[Qemu-devel] [PATCH 2/2] ppc: Fix tlb invalidations on 6xx/7xx/7xxx 32-bit processors

[Qemu-devel] [PATCH 2/2] ppc: Fix tlb invalidations on 6xx/7xx/7xxx 32-bit processors

[Benjamin Herrenschmidt]

The processor only uses some bits of the address and invalidates an
entire congruence class. Some OSes such as Darwin and HelenOS take
advantage of this and occasionally invalidate the entire TLB by just
doing a series of 64 consecutive tlbie for example.

Our code tries to be too smart here only invalidating a segment
congruence class (ie, allowing more address bits to be relevant
in the invalidation), this fails miserably on those OSes.

Instead don't bother, do like ppc64 and blow the whole tlb when tlbie
is executed.

Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
---
 target-ppc/mmu_helper.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/target-ppc/mmu_helper.c b/target-ppc/mmu_helper.c
index f5c4e69..a5e3878 100644
--- a/target-ppc/mmu_helper.c
+++ b/target-ppc/mmu_helper.c
@@ -1969,6 +1969,11 @@ void ppc_tlb_invalidate_one(CPUPPCState *env, target_ulong addr)
         /* XXX: this case should be optimized,
          * giving a mask to tlb_flush_page
          */
+        /* This is broken, some CPUs invalidate a whole congruence
+         * class on an even smaller subset of bits and some OSes take
+         * advantage of this. Just blow the whole thing away.
+         */
+#if 0
         tlb_flush_page(cs, addr | (0x0 << 28));
         tlb_flush_page(cs, addr | (0x1 << 28));
         tlb_flush_page(cs, addr | (0x2 << 28));
@@ -1985,6 +1990,9 @@ void ppc_tlb_invalidate_one(CPUPPCState *env, target_ulong addr)
         tlb_flush_page(cs, addr | (0xD << 28));
         tlb_flush_page(cs, addr | (0xE << 28));
         tlb_flush_page(cs, addr | (0xF << 28));
+#else
+        tlb_flush(cs, 1);
+#endif
         break;
 #if defined(TARGET_PPC64)
     case POWERPC_MMU_64B:

Re: [Qemu-devel] [PATCH 2/2] ppc: Fix tlb invalidations on 6xx/7xx/7xxx 32-bit processors

[Cédric Le Goater]

On 06/06/2016 11:52 AM, Benjamin Herrenschmidt wrote:
> The processor only uses some bits of the address and invalidates an
> entire congruence class. Some OSes such as Darwin and HelenOS take
> advantage of this and occasionally invalidate the entire TLB by just
> doing a series of 64 consecutive tlbie for example.
> 
> Our code tries to be too smart here only invalidating a segment
> congruence class (ie, allowing more address bits to be relevant
> in the invalidation), this fails miserably on those OSes.
> 
> Instead don't bother, do like ppc64 and blow the whole tlb when tlbie
> is executed.
> 
> Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>

Looks good on G3 and G4 running macosx10.2 and macosx10.4.

Tested-by: Cédric Le Goater <clg@kaod.org>

> ---
>  target-ppc/mmu_helper.c | 8 ++++++++
>  1 file changed, 8 insertions(+)
> 
> diff --git a/target-ppc/mmu_helper.c b/target-ppc/mmu_helper.c
> index f5c4e69..a5e3878 100644
> --- a/target-ppc/mmu_helper.c
> +++ b/target-ppc/mmu_helper.c
> @@ -1969,6 +1969,11 @@ void ppc_tlb_invalidate_one(CPUPPCState *env, target_ulong addr)
>          /* XXX: this case should be optimized,
>           * giving a mask to tlb_flush_page
>           */
> +        /* This is broken, some CPUs invalidate a whole congruence
> +         * class on an even smaller subset of bits and some OSes take
> +         * advantage of this. Just blow the whole thing away.
> +         */
> +#if 0
>          tlb_flush_page(cs, addr | (0x0 << 28));
>          tlb_flush_page(cs, addr | (0x1 << 28));
>          tlb_flush_page(cs, addr | (0x2 << 28));
> @@ -1985,6 +1990,9 @@ void ppc_tlb_invalidate_one(CPUPPCState *env, target_ulong addr)
>          tlb_flush_page(cs, addr | (0xD << 28));
>          tlb_flush_page(cs, addr | (0xE << 28));
>          tlb_flush_page(cs, addr | (0xF << 28));
> +#else
> +        tlb_flush(cs, 1);
> +#endif
>          break;
>  #if defined(TARGET_PPC64)
>      case POWERPC_MMU_64B:
> 
> 

