| 1 | Just one bugfix patch for this rc: | 1 | This bug seemed worth fixing for 8.0 since we need an rc4 anyway: |
|---|---|---|---|
| 2 | we were using uninitialized data for the guarded bit when | ||
| 3 | combining stage 1 and stage 2 attrs. | ||
| 2 | 4 | ||
| 3 | The following changes since commit ca5f3d4df1b47d7f66a109cdb504e83dfd7ec433: | 5 | thanks |
| 6 | -- PMM | ||
| 4 | 7 | ||
| 5 | Merge tag 'pull-la-20220808' of https://gitlab.com/rth7680/qemu into staging (2022-08-08 19:51:12 -0700) | 8 | The following changes since commit 08dede07030973c1053868bc64de7e10bfa02ad6: |
| 9 | |||
| 10 | Merge tag 'pull-ppc-20230409' of https://github.com/legoater/qemu into staging (2023-04-10 11:47:52 +0100) | ||
| 6 | 11 | ||
| 7 | are available in the Git repository at: | 12 | are available in the Git repository at: |
| 8 | 13 | ||
| 9 | https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20220809 | 14 | https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20230410 |
| 10 | 15 | ||
| 11 | for you to fetch changes up to c7f26ded6d5065e4116f630f6a490b55f6c5f58e: | 16 | for you to fetch changes up to 8539dc00552e8ea60420856fc1262c8299bc6308: |
| 12 | 17 | ||
| 13 | icount: Take iothread lock when running QEMU timers (2022-08-09 10:55:14 +0100) | 18 | target/arm: Copy guarded bit in combine_cacheattrs (2023-04-10 14:31:40 +0100) |
| 14 | 19 | ||
| 15 | ---------------------------------------------------------------- | 20 | ---------------------------------------------------------------- |
| 16 | target-arm queue: | 21 | target-arm: Fix bug where we weren't initializing |
| 17 | * icount: Take iothread lock when running QEMU timers | 22 | guarded bit state when combining S1/S2 attrs |
| 18 | 23 | ||
| 19 | ---------------------------------------------------------------- | 24 | ---------------------------------------------------------------- |
| 20 | Peter Maydell (1): | 25 | Richard Henderson (2): |
| 21 | icount: Take iothread lock when running QEMU timers | 26 | target/arm: PTE bit GP only applies to stage1 |
| 27 | target/arm: Copy guarded bit in combine_cacheattrs | ||
| 22 | 28 | ||
| 23 | accel/tcg/tcg-accel-ops-icount.c | 6 ++++++ | 29 | target/arm/ptw.c | 11 ++++++----- |
| 24 | 1 file changed, 6 insertions(+) | 30 | 1 file changed, 6 insertions(+), 5 deletions(-) | diff view generated by jsdifflib |
New patch | |||
|---|---|---|---|
| 1 | From: Richard Henderson <richard.henderson@linaro.org> | ||
| 1 | 2 | ||
| 3 | Only perform the extract of GP during the stage1 walk. | ||
| 4 | |||
| 5 | Reported-by: Peter Maydell <peter.maydell@linaro.org> | ||
| 6 | Signed-off-by: Richard Henderson <richard.henderson@linaro.org> | ||
| 7 | Reviewed-by: Peter Maydell <peter.maydell@linaro.org> | ||
| 8 | Message-id: 20230407185149.3253946-2-richard.henderson@linaro.org | ||
| 9 | Signed-off-by: Peter Maydell <peter.maydell@linaro.org> | ||
| 10 | --- | ||
| 11 | target/arm/ptw.c | 10 +++++----- | ||
| 12 | 1 file changed, 5 insertions(+), 5 deletions(-) | ||
| 13 | |||
| 14 | diff --git a/target/arm/ptw.c b/target/arm/ptw.c | ||
| 15 | index XXXXXXX..XXXXXXX 100644 | ||
| 16 | --- a/target/arm/ptw.c | ||
| 17 | +++ b/target/arm/ptw.c | ||
| 18 | @@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw, | ||
| 19 | result->f.attrs.secure = false; | ||
| 20 | } | ||
| 21 | |||
| 22 | - /* When in aarch64 mode, and BTI is enabled, remember GP in the TLB. */ | ||
| 23 | - if (aarch64 && cpu_isar_feature(aa64_bti, cpu)) { | ||
| 24 | - result->f.guarded = extract64(attrs, 50, 1); /* GP */ | ||
