From patchwork Fri Jun 30 19:09:03 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Richard Henderson X-Patchwork-Id: 9820273 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 59F4260224 for ; Fri, 30 Jun 2017 19:11:45 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 4A91322638 for ; Fri, 30 Jun 2017 19:11:45 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 3F361284C7; Fri, 30 Jun 2017 19:11:45 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=2.0 tests=BAYES_00,DKIM_SIGNED, RCVD_IN_DNSWL_HI,T_DKIM_INVALID autolearn=ham version=3.3.1 Received: from lists.gnu.org (lists.gnu.org [208.118.235.17]) (using TLSv1 with cipher AES256-SHA (256/256 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id A12FC22638 for ; Fri, 30 Jun 2017 19:11:44 +0000 (UTC) Received: from localhost ([::1]:45669 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1dR1KR-0007dc-Lx for patchwork-qemu-devel@patchwork.kernel.org; Fri, 30 Jun 2017 15:11:43 -0400 Received: from eggs.gnu.org ([2001:4830:134:3::10]:48393) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1dR1I1-0006V5-A9 for qemu-devel@nongnu.org; Fri, 30 Jun 2017 15:09:14 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1dR1I0-00037u-1r for qemu-devel@nongnu.org; Fri, 30 Jun 2017 15:09:13 -0400 Received: from mail-qt0-x241.google.com ([2607:f8b0:400d:c0d::241]:34442) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_128_CBC_SHA1:16) (Exim 4.71) (envelope-from ) id 1dR1Hz-00037c-TL for qemu-devel@nongnu.org; Fri, 30 Jun 2017 15:09:11 -0400 Received: by mail-qt0-x241.google.com with SMTP id m54so13667206qtb.1 for ; Fri, 30 Jun 2017 12:09:11 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=sender:from:to:cc:subject:date:message-id:in-reply-to:references; bh=TGxHqc7KHzZuIHV7PHdsZu9127opeu4xewpN0oRmX6k=; b=LWT2r/Xzvrdm/HmmpormyWN9h9N7mWp3xlvaKzEokP8XfWJWd03KRAo+KbqEqL9Nvx 33JoQk7kI/TcEgFj4iB6qg9Y8aEnF/Bdn7724ugSRU0buRTQDAOdWeem8qnb97TBJVpI mmBk1thHn0rJNpumjknFE+o2fWh+HxJLTzUx7D7qbP18MR4B9fkDnYIgNfbdkMRYVZZf uDVHTkCXjU47gmCM9LGAHjBELcTujCqh/5KL1uyorJ/NLcTgD6nXZY/zQx36sDrr0pB1 IL36fZg1a2lWhQKMhgzGhClQbIO8StyUrDJ18GWaFoVU0ppIk5m92knZPeM8WNj+DyVA I1AA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:sender:from:to:cc:subject:date:message-id :in-reply-to:references; bh=TGxHqc7KHzZuIHV7PHdsZu9127opeu4xewpN0oRmX6k=; b=Kx8Qlk9dnThicQdeQo8aPtWmcGK+WEJWbSQVsv8x43YJIBHdIc8BtGpCOXL1aX6w6H KXYph4b2LqBGNHkPIqeS5ZeHeeV5G60fU/aToK0Jdx+YwJ0lqY2BRhOjqJ9mkzMpFxvr jKnBNN7PSWY6mLGHQusqnvWEPU6hnPLagKoeiTeJegO9DkmvVM2kRXZj0H6695+KPbut nOGLj/8WYJe9ZP+mnsb3z2bfifaGp9KoKjjxxoDNfSq75xIZM16JHFO4b/XR72TQG+rf J8k1v8NpkMdkMvMsBbOVxatVYSR4rB9svfRzhQ/2ewAzPXFOD8iXBpRcawgOEjoH/Keh YGRA== X-Gm-Message-State: AKS2vOxhogj7hoRovU+29L94L+engem1MzOOLDTN89Mbk2lYUK3hS49V MmY8ytdriERpfc9XfKs= X-Received: by 10.237.63.119 with SMTP id q52mr27785793qtf.49.1498849751125; Fri, 30 Jun 2017 12:09:11 -0700 (PDT) Received: from bigtime.twiddle.net.com (97-113-165-157.tukw.qwest.net. [97.113.165.157]) by smtp.gmail.com with ESMTPSA id g25sm7454446qte.57.2017.06.30.12.09.09 