Comcat：/* 现象 */

2025-12-04T02:49:27Z

‎现象

Comcat：以“== 现象 == 本意想用如下的函数人为地将 Cache 的某个组的所有行的Tag 强制写为相同的值，然后访问一个索引到这个组的地址...”为内容创建页面

2014-05-19T08:10:43Z

以“== 现象 == 本意想用如下的函数人为地将 Cache 的某个组的所有行的Tag 强制写为相同的值，然后访问一个索引到这个组的地址...”为内容创建页面

新页面

== 现象 ==

本意想用如下的函数人为地将 Cache 的某个组的所有行的Tag 强制写为相同的值，然后访问一个索引到这个组的地址，人造一个多命中的情况 ;)

<pre>
static void sysrq_handle_comcat(int key, struct tty_struct *tty)
{
const u32 addr_cool = 0x80400000;
const u32 ws_inc = 1UL << current_cpu_data.dcache.waybit;
const u32 ws_end = current_cpu_data.dcache.ways << current_cpu_data.dcache.waybit;

int i = 0;
u32 taglo = 0;

/* dump all line's tag in set 0*/
printk("<0>----------------------- Before invalidated ---------------------- \n");
do {
asm (
"lui $3, 0x8040\n\t"
"addu $8, $3, %1\n\t"
"cache 0x05, 0($8)\n\t"
"mfc0 %0, $28, 2\n\t"
: "=r"(taglo)
: "r"(i)
: "$8", "$3"
);

printk("<0> taglo_%d = 0x%08x\n", i/ws_inc, taglo);
i += ws_inc;

} while (i < ws_end);

printk("<0> -------------- Invalidated all lines in set_0 ------------------ \n");

asm ("mtc0 $0, $28, 2\n\t"); // set TagLo to zero
/* clear all line's tag in set 0 */
do {
asm (
"lui $8, 0x8040\n\t"
"mtc0 $0, $28, 2\n\t"
"addu $3, $8, %0\n\t"
//"cache 0x01, 0($3)\n\t" /* invalidate write-back a line */
"cache 0x09, 0($3)\n\t" /* clear this line's tag to zero */
:
: "r"(i)
: "$8", "$3"
);

i += ws_inc;

} while (i < ws_end);

/* dump all line's tag in set 0*/
i = 0;
do {
asm (
"lui $3, 0x8040\n\t"
"addu $8, $3, %1\n\t"
"cache 0x05, 0($8)\n\t"
"mfc0 %0, $28, 2\n\t"
: "=r"(taglo)
: "r"(i)
: "$8", "$3"
);

printk("<0> taglo_%d = 0x%08x\n", i/ws_inc, taglo);
i += ws_inc;

} while (i < ws_end);

printk("<0> ----------------- Cache a line into set 0 ---------------------- \n");

/* cache a line into set 0 */
u32 tmp = *(u32 *) addr_cool;
printk("<0> *(u32 *)0x%08x = 0x%08x\n", addr_cool, tmp);

/* dump all line's tag in set 0*/
i = 0;
do {
asm (
"lui $3, 0x8040\n\t"
"addu $8, $3, %1\n\t"
"cache 0x05, 0($8)\n\t"
"mfc0 %0, $28, 2\n\t"
: "=r"(taglo)
: "r"(i)
: "$8", "$3"
);

printk("<0> taglo_%d = 0x%08x\n", i/ws_inc, taglo);
i += ws_inc;

} while (i < ws_end);

printk("<0> -- Get a validated line, read its Tag, write it to all lines -- \n");

/* find a validated line, read its tag */
i = 0;
do {
asm (
"lui $3, 0x8040\n\t"
"addu $8, $3, %1\n\t"
"cache 0x05, 0($8)\n\t"
"mfc0 %0, $28, 2\n\t"
: "=r"(taglo)
: "r"(i)
: "$8", "$3"
);

printk("<0> taglo = 0x%08x\n", taglo);
i += ws_inc;

} while ((((taglo >> 6) & 3) == 0) && i < ws_end); /* cache line is invalide */

/* set all other line's tag to the validated line's tag */
do {
asm (
"lui $8, 0x8040\n\t"
"addu $3, $8, %0\n\t"
"cache 0x09, 0($3)\n\t" /* store tag */
:
: "r" (i)
: "$8", "$3"
);

i += ws_inc;

} while (i < ws_end);

/* dump all line's tag in set 0*/
i = 0;
do {
asm (
"lui $3, 0x8040\n\t"
"addu $8, $3, %1\n\t"
"cache 0x05, 0($8)\n\t"
"mfc0 %0, $28, 2\n\t"
: "=r"(taglo)
: "r"(i)
: "$8", "$3"
);

printk("<0> taglo_%d = 0x%08x\n", i/ws_inc, taglo);
i += ws_inc;

} while (i < ws_end);

/* multi-hit cache line */
printk("<0> --------------------- Multi-Hit cache line --------------------- \n");
tmp = *(u32 *) addr_cool;
printk("<0> *(u32 *)0x%08x = 0x%08x\n\n", addr_cool, tmp);

printk("<0> ------------------------ After Multi-Hit ----------------------- \n");
/* dump all line's tag in set 0*/
i = 0;
do {
asm (
"lui $3, 0x8040\n\t"
"addu $8, $3, %1\n\t"
"cache 0x05, 0($8)\n\t"
"mfc0 %0, $28, 2\n\t"
: "=r"(taglo)
: "r"(i)
: "$8", "$3"
);

printk("<0> taglo_%d = 0x%08x\n", i/ws_inc, taglo);
i += ws_inc;

