qemu-devel.nongnu.org archive mirror
 help / color / mirror / Atom feed
From: "Philippe Mathieu-Daudé" <philmd@linaro.org>
To: qemu-devel@nongnu.org
Cc: "Peter Maydell" <peter.maydell@linaro.org>,
	"Yanan Wang" <wangyanan55@huawei.com>,
	"Eduardo Habkost" <eduardo@habkost.net>,
	"Harsh Prateek Bora" <harshpb@linux.ibm.com>,
	kvm@vger.kernel.org, "Zhao Liu" <zhao1.liu@intel.com>,
	"Daniel P. Berrangé" <berrange@redhat.com>,
	"Markus Armbruster" <armbru@redhat.com>,
	"Igor Mammedov" <imammedo@redhat.com>,
	"Marcel Apfelbaum" <marcel.apfelbaum@gmail.com>,
	"Peter Xu" <peterx@redhat.com>,
	"Philippe Mathieu-Daudé" <philmd@linaro.org>,
	"Paolo Bonzini" <pbonzini@redhat.com>,
	"Richard Henderson" <richard.henderson@linaro.org>
Subject: [RFC PATCH 2/9] accel/tcg: Invalidate TB jump cache with global vCPU queue locked
Date: Tue, 28 Jan 2025 15:21:45 +0100	[thread overview]
Message-ID: <20250128142152.9889-3-philmd@linaro.org> (raw)
In-Reply-To: <20250128142152.9889-1-philmd@linaro.org>

Invalidate TB with global vCPU queue locked.

See commit 4731f89b3b9 ("cpu: free cpu->tb_jmp_cache with RCU"):

    Fixes the appended use-after-free. The root cause is that
    during tb invalidation we use CPU_FOREACH, and therefore
    to safely free a vCPU we must wait for an RCU grace period
    to elapse.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 accel/tcg/tb-maint.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/accel/tcg/tb-maint.c b/accel/tcg/tb-maint.c
index 3f1bebf6ab5..64471af439d 100644
--- a/accel/tcg/tb-maint.c
+++ b/accel/tcg/tb-maint.c
@@ -891,6 +891,8 @@ static void tb_jmp_cache_inval_tb(TranslationBlock *tb)
     } else {
         uint32_t h = tb_jmp_cache_hash_func(tb->pc);
 
+        QEMU_LOCK_GUARD(&qemu_cpu_list_lock);
+
         CPU_FOREACH(cpu) {
             CPUJumpCache *jc = cpu->tb_jmp_cache;
 
-- 
2.47.1



  parent reply	other threads:[~2025-01-28 14:22 UTC|newest]

Thread overview: 23+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2025-01-28 14:21 [RFC PATCH 0/9] accel: Only include qdev-realized vCPUs in global &cpus_queue Philippe Mathieu-Daudé
2025-01-28 14:21 ` [RFC PATCH 1/9] accel/tcg: Simplify use of &first_cpu in rr_cpu_thread_fn() Philippe Mathieu-Daudé
2025-01-28 19:44   ` Richard Henderson
2025-01-28 14:21 ` Philippe Mathieu-Daudé [this message]
2025-01-28 20:05   ` [RFC PATCH 2/9] accel/tcg: Invalidate TB jump cache with global vCPU queue locked Richard Henderson
2025-01-28 14:21 ` [RFC PATCH 3/9] cpus: Remove cpu from global queue after UNREALIZE completed Philippe Mathieu-Daudé
2025-01-28 20:08   ` Richard Henderson
2025-01-28 14:21 ` [RFC PATCH 4/9] hw/qdev: Introduce DeviceClass::[un]wire() handlers Philippe Mathieu-Daudé
2025-01-28 20:52   ` Richard Henderson
2025-02-04 13:39     ` Igor Mammedov
2025-01-28 14:21 ` [PATCH 5/9] cpus: Add DeviceClass::[un]wire() stubs Philippe Mathieu-Daudé
2025-01-28 20:53   ` Richard Henderson
2025-01-28 14:21 ` [PATCH 6/9] cpus: Call hotplug handlers in DeviceWire() Philippe Mathieu-Daudé
2025-01-28 20:53   ` Richard Henderson
2025-01-28 14:21 ` [RFC PATCH 7/9] cpus: Only expose REALIZED vCPUs to global &cpus_queue Philippe Mathieu-Daudé
2025-01-28 20:53   ` Richard Henderson
2025-01-28 20:55   ` Richard Henderson
2025-01-28 14:21 ` [PATCH 8/9] accel/kvm: Assert vCPU is created when calling kvm_dirty_ring_reap*() Philippe Mathieu-Daudé
2025-01-28 20:57   ` Richard Henderson
2025-01-28 14:21 ` [PATCH 9/9] accel/kvm: Remove unreachable assertion in kvm_dirty_ring_reap*() Philippe Mathieu-Daudé
2025-01-28 20:58   ` Richard Henderson
2025-02-07 15:45 ` [RFC PATCH 0/9] accel: Only include qdev-realized vCPUs in global &cpus_queue Igor Mammedov
2025-02-09 18:02   ` Philippe Mathieu-Daudé

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20250128142152.9889-3-philmd@linaro.org \
    --to=philmd@linaro.org \
    --cc=armbru@redhat.com \
    --cc=berrange@redhat.com \
    --cc=eduardo@habkost.net \
    --cc=harshpb@linux.ibm.com \
    --cc=imammedo@redhat.com \
    --cc=kvm@vger.kernel.org \
    --cc=marcel.apfelbaum@gmail.com \
    --cc=pbonzini@redhat.com \
    --cc=peter.maydell@linaro.org \
    --cc=peterx@redhat.com \
    --cc=qemu-devel@nongnu.org \
    --cc=richard.henderson@linaro.org \
    --cc=wangyanan55@huawei.com \
    --cc=zhao1.liu@intel.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).