The linux-user patches are on the tcg-ish side of user-only

emulation, rather than the syscall-ish side, so queuing here.

Solving the deadlock issue is quite important vs timeouts.

The following changes since commit 6dffbe36af79e26a4d23f94a9a1c1201de99c261:

Merge tag 'migration-20230215-pull-request' of https://gitlab.com/juan.quintela/qemu into staging (2023-02-16 13:09:51 +0000)

https://gitlab.com/rth7680/qemu.git tags/pull-tcg-20230219

for you to fetch changes up to 2f5b4792c0220920831ac84f94c3435b14791857:

target/microblaze: Add gdbstub xml (2023-02-19 16:12:26 -1000)

tcg: Allow first half of insn in ram, and second half in mmio

linux-user/sparc: SIGILL for unknown trap vectors

linux-user/microblaze: SIGILL for privileged insns

linux-user: Fix deadlock while exiting due to signal

target/microblaze: Add gdbstub xml

Ilya Leoshkevich (4):

linux-user: Always exit from exclusive state in fork_end()

cpus: Make {start,end}_exclusive() recursive

linux-user/microblaze: Handle privileged exception

tests/tcg/linux-test: Add linux-fork-trap test

Richard Henderson (3):

accel/tcg: Allow the second page of an instruction to be MMIO

linux-user/sparc: Raise SIGILL for all unhandled software traps

target/microblaze: Add gdbstub xml

configs/targets/microblaze-linux-user.mak | 1 +

configs/targets/microblaze-softmmu.mak | 1 +

configs/targets/microblazeel-linux-user.mak | 1 +

configs/targets/microblazeel-softmmu.mak | 1 +

include/hw/core/cpu.h | 4 +-

target/microblaze/cpu.h | 2 +

accel/tcg/translator.c | 12 +++++-

cpus-common.c | 12 +++++-

linux-user/main.c | 10 +++--

linux-user/microblaze/cpu_loop.c | 10 ++++-

linux-user/sparc/cpu_loop.c | 8 ++++

linux-user/syscall.c | 1 +

target/microblaze/cpu.c | 7 ++-

target/microblaze/gdbstub.c | 51 ++++++++++++++++------

tests/tcg/multiarch/linux/linux-fork-trap.c | 51 ++++++++++++++++++++++

gdb-xml/microblaze-core.xml | 67 +++++++++++++++++++++++++++++

gdb-xml/microblaze-stack-protect.xml | 12 ++++++

17 files changed, 224 insertions(+), 27 deletions(-)

create mode 100644 tests/tcg/multiarch/linux/linux-fork-trap.c

create mode 100644 gdb-xml/microblaze-core.xml

create mode 100644 gdb-xml/microblaze-stack-protect.xml

If an instruction straddles a page boundary, and the first page

was ram, but the second page was MMIO, we would abort. Handle

this as if both pages are MMIO, by setting the ram_addr_t for

the first page to -1.

Reported-by: Sid Manning <sidneym@quicinc.com>

Reported-by: Jørgen Hansen <Jorgen.Hansen@wdc.com>

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>

accel/tcg/translator.c | 12 ++++++++++--

1 file changed, 10 insertions(+), 2 deletions(-)

@@ -XXX,XX +XXX,XX @@ static void *translator_access(CPUArchState *env, DisasContextBase *db,

if (host == NULL) {

tb_page_addr_t phys_page =

get_page_addr_code_hostp(env, base, &db->host_addr[1]);

- /* We cannot handle MMIO as second page. */

- assert(phys_page != -1);

+

+ /*

+ * If the second page is MMIO, treat as if the first page

+ * was MMIO as well, so that we do not cache the TB.

+ */

+ if (unlikely(phys_page == -1)) {

+ tb_set_page_addr0(tb, -1);

+ return NULL;

+ }

+

tb_set_page_addr1(tb, phys_page);

#ifdef CONFIG_USER_ONLY

page_protect(end);

The linux kernel's trap tables vector all unassigned trap

numbers to BAD_TRAP, which then raises SIGILL.

Tested-by: Ilya Leoshkevich <iii@linux.ibm.com>

Reported-by: Ilya Leoshkevich <iii@linux.ibm.com>

linux-user/sparc/cpu_loop.c | 8 ++++++++

1 file changed, 8 insertions(+)

diff --git a/linux-user/sparc/cpu_loop.c b/linux-user/sparc/cpu_loop.c

--- a/linux-user/sparc/cpu_loop.c

+++ b/linux-user/sparc/cpu_loop.c

@@ -XXX,XX +XXX,XX @@ void cpu_loop (CPUSPARCState *env)

cpu_exec_step_atomic(cs);

break;

default:

+ /*

+ * Most software trap numbers vector to BAD_TRAP.

