From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:54801) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1anSy7-0006js-UW for qemu-devel@nongnu.org; Tue, 05 Apr 2016 11:32:41 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1anSy6-0007E5-GJ for qemu-devel@nongnu.org; Tue, 05 Apr 2016 11:32:39 -0400 Received: from mail-wm0-x22f.google.com ([2a00:1450:400c:c09::22f]:35010) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1anSy6-0007Dx-6S for qemu-devel@nongnu.org; Tue, 05 Apr 2016 11:32:38 -0400 Received: by mail-wm0-x22f.google.com with SMTP id 191so28630054wmq.0 for ; Tue, 05 Apr 2016 08:32:38 -0700 (PDT) From: =?UTF-8?q?Alex=20Benn=C3=A9e?= Date: Tue, 5 Apr 2016 16:32:18 +0100 Message-Id: <1459870344-16773-6-git-send-email-alex.bennee@linaro.org> In-Reply-To: <1459870344-16773-1-git-send-email-alex.bennee@linaro.org> References: <1459870344-16773-1-git-send-email-alex.bennee@linaro.org> MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Subject: [Qemu-devel] [RFC v2 05/11] tcg: protect TBContext with tb_lock. List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: mttcg@listserver.greensocs.com, fred.konrad@greensocs.com, a.rigo@virtualopensystems.com, serge.fdrv@gmail.com, cota@braap.org Cc: peter.maydell@linaro.org, claudio.fontana@huawei.com, Peter Crosthwaite , jan.kiszka@siemens.com, "Michael S. Tsirkin" , mark.burton@greensocs.com, qemu-devel@nongnu.org, Eduardo Habkost , pbonzini@redhat.com, =?UTF-8?q?Alex=20Benn=C3=A9e?= , rth@twiddle.net From: KONRAD Frederic This protects TBContext with tb_lock to make tb_* thread safe. We can still have issue with tb_flush in case of multithread TCG: another CPU can be executing code during a flush. This can be fixed later by making all other TCG thread exiting before calling tb_flush(). Signed-off-by: KONRAD Frederic Message-Id: <1439220437-23957-8-git-send-email-fred.konrad@greensocs.com> Signed-off-by: Emilio G. Cota Signed-off-by: Paolo Bonzini [AJB: moved into tree, clean-up history] Signed-off-by: Alex Bennée --- v2 (base-patches, ajb): - re-base fixes v7 (FK, MTTCG): - Drop a tb_lock in already locked restore_state_to_opc. v6 (FK, MTTCG): - Drop a tb_lock arround tb_find_fast in cpu-exec.c. --- cpu-exec.c | 8 +++++++- exec.c | 3 +++ hw/i386/kvmvapic.c | 3 +++ translate-all.c | 32 +++++++++++++++++++++++++------- 4 files changed, 38 insertions(+), 8 deletions(-) diff --git a/cpu-exec.c b/cpu-exec.c index 74065d9..bd50fef 100644 --- a/cpu-exec.c +++ b/cpu-exec.c @@ -205,18 +205,24 @@ static void cpu_exec_nocache(CPUState *cpu, int max_cycles, if (max_cycles > CF_COUNT_MASK) max_cycles = CF_COUNT_MASK; + tb_lock(); cpu->tb_invalidated_flag = false; tb = tb_gen_code(cpu, orig_tb->pc, orig_tb->cs_base, orig_tb->flags, max_cycles | CF_NOCACHE | (ignore_icount ? CF_IGNORE_ICOUNT : 0)); tb->orig_tb = cpu->tb_invalidated_flag ? NULL : orig_tb; cpu->current_tb = tb; + tb_unlock(); + /* execute the generated code */ trace_exec_tb_nocache(tb, tb->pc); - cpu_tb_exec(cpu, tb); + cpu_tb_exec(cpu, tb->tc_ptr); + + tb_lock(); cpu->current_tb = NULL; tb_phys_invalidate(tb, -1); tb_free(tb); + tb_unlock(); } #endif diff --git a/exec.c b/exec.c index 17f390e..c46c123 100644 --- a/exec.c +++ b/exec.c @@ -2111,6 +2111,9 @@ static void check_watchpoint(int offset, int len, MemTxAttrs attrs, int flags) continue; } cpu->watchpoint_hit = wp; + + /* Unlocked by cpu_loop_exit or cpu_resume_from_signal. */ + tb_lock(); tb_check_watchpoint(cpu); if (wp->flags & BP_STOP_BEFORE_ACCESS) { cpu->exception_index = EXCP_DEBUG; diff --git a/hw/i386/kvmvapic.c b/hw/i386/kvmvapic.c index c69f374..7c0d542 100644 --- a/hw/i386/kvmvapic.c +++ b/hw/i386/kvmvapic.c @@ -14,6 +14,7 @@ #include "sysemu/kvm.h" #include "hw/i386/apic_internal.h" #include "hw/sysbus.h" +#include "tcg/tcg.h" #define VAPIC_IO_PORT 0x7e @@ -446,6 +447,8 @@ static void patch_instruction(VAPICROMState *s, X86CPU *cpu, target_ulong ip) resume_all_vcpus(); if (!kvm_enabled()) { + /* Unlocked by cpu_resume_from_signal. */ + tb_lock(); cs->current_tb = NULL; tb_gen_code(cs, current_pc, current_cs_base, current_flags, 1); cpu_resume_from_signal(cs, NULL); diff --git a/translate-all.c b/translate-all.c index a7ff5e7..935d24c 100644 --- a/translate-all.c +++ b/translate-all.c @@ -834,7 +834,9 @@ static void page_flush_tb(void) } /* flush all the translation blocks */ -/* XXX: tb_flush is currently not thread safe */ +/* XXX: tb_flush is currently not thread safe. System emulation calls it only + * with tb_lock taken or from safe_work, so no need to take tb_lock here. + */ void tb_flush(CPUState *cpu) { #if defined(DEBUG_FLUSH) @@ -1350,6 +1352,7 @@ void tb_invalidate_phys_page_range(tb_page_addr_t start, tb_page_addr_t end, /* we remove all the TBs in the range [start, end[ */ /* XXX: see if in some cases it could be faster to invalidate all the code */ + tb_lock(); tb = p->first_tb; while (tb != NULL) { n = (uintptr_t)tb & 3; @@ -1417,12 +1420,13 @@ void tb_invalidate_phys_page_range(tb_page_addr_t start, tb_page_addr_t end, if (current_tb_modified) { /* we generate a block containing just the instruction modifying the memory. It will ensure that it cannot modify - itself */ + itself. cpu_resume_from_signal unlocks tb_lock. */ cpu->current_tb = NULL; tb_gen_code(cpu, current_pc, current_cs_base, current_flags, 1); cpu_resume_from_signal(cpu, NULL); } #endif + tb_unlock(); } #ifdef CONFIG_SOFTMMU @@ -1489,6 +1493,8 @@ static void tb_invalidate_phys_page(tb_page_addr_t addr, if (!p) { return; } + + tb_lock(); tb = p->first_tb; #ifdef TARGET_HAS_PRECISE_SMC if (tb && pc != 0) { @@ -1530,9 +1536,12 @@ static void tb_invalidate_phys_page(tb_page_addr_t addr, if (locked) { mmap_unlock(); } + + /* tb_lock released by cpu_resume_from_signal. */ cpu_resume_from_signal(cpu, puc); } #endif + tb_unlock(); } #endif @@ -1627,6 +1636,7 @@ void cpu_io_recompile(CPUState *cpu, uintptr_t retaddr) target_ulong pc, cs_base; uint64_t flags; + tb_lock(); tb = tb_find_pc(retaddr); if (!tb) { cpu_abort(cpu, "cpu_io_recompile: could not find TB for pc=%p", @@ -1678,11 +1688,15 @@ void cpu_io_recompile(CPUState *cpu, uintptr_t retaddr) /* FIXME: In theory this could raise an exception. In practice we have already translated the block once so it's probably ok. */ tb_gen_code(cpu, pc, cs_base, flags, cflags); - /* TODO: If env->pc != tb->pc (i.e. the faulting instruction was not - the first in the TB) then we end up generating a whole new TB and - repeating the fault, which is horribly inefficient. - Better would be to execute just this insn uncached, or generate a - second new TB. */ + + /* This unlocks the tb_lock. + * + * TODO: If env->pc != tb->pc (i.e. the faulting instruction was not + * the first in the TB) then we end up generating a whole new TB and + * repeating the fault, which is horribly inefficient. + * Better would be to execute just this insn uncached, or generate a + * second new TB. + */ cpu_resume_from_signal(cpu, NULL); } @@ -1707,6 +1721,8 @@ void dump_exec_info(FILE *f, fprintf_function cpu_fprintf) int direct_jmp_count, direct_jmp2_count, cross_page; TranslationBlock *tb; + tb_lock(); + target_code_size = 0; max_target_code_size = 0; cross_page = 0; @@ -1762,6 +1778,8 @@ void dump_exec_info(FILE *f, fprintf_function cpu_fprintf) tcg_ctx.tb_ctx.tb_phys_invalidate_count); cpu_fprintf(f, "TLB flush count %d\n", tlb_flush_count); tcg_dump_info(f, cpu_fprintf); + + tb_unlock(); } void dump_opcount_info(FILE *f, fprintf_function cpu_fprintf) -- 2.7.4