From patchwork Sun Jul 14 11:12:49 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Richard Henderson X-Patchwork-Id: 168971 Delivered-To: patch@linaro.org Received: by 2002:a92:4782:0:0:0:0:0 with SMTP id e2csp3118527ilk; Sun, 14 Jul 2019 04:14:21 -0700 (PDT) X-Google-Smtp-Source: APXvYqyKGqp7Lxw+ocqrKv9KTXB050Q1ZpZNgqukMCmWq74TnRjOFX6BFmB9xkUw1smHhlmUHEXT X-Received: by 2002:aa7:c554:: with SMTP id s20mr17517895edr.209.1563102860940; Sun, 14 Jul 2019 04:14:20 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1563102860; cv=none; d=google.com; s=arc-20160816; b=ocwwK/37m82RLDU3V8LheoBSYzf9M0sCbsTzSnbiTkzmRXOrOm0F0KD6cTcyeaIBjr 7BamDLPXVZSVbmb9Z4oER6wDorJWUqswZ+cA8V3wG4aSulSo18SDg2zLAY+Eq9tGsopr fHB8ZG1NrdxpD0EWh6850MaFp1Ik8j2cQUS4W0U2OW+7G5Fa8Hp6in0baj+I0KyaFjhr DCwC0nb+PkZk+R6sE7zKJJLAJnOg4eyX4XUf5TpvDUSBkgnOWEBrinp0cbkrn5LgkpQW BZVS5gv9fqF0o0m1vYdCoZo292F9A43aRjV+hoxKcdv5jTv8DpmnuUtsUHbk7gQwjPLP JaIg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=sender:errors-to:cc:list-subscribe:list-help:list-post:list-archive :list-unsubscribe:list-id:precedence:subject :content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:to:from:dkim-signature; bh=lrFuCc5Kh7yR4Plfx6C/M8vdRg/qQANiKVV3zv9IyqE=; b=KkJnO7Q+5QtnLyXFfcuTFf9iHluPAIB5C48mofa4IjHJ0XbspPDlQX1ryjlWvK17Ba KGiVHYakrtUISvMdvPM7Z0QKhRnIYVcjW+i6EuQ+Mk9kcqgT3HzIBk4aXAZRX0WonFwv /o5LoSvYqR1qDritHRFflbno37rVVb4DSmbp6tHmOC7z2Rlcz6j4dUcTQZUQu/1PKzdq 1DwftUcupJOLZC9sVqmUC+PnvfX7MtDT0vF2xBnMrrZyePHNWdI0jyngLGF1zwGNEVDT iA6FJgMKx5hpL+fm+KQy9wwMvu9yVXwTWlYbIWft0Dj/01U83fi8PBYkqFWSubR1k/0Q uBHA== ARC-Authentication-Results: i=1; mx.google.com; dkim=fail header.i=@linaro.org header.s=google header.b=BLXCiQBr; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org"; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=linaro.org Return-Path: Received: from lists.gnu.org (lists.gnu.org. [209.51.188.17]) by mx.google.com with ESMTPS id p16si7718785ejr.358.2019.07.14.04.14.20 for (version=TLS1_2 cipher=ECDHE-RSA-CHACHA20-POLY1305 bits=256/256); Sun, 14 Jul 2019 04:14:20 -0700 (PDT) Received-SPF: pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; Authentication-Results: mx.google.com; dkim=fail header.i=@linaro.org header.s=google header.b=BLXCiQBr; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org"; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=linaro.org Received: from localhost ([::1]:59768 helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.86_2) (envelope-from ) id 1hmcSR-0002iY-UI for patch@linaro.org; Sun, 14 Jul 2019 07:14:19 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]:60397) by lists.gnu.org with esmtp (Exim 4.86_2) (envelope-from ) id 1hmcRB-0005tm-EM for qemu-devel@nongnu.org; Sun, 14 Jul 2019 07:13:02 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1hmcR9-0006Oz-Sm for qemu-devel@nongnu.org; Sun, 14 Jul 2019 07:13:01 -0400 Received: from mail-wm1-x344.google.com ([2a00:1450:4864:20::344]:36565) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_128_CBC_SHA1:16) (Exim 4.71) (envelope-from ) id 1hmcR9-0006Oe-Kl for qemu-devel@nongnu.org; Sun, 14 Jul 2019 07:12:59 -0400 Received: by mail-wm1-x344.google.com with SMTP id g67so8393185wme.1 for ; Sun, 14 Jul 2019 04:12:59 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=lrFuCc5Kh7yR4Plfx6C/M8vdRg/qQANiKVV3zv9IyqE=; b=BLXCiQBrVW0eEY3m+JSCMjwSUT4j+IPCcr6ebq8qdmiFVrSfrjsiN7lPU+y2JNKrLW NXgpGJPnakWBUXEdw4k8mVn74Ma3nwJAsolCv6j+4UU7FJV6zREW8Sci7Ys4AzuJbYWx 