2 * virtual page mapping and translated block handling
4 * Copyright (c) 2003 Fabrice Bellard
6 * This library is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU Lesser General Public
8 * License as published by the Free Software Foundation; either
9 * version 2 of the License, or (at your option) any later version.
11 * This library is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
14 * Lesser General Public License for more details.
16 * You should have received a copy of the GNU Lesser General Public
17 * License along with this library; if not, see <http://www.gnu.org/licenses/>.
23 #include <sys/types.h>
36 #include "qemu-common.h"
37 #include "cache-utils.h"
39 #if !defined(TARGET_IA64)
47 #if defined(CONFIG_USER_ONLY)
51 //#define DEBUG_TB_INVALIDATE
54 //#define DEBUG_UNASSIGNED
56 /* make various TB consistency checks */
57 //#define DEBUG_TB_CHECK
58 //#define DEBUG_TLB_CHECK
60 //#define DEBUG_IOPORT
61 //#define DEBUG_SUBPAGE
63 #if !defined(CONFIG_USER_ONLY)
64 /* TB consistency checks only implemented for usermode emulation. */
68 #define SMC_BITMAP_USE_THRESHOLD 10
70 #if defined(TARGET_SPARC64)
71 #define TARGET_PHYS_ADDR_SPACE_BITS 41
72 #elif defined(TARGET_SPARC)
73 #define TARGET_PHYS_ADDR_SPACE_BITS 36
74 #elif defined(TARGET_ALPHA)
75 #define TARGET_PHYS_ADDR_SPACE_BITS 42
76 #define TARGET_VIRT_ADDR_SPACE_BITS 42
77 #elif defined(TARGET_PPC64)
78 #define TARGET_PHYS_ADDR_SPACE_BITS 42
79 #elif defined(TARGET_X86_64) && !defined(CONFIG_KQEMU)
80 #define TARGET_PHYS_ADDR_SPACE_BITS 42
81 #elif defined(TARGET_I386) && !defined(CONFIG_KQEMU)
82 #define TARGET_PHYS_ADDR_SPACE_BITS 36
83 #elif defined(TARGET_IA64)
84 #define TARGET_PHYS_ADDR_SPACE_BITS 36
86 /* Note: for compatibility with kqemu, we use 32 bits for x86_64 */
87 #define TARGET_PHYS_ADDR_SPACE_BITS 32
90 static TranslationBlock
*tbs
;
91 int code_gen_max_blocks
;
92 TranslationBlock
*tb_phys_hash
[CODE_GEN_PHYS_HASH_SIZE
];
94 /* any access to the tbs or the page table must use this lock */
95 spinlock_t tb_lock
= SPIN_LOCK_UNLOCKED
;
97 #if defined(__arm__) || defined(__sparc_v9__)
98 /* The prologue must be reachable with a direct jump. ARM and Sparc64
99 have limited branch ranges (possibly also PPC) so place it in a
100 section close to code segment. */
101 #define code_gen_section \
102 __attribute__((__section__(".gen_code"))) \
103 __attribute__((aligned (32)))
104 #elif defined(_WIN32)
105 /* Maximum alignment for Win32 is 16. */
106 #define code_gen_section \
107 __attribute__((aligned (16)))
109 #define code_gen_section \
110 __attribute__((aligned (32)))
113 uint8_t code_gen_prologue
[1024] code_gen_section
;
114 static uint8_t *code_gen_buffer
;
115 static unsigned long code_gen_buffer_size
;
116 /* threshold to flush the translated code buffer */
117 static unsigned long code_gen_buffer_max_size
;
118 uint8_t *code_gen_ptr
;
120 #if !defined(CONFIG_USER_ONLY)
122 uint8_t *phys_ram_dirty
;
124 static int in_migration
;
126 typedef struct RAMBlock
{
130 struct RAMBlock
*next
;
133 static RAMBlock
*ram_blocks
;
134 /* TODO: When we implement (and use) ram deallocation (e.g. for hotplug)
135 then we can no longer assume contiguous ram offsets, and external uses
136 of this variable will break. */
137 ram_addr_t last_ram_offset
;
141 /* current CPU in the current thread. It is only valid inside
143 CPUState
*cpu_single_env
;
144 /* 0 = Do not count executed instructions.
145 1 = Precise instruction counting.
146 2 = Adaptive rate instruction counting. */
148 /* Current instruction counter. While executing translated code this may
149 include some instructions that have not yet been executed. */
152 typedef struct PageDesc
{
153 /* list of TBs intersecting this ram page */
154 TranslationBlock
*first_tb
;
155 /* in order to optimize self modifying code, we count the number
156 of lookups we do to a given page to use a bitmap */
157 unsigned int code_write_count
;
158 uint8_t *code_bitmap
;
159 #if defined(CONFIG_USER_ONLY)
164 typedef struct PhysPageDesc
{
165 /* offset in host memory of the page + io_index in the low bits */
166 ram_addr_t phys_offset
;
167 ram_addr_t region_offset
;
171 #if defined(CONFIG_USER_ONLY) && defined(TARGET_VIRT_ADDR_SPACE_BITS)
172 /* XXX: this is a temporary hack for alpha target.
173 * In the future, this is to be replaced by a multi-level table
174 * to actually be able to handle the complete 64 bits address space.
176 #define L1_BITS (TARGET_VIRT_ADDR_SPACE_BITS - L2_BITS - TARGET_PAGE_BITS)
178 #define L1_BITS (32 - L2_BITS - TARGET_PAGE_BITS)
181 #define L1_SIZE (1 << L1_BITS)
182 #define L2_SIZE (1 << L2_BITS)
184 unsigned long qemu_real_host_page_size
;
185 unsigned long qemu_host_page_bits
;
186 unsigned long qemu_host_page_size
;
187 unsigned long qemu_host_page_mask
;
189 /* XXX: for system emulation, it could just be an array */
190 static PageDesc
*l1_map
[L1_SIZE
];
191 static PhysPageDesc
**l1_phys_map
;
193 #if !defined(CONFIG_USER_ONLY)
194 static void io_mem_init(void);
196 /* io memory support */
197 CPUWriteMemoryFunc
*io_mem_write
[IO_MEM_NB_ENTRIES
][4];
198 CPUReadMemoryFunc
*io_mem_read
[IO_MEM_NB_ENTRIES
][4];
199 void *io_mem_opaque
[IO_MEM_NB_ENTRIES
];
200 static char io_mem_used
[IO_MEM_NB_ENTRIES
];
201 static int io_mem_watch
;
205 static const char *logfilename
= "/tmp/qemu.log";
208 static int log_append
= 0;
211 static int tlb_flush_count
;
212 static int tb_flush_count
;
213 static int tb_phys_invalidate_count
;
215 #define SUBPAGE_IDX(addr) ((addr) & ~TARGET_PAGE_MASK)
216 typedef struct subpage_t
{
217 target_phys_addr_t base
;
218 CPUReadMemoryFunc
**mem_read
[TARGET_PAGE_SIZE
][4];
219 CPUWriteMemoryFunc
**mem_write
[TARGET_PAGE_SIZE
][4];
220 void *opaque
[TARGET_PAGE_SIZE
][2][4];
221 ram_addr_t region_offset
[TARGET_PAGE_SIZE
][2][4];
225 static void map_exec(void *addr
, long size
)
228 VirtualProtect(addr
, size
,
229 PAGE_EXECUTE_READWRITE
, &old_protect
);
233 static void map_exec(void *addr
, long size
)
235 unsigned long start
, end
, page_size
;
237 page_size
= getpagesize();
238 start
= (unsigned long)addr
;
239 start
&= ~(page_size
- 1);
241 end
= (unsigned long)addr
+ size
;
242 end
+= page_size
- 1;
243 end
&= ~(page_size
- 1);
245 mprotect((void *)start
, end
- start
,
246 PROT_READ
| PROT_WRITE
| PROT_EXEC
);
250 static void page_init(void)
252 /* NOTE: we can always suppose that qemu_host_page_size >=
256 SYSTEM_INFO system_info
;
258 GetSystemInfo(&system_info
);
259 qemu_real_host_page_size
= system_info
.dwPageSize
;
262 qemu_real_host_page_size
= getpagesize();
264 if (qemu_host_page_size
== 0)
265 qemu_host_page_size
= qemu_real_host_page_size
;
266 if (qemu_host_page_size
< TARGET_PAGE_SIZE
)
267 qemu_host_page_size
= TARGET_PAGE_SIZE
;
268 qemu_host_page_bits
= 0;
269 while ((1 << qemu_host_page_bits
) < qemu_host_page_size
)
270 qemu_host_page_bits
++;
271 qemu_host_page_mask
= ~(qemu_host_page_size
- 1);
272 l1_phys_map
= qemu_vmalloc(L1_SIZE
* sizeof(void *));
273 memset(l1_phys_map
, 0, L1_SIZE
* sizeof(void *));
275 #if !defined(_WIN32) && defined(CONFIG_USER_ONLY)
277 long long startaddr
, endaddr
;
282 last_brk
= (unsigned long)sbrk(0);
283 f
= fopen("/proc/self/maps", "r");
286 n
= fscanf (f
, "%llx-%llx %*[^\n]\n", &startaddr
, &endaddr
);
288 startaddr
= MIN(startaddr
,
289 (1ULL << TARGET_PHYS_ADDR_SPACE_BITS
) - 1);
290 endaddr
= MIN(endaddr
,
291 (1ULL << TARGET_PHYS_ADDR_SPACE_BITS
) - 1);
292 page_set_flags(startaddr
& TARGET_PAGE_MASK
,
293 TARGET_PAGE_ALIGN(endaddr
),
304 static inline PageDesc
**page_l1_map(target_ulong index
)
306 #if TARGET_LONG_BITS > 32
307 /* Host memory outside guest VM. For 32-bit targets we have already
308 excluded high addresses. */
309 if (index
> ((target_ulong
)L2_SIZE
* L1_SIZE
))
312 return &l1_map
[index
>> L2_BITS
];
315 static inline PageDesc
*page_find_alloc(target_ulong index
)
318 lp
= page_l1_map(index
);
324 /* allocate if not found */
325 #if defined(CONFIG_USER_ONLY)
326 size_t len
= sizeof(PageDesc
) * L2_SIZE
;
327 /* Don't use qemu_malloc because it may recurse. */
328 p
= mmap(NULL
, len
, PROT_READ
| PROT_WRITE
,
329 MAP_PRIVATE
| MAP_ANONYMOUS
, -1, 0);
332 unsigned long addr
= h2g(p
);
333 page_set_flags(addr
& TARGET_PAGE_MASK
,
334 TARGET_PAGE_ALIGN(addr
+ len
),
338 p
= qemu_mallocz(sizeof(PageDesc
) * L2_SIZE
);
342 return p
+ (index
& (L2_SIZE
- 1));
345 static inline PageDesc
*page_find(target_ulong index
)
348 lp
= page_l1_map(index
);
356 return p
+ (index
& (L2_SIZE
- 1));
359 static PhysPageDesc
*phys_page_find_alloc(target_phys_addr_t index
, int alloc
)
364 p
= (void **)l1_phys_map
;
365 #if TARGET_PHYS_ADDR_SPACE_BITS > 32
367 #if TARGET_PHYS_ADDR_SPACE_BITS > (32 + L1_BITS)
368 #error unsupported TARGET_PHYS_ADDR_SPACE_BITS
370 lp
= p
+ ((index
>> (L1_BITS
+ L2_BITS
)) & (L1_SIZE
- 1));
373 /* allocate if not found */
376 p
= qemu_vmalloc(sizeof(void *) * L1_SIZE
);
377 memset(p
, 0, sizeof(void *) * L1_SIZE
);
381 lp
= p
+ ((index
>> L2_BITS
) & (L1_SIZE
- 1));
385 /* allocate if not found */
388 pd
= qemu_vmalloc(sizeof(PhysPageDesc
) * L2_SIZE
);
390 for (i
= 0; i
< L2_SIZE
; i
++) {
391 pd
[i
].phys_offset
= IO_MEM_UNASSIGNED
;
392 pd
[i
].region_offset
= (index
+ i
) << TARGET_PAGE_BITS
;
395 return ((PhysPageDesc
*)pd
) + (index
& (L2_SIZE
- 1));
398 static inline PhysPageDesc
*phys_page_find(target_phys_addr_t index
)
400 return phys_page_find_alloc(index
, 0);
403 #if !defined(CONFIG_USER_ONLY)
404 static void tlb_protect_code(ram_addr_t ram_addr
);
405 static void tlb_unprotect_code_phys(CPUState
*env
, ram_addr_t ram_addr
,
407 #define mmap_lock() do { } while(0)
408 #define mmap_unlock() do { } while(0)
411 #define DEFAULT_CODE_GEN_BUFFER_SIZE (32 * 1024 * 1024)
413 #if defined(CONFIG_USER_ONLY)
414 /* Currently it is not recommended to allocate big chunks of data in
415 user mode. It will change when a dedicated libc will be used */
416 #define USE_STATIC_CODE_GEN_BUFFER
419 #ifdef USE_STATIC_CODE_GEN_BUFFER
420 static uint8_t static_code_gen_buffer
[DEFAULT_CODE_GEN_BUFFER_SIZE
];
423 static void code_gen_alloc(unsigned long tb_size
)
428 #ifdef USE_STATIC_CODE_GEN_BUFFER
429 code_gen_buffer
= static_code_gen_buffer
;
430 code_gen_buffer_size
= DEFAULT_CODE_GEN_BUFFER_SIZE
;
431 map_exec(code_gen_buffer
, code_gen_buffer_size
);
433 code_gen_buffer_size
= tb_size
;
434 if (code_gen_buffer_size
== 0) {
435 #if defined(CONFIG_USER_ONLY)
436 /* in user mode, phys_ram_size is not meaningful */
437 code_gen_buffer_size
= DEFAULT_CODE_GEN_BUFFER_SIZE
;
439 /* XXX: needs adjustments */
440 code_gen_buffer_size
= (unsigned long)(ram_size
/ 4);
443 if (code_gen_buffer_size
< MIN_CODE_GEN_BUFFER_SIZE
)
444 code_gen_buffer_size
= MIN_CODE_GEN_BUFFER_SIZE
;
445 /* The code gen buffer location may have constraints depending on
446 the host cpu and OS */
447 #if defined(__linux__)
452 flags
= MAP_PRIVATE
| MAP_ANONYMOUS
;
453 #if defined(__x86_64__)
455 /* Cannot map more than that */
456 if (code_gen_buffer_size
> (800 * 1024 * 1024))
457 code_gen_buffer_size
= (800 * 1024 * 1024);
458 #elif defined(__sparc_v9__)
459 // Map the buffer below 2G, so we can use direct calls and branches
461 start
= (void *) 0x60000000UL
;
462 if (code_gen_buffer_size
> (512 * 1024 * 1024))
463 code_gen_buffer_size
= (512 * 1024 * 1024);
464 #elif defined(__arm__)
465 /* Map the buffer below 32M, so we can use direct calls and branches */
467 start
= (void *) 0x01000000UL
;
468 if (code_gen_buffer_size
> 16 * 1024 * 1024)
469 code_gen_buffer_size
= 16 * 1024 * 1024;
471 code_gen_buffer
= mmap(start
, code_gen_buffer_size
,
472 PROT_WRITE
| PROT_READ
| PROT_EXEC
,
474 if (code_gen_buffer
== MAP_FAILED
) {
475 fprintf(stderr
, "Could not allocate dynamic translator buffer\n");
479 #elif defined(__FreeBSD__) || defined(__DragonFly__)
483 flags
= MAP_PRIVATE
| MAP_ANONYMOUS
;
484 #if defined(__x86_64__)
485 /* FreeBSD doesn't have MAP_32BIT, use MAP_FIXED and assume
486 * 0x40000000 is free */
488 addr
= (void *)0x40000000;
489 /* Cannot map more than that */
490 if (code_gen_buffer_size
> (800 * 1024 * 1024))
491 code_gen_buffer_size
= (800 * 1024 * 1024);
493 code_gen_buffer
= mmap(addr
, code_gen_buffer_size
,
494 PROT_WRITE
| PROT_READ
| PROT_EXEC
,
496 if (code_gen_buffer
== MAP_FAILED
) {
497 fprintf(stderr
, "Could not allocate dynamic translator buffer\n");
502 code_gen_buffer
= qemu_malloc(code_gen_buffer_size
);
503 map_exec(code_gen_buffer
, code_gen_buffer_size
);
505 #endif /* !USE_STATIC_CODE_GEN_BUFFER */
506 map_exec(code_gen_prologue
, sizeof(code_gen_prologue
));
507 code_gen_buffer_max_size
= code_gen_buffer_size
-
508 code_gen_max_block_size();
509 code_gen_max_blocks
= code_gen_buffer_size
/ CODE_GEN_AVG_BLOCK_SIZE
;
510 tbs
= qemu_malloc(code_gen_max_blocks
* sizeof(TranslationBlock
));
513 /* Must be called before using the QEMU cpus. 'tb_size' is the size
514 (in bytes) allocated to the translation buffer. Zero means default
516 void cpu_exec_init_all(unsigned long tb_size
)
