All of lore.kernel.org
 help / color / mirror / Atom feed
* [PATCH 1/1] accel/tcg: Fix the comment for CPUTLBEntryFull
@ 2023-09-01  6:01 LIU Zhiwei
  2023-09-09 21:31 ` Richard Henderson
  2023-11-28 13:04 ` Mark Cave-Ayland
  0 siblings, 2 replies; 4+ messages in thread
From: LIU Zhiwei @ 2023-09-01  6:01 UTC (permalink / raw)
  To: qemu-devel; +Cc: richard.henderson, pbonzini, LIU Zhiwei

When memory region is ram, the lower TARGET_PAGE_BITS is not the
physical section number. Instead, its value is always 0.

Add comment and assert to make it clear.

Signed-off-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
---
 accel/tcg/cputlb.c      | 11 +++++++----
 include/exec/cpu-defs.h | 12 ++++++------
 2 files changed, 13 insertions(+), 10 deletions(-)

diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
index d68fa6867c..a1ebf75068 100644
--- a/accel/tcg/cputlb.c
+++ b/accel/tcg/cputlb.c
@@ -1192,6 +1192,7 @@ void tlb_set_page_full(CPUState *cpu, int mmu_idx,
     write_flags = read_flags;
     if (is_ram) {
         iotlb = memory_region_get_ram_addr(section->mr) + xlat;
+        assert(!(iotlb & ~TARGET_PAGE_MASK));
         /*
          * Computing is_clean is expensive; avoid all that unless
          * the page is actually writable.
@@ -1254,10 +1255,12 @@ void tlb_set_page_full(CPUState *cpu, int mmu_idx,
 
     /* refill the tlb */
     /*
-     * At this point iotlb contains a physical section number in the lower
-     * TARGET_PAGE_BITS, and either
-     *  + the ram_addr_t of the page base of the target RAM (RAM)
-     *  + the offset within section->mr of the page base (I/O, ROMD)
+     * When memory region is ram, iotlb contains a TARGET_PAGE_BITS
+     * aligned ram_addr_t of the page base of the target RAM.
+     * Otherwise, iotlb contains
+     *  - a physical section number in the lower TARGET_PAGE_BITS
+     *  - the offset within section->mr of the page base (I/O, ROMD) with the
+     *    TARGET_PAGE_BITS masked off.
      * We subtract addr_page (which is page aligned and thus won't
      * disturb the low bits) to give an offset which can be added to the
      * (non-page-aligned) vaddr of the eventual memory access to get
diff --git a/include/exec/cpu-defs.h b/include/exec/cpu-defs.h
index fb4c8d480f..350287852e 100644
--- a/include/exec/cpu-defs.h
+++ b/include/exec/cpu-defs.h
@@ -100,12 +100,12 @@
 typedef struct CPUTLBEntryFull {
     /*
      * @xlat_section contains:
-     *  - in the lower TARGET_PAGE_BITS, a physical section number
-     *  - with the lower TARGET_PAGE_BITS masked off, an offset which
-     *    must be added to the virtual address to obtain:
-     *     + the ram_addr_t of the target RAM (if the physical section
-     *       number is PHYS_SECTION_NOTDIRTY or PHYS_SECTION_ROM)
-     *     + the offset within the target MemoryRegion (otherwise)
+     *  - For ram, an offset which must be added to the virtual address
+     *    to obtain the ram_addr_t of the target RAM
+     *  - For other memory regions,
+     *     + in the lower TARGET_PAGE_BITS, the physical section number
+     *     + with the TARGET_PAGE_BITS masked off, the offset within
+     *       the target MemoryRegion
      */
     hwaddr xlat_section;
 
-- 
2.17.1



^ permalink raw reply related	[flat|nested] 4+ messages in thread

* Re: [PATCH 1/1] accel/tcg: Fix the comment for CPUTLBEntryFull
  2023-09-01  6:01 [PATCH 1/1] accel/tcg: Fix the comment for CPUTLBEntryFull LIU Zhiwei
@ 2023-09-09 21:31 ` Richard Henderson
  2023-11-28 13:04 ` Mark Cave-Ayland
  1 sibling, 0 replies; 4+ messages in thread
From: Richard Henderson @ 2023-09-09 21:31 UTC (permalink / raw)
  To: LIU Zhiwei, qemu-devel; +Cc: pbonzini

