motorhead/qemu
1
0
Fork 0
mirror of https://github.com/Motorhead1991/qemu.git synced 2025-09-03 07:21:55 -06:00
Code Issues Projects Releases Packages Wiki Activity Actions

accel/tcg: Take mmap_lock in load_atomic*_or_exit

Browse source 
For user-only, the probe for page writability may race with another
thread's mprotect.  Take the mmap_lock around the operation.  This
is still faster than the start/end_exclusive fallback.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
This commit is contained in:
Richard Henderson 2023-07-16 16:54:16 +00:00
parent f1ce0b8028
commit 2c8412d469
1 changed files with 18 additions and 14 deletions
Download patch file Download diff file Expand all files Collapse all files

16
accel/tcg/ldst_atomicity.c.inc
View file

@ -159,10 +159,12 @@ static uint64_t load_atomic8_or_exit(CPUArchState *env, uintptr_t ra, void *pv)
* another process, because the fallback start_exclusive solution * another process, because the fallback start_exclusive solution
* provides no protection across processes. * provides no protection across processes.
*/ */
WITH_MMAP_LOCK_GUARD() {
if (!page_check_range(h2g(pv), 8, PAGE_WRITE_ORG)) { if (!page_check_range(h2g(pv), 8, PAGE_WRITE_ORG)) {
uint64_t *p = __builtin_assume_aligned(pv, 8); uint64_t *p = __builtin_assume_aligned(pv, 8);
return *p; return *p;
} }
}
#endif #endif
/* Ultimate fallback: re-execute in serial context. */ /* Ultimate fallback: re-execute in serial context. */
@ -186,26 +188,28 @@ static Int128 load_atomic16_or_exit(CPUArchState *env, uintptr_t ra, void *pv)
return atomic16_read_ro(p); return atomic16_read_ro(p);
} }
#ifdef CONFIG_USER_ONLY
/* /*
* We can only use cmpxchg to emulate a load if the page is writable. * We can only use cmpxchg to emulate a load if the page is writable.
* If the page is not writable, then assume the value is immutable * If the page is not writable, then assume the value is immutable
* and requires no locking. This ignores the case of MAP_SHARED with * and requires no locking. This ignores the case of MAP_SHARED with
* another process, because the fallback start_exclusive solution * another process, because the fallback start_exclusive solution
* provides no protection across processes. * provides no protection across processes.
*
* In system mode all guest pages are writable. For user mode,
* we must take mmap_lock so that the query remains valid until
* the write is complete -- tests/tcg/multiarch/munmap-pthread.c
* is an example that can race.
*/ */
WITH_MMAP_LOCK_GUARD() {
#ifdef CONFIG_USER_ONLY
if (!page_check_range(h2g(p), 16, PAGE_WRITE_ORG)) { if (!page_check_range(h2g(p), 16, PAGE_WRITE_ORG)) {
return *p; return *p;
} }
#endif #endif
/*
* In system mode all guest pages are writable, and for user-only
* we have just checked writability. Try cmpxchg.
*/
if (HAVE_ATOMIC128_RW) { if (HAVE_ATOMIC128_RW) {
return atomic16_read_rw(p); return atomic16_read_rw(p);
} }
}
/* Ultimate fallback: re-execute in serial context. */ /* Ultimate fallback: re-execute in serial context. */
cpu_loop_exit_atomic(env_cpu(env), ra); cpu_loop_exit_atomic(env_cpu(env), ra);