?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
Propagate make clean into libkvm directory
[qemu-kvm/fedora.git] / exec.c
bloba5bca49c27e94f749e7901ba6a5885714dcdd09e
1 /*
2 * virtual page mapping and translated block handling
3 *
4 * Copyright (c) 2003 Fabrice Bellard
5 *
6 * This library is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU Lesser General Public
8 * License as published by the Free Software Foundation; either
9 * version 2 of the License, or (at your option) any later version.
10 *
11 * This library is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
14 * Lesser General Public License for more details.
15 *
16 * You should have received a copy of the GNU Lesser General Public
17 * License along with this library; if not, write to the Free Software
18 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston MA 02110-1301 USA
19 */
20 #include "config.h"
21 #ifdef _WIN32
22 #include <windows.h>
23 #else
24 #include <sys/types.h>
25 #include <sys/mman.h>
26 #endif
27 #include <stdlib.h>
28 #include <stdio.h>
29 #include <stdarg.h>
30 #include <string.h>
31 #include <errno.h>
32 #include <unistd.h>
33 #include <inttypes.h>
34
35 #include "cpu.h"
36 #include "exec-all.h"
37 #include "qemu-common.h"
38
39 #if !defined(TARGET_IA64)
40 #include "tcg.h"
41 #endif
42 #include "qemu-kvm.h"
43
44 #include "hw/hw.h"
45 #include "osdep.h"
46 #include "kvm.h"
47 #if defined(CONFIG_USER_ONLY)
48 #include <qemu.h>
49 #endif
50
51 //#define DEBUG_TB_INVALIDATE
52 //#define DEBUG_FLUSH
53 //#define DEBUG_TLB
54 //#define DEBUG_UNASSIGNED
55
56 /* make various TB consistency checks */
57 //#define DEBUG_TB_CHECK
58 //#define DEBUG_TLB_CHECK
59
60 //#define DEBUG_IOPORT
61 //#define DEBUG_SUBPAGE
62
63 #if !defined(CONFIG_USER_ONLY)
64 /* TB consistency checks only implemented for usermode emulation. */
65 #undef DEBUG_TB_CHECK
66 #endif
67
68 #define SMC_BITMAP_USE_THRESHOLD 10
69
70 #if defined(TARGET_SPARC64)
71 #define TARGET_PHYS_ADDR_SPACE_BITS 41
72 #elif defined(TARGET_SPARC)
73 #define TARGET_PHYS_ADDR_SPACE_BITS 36
74 #elif defined(TARGET_ALPHA)
75 #define TARGET_PHYS_ADDR_SPACE_BITS 42
76 #define TARGET_VIRT_ADDR_SPACE_BITS 42
77 #elif defined(TARGET_PPC64)
78 #define TARGET_PHYS_ADDR_SPACE_BITS 42
79 #elif defined(TARGET_X86_64) && !defined(CONFIG_KQEMU)
80 #define TARGET_PHYS_ADDR_SPACE_BITS 42
81 #elif defined(TARGET_I386) && !defined(CONFIG_KQEMU)
82 #define TARGET_PHYS_ADDR_SPACE_BITS 36
83 #elif defined(TARGET_IA64)
84 #define TARGET_PHYS_ADDR_SPACE_BITS 36
85 #else
86 /* Note: for compatibility with kqemu, we use 32 bits for x86_64 */
87 #define TARGET_PHYS_ADDR_SPACE_BITS 32
88 #endif
89
90 static TranslationBlock *tbs;
91 int code_gen_max_blocks;
92 TranslationBlock *tb_phys_hash[CODE_GEN_PHYS_HASH_SIZE];
93 static int nb_tbs;
94 /* any access to the tbs or the page table must use this lock */
95 spinlock_t tb_lock = SPIN_LOCK_UNLOCKED;
96
97 #if defined(__arm__) || defined(__sparc_v9__)
98 /* The prologue must be reachable with a direct jump. ARM and Sparc64
99 have limited branch ranges (possibly also PPC) so place it in a
100 section close to code segment. */
101 #define code_gen_section \
102 __attribute__((__section__(".gen_code"))) \
103 __attribute__((aligned (32)))
104 #else
105 #define code_gen_section \
106 __attribute__((aligned (32)))
107 #endif
108
109 uint8_t code_gen_prologue[1024] code_gen_section;
110 static uint8_t *code_gen_buffer;
111 static unsigned long code_gen_buffer_size;
112 /* threshold to flush the translated code buffer */
113 static unsigned long code_gen_buffer_max_size;
114 uint8_t *code_gen_ptr;
115
116 #if !defined(CONFIG_USER_ONLY)
117 int phys_ram_fd;
118 uint8_t *phys_ram_dirty;
119 uint8_t *bios_mem;
120 static int in_migration;
121
122 typedef struct RAMBlock {
123 uint8_t *host;
124 ram_addr_t offset;
125 ram_addr_t length;
126 struct RAMBlock *next;
127 } RAMBlock;
128
129 static RAMBlock *ram_blocks;
130 /* TODO: When we implement (and use) ram deallocation (e.g. for hotplug)
131 then we can no longet assume contiguous ram offsets, and external uses
132 of this variable will break. */
133 ram_addr_t last_ram_offset;
134 #endif
135
136 CPUState *first_cpu;
137 /* current CPU in the current thread. It is only valid inside
138 cpu_exec() */
139 CPUState *cpu_single_env;
140 /* 0 = Do not count executed instructions.
141 1 = Precise instruction counting.
142 2 = Adaptive rate instruction counting. */
143 int use_icount = 0;
144 /* Current instruction counter. While executing translated code this may
145 include some instructions that have not yet been executed. */
146 int64_t qemu_icount;
147
148 typedef struct PageDesc {
149 /* list of TBs intersecting this ram page */
150 TranslationBlock *first_tb;
151 /* in order to optimize self modifying code, we count the number
152 of lookups we do to a given page to use a bitmap */
153 unsigned int code_write_count;
154 uint8_t *code_bitmap;
155 #if defined(CONFIG_USER_ONLY)
156 unsigned long flags;
157 #endif
158 } PageDesc;
159
160 typedef struct PhysPageDesc {
161 /* offset in host memory of the page + io_index in the low bits */
162 ram_addr_t phys_offset;
163 ram_addr_t region_offset;
164 } PhysPageDesc;
165
166 #define L2_BITS 10
167 #if defined(CONFIG_USER_ONLY) && defined(TARGET_VIRT_ADDR_SPACE_BITS)
168 /* XXX: this is a temporary hack for alpha target.
169 * In the future, this is to be replaced by a multi-level table
170 * to actually be able to handle the complete 64 bits address space.
171 */
172 #define L1_BITS (TARGET_VIRT_ADDR_SPACE_BITS - L2_BITS - TARGET_PAGE_BITS)
173 #else
174 #define L1_BITS (32 - L2_BITS - TARGET_PAGE_BITS)
175 #endif
176
177 #define L1_SIZE (1 << L1_BITS)
178 #define L2_SIZE (1 << L2_BITS)
179
180 unsigned long qemu_real_host_page_size;
181 unsigned long qemu_host_page_bits;
182 unsigned long qemu_host_page_size;
183 unsigned long qemu_host_page_mask;
184
185 /* XXX: for system emulation, it could just be an array */
186 static PageDesc *l1_map[L1_SIZE];
187 static PhysPageDesc **l1_phys_map;
188
189 #if !defined(CONFIG_USER_ONLY)
190 static void io_mem_init(void);
191
192 /* io memory support */
193 CPUWriteMemoryFunc *io_mem_write[IO_MEM_NB_ENTRIES][4];
194 CPUReadMemoryFunc *io_mem_read[IO_MEM_NB_ENTRIES][4];
195 void *io_mem_opaque[IO_MEM_NB_ENTRIES];
196 static char io_mem_used[IO_MEM_NB_ENTRIES];
197 static int io_mem_watch;
198 #endif
199
200 /* log support */
201 static const char *logfilename = "/tmp/qemu.log";
202 FILE *logfile;
203 int loglevel;
204 static int log_append = 0;
205
206 /* statistics */
207 static int tlb_flush_count;
208 static int tb_flush_count;
209 static int tb_phys_invalidate_count;
210
211 #define SUBPAGE_IDX(addr) ((addr) & ~TARGET_PAGE_MASK)
212 typedef struct subpage_t {
213 target_phys_addr_t base;
214 CPUReadMemoryFunc **mem_read[TARGET_PAGE_SIZE][4];
215 CPUWriteMemoryFunc **mem_write[TARGET_PAGE_SIZE][4];
216 void *opaque[TARGET_PAGE_SIZE][2][4];
217 ram_addr_t region_offset[TARGET_PAGE_SIZE][2][4];
218 } subpage_t;
219
220 #ifdef _WIN32
221 static void map_exec(void *addr, long size)
222 {
223 DWORD old_protect;
224 VirtualProtect(addr, size,
225 PAGE_EXECUTE_READWRITE, &old_protect);
226
227 }
228 #else
229 static void map_exec(void *addr, long size)
230 {
231 unsigned long start, end, page_size;
232
233 page_size = getpagesize();
234 start = (unsigned long)addr;
235 start &= ~(page_size - 1);
236
237 end = (unsigned long)addr + size;
238 end += page_size - 1;
239 end &= ~(page_size - 1);
240
241 mprotect((void *)start, end - start,
242 PROT_READ | PROT_WRITE | PROT_EXEC);
243 }
244 #endif
245
246 static void page_init(void)
247 {
248 /* NOTE: we can always suppose that qemu_host_page_size >=
249 TARGET_PAGE_SIZE */
250 #ifdef _WIN32
251 {
252 SYSTEM_INFO system_info;
253
254 GetSystemInfo(&system_info);
255 qemu_real_host_page_size = system_info.dwPageSize;
256 }
257 #else
258 qemu_real_host_page_size = getpagesize();
259 #endif
260 if (qemu_host_page_size == 0)
261 qemu_host_page_size = qemu_real_host_page_size;
262 if (qemu_host_page_size < TARGET_PAGE_SIZE)
263 qemu_host_page_size = TARGET_PAGE_SIZE;
264 qemu_host_page_bits = 0;
265 while ((1 << qemu_host_page_bits) < qemu_host_page_size)
266 qemu_host_page_bits++;
267 qemu_host_page_mask = ~(qemu_host_page_size - 1);
268 l1_phys_map = qemu_vmalloc(L1_SIZE * sizeof(void *));
269 memset(l1_phys_map, 0, L1_SIZE * sizeof(void *));
270
271 #if !defined(_WIN32) && defined(CONFIG_USER_ONLY)
272 {
273 long long startaddr, endaddr;
274 FILE *f;
275 int n;
276
277 mmap_lock();
278 last_brk = (unsigned long)sbrk(0);
279 f = fopen("/proc/self/maps", "r");
280 if (f) {
281 do {
282 n = fscanf (f, "%llx-%llx %*[^\n]\n", &startaddr, &endaddr);
283 if (n == 2) {
284 startaddr = MIN(startaddr,
285 (1ULL << TARGET_PHYS_ADDR_SPACE_BITS) - 1);
286 endaddr = MIN(endaddr,
287 (1ULL << TARGET_PHYS_ADDR_SPACE_BITS) - 1);
288 page_set_flags(startaddr & TARGET_PAGE_MASK,
289 TARGET_PAGE_ALIGN(endaddr),
290 PAGE_RESERVED);
291 }
292 } while (!feof(f));
293 fclose(f);
294 }
295 mmap_unlock();
296 }
297 #endif
298 }
299
300 static inline PageDesc **page_l1_map(target_ulong index)
301 {
302 #if TARGET_LONG_BITS > 32
