2003-08-09 07:58:05 +08:00
|
|
|
/*
|
|
|
|
|
* Software MMU support
|
2007-09-17 05:08:06 +08:00
|
|
|
*
|
2011-09-22 04:00:18 +08:00
|
|
|
* Generate helpers used by TCG for qemu_ld/st ops and code load
|
|
|
|
|
* functions.
|
|
|
|
|
*
|
|
|
|
|
* Included from target op helpers and exec.c.
|
|
|
|
|
*
|
2003-08-09 07:58:05 +08:00
|
|
|
* Copyright (c) 2003 Fabrice Bellard
|
|
|
|
|
*
|
|
|
|
|
* This library is free software; you can redistribute it and/or
|
|
|
|
|
* modify it under the terms of the GNU Lesser General Public
|
|
|
|
|
* License as published by the Free Software Foundation; either
|
|
|
|
|
* version 2 of the License, or (at your option) any later version.
|
|
|
|
|
*
|
|
|
|
|
* This library is distributed in the hope that it will be useful,
|
|
|
|
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
|
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
|
|
|
|
* Lesser General Public License for more details.
|
|
|
|
|
*
|
|
|
|
|
* You should have received a copy of the GNU Lesser General Public
|
2009-07-17 04:47:01 +08:00
|
|
|
* License along with this library; if not, see <http://www.gnu.org/licenses/>.
|
2003-08-09 07:58:05 +08:00
|
|
|
*/
|
2012-12-18 01:20:00 +08:00
|
|
|
#include "qemu/timer.h"
|
2013-11-08 02:55:56 +08:00
|
|
|
#include "exec/address-spaces.h"
|
2012-12-18 01:19:49 +08:00
|
|
|
#include "exec/memory.h"
|
2010-03-30 03:24:00 +08:00
|
|
|
|
2003-08-09 07:58:05 +08:00
|
|
|
#define DATA_SIZE (1 << SHIFT)
|
|
|
|
|
|
|
|
|
|
#if DATA_SIZE == 8
|
|
|
|
|
#define SUFFIX q
|
2013-08-28 02:31:48 +08:00
|
|
|
#define LSUFFIX q
|
2013-08-28 05:09:14 +08:00
|
|
|
#define SDATA_TYPE int64_t
|
2014-01-18 21:47:23 +08:00
|
|
|
#define DATA_TYPE uint64_t
|
2003-08-09 07:58:05 +08:00
|
|
|
#elif DATA_SIZE == 4
|
|
|
|
|
#define SUFFIX l
|
2013-08-28 02:31:48 +08:00
|
|
|
#define LSUFFIX l
|
2013-08-28 05:09:14 +08:00
|
|
|
#define SDATA_TYPE int32_t
|
2014-01-18 21:47:23 +08:00
|
|
|
#define DATA_TYPE uint32_t
|
2003-08-09 07:58:05 +08:00
|
|
|
#elif DATA_SIZE == 2
|
|
|
|
|
#define SUFFIX w
|
2013-08-28 02:31:48 +08:00
|
|
|
#define LSUFFIX uw
|
2013-08-28 05:09:14 +08:00
|
|
|
#define SDATA_TYPE int16_t
|
2014-01-18 21:47:23 +08:00
|
|
|
#define DATA_TYPE uint16_t
|
2003-08-09 07:58:05 +08:00
|
|
|
#elif DATA_SIZE == 1
|
|
|
|
|
#define SUFFIX b
|
2013-08-28 02:31:48 +08:00
|
|
|
#define LSUFFIX ub
|
2013-08-28 05:09:14 +08:00
|
|
|
#define SDATA_TYPE int8_t
|
2014-01-18 21:47:23 +08:00
|
|
|
#define DATA_TYPE uint8_t
|
2003-08-09 07:58:05 +08:00
|
|
|
#else
|
|
|
|
|
#error unsupported data size
|
|
|
|
|
#endif
|
|
|
|
|
|
2013-08-28 05:09:14 +08:00
|
|
|
|
|
|
|
|
/* For the benefit of TCG generated code, we want to avoid the complication
|
|
|
|
|
of ABI-specific return type promotion and always return a value extended
|
|
|
|
|
to the register size of the host. This is tcg_target_long, except in the
|
|
|
|
|
case of a 32-bit host and 64-bit data, and for that we always have
|
|
|
|
|
uint64_t. Don't bother with this widened value for SOFTMMU_CODE_ACCESS. */
|
|
|
|
|
#if defined(SOFTMMU_CODE_ACCESS) || DATA_SIZE == 8
|
|
|
|
|
# define WORD_TYPE DATA_TYPE
|
|
|
|
|
# define USUFFIX SUFFIX
|
|
|
|
|
#else
|
|
|
|
|
# define WORD_TYPE tcg_target_ulong
|
|
|
|
|
# define USUFFIX glue(u, SUFFIX)
|
|
|
|
|
# define SSUFFIX glue(s, SUFFIX)
|
|
|
|
|
#endif
|
|
|
|
|
|
2004-10-03 23:07:13 +08:00
|
|
|
#ifdef SOFTMMU_CODE_ACCESS
|
2014-07-07 18:23:56 +08:00
|
|
|
#define READ_ACCESS_TYPE MMU_INST_FETCH
|
2005-11-29 05:19:04 +08:00
|
|
|
#define ADDR_READ addr_code
|
2004-10-03 23:07:13 +08:00
|
|
|
#else
|
2014-07-07 18:23:56 +08:00
|
|
|
#define READ_ACCESS_TYPE MMU_DATA_LOAD
|
2005-11-29 05:19:04 +08:00
|
|
|
#define ADDR_READ addr_read
|
2004-10-03 23:07:13 +08:00
|
|
|
#endif
|
|
|
|
|
|
2013-09-05 02:45:20 +08:00
|
|
|
#if DATA_SIZE == 8
|
|
|
|
|
# define BSWAP(X) bswap64(X)
|
|
|
|
|
#elif DATA_SIZE == 4
|
|
|
|
|
# define BSWAP(X) bswap32(X)
|
|
|
|
|
#elif DATA_SIZE == 2
|
|
|
|
|
# define BSWAP(X) bswap16(X)
|
|
|
|
|
#else
|
|
|
|
|
# define BSWAP(X) (X)
|
|
|
|
|
#endif
|
|
|
|
|
|
|
|
|
|
#ifdef TARGET_WORDS_BIGENDIAN
|
|
|
|
|
# define TGT_BE(X) (X)
|
|
|
|
|
# define TGT_LE(X) BSWAP(X)
|
|
|
|
|
#else
|
|
|
|
|
# define TGT_BE(X) BSWAP(X)
|
|
|
|
|
# define TGT_LE(X) (X)
|
|
|
|
|
#endif
|
|
|
|
|
|
|
|
|
|
#if DATA_SIZE == 1
|
|
|
|
|
# define helper_le_ld_name glue(glue(helper_ret_ld, USUFFIX), MMUSUFFIX)
|
|
|
|
|
# define helper_be_ld_name helper_le_ld_name
|
|
|
|
|
# define helper_le_lds_name glue(glue(helper_ret_ld, SSUFFIX), MMUSUFFIX)
|
|
|
|
|
# define helper_be_lds_name helper_le_lds_name
|
|
|
|
|
# define helper_le_st_name glue(glue(helper_ret_st, SUFFIX), MMUSUFFIX)
|
|
|
|
|
# define helper_be_st_name helper_le_st_name
|
|
|
|
|
#else
|
|
|
|
|
# define helper_le_ld_name glue(glue(helper_le_ld, USUFFIX), MMUSUFFIX)
|
|
|
|
|
# define helper_be_ld_name glue(glue(helper_be_ld, USUFFIX), MMUSUFFIX)
|
|
|
|
|
# define helper_le_lds_name glue(glue(helper_le_ld, SSUFFIX), MMUSUFFIX)
|
|
|
|
|
# define helper_be_lds_name glue(glue(helper_be_ld, SSUFFIX), MMUSUFFIX)
|
|
|
|
|
# define helper_le_st_name glue(glue(helper_le_st, SUFFIX), MMUSUFFIX)
|
|
|
|
|
# define helper_be_st_name glue(glue(helper_be_st, SUFFIX), MMUSUFFIX)
|
|
|
|
|
#endif
|
|
|
|
|
|
|
|
|
|
#ifdef TARGET_WORDS_BIGENDIAN
|
|
|
|
|
# define helper_te_ld_name helper_be_ld_name
|
|
|
|
|
# define helper_te_st_name helper_be_st_name
|
|
|
|
|
#else
|
|
|
|
|
# define helper_te_ld_name helper_le_ld_name
|
|
|
|
|
# define helper_te_st_name helper_le_st_name
|
|
|
|
|
#endif
|
|
|
|
|
|
implementing victim TLB for QEMU system emulated TLB
QEMU system mode page table walks are expensive. Taken by running QEMU
qemu-system-x86_64 system mode on Intel PIN , a TLB miss and walking a
4-level page tables in guest Linux OS takes ~450 X86 instructions on
average.
