diff mbox

[4/6] Handle CPU interrupts by inline checking of a flag

Message ID 1361556605-21963-5-git-send-email-peter.maydell@linaro.org
State Accepted
Commit 378df4b23753a11be650af7664ca76bc75cb9f01
Headers show

Commit Message

Peter Maydell Feb. 22, 2013, 6:10 p.m. UTC
Fix some of the nasty TCG race conditions and crashes by implementing
cpu_exit() as setting a flag which is checked at the start of each TB.
This avoids crashes if a thread or signal handler calls cpu_exit()
while the execution thread is itself modifying the TB graph (which
may happen in system emulation mode as well as in linux-user mode
with a multithreaded guest binary).

This fixes the crashes seen in LP:668799; however there are another
class of crashes described in LP:1098729 which stem from the fact
that in linux-user with a multithreaded guest all threads will
use and modify the same global TCG date structures (including the
generated code buffer) without any kind of locking. This means that
multithreaded guest binaries are still in the "unsupported"
category.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 cpu-exec.c                |   25 ++++++++++++++++++++++++-
 exec.c                    |    2 +-
 include/exec/gen-icount.h |   12 ++++++++++++
 include/qom/cpu.h         |    3 +++
 tcg/tcg.h                 |    5 +++++
 translate-all.c           |    4 ++--
 6 files changed, 47 insertions(+), 4 deletions(-)

Comments

Paul Brook Feb. 22, 2013, 9:15 p.m. UTC | #1
> @@ -100,6 +102,7 @@ struct CPUState {
>      bool stop;
>      bool stopped;
>      volatile sig_atomic_t exit_request;
> +    volatile sig_atomic_t tcg_exit_req;

Do we really need annother variable/check?  It seems like this should be at 
least partially redundant with the existing icount code. I have a simialr 
patch to that effect.

Paul
Peter Maydell Feb. 23, 2013, 10:03 a.m. UTC | #2
On 22 February 2013 21:15, Paul Brook <paul@codesourcery.com> wrote:
>> @@ -100,6 +102,7 @@ struct CPUState {
>>      bool stop;
>>      bool stopped;
>>      volatile sig_atomic_t exit_request;
>> +    volatile sig_atomic_t tcg_exit_req;
>
> Do we really need annother variable/check?  It seems like this should be at
> least partially redundant with the existing icount code. I have a simialr
> patch to that effect.

I wanted to keep the code simple and easy to review for correctness
and obvious non-interaction with other features. (My first patch
along these lines tried to reuse exit_request, but this hangs
Linux in SMP in system mode, for instance.)

-- PMM
Peter Maydell Feb. 23, 2013, 11:17 a.m. UTC | #3
On 23 February 2013 10:03, Peter Maydell <peter.maydell@linaro.org> wrote:
> On 22 February 2013 21:15, Paul Brook <paul@codesourcery.com> wrote:
>>> @@ -100,6 +102,7 @@ struct CPUState {
>>>      bool stop;
>>>      bool stopped;
>>>      volatile sig_atomic_t exit_request;
>>> +    volatile sig_atomic_t tcg_exit_req;
>>
>> Do we really need annother variable/check?  It seems like this should be at
>> least partially redundant with the existing icount code. I have a simialr
>> patch to that effect.
>
> I wanted to keep the code simple and easy to review for correctness
> and obvious non-interaction with other features.

Also the icount check code does comparatively complicated operations
on the icount which would be awkward to make atomic or otherwise
safe against a signal handler or other thread coming in and
changing something.

-- PMM
Lluís Vilanova Feb. 27, 2013, 7:17 p.m. UTC | #4
Peter Maydell writes:
[...]
> diff --git a/include/exec/gen-icount.h b/include/exec/gen-icount.h
> index c858a73..384153b 100644
> --- a/include/exec/gen-icount.h
> +++ b/include/exec/gen-icount.h
> @@ -7,10 +7,19 @@
 
>  static TCGArg *icount_arg;
>  static int icount_label;
> +static int exitreq_label;
 
>  static inline void gen_icount_start(void)
>  {
>      TCGv_i32 count;
> +    TCGv_i32 flag;
> +
> +    exitreq_label = gen_new_label();
> +    flag = tcg_temp_local_new_i32();
> +    tcg_gen_ld_i32(flag, cpu_env,
> +                   offsetof(CPUState, tcg_exit_req) - ENV_OFFSET);
> +    tcg_gen_brcondi_i32(TCG_COND_NE, flag, 0, exitreq_label);
> +    tcg_temp_free_i32(flag);

It feels weird to me that this code is in 'gen_icount_start' as opposed that
some other separate function like 'gen_tb_exit_check'.

