From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mailman by lists.gnu.org with tmda-scanned (Exim 4.43) id 1HOMXr-0002qE-FO for qemu-devel@nongnu.org; Mon, 05 Mar 2007 18:24:43 -0500 Received: from exim by lists.gnu.org with spam-scanned (Exim 4.43) id 1HOMXq-0002q0-71 for qemu-devel@nongnu.org; Mon, 05 Mar 2007 18:24:42 -0500 Received: from [199.232.76.173] (helo=monty-python.gnu.org) by lists.gnu.org with esmtp (Exim 4.43) id 1HOMXq-0002px-3H for qemu-devel@nongnu.org; Mon, 05 Mar 2007 18:24:42 -0500 Received: from sp604001mt.neufgp.fr ([84.96.92.60] helo=Smtp.neuf.fr) by monty-python.gnu.org with esmtp (Exim 4.52) id 1HOMXo-0002EJ-Rc for qemu-devel@nongnu.org; Mon, 05 Mar 2007 18:24:41 -0500 Received: from [84.99.204.121] by sp604001mt.gpm.neuf.ld (Sun Java System Messaging Server 6.2-5.05 (built Feb 16 2006)) with ESMTP id <0JEG008FJECIUOS0@sp604001mt.gpm.neuf.ld> for qemu-devel@nongnu.org; Tue, 06 Mar 2007 00:24:18 +0100 (CET) Date: Tue, 06 Mar 2007 00:24:39 +0100 From: Fabrice Bellard Subject: Re: [Qemu-devel] [PATCH] workaround qemu guest SIGSEGVs with cmpxchg8b insn In-reply-to: <200703051027.l25ARYfE008182@imap.tools.intra> Message-id: <45ECA6B7.7050400@bellard.org> MIME-version: 1.0 Content-type: text/plain; charset=ISO-8859-1; format=flowed Content-transfer-encoding: 7BIT References: <200703051027.l25ARYfE008182@imap.tools.intra> Reply-To: qemu-devel@nongnu.org List-Id: qemu-devel.nongnu.org List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Juergen Keil , qemu-devel@nongnu.org OK for the bug. The proper patch is to set the EIP before executing the instruction, as it is done for the other helpers which can generate exceptions. I'll try to make a fix ASAP. Regards, Fabrice. Juergen Keil wrote: > Current "Solaris x86 Developer Express" doesn't install any more as qemu > guest > > - qemu 0.9.0 + cvs (32bit), 768 mbyte memory (or more) allocated for guest > - kqemu *not* used > > > I doesn't install because the java virtual machine (used for the installer) > crashes with a SIGSEGV. > > > > ======================================================================== > > The following test program reproduces the problem. The second cmpxchg8b > instruction after the fork results in a copy-on-write page fault and > the process terminates with a core dump. > > > Same program runs on bare metal just fine. > > > The problem can be reproduced both with an opensolaris b55 guest or a > linux ubuntu guest, running inside an i386-softmmu qemu, and running it > with -no-kqemu. > > ======================================================================== > > /* > * cc -o cmpxchg cmpxchg.c > */ > > #include > #include > #include > #include > > > #if 0 > static int > cmpxchg64(int64_t *mem, int64_t *expected_old, int64_t new) > { > if (*mem == *expected_old) { > *mem = new; > return 1; > } else { > *expected_old = *mem; > return 0; > } > } > #else > static int > cmpxchg64(int64_t *mem, int64_t *expected_old, int64_t new) > { > asm("pushl %ebx"); > asm("pushl %esi"); > asm("pushl %edi"); > > asm("movl 12(%ebp), %esi"); > asm("movl (%esi), %eax"); > asm("movl 4(%esi), %edx"); > asm("movl 16(%ebp), %ebx"); > asm("movl 20(%ebp), %ecx"); > asm("movl 8(%ebp), %edi"); > asm("cmpxchg8b (%edi)"); > asm("movl %eax, (%esi)"); > asm("movl %edx, 4(%esi)"); > > asm("sete %al"); > asm("movsbl %al, %eax"); > > asm("popl %edi"); > asm("popl %esi"); > asm("popl %ebx"); > } > #endif > > int64_t *val; > > int > main(int argc, char **argv) > { > int64_t old, update; > > val = calloc(2*4096, 1); > val = (void*)(((long)val + 0xfff) & ~0xfff); > printf("%lld\n", *val); > > old = 0; > update = 1; > cmpxchg64(val, &old, update); > > printf("%lld\n", *val); > > switch (fork()) { > case -1: > perror("fork"); > exit(1); > case 0: > sleep(1); > _exit(0); > break; > default: > break; > } > > old = update; > update++; > cmpxchg64(val, &old, update); > > printf("%lld\n", *val); > } > ======================================================================== > > Workaround: move the code from inside the helper_cmpxchg8b() function > into the op_cmpxchg8b() insn template[*]. > > A patch for this workaround is attached. With this workaround applied, > the above test program doesn't SIGSEGV any more, and the java installer > from "Solaris x86 Developer Express" doesn't crash with SIGSEGV any more > either. > > > > [*] so that softmmu_template.h function __stq_mmu() ... > > ``void REGPARM(2) glue(glue(__st, SUFFIX), MMUSUFFIX)(target_ulong addr, > DATA_TYPE val, > int is_user)'' > > ... passes a PC that is is inside translated code to tlb_fill(). > > Without the workaround, the return address passed into tlb_fill() > is inside helper_cmpxchg8b() and tlb_fill() is unable to pass > the correct virtual PC for the page fault to the kernel exception - > the PC that gets passed is the PC that was last saved to the "env" > register file, and this could point to a location that was executed > a few translations blocks before we reached the cmpxchg8b instruction. > > > > > > ------------------------------------------------------------------------ > > diff -ru qemu-cvs-orig/target-i386/helper.c qemu-cvs/target-i386/helper.c > --- qemu-cvs-orig/target-i386/helper.c 2007-02-09 22:10:08.000000000 +0100 > +++ qemu-cvs/target-i386/helper.c 2007-03-04 21:46:41.971808493 +0100 > @@ -1573,24 +1573,6 @@ > EDX = (uint32_t)r; > } > > -void helper_cmpxchg8b(void) > -{ > - uint64_t d; > - int eflags; > - > - eflags = cc_table[CC_OP].compute_all(); > - d = ldq(A0); > - if (d == (((uint64_t)EDX << 32) | EAX)) { > - stq(A0, ((uint64_t)ECX << 32) | EBX); > - eflags |= CC_Z; > - } else { > - EDX = d >> 32; > - EAX = d; > - eflags &= ~CC_Z; > - } > - CC_SRC = eflags; > -} > - > void helper_cpuid(void) > { > uint32_t index; > diff -ru qemu-cvs-orig/target-i386/op.c qemu-cvs/target-i386/op.c > --- qemu-cvs-orig/target-i386/op.c 2007-02-09 22:10:08.000000000 +0100 > +++ qemu-cvs/target-i386/op.c 2007-03-04 21:46:46.396171993 +0100 > @@ -727,7 +727,21 @@ > > void OPPROTO op_cmpxchg8b(void) > { > - helper_cmpxchg8b(); > + uint64_t d; > + int eflags; > + > + eflags = cc_table[CC_OP].compute_all(); > + d = ldq(A0); > + if (d == (((uint64_t)EDX << 32) | EAX)) { > + stq(A0, ((uint64_t)ECX << 32) | EBX); > + eflags |= CC_Z; > + } else { > + EDX = d >> 32; > + EAX = d; > + eflags &= ~CC_Z; > + } > + CC_SRC = eflags; > + FORCE_RET(); > } > > void OPPROTO op_movl_T0_0(void) > > > ------------------------------------------------------------------------ > > _______________________________________________ > Qemu-devel mailing list > Qemu-devel@nongnu.org > http://lists.nongnu.org/mailman/listinfo/qemu-devel