diff options
| author | Paolo Bonzini <pbonzini@redhat.com> | 2015-08-11 11:33:24 +0200 |
|---|---|---|
| committer | Paolo Bonzini <pbonzini@redhat.com> | 2015-09-09 15:34:56 +0200 |
| commit | 9fd1a94888cd6a559f95c3596ec1ac28b74838c1 (patch) | |
| tree | cecbe1ad9b5c5593e85b6ced7498f5d88f5078ad /translate-all.c | |
| parent | 8fd19e6cfd5b6cdf028c6ac2ff4157ed831ea3a6 (diff) | |
| download | hqemu-9fd1a94888cd6a559f95c3596ec1ac28b74838c1.zip hqemu-9fd1a94888cd6a559f95c3596ec1ac28b74838c1.tar.gz | |
cpu-exec: fix lock hierarchy for user-mode emulation
tb_lock has to be taken inside the mmap_lock (example:
tb_invalidate_phys_range is called by target_mmap), but
tb_link_page is taking the mmap_lock and it is called
with the tb_lock held.
To fix this, take the mmap_lock in tb_find_slow, not
in tb_link_page.
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Diffstat (limited to 'translate-all.c')
| -rw-r--r-- | translate-all.c | 6 |
1 files changed, 2 insertions, 4 deletions
diff --git a/translate-all.c b/translate-all.c index e3c5c5e..d9c7aac 100644 --- a/translate-all.c +++ b/translate-all.c @@ -1375,6 +1375,8 @@ static inline void tb_alloc_page(TranslationBlock *tb, /* add a new TB and link it to the physical page tables. phys_page2 is * (-1) to indicate that only one page contains the TB. + * + * Called with mmap_lock held for user-mode emulation. */ static void tb_link_page(TranslationBlock *tb, tb_page_addr_t phys_pc, tb_page_addr_t phys_page2) @@ -1382,9 +1384,6 @@ static void tb_link_page(TranslationBlock *tb, tb_page_addr_t phys_pc, unsigned int h; TranslationBlock **ptb; - /* Grab the mmap lock to stop another thread invalidating this TB - before we are done. */ - mmap_lock(); /* add in the physical hash table */ h = tb_phys_hash_func(phys_pc); ptb = &tcg_ctx.tb_ctx.tb_phys_hash[h]; @@ -1414,7 +1413,6 @@ static void tb_link_page(TranslationBlock *tb, tb_page_addr_t phys_pc, #ifdef DEBUG_TB_CHECK tb_page_check(); #endif - mmap_unlock(); } /* find the TB 'tb' such that tb[0].tc_ptr <= tc_ptr < |