+ * Handle anything not explicitly matched above.

+ */

+ if (trapnr >= TT_TRAP && trapnr <= TT_TRAP + 0x7f) {

+ force_sig_fault(TARGET_SIGILL, ILL_ILLTRP, env->pc);

+ break;

+ }

fprintf(stderr, "Unhandled trap: 0x%x\n", trapnr);

cpu_dump_state(cs, stderr, 0);

exit(EXIT_FAILURE);

From: Ilya Leoshkevich <iii@linux.ibm.com>

linux-user/main.c | 10 ++++++----

linux-user/syscall.c | 1 +

2 files changed, 7 insertions(+), 4 deletions(-)

diff --git a/linux-user/main.c b/linux-user/main.c

--- a/linux-user/main.c

+++ b/linux-user/main.c

@@ -XXX,XX +XXX,XX @@ void fork_end(int child)

}

qemu_init_cpu_list();

gdbserver_fork(thread_cpu);

- /* qemu_init_cpu_list() takes care of reinitializing the

- * exclusive state, so we don't need to end_exclusive() here.

- */

} else {

cpu_list_unlock();

- end_exclusive();

}

+ /*

+ * qemu_init_cpu_list() reinitialized the child exclusive state, but we

+ * also need to keep current_cpu consistent, so call end_exclusive() for

+ * both child and parent.

+ */

+ end_exclusive();

__thread CPUState *thread_cpu;

diff --git a/linux-user/syscall.c b/linux-user/syscall.c

--- a/linux-user/syscall.c

+++ b/linux-user/syscall.c

@@ -XXX,XX +XXX,XX @@ static int do_fork(CPUArchState *env, unsigned int flags, abi_ulong newsp,

cpu_clone_regs_parent(env, flags);

fork_end(0);

}

+ g_assert(!cpu_in_exclusive_context(cpu));

}

return ret;

From: Ilya Leoshkevich <iii@linux.ibm.com>

Currently dying to one of the core_dump_signal()s deadlocks, because

dump_core_and_abort() calls start_exclusive() two times: first via

stop_all_tasks(), and then via preexit_cleanup() ->

qemu_plugin_user_exit().

There are a number of ways to solve this: resume after dumping core;

check cpu_in_exclusive_context() in qemu_plugin_user_exit(); or make

{start,end}_exclusive() recursive. Pick the last option, since it's

the most straightforward one.

Fixes: da91c1920242 ("linux-user: Clean up when exiting due to a signal")

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>

Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>

Message-Id: <20230214140829.45392-3-iii@linux.ibm.com>

include/hw/core/cpu.h | 4 ++--

cpus-common.c | 12 ++++++++++--

2 files changed, 12 insertions(+), 4 deletions(-)

@@ -XXX,XX +XXX,XX @@ struct CPUState {

bool unplug;

bool crash_occurred;

bool exit_request;

- bool in_exclusive_context;

+ int exclusive_context_count;

uint32_t cflags_next_tb;

/* updates protected by BQL */

uint32_t interrupt_request;

@@ -XXX,XX +XXX,XX @@ void async_safe_run_on_cpu(CPUState *cpu, run_on_cpu_func func, run_on_cpu_data

static inline bool cpu_in_exclusive_context(const CPUState *cpu)

{

- return cpu->in_exclusive_context;

+ return cpu->exclusive_context_count;

}

/**

diff --git a/cpus-common.c b/cpus-common.c

--- a/cpus-common.c

+++ b/cpus-common.c

@@ -XXX,XX +XXX,XX @@ void start_exclusive(void)

CPUState *other_cpu;

int running_cpus;

+ if (current_cpu->exclusive_context_count) {

+ current_cpu->exclusive_context_count++;

+ return;

+ }

+

qemu_mutex_lock(&qemu_cpu_list_lock);

exclusive_idle();

@@ -XXX,XX +XXX,XX @@ void start_exclusive(void)

*/

qemu_mutex_unlock(&qemu_cpu_list_lock);

- current_cpu->in_exclusive_context = true;

+ current_cpu->exclusive_context_count = 1;

}

/* Finish an exclusive operation. */

void end_exclusive(void)

- current_cpu->in_exclusive_context = false;

+ current_cpu->exclusive_context_count--;

+ if (current_cpu->exclusive_context_count) {

+ return;

+ }

qemu_mutex_lock(&qemu_cpu_list_lock);

qatomic_set(&pending_cpus, 0);