[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PULL 43/43] cpu-exec: fix lock hierarchy for user-mode emu
From: |
Paolo Bonzini |
Subject: |
[Qemu-devel] [PULL 43/43] cpu-exec: fix lock hierarchy for user-mode emulation |
Date: |
Wed, 9 Sep 2015 15:50:13 +0200 |
tb_lock has to be taken inside the mmap_lock (example:
tb_invalidate_phys_range is called by target_mmap), but
tb_link_page is taking the mmap_lock and it is called
with the tb_lock held.
To fix this, take the mmap_lock in tb_find_slow, not
in tb_link_page.
Reviewed-by: Peter Maydell <address@hidden>
Signed-off-by: Paolo Bonzini <address@hidden>
---
cpu-exec.c | 71 ++++++++++++++++++++++++++++++++++++++++++---------------
translate-all.c | 6 ++---
2 files changed, 55 insertions(+), 22 deletions(-)
diff --git a/cpu-exec.c b/cpu-exec.c
index 2c0a6f6..cb0c75d 100644
--- a/cpu-exec.c
+++ b/cpu-exec.c
@@ -249,10 +249,10 @@ static void cpu_exec_nocache(CPUState *cpu, int
max_cycles,
tb_free(tb);
}
-static TranslationBlock *tb_find_slow(CPUState *cpu,
- target_ulong pc,
- target_ulong cs_base,
- uint64_t flags)
+static TranslationBlock *tb_find_physical(CPUState *cpu,
+ target_ulong pc,
+ target_ulong cs_base,
+ uint64_t flags)
{
CPUArchState *env = (CPUArchState *)cpu->env_ptr;
TranslationBlock *tb, **ptb1;
@@ -269,8 +269,9 @@ static TranslationBlock *tb_find_slow(CPUState *cpu,
ptb1 = &tcg_ctx.tb_ctx.tb_phys_hash[h];
for(;;) {
tb = *ptb1;
- if (!tb)
- goto not_found;
+ if (!tb) {
+ return NULL;
+ }
if (tb->pc == pc &&
tb->page_addr[0] == phys_page1 &&
tb->cs_base == cs_base &&
@@ -282,25 +283,59 @@ static TranslationBlock *tb_find_slow(CPUState *cpu,
virt_page2 = (pc & TARGET_PAGE_MASK) +
TARGET_PAGE_SIZE;
phys_page2 = get_page_addr_code(env, virt_page2);
- if (tb->page_addr[1] == phys_page2)
- goto found;
+ if (tb->page_addr[1] == phys_page2) {
+ break;
+ }
} else {
- goto found;
+ break;
}
}
ptb1 = &tb->phys_hash_next;
}
- not_found:
- /* if no translated code available, then translate it now */
- tb = tb_gen_code(cpu, pc, cs_base, flags, 0);
- found:
- /* Move the last found TB to the head of the list */
- if (likely(*ptb1)) {
- *ptb1 = tb->phys_hash_next;
- tb->phys_hash_next = tcg_ctx.tb_ctx.tb_phys_hash[h];
- tcg_ctx.tb_ctx.tb_phys_hash[h] = tb;
+ /* Move the TB to the head of the list */
+ *ptb1 = tb->phys_hash_next;
+ tb->phys_hash_next = tcg_ctx.tb_ctx.tb_phys_hash[h];
+ tcg_ctx.tb_ctx.tb_phys_hash[h] = tb;
+ return tb;
+}
+
+static TranslationBlock *tb_find_slow(CPUState *cpu,
+ target_ulong pc,
+ target_ulong cs_base,
+ uint64_t flags)
+{
+ TranslationBlock *tb;
+
+ tb = tb_find_physical(cpu, pc, cs_base, flags);
+ if (tb) {
+ goto found;
+ }
+
+#ifdef CONFIG_USER_ONLY
+ /* mmap_lock is needed by tb_gen_code, and mmap_lock must be
+ * taken outside tb_lock. Since we're momentarily dropping
+ * tb_lock, there's a chance that our desired tb has been
+ * translated.
