Skip to content

Commit

Permalink
target/i386: raise FERR interrupt with iothread locked
Browse files Browse the repository at this point in the history
Otherwise tcg_handle_interrupt() triggers an assertion failure:

  #5  0x0000555555c97369 in tcg_handle_interrupt (cpu=0x555557434cb0, mask=2) at ../accel/tcg/tcg-accel-ops.c:83
  #6  tcg_handle_interrupt (cpu=0x555557434cb0, mask=2) at ../accel/tcg/tcg-accel-ops.c:81
  #7  0x0000555555b4d58b in pic_irq_request (opaque=<optimized out>, irq=<optimized out>, level=1) at ../hw/i386/x86.c:555
  #8  0x0000555555b4f218 in gsi_handler (opaque=0x5555579423d0, n=13, level=1) at ../hw/i386/x86.c:611
  #9  0x00007fffa42bde14 in code_gen_buffer ()
  #10 0x0000555555c724bb in cpu_tb_exec (cpu=cpu@entry=0x555557434cb0, itb=<optimized out>, tb_exit=tb_exit@entry=0x7fffe9bfd658) at ../accel/tcg/cpu-exec.c:457

Cc: qemu-stable@nongnu.org
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1808
Reported-by: NyanCatTW1 <https://gitlab.com/a0939712328>
Co-developed-by: Richard Henderson <richard.henderson@linaro.org>'
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
  • Loading branch information
bonzini committed Sep 1, 2023
1 parent 473cd07 commit c1f27a0
Show file tree
Hide file tree
Showing 2 changed files with 13 additions and 1 deletion.
6 changes: 6 additions & 0 deletions target/i386/tcg/sysemu/fpu_helper.c
Original file line number Diff line number Diff line change
Expand Up @@ -18,6 +18,7 @@
*/

#include "qemu/osdep.h"
#include "qemu/main-loop.h"
#include "cpu.h"
#include "hw/irq.h"

Expand All @@ -31,7 +32,9 @@ void x86_register_ferr_irq(qemu_irq irq)
void fpu_check_raise_ferr_irq(CPUX86State *env)
{
if (ferr_irq && !(env->hflags2 & HF2_IGNNE_MASK)) {
qemu_mutex_lock_iothread();
qemu_irq_raise(ferr_irq);
qemu_mutex_unlock_iothread();
return;
}
}
Expand All @@ -45,6 +48,9 @@ void cpu_clear_ignne(void)
void cpu_set_ignne(void)
{
CPUX86State *env = &X86_CPU(first_cpu)->env;

assert(qemu_mutex_iothread_locked());

env->hflags2 |= HF2_IGNNE_MASK;
/*
* We get here in response to a write to port F0h. The chipset should
Expand Down
8 changes: 7 additions & 1 deletion target/i386/tcg/translate.c
Original file line number Diff line number Diff line change
Expand Up @@ -4619,7 +4619,11 @@ static bool disas_insn(DisasContext *s, CPUState *cpu)
case 0x0a: /* grp d9/2 */
switch (rm) {
case 0: /* fnop */
/* check exceptions (FreeBSD FPU probe) */
/*
* check exceptions (FreeBSD FPU probe)
* needs to be treated as I/O because of ferr_irq
*/
translator_io_start(&s->base);
gen_helper_fwait(cpu_env);
update_fip = false;
break;
Expand Down Expand Up @@ -5548,6 +5552,8 @@ static bool disas_insn(DisasContext *s, CPUState *cpu)
(HF_MP_MASK | HF_TS_MASK)) {
gen_exception(s, EXCP07_PREX);
} else {
/* needs to be treated as I/O because of ferr_irq */
translator_io_start(&s->base);
gen_helper_fwait(cpu_env);
}
break;
Expand Down

0 comments on commit c1f27a0

Please sign in to comment.