summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
| * | target/riscv: Add support for the 32-bit MSTATUSH CSRAlistair Francis2020-02-276-0/+62
| | | | | | | | | | | | | | | | | | Signed-off-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Palmer Dabbelt <palmerdabbelt@google.com> Signed-off-by: Palmer Dabbelt <palmerdabbelt@google.com>
| * | target/riscv: Set htval and mtval2 on execptionsAlistair Francis2020-02-271-0/+10
| | | | | | | | | | | | | | | | | | Signed-off-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Palmer Dabbelt <palmerdabbelt@google.com> Signed-off-by: Palmer Dabbelt <palmerdabbelt@google.com>
| * | target/riscv: Raise the new execptions when 2nd stage translation failsAlistair Francis2020-02-271-6/+18
| | | | | | | | | | | | | | | | | | Signed-off-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Palmer Dabbelt <palmerdabbelt@google.com> Signed-off-by: Palmer Dabbelt <palmerdabbelt@google.com>
| * | target/riscv: Implement second stage MMUAlistair Francis2020-02-272-19/+175
| | | | | | | | | | | | | | | | | | Signed-off-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Palmer Dabbelt <palmerdabbelt@google.com> Signed-off-by: Palmer Dabbelt <palmerdabbelt@google.com>
| * | target/riscv: Allow specifying MMU stageAlistair Francis2020-02-271-9/+28
| | | | | | | | | | | | | | | | | | Signed-off-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Palmer Dabbelt <palmerdabbelt@google.com> Signed-off-by: Palmer Dabbelt <palmerdabbelt@google.com>
| * | target/riscv: Respect MPRV and SPRV for floating point opsAlistair Francis2020-02-271-1/+15
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | mark_fs_dirty() is the only place in translate.c that uses the virt_enabled bool. Let's respect the contents of MSTATUS.MPRV and HSTATUS.SPRV when setting the bool as this is used for performing floating point operations when V=0. Signed-off-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Palmer Dabbelt <palmerdabbelt@google.com> Signed-off-by: Palmer Dabbelt <palmerdabbelt@google.com>
| * | target/riscv: Mark both sstatus and msstatus_hs as dirtyAlistair Francis2020-02-271-0/+13
| | | | | | | | | | | | | | | | | | | | | | | | Mark both sstatus and vsstatus as dirty (3). Signed-off-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Palmer Dabbelt <palmerdabbelt@google.com> Signed-off-by: Palmer Dabbelt <palmerdabbelt@google.com>
| * | target/riscv: Disable guest FP support based on virtual statusAlistair Francis2020-02-271-0/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When the Hypervisor extension is in use we only enable floating point support when both status and vsstatus have enabled floating point support. Signed-off-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Palmer Dabbelt <palmerdabbelt@google.com> Signed-off-by: Palmer Dabbelt <palmerdabbelt@google.com>
| * | target/riscv: Only set TB flags with FP status if enabledAlistair Francis2020-02-271-1/+4
| | | | | | | | | | | | | | | | | | Signed-off-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Palmer Dabbelt <palmerdabbelt@google.com> Signed-off-by: Palmer Dabbelt <palmerdabbelt@google.com>
| * | target/riscv: Remove the hret instructionAlistair Francis2020-02-272-6/+0Star
| | | | | | | | | | | | | | | | | | | | | | | | | | | The hret instruction does not exist in the new spec versions, so remove it from QEMU. Signed-off-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Palmer Dabbelt <palmerdabbelt@google.com> Signed-off-by: Palmer Dabbelt <palmerdabbelt@google.com>
| * | target/riscv: Add hfence instructionsAlistair Francis2020-02-272-9/+54
| | | | | | | | | | | | | | | | | | Signed-off-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Palmer Dabbelt <palmer@sifive.com> Signed-off-by: Palmer Dabbelt <palmerdabbelt@google.com>
| * | target/riscv: Add Hypervisor trap return supportAlistair Francis2020-02-271-10/+52