519 code_gen_alloc(tb_size
);
520 code_gen_ptr
= code_gen_buffer
;
522 #if !defined(CONFIG_USER_ONLY)
527 #if defined(CPU_SAVE_VERSION) && !defined(CONFIG_USER_ONLY)
529 #define CPU_COMMON_SAVE_VERSION 1
531 static void cpu_common_save(QEMUFile
*f
, void *opaque
)
533 CPUState
*env
= opaque
;
535 cpu_synchronize_state(env
, 0);
537 qemu_put_be32s(f
, &env
->halted
);
538 qemu_put_be32s(f
, &env
->interrupt_request
);
541 static int cpu_common_load(QEMUFile
*f
, void *opaque
, int version_id
)
543 CPUState
*env
= opaque
;
545 if (version_id
!= CPU_COMMON_SAVE_VERSION
)
548 qemu_get_be32s(f
, &env
->halted
);
549 qemu_get_be32s(f
, &env
->interrupt_request
);
550 /* 0x01 was CPU_INTERRUPT_EXIT. This line can be removed when the
551 version_id is increased. */
552 env
->interrupt_request
&= ~0x01;
554 cpu_synchronize_state(env
, 1);
560 CPUState
*qemu_get_cpu(int cpu
)
562 CPUState
*env
= first_cpu
;
565 if (env
->cpu_index
== cpu
)
573 void cpu_exec_init(CPUState
*env
)
578 #if defined(CONFIG_USER_ONLY)
581 env
->next_cpu
= NULL
;
584 while (*penv
!= NULL
) {
585 penv
= &(*penv
)->next_cpu
;
588 env
->cpu_index
= cpu_index
;
590 TAILQ_INIT(&env
->breakpoints
);
591 TAILQ_INIT(&env
->watchpoints
);
593 env
->thread_id
= GetCurrentProcessId();
595 env
->thread_id
= getpid();
598 #if defined(CONFIG_USER_ONLY)
601 #if defined(CPU_SAVE_VERSION) && !defined(CONFIG_USER_ONLY)
602 register_savevm("cpu_common", cpu_index
, CPU_COMMON_SAVE_VERSION
,
603 cpu_common_save
, cpu_common_load
, env
);
604 register_savevm("cpu", cpu_index
, CPU_SAVE_VERSION
,
605 cpu_save
, cpu_load
, env
);
609 static inline void invalidate_page_bitmap(PageDesc
*p
)
611 if (p
->code_bitmap
) {
612 qemu_free(p
->code_bitmap
);
613 p
->code_bitmap
= NULL
;
615 p
->code_write_count
= 0;
618 /* set to NULL all the 'first_tb' fields in all PageDescs */
619 static void page_flush_tb(void)
624 for(i
= 0; i
< L1_SIZE
; i
++) {
627 for(j
= 0; j
< L2_SIZE
; j
++) {
629 invalidate_page_bitmap(p
);
636 /* flush all the translation blocks */
637 /* XXX: tb_flush is currently not thread safe */
638 void tb_flush(CPUState
*env1
)
641 #if defined(DEBUG_FLUSH)
642 printf("qemu: flush code_size=%ld nb_tbs=%d avg_tb_size=%ld\n",
643 (unsigned long)(code_gen_ptr
- code_gen_buffer
),
645 ((unsigned long)(code_gen_ptr
- code_gen_buffer
)) / nb_tbs
: 0);
647 if ((unsigned long)(code_gen_ptr
- code_gen_buffer
) > code_gen_buffer_size
)
648 cpu_abort(env1
, "Internal error: code buffer overflow\n");
652 for(env
= first_cpu
; env
!= NULL
; env
= env
->next_cpu
) {
653 memset (env
->tb_jmp_cache
, 0, TB_JMP_CACHE_SIZE
* sizeof (void *));
656 memset (tb_phys_hash
, 0, CODE_GEN_PHYS_HASH_SIZE
* sizeof (void *));
659 code_gen_ptr
= code_gen_buffer
;
660 /* XXX: flush processor icache at this point if cache flush is
665 #ifdef DEBUG_TB_CHECK
667 static void tb_invalidate_check(target_ulong address
)
669 TranslationBlock
*tb
;
671 address
&= TARGET_PAGE_MASK
;
672 for(i
= 0;i
< CODE_GEN_PHYS_HASH_SIZE
; i
++) {
673 for(tb
= tb_phys_hash
[i
]; tb
!= NULL
; tb
= tb
->phys_hash_next
) {
674 if (!(address
+ TARGET_PAGE_SIZE
<= tb
->pc
||
675 address
>= tb
->pc
+ tb
->size
)) {
676 printf("ERROR invalidate: address=" TARGET_FMT_lx
677 " PC=%08lx size=%04x\n",
678 address
, (long)tb
->pc
, tb
->size
);
684 /* verify that all the pages have correct rights for code */
685 static void tb_page_check(void)
687 TranslationBlock
*tb
;
688 int i
, flags1
, flags2
;
690 for(i
= 0;i
< CODE_GEN_PHYS_HASH_SIZE
; i
++) {
691 for(tb
= tb_phys_hash
[i
]; tb
!= NULL
; tb
= tb
->phys_hash_next
) {
692 flags1
= page_get_flags(tb
->pc
);
693 flags2
= page_get_flags(tb
->pc
+ tb
->size
- 1);
694 if ((flags1
& PAGE_WRITE
) || (flags2
& PAGE_WRITE
)) {
695 printf("ERROR page flags: PC=%08lx size=%04x f1=%x f2=%x\n",
696 (long)tb
->pc
, tb
->size
, flags1
, flags2
);
704 /* invalidate one TB */
705 static inline void tb_remove(TranslationBlock
**ptb
, TranslationBlock
*tb
,
708 TranslationBlock
*tb1
;
712 *ptb
= *(TranslationBlock
**)((char *)tb1
+ next_offset
);
715 ptb
= (TranslationBlock
**)((char *)tb1
+ next_offset
);
719 static inline void tb_page_remove(TranslationBlock
**ptb
, TranslationBlock
*tb
)
721 TranslationBlock
*tb1
;
727 tb1
= (TranslationBlock
*)((long)tb1
& ~3);
729 *ptb
= tb1
->page_next
[n1
];
732 ptb
= &tb1
->page_next
[n1
];
736 static inline void tb_jmp_remove(TranslationBlock
*tb
, int n
)
738 TranslationBlock
*tb1
, **ptb
;
741 ptb
= &tb
->jmp_next
[n
];
744 /* find tb(n) in circular list */
748 tb1
= (TranslationBlock
*)((long)tb1
& ~3);
749 if (n1
== n
&& tb1
== tb
)
752 ptb
= &tb1
->jmp_first
;
754 ptb
= &tb1
->jmp_next
[n1
];
757 /* now we can suppress tb(n) from the list */
758 *ptb
= tb
->jmp_next
[n
];
760 tb
->jmp_next
[n
] = NULL
;
764 /* reset the jump entry 'n' of a TB so that it is not chained to
766 static inline void tb_reset_jump(TranslationBlock
*tb
, int n
)
768 tb_set_jmp_target(tb
, n
, (unsigned long)(tb
->tc_ptr
+ tb
->tb_next_offset
[n
]));
771 void tb_phys_invalidate(TranslationBlock
*tb
, target_ulong page_addr
)
776 target_phys_addr_t phys_pc
;
777 TranslationBlock
*tb1
, *tb2
;
779 /* remove the TB from the hash list */
780 phys_pc
= tb
->page_addr
[0] + (tb
->pc
& ~TARGET_PAGE_MASK
);
781 h
= tb_phys_hash_func(phys_pc
);
782 tb_remove(&tb_phys_hash
[h
], tb
,
783 offsetof(TranslationBlock
, phys_hash_next
));
785 /* remove the TB from the page list */
786 if (tb
->page_addr
[0] != page_addr
) {
787 p
= page_find(tb
->page_addr
[0] >> TARGET_PAGE_BITS
);
788 tb_page_remove(&p
->first_tb
, tb
);
789 invalidate_page_bitmap(p
);
791 if (tb
->page_addr
[1] != -1 && tb
->page_addr
[1] != page_addr
) {
792 p
= page_find(tb
->page_addr
[1] >> TARGET_PAGE_BITS
);
793 tb_page_remove(&p
->first_tb
, tb
);
794 invalidate_page_bitmap(p
);
797 tb_invalidated_flag
= 1;
799 /* remove the TB from the hash list */
800 h
= tb_jmp_cache_hash_func(tb
->pc
);
801 for(env
= first_cpu
; env
!= NULL
; env
= env
->next_cpu
) {
802 if (env
->tb_jmp_cache
[h
] == tb
)
803 env
->tb_jmp_cache
[h
] = NULL
;
806 /* suppress this TB from the two jump lists */
807 tb_jmp_remove(tb
, 0);
808 tb_jmp_remove(tb
, 1);
810 /* suppress any remaining jumps to this TB */
816 tb1
= (TranslationBlock
*)((long)tb1
& ~3);
817 tb2
= tb1
->jmp_next
[n1
];
818 tb_reset_jump(tb1
, n1
);
819 tb1
->jmp_next
[n1
] = NULL
;
822 tb
->jmp_first
= (TranslationBlock
*)((long)tb
| 2); /* fail safe */
824 tb_phys_invalidate_count
++;
827 static inline void set_bits(uint8_t *tab
, int start
, int len
)
833 mask
= 0xff << (start
& 7);
834 if ((start
& ~7) == (end
& ~7)) {
836 mask
&= ~(0xff << (end
& 7));
841 start
= (start
+ 8) & ~7;
843 while (start
< end1
) {
848 mask
= ~(0xff << (end
& 7));
854 static void build_page_bitmap(PageDesc
*p
)
856 int n
, tb_start
, tb_end
;
857 TranslationBlock
*tb
;
859 p
->code_bitmap
= qemu_mallocz(TARGET_PAGE_SIZE
/ 8);
864 tb
= (TranslationBlock
*)((long)tb
& ~3);
865 /* NOTE: this is subtle as a TB may span two physical pages */
867 /* NOTE: tb_end may be after the end of the page, but
868 it is not a problem */
869 tb_start
= tb
->pc
& ~TARGET_PAGE_MASK
;
870 tb_end
= tb_start
+ tb
->size
;
871 if (tb_end
> TARGET_PAGE_SIZE
)
872 tb_end
= TARGET_PAGE_SIZE
;
875 tb_end
= ((tb
->pc
+ tb
->size
) & ~TARGET_PAGE_MASK
);
877 set_bits(p
->code_bitmap
, tb_start
, tb_end
- tb_start
);
878 tb
= tb
->page_next
[n
];
882 TranslationBlock
*tb_gen_code(CPUState
*env
,
883 target_ulong pc
, target_ulong cs_base
,
884 int flags
, int cflags
)
886 TranslationBlock
*tb
;
888 target_ulong phys_pc
, phys_page2
, virt_page2
;
891 phys_pc
= get_phys_addr_code(env
, pc
);
894 /* flush must be done */
896 /* cannot fail at this point */
898 /* Don't forget to invalidate previous TB info. */
899 tb_invalidated_flag
= 1;
901 tc_ptr
= code_gen_ptr
;
903 tb
->cs_base
= cs_base
;
906 cpu_gen_code(env
, tb
, &code_gen_size
);
907 code_gen_ptr
= (void *)(((unsigned long)code_gen_ptr
+ code_gen_size
+ CODE_GEN_ALIGN
- 1) & ~(CODE_GEN_ALIGN
- 1));
909 /* check next page if needed */
910 virt_page2
= (pc
+ tb
->size
- 1) & TARGET_PAGE_MASK
;
912 if ((pc
& TARGET_PAGE_MASK
) != virt_page2
) {
913 phys_page2
= get_phys_addr_code(env
, virt_page2
);
915 tb_link_phys(tb
, phys_pc
, phys_page2
);
919 /* invalidate all TBs which intersect with the target physical page
920 starting in range [start;end[. NOTE: start and end must refer to
921 the same physical page. 'is_cpu_write_access' should be true if called
922 from a real cpu write access: the virtual CPU will exit the current
923 TB if code is modified inside this TB. */
924 void tb_invalidate_phys_page_range(target_phys_addr_t start
, target_phys_addr_t end
,
925 int is_cpu_write_access
)
927 TranslationBlock
*tb
, *tb_next
, *saved_tb
;
928 CPUState
*env
= cpu_single_env
;
929 target_ulong tb_start
, tb_end
;
932 #ifdef TARGET_HAS_PRECISE_SMC
933 int current_tb_not_found
= is_cpu_write_access
;
934 TranslationBlock
*current_tb
= NULL
;
935 int current_tb_modified
= 0;
936 target_ulong current_pc
= 0;
937 target_ulong current_cs_base
= 0;
938 int current_flags
= 0;
939 #endif /* TARGET_HAS_PRECISE_SMC */
941 p
= page_find(start
>> TARGET_PAGE_BITS
);
944 if (!p
->code_bitmap
&&
945 ++p
->code_write_count
>= SMC_BITMAP_USE_THRESHOLD
&&
946 is_cpu_write_access
) {
947 /* build code bitmap */
948 build_page_bitmap(p
);
951 /* we remove all the TBs in the range [start, end[ */
952 /* XXX: see if in some cases it could be faster to invalidate all the code */
956 tb
= (TranslationBlock
*)((long)tb
& ~3);
957 tb_next
= tb
->page_next
[n
];
958 /* NOTE: this is subtle as a TB may span two physical pages */
960 /* NOTE: tb_end may be after the end of the page, but
961 it is not a problem */
962 tb_start
= tb
->page_addr
[0] + (tb
->pc
& ~TARGET_PAGE_MASK
);
963 tb_end
= tb_start
+ tb
->size
;
965 tb_start
= tb
->page_addr
[1];
966 tb_end
= tb_start
+ ((tb
->pc
+ tb
->size
) & ~TARGET_PAGE_MASK
);
968 if (!(tb_end
<= start
|| tb_start
>= end
)) {
969 #ifdef TARGET_HAS_PRECISE_SMC
970 if (current_tb_not_found
) {
971 current_tb_not_found
= 0;
973 if (env
->mem_io_pc
) {
974 /* now we have a real cpu fault */
975 current_tb
= tb_find_pc(env
->mem_io_pc
);
978 if (current_tb
== tb
&&
979 (current_tb
->cflags
& CF_COUNT_MASK
) != 1) {
980 /* If we are modifying the current TB, we must stop
981 its execution. We could be more precise by checking
982 that the modification is after the current PC, but it
983 would require a specialized function to partially
984 restore the CPU state */
986 current_tb_modified
= 1;
987 cpu_restore_state(current_tb
, env
,
988 env
->mem_io_pc
, NULL
);
989 cpu_get_tb_cpu_state(env
, ¤t_pc
, ¤t_cs_base
,
992 #endif /* TARGET_HAS_PRECISE_SMC */
993 /* we need to do that to handle the case where a signal
994 occurs while doing tb_phys_invalidate() */
997 saved_tb
= env
->current_tb
;
998 env
->current_tb
= NULL
;
1000 tb_phys_invalidate(tb
, -1);
1002 env
->current_tb
= saved_tb
;
1003 if (env
->interrupt_request
&& env
->current_tb
)
1004 cpu_interrupt(env
, env
->interrupt_request
);
1009 #if !defined(CONFIG_USER_ONLY)
1010 /* if no code remaining, no need to continue to use slow writes */
1012 invalidate_page_bitmap(p
);
1013 if (is_cpu_write_access
) {
1014 tlb_unprotect_code_phys(env
, start
, env
->mem_io_vaddr
);
1018 #ifdef TARGET_HAS_PRECISE_SMC
1019 if (current_tb_modified
) {
1020 /* we generate a block containing just the instruction
1021 modifying the memory. It will ensure that it cannot modify
1023 env
->current_tb
= NULL
;
1024 tb_gen_code(env
, current_pc
, current_cs_base
, current_flags
, 1);
1025 cpu_resume_from_signal(env
, NULL
);
1030 /* len must be <= 8 and start must be a multiple of len */
1031 static inline void tb_invalidate_phys_page_fast(target_phys_addr_t start
, int len
)
1037 qemu_log("modifying code at 0x%x size=%d EIP=%x PC=%08x\n",
1038 cpu_single_env
->mem_io_vaddr
, len
,
1039 cpu_single_env
->eip
,
1040 cpu_single_env
->eip
+ (long)cpu_single_env
->segs
[R_CS
].base
);
1043 p
= page_find(start
>> TARGET_PAGE_BITS
);
1046 if (p
->code_bitmap
) {
1047 offset
= start
& ~TARGET_PAGE_MASK
;
1048 b
= p
->code_bitmap
[offset
>> 3] >> (offset
& 7);
1049 if (b
& ((1 << len
) - 1))
1053 tb_invalidate_phys_page_range(start
, start
+ len
, 1);
1057 #if !defined(CONFIG_SOFTMMU)
1058 static void tb_invalidate_phys_page(target_phys_addr_t addr
,
1059 unsigned long pc
, void *puc
)
1061 TranslationBlock
*tb
;
1064 #ifdef TARGET_HAS_PRECISE_SMC
1065 TranslationBlock
*current_tb
= NULL
;
1066 CPUState
*env
= cpu_single_env
;
1067 int current_tb_modified
= 0;
1068 target_ulong current_pc
= 0;
1069 target_ulong current_cs_base
= 0;
1070 int current_flags
= 0;
1073 addr
&= TARGET_PAGE_MASK
;
1074 p
= page_find(addr
>> TARGET_PAGE_BITS
);
1078 #ifdef TARGET_HAS_PRECISE_SMC
1079 if (tb
&& pc
!= 0) {
1080 current_tb
= tb_find_pc(pc
);
1083 while (tb
!= NULL
) {
1085 tb
= (TranslationBlock
*)((long)tb
& ~3);
1086 #ifdef TARGET_HAS_PRECISE_SMC
1087 if (current_tb
== tb
&&
