yuzu/unicorn
1
0
Fork 0
mirror of https://github.com/yuzu-emu/unicorn.git synced 2025-04-01 23:07:03 +00:00
Code Issues Packages Projects Releases Wiki Activity

accel/tcg/translate-all: expand cpu_restore_state addr check

Browse source 
We are still seeing signals during translation time when we walk over
a page protection boundary. This expands the check to ensure the host
PC is inside the code generation buffer. The original suggestion was
to check versus tcg_ctx.code_gen_ptr but as we now segment the
translation buffer we have to settle for just a general check for
being inside.

I've also fixed up the declaration to make it clear it can deal with
invalid addresses. A later patch will fix up the call sites.

Backports commit d25f2a72272b9ffe0d06710d6217d1169bc2cc7d from qemu
This commit is contained in:
Alex Bennée 2018-04-11 19:48:47 -04:00 committed by Lioncash
parent bc8e85a1c5
commit 4074587775
No known key found for this signature in database
GPG key ID: 4E3C3CC1031BA9C7
2 changed files with 40 additions and 21 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

50
qemu/accel/tcg/translate-all.c
View file

@ -332,35 +332,43 @@ found:
return 0;
}
bool cpu_restore_state(CPUState *cpu, uintptr_t retaddr)
bool cpu_restore_state(CPUState *cpu, uintptr_t host_pc)
{
TranslationBlock *tb;
CPUArchState *env = cpu->env_ptr;
TCGContext* tcg_ctx = env->uc->tcg_ctx;
bool r = false;
uintptr_t check_offset;
/* A retaddr of zero is invalid so we really shouldn't have ended
* up here. The target code has likely forgotten to check retaddr
* != 0 before attempting to restore state. We return early to
* avoid blowing up on a recursive tb_lock(). The target must have
* previously survived a failed cpu_restore_state because
* tb_find_pc(0) would have failed anyway. It still should be
* fixed though.
/* The host_pc has to be in the region of current code buffer. If
* it is not we will not be able to resolve it here. The two cases
* where host_pc will not be correct are:
*
* - fault during translation (instruction fetch)
* - fault from helper (not using GETPC() macro)
*
* Either way we need return early to avoid blowing up on a
* recursive tb_lock() as we can't resolve it here.
*
* We are using unsigned arithmetic so if host_pc <
* tcg_init_ctx.code_gen_buffer check_offset will wrap to way
* above the code_gen_buffer_size
*/
check_offset = host_pc - (uintptr_t) tcg_ctx->code_gen_buffer;
if (!retaddr) {
return false;
}
tb = tb_find_pc(env->uc, retaddr);
if (tb) {
cpu_restore_state_from_tb(cpu, tb, retaddr);
if (tb->cflags & CF_NOCACHE) {
/* one-shot translation, invalidate it immediately */
tb_phys_invalidate(cpu->uc, tb, -1);
tb_free(cpu->uc, tb);
if (check_offset < tcg_ctx->code_gen_buffer_size) {
tb = tb_find_pc(env->uc, host_pc);
if (tb) {
cpu_restore_state_from_tb(cpu, tb, host_pc);
if (tb->cflags & CF_NOCACHE) {
/* one-shot translation, invalidate it immediately */
tb_phys_invalidate(cpu->uc, tb, -1);
tb_free(cpu->uc, tb);
}
r = true;
}
return true;
}
return false;
return r;
}
static void page_init(struct uc_struct *uc)

11
qemu/include/exec/exec-all.h
View file

@ -42,6 +42,17 @@ typedef ram_addr_t tb_page_addr_t;
void gen_intermediate_code(CPUState *cpu, struct TranslationBlock *tb);
void restore_state_to_opc(CPUArchState *env, struct TranslationBlock *tb,
target_ulong *data);
/**
* cpu_restore_state:
* @cpu: the vCPU state is to be restore to
* @searched_pc: the host PC the fault occurred at
* @return: true if state was restored, false otherwise
*
* Attempt to restore the state for a fault occurring in translated
* code. If the searched_pc is not in translated code no state is
* restored and the function returns false.
*/
bool cpu_restore_state(CPUState *cpu, uintptr_t searched_pc);
void QEMU_NORETURN cpu_loop_exit_noexc(CPUState *cpu);