diff mbox

[v2,1/1] target-ppc, tcg: fix usermode segfault with pthread_create()

Message ID 7c016bdc97ed45dc2eb5002db98efcee26c4d8bf.1486437689.git.sam.bobroff@au1.ibm.com (mailing list archive)
State New, archived
Headers show

Commit Message

Sam Bobroff Feb. 7, 2017, 3:21 a.m. UTC
Programs run under qemu-ppc64 on an x86_64 host currently segfault
if they use pthread_create() due to the adjustment made to the NIP in
commit bd6fefe71cec5a0c7d2be4ac96307f25db56abf9.

This patch changes cpu_loop() to set the NIP back to the
pre-incremented value before calling do_syscall(), which causes the
correct address to be used for the new thread and corrects the fault.

Signed-off-by: Sam Bobroff <sam.bobroff@au1.ibm.com>
---

v2:

* Remove the NIP adjustment from the -TARGET_QEMU_ESIGRETURN case, it must
break out with the same NIP as do_syscall().

 linux-user/main.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

Comments

Laurent Vivier Feb. 7, 2017, 11 a.m. UTC | #1
Le 07/02/2017 à 04:21, Sam Bobroff a écrit :
> Programs run under qemu-ppc64 on an x86_64 host currently segfault
> if they use pthread_create() due to the adjustment made to the NIP in
> commit bd6fefe71cec5a0c7d2be4ac96307f25db56abf9.
> 
> This patch changes cpu_loop() to set the NIP back to the
> pre-incremented value before calling do_syscall(), which causes the
> correct address to be used for the new thread and corrects the fault.
> 
> Signed-off-by: Sam Bobroff <sam.bobroff@au1.ibm.com>
> ---
> 
> v2:
> 
> * Remove the NIP adjustment from the -TARGET_QEMU_ESIGRETURN case, it must
> break out with the same NIP as do_syscall().
> 
>  linux-user/main.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/linux-user/main.c b/linux-user/main.c
> index 30049581ef..4ea49f68be 100644
> --- a/linux-user/main.c
> +++ b/linux-user/main.c
> @@ -1712,10 +1712,12 @@ void cpu_loop(CPUPPCState *env)
>               * in syscalls.
>               */
>              env->crf[0] &= ~0x1;
> +            env->nip += 4;
>              ret = do_syscall(env, env->gpr[0], env->gpr[3], env->gpr[4],
>                               env->gpr[5], env->gpr[6], env->gpr[7],
>                               env->gpr[8], 0, 0);
>              if (ret == -TARGET_ERESTARTSYS) {
> +                env->nip -= 4;
>                  break;
>              }
>              if (ret == (target_ulong)(-TARGET_QEMU_ESIGRETURN)) {
> @@ -1723,7 +1725,6 @@ void cpu_loop(CPUPPCState *env)
>                     Avoid corrupting register state.  */
>                  break;
>              }
> -            env->nip += 4;
>              if (ret > (target_ulong)(-515)) {
>                  env->crf[0] |= 0x1;
>                  ret = -ret;
> 

Reviewed-by: Laurent Vivier <laurent@vivier.eu>
[my comments on previous patch were inaccurate]

Thanks,
Laurent
Peter Maydell Feb. 7, 2017, 11:14 a.m. UTC | #2
On 7 February 2017 at 03:21, Sam Bobroff <sam.bobroff@au1.ibm.com> wrote:
> Programs run under qemu-ppc64 on an x86_64 host currently segfault
> if they use pthread_create() due to the adjustment made to the NIP in
> commit bd6fefe71cec5a0c7d2be4ac96307f25db56abf9.
>
> This patch changes cpu_loop() to set the NIP back to the
> pre-incremented value before calling do_syscall(), which causes the
> correct address to be used for the new thread and corrects the fault.
>
> Signed-off-by: Sam Bobroff <sam.bobroff@au1.ibm.com>

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>

thanks
-- PMM
Michael Roth Feb. 7, 2017, 10:32 p.m. UTC | #3
Quoting Sam Bobroff (2017-02-06 21:21:39)
> Programs run under qemu-ppc64 on an x86_64 host currently segfault
> if they use pthread_create() due to the adjustment made to the NIP in
> commit bd6fefe71cec5a0c7d2be4ac96307f25db56abf9.
> 
> This patch changes cpu_loop() to set the NIP back to the
> pre-incremented value before calling do_syscall(), which causes the
> correct address to be used for the new thread and corrects the fault.
> 
> Signed-off-by: Sam Bobroff <sam.bobroff@au1.ibm.com>

Cc'ing qemu-stable@nongnu.org

> ---
> 
> v2:
> 
> * Remove the NIP adjustment from the -TARGET_QEMU_ESIGRETURN case, it must
> break out with the same NIP as do_syscall().
> 
>  linux-user/main.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/linux-user/main.c b/linux-user/main.c
> index 30049581ef..4ea49f68be 100644
> --- a/linux-user/main.c
> +++ b/linux-user/main.c
> @@ -1712,10 +1712,12 @@ void cpu_loop(CPUPPCState *env)
>               * in syscalls.
>               */
>              env->crf[0] &= ~0x1;
> +            env->nip += 4;
>              ret = do_syscall(env, env->gpr[0], env->gpr[3], env->gpr[4],
>                               env->gpr[5], env->gpr[6], env->gpr[7],
>                               env->gpr[8], 0, 0);
>              if (ret == -TARGET_ERESTARTSYS) {
> +                env->nip -= 4;
>                  break;
>              }
>              if (ret == (target_ulong)(-TARGET_QEMU_ESIGRETURN)) {
> @@ -1723,7 +1725,6 @@ void cpu_loop(CPUPPCState *env)
>                     Avoid corrupting register state.  */
>                  break;
>              }
> -            env->nip += 4;
>              if (ret > (target_ulong)(-515)) {
>                  env->crf[0] |= 0x1;
>                  ret = -ret;
> -- 
> 2.11.0
> 
>
diff mbox

Patch

diff --git a/linux-user/main.c b/linux-user/main.c
index 30049581ef..4ea49f68be 100644
--- a/linux-user/main.c
+++ b/linux-user/main.c
@@ -1712,10 +1712,12 @@  void cpu_loop(CPUPPCState *env)
              * in syscalls.
              */
             env->crf[0] &= ~0x1;
+            env->nip += 4;
             ret = do_syscall(env, env->gpr[0], env->gpr[3], env->gpr[4],
                              env->gpr[5], env->gpr[6], env->gpr[7],
                              env->gpr[8], 0, 0);
             if (ret == -TARGET_ERESTARTSYS) {
+                env->nip -= 4;
                 break;
             }
             if (ret == (target_ulong)(-TARGET_QEMU_ESIGRETURN)) {
@@ -1723,7 +1725,6 @@  void cpu_loop(CPUPPCState *env)
                    Avoid corrupting register state.  */
                 break;
             }
-            env->nip += 4;
             if (ret > (target_ulong)(-515)) {
                 env->crf[0] |= 0x1;
                 ret = -ret;