QEMU system mode TLB is implemented using a directly-mapped hashtable.
This structure suffers from conflict misses. Increasing the
associativity of the TLB may not be the solution to conflict misses as
all the ways may have to be walked in serial.
A victim TLB is a TLB used to hold translations evicted from the
primary TLB upon replacement. The victim TLB lies between the main TLB
and its refill path. Victim TLB is of greater associativity (fully
associative in this patch). It takes longer to lookup the victim TLB,
but its likely better than a full page table walk. The memory
translation path is changed as follows :
Before Victim TLB:
1. Inline TLB lookup
2. Exit code cache on TLB miss.
3. Check for unaligned, IO accesses
4. TLB refill.
5. Do the memory access.
6. Return to code cache.
After Victim TLB:
1. Inline TLB lookup
2. Exit code cache on TLB miss.
3. Check for unaligned, IO accesses
4. Victim TLB lookup.
5. If victim TLB misses, TLB refill
6. Do the memory access.
7. Return to code cache
The advantage is that victim TLB can offer more associativity to a
directly mapped TLB and thus potentially fewer page table walks while
still keeping the time taken to flush within reasonable limits.
However, placing a victim TLB before the refill path increase TLB
refill path as the victim TLB is consulted before the TLB refill. The
performance results demonstrate that the pros outweigh the cons.
some performance results taken on SPECINT2006 train
datasets and kernel boot and qemu configure script on an
Intel(R) Xeon(R) CPU E5620 @ 2.40GHz Linux machine are shown in the
Google Doc link below.
https://docs.google.com/spreadsheets/d/1eiItzekZwNQOal_h-5iJmC4tMDi051m9qidi5_nwvH4/edit?usp=sharing
In summary, victim TLB improves the performance of qemu-system-x86_64 by
11% on average on SPECINT2006, kernelboot and qemu configscript and with
highest improvement of in 26% in 456.hmmer. And victim TLB does not result
in any performance degradation in any of the measured benchmarks. Furthermore,
the implemented victim TLB is architecture independent and is expected to
benefit other architectures in QEMU as well.
Although there are measurement fluctuations, the performance
improvement is very significant and by no means in the range of
noises.
Signed-off-by: Xin Tong <trent.tong@gmail.com>
Message-id: 1407202523-23553-1-git-send-email-trent.tong@gmail.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-08-05 09:35:23 +08:00
|
|
|
/* macro to check the victim tlb */
|
|
|
|
|
#define VICTIM_TLB_HIT(ty) \
|
|
|
|
|
({ \
|
|
|
|
|
/* we are about to do a page table walk. our last hope is the \
|
|
|
|
|
* victim tlb. try to refill from the victim tlb before walking the \
|
|
|
|
|
* page table. */ \
|
|
|
|
|
int vidx; \
|
2015-04-26 23:49:23 +08:00
|
|
|
CPUIOTLBEntry tmpiotlb; \
|
implementing victim TLB for QEMU system emulated TLB
QEMU system mode page table walks are expensive. Taken by running QEMU
qemu-system-x86_64 system mode on Intel PIN , a TLB miss and walking a
4-level page tables in guest Linux OS takes ~450 X86 instructions on
average.
QEMU system mode TLB is implemented using a directly-mapped hashtable.
This structure suffers from conflict misses. Increasing the
associativity of the TLB may not be the solution to conflict misses as
all the ways may have to be walked in serial.
A victim TLB is a TLB used to hold translations evicted from the
primary TLB upon replacement. The victim TLB lies between the main TLB
and its refill path. Victim TLB is of greater associativity (fully
associative in this patch). It takes longer to lookup the victim TLB,
but its likely better than a full page table walk. The memory
translation path is changed as follows :
Before Victim TLB:
1. Inline TLB lookup
2. Exit code cache on TLB miss.
3. Check for unaligned, IO accesses
4. TLB refill.
5. Do the memory access.
6. Return to code cache.
After Victim TLB:
1. Inline TLB lookup
2. Exit code cache on TLB miss.
3. Check for unaligned, IO accesses
4. Victim TLB lookup.
5. If victim TLB misses, TLB refill
6. Do the memory access.
7. Return to code cache
The advantage is that victim TLB can offer more associativity to a
directly mapped TLB and thus potentially fewer page table walks while
still keeping the time taken to flush within reasonable limits.
However, placing a victim TLB before the refill path increase TLB
refill path as the victim TLB is consulted before the TLB refill. The
performance results demonstrate that the pros outweigh the cons.
some performance results taken on SPECINT2006 train
datasets and kernel boot and qemu configure script on an
Intel(R) Xeon(R) CPU E5620 @ 2.40GHz Linux machine are shown in the
Google Doc link below.
https://docs.google.com/spreadsheets/d/1eiItzekZwNQOal_h-5iJmC4tMDi051m9qidi5_nwvH4/edit?usp=sharing
In summary, victim TLB improves the performance of qemu-system-x86_64 by
11% on average on SPECINT2006, kernelboot and qemu configscript and with
highest improvement of in 26% in 456.hmmer. And victim TLB does not result
in any performance degradation in any of the measured benchmarks. Furthermore,
the implemented victim TLB is architecture independent and is expected to
benefit other architectures in QEMU as well.
Although there are measurement fluctuations, the performance
improvement is very significant and by no means in the range of
noises.
