From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:51838) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1bLc5X-0006Ev-67 for qemu-devel@nongnu.org; Fri, 08 Jul 2016 16:09:28 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1bLc5S-0005wK-UB for qemu-devel@nongnu.org; Fri, 08 Jul 2016 16:09:26 -0400 Received: from mail-lf0-x243.google.com ([2a00:1450:4010:c07::243]:35945) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1bLc5S-0005wF-Hf for qemu-devel@nongnu.org; Fri, 08 Jul 2016 16:09:22 -0400 Received: by mail-lf0-x243.google.com with SMTP id a2so8375554lfe.3 for ; Fri, 08 Jul 2016 13:09:22 -0700 (PDT) References: <1467735496-16256-1-git-send-email-alex.bennee@linaro.org> <1467735496-16256-4-git-send-email-alex.bennee@linaro.org> From: Sergey Fedorov Message-ID: <57800870.5070503@gmail.com> Date: Fri, 8 Jul 2016 23:09:20 +0300 MIME-Version: 1.0 In-Reply-To: <1467735496-16256-4-git-send-email-alex.bennee@linaro.org> Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit Subject: Re: [Qemu-devel] [PATCH v2 3/6] tcg: cpu-exec: remove tb_lock from the hot-path List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: =?UTF-8?Q?Alex_Benn=c3=a9e?= , mttcg@listserver.greensocs.com, qemu-devel@nongnu.org, fred.konrad@greensocs.com, a.rigo@virtualopensystems.com, cota@braap.org, bobby.prani@gmail.com, rth@twiddle.net Cc: mark.burton@greensocs.com, pbonzini@redhat.com, jan.kiszka@siemens.com, peter.maydell@linaro.org, claudio.fontana@huawei.com, Peter Crosthwaite On 05/07/16 19:18, Alex Bennée wrote: > Lock contention in the hot path of moving between existing patched > TranslationBlocks is the main drag in multithreaded performance. This > patch pushes the tb_lock() usage down to the two places that really need > it: > > - code generation (tb_gen_code) > - jump patching (tb_add_jump) > > The rest of the code doesn't really need to hold a lock as it is either > using per-CPU structures, atomically updated or designed to be used in > concurrent read situations (qht_lookup). > > To keep things simple I removed the #ifdef CONFIG_USER_ONLY stuff as the > locks become NOPs anyway until the MTTCG work is completed. > > Signed-off-by: Alex Bennée > Reviewed-by: Richard Henderson > > --- > v3 (base-patches) > - fix merge conflicts with Sergey's patch > v1 (hot path, split from base-patches series) > - revert name tweaking > - drop test jmp_list_next outside lock > - mention lock NOPs in comments > v2 (hot path) > - Add r-b tags > --- > cpu-exec.c | 48 +++++++++++++++++++++--------------------------- > 1 file changed, 21 insertions(+), 27 deletions(-) > > diff --git a/cpu-exec.c b/cpu-exec.c > index 10ce1cb..dd0bd50 100644 > --- a/cpu-exec.c > +++ b/cpu-exec.c > @@ -291,35 +291,29 @@ static TranslationBlock *tb_find_slow(CPUState *cpu, > * Pairs with smp_wmb() in tb_phys_invalidate(). */ > smp_rmb(); > tb = tb_find_physical(cpu, pc, cs_base, flags); > - if (tb) { > - goto found; > - } > + if (!tb) { > > -#ifdef CONFIG_USER_ONLY > - /* mmap_lock is needed by tb_gen_code, and mmap_lock must be > - * taken outside tb_lock. Since we're momentarily dropping > - * tb_lock, there's a chance that our desired tb has been > - * translated. > - */ > - tb_unlock(); > - mmap_lock(); > - tb_lock(); > - tb = tb_find_physical(cpu, pc, cs_base, flags); > - if (tb) { > - mmap_unlock(); > - goto found; > - } > -#endif > + /* mmap_lock is needed by tb_gen_code, and mmap_lock must be > + * taken outside tb_lock. As system emulation is currently > + * single threaded the locks are NOPs. > + */ > + mmap_lock(); > + tb_lock(); > > - /* if no translated code available, then translate it now */ > - tb = tb_gen_code(cpu, pc, cs_base, flags, 0); > + /* There's a chance that our desired tb has been translated while > + * taking the locks so we check again inside the lock. > + */ > + tb = tb_find_physical(cpu, pc, cs_base, flags); > + if (!tb) { > + /* if no translated code available, then translate it now */ > + tb = tb_gen_code(cpu, pc, cs_base, flags, 0); > + } > > -#ifdef CONFIG_USER_ONLY > - mmap_unlock(); > -#endif > + tb_unlock(); > + mmap_unlock(); > + } > > -found: > - /* we add the TB in the virtual pc hash table */ > + /* We add the TB in the virtual pc hash table for the fast lookup */ > atomic_set(&cpu->tb_jmp_cache[tb_jmp_cache_hash_func(pc)], tb); There can be a race with tb_phys_invalidate() if we do this out of tb_lock. Suppose: (1) Thread 1: The first tb_find_phys() out of the lock is successful (2) Thread 2: Remove the TB from the global hash table with qht_remove() (3) Thread 2: Reset the 'tb_jmp_cache' entry (4) Thread 1: Set the 'tb_jmp_cache' entry back (this line) So it is only safe to do 'tb_jmp_cache' lookup out of lock, not to set it. Kind regards, Sergey > return tb; > } > @@ -337,7 +331,6 @@ static inline TranslationBlock *tb_find_fast(CPUState *cpu, > always be the same before a given translated block > is executed. */ > cpu_get_tb_cpu_state(env, &pc, &cs_base, &flags); > - tb_lock(); > tb = atomic_read(&cpu->tb_jmp_cache[tb_jmp_cache_hash_func(pc)]); > if (unlikely(!tb || tb->pc != pc || tb->cs_base != cs_base || > tb->flags != flags)) { > @@ -361,9 +354,10 @@ static inline TranslationBlock *tb_find_fast(CPUState *cpu, > #endif > /* See if we can patch the calling TB. */ > if (*last_tb && !qemu_loglevel_mask(CPU_LOG_TB_NOCHAIN)) { > + tb_lock(); > tb_add_jump(*last_tb, tb_exit, tb); > + tb_unlock(); > } > - tb_unlock(); > return tb; > } >