mirror of
https://github.com/yuzu-emu/unicorn.git
synced 2024-12-23 15:35:29 +00:00
translate-all: exit from tb_phys_invalidate if qht_remove fails
Two or more threads might race while invalidating the same TB. We currently do not check for this at all despite taking tb_lock, which means we would wrongly invalidate the same TB more than once. This bug has actually been hit by users: I recently saw a report on IRC, although I have yet to see the corresponding test case. Fix this by using qht_remove as the synchronization point; if it fails, that means the TB has already been invalidated, and therefore there is nothing left to do in tb_phys_invalidate. Note that this solution works now that we still have tb_lock, and will continue working once we remove tb_lock. Backports commit cc689485ee3e9dca05765326ee8fd619a6ec48f0 from qemu
This commit is contained in:
parent
cd538f0b7e
commit
fc30b3d5cf
|
@ -1114,7 +1114,9 @@ void tb_phys_invalidate(struct uc_struct *uc,
|
|||
phys_pc = tb->page_addr[0] + (tb->pc & ~TARGET_PAGE_MASK);
|
||||
h = tb_hash_func(phys_pc, tb->pc, tb->flags, tb->cflags & CF_HASH_MASK,
|
||||
tb->trace_vcpu_dstate);
|
||||
qht_remove(&uc->tb_ctx.htable, tb, h);
|
||||
if (!qht_remove(&uc->tb_ctx.htable, tb, h)) {
|
||||
return;
|
||||
}
|
||||
|
||||
/* remove the TB from the page list */
|
||||
if (tb->page_addr[0] != page_addr) {
|
||||
|
|
Loading…
Reference in a new issue