Signed-off-by: Xin Tong <trent.tong@gmail.com>
Message-id: 1407202523-23553-1-git-send-email-trent.tong@gmail.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-08-05 09:35:23 +08:00
|
|
|
CPUTLBEntry tmptlb; \
|
|
|
|
|
for (vidx = CPU_VTLB_SIZE-1; vidx >= 0; --vidx) { \
|
|
|
|
|
if (env->tlb_v_table[mmu_idx][vidx].ty == (addr & TARGET_PAGE_MASK)) {\
|
|
|
|
|
/* found entry in victim tlb, swap tlb and iotlb */ \
|
|
|
|
|
tmptlb = env->tlb_table[mmu_idx][index]; \
|
|
|
|
|
env->tlb_table[mmu_idx][index] = env->tlb_v_table[mmu_idx][vidx]; \
|
|
|
|
|
env->tlb_v_table[mmu_idx][vidx] = tmptlb; \
|
|
|
|
|
tmpiotlb = env->iotlb[mmu_idx][index]; \
|
|
|
|
|
env->iotlb[mmu_idx][index] = env->iotlb_v[mmu_idx][vidx]; \
|
|
|
|
|
env->iotlb_v[mmu_idx][vidx] = tmpiotlb; \
|
|
|
|
|
break; \
|
|
|
|
|
} \
|
|
|
|
|
} \
|
|
|
|
|
/* return true when there is a vtlb hit, i.e. vidx >=0 */ \
|
|
|
|
|
vidx >= 0; \
|
|
|
|
|
})
|
|
|
|
|
|
2014-03-29 00:55:24 +08:00
|
|
|
#ifndef SOFTMMU_CODE_ACCESS
|
2012-09-02 23:28:56 +08:00
|
|
|
static inline DATA_TYPE glue(io_read, SUFFIX)(CPUArchState *env,
|
2015-04-26 23:49:23 +08:00
|
|
|
CPUIOTLBEntry *iotlbentry,
|
2008-06-29 09:03:05 +08:00
|
|
|
target_ulong addr,
|
2012-04-09 22:20:20 +08:00
|
|
|
uintptr_t retaddr)
|
2003-08-09 07:58:05 +08:00
|
|
|
{
|
2013-05-24 22:10:39 +08:00
|
|
|
uint64_t val;
|
2013-12-17 11:06:51 +08:00
|
|
|
CPUState *cpu = ENV_GET_CPU(env);
|
2015-04-26 23:49:23 +08:00
|
|
|
hwaddr physaddr = iotlbentry->addr;
|
2016-01-21 22:15:05 +08:00
|
|
|
MemoryRegion *mr = iotlb_to_region(cpu, physaddr, iotlbentry->attrs);
|
2012-03-09 00:08:35 +08:00
|
|
|
|
2008-06-09 08:20:13 +08:00
|
|
|
physaddr = (physaddr & TARGET_PAGE_MASK) + addr;
|
2013-08-26 09:41:01 +08:00
|
|
|
cpu->mem_io_pc = retaddr;
|
2015-06-24 20:16:26 +08:00
|
|
|
if (mr != &io_mem_rom && mr != &io_mem_notdirty && !cpu->can_do_io) {
|
2013-09-01 23:21:47 +08:00
|
|
|
cpu_io_recompile(cpu, retaddr);
|
2008-06-29 09:03:05 +08:00
|
|
|
}
|
2003-08-09 07:58:05 +08:00
|
|
|
|
2013-08-26 09:41:01 +08:00
|
|
|
cpu->mem_io_vaddr = addr;
|
2015-04-26 23:49:23 +08:00
|
|
|
memory_region_dispatch_read(mr, physaddr, &val, 1 << SHIFT,
|
2015-04-26 23:49:24 +08:00
|
|
|
iotlbentry->attrs);
|
2013-05-24 22:10:39 +08:00
|
|
|
return val;
|
2003-08-09 07:58:05 +08:00
|
|
|
}
|
2014-03-29 00:55:24 +08:00
|
|
|
#endif
|
2003-08-09 07:58:05 +08:00
|
|
|
|
2015-05-14 00:10:33 +08:00
|
|
|
WORD_TYPE helper_le_ld_name(CPUArchState *env, target_ulong addr,
|
|
|
|
|
TCGMemOpIdx oi, uintptr_t retaddr)
|
2003-08-09 07:58:05 +08:00
|
|
|
{
|
2015-05-14 00:10:33 +08:00
|
|
|
unsigned mmu_idx = get_mmuidx(oi);
|
2013-07-27 02:29:15 +08:00
|
|
|
int index = (addr >> TARGET_PAGE_BITS) & (CPU_TLB_SIZE - 1);
|
|
|
|
|
target_ulong tlb_addr = env->tlb_table[mmu_idx][index].ADDR_READ;
|
|
|
|
|
uintptr_t haddr;
|
2013-09-05 02:45:20 +08:00
|
|
|
DATA_TYPE res;
|
2007-09-17 16:09:54 +08:00
|
|
|
|
2013-08-28 01:22:54 +08:00
|
|
|
/* Adjust the given return address. */
|
|
|
|
|
retaddr -= GETPC_ADJ;
|
|
|
|
|
|
2013-07-27 02:29:15 +08:00
|
|
|
/* If the TLB entry is for a different page, reload and try again. */
|
|
|
|
|
if ((addr & TARGET_PAGE_MASK)
|
|
|
|
|
!= (tlb_addr & (TARGET_PAGE_MASK | TLB_INVALID_MASK))) {
|
2015-05-14 02:25:20 +08:00
|
|
|
if ((addr & (DATA_SIZE - 1)) != 0
|
|
|
|
|
&& (get_memop(oi) & MO_AMASK) == MO_ALIGN) {
|
2014-03-29 01:14:58 +08:00
|
|
|
cpu_unaligned_access(ENV_GET_CPU(env), addr, READ_ACCESS_TYPE,
|
|
|
|
|
mmu_idx, retaddr);
|
2013-07-27 02:29:15 +08:00
|
|
|
}
|
implementing victim TLB for QEMU system emulated TLB
QEMU system mode page table walks are expensive. Taken by running QEMU
qemu-system-x86_64 system mode on Intel PIN , a TLB miss and walking a
4-level page tables in guest Linux OS takes ~450 X86 instructions on
average.
QEMU system mode TLB is implemented using a directly-mapped hashtable.
This structure suffers from conflict misses. Increasing the
associativity of the TLB may not be the solution to conflict misses as
all the ways may have to be walked in serial.
A victim TLB is a TLB used to hold translations evicted from the
primary TLB upon replacement. The victim TLB lies between the main TLB
and its refill path. Victim TLB is of greater associativity (fully
associative in this patch). It takes longer to lookup the victim TLB,
but its likely better than a full page table walk. The memory
translation path is changed as follows :
Before Victim TLB:
1. Inline TLB lookup
2. Exit code cache on TLB miss.
3. Check for unaligned, IO accesses
4. TLB refill.
5. Do the memory access.
6. Return to code cache.
After Victim TLB:
1. Inline TLB lookup
2. Exit code cache on TLB miss.
3. Check for unaligned, IO accesses
4. Victim TLB lookup.
5. If victim TLB misses, TLB refill
6. Do the memory access.
7. Return to code cache
The advantage is that victim TLB can offer more associativity to a
directly mapped TLB and thus potentially fewer page table walks while
still keeping the time taken to flush within reasonable limits.
However, placing a victim TLB before the refill path increase TLB
refill path as the victim TLB is consulted before the TLB refill. The
performance results demonstrate that the pros outweigh the cons.
some performance results taken on SPECINT2006 train
datasets and kernel boot and qemu configure script on an
Intel(R) Xeon(R) CPU E5620 @ 2.40GHz Linux machine are shown in the
Google Doc link below.
https://docs.google.com/spreadsheets/d/1eiItzekZwNQOal_h-5iJmC4tMDi051m9qidi5_nwvH4/edit?usp=sharing
In summary, victim TLB improves the performance of qemu-system-x86_64 by
11% on average on SPECINT2006, kernelboot and qemu configscript and with
highest improvement of in 26% in 456.hmmer. And victim TLB does not result
in any performance degradation in any of the measured benchmarks. Furthermore,
the implemented victim TLB is architecture independent and is expected to
benefit other architectures in QEMU as well.
Although there are measurement fluctuations, the performance
improvement is very significant and by no means in the range of
noises.
Signed-off-by: Xin Tong <trent.tong@gmail.com>
Message-id: 1407202523-23553-1-git-send-email-trent.tong@gmail.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-08-05 09:35:23 +08:00
|
|
|
if (!VICTIM_TLB_HIT(ADDR_READ)) {
|
|
|
|
|
tlb_fill(ENV_GET_CPU(env), addr, READ_ACCESS_TYPE,
|
|
|
|
|
mmu_idx, retaddr);
|
|
|
|
|
}
|
2013-07-27 02:29:15 +08:00
|
|
|
tlb_addr = env->tlb_table[mmu_idx][index].ADDR_READ;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
/* Handle an IO access. */
|
|
|
|
|
if (unlikely(tlb_addr & ~TARGET_PAGE_MASK)) {
|
2015-04-26 23:49:23 +08:00
|
|
|
CPUIOTLBEntry *iotlbentry;
|
2013-07-27 02:29:15 +08:00
|
|
|
if ((addr & (DATA_SIZE - 1)) != 0) {
|
|
|
|
|
goto do_unaligned_access;
|
2003-08-09 07:58:05 +08:00
|
|
|
}
|
2015-04-26 23:49:23 +08:00
|
|
|
iotlbentry = &env->iotlb[mmu_idx][index];
|
2013-09-05 02:45:20 +08:00
|
|
|
|
|
|
|
|
/* ??? Note that the io helpers always read data in the target
|
|
|
|
|
byte ordering. We should push the LE/BE request down into io. */
|
2015-04-26 23:49:23 +08:00
|
|
|
res = glue(io_read, SUFFIX)(env, iotlbentry, addr, retaddr);
|
2013-09-05 02:45:20 +08:00
|
|
|
res = TGT_LE(res);
|
|
|
|
|
return res;
|
2013-07-27 02:29:15 +08:00
|
|
|
}
|
|
|
|
|
|
|
|
|
|
/* Handle slow unaligned access (it spans two pages or IO). */
|
|
|
|
|
if (DATA_SIZE > 1
|
|
|
|
|
&& unlikely((addr & ~TARGET_PAGE_MASK) + DATA_SIZE - 1
|
|
|
|
|
>= TARGET_PAGE_SIZE)) {
|
|
|
|
|
target_ulong addr1, addr2;
|
2013-09-05 02:45:20 +08:00
|
|
|
DATA_TYPE res1, res2;
|
2013-07-27 02:29:15 +08:00
|
|
|
unsigned shift;
|
|
|
|
|
do_unaligned_access:
|
2015-05-14 02:25:20 +08:00
|
|
|
if ((get_memop(oi) & MO_AMASK) == MO_ALIGN) {
|
|
|
|
|
cpu_unaligned_access(ENV_GET_CPU(env), addr, READ_ACCESS_TYPE,
|
|
|
|
|
mmu_idx, retaddr);
|
|
|
|
|
}
|
2013-07-27 02:29:15 +08:00
|
|
|
addr1 = addr & ~(DATA_SIZE - 1);
|
|
|
|
|
addr2 = addr1 + DATA_SIZE;
|
2013-08-28 01:22:54 +08:00
|
|
|
/* Note the adjustment at the beginning of the function.