303 /* Host memory outside guest VM. For 32-bit targets we have already
304 excluded high addresses. */
305 if (index > ((target_ulong)L2_SIZE * L1_SIZE))
306 return NULL;
307 #endif
308 return &l1_map[index >> L2_BITS];
309 }
310
311 static inline PageDesc *page_find_alloc(target_ulong index)
312 {
313 PageDesc **lp, *p;
314 lp = page_l1_map(index);
315 if (!lp)
316 return NULL;
317
318 p = *lp;
319 if (!p) {
320 /* allocate if not found */
321 #if defined(CONFIG_USER_ONLY)
322 size_t len = sizeof(PageDesc) * L2_SIZE;
323 /* Don't use qemu_malloc because it may recurse. */
324 p = mmap(0, len, PROT_READ | PROT_WRITE,
325 MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
326 *lp = p;
327 if (h2g_valid(p)) {
328 unsigned long addr = h2g(p);
329 page_set_flags(addr & TARGET_PAGE_MASK,
330 TARGET_PAGE_ALIGN(addr + len),
331 PAGE_RESERVED);
332 }
333 #else
334 p = qemu_mallocz(sizeof(PageDesc) * L2_SIZE);
335 *lp = p;
336 #endif
337 }
338 return p + (index & (L2_SIZE - 1));
339 }
340
341 static inline PageDesc *page_find(target_ulong index)
342 {
343 PageDesc **lp, *p;
344 lp = page_l1_map(index);
345 if (!lp)
346 return NULL;
347
348 p = *lp;
349 if (!p)
350 return 0;
351 return p + (index & (L2_SIZE - 1));
352 }
353
354 static PhysPageDesc *phys_page_find_alloc(target_phys_addr_t index, int alloc)
355 {
356 void **lp, **p;
357 PhysPageDesc *pd;
358
359 p = (void **)l1_phys_map;
360 #if TARGET_PHYS_ADDR_SPACE_BITS > 32
361
362 #if TARGET_PHYS_ADDR_SPACE_BITS > (32 + L1_BITS)
363 #error unsupported TARGET_PHYS_ADDR_SPACE_BITS
364 #endif
365 lp = p + ((index >> (L1_BITS + L2_BITS)) & (L1_SIZE - 1));
366 p = *lp;
367 if (!p) {
368 /* allocate if not found */
369 if (!alloc)
370 return NULL;
371 p = qemu_vmalloc(sizeof(void *) * L1_SIZE);
372 memset(p, 0, sizeof(void *) * L1_SIZE);
373 *lp = p;
374 }
375 #endif
376 lp = p + ((index >> L2_BITS) & (L1_SIZE - 1));
377 pd = *lp;
378 if (!pd) {
379 int i;
380 /* allocate if not found */
381 if (!alloc)
382 return NULL;
383 pd = qemu_vmalloc(sizeof(PhysPageDesc) * L2_SIZE);
384 *lp = pd;
385 for (i = 0; i < L2_SIZE; i++) {
386 pd[i].phys_offset = IO_MEM_UNASSIGNED;
387 pd[i].region_offset = (index + i) << TARGET_PAGE_BITS;
388 }
389 }
390 return ((PhysPageDesc *)pd) + (index & (L2_SIZE - 1));
391 }
392
393 static inline PhysPageDesc *phys_page_find(target_phys_addr_t index)
394 {
395 return phys_page_find_alloc(index, 0);
396 }
397
398 #if !defined(CONFIG_USER_ONLY)
399 static void tlb_protect_code(ram_addr_t ram_addr);
400 static void tlb_unprotect_code_phys(CPUState *env, ram_addr_t ram_addr,
401 target_ulong vaddr);
402 #define mmap_lock() do { } while(0)
403 #define mmap_unlock() do { } while(0)
404 #endif
405
406 #define DEFAULT_CODE_GEN_BUFFER_SIZE (32 * 1024 * 1024)
407
408 #if defined(CONFIG_USER_ONLY)
409 /* Currently it is not recommanded to allocate big chunks of data in
410 user mode. It will change when a dedicated libc will be used */
411 #define USE_STATIC_CODE_GEN_BUFFER
412 #endif
413
414 #ifdef USE_STATIC_CODE_GEN_BUFFER
415 static uint8_t static_code_gen_buffer[DEFAULT_CODE_GEN_BUFFER_SIZE];
416 #endif
417
418 static void code_gen_alloc(unsigned long tb_size)
419 {
420 if (kvm_enabled())
421 return;
422
423 #ifdef USE_STATIC_CODE_GEN_BUFFER
424 code_gen_buffer = static_code_gen_buffer;
425 code_gen_buffer_size = DEFAULT_CODE_GEN_BUFFER_SIZE;
426 map_exec(code_gen_buffer, code_gen_buffer_size);
427 #else
428 code_gen_buffer_size = tb_size;
429 if (code_gen_buffer_size == 0) {
430 #if defined(CONFIG_USER_ONLY)
431 /* in user mode, phys_ram_size is not meaningful */
432 code_gen_buffer_size = DEFAULT_CODE_GEN_BUFFER_SIZE;
433 #else
434 /* XXX: needs ajustments */
435 code_gen_buffer_size = (unsigned long)(ram_size / 4);
436 #endif
437 }
438 if (code_gen_buffer_size < MIN_CODE_GEN_BUFFER_SIZE)
439 code_gen_buffer_size = MIN_CODE_GEN_BUFFER_SIZE;
440 /* The code gen buffer location may have constraints depending on
441 the host cpu and OS */
442 #if defined(__linux__)
443 {
444 int flags;
445 void *start = NULL;
446
447 flags = MAP_PRIVATE | MAP_ANONYMOUS;
448 #if defined(__x86_64__)
449 flags |= MAP_32BIT;
450 /* Cannot map more than that */
451 if (code_gen_buffer_size > (800 * 1024 * 1024))
452 code_gen_buffer_size = (800 * 1024 * 1024);
453 #elif defined(__sparc_v9__)
454 // Map the buffer below 2G, so we can use direct calls and branches
455 flags |= MAP_FIXED;
456 start = (void *) 0x60000000UL;
457 if (code_gen_buffer_size > (512 * 1024 * 1024))
458 code_gen_buffer_size = (512 * 1024 * 1024);
459 #elif defined(__arm__)
460 /* Map the buffer below 32M, so we can use direct calls and branches */
461 flags |= MAP_FIXED;
462 start = (void *) 0x01000000UL;
463 if (code_gen_buffer_size > 16 * 1024 * 1024)
464 code_gen_buffer_size = 16 * 1024 * 1024;
465 #endif
466 code_gen_buffer = mmap(start, code_gen_buffer_size,
467 PROT_WRITE | PROT_READ | PROT_EXEC,
468 flags, -1, 0);
469 if (code_gen_buffer == MAP_FAILED) {
470 fprintf(stderr, "Could not allocate dynamic translator buffer\n");
471 exit(1);
472 }
473 }
474 #elif defined(__FreeBSD__) || defined(__DragonFly__)
475 {
476 int flags;
477 void *addr = NULL;
478 flags = MAP_PRIVATE | MAP_ANONYMOUS;
479 #if defined(__x86_64__)
480 /* FreeBSD doesn't have MAP_32BIT, use MAP_FIXED and assume
481 * 0x40000000 is free */
482 flags |= MAP_FIXED;
483 addr = (void *)0x40000000;
484 /* Cannot map more than that */
485 if (code_gen_buffer_size > (800 * 1024 * 1024))
486 code_gen_buffer_size = (800 * 1024 * 1024);
487 #endif
488 code_gen_buffer = mmap(addr, code_gen_buffer_size,
489 PROT_WRITE | PROT_READ | PROT_EXEC,
490 flags, -1, 0);
491 if (code_gen_buffer == MAP_FAILED) {
492 fprintf(stderr, "Could not allocate dynamic translator buffer\n");
493 exit(1);
494 }
495 }
496 #else
497 code_gen_buffer = qemu_malloc(code_gen_buffer_size);
498 map_exec(code_gen_buffer, code_gen_buffer_size);
499 #endif
500 #endif /* !USE_STATIC_CODE_GEN_BUFFER */
501 map_exec(code_gen_prologue, sizeof(code_gen_prologue));
502 code_gen_buffer_max_size = code_gen_buffer_size -
503 code_gen_max_block_size();
504 code_gen_max_blocks = code_gen_buffer_size / CODE_GEN_AVG_BLOCK_SIZE;
505 tbs = qemu_malloc(code_gen_max_blocks * sizeof(TranslationBlock));
506 }
507
508 /* Must be called before using the QEMU cpus. 'tb_size' is the size
509 (in bytes) allocated to the translation buffer. Zero means default
510 size. */
511 void cpu_exec_init_all(unsigned long tb_size)
512 {
513 cpu_gen_init();
514 code_gen_alloc(tb_size);
515 code_gen_ptr = code_gen_buffer;
516 page_init();
517 #if !defined(CONFIG_USER_ONLY)
518 io_mem_init();
519 #endif
520 }
521
522 #if defined(CPU_SAVE_VERSION) && !defined(CONFIG_USER_ONLY)
523
524 #define CPU_COMMON_SAVE_VERSION 1
525
526 static void cpu_common_save(QEMUFile *f, void *opaque)
527 {
528 CPUState *env = opaque;
529
530 qemu_put_be32s(f, &env->halted);
531 qemu_put_be32s(f, &env->interrupt_request);
532 }
533
534 static int cpu_common_load(QEMUFile *f, void *opaque, int version_id)
535 {
536 CPUState *env = opaque;
537
538 if (version_id != CPU_COMMON_SAVE_VERSION)
539 return -EINVAL;
540
541 qemu_get_be32s(f, &env->halted);
542 qemu_get_be32s(f, &env->interrupt_request);
543 /* 0x01 was CPU_INTERRUPT_EXIT. This line can be removed when the
544 version_id is increased. */
545 env->interrupt_request &= ~0x01;
546 tlb_flush(env, 1);
547
548 return 0;
549 }
550 #endif
551
552 void cpu_exec_init(CPUState *env)
553 {
554 CPUState **penv;
555 int cpu_index;
556
557 #if defined(CONFIG_USER_ONLY)
558 cpu_list_lock();
559 #endif
560 env->next_cpu = NULL;
561 penv = &first_cpu;
562 cpu_index = 0;
563 while (*penv != NULL) {
564 penv = (CPUState **)&(*penv)->next_cpu;
565 cpu_index++;
566 }
567 env->cpu_index = cpu_index;
568 env->numa_node = 0;
569 TAILQ_INIT(&env->breakpoints);
570 TAILQ_INIT(&env->watchpoints);
571 #ifdef __WIN32
572 env->thread_id = GetCurrentProcessId();
573 #else
574 env->thread_id = getpid();
575 #endif
576 *penv = env;
577 #if defined(CONFIG_USER_ONLY)
578 cpu_list_unlock();
579 #endif
580 #if defined(CPU_SAVE_VERSION) && !defined(CONFIG_USER_ONLY)
581 register_savevm("cpu_common", cpu_index, CPU_COMMON_SAVE_VERSION,
582 cpu_common_save, cpu_common_load, env);
583 register_savevm("cpu", cpu_index, CPU_SAVE_VERSION,
584 cpu_save, cpu_load, env);
585 #endif
586 }
587
588 static inline void invalidate_page_bitmap(PageDesc *p)
589 {
590 if (p->code_bitmap) {
591 qemu_free(p->code_bitmap);
592 p->code_bitmap = NULL;
593 }
594 p->code_write_count = 0;
595 }
596
597 /* set to NULL all the 'first_tb' fields in all PageDescs */
598 static void page_flush_tb(void)
599 {
600 int i, j;
601 PageDesc *p;
602
603 for(i = 0; i < L1_SIZE; i++) {
604 p = l1_map[i];
605 if (p) {
606 for(j = 0; j < L2_SIZE; j++) {
607 p->first_tb = NULL;
608 invalidate_page_bitmap(p);
609 p++;
610 }
611 }
612 }
613 }
614
615 /* flush all the translation blocks */
616 /* XXX: tb_flush is currently not thread safe */
617 void tb_flush(CPUState *env1)
618 {
619 CPUState *env;
620 #if defined(DEBUG_FLUSH)
621 printf("qemu: flush code_size=%ld nb_tbs=%d avg_tb_size=%ld\n",
622 (unsigned long)(code_gen_ptr - code_gen_buffer),
623 nb_tbs, nb_tbs > 0 ?
