I see you didn't touch cpu_loop_exit() and I'm curious how async interrupts are handled. Have you tested this and it works i.e. booting Windows 7 or Ubuntu 20.04? Also I've seen do_tb_phys_invalidate() called both from code generation context (write unlocked) and execution context (write locked), how does this patch differentiate the two?
-j On Sat, Jan 2, 2021 at 8:13 AM Roman Bolshakov <r.bolsha...@yadro.com> wrote: > > On Sat, Jan 02, 2021 at 03:21:02PM +0300, Roman Bolshakov wrote: > > Pages can't be both write and executable at the same time on Apple > > Silicon. macOS provides public API to switch write protection [1] for > > JIT applications, like TCG. > > > > 1. > > https://developer.apple.com/documentation/apple_silicon/porting_just-in-time_compilers_to_apple_silicon > > > > Signed-off-by: Roman Bolshakov <r.bolsha...@yadro.com> > > --- > > > > Happy holidays, everyone. > > > > This is somewhat similar to > > https://patchwork.kernel.org/project/qemu-devel/patch/20201108232425.1705-...@getutm.app/ > > but I couldn't apply the series so I started from scratch. > > > > The primary difference from the patch above is that public API is used. > > Other differences: > > * TB pages are mostly kept write-locked except around tcg_qemu_tb_exec() > > * x86_64 macOS doesn't use MAP_JIT and W^X switches > > > > Regards, > > Roman > > > > accel/tcg/cpu-exec.c | 10 ++++++++++ > > accel/tcg/translate-all.c | 26 ++++++++++++++++++++++++++ > > include/exec/exec-all.h | 2 ++ > > tcg/tcg.c | 1 + > > 4 files changed, 39 insertions(+) > > > > diff --git a/accel/tcg/cpu-exec.c b/accel/tcg/cpu-exec.c > > index 8689c54499..0042fc9f2b 100644 > > --- a/accel/tcg/cpu-exec.c > > +++ b/accel/tcg/cpu-exec.c > > @@ -175,7 +175,9 @@ static inline tcg_target_ulong cpu_tb_exec(CPUState > > *cpu, TranslationBlock *itb) > > } > > #endif /* DEBUG_DISAS */ > > > > + tb_write_lock(); > > ret = tcg_qemu_tb_exec(env, tb_ptr); > > + tb_write_unlock(); > > cpu->can_do_io = 1; > > last_tb = (TranslationBlock *)(ret & ~TB_EXIT_MASK); > > tb_exit = ret & TB_EXIT_MASK; > > @@ -220,9 +222,11 @@ static void cpu_exec_nocache(CPUState *cpu, int > > max_cycles, > > cflags |= MIN(max_cycles, CF_COUNT_MASK); > > > > mmap_lock(); > > + tb_write_unlock(); > > tb = tb_gen_code(cpu, orig_tb->pc, orig_tb->cs_base, > > orig_tb->flags, cflags); > > tb->orig_tb = orig_tb; > > + tb_write_lock(); > > mmap_unlock(); > > > > /* execute the generated code */ > > @@ -268,7 +272,9 @@ void cpu_exec_step_atomic(CPUState *cpu) > > tb = tb_lookup__cpu_state(cpu, &pc, &cs_base, &flags, cf_mask); > > if (tb == NULL) { > > mmap_lock(); > > + tb_write_unlock(); > > tb = tb_gen_code(cpu, pc, cs_base, flags, cflags); > > + tb_write_lock(); > > mmap_unlock(); > > } > > > > @@ -428,7 +434,9 @@ static inline TranslationBlock *tb_find(CPUState *cpu, > > tb = tb_lookup__cpu_state(cpu, &pc, &cs_base, &flags, cf_mask); > > if (tb == NULL) { > > mmap_lock(); > > + tb_write_unlock(); > > tb = tb_gen_code(cpu, pc, cs_base, flags, cf_mask); > > + tb_write_lock(); > > mmap_unlock(); > > /* We add the TB in the virtual pc hash table for the fast lookup > > */ > > qatomic_set(&cpu->tb_jmp_cache[tb_jmp_cache_hash_func(pc)], tb); > > @@ -444,7 +452,9 @@ static inline TranslationBlock *tb_find(CPUState *cpu, > > #endif > > /* See if we can patch the calling TB. */ > > if (last_tb) { > > + tb_write_unlock(); > > tb_add_jump(last_tb, tb_exit, tb); > > + tb_write_lock(); > > } > > return tb; > > } > > diff --git a/accel/tcg/translate-all.c b/accel/tcg/translate-all.c > > index b7d50a73d4..1562076ffb 100644 > > --- a/accel/tcg/translate-all.c > > +++ b/accel/tcg/translate-all.c > > @@ -1072,6 +1072,9 @@ static inline void *alloc_code_gen_buffer(void) > > size_t size = tcg_ctx->code_gen_buffer_size; > > void *buf; > > > > +#if defined(__APPLE__) && defined(__aarch64__) > > + flags |= MAP_JIT; > > +#endif > > buf = mmap(NULL, size, prot, flags, -1, 0); > > if (buf == MAP_FAILED) { > > return NULL; > > @@ -1485,7 +1488,9 @@ static void do_tb_phys_invalidate(TranslationBlock > > *tb, bool rm_from_page_list) > > > > static void tb_phys_invalidate__locked(TranslationBlock *tb) > > { > > + tb_write_unlock(); > > do_tb_phys_invalidate(tb, true); > > + tb_write_lock(); > > } > > > > /* invalidate one TB > > @@ -2722,3 +2727,24 @@ void tcg_flush_softmmu_tlb(CPUState *cs) > > tlb_flush(cs); > > #endif > > } > > + > > +#if defined(__APPLE__) && defined(__aarch64__) > > +static void tb_write_protect(bool locked) > > +{ > > + if (pthread_jit_write_protect_supported_np()){ > > + pthread_jit_write_protect_np(locked); > > + } > > +} > > +#else > > +static void tb_write_protect(bool locked) {} > > +#endif > > + > > +void tb_write_lock(void) > > +{ > > + tb_write_protect(true); > > +} > > + > > +void tb_write_unlock(void) > > +{ > > + tb_write_protect(false); > > +} > > diff --git a/include/exec/exec-all.h b/include/exec/exec-all.h > > index fab573da06..962dca0975 100644 > > --- a/include/exec/exec-all.h > > +++ b/include/exec/exec-all.h > > @@ -549,6 +549,8 @@ TranslationBlock *tb_htable_lookup(CPUState *cpu, > > target_ulong pc, > > target_ulong cs_base, uint32_t flags, > > uint32_t cf_mask); > > void tb_set_jmp_target(TranslationBlock *tb, int n, uintptr_t addr); > > +void tb_write_lock(void); > > +void tb_write_unlock(void); > > > > /* GETPC is the true target of the return instruction that we'll execute. > > */ > > #if defined(CONFIG_TCG_INTERPRETER) > > diff --git a/tcg/tcg.c b/tcg/tcg.c > > index 43c6cf8f52..303bb436bd 100644 > > --- a/tcg/tcg.c > > +++ b/tcg/tcg.c > > @@ -1065,6 +1065,7 @@ void tcg_prologue_init(TCGContext *s) > > s->pool_labels = NULL; > > #endif > > > > + tb_write_unlock(); > > /* Generate the prologue. */ > > tcg_target_qemu_prologue(s); > > > > -- > > 2.29.2 > > > > I've also noticed that Apple doesn't worry about sticking to particular > W^X mode: > > https://bugs.webkit.org/attachment.cgi?id=402515&action=prettypatch > > We might also drop lock/unlock symmetry from here. E.g. we can have two > functions that switch the mode (they might be moved to util/osdep.c): > > qemu_jit_write(); > qemu_jit_execute(); > > Then we use them just before writing or before executing like advised on > their documentation page. > > -Roman