1088 (current_tb
->cflags
& CF_COUNT_MASK
) != 1) {
1089 /* If we are modifying the current TB, we must stop
1090 its execution. We could be more precise by checking
1091 that the modification is after the current PC, but it
1092 would require a specialized function to partially
1093 restore the CPU state */
1095 current_tb_modified
= 1;
1096 cpu_restore_state(current_tb
, env
, pc
, puc
);
1097 cpu_get_tb_cpu_state(env
, ¤t_pc
, ¤t_cs_base
,
1100 #endif /* TARGET_HAS_PRECISE_SMC */
1101 tb_phys_invalidate(tb
, addr
);
1102 tb
= tb
->page_next
[n
];
1105 #ifdef TARGET_HAS_PRECISE_SMC
1106 if (current_tb_modified
) {
1107 /* we generate a block containing just the instruction
1108 modifying the memory. It will ensure that it cannot modify
1110 env
->current_tb
= NULL
;
1111 tb_gen_code(env
, current_pc
, current_cs_base
, current_flags
, 1);
1112 cpu_resume_from_signal(env
, puc
);
1118 /* add the tb in the target page and protect it if necessary */
1119 static inline void tb_alloc_page(TranslationBlock
*tb
,
1120 unsigned int n
, target_ulong page_addr
)
1123 TranslationBlock
*last_first_tb
;
1125 tb
->page_addr
[n
] = page_addr
;
1126 p
= page_find_alloc(page_addr
>> TARGET_PAGE_BITS
);
1127 tb
->page_next
[n
] = p
->first_tb
;
1128 last_first_tb
= p
->first_tb
;
1129 p
->first_tb
= (TranslationBlock
*)((long)tb
| n
);
1130 invalidate_page_bitmap(p
);
1132 #if defined(TARGET_HAS_SMC) || 1
1134 #if defined(CONFIG_USER_ONLY)
1135 if (p
->flags
& PAGE_WRITE
) {
1140 /* force the host page as non writable (writes will have a
1141 page fault + mprotect overhead) */
1142 page_addr
&= qemu_host_page_mask
;
1144 for(addr
= page_addr
; addr
< page_addr
+ qemu_host_page_size
;
1145 addr
+= TARGET_PAGE_SIZE
) {
1147 p2
= page_find (addr
>> TARGET_PAGE_BITS
);
1151 p2
->flags
&= ~PAGE_WRITE
;
1152 page_get_flags(addr
);
1154 mprotect(g2h(page_addr
), qemu_host_page_size
,
1155 (prot
& PAGE_BITS
) & ~PAGE_WRITE
);
1156 #ifdef DEBUG_TB_INVALIDATE
1157 printf("protecting code page: 0x" TARGET_FMT_lx
"\n",
1162 /* if some code is already present, then the pages are already
1163 protected. So we handle the case where only the first TB is
1164 allocated in a physical page */
1165 if (!last_first_tb
) {
1166 tlb_protect_code(page_addr
);
1170 #endif /* TARGET_HAS_SMC */
1173 /* Allocate a new translation block. Flush the translation buffer if
1174 too many translation blocks or too much generated code. */
1175 TranslationBlock
*tb_alloc(target_ulong pc
)
1177 TranslationBlock
*tb
;
1179 if (nb_tbs
>= code_gen_max_blocks
||
1180 (code_gen_ptr
- code_gen_buffer
) >= code_gen_buffer_max_size
)
1182 tb
= &tbs
[nb_tbs
++];
1188 void tb_free(TranslationBlock
*tb
)
1190 /* In practice this is mostly used for single use temporary TB
1191 Ignore the hard cases and just back up if this TB happens to
1192 be the last one generated. */
1193 if (nb_tbs
> 0 && tb
== &tbs
[nb_tbs
- 1]) {
1194 code_gen_ptr
= tb
->tc_ptr
;
1199 /* add a new TB and link it to the physical page tables. phys_page2 is
1200 (-1) to indicate that only one page contains the TB. */
1201 void tb_link_phys(TranslationBlock
*tb
,
1202 target_ulong phys_pc
, target_ulong phys_page2
)
1205 TranslationBlock
**ptb
;
1207 /* Grab the mmap lock to stop another thread invalidating this TB
1208 before we are done. */
1210 /* add in the physical hash table */
1211 h
= tb_phys_hash_func(phys_pc
);
1212 ptb
= &tb_phys_hash
[h
];
1213 tb
->phys_hash_next
= *ptb
;
1216 /* add in the page list */
1217 tb_alloc_page(tb
, 0, phys_pc
& TARGET_PAGE_MASK
);
1218 if (phys_page2
!= -1)
1219 tb_alloc_page(tb
, 1, phys_page2
);
1221 tb
->page_addr
[1] = -1;
1223 tb
->jmp_first
= (TranslationBlock
*)((long)tb
| 2);
1224 tb
->jmp_next
[0] = NULL
;
1225 tb
->jmp_next
[1] = NULL
;
1227 /* init original jump addresses */
1228 if (tb
->tb_next_offset
[0] != 0xffff)
1229 tb_reset_jump(tb
, 0);
1230 if (tb
->tb_next_offset
[1] != 0xffff)
1231 tb_reset_jump(tb
, 1);
1233 #ifdef DEBUG_TB_CHECK
1239 /* find the TB 'tb' such that tb[0].tc_ptr <= tc_ptr <
1240 tb[1].tc_ptr. Return NULL if not found */
1241 TranslationBlock
*tb_find_pc(unsigned long tc_ptr
)
1243 int m_min
, m_max
, m
;
1245 TranslationBlock
*tb
;
1249 if (tc_ptr
< (unsigned long)code_gen_buffer
||
1250 tc_ptr
>= (unsigned long)code_gen_ptr
)
1252 /* binary search (cf Knuth) */
1255 while (m_min
<= m_max
) {
1256 m
= (m_min
+ m_max
) >> 1;
1258 v
= (unsigned long)tb
->tc_ptr
;
1261 else if (tc_ptr
< v
) {
1270 static void tb_reset_jump_recursive(TranslationBlock
*tb
);
1272 static inline void tb_reset_jump_recursive2(TranslationBlock
*tb
, int n
)
1274 TranslationBlock
*tb1
, *tb_next
, **ptb
;
1277 tb1
= tb
->jmp_next
[n
];
1279 /* find head of list */
1282 tb1
= (TranslationBlock
*)((long)tb1
& ~3);
1285 tb1
= tb1
->jmp_next
[n1
];
1287 /* we are now sure now that tb jumps to tb1 */
1290 /* remove tb from the jmp_first list */
1291 ptb
= &tb_next
->jmp_first
;
1295 tb1
= (TranslationBlock
*)((long)tb1
& ~3);
1296 if (n1
== n
&& tb1
== tb
)
1298 ptb
= &tb1
->jmp_next
[n1
];
1300 *ptb
= tb
->jmp_next
[n
];
1301 tb
->jmp_next
[n
] = NULL
;
1303 /* suppress the jump to next tb in generated code */
1304 tb_reset_jump(tb
, n
);
1306 /* suppress jumps in the tb on which we could have jumped */
1307 tb_reset_jump_recursive(tb_next
);
1311 static void tb_reset_jump_recursive(TranslationBlock
*tb
)
1313 tb_reset_jump_recursive2(tb
, 0);
1314 tb_reset_jump_recursive2(tb
, 1);
1317 #if defined(TARGET_HAS_ICE)
1318 static void breakpoint_invalidate(CPUState
*env
, target_ulong pc
)
1320 target_phys_addr_t addr
;
1322 ram_addr_t ram_addr
;
1325 addr
= cpu_get_phys_page_debug(env
, pc
);
1326 p
= phys_page_find(addr
>> TARGET_PAGE_BITS
);
1328 pd
= IO_MEM_UNASSIGNED
;
1330 pd
= p
->phys_offset
;
1332 ram_addr
= (pd
& TARGET_PAGE_MASK
) | (pc
& ~TARGET_PAGE_MASK
);
1333 tb_invalidate_phys_page_range(ram_addr
, ram_addr
+ 1, 0);
1337 /* Add a watchpoint. */
1338 int cpu_watchpoint_insert(CPUState
*env
, target_ulong addr
, target_ulong len
,
1339 int flags
, CPUWatchpoint
**watchpoint
)
1341 target_ulong len_mask
= ~(len
- 1);
1344 /* sanity checks: allow power-of-2 lengths, deny unaligned watchpoints */
1345 if ((len
!= 1 && len
!= 2 && len
!= 4 && len
!= 8) || (addr
& ~len_mask
)) {
1346 fprintf(stderr
, "qemu: tried to set invalid watchpoint at "
1347 TARGET_FMT_lx
", len=" TARGET_FMT_lu
"\n", addr
, len
);
1350 wp
= qemu_malloc(sizeof(*wp
));
1353 wp
->len_mask
= len_mask
;
1356 /* keep all GDB-injected watchpoints in front */
1358 TAILQ_INSERT_HEAD(&env
->watchpoints
, wp
, entry
);
1360 TAILQ_INSERT_TAIL(&env
->watchpoints
, wp
, entry
);
1362 tlb_flush_page(env
, addr
);
1369 /* Remove a specific watchpoint. */
1370 int cpu_watchpoint_remove(CPUState
*env
, target_ulong addr
, target_ulong len
,
1373 target_ulong len_mask
= ~(len
- 1);
1376 TAILQ_FOREACH(wp
, &env
->watchpoints
, entry
) {
1377 if (addr
== wp
->vaddr
&& len_mask
== wp
->len_mask
1378 && flags
== (wp
->flags
& ~BP_WATCHPOINT_HIT
)) {
1379 cpu_watchpoint_remove_by_ref(env
, wp
);
1386 /* Remove a specific watchpoint by reference. */
1387 void cpu_watchpoint_remove_by_ref(CPUState
*env
, CPUWatchpoint
*watchpoint
)
1389 TAILQ_REMOVE(&env
->watchpoints
, watchpoint
, entry
);
1391 tlb_flush_page(env
, watchpoint
->vaddr
);
1393 qemu_free(watchpoint
);
1396 /* Remove all matching watchpoints. */
1397 void cpu_watchpoint_remove_all(CPUState
*env
, int mask
)
1399 CPUWatchpoint
*wp
, *next
;
1401 TAILQ_FOREACH_SAFE(wp
, &env
->watchpoints
, entry
, next
) {
1402 if (wp
->flags
& mask
)
1403 cpu_watchpoint_remove_by_ref(env
, wp
);
1407 /* Add a breakpoint. */
1408 int cpu_breakpoint_insert(CPUState
*env
, target_ulong pc
, int flags
,
1409 CPUBreakpoint
**breakpoint
)
1411 #if defined(TARGET_HAS_ICE)
1414 bp
= qemu_malloc(sizeof(*bp
));
1419 /* keep all GDB-injected breakpoints in front */
1421 TAILQ_INSERT_HEAD(&env
->breakpoints
, bp
, entry
);
1423 TAILQ_INSERT_TAIL(&env
->breakpoints
, bp
, entry
);
1425 breakpoint_invalidate(env
, pc
);
1435 /* Remove a specific breakpoint. */
1436 int cpu_breakpoint_remove(CPUState
*env
, target_ulong pc
, int flags
)
1438 #if defined(TARGET_HAS_ICE)
1441 TAILQ_FOREACH(bp
, &env
->breakpoints
, entry
) {
1442 if (bp
->pc
== pc
&& bp
->flags
== flags
) {
1443 cpu_breakpoint_remove_by_ref(env
, bp
);
1453 /* Remove a specific breakpoint by reference. */
1454 void cpu_breakpoint_remove_by_ref(CPUState
*env
, CPUBreakpoint
*breakpoint
)
1456 #if defined(TARGET_HAS_ICE)
1457 TAILQ_REMOVE(&env
->breakpoints
, breakpoint
, entry
);
1459 breakpoint_invalidate(env
, breakpoint
->pc
);
1461 qemu_free(breakpoint
);
1465 /* Remove all matching breakpoints. */
1466 void cpu_breakpoint_remove_all(CPUState
*env
, int mask
)
1468 #if defined(TARGET_HAS_ICE)
1469 CPUBreakpoint
*bp
, *next
;
1471 TAILQ_FOREACH_SAFE(bp
, &env
->breakpoints
, entry
, next
) {
1472 if (bp
->flags
& mask
)
1473 cpu_breakpoint_remove_by_ref(env
, bp
);
1478 /* enable or disable single step mode. EXCP_DEBUG is returned by the
1479 CPU loop after each instruction */
1480 void cpu_single_step(CPUState
*env
, int enabled
)
1482 #if defined(TARGET_HAS_ICE)
1483 if (env
->singlestep_enabled
!= enabled
) {
1484 env
->singlestep_enabled
= enabled
;
1486 kvm_update_guest_debug(env
, 0);
1488 /* must flush all the translated code to avoid inconsistencies */
1489 /* XXX: only flush what is necessary */
1496 /* enable or disable low levels log */
1497 void cpu_set_log(int log_flags
)
1499 loglevel
= log_flags
;
1500 if (loglevel
&& !logfile
) {
1501 logfile
= fopen(logfilename
, log_append
? "a" : "w");
1503 perror(logfilename
);
1506 #if !defined(CONFIG_SOFTMMU)
1507 /* must avoid mmap() usage of glibc by setting a buffer "by hand" */
1509 static char logfile_buf
[4096];
1510 setvbuf(logfile
, logfile_buf
, _IOLBF
, sizeof(logfile_buf
));
1513 setvbuf(logfile
, NULL
, _IOLBF
, 0);
1517 if (!loglevel
&& logfile
) {
1523 void cpu_set_log_filename(const char *filename
)
1525 logfilename
= strdup(filename
);
1530 cpu_set_log(loglevel
);
1533 static void cpu_unlink_tb(CPUState
*env
)
1535 #if defined(USE_NPTL)
1536 /* FIXME: TB unchaining isn't SMP safe. For now just ignore the
1537 problem and hope the cpu will stop of its own accord. For userspace
1538 emulation this often isn't actually as bad as it sounds. Often
1539 signals are used primarily to interrupt blocking syscalls. */
1541 TranslationBlock
*tb
;
1542 static spinlock_t interrupt_lock
= SPIN_LOCK_UNLOCKED
;
1544 tb
= env
->current_tb
;
1545 /* if the cpu is currently executing code, we must unlink it and
1546 all the potentially executing TB */
1547 if (tb
&& !testandset(&interrupt_lock
)) {
1548 env
->current_tb
= NULL
;
1549 tb_reset_jump_recursive(tb
);
1550 resetlock(&interrupt_lock
);
1555 /* mask must never be zero, except for A20 change call */
1556 void cpu_interrupt(CPUState
*env
, int mask
)
1560 old_mask
= env
->interrupt_request
;
1561 env
->interrupt_request
|= mask
;
1562 if (kvm_enabled() && !qemu_kvm_irqchip_in_kernel())
1563 kvm_update_interrupt_request(env
);
1565 #ifndef CONFIG_USER_ONLY
1567 * If called from iothread context, wake the target cpu in
1570 if (!qemu_cpu_self(env
)) {
1577 env
->icount_decr
.u16
.high
= 0xffff;
1578 #ifndef CONFIG_USER_ONLY
1580 && (mask
& ~old_mask
) != 0) {
1581 cpu_abort(env
, "Raised interrupt while not in I/O function");
1589 void cpu_reset_interrupt(CPUState
*env
, int mask
)
1591 env
->interrupt_request
&= ~mask
;
1594 void cpu_exit(CPUState
*env
)
1596 env
->exit_request
= 1;
1600 const CPULogItem cpu_log_items
[] = {
1601 { CPU_LOG_TB_OUT_ASM
, "out_asm",
1602 "show generated host assembly code for each compiled TB" },
1603 { CPU_LOG_TB_IN_ASM
, "in_asm",
1604 "show target assembly code for each compiled TB" },
1605 { CPU_LOG_TB_OP
, "op",
1606 "show micro ops for each compiled TB" },
1607 { CPU_LOG_TB_OP_OPT
, "op_opt",
1610 "before eflags optimization and "
1612 "after liveness analysis" },
1613 { CPU_LOG_INT
, "int",
1614 "show interrupts/exceptions in short format" },
1615 { CPU_LOG_EXEC
, "exec",
1616 "show trace before each executed TB (lots of logs)" },
1617 { CPU_LOG_TB_CPU
, "cpu",
1618 "show CPU state before block translation" },
1620 { CPU_LOG_PCALL
, "pcall",
1621 "show protected mode far calls/returns/exceptions" },
1622 { CPU_LOG_RESET
, "cpu_reset",
1623 "show CPU state before CPU resets" },
1626 { CPU_LOG_IOPORT
, "ioport",
1627 "show all i/o ports accesses" },
1632 static int cmp1(const char *s1
, int n
, const char *s2
)
1634 if (strlen(s2
) != n
)
1636 return memcmp(s1
, s2
, n
) == 0;
1639 /* takes a comma separated list of log masks. Return 0 if error. */
1640 int cpu_str_to_log_mask(const char *str
)
1642 const CPULogItem
*item
;
1649 p1
= strchr(p
, ',');
1652 if(cmp1(p
,p1
-p
,"all")) {
1653 for(item
= cpu_log_items
; item
->mask
!= 0; item
++) {
1657 for(item
= cpu_log_items
; item
->mask
!= 0; item
++) {
1658 if (cmp1(p
, p1
- p
, item
->name
))
1672 void cpu_abort(CPUState
*env
, const char *fmt
, ...)