On 8/31/23 23:01, LIU Zhiwei wrote:
> When memory region is ram, the lower TARGET_PAGE_BITS is not the
> physical section number. Instead, its value is always 0.
> 
> Add comment and assert to make it clear.
> 
> Signed-off-by: LIU Zhiwei<zhiwei_liu@linux.alibaba.com>
> ---
>   accel/tcg/cputlb.c      | 11 +++++++----
>   include/exec/cpu-defs.h | 12 ++++++------
>   2 files changed, 13 insertions(+), 10 deletions(-)

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>

Queued to tcg-next.


r~


^ permalink raw reply	[flat|nested] 4+ messages in thread

* Re: [PATCH 1/1] accel/tcg: Fix the comment for CPUTLBEntryFull
  2023-09-01  6:01 [PATCH 1/1] accel/tcg: Fix the comment for CPUTLBEntryFull LIU Zhiwei
  2023-09-09 21:31 ` Richard Henderson
@ 2023-11-28 13:04 ` Mark Cave-Ayland
  2023-12-08  2:44   ` LIU Zhiwei
  1 sibling, 1 reply; 4+ messages in thread
From: Mark Cave-Ayland @ 2023-11-28 13:04 UTC (permalink / raw)
  To: LIU Zhiwei, qemu-devel; +Cc: richard.henderson, pbonzini

On 01/09/2023 07:01, LIU Zhiwei wrote:

> When memory region is ram, the lower TARGET_PAGE_BITS is not the
> physical section number. Instead, its value is always 0.
> 
> Add comment and assert to make it clear.
> 
> Signed-off-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
> ---
>   accel/tcg/cputlb.c      | 11 +++++++----
>   include/exec/cpu-defs.h | 12 ++++++------
>   2 files changed, 13 insertions(+), 10 deletions(-)
> 
> diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
> index d68fa6867c..a1ebf75068 100644
> --- a/accel/tcg/cputlb.c
> +++ b/accel/tcg/cputlb.c
> @@ -1192,6 +1192,7 @@ void tlb_set_page_full(CPUState *cpu, int mmu_idx,
>       write_flags = read_flags;
>       if (is_ram) {
>           iotlb = memory_region_get_ram_addr(section->mr) + xlat;
> +        assert(!(iotlb & ~TARGET_PAGE_MASK));
>           /*
>            * Computing is_clean is expensive; avoid all that unless
>            * the page is actually writable.
> @@ -1254,10 +1255,12 @@ void tlb_set_page_full(CPUState *cpu, int mmu_idx,
>   
>       /* refill the tlb */
>       /*
> -     * At this point iotlb contains a physical section number in the lower
> -     * TARGET_PAGE_BITS, and either
> -     *  + the ram_addr_t of the page base of the target RAM (RAM)
> -     *  + the offset within section->mr of the page base (I/O, ROMD)
> +     * When memory region is ram, iotlb contains a TARGET_PAGE_BITS
> +     * aligned ram_addr_t of the page base of the target RAM.
> +     * Otherwise, iotlb contains
> +     *  - a physical section number in the lower TARGET_PAGE_BITS
> +     *  - the offset within section->mr of the page base (I/O, ROMD) with the
> +     *    TARGET_PAGE_BITS masked off.
>        * We subtract addr_page (which is page aligned and thus won't
>        * disturb the low bits) to give an offset which can be added to the
>        * (non-page-aligned) vaddr of the eventual memory access to get
> diff --git a/include/exec/cpu-defs.h b/include/exec/cpu-defs.h
> index fb4c8d480f..350287852e 100644
> --- a/include/exec/cpu-defs.h
> +++ b/include/exec/cpu-defs.h
> @@ -100,12 +100,12 @@
>   typedef struct CPUTLBEntryFull {
>       /*
>        * @xlat_section contains:
> -     *  - in the lower TARGET_PAGE_BITS, a physical section number
> -     *  - with the lower TARGET_PAGE_BITS masked off, an offset which
> -     *    must be added to the virtual address to obtain:
> -     *     + the ram_addr_t of the target RAM (if the physical section
> -     *       number is PHYS_SECTION_NOTDIRTY or PHYS_SECTION_ROM)
> -     *     + the offset within the target MemoryRegion (otherwise)
> +     *  - For ram, an offset which must be added to the virtual address
> +     *    to obtain the ram_addr_t of the target RAM
> +     *  - For other memory regions,
> +     *     + in the lower TARGET_PAGE_BITS, the physical section number
> +     *     + with the TARGET_PAGE_BITS masked off, the offset within
> +     *       the target MemoryRegion
>        */
>       hwaddr xlat_section;

