From patchwork Thu Aug 10 15:48:02 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Richard Henderson X-Patchwork-Id: 712365 Delivered-To: patch@linaro.org Received: by 2002:a05:6359:baf:b0:129:c516:61db with SMTP id gf47csp728220rwb; Thu, 10 Aug 2023 08:49:04 -0700 (PDT) X-Google-Smtp-Source: AGHT+IFMAJLaqXk/ztSKupGI1x4lE/PU4qj7wv66V4Beq2peB+5jybBphEFp5KElcFiTohNjAGet X-Received: by 2002:a05:620a:172c:b0:76c:ae76:4ca0 with SMTP id az44-20020a05620a172c00b0076cae764ca0mr3388774qkb.22.1691682544389; Thu, 10 Aug 2023 08:49:04 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1691682544; cv=none; d=google.com; s=arc-20160816; b=c8sncsjuE0tyY6DmO6QK/NNWhHRuAHkyL6jqV0PbDVpqtWI7C7PhRxndMtEvuvGXFO 62p08CJ/mo+LaAqngaRc7/F+Vfv5yre9G0CcW9+SjFrtK7W5/8jbFReGxuhkb06j+wtv y+rT/Z8JnyXSPenP1XGppG/ZUrAx+51AqigZ7pqCSUT6TIGRVS4Fuvls2nwS72BZVmhH HKomh6tltY2Bb1ggHfkeaq6jgcYtvISCbQkAegSg+Zjnfx9JtyUamu7k2nJVtdybuKB4 2vjmPfe9kUMS+2+RVQnh4OWbB0ac/b3clkHCbayE80pKVwLmPfWnbt5leO84OEpF17o6 42wA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=sender:errors-to:list-subscribe:list-help:list-post:list-archive :list-unsubscribe:list-id:precedence:content-transfer-encoding :mime-version:message-id:date:subject:cc:to:from:dkim-signature; bh=31QcrEnKIPElQsGKjnVGAqCQNo3S4RsklQmlCnbkjy0=; fh=VfTwSuIN1r8D35V8rZhzFeHheMJDOBtYu/kETJM8Jl8=; b=wdYAc71LHWo4eP9ZSq3ll2ZxOtCTfv7XR68xse3vo1cUHf5mK/pZ9M4k0+f8VrHRxJ uDGRfX/YvNpaPdXq9Bnpw+9uDRZCoxNZAE22WvZtOrDsMzASxq745JnDfUjJ+SsTzj3a /0pRbudQ3cuPv77cqc0pKpJ1NMANKPVnGvVSx4pHbo0YgrTaJyssQMShoBMrtl8Wmvo6 bz8Q1veYguQwHC4+0ThOTua8iXyByj7QGRGUQ0lartdAWOveh0ELTJisPdK6FFwHZdGz UwLRLElhPL66BHNlg4IhWZgx+JSywu2DsWBfKRRazZqMXZA9NfjgIix2t+Cg1Yi6mZNy R0CQ== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=ZN+eep8+; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org"; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Return-Path: Received: from lists.gnu.org (lists.gnu.org. [209.51.188.17]) by mx.google.com with ESMTPS id bl15-20020a05620a1a8f00b007675e0d15f9si1065566qkb.395.2023.08.10.08.49.04 for (version=TLS1_2 cipher=ECDHE-ECDSA-CHACHA20-POLY1305 bits=256/256); Thu, 10 Aug 2023 08:49:04 -0700 (PDT) Received-SPF: pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; Authentication-Results: mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=ZN+eep8+; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org"; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1qU7tX-00013K-Gy; Thu, 10 Aug 2023 11:48:16 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1qU7tS-0000vL-R2 for qemu-devel@nongnu.org; Thu, 10 Aug 2023 11:48:10 -0400 Received: from mail-pf1-x434.google.com ([2607:f8b0:4864:20::434]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1qU7tO-0005ta-LH for qemu-devel@nongnu.org; Thu, 