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Fri, 30 Jun 2017 12:09:10 -0700 (PDT) From: Richard Henderson To: qemu-devel@nongnu.org Date: Fri, 30 Jun 2017 12:09:03 -0700 Message-Id: <20170630190903.9886-4-rth@twiddle.net> X-Mailer: git-send-email 2.9.4 In-Reply-To: <20170630190903.9886-1-rth@twiddle.net> References: <20170630190903.9886-1-rth@twiddle.net> X-detected-operating-system: by eggs.gnu.org: Genre and OS details not recognized. X-Received-From: 2607:f8b0:400d:c0d::241 Subject: [Qemu-devel] [PULL 3/3] tcg: consistently access cpu->tb_jmp_cache atomically X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: peter.maydell@linaro.org, "Emilio G. Cota" Errors-To: qemu-devel-bounces+patchwork-qemu-devel=patchwork.kernel.org@nongnu.org Sender: "Qemu-devel" X-Virus-Scanned: ClamAV using ClamSMTP From: "Emilio G. Cota" Some code paths can lead to atomic accesses racing with memset() on cpu->tb_jmp_cache, which can result in torn reads/writes and is undefined behaviour in C11. These torn accesses are unlikely to show up as bugs, but from code inspection they seem possible. For example, tb_phys_invalidate does: /* remove the TB from the hash list */ h = tb_jmp_cache_hash_func(tb->pc); CPU_FOREACH(cpu) { if (atomic_read(&cpu->tb_jmp_cache[h]) == tb) { atomic_set(&cpu->tb_jmp_cache[h], NULL); } } Here atomic_set might race with a concurrent memset (such as the ones scheduled via "unsafe" async work, e.g. tlb_flush_page) and therefore we might end up with a torn pointer (or who knows what, because we are under undefined behaviour). This patch converts parallel accesses to cpu->tb_jmp_cache to use atomic primitives, thereby bringing these accesses back to defined behaviour. The price to pay is to potentially execute more instructions when clearing cpu->tb_jmp_cache, but given how infrequently they happen and the small size of the cache, the performance impact I have measured is within noise range when booting debian-arm. Note that under "safe async" work (e.g. do_tb_flush) we could use memset because no other vcpus are running. However I'm keeping these accesses atomic as well to keep things simple and to avoid confusing analysis tools such as ThreadSanitizer. Reviewed-by: Paolo Bonzini Reviewed-by: Richard Henderson Signed-off-by: Emilio G. Cota Message-Id: <1497486973-25845-1-git-send-email-cota@braap.org> Signed-off-by: Richard Henderson --- include/qom/cpu.h | 11 ++++++++++- accel/tcg/cputlb.c | 4 ++-- accel/tcg/translate-all.c | 26 ++++++++++++-------------- qom/cpu.c | 5 +---- 4 files changed, 25 insertions(+), 21 deletions(-) diff --git a/include/qom/cpu.h b/include/qom/cpu.h index 89ddb68..2fe7cff 100644 --- a/include/qom/cpu.h +++ b/include/qom/cpu.h @@ -346,7 +346,7 @@ struct CPUState { void *env_ptr; /* CPUArchState */ - /* Writes protected by tb_lock, reads not thread-safe */ + /* Accessed in parallel; all accesses must be atomic */ struct TranslationBlock *tb_jmp_cache[TB_JMP_CACHE_SIZE]; struct GDBRegisterState *gdb_regs; @@ -422,6 +422,15 @@ extern