When used in linux-user mode, tlb_vaddr_to_host(..., addr, ...))
should return "g2h(addr)", but instead it returns "g2h(vaddr)".
As "vaddr" is "typedef uint64_t", the result of "g2h(vaddr)" is
"((void *)((unsigned long)(target_ulong)(uint64_t) + guest_base))".

This bug has been found trying to run "ls" with qemu-ppc.

Fixes: "c9f82d0 ppc: Speed up dcbz"
Reported-by: Andreas Färber <afaer...@suse.de>
Signed-off-by: Laurent Vivier <lviv...@redhat.com>
---
 include/exec/cpu_ldst.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/exec/cpu_ldst.h b/include/exec/cpu_ldst.h
index b573df5..6eb5fe8 100644
--- a/include/exec/cpu_ldst.h
+++ b/include/exec/cpu_ldst.h
@@ -401,7 +401,7 @@ static inline void *tlb_vaddr_to_host(CPUArchState *env, 
target_ulong addr,
                                       int access_type, int mmu_idx)
 {
 #if defined(CONFIG_USER_ONLY)
-    return g2h(vaddr);
+    return g2h(addr);
 #else
     int index = (addr >> TARGET_PAGE_BITS) & (CPU_TLB_SIZE - 1);
     CPUTLBEntry *tlbentry = &env->tlb_table[mmu_idx][index];
-- 
2.5.5


Reply via email to