4zpk/Hmd2RiNBEWwVkIZN58fbGTbPpXR4PQng73mspke8KJoYBo+kQNBgSXwjdw6/emU +6ERd2i0gFUK5HwwADeq1ZpQI1UUjaaNBvlQBn49VimWRtGFwXJn+rl11tG3NQyQklEy qYhY8WUQHFl73tUH3jWH9dNtwHSDNMpy9m6iojyLRyuWuY3+ZA73PJ5pGIMidTqG/xN3 lgkQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=lrFuCc5Kh7yR4Plfx6C/M8vdRg/qQANiKVV3zv9IyqE=; b=V2qjmBay1SLUeeM8jlsnIJ+vyHtszgW5QO/zcNpWa488KOwfpOc00Uh0Ef30ZV/g7V fFh1jh+Vfy9xPV7tphBPmZxR+WsNiC6MnYB9G2owz0WU1fAlko+O/B/ts+iIUKO48PgB YfEcPVrazCjLfqOReIBdCJ2C/JD1ar03YBXW/kesF9NIUZM07yjVWX1IGOYSNavg5TXE 1KlR5s8Km4e6xeLbBtXmiWMXTrPVoWYhdXOwjNdFcP4+YHGy01j9MxSSqyY48+IOo308 DbqZQ4Qk56vfFmmrO7MZdFMrAOidu8U5steBjIjAJvPoWhmtlkGAX6/lws895u58x/wI XMNw== X-Gm-Message-State: APjAAAXxsr7Arlb/HD0iX6Vyag80JjoWZi5mjGU/uu0EF0dTqZIvHmJq eTO44ImMDI5U0cLxnRIcETdwrrQ3RiGGRA== X-Received: by 2002:a7b:c04f:: with SMTP id u15mr18828164wmc.106.1563102778326; Sun, 14 Jul 2019 04:12:58 -0700 (PDT) Received: from localhost.localdomain ([194.144.248.241]) by smtp.gmail.com with ESMTPSA id f17sm12675795wmf.27.2019.07.14.04.12.57 (version=TLS1_3 cipher=AEAD-AES256-GCM-SHA384 bits=256/256); Sun, 14 Jul 2019 04:12:57 -0700 (PDT) From: Richard Henderson To: qemu-devel@nongnu.org Date: Sun, 14 Jul 2019 11:12:49 +0000 Message-Id: <20190714111249.13859-8-richard.henderson@linaro.org> X-Mailer: git-send-email 2.17.1 In-Reply-To: <20190714111249.13859-1-richard.henderson@linaro.org> References: <20190714111249.13859-1-richard.henderson@linaro.org> MIME-Version: 1.0 X-detected-operating-system: by eggs.gnu.org: Genre and OS details not recognized. X-Received-From: 2a00:1450:4864:20::344 Subject: [Qemu-devel] [PULL for-4.1 7/7] tcg: Release mmap_lock on translation fault X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: peter.maydell@linaro.org Errors-To: qemu-devel-bounces+patch=linaro.org@nongnu.org Sender: "Qemu-devel" Turn helper_retaddr into a multi-state flag that may now also indicate when we're performing a read on behalf of the translator. In this case, release the mmap_lock before the longjmp back to the main cpu loop, and thereby avoid a failing assert therein. Fixes: https://bugs.launchpad.net/qemu/+bug/1832353 Tested-by: Alex Bennée Reviewed-by: Alex Bennée Signed-off-by: Richard Henderson --- include/exec/cpu_ldst_useronly_template.h | 20 +++++-- accel/tcg/user-exec.c | 66 ++++++++++++++++------- 2 files changed, 63 insertions(+), 23 deletions(-) -- 2.17.1 diff --git a/include/exec/cpu_ldst_useronly_template.h b/include/exec/cpu_ldst_useronly_template.h index d663826ac2..2378f2958c 100644 --- a/include/exec/cpu_ldst_useronly_template.h +++ b/include/exec/cpu_ldst_useronly_template.h @@ -64,12 +64,18 @@ static inline RES_TYPE glue(glue(cpu_ld, USUFFIX), MEMSUFFIX)(CPUArchState *env, abi_ptr ptr) { -#if !defined(CODE_ACCESS) +#ifdef CODE_ACCESS + RES_TYPE ret; + set_helper_retaddr(1); + ret = glue(glue(ld, USUFFIX), _p)(g2h(ptr)); + clear_helper_retaddr(); + return ret; +#else trace_guest_mem_before_exec( env_cpu(env), ptr, trace_mem_build_info(SHIFT, false, MO_TE, false)); -#endif return glue(glue(ld, USUFFIX), _p)(g2h(ptr)); +#endif } #ifndef CODE_ACCESS @@ -90,12 +96,18 @@ glue(glue(glue(cpu_ld, USUFFIX), MEMSUFFIX), _ra)(CPUArchState *env, static inline int glue(glue(cpu_lds, SUFFIX), MEMSUFFIX)(CPUArchState *env, abi_ptr ptr) { -#if !defined(CODE_ACCESS) +#ifdef CODE_ACCESS + int ret; + set_helper_retaddr(1); + ret = glue(glue(lds, SUFFIX), _p)(g2h(ptr)); + clear_helper_retaddr(); + return