 
>      if (!use_icount)
>          return;
> @@ -29,6 +38,9 @@ static inline void gen_icount_start(void)
 
>  static void gen_icount_end(TranslationBlock *tb, int num_insns)
>  {
> +    gen_set_label(exitreq_label);
> +    tcg_gen_exit_tb((tcg_target_long)tb + TB_EXIT_REQUESTED);
> +

This too feels weird to me.


Lluis
Lluís Vilanova Feb. 27, 2013, 7:22 p.m. UTC | #5
Forget it, I misread patch 6; sorry.


Lluis


Lluís Vilanova writes:

> Peter Maydell writes:
> [...]
>> diff --git a/include/exec/gen-icount.h b/include/exec/gen-icount.h
>> index c858a73..384153b 100644
>> --- a/include/exec/gen-icount.h
>> +++ b/include/exec/gen-icount.h
>> @@ -7,10 +7,19 @@
 
>> static TCGArg *icount_arg;
>> static int icount_label;
>> +static int exitreq_label;
 
>> static inline void gen_icount_start(void)
>> {
>> TCGv_i32 count;
>> +    TCGv_i32 flag;
>> +
>> +    exitreq_label = gen_new_label();
>> +    flag = tcg_temp_local_new_i32();
>> +    tcg_gen_ld_i32(flag, cpu_env,
>> +                   offsetof(CPUState, tcg_exit_req) - ENV_OFFSET);
>> +    tcg_gen_brcondi_i32(TCG_COND_NE, flag, 0, exitreq_label);
>> +    tcg_temp_free_i32(flag);

> It feels weird to me that this code is in 'gen_icount_start' as opposed that
> some other separate function like 'gen_tb_exit_check'.

 
>> if (!use_icount)
>> return;
>> @@ -29,6 +38,9 @@ static inline void gen_icount_start(void)
 
>> static void gen_icount_end(TranslationBlock *tb, int num_insns)
>> {
>> +    gen_set_label(exitreq_label);
>> +    tcg_gen_exit_tb((tcg_target_long)tb + TB_EXIT_REQUESTED);
>> +

> This too feels weird to me.


> Lluis

> -- 
>  "And it's much the same thing with knowledge, for whenever you learn
>  something new, the whole world becomes that much richer."
>  -- The Princess of Pure Reason, as told by Norton Juster in The Phantom
>  Tollbooth
diff mbox

Patch

diff --git a/cpu-exec.c b/cpu-exec.c
index e80626a..6f4cc36 100644
--- a/cpu-exec.c
+++ b/cpu-exec.c
@@ -64,6 +64,12 @@  static inline tcg_target_ulong cpu_tb_exec(CPUState *cpu, uint8_t *tb_ptr)
         TranslationBlock *tb = (TranslationBlock *)(next_tb & ~TB_EXIT_MASK);
         cpu_pc_from_tb(env, tb);
     }
+    if ((next_tb & TB_EXIT_MASK) == TB_EXIT_REQUESTED) {
+        /* We were asked to stop executing TBs (probably a pending
+         * interrupt. We've now stopped, so clear the flag.
+         */
+        cpu->tcg_exit_req = 0;
+    }
     return next_tb;
 }
 
@@ -608,7 +614,20 @@  int cpu_exec(CPUArchState *env)
                     tc_ptr = tb->tc_ptr;
                     /* execute the generated code */
                     next_tb = cpu_tb_exec(cpu, tc_ptr);
-                    if ((next_tb & TB_EXIT_MASK) == TB_EXIT_ICOUNT_EXPIRED) {
+                    switch (next_tb & TB_EXIT_MASK) {
+                    case TB_EXIT_REQUESTED:
+                        /* Something asked us to stop executing
+                         * chained TBs; just continue round the main
+                         * loop. Whatever requested the exit will also
+                         * have set something else (eg exit_request or
+                         * interrupt_request) which we will handle
+                         * next time around the loop.
+                         */
+                        tb = (TranslationBlock *)(next_tb & ~TB_EXIT_MASK);
+                        next_tb = 0;
+                        break;
+                    case TB_EXIT_ICOUNT_EXPIRED:
+                    {
                         /* Instruction counter expired.  */
                         int insns_left;
                         tb = (TranslationBlock *)(next_tb & ~TB_EXIT_MASK);
@@ -632,6 +651,10 @@  int cpu_exec(CPUArchState *env)
                             next_tb = 0;
                             cpu_loop_exit(env);
                         }
+                        break;
+                    }
+                    default:
+                        break;
                     }
                 }
                 cpu->current_tb = NULL;
diff --git a/exec.c b/exec.c
index a41bcb8..46a2830 100644
--- a/exec.c
+++ b/exec.c
@@ -495,7 +495,7 @@  void cpu_exit(CPUArchState *env)
     CPUState *cpu = ENV_GET_CPU(env);
 
