[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PATCH v7 52/52] translate-all: exit from tb_phys_invalidat
From: |
Richard Henderson |
Subject: |
[Qemu-devel] [PATCH v7 52/52] translate-all: exit from tb_phys_invalidate if qht_remove fails |
Date: |
Fri, 20 Oct 2017 16:20:23 -0700 |
From: "Emilio G. Cota" <address@hidden>
Two or more threads might race while invalidating the same TB. We currently
do not check for this at all despite taking tb_lock, which means we would
wrongly invalidate the same TB more than once. This bug has actually been
hit by users: I recently saw a report on IRC, although I have yet to see
the corresponding test case.
Fix this by using qht_remove as the synchronization point; if it fails,
that means the TB has already been invalidated, and therefore there
is nothing left to do in tb_phys_invalidate.
Note that this solution works now that we still have tb_lock, and will
continue working once we remove tb_lock.
Reviewed-by: Richard Henderson <address@hidden>
Signed-off-by: Emilio G. Cota <address@hidden>
Message-Id: <address@hidden>
Signed-off-by: Richard Henderson <address@hidden>
---
accel/tcg/translate-all.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/accel/tcg/translate-all.c b/accel/tcg/translate-all.c
index 5724149289..34c5e28d07 100644
--- a/accel/tcg/translate-all.c
+++ b/accel/tcg/translate-all.c
@@ -1079,7 +1079,9 @@ void tb_phys_invalidate(TranslationBlock *tb,
tb_page_addr_t page_addr)
phys_pc = tb->page_addr[0] + (tb->pc & ~TARGET_PAGE_MASK);
h = tb_hash_func(phys_pc, tb->pc, tb->flags, tb->cflags & CF_HASH_MASK,
tb->trace_vcpu_dstate);
- qht_remove(&tb_ctx.htable, tb, h);
+ if (!qht_remove(&tb_ctx.htable, tb, h)) {
+ return;
+ }
/* remove the TB from the page list */
if (tb->page_addr[0] != page_addr) {
--
2.13.6
- [Qemu-devel] [PATCH v7 40/52] translate-all: report correct avg host TB size, (continued)
- [Qemu-devel] [PATCH v7 40/52] translate-all: report correct avg host TB size, Richard Henderson, 2017/10/20
- [Qemu-devel] [PATCH v7 41/52] tcg: take tb_ctx out of TCGContext, Richard Henderson, 2017/10/20
- [Qemu-devel] [PATCH v7 44/52] tcg: introduce **tcg_ctxs to keep track of all TCGContext's, Richard Henderson, 2017/10/20
- [Qemu-devel] [PATCH v7 45/52] tcg: distribute profiling counters across TCGContext's, Richard Henderson, 2017/10/20
- [Qemu-devel] [PATCH v7 42/52] tcg: define tcg_init_ctx and make tcg_ctx a pointer, Richard Henderson, 2017/10/20
- [Qemu-devel] [PATCH v7 46/52] tcg: allocate optimizer temps with tcg_malloc, Richard Henderson, 2017/10/20
- [Qemu-devel] [PATCH v7 43/52] gen-icount: fold exitreq_label into TCGContext, Richard Henderson, 2017/10/20
- [Qemu-devel] [PATCH v7 47/52] osdep: introduce qemu_mprotect_rwx/none, Richard Henderson, 2017/10/20
- [Qemu-devel] [PATCH v7 49/52] tcg: introduce regions to split code_gen_buffer, Richard Henderson, 2017/10/20
- [Qemu-devel] [PATCH v7 50/52] tcg: enable multiple TCG contexts in softmmu, Richard Henderson, 2017/10/20
- [Qemu-devel] [PATCH v7 52/52] translate-all: exit from tb_phys_invalidate if qht_remove fails,
Richard Henderson <=
- [Qemu-devel] [PATCH v7 48/52] translate-all: use qemu_protect_rwx/none helpers, Richard Henderson, 2017/10/20
- [Qemu-devel] [PATCH v7 51/52] tcg: Initialize cpu_env generically, Richard Henderson, 2017/10/20
- Re: [Qemu-devel] [PATCH v7 00/52] tcg queued patches, no-reply, 2017/10/20
- Re: [Qemu-devel] [PATCH v7 00/52] tcg queued patches, no-reply, 2017/10/22
- Re: [Qemu-devel] [PATCH v7 00/52] tcg queued patches, Emilio G. Cota, 2017/10/23