[Qemu-devel] [PULL 0/4] tcg queued patches

[Qemu-devel] [PULL 0/4] tcg queued patches

[Richard Henderson]

The following changes since commit a044e3de2917d54b95f1211f4d14ec30cac9a59f:

  Merge remote-tracking branch 'remotes/stsquad/tags/pull-testing-next-110219-1' into staging (2019-02-11 14:47:44 +0000)

are available in the Git repository at:

  https://github.com/rth7680/qemu.git tags/pull-tcg-20190211

for you to fetch changes up to 6d967cb86d5b4a60ba15b497126b621ce9ca6609:

  cputlb: update TLB entry/index after tlb_fill (2019-02-11 08:52:44 -0800)

----------------------------------------------------------------
Fix dynamic tlb resize
Fix x86 host vector saturation
Diagnose missing tcg labels

----------------------------------------------------------------
Emilio G. Cota (2):
      exec-all: document that tlb_fill can trigger a TLB resize
      cputlb: update TLB entry/index after tlb_fill

Mark Cave-Ayland (1):
      tcg/i386: fix unsigned vector saturating arithmetic

Richard Henderson (1):
      tcg: Diagnose referenced labels that have not been emitted

 accel/tcg/softmmu_template.h |  8 ++++++++
 include/exec/exec-all.h      |  5 +++++
 tcg/tcg-op.h                 |  1 +
 tcg/tcg.h                    | 12 +++++++++---
 accel/tcg/cputlb.c           |  4 ++++
 tcg/i386/tcg-target.inc.c    |  4 ++--
 tcg/tcg.c                    | 23 +++++++++++++++++++++++
 7 files changed, 52 insertions(+), 5 deletions(-)

[Qemu-devel] [PULL 1/4] tcg: Diagnose referenced labels that have not been emitted

[Richard Henderson]

Currently, a jump to a label that is not defined anywhere will
be emitted not be relocated.  This results in a jump to a random
jump target.  With tcg debugging, print a diagnostic to the -d op
file and abort.

This could help debug or detect errors like
c2d9644e6d ("target/arm: Fix crash on conditional instruction in an IT block")

Reported-by: Roman Kapl <code@rkapl.cz>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/tcg-op.h |  1 +
 tcg/tcg.h    | 12 +++++++++---
 tcg/tcg.c    | 23 +++++++++++++++++++++++
 3 files changed, 33 insertions(+), 3 deletions(-)

diff --git a/tcg/tcg-op.h b/tcg/tcg-op.h
index 2d98868d8f..d3e51b15af 100644
--- a/tcg/tcg-op.h
+++ b/tcg/tcg-op.h
@@ -255,6 +255,7 @@ static inline void tcg_gen_op6ii_i64(TCGOpcode opc, TCGv_i64 a1, TCGv_i64 a2,
 
 static inline void gen_set_label(TCGLabel *l)
 {
+    l->present = 1;
     tcg_gen_op1(INDEX_op_set_label, label_arg(l));
 }
 
diff --git a/tcg/tcg.h b/tcg/tcg.h
index 045c24a357..32b7cf3489 100644
--- a/tcg/tcg.h
+++ b/tcg/tcg.h
@@ -244,16 +244,21 @@ typedef struct TCGRelocation {
     intptr_t addend;
 } TCGRelocation; 
 
-typedef struct TCGLabel {
+typedef struct TCGLabel TCGLabel;
+struct TCGLabel {
+    unsigned present : 1;
     unsigned has_value : 1;
-    unsigned id : 15;
+    unsigned id : 14;
     unsigned refs : 16;
     union {
         uintptr_t value;
         tcg_insn_unit *value_ptr;
         TCGRelocation *first_reloc;
     } u;
-} TCGLabel;
+#ifdef CONFIG_DEBUG_TCG
+    QSIMPLEQ_ENTRY(TCGLabel) next;
+#endif
+};
 
 typedef struct TCGPool {
     struct TCGPool *next;
@@ -685,6 +690,7 @@ struct TCGContext {
 #endif
 
 #ifdef CONFIG_DEBUG_TCG
+    QSIMPLEQ_HEAD(, TCGLabel) labels;
     int temps_in_use;
     int goto_tb_issue_mask;
 #endif
diff --git a/tcg/tcg.c b/tcg/tcg.c
index 20a5d8f315..9b2bf7f439 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -305,6 +305,9 @@ TCGLabel *gen_new_label(void)
     *l = (TCGLabel){
         .id = s->nb_labels++
     };
+#ifdef CONFIG_DEBUG_TCG
+    QSIMPLEQ_INSERT_TAIL(&s->labels, l, next);
+#endif
 
     return l;
 }
@@ -1092,6 +1095,9 @@ void tcg_func_start(TCGContext *s)
 