624 ((unsigned long)(code_gen_ptr - code_gen_buffer)) / nb_tbs : 0);
625 #endif
626 if ((unsigned long)(code_gen_ptr - code_gen_buffer) > code_gen_buffer_size)
627 cpu_abort(env1, "Internal error: code buffer overflow\n");
628
629 nb_tbs = 0;
630
631 for(env = first_cpu; env != NULL; env = env->next_cpu) {
632 memset (env->tb_jmp_cache, 0, TB_JMP_CACHE_SIZE * sizeof (void *));
633 }
634
635 memset (tb_phys_hash, 0, CODE_GEN_PHYS_HASH_SIZE * sizeof (void *));
636 page_flush_tb();
637
638 code_gen_ptr = code_gen_buffer;
639 /* XXX: flush processor icache at this point if cache flush is
640 expensive */
641 tb_flush_count++;
642 }
643
644 #ifdef DEBUG_TB_CHECK
645
646 static void tb_invalidate_check(target_ulong address)
647 {
648 TranslationBlock *tb;
649 int i;
650 address &= TARGET_PAGE_MASK;
651 for(i = 0;i < CODE_GEN_PHYS_HASH_SIZE; i++) {
652 for(tb = tb_phys_hash[i]; tb != NULL; tb = tb->phys_hash_next) {
653 if (!(address + TARGET_PAGE_SIZE <= tb->pc ||
654 address >= tb->pc + tb->size)) {
655 printf("ERROR invalidate: address=%08lx PC=%08lx size=%04x\n",
656 address, (long)tb->pc, tb->size);
657 }
658 }
659 }
660 }
661
662 /* verify that all the pages have correct rights for code */
663 static void tb_page_check(void)
664 {
665 TranslationBlock *tb;
666 int i, flags1, flags2;
667
668 for(i = 0;i < CODE_GEN_PHYS_HASH_SIZE; i++) {
669 for(tb = tb_phys_hash[i]; tb != NULL; tb = tb->phys_hash_next) {
670 flags1 = page_get_flags(tb->pc);
671 flags2 = page_get_flags(tb->pc + tb->size - 1);
672 if ((flags1 & PAGE_WRITE) || (flags2 & PAGE_WRITE)) {
673 printf("ERROR page flags: PC=%08lx size=%04x f1=%x f2=%x\n",
674 (long)tb->pc, tb->size, flags1, flags2);
675 }
676 }
677 }
678 }
679
680 static void tb_jmp_check(TranslationBlock *tb)
681 {
682 TranslationBlock *tb1;
683 unsigned int n1;
684
685 /* suppress any remaining jumps to this TB */
686 tb1 = tb->jmp_first;
687 for(;;) {
688 n1 = (long)tb1 & 3;
689 tb1 = (TranslationBlock *)((long)tb1 & ~3);
690 if (n1 == 2)
691 break;
692 tb1 = tb1->jmp_next[n1];
693 }
694 /* check end of list */
695 if (tb1 != tb) {
696 printf("ERROR: jmp_list from 0x%08lx\n", (long)tb);
697 }
698 }
699
700 #endif
701
702 /* invalidate one TB */
703 static inline void tb_remove(TranslationBlock **ptb, TranslationBlock *tb,
704 int next_offset)
705 {
706 TranslationBlock *tb1;
707 for(;;) {
708 tb1 = *ptb;
709 if (tb1 == tb) {
710 *ptb = *(TranslationBlock **)((char *)tb1 + next_offset);
711 break;
712 }
713 ptb = (TranslationBlock **)((char *)tb1 + next_offset);
714 }
715 }
716
717 static inline void tb_page_remove(TranslationBlock **ptb, TranslationBlock *tb)
718 {
719 TranslationBlock *tb1;
720 unsigned int n1;
721
722 for(;;) {
723 tb1 = *ptb;
724 n1 = (long)tb1 & 3;
725 tb1 = (TranslationBlock *)((long)tb1 & ~3);
726 if (tb1 == tb) {
727 *ptb = tb1->page_next[n1];
728 break;
729 }
730 ptb = &tb1->page_next[n1];
731 }
732 }
733
734 static inline void tb_jmp_remove(TranslationBlock *tb, int n)
735 {
736 TranslationBlock *tb1, **ptb;
737 unsigned int n1;
738
739 ptb = &tb->jmp_next[n];
740 tb1 = *ptb;
741 if (tb1) {
742 /* find tb(n) in circular list */
743 for(;;) {
744 tb1 = *ptb;
745 n1 = (long)tb1 & 3;
746 tb1 = (TranslationBlock *)((long)tb1 & ~3);
747 if (n1 == n && tb1 == tb)
748 break;
749 if (n1 == 2) {
750 ptb = &tb1->jmp_first;
751 } else {
752 ptb = &tb1->jmp_next[n1];
753 }
754 }
755 /* now we can suppress tb(n) from the list */
756 *ptb = tb->jmp_next[n];
757
758 tb->jmp_next[n] = NULL;
759 }
760 }
761
762 /* reset the jump entry 'n' of a TB so that it is not chained to
763 another TB */
764 static inline void tb_reset_jump(TranslationBlock *tb, int n)
765 {
766 tb_set_jmp_target(tb, n, (unsigned long)(tb->tc_ptr + tb->tb_next_offset[n]));
767 }
768
769 void tb_phys_invalidate(TranslationBlock *tb, target_ulong page_addr)
770 {
771 CPUState *env;
772 PageDesc *p;
773 unsigned int h, n1;
774 target_phys_addr_t phys_pc;
775 TranslationBlock *tb1, *tb2;
776
777 /* remove the TB from the hash list */
778 phys_pc = tb->page_addr[0] + (tb->pc & ~TARGET_PAGE_MASK);
779 h = tb_phys_hash_func(phys_pc);
780 tb_remove(&tb_phys_hash[h], tb,
781 offsetof(TranslationBlock, phys_hash_next));
782
783 /* remove the TB from the page list */
784 if (tb->page_addr[0] != page_addr) {
785 p = page_find(tb->page_addr[0] >> TARGET_PAGE_BITS);
786 tb_page_remove(&p->first_tb, tb);
787 invalidate_page_bitmap(p);
788 }
789 if (tb->page_addr[1] != -1 && tb->page_addr[1] != page_addr) {
790 p = page_find(tb->page_addr[1] >> TARGET_PAGE_BITS);
791 tb_page_remove(&p->first_tb, tb);
792 invalidate_page_bitmap(p);
793 }
794
795 tb_invalidated_flag = 1;
796
797 /* remove the TB from the hash list */
798 h = tb_jmp_cache_hash_func(tb->pc);
799 for(env = first_cpu; env != NULL; env = env->next_cpu) {
800 if (env->tb_jmp_cache[h] == tb)
801 env->tb_jmp_cache[h] = NULL;
802 }
803
804 /* suppress this TB from the two jump lists */
805 tb_jmp_remove(tb, 0);
806 tb_jmp_remove(tb, 1);
807
808 /* suppress any remaining jumps to this TB */
809 tb1 = tb->jmp_first;
810 for(;;) {
811 n1 = (long)tb1 & 3;
812 if (n1 == 2)
813 break;
814 tb1 = (TranslationBlock *)((long)tb1 & ~3);
815 tb2 = tb1->jmp_next[n1];
816 tb_reset_jump(tb1, n1);
817 tb1->jmp_next[n1] = NULL;
818 tb1 = tb2;
819 }
820 tb->jmp_first = (TranslationBlock *)((long)tb | 2); /* fail safe */
821
822 tb_phys_invalidate_count++;
823 }
824
825 static inline void set_bits(uint8_t *tab, int start, int len)
826 {
827 int end, mask, end1;
828
829 end = start + len;
830 tab += start >> 3;
831 mask = 0xff << (start & 7);
832 if ((start & ~7) == (end & ~7)) {
833 if (start < end) {
834 mask &= ~(0xff << (end & 7));
835 *tab |= mask;
836 }
837 } else {
838 *tab++ |= mask;
839 start = (start + 8) & ~7;
840 end1 = end & ~7;
841 while (start < end1) {
842 *tab++ = 0xff;
843 start += 8;
844 }
845 if (start < end) {
846 mask = ~(0xff << (end & 7));
847 *tab |= mask;
848 }
849 }
850 }
851
852 static void build_page_bitmap(PageDesc *p)
853 {
854 int n, tb_start, tb_end;
855 TranslationBlock *tb;
856
857 p->code_bitmap = qemu_mallocz(TARGET_PAGE_SIZE / 8);
858
859 tb = p->first_tb;
860 while (tb != NULL) {
861 n = (long)tb & 3;
862 tb = (TranslationBlock *)((long)tb & ~3);
863 /* NOTE: this is subtle as a TB may span two physical pages */
864 if (n == 0) {
865 /* NOTE: tb_end may be after the end of the page, but
866 it is not a problem */
867 tb_start = tb->pc & ~TARGET_PAGE_MASK;
868 tb_end = tb_start + tb->size;
869 if (tb_end > TARGET_PAGE_SIZE)
870 tb_end = TARGET_PAGE_SIZE;
871 } else {
872 tb_start = 0;
873 tb_end = ((tb->pc + tb->size) & ~TARGET_PAGE_MASK);
874 }
875 set_bits(p->code_bitmap, tb_start, tb_end - tb_start);
876 tb = tb->page_next[n];
877 }
878 }
879
880 TranslationBlock *tb_gen_code(CPUState *env,
881 target_ulong pc, target_ulong cs_base,
882 int flags, int cflags)
883 {
884 TranslationBlock *tb;
885 uint8_t *tc_ptr;
886 target_ulong phys_pc, phys_page2, virt_page2;
887 int code_gen_size;
888
889 phys_pc = get_phys_addr_code(env, pc);
890 tb = tb_alloc(pc);
891 if (!tb) {
892 /* flush must be done */
893 tb_flush(env);
894 /* cannot fail at this point */
895 tb = tb_alloc(pc);
896 /* Don't forget to invalidate previous TB info. */
897 tb_invalidated_flag = 1;
898 }
899 tc_ptr = code_gen_ptr;
900 tb->tc_ptr = tc_ptr;
901 tb->cs_base = cs_base;
902 tb->flags = flags;
903 tb->cflags = cflags;
904 cpu_gen_code(env, tb, &code_gen_size);
905 code_gen_ptr = (void *)(((unsigned long)code_gen_ptr + code_gen_size + CODE_GEN_ALIGN - 1) & ~(CODE_GEN_ALIGN - 1));
906
907 /* check next page if needed */
908 virt_page2 = (pc + tb->size - 1) & TARGET_PAGE_MASK;
909 phys_page2 = -1;
910 if ((pc & TARGET_PAGE_MASK) != virt_page2) {
911 phys_page2 = get_phys_addr_code(env, virt_page2);
912 }
913 tb_link_phys(tb, phys_pc, phys_page2);
914 return tb;
915 }
916
917 /* invalidate all TBs which intersect with the target physical page
918 starting in range [start;end[. NOTE: start and end must refer to
919 the same physical page. 'is_cpu_write_access' should be true if called
920 from a real cpu write access: the virtual CPU will exit the current
921 TB if code is modified inside this TB. */
922 void tb_invalidate_phys_page_range(target_phys_addr_t start, target_phys_addr_t end,
923 int is_cpu_write_access)
924 {
925 TranslationBlock *tb, *tb_next, *saved_tb;
926 CPUState *env = cpu_single_env;
927 target_ulong tb_start, tb_end;
928 PageDesc *p;
929 int n;
930 #ifdef TARGET_HAS_PRECISE_SMC
931 int current_tb_not_found = is_cpu_write_access;
932 TranslationBlock *current_tb = NULL;
933 int current_tb_modified = 0;
934 target_ulong current_pc = 0;
935 target_ulong current_cs_base = 0;
936 int current_flags = 0;
937 #endif /* TARGET_HAS_PRECISE_SMC */
938
939 p = page_find(start >> TARGET_PAGE_BITS);
940 if (!p)
941 return;
942 if (!p->code_bitmap &&
943 ++p->code_write_count >= SMC_BITMAP_USE_THRESHOLD &&
944 is_cpu_write_access) {
945 /* build code bitmap */
946 build_page_bitmap(p);
947 }
948
949 /* we remove all the TBs in the range [start, end[ */
950 /* XXX: see if in some cases it could be faster to invalidate all the code */
951 tb = p->first_tb;
952 while (tb != NULL) {
953 n = (long)tb & 3;
954 tb = (TranslationBlock *)((long)tb & ~3);
955 tb_next = tb->page_next[n];
956 /* NOTE: this is subtle as a TB may span two physical pages */
957 if (n == 0) {
958 /* NOTE: tb_end may be after the end of the page, but
959 it is not a problem */
960 tb_start = tb->page_addr[0] + (tb->pc & ~TARGET_PAGE_MASK);
961 tb_end = tb_start + tb->size;
962 } else {
963 tb_start = tb->page_addr[1];
964 tb_end = tb_start + ((tb->pc + tb->size) & ~TARGET_PAGE_MASK);
965 }
966 if (!(tb_end <= start || tb_start >= end)) {
967 #ifdef TARGET_HAS_PRECISE_SMC
