From patchwork Mon Jul 23 20:17:41 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Michael Roth X-Patchwork-Id: 142664 Delivered-To: patch@linaro.org Received: by 2002:a2e:9754:0:0:0:0:0 with SMTP id f20-v6csp6527067ljj; Mon, 23 Jul 2018 14:44:57 -0700 (PDT) X-Google-Smtp-Source: AAOMgpeoONTPvH9HEi13E/wkrpdfIyuCxmtWiuJxPKNQJeZly2kMbXRHX6Ta+OqLcyCKeQ7Irtzs X-Received: by 2002:ac8:71d0:: with SMTP id i16-v6mr14256523qtp.111.1532382297577; Mon, 23 Jul 2018 14:44:57 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1532382297; cv=none; d=google.com; s=arc-20160816; b=cbJEBF+tY9vSS5J2Oa60p2W2tIWyrhqKdVb5/zoR5cliT1aYSJFX58MHmr319ye6pE 3zzIgbZV1gPcJ39pUpSUSeraRUPdpAeIwqY+ZkKh3gUJvWDW/tf58zmYZ87dOB68SnkJ ZXZWc78EYtjFoVG0UKhQJAHZ0L/chOaZlVr3Gsv/ws038G/qHbTWuiZXwlwp/dnG8Gf8 FfwFuMRyAj3OYy91toZZq3hY6h8DXHHiibU+yMamP9WZAcjawrcuDEhPzoWEoySTDsvI WWmPMPO+etYdtsB4wVGa7oQWMag7Wkv02aogJsBONbIRNY2MXWn1JxRPaiwmkcrnANfo 5APw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=sender:errors-to:cc:list-subscribe:list-help:list-post:list-archive :list-unsubscribe:list-id:precedence:subject :content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:to:from:dkim-signature:arc-authentication-results; bh=eyN2xqzxccTS5JZm6NGArfM+iXBtgcgfJ9nYhuRKytg=; b=dN6ThinS62ozu0x4pyeUORaTwVwOAEqX3BE449FfWREd00oWTmOr7uTkL/MiJEBxO4 Cvp8CT4ekKoEyG3aKhpNb7KFr5Seod+OKpar87boHpkTbyoKqdJUECvqPEeac71rt3mS kBtL4ryVfZTEFTY79vO7eKfyxOK09mIagoNvv6SRG3R8OW9LLPYOYFZcKN46HbGHWfFu 8LOknpAR6Qc2hhbyJ0u76dRvTvy+pQ4dlqh62xiZxa+xwdXg5TJq1fccppJBWD9B4XoM bVI4Q42Igx8KRcalu1Hubr5g4I+WgKphsEaouqqwGWdwPK0A0wV+e4EZxk8M81m4IUA4 WQXw== ARC-Authentication-Results: i=1; mx.google.com; dkim=fail header.i=@gmail.com header.s=20161025 header.b=CVYcqBBI; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 2001:4830:134:3::11 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org"; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=ibm.com Return-Path: Received: from lists.gnu.org (lists.gnu.org. [2001:4830:134:3::11]) by mx.google.com with ESMTPS id q15-v6si4232510qvn.239.2018.07.23.14.44.57 for (version=TLS1 cipher=AES128-SHA bits=128/128); Mon, 23 Jul 2018 14:44:57 -0700 (PDT) Received-SPF: pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 2001:4830:134:3::11 as permitted sender) client-ip=2001:4830:134:3::11; Authentication-Results: mx.google.com; dkim=fail header.i=@gmail.com header.s=20161025 header.b=CVYcqBBI; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 2001:4830:134:3::11 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org"; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=ibm.com Received: from localhost ([::1]:36904 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1fhidV-0004uw-2r for patch@linaro.org; Mon, 23 Jul 2018 17:44:57 -0400 Received: from eggs.gnu.org ([2001:4830:134:3::10]:43550) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1fhhLH-0004RB-7I for qemu-devel@nongnu.org; Mon, 23 Jul 2018 16:22:04 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1fhhLF-0005hM-M1 for qemu-devel@nongnu.org; Mon, 23 Jul 2018 16:22:03 -0400 Received: from mail-oi0-x242.google.com ([2607:f8b0:4003:c06::242]:40416) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_128_CBC_SHA1:16) (Exim 