     QTAILQ_INIT(&s->ops);
     QTAILQ_INIT(&s->free_ops);
+#ifdef CONFIG_DEBUG_TCG
+    QSIMPLEQ_INIT(&s->labels);
+#endif
 }
 
 static inline TCGTemp *tcg_temp_alloc(TCGContext *s)
@@ -3841,6 +3847,23 @@ int tcg_gen_code(TCGContext *s, TranslationBlock *tb)
     }
 #endif
 
+#ifdef CONFIG_DEBUG_TCG
+    /* Ensure all labels referenced have been emitted.  */
+    {
+        TCGLabel *l;
+        bool error = false;
+
+        QSIMPLEQ_FOREACH(l, &s->labels, next) {
+            if (unlikely(!l->present) && l->refs) {
+                qemu_log_mask(CPU_LOG_TB_OP,
+                              "$L%d referenced but not present.\n", l->id);
+                error = true;
+            }
+        }
+        assert(!error);
+    }
+#endif
+
 #ifdef CONFIG_PROFILER
     atomic_set(&prof->opt_time, prof->opt_time - profile_getclock());
 #endif
-- 
2.17.2

[Qemu-devel] [PULL 2/4] tcg/i386: fix unsigned vector saturating arithmetic

[Richard Henderson]

From: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>

Due to a cut/paste error in the original implementation, the unsigned
vector saturating arithmetic was erroneously being calculated as signed
vector saturating arithmetic.

Fixes: 8ffafbcec2 ("tcg/i386: Implement vector saturating arithmetic")
Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Message-Id: <20190207224258.426-1-mark.cave-ayland@ilande.co.uk>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/i386/tcg-target.inc.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/tcg/i386/tcg-target.inc.c b/tcg/i386/tcg-target.inc.c
index 4d84aea3a9..e0670e5098 100644
--- a/tcg/i386/tcg-target.inc.c
+++ b/tcg/i386/tcg-target.inc.c
@@ -2615,7 +2615,7 @@ static void tcg_out_vec_op(TCGContext *s, TCGOpcode opc,
         OPC_PADDSB, OPC_PADDSW, OPC_UD2, OPC_UD2
     };
     static int const usadd_insn[4] = {
-        OPC_PADDSB, OPC_PADDSW, OPC_UD2, OPC_UD2
+        OPC_PADDUB, OPC_PADDUW, OPC_UD2, OPC_UD2
     };
     static int const sub_insn[4] = {
         OPC_PSUBB, OPC_PSUBW, OPC_PSUBD, OPC_PSUBQ
@@ -2624,7 +2624,7 @@ static void tcg_out_vec_op(TCGContext *s, TCGOpcode opc,
         OPC_PSUBSB, OPC_PSUBSW, OPC_UD2, OPC_UD2
     };
     static int const ussub_insn[4] = {
-        OPC_PSUBSB, OPC_PSUBSW, OPC_UD2, OPC_UD2
+        OPC_PSUBUB, OPC_PSUBUW, OPC_UD2, OPC_UD2
     };
     static int const mul_insn[4] = {
         OPC_UD2, OPC_PMULLW, OPC_PMULLD, OPC_UD2
-- 
2.17.2

[Qemu-devel] [PULL 3/4] exec-all: document that tlb_fill can trigger a TLB resize

[Richard Henderson]

From: "Emilio G. Cota" <cota@braap.org>

Signed-off-by: Emilio G. Cota <cota@braap.org>
Message-Id: <20190209162745.12668-2-cota@braap.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/exec/exec-all.h | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/include/exec/exec-all.h b/include/exec/exec-all.h
index aa7b81aaf0..97b90cb0db 100644
--- a/include/exec/exec-all.h
+++ b/include/exec/exec-all.h
@@ -475,6 +475,11 @@ static inline void assert_no_pages_locked(void)
 struct MemoryRegionSection *iotlb_to_section(CPUState *cpu,
                                              hwaddr index, MemTxAttrs attrs);
 
