On Wed, 10 Jul 2024 at 04:31, Richard Henderson
<richard.hender...@linaro.org> wrote:
>
> Avoid a race condition with munmap in another thread.
> Use around blocks that exclusively use "host_fn".
> Keep the blocks as small as possible, but without setting
> and clearing for every operation on one page.
>
> Signed-off-by: Richard Henderson <richard.hender...@linaro.org>
> ---
> target/arm/tcg/sme_helper.c | 16 ++++++++++++++++
> target/arm/tcg/sve_helper.c | 26 ++++++++++++++++++++++++++
> 2 files changed, 42 insertions(+)
> @@ -6093,6 +6101,8 @@ void sve_ldnfff1_r(CPUARMState *env, void *vg, const
> target_ulong addr,
> reg_last = info.reg_off_last[0];
> host = info.page[0].host;
>
> + set_helper_retaddr(retaddr);
> +
> do {
> uint64_t pg = *(uint64_t *)(vg + (reg_off >> 3));
> do {
> @@ -6113,6 +6123,8 @@ void sve_ldnfff1_r(CPUARMState *env, void *vg, const
> target_ulong addr,
> } while (reg_off <= reg_last && (reg_off & 63));
> } while (reg_off <= reg_last);
>
> + clear_helper_retaddr();
> +
> /*
> * MemSingleNF is allowed to fail for any reason. We have special
> * code above to handle the first element crossing a page boundary.
There's a "goto do_fault" inside the loop that we've bracketed here with
the set/clear_helper_retaddr() calls -- don't we need to call
clear_helper_retaddr() on that failure path too?
There's a TODO comment at the top of this file:
/*
* Load contiguous data, first-fault and no-fault.
*
* For user-only, one could argue that we should hold the mmap_lock during
* the operation so that there is no race between page_check_range and the
* load operation. However, unmapping pages out from under a running thread
* is extraordinarily unlikely. This theoretical race condition also affects
* linux-user/ in its get_user/put_user macros.
*
* TODO: Construct some helpers, written in assembly, that interact with
* host_signal_handler to produce memory ops which can properly report errors
* without racing.
*/
Should we update it to note that we make at least some attempt to
handle the pages-unmapped-from-under-a-running-thread situation now?
thanks
-- PMM
