From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:38334) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1b10kQ-0008NQ-Kj for qemu-devel@nongnu.org; Thu, 12 May 2016 20:14:35 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1b10kO-0002fJ-9Y for qemu-devel@nongnu.org; Thu, 12 May 2016 20:14:29 -0400 Received: from mail-qg0-x243.google.com ([2607:f8b0:400d:c04::243]:33277) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1b10kO-0002fD-5a for qemu-devel@nongnu.org; Thu, 12 May 2016 20:14:28 -0400 Received: by mail-qg0-x243.google.com with SMTP id 90so6865319qgz.0 for ; Thu, 12 May 2016 17:14:28 -0700 (PDT) Sender: Richard Henderson From: Richard Henderson Date: Thu, 12 May 2016 14:13:05 -1000 Message-Id: <1463098420-29113-5-git-send-email-rth@twiddle.net> In-Reply-To: <1463098420-29113-1-git-send-email-rth@twiddle.net> References: <1463098420-29113-1-git-send-email-rth@twiddle.net> Subject: [Qemu-devel] [PULL 04/39] tci: Make direct jump patching thread-safe List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: peter.maydell@linaro.org, Sergey Fedorov , Sergey Fedorov From: Sergey Fedorov Ensure direct jump patching in TCI is atomic by: * naturally aligning a location of direct jump address; * using atomic_read()/atomic_set() to load/store the address. Signed-off-by: Sergey Fedorov Signed-off-by: Sergey Fedorov Message-Id: <1461341333-19646-4-git-send-email-sergey.fedorov@linaro.org> Signed-off-by: Richard Henderson --- include/exec/exec-all.h | 2 +- tcg/tci/tcg-target.inc.c | 2 ++ tci.c | 5 ++++- 3 files changed, 7 insertions(+), 2 deletions(-) diff --git a/include/exec/exec-all.h b/include/exec/exec-all.h index c75fb3a..d49befd 100644 --- a/include/exec/exec-all.h +++ b/include/exec/exec-all.h @@ -303,7 +303,7 @@ void tb_phys_invalidate(TranslationBlock *tb, tb_page_addr_t page_addr); static inline void tb_set_jmp_target1(uintptr_t jmp_addr, uintptr_t addr) { /* patch the branch destination */ - *(uint32_t *)jmp_addr = addr - (jmp_addr + 4); + atomic_set((int32_t *)jmp_addr, addr - (jmp_addr + 4)); /* no need to flush icache explicitly */ } #elif defined(_ARCH_PPC) diff --git a/tcg/tci/tcg-target.inc.c b/tcg/tci/tcg-target.inc.c index e2fc52a..85eeb5d 100644 --- a/tcg/tci/tcg-target.inc.c +++ b/tcg/tci/tcg-target.inc.c @@ -556,6 +556,8 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, const TCGArg *args, if (s->tb_jmp_offset) { /* Direct jump method. */ tcg_debug_assert(args[0] < ARRAY_SIZE(s->tb_jmp_offset)); + /* Align for atomic patching and thread safety */ + s->code_ptr = QEMU_ALIGN_PTR_UP(s->code_ptr, 4); s->tb_jmp_offset[args[0]] = tcg_current_code_size(s); tcg_out32(s, 0); } else { diff --git a/tci.c b/tci.c index 82705fe..a8939e6 100644 --- a/tci.c +++ b/tci.c @@ -1089,7 +1089,10 @@ uintptr_t tcg_qemu_tb_exec(CPUArchState *env, uint8_t *tb_ptr) goto exit; break; case INDEX_op_goto_tb: - t0 = tci_read_i32(&tb_ptr); + /* Jump address is aligned */ + tb_ptr = QEMU_ALIGN_PTR_UP(tb_ptr, 4); + t0 = atomic_read((int32_t *)tb_ptr); + tb_ptr += sizeof(int32_t); tci_assert(tb_ptr == old_code_ptr + op_size); tb_ptr += (int32_t)t0; continue; -- 2.5.5