tlbwr replaces a random architectural TLB entry. Once that happens, the evicted entry must stop translating guest virtual addresses.
The current helper keeps the evicted entry in QEMU-only extra TLB state. That makes the old mapping survive until some later operation discards the extra entries. A guest can observe this directly by writing through a TLB mapping, replacing that entry with tlbwr, and writing through the old virtual address again. Invalidate the replaced entry instead of shadowing it. This keeps the translated TLB state aligned with the architectural TLB contents. Signed-off-by: Kirill A. Korinsky <[email protected]> --- target/mips/tcg/system/tlb_helper.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/target/mips/tcg/system/tlb_helper.c b/target/mips/tcg/system/tlb_helper.c index 9772df5d6c..4c0a25e622 100644 --- a/target/mips/tcg/system/tlb_helper.c +++ b/target/mips/tcg/system/tlb_helper.c @@ -165,7 +165,7 @@ static void r4k_helper_tlbwr(CPUMIPSState *env) { int r = cpu_mips_get_random(env); - r4k_invalidate_tlb(env, r, 1); + r4k_invalidate_tlb(env, r, 0); r4k_fill_tlb(env, r); } -- 2.54.0
