From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([208.118.235.92]:51080) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1TIilT-00040A-8b for qemu-devel@nongnu.org; Mon, 01 Oct 2012 12:22:40 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1TIilO-00069t-O0 for qemu-devel@nongnu.org; Mon, 01 Oct 2012 12:22:39 -0400 Received: from e34.co.us.ibm.com ([32.97.110.152]:34782) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1TIilO-00069i-Gz for qemu-devel@nongnu.org; Mon, 01 Oct 2012 12:22:34 -0400 Received: from /spool/local by e34.co.us.ibm.com with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted for from ; Mon, 1 Oct 2012 10:22:33 -0600 Received: from d03relay01.boulder.ibm.com (d03relay01.boulder.ibm.com [9.17.195.226]) by d03dlp03.boulder.ibm.com (Postfix) with ESMTP id 17E6619D803E for ; Mon, 1 Oct 2012 10:22:30 -0600 (MDT) Received: from d03av06.boulder.ibm.com (d03av06.boulder.ibm.com [9.17.195.245]) by d03relay01.boulder.ibm.com (8.13.8/8.13.8/NCO v10.0) with ESMTP id q91GMDTB173430 for ; Mon, 1 Oct 2012 10:22:14 -0600 Received: from d03av06.boulder.ibm.com (loopback [127.0.0.1]) by d03av06.boulder.ibm.com (8.14.4/8.13.1/NCO v10.0 AVout) with ESMTP id q91GNWbV028802 for ; Mon, 1 Oct 2012 10:23:33 -0600 From: Anthony Liguori In-Reply-To: <5069B7F0.30300@redhat.com> References: <1347244257-15586-1-git-send-email-david@gibson.dropbear.id.au> <1347244257-15586-3-git-send-email-david@gibson.dropbear.id.au> <504DEAD1.3060908@suse.de> <20120912055706.GX12554@truffula.fritz.box> <50699E11.8020203@redhat.com> <871uhigtb3.fsf@codemonkey.ws> <5069B7F0.30300@redhat.com> Date: Mon, 01 Oct 2012 11:21:52 -0500 Message-ID: <87txue2me7.fsf@codemonkey.ws> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Subject: Re: [Qemu-devel] [PATCH 2/2] cpu_physical_memory_write_rom() needs to do TB invalidates List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Pavel Hrdina Cc: qemu-devel@nongnu.org, Andreas =?utf-8?Q?F=C3=A4rber?= , David Gibson Pavel Hrdina writes: > On 10/01/2012 04:28 PM, Anthony Liguori wrote: >> Pavel Hrdina writes: >> >>> On 09/12/2012 07:57 AM, David Gibson wrote: >>>> On Mon, Sep 10, 2012 at 03:27:45PM +0200, Andreas F=C3=A4rber wrote: >>>>> Am 10.09.2012 04:30, schrieb David Gibson: >>>>>> cpu_physical_memory_write_rom(), despite the name, can also be used = to >>>>>> write images into RAM - and will often be used that way if the machi= ne >>>>>> uses load_image_targphys() into RAM addresses. >>>>>> >>>>>> However, cpu_physical_memory_write_rom(), unlike cpu_physical_memory= _rw() >>>>>> does invalidate any cached TBs which might be affected by the region >>>>> "doesn't"? >>>>> >>>>> Otherwise doesn't look wrong. >>>> Oops, comment updated. >>>> >>>> From 6b913afaf83f52ee787271827c84b492e8ac5895 Mon Sep 17 00:00:00 20= 01 >>>> From: David Gibson >>>> Date: Wed, 22 Aug 2012 14:58:04 +1000 >>>> Subject: [PATCH] cpu_physical_memory_write_rom() needs to do TB invali= dates >>>> >>>> cpu_physical_memory_write_rom(), despite the name, can also be used to >>>> write images into RAM - and will often be used that way if the machine >>>> uses load_image_targphys() into RAM addresses. >>>> >>>> However, cpu_physical_memory_write_rom(), unlike >>>> cpu_physical_memory_rw() doesn't invalidate any cached TBs which might >>>> be affected by the region written. >>>> >>>> This was breaking reset (under full emu) on the pseries machine - we l= oaded >>>> our firmware image into RAM, and while executing it rewrite the code at >>>> the entry point (correctly causing a TB invalidate/refresh). When we >>>> reset the firmware image was reloaded, but the TB from the rewrite was >>>> still active and caused us to get an illegal instruction trap. >>>> >>>> This patch fixes the bug by duplicating the tb invalidate code from >>>> cpu_physical_memory_rw() in cpu_physical_memory_write_rom(). >>>> >>>> Signed-off-by: David Gibson >>>> --- >>>> exec.c | 7 +++++++ >>>> 1 file changed, 7 insertions(+) >>>> >>>> diff --git a/exec.c b/exec.c >>>> index 5834766..eff40d7 100644 >>>> --- a/exec.c >>>> +++ b/exec.c >>>> @@ -3523,6 +3523,13 @@ void cpu_physical_memory_write_rom(target_phys_= addr_t addr, >>>> /* ROM/RAM case */ >>>> ptr =3D qemu_get_ram_ptr(addr1); >>>> memcpy(ptr, buf, l); >>>> + if (!cpu_physical_memory_is_dirty(addr1)) { >>>> + /* invalidate code */ >>>> + tb_invalidate_phys_page_range(addr1, addr1 + l, 0); >>>> + /* set dirty bit */ >>>> + cpu_physical_memory_set_dirty_flags( >>>> + addr1, (0xff & ~CODE_DIRTY_FLAG)); >>>> + } >>>> qemu_put_ram_ptr(ptr); >>>> } >>>> len -=3D l; >>> Hi, >>> >>> this patch breaks Windows XP guest at all. Windows XP boot ends in loob >>> by restarting itself after time-out expires in windows advanced boot >>> options. >>> >>> I started the guest using this command-line: >>> >>> ./x86_64-softmmu/qemu-system-x86_64 -m 2G -drive >>> file=3D/data/data-shared/images/winxp-test.img -vnc 0.0.0.0:0 >> Does changing the tb_invalidate_phys_page_range() call to: >> >> tb_invalidate_phys_page_range(addr1, addr1 + MAX(l, TARGET_PAGE_SIZE), 0= ); >> >> The dirty flag is being reset for the full page but we're potentially >> only invalidating a subset of TBs that occur on the page. >> >> Regards, >> >> Anthony Liguori >> > > No, it doesn't fix this bug. Then I'm confused... invalidating TBs should never have a functional impact IIUC. Are you confident in your bisection? Reverting this patch fixes the problem? Regards, Anthony Liguori > > Pavel > >>> Pavel