968 if (current_tb_not_found) {
969 current_tb_not_found = 0;
970 current_tb = NULL;
971 if (env->mem_io_pc) {
972 /* now we have a real cpu fault */
973 current_tb = tb_find_pc(env->mem_io_pc);
974 }
975 }
976 if (current_tb == tb &&
977 (current_tb->cflags & CF_COUNT_MASK) != 1) {
978 /* If we are modifying the current TB, we must stop
979 its execution. We could be more precise by checking
980 that the modification is after the current PC, but it
981 would require a specialized function to partially
982 restore the CPU state */
983
984 current_tb_modified = 1;
985 cpu_restore_state(current_tb, env,
986 env->mem_io_pc, NULL);
987 cpu_get_tb_cpu_state(env, &current_pc, &current_cs_base,
988 &current_flags);
989 }
990 #endif /* TARGET_HAS_PRECISE_SMC */
991 /* we need to do that to handle the case where a signal
992 occurs while doing tb_phys_invalidate() */
993 saved_tb = NULL;
994 if (env) {
995 saved_tb = env->current_tb;
996 env->current_tb = NULL;
997 }
998 tb_phys_invalidate(tb, -1);
999 if (env) {
1000 env->current_tb = saved_tb;
1001 if (env->interrupt_request && env->current_tb)
1002 cpu_interrupt(env, env->interrupt_request);
1003 }
1004 }
1005 tb = tb_next;
1006 }
1007 #if !defined(CONFIG_USER_ONLY)
1008 /* if no code remaining, no need to continue to use slow writes */
1009 if (!p->first_tb) {
1010 invalidate_page_bitmap(p);
1011 if (is_cpu_write_access) {
1012 tlb_unprotect_code_phys(env, start, env->mem_io_vaddr);
1013 }
1014 }
1015 #endif
1016 #ifdef TARGET_HAS_PRECISE_SMC
1017 if (current_tb_modified) {
1018 /* we generate a block containing just the instruction
1019 modifying the memory. It will ensure that it cannot modify
1020 itself */
1021 env->current_tb = NULL;
1022 tb_gen_code(env, current_pc, current_cs_base, current_flags, 1);
1023 cpu_resume_from_signal(env, NULL);
1024 }
1025 #endif
1026 }
1027
1028 /* len must be <= 8 and start must be a multiple of len */
1029 static inline void tb_invalidate_phys_page_fast(target_phys_addr_t start, int len)
1030 {
1031 PageDesc *p;
1032 int offset, b;
1033 #if 0
1034 if (1) {
1035 qemu_log("modifying code at 0x%x size=%d EIP=%x PC=%08x\n",
1036 cpu_single_env->mem_io_vaddr, len,
1037 cpu_single_env->eip,
1038 cpu_single_env->eip + (long)cpu_single_env->segs[R_CS].base);
1039 }
1040 #endif
1041 p = page_find(start >> TARGET_PAGE_BITS);
1042 if (!p)
1043 return;
1044 if (p->code_bitmap) {
1045 offset = start & ~TARGET_PAGE_MASK;
1046 b = p->code_bitmap[offset >> 3] >> (offset & 7);
1047 if (b & ((1 << len) - 1))
1048 goto do_invalidate;
1049 } else {
1050 do_invalidate:
1051 tb_invalidate_phys_page_range(start, start + len, 1);
1052 }
1053 }
1054
1055 #if !defined(CONFIG_SOFTMMU)
1056 static void tb_invalidate_phys_page(target_phys_addr_t addr,
1057 unsigned long pc, void *puc)
1058 {
1059 TranslationBlock *tb;
1060 PageDesc *p;
1061 int n;
1062 #ifdef TARGET_HAS_PRECISE_SMC
1063 TranslationBlock *current_tb = NULL;
1064 CPUState *env = cpu_single_env;
1065 int current_tb_modified = 0;
1066 target_ulong current_pc = 0;
1067 target_ulong current_cs_base = 0;
1068 int current_flags = 0;
1069 #endif
1070
1071 addr &= TARGET_PAGE_MASK;
1072 p = page_find(addr >> TARGET_PAGE_BITS);
1073 if (!p)
1074 return;
1075 tb = p->first_tb;
1076 #ifdef TARGET_HAS_PRECISE_SMC
1077 if (tb && pc != 0) {
1078 current_tb = tb_find_pc(pc);
1079 }
1080 #endif
1081 while (tb != NULL) {
1082 n = (long)tb & 3;
1083 tb = (TranslationBlock *)((long)tb & ~3);
1084 #ifdef TARGET_HAS_PRECISE_SMC
1085 if (current_tb == tb &&
1086 (current_tb->cflags & CF_COUNT_MASK) != 1) {
1087 /* If we are modifying the current TB, we must stop
1088 its execution. We could be more precise by checking
1089 that the modification is after the current PC, but it
1090 would require a specialized function to partially
1091 restore the CPU state */
1092
1093 current_tb_modified = 1;
1094 cpu_restore_state(current_tb, env, pc, puc);
1095 cpu_get_tb_cpu_state(env, &current_pc, &current_cs_base,
1096 &current_flags);
1097 }
1098 #endif /* TARGET_HAS_PRECISE_SMC */
1099 tb_phys_invalidate(tb, addr);
1100 tb = tb->page_next[n];
1101 }
1102 p->first_tb = NULL;
1103 #ifdef TARGET_HAS_PRECISE_SMC
1104 if (current_tb_modified) {
1105 /* we generate a block containing just the instruction
1106 modifying the memory. It will ensure that it cannot modify
1107 itself */
1108 env->current_tb = NULL;
1109 tb_gen_code(env, current_pc, current_cs_base, current_flags, 1);
1110 cpu_resume_from_signal(env, puc);
1111 }
1112 #endif
1113 }
1114 #endif
1115
1116 /* add the tb in the target page and protect it if necessary */
1117 static inline void tb_alloc_page(TranslationBlock *tb,
1118 unsigned int n, target_ulong page_addr)
1119 {
1120 PageDesc *p;
1121 TranslationBlock *last_first_tb;
1122
1123 tb->page_addr[n] = page_addr;
1124 p = page_find_alloc(page_addr >> TARGET_PAGE_BITS);
1125 tb->page_next[n] = p->first_tb;
1126 last_first_tb = p->first_tb;
1127 p->first_tb = (TranslationBlock *)((long)tb | n);
1128 invalidate_page_bitmap(p);
1129
1130 #if defined(TARGET_HAS_SMC) || 1
1131
1132 #if defined(CONFIG_USER_ONLY)
1133 if (p->flags & PAGE_WRITE) {
1134 target_ulong addr;
1135 PageDesc *p2;
1136 int prot;
1137
1138 /* force the host page as non writable (writes will have a
1139 page fault + mprotect overhead) */
1140 page_addr &= qemu_host_page_mask;
1141 prot = 0;
1142 for(addr = page_addr; addr < page_addr + qemu_host_page_size;
1143 addr += TARGET_PAGE_SIZE) {
1144
1145 p2 = page_find (addr >> TARGET_PAGE_BITS);
1146 if (!p2)
1147 continue;
1148 prot |= p2->flags;
1149 p2->flags &= ~PAGE_WRITE;
1150 page_get_flags(addr);
1151 }
1152 mprotect(g2h(page_addr), qemu_host_page_size,
1153 (prot & PAGE_BITS) & ~PAGE_WRITE);
1154 #ifdef DEBUG_TB_INVALIDATE
1155 printf("protecting code page: 0x" TARGET_FMT_lx "\n",
1156 page_addr);
1157 #endif
1158 }
1159 #else
1160 /* if some code is already present, then the pages are already
1161 protected. So we handle the case where only the first TB is
1162 allocated in a physical page */
1163 if (!last_first_tb) {
1164 tlb_protect_code(page_addr);
1165 }
1166 #endif
1167
1168 #endif /* TARGET_HAS_SMC */
1169 }
1170
1171 /* Allocate a new translation block. Flush the translation buffer if
1172 too many translation blocks or too much generated code. */
1173 TranslationBlock *tb_alloc(target_ulong pc)
1174 {
1175 TranslationBlock *tb;
1176
1177 if (nb_tbs >= code_gen_max_blocks ||
1178 (code_gen_ptr - code_gen_buffer) >= code_gen_buffer_max_size)
1179 return NULL;
1180 tb = &tbs[nb_tbs++];
1181 tb->pc = pc;
1182 tb->cflags = 0;
1183 return tb;
1184 }
1185
1186 void tb_free(TranslationBlock *tb)
1187 {
1188 /* In practice this is mostly used for single use temporary TB
1189 Ignore the hard cases and just back up if this TB happens to
1190 be the last one generated. */
1191 if (nb_tbs > 0 && tb == &tbs[nb_tbs - 1]) {
1192 code_gen_ptr = tb->tc_ptr;
1193 nb_tbs--;
1194 }
1195 }
1196
1197 /* add a new TB and link it to the physical page tables. phys_page2 is
1198 (-1) to indicate that only one page contains the TB. */
1199 void tb_link_phys(TranslationBlock *tb,
1200 target_ulong phys_pc, target_ulong phys_page2)
1201 {
1202 unsigned int h;
1203 TranslationBlock **ptb;
1204
1205 /* Grab the mmap lock to stop another thread invalidating this TB
1206 before we are done. */
1207 mmap_lock();
1208 /* add in the physical hash table */
1209 h = tb_phys_hash_func(phys_pc);
1210 ptb = &tb_phys_hash[h];
1211 tb->phys_hash_next = *ptb;
1212 *ptb = tb;
1213
1214 /* add in the page list */
1215 tb_alloc_page(tb, 0, phys_pc & TARGET_PAGE_MASK);
1216 if (phys_page2 != -1)
1217 tb_alloc_page(tb, 1, phys_page2);
1218 else
1219 tb->page_addr[1] = -1;
1220
1221 tb->jmp_first = (TranslationBlock *)((long)tb | 2);
1222 tb->jmp_next[0] = NULL;
1223 tb->jmp_next[1] = NULL;
1224
1225 /* init original jump addresses */
1226 if (tb->tb_next_offset[0] != 0xffff)
1227 tb_reset_jump(tb, 0);
1228 if (tb->tb_next_offset[1] != 0xffff)
1229 tb_reset_jump(tb, 1);
1230
1231 #ifdef DEBUG_TB_CHECK
1232 tb_page_check();
1233 #endif
1234 mmap_unlock();
1235 }
1236
1237 /* find the TB 'tb' such that tb[0].tc_ptr <= tc_ptr <
1238 tb[1].tc_ptr. Return NULL if not found */
1239 TranslationBlock *tb_find_pc(unsigned long tc_ptr)
1240 {
1241 int m_min, m_max, m;
1242 unsigned long v;
1243 TranslationBlock *tb;
1244
1245 if (nb_tbs <= 0)
1246 return NULL;
1247 if (tc_ptr < (unsigned long)code_gen_buffer ||
1248 tc_ptr >= (unsigned long)code_gen_ptr)
1249 return NULL;
1250 /* binary search (cf Knuth) */
1251 m_min = 0;
1252 m_max = nb_tbs - 1;
1253 while (m_min <= m_max) {
1254 m = (m_min + m_max) >> 1;
1255 tb = &tbs[m];
1256 v = (unsigned long)tb->tc_ptr;
1257 if (v == tc_ptr)
1258 return tb;
1259 else if (tc_ptr < v) {
1260 m_max = m - 1;
1261 } else {
1262 m_min = m + 1;
1263 }
1264 }
1265 return &tbs[m_max];
1266 }
1267
1268 static void tb_reset_jump_recursive(TranslationBlock *tb);
1269
1270 static inline void tb_reset_jump_recursive2(TranslationBlock *tb, int n)
1271 {
1272 TranslationBlock *tb1, *tb_next, **ptb;
1273 unsigned int n1;
1274
1275 tb1 = tb->jmp_next[n];
1276 if (tb1 != NULL) {
1277 /* find head of list */
1278 for(;;) {
1279 n1 = (long)tb1 & 3;
1280 tb1 = (TranslationBlock *)((long)tb1 & ~3);
1281 if (n1 == 2)
1282 break;
1283 tb1 = tb1->jmp_next[n1];
1284 }
1285 /* we are now sure now that tb jumps to tb1 */
1286 tb_next = tb1;
1287
1288 /* remove tb from the jmp_first list */
1289 ptb = &tb_next->jmp_first;
1290 for(;;) {
1291 tb1 = *ptb;
1292 n1 = (long)tb1 & 3;
1293 tb1 = (TranslationBlock *)((long)tb1 & ~3);
1294 if (n1 == n && tb1 == tb)
1295 break;
1296 ptb = &tb1->jmp_next[n1];
1297 }
1298 *ptb = tb->jmp_next[n];
1299 tb->jmp_next[n] = NULL;
1300
1301 /* suppress the jump to next tb in generated code */