1679 fprintf(stderr
, "qemu: fatal: ");
1680 vfprintf(stderr
, fmt
, ap
);
1681 fprintf(stderr
, "\n");
1683 cpu_dump_state(env
, stderr
, fprintf
, X86_DUMP_FPU
| X86_DUMP_CCOP
);
1685 cpu_dump_state(env
, stderr
, fprintf
, 0);
1687 if (qemu_log_enabled()) {
1688 qemu_log("qemu: fatal: ");
1689 qemu_log_vprintf(fmt
, ap2
);
1692 log_cpu_state(env
, X86_DUMP_FPU
| X86_DUMP_CCOP
);
1694 log_cpu_state(env
, 0);
1704 CPUState
*cpu_copy(CPUState
*env
)
1706 CPUState
*new_env
= cpu_init(env
->cpu_model_str
);
1707 CPUState
*next_cpu
= new_env
->next_cpu
;
1708 int cpu_index
= new_env
->cpu_index
;
1709 #if defined(TARGET_HAS_ICE)
1714 memcpy(new_env
, env
, sizeof(CPUState
));
1716 /* Preserve chaining and index. */
1717 new_env
->next_cpu
= next_cpu
;
1718 new_env
->cpu_index
= cpu_index
;
1720 /* Clone all break/watchpoints.
1721 Note: Once we support ptrace with hw-debug register access, make sure
1722 BP_CPU break/watchpoints are handled correctly on clone. */
1723 TAILQ_INIT(&env
->breakpoints
);
1724 TAILQ_INIT(&env
->watchpoints
);
1725 #if defined(TARGET_HAS_ICE)
1726 TAILQ_FOREACH(bp
, &env
->breakpoints
, entry
) {
1727 cpu_breakpoint_insert(new_env
, bp
->pc
, bp
->flags
, NULL
);
1729 TAILQ_FOREACH(wp
, &env
->watchpoints
, entry
) {
1730 cpu_watchpoint_insert(new_env
, wp
->vaddr
, (~wp
->len_mask
) + 1,
1738 #if !defined(CONFIG_USER_ONLY)
1740 static inline void tlb_flush_jmp_cache(CPUState
*env
, target_ulong addr
)
1744 /* Discard jump cache entries for any tb which might potentially
1745 overlap the flushed page. */
1746 i
= tb_jmp_cache_hash_page(addr
- TARGET_PAGE_SIZE
);
1747 memset (&env
->tb_jmp_cache
[i
], 0,
1748 TB_JMP_PAGE_SIZE
* sizeof(TranslationBlock
*));
1750 i
= tb_jmp_cache_hash_page(addr
);
1751 memset (&env
->tb_jmp_cache
[i
], 0,
1752 TB_JMP_PAGE_SIZE
* sizeof(TranslationBlock
*));
1755 static CPUTLBEntry s_cputlb_empty_entry
= {
1762 /* NOTE: if flush_global is true, also flush global entries (not
1764 void tlb_flush(CPUState
*env
, int flush_global
)
1768 #if defined(DEBUG_TLB)
1769 printf("tlb_flush:\n");
1771 /* must reset current TB so that interrupts cannot modify the
1772 links while we are modifying them */
1773 env
->current_tb
= NULL
;
1775 for(i
= 0; i
< CPU_TLB_SIZE
; i
++) {
1777 for (mmu_idx
= 0; mmu_idx
< NB_MMU_MODES
; mmu_idx
++) {
1778 env
->tlb_table
[mmu_idx
][i
] = s_cputlb_empty_entry
;
1782 memset (env
->tb_jmp_cache
, 0, TB_JMP_CACHE_SIZE
* sizeof (void *));
1785 if (env
->kqemu_enabled
) {
1786 kqemu_flush(env
, flush_global
);
1792 static inline void tlb_flush_entry(CPUTLBEntry
*tlb_entry
, target_ulong addr
)
1794 if (addr
== (tlb_entry
->addr_read
&
1795 (TARGET_PAGE_MASK
| TLB_INVALID_MASK
)) ||
1796 addr
== (tlb_entry
->addr_write
&
1797 (TARGET_PAGE_MASK
| TLB_INVALID_MASK
)) ||
1798 addr
== (tlb_entry
->addr_code
&
1799 (TARGET_PAGE_MASK
| TLB_INVALID_MASK
))) {
1800 *tlb_entry
= s_cputlb_empty_entry
;
1804 void tlb_flush_page(CPUState
*env
, target_ulong addr
)
1809 #if defined(DEBUG_TLB)
1810 printf("tlb_flush_page: " TARGET_FMT_lx
"\n", addr
);
1812 /* must reset current TB so that interrupts cannot modify the
1813 links while we are modifying them */
1814 env
->current_tb
= NULL
;
1816 addr
&= TARGET_PAGE_MASK
;
1817 i
= (addr
>> TARGET_PAGE_BITS
) & (CPU_TLB_SIZE
- 1);
1818 for (mmu_idx
= 0; mmu_idx
< NB_MMU_MODES
; mmu_idx
++)
1819 tlb_flush_entry(&env
->tlb_table
[mmu_idx
][i
], addr
);
1821 tlb_flush_jmp_cache(env
, addr
);
1824 if (env
->kqemu_enabled
) {
1825 kqemu_flush_page(env
, addr
);
1830 /* update the TLBs so that writes to code in the virtual page 'addr'
1832 static void tlb_protect_code(ram_addr_t ram_addr
)
1834 cpu_physical_memory_reset_dirty(ram_addr
,
1835 ram_addr
+ TARGET_PAGE_SIZE
,
1839 /* update the TLB so that writes in physical page 'phys_addr' are no longer
1840 tested for self modifying code */
1841 static void tlb_unprotect_code_phys(CPUState
*env
, ram_addr_t ram_addr
,
1844 phys_ram_dirty
[ram_addr
>> TARGET_PAGE_BITS
] |= CODE_DIRTY_FLAG
;
1847 static inline void tlb_reset_dirty_range(CPUTLBEntry
*tlb_entry
,
1848 unsigned long start
, unsigned long length
)
1851 if ((tlb_entry
->addr_write
& ~TARGET_PAGE_MASK
) == IO_MEM_RAM
) {
1852 addr
= (tlb_entry
->addr_write
& TARGET_PAGE_MASK
) + tlb_entry
->addend
;
1853 if ((addr
- start
) < length
) {
1854 tlb_entry
->addr_write
= (tlb_entry
->addr_write
& TARGET_PAGE_MASK
) | TLB_NOTDIRTY
;
1859 /* Note: start and end must be within the same ram block. */
1860 void cpu_physical_memory_reset_dirty(ram_addr_t start
, ram_addr_t end
,
1864 unsigned long length
, start1
;
1868 start
&= TARGET_PAGE_MASK
;
1869 end
= TARGET_PAGE_ALIGN(end
);
1871 length
= end
- start
;
1874 len
= length
>> TARGET_PAGE_BITS
;
1876 /* XXX: should not depend on cpu context */
1878 if (env
->kqemu_enabled
) {
1881 for(i
= 0; i
< len
; i
++) {
1882 kqemu_set_notdirty(env
, addr
);
1883 addr
+= TARGET_PAGE_SIZE
;
1887 mask
= ~dirty_flags
;
1888 p
= phys_ram_dirty
+ (start
>> TARGET_PAGE_BITS
);
1889 for(i
= 0; i
< len
; i
++)
1892 /* we modify the TLB cache so that the dirty bit will be set again
1893 when accessing the range */
1894 start1
= (unsigned long)qemu_get_ram_ptr(start
);
1895 /* Chek that we don't span multiple blocks - this breaks the
1896 address comparisons below. */
1897 if ((unsigned long)qemu_get_ram_ptr(end
- 1) - start1
1898 != (end
- 1) - start
) {
1902 for(env
= first_cpu
; env
!= NULL
; env
= env
->next_cpu
) {
1904 for (mmu_idx
= 0; mmu_idx
< NB_MMU_MODES
; mmu_idx
++) {
1905 for(i
= 0; i
< CPU_TLB_SIZE
; i
++)
1906 tlb_reset_dirty_range(&env
->tlb_table
[mmu_idx
][i
],
1912 int cpu_physical_memory_set_dirty_tracking(int enable
)
1914 if (kvm_enabled()) {
1915 return kvm_set_migration_log(enable
);
1920 int cpu_physical_memory_get_dirty_tracking(void)
1922 return in_migration
;
1925 int cpu_physical_sync_dirty_bitmap(target_phys_addr_t start_addr
,
1926 target_phys_addr_t end_addr
)
1931 ret
= kvm_physical_sync_dirty_bitmap(start_addr
, end_addr
);
1935 static inline void tlb_update_dirty(CPUTLBEntry
*tlb_entry
)
1937 ram_addr_t ram_addr
;
1940 if ((tlb_entry
->addr_write
& ~TARGET_PAGE_MASK
) == IO_MEM_RAM
) {
1941 p
= (void *)(unsigned long)((tlb_entry
->addr_write
& TARGET_PAGE_MASK
)
1942 + tlb_entry
->addend
);
1943 ram_addr
= qemu_ram_addr_from_host(p
);
1944 if (!cpu_physical_memory_is_dirty(ram_addr
)) {
1945 tlb_entry
->addr_write
|= TLB_NOTDIRTY
;
1950 /* update the TLB according to the current state of the dirty bits */
1951 void cpu_tlb_update_dirty(CPUState
*env
)
1955 for (mmu_idx
= 0; mmu_idx
< NB_MMU_MODES
; mmu_idx
++) {
1956 for(i
= 0; i
< CPU_TLB_SIZE
; i
++)
1957 tlb_update_dirty(&env
->tlb_table
[mmu_idx
][i
]);
1961 static inline void tlb_set_dirty1(CPUTLBEntry
*tlb_entry
, target_ulong vaddr
)
1963 if (tlb_entry
->addr_write
== (vaddr
| TLB_NOTDIRTY
))
1964 tlb_entry
->addr_write
= vaddr
;
1967 /* update the TLB corresponding to virtual page vaddr
1968 so that it is no longer dirty */
1969 static inline void tlb_set_dirty(CPUState
*env
, target_ulong vaddr
)
1974 vaddr
&= TARGET_PAGE_MASK
;
1975 i
= (vaddr
>> TARGET_PAGE_BITS
) & (CPU_TLB_SIZE
- 1);
1976 for (mmu_idx
= 0; mmu_idx
< NB_MMU_MODES
; mmu_idx
++)
1977 tlb_set_dirty1(&env
->tlb_table
[mmu_idx
][i
], vaddr
);
1980 /* add a new TLB entry. At most one entry for a given virtual address
1981 is permitted. Return 0 if OK or 2 if the page could not be mapped
1982 (can only happen in non SOFTMMU mode for I/O pages or pages
1983 conflicting with the host address space). */
1984 int tlb_set_page_exec(CPUState
*env
, target_ulong vaddr
,
1985 target_phys_addr_t paddr
, int prot
,
1986 int mmu_idx
, int is_softmmu
)
1991 target_ulong address
;
1992 target_ulong code_address
;
1993 target_phys_addr_t addend
;
1997 target_phys_addr_t iotlb
;
1999 p
= phys_page_find(paddr
>> TARGET_PAGE_BITS
);
2001 pd
= IO_MEM_UNASSIGNED
;
2003 pd
= p
->phys_offset
;
2005 #if defined(DEBUG_TLB)
2006 printf("tlb_set_page: vaddr=" TARGET_FMT_lx
" paddr=0x%08x prot=%x idx=%d smmu=%d pd=0x%08lx\n",
2007 vaddr
, (int)paddr
, prot
, mmu_idx
, is_softmmu
, pd
);
2012 if ((pd
& ~TARGET_PAGE_MASK
) > IO_MEM_ROM
&& !(pd
& IO_MEM_ROMD
)) {
2013 /* IO memory case (romd handled later) */
2014 address
|= TLB_MMIO
;
2016 addend
= (unsigned long)qemu_get_ram_ptr(pd
& TARGET_PAGE_MASK
);
2017 if ((pd
& ~TARGET_PAGE_MASK
) <= IO_MEM_ROM
) {
2019 iotlb
= pd
& TARGET_PAGE_MASK
;
2020 if ((pd
& ~TARGET_PAGE_MASK
) == IO_MEM_RAM
)
2021 iotlb
|= IO_MEM_NOTDIRTY
;
2023 iotlb
|= IO_MEM_ROM
;
2025 /* IO handlers are currently passed a physical address.
