[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: Crash with CXL + TCG on 8.2: Was Re: qemu cxl memory expander shows
From: |
Gregory Price |
Subject: |
Re: Crash with CXL + TCG on 8.2: Was Re: qemu cxl memory expander shows numa_node -1 |
Date: |
Thu, 1 Feb 2024 13:56:09 -0500 |
On Thu, Feb 01, 2024 at 06:04:26PM +0000, Peter Maydell wrote:
> On Thu, 1 Feb 2024 at 17:25, Alex Bennée <alex.bennee@linaro.org> wrote:
> >
> > Jonathan Cameron <Jonathan.Cameron@Huawei.com> writes:
> > >> > #21 0x0000555555ca3e5d in do_st8_mmu (cpu=0x5555578e0cb0, addr=23937,
> > >> > val=18386491784638059520, oi=6, ra=140736029817822) at
> > >> > ../../accel/tcg/cputlb.c:2853
> > >> > #22 0x00007fffa9107c63 in code_gen_buffer ()
> > >>
> > >> No thats different - we are actually writing to the MMIO region here.
> > >> But the fact we hit cpu_abort because we can't find the TB we are
> > >> executing is a little problematic.
> > >>
> > >> Does ra properly point to the code buffer here?
> > >
> > > Err. How would I tell?
> >
> > (gdb) p/x 140736029817822
> > $1 = 0x7fffa9107bde
> >
> > seems off because code_gen_buffer starts at 0x00007fffa9107c63
>
> The code_gen_buffer doesn't *start* at 0x00007fffa9107c63 --
> that is our return address into it, which is to say it's just
> after the call insn to the do_st8_mmu helper. The 'ra' argument
> to the helper function is going to be a number slightly lower
> than that, because it points within the main lump of generated
> code for the TB, whereas the helper call is done as part of
> an out-of-line lump of common code at the end of the TB.
>
> The 'ra' here is fine -- the problem is that we don't
> pass it all the way down the callstack and instead end
> up using 0 as a 'ra' within the ptw code.
>
> -- PMM
Is there any particular reason not to, as below?
~Gregory
diff --git a/target/i386/tcg/sysemu/excp_helper.c
b/target/i386/tcg/sysemu/excp_helper.c
index 5b86f439ad..2f581b9bfb 100644
--- a/target/i386/tcg/sysemu/excp_helper.c
+++ b/target/i386/tcg/sysemu/excp_helper.c
@@ -59,14 +59,14 @@ typedef struct PTETranslate {
hwaddr gaddr;
} PTETranslate;
-static bool ptw_translate(PTETranslate *inout, hwaddr addr)
+static bool ptw_translate(PTETranslate *inout, hwaddr addr, uint64_t ra)
{
CPUTLBEntryFull *full;
int flags;
inout->gaddr = addr;
flags = probe_access_full(inout->env, addr, 0, MMU_DATA_STORE,
- inout->ptw_idx, true, &inout->haddr, &full, 0);
+ inout->ptw_idx, true, &inout->haddr, &full, ra);
if (unlikely(flags & TLB_INVALID_MASK)) {
TranslateFault *err = inout->err;
@@ -82,20 +82,20 @@ static bool ptw_translate(PTETranslate *inout, hwaddr addr)
return true;
}
-static inline uint32_t ptw_ldl(const PTETranslate *in)
+static inline uint32_t ptw_ldl(const PTETranslate *in, uint64_t ra)
{
if (likely(in->haddr)) {
return ldl_p(in->haddr);
}
- return cpu_ldl_mmuidx_ra(in->env, in->gaddr, in->ptw_idx, 0);
+ return cpu_ldl_mmuidx_ra(in->env, in->gaddr, in->ptw_idx, ra);
}
-static inline uint64_t ptw_ldq(const PTETranslate *in)
+static inline uint64_t ptw_ldq(const PTETranslate *in, uint64_t ra)
{
if (likely(in->haddr)) {
return ldq_p(in->haddr);
}
- return cpu_ldq_mmuidx_ra(in->env, in->gaddr, in->ptw_idx, 0);
+ return cpu_ldq_mmuidx_ra(in->env, in->gaddr, in->ptw_idx, ra);
}
/*
@@ -132,7 +132,8 @@ static inline bool ptw_setl(const PTETranslate *in,
uint32_t old, uint32_t set)
}
static bool mmu_translate(CPUX86State *env, const TranslateParams *in,
- TranslateResult *out, TranslateFault *err)
+ TranslateResult *out, TranslateFault *err,
+ uint64_t ra)
{