4.71) (envelope-from ) id 1fhhLF-0005hG-EC; Mon, 23 Jul 2018 16:22:01 -0400 Received: by mail-oi0-x242.google.com with SMTP id w126-v6so3485384oie.7; Mon, 23 Jul 2018 13:22:01 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=sender:from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=eyN2xqzxccTS5JZm6NGArfM+iXBtgcgfJ9nYhuRKytg=; b=CVYcqBBIHpbgV/1+8ESTQJhrGxpcQG3Qy9rvftIp16dHZ/RgTBKsmAE4wH80jcShct w3yrO5SblVEXmKRQjZIxqB7AedkPu1r8d1GOK/6zL+xFMHSpGQt480vUfl0ipAosvyyY PJZ/j83RockF6HPyayE4rv0nc+yVBGnqkgV9eyeudY6EwAO/zqU1u6HX6dbsSk/YdbwE 72XYK+6A9HXxA4aqOCjvsqaRdMPzA0FCGyNnCW+JUxyBX3DiZ9j6+t0Rsf2eLRySGoR0 Uqxn74ViVwsOYveCLnsBqwaRmWHHtYmymjQawMiSP8TFqUJuV8UHGhw/aWUK18GMhT3r Cb3Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:sender:from:to:cc:subject:date:message-id :in-reply-to:references:mime-version:content-transfer-encoding; bh=eyN2xqzxccTS5JZm6NGArfM+iXBtgcgfJ9nYhuRKytg=; b=BPsPV6VdHCqE2IMRy0p7A2lMtag+dg1JdIqA56BOVEGgR5fdqFiIjI4TShItzuW1Ub 4RKh3IETttFFHQnJTKjpIr6CezjPJliNsXuJHdy4yLotJtaWYuwQP8m8e9LZWx/H9p0B CHIY7VFKU3OE5Oy/tM+TmVaMZFXtvNQwqnG5rR42eI+RzrgUz74SrNgNyDlKDWth9Lh0 CuCKnsaJbzAiSpmdgawQkHjRqs+oecHkJv928SUE5rVyFhk/6A6+89tWVg9/MEufSpoy Shn/JFpuHiGk8dYafR/s3tahOs+uVVyCdUfS16kSG9CwnR0VEhXqsXYinIGC58XEqPDf jlBQ== X-Gm-Message-State: AOUpUlGS99lJT08lt77CUCNvvyOOhgoIaGYZe6WQbfnx+94ge1DOMlbl /cFW8M2yBxecf68n7QIZtin4Liw1nOPmSg== X-Received: by 2002:aca:4808:: with SMTP id v8-v6mr261314oia.259.1532377320130; Mon, 23 Jul 2018 13:22:00 -0700 (PDT) Received: from localhost (76-251-165-188.lightspeed.austtx.sbcglobal.net. [76.251.165.188]) by smtp.gmail.com with ESMTPSA id a8-v6sm7950609oia.24.2018.07.23.13.21.58 (version=TLS1_2 cipher=ECDHE-RSA-CHACHA20-POLY1305 bits=256/256); Mon, 23 Jul 2018 13:21:59 -0700 (PDT) From: Michael Roth To: qemu-devel@nongnu.org Date: Mon, 23 Jul 2018 15:17:41 -0500 Message-Id: <20180723201748.25573-93-mdroth@linux.vnet.ibm.com> X-Mailer: git-send-email 2.17.1 In-Reply-To: <20180723201748.25573-1-mdroth@linux.vnet.ibm.com> References: <20180723201748.25573-1-mdroth@linux.vnet.ibm.com> MIME-Version: 1.0 X-detected-operating-system: by eggs.gnu.org: Genre and OS details not recognized. X-Received-From: 2607:f8b0:4003:c06::242 Subject: [Qemu-devel] [PATCH 92/99] tcg: Reduce max TB opcode count X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Richard Henderson , qemu-stable@nongnu.org Errors-To: qemu-devel-bounces+patch=linaro.org@nongnu.org Sender: "Qemu-devel" From: Richard Henderson Also, assert that we don't overflow any of two different offsets into the TB. Both unwind and goto_tb both record a uint16_t for later use. This fixes an arm-softmmu test case utilizing NEON in which there is a TB generated that runs to 7800 opcodes, and compiles to 96k on an x86_64 host. This overflows the 16-bit offset in which we record the goto_tb reset offset. Because of that overflow, we install a jump destination that goes to neverland. Boom. With this reduced op count, the same TB compiles to about 48k for aarch64, ppc64le, and x86_64 hosts, and neither assertion fires. Cc: qemu-stable@nongnu.org Reported-by: "Jason A. Donenfeld" Reviewed-by: Philippe