Re: [Qemu-devel] [PATCH 2/2] ppc: Fix tlb invalidations on 6xx/7xx/7xxx 32-bit processors

[David Gibson]

[-- Attachment #1: Type: text/plain, Size: 2412 bytes --]

On Mon, Jun 06, 2016 at 07:52:48PM +1000, Benjamin Herrenschmidt wrote:
> The processor only uses some bits of the address and invalidates an
> entire congruence class. Some OSes such as Darwin and HelenOS take
> advantage of this and occasionally invalidate the entire TLB by just
> doing a series of 64 consecutive tlbie for example.
> 
> Our code tries to be too smart here only invalidating a segment
> congruence class (ie, allowing more address bits to be relevant
> in the invalidation), this fails miserably on those OSes.
> 
> Instead don't bother, do like ppc64 and blow the whole tlb when tlbie
> is executed.
> 
> Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>

Ugh, this patch too is showing as corrupt for me.  I suspect the
problem is on my end, but I have no idea what, yet.


The concept looks good here, but I don't see much point to keeping the
old broken code around under the #if 0.  I'll rewite accordingly and merge.

> ---
>  target-ppc/mmu_helper.c | 8 ++++++++
>  1 file changed, 8 insertions(+)
> 
> diff --git a/target-ppc/mmu_helper.c b/target-ppc/mmu_helper.c
> index f5c4e69..a5e3878 100644
> --- a/target-ppc/mmu_helper.c
> +++ b/target-ppc/mmu_helper.c
> @@ -1969,6 +1969,11 @@ void ppc_tlb_invalidate_one(CPUPPCState *env, target_ulong addr)
>          /* XXX: this case should be optimized,
>           * giving a mask to tlb_flush_page
>           */
> +        /* This is broken, some CPUs invalidate a whole congruence
> +         * class on an even smaller subset of bits and some OSes take
> +         * advantage of this. Just blow the whole thing away.
> +         */
> +#if 0
>          tlb_flush_page(cs, addr | (0x0 << 28));
>          tlb_flush_page(cs, addr | (0x1 << 28));
>          tlb_flush_page(cs, addr | (0x2 << 28));
> @@ -1985,6 +1990,9 @@ void ppc_tlb_invalidate_one(CPUPPCState *env, target_ulong addr)
>          tlb_flush_page(cs, addr | (0xD << 28));
>          tlb_flush_page(cs, addr | (0xE << 28));
>          tlb_flush_page(cs, addr | (0xF << 28));
> +#else
> +        tlb_flush(cs, 1);
> +#endif
>          break;
>  #if defined(TARGET_PPC64)
>      case POWERPC_MMU_64B:
> 
> 

-- 
David Gibson			| I'll have my music baroque, and my code
david AT gibson.dropbear.id.au	| minimalist, thank you.  NOT _the_ _other_
				| _way_ _around_!
http://www.ozlabs.org/~dgibson

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 819 bytes --]

Re: [Qemu-devel] [PATCH 2/2] ppc: Fix tlb invalidations on 6xx/7xx/7xxx 32-bit processors

[Benjamin Herrenschmidt]

On Tue, 2016-06-07 at 11:40 +1000, David Gibson wrote:
> Ugh, this patch too is showing as corrupt for me.  I suspect the
> problem is on my end, but I have no idea what, yet.

No it's on mine. The latest update of evolution in Fedora broke sending
patches :-(

It unconditionally replaces 2 or more consecutive spaces with some
unicode non-breakable space character even in text/plain and preformat
mode. Ugh...

I'll resend the whole lot later today using git-send-email

> The concept looks good here, but I don't see much point to keeping the
> old broken code around under the #if 0.  I'll rewite accordingly and merge.

Don't bother, my next patch that does the batching takes it out.

Cheers,
Ben.