const int32_t a20_mask = x86_get_a20_mask(env);
const target_ulong addr = in->addr;
@@ -166,11 +167,11 @@ static bool mmu_translate(CPUX86State *env, const
TranslateParams *in,
*/
pte_addr = ((in->cr3 & ~0xfff) +
(((addr >> 48) & 0x1ff) << 3)) & a20_mask;
- if (!ptw_translate(&pte_trans, pte_addr)) {
+ if (!ptw_translate(&pte_trans, pte_addr, ra)) {
return false;
}
restart_5:
- pte = ptw_ldq(&pte_trans);
+ pte = ptw_ldq(&pte_trans, ra);
if (!(pte & PG_PRESENT_MASK)) {
goto do_fault;
}
@@ -191,11 +192,11 @@ static bool mmu_translate(CPUX86State *env, const
TranslateParams *in,
*/
pte_addr = ((pte & PG_ADDRESS_MASK) +
(((addr >> 39) & 0x1ff) << 3)) & a20_mask;
- if (!ptw_translate(&pte_trans, pte_addr)) {
+ if (!ptw_translate(&pte_trans, pte_addr, ra)) {
return false;
}
restart_4:
- pte = ptw_ldq(&pte_trans);
+ pte = ptw_ldq(&pte_trans, ra);
if (!(pte & PG_PRESENT_MASK)) {
goto do_fault;
}
@@ -212,11 +213,11 @@ static bool mmu_translate(CPUX86State *env, const
TranslateParams *in,
*/
pte_addr = ((pte & PG_ADDRESS_MASK) +
(((addr >> 30) & 0x1ff) << 3)) & a20_mask;
- if (!ptw_translate(&pte_trans, pte_addr)) {
+ if (!ptw_translate(&pte_trans, pte_addr, ra)) {
return false;
}
restart_3_lma:
- pte = ptw_ldq(&pte_trans);
+ pte = ptw_ldq(&pte_trans, ra);
if (!(pte & PG_PRESENT_MASK)) {
goto do_fault;
}
@@ -239,12 +240,12 @@ static bool mmu_translate(CPUX86State *env, const
TranslateParams *in,
* Page table level 3
*/
pte_addr = ((in->cr3 & ~0x1f) + ((addr >> 27) & 0x18)) & a20_mask;
- if (!ptw_translate(&pte_trans, pte_addr)) {
+ if (!ptw_translate(&pte_trans, pte_addr, ra)) {
return false;
}
rsvd_mask |= PG_HI_USER_MASK;
restart_3_nolma:
- pte = ptw_ldq(&pte_trans);
+ pte = ptw_ldq(&pte_trans, ra);
if (!(pte & PG_PRESENT_MASK)) {
goto do_fault;
}
@@ -262,11 +263,11 @@ static bool mmu_translate(CPUX86State *env, const
TranslateParams *in,
*/
pte_addr = ((pte & PG_ADDRESS_MASK) +
(((addr >> 21) & 0x1ff) << 3)) & a20_mask;
- if (!ptw_translate(&pte_trans, pte_addr)) {
+ if (!ptw_translate(&pte_trans, pte_addr, ra)) {
return false;
}
restart_2_pae:
- pte = ptw_ldq(&pte_trans);
+ pte = ptw_ldq(&pte_trans, ra);
if (!(pte & PG_PRESENT_MASK)) {
goto do_fault;
}
@@ -289,10 +290,10 @@ static bool mmu_translate(CPUX86State *env, const
TranslateParams *in,
*/
pte_addr = ((pte & PG_ADDRESS_MASK) +
(((addr >> 12) & 0x1ff) << 3)) & a20_mask;
- if (!ptw_translate(&pte_trans, pte_addr)) {
+ if (!ptw_translate(&pte_trans, pte_addr, ra)) {
return false;
}
- pte = ptw_ldq(&pte_trans);
+ pte = ptw_ldq(&pte_trans, ra);
if (!(pte & PG_PRESENT_MASK)) {
goto do_fault;
}
@@ -307,11 +308,11 @@ static bool mmu_translate(CPUX86State *env, const
TranslateParams *in,
* Page table level 2
*/
pte_addr = ((in->cr3 & ~0xfff) + ((addr >> 20) & 0xffc)) & a20_mask;
- if (!ptw_translate(&pte_trans, pte_addr)) {
+ if (!ptw_translate(&pte_trans, pte_addr, ra)) {
return false;
}
restart_2_nopae:
- pte = ptw_ldl(&pte_trans);
+ pte = ptw_ldl(&pte_trans, ra);
if (!(pte & PG_PRESENT_MASK)) {
goto do_fault;
}
@@ -336,10 +337,10 @@ static bool mmu_translate(CPUX86State *env, const
TranslateParams *in,
* Page table level 1
*/
pte_addr = ((pte & ~0xfffu) + ((addr >> 10) & 0xffc)) & a20_mask;
- if (!ptw_translate(&pte_trans, pte_addr)) {
+ if (!ptw_translate(&pte_trans, pte_addr, ra)) {
return false;
}
- pte = ptw_ldl(&pte_trans);
+ pte = ptw_ldl(&pte_trans, ra);
if (!(pte & PG_PRESENT_MASK)) {
goto do_fault;
}
@@ -529,7 +530,8 @@ static G_NORETURN void raise_stage2(CPUX86State *env,
TranslateFault *err,
static bool get_physical_address(CPUX86State *env, vaddr addr,