|
|
|
|
|
Undo that for the recursion. */
|
2015-05-14 00:10:33 +08:00
|
|
|
res1 = helper_le_ld_name(env, addr1, oi, retaddr + GETPC_ADJ);
|
|
|
|
|
res2 = helper_le_ld_name(env, addr2, oi, retaddr + GETPC_ADJ);
|
2013-07-27 02:29:15 +08:00
|
|
|
shift = (addr & (DATA_SIZE - 1)) * 8;
|
2013-09-05 02:45:20 +08:00
|
|
|
|
|
|
|
|
/* Little-endian combine. */
|
2013-07-27 02:29:15 +08:00
|
|
|
res = (res1 >> shift) | (res2 << ((DATA_SIZE * 8) - shift));
|
2013-09-05 02:45:20 +08:00
|
|
|
return res;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
/* Handle aligned access or unaligned access in the same page. */
|
2015-05-14 02:25:20 +08:00
|
|
|
if ((addr & (DATA_SIZE - 1)) != 0
|
|
|
|
|
&& (get_memop(oi) & MO_AMASK) == MO_ALIGN) {
|
2014-03-29 01:14:58 +08:00
|
|
|
cpu_unaligned_access(ENV_GET_CPU(env), addr, READ_ACCESS_TYPE,
|
|
|
|
|
mmu_idx, retaddr);
|
2013-09-05 02:45:20 +08:00
|
|
|
}
|
|
|
|
|
|
|
|
|
|
haddr = addr + env->tlb_table[mmu_idx][index].addend;
|
|
|
|
|
#if DATA_SIZE == 1
|
|
|
|
|
res = glue(glue(ld, LSUFFIX), _p)((uint8_t *)haddr);
|
|
|
|
|
#else
|
|
|
|
|
res = glue(glue(ld, LSUFFIX), _le_p)((uint8_t *)haddr);
|
|
|
|
|
#endif
|
|
|
|
|
return res;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
#if DATA_SIZE > 1
|
2015-05-14 00:10:33 +08:00
|
|
|
WORD_TYPE helper_be_ld_name(CPUArchState *env, target_ulong addr,
|
|
|
|
|
TCGMemOpIdx oi, uintptr_t retaddr)
|
2013-09-05 02:45:20 +08:00
|
|
|
{
|
2015-05-14 00:10:33 +08:00
|
|
|
unsigned mmu_idx = get_mmuidx(oi);
|
2013-09-05 02:45:20 +08:00
|
|
|
int index = (addr >> TARGET_PAGE_BITS) & (CPU_TLB_SIZE - 1);
|
|
|
|
|
target_ulong tlb_addr = env->tlb_table[mmu_idx][index].ADDR_READ;
|
|
|
|
|
uintptr_t haddr;
|
|
|
|
|
DATA_TYPE res;
|
|
|
|
|
|
|
|
|
|
/* Adjust the given return address. */
|
|
|
|
|
retaddr -= GETPC_ADJ;
|
|
|
|
|
|
|
|
|
|
/* If the TLB entry is for a different page, reload and try again. */
|
|
|
|
|
if ((addr & TARGET_PAGE_MASK)
|
|
|
|
|
!= (tlb_addr & (TARGET_PAGE_MASK | TLB_INVALID_MASK))) {
|
2015-05-14 02:25:20 +08:00
|
|
|
if ((addr & (DATA_SIZE - 1)) != 0
|
|
|
|
|
&& (get_memop(oi) & MO_AMASK) == MO_ALIGN) {
|
2014-03-29 01:14:58 +08:00
|
|
|
cpu_unaligned_access(ENV_GET_CPU(env), addr, READ_ACCESS_TYPE,
|
|
|
|
|
mmu_idx, retaddr);
|
2013-09-05 02:45:20 +08:00
|
|
|
}
|
implementing victim TLB for QEMU system emulated TLB
QEMU system mode page table walks are expensive. Taken by running QEMU
qemu-system-x86_64 system mode on Intel PIN , a TLB miss and walking a
4-level page tables in guest Linux OS takes ~450 X86 instructions on
average.
QEMU system mode TLB is implemented using a directly-mapped hashtable.
This structure suffers from conflict misses. Increasing the
associativity of the TLB may not be the solution to conflict misses as
all the ways may have to be walked in serial.
A victim TLB is a TLB used to hold translations evicted from the
primary TLB upon replacement. The victim TLB lies between the main TLB
and its refill path. Victim TLB is of greater associativity (fully
associative in this patch). It takes longer to lookup the victim TLB,
but its likely better than a full page table walk. The memory
translation path is changed as follows :
Before Victim TLB:
1. Inline TLB lookup
2. Exit code cache on TLB miss.
3. Check for unaligned, IO accesses
4. TLB refill.
5. Do the memory access.
6. Return to code cache.
After Victim TLB:
1. Inline TLB lookup
2. Exit code cache on TLB miss.
3. Check for unaligned, IO accesses
4. Victim TLB lookup.
5. If victim TLB misses, TLB refill
6. Do the memory access.
7. Return to code cache
The advantage is that victim TLB can offer more associativity to a
directly mapped TLB and thus potentially fewer page table walks while
still keeping the time taken to flush within reasonable limits.
However, placing a victim TLB before the refill path increase TLB
refill path as the victim TLB is consulted before the TLB refill. The
performance results demonstrate that the pros outweigh the cons.
some performance results taken on SPECINT2006 train
datasets and kernel boot and qemu configure script on an
Intel(R) Xeon(R) CPU E5620 @ 2.40GHz Linux machine are shown in the
Google Doc link below.
https://docs.google.com/spreadsheets/d/1eiItzekZwNQOal_h-5iJmC4tMDi051m9qidi5_nwvH4/edit?usp=sharing
In summary, victim TLB improves the performance of qemu-system-x86_64 by
11% on average on SPECINT2006, kernelboot and qemu configscript and with
highest improvement of in 26% in 456.hmmer. And victim TLB does not result
in any performance degradation in any of the measured benchmarks. Furthermore,
the implemented victim TLB is architecture independent and is expected to
benefit other architectures in QEMU as well.
Although there are measurement fluctuations, the performance
improvement is very significant and by no means in the range of
noises.
Signed-off-by: Xin Tong <trent.tong@gmail.com>
Message-id: 1407202523-23553-1-git-send-email-trent.tong@gmail.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-08-05 09:35:23 +08:00
|
|
|
if (!VICTIM_TLB_HIT(ADDR_READ)) {
|
|
|
|
|
tlb_fill(ENV_GET_CPU(env), addr, READ_ACCESS_TYPE,
|
|
|
|
|
mmu_idx, retaddr);
|
|
|
|
|
}
|
2013-09-05 02:45:20 +08:00
|
|
|
tlb_addr = env->tlb_table[mmu_idx][index].ADDR_READ;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
/* Handle an IO access. */
|
|
|
|
|
if (unlikely(tlb_addr & ~TARGET_PAGE_MASK)) {
|
2015-04-26 23:49:23 +08:00
|
|
|
CPUIOTLBEntry *iotlbentry;
|
2013-09-05 02:45:20 +08:00
|
|
|
if ((addr & (DATA_SIZE - 1)) != 0) {
|
|
|
|
|
goto do_unaligned_access;
|
|
|
|
|
}
|
2015-04-26 23:49:23 +08:00
|
|
|
iotlbentry = &env->iotlb[mmu_idx][index];
|
2013-09-05 02:45:20 +08:00
|
|
|
|
|
|
|
|
/* ??? Note that the io helpers always read data in the target
|
|
|
|
|
byte ordering. We should push the LE/BE request down into io. */
|
2015-04-26 23:49:23 +08:00
|
|
|
res = glue(io_read, SUFFIX)(env, iotlbentry, addr, retaddr);
|
2013-09-05 02:45:20 +08:00
|
|
|
res = TGT_BE(res);
|
|
|
|
|
return res;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
/* Handle slow unaligned access (it spans two pages or IO). */
|
|
|
|
|
if (DATA_SIZE > 1
|
|
|
|
|
&& unlikely((addr & ~TARGET_PAGE_MASK) + DATA_SIZE - 1
|
|
|
|
|
>= TARGET_PAGE_SIZE)) {
|
|
|
|
|
target_ulong addr1, addr2;
|
|
|
|
|
DATA_TYPE res1, res2;
|
|
|
|
|
unsigned shift;
|
|
|
|
|
do_unaligned_access:
|
2015-05-14 02:25:20 +08:00
|
|
|
if ((get_memop(oi) & MO_AMASK) == MO_ALIGN) {
|
|
|
|
|
cpu_unaligned_access(ENV_GET_CPU(env), addr, READ_ACCESS_TYPE,
|
|
|
|
|
mmu_idx, retaddr);
|
|
|
|
|
}
|
2013-09-05 02:45:20 +08:00
|
|
|
addr1 = addr & ~(DATA_SIZE - 1);
|
|
|
|
|
addr2 = addr1 + DATA_SIZE;
|
|
|
|
|
/* Note the adjustment at the beginning of the function.