     cpu->exit_request = 1;
-    cpu_unlink_tb(cpu);
+    cpu->tcg_exit_req = 1;
 }
 
 void cpu_abort(CPUArchState *env, const char *fmt, ...)
diff --git a/include/exec/gen-icount.h b/include/exec/gen-icount.h
index c858a73..384153b 100644
--- a/include/exec/gen-icount.h
+++ b/include/exec/gen-icount.h
@@ -7,10 +7,19 @@ 
 
 static TCGArg *icount_arg;
 static int icount_label;
+static int exitreq_label;
 
 static inline void gen_icount_start(void)
 {
     TCGv_i32 count;
+    TCGv_i32 flag;
+
+    exitreq_label = gen_new_label();
+    flag = tcg_temp_local_new_i32();
+    tcg_gen_ld_i32(flag, cpu_env,
+                   offsetof(CPUState, tcg_exit_req) - ENV_OFFSET);
+    tcg_gen_brcondi_i32(TCG_COND_NE, flag, 0, exitreq_label);
+    tcg_temp_free_i32(flag);
 
     if (!use_icount)
         return;
@@ -29,6 +38,9 @@  static inline void gen_icount_start(void)
 
 static void gen_icount_end(TranslationBlock *tb, int num_insns)
 {
+    gen_set_label(exitreq_label);
+    tcg_gen_exit_tb((tcg_target_long)tb + TB_EXIT_REQUESTED);
+
     if (use_icount) {
         *icount_arg = num_insns;
         gen_set_label(icount_label);
diff --git a/include/qom/cpu.h b/include/qom/cpu.h
index ee1a7c8..ab2657c 100644
--- a/include/qom/cpu.h
+++ b/include/qom/cpu.h
@@ -71,6 +71,8 @@  struct kvm_run;
  * @created: Indicates whether the CPU thread has been successfully created.
  * @stop: Indicates a pending stop request.
  * @stopped: Indicates the CPU has been artificially stopped.
+ * @tcg_exit_req: Set to force TCG to stop executing linked TBs for this
+ *           CPU and return to its top level loop.
  * @env_ptr: Pointer to subclass-specific CPUArchState field.
  * @current_tb: Currently executing TB.
  * @kvm_fd: vCPU file descriptor for KVM.
@@ -100,6 +102,7 @@  struct CPUState {
     bool stop;
     bool stopped;
     volatile sig_atomic_t exit_request;
+    volatile sig_atomic_t tcg_exit_req;
 
     void *env_ptr; /* CPUArchState */
     struct TranslationBlock *current_tb;
diff --git a/tcg/tcg.h b/tcg/tcg.h
index 2ebde07..90375c0 100644
--- a/tcg/tcg.h
+++ b/tcg/tcg.h
@@ -695,6 +695,10 @@  TCGv_i64 tcg_const_local_i64(int64_t val);
  *        would hit zero midway through it. In this case the next-TB pointer
  *        returned is the TB we were about to execute, and the caller must
  *        arrange to execute the remaining count of instructions.
+ *  3:    we stopped because the CPU's exit_request flag was set
+ *        (usually meaning that there is an interrupt that needs to be
+ *        handled). The next-TB pointer returned is the TB we were
+ *        about to execute when we noticed the pending exit request.
  *
  * If the bottom two bits indicate an exit-via-index then the CPU
  * state is correctly synchronised and ready for execution of the next
@@ -711,6 +715,7 @@  TCGv_i64 tcg_const_local_i64(int64_t val);
 #define TB_EXIT_IDX0 0
 #define TB_EXIT_IDX1 1
 #define TB_EXIT_ICOUNT_EXPIRED 2
+#define TB_EXIT_REQUESTED 3
 
 #if !defined(tcg_qemu_tb_exec)
 # define tcg_qemu_tb_exec(env, tb_ptr) \
diff --git a/translate-all.c b/translate-all.c
index b50fb89..9741d96 100644
--- a/translate-all.c
+++ b/translate-all.c
@@ -1475,7 +1475,7 @@  static void tcg_handle_interrupt(CPUArchState *env, int mask)
             cpu_abort(env, "Raised interrupt while not in I/O function");
         }
     } else {
-        cpu_unlink_tb(cpu);
+        cpu->tcg_exit_req = 1;
     }
 }
 
@@ -1626,7 +1626,7 @@  void cpu_interrupt(CPUArchState *env, int mask)
     CPUState *cpu = ENV_GET_CPU(env);
 
     env->interrupt_request |= mask;
-    cpu_unlink_tb(cpu);
+    cpu->tcg_exit_req = 1;
 }
 
 /*