MMUAccessType access_type, int mmu_idx,
- TranslateResult *out, TranslateFault *err)
+ TranslateResult *out, TranslateFault *err,
+ uint64_t ra)
{
TranslateParams in;
bool use_stage2 = env->hflags2 & HF2_NPT_MASK;
@@ -548,7 +550,7 @@ static bool get_physical_address(CPUX86State *env, vaddr
addr,
in.mmu_idx = MMU_USER_IDX;
in.ptw_idx = MMU_PHYS_IDX;
- if (!mmu_translate(env, &in, out, err)) {
+ if (!mmu_translate(env, &in, out, err, ra)) {
err->stage2 = S2_GPA;
return false;
}
@@ -575,7 +577,7 @@ static bool get_physical_address(CPUX86State *env, vaddr
addr,
return false;
}
}
- return mmu_translate(env, &in, out, err);
+ return mmu_translate(env, &in, out, err, ra);
}
break;
}
@@ -601,7 +603,7 @@ bool x86_cpu_tlb_fill(CPUState *cs, vaddr addr, int size,
TranslateResult out;
TranslateFault err;
- if (get_physical_address(env, addr, access_type, mmu_idx, &out, &err)) {
+ if (get_physical_address(env, addr, access_type, mmu_idx, &out, &err,
retaddr)) {
/*
* Even if 4MB pages, we map only one 4KB page in the cache to
* avoid filling it too fast.
- Re: Crash with CXL + TCG on 8.2: Was Re: qemu cxl memory expander shows numa_node -1, (continued)
- Re: Crash with CXL + TCG on 8.2: Was Re: qemu cxl memory expander shows numa_node -1, Alex Bennée, 2024/02/01
- Re: Crash with CXL + TCG on 8.2: Was Re: qemu cxl memory expander shows numa_node -1, Jonathan Cameron, 2024/02/01
- Re: Crash with CXL + TCG on 8.2: Was Re: qemu cxl memory expander shows numa_node -1, Peter Maydell, 2024/02/01
- Re: Crash with CXL + TCG on 8.2: Was Re: qemu cxl memory expander shows numa_node -1, Jonathan Cameron, 2024/02/01
- Re: Crash with CXL + TCG on 8.2: Was Re: qemu cxl memory expander shows numa_node -1, Alex Bennée, 2024/02/01
- Re: Crash with CXL + TCG on 8.2: Was Re: qemu cxl memory expander shows numa_node -1, Jonathan Cameron, 2024/02/01
- Re: Crash with CXL + TCG on 8.2: Was Re: qemu cxl memory expander shows numa_node -1, Peter Maydell, 2024/02/01
- Re: Crash with CXL + TCG on 8.2: Was Re: qemu cxl memory expander shows numa_node -1, Jonathan Cameron, 2024/02/01
- Re: Crash with CXL + TCG on 8.2: Was Re: qemu cxl memory expander shows numa_node -1, Alex Bennée, 2024/02/01
- Re: Crash with CXL + TCG on 8.2: Was Re: qemu cxl memory expander shows numa_node -1, Peter Maydell, 2024/02/01
- Re: Crash with CXL + TCG on 8.2: Was Re: qemu cxl memory expander shows numa_node -1,
Gregory Price <=
- Re: Crash with CXL + TCG on 8.2: Was Re: qemu cxl memory expander shows numa_node -1, Jonathan Cameron, 2024/02/02
- Re: Crash with CXL + TCG on 8.2: Was Re: qemu cxl memory expander shows numa_node -1, Peter Maydell, 2024/02/02
- Re: Crash with CXL + TCG on 8.2: Was Re: qemu cxl memory expander shows numa_node -1, Gregory Price, 2024/02/02
- Re: Crash with CXL + TCG on 8.2: Was Re: qemu cxl memory expander shows numa_node -1, Peter Maydell, 2024/02/02
- Re: Crash with CXL + TCG on 8.2: Was Re: qemu cxl memory expander shows numa_node -1, Jonathan Cameron, 2024/02/07
- Re: Crash with CXL + TCG on 8.2: Was Re: qemu cxl memory expander shows numa_node -1, Jonathan Cameron, 2024/02/08
- Re: Crash with CXL + TCG on 8.2: Was Re: qemu cxl memory expander shows numa_node -1, Jonathan Cameron, 2024/02/15
- Re: Crash with CXL + TCG on 8.2: Was Re: qemu cxl memory expander shows numa_node -1, Mattias Nissler, 2024/02/19
- Re: Crash with CXL + TCG on 8.2: Was Re: qemu cxl memory expander shows numa_node -1, Gregory Price, 2024/02/01
- Re: Crash with CXL + TCG on 8.2: Was Re: qemu cxl memory expander shows numa_node -1, Peter Maydell, 2024/02/01