|
|
|
|
|
Undo that for the recursion. */
|
2015-05-14 00:10:33 +08:00
|
|
|
res1 = helper_be_ld_name(env, addr1, oi, retaddr + GETPC_ADJ);
|
|
|
|
|
res2 = helper_be_ld_name(env, addr2, oi, retaddr + GETPC_ADJ);
|
2013-09-05 02:45:20 +08:00
|
|
|
shift = (addr & (DATA_SIZE - 1)) * 8;
|
|
|
|
|
|
|
|
|
|
/* Big-endian combine. */
|
|
|
|
|
res = (res1 << shift) | (res2 >> ((DATA_SIZE * 8) - shift));
|
2013-07-27 02:29:15 +08:00
|
|
|
return res;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
/* Handle aligned access or unaligned access in the same page. */
|
2015-05-14 02:25:20 +08:00
|
|
|
if ((addr & (DATA_SIZE - 1)) != 0
|
|
|
|
|
&& (get_memop(oi) & MO_AMASK) == MO_ALIGN) {
|
2014-03-29 01:14:58 +08:00
|
|
|
cpu_unaligned_access(ENV_GET_CPU(env), addr, READ_ACCESS_TYPE,
|
|
|
|
|
mmu_idx, retaddr);
|
2003-08-09 07:58:05 +08:00
|
|
|
}
|
2013-07-27 02:29:15 +08:00
|
|
|
|
|
|
|
|
haddr = addr + env->tlb_table[mmu_idx][index].addend;
|
2013-09-05 02:45:20 +08:00
|
|
|
res = glue(glue(ld, LSUFFIX), _be_p)((uint8_t *)haddr);
|
|
|
|
|
return res;
|
2003-08-09 07:58:05 +08:00
|
|
|
}
|
2013-09-05 02:45:20 +08:00
|
|
|
#endif /* DATA_SIZE > 1 */
|
2003-08-09 07:58:05 +08:00
|
|
|
|
2004-10-03 23:07:13 +08:00
|
|
|
#ifndef SOFTMMU_CODE_ACCESS
|
|
|
|
|
|
2013-08-28 05:09:14 +08:00
|
|
|
/* Provide signed versions of the load routines as well. We can of course
|
|
|
|
|
avoid this for 64-bit data, or for 32-bit data on 32-bit host. */
|
|
|
|
|
#if DATA_SIZE * 8 < TCG_TARGET_REG_BITS
|
2013-09-05 02:45:20 +08:00
|
|
|
WORD_TYPE helper_le_lds_name(CPUArchState *env, target_ulong addr,
|
2015-05-14 00:10:33 +08:00
|
|
|
TCGMemOpIdx oi, uintptr_t retaddr)
|
2013-09-05 02:45:20 +08:00
|
|
|
{
|
2015-05-14 00:10:33 +08:00
|
|
|
return (SDATA_TYPE)helper_le_ld_name(env, addr, oi, retaddr);
|
2013-09-05 02:45:20 +08:00
|
|
|
}
|
|
|
|
|
|
|
|
|
|
# if DATA_SIZE > 1
|
|
|
|
|
WORD_TYPE helper_be_lds_name(CPUArchState *env, target_ulong addr,
|
2015-05-14 00:10:33 +08:00
|
|
|
TCGMemOpIdx oi, uintptr_t retaddr)
|
2013-08-28 05:09:14 +08:00
|
|
|
{
|
2015-05-14 00:10:33 +08:00
|
|
|
return (SDATA_TYPE)helper_be_ld_name(env, addr, oi, retaddr);
|
2013-08-28 05:09:14 +08:00
|
|
|
}
|
2013-09-05 02:45:20 +08:00
|
|
|
# endif
|
2013-08-28 05:09:14 +08:00
|
|
|
#endif
|
|
|
|
|
|
2012-09-02 23:28:56 +08:00
|
|
|
static inline void glue(io_write, SUFFIX)(CPUArchState *env,
|
2015-04-26 23:49:23 +08:00
|
|
|
CPUIOTLBEntry *iotlbentry,
|
2004-10-03 23:07:13 +08:00
|
|
|
DATA_TYPE val,
|
2008-06-09 08:20:13 +08:00
|
|
|
target_ulong addr,
|
2012-04-09 22:20:20 +08:00
|
|
|
uintptr_t retaddr)
|
2004-10-03 23:07:13 +08:00
|
|
|
{
|
2013-12-17 11:06:51 +08:00
|
|
|
CPUState *cpu = ENV_GET_CPU(env);
|
2015-04-26 23:49:23 +08:00
|
|
|
hwaddr physaddr = iotlbentry->addr;
|
2016-01-21 22:15:05 +08:00
|
|
|
MemoryRegion *mr = iotlb_to_region(cpu, physaddr, iotlbentry->attrs);
|
2012-03-09 00:08:35 +08:00
|
|
|
|
2008-06-09 08:20:13 +08:00
|
|
|
physaddr = (physaddr & TARGET_PAGE_MASK) + addr;
|
2015-06-24 20:16:26 +08:00
|
|
|
if (mr != &io_mem_rom && mr != &io_mem_notdirty && !cpu->can_do_io) {
|
2013-09-01 23:21:47 +08:00
|
|
|
cpu_io_recompile(cpu, retaddr);
|
2008-06-29 09:03:05 +08:00
|
|
|
}
|
2004-10-03 23:07:13 +08:00
|
|
|
|
2013-08-26 09:41:01 +08:00
|
|
|
cpu->mem_io_vaddr = addr;
|
|
|
|
|
cpu->mem_io_pc = retaddr;
|
2015-04-26 23:49:23 +08:00
|
|
|
memory_region_dispatch_write(mr, physaddr, val, 1 << SHIFT,
|
2015-04-26 23:49:24 +08:00
|
|
|
iotlbentry->attrs);
|
2004-10-03 23:07:13 +08:00
|
|
|
}
|
2003-08-09 07:58:05 +08:00
|
|
|
|
2013-09-05 02:45:20 +08:00
|
|
|
void helper_le_st_name(CPUArchState *env, target_ulong addr, DATA_TYPE val,
|
2015-05-14 00:10:33 +08:00
|
|
|
TCGMemOpIdx oi, uintptr_t retaddr)
|
2003-08-09 07:58:05 +08:00
|
|
|
{
|
2015-05-14 00:10:33 +08:00
|
|
|
unsigned mmu_idx = get_mmuidx(oi);
|
2013-07-27 02:29:15 +08:00
|
|
|
int index = (addr >> TARGET_PAGE_BITS) & (CPU_TLB_SIZE - 1);
|
|
|
|
|
target_ulong tlb_addr = env->tlb_table[mmu_idx][index].addr_write;
|
|
|
|
|
uintptr_t haddr;
|
2007-09-17 16:09:54 +08:00
|
|
|
|
2013-08-28 01:22:54 +08:00
|
|
|
/* Adjust the given return address. */
|
|
|
|
|
retaddr -= GETPC_ADJ;
|
|
|
|
|
|
2013-07-27 02:29:15 +08:00
|
|
|
/* If the TLB entry is for a different page, reload and try again. */
|
|
|
|
|
if ((addr & TARGET_PAGE_MASK)
|
|
|
|
|
!= (tlb_addr & (TARGET_PAGE_MASK | TLB_INVALID_MASK))) {
|
2015-05-14 02:25:20 +08:00
|
|
|
if ((addr & (DATA_SIZE - 1)) != 0
|
|
|
|
|
&& (get_memop(oi) & MO_AMASK) == MO_ALIGN) {
|
2014-07-07 18:23:56 +08:00
|
|
|
cpu_unaligned_access(ENV_GET_CPU(env), addr, MMU_DATA_STORE,
|
|
|
|
|
mmu_idx, retaddr);
|
2013-07-27 02:29:15 +08:00
|
|
|
}
|
implementing victim TLB for QEMU system emulated TLB
QEMU system mode page table walks are expensive. Taken by running QEMU
qemu-system-x86_64 system mode on Intel PIN , a TLB miss and walking a
4-level page tables in guest Linux OS takes ~450 X86 instructions on
average.