2026 It would be nice to pass an offset from the base address
2027 of that region. This would avoid having to special case RAM,
2028 and avoid full address decoding in every device.
2029 We can't use the high bits of pd for this because
2030 IO_MEM_ROMD uses these as a ram address. */
2031 iotlb
= (pd
& ~TARGET_PAGE_MASK
);
2033 iotlb
+= p
->region_offset
;
2039 code_address
= address
;
2040 /* Make accesses to pages with watchpoints go via the
2041 watchpoint trap routines. */
2042 TAILQ_FOREACH(wp
, &env
->watchpoints
, entry
) {
2043 if (vaddr
== (wp
->vaddr
& TARGET_PAGE_MASK
)) {
2044 iotlb
= io_mem_watch
+ paddr
;
2045 /* TODO: The memory case can be optimized by not trapping
2046 reads of pages with a write breakpoint. */
2047 address
|= TLB_MMIO
;
2051 index
= (vaddr
>> TARGET_PAGE_BITS
) & (CPU_TLB_SIZE
- 1);
2052 env
->iotlb
[mmu_idx
][index
] = iotlb
- vaddr
;
2053 te
= &env
->tlb_table
[mmu_idx
][index
];
2054 te
->addend
= addend
- vaddr
;
2055 if (prot
& PAGE_READ
) {
2056 te
->addr_read
= address
;
2061 if (prot
& PAGE_EXEC
) {
2062 te
->addr_code
= code_address
;
2066 if (prot
& PAGE_WRITE
) {
2067 if ((pd
& ~TARGET_PAGE_MASK
) == IO_MEM_ROM
||
2068 (pd
& IO_MEM_ROMD
)) {
2069 /* Write access calls the I/O callback. */
2070 te
->addr_write
= address
| TLB_MMIO
;
2071 } else if ((pd
& ~TARGET_PAGE_MASK
) == IO_MEM_RAM
&&
2072 !cpu_physical_memory_is_dirty(pd
)) {
2073 te
->addr_write
= address
| TLB_NOTDIRTY
;
2075 te
->addr_write
= address
;
2078 te
->addr_write
= -1;
2085 void tlb_flush(CPUState
*env
, int flush_global
)
2089 void tlb_flush_page(CPUState
*env
, target_ulong addr
)
2093 int tlb_set_page_exec(CPUState
*env
, target_ulong vaddr
,
2094 target_phys_addr_t paddr
, int prot
,
2095 int mmu_idx
, int is_softmmu
)
2101 * Walks guest process memory "regions" one by one
2102 * and calls callback function 'fn' for each region.
2104 int walk_memory_regions(void *priv
,
2105 int (*fn
)(void *, unsigned long, unsigned long, unsigned long))
2107 unsigned long start
, end
;
2109 int i
, j
, prot
, prot1
;
2115 for (i
= 0; i
<= L1_SIZE
; i
++) {
2116 p
= (i
< L1_SIZE
) ? l1_map
[i
] : NULL
;
2117 for (j
= 0; j
< L2_SIZE
; j
++) {
2118 prot1
= (p
== NULL
) ? 0 : p
[j
].flags
;
2120 * "region" is one continuous chunk of memory
2121 * that has same protection flags set.
2123 if (prot1
!= prot
) {
2124 end
= (i
<< (32 - L1_BITS
)) | (j
<< TARGET_PAGE_BITS
);
2126 rc
= (*fn
)(priv
, start
, end
, prot
);
2127 /* callback can stop iteration by returning != 0 */
2144 static int dump_region(void *priv
, unsigned long start
,
2145 unsigned long end
, unsigned long prot
)
2147 FILE *f
= (FILE *)priv
;
2149 (void) fprintf(f
, "%08lx-%08lx %08lx %c%c%c\n",
2150 start
, end
, end
- start
,
2151 ((prot
& PAGE_READ
) ? 'r' : '-'),
2152 ((prot
& PAGE_WRITE
) ? 'w' : '-'),
2153 ((prot
& PAGE_EXEC
) ? 'x' : '-'));
2158 /* dump memory mappings */
2159 void page_dump(FILE *f
)
2161 (void) fprintf(f
, "%-8s %-8s %-8s %s\n",
2162 "start", "end", "size", "prot");
2163 walk_memory_regions(f
, dump_region
);
2166 int page_get_flags(target_ulong address
)
2170 p
= page_find(address
>> TARGET_PAGE_BITS
);
2176 /* modify the flags of a page and invalidate the code if
2177 necessary. The flag PAGE_WRITE_ORG is positioned automatically
2178 depending on PAGE_WRITE */
2179 void page_set_flags(target_ulong start
, target_ulong end
, int flags
)
2184 /* mmap_lock should already be held. */
2185 start
= start
& TARGET_PAGE_MASK
;
2186 end
= TARGET_PAGE_ALIGN(end
);
2187 if (flags
& PAGE_WRITE
)
2188 flags
|= PAGE_WRITE_ORG
;
2189 for(addr
= start
; addr
< end
; addr
+= TARGET_PAGE_SIZE
) {
2190 p
= page_find_alloc(addr
>> TARGET_PAGE_BITS
);
2191 /* We may be called for host regions that are outside guest
2195 /* if the write protection is set, then we invalidate the code
2197 if (!(p
->flags
& PAGE_WRITE
) &&
2198 (flags
& PAGE_WRITE
) &&
2200 tb_invalidate_phys_page(addr
, 0, NULL
);
2206 int page_check_range(target_ulong start
, target_ulong len
, int flags
)
2212 if (start
+ len
< start
)
2213 /* we've wrapped around */
2216 end
= TARGET_PAGE_ALIGN(start
+len
); /* must do before we loose bits in the next step */
2217 start
= start
& TARGET_PAGE_MASK
;
2219 for(addr
= start
; addr
< end
; addr
+= TARGET_PAGE_SIZE
) {
2220 p
= page_find(addr
>> TARGET_PAGE_BITS
);
2223 if( !(p
->flags
& PAGE_VALID
) )
2226 if ((flags
& PAGE_READ
) && !(p
->flags
& PAGE_READ
))
2228 if (flags
& PAGE_WRITE
) {
2229 if (!(p
->flags
& PAGE_WRITE_ORG
))
2231 /* unprotect the page if it was put read-only because it
2232 contains translated code */
2233 if (!(p
->flags
& PAGE_WRITE
)) {
2234 if (!page_unprotect(addr
, 0, NULL
))
2243 /* called from signal handler: invalidate the code and unprotect the
2244 page. Return TRUE if the fault was successfully handled. */
2245 int page_unprotect(target_ulong address
, unsigned long pc
, void *puc
)
2247 unsigned int page_index
, prot
, pindex
;
2249 target_ulong host_start
, host_end
, addr
;
2251 /* Technically this isn't safe inside a signal handler. However we
2252 know this only ever happens in a synchronous SEGV handler, so in
2253 practice it seems to be ok. */
2256 host_start
= address
& qemu_host_page_mask
;
2257 page_index
= host_start
>> TARGET_PAGE_BITS
;
2258 p1
= page_find(page_index
);
2263 host_end
= host_start
+ qemu_host_page_size
;
2266 for(addr
= host_start
;addr
< host_end
; addr
+= TARGET_PAGE_SIZE
) {
2270 /* if the page was really writable, then we change its
2271 protection back to writable */
2272 if (prot
& PAGE_WRITE_ORG
) {
2273 pindex
= (address
- host_start
) >> TARGET_PAGE_BITS
;
2274 if (!(p1
[pindex
].flags
& PAGE_WRITE
)) {
2275 mprotect((void *)g2h(host_start
), qemu_host_page_size
,
2276 (prot
& PAGE_BITS
) | PAGE_WRITE
);
2277 p1
[pindex
].flags
|= PAGE_WRITE
;
2278 /* and since the content will be modified, we must invalidate
2279 the corresponding translated code. */
2280 tb_invalidate_phys_page(address
, pc
, puc
);
2281 #ifdef DEBUG_TB_CHECK
2282 tb_invalidate_check(address
);
2292 static inline void tlb_set_dirty(CPUState
*env
,
2293 unsigned long addr
, target_ulong vaddr
)
2296 #endif /* defined(CONFIG_USER_ONLY) */
2298 #if !defined(CONFIG_USER_ONLY)
2300 static int subpage_register (subpage_t
*mmio
, uint32_t start
, uint32_t end
,
2301 ram_addr_t memory
, ram_addr_t region_offset
);
2302 static void *subpage_init (target_phys_addr_t base
, ram_addr_t
*phys
,
2303 ram_addr_t orig_memory
, ram_addr_t region_offset
);
2304 #define CHECK_SUBPAGE(addr, start_addr, start_addr2, end_addr, end_addr2, \
2307 if (addr > start_addr) \
2310 start_addr2 = start_addr & ~TARGET_PAGE_MASK; \
2311 if (start_addr2 > 0) \
2315 if ((start_addr + orig_size) - addr >= TARGET_PAGE_SIZE) \
2316 end_addr2 = TARGET_PAGE_SIZE - 1; \
2318 end_addr2 = (start_addr + orig_size - 1) & ~TARGET_PAGE_MASK; \
2319 if (end_addr2 < TARGET_PAGE_SIZE - 1) \
2324 /* register physical memory. 'size' must be a multiple of the target
2325 page size. If (phys_offset & ~TARGET_PAGE_MASK) != 0, then it is an
2326 io memory page. The address used when calling the IO function is
2327 the offset from the start of the region, plus region_offset. Both
2328 start_addr and region_offset are rounded down to a page boundary
2329 before calculating this offset. This should not be a problem unless
2330 the low bits of start_addr and region_offset differ. */
2331 void cpu_register_physical_memory_offset(target_phys_addr_t start_addr
,
2333 ram_addr_t phys_offset
,
2334 ram_addr_t region_offset
)
2336 target_phys_addr_t addr
, end_addr
;
2339 ram_addr_t orig_size
= size
;
2343 /* XXX: should not depend on cpu context */
2345 if (env
->kqemu_enabled
) {
2346 kqemu_set_phys_mem(start_addr
, size
, phys_offset
);
2350 kvm_set_phys_mem(start_addr
, size
, phys_offset
);
2352 if (phys_offset
== IO_MEM_UNASSIGNED
) {
2353 region_offset
= start_addr
;
2355 region_offset
&= TARGET_PAGE_MASK
;
2356 size
= (size
+ TARGET_PAGE_SIZE
- 1) & TARGET_PAGE_MASK
;
2357 end_addr
= start_addr
+ (target_phys_addr_t
)size
;
2358 for(addr
= start_addr
; addr
!= end_addr
; addr
+= TARGET_PAGE_SIZE
) {
2359 p
= phys_page_find(addr
>> TARGET_PAGE_BITS
);
2360 if (p
&& p
->phys_offset
!= IO_MEM_UNASSIGNED
) {
2361 ram_addr_t orig_memory
= p
->phys_offset
;
2362 target_phys_addr_t start_addr2
, end_addr2
;
2363 int need_subpage
= 0;
2365 CHECK_SUBPAGE(addr
, start_addr
, start_addr2
, end_addr
, end_addr2
,
2367 if (need_subpage
|| phys_offset
& IO_MEM_SUBWIDTH
) {
2368 if (!(orig_memory
& IO_MEM_SUBPAGE
)) {
2369 subpage
= subpage_init((addr
& TARGET_PAGE_MASK
),
2370 &p
->phys_offset
, orig_memory
,
2373 subpage
= io_mem_opaque
[(orig_memory
& ~TARGET_PAGE_MASK
)
2376 subpage_register(subpage
, start_addr2
, end_addr2
, phys_offset
,
2378 p
->region_offset
= 0;
2380 p
->phys_offset
= phys_offset
;
2381 if ((phys_offset
& ~TARGET_PAGE_MASK
) <= IO_MEM_ROM
||
2382 (phys_offset
& IO_MEM_ROMD
))
2383 phys_offset
+= TARGET_PAGE_SIZE
;
2386 p
= phys_page_find_alloc(addr
>> TARGET_PAGE_BITS
, 1);
2387 p
->phys_offset
= phys_offset
;
2388 p
->region_offset
= region_offset
;
2389 if ((phys_offset
& ~TARGET_PAGE_MASK
) <= IO_MEM_ROM
||
2390 (phys_offset
& IO_MEM_ROMD
)) {
2391 phys_offset
+= TARGET_PAGE_SIZE
;
2393 target_phys_addr_t start_addr2
, end_addr2
;
2394 int need_subpage
= 0;
2396 CHECK_SUBPAGE(addr
, start_addr
, start_addr2
, end_addr
,
2397 end_addr2
, need_subpage
);
2399 if (need_subpage
|| phys_offset
& IO_MEM_SUBWIDTH
) {
2400 subpage
= subpage_init((addr
& TARGET_PAGE_MASK
),
2401 &p
->phys_offset
, IO_MEM_UNASSIGNED
,
2402 addr
& TARGET_PAGE_MASK
);
2403 subpage_register(subpage
, start_addr2
, end_addr2
,
2404 phys_offset
, region_offset
);
2405 p
->region_offset
= 0;
2409 region_offset
+= TARGET_PAGE_SIZE
;
2412 /* since each CPU stores ram addresses in its TLB cache, we must
2413 reset the modified entries */
2415 for(env
= first_cpu
; env
!= NULL
; env
= env
->next_cpu
) {
2420 /* XXX: temporary until new memory mapping API */
2421 ram_addr_t
cpu_get_physical_page_desc(target_phys_addr_t addr
)
2425 p
= phys_page_find(addr
>> TARGET_PAGE_BITS
);
2427 return IO_MEM_UNASSIGNED
;
2428 return p
->phys_offset
;
2431 void qemu_register_coalesced_mmio(target_phys_addr_t addr
, ram_addr_t size
)
2434 kvm_coalesce_mmio_region(addr
, size
);
2437 void qemu_unregister_coalesced_mmio(target_phys_addr_t addr
, ram_addr_t size
)
2440 kvm_uncoalesce_mmio_region(addr
, size
);
2444 /* XXX: better than nothing */
2445 static ram_addr_t
kqemu_ram_alloc(ram_addr_t size
)
2448 if ((last_ram_offset
+ size
) > kqemu_phys_ram_size
) {
2449 fprintf(stderr
, "Not enough memory (requested_size = %" PRIu64
", max memory = %" PRIu64
")\n",
2450 (uint64_t)size
, (uint64_t)kqemu_phys_ram_size
);
2453 addr
= last_ram_offset
;
2454 last_ram_offset
= TARGET_PAGE_ALIGN(last_ram_offset
+ size
);
2461 #include <sys/vfs.h>
2463 #define HUGETLBFS_MAGIC 0x958458f6
2465 static long gethugepagesize(const char *path
)
2471 ret
= statfs(path
, &fs
);
2472 } while (ret
!= 0 && errno
== EINTR
);
2479 if (fs
.f_type
!= HUGETLBFS_MAGIC
)
2480 fprintf(stderr
, "Warning: path not on HugeTLBFS: %s\n", path
);
2485 static void *file_ram_alloc(ram_addr_t memory
, const char *path
)
2493 unsigned long hpagesize
;
2494 extern int mem_prealloc
;
2500 hpagesize
= gethugepagesize(path
);
2505 if (memory
< hpagesize
) {
2509 if (kvm_enabled() && !kvm_has_sync_mmu()) {
2510 fprintf(stderr
, "host lacks mmu notifiers, disabling --mem-path\n");
2514 if (asprintf(&filename
, "%s/kvm.XXXXXX", path
) == -1) {
2518 fd
= mkstemp(filename
);
2527 memory
= (memory
+hpagesize
-1) & ~(hpagesize
-1);
2530 * ftruncate is not supported by hugetlbfs in older
2531 * hosts, so don't bother checking for errors.
