Re: [PULL 30/33] tcg: Allocate sufficient storage in temp_allocate_frame

From: "Daniel P. Berrangé" <berrange@redhat.com>
To: "Richard W.M. Jones" <rjones@redhat.com>
Cc: peter.maydell@linaro.org, "Stefan Weil" <sw@weilnetz.de>,
	qemu-stable@nongnu.org,
	"Richard Henderson" <richard.henderson@linaro.org>,
	qemu-devel@nongnu.org, "Philippe Mathieu-Daudé" <f4bug@amsat.org>
Subject: Re: [PULL 30/33] tcg: Allocate sufficient storage in temp_allocate_frame
Date: Wed, 1 Sep 2021 13:55:20 +0100	[thread overview]
Message-ID: <YS94OImIRPOh+KSN@redhat.com> (raw)
In-Reply-To: <20210901105231.GA719@redhat.com>

On Wed, Sep 01, 2021 at 11:52:31AM +0100, Richard W.M. Jones wrote:
> On Sat, Jun 19, 2021 at 11:14:49AM -0700, Richard Henderson wrote:
> > This function should have been updated for vector types
> > when they were introduced.
> > 
> > Fixes: d2fd745fe8b
> > Resolves: https://gitlab.com/qemu-project/qemu/-/issues/367
> > Cc: qemu-stable@nongnu.org
> > Tested-by: Stefan Weil <sw@weilnetz.de>
> > Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
> > Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
> > ---
> >  tcg/tcg.c | 32 +++++++++++++++++++++++++++-----
> >  1 file changed, 27 insertions(+), 5 deletions(-)
> > 
> ...
> > +    assert(align <= TCG_TARGET_STACK_ALIGN);
> 
> This assertion is triggering:
> https://bugzilla.redhat.com/show_bug.cgi?id=1999878
> 
> It happens when the kernel is booting after this line:
> 
>   [    7.315373] Loading compiled-in X.509 certificates
> 
> If everything was working then the next line of output *should* be:
> 
>   Loaded X.509 cert 'Fedora kernel signing key: 65d4930f94e951d5c1531017b9559872a4e7b0b0'
> 
> but instead it is:
> 
>   [    7.183521] ThumbEE CPU extension supported.
>   [    7.186066] Registering SWP/SWPB emulation handler
>   [    7.304374] registered taskstats version 1
>   [    7.315373] Loading compiled-in X.509 certificates
>   qemu-system-arm: ../tcg/tcg.c:3063: temp_allocate_frame: Assertion `align <= TCG_TARGET_STACK_ALIGN' failed.
> 
> Unfortunately I don't have an easy reproducer.  It reproduces very
> reliably in Fedora's build system (qemu 6.1.0 running a TCG armv7 L2
> guest on armv7 L1 host on unknown aarch64 L0 host).  But my attempts
> to perform the same operation anywhere else don't reproduce the
> problem.
> 
> What does the assertion mean?

For arm we can see the TCG_TARGET_STACK_ALIGN value is 8:

  $ git grep TARGET_STACK_ALIGN | grep define | grep arm
  tcg/arm/tcg-target.h:#define TCG_TARGET_STACK_ALIGN		8

The value of 'align' can be larger than that though:

    switch (ts->type) {
    case TCG_TYPE_I32:
        size = align = 4;
        break;
    case TCG_TYPE_I64:
    case TCG_TYPE_V64:
        size = align = 8;
        break;
    case TCG_TYPE_V128:
        size = align = 16;
        break;
    case TCG_TYPE_V256:
        /* Note that we do not require aligned storage for V256. */
        size = 32, align = 16;

So something in TCG arm host/guest is triggering usage
of TCG_TYPE_V128 or TCG_TYPE_V256 types, and thus violating
the assert.

Either the assert is bogus, or TCG arm host/guest should not
be using those types that imply 16 byte alignment.

Regards,
Daniel
-- 
|: https://berrange.com      -o-    https://www.flickr.com/photos/dberrange :|
|: https://libvirt.org         -o-            https://fstop138.berrange.com :|
|: https://entangle-photo.org    -o-    https://www.instagram.com/dberrange :|