Someone sent me a test case that triggers the assert() introduced by this commit 
dff1ab6 ("accel/tcg: Fix the comment for CPUTLBEntryFull") for qemu-system-m68k which 
is still present in git master. The reproducer is easy:

1. Grab the machine ROM file from https://www.ilande.co.uk/tmp/qemu/tQuadra800.rom

2. Create an empty declaration ROM greater than 4K:

    dd if=/dev/zero of=/tmp/badrom bs=512 count=12

3. Start QEMU like this:

    qemu-system-m68k -M q800 -bios tQuadra800.rom \
        -device nubus-macfb,romfile=/tmp/badrom

The QEMU process hits the assert() with the following backtrace:

(gdb) bt
#0  0x00007ffff58a9d3c in ?? () from /lib/x86_64-linux-gnu/libc.so.6
#1  0x00007ffff585af32 in raise () from /lib/x86_64-linux-gnu/libc.so.6
#2  0x00007ffff5845472 in abort () from /lib/x86_64-linux-gnu/libc.so.6
#3  0x00007ffff5845395 in ?? () from /lib/x86_64-linux-gnu/libc.so.6
#4  0x00007ffff5853e32 in __assert_fail () from /lib/x86_64-linux-gnu/libc.so.6
#5  0x0000555555942e0a in tlb_set_page_full (cpu=0x55555618d4a0, mmu_idx=0, 
addr=4244631552, full=0x7fffe7d7f7c0) at ../accel/tcg/cputlb.c:1171
#6  0x00005555559432a0 in tlb_set_page_with_attrs (cpu=0x55555618d4a0, 
addr=4244631552, paddr=4244631552, attrs=..., prot=7, mmu_idx=0, size=4096) at 
../accel/tcg/cputlb.c:1290
#7  0x0000555555943305 in tlb_set_page (cpu=0x55555618d4a0, addr=4244631552, 
paddr=4244631552, prot=7, mmu_idx=0, size=4096) at ../accel/tcg/cputlb.c:1297
#8  0x000055555588aade in m68k_cpu_tlb_fill (cs=0x55555618d4a0, address=4244635647, 
size=1, qemu_access_type=MMU_DATA_LOAD, mmu_idx=0, probe=false, 
retaddr=140734805255937) at ../target/m68k/helper.c:1018
#9  0x0000555555943367 in tlb_fill (cpu=0x55555618d4a0, addr=4244635647, size=1, 
access_type=MMU_DATA_LOAD, mmu_idx=0, retaddr=140734805255937) at 
../accel/tcg/cputlb.c:1315
#10 0x0000555555945d78 in mmu_lookup1 (cpu=0x55555618d4a0, data=0x7fffe7d7fa00, 
mmu_idx=0, access_type=MMU_DATA_LOAD, ra=140734805255937) at ../accel/tcg/cputlb.c:1713
#11 0x0000555555946081 in mmu_lookup (cpu=0x55555618d4a0, addr=4244635647, oi=3712, 
ra=140734805255937, type=MMU_DATA_LOAD, l=0x7fffe7d7fa00) at ../accel/tcg/cputlb.c:1803
#12 0x000055555594742b in do_ld1_mmu (cpu=0x55555618d4a0, addr=4244635647, oi=3712, 
ra=140734805255937, access_type=MMU_DATA_LOAD) at ../accel/tcg/cputlb.c:2377
#13 0x0000555555948f17 in helper_ldub_mmu (env=0x55555618fc60, addr=4244635647, 
oi=3712, retaddr=140734805255937) at ../accel/tcg/ldst_common.c.inc:19
#14 0x00007fff6013286c in code_gen_buffer ()
#15 0x00005555559308ff in cpu_tb_exec (cpu=0x55555618d4a0, itb=0x7fffa0132480, 
tb_exit=0x7fffe7d80030) at ../accel/tcg/cpu-exec.c:458
#16 0x000055555593160a in cpu_loop_exec_tb (cpu=0x55555618d4a0, tb=0x7fffa0132480, 
pc=1082158370, last_tb=0x7fffe7d80040, tb_exit=0x7fffe7d80030) at 
../accel/tcg/cpu-exec.c:920
#17 0x000055555593196a in cpu_exec_loop (cpu=0x55555618d4a0, sc=0x7fffe7d800c0) at 
../accel/tcg/cpu-exec.c:1041
#18 0x0000555555931a28 in cpu_exec_setjmp (cpu=0x55555618d4a0, sc=0x7fffe7d800c0) at 
../accel/tcg/cpu-exec.c:1058
#19 0x0000555555931aaf in cpu_exec (cpu=0x55555618d4a0) at ../accel/tcg/cpu-exec.c:1084
#20 0x00005555559560ad in tcg_cpus_exec (cpu=0x55555618d4a0) at 
../accel/tcg/tcg-accel-ops.c:76
#21 0x00005555559575c2 in rr_cpu_thread_fn (arg=0x55555618d4a0) at 
../accel/tcg/tcg-accel-ops-rr.c:261
#22 0x0000555555b61f25 in qemu_thread_start (args=0x555556347a10) at 
../util/qemu-thread-posix.c:541
#23 0x00007ffff58a8044 in ?? () from /lib/x86_64-linux-gnu/libc.so.6
#24 0x00007ffff592861c in ?? () from /lib/x86_64-linux-gnu/libc.so.6


