Performance Research C03 Memory Callback Lifetime and Caching

Cached memory-access callbacks

C03 — Implementation and validation notes

Field	Value
Evidence state	Historical lifetime defect and ordering repair; new cache must account for every reader
Inspected source	322986f4c5502b3fa887a9605ac8cd88e9b2c579
First experiment	Delayed-reader retirement stress before lookup optimization
Scope	Addendum dated September 15, 2026; not a current-main benchmark or implementation status

Unproven performance research · Performance research — common test protocol · Performance research — reproducible checks

Evidence and implementation reasoning

Evidence warns against a naive cache. The repository records a previous cached-callback lifetime failure: freeing before asynchronous removal completed caused an access violation. Its repaired ordering begins inside exclusive removal, queues all CPUs' flushes, then a barrier and deferred free. Research history.

Merited design. A cache entry needs both lookup identity and a lifetime guarantee. A generation counter can reject stale identities, but checking one does not by itself keep the pointed-to object alive while it is used. Likewise, an RCU grace period does not automatically invalidate pointers retained in per-CPU caches or generated code outside the intended read-side interval. QEMU RCU.

Expected gain. Avoid repeated callback-range/dispatch lookup in eligible memory accesses. Establish callback lookup frequency and cost before paying for a more elaborate invalidation protocol.

Acceptance. Concurrent install/remove, overlapping ranges, remote CPUs, repeated unregister/re-register with reused addresses, reset, snapshot, and forced delayed readers. A fast single-vCPU run is not a lifetime proof. Never use “RCU” or “atomic” as a substitute for identifying every possible remaining user before free.

First patch boundary

Identify readers in generated code, cached per-CPU state and concurrent callback invocations. Use a lifetime protocol, not only an identity counter.

remove publication -> retire every cached/generated reference -> synchronization boundary -> deferred free

Locate the inspected seam before editing; names or ownership may have changed since the pinned review:

git grep -n -E 'mem_access_callback|callback_remove|run_on_cpu|async_run_on_cpu' -- accel include hw/xbox

Proposed focused tests

These are implementation gates to add or exercise, not claims that production tests already exist or passed. Retained standalone checks are on the checks page.

Test ID	Setup / deliberate control	Required oracle
C03.01	Pause a reader after acquiring a callback while another context unregisters it.	The callback remains alive until that reader can no longer use it.
C03.02	Repeated unregister/re-register with allocator address reuse and overlapping ranges.	An old identity cannot invoke a new or freed object; correct callback selection is preserved.
C03.03	Multiple CPU references, reset and snapshot with delayed flush callbacks.	All required references retire before free; sanitizers and state oracle remain clean.

Counters and rejection criteria

Collect: callback_lookups, callback_hits, callback_invocations, flush_count, retirement_latency_ns, live_callback_objects, invalid_accesses. Keep exact counts separate from sampled durations; use an uninstrumented build for performance qualification.

Reject or hold: Reject any lifetime gap regardless of lookup speed. A fast single-vCPU retail run is not a concurrent-retirement proof.

Follow the common protocol for source identities, previous-main/fixed-baseline controls, raw results, confidence and retail/XISO qualification. No gain becomes proven from a model, cache hit, local operation count, or shifted wait label alone.