QEMU system mode TLB is implemented using a directly-mapped hashtable.
This structure suffers from conflict misses. Increasing the
associativity of the TLB may not be the solution to conflict misses as
all the ways may have to be walked in serial.
A victim TLB is a TLB used to hold translations evicted from the
primary TLB upon replacement. The victim TLB lies between the main TLB
and its refill path. Victim TLB is of greater associativity (fully
associative in this patch). It takes longer to lookup the victim TLB,
but its likely better than a full page table walk. The memory
translation path is changed as follows :
Before Victim TLB:
1. Inline TLB lookup
2. Exit code cache on TLB miss.
3. Check for unaligned, IO accesses
4. TLB refill.
5. Do the memory access.
6. Return to code cache.
After Victim TLB:
1. Inline TLB lookup
2. Exit code cache on TLB miss.
3. Check for unaligned, IO accesses
4. Victim TLB lookup.
5. If victim TLB misses, TLB refill
6. Do the memory access.
7. Return to code cache
The advantage is that victim TLB can offer more associativity to a
directly mapped TLB and thus potentially fewer page table walks while
still keeping the time taken to flush within reasonable limits.
However, placing a victim TLB before the refill path increase TLB
refill path as the victim TLB is consulted before the TLB refill. The
performance results demonstrate that the pros outweigh the cons.
some performance results taken on SPECINT2006 train
datasets and kernel boot and qemu configure script on an
Intel(R) Xeon(R) CPU E5620 @ 2.40GHz Linux machine are shown in the
Google Doc link below.
https://docs.google.com/spreadsheets/d/1eiItzekZwNQOal_h-5iJmC4tMDi051m9qidi5_nwvH4/edit?usp=sharing
In summary, victim TLB improves the performance of qemu-system-x86_64 by
11% on average on SPECINT2006, kernelboot and qemu configscript and with
highest improvement of in 26% in 456.hmmer. And victim TLB does not result
in any performance degradation in any of the measured benchmarks. Furthermore,
the implemented victim TLB is architecture independent and is expected to
benefit other architectures in QEMU as well.
Although there are measurement fluctuations, the performance
improvement is very significant and by no means in the range of
noises.
Signed-off-by: Xin Tong <trent.tong@gmail.com>
Message-id: 1407202523-23553-1-git-send-email-trent.tong@gmail.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-08-05 09:35:23 +08:00
|
|
|
if (!VICTIM_TLB_HIT(addr_write)) {
|
2014-07-07 18:23:56 +08:00
|
|
|
tlb_fill(ENV_GET_CPU(env), addr, MMU_DATA_STORE, mmu_idx, retaddr);
|
implementing victim TLB for QEMU system emulated TLB
QEMU system mode page table walks are expensive. Taken by running QEMU
qemu-system-x86_64 system mode on Intel PIN , a TLB miss and walking a
4-level page tables in guest Linux OS takes ~450 X86 instructions on
average.
QEMU system mode TLB is implemented using a directly-mapped hashtable.
This structure suffers from conflict misses. Increasing the
associativity of the TLB may not be the solution to conflict misses as
all the ways may have to be walked in serial.
A victim TLB is a TLB used to hold translations evicted from the
primary TLB upon replacement. The victim TLB lies between the main TLB
and its refill path. Victim TLB is of greater associativity (fully
associative in this patch). It takes longer to lookup the victim TLB,
but its likely better than a full page table walk. The memory
translation path is changed as follows :
Before Victim TLB:
1. Inline TLB lookup
2. Exit code cache on TLB miss.
3. Check for unaligned, IO accesses
4. TLB refill.
5. Do the memory access.
6. Return to code cache.
After Victim TLB:
1. Inline TLB lookup
2. Exit code cache on TLB miss.
3. Check for unaligned, IO accesses
4. Victim TLB lookup.
5. If victim TLB misses, TLB refill
6. Do the memory access.
7. Return to code cache
The advantage is that victim TLB can offer more associativity to a
directly mapped TLB and thus potentially fewer page table walks while
still keeping the time taken to flush within reasonable limits.
However, placing a victim TLB before the refill path increase TLB
refill path as the victim TLB is consulted before the TLB refill. The
performance results demonstrate that the pros outweigh the cons.
some performance results taken on SPECINT2006 train
datasets and kernel boot and qemu configure script on an
Intel(R) Xeon(R) CPU E5620 @ 2.40GHz Linux machine are shown in the
Google Doc link below.
https://docs.google.com/spreadsheets/d/1eiItzekZwNQOal_h-5iJmC4tMDi051m9qidi5_nwvH4/edit?usp=sharing
In summary, victim TLB improves the performance of qemu-system-x86_64 by
11% on average on SPECINT2006, kernelboot and qemu configscript and with
highest improvement of in 26% in 456.hmmer. And victim TLB does not result
in any performance degradation in any of the measured benchmarks. Furthermore,
the implemented victim TLB is architecture independent and is expected to
benefit other architectures in QEMU as well.
Although there are measurement fluctuations, the performance
improvement is very significant and by no means in the range of
noises.
Signed-off-by: Xin Tong <trent.tong@gmail.com>
Message-id: 1407202523-23553-1-git-send-email-trent.tong@gmail.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-08-05 09:35:23 +08:00
|
|
|
}
|
2013-07-27 02:29:15 +08:00
|
|
|
tlb_addr = env->tlb_table[mmu_idx][index].addr_write;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
/* Handle an IO access. */
|
|
|
|
|
if (unlikely(tlb_addr & ~TARGET_PAGE_MASK)) {
|
2015-04-26 23:49:23 +08:00
|
|
|
CPUIOTLBEntry *iotlbentry;
|
2013-07-27 02:29:15 +08:00
|
|
|
if ((addr & (DATA_SIZE - 1)) != 0) {
|
|
|
|
|
goto do_unaligned_access;
|
|
|
|
|
}
|
2015-04-26 23:49:23 +08:00
|
|
|
iotlbentry = &env->iotlb[mmu_idx][index];
|
2013-09-05 02:45:20 +08:00
|
|
|
|
|
|
|
|
/* ??? Note that the io helpers always read data in the target
|
|
|
|
|
byte ordering. We should push the LE/BE request down into io. */
|
|
|
|
|
val = TGT_LE(val);
|
2015-04-26 23:49:23 +08:00
|
|
|
glue(io_write, SUFFIX)(env, iotlbentry, val, addr, retaddr);
|
2013-07-27 02:29:15 +08:00
|
|
|
return;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
/* Handle slow unaligned access (it spans two pages or IO). */
|
|
|
|
|
if (DATA_SIZE > 1
|
|
|
|
|
&& unlikely((addr & ~TARGET_PAGE_MASK) + DATA_SIZE - 1
|
|
|
|
|
>= TARGET_PAGE_SIZE)) {
|
|
|
|
|
int i;
|
|
|
|
|
do_unaligned_access:
|
2015-05-14 02:25:20 +08:00
|
|
|
if ((get_memop(oi) & MO_AMASK) == MO_ALIGN) {
|
|
|
|
|
cpu_unaligned_access(ENV_GET_CPU(env), addr, MMU_DATA_STORE,
|
|
|
|
|
mmu_idx, retaddr);
|
|
|
|
|
}
|
2013-07-27 02:29:15 +08:00
|
|
|
/* XXX: not efficient, but simple */
|
|
|
|
|
/* Note: relies on the fact that tlb_fill() does not remove the
|
|
|
|
|
* previous page from the TLB cache. */
|
|
|
|
|
for (i = DATA_SIZE - 1; i >= 0; i--) {
|
2013-09-05 02:45:20 +08:00
|
|
|
/* Little-endian extract. */
|
2013-07-27 02:29:15 +08:00
|
|
|
uint8_t val8 = val >> (i * 8);
|
2013-09-05 02:45:20 +08:00
|
|
|
/* Note the adjustment at the beginning of the function.