| | | | | | | | | | | | | | | | | | Signed-off-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Palmer Dabbelt <palmer@sifive.com> Signed-off-by: Palmer Dabbelt <palmerdabbelt@google.com>
| * | target/riscv: Add hypvervisor trap supportAlistair Francis2020-02-271-10/+59
| | | | | | | | | | | | | | | | | | Signed-off-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Palmer Dabbelt <palmerdabbelt@google.com> Signed-off-by: Palmer Dabbelt <palmerdabbelt@google.com>
| * | target/riscv: Generate illegal instruction on WFI when V=1Alistair Francis2020-02-271-2/+3
| | | | | | | | | | | | | | | | | | Signed-off-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Palmer Dabbelt <palmer@sifive.com> Signed-off-by: Palmer Dabbelt <palmerdabbelt@google.com>
| * | target/ricsv: Flush the TLB on virtulisation mode changesAlistair Francis2020-02-271-0/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | To ensure our TLB isn't out-of-date we flush it on all virt mode changes. Unlike priv mode this isn't saved in the mmu_idx as all guests share V=1. The easiest option is just to flush on all changes. Signed-off-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Palmer Dabbelt <palmer@sifive.com> Signed-off-by: Palmer Dabbelt <palmerdabbelt@google.com>
| * | target/riscv: Add support for virtual interrupt settingAlistair Francis2020-02-271-5/+28
| | | | | | | | | | | | | | | | | | Signed-off-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Palmer Dabbelt <palmerdabbelt@google.com> Signed-off-by: Palmer Dabbelt <palmerdabbelt@google.com>
| * | target/riscv: Extend the SIP CSR to support virtulisationAlistair Francis2020-02-271-1/+12
| | | | | | | | | | | | | | | | | | Signed-off-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Palmer Dabbelt <palmerdabbelt@google.com> Signed-off-by: Palmer Dabbelt <palmerdabbelt@google.com>
| * | target/riscv: Extend the MIE CSR to support virtulisationAlistair Francis2020-02-271-4/+20
| | | | | | | | | | | | | | | | | | Signed-off-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Palmer Dabbelt <palmerdabbelt@google.com> Signed-off-by: Palmer Dabbelt <palmerdabbelt@google.com>
| * | target/riscv: Set VS bits in mideleg for Hyp extensionAlistair Francis2020-02-271-0/+3
| | | | | | | | | | | | | | | | | | Signed-off-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Palmer Dabbelt <palmerdabbelt@google.com> Signed-off-by: Palmer Dabbelt <palmerdabbelt@google.com>
| * | target/riscv: Add virtual register swapping functionAlistair Francis2020-02-273-0/+79
| | | | | | | | | | | | | | | | | | Signed-off-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Palmer Dabbelt <palmerdabbelt@google.com> Signed-off-by: Palmer Dabbelt <palmerdabbelt@google.com>
| * | target/riscv: Add Hypervisor machine CSRs accessesAlistair Francis2020-02-271-0/+27
| | | | | | | | | | | | | | | | | | Signed-off-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Palmer Dabbelt <palmerdabbelt@google.com> Signed-off-by: Palmer Dabbelt <palmerdabbelt@google.com>
| * | target/riscv: Add Hypervisor virtual CSRs accessesAlistair Francis2020-02-271-0/+116
| | | | | | | | | | | | | | | | | | Signed-off-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Palmer Dabbelt <palmer@sifive.com> Signed-off-by: Palmer Dabbelt <palmerdabbelt@google.com>
| * | target/riscv: Add Hypervisor CSR access functionsAlistair Francis2020-02-271-2/+134
| | | | | | | | | | | | | | | | | | Signed-off-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Palmer Dabbelt <palmerdabbelt@google.com> Signed-off-by: Palmer Dabbelt <palmerdabbelt@google.com>
| * | target/riscv: Dump Hypervisor registers if enabledAlistair Francis2020-02-271-0/+33
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Dump the Hypervisor registers and the current Hypervisor state. While we are editing this code let's also dump stvec and scause. Signed-off-by: Alistair Francis <alistair.francis@wdc.com> Signed-off-by: Atish Patra <atish.patra@wdc.com> Reviewed-by: Palmer Dabbelt <palmer@sifive.com> Signed-off-by: Palmer Dabbelt <palmerdabbelt@google.com>
