Re: [RFC] exec: flush CPU TB cache when breakpoint address translation fails

[Richard Henderson <richard.henderson@linaro.org>]

On 11/26/19 10:26 PM, Max Filippov wrote:
> When a breakpoint is inserted at location for which there's currently no
> virtual to physical translation no action is taken on CPU TB cache. If a
> TB for that virtual address already exists but is not visible ATM the
> breakpoint won't be hit next time an instruction at that address will be
> executed.
> 
> Flush entire CPU TB cache when a breakpoint is set for a virtual address
> that cannot be translated to physical address.
> 
> This change fixes the following workflow:
> - linux user application is running
> - a breakpoint is inserted from QEMU gdbstub for a user address that is
>   not currently present in the target CPU TLB
> - an instruction at that address is executed, but the external debugger
>   doesn't get control.
> 
> Signed-off-by: Max Filippov <jcmvbkbc@gmail.com>

As a short-term fix this works.  I'm willing to apply this to 5.0 with cc:
stable so that as a bug fix this gets pulled back to 4.2.1.  Paolo's request
for a comment is en pointe, so I'll wait for a version 2.

However, while running in system mode with a decent sized amount of guest ram,
I see 1-2M tbs live at once.  We don't really want to throw all of those away.

I think it would be better to put the tbs into some sort of data structure that
indexes the tbs by their virtual address.  I have no strong feelings about what
sort of data structure would be best, just something better than a linear
search of all of the tbs.  :-)


r~