Re: [Qemu-devel] [PATCH 1/2] tcg: Ensure safe tb_jmp_cache lookup out of 'tb_lock'

[Emilio G. Cota]

On Fri, Jul 01, 2016 at 17:32:01 -0700, Richard Henderson wrote:
> On 07/01/2016 05:17 PM, Emilio G. Cota wrote:
> >On Fri, Jul 01, 2016 at 17:16:09 +0100, Alex Bennée wrote:
> >>From: Sergey Fedorov <address@hidden>
> >(snip)
> >>@@ -333,7 +338,7 @@ static inline TranslationBlock *tb_find_fast(CPUState 
> >>*cpu,
> >>        is executed. */
> >>     cpu_get_tb_cpu_state(env, &pc, &cs_base, &flags);
> >>     tb_lock();
> >>-    tb = cpu->tb_jmp_cache[tb_jmp_cache_hash_func(pc)];
> >>+    tb = atomic_read(&cpu->tb_jmp_cache[tb_jmp_cache_hash_func(pc)]);
> >>     if (unlikely(!tb || tb->pc != pc || tb->cs_base != cs_base ||
> >>                  tb->flags != flags)) {
> >>         tb = tb_find_slow(cpu, pc, cs_base, flags);
> >>diff --git a/translate-all.c b/translate-all.c
> >>index eaa95e4..1fcfe79 100644
> >>--- a/translate-all.c
> >>+++ b/translate-all.c
> >>@@ -1004,11 +1004,16 @@ void tb_phys_invalidate(TranslationBlock *tb, 
> >>tb_page_addr_t page_addr)
> >>         invalidate_page_bitmap(p);
> >>     }
> >>
> >>+    /* Ensure that we won't find the TB in the shared hash table
> >>+     * if we con't see it in CPU's local cache.
> >
> >s/con't/can't/
> >
> >>+     * Pairs with smp_rmb() in tb_find_slow(). */
> >>+    smp_wmb();
> >
> >This fence is already embedded in qht_remove, since it internally
> >calls seqlock_write_end() on a successful removal...
> 
> No.  There's stuff that happens after qht_remove and before this barrier:
> tb_page_remove and invalidate_page_bitmap.

I can't see how that "tb page" stuff you refer to is relevant here.

AFAICT the barrier pairing in this patch only applies to tb_jmp_cache
and qht. If as you say it does not, then all comments and the commit message
are wrong.

What am I missing?

                Emilio