[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PATCH v5 27/33] cputlb: atomically update tlb fields used
From: |
Alex Bennée |
Subject: |
[Qemu-devel] [PATCH v5 27/33] cputlb: atomically update tlb fields used by tlb_reset_dirty |
Date: |
Thu, 27 Oct 2016 16:10:24 +0100 |
The main use case for tlb_reset_dirty is to set the TLB_NOTDIRTY flags
in TLB entries to force the slow-path on writes. This is used to mark
page ranges containing code which has been translated so it can be
invalidated if written to. To do this safely we need to ensure the TLB
entries in question for all vCPUs are updated before we attempt to run
the code otherwise a race could be introduced.
To achieve this we atomically set the flag in tlb_reset_dirty_range and
take care when setting it when the TLB entry is filled.
The helper function is made static as it isn't used outside of cputlb.
Signed-off-by: Alex Bennée <address@hidden>
---
cputlb.c | 91 ++++++++++++++++++++++++++++++++++++++-------------
include/exec/cputlb.h | 2 --
2 files changed, 68 insertions(+), 25 deletions(-)
diff --git a/cputlb.c b/cputlb.c
index 614c0b3..981cb42 100644
--- a/cputlb.c
+++ b/cputlb.c
@@ -303,32 +303,50 @@ void tlb_unprotect_code(ram_addr_t ram_addr)
cpu_physical_memory_set_dirty_flag(ram_addr, DIRTY_MEMORY_CODE);
}
-static bool tlb_is_dirty_ram(CPUTLBEntry *tlbe)
-{
- return (tlbe->addr_write & (TLB_INVALID_MASK|TLB_MMIO|TLB_NOTDIRTY)) == 0;
-}
-void tlb_reset_dirty_range(CPUTLBEntry *tlb_entry, uintptr_t start,
+/*
+ * Dirty write flag handling
+ *
+ * When the TCG code writes to a location it looks up the address in
+ * the TLB and uses that data to compute the final address. If any of
+ * the lower bits of the address are set then the slow path is forced.
+ * There are a number of reasons to do this but for normal RAM the
+ * most usual is detecting writes to code regions which may invalidate
+ * generated code.
+ *
+ * Because we want other vCPUs to respond to changes straight away we
+ * update the te->addr_write field atomically. If the TLB entry has
+ * been changed by the vCPU in the mean time we skip the update.
+ */
+
+static void tlb_reset_dirty_range(CPUTLBEntry *tlb_entry, uintptr_t start,
uintptr_t length)
{
- uintptr_t addr;
+ /* paired with atomic_mb_set in tlb_set_page_with_attrs */
+ uintptr_t orig_addr = atomic_mb_read(&tlb_entry->addr_write);
+ uintptr_t addr = orig_addr;
- if (tlb_is_dirty_ram(tlb_entry)) {
- addr = (tlb_entry->addr_write & TARGET_PAGE_MASK) + tlb_entry->addend;
+ if ((addr & (TLB_INVALID_MASK | TLB_MMIO | TLB_NOTDIRTY)) == 0) {
+ addr &= TARGET_PAGE_MASK;
+ addr += atomic_read(&tlb_entry->addend);
if ((addr - start) < length) {
- tlb_entry->addr_write |= TLB_NOTDIRTY;
+ uintptr_t notdirty_addr = orig_addr | TLB_NOTDIRTY;
+ atomic_cmpxchg(&tlb_entry->addr_write, orig_addr, notdirty_addr);
}
}
}
+/* This is a cross vCPU call (i.e. another vCPU resetting the flags of
+ * the target vCPU). As such care needs to be taken that we don't
+ * dangerously race with another vCPU update. The only thing actually
+ * updated is the target TLB entry ->addr_write flags.
