way. */ for (i = 0; i < ARRAY_SIZE(env->tlb); ++i) { hppa_tlb_entry *ent = &env->tlb[i]; - if (!ent->entry_valid) { - empty = ent; - } else if (ent->va_b <= addr && addr <= ent->va_e) { - hppa_flush_tlb_ent(env, ent); - empty = ent; + if (ent->va_b <= addr && addr <= ent->va_e) { + if (ent->entry_valid) { + hppa_flush_tlb_ent(env, ent); + } + if (!empty) { + empty = ent; + } } }