Mathieu-Daudé Signed-off-by: Richard Henderson (cherry picked from commit 9f754620651d3432114f4bb89c7f12cbea814b3e) Signed-off-by: Michael Roth --- tcg/aarch64/tcg-target.inc.c | 2 +- tcg/arm/tcg-target.inc.c | 2 +- tcg/i386/tcg-target.inc.c | 2 +- tcg/mips/tcg-target.inc.c | 2 +- tcg/ppc/tcg-target.inc.c | 4 ++-- tcg/s390/tcg-target.inc.c | 2 +- tcg/sparc/tcg-target.inc.c | 4 ++-- tcg/tcg.c | 13 ++++++++++++- tcg/tcg.h | 6 ++++-- tcg/tci/tcg-target.inc.c | 2 +- 10 files changed, 26 insertions(+), 13 deletions(-) -- 2.17.1 diff --git a/tcg/aarch64/tcg-target.inc.c b/tcg/aarch64/tcg-target.inc.c index be3192078d..4562d36d1b 100644 --- a/tcg/aarch64/tcg-target.inc.c +++ b/tcg/aarch64/tcg-target.inc.c @@ -1733,7 +1733,7 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, tcg_out_insn(s, 3305, LDR, offset, TCG_REG_TMP); } tcg_out_insn(s, 3207, BR, TCG_REG_TMP); - s->tb_jmp_reset_offset[a0] = tcg_current_code_size(s); + set_jmp_reset_offset(s, a0); break; case INDEX_op_goto_ptr: diff --git a/tcg/arm/tcg-target.inc.c b/tcg/arm/tcg-target.inc.c index 56a32a470f..e1fbf465cb 100644 --- a/tcg/arm/tcg-target.inc.c +++ b/tcg/arm/tcg-target.inc.c @@ -1822,7 +1822,7 @@ static inline void tcg_out_op(TCGContext *s, TCGOpcode opc, tcg_out_movi32(s, COND_AL, base, ptr - dil); } tcg_out_ld32_12(s, COND_AL, TCG_REG_PC, base, dil); - s->tb_jmp_reset_offset[args[0]] = tcg_current_code_size(s); + set_jmp_reset_offset(s, args[0]); } break; case INDEX_op_goto_ptr: diff --git a/tcg/i386/tcg-target.inc.c b/tcg/i386/tcg-target.inc.c index 5357909fff..ccde8801a5 100644 --- a/tcg/i386/tcg-target.inc.c +++ b/tcg/i386/tcg-target.inc.c @@ -2245,7 +2245,7 @@ static inline void tcg_out_op(TCGContext *s, TCGOpcode opc, tcg_out_modrm_offset(s, OPC_GRP5, EXT5_JMPN_Ev, -1, (intptr_t)(s->tb_jmp_target_addr + a0)); } - s->tb_jmp_reset_offset[a0] = tcg_current_code_size(s); + set_jmp_reset_offset(s, a0); break; case INDEX_op_goto_ptr: /* jmp to the given host address (could be epilogue) */ diff --git a/tcg/mips/tcg-target.inc.c b/tcg/mips/tcg-target.inc.c index ca5f1d4894..cff525373b 100644 --- a/tcg/mips/tcg-target.inc.c +++ b/tcg/mips/tcg-target.inc.c @@ -1744,7 +1744,7 @@ static inline void tcg_out_op(TCGContext *s, TCGOpcode opc, tcg_out_opc_reg(s, OPC_JR, 0, TCG_TMP0, 0); } tcg_out_nop(s); - s->tb_jmp_reset_offset[a0] = tcg_current_code_size(s); + set_jmp_reset_offset(s, a0); break; case INDEX_op_goto_ptr: /* jmp to the given host address (could be epilogue) */ diff --git a/tcg/ppc/tcg-target.inc.c b/tcg/ppc/tcg-target.inc.c index 86f7de5f7e..c2f729ee8f 100644 --- a/tcg/ppc/tcg-target.inc.c +++ b/tcg/ppc/tcg-target.inc.c @@ -2025,10 +2025,10 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, const TCGArg *args, } tcg_out32(s, MTSPR | RS(TCG_REG_TB) | CTR); tcg_out32(s, BCCTR | BO_ALWAYS); - s->tb_jmp_reset_offset[args[0]] = c = tcg_current_code_size(s); + set_jmp_reset_offset(s, args[0]); if (USE_REG_TB) { /* For the unlinked case, need to reset TCG_REG_TB. */ - c = -c; + c = -tcg_current_code_size(s); assert(c == (int16_t)c); tcg_out32(s, ADDI | TAI(TCG_REG_TB, TCG_REG_TB, c)); } diff --git a/tcg/s390/tcg-target.inc.c b/tcg/s390/tcg-target.inc.c