2532 * If anything goes wrong with it under other filesystems,
2535 ftruncate(fd
, memory
);
2538 /* NB: MAP_POPULATE won't exhaustively alloc all phys pages in the case
2539 * MAP_PRIVATE is requested. For mem_prealloc we mmap as MAP_SHARED
2540 * to sidestep this quirk.
2542 flags
= mem_prealloc
? MAP_POPULATE
|MAP_SHARED
: MAP_PRIVATE
;
2543 area
= mmap(0, memory
, PROT_READ
|PROT_WRITE
, flags
, fd
, 0);
2545 area
= mmap(0, memory
, PROT_READ
|PROT_WRITE
, MAP_PRIVATE
, fd
, 0);
2547 if (area
== MAP_FAILED
) {
2548 perror("alloc_mem_area: can't mmap hugetlbfs pages");
2557 static void *file_ram_alloc(ram_addr_t memory
, const char *path
)
2564 extern const char *mem_path
;
2566 ram_addr_t
qemu_ram_alloc(ram_addr_t size
)
2568 RAMBlock
*new_block
;
2571 if (kqemu_phys_ram_base
) {
2572 return kqemu_ram_alloc(size
);
2576 size
= TARGET_PAGE_ALIGN(size
);
2577 new_block
= qemu_malloc(sizeof(*new_block
));
2579 new_block
->host
= file_ram_alloc(size
, mem_path
);
2580 if (!new_block
->host
) {
2581 new_block
->host
= qemu_vmalloc(size
);
2582 #ifdef MADV_MERGEABLE
2583 madvise(new_block
->host
, size
, MADV_MERGEABLE
);
2586 new_block
->offset
= last_ram_offset
;
2587 new_block
->length
= size
;
2589 new_block
->next
= ram_blocks
;
2590 ram_blocks
= new_block
;
2592 phys_ram_dirty
= qemu_realloc(phys_ram_dirty
,
2593 (last_ram_offset
+ size
) >> TARGET_PAGE_BITS
);
2594 memset(phys_ram_dirty
+ (last_ram_offset
>> TARGET_PAGE_BITS
),
2595 0xff, size
>> TARGET_PAGE_BITS
);
2597 last_ram_offset
+= size
;
2600 kvm_setup_guest_memory(new_block
->host
, size
);
2602 return new_block
->offset
;
2605 void qemu_ram_free(ram_addr_t addr
)
2607 /* TODO: implement this. */
2610 /* Return a host pointer to ram allocated with qemu_ram_alloc.
2611 With the exception of the softmmu code in this file, this should
2612 only be used for local memory (e.g. video ram) that the device owns,
2613 and knows it isn't going to access beyond the end of the block.
2615 It should not be used for general purpose DMA.
2616 Use cpu_physical_memory_map/cpu_physical_memory_rw instead.
2618 void *qemu_get_ram_ptr(ram_addr_t addr
)
2625 if (kqemu_phys_ram_base
) {
2626 return kqemu_phys_ram_base
+ addr
;
2631 prevp
= &ram_blocks
;
2633 while (block
&& (block
->offset
> addr
2634 || block
->offset
+ block
->length
<= addr
)) {
2636 prevp
= &prev
->next
;
2638 block
= block
->next
;
2641 fprintf(stderr
, "Bad ram offset %" PRIx64
"\n", (uint64_t)addr
);
2644 /* Move this entry to to start of the list. */
2646 prev
->next
= block
->next
;
2647 block
->next
= *prevp
;
2650 return block
->host
+ (addr
- block
->offset
);
2653 /* Some of the softmmu routines need to translate from a host pointer
2654 (typically a TLB entry) back to a ram offset. */
2655 ram_addr_t
qemu_ram_addr_from_host(void *ptr
)
2660 uint8_t *host
= ptr
;
2663 if (kqemu_phys_ram_base
) {
2664 return host
- kqemu_phys_ram_base
;
2669 prevp
= &ram_blocks
;
2671 while (block
&& (block
->host
> host
2672 || block
->host
+ block
->length
<= host
)) {
2674 prevp
= &prev
->next
;
2676 block
= block
->next
;
2679 fprintf(stderr
, "Bad ram pointer %p\n", ptr
);
2682 return block
->offset
+ (host
- block
->host
);
2685 static uint32_t unassigned_mem_readb(void *opaque
, target_phys_addr_t addr
)
2687 #ifdef DEBUG_UNASSIGNED
2688 printf("Unassigned mem read " TARGET_FMT_plx
"\n", addr
);
2690 #if defined(TARGET_SPARC)
2691 do_unassigned_access(addr
, 0, 0, 0, 1);
2696 static uint32_t unassigned_mem_readw(void *opaque
, target_phys_addr_t addr
)
2698 #ifdef DEBUG_UNASSIGNED
2699 printf("Unassigned mem read " TARGET_FMT_plx
"\n", addr
);
2701 #if defined(TARGET_SPARC)
2702 do_unassigned_access(addr
, 0, 0, 0, 2);
2707 static uint32_t unassigned_mem_readl(void *opaque
, target_phys_addr_t addr
)
2709 #ifdef DEBUG_UNASSIGNED
2710 printf("Unassigned mem read " TARGET_FMT_plx
"\n", addr
);
2712 #if defined(TARGET_SPARC)
2713 do_unassigned_access(addr
, 0, 0, 0, 4);
2718 static void unassigned_mem_writeb(void *opaque
, target_phys_addr_t addr
, uint32_t val
)
2720 #ifdef DEBUG_UNASSIGNED
2721 printf("Unassigned mem write " TARGET_FMT_plx
" = 0x%x\n", addr
, val
);
2723 #if defined(TARGET_SPARC)
2724 do_unassigned_access(addr
, 1, 0, 0, 1);
2728 static void unassigned_mem_writew(void *opaque
, target_phys_addr_t addr
, uint32_t val
)
2730 #ifdef DEBUG_UNASSIGNED
2731 printf("Unassigned mem write " TARGET_FMT_plx
" = 0x%x\n", addr
, val
);
2733 #if defined(TARGET_SPARC)
2734 do_unassigned_access(addr
, 1, 0, 0, 2);
2738 static void unassigned_mem_writel(void *opaque
, target_phys_addr_t addr
, uint32_t val
)
2740 #ifdef DEBUG_UNASSIGNED
2741 printf("Unassigned mem write " TARGET_FMT_plx
" = 0x%x\n", addr
, val
);
2743 #if defined(TARGET_SPARC)
2744 do_unassigned_access(addr
, 1, 0, 0, 4);
2748 static CPUReadMemoryFunc
*unassigned_mem_read
[3] = {
2749 unassigned_mem_readb
,
2750 unassigned_mem_readw
,
2751 unassigned_mem_readl
,
2754 static CPUWriteMemoryFunc
*unassigned_mem_write
[3] = {
2755 unassigned_mem_writeb
,
2756 unassigned_mem_writew
,
2757 unassigned_mem_writel
,
2760 static void notdirty_mem_writeb(void *opaque
, target_phys_addr_t ram_addr
,
2764 dirty_flags
= phys_ram_dirty
[ram_addr
>> TARGET_PAGE_BITS
];
2765 if (!(dirty_flags
& CODE_DIRTY_FLAG
)) {
2766 #if !defined(CONFIG_USER_ONLY)
2767 tb_invalidate_phys_page_fast(ram_addr
, 1);
2768 dirty_flags
= phys_ram_dirty
[ram_addr
>> TARGET_PAGE_BITS
];
2771 stb_p(qemu_get_ram_ptr(ram_addr
), val
);
2773 if (cpu_single_env
->kqemu_enabled
&&
2774 (dirty_flags
& KQEMU_MODIFY_PAGE_MASK
) != KQEMU_MODIFY_PAGE_MASK
)
2775 kqemu_modify_page(cpu_single_env
, ram_addr
);
2777 dirty_flags
|= (0xff & ~CODE_DIRTY_FLAG
);
2778 phys_ram_dirty
[ram_addr
>> TARGET_PAGE_BITS
] = dirty_flags
;
2779 /* we remove the notdirty callback only if the code has been
2781 if (dirty_flags
== 0xff)
2782 tlb_set_dirty(cpu_single_env
, cpu_single_env
->mem_io_vaddr
);
2785 static void notdirty_mem_writew(void *opaque
, target_phys_addr_t ram_addr
,
2789 dirty_flags
= phys_ram_dirty
[ram_addr
>> TARGET_PAGE_BITS
];
2790 if (!(dirty_flags
& CODE_DIRTY_FLAG
)) {
2791 #if !defined(CONFIG_USER_ONLY)
2792 tb_invalidate_phys_page_fast(ram_addr
, 2);
2793 dirty_flags
= phys_ram_dirty
[ram_addr
>> TARGET_PAGE_BITS
];
2796 stw_p(qemu_get_ram_ptr(ram_addr
), val
);
2798 if (cpu_single_env
->kqemu_enabled
&&
2799 (dirty_flags
& KQEMU_MODIFY_PAGE_MASK
) != KQEMU_MODIFY_PAGE_MASK
)
2800 kqemu_modify_page(cpu_single_env
, ram_addr
);
2802 dirty_flags
|= (0xff & ~CODE_DIRTY_FLAG
);
2803 phys_ram_dirty
[ram_addr
>> TARGET_PAGE_BITS
] = dirty_flags
;
2804 /* we remove the notdirty callback only if the code has been
2806 if (dirty_flags
== 0xff)
2807 tlb_set_dirty(cpu_single_env
, cpu_single_env
->mem_io_vaddr
);
2810 static void notdirty_mem_writel(void *opaque
, target_phys_addr_t ram_addr
,
2814 dirty_flags
= phys_ram_dirty
[ram_addr
>> TARGET_PAGE_BITS
];
2815 if (!(dirty_flags
& CODE_DIRTY_FLAG
)) {
2816 #if !defined(CONFIG_USER_ONLY)
2817 tb_invalidate_phys_page_fast(ram_addr
, 4);
2818 dirty_flags
= phys_ram_dirty
[ram_addr
>> TARGET_PAGE_BITS
];
2821 stl_p(qemu_get_ram_ptr(ram_addr
), val
);
2823 if (cpu_single_env
->kqemu_enabled
&&
2824 (dirty_flags
& KQEMU_MODIFY_PAGE_MASK
) != KQEMU_MODIFY_PAGE_MASK
)
2825 kqemu_modify_page(cpu_single_env
, ram_addr
);
2827 dirty_flags
|= (0xff & ~CODE_DIRTY_FLAG
);
2828 phys_ram_dirty
[ram_addr
>> TARGET_PAGE_BITS
] = dirty_flags
;
2829 /* we remove the notdirty callback only if the code has been
2831 if (dirty_flags
== 0xff)
2832 tlb_set_dirty(cpu_single_env
, cpu_single_env
->mem_io_vaddr
);
2835 static CPUReadMemoryFunc
*error_mem_read
[3] = {
2836 NULL
, /* never used */
2837 NULL
, /* never used */
2838 NULL
, /* never used */
2841 static CPUWriteMemoryFunc
*notdirty_mem_write
[3] = {
2842 notdirty_mem_writeb
,
2843 notdirty_mem_writew
,
2844 notdirty_mem_writel
,
2847 /* Generate a debug exception if a watchpoint has been hit. */
2848 static void check_watchpoint(int offset
, int len_mask
, int flags
)
2850 CPUState
*env
= cpu_single_env
;
2851 target_ulong pc
, cs_base
;
2852 TranslationBlock
*tb
;
2857 if (env
->watchpoint_hit
) {
2858 /* We re-entered the check after replacing the TB. Now raise
2859 * the debug interrupt so that is will trigger after the
2860 * current instruction. */
2861 cpu_interrupt(env
, CPU_INTERRUPT_DEBUG
);
2864 vaddr
= (env
->mem_io_vaddr
& TARGET_PAGE_MASK
) + offset
;
2865 TAILQ_FOREACH(wp
, &env
->watchpoints
, entry
) {
2866 if ((vaddr
== (wp
->vaddr
& len_mask
) ||
2867 (vaddr
& wp
->len_mask
) == wp
->vaddr
) && (wp
->flags
& flags
)) {
2868 wp
->flags
|= BP_WATCHPOINT_HIT
;
2869 if (!env
->watchpoint_hit
) {
2870 env
->watchpoint_hit
= wp
;
2871 tb
= tb_find_pc(env
->mem_io_pc
);
2873 cpu_abort(env
, "check_watchpoint: could not find TB for "
2874 "pc=%p", (void *)env
->mem_io_pc
);
2876 cpu_restore_state(tb
, env
, env
->mem_io_pc
, NULL
);
2877 tb_phys_invalidate(tb
, -1);
2878 if (wp
->flags
& BP_STOP_BEFORE_ACCESS
) {
2879 env
->exception_index
= EXCP_DEBUG
;
2881 cpu_get_tb_cpu_state(env
, &pc
, &cs_base
, &cpu_flags
);
2882 tb_gen_code(env
, pc
, cs_base
, cpu_flags
, 1);
2884 cpu_resume_from_signal(env
, NULL
);
2887 wp
->flags
&= ~BP_WATCHPOINT_HIT
;
2892 /* Watchpoint access routines. Watchpoints are inserted using TLB tricks,
2893 so these check for a hit then pass through to the normal out-of-line
2895 static uint32_t watch_mem_readb(void *opaque
, target_phys_addr_t addr
)
2897 check_watchpoint(addr
& ~TARGET_PAGE_MASK
, ~0x0, BP_MEM_READ
);
2898 return ldub_phys(addr
);
2901 static uint32_t watch_mem_readw(void *opaque
, target_phys_addr_t addr
)
2903 check_watchpoint(addr
& ~TARGET_PAGE_MASK
, ~0x1, BP_MEM_READ
);
2904 return lduw_phys(addr
);
2907 static uint32_t watch_mem_readl(void *opaque
, target_phys_addr_t addr
)
2909 check_watchpoint(addr
& ~TARGET_PAGE_MASK
, ~0x3, BP_MEM_READ
);
2910 return ldl_phys(addr
);
2913 static void watch_mem_writeb(void *opaque
, target_phys_addr_t addr
,
2916 check_watchpoint(addr
& ~TARGET_PAGE_MASK
, ~0x0, BP_MEM_WRITE
);
2917 stb_phys(addr
, val
);
2920 static void watch_mem_writew(void *opaque
, target_phys_addr_t addr
,
2923 check_watchpoint(addr
& ~TARGET_PAGE_MASK
, ~0x1, BP_MEM_WRITE
);
2924 stw_phys(addr
, val
);
2927 static void watch_mem_writel(void *opaque
, target_phys_addr_t addr
,
2930 check_watchpoint(addr
& ~TARGET_PAGE_MASK
, ~0x3, BP_MEM_WRITE
);
2931 stl_phys(addr
, val
);
2934 static CPUReadMemoryFunc
*watch_mem_read
[3] = {
2940 static CPUWriteMemoryFunc
*watch_mem_write
[3] = {
2946 static inline uint32_t subpage_readlen (subpage_t
*mmio
, target_phys_addr_t addr
,
2952 idx
= SUBPAGE_IDX(addr
);
2953 #if defined(DEBUG_SUBPAGE)
2954 printf("%s: subpage %p len %d addr " TARGET_FMT_plx
" idx %d\n", __func__
,
2955 mmio
, len
, addr
, idx
);
2957 ret
= (**mmio
->mem_read
[idx
][len
])(mmio
->opaque
[idx
][0][len
],
2958 addr
+ mmio
->region_offset
[idx
][0][len
]);
2963 static inline void subpage_writelen (subpage_t