+/*
+ * Note: tlb_fill() can trigger a resize of the TLB. This means that all of the
+ * caller's prior references to the TLB table (e.g. CPUTLBEntry pointers) must
+ * be discarded and looked up again (e.g. via tlb_entry()).
+ */
 void tlb_fill(CPUState *cpu, target_ulong addr, int size,
               MMUAccessType access_type, int mmu_idx, uintptr_t retaddr);
 
-- 
2.17.2

[Qemu-devel] [PULL 4/4] cputlb: update TLB entry/index after tlb_fill

[Richard Henderson]

From: "Emilio G. Cota" <cota@braap.org>

We are failing to take into account that tlb_fill() can cause a
TLB resize, which renders prior TLB entry pointers/indices stale.
Fix it by re-doing the TLB entry lookups immediately after tlb_fill.

Fixes: 86e1eff8bc ("tcg: introduce dynamic TLB sizing", 2019-01-28)
Reported-by: Max Filippov <jcmvbkbc@gmail.com>
Tested-by: Max Filippov <jcmvbkbc@gmail.com>
Signed-off-by: Emilio G. Cota <cota@braap.org>
Message-Id: <20190209162745.12668-3-cota@braap.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/softmmu_template.h | 8 ++++++++
 accel/tcg/cputlb.c           | 4 ++++
 2 files changed, 12 insertions(+)

diff --git a/accel/tcg/softmmu_template.h b/accel/tcg/softmmu_template.h
index 1fdd262ea4..e970a8b378 100644
--- a/accel/tcg/softmmu_template.h
+++ b/accel/tcg/softmmu_template.h
@@ -129,6 +129,8 @@ WORD_TYPE helper_le_ld_name(CPUArchState *env, target_ulong addr,
         if (!VICTIM_TLB_HIT(ADDR_READ, addr)) {
             tlb_fill(ENV_GET_CPU(env), addr, DATA_SIZE, READ_ACCESS_TYPE,
                      mmu_idx, retaddr);
+            index = tlb_index(env, mmu_idx, addr);
+            entry = tlb_entry(env, mmu_idx, addr);
         }
         tlb_addr = entry->ADDR_READ;
     }
@@ -198,6 +200,8 @@ WORD_TYPE helper_be_ld_name(CPUArchState *env, target_ulong addr,
         if (!VICTIM_TLB_HIT(ADDR_READ, addr)) {
             tlb_fill(ENV_GET_CPU(env), addr, DATA_SIZE, READ_ACCESS_TYPE,
                      mmu_idx, retaddr);
+            index = tlb_index(env, mmu_idx, addr);
+            entry = tlb_entry(env, mmu_idx, addr);
         }
         tlb_addr = entry->ADDR_READ;
     }
@@ -294,6 +298,8 @@ void helper_le_st_name(CPUArchState *env, target_ulong addr, DATA_TYPE val,
         if (!VICTIM_TLB_HIT(addr_write, addr)) {
             tlb_fill(ENV_GET_CPU(env), addr, DATA_SIZE, MMU_DATA_STORE,
                      mmu_idx, retaddr);
+            index = tlb_index(env, mmu_idx, addr);
+            entry = tlb_entry(env, mmu_idx, addr);
         }
         tlb_addr = tlb_addr_write(entry) & ~TLB_INVALID_MASK;
     }
@@ -372,6 +378,8 @@ void helper_be_st_name(CPUArchState *env, target_ulong addr, DATA_TYPE val,
         if (!VICTIM_TLB_HIT(addr_write, addr)) {
             tlb_fill(ENV_GET_CPU(env), addr, DATA_SIZE, MMU_DATA_STORE,
                      mmu_idx, retaddr);
+            index = tlb_index(env, mmu_idx, addr);
+            entry = tlb_entry(env, mmu_idx, addr);
         }
         tlb_addr = tlb_addr_write(entry) & ~TLB_INVALID_MASK;
     }
diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
index f580e4dd7e..88cc8389e9 100644
--- a/accel/tcg/cputlb.c
+++ b/accel/tcg/cputlb.c
@@ -1045,6 +1045,8 @@ tb_page_addr_t get_page_addr_code(CPUArchState *env, target_ulong addr)
     if (unlikely(!tlb_hit(entry->addr_code, addr))) {
         if (!VICTIM_TLB_HIT(addr_code, addr)) {
             tlb_fill(ENV_GET_CPU(env), addr, 0, MMU_INST_FETCH, mmu_idx, 0);
+            index = tlb_index(env, mmu_idx, addr);
+            entry = tlb_entry(env, mmu_idx, addr);
         }
         assert(tlb_hit(entry->addr_code, addr));
     }
@@ -1125,6 +1127,8 @@ static void *atomic_mmu_lookup(CPUArchState *env, target_ulong addr,
         if (!VICTIM_TLB_HIT(addr_write, addr)) {
             tlb_fill(ENV_GET_CPU(env), addr, 1 << s_bits, MMU_DATA_STORE,
                      mmu_idx, retaddr);
+            index = tlb_index(env, mmu_idx, addr);
+            tlbe = tlb_entry(env, mmu_idx, addr);
         }
         tlb_addr = tlb_addr_write(tlbe) & ~TLB_INVALID_MASK;
     }
-- 
2.17.2