1302 tb_reset_jump(tb, n);
1303
1304 /* suppress jumps in the tb on which we could have jumped */
1305 tb_reset_jump_recursive(tb_next);
1306 }
1307 }
1308
1309 static void tb_reset_jump_recursive(TranslationBlock *tb)
1310 {
1311 tb_reset_jump_recursive2(tb, 0);
1312 tb_reset_jump_recursive2(tb, 1);
1313 }
1314
1315 #if defined(TARGET_HAS_ICE)
1316 static void breakpoint_invalidate(CPUState *env, target_ulong pc)
1317 {
1318 target_phys_addr_t addr;
1319 target_ulong pd;
1320 ram_addr_t ram_addr;
1321 PhysPageDesc *p;
1322
1323 addr = cpu_get_phys_page_debug(env, pc);
1324 p = phys_page_find(addr >> TARGET_PAGE_BITS);
1325 if (!p) {
1326 pd = IO_MEM_UNASSIGNED;
1327 } else {
1328 pd = p->phys_offset;
1329 }
1330 ram_addr = (pd & TARGET_PAGE_MASK) | (pc & ~TARGET_PAGE_MASK);
1331 tb_invalidate_phys_page_range(ram_addr, ram_addr + 1, 0);
1332 }
1333 #endif
1334
1335 /* Add a watchpoint. */
1336 int cpu_watchpoint_insert(CPUState *env, target_ulong addr, target_ulong len,
1337 int flags, CPUWatchpoint **watchpoint)
1338 {
1339 target_ulong len_mask = ~(len - 1);
1340 CPUWatchpoint *wp;
1341
1342 /* sanity checks: allow power-of-2 lengths, deny unaligned watchpoints */
1343 if ((len != 1 && len != 2 && len != 4 && len != 8) || (addr & ~len_mask)) {
1344 fprintf(stderr, "qemu: tried to set invalid watchpoint at "
1345 TARGET_FMT_lx ", len=" TARGET_FMT_lu "\n", addr, len);
1346 return -EINVAL;
1347 }
1348 wp = qemu_malloc(sizeof(*wp));
1349
1350 wp->vaddr = addr;
1351 wp->len_mask = len_mask;
1352 wp->flags = flags;
1353
1354 /* keep all GDB-injected watchpoints in front */
1355 if (flags & BP_GDB)
1356 TAILQ_INSERT_HEAD(&env->watchpoints, wp, entry);
1357 else
1358 TAILQ_INSERT_TAIL(&env->watchpoints, wp, entry);
1359
1360 tlb_flush_page(env, addr);
1361
1362 if (watchpoint)
1363 *watchpoint = wp;
1364 return 0;
1365 }
1366
1367 /* Remove a specific watchpoint. */
1368 int cpu_watchpoint_remove(CPUState *env, target_ulong addr, target_ulong len,
1369 int flags)
1370 {
1371 target_ulong len_mask = ~(len - 1);
1372 CPUWatchpoint *wp;
1373
1374 TAILQ_FOREACH(wp, &env->watchpoints, entry) {
1375 if (addr == wp->vaddr && len_mask == wp->len_mask
1376 && flags == (wp->flags & ~BP_WATCHPOINT_HIT)) {
1377 cpu_watchpoint_remove_by_ref(env, wp);
1378 return 0;
1379 }
1380 }
1381 return -ENOENT;
1382 }
1383
1384 /* Remove a specific watchpoint by reference. */
1385 void cpu_watchpoint_remove_by_ref(CPUState *env, CPUWatchpoint *watchpoint)
1386 {
1387 TAILQ_REMOVE(&env->watchpoints, watchpoint, entry);
1388
1389 tlb_flush_page(env, watchpoint->vaddr);
1390
1391 qemu_free(watchpoint);
1392 }
1393
1394 /* Remove all matching watchpoints. */
1395 void cpu_watchpoint_remove_all(CPUState *env, int mask)
1396 {
1397 CPUWatchpoint *wp, *next;
1398
1399 TAILQ_FOREACH_SAFE(wp, &env->watchpoints, entry, next) {
1400 if (wp->flags & mask)
1401 cpu_watchpoint_remove_by_ref(env, wp);
1402 }
1403 }
1404
1405 /* Add a breakpoint. */
1406 int cpu_breakpoint_insert(CPUState *env, target_ulong pc, int flags,
1407 CPUBreakpoint **breakpoint)
1408 {
1409 #if defined(TARGET_HAS_ICE)
1410 CPUBreakpoint *bp;
1411
1412 bp = qemu_malloc(sizeof(*bp));
1413
1414 bp->pc = pc;
1415 bp->flags = flags;
1416
1417 /* keep all GDB-injected breakpoints in front */
1418 if (flags & BP_GDB)
1419 TAILQ_INSERT_HEAD(&env->breakpoints, bp, entry);
1420 else
1421 TAILQ_INSERT_TAIL(&env->breakpoints, bp, entry);
1422
1423 breakpoint_invalidate(env, pc);
1424
1425 if (breakpoint)
1426 *breakpoint = bp;
1427 return 0;
1428 #else
1429 return -ENOSYS;
1430 #endif
1431 }
1432
1433 /* Remove a specific breakpoint. */
1434 int cpu_breakpoint_remove(CPUState *env, target_ulong pc, int flags)
1435 {
1436 #if defined(TARGET_HAS_ICE)
1437 CPUBreakpoint *bp;
1438
1439 TAILQ_FOREACH(bp, &env->breakpoints, entry) {
1440 if (bp->pc == pc && bp->flags == flags) {
1441 cpu_breakpoint_remove_by_ref(env, bp);
1442 return 0;
1443 }
1444 }
1445 return -ENOENT;
1446 #else
1447 return -ENOSYS;
1448 #endif
1449 }
1450
1451 /* Remove a specific breakpoint by reference. */
1452 void cpu_breakpoint_remove_by_ref(CPUState *env, CPUBreakpoint *breakpoint)
1453 {
1454 #if defined(TARGET_HAS_ICE)
1455 TAILQ_REMOVE(&env->breakpoints, breakpoint, entry);
1456
1457 breakpoint_invalidate(env, breakpoint->pc);
1458
1459 qemu_free(breakpoint);
1460 #endif
1461 }
1462
1463 /* Remove all matching breakpoints. */
1464 void cpu_breakpoint_remove_all(CPUState *env, int mask)
1465 {
1466 #if defined(TARGET_HAS_ICE)
1467 CPUBreakpoint *bp, *next;
1468
1469 TAILQ_FOREACH_SAFE(bp, &env->breakpoints, entry, next) {
1470 if (bp->flags & mask)
1471 cpu_breakpoint_remove_by_ref(env, bp);
1472 }
1473 #endif
1474 }
1475
1476 /* enable or disable single step mode. EXCP_DEBUG is returned by the
1477 CPU loop after each instruction */
1478 void cpu_single_step(CPUState *env, int enabled)
1479 {
1480 #if defined(TARGET_HAS_ICE)
1481 if (env->singlestep_enabled != enabled) {
1482 env->singlestep_enabled = enabled;
1483 if (kvm_enabled())
1484 kvm_update_guest_debug(env, 0);
1485 else {
1486 /* must flush all the translated code to avoid inconsistancies */
1487 /* XXX: only flush what is necessary */
1488 tb_flush(env);
1489 }
1490 }
1491 #endif
1492 }
1493
1494 /* enable or disable low levels log */
1495 void cpu_set_log(int log_flags)
1496 {
1497 loglevel = log_flags;
1498 if (loglevel && !logfile) {
1499 logfile = fopen(logfilename, log_append ? "a" : "w");
1500 if (!logfile) {
1501 perror(logfilename);
1502 _exit(1);
1503 }
1504 #if !defined(CONFIG_SOFTMMU)
1505 /* must avoid mmap() usage of glibc by setting a buffer "by hand" */
1506 {
1507 static char logfile_buf[4096];
1508 setvbuf(logfile, logfile_buf, _IOLBF, sizeof(logfile_buf));
1509 }
1510 #else
1511 setvbuf(logfile, NULL, _IOLBF, 0);
1512 #endif
1513 log_append = 1;
1514 }
1515 if (!loglevel && logfile) {
1516 fclose(logfile);
1517 logfile = NULL;
1518 }
1519 }
1520
1521 void cpu_set_log_filename(const char *filename)
1522 {
1523 logfilename = strdup(filename);
1524 if (logfile) {
1525 fclose(logfile);
1526 logfile = NULL;
1527 }
1528 cpu_set_log(loglevel);
1529 }
1530
1531 static void cpu_unlink_tb(CPUState *env)
1532 {
1533 #if defined(USE_NPTL)
1534 /* FIXME: TB unchaining isn't SMP safe. For now just ignore the
1535 problem and hope the cpu will stop of its own accord. For userspace
1536 emulation this often isn't actually as bad as it sounds. Often
1537 signals are used primarily to interrupt blocking syscalls. */
1538 #else
1539 TranslationBlock *tb;
1540 static spinlock_t interrupt_lock = SPIN_LOCK_UNLOCKED;
1541
1542 tb = env->current_tb;
1543 /* if the cpu is currently executing code, we must unlink it and
1544 all the potentially executing TB */
1545 if (tb && !testandset(&interrupt_lock)) {
1546 env->current_tb = NULL;
1547 tb_reset_jump_recursive(tb);
1548 resetlock(&interrupt_lock);
1549 }
1550 #endif
1551 }
1552
1553 /* mask must never be zero, except for A20 change call */
1554 void cpu_interrupt(CPUState *env, int mask)
1555 {
1556 int old_mask;
1557
1558 old_mask = env->interrupt_request;
1559 env->interrupt_request |= mask;
1560 if (kvm_enabled() && !qemu_kvm_irqchip_in_kernel())
1561 kvm_update_interrupt_request(env);
1562
1563 if (use_icount) {
1564 env->icount_decr.u16.high = 0xffff;
1565 #ifndef CONFIG_USER_ONLY
1566 if (!can_do_io(env)
1567 && (mask & ~old_mask) != 0) {
1568 cpu_abort(env, "Raised interrupt while not in I/O function");
1569 }
1570 #endif
1571 } else {
1572 cpu_unlink_tb(env);
1573 }
1574 }
1575
1576 void cpu_reset_interrupt(CPUState *env, int mask)
1577 {
1578 env->interrupt_request &= ~mask;
1579 }
1580
1581 void cpu_exit(CPUState *env)
1582 {
1583 env->exit_request = 1;
1584 cpu_unlink_tb(env);
1585 }
1586
1587 const CPULogItem cpu_log_items[] = {
1588 { CPU_LOG_TB_OUT_ASM, "out_asm",
1589 "show generated host assembly code for each compiled TB" },
1590 { CPU_LOG_TB_IN_ASM, "in_asm",
1591 "show target assembly code for each compiled TB" },
1592 { CPU_LOG_TB_OP, "op",
1593 "show micro ops for each compiled TB" },
1594 { CPU_LOG_TB_OP_OPT, "op_opt",
1595 "show micro ops "
1596 #ifdef TARGET_I386
1597 "before eflags optimization and "
1598 #endif
1599 "after liveness analysis" },
1600 { CPU_LOG_INT, "int",
1601 "show interrupts/exceptions in short format" },
1602 { CPU_LOG_EXEC, "exec",
1603 "show trace before each executed TB (lots of logs)" },
1604 { CPU_LOG_TB_CPU, "cpu",
1605 "show CPU state before block translation" },
1606 #ifdef TARGET_I386
1607 { CPU_LOG_PCALL, "pcall",
1608 "show protected mode far calls/returns/exceptions" },
1609 { CPU_LOG_RESET, "cpu_reset",
1610 "show CPU state before CPU resets" },
1611 #endif
1612 #ifdef DEBUG_IOPORT
1613 { CPU_LOG_IOPORT, "ioport",
1614 "show all i/o ports accesses" },
1615 #endif
1616 { 0, NULL, NULL },
1617 };
1618
1619 static int cmp1(const char *s1, int n, const char *s2)
1620 {
1621 if (strlen(s2) != n)
1622 return 0;
1623 return memcmp(s1, s2, n) == 0;
1624 }
1625
1626 /* takes a comma separated list of log masks. Return 0 if error. */
1627 int cpu_str_to_log_mask(const char *str)
1628 {
1629 const CPULogItem *item;
1630 int mask;
1631 const char *p, *p1;
1632
1633 p = str;
1634 mask = 0;
1635 for(;;) {
1636 p1 = strchr(p, ',');
1637 if (!p1)
1638 p1 = p + strlen(p);
1639 if(cmp1(p,p1-p,"all")) {
1640 for(item = cpu_log_items; item->mask != 0; item++) {
1641 mask |= item->mask;
1642 }
1643 } else {
1644 for(item = cpu_log_items; item->mask != 0; item++) {
1645 if (cmp1(p, p1 - p, item->name))
1646 goto found;
1647 }
1648 return 0;
1649 }
1650 found:
1651 mask |= item->mask;
1652 if (*p1 != ',')
1653 break;
1654 p = p1 + 1;
1655 }
1656 return mask;
1657 }
1658
1659 void cpu_abort(CPUState *env, const char *fmt, ...)
