Roman Bolshakov <r.bolsha...@yadro.com> writes:
> On Mon, Jan 04, 2021 at 03:23:07PM +0000, Alex Bennée wrote: >> >> Roman Bolshakov <r.bolsha...@yadro.com> writes: >> >> > Pages can't be both write and executable at the same time on Apple >> > Silicon. macOS provides public API to switch write protection [1] for >> > JIT applications, like TCG. >> > >> > 1. >> > https://developer.apple.com/documentation/apple_silicon/porting_just-in-time_compilers_to_apple_silicon >> > >> > Signed-off-by: Roman Bolshakov <r.bolsha...@yadro.com> >> > --- >> > v1: https://lists.gnu.org/archive/html/qemu-devel/2021-01/msg00073.html >> > Changes since v1: >> > >> > - Pruned not needed fiddling with W^X and dropped symmetry from write >> > lock/unlock and renamed related functions. >> > Similar approach is used in JavaScriptCore [1]. >> > >> > - Moved jit helper functions to util/osdep >> > >> > As >> > outlined in osdep.h, this matches to (2): >> > >> > >> > * In an ideal >> > world this header would contain only: >> > * (1) things which >> > everybody needs >> > * (2) things without >> > which code would work on most platforms but >> > * fail to compile or >> > misbehave on a minority of host OSes >> > >> > - Fixed a checkpatch error >> > >> > - Limit new behaviour only to macOS 11.0 and above, because of the >> > following declarations: >> > >> > __API_AVAILABLE(macos(11.0)) >> > __API_UNAVAILABLE(ios, tvos, watchos) >> > void pthread_jit_write_protect_np(int enabled); >> > >> > __API_AVAILABLE(macos(11.0)) >> > __API_UNAVAILABLE(ios, tvos, watchos) >> > int pthread_jit_write_protect_supported_np(void); >> > >> > 1. https://bugs.webkit.org/attachment.cgi?id=402515&action=prettypatch >> > >> > accel/tcg/cpu-exec.c | 2 ++ >> > accel/tcg/translate-all.c | 6 ++++++ >> > include/qemu/osdep.h | 3 +++ >> > tcg/tcg.c | 1 + >> > util/osdep.c | 22 ++++++++++++++++++++++ >> > 5 files changed, 34 insertions(+) >> > >> > diff --git a/accel/tcg/cpu-exec.c b/accel/tcg/cpu-exec.c >> > index 8689c54499..374060eb45 100644 >> > --- a/accel/tcg/cpu-exec.c >> > +++ b/accel/tcg/cpu-exec.c >> > @@ -175,6 +175,7 @@ static inline tcg_target_ulong cpu_tb_exec(CPUState >> > *cpu, TranslationBlock *itb) >> > } >> > #endif /* DEBUG_DISAS */ >> > >> > + qemu_thread_jit_execute(); >> > ret = tcg_qemu_tb_exec(env, tb_ptr); >> > cpu->can_do_io = 1; >> > last_tb = (TranslationBlock *)(ret & ~TB_EXIT_MASK); >> > @@ -382,6 +383,7 @@ static inline void tb_add_jump(TranslationBlock *tb, >> > int n, >> > { >> > uintptr_t old; >> > >> > + qemu_thread_jit_write(); >> > assert(n < ARRAY_SIZE(tb->jmp_list_next)); >> > qemu_spin_lock(&tb_next->jmp_lock); >> > >> > diff --git a/accel/tcg/translate-all.c b/accel/tcg/translate-all.c >> > index b7d50a73d4..88ae5d35ef 100644 >> > --- a/accel/tcg/translate-all.c >> > +++ b/accel/tcg/translate-all.c >> > @@ -1072,6 +1072,9 @@ static inline void *alloc_code_gen_buffer(void) >> > size_t size = tcg_ctx->code_gen_buffer_size; >> > void *buf; >> > >> > +#if defined(__APPLE__) && defined(MAC_OS_VERSION_11_0) >> > + flags |= MAP_JIT; >> > +#endif >> > buf = mmap(NULL, size, prot, flags, -1, 0); >> > if (buf == MAP_FAILED) { >> > return NULL; >> > @@ -1485,7 +1488,9 @@ static void do_tb_phys_invalidate(TranslationBlock >> > *tb, bool rm_from_page_list) >> > >> > static void