| * | target/riscv: Print priv and virt in disas logAlistair Francis2020-02-271-0/+8
| | | | | | | | | | | | | | | | | | Signed-off-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Palmer Dabbelt <palmer@sifive.com> Signed-off-by: Palmer Dabbelt <palmerdabbelt@google.com>
| * | target/riscv: Fix CSR perm checking for HS modeAlistair Francis2020-02-271-4/+14
| | | | | | | | | | | | | | | | | | | | | | | | | | | Update the CSR permission checking to work correctly when we are in HS-mode. Signed-off-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Palmer Dabbelt <palmerdabbelt@google.com> Signed-off-by: Palmer Dabbelt <palmerdabbelt@google.com>
| * | target/riscv: Add the force HS exception modeAlistair Francis2020-02-273-0/+26
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add a FORCE_HS_EXCEP mode to the RISC-V virtulisation status. This bit specifies if an exeption should be taken to HS mode no matter the current delegation status. This is used when an exeption must be taken to HS mode, such as when handling interrupts. Signed-off-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Palmer Dabbelt <palmerdabbelt@google.com> Signed-off-by: Palmer Dabbelt <palmerdabbelt@google.com>
| * | target/riscv: Add the virtulisation modeAlistair Francis2020-02-273-0/+25
| | | | | | | | | | | | | | | | | | Signed-off-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Palmer Dabbelt <palmerdabbelt@google.com> Signed-off-by: Palmer Dabbelt <palmerdabbelt@google.com>
| * | target/riscv: Rename the H irqs to VS irqsAlistair Francis2020-02-272-9/+9
| | | | | | | | | | | | | | | | | | Signed-off-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Palmer Dabbelt <palmerdabbelt@google.com> Signed-off-by: Palmer Dabbelt <palmerdabbelt@google.com>
| * | target/riscv: Add support for the new execption numbersAlistair Francis2020-02-274-20/+37
| | | | | | | | | | | | | | | | | | | | | | | | | | | The v0.5 Hypervisor spec add new execption numbers, let's add support for those. Signed-off-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Palmer Dabbelt <palmerdabbelt@google.com> Signed-off-by: Palmer Dabbelt <palmerdabbelt@google.com>
| * | target/riscv: Add the Hypervisor CSRs to CPUStateAlistair Francis2020-02-273-18/+48
| | | | | | | | | | | | | | | | | | | | | | | | | | | Add the Hypervisor CSRs to CPUState and at the same time (to avoid bisect issues) update the CSR macros for the v0.5 Hyp spec. Signed-off-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Palmer Dabbelt <palmerdabbelt@google.com> Signed-off-by: Palmer Dabbelt <palmerdabbelt@google.com>
| * | target/riscv: Add the Hypervisor extensionAlistair Francis2020-02-271-0/+1
| | | | | | | | | | | | | | | | | | | | | Signed-off-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Chih-Min Chao <chihmin.chao@sifive.com> Reviewed-by: Palmer Dabbelt <palmer@sifive.com> Signed-off-by: Palmer Dabbelt <palmerdabbelt@google.com>
| * | target/riscv: Convert MIP CSR to target_ulongAlistair Francis2020-02-272-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The MIP CSR is a xlen CSR, it was only 32-bits to allow atomic access. Now that we don't use atomics for MIP we can change this back to a xlen CSR. Signed-off-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Palmer Dabbelt <palmerdabbelt@google.com> Signed-off-by: Palmer Dabbelt <palmerdabbelt@google.com>
* | | Merge remote-tracking branch 'remotes/kraxel/tags/vga-20200302-pull-request' ↵Peter Maydell2020-03-022-3/+3