1660 {
1661 va_list ap;
1662 va_list ap2;
1663
1664 va_start(ap, fmt);
1665 va_copy(ap2, ap);
1666 fprintf(stderr, "qemu: fatal: ");
1667 vfprintf(stderr, fmt, ap);
1668 fprintf(stderr, "\n");
1669 #ifdef TARGET_I386
1670 cpu_dump_state(env, stderr, fprintf, X86_DUMP_FPU | X86_DUMP_CCOP);
1671 #else
1672 cpu_dump_state(env, stderr, fprintf, 0);
1673 #endif
1674 if (qemu_log_enabled()) {
1675 qemu_log("qemu: fatal: ");
1676 qemu_log_vprintf(fmt, ap2);
1677 qemu_log("\n");
1678 #ifdef TARGET_I386
1679 log_cpu_state(env, X86_DUMP_FPU | X86_DUMP_CCOP);
1680 #else
1681 log_cpu_state(env, 0);
1682 #endif
1683 qemu_log_flush();
1684 qemu_log_close();
1685 }
1686 va_end(ap2);
1687 va_end(ap);
1688 abort();
1689 }
1690
1691 CPUState *cpu_copy(CPUState *env)
1692 {
1693 CPUState *new_env = cpu_init(env->cpu_model_str);
1694 CPUState *next_cpu = new_env->next_cpu;
1695 int cpu_index = new_env->cpu_index;
1696 #if defined(TARGET_HAS_ICE)
1697 CPUBreakpoint *bp;
1698 CPUWatchpoint *wp;
1699 #endif
1700
1701 memcpy(new_env, env, sizeof(CPUState));
1702
1703 /* Preserve chaining and index. */
1704 new_env->next_cpu = next_cpu;
1705 new_env->cpu_index = cpu_index;
1706
1707 /* Clone all break/watchpoints.
1708 Note: Once we support ptrace with hw-debug register access, make sure
1709 BP_CPU break/watchpoints are handled correctly on clone. */
1710 TAILQ_INIT(&env->breakpoints);
1711 TAILQ_INIT(&env->watchpoints);
1712 #if defined(TARGET_HAS_ICE)
1713 TAILQ_FOREACH(bp, &env->breakpoints, entry) {
1714 cpu_breakpoint_insert(new_env, bp->pc, bp->flags, NULL);
1715 }
1716 TAILQ_FOREACH(wp, &env->watchpoints, entry) {
1717 cpu_watchpoint_insert(new_env, wp->vaddr, (~wp->len_mask) + 1,
1718 wp->flags, NULL);
1719 }
1720 #endif
1721
1722 return new_env;
1723 }
1724
1725 #if !defined(CONFIG_USER_ONLY)
1726
1727 static inline void tlb_flush_jmp_cache(CPUState *env, target_ulong addr)
1728 {
1729 unsigned int i;
1730
1731 /* Discard jump cache entries for any tb which might potentially
1732 overlap the flushed page. */
1733 i = tb_jmp_cache_hash_page(addr - TARGET_PAGE_SIZE);
1734 memset (&env->tb_jmp_cache[i], 0,
1735 TB_JMP_PAGE_SIZE * sizeof(TranslationBlock *));
1736
1737 i = tb_jmp_cache_hash_page(addr);
1738 memset (&env->tb_jmp_cache[i], 0,
1739 TB_JMP_PAGE_SIZE * sizeof(TranslationBlock *));
1740 }
1741
1742 /* NOTE: if flush_global is true, also flush global entries (not
1743 implemented yet) */
1744 void tlb_flush(CPUState *env, int flush_global)
1745 {
1746 int i;
1747
1748 #if defined(DEBUG_TLB)
1749 printf("tlb_flush:\n");
1750 #endif
1751 /* must reset current TB so that interrupts cannot modify the
1752 links while we are modifying them */
1753 env->current_tb = NULL;
1754
1755 for(i = 0; i < CPU_TLB_SIZE; i++) {
1756 env->tlb_table[0][i].addr_read = -1;
1757 env->tlb_table[0][i].addr_write = -1;
1758 env->tlb_table[0][i].addr_code = -1;
1759 env->tlb_table[1][i].addr_read = -1;
1760 env->tlb_table[1][i].addr_write = -1;
1761 env->tlb_table[1][i].addr_code = -1;
1762 #if (NB_MMU_MODES >= 3)
1763 env->tlb_table[2][i].addr_read = -1;
1764 env->tlb_table[2][i].addr_write = -1;
1765 env->tlb_table[2][i].addr_code = -1;
1766 #endif
1767 #if (NB_MMU_MODES >= 4)
1768 env->tlb_table[3][i].addr_read = -1;
1769 env->tlb_table[3][i].addr_write = -1;
1770 env->tlb_table[3][i].addr_code = -1;
1771 #endif
1772 #if (NB_MMU_MODES >= 5)
1773 env->tlb_table[4][i].addr_read = -1;
1774 env->tlb_table[4][i].addr_write = -1;
1775 env->tlb_table[4][i].addr_code = -1;
1776 #endif
1777
1778 }
1779
1780 memset (env->tb_jmp_cache, 0, TB_JMP_CACHE_SIZE * sizeof (void *));
1781
1782 #ifdef CONFIG_KQEMU
1783 if (env->kqemu_enabled) {
1784 kqemu_flush(env, flush_global);
1785 }
1786 #endif
1787 tlb_flush_count++;
1788 }
1789
1790 static inline void tlb_flush_entry(CPUTLBEntry *tlb_entry, target_ulong addr)
1791 {
1792 if (addr == (tlb_entry->addr_read &
1793 (TARGET_PAGE_MASK | TLB_INVALID_MASK)) ||
1794 addr == (tlb_entry->addr_write &
1795 (TARGET_PAGE_MASK | TLB_INVALID_MASK)) ||
1796 addr == (tlb_entry->addr_code &
1797 (TARGET_PAGE_MASK | TLB_INVALID_MASK))) {
1798 tlb_entry->addr_read = -1;
1799 tlb_entry->addr_write = -1;
1800 tlb_entry->addr_code = -1;
1801 }
1802 }
1803
1804 void tlb_flush_page(CPUState *env, target_ulong addr)
1805 {
1806 int i;
1807
1808 #if defined(DEBUG_TLB)
1809 printf("tlb_flush_page: " TARGET_FMT_lx "\n", addr);
1810 #endif
1811 /* must reset current TB so that interrupts cannot modify the
1812 links while we are modifying them */
1813 env->current_tb = NULL;
1814
1815 addr &= TARGET_PAGE_MASK;
1816 i = (addr >> TARGET_PAGE_BITS) & (CPU_TLB_SIZE - 1);
1817 tlb_flush_entry(&env->tlb_table[0][i], addr);
1818 tlb_flush_entry(&env->tlb_table[1][i], addr);
1819 #if (NB_MMU_MODES >= 3)
1820 tlb_flush_entry(&env->tlb_table[2][i], addr);
1821 #endif
1822 #if (NB_MMU_MODES >= 4)
1823 tlb_flush_entry(&env->tlb_table[3][i], addr);
1824 #endif
1825 #if (NB_MMU_MODES >= 5)
1826 tlb_flush_entry(&env->tlb_table[4][i], addr);
1827 #endif
1828
1829 tlb_flush_jmp_cache(env, addr);
1830
1831 #ifdef CONFIG_KQEMU
1832 if (env->kqemu_enabled) {
1833 kqemu_flush_page(env, addr);
1834 }
1835 #endif
1836 }
1837
1838 /* update the TLBs so that writes to code in the virtual page 'addr'
1839 can be detected */
1840 static void tlb_protect_code(ram_addr_t ram_addr)
1841 {
1842 cpu_physical_memory_reset_dirty(ram_addr,
1843 ram_addr + TARGET_PAGE_SIZE,
1844 CODE_DIRTY_FLAG);
1845 }
1846
1847 /* update the TLB so that writes in physical page 'phys_addr' are no longer
1848 tested for self modifying code */
1849 static void tlb_unprotect_code_phys(CPUState *env, ram_addr_t ram_addr,
1850 target_ulong vaddr)
1851 {
1852 phys_ram_dirty[ram_addr >> TARGET_PAGE_BITS] |= CODE_DIRTY_FLAG;
1853 }
1854
1855 static inline void tlb_reset_dirty_range(CPUTLBEntry *tlb_entry,
1856 unsigned long start, unsigned long length)
1857 {
1858 unsigned long addr;
1859 if ((tlb_entry->addr_write & ~TARGET_PAGE_MASK) == IO_MEM_RAM) {
1860 addr = (tlb_entry->addr_write & TARGET_PAGE_MASK) + tlb_entry->addend;
1861 if ((addr - start) < length) {
1862 tlb_entry->addr_write = (tlb_entry->addr_write & TARGET_PAGE_MASK) | TLB_NOTDIRTY;
1863 }
1864 }
1865 }
1866
1867 /* Note: start and end must be within the same ram block. */
1868 void cpu_physical_memory_reset_dirty(ram_addr_t start, ram_addr_t end,
1869 int dirty_flags)
1870 {
1871 CPUState *env;
1872 unsigned long length, start1;
1873 int i, mask, len;
1874 uint8_t *p;
1875
1876 start &= TARGET_PAGE_MASK;
1877 end = TARGET_PAGE_ALIGN(end);
1878
1879 length = end - start;
1880 if (length == 0)
1881 return;
1882 len = length >> TARGET_PAGE_BITS;
1883 #ifdef CONFIG_KQEMU
1884 /* XXX: should not depend on cpu context */
1885 env = first_cpu;
1886 if (env->kqemu_enabled) {
1887 ram_addr_t addr;
1888 addr = start;
1889 for(i = 0; i < len; i++) {
1890 kqemu_set_notdirty(env, addr);
1891 addr += TARGET_PAGE_SIZE;
1892 }
1893 }
1894 #endif
1895 mask = ~dirty_flags;
1896 p = phys_ram_dirty + (start >> TARGET_PAGE_BITS);
1897 for(i = 0; i < len; i++)
1898 p[i] &= mask;
1899
1900 /* we modify the TLB cache so that the dirty bit will be set again
1901 when accessing the range */
1902 start1 = (unsigned long)qemu_get_ram_ptr(start);
1903 /* Chek that we don't span multiple blocks - this breaks the
1904 address comparisons below. */
1905 if ((unsigned long)qemu_get_ram_ptr(end - 1) - start1
1906 != (end - 1) - start) {
1907 abort();
1908 }
1909
1910 for(env = first_cpu; env != NULL; env = env->next_cpu) {
1911 for(i = 0; i < CPU_TLB_SIZE; i++)
1912 tlb_reset_dirty_range(&env->tlb_table[0][i], start1, length);
1913 for(i = 0; i < CPU_TLB_SIZE; i++)
1914 tlb_reset_dirty_range(&env->tlb_table[1][i], start1, length);
1915 #if (NB_MMU_MODES >= 3)
1916 for(i = 0; i < CPU_TLB_SIZE; i++)
1917 tlb_reset_dirty_range(&env->tlb_table[2][i], start1, length);
1918 #endif
1919 #if (NB_MMU_MODES >= 4)
1920 for(i = 0; i < CPU_TLB_SIZE; i++)
1921 tlb_reset_dirty_range(&env->tlb_table[3][i], start1, length);
1922 #endif
1923 #if (NB_MMU_MODES >= 5)
1924 for(i = 0; i < CPU_TLB_SIZE; i++)
1925 tlb_reset_dirty_range(&env->tlb_table[4][i], start1, length);
1926 #endif
1927 }
1928 }
1929
1930 int cpu_physical_memory_set_dirty_tracking(int enable)
1931 {
1932 int r=0;
1933
1934 if (kvm_enabled())
1935 r = kvm_physical_memory_set_dirty_tracking(enable);
1936 in_migration = enable;
1937 return r;
1938 }
1939
1940 int cpu_physical_memory_get_dirty_tracking(void)
1941 {
1942 return in_migration;
1943 }
1944
1945 void cpu_physical_sync_dirty_bitmap(target_phys_addr_t start_addr, target_phys_addr_t end_addr)
1946 {
1947 if (kvm_enabled())
1948 kvm_physical_sync_dirty_bitmap(start_addr, end_addr);
1949 }
1950
1951 static inline void tlb_update_dirty(CPUTLBEntry *tlb_entry)
1952 {
1953 ram_addr_t ram_addr;
1954 void *p;
1955
1956 if ((tlb_entry->addr_write & ~TARGET_PAGE_MASK) == IO_MEM_RAM) {
1957 p = (void *)(unsigned long)((tlb_entry->addr_write & TARGET_PAGE_MASK)
1958 + tlb_entry->addend);
1959 ram_addr = qemu_ram_addr_from_host(p);
1960 if (!cpu_physical_memory_is_dirty(ram_addr)) {
1961 tlb_entry->addr_write |= TLB_NOTDIRTY;
1962 }
1963 }
1964 }
1965
1966 /* update the TLB according to the current state of the dirty bits */
1967 void cpu_tlb_update_dirty(CPUState *env)
1968 {
1969 int i;
1970 for(i = 0; i < CPU_TLB_SIZE; i++)
1971 tlb_update_dirty(&env->tlb_table[0][i]);