*mmio
, target_phys_addr_t addr
,
2964 uint32_t value
, unsigned int len
)
2968 idx
= SUBPAGE_IDX(addr
);
2969 #if defined(DEBUG_SUBPAGE)
2970 printf("%s: subpage %p len %d addr " TARGET_FMT_plx
" idx %d value %08x\n", __func__
,
2971 mmio
, len
, addr
, idx
, value
);
2973 (**mmio
->mem_write
[idx
][len
])(mmio
->opaque
[idx
][1][len
],
2974 addr
+ mmio
->region_offset
[idx
][1][len
],
2978 static uint32_t subpage_readb (void *opaque
, target_phys_addr_t addr
)
2980 #if defined(DEBUG_SUBPAGE)
2981 printf("%s: addr " TARGET_FMT_plx
"\n", __func__
, addr
);
2984 return subpage_readlen(opaque
, addr
, 0);
2987 static void subpage_writeb (void *opaque
, target_phys_addr_t addr
,
2990 #if defined(DEBUG_SUBPAGE)
2991 printf("%s: addr " TARGET_FMT_plx
" val %08x\n", __func__
, addr
, value
);
2993 subpage_writelen(opaque
, addr
, value
, 0);
2996 static uint32_t subpage_readw (void *opaque
, target_phys_addr_t addr
)
2998 #if defined(DEBUG_SUBPAGE)
2999 printf("%s: addr " TARGET_FMT_plx
"\n", __func__
, addr
);
3002 return subpage_readlen(opaque
, addr
, 1);
3005 static void subpage_writew (void *opaque
, target_phys_addr_t addr
,
3008 #if defined(DEBUG_SUBPAGE)
3009 printf("%s: addr " TARGET_FMT_plx
" val %08x\n", __func__
, addr
, value
);
3011 subpage_writelen(opaque
, addr
, value
, 1);
3014 static uint32_t subpage_readl (void *opaque
, target_phys_addr_t addr
)
3016 #if defined(DEBUG_SUBPAGE)
3017 printf("%s: addr " TARGET_FMT_plx
"\n", __func__
, addr
);
3020 return subpage_readlen(opaque
, addr
, 2);
3023 static void subpage_writel (void *opaque
,
3024 target_phys_addr_t addr
, uint32_t value
)
3026 #if defined(DEBUG_SUBPAGE)
3027 printf("%s: addr " TARGET_FMT_plx
" val %08x\n", __func__
, addr
, value
);
3029 subpage_writelen(opaque
, addr
, value
, 2);
3032 static CPUReadMemoryFunc
*subpage_read
[] = {
3038 static CPUWriteMemoryFunc
*subpage_write
[] = {
3044 static int subpage_register (subpage_t
*mmio
, uint32_t start
, uint32_t end
,
3045 ram_addr_t memory
, ram_addr_t region_offset
)
3050 if (start
>= TARGET_PAGE_SIZE
|| end
>= TARGET_PAGE_SIZE
)
3052 idx
= SUBPAGE_IDX(start
);
3053 eidx
= SUBPAGE_IDX(end
);
3054 #if defined(DEBUG_SUBPAGE)
3055 printf("%s: %p start %08x end %08x idx %08x eidx %08x mem %ld\n", __func__
,
3056 mmio
, start
, end
, idx
, eidx
, memory
);
3058 memory
>>= IO_MEM_SHIFT
;
3059 for (; idx
<= eidx
; idx
++) {
3060 for (i
= 0; i
< 4; i
++) {
3061 if (io_mem_read
[memory
][i
]) {
3062 mmio
->mem_read
[idx
][i
] = &io_mem_read
[memory
][i
];
3063 mmio
->opaque
[idx
][0][i
] = io_mem_opaque
[memory
];
3064 mmio
->region_offset
[idx
][0][i
] = region_offset
;
3066 if (io_mem_write
[memory
][i
]) {
3067 mmio
->mem_write
[idx
][i
] = &io_mem_write
[memory
][i
];
3068 mmio
->opaque
[idx
][1][i
] = io_mem_opaque
[memory
];
3069 mmio
->region_offset
[idx
][1][i
] = region_offset
;
3077 static void *subpage_init (target_phys_addr_t base
, ram_addr_t
*phys
,
3078 ram_addr_t orig_memory
, ram_addr_t region_offset
)
3083 mmio
= qemu_mallocz(sizeof(subpage_t
));
3086 subpage_memory
= cpu_register_io_memory(subpage_read
, subpage_write
, mmio
);
3087 #if defined(DEBUG_SUBPAGE)
3088 printf("%s: %p base " TARGET_FMT_plx
" len %08x %d\n", __func__
,
3089 mmio
, base
, TARGET_PAGE_SIZE
, subpage_memory
);
3091 *phys
= subpage_memory
| IO_MEM_SUBPAGE
;
3092 subpage_register(mmio
, 0, TARGET_PAGE_SIZE
- 1, orig_memory
,
3098 static int get_free_io_mem_idx(void)
3102 for (i
= 0; i
<IO_MEM_NB_ENTRIES
; i
++)
3103 if (!io_mem_used
[i
]) {
3111 /* mem_read and mem_write are arrays of functions containing the
3112 function to access byte (index 0), word (index 1) and dword (index
3113 2). Functions can be omitted with a NULL function pointer.
3114 If io_index is non zero, the corresponding io zone is
3115 modified. If it is zero, a new io zone is allocated. The return
3116 value can be used with cpu_register_physical_memory(). (-1) is
3117 returned if error. */
3118 static int cpu_register_io_memory_fixed(int io_index
,
3119 CPUReadMemoryFunc
**mem_read
,
3120 CPUWriteMemoryFunc
**mem_write
,
3123 int i
, subwidth
= 0;
3125 if (io_index
<= 0) {
3126 io_index
= get_free_io_mem_idx();
3130 io_index
>>= IO_MEM_SHIFT
;
3131 if (io_index
>= IO_MEM_NB_ENTRIES
)
3135 for(i
= 0;i
< 3; i
++) {
3136 if (!mem_read
[i
] || !mem_write
[i
])
3137 subwidth
= IO_MEM_SUBWIDTH
;
3138 io_mem_read
[io_index
][i
] = mem_read
[i
];
3139 io_mem_write
[io_index
][i
] = mem_write
[i
];
3141 io_mem_opaque
[io_index
] = opaque
;
3142 return (io_index
<< IO_MEM_SHIFT
) | subwidth
;
3145 int cpu_register_io_memory(CPUReadMemoryFunc
**mem_read
,
3146 CPUWriteMemoryFunc
**mem_write
,
3149 return cpu_register_io_memory_fixed(0, mem_read
, mem_write
, opaque
);
3152 void cpu_unregister_io_memory(int io_table_address
)
3155 int io_index
= io_table_address
>> IO_MEM_SHIFT
;
3157 for (i
=0;i
< 3; i
++) {
3158 io_mem_read
[io_index
][i
] = unassigned_mem_read
[i
];
3159 io_mem_write
[io_index
][i
] = unassigned_mem_write
[i
];
3161 io_mem_opaque
[io_index
] = NULL
;
3162 io_mem_used
[io_index
] = 0;
3165 static void io_mem_init(void)
3169 cpu_register_io_memory_fixed(IO_MEM_ROM
, error_mem_read
, unassigned_mem_write
, NULL
);
3170 cpu_register_io_memory_fixed(IO_MEM_UNASSIGNED
, unassigned_mem_read
, unassigned_mem_write
, NULL
);
3171 cpu_register_io_memory_fixed(IO_MEM_NOTDIRTY
, error_mem_read
, notdirty_mem_write
, NULL
);
3175 io_mem_watch
= cpu_register_io_memory(watch_mem_read
,
3176 watch_mem_write
, NULL
);
3178 if (kqemu_phys_ram_base
) {
3179 /* alloc dirty bits array */
3180 phys_ram_dirty
= qemu_vmalloc(kqemu_phys_ram_size
>> TARGET_PAGE_BITS
);
3181 memset(phys_ram_dirty
, 0xff, kqemu_phys_ram_size
>> TARGET_PAGE_BITS
);
3186 #endif /* !defined(CONFIG_USER_ONLY) */
3188 /* physical memory access (slow version, mainly for debug) */
3189 #if defined(CONFIG_USER_ONLY)
3190 void cpu_physical_memory_rw(target_phys_addr_t addr
, uint8_t *buf
,
3191 int len
, int is_write
)
3198 page
= addr
& TARGET_PAGE_MASK
;
3199 l
= (page
+ TARGET_PAGE_SIZE
) - addr
;
3202 flags
= page_get_flags(page
);
3203 if (!(flags
& PAGE_VALID
))
3206 if (!(flags
& PAGE_WRITE
))
3208 /* XXX: this code should not depend on lock_user */
3209 if (!(p
= lock_user(VERIFY_WRITE
, addr
, l
, 0)))
3210 /* FIXME - should this return an error rather than just fail? */
3213 unlock_user(p
, addr
, l
);
3215 if (!(flags
& PAGE_READ
))
3217 /* XXX: this code should not depend on lock_user */
3218 if (!(p
= lock_user(VERIFY_READ
, addr
, l
, 1)))
3219 /* FIXME - should this return an error rather than just fail? */
3222 unlock_user(p
, addr
, 0);
3231 void cpu_physical_memory_rw(target_phys_addr_t addr
, uint8_t *buf
,
3232 int len
, int is_write
)
3237 target_phys_addr_t page
;
3242 page
= addr
& TARGET_PAGE_MASK
;
3243 l
= (page
+ TARGET_PAGE_SIZE
) - addr
;
3246 p
= phys_page_find(page
>> TARGET_PAGE_BITS
);
3248 pd
= IO_MEM_UNASSIGNED
;
3250 pd
= p
->phys_offset
;
3254 if ((pd
& ~TARGET_PAGE_MASK
) != IO_MEM_RAM
) {
3255 target_phys_addr_t addr1
= addr
;
3256 io_index
= (pd
>> IO_MEM_SHIFT
) & (IO_MEM_NB_ENTRIES
- 1);
3258 addr1
= (addr
& ~TARGET_PAGE_MASK
) + p
->region_offset
;
3259 /* XXX: could force cpu_single_env to NULL to avoid
3261 if (l
>= 4 && ((addr1
& 3) == 0)) {
3262 /* 32 bit write access */
3264 io_mem_write
[io_index
][2](io_mem_opaque
[io_index
], addr1
, val
);
3266 } else if (l
>= 2 && ((addr1
& 1) == 0)) {
3267 /* 16 bit write access */
3269 io_mem_write
[io_index
][1](io_mem_opaque
[io_index
], addr1
, val
);
3272 /* 8 bit write access */
3274 io_mem_write
[io_index
][0](io_mem_opaque
[io_index
], addr1
, val
);
3278 unsigned long addr1
;
3279 addr1
= (pd
& TARGET_PAGE_MASK
) + (addr
& ~TARGET_PAGE_MASK
);
3281 ptr
= qemu_get_ram_ptr(addr1
);
3282 memcpy(ptr
, buf
, l
);
3283 if (!cpu_physical_memory_is_dirty(addr1
)) {
3284 /* invalidate code */
3285 tb_invalidate_phys_page_range(addr1
, addr1
+ l
, 0);
3287 phys_ram_dirty
[addr1
>> TARGET_PAGE_BITS
] |=
3288 (0xff & ~CODE_DIRTY_FLAG
);
3290 /* qemu doesn't execute guest code directly, but kvm does
3291 therefore flush instruction caches */
3293 flush_icache_range((unsigned long)ptr
,
3294 ((unsigned long)ptr
)+l
);
3297 if ((pd
& ~TARGET_PAGE_MASK
) > IO_MEM_ROM
&&
3298 !(pd
& IO_MEM_ROMD
)) {
3299 target_phys_addr_t addr1
= addr
;
3301 io_index
= (pd
>> IO_MEM_SHIFT
) & (IO_MEM_NB_ENTRIES
- 1);
3303 addr1
= (addr
& ~TARGET_PAGE_MASK
) + p
->region_offset
;
3304 if (l
>= 4 && ((addr1
& 3) == 0)) {
3305 /* 32 bit read access */
3306 val
= io_mem_read
[io_index
][2](io_mem_opaque
[io_index
], addr1
);
3309 } else if (l
>= 2 && ((addr1
& 1) == 0)) {
3310 /* 16 bit read access */
3311 val
= io_mem_read
[io_index
][1](io_mem_opaque
[io_index
], addr1
);
3315 /* 8 bit read access */
3316 val
= io_mem_read
[io_index
][0](io_mem_opaque
[io_index
], addr1
);
3322 ptr
= qemu_get_ram_ptr(pd
& TARGET_PAGE_MASK
) +
3323 (addr
& ~TARGET_PAGE_MASK
);
3324 memcpy(buf
, ptr
, l
);
3333 /* used for ROM loading : can write in RAM and ROM */
3334 void cpu_physical_memory_write_rom(target_phys_addr_t addr
,
3335 const uint8_t *buf
, int len
)
3339 target_phys_addr_t page
;
3344 page
= addr
& TARGET_PAGE_MASK
;
3345 l
= (page
+ TARGET_PAGE_SIZE
) - addr
;
3348 p
= phys_page_find(page
>> TARGET_PAGE_BITS
);
3350 pd
= IO_MEM_UNASSIGNED
;
3352 pd
= p
->phys_offset
;
3355 if ((pd
& ~TARGET_PAGE_MASK
) != IO_MEM_RAM
&&
3356 (pd
& ~TARGET_PAGE_MASK
) != IO_MEM_ROM
&&
3357 !(pd
& IO_MEM_ROMD
)) {
3360 unsigned long addr1
;
3361 addr1
= (pd
& TARGET_PAGE_MASK
) + (addr
& ~TARGET_PAGE_MASK
);
3363 ptr
= qemu_get_ram_ptr(addr1
);
3364 memcpy(ptr
, buf
, l
);
3374 target_phys_addr_t addr
;
3375 target_phys_addr_t len
;
3378 static BounceBuffer bounce
;
3380 typedef struct MapClient
{
3382 void (*callback
)(void *opaque
);
3383 LIST_ENTRY(MapClient
) link
;
3386 static LIST_HEAD(map_client_list
, MapClient
) map_client_list
3387 = LIST_HEAD_INITIALIZER(map_client_list
);
3389 void *cpu_register_map_client(void *opaque
, void (*callback
)(void *opaque
))
3391 MapClient
*client
= qemu_malloc(sizeof(*client
));
3393 client
->opaque
= opaque
;
3394 client
->callback
= callback
;
3395 LIST_INSERT_HEAD(&map_client_list
, client
, link
);
3399 void cpu_unregister_map_client(void *_client
)
3401 MapClient
*client
= (MapClient
*)_client
;
3403 LIST_REMOVE(client
, link
);
3407 static void cpu_notify_map_clients(void)
3411 while (!LIST_EMPTY(&map_client_list
)) {
3412 client
= LIST_FIRST(&map_client_list
);
3413 client
->callback(client
->opaque
);
3414 cpu_unregister_map_client(client
);
3418 /* Map a physical memory region into a host virtual address.
3419 * May map a subset of the requested range, given by and returned in *plen.
3420 * May return NULL if resources needed to perform the mapping are exhausted.
3421 * Use only for reads OR writes - not for read-modify-write operations.
3422 * Use cpu_register_map_client() to know when retrying the map operation is
3423 * likely to succeed.
