[Qemu-devel] [PATCH v2 6/6] tcg: cpu-exec: roll-up tb_find_fast/slow

["Alex Bennée" <alex.bennee@linaro.org>]

In an effort not to re-take locks I've re-factored the code so
everything is done inside the new tb_find function. The fast path will
only take a lock if the previous TB needs patching. The generation path
will do the patching inside the generation critical section.

Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
---
 cpu-exec.c | 117 ++++++++++++++++++++++++++++++++++---------------------------
 1 file changed, 66 insertions(+), 51 deletions(-)

diff --git a/cpu-exec.c b/cpu-exec.c
index 59c2ec5..529eae1 100644
--- a/cpu-exec.c
+++ b/cpu-exec.c
@@ -281,7 +281,8 @@ static TranslationBlock *tb_find_physical(CPUState *cpu,
 /*
  * Patch the last TB with a jump to the current TB.
  *
- * Modification of the TB has to be protected with tb_lock.
+ * Modification of the TB has to be protected with tb_lock which can
+ * either be already held or taken here.
  */
 static inline void maybe_patch_last_tb(CPUState *cpu,
                                        TranslationBlock *tb,
@@ -306,72 +307,86 @@ static inline void maybe_patch_last_tb(CPUState *cpu,
 #endif
     /* See if we can patch the calling TB. */
     if (*last_tb && !qemu_loglevel_mask(CPU_LOG_TB_NOCHAIN)) {
-        tb_lock();
+        bool locked = tb_lock_recursive();
         tb_add_jump(*last_tb, tb_exit, tb);
-        tb_unlock();
-    }
-}
-
-static TranslationBlock *tb_find_slow(CPUState *cpu,
-                                      target_ulong pc,
-                                      target_ulong cs_base,
-                                      uint32_t flags)
-{
-    TranslationBlock *tb;
-
-    /* Ensure that we won't find a TB in the shared hash table
-     * if it is being invalidated by some other thread.
-     * Otherwise we'd put it back to CPU's local cache.
-     * Pairs with smp_wmb() in tb_phys_invalidate(). */
-    smp_rmb();
-    tb = tb_find_physical(cpu, pc, cs_base, flags);
-    if (!tb) {
-
-        /* mmap_lock is needed by tb_gen_code, and mmap_lock must be
-         * taken outside tb_lock. As system emulation is currently
-         * single threaded the locks are NOPs.
-         */
-        mmap_lock();
-        tb_lock();
-
-        /* There's a chance that our desired tb has been translated while
-         * taking the locks so we check again inside the lock.
-         */
-        tb = tb_find_physical(cpu, pc, cs_base, flags);
-        if (!tb) {
-            /* if no translated code available, then translate it now */
-            tb = tb_gen_code(cpu, pc, cs_base, flags, 0);
+        if (locked) {
+            tb_unlock();
         }
-
-        tb_unlock();
-        mmap_unlock();
     }
-
-    /* We add the TB in the virtual pc hash table for the fast lookup */
-    atomic_set(&cpu->tb_jmp_cache[tb_jmp_cache_hash_func(pc)], tb);
-    return tb;
 }
 
-static inline TranslationBlock *tb_find_fast(CPUState *cpu,
-                                             TranslationBlock **last_tb,
-                                             int tb_exit)
+/*
+ * tb_find - find next TB, possibly generating it
+ *
+ * There is a multi-level lookup for finding the next TB which avoids
+ * locks unless generation is required.
+ *
+ * 1. Lookup via the per-vcpu tb_jmp_cache
+ * 2. Lookup via tb_find_physical (using QHT)
+ *
+ * If both of those fail then we need to grab the mmap_lock and
+ * tb_lock and do code generation.
+ *
+ * As the jump patching of code also needs to be protected by locks we
+ * have multiple paths into maybe_patch_last_tb taking advantage of
+ * the fact we may already have locks held for code generation.
+ */
+static TranslationBlock *tb_find(CPUState *cpu,
+                                 TranslationBlock **last_tb,
+                                 int tb_exit)
 {
     CPUArchState *env = (CPUArchState *)cpu->env_ptr;
     TranslationBlock *tb;
     target_ulong cs_base, pc;
+    unsigned int h;
     uint32_t flags;
 
     /* we record a subset of the CPU state. It will
        always be the same before a given translated block
        is executed. */
     cpu_get_tb_cpu_state(env, &pc, &cs_base, &flags);
-    tb = atomic_read(&cpu->tb_jmp_cache[tb_jmp_cache_hash_func(pc)]);
+    h = tb_jmp_cache_hash_func(pc);
+    tb = atomic_read(&cpu->tb_jmp_cache[h]);
+
     if (unlikely(!tb || tb->pc != pc || tb->cs_base != cs_base ||
                  tb->flags != flags)) {
-        tb = tb_find_slow(cpu, pc, cs_base, flags);
-    }
 
-    maybe_patch_last_tb(cpu, tb, last_tb, tb_exit);
+        /* Ensure that we won't find a TB in the shared hash table
+         * if it is being invalidated by some other thread.
+         * Otherwise we'd put it back to CPU's local cache.
+         * Pairs with smp_wmb() in tb_phys_invalidate(). */
+        smp_rmb();
+        tb = tb_find_physical(cpu, pc, cs_base, flags);
+
+        if (!tb) {
+            /* mmap_lock is needed by tb_gen_code, and mmap_lock must be
+             * taken outside tb_lock. As system emulation is currently
+             * single threaded the locks are NOPs.
+             */
+            mmap_lock();
+            tb_lock();
+
+            /* There's a chance that our desired tb has been translated while
+             * taking the locks so we check again inside the lock.
+             */
+            tb = tb_find_physical(cpu, pc, cs_base, flags);
+            if (!tb) {
+                /* if no translated code available, then translate it now */
+                tb = tb_gen_code(cpu, pc, cs_base, flags, 0);
+            }
+            maybe_patch_last_tb(cpu, tb, last_tb, tb_exit);
+
+            tb_unlock();
+            mmap_unlock();
+        } else {
+            maybe_patch_last_tb(cpu, tb, last_tb, tb_exit);
+        }
+
+        /* We update the TB in the virtual pc hash table for the fast lookup */
+        atomic_set(&cpu->tb_jmp_cache[h], tb);
+    } else {
+        maybe_patch_last_tb(cpu, tb, last_tb, tb_exit);
+    }
 
     return tb;
 }
@@ -452,7 +467,7 @@ static inline bool cpu_handle_exception(CPUState *cpu, int *ret)
                && cpu->icount_decr.u16.low + cpu->icount_extra == 0) {
         /* try to cause an exception pending in the log */
         TranslationBlock *last_tb = NULL; /* Avoid chaining TBs */
-        cpu_exec_nocache(cpu, 1, tb_find_fast(cpu, &last_tb, 0), true);
+        cpu_exec_nocache(cpu, 1, tb_find(cpu, &last_tb, 0), true);
         *ret = -1;
         return true;
 #endif
@@ -636,7 +651,7 @@ int cpu_exec(CPUState *cpu)
             cpu->tb_flushed = false; /* reset before first TB lookup */
             for(;;) {
                 cpu_handle_interrupt(cpu, &last_tb);
-                tb = tb_find_fast(cpu, &last_tb, tb_exit);
+                tb = tb_find(cpu, &last_tb, tb_exit);
                 cpu_loop_exec_tb(cpu, tb, &last_tb, &tb_exit, &sc);
                 /* Try to align the host and virtual clocks
                    if the guest is in advance */
-- 
2.7.4