Re: [Qemu-devel] [PULL 0/4] tcg queued patches

[Peter Maydell]

On Mon, 11 Feb 2019 at 17:01, Richard Henderson
<richard.henderson@linaro.org> wrote:
>
> The following changes since commit a044e3de2917d54b95f1211f4d14ec30cac9a59f:
>
>   Merge remote-tracking branch 'remotes/stsquad/tags/pull-testing-next-110219-1' into staging (2019-02-11 14:47:44 +0000)
>
> are available in the Git repository at:
>
>   https://github.com/rth7680/qemu.git tags/pull-tcg-20190211
>
> for you to fetch changes up to 6d967cb86d5b4a60ba15b497126b621ce9ca6609:
>
>   cputlb: update TLB entry/index after tlb_fill (2019-02-11 08:52:44 -0800)
>
> ----------------------------------------------------------------
> Fix dynamic tlb resize
> Fix x86 host vector saturation
> Diagnose missing tcg labels
>

Applied, thanks.

Please update the changelog at https://wiki.qemu.org/ChangeLog/4.0
for any user-visible changes.

-- PMM

[Qemu-devel] [PULL 0/4] TCG queued patches

[Richard Henderson]

This includes a fix for the tcg/arm bug exposed by the ppc64 code change
for comparisons.

It also includes improvements to tcg/arm and tcg/ppc to allow for larger
CPUFooState structures, as exposed by expanding CPUARMState for 2048-bit
vector registers.

Note that tcg/mips has the exact same problem.  However, the mips isa
makes it more difficult to fix up.  I'd like someone with hardware to
make this change.



r~



The following changes since commit 7398166ddf7c6dbbc9cae6ac69bb2feda14b40ac:

  Merge remote-tracking branch 'remotes/kraxel/tags/vnc-20180112-pull-request' into staging (2018-01-12 16:01:30 +0000)

are available in the Git repository at:

  git://github.com/rth7680/qemu.git tags/pull-tcg-20180112

for you to fetch changes up to bb08c35b17b7245c696bd12e527453e624e77da3:

  tcg/ppc: Allow a 32-bit offset to the constant pool (2018-01-12 12:50:36 -0800)

----------------------------------------------------------------
Queued tcg patches

----------------------------------------------------------------
Richard Henderson (4):
      tcg/arm: Fix double-word comparisons
      tcg/arm: Support tlb offsets larger than 64k
      tcg/ppc: Support tlb offsets larger than 64k
      tcg/ppc: Allow a 32-bit offset to the constant pool

 tcg/arm/tcg-target.inc.c | 142 ++++++++++++++++++++++++++++++++---------------
 tcg/ppc/tcg-target.inc.c |  84 ++++++++++++++++------------
 2 files changed, 144 insertions(+), 82 deletions(-)

Re: [Qemu-devel] [PULL 0/4] TCG queued patches

[Aurelien Jarno]

On 2018-01-12 13:06, Richard Henderson wrote:
> This includes a fix for the tcg/arm bug exposed by the ppc64 code change
> for comparisons.
> 
> It also includes improvements to tcg/arm and tcg/ppc to allow for larger
> CPUFooState structures, as exposed by expanding CPUARMState for 2048-bit
> vector registers.
> 
> Note that tcg/mips has the exact same problem.  However, the mips isa
> makes it more difficult to fix up.  I'd like someone with hardware to
> make this change.

Ok, I'll try to have a look at that.
 
