Hi all, Patch 1 decides whether to use tlb_flush_page based on whether rs1 is 0. This is similar to a patch I submitted last year [1]. Under normal circumstances this works fine, but it can leave stale TLB entries when the guest kernel uses THP.
The reason is that with THP, the guest's mapping is at the PMD level. When flushing the TLB, the guest executes sfence.vma only once for the whole huge page, rather than 512 times to flush each individual 4K page. Patch 1 does not account for this: it only flushes the single 4K page corresponding to the address in rs1, leaving the other 511 pages of the huge page with stale entries. As a result, guest memory access faults can occur after Patch 1 is merged, unless huge-page TLB support is added for the RISC-V TCG case. Please correct me if I've misunderstood anything. [1] https://lore.kernel.org/qemu-devel/[email protected]/ Yechao, Regards