} while (i < ws_end);
printk("<0> ---------------------------------------------------------------- \n\n");
}

static struct sysrq_key_op sysrq_jack_op = {
.handler = sysrq_handle_jack,
.help_msg = "Jack's Debug",
.action_msg = "Jack's Debug",
.enable_mask = SYSRQ_ENABLE_DUMP,
};
</pre>

将这个函数映射到 sysrq 的 j 键方便操作。

哪知在多个 MIPS 平台上，第二步将组内所用行的 Tag 置为 0 的操作总是有一行不为所动 :( ，一下是一些 log:

4KEc 平台，8KB, 2-way, linesize 16 bytes L1 DCache:

<pre>
telnet> send brk
SysRq : Jack's Debug
----------------------- Before invalidated ----------------------
taglo_0 = 0x003260c0
taglo_1 = 0x002b4080

-------------- Invalidated all lines in set_0 ------------------
taglo_0 = 0x00000000
taglo_1 = 0x002b4080

----------------- Cache a line into set 0 ----------------------
*(u32 *)0x80000000 = 0x3c1b802f
taglo_0 = 0x00000080
taglo_1 = 0x002b4080

-- Get a validated line, read its Tag, write it to all lines --
taglo = 0x00000080
taglo_0 = 0x00000080
taglo_1 = 0x00000080

--------------------- Multi-Hit cache line ---------------------
*(u32 *)0x80000000 = 0x802b6188

------------------------ After Multi-Hit -----------------------
taglo_0 = 0x002b4080
taglo_1 = 0x00000080
----------------------------------------------------------------
</pre>

下面的这次，因为残留的一行有效，且在目标行的前面，所以这次造多命中失败了:(

<pre>
telnet> send brk
SysRq : Jack's Debug
----------------------- Before invalidated ----------------------
taglo_0 = 0x002b4080
taglo_1 = 0x003260c0

-------------- Invalidated all lines in set_0 ------------------
taglo_0 = 0x00000000
taglo_1 = 0x003260c0

----------------- Cache a line into set 0 ----------------------
*(u32 *)0x80000000 = 0x3c1b802f
taglo_0 = 0x002b4080
taglo_1 = 0x00000080

-- Get a validated line, read its Tag, write it to all lines --
taglo = 0x002b4080
taglo_0 = 0x002b4080
taglo_1 = 0x002b4080

--------------------- Multi-Hit cache line ---------------------
*(u32 *)0x80000000 = 0x3c1b802f

------------------------ After Multi-Hit -----------------------
taglo_0 = 0x002b4080
taglo_1 = 0x00000080
----------------------------------------------------------------
</pre>

VR5500 平台，64kB, 4-way, linesize 32 bytes L1 DCache:

<pre>
----------------------- Before invalidated ----------------------
taglo_0 = 0x000458c0
taglo_1 = 0x0004a481
taglo_2 = 0x0004e8c1
taglo_3 = 0x0014dcc1
-------------- Invalidated all lines in set_0 ------------------
taglo_0 = 0x00000000
taglo_1 = 0x00000000
taglo_2 = 0x00000000
taglo_3 = 0x000458c0

----------------- Cache a line into set 0 ----------------------
*(u32 *)0x80000000 = 0x3c1b804b
taglo_0 = 0x00000000
taglo_1 = 0x00000000
taglo_2 = 0x00000081
taglo_3 = 0x000458c0

-- Get a validated line, read its Tag, write it to all lines --
taglo = 0x00000000
taglo = 0x00000000
taglo = 0x00000081

taglo_0 = 0x00000081
taglo_1 = 0x000458c0
taglo_2 = 0x00000081
taglo_3 = 0x00000081

--------------------- Multi-Hit cache line ---------------------
*(u32 *)0x80000000 = 0x8045a188

------------------------ After Multi-Hit -----------------------
taglo_0 = 0x00000081
taglo_1 = 0x000458c0
taglo_2 = 0x00000081
taglo_3 = 0x00000081
----------------------------------------------------------------
</pre>

多次测试表明，似乎每次顽强生存着的 Tag 值皆一样，但位置可能会改变。这真是个诡异的现象，不知是不是 Cache lock 的原因。

@@ 第299行： / 第299行： @@
 <br><br>
-<br><br>
-<br><br>
+== Reference ==
-<br><br>
-<br><br>
+* [[GNU/Linux 内核移植捉虫笔记 (Linux Kernel Debug Notes)]]
-<br><br>
-<br><br>
-<br><br>
-<br><br>
-<br><br>
-<br><br>
-<br><br>
-<br><br>
 <br><br>

捉虫日记 0003: MIPS Cache 操作时的奇怪现象 - 版本历史

Comcat：/* 现象 */

Comcat：以“== 现象 == 本意想用如下的函数人为地将 Cache 的某个组的所有行的Tag 强制写为相同的值，然后访问一个索引到这个组的地址...”为内容创建页面