+ */
void tlb_reset_dirty(CPUState *cpu, ram_addr_t start1, ram_addr_t length)
{
CPUArchState *env;
int mmu_idx;
- assert_cpu_is_self(cpu);
-
env = cpu->env_ptr;
for (mmu_idx = 0; mmu_idx < NB_MMU_MODES; mmu_idx++) {
unsigned int i;
@@ -414,9 +432,9 @@ void tlb_set_page_with_attrs(CPUState *cpu, target_ulong
vaddr,
MemoryRegionSection *section;
unsigned int index;
target_ulong address;
- target_ulong code_address;
+ target_ulong code_address, write_address;
uintptr_t addend;
- CPUTLBEntry *te;
+ CPUTLBEntry *te, *tv;
hwaddr iotlb, xlat, sz;
unsigned vidx = env->vtlb_index++ % CPU_VTLB_SIZE;
int asidx = cpu_asidx_from_attrs(cpu, attrs);
@@ -451,15 +469,21 @@ void tlb_set_page_with_attrs(CPUState *cpu, target_ulong
vaddr,
index = (vaddr >> TARGET_PAGE_BITS) & (CPU_TLB_SIZE - 1);
te = &env->tlb_table[mmu_idx][index];
-
/* do not discard the translation in te, evict it into a victim tlb */
- env->tlb_v_table[mmu_idx][vidx] = *te;
+ tv = &env->tlb_v_table[mmu_idx][vidx];
+
+ /* addr_write can race with tlb_reset_dirty_range_all */
+ tv->addr_read = te->addr_read;
+ atomic_set(&tv->addr_write, atomic_read(&te->addr_write));
+ tv->addr_code = te->addr_code;
+ atomic_set(&tv->addend, atomic_read(&te->addend));
+
env->iotlb_v[mmu_idx][vidx] = env->iotlb[mmu_idx][index];
/* refill the tlb */
env->iotlb[mmu_idx][index].addr = iotlb - vaddr;
env->iotlb[mmu_idx][index].attrs = attrs;
- te->addend = addend - vaddr;
+ atomic_set(&te->addend, addend - vaddr);
if (prot & PAGE_READ) {
te->addr_read = address;
} else {
@@ -471,21 +495,24 @@ void tlb_set_page_with_attrs(CPUState *cpu, target_ulong
vaddr,
} else {
te->addr_code = -1;
}
+
+ write_address = -1;
if (prot & PAGE_WRITE) {
if ((memory_region_is_ram(section->mr) && section->readonly)
|| memory_region_is_romd(section->mr)) {
/* Write access calls the I/O callback. */
- te->addr_write = address | TLB_MMIO;
+ write_address = address | TLB_MMIO;
} else if (memory_region_is_ram(section->mr)
&& cpu_physical_memory_is_clean(
memory_region_get_ram_addr(section->mr) + xlat)) {
- te->addr_write = address | TLB_NOTDIRTY;
+ write_address = address | TLB_NOTDIRTY;
} else {
- te->addr_write = address;
+ write_address = address;
}
- } else {
- te->addr_write = -1;
}
+
+ /* Pairs with flag setting in tlb_reset_dirty_range */
+ atomic_mb_set(&te->addr_write, write_address);
}
/* Add a new TLB entry, but without specifying the memory
@@ -648,10 +675,28 @@ static bool victim_tlb_hit(CPUArchState *env, size_t
mmu_idx, size_t index,
if (cmp == page) {
/* Found entry in victim tlb, swap tlb and iotlb. */
CPUTLBEntry tmptlb, *tlb = &env->tlb_table[mmu_idx][index];
+
+ /* tmptlb = *tlb; */
+ /* addr_write can race with tlb_reset_dirty_range_all */
+ tmptlb.addr_read = tlb->addr_read;
+ tmptlb.addr_write = atomic_read(&tlb->addr_write);