1972 for(i = 0; i < CPU_TLB_SIZE; i++)
1973 tlb_update_dirty(&env->tlb_table[1][i]);
1974 #if (NB_MMU_MODES >= 3)
1975 for(i = 0; i < CPU_TLB_SIZE; i++)
1976 tlb_update_dirty(&env->tlb_table[2][i]);
1977 #endif
1978 #if (NB_MMU_MODES >= 4)
1979 for(i = 0; i < CPU_TLB_SIZE; i++)
1980 tlb_update_dirty(&env->tlb_table[3][i]);
1981 #endif
1982 #if (NB_MMU_MODES >= 5)
1983 for(i = 0; i < CPU_TLB_SIZE; i++)
1984 tlb_update_dirty(&env->tlb_table[4][i]);
1985 #endif
1986 }
1987
1988 static inline void tlb_set_dirty1(CPUTLBEntry *tlb_entry, target_ulong vaddr)
1989 {
1990 if (tlb_entry->addr_write == (vaddr | TLB_NOTDIRTY))
1991 tlb_entry->addr_write = vaddr;
1992 }
1993
1994 /* update the TLB corresponding to virtual page vaddr
1995 so that it is no longer dirty */
1996 static inline void tlb_set_dirty(CPUState *env, target_ulong vaddr)
1997 {
1998 int i;
1999
2000 vaddr &= TARGET_PAGE_MASK;
2001 i = (vaddr >> TARGET_PAGE_BITS) & (CPU_TLB_SIZE - 1);
2002 tlb_set_dirty1(&env->tlb_table[0][i], vaddr);
2003 tlb_set_dirty1(&env->tlb_table[1][i], vaddr);
2004 #if (NB_MMU_MODES >= 3)
2005 tlb_set_dirty1(&env->tlb_table[2][i], vaddr);
2006 #endif
2007 #if (NB_MMU_MODES >= 4)
2008 tlb_set_dirty1(&env->tlb_table[3][i], vaddr);
2009 #endif
2010 #if (NB_MMU_MODES >= 5)
2011 tlb_set_dirty1(&env->tlb_table[4][i], vaddr);
2012 #endif
2013 }
2014
2015 /* add a new TLB entry. At most one entry for a given virtual address
2016 is permitted. Return 0 if OK or 2 if the page could not be mapped
2017 (can only happen in non SOFTMMU mode for I/O pages or pages
2018 conflicting with the host address space). */
2019 int tlb_set_page_exec(CPUState *env, target_ulong vaddr,
2020 target_phys_addr_t paddr, int prot,
2021 int mmu_idx, int is_softmmu)
2022 {
2023 PhysPageDesc *p;
2024 unsigned long pd;
2025 unsigned int index;
2026 target_ulong address;
2027 target_ulong code_address;
2028 target_phys_addr_t addend;
2029 int ret;
2030 CPUTLBEntry *te;
2031 CPUWatchpoint *wp;
2032 target_phys_addr_t iotlb;
2033
2034 p = phys_page_find(paddr >> TARGET_PAGE_BITS);
2035 if (!p) {
2036 pd = IO_MEM_UNASSIGNED;
2037 } else {
2038 pd = p->phys_offset;
2039 }
2040 #if defined(DEBUG_TLB)
2041 printf("tlb_set_page: vaddr=" TARGET_FMT_lx " paddr=0x%08x prot=%x idx=%d smmu=%d pd=0x%08lx\n",
2042 vaddr, (int)paddr, prot, mmu_idx, is_softmmu, pd);
2043 #endif
2044
2045 ret = 0;
2046 address = vaddr;
2047 if ((pd & ~TARGET_PAGE_MASK) > IO_MEM_ROM && !(pd & IO_MEM_ROMD)) {
2048 /* IO memory case (romd handled later) */
2049 address |= TLB_MMIO;
2050 }
2051 addend = (unsigned long)qemu_get_ram_ptr(pd & TARGET_PAGE_MASK);
2052 if ((pd & ~TARGET_PAGE_MASK) <= IO_MEM_ROM) {
2053 /* Normal RAM. */
2054 iotlb = pd & TARGET_PAGE_MASK;
2055 if ((pd & ~TARGET_PAGE_MASK) == IO_MEM_RAM)
2056 iotlb |= IO_MEM_NOTDIRTY;
2057 else
2058 iotlb |= IO_MEM_ROM;
2059 } else {
2060 /* IO handlers are currently passed a phsical address.
2061 It would be nice to pass an offset from the base address
2062 of that region. This would avoid having to special case RAM,
2063 and avoid full address decoding in every device.
2064 We can't use the high bits of pd for this because
2065 IO_MEM_ROMD uses these as a ram address. */
2066 iotlb = (pd & ~TARGET_PAGE_MASK);
2067 if (p) {
2068 iotlb += p->region_offset;
2069 } else {
2070 iotlb += paddr;
2071 }
2072 }
2073
2074 code_address = address;
2075 /* Make accesses to pages with watchpoints go via the
2076 watchpoint trap routines. */
2077 TAILQ_FOREACH(wp, &env->watchpoints, entry) {
2078 if (vaddr == (wp->vaddr & TARGET_PAGE_MASK)) {
2079 iotlb = io_mem_watch + paddr;
2080 /* TODO: The memory case can be optimized by not trapping
2081 reads of pages with a write breakpoint. */
2082 address |= TLB_MMIO;
2083 }
2084 }
2085
2086 index = (vaddr >> TARGET_PAGE_BITS) & (CPU_TLB_SIZE - 1);
2087 env->iotlb[mmu_idx][index] = iotlb - vaddr;
2088 te = &env->tlb_table[mmu_idx][index];
2089 te->addend = addend - vaddr;
2090 if (prot & PAGE_READ) {
2091 te->addr_read = address;
2092 } else {
2093 te->addr_read = -1;
2094 }
2095
2096 if (prot & PAGE_EXEC) {
2097 te->addr_code = code_address;
2098 } else {
2099 te->addr_code = -1;
2100 }
2101 if (prot & PAGE_WRITE) {
2102 if ((pd & ~TARGET_PAGE_MASK) == IO_MEM_ROM ||
2103 (pd & IO_MEM_ROMD)) {
2104 /* Write access calls the I/O callback. */
2105 te->addr_write = address | TLB_MMIO;
2106 } else if ((pd & ~TARGET_PAGE_MASK) == IO_MEM_RAM &&
2107 !cpu_physical_memory_is_dirty(pd)) {
2108 te->addr_write = address | TLB_NOTDIRTY;
2109 } else {
2110 te->addr_write = address;
2111 }
2112 } else {
2113 te->addr_write = -1;
2114 }
2115 return ret;
2116 }
2117
2118 #else
2119
2120 void tlb_flush(CPUState *env, int flush_global)
2121 {
2122 }
2123
2124 void tlb_flush_page(CPUState *env, target_ulong addr)
2125 {
2126 }
2127
2128 int tlb_set_page_exec(CPUState *env, target_ulong vaddr,
2129 target_phys_addr_t paddr, int prot,
2130 int mmu_idx, int is_softmmu)
2131 {
2132 return 0;
2133 }
2134
2135 /* dump memory mappings */
2136 void page_dump(FILE *f)
2137 {
2138 unsigned long start, end;
2139 int i, j, prot, prot1;
2140 PageDesc *p;
2141
2142 fprintf(f, "%-8s %-8s %-8s %s\n",
2143 "start", "end", "size", "prot");
2144 start = -1;
2145 end = -1;
2146 prot = 0;
2147 for(i = 0; i <= L1_SIZE; i++) {
2148 if (i < L1_SIZE)
2149 p = l1_map[i];
2150 else
2151 p = NULL;
2152 for(j = 0;j < L2_SIZE; j++) {
2153 if (!p)
2154 prot1 = 0;
2155 else
2156 prot1 = p[j].flags;
2157 if (prot1 != prot) {
2158 end = (i << (32 - L1_BITS)) | (j << TARGET_PAGE_BITS);
2159 if (start != -1) {
2160 fprintf(f, "%08lx-%08lx %08lx %c%c%c\n",
2161 start, end, end - start,
2162 prot & PAGE_READ ? 'r' : '-',
2163 prot & PAGE_WRITE ? 'w' : '-',
2164 prot & PAGE_EXEC ? 'x' : '-');
2165 }
2166 if (prot1 != 0)
2167 start = end;
2168 else
2169 start = -1;
2170 prot = prot1;
2171 }
2172 if (!p)
2173 break;
2174 }
2175 }
2176 }
2177
2178 int page_get_flags(target_ulong address)
2179 {
2180 PageDesc *p;
2181
2182 p = page_find(address >> TARGET_PAGE_BITS);
2183 if (!p)
2184 return 0;
2185 return p->flags;
2186 }
2187
2188 /* modify the flags of a page and invalidate the code if
2189 necessary. The flag PAGE_WRITE_ORG is positionned automatically
2190 depending on PAGE_WRITE */
2191 void page_set_flags(target_ulong start, target_ulong end, int flags)
2192 {
2193 PageDesc *p;
2194 target_ulong addr;
2195
2196 /* mmap_lock should already be held. */
2197 start = start & TARGET_PAGE_MASK;
2198 end = TARGET_PAGE_ALIGN(end);
2199 if (flags & PAGE_WRITE)
2200 flags |= PAGE_WRITE_ORG;
2201 for(addr = start; addr < end; addr += TARGET_PAGE_SIZE) {
2202 p = page_find_alloc(addr >> TARGET_PAGE_BITS);
2203 /* We may be called for host regions that are outside guest
2204 address space. */
2205 if (!p)
2206 return;
2207 /* if the write protection is set, then we invalidate the code
2208 inside */
2209 if (!(p->flags & PAGE_WRITE) &&
2210 (flags & PAGE_WRITE) &&
2211 p->first_tb) {
2212 tb_invalidate_phys_page(addr, 0, NULL);
2213 }
2214 p->flags = flags;
2215 }
2216 }
2217
2218 int page_check_range(target_ulong start, target_ulong len, int flags)
2219 {
2220 PageDesc *p;
2221 target_ulong end;
2222 target_ulong addr;
2223
2224 if (start + len < start)
2225 /* we've wrapped around */
2226 return -1;
2227
2228 end = TARGET_PAGE_ALIGN(start+len); /* must do before we loose bits in the next step */
2229 start = start & TARGET_PAGE_MASK;
2230
2231 for(addr = start; addr < end; addr += TARGET_PAGE_SIZE) {
2232 p = page_find(addr >> TARGET_PAGE_BITS);
2233 if( !p )
2234 return -1;
2235 if( !(p->flags & PAGE_VALID) )
2236 return -1;
2237
2238 if ((flags & PAGE_READ) && !(p->flags & PAGE_READ))
2239 return -1;
2240 if (flags & PAGE_WRITE) {
2241 if (!(p->flags & PAGE_WRITE_ORG))
2242 return -1;
2243 /* unprotect the page if it was put read-only because it
2244 contains translated code */
2245 if (!(p->flags & PAGE_WRITE)) {
2246 if (!page_unprotect(addr, 0, NULL))
2247 return -1;
2248 }
2249 return 0;
2250 }
2251 }
2252 return 0;
2253 }
2254
2255 /* called from signal handler: invalidate the code and unprotect the
2256 page. Return TRUE if the fault was succesfully handled. */
2257 int page_unprotect(target_ulong address, unsigned long pc, void *puc)
2258 {
2259 unsigned int page_index, prot, pindex;
2260 PageDesc *p, *p1;
2261 target_ulong host_start, host_end, addr;
2262
2263 /* Technically this isn't safe inside a signal handler. However we
2264 know this only ever happens in a synchronous SEGV handler, so in
2265 practice it seems to be ok. */
2266 mmap_lock();
2267
2268 host_start = address & qemu_host_page_mask;
2269 page_index = host_start >> TARGET_PAGE_BITS;
2270 p1 = page_find(page_index);
2271 if (!p1) {
2272 mmap_unlock();
2273 return 0;
2274 }
2275 host_end = host_start + qemu_host_page_size;
2276 p = p1;
2277 prot = 0;
2278 for(addr = host_start;addr < host_end; addr += TARGET_PAGE_SIZE) {
2279 prot |= p->flags;
2280 p++;
2281 }
2282 /* if the page was really writable, then we change its
2283 protection back to writable */
2284 if (prot & PAGE_WRITE_ORG) {
2285 pindex = (address - host_start) >> TARGET_PAGE_BITS;
2286 if (!(p1[pindex].flags & PAGE_WRITE)) {
2287 mprotect((void *)g2h(host_start), qemu_host_page_size,
2288 (prot & PAGE_BITS) | PAGE_WRITE);
2289 p1[pindex].flags |= PAGE_WRITE;
2290 /* and since the content will be modified, we must invalidate