struct CPUTailQ cpus; extern __thread CPUState *current_cpu; +static inline void cpu_tb_jmp_cache_clear(CPUState *cpu) +{ + unsigned int i; + + for (i = 0; i < TB_JMP_CACHE_SIZE; i++) { + atomic_set(&cpu->tb_jmp_cache[i], NULL); + } +} + /** * qemu_tcg_mttcg_enabled: * Check whether we are running MultiThread TCG or not. diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c index 1900936..85635ae 100644 --- a/accel/tcg/cputlb.c +++ b/accel/tcg/cputlb.c @@ -118,7 +118,7 @@ static void tlb_flush_nocheck(CPUState *cpu) memset(env->tlb_table, -1, sizeof(env->tlb_table)); memset(env->tlb_v_table, -1, sizeof(env->tlb_v_table)); - memset(cpu->tb_jmp_cache, 0, sizeof(cpu->tb_jmp_cache)); + cpu_tb_jmp_cache_clear(cpu); env->vtlb_index = 0; env->tlb_flush_addr = -1; @@ -183,7 +183,7 @@ static void tlb_flush_by_mmuidx_async_work(CPUState *cpu, run_on_cpu_data data) } } - memset(cpu->tb_jmp_cache, 0, sizeof(cpu->tb_jmp_cache)); + cpu_tb_jmp_cache_clear(cpu); tlb_debug("done\n"); diff --git a/accel/tcg/translate-all.c b/accel/tcg/translate-all.c index f6ad46b..93fb923 100644 --- a/accel/tcg/translate-all.c +++ b/accel/tcg/translate-all.c @@ -928,11 +928,7 @@ static void do_tb_flush(CPUState *cpu, run_on_cpu_data tb_flush_count) } CPU_FOREACH(cpu) { - int i; - - for (i = 0; i < TB_JMP_CACHE_SIZE; ++i) { - atomic_set(&cpu->tb_jmp_cache[i], NULL); - } + cpu_tb_jmp_cache_clear(cpu); } tcg_ctx.tb_ctx.nb_tbs = 0; @@ -1813,19 +1809,21 @@ void cpu_io_recompile(CPUState *cpu, uintptr_t retaddr) cpu_loop_exit_noexc(cpu); } -void tb_flush_jmp_cache(CPUState *cpu, target_ulong addr) +static void tb_jmp_cache_clear_page(CPUState *cpu, target_ulong page_addr) { - unsigned int i; + unsigned int i, i0 = tb_jmp_cache_hash_page(page_addr); + for (i = 0; i < TB_JMP_PAGE_SIZE; i++) { + atomic_set(&cpu->tb_jmp_cache[i0 + i], NULL); + } +} + +void tb_flush_jmp_cache(CPUState *cpu, target_ulong addr) +{ /* Discard jump cache entries for any tb which might potentially overlap the flushed page. */ - i = tb_jmp_cache_hash_page(addr - TARGET_PAGE_SIZE); - memset(&cpu->tb_jmp_cache[i], 0, - TB_JMP_PAGE_SIZE * sizeof(TranslationBlock *)); - - i = tb_jmp_cache_hash_page(addr); - memset(&cpu->tb_jmp_cache[i], 0, - TB_JMP_PAGE_SIZE * sizeof(TranslationBlock *)); + tb_jmp_cache_clear_page(cpu, addr - TARGET_PAGE_SIZE); + tb_jmp_cache_clear_page(cpu, addr); } static void print_qht_statistics(FILE *f, fprintf_function cpu_fprintf, diff --git a/qom/cpu.c b/qom/cpu.c index 5069876..585419b 100644 --- a/qom/cpu.c +++ b/qom/cpu.c @@ -274,7 +274,6 @@ void cpu_reset(CPUState *cpu) static void cpu_common_reset(CPUState *cpu) { CPUClass *cc = CPU_GET_CLASS(cpu); - int i; if (qemu_loglevel_mask(CPU_LOG_RESET)) { qemu_log("CPU Reset (CPU %d)\n", cpu->cpu_index); @@ -292,9 +291,7 @@ static void cpu_common_reset(CPUState *cpu) cpu->crash_occurred = false; if (tcg_enabled()) { - for (i = 0; i < TB_JMP_CACHE_SIZE; ++i) { - atomic_set(&cpu->tb_jmp_cache[i], NULL); - } + cpu_tb_jmp_cache_clear(cpu); #ifdef CONFIG_SOFTMMU tlb_flush(cpu, 0);