Skip to content
Snippets Groups Projects
  1. Sep 15, 2023
  2. Sep 07, 2023
  3. Aug 31, 2023
  4. Aug 29, 2023
  5. Aug 24, 2023
  6. Aug 12, 2023
  7. Jul 23, 2023
    • Ilya Leoshkevich's avatar
      tcg/{i386, s390x}: Add earlyclobber to the op_add2's first output · 22d2e535
      Ilya Leoshkevich authored
      
      i386 and s390x implementations of op_add2 require an earlyclobber,
      which is currently missing. This breaks VCKSM in s390x guests. E.g., on
      x86_64 the following op:
      
          add2_i32 tmp2,tmp3,tmp2,tmp3,tmp3,tmp2   dead: 0 2 3 4 5  pref=none,0xffff
      
      is translated to:
      
          addl     %ebx, %r12d
          adcl     %r12d, %ebx
      
      Introduce a new C_N1_O1_I4 constraint, and make sure that earlyclobber
      of aliased outputs is honored.
      
      Cc: qemu-stable@nongnu.org
      Fixes: 82790a87 ("tcg: Add markup for output requires new register")
      Signed-off-by: default avatarIlya Leoshkevich <iii@linux.ibm.com>
      Reviewed-by: default avatarRichard Henderson <richard.henderson@linaro.org>
      Message-Id: <20230719221310.1968845-7-iii@linux.ibm.com>
      Signed-off-by: default avatarRichard Henderson <richard.henderson@linaro.org>
      22d2e535
    • Jordan Niethe's avatar
      tcg/ppc: Fix race in goto_tb implementation · 736a1588
      Jordan Niethe authored
      Commit 20b66433 ("tcg/ppc: Reorg goto_tb implementation") modified
      goto_tb to ensure only a single instruction was patched to prevent
      incorrect behavior if a thread was in the middle of multiple
      instructions when they were replaced. However this introduced a race
      between loading the jmp target into TCG_REG_TB and patching and
      executing the direct branch.
      
      The relevant part of the goto_tb implementation:
      
          ld TCG_REG_TB, TARGET_ADDR_LOCATION(TCG_REG_TB)
        patch_location:
          mtctr TCG_REG_TB
          bctr
      
      tb_target_set_jmp_target() will replace 'patch_location' with a direct
      branch if the target is in range. The direct branch now relies on
      TCG_REG_TB being set up correctly by the ld. Prior to this commit
      multiple instructions were patched in for the direct branch case; these
      instructions would initialize TCG_REG_TB to the same value as the branch
      target.
      
      Imagine the following sequence:
      
      1) Thread A is executing the goto_tb sequence and loads the jmp
         target into TCG_REG_TB.
      
      2) Thread B updates the jmp target address and calls
         tb_target_set_jmp_target(). This patches a new direct branch into the
         goto_tb sequence.
      
      3) Thread A executes the newly patched direct branch. The value in
         TCG_REG_TB still contains the old jmp target.
      
      TCG_REG_TB MUST contain the translation block's tc.ptr. Execution will
      eventually crash after performing memory accesses generated from a
      faulty value in TCG_REG_TB.
      
      This presents as segfaults or illegal instruction exceptions.
      
      Do not revert commit 20b66433 as it did fix a different race
      condition. Instead remove the direct branch optimization and always use
      indirect branches.
      
      The direct branch optimization can be re-added later with a race free
      sequence.
      
      Fixes: 20b66433 ("tcg/ppc: Reorg goto_tb implementation")
      Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1726
      
      
      Reported-by: default avatarAnushree Mathur <anushree.mathur@linux.vnet.ibm.com>
      Tested-by: default avatarAnushree Mathur <anushree.mathur@linux.vnet.ibm.com>
      Tested-by: default avatarMichael Tokarev <mjt@tls.msk.ru>
      Reviewed-by: default avatarRichard Henderson <richard.henderson@linaro.org>
      Co-developed-by: default avatarBenjamin Gray <bgray@linux.ibm.com>
      Signed-off-by: default avatarJordan Niethe <jniethe5@gmail.com>
      Signed-off-by: default avatarBenjamin Gray <bgray@linux.ibm.com>
      Message-Id: <20230717093001.13167-1-jniethe5@gmail.com>
      736a1588
  8. Jul 15, 2023
  9. Jul 08, 2023
  10. Jul 01, 2023
Loading