index 9af6dcef05..17c435ade5 100644 --- a/tcg/s390/tcg-target.inc.c +++ b/tcg/s390/tcg-target.inc.c @@ -1783,7 +1783,7 @@ static inline void tcg_out_op(TCGContext *s, TCGOpcode opc, /* and go there */ tcg_out_insn(s, RR, BCR, S390_CC_ALWAYS, TCG_REG_TB); } - s->tb_jmp_reset_offset[a0] = tcg_current_code_size(s); + set_jmp_reset_offset(s, a0); /* For the unlinked path of goto_tb, we need to reset TCG_REG_TB to the beginning of this TB. */ diff --git a/tcg/sparc/tcg-target.inc.c b/tcg/sparc/tcg-target.inc.c index bc673bd8c6..04bdc3df5e 100644 --- a/tcg/sparc/tcg-target.inc.c +++ b/tcg/sparc/tcg-target.inc.c @@ -1388,12 +1388,12 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, tcg_out_arithi(s, TCG_REG_G0, TCG_REG_TB, 0, JMPL); tcg_out_nop(s); } - s->tb_jmp_reset_offset[a0] = c = tcg_current_code_size(s); + set_jmp_reset_offset(s, a0); /* For the unlinked path of goto_tb, we need to reset TCG_REG_TB to the beginning of this TB. */ if (USE_REG_TB) { - c = -c; + c = -tcg_current_code_size(s); if (check_fit_i32(c, 13)) { tcg_out_arithi(s, TCG_REG_TB, TCG_REG_TB, c, ARITH_ADD); } else { diff --git a/tcg/tcg.c b/tcg/tcg.c index 66997cc653..9c1de541d6 100644 --- a/tcg/tcg.c +++ b/tcg/tcg.c @@ -293,6 +293,14 @@ TCGLabel *gen_new_label(void) return l; } +static void set_jmp_reset_offset(TCGContext *s, int which) +{ + size_t off = tcg_current_code_size(s); + s->tb_jmp_reset_offset[which] = off; + /* Make sure that we didn't overflow the stored offset. */ + assert(s->tb_jmp_reset_offset[which] == off); +} + #include "tcg-target.inc.c" static void tcg_region_bounds(size_t curr_region, void **pstart, void **pend) @@ -3354,7 +3362,10 @@ int tcg_gen_code(TCGContext *s, TranslationBlock *tb) break; case INDEX_op_insn_start: if (num_insns >= 0) { - s->gen_insn_end_off[num_insns] = tcg_current_code_size(s); + size_t off = tcg_current_code_size(s); + s->gen_insn_end_off[num_insns] = off; + /* Assert that we do not overflow our stored offset. */ + assert(s->gen_insn_end_off[num_insns] == off); } num_insns++; for (i = 0; i < TARGET_INSN_START_WORDS; ++i) { diff --git a/tcg/tcg.h b/tcg/tcg.h index 17cf764565..755860e50d 100644 --- a/tcg/tcg.h +++ b/tcg/tcg.h @@ -848,9 +848,11 @@ static inline bool tcg_op_buf_full(void) /* This is not a hard limit, it merely stops translation when * we have produced "enough" opcodes. We want to limit TB size * such that a RISC host can reasonably use a 16-bit signed - * branch within the TB. + * branch within the TB. We also need to be mindful of the + * 16-bit unsigned offsets, TranslationBlock.jmp_reset_offset[] + * and TCGContext.gen_insn_end_off[]. */ - return tcg_ctx->nb_ops >= 8000; + return tcg_ctx->nb_ops >= 4000; } /* pool based memory allocation */ diff --git a/tcg/tci/tcg-target.inc.c b/tcg/tci/tcg-target.inc.c index cc949bea85..62ed097254 100644 --- a/tcg/tci/tcg-target.inc.c +++ b/tcg/tci/tcg-target.inc.c @@ -574,7 +574,7 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, const TCGArg *args, /* Indirect jump method. */ TODO(); } - s->tb_jmp_reset_offset[args[0]] = tcg_current_code_size(s); + set_jmp_reset_offset(s, args[0]); break; case INDEX_op_br: tci_out_label(s, arg_label(args[0]));