exec.c: Fix breakpoint invalidation race

A bug (1647683) was reported showing a crash when removing
breakpoints. The reproducer was bisected to 3359baad when tb_flush
was finally made thread safe. While in MTTCG the locking in
breakpoint_invalidate would have prevented any problems, but
currently tb_lock() is a NOP for system emulation.

The race is between a tb_flush from the gdbstub and the
tb_invalidate_phys_addr() in breakpoint_invalidate().

Ideally we'd have actual locking here; for the moment the
simple fix is to do a full tb_flush() for a bp invalidate,
since that is thread-safe even if no lock is taken.

Backports commit a9353fe897ca2687e5b3385ed39e3db3927a90e0 from qemu
This commit is contained in:
Peter Maydell 2018-03-01 09:10:52 -05:00 committed by Lioncash
parent f4c65739f3
commit 488b6cc82b
No known key found for this signature in database
GPG key ID: 4E3C3CC1031BA9C7

View file

@ -522,29 +522,15 @@ void cpu_exec_init(CPUState *cpu, void *opaque)
#endif #endif
} }
#if defined(CONFIG_USER_ONLY)
static void breakpoint_invalidate(CPUState *cpu, target_ulong pc) static void breakpoint_invalidate(CPUState *cpu, target_ulong pc)
{ {
// Unicorn: commented out /* Flush the whole TB as this will not have race conditions
mmap_lock(); * even if we don't have proper locking yet.
//tb_lock(); * Ideally we would just invalidate the TBs for the
tb_invalidate_phys_page_range(pc, pc + 1, 0); * specified PC.
//tb_unlock(); */
mmap_unlock(); tb_flush(cpu);
} }
#else
static void breakpoint_invalidate(CPUState *cpu, target_ulong pc)
{
MemTxAttrs attrs;
hwaddr phys = cpu_get_phys_page_attrs_debug(cpu, pc, &attrs);
int asidx = cpu_asidx_from_attrs(cpu, attrs);
if (phys != -1) {
/* Locks grabbed by tb_invalidate_phys_addr */
tb_invalidate_phys_addr(cpu->cpu_ases[asidx].as,
phys | (pc & ~TARGET_PAGE_MASK));
}
}
#endif
#if defined(CONFIG_USER_ONLY) #if defined(CONFIG_USER_ONLY)
void cpu_watchpoint_remove_all(CPUState *cpu, int mask) void cpu_watchpoint_remove_all(CPUState *cpu, int mask)