Performance Research C02 Dirty TLB Range and MMU Metadata

Active-MMU dirty reset, range-helper inlining, and tiny-draw metadata

C02 — Implementation and validation notes

Field	Value
Evidence state	Existing isolated research; active/victim/resize equivalence gate outstanding here
Inspected source	322986f4c5502b3fa887a9605ac8cd88e9b2c579
First experiment	Randomized full-scan versus optimized state comparison
Scope	Addendum dated September 15, 2026; not a current-main benchmark or implementation status

Unproven performance research · Performance research — common test protocol · Performance research — reproducible checks

Evidence and implementation reasoning

Supported lead. The repository records active-MMU filtering, an isolated dirty-range inline experiment, and tiny-draw metadata research. Its required coverage explicitly includes active/victim modes and resize/flush transitions. Research history.

Required invariant. A skipped mode must contain no primary, victim, or otherwise eligible entry requiring the operation. An occupancy counter describing only one structure is insufficient. False positives cost time; false negatives can permit stale code/data observation. Atomics and generation publication must preserve that asymmetry.

Implementation order. First isolate harmless local inlining/duplicate metadata reads. Separately establish an accurate active-mode predicate, including insertion, eviction, resize, flush, and snapshot lifecycle. Then consider range indexing or batching. QEMU documents why dirty flags and cross-vCPU TLB updates participate in memory correctness. MTTCG/TLB design.

Expected gain. Fewer scanned entries/modes or cheaper per-entry work. Added bookkeeping can exceed saved scans for other workloads. A “large named profiler function” is an opportunity to measure, not proof that every instruction inside it is avoidable.

Acceptance. Randomized model/state differential tests against the full scan, forced victim-cache use, sparse/dense modes, resize races, broad/narrow ranges, and runtime callback changes. Measure total call count, scan count, and guest progress.

First patch boundary

Separate helper inlining, repeated-metadata-load removal and active-MMU filtering. Each gets its own control so effects remain attributable.

range reset -> conservative mode/range eligibility -> all relevant active and victim entries -> same dirty state

Locate the inspected seam before editing; names or ownership may have changed since the pinned review:

git grep -n -E 'tlb_reset_dirty|victim|n_used_entries|tlb_flush' -- accel/tcg include/exec

Proposed focused tests

These are implementation gates to add or exercise, not claims that production tests already exist or passed. Retained standalone checks are on the checks page.

Test ID	Setup / deliberate control	Required oracle
C02.01	Construct empty, active-only, victim-only and sparse/dense modes; compare every entry after reset.	Optimized and complete scans produce identical state.
C02.02	Randomized insertion/eviction/resize/flush transitions, forcing boundary ranges and reused slots.	Eligibility metadata never produces a false negative; stale metadata is detected.
C02.03	One-variable Release builds for inlining, metadata loads and filtering.	Measured effects are independent of debug assertions and of each other.

Counters and rejection criteria

Collect: modes_scanned, active_entries_scanned, victim_entries_scanned, skipped_empty_modes, dirty_reset_ns, metadata_updates. Keep exact counts separate from sampled durations; use an uninstrumented build for performance qualification.

Reject or hold: A false positive only wastes work; any false negative invalidates the optimization. Do not use an active-table-only test as victim-table coverage.

Follow the common protocol for source identities, previous-main/fixed-baseline controls, raw results, confidence and retail/XISO qualification. No gain becomes proven from a model, cache hit, local operation count, or shifted wait label alone.