|
|
|
|
|
Undo that for the recursion. */
|
|
|
|
|
glue(helper_ret_stb, MMUSUFFIX)(env, addr + i, val8,
|
2015-05-14 00:10:33 +08:00
|
|
|
oi, retaddr + GETPC_ADJ);
|
2013-09-05 02:45:20 +08:00
|
|
|
}
|
|
|
|
|
return;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
/* Handle aligned access or unaligned access in the same page. */
|
2015-05-14 02:25:20 +08:00
|
|
|
if ((addr & (DATA_SIZE - 1)) != 0
|
|
|
|
|
&& (get_memop(oi) & MO_AMASK) == MO_ALIGN) {
|
2014-07-07 18:23:56 +08:00
|
|
|
cpu_unaligned_access(ENV_GET_CPU(env), addr, MMU_DATA_STORE,
|
|
|
|
|
mmu_idx, retaddr);
|
2013-09-05 02:45:20 +08:00
|
|
|
}
|
|
|
|
|
|
|
|
|
|
haddr = addr + env->tlb_table[mmu_idx][index].addend;
|
|
|
|
|
#if DATA_SIZE == 1
|
|
|
|
|
glue(glue(st, SUFFIX), _p)((uint8_t *)haddr, val);
|
|
|
|
|
#else
|
|
|
|
|
glue(glue(st, SUFFIX), _le_p)((uint8_t *)haddr, val);
|
2005-12-06 03:57:57 +08:00
|
|
|
#endif
|
2013-09-05 02:45:20 +08:00
|
|
|
}
|
|
|
|
|
|
|
|
|
|
#if DATA_SIZE > 1
|
|
|
|
|
void helper_be_st_name(CPUArchState *env, target_ulong addr, DATA_TYPE val,
|
2015-05-14 00:10:33 +08:00
|
|
|
TCGMemOpIdx oi, uintptr_t retaddr)
|
2013-09-05 02:45:20 +08:00
|
|
|
{
|
2015-05-14 00:10:33 +08:00
|
|
|
unsigned mmu_idx = get_mmuidx(oi);
|
2013-09-05 02:45:20 +08:00
|
|
|
int index = (addr >> TARGET_PAGE_BITS) & (CPU_TLB_SIZE - 1);
|
|
|
|
|
target_ulong tlb_addr = env->tlb_table[mmu_idx][index].addr_write;
|
|
|
|
|
uintptr_t haddr;
|
|
|
|
|
|
|
|
|
|
/* Adjust the given return address. */
|
|
|
|
|
retaddr -= GETPC_ADJ;
|
|
|
|
|
|
|
|
|
|
/* If the TLB entry is for a different page, reload and try again. */
|
|
|
|
|
if ((addr & TARGET_PAGE_MASK)
|
|
|
|
|
!= (tlb_addr & (TARGET_PAGE_MASK | TLB_INVALID_MASK))) {
|
2015-05-14 02:25:20 +08:00
|
|
|
if ((addr & (DATA_SIZE - 1)) != 0
|
|
|
|
|
&& (get_memop(oi) & MO_AMASK) == MO_ALIGN) {
|
2014-07-07 18:23:56 +08:00
|
|
|
cpu_unaligned_access(ENV_GET_CPU(env), addr, MMU_DATA_STORE,
|
|
|
|
|
mmu_idx, retaddr);
|
2013-09-05 02:45:20 +08:00
|
|
|
}
|
implementing victim TLB for QEMU system emulated TLB
QEMU system mode page table walks are expensive. Taken by running QEMU
qemu-system-x86_64 system mode on Intel PIN , a TLB miss and walking a
4-level page tables in guest Linux OS takes ~450 X86 instructions on
average.
QEMU system mode TLB is implemented using a directly-mapped hashtable.
This structure suffers from conflict misses. Increasing the
associativity of the TLB may not be the solution to conflict misses as
all the ways may have to be walked in serial.
A victim TLB is a TLB used to hold translations evicted from the
primary TLB upon replacement. The victim TLB lies between the main TLB
and its refill path. Victim TLB is of greater associativity (fully
associative in this patch). It takes longer to lookup the victim TLB,
but its likely better than a full page table walk. The memory
translation path is changed as follows :
Before Victim TLB:
1. Inline TLB lookup
2. Exit code cache on TLB miss.
3. Check for unaligned, IO accesses
4. TLB refill.
5. Do the memory access.
6. Return to code cache.
After Victim TLB:
1. Inline TLB lookup
2. Exit code cache on TLB miss.
3. Check for unaligned, IO accesses
4. Victim TLB lookup.
5. If victim TLB misses, TLB refill
6. Do the memory access.
7. Return to code cache
The advantage is that victim TLB can offer more associativity to a
directly mapped TLB and thus potentially fewer page table walks while
still keeping the time taken to flush within reasonable limits.
However, placing a victim TLB before the refill path increase TLB
refill path as the victim TLB is consulted before the TLB refill. The
performance results demonstrate that the pros outweigh the cons.
some performance results taken on SPECINT2006 train
datasets and kernel boot and qemu configure script on an
Intel(R) Xeon(R) CPU E5620 @ 2.40GHz Linux machine are shown in the
Google Doc link below.
https://docs.google.com/spreadsheets/d/1eiItzekZwNQOal_h-5iJmC4tMDi051m9qidi5_nwvH4/edit?usp=sharing
In summary, victim TLB improves the performance of qemu-system-x86_64 by
11% on average on SPECINT2006, kernelboot and qemu configscript and with
highest improvement of in 26% in 456.hmmer. And victim TLB does not result
in any performance degradation in any of the measured benchmarks. Furthermore,
the implemented victim TLB is architecture independent and is expected to
benefit other architectures in QEMU as well.
Although there are measurement fluctuations, the performance
improvement is very significant and by no means in the range of
noises.
Signed-off-by: Xin Tong <trent.tong@gmail.com>
Message-id: 1407202523-23553-1-git-send-email-trent.tong@gmail.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-08-05 09:35:23 +08:00
|
|
|
if (!VICTIM_TLB_HIT(addr_write)) {
|
2014-07-07 18:23:56 +08:00
|
|
|
tlb_fill(ENV_GET_CPU(env), addr, MMU_DATA_STORE, mmu_idx, retaddr);
|
implementing victim TLB for QEMU system emulated TLB
QEMU system mode page table walks are expensive. Taken by running QEMU
qemu-system-x86_64 system mode on Intel PIN , a TLB miss and walking a
4-level page tables in guest Linux OS takes ~450 X86 instructions on
average.
QEMU system mode TLB is implemented using a directly-mapped hashtable.
This structure suffers from conflict misses. Increasing the
associativity of the TLB may not be the solution to conflict misses as
all the ways may have to be walked in serial.
A victim TLB is a TLB used to hold translations evicted from the
primary TLB upon replacement. The victim TLB lies between the main TLB
and its refill path. Victim TLB is of greater associativity (fully
associative in this patch). It takes longer to lookup the victim TLB,
but its likely better than a full page table walk. The memory
translation path is changed as follows :
Before Victim TLB:
1. Inline TLB lookup
2. Exit code cache on TLB miss.
3. Check for unaligned, IO accesses
4. TLB refill.
5. Do the memory access.
6. Return to code cache.
After Victim TLB:
1. Inline TLB lookup
2. Exit code cache on TLB miss.
3. Check for unaligned, IO accesses
4. Victim TLB lookup.
5. If victim TLB misses, TLB refill
6. Do the memory access.
7. Return to code cache
The advantage is that victim TLB can offer more associativity to a
directly mapped TLB and thus potentially fewer page table walks while
still keeping the time taken to flush within reasonable limits.