|\ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | into staging vga: bugfixes for qxl and edid generator. # gpg: Signature made Mon 02 Mar 2020 09:16:28 GMT # gpg: using RSA key 4CB6D8EED3E87138 # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>" [full] # gpg: aka "Gerd Hoffmann <gerd@kraxel.org>" [full] # gpg: aka "Gerd Hoffmann (private) <kraxel@gmail.com>" [full] # Primary key fingerprint: A032 8CFF B93A 17A7 9901 FE7D 4CB6 D8EE D3E8 7138 * remotes/kraxel/tags/vga-20200302-pull-request: qxl: map rom r/o Arithmetic error in EDID generation fixed Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * | | qxl: map rom r/oGerd Hoffmann2020-03-021-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Map qxl rom read-only into the guest, so the guest can't tamper with the content. qxl has a shadow copy of the rom to deal with that, but the shadow doesn't cover the mode list. A privilidged user in the guest can manipulate the mode list and that to trick qemu into oob reads, leading to a DoS via segfault if that read access happens to hit unmapped memory. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-id: 20200225055920.17261-2-kraxel@redhat.com
| * | | Arithmetic error in EDID generation fixedAnton V. Boyarshinov2020-03-021-2/+2
| | |/ | |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | To calculate screen size in centimeters we should calculate: pixels/dpi*2.54 but not pixels*dpi/2540 Using wrong formula we actually get 65 DPI and very small fonts. Signed-off-by: Anton V. Boyarshinov <boyarsh@altlinux.org> Message-id: 20200226122054.366b9cda@table.localdomain Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* | | Merge remote-tracking branch 'remotes/rth/tags/pull-tcg-20200228' into stagingPeter Maydell2020-03-024-53/+60
|\ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Fix race in cpu_exec_step_atomic. Work around compile failure with -fno-inine. Expand tcg/arm epilogue inline. Adjustments to the default code gen buffer size. # gpg: Signature made Sat 29 Feb 2020 02:13:43 GMT # gpg: using RSA key 7A481E78868B4DB6A85A05C064DF38E8AF7E215F # gpg: issuer "richard.henderson@linaro.org" # gpg: Good signature from "Richard Henderson <richard.henderson@linaro.org>" [full] # Primary key fingerprint: 7A48 1E78 868B 4DB6 A85A 05C0 64DF 38E8 AF7E 215F * remotes/rth/tags/pull-tcg-20200228: accel/tcg: increase default code gen buffer size for 64 bit accel/tcg: only USE_STATIC_CODE_GEN_BUFFER on 32 bit hosts accel/tcg: remove link between guest ram and TCG cache size accel/tcg: use units.h for defining code gen buffer sizes tcg/arm: Expand epilogue inline tcg/arm: Split out tcg_out_epilogue compiler.h: Don't use compile-time assert when __NO_INLINE__ is defined accel/tcg: fix race in cpu_exec_step_atomic (bug 1863025) Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * | | accel/tcg: increase default code gen buffer size for 64 bitAlex Bennée2020-02-291-9/+26
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | While 32mb is certainly usable a full system boot ends up flushing the codegen buffer nearly 100 times. Increase the default on 64 bit hosts to take advantage of all that spare memory. After this change I can boot my tests system without any TB flushes. As we usually run more CONFIG_USER binaries at a time in typical usage we aren't quite as profligate for user-mode code generation usage. We also bring the static code gen defies to the same place to keep all the reasoning in the comments together. Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Tested-by: Niek Linnenbank <nieklinnenbank@gmail.com> Reviewed-by: Niek Linnenbank <nieklinnenbank@gmail.com> Message-Id: <20200228192415.19867-5-alex.bennee@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
| * | | accel/tcg: only USE_STATIC_CODE_GEN_BUFFER on 32 bit hostsAlex Bennée2020-02-291-5/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | There is no particular reason to use a static codegen buffer on 64 bit hosts as we have address space to burn. Allow the common CONFIG_USER case to use the mmap'ed buffers like SoftMMU. Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Niek Linnenbank <nieklinnenbank@gmail.com> Message-Id: <20200228192415.19867-4-alex.bennee@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