10 Aug 2023 11:48:10 -0400 Received: by mail-pf1-x434.google.com with SMTP id d2e1a72fcca58-686fc0d3c92so788842b3a.0 for ; Thu, 10 Aug 2023 08:48:05 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; t=1691682484; x=1692287284; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=31QcrEnKIPElQsGKjnVGAqCQNo3S4RsklQmlCnbkjy0=; b=ZN+eep8+TEvVFC3AHcWnDimj0n/1A8sImpwHFzGhcNil9j3y0V9gYDM1ycPbBrbK5g bialK8qvZx1elP/zG5Q3kJf7VJfmnIjYZLNJEzcg79PMUKS6OlDRE6t3FkBC3WbV+Kfv WukrYrPWjAX114KecXyZ8FwKptK7k18IWMADuhln4ypoyenHophSeWte1QQ7XmSKgE98 Vtx1y4VPALgGiD8bwpRZCwBf6qtomBvbCq/d2u35EcJqYuzJunnoW7RB0xu0WAsi6axZ kXheeKtUwrY1FqjqjxKf+cjZ4L/JgL4Q3w2ktbKTgCldPBevA+ZAtbeoF+C6zfoUHdC3 /yzw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20221208; t=1691682484; x=1692287284; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=31QcrEnKIPElQsGKjnVGAqCQNo3S4RsklQmlCnbkjy0=; b=TC+7lg2+j7ykIAF8F14qfhWLnN487ATs9VCxeYUv7PRFK390VunGvD/5Xw2EBEoKEd wUVgsnyeUunliwpaO9oLhSsEagRETne1OCfDhJz80P+DDF2Knadq8DdKxSywkgqSROAv Ak9H14y/aEfjYkb+QPlvHXjEptIpAGBdz+3RxT/JDegJOImzpe1rQboGObi6D+xpbuno bU5KylcWM8GispNVko1vSph6zyPRA4wZELBThL9nxOkZ/yBT+MvD/B/DFE6MvqZPd2jK cJs6ZubEXa9wDb/heecAwDSSrLxVuK4ojrav3jOB5qKaF4ordSUgczhyFEwjyCKnMDYW 46gg== X-Gm-Message-State: AOJu0Yy26BOJ7UZiTA2+4jwGPZeSOqQeHUoanQrK0T0i6org8KOwceWj LPlaJ7SZa0AXmlRffXoBkd+Aj2CaUNPNsCug5Jw= X-Received: by 2002:a05:6a00:a1f:b0:67a:a4d1:e70 with SMTP id p31-20020a056a000a1f00b0067aa4d10e70mr3051928pfh.16.1691682484366; Thu, 10 Aug 2023 08:48:04 -0700 (PDT) Received: from stoup.. ([2602:47:d483:7301:9e4d:b830:d4fd:9164]) by smtp.gmail.com with ESMTPSA id x3-20020a056a00270300b00682b299b6besm1692231pfv.70.2023.08.10.08.48.03 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 10 Aug 2023 08:48:03 -0700 (PDT) From: Richard Henderson To: qemu-devel@nongnu.org Cc: Mark Cave-Ayland Subject: [PATCH for-8.1] accel/tcg: Avoid reading too much in load_atom_{2,4} Date: Thu, 10 Aug 2023 08:48:02 -0700 Message-Id: <20230810154802.16663-1-richard.henderson@linaro.org> X-Mailer: git-send-email 2.34.1 MIME-Version: 1.0 Received-SPF: pass client-ip=2607:f8b0:4864:20::434; envelope-from=richard.henderson@linaro.org; helo=mail-pf1-x434.google.com X-Spam_score_int: -20 X-Spam_score: -2.1 X-Spam_bar: -- X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+patch=linaro.org@nongnu.org Sender: qemu-devel-bounces+patch=linaro.org@nongnu.org When load_atom_extract_al16_or_al8 is inexpensive, we want to use it early, in order to avoid the overhead of required_atomicity. However, we must not read past the end of the page. Reported-by: Mark Cave-Ayland Signed-off-by: Richard Henderson Reviewed-by: Philippe Mathieu-Daudé Reviewed-by: Peter Maydell --- This should solve the problem