tb_phys_invalidate__locked(TranslationBlock *tb) >> > { >> > + qemu_thread_jit_write(); >> > do_tb_phys_invalidate(tb, true); >> > + qemu_thread_jit_execute(); >> > } >> > >> > /* invalidate one TB >> > @@ -1687,6 +1692,7 @@ TranslationBlock *tb_gen_code(CPUState *cpu, >> > #endif >> > >> > assert_memory_lock(); >> > + qemu_thread_jit_write(); >> > >> > phys_pc = get_page_addr_code(env, pc); >> > >> > diff --git a/include/qemu/osdep.h b/include/qemu/osdep.h >> > index f9ec8c84e9..89abebcf5d 100644 >> > --- a/include/qemu/osdep.h >> > +++ b/include/qemu/osdep.h >> > @@ -686,4 +686,7 @@ char *qemu_get_host_name(Error **errp); >> > */ >> > size_t qemu_get_host_physmem(void); >> > >> > +void qemu_thread_jit_write(void); >> > +void qemu_thread_jit_execute(void); >> > + >> > #endif >> > diff --git a/tcg/tcg.c b/tcg/tcg.c >> > index 43c6cf8f52..ab8488f5d5 100644 >> > --- a/tcg/tcg.c >> > +++ b/tcg/tcg.c >> > @@ -1065,6 +1065,7 @@ void tcg_prologue_init(TCGContext *s) >> > s->pool_labels = NULL; >> > #endif >> > >> > + qemu_thread_jit_write(); >> > /* Generate the prologue. */ >> > tcg_target_qemu_prologue(s); >> > >> > diff --git a/util/osdep.c b/util/osdep.c >> > index 66d01b9160..80ec7185da 100644 >> > --- a/util/osdep.c >> > +++ b/util/osdep.c >> > @@ -606,3 +606,25 @@ writev(int fd, const struct iovec *iov, int iov_cnt) >> > return readv_writev(fd, iov, iov_cnt, true); >> > } >> > #endif >> > + >> > +#if defined(__APPLE__) && defined(MAC_OS_VERSION_11_0) >> > +static inline void qemu_thread_jit_write_protect(bool enabled) >> > +{ >> > + if (pthread_jit_write_protect_supported_np()) { >> > + pthread_jit_write_protect_np(enabled); >> > + } >> > +} >> > + >> > +void qemu_thread_jit_execute(void) >> > +{ >> > + qemu_thread_jit_write_protect(true); >> > +} >> > + >> > +void qemu_thread_jit_write(void) >> > +{ >> > + qemu_thread_jit_write_protect(false); >> > +} >> >> What happens if you emulate a -smp 2 ARM guest? In this case MTTCG >> should be enabled (same guest ordering) but you run a risk of attempting >> to execute code while write is enabled. >> > > Hi Alex, > > Thanks for providing a hint. Ubuntu ARM with -smp 4 boots and works. I > can see 4 CPU in the guest and use the VM without any crashes (but it > requires patience as it's much slower compared to hvf). > >> Is there any way to only change the mapping for the parts of the TB >> cache used by a thread? Otherwise we'll need additional logic in >> default_mttcg_enabled to ensure we don't accidentally enable it on Apple >> silicon. > > I'm not sure I understand the question. The mappings are changed only > for the thread that invokes pthread_jit_write_protect_np(). Each thread > has its own permissions for MAP_JIT region. Ahh that was the bit I was unsure of. If two threads can have different permissions at the same time then it will be fine ;-) > As far as I understand MTTCG > works fine with the series as I've seen 376% CPU utilization at times > with -smp 4, regardless whether MTTCG is specified explicitly > (-accel tcg,thread=multi) or not. Respectively, default ARM on ARM is > MTTCG and it works fine, we don't need to disable it :) > > Thanks, > Roman > >> >> > +#else >> > +void qemu_thread_jit_write(void) {} >> > +void qemu_thread_jit_execute(void) {} >> > +#endif >> >> >> -- >> Alex Bennée -- Alex Bennée