| * | | accel/tcg: remove link between guest ram and TCG cache sizeAlex Bennée2020-02-291-8/+0Star
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Basing the TB cache size on the ram_size was always a little heuristic and was broken by a1b18df9a4 which caused ram_size not to be fully realised at the time we initialise the TCG translation cache. The current DEFAULT_CODE_GEN_BUFFER_SIZE may still be a little small but follow-up patches will address that. Fixes: a1b18df9a4 Cc: Igor Mammedov <imammedo@redhat.com> Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Niek Linnenbank <nieklinnenbank@gmail.com> Message-Id: <20200228192415.19867-3-alex.bennee@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
| * | | accel/tcg: use units.h for defining code gen buffer sizesAlex Bennée2020-02-291-9/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | It's easier to read. Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Niek Linnenbank <nieklinnenbank@gmail.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-Id: <20200228192415.19867-2-alex.bennee@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
| * | | tcg/arm: Expand epilogue inlineRichard Henderson2020-02-281-10/+2Star
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | It is, after all, just two instructions. Profiling on a cortex-a15, using -d nochain to increase the number of exit_tb that are executed, shows a minor improvement of 0.5%. Signed-off-by: Richard Henderson <rth@twiddle.net>
| * | | tcg/arm: Split out tcg_out_epilogueRichard Henderson2020-02-281-8/+11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | We will shortly use this function from tcg_out_op as well. Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Signed-off-by: Richard Henderson <rth@twiddle.net>
| * | | compiler.h: Don't use compile-time assert when __NO_INLINE__ is definedZenghui Yu2020-02-281-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Our robot reported the following compile-time warning while compiling Qemu with -fno-inline cflags: In function 'load_memop', inlined from 'load_helper' at /qemu/accel/tcg/cputlb.c:1578:20, inlined from 'full_ldub_mmu' at /qemu/accel/tcg/cputlb.c:1624:12: /qemu/accel/tcg/cputlb.c:1502:9: error: call to 'qemu_build_not_reached' declared with attribute error: code path is reachable qemu_build_not_reached(); ^~~~~~~~~~~~~~~~~~~~~~~~ [...] It looks like a false-positive because only (MO_UB ^ MO_BSWAP) will hit the default case in load_memop() while need_swap (size > 1) has already ensured that MO_UB is not involved. So the thing is that compilers get confused by the -fno-inline and just can't accurately evaluate memop_size(op) at compile time, and then the qemu_build_not_reached() is wrongly triggered by (MO_UB ^ MO_BSWAP). Let's carefully don't use the compile-time assert when no functions will be inlined into their callers. Reported-by: Euler Robot <euler.robot@huawei.com> Suggested-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Zenghui Yu <yuzenghui@huawei.com> Message-Id: <20200205141545.180-1-yuzenghui@huawei.com> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
| * | | accel/tcg: fix race in cpu_exec_step_atomic (bug 1863025)Alex Bennée2020-02-281-10/+11
