mirror of
https://github.com/qemu/qemu.git
synced 2024-12-28 14:43:49 +08:00
c979d901c8
This patch fixes the issue originally reported in this thread: https://lists.gnu.org/archive/html/qemu-devel/2021-11/msg01102.html The root cause of the issue is a bug in the hexagon specific logic for saving & restoring context during signal delivery. The CPU state has two different representations for the predicate registers. The current logic saves & restores only the aliased HEX_REG_P3_O register, which is part of env->gpr[] field in the CPU state, but not the individual byte-level predicate registers (pO, p1, p2, p3) backed by env->pred[]. Since all predicated instructions refer only to the indiviual registers, switching to and back from a signal handler can clobber these registers if the signal handler writes to them causing the normal application code to behave unpredictably when context is restored. In the reported issue with the 'signals' test, since the updated hexagon toolchain had built musl with -O2, the functions called from non_trivial_free were inlined. This meant that the code emitted reused predicate P0 computed in the entry translation block of the function non_trivial_free in one of the child TB as part of an assertion. Since P0 is clobbered by the signal handler in the signals test, the assertion in non_trivial_free fails incorectly. Since musl for hexagon implements the 'abort' function by deliberately writing to memory via null pointer, this causes the test to fail with segmentation fault. This patch modifies the signal context save & restore logic to include the individual p0, p1, p2, p3 and excludes the 32b p3_0 register since its value is derived from the former registers. It also adds a new test case that reliabily reproduces the issue for all four predicate registers. Buglink: https://github.com/quic/toolchain_for_hexagon/issues/6 Signed-off-by: Mukilan Thiyagarajan <quic_mthiyaga@quicinc.com> Signed-off-by: Taylor Simpson <tsimpson@quicinc.com> Reviewed-by: Taylor Simpson <tsimpson@quicinc.com> Message-Id: <20221229092006.10709-2-quic_mthiyaga@quicinc.com> |
||
|---|---|---|
| .. | ||
| cpu_loop.c | ||
| signal.c | ||
| sockbits.h | ||
| syscall_nr.h | ||
| target_cpu.h | ||
| target_elf.h | ||
| target_errno_defs.h | ||
| target_fcntl.h | ||
| target_mman.h | ||
| target_prctl.h | ||
| target_resource.h | ||
| target_signal.h | ||
| target_structs.h | ||
| target_syscall.h | ||
| termbits.h | ||