-- 
Aurelien Jarno                          GPG: 4096R/1DDD8C9B
aurelien@aurel32.net                 http://www.aurel32.net

Re: [Qemu-devel] [PULL 0/4] TCG queued patches

[Peter Maydell]

On 12 January 2018 at 21:06, Richard Henderson
<richard.henderson@linaro.org> wrote:
> This includes a fix for the tcg/arm bug exposed by the ppc64 code change
> for comparisons.
>
> It also includes improvements to tcg/arm and tcg/ppc to allow for larger
> CPUFooState structures, as exposed by expanding CPUARMState for 2048-bit
> vector registers.

> ----------------------------------------------------------------
> Queued tcg patches
>
> ----------------------------------------------------------------
> Richard Henderson (4):
>       tcg/arm: Fix double-word comparisons
>       tcg/arm: Support tlb offsets larger than 64k
>       tcg/ppc: Support tlb offsets larger than 64k
>       tcg/ppc: Allow a 32-bit offset to the constant pool

This seems to crash on arm32 hosts with a sparc64 guest:

$ ./sparc64-softmmu/qemu-system-sparc64  -display none
Segmentation fault

Here's a backtrace:

Thread 3 "qemu-system-spa" received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0xe8cb8e10 (LWP 25876)]
0x000325a0 in tcg_out32 (s=0xe8300470, v=<optimised out>) at
/home/peter.maydell/qemu/tcg/tcg.c:193
193             *s->code_ptr++ = v;
(gdb) bt
#0  0x000325a0 in tcg_out32 (s=0xe8300470, v=<optimised out>) at
/home/peter.maydell/qemu/tcg/tcg.c:193
#1  tcg_out_dat_imm (im=<optimised out>, rn=<optimised out>, rd=2,
opc=8388608, cond=14, s=0xe8300470)
    at /home/peter.maydell/qemu/tcg/arm/tcg-target.inc.c:451
#2  tcg_out_tlb_read (s=s@entry=0xe8300470,
addrlo=addrlo@entry=TCG_REG_R4, addrhi=addrhi@entry=TCG_REG_R5,
opc=opc@entry=MO_8,
    mem_index=mem_index@entry=5, is_load=is_load@entry=true) at
/home/peter.maydell/qemu/tcg/arm/tcg-target.inc.c:1320
#3  0x00033144 in tcg_out_qemu_ld (s=0xe8300470, args=<optimised out>,
is64=<optimised out>)
    at /home/peter.maydell/qemu/tcg/arm/tcg-target.inc.c:1648
#4  0x00033b06 in tcg_out_op (s=s@entry=0xe8300470, opc=<optimised
out>, args=args@entry=0xe8cb85fc,
    const_args=const_args@entry=0xe8cb863c) at
/home/peter.maydell/qemu/tcg/arm/tcg-target.inc.c:2059
#5  0x000360b6 in tcg_reg_alloc_op (op=0xe83076b8, s=<optimised out>)
at /home/peter.maydell/qemu/tcg/tcg.c:2893
#6  tcg_gen_code (s=<optimised out>, tb=tb@entry=0xe8e9d680
<code_gen_buffer+1636>) at /home/peter.maydell/qemu/tcg/tcg.c:3279
#7  0x000757b8 in tb_gen_code (cpu=cpu@entry=0xaf3ee8,
pc=2198754869620, cs_base=cs_base@entry=2198754869624,
flags=flags@entry=69,
    cflags=0) at /home/peter.maydell/qemu/accel/tcg/translate-all.c:1319
#8  0x000747fc in tb_find (cf_mask=<optimised out>, tb_exit=<optimised
out>, last_tb=0x0, cpu=0xf000c178)
    at /home/peter.maydell/qemu/accel/tcg/cpu-exec.c:404
#9  cpu_exec (cpu=cpu@entry=0xaf3ee8) at
/home/peter.maydell/qemu/accel/tcg/cpu-exec.c:731
#10 0x00052f60 in tcg_cpu_exec (cpu=0xaf3ee8) at
/home/peter.maydell/qemu/cpus.c:1300
#11 qemu_tcg_rr_cpu_thread_fn (arg=<optimised out>) at
/home/peter.maydell/qemu/cpus.c:1396
#12 0xec9235b4 in start_thread (arg=0x0) at pthread_create.c:335
#13 0xec8c4bec in ?? () at ../sysdeps/unix/sysv/linux/arm/clone.S:89
from /lib/arm-linux-gnueabihf/libc.so.6

Writing off the end of the codegen buffer?

thanks
-- PMM