| |/ / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The bug describes a race whereby cpu_exec_step_atomic can acquire a TB which is invalidated by a tb_flush before we execute it. This doesn't affect the other cpu_exec modes as a tb_flush by it's nature can only occur on a quiescent system. The race was described as: B2. tcg_cpu_exec => cpu_exec => tb_find => tb_gen_code B3. tcg_tb_alloc obtains a new TB C3. TB obtained with tb_lookup__cpu_state or tb_gen_code (same TB as B2) A3. start_exclusive critical section entered A4. do_tb_flush is called, TB memory freed/re-allocated A5. end_exclusive exits critical section B2. tcg_cpu_exec => cpu_exec => tb_find => tb_gen_code B3. tcg_tb_alloc reallocates TB from B2 C4. start_exclusive critical section entered C5. cpu_tb_exec executes the TB code that was free in A4 The simplest fix is to widen the exclusive period to include the TB lookup. As a result we can drop the complication of checking we are in the exclusive region before we end it. Cc: Yifan <me@yifanlu.com> Buglink: https://bugs.launchpad.net/qemu/+bug/1863025 Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Message-Id: <20200214144952.15502-1-alex.bennee@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
* | | Merge remote-tracking branch ↵Peter Maydell2020-03-0226-32/+31Star
|\ \ \ | |/ / |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | 'remotes/ehabkost/tags/machine-next-pull-request' into staging Machine queue, 2020-02-28 Cleanups: * Fix NMI() macro (Philippe Mathieu-Daudé) * Make MachineClass::is_default boolean, refuse multiple default machines (Philippe Mathieu-Daudé) # gpg: Signature made Fri 28 Feb 2020 21:03:20 GMT # gpg: using RSA key 5A322FD5ABC4D3DBACCFD1AA2807936F984DC5A6 # gpg: issuer "ehabkost@redhat.com" # gpg: Good signature from "Eduardo Habkost <ehabkost@redhat.com>" [full] # Primary key fingerprint: 5A32 2FD5 ABC4 D3DB ACCF D1AA 2807 936F 984D C5A6 * remotes/ehabkost/tags/machine-next-pull-request: vl: Abort if multiple machines are registered as default hw: Make MachineClass::is_default a boolean type hw: Do not initialize MachineClass::is_default to 0 hw/nmi: Fix the NMI() macro, based on INTERFACE_CHECK() Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * | vl: Abort if multiple machines are registered as defaultPhilippe Mathieu-Daudé2020-02-281-2/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | It would be confusing to have multiple default machines. Abort if this ever occurs. Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-Id: <20200207161948.15972-4-philmd@redhat.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com> Reviewed-by: Laurent Vivier <laurent@vivier.eu> Tested-by: Laurent Vivier <laurent@vivier.eu>
| * | hw: Make MachineClass::is_default a boolean typePhilippe Mathieu-Daudé2020-02-2820-24/+26
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | There's no good reason for it to be type int, change it to bool. Suggested-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-Id: <20200207161948.15972-3-philmd@redhat.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Laurent Vivier <laurent@vivier.eu> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
| * | hw: Do not initialize MachineClass::is_default to 0Philippe Mathieu-Daudé2020-02-285-5/+0Star
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The MachineClass is already zeroed on creation. Note: The code setting is_default=0 in hw/i386/pc_piix.c is different (related to compat options). When adding a new versioned machine, we want it to be the new default, so we have to mark the previous one as not default. Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-Id: <20200207161948.15972-2-philmd@redhat.com> Reviewed-by: Laurent Vivier <laurent@vivier.eu> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
| * | hw/nmi: Fix the NMI() macro, based on INTERFACE_CHECK()Philippe Mathieu-Daudé2020-02-281-1/+1
|/ / | | | | | | | | | | | | | | | | | | | | | | There is no declaration of the 'NMI' type. INTERFACE_CHECK() returns an abstract type (see commit aa1b35b975d8). The abstract type corresponding to the TYPE_NMI interface is 'NMIState'. Fixes: 9cb805fd267 Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-Id: <20191207094823.20707-1-philmd@redhat.com> Reviewed-by: Gavin Shan <gshan@redhat.com> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
generated by cgit v1.2.3-55-g7522 (git 2.39.0) at 2025-02-04 13:53:48 +0100