[Qemu-devel] [RFC 0/7] Safe watch and breakpoint manipulation

[Alex Bennée]

Hi,

Last time I went through the MTTCG code the access to the
break/watchpoint code was annotated with "RCU?". The code currently
gets away with avoiding locks for the gdbstub as the guest execution
state is usually halted. However when used for modelling architectural
debug registers there is no such protection.

The patch series changes things in stages.

First we move the break/watchpoints into an array which is more
amenable to RCU control that the QLIST. We then control the life time
of references to break/watchpoint data by removing long held
references in the target code and getting information when needed from
the core. Then we stop dynamically allocation the watch/breakpoint
data and store it directly in the array which makes iteration across
the list a bit more cache friendly than referenced pointers. Finally
addition and removal of elements of the array is put under RCU
control. This ensures there is always a safe array of data to check
in the run-loop.

I've taken the decision not to use the RCU like mechanism for setting
the hit flags because I can't construct a potential race between a WP
being hit and it being removed or updated.

I've tested with the gdbstub on ARMv7 using
./tests/guest-debug/test-gdbstub.py and done some manual testing with
arm-linux/qemu-arm -g 1234 and everything seems to work fine. I could
really do with adding some unit tests for exercising this code but I'm
unsure of the best approach of doing this.

Cheers,

Alex Bennée (7):
  cpu: move break/watchpoints into arrays.
  exec: keep CPUWatchpoint references internal
  exec: keep CPUBreakpoint references internal
  break/watchpoints: store inside array
  breakpoints: put breakpoints under RCU control
  linux-user: don't clone watchpoints
  watchpoints: put watchpoints under RCU control

 cpu-exec.c                 |   7 +-
 cpus.c                     |   3 +
 exec.c                     | 522 ++++++++++++++++++++++++++++++++++++---------
 gdbstub.c                  |   4 +-
 include/qom/cpu.h          | 160 ++++++++++++--
 linux-user/main.c          |  13 +-
 qom/cpu.c                  |   2 -
 target-arm/cpu.h           |   3 -
 target-arm/helper.c        |  24 +--
 target-arm/op_helper.c     |  10 +-
 target-arm/translate-a64.c |   6 +-
 target-arm/translate.c     |   6 +-
 target-i386/bpt_helper.c   |  44 ++--
 target-i386/cpu.h          |   4 -
 target-lm32/cpu.h          |   3 -
 target-lm32/helper.c       |  31 +--
 target-s390x/helper.c      |  10 +-
 target-xtensa/cpu.h        |   3 -
 target-xtensa/helper.c     |   4 +-
 target-xtensa/op_helper.c  |  16 +-
 20 files changed, 639 insertions(+), 236 deletions(-)

-- 
2.7.4