From patchwork Mon Mar 1 22:33:23 2010 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Paolo Bonzini X-Patchwork-Id: 46615 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from lists.gnu.org (lists.gnu.org [199.232.76.165]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client did not present a certificate) by ozlabs.org (Postfix) with ESMTPS id AA35FB7D24 for ; Tue, 2 Mar 2010 09:38:59 +1100 (EST) Received: from localhost ([127.0.0.1]:56533 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.43) id 1NmECM-0001rD-MF for incoming@patchwork.ozlabs.org; Mon, 01 Mar 2010 17:34:46 -0500 Received: from mailman by lists.gnu.org with tmda-scanned (Exim 4.43) id 1NmEBA-0001r1-KX for qemu-devel@nongnu.org; Mon, 01 Mar 2010 17:33:32 -0500 Received: from [199.232.76.173] (port=38331 helo=monty-python.gnu.org) by lists.gnu.org with esmtp (Exim 4.43) id 1NmEB9-0001qh-Ff for qemu-devel@nongnu.org; Mon, 01 Mar 2010 17:33:31 -0500 Received: from Debian-exim by monty-python.gnu.org with spam-scanned (Exim 4.60) (envelope-from ) id 1NmEB8-0002sz-Ig for qemu-devel@nongnu.org; Mon, 01 Mar 2010 17:33:31 -0500 Received: from mail-fx0-f214.google.com ([209.85.220.214]:47100) by monty-python.gnu.org with esmtp (Exim 4.60) (envelope-from ) id 1NmEB8-0002sv-5o for qemu-devel@nongnu.org; Mon, 01 Mar 2010 17:33:30 -0500 Received: by fxm6 with SMTP id 6so3111557fxm.2 for ; Mon, 01 Mar 2010 14:33:29 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:sender:message-id:date:from :user-agent:mime-version:to:cc:subject:references:in-reply-to :content-type; bh=K0pQuckDmgOtKasPljEjy2Um5V0X2yUqKXCNX4UvO+M=; b=YMVDfktSMeTlISURso6g4MvyogxSLGJE89Xzz02+osQ7wGh7AZQew1vDuiuN0yiOcq rht194MyqHx+Kp6yN8wEcRtKX7eayQ14hZvQi1ulg2/pogngJ+qw8jXKhLWRl5We3UpP /fWKgLyphI5x49OmWmcnig+TzuQscMx0dDUSc= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=sender:message-id:date:from:user-agent:mime-version:to:cc:subject :references:in-reply-to:content-type; b=XXJrgdHuMXJK0NMiUpoYw0r3iQHjWDSya9DvnNN2ok+JaVXJSPfzkdAyuB/5fmfYYl RDRcFBQhlBrQQg+mIjhW7atU3Z4BcZOj9UjJxbuiAEKUvFA5UlwpUiBLdy/9DVbVrA8r w2udvov5hiD59Ksp5z9ZsRtlN5fPXx7bQgKLo= Received: by 10.223.65.12 with SMTP id g12mr5645979fai.69.1267482808854; Mon, 01 Mar 2010 14:33:28 -0800 (PST) Received: from yakj.usersys.redhat.com ([85.93.118.17]) by mx.google.com with ESMTPS id 13sm6194821fks.0.2010.03.01.14.33.27 (version=TLSv1/SSLv3 cipher=RC4-MD5); Mon, 01 Mar 2010 14:33:27 -0800 (PST) Message-ID: <4B8C40B3.6030008@redhat.com> Date: Mon, 01 Mar 2010 23:33:23 +0100 From: Paolo Bonzini User-Agent: Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.1.7) Gecko/20100120 Fedora/3.0.1-1.fc12 Lightning/1.0b2pre Thunderbird/3.0.1 MIME-Version: 1.0 To: Aurelien Jarno References: <20100301213351.GN8952@hall.aurel32.net> In-Reply-To: <20100301213351.GN8952@hall.aurel32.net> X-detected-operating-system: by monty-python.gnu.org: GNU/Linux 2.6 (newer, 2) Cc: qemu-devel Subject: [Qemu-devel] Re: Regression: segfault on ARM host X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: qemu-devel.nongnu.org List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org Errors-To: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org On 03/01/2010 10:33 PM, Aurelien Jarno wrote: > While trying to implement setcond on TCG ARM, I have discovered it does > not work anymore. I have bisected this regression to: > > commit 6113d6d3169393c323ac4c82d756a850145a5e7a > Author: Paolo Bonzini > Date: Fri Jan 15 09:42:09 2010 +0100 > > change while to if > > The while loop will be executed exactly 0 or 1 times, depending on > env->exit_request. > > Signed-off-by: Paolo Bonzini > Signed-off-by: Anthony Liguori > > The assertion is actually triggered. When the next patch removing the > assertion is also applied it segfaults instead. Looks like a race. The only piece of logic that is changed by that commit is reverted in the attached patch, can you try it? If it passes, I can resubmit with S-o-b. If it doesn't pass, I wonder whether the while loop was there to trick the compiler into not optimizing something. Seems a bit too clever though. Paolo diff --git a/cpu-exec.c b/cpu-exec.c index 5d6dd51..61b1c59 100644 --- a/cpu-exec.c +++ b/cpu-exec.c @@ -602,9 +602,15 @@ int cpu_exec(CPUState *env1) /* cpu_interrupt might be called while translating the TB, but before it is linked into a potentially infinite loop and becomes env->current_tb. Avoid - starting execution if there is a pending interrupt. */ - if (!unlikely (env->exit_request)) { - env->current_tb = tb; + starting execution if there is a pending interrupt. + Doing it this way is necessary to avoid races with + cpu_unlink_tb (called by cpu_exit). */ + env->current_tb = tb; + if (unlikely (env->exit_request)) { + env->current_tb = NULL; + } + + if (likely (env->current_tb)) { tc_ptr = tb->tc_ptr; /* execute the generated code */ #if defined(__sparc__) && !defined(CONFIG_SOLARIS)