+ tmptlb.addr_code = tlb->addr_code;
+ tmptlb.addend = atomic_read(&tlb->addend);
+
+ /* *tlb = *vtlb; */
+ tlb->addr_read = vtlb->addr_read;
+ atomic_set(&tlb->addr_write, atomic_read(&vtlb->addr_write));
+ tlb->addr_code = vtlb->addr_code;
+ atomic_set(&tlb->addend, atomic_read(&vtlb->addend));
+
+ /* *vtlb = tmptlb; */
+ vtlb->addr_read = tmptlb.addr_read;
+ atomic_set(&vtlb->addr_write, tmptlb.addr_write);
+ vtlb->addr_code = tmptlb.addr_code;
+ atomic_set(&vtlb->addend, tmptlb.addend);
+
CPUIOTLBEntry tmpio, *io = &env->iotlb[mmu_idx][index];
CPUIOTLBEntry *vio = &env->iotlb_v[mmu_idx][vidx];
-
- tmptlb = *tlb; *tlb = *vtlb; *vtlb = tmptlb;
tmpio = *io; *io = *vio; *vio = tmpio;
return true;
}
diff --git a/include/exec/cputlb.h b/include/exec/cputlb.h
index d454c00..3f94178 100644
--- a/include/exec/cputlb.h
+++ b/include/exec/cputlb.h
@@ -23,8 +23,6 @@
/* cputlb.c */
void tlb_protect_code(ram_addr_t ram_addr);
void tlb_unprotect_code(ram_addr_t ram_addr);
-void tlb_reset_dirty_range(CPUTLBEntry *tlb_entry, uintptr_t start,
- uintptr_t length);
extern int tlb_flush_count;
#endif
--
2.10.1
- Re: [Qemu-devel] [PATCH v5 14/33] tcg: add kick timer for single-threaded vCPU emulation, (continued)
- [Qemu-devel] [PATCH v5 13/33] tcg: add options for enabling MTTCG, Alex Bennée, 2016/10/27
- [Qemu-devel] [PATCH v5 17/33] cpus: re-factor out handle_icount_deadline, Alex Bennée, 2016/10/27
- [Qemu-devel] [PATCH v5 22/33] atomic: introduce cmpxchg_bool, Alex Bennée, 2016/10/27
- [Qemu-devel] [PATCH v5 16/33] tcg: drop global lock during TCG code execution, Alex Bennée, 2016/10/27
- [Qemu-devel] [PATCH v5 18/33] tcg: remove global exit_request, Alex Bennée, 2016/10/27
- [Qemu-devel] [PATCH v5 15/33] tcg: rename tcg_current_cpu to tcg_current_rr_cpu, Alex Bennée, 2016/10/27
- [Qemu-devel] [PATCH v5 06/33] tcg: comment on which functions have to be called with tb_lock held, Alex Bennée, 2016/10/27
- [Qemu-devel] [PATCH v5 11/33] tcg: move tcg_exec_all and helpers above thread fn, Alex Bennée, 2016/10/27
- [Qemu-devel] [PATCH v5 27/33] cputlb: atomically update tlb fields used by tlb_reset_dirty,
Alex Bennée <=
- [Qemu-devel] [PATCH v5 24/33] cputlb: add assert_cpu_is_self checks, Alex Bennée, 2016/10/27
- [Qemu-devel] [PATCH v5 25/33] cputlb: introduce tlb_flush_* async work., Alex Bennée, 2016/10/27
- [Qemu-devel] [PATCH v5 31/33] target-arm: ensure BQL taken for ARM_CP_IO register access, Alex Bennée, 2016/10/27
- [Qemu-devel] [PATCH v5 30/33] target-arm/cpu: don't reset TLB structures, use cputlb to do it, Alex Bennée, 2016/10/27
[Qemu-devel] [PATCH v5 19/33] tcg: move locking for tb_invalidate_phys_page_range up, Alex Bennée, 2016/10/27
[Qemu-devel] [PATCH v5 21/33] tcg: enable thread-per-vCPU, Alex Bennée, 2016/10/27