We are going to disallow tb_flush from within the context
of a running cpu.  Introduce a tcg-internal exception to
return out of the cpu run loop and perform the flush there.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/exec/cpu-common.h       | 1 +
 accel/tcg/tcg-accel-ops-mttcg.c | 7 +++++++
 accel/tcg/tcg-accel-ops-rr.c    | 9 +++++++--
 3 files changed, 15 insertions(+), 2 deletions(-)

diff --git a/include/exec/cpu-common.h b/include/exec/cpu-common.h
index 9b658a3f48..ce9f116ac3 100644
--- a/include/exec/cpu-common.h
+++ b/include/exec/cpu-common.h
@@ -20,6 +20,7 @@
 #define EXCP_HALTED     0x10003 /* cpu is halted (waiting for external event) */
 #define EXCP_YIELD      0x10004 /* cpu wants to yield timeslice to another */
 #define EXCP_ATOMIC     0x10005 /* stop-the-world and emulate atomic */
+#define EXCP_TB_FLUSH   0x10006 /* stop-the-world and flush all tb */
 
 void cpu_exec_init_all(void);
 void cpu_exec_step_atomic(CPUState *cpu);
diff --git a/accel/tcg/tcg-accel-ops-mttcg.c b/accel/tcg/tcg-accel-ops-mttcg.c
index cf1ee7ac25..c7b8e8a713 100644
--- a/accel/tcg/tcg-accel-ops-mttcg.c
+++ b/accel/tcg/tcg-accel-ops-mttcg.c
@@ -27,6 +27,7 @@
 #include "system/tcg.h"
 #include "system/replay.h"
 #include "exec/icount.h"
+#include "exec/tb-flush.h"
 #include "qemu/main-loop.h"
 #include "qemu/notify.h"
 #include "qemu/guest-random.h"
@@ -106,6 +107,12 @@ static void *mttcg_cpu_thread_fn(void *arg)
                 bql_unlock();
                 cpu_exec_step_atomic(cpu);
                 bql_lock();
+                break;
+            case EXCP_TB_FLUSH:
+                start_exclusive();
+                tb_flush__exclusive();
+                end_exclusive();
+                break;
             default:
                 /* Ignore everything else? */
                 break;
diff --git a/accel/tcg/tcg-accel-ops-rr.c b/accel/tcg/tcg-accel-ops-rr.c
index 2fb4643997..85dade50a8 100644
--- a/accel/tcg/tcg-accel-ops-rr.c
+++ b/accel/tcg/tcg-accel-ops-rr.c
@@ -32,6 +32,7 @@
 #include "qemu/notify.h"
 #include "qemu/guest-random.h"
 #include "exec/cpu-common.h"
+#include "exec/tb-flush.h"
 #include "tcg/startup.h"
 #include "tcg-accel-ops.h"
 #include "tcg-accel-ops-rr.h"
@@ -288,14 +289,18 @@ static void *rr_cpu_thread_fn(void *arg)
                 }
                 bql_lock();
 
-                if (r == EXCP_DEBUG) {
+                switch (r) {
+                case EXCP_DEBUG:
                     cpu_handle_guest_debug(cpu);
                     break;
-                } else if (r == EXCP_ATOMIC) {
+                case EXCP_ATOMIC:
                     bql_unlock();
                     cpu_exec_step_atomic(cpu);
                     bql_lock();
                     break;
+                case EXCP_TB_FLUSH:
+                    tb_flush__exclusive();
+                    break;
                 }
             } else if (cpu->stop) {
                 if (cpu->unplug) {
-- 
2.43.0

On 9/23/25 04:39, Richard Henderson wrote:
> We are going to disallow tb_flush from within the context
> of a running cpu.  Introduce a tcg-internal exception to
> return out of the cpu run loop and perform the flush there.
> 
> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>

One small difference is that different CPUs can fail tcg_tb_alloc() at 
the same time and flush multiple times.

I think the check on the generation count should remain.  Instead of 
introducing EXCP_TB_FLUSH, you can keep the guts of tb_flush() as

void tb_queue_flush(CPUState *cpu)
{
     unsigned tb_flush_count = qatomic_read(&tb_ctx.tb_flush_count);
     async_safe_run_on_cpu(cpu, do_tb_flush,
                           RUN_ON_CPU_HOST_INT(tb_flush_count));
}

With the unconditional async_safe_run_on_cpu() hidden behind a function, 
this patch goes away while the next one survives as

      if (unlikely(!tb)) {
-        /* flush must be done */
-        tb_flush(cpu);
          mmap_unlock();
-        /* Make the execution loop process the flush as soon as 
possible.  */
-        cpu->exception_index = EXCP_INTERRUPT;
+        tb_queue_flush(cpu);
          cpu_loop_exit(cpu);
      }

Paolo

On 9/23/25 00:10, Paolo Bonzini wrote:
> On 9/23/25 04:39, Richard Henderson wrote:
>> We are going to disallow tb_flush from within the context
>> of a running cpu.  Introduce a tcg-internal exception to
>> return out of the cpu run loop and perform the flush there.
>>
>> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
> 
> One small difference is that different CPUs can fail tcg_tb_alloc() at the same time and 
> flush multiple times.
> 
> I think the check on the generation count should remain.  Instead of introducing 
> EXCP_TB_FLUSH, you can keep the guts of tb_flush() as
> 
> void tb_queue_flush(CPUState *cpu)
> {
>      unsigned tb_flush_count = qatomic_read(&tb_ctx.tb_flush_count);
>      async_safe_run_on_cpu(cpu, do_tb_flush,
>                            RUN_ON_CPU_HOST_INT(tb_flush_count));
> }
> 
> With the unconditional async_safe_run_on_cpu() hidden behind a function, this patch goes 
> away while the next one survives as
> 
>       if (unlikely(!tb)) {
> -        /* flush must be done */
> -        tb_flush(cpu);
>           mmap_unlock();
> -        /* Make the execution loop process the flush as soon as possible.  */
> -        cpu->exception_index = EXCP_INTERRUPT;
> +        tb_queue_flush(cpu);

You have a point.  It's not even that unlikely a scenario.


r~