ret; +#else trace_guest_mem_before_exec( env_cpu(env), ptr, trace_mem_build_info(SHIFT, true, MO_TE, false)); -#endif return glue(glue(lds, SUFFIX), _p)(g2h(ptr)); +#endif } #ifndef CODE_ACCESS diff --git a/accel/tcg/user-exec.c b/accel/tcg/user-exec.c index 4384b59a4d..897d1571c4 100644 --- a/accel/tcg/user-exec.c +++ b/accel/tcg/user-exec.c @@ -64,27 +64,56 @@ static inline int handle_cpu_signal(uintptr_t pc, siginfo_t *info, CPUState *cpu = current_cpu; CPUClass *cc; unsigned long address = (unsigned long)info->si_addr; - MMUAccessType access_type; + MMUAccessType access_type = is_write ? MMU_DATA_STORE : MMU_DATA_LOAD; - /* We must handle PC addresses from two different sources: - * a call return address and a signal frame address. - * - * Within cpu_restore_state_from_tb we assume the former and adjust - * the address by -GETPC_ADJ so that the address is within the call - * insn so that addr does not accidentally match the beginning of the - * next guest insn. - * - * However, when the PC comes from the signal frame, it points to - * the actual faulting host insn and not a call insn. Subtracting - * GETPC_ADJ in that case may accidentally match the previous guest insn. - * - * So for the later case, adjust forward to compensate for what - * will be done later by cpu_restore_state_from_tb. - */ - if (helper_retaddr) { + switch (helper_retaddr) { + default: + /* + * Fault during host memory operation within a helper function. + * The helper's host return address, saved here, gives us a + * pointer into the generated code that will unwind to the + * correct guest pc. + */ pc = helper_retaddr; - } else { + break; + + case 0: + /* + * Fault during host memory operation within generated code. + * (Or, a unrelated bug within qemu, but we can't tell from here). + * + * We take the host pc from the signal frame. However, we cannot + * use that value directly. Within cpu_restore_state_from_tb, we + * assume PC comes from GETPC(), as used by the helper functions, + * so we adjust the address by -GETPC_ADJ to form an address that + * is within the call insn, so that the address does not accidentially + * match the beginning of the next guest insn. However, when the + * pc comes from the signal frame it points to the actual faulting + * host memory insn and not the return from a call insn. + * + * Therefore, adjust to compensate for what will be done later + * by cpu_restore_state_from_tb. + */ pc += GETPC_ADJ; + break; + + case 1: + /* + * Fault during host read for translation, or loosely, "execution". + * + * The guest pc is already pointing to the start of the TB for which + * code is being generated. If the guest translator manages the + * page crossings correctly, this is exactly the correct address + * (and if the translator doesn't handle page boundaries correctly + * there's little we can do about that here). Therefore, do not + * trigger the unwinder. + * + * Like tb_gen_code, release the memory lock before cpu_loop_exit. + */ + pc = 0; + access_type = MMU_INST_FETCH; + mmap_unlock(); + break; } /* For synchronous signals we expect to be coming from the vCPU @@ -155,7 +184,6 @@ static inline int handle_cpu_signal(uintptr_t pc, siginfo_t *info, clear_helper_retaddr(); cc = CPU_GET_CLASS(cpu); - access_type = is_write ? MMU_DATA_STORE : MMU_DATA_LOAD; cc->tlb_fill(cpu, address, 0, access_type, MMU_USER_IDX, false, pc); g_assert_not_reached(); }