Two or more threads might race while invalidating the same TB. We currently do not check for this at all despite taking tb_lock, which means we would wrongly invalidate the same TB more than once. This bug has actually been hit by users: I recently saw a report on IRC, although I have yet to see the corresponding test case. Fix this by using qht_remove as the synchronization point; if it fails, that means the TB has already been invalidated, and therefore there is nothing left to do in tb_phys_invalidate. Note that this solution works now that we still have tb_lock, and will continue working once we remove tb_lock. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Emilio G. Cota <cota@braap.org> Message-Id: <1508445114-4717-1-git-send-email-cota@braap.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org> |
||
|---|---|---|
| .. | ||
| Makefile.objs | ||
| atomic_template.h | ||
| cpu-exec-common.c | ||
| cpu-exec.c | ||
| cputlb.c | ||
| softmmu_template.h | ||
| tcg-all.c | ||
| tcg-runtime.c | ||
| tcg-runtime.h | ||
| trace-events | ||
| translate-all.c | ||
| translate-all.h | ||
| translator.c | ||
| user-exec-stub.c | ||
| user-exec.c | ||