summary refs log tree commit diff stats
path: root/results/classifier/gemma3:12b/debug/1053
diff options
context:
space:
mode:
authorChristian Krinitsin <mail@krinitsin.com>2025-07-03 07:27:52 +0000
committerChristian Krinitsin <mail@krinitsin.com>2025-07-03 07:27:52 +0000
commitd0c85e36e4de67af628d54e9ab577cc3fad7796a (patch)
treef8f784b0f04343b90516a338d6df81df3a85dfa2 /results/classifier/gemma3:12b/debug/1053
parent7f4364274750eb8cb39a3e7493132fca1c01232e (diff)
downloadqemu-analysis-d0c85e36e4de67af628d54e9ab577cc3fad7796a.tar.gz
qemu-analysis-d0c85e36e4de67af628d54e9ab577cc3fad7796a.zip
add deepseek and gemma results
Diffstat (limited to 'results/classifier/gemma3:12b/debug/1053')
-rw-r--r--results/classifier/gemma3:12b/debug/105310
1 files changed, 10 insertions, 0 deletions
diff --git a/results/classifier/gemma3:12b/debug/1053 b/results/classifier/gemma3:12b/debug/1053
new file mode 100644
index 000000000..3cc98f1ad
--- /dev/null
+++ b/results/classifier/gemma3:12b/debug/1053
@@ -0,0 +1,10 @@
+
+Executable PMP regions of size less than 4K always trigger an instruction access fault
+Description of problem:
+When configuring a PMP region that is less than 4K in size (Page size), and then trying to execute instructions inside said region, TCG always throws a PMP exception, even though the area allows code execution.
+Additional information:
+I've debugged the issue already, and it's happening because of the following optimization in TCG:
+
+TCG uses `get_page_addr_code_hostp` in order to try and get the translation cached for a whole page of instructions; if this function is unable to translate a whole page, it's supposed to simply return `-1`, and then the caller is supposed to translate and execute on a per-instruction basis. In this case `get_page_addr_code_hostp` calls `tlb_fill`, which then calls `riscv_cpu_tlb_fill`, which then calls `get_physical_address_pmp` to perform the PMP access checks. When said instructions are covered by a PMP region which is smaller than a page, this check then fails, since PMP regions must cover the whole access in order to allow it. At this point `riscv_cpu_tlb_fill` will see that a PMP fault happened, and since `probe` is set to false by `get_page_addr_code_hostp`, it will throw a RISC-V access fault exception instead of just returning a failure that `get_page_addr_code_hostp` can handle (by only accessing the memory of the specific instruction instead, which will be fully covered by the PMP region).
+
+I haven't tried to fix it myself (my first idea is to simply make `get_page_addr_code_hostp` set the probe flag), since I'm not sure if changing that part of TCG will affect other architectures that I'm not aware of.