that Mark reported for m68k. In his system-mode scenario, we would need a tlb fault on the final 7 bytes of the final page of system ram. With aarch64 FEAT_LSE2 I can create an internal alignment fault that leads to the same code path -- the test case fails before the fix. r~ --- tests/tcg/aarch64/lse2-fault.c | 38 +++++++++++++++++++++++++++++++ accel/tcg/ldst_atomicity.c.inc | 10 ++++++-- tests/tcg/aarch64/Makefile.target | 2 +- 3 files changed, 47 insertions(+), 3 deletions(-) create mode 100644 tests/tcg/aarch64/lse2-fault.c diff --git a/tests/tcg/aarch64/lse2-fault.c b/tests/tcg/aarch64/lse2-fault.c new file mode 100644 index 0000000000..2187219a08 --- /dev/null +++ b/tests/tcg/aarch64/lse2-fault.c @@ -0,0 +1,38 @@ +#include +#include +#include +#include + +int main() +{ + int psize = getpagesize(); + int id; + void *p; + + /* + * We need a shared mapping to enter CF_PARALLEL mode. + * The easiest way to get that is shmat. + */ + id = shmget(IPC_PRIVATE, 2 * psize, IPC_CREAT | 0600); + if (id < 0) { + perror("shmget"); + return 2; + } + p = shmat(id, NULL, 0); + if (p == MAP_FAILED) { + perror("shmat"); + return 2; + } + + /* Protect the second page. */ + if (mprotect(p + psize, psize, PROT_NONE) < 0) { + perror("mprotect"); + return 2; + } + + /* + * Load 4 bytes, 6 bytes from the end of the page. + * On success this will load 0 from the newly allocated shm. + */ + return *(int *)(p + psize - 6); +} diff --git a/accel/tcg/ldst_atomicity.c.inc b/accel/tcg/ldst_atomicity.c.inc index e5c590a499..5d92485a49 100644 --- a/accel/tcg/ldst_atomicity.c.inc +++ b/accel/tcg/ldst_atomicity.c.inc @@ -404,7 +404,10 @@ static uint16_t load_atom_2(CPUArchState *env, uintptr_t ra, return load_atomic2(pv); } if (HAVE_ATOMIC128_RO) { - return load_atom_extract_al16_or_al8(pv, 2); + intptr_t left_in_page = pi | TARGET_PAGE_MASK; + if (likely(left_in_page <= -16)) { + return load_atom_extract_al16_or_al8(pv, 2); + } } atmax = required_atomicity(env, pi, memop); @@ -443,7 +446,10 @@ static uint32_t load_atom_4(CPUArchState *env, uintptr_t ra, return load_atomic4(pv); } if (HAVE_ATOMIC128_RO) { - return load_atom_extract_al16_or_al8(pv, 4); + intptr_t left_in_page = pi | TARGET_PAGE_MASK; + if (likely(left_in_page <= -16)) { + return load_atom_extract_al16_or_al8(pv, 4); + } } atmax = required_atomicity(env, pi, memop); diff --git a/tests/tcg/aarch64/Makefile.target b/tests/tcg/aarch64/Makefile.target index 617f821613..681dfa077c 100644 --- a/tests/tcg/aarch64/Makefile.target +++ b/tests/tcg/aarch64/Makefile.target @@ -9,7 +9,7 @@ AARCH64_SRC=$(SRC_PATH)/tests/tcg/aarch64 VPATH += $(AARCH64_SRC) # Base architecture tests -AARCH64_TESTS=fcvt pcalign-a64 +AARCH64_TESTS=fcvt pcalign-a64 lse2-fault fcvt: LDFLAGS+=-lm