ATB,

Mark.



^ permalink raw reply	[flat|nested] 4+ messages in thread

* Re: [PATCH 1/1] accel/tcg: Fix the comment for CPUTLBEntryFull
  2023-11-28 13:04 ` Mark Cave-Ayland
@ 2023-12-08  2:44   ` LIU Zhiwei
  0 siblings, 0 replies; 4+ messages in thread
From: LIU Zhiwei @ 2023-12-08  2:44 UTC (permalink / raw)
  To: Mark Cave-Ayland, qemu-devel; +Cc: richard.henderson, pbonzini


On 2023/11/28 21:04, Mark Cave-Ayland wrote:
> On 01/09/2023 07:01, LIU Zhiwei wrote:
>
>> When memory region is ram, the lower TARGET_PAGE_BITS is not the
>> physical section number. Instead, its value is always 0.
>>
>> Add comment and assert to make it clear.
>>
>> Signed-off-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
>> ---
>>   accel/tcg/cputlb.c      | 11 +++++++----
>>   include/exec/cpu-defs.h | 12 ++++++------
>>   2 files changed, 13 insertions(+), 10 deletions(-)
>>
>> diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
>> index d68fa6867c..a1ebf75068 100644
>> --- a/accel/tcg/cputlb.c
>> +++ b/accel/tcg/cputlb.c
>> @@ -1192,6 +1192,7 @@ void tlb_set_page_full(CPUState *cpu, int mmu_idx,
>>       write_flags = read_flags;
>>       if (is_ram) {
>>           iotlb = memory_region_get_ram_addr(section->mr) + xlat;
>> +        assert(!(iotlb & ~TARGET_PAGE_MASK));
>>           /*
>>            * Computing is_clean is expensive; avoid all that unless
>>            * the page is actually writable.
>> @@ -1254,10 +1255,12 @@ void tlb_set_page_full(CPUState *cpu, int 
>> mmu_idx,
>>         /* refill the tlb */
>>       /*
>> -     * At this point iotlb contains a physical section number in the 
>> lower
>> -     * TARGET_PAGE_BITS, and either
>> -     *  + the ram_addr_t of the page base of the target RAM (RAM)
>> -     *  + the offset within section->mr of the page base (I/O, ROMD)
>> +     * When memory region is ram, iotlb contains a TARGET_PAGE_BITS
>> +     * aligned ram_addr_t of the page base of the target RAM.
>> +     * Otherwise, iotlb contains
>> +     *  - a physical section number in the lower TARGET_PAGE_BITS
>> +     *  - the offset within section->mr of the page base (I/O, ROMD) 
>> with the
>> +     *    TARGET_PAGE_BITS masked off.
>>        * We subtract addr_page (which is page aligned and thus won't
>>        * disturb the low bits) to give an offset which can be added 
>> to the
>>        * (non-page-aligned) vaddr of the eventual memory access to get
>> diff --git a/include/exec/cpu-defs.h b/include/exec/cpu-defs.h
>> index fb4c8d480f..350287852e 100644
>> --- a/include/exec/cpu-defs.h
>> +++ b/include/exec/cpu-defs.h
>> @@ -100,12 +100,12 @@
>>   typedef struct CPUTLBEntryFull {
>>       /*