+ */
+ tb_unlock();
+ mmap_lock();
+ tb_lock();
+ tb = tb_find_physical(cpu, pc, cs_base, flags);
+ if (tb) {
+ mmap_unlock();
+ goto found;
}
+#endif
+
+ /* if no translated code available, then translate it now */
+ tb = tb_gen_code(cpu, pc, cs_base, flags, 0);
+
+#ifdef CONFIG_USER_ONLY
+ mmap_unlock();
+#endif
+
+found:
/* we add the TB in the virtual pc hash table */
cpu->tb_jmp_cache[tb_jmp_cache_hash_func(pc)] = tb;
return tb;
diff --git a/translate-all.c b/translate-all.c
index e3c5c5e..d9c7aac 100644
--- a/translate-all.c
+++ b/translate-all.c
@@ -1375,6 +1375,8 @@ static inline void tb_alloc_page(TranslationBlock *tb,
/* add a new TB and link it to the physical page tables. phys_page2 is
* (-1) to indicate that only one page contains the TB.
+ *
+ * Called with mmap_lock held for user-mode emulation.
*/
static void tb_link_page(TranslationBlock *tb, tb_page_addr_t phys_pc,
tb_page_addr_t phys_page2)
@@ -1382,9 +1384,6 @@ static void tb_link_page(TranslationBlock *tb,
tb_page_addr_t phys_pc,
unsigned int h;
TranslationBlock **ptb;
- /* Grab the mmap lock to stop another thread invalidating this TB
- before we are done. */
- mmap_lock();
/* add in the physical hash table */
h = tb_phys_hash_func(phys_pc);
ptb = &tcg_ctx.tb_ctx.tb_phys_hash[h];
@@ -1414,7 +1413,6 @@ static void tb_link_page(TranslationBlock *tb,
tb_page_addr_t phys_pc,
#ifdef DEBUG_TB_CHECK
tb_page_check();
#endif
- mmap_unlock();
}
/* find the TB 'tb' such that tb[0].tc_ptr <= tc_ptr <
--
2.4.3
- [Qemu-devel] [PULL 34/43] configure: Add support for jemalloc, (continued)
- [Qemu-devel] [PULL 34/43] configure: Add support for jemalloc, Paolo Bonzini, 2015/09/09
- [Qemu-devel] [PULL 35/43] scripts/dump-guest-memory.py: fix after RAMBlock change, Paolo Bonzini, 2015/09/09
- [Qemu-devel] [PULL 33/43] add macro file for coccinelle, Paolo Bonzini, 2015/09/09
- [Qemu-devel] [PULL 37/43] cpus: remove tcg_halt_cond and tcg_cpu_thread globals, Paolo Bonzini, 2015/09/09
- [Qemu-devel] [PULL 36/43] cpus: protect work list with work_mutex, Paolo Bonzini, 2015/09/09
- [Qemu-devel] [PULL 41/43] tcg: comment on which functions have to be called with mmap_lock held, Paolo Bonzini, 2015/09/09
- [Qemu-devel] [PULL 39/43] remove unused spinlock., Paolo Bonzini, 2015/09/09
- [Qemu-devel] [PULL 40/43] tcg: add memory barriers in page_find_alloc accesses, Paolo Bonzini, 2015/09/09
- [Qemu-devel] [PULL 42/43] exec: make mmap_lock/mmap_unlock globally available, Paolo Bonzini, 2015/09/09
- [Qemu-devel] [PULL 38/43] replace spinlock by QemuMutex., Paolo Bonzini, 2015/09/09
- [Qemu-devel] [PULL 43/43] cpu-exec: fix lock hierarchy for user-mode emulation,
Paolo Bonzini <=
- Re: [Qemu-devel] [PULL 00/43] First batch of misc changes for 2.5 (2015-09-09), Peter Maydell, 2015/09/09