2291 the corresponding translated code. */
2292 tb_invalidate_phys_page(address, pc, puc);
2293 #ifdef DEBUG_TB_CHECK
2294 tb_invalidate_check(address);
2295 #endif
2296 mmap_unlock();
2297 return 1;
2298 }
2299 }
2300 mmap_unlock();
2301 return 0;
2302 }
2303
2304 static inline void tlb_set_dirty(CPUState *env,
2305 unsigned long addr, target_ulong vaddr)
2306 {
2307 }
2308 #endif /* defined(CONFIG_USER_ONLY) */
2309
2310 #if !defined(CONFIG_USER_ONLY)
2311
2312 static int subpage_register (subpage_t *mmio, uint32_t start, uint32_t end,
2313 ram_addr_t memory, ram_addr_t region_offset);
2314 static void *subpage_init (target_phys_addr_t base, ram_addr_t *phys,
2315 ram_addr_t orig_memory, ram_addr_t region_offset);
2316 #define CHECK_SUBPAGE(addr, start_addr, start_addr2, end_addr, end_addr2, \
2317 need_subpage) \
2318 do { \
2319 if (addr > start_addr) \
2320 start_addr2 = 0; \
2321 else { \
2322 start_addr2 = start_addr & ~TARGET_PAGE_MASK; \
2323 if (start_addr2 > 0) \
2324 need_subpage = 1; \
2325 } \
2326 \
2327 if ((start_addr + orig_size) - addr >= TARGET_PAGE_SIZE) \
2328 end_addr2 = TARGET_PAGE_SIZE - 1; \
2329 else { \
2330 end_addr2 = (start_addr + orig_size - 1) & ~TARGET_PAGE_MASK; \
2331 if (end_addr2 < TARGET_PAGE_SIZE - 1) \
2332 need_subpage = 1; \
2333 } \
2334 } while (0)
2335
2336 /* register physical memory. 'size' must be a multiple of the target
2337 page size. If (phys_offset & ~TARGET_PAGE_MASK) != 0, then it is an
2338 io memory page. The address used when calling the IO function is
2339 the offset from the start of the region, plus region_offset. Both
2340 start_region and regon_offset are rounded down to a page boundary
2341 before calculating this offset. This should not be a problem unless
2342 the low bits of start_addr and region_offset differ. */
2343 void cpu_register_physical_memory_offset(target_phys_addr_t start_addr,
2344 ram_addr_t size,
2345 ram_addr_t phys_offset,
2346 ram_addr_t region_offset)
2347 {
2348 target_phys_addr_t addr, end_addr;
2349 PhysPageDesc *p;
2350 CPUState *env;
2351 ram_addr_t orig_size = size;
2352 void *subpage;
2353
2354 #ifdef CONFIG_KQEMU
2355 /* XXX: should not depend on cpu context */
2356 env = first_cpu;
2357 if (env->kqemu_enabled) {
2358 kqemu_set_phys_mem(start_addr, size, phys_offset);
2359 }
2360 #endif
2361 if (kvm_enabled())
2362 kvm_set_phys_mem(start_addr, size, phys_offset);
2363
2364 if (phys_offset == IO_MEM_UNASSIGNED) {
2365 region_offset = start_addr;
2366 }
2367 region_offset &= TARGET_PAGE_MASK;
2368 size = (size + TARGET_PAGE_SIZE - 1) & TARGET_PAGE_MASK;
2369 end_addr = start_addr + (target_phys_addr_t)size;
2370 for(addr = start_addr; addr != end_addr; addr += TARGET_PAGE_SIZE) {
2371 p = phys_page_find(addr >> TARGET_PAGE_BITS);
2372 if (p && p->phys_offset != IO_MEM_UNASSIGNED) {
2373 ram_addr_t orig_memory = p->phys_offset;
2374 target_phys_addr_t start_addr2, end_addr2;
2375 int need_subpage = 0;
2376
2377 CHECK_SUBPAGE(addr, start_addr, start_addr2, end_addr, end_addr2,
2378 need_subpage);
2379 if (need_subpage || phys_offset & IO_MEM_SUBWIDTH) {
2380 if (!(orig_memory & IO_MEM_SUBPAGE)) {
2381 subpage = subpage_init((addr & TARGET_PAGE_MASK),
2382 &p->phys_offset, orig_memory,
2383 p->region_offset);
2384 } else {
2385 subpage = io_mem_opaque[(orig_memory & ~TARGET_PAGE_MASK)
2386 >> IO_MEM_SHIFT];
2387 }
2388 subpage_register(subpage, start_addr2, end_addr2, phys_offset,
2389 region_offset);
2390 p->region_offset = 0;
2391 } else {
2392 p->phys_offset = phys_offset;
2393 if ((phys_offset & ~TARGET_PAGE_MASK) <= IO_MEM_ROM ||
2394 (phys_offset & IO_MEM_ROMD))
2395 phys_offset += TARGET_PAGE_SIZE;
2396 }
2397 } else {
2398 p = phys_page_find_alloc(addr >> TARGET_PAGE_BITS, 1);
2399 p->phys_offset = phys_offset;
2400 p->region_offset = region_offset;
2401 if ((phys_offset & ~TARGET_PAGE_MASK) <= IO_MEM_ROM ||
2402 (phys_offset & IO_MEM_ROMD)) {
2403 phys_offset += TARGET_PAGE_SIZE;
2404 } else {
2405 target_phys_addr_t start_addr2, end_addr2;
2406 int need_subpage = 0;
2407
2408 CHECK_SUBPAGE(addr, start_addr, start_addr2, end_addr,
2409 end_addr2, need_subpage);
2410
2411 if (need_subpage || phys_offset & IO_MEM_SUBWIDTH) {
2412 subpage = subpage_init((addr & TARGET_PAGE_MASK),
2413 &p->phys_offset, IO_MEM_UNASSIGNED,
2414 addr & TARGET_PAGE_MASK);
2415 subpage_register(subpage, start_addr2, end_addr2,
2416 phys_offset, region_offset);
2417 p->region_offset = 0;
2418 }
2419 }
2420 }
2421 region_offset += TARGET_PAGE_SIZE;
2422 }
2423
2424 /* since each CPU stores ram addresses in its TLB cache, we must
2425 reset the modified entries */
2426 /* XXX: slow ! */
2427 for(env = first_cpu; env != NULL; env = env->next_cpu) {
2428 tlb_flush(env, 1);
2429 }
2430 }
2431
2432 /* XXX: temporary until new memory mapping API */
2433 ram_addr_t cpu_get_physical_page_desc(target_phys_addr_t addr)
2434 {
2435 PhysPageDesc *p;
2436
2437 p = phys_page_find(addr >> TARGET_PAGE_BITS);
2438 if (!p)
2439 return IO_MEM_UNASSIGNED;
2440 return p->phys_offset;
2441 }
2442
2443 void qemu_register_coalesced_mmio(target_phys_addr_t addr, ram_addr_t size)
2444 {
2445 if (kvm_enabled())
2446 kvm_coalesce_mmio_region(addr, size);
2447 }
2448
2449 void qemu_unregister_coalesced_mmio(target_phys_addr_t addr, ram_addr_t size)
2450 {
2451 if (kvm_enabled())
2452 kvm_uncoalesce_mmio_region(addr, size);
2453 }
2454
2455 #ifdef CONFIG_KQEMU
2456 /* XXX: better than nothing */
2457 static ram_addr_t kqemu_ram_alloc(ram_addr_t size)
2458 {
2459 ram_addr_t addr;
2460 if ((last_ram_offset + size) > kqemu_phys_ram_size) {
2461 fprintf(stderr, "Not enough memory (requested_size = %" PRIu64 ", max memory = %" PRIu64 ")\n",
2462 (uint64_t)size, (uint64_t)kqemu_phys_ram_size);
2463 abort();
2464 }
2465 addr = last_ram_offset;
2466 last_ram_offset = TARGET_PAGE_ALIGN(last_ram_offset + size);
2467 return addr;
2468 }
2469 #endif
2470
2471 ram_addr_t qemu_ram_alloc(ram_addr_t size)
2472 {
2473 RAMBlock *new_block;
2474
2475 #ifdef CONFIG_KQEMU
2476 if (kqemu_phys_ram_base) {
2477 return kqemu_ram_alloc(size);
2478 }
2479 #endif
2480
2481 size = TARGET_PAGE_ALIGN(size);
2482 new_block = qemu_malloc(sizeof(*new_block));
2483
2484 new_block->host = qemu_vmalloc(size);
2485 new_block->offset = last_ram_offset;
2486 new_block->length = size;
2487
2488 new_block->next = ram_blocks;
2489 ram_blocks = new_block;
2490
2491 phys_ram_dirty = qemu_realloc(phys_ram_dirty,
2492 (last_ram_offset + size) >> TARGET_PAGE_BITS);
2493 memset(phys_ram_dirty + (last_ram_offset >> TARGET_PAGE_BITS),
2494 0xff, size >> TARGET_PAGE_BITS);
2495
2496 last_ram_offset += size;
2497
2498 return new_block->offset;
2499 }
2500
2501 void qemu_ram_free(ram_addr_t addr)
2502 {
2503 /* TODO: implement this. */
2504 }
2505
2506 /* Return a host pointer to ram allocated with qemu_ram_alloc.
2507 With the exception of the softmmu code in this file, this should
2508 only be used for local memory (e.g. video ram) that the device owns,
2509 and knows it isn't going to access beyond the end of the block.
2510
2511 It should not be used for general purpose DMA.
2512 Use cpu_physical_memory_map/cpu_physical_memory_rw instead.
2513 */
2514 void *qemu_get_ram_ptr(ram_addr_t addr)
2515 {
2516 RAMBlock *prev;
2517 RAMBlock **prevp;
2518 RAMBlock *block;
2519
2520 #ifdef CONFIG_KQEMU
2521 if (kqemu_phys_ram_base) {
2522 return kqemu_phys_ram_base + addr;
2523 }
2524 #endif
2525
2526 prev = NULL;
2527 prevp = &ram_blocks;
2528 block = ram_blocks;
2529 while (block && (block->offset > addr
2530 || block->offset + block->length <= addr)) {
2531 if (prev)
2532 prevp = &prev->next;
2533 prev = block;
2534 block = block->next;
2535 }
2536 if (!block) {
2537 fprintf(stderr, "Bad ram offset %" PRIx64 "\n", (uint64_t)addr);
2538 abort();
2539 }
2540 /* Move this entry to to start of the list. */
2541 if (prev) {
2542 prev->next = block->next;
2543 block->next = *prevp;
2544 *prevp = block;
2545 }
2546 return block->host + (addr - block->offset);
2547 }
2548
2549 /* Some of the softmmu routines need to translate from a host pointer
2550 (typically a TLB entry) back to a ram offset. */
2551 ram_addr_t qemu_ram_addr_from_host(void *ptr)
2552 {
2553 RAMBlock *prev;
2554 RAMBlock **prevp;
2555 RAMBlock *block;
2556 uint8_t *host = ptr;
2557
2558 #ifdef CONFIG_KQEMU
2559 if (kqemu_phys_ram_base) {
2560 return host - kqemu_phys_ram_base;
2561 }
2562 #endif
2563
2564 prev = NULL;
2565 prevp = &ram_blocks;
2566 block = ram_blocks;
2567 while (block && (block->host > host
2568 || block->host + block->length <= host)) {
2569 if (prev)
2570 prevp = &prev->next;
2571 prev = block;
2572 block = block->next;
2573 }
2574 if (!block) {
2575 fprintf(stderr, "Bad ram pointer %p\n", ptr);
2576 abort();
2577 }
2578 return block->offset + (host - block->host);
2579 }
2580
2581 static uint32_t unassigned_mem_readb(void *opaque, target_phys_addr_t addr)
2582 {
2583 #ifdef DEBUG_UNASSIGNED
2584 printf("Unassigned mem read " TARGET_FMT_plx "\n", addr);
2585 #endif
2586 #if defined(TARGET_SPARC)
2587 do_unassigned_access(addr, 0, 0, 0, 1);
2588 #endif
2589 return 0;
2590 }
2591
2592 static uint32_t unassigned_mem_readw(void *opaque, target_phys_addr_t addr)
2593 {
2594 #ifdef DEBUG_UNASSIGNED
2595 printf("Unassigned mem read " TARGET_FMT_plx "\n", addr);
2596 #endif
2597 #if defined(TARGET_SPARC)
2598 do_unassigned_access(addr, 0, 0, 0, 2);
2