| 25 | - } | ||
| 26 | - | ||
| 27 | if (regime_is_stage2(mmu_idx)) { | ||
| 28 | result->cacheattrs.is_s2_format = true; | ||
| 29 | result->cacheattrs.attrs = extract32(attrs, 2, 4); | ||
| 30 | @@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw, | ||
| 31 | assert(attrindx <= 7); | ||
| 32 | result->cacheattrs.is_s2_format = false; | ||
| 33 | result->cacheattrs.attrs = extract64(mair, attrindx * 8, 8); | ||
| 34 | + | ||
| 35 | + /* When in aarch64 mode, and BTI is enabled, remember GP in the TLB. */ | ||
| 36 | + if (aarch64 && cpu_isar_feature(aa64_bti, cpu)) { | ||
| 37 | + result->f.guarded = extract64(attrs, 50, 1); /* GP */ | ||
| 38 | + } | ||
| 39 | } | ||
| 40 | |||
| 41 | /* | ||
| 42 | -- | ||
| 43 | 2.34.1 | diff view generated by jsdifflib |
| 1 | The function icount_prepare_for_run() is called with the iothread | 1 | From: Richard Henderson <richard.henderson@linaro.org> |
|---|---|---|---|
| 2 | unlocked, but it can call icount_notify_aio_contexts() which will | ||
| 3 | run qemu timer handlers. Those are supposed to be run only with | ||
| 4 | the iothread lock held, so take the lock while we do that. | ||
| 5 | 2 | ||
| 6 | Since icount mode runs everything on a single thread anyway, | 3 | The guarded bit comes from the stage1 walk. |
| 7 | not holding the lock is likely mostly not going to introduce | ||
| 8 | races, but it can cause us to trip over assertions that we | ||
| 9 | do hold the lock, such as the one reported in issue 1130. | ||
| 10 | 4 | ||
| 11 | Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1130 | 5 | Fixes: Coverity CID 1507929 |
| 6 | Signed-off-by: Richard Henderson <richard.henderson@linaro.org> | ||
| 7 | Reviewed-by: Peter Maydell <peter.maydell@linaro.org> | ||
| 8 | Message-id: 20230407185149.3253946-3-richard.henderson@linaro.org | ||
| 12 | Signed-off-by: Peter Maydell <peter.maydell@linaro.org> | 9 | Signed-off-by: Peter Maydell <peter.maydell@linaro.org> |
| 13 | Reviewed-by: Richard Henderson <richard.henderson@linaro.org> | ||
| 14 | Tested-by: Pavel Dovgalyuk <Pavel.Dovgalyuk@ispras.ru> | ||
| 15 | Message-id: 20220801164527.3134765-1-peter.maydell@linaro.org | ||
| 16 | --- | 10 | --- |
| 17 | accel/tcg/tcg-accel-ops-icount.c | 6 ++++++ | 11 | target/arm/ptw.c | 1 + |
| 18 | 1 file changed, 6 insertions(+) | 12 | 1 file changed, 1 insertion(+) |
| 19 | 13 | ||
| 20 | diff --git a/accel/tcg/tcg-accel-ops-icount.c b/accel/tcg/tcg-accel-ops-icount.c | 14 | diff --git a/target/arm/ptw.c b/target/arm/ptw.c |
| 21 | index XXXXXXX..XXXXXXX 100644 | 15 | index XXXXXXX..XXXXXXX 100644 |
| 22 | --- a/accel/tcg/tcg-accel-ops-icount.c | 16 | --- a/target/arm/ptw.c |
| 23 | +++ b/accel/tcg/tcg-accel-ops-icount.c | 17 | +++ b/target/arm/ptw.c |
| 24 | @@ -XXX,XX +XXX,XX @@ void icount_prepare_for_run(CPUState *cpu) | 18 | @@ -XXX,XX +XXX,XX @@ static ARMCacheAttrs combine_cacheattrs(uint64_t hcr, |
| 25 | replay_mutex_lock(); | 19 | |
| 26 | 20 | assert(!s1.is_s2_format); | |
| 27 | if (cpu->icount_budget == 0) { | 21 | ret.is_s2_format = false; |
| 28 | + /* | 22 | + ret.guarded = s1.guarded; |
| 29 | + * We're called without the iothread lock, so must take it while | 23 | |
| 30 | + * we're calling timer handlers. | 24 | if (s1.attrs == 0xf0) { |
| 31 | + */ | 25 | tagged = true; |
| 32 | + qemu_mutex_lock_iothread(); | ||
| 33 | icount_notify_aio_contexts(); | ||
| 34 | + qemu_mutex_unlock_iothread(); | ||
| 35 | } | ||
| 36 | } | ||
| 37 | |||
| 38 | -- | 26 | -- |
| 39 | 2.25.1 | 27 | 2.34.1 | diff view generated by jsdifflib |