>>        * @xlat_section contains:
>> -     *  - in the lower TARGET_PAGE_BITS, a physical section number
>> -     *  - with the lower TARGET_PAGE_BITS masked off, an offset which
>> -     *    must be added to the virtual address to obtain:
>> -     *     + the ram_addr_t of the target RAM (if the physical section
>> -     *       number is PHYS_SECTION_NOTDIRTY or PHYS_SECTION_ROM)
>> -     *     + the offset within the target MemoryRegion (otherwise)
>> +     *  - For ram, an offset which must be added to the virtual address
>> +     *    to obtain the ram_addr_t of the target RAM
>> +     *  - For other memory regions,
>> +     *     + in the lower TARGET_PAGE_BITS, the physical section number
>> +     *     + with the TARGET_PAGE_BITS masked off, the offset within
>> +     *       the target MemoryRegion
>>        */
>>       hwaddr xlat_section;
>
> Someone sent me a test case that triggers the assert() introduced by 
> this commit dff1ab6 ("accel/tcg: Fix the comment for CPUTLBEntryFull") 
> for qemu-system-m68k which is still present in git master. The 
> reproducer is easy:
>
> 1. Grab the machine ROM file from 
> https://www.ilande.co.uk/tmp/qemu/tQuadra800.rom
>
> 2. Create an empty declaration ROM greater than 4K:
>
>    dd if=/dev/zero of=/tmp/badrom bs=512 count=12
>
> 3. Start QEMU like this:
>
>    qemu-system-m68k -M q800 -bios tQuadra800.rom \
>        -device nubus-macfb,romfile=/tmp/badrom
>
> The QEMU process hits the assert() with the following backtrace:
>
> (gdb) bt
> #0  0x00007ffff58a9d3c in ?? () from /lib/x86_64-linux-gnu/libc.so.6
> #1  0x00007ffff585af32 in raise () from /lib/x86_64-linux-gnu/libc.so.6
> #2  0x00007ffff5845472 in abort () from /lib/x86_64-linux-gnu/libc.so.6
> #3  0x00007ffff5845395 in ?? () from /lib/x86_64-linux-gnu/libc.so.6
> #4  0x00007ffff5853e32 in __assert_fail () from 
> /lib/x86_64-linux-gnu/libc.so.6
> #5  0x0000555555942e0a in tlb_set_page_full (cpu=0x55555618d4a0, 
> mmu_idx=0, addr=4244631552, full=0x7fffe7d7f7c0) at 
> ../accel/tcg/cputlb.c:1171
> #6  0x00005555559432a0 in tlb_set_page_with_attrs (cpu=0x55555618d4a0, 
> addr=4244631552, paddr=4244631552, attrs=..., prot=7, mmu_idx=0, 
> size=4096) at ../accel/tcg/cputlb.c:1290
> #7  0x0000555555943305 in tlb_set_page (cpu=0x55555618d4a0, 
> addr=4244631552, paddr=4244631552, prot=7, mmu_idx=0, size=4096) at 
> ../accel/tcg/cputlb.c:1297
> #8  0x000055555588aade in m68k_cpu_tlb_fill (cs=0x55555618d4a0, 
> address=4244635647, size=1, qemu_access_type=MMU_DATA_LOAD, mmu_idx=0, 
> probe=false, retaddr=140734805255937) at ../target/m68k/helper.c:1018
> #9  0x0000555555943367 in tlb_fill (cpu=0x55555618d4a0, 