3425 void *cpu_physical_memory_map(target_phys_addr_t addr
,
3426 target_phys_addr_t
*plen
,
3429 target_phys_addr_t len
= *plen
;
3430 target_phys_addr_t done
= 0;
3432 uint8_t *ret
= NULL
;
3434 target_phys_addr_t page
;
3437 unsigned long addr1
;
3440 page
= addr
& TARGET_PAGE_MASK
;
3441 l
= (page
+ TARGET_PAGE_SIZE
) - addr
;
3444 p
= phys_page_find(page
>> TARGET_PAGE_BITS
);
3446 pd
= IO_MEM_UNASSIGNED
;
3448 pd
= p
->phys_offset
;
3451 if ((pd
& ~TARGET_PAGE_MASK
) != IO_MEM_RAM
) {
3452 if (done
|| bounce
.buffer
) {
3455 bounce
.buffer
= qemu_memalign(TARGET_PAGE_SIZE
, TARGET_PAGE_SIZE
);
3459 cpu_physical_memory_rw(addr
, bounce
.buffer
, l
, 0);
3461 ptr
= bounce
.buffer
;
3463 addr1
= (pd
& TARGET_PAGE_MASK
) + (addr
& ~TARGET_PAGE_MASK
);
3464 ptr
= qemu_get_ram_ptr(addr1
);
3468 } else if (ret
+ done
!= ptr
) {
3480 /* Unmaps a memory region previously mapped by cpu_physical_memory_map().
3481 * Will also mark the memory as dirty if is_write == 1. access_len gives
3482 * the amount of memory that was actually read or written by the caller.
3484 void cpu_physical_memory_unmap(void *buffer
, target_phys_addr_t len
,
3485 int is_write
, target_phys_addr_t access_len
)
3487 unsigned long flush_len
= (unsigned long)access_len
;
3489 if (buffer
!= bounce
.buffer
) {
3491 ram_addr_t addr1
= qemu_ram_addr_from_host(buffer
);
3492 while (access_len
) {
3494 l
= TARGET_PAGE_SIZE
;
3497 if (!cpu_physical_memory_is_dirty(addr1
)) {
3498 /* invalidate code */
3499 tb_invalidate_phys_page_range(addr1
, addr1
+ l
, 0);
3501 phys_ram_dirty
[addr1
>> TARGET_PAGE_BITS
] |=
3502 (0xff & ~CODE_DIRTY_FLAG
);
3507 dma_flush_range((unsigned long)buffer
,
3508 (unsigned long)buffer
+ flush_len
);
3513 cpu_physical_memory_write(bounce
.addr
, bounce
.buffer
, access_len
);
3515 qemu_free(bounce
.buffer
);
3516 bounce
.buffer
= NULL
;
3517 cpu_notify_map_clients();
3520 /* warning: addr must be aligned */
3521 uint32_t ldl_phys(target_phys_addr_t addr
)
3529 p
= phys_page_find(addr
>> TARGET_PAGE_BITS
);
3531 pd
= IO_MEM_UNASSIGNED
;
3533 pd
= p
->phys_offset
;
3536 if ((pd
& ~TARGET_PAGE_MASK
) > IO_MEM_ROM
&&
3537 !(pd
& IO_MEM_ROMD
)) {
3539 io_index
= (pd
>> IO_MEM_SHIFT
) & (IO_MEM_NB_ENTRIES
- 1);
3541 addr
= (addr
& ~TARGET_PAGE_MASK
) + p
->region_offset
;
3542 val
= io_mem_read
[io_index
][2](io_mem_opaque
[io_index
], addr
);
3545 ptr
= qemu_get_ram_ptr(pd
& TARGET_PAGE_MASK
) +
3546 (addr
& ~TARGET_PAGE_MASK
);
3552 /* warning: addr must be aligned */
3553 uint64_t ldq_phys(target_phys_addr_t addr
)
3561 p
= phys_page_find(addr
>> TARGET_PAGE_BITS
);
3563 pd
= IO_MEM_UNASSIGNED
;
3565 pd
= p
->phys_offset
;
3568 if ((pd
& ~TARGET_PAGE_MASK
) > IO_MEM_ROM
&&
3569 !(pd
& IO_MEM_ROMD
)) {
3571 io_index
= (pd
>> IO_MEM_SHIFT
) & (IO_MEM_NB_ENTRIES
- 1);
3573 addr
= (addr
& ~TARGET_PAGE_MASK
) + p
->region_offset
;
3574 #ifdef TARGET_WORDS_BIGENDIAN
3575 val
= (uint64_t)io_mem_read
[io_index
][2](io_mem_opaque
[io_index
], addr
) << 32;
3576 val
|= io_mem_read
[io_index
][2](io_mem_opaque
[io_index
], addr
+ 4);
3578 val
= io_mem_read
[io_index
][2](io_mem_opaque
[io_index
], addr
);
3579 val
|= (uint64_t)io_mem_read
[io_index
][2](io_mem_opaque
[io_index
], addr
+ 4) << 32;
3583 ptr
= qemu_get_ram_ptr(pd
& TARGET_PAGE_MASK
) +
3584 (addr
& ~TARGET_PAGE_MASK
);
3591 uint32_t ldub_phys(target_phys_addr_t addr
)
3594 cpu_physical_memory_read(addr
, &val
, 1);
3599 uint32_t lduw_phys(target_phys_addr_t addr
)
3602 cpu_physical_memory_read(addr
, (uint8_t *)&val
, 2);
3603 return tswap16(val
);
3606 /* warning: addr must be aligned. The ram page is not masked as dirty
3607 and the code inside is not invalidated. It is useful if the dirty
3608 bits are used to track modified PTEs */
3609 void stl_phys_notdirty(target_phys_addr_t addr
, uint32_t val
)
3616 p
= phys_page_find(addr
>> TARGET_PAGE_BITS
);
3618 pd
= IO_MEM_UNASSIGNED
;
3620 pd
= p
->phys_offset
;
3623 if ((pd
& ~TARGET_PAGE_MASK
) != IO_MEM_RAM
) {
3624 io_index
= (pd
>> IO_MEM_SHIFT
) & (IO_MEM_NB_ENTRIES
- 1);
3626 addr
= (addr
& ~TARGET_PAGE_MASK
) + p
->region_offset
;
3627 io_mem_write
[io_index
][2](io_mem_opaque
[io_index
], addr
, val
);
3629 unsigned long addr1
= (pd
& TARGET_PAGE_MASK
) + (addr
& ~TARGET_PAGE_MASK
);
3630 ptr
= qemu_get_ram_ptr(addr1
);
3633 if (unlikely(in_migration
)) {
3634 if (!cpu_physical_memory_is_dirty(addr1
)) {
3635 /* invalidate code */
3636 tb_invalidate_phys_page_range(addr1
, addr1
+ 4, 0);
3638 phys_ram_dirty
[addr1
>> TARGET_PAGE_BITS
] |=
3639 (0xff & ~CODE_DIRTY_FLAG
);
3645 void stq_phys_notdirty(target_phys_addr_t addr
, uint64_t val
)
3652 p
= phys_page_find(addr
>> TARGET_PAGE_BITS
);
3654 pd
= IO_MEM_UNASSIGNED
;
3656 pd
= p
->phys_offset
;
3659 if ((pd
& ~TARGET_PAGE_MASK
) != IO_MEM_RAM
) {
3660 io_index
= (pd
>> IO_MEM_SHIFT
) & (IO_MEM_NB_ENTRIES
- 1);
3662 addr
= (addr
& ~TARGET_PAGE_MASK
) + p
->region_offset
;
3663 #ifdef TARGET_WORDS_BIGENDIAN
3664 io_mem_write
[io_index
][2](io_mem_opaque
[io_index
], addr
, val
>> 32);
3665 io_mem_write
[io_index
][2](io_mem_opaque
[io_index
], addr
+ 4, val
);
3667 io_mem_write
[io_index
][2](io_mem_opaque
[io_index
], addr
, val
);
3668 io_mem_write
[io_index
][2](io_mem_opaque
[io_index
], addr
+ 4, val
>> 32);
3671 ptr
= qemu_get_ram_ptr(pd
& TARGET_PAGE_MASK
) +
3672 (addr
& ~TARGET_PAGE_MASK
);
3677 /* warning: addr must be aligned */
3678 void stl_phys(target_phys_addr_t addr
, uint32_t val
)
3685 p
= phys_page_find(addr
>> TARGET_PAGE_BITS
);
3687 pd
= IO_MEM_UNASSIGNED
;
3689 pd
= p
->phys_offset
;
3692 if ((pd
& ~TARGET_PAGE_MASK
) != IO_MEM_RAM
) {
3693 io_index
= (pd
>> IO_MEM_SHIFT
) & (IO_MEM_NB_ENTRIES
- 1);
3695 addr
= (addr
& ~TARGET_PAGE_MASK
) + p
->region_offset
;
3696 io_mem_write
[io_index
][2](io_mem_opaque
[io_index
], addr
, val
);
3698 unsigned long addr1
;
3699 addr1
= (pd
& TARGET_PAGE_MASK
) + (addr
& ~TARGET_PAGE_MASK
);
3701 ptr
= qemu_get_ram_ptr(addr1
);
3703 if (!cpu_physical_memory_is_dirty(addr1
)) {
3704 /* invalidate code */
3705 tb_invalidate_phys_page_range(addr1
, addr1
+ 4, 0);
3707 phys_ram_dirty
[addr1
>> TARGET_PAGE_BITS
] |=
3708 (0xff & ~CODE_DIRTY_FLAG
);
3714 void stb_phys(target_phys_addr_t addr
, uint32_t val
)
3717 cpu_physical_memory_write(addr
, &v
, 1);
3721 void stw_phys(target_phys_addr_t addr
, uint32_t val
)
3723 uint16_t v
= tswap16(val
);
3724 cpu_physical_memory_write(addr
, (const uint8_t *)&v
, 2);
3728 void stq_phys(target_phys_addr_t addr
, uint64_t val
)
3731 cpu_physical_memory_write(addr
, (const uint8_t *)&val
, 8);
3736 /* virtual memory access for debug (includes writing to ROM) */
3737 int cpu_memory_rw_debug(CPUState
*env
, target_ulong addr
,
3738 uint8_t *buf
, int len
, int is_write
)
3741 target_phys_addr_t phys_addr
;
3745 page
= addr
& TARGET_PAGE_MASK
;
3746 phys_addr
= cpu_get_phys_page_debug(env
, page
);
3747 /* if no physical page mapped, return an error */
3748 if (phys_addr
== -1)
3750 l
= (page
+ TARGET_PAGE_SIZE
) - addr
;
3753 phys_addr
+= (addr
& ~TARGET_PAGE_MASK
);
3754 #if !defined(CONFIG_USER_ONLY)
3756 cpu_physical_memory_write_rom(phys_addr
, buf
, l
);
3759 cpu_physical_memory_rw(phys_addr
, buf
, l
, is_write
);
3767 /* in deterministic execution mode, instructions doing device I/Os
3768 must be at the end of the TB */
3769 void cpu_io_recompile(CPUState
*env
, void *retaddr
)
3771 TranslationBlock
*tb
;
3773 target_ulong pc
, cs_base
;
3776 tb
= tb_find_pc((unsigned long)retaddr
);
3778 cpu_abort(env
, "cpu_io_recompile: could not find TB for pc=%p",
3781 n
= env
->icount_decr
.u16
.low
+ tb
->icount
;
3782 cpu_restore_state(tb
, env
, (unsigned long)retaddr
, NULL
);
3783 /* Calculate how many instructions had been executed before the fault
3785 n
= n
- env
->icount_decr
.u16
.low
;
3786 /* Generate a new TB ending on the I/O insn. */
3788 /* On MIPS and SH, delay slot instructions can only be restarted if
3789 they were already the first instruction in the TB. If this is not
3790 the first instruction in a TB then re-execute the preceding
3792 #if defined(TARGET_MIPS)
3793 if ((env
->hflags
& MIPS_HFLAG_BMASK
) != 0 && n
> 1) {
3794 env
->active_tc
.PC
-= 4;
3795 env
->icount_decr
.u16
.low
++;
3796 env
->hflags
&= ~MIPS_HFLAG_BMASK
;
3798 #elif defined(TARGET_SH4)
3799 if ((env
->flags
& ((DELAY_SLOT
| DELAY_SLOT_CONDITIONAL
))) != 0
3802 env
->icount_decr
.u16
.low
++;
3803 env
->flags
&= ~(DELAY_SLOT
| DELAY_SLOT_CONDITIONAL
);
3806 /* This should never happen. */
3807 if (n
> CF_COUNT_MASK
)
3808 cpu_abort(env
, "TB too big during recompile");
3810 cflags
= n
| CF_LAST_IO
;
3812 cs_base
= tb
->cs_base
;
3814 tb_phys_invalidate(tb
, -1);
3815 /* FIXME: In theory this could raise an exception. In practice
3816 we have already translated the block once so it's probably ok. */
3817 tb_gen_code(env
, pc
, cs_base
, flags
, cflags
);
3818 /* TODO: If env->pc != tb->pc (i.e. the faulting instruction was not
3819 the first in the TB) then we end up generating a whole new TB and
3820 repeating the fault, which is horribly inefficient.
3821 Better would be to execute just this insn uncached, or generate a
3823 cpu_resume_from_signal(env
, NULL
);
3826 void dump_exec_info(FILE *f
,
3827 int (*cpu_fprintf
)(FILE *f
, const char *fmt
, ...))
3829 int i
, target_code_size
, max_target_code_size
;
3830 int direct_jmp_count
, direct_jmp2_count
, cross_page
;
3831 TranslationBlock
*tb
;
3833 target_code_size
= 0;
3834 max_target_code_size
= 0;
3836 direct_jmp_count
= 0;
3837 direct_jmp2_count
= 0;
3838 for(i
= 0; i
< nb_tbs
; i
++) {
3840 target_code_size
+= tb
->size
;
3841 if (tb
->size
> max_target_code_size
)
3842 max_target_code_size
= tb
->size
;
3843 if (tb
->page_addr
[1] != -1)
3845 if (tb
->tb_next_offset
[0] != 0xffff) {
3847 if (tb
->tb_next_offset
[1] != 0xffff) {
3848 direct_jmp2_count
++;
3852 /* XXX: avoid using doubles ? */
3853 cpu_fprintf(f
, "Translation buffer state:\n");
3854 cpu_fprintf(f
, "gen code size %ld/%ld\n",
3855 code_gen_ptr
- code_gen_buffer
, code_gen_buffer_max_size
);
3856 cpu_fprintf(f
, "TB count %d/%d\n",
3857 nb_tbs
, code_gen_max_blocks
);
3858 cpu_fprintf(f
, "TB avg target size %d max=%d bytes\n",
3859 nb_tbs
? target_code_size
/ nb_tbs
: 0,
3860 max_target_code_size
);
3861 cpu_fprintf(f
, "TB avg host size %d bytes (expansion ratio: %0.1f)\n",
3862 nb_tbs
? (code_gen_ptr
- code_gen_buffer
) / nb_tbs
: 0,
3863 target_code_size
? (double) (code_gen_ptr
- code_gen_buffer
) / target_code_size
: 0);
3864 cpu_fprintf(f
, "cross page TB count %d (%d%%)\n",
3866 nb_tbs
? (cross_page
* 100) / nb_tbs
: 0);
3867 cpu_fprintf(f
, "direct jump count %d (%d%%) (2 jumps=%d %d%%)\n",
3869 nb_tbs
? (direct_jmp_count
* 100) / nb_tbs
: 0,
3871 nb_tbs
? (direct_jmp2_count
* 100) / nb_tbs
: 0);
3872 cpu_fprintf(f
, "\nStatistics:\n");
3873 cpu_fprintf(f
, "TB flush count %d\n", tb_flush_count
);
3874 cpu_fprintf(f
, "TB invalidate count %d\n", tb_phys_invalidate_count
);
3875 cpu_fprintf(f
, "TLB flush count %d\n", tlb_flush_count
);
3876 tcg_dump_info(f
, cpu_fprintf
);
3879 #if !defined(CONFIG_USER_ONLY)
3881 #define MMUSUFFIX _cmmu
3882 #define GETPC() NULL
3883 #define env cpu_single_env
3884 #define SOFTMMU_CODE_ACCESS
3887 #include "softmmu_template.h"
3890 #include "softmmu_template.h"
3893 #include "softmmu_template.h"
3896 #include "softmmu_template.h"