diff options
| author | Paolo Bonzini <pbonzini@redhat.com> | 2023-08-29 17:33:06 +0200 |
|---|---|---|
| committer | Michael Tokarev <mjt@tls.msk.ru> | 2023-09-21 19:35:19 +0300 |
| commit | e975434d62c325bdd3bacb030c5a610d095b8909 (patch) | |
| tree | 9f2748f56ac98fbf1e8c40982d81d7e748a4ec80 | |
| parent | e5e77f256fba11d61ffa237eed0b53a78882b3bb (diff) | |
target/i386: raise FERR interrupt with iothread locked
Otherwise tcg_handle_interrupt() triggers an assertion failure:
#5 0x0000555555c97369 in tcg_handle_interrupt (cpu=0x555557434cb0, mask=2) at ../accel/tcg/tcg-accel-ops.c:83
#6 tcg_handle_interrupt (cpu=0x555557434cb0, mask=2) at ../accel/tcg/tcg-accel-ops.c:81
#7 0x0000555555b4d58b in pic_irq_request (opaque=<optimized out>, irq=<optimized out>, level=1) at ../hw/i386/x86.c:555
#8 0x0000555555b4f218 in gsi_handler (opaque=0x5555579423d0, n=13, level=1) at ../hw/i386/x86.c:611
#9 0x00007fffa42bde14 in code_gen_buffer ()
#10 0x0000555555c724bb in cpu_tb_exec (cpu=cpu@entry=0x555557434cb0, itb=<optimized out>, tb_exit=tb_exit@entry=0x7fffe9bfd658) at ../accel/tcg/cpu-exec.c:457
Cc: qemu-stable@nongnu.org
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1808
Reported-by: NyanCatTW1 <https://gitlab.com/a0939712328>
Co-developed-by: Richard Henderson <richard.henderson@linaro.org>'
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
(cherry picked from commit c1f27a0c6ae4059a1d809e9c2bc4d47b823c32a3)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
| -rw-r--r-- | target/i386/tcg/sysemu/fpu_helper.c | 6 | ||||
| -rw-r--r-- | target/i386/tcg/translate.c | 8 |
2 files changed, 13 insertions, 1 deletions
diff --git a/target/i386/tcg/sysemu/fpu_helper.c b/target/i386/tcg/sysemu/fpu_helper.c index 1c3610da3b..93506cdd94 100644 --- a/target/i386/tcg/sysemu/fpu_helper.c +++ b/target/i386/tcg/sysemu/fpu_helper.c @@ -18,6 +18,7 @@ */ #include "qemu/osdep.h" +#include "qemu/main-loop.h" #include "cpu.h" #include "hw/irq.h" @@ -31,7 +32,9 @@ void x86_register_ferr_irq(qemu_irq irq) void fpu_check_raise_ferr_irq(CPUX86State *env) { if (ferr_irq && !(env->hflags2 & HF2_IGNNE_MASK)) { + qemu_mutex_lock_iothread(); qemu_irq_raise(ferr_irq); + qemu_mutex_unlock_iothread(); return; } } @@ -45,6 +48,9 @@ void cpu_clear_ignne(void) void cpu_set_ignne(void) { CPUX86State *env = &X86_CPU(first_cpu)->env; + + assert(qemu_mutex_iothread_locked()); + env->hflags2 |= HF2_IGNNE_MASK; /* * We get here in response to a write to port F0h. The chipset should diff --git a/target/i386/tcg/translate.c b/target/i386/tcg/translate.c index 90c7b32f36..e0a622941c 100644 --- a/target/i386/tcg/translate.c +++ b/target/i386/tcg/translate.c @@ -4619,7 +4619,11 @@ static bool disas_insn(DisasContext *s, CPUState *cpu) case 0x0a: /* grp d9/2 */ switch (rm) { case 0: /* fnop */ - /* check exceptions (FreeBSD FPU probe) */ + /* + * check exceptions (FreeBSD FPU probe) + * needs to be treated as I/O because of ferr_irq + */ + translator_io_start(&s->base); gen_helper_fwait(cpu_env); update_fip = false; break; @@ -5548,6 +5552,8 @@ static bool disas_insn(DisasContext *s, CPUState *cpu) (HF_MP_MASK | HF_TS_MASK)) { gen_exception(s, EXCP07_PREX); } else { + /* needs to be treated as I/O because of ferr_irq */ + translator_io_start(&s->base); gen_helper_fwait(cpu_env); } break; |