> addr=4244635647, size=1, access_type=MMU_DATA_LOAD, mmu_idx=0, 
> retaddr=140734805255937) at ../accel/tcg/cputlb.c:1315
> #10 0x0000555555945d78 in mmu_lookup1 (cpu=0x55555618d4a0, 
> data=0x7fffe7d7fa00, mmu_idx=0, access_type=MMU_DATA_LOAD, 
> ra=140734805255937) at ../accel/tcg/cputlb.c:1713
> #11 0x0000555555946081 in mmu_lookup (cpu=0x55555618d4a0, 
> addr=4244635647, oi=3712, ra=140734805255937, type=MMU_DATA_LOAD, 
> l=0x7fffe7d7fa00) at ../accel/tcg/cputlb.c:1803
> #12 0x000055555594742b in do_ld1_mmu (cpu=0x55555618d4a0, 
> addr=4244635647, oi=3712, ra=140734805255937, 
> access_type=MMU_DATA_LOAD) at ../accel/tcg/cputlb.c:2377
> #13 0x0000555555948f17 in helper_ldub_mmu (env=0x55555618fc60, 
> addr=4244635647, oi=3712, retaddr=140734805255937) at 
> ../accel/tcg/ldst_common.c.inc:19
> #14 0x00007fff6013286c in code_gen_buffer ()
> #15 0x00005555559308ff in cpu_tb_exec (cpu=0x55555618d4a0, 
> itb=0x7fffa0132480, tb_exit=0x7fffe7d80030) at 
> ../accel/tcg/cpu-exec.c:458
> #16 0x000055555593160a in cpu_loop_exec_tb (cpu=0x55555618d4a0, 
> tb=0x7fffa0132480, pc=1082158370, last_tb=0x7fffe7d80040, 
> tb_exit=0x7fffe7d80030) at ../accel/tcg/cpu-exec.c:920
> #17 0x000055555593196a in cpu_exec_loop (cpu=0x55555618d4a0, 
> sc=0x7fffe7d800c0) at ../accel/tcg/cpu-exec.c:1041
> #18 0x0000555555931a28 in cpu_exec_setjmp (cpu=0x55555618d4a0, 
> sc=0x7fffe7d800c0) at ../accel/tcg/cpu-exec.c:1058
> #19 0x0000555555931aaf in cpu_exec (cpu=0x55555618d4a0) at 
> ../accel/tcg/cpu-exec.c:1084
> #20 0x00005555559560ad in tcg_cpus_exec (cpu=0x55555618d4a0) at 
> ../accel/tcg/tcg-accel-ops.c:76
> #21 0x00005555559575c2 in rr_cpu_thread_fn (arg=0x55555618d4a0) at 
> ../accel/tcg/tcg-accel-ops-rr.c:261
> #22 0x0000555555b61f25 in qemu_thread_start (args=0x555556347a10) at 
> ../util/qemu-thread-posix.c:541
> #23 0x00007ffff58a8044 in ?? () from /lib/x86_64-linux-gnu/libc.so.6
> #24 0x00007ffff592861c in ?? () from /lib/x86_64-linux-gnu/libc.so.6
>
Hi Mark,

The  nubus-macfb device create a section not aligned to the 
TARGET_PAGE_BITS. That is the reason why it fails the assert. But that's 
OK. It is my error. I have sent a patch to de-assert it.  I am not sure 
whether it can be merged into the 8.2.

Thanks,
Zhiwei

>
> ATB,
>
> Mark.


^ permalink raw reply	[flat|nested] 4+ messages in thread

end of thread, other threads:[~2023-12-08  2:46 UTC | newest]

Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2023-09-01  6:01 [PATCH 1/1] accel/tcg: Fix the comment for CPUTLBEntryFull LIU Zhiwei
2023-09-09 21:31 ` Richard Henderson
2023-11-28 13:04 ` Mark Cave-Ayland
2023-12-08  2:44   ` LIU Zhiwei

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.