However, placing a victim TLB before the refill path increase TLB
refill path as the victim TLB is consulted before the TLB refill. The
performance results demonstrate that the pros outweigh the cons.
some performance results taken on SPECINT2006 train
datasets and kernel boot and qemu configure script on an
Intel(R) Xeon(R) CPU E5620 @ 2.40GHz Linux machine are shown in the
Google Doc link below.
https://docs.google.com/spreadsheets/d/1eiItzekZwNQOal_h-5iJmC4tMDi051m9qidi5_nwvH4/edit?usp=sharing
In summary, victim TLB improves the performance of qemu-system-x86_64 by
11% on average on SPECINT2006, kernelboot and qemu configscript and with
highest improvement of in 26% in 456.hmmer. And victim TLB does not result
in any performance degradation in any of the measured benchmarks. Furthermore,
the implemented victim TLB is architecture independent and is expected to
benefit other architectures in QEMU as well.
Although there are measurement fluctuations, the performance
improvement is very significant and by no means in the range of
noises.
Signed-off-by: Xin Tong <trent.tong@gmail.com>
Message-id: 1407202523-23553-1-git-send-email-trent.tong@gmail.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-08-05 09:35:23 +08:00
|
|
|
}
|
2013-09-05 02:45:20 +08:00
|
|
|
tlb_addr = env->tlb_table[mmu_idx][index].addr_write;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
/* Handle an IO access. */
|
|
|
|
|
if (unlikely(tlb_addr & ~TARGET_PAGE_MASK)) {
|
2015-04-26 23:49:23 +08:00
|
|
|
CPUIOTLBEntry *iotlbentry;
|
2013-09-05 02:45:20 +08:00
|
|
|
if ((addr & (DATA_SIZE - 1)) != 0) {
|
|
|
|
|
goto do_unaligned_access;
|
|
|
|
|
}
|
2015-04-26 23:49:23 +08:00
|
|
|
iotlbentry = &env->iotlb[mmu_idx][index];
|
2013-09-05 02:45:20 +08:00
|
|
|
|
|
|
|
|
/* ??? Note that the io helpers always read data in the target
|
|
|
|
|
byte ordering. We should push the LE/BE request down into io. */
|
|
|
|
|
val = TGT_BE(val);
|
2015-04-26 23:49:23 +08:00
|
|
|
glue(io_write, SUFFIX)(env, iotlbentry, val, addr, retaddr);
|
2013-09-05 02:45:20 +08:00
|
|
|
return;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
/* Handle slow unaligned access (it spans two pages or IO). */
|
|
|
|
|
if (DATA_SIZE > 1
|
|
|
|
|
&& unlikely((addr & ~TARGET_PAGE_MASK) + DATA_SIZE - 1
|
|
|
|
|
>= TARGET_PAGE_SIZE)) {
|
|
|
|
|
int i;
|
|
|
|
|
do_unaligned_access:
|
2015-05-14 02:25:20 +08:00
|
|
|
if ((get_memop(oi) & MO_AMASK) == MO_ALIGN) {
|
|
|
|
|
cpu_unaligned_access(ENV_GET_CPU(env), addr, MMU_DATA_STORE,
|
|
|
|
|
mmu_idx, retaddr);
|
|
|
|
|
}
|
2013-09-05 02:45:20 +08:00
|
|
|
/* XXX: not efficient, but simple */
|
|
|
|
|
/* Note: relies on the fact that tlb_fill() does not remove the
|
|
|
|
|
* previous page from the TLB cache. */
|
|
|
|
|
for (i = DATA_SIZE - 1; i >= 0; i--) {
|
|
|
|
|
/* Big-endian extract. */
|
|
|
|
|
uint8_t val8 = val >> (((DATA_SIZE - 1) * 8) - (i * 8));
|
2013-08-28 01:22:54 +08:00
|
|
|
/* Note the adjustment at the beginning of the function.
|
|
|
|
|
Undo that for the recursion. */
|
2013-07-27 02:29:15 +08:00
|
|
|
glue(helper_ret_stb, MMUSUFFIX)(env, addr + i, val8,
|
2015-05-14 00:10:33 +08:00
|
|
|
oi, retaddr + GETPC_ADJ);
|
2003-08-09 07:58:05 +08:00
|
|
|
}
|
2013-07-27 02:29:15 +08:00
|
|
|
return;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
/* Handle aligned access or unaligned access in the same page. */
|
2015-05-14 02:25:20 +08:00
|
|
|
if ((addr & (DATA_SIZE - 1)) != 0
|
|
|
|
|
&& (get_memop(oi) & MO_AMASK) == MO_ALIGN) {
|
2014-07-07 18:23:56 +08:00
|
|
|
cpu_unaligned_access(ENV_GET_CPU(env), addr, MMU_DATA_STORE,
|
|
|
|
|
mmu_idx, retaddr);
|
2003-08-09 07:58:05 +08:00
|
|
|
}
|
2013-07-27 02:29:15 +08:00
|
|
|
|
|
|
|
|
haddr = addr + env->tlb_table[mmu_idx][index].addend;
|
2013-09-05 02:45:20 +08:00
|
|
|
glue(glue(st, SUFFIX), _be_p)((uint8_t *)haddr, val);
|
2003-08-09 07:58:05 +08:00
|
|
|
}
|
2013-09-05 02:45:20 +08:00
|
|
|
#endif /* DATA_SIZE > 1 */
|
2003-08-09 07:58:05 +08:00
|
|
|
|
2015-06-01 19:13:23 +08:00
|
|
|
#if DATA_SIZE == 1
|
|
|
|
|
/* Probe for whether the specified guest write access is permitted.
|
|
|
|
|
* If it is not permitted then an exception will be taken in the same
|
|
|
|
|
* way as if this were a real write access (and we will not return).
|
|
|
|
|
* Otherwise the function will return, and there will be a valid
|
|
|
|
|
* entry in the TLB for this access.
|
|
|
|
|
*/
|
|
|
|
|
void probe_write(CPUArchState *env, target_ulong addr, int mmu_idx,
|
|
|
|
|
uintptr_t retaddr)
|
|
|
|
|
{
|
|
|
|
|
int index = (addr >> TARGET_PAGE_BITS) & (CPU_TLB_SIZE - 1);
|
|
|
|
|
target_ulong tlb_addr = env->tlb_table[mmu_idx][index].addr_write;
|
|
|
|
|
|
|
|
|
|
if ((addr & TARGET_PAGE_MASK)
|
|
|
|
|
!= (tlb_addr & (TARGET_PAGE_MASK | TLB_INVALID_MASK))) {
|
|
|
|
|
/* TLB entry is for a different page */
|
|
|
|
|
if (!VICTIM_TLB_HIT(addr_write)) {
|
|
|
|
|
tlb_fill(ENV_GET_CPU(env), addr, MMU_DATA_STORE, mmu_idx, retaddr);
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
#endif
|
2004-10-03 23:07:13 +08:00
|
|
|
#endif /* !defined(SOFTMMU_CODE_ACCESS) */
|
|
|
|
|
|
|
|
|
|
#undef READ_ACCESS_TYPE
|
2003-08-09 07:58:05 +08:00
|
|
|
#undef SHIFT
|
|
|
|
|
#undef DATA_TYPE
|
|
|
|
|
#undef SUFFIX
|
2013-08-28 02:31:48 +08:00
|
|
|
#undef LSUFFIX
|
2003-08-09 07:58:05 +08:00
|
|
|
#undef DATA_SIZE
|
2005-11-29 05:19:04 +08:00
|
|
|
#undef ADDR_READ
|
2013-08-28 05:09:14 +08:00
|
|
|
#undef WORD_TYPE
|
|
|
|
|
#undef SDATA_TYPE
|
|
|
|
|
#undef USUFFIX
|
|
|
|
|
#undef SSUFFIX
|
2013-09-05 02:45:20 +08:00
|
|
|
#undef BSWAP
|
|
|
|
|
#undef TGT_BE
|
|
|
|
|
#undef TGT_LE
|
|
|
|
|
#undef CPU_BE
|
|
|
|
|
#undef CPU_LE
|
|
|
|
|
#undef helper_le_ld_name
|
|
|
|
|
#undef helper_be_ld_name
|
|
|
|
|
#undef helper_le_lds_name
|
|
|
|
|
#undef helper_be_lds_name
|
|
|
|
|
#undef helper_le_st_name
|
|
|
|
|
#undef helper_be_st_name
|
|
|
|
|
#undef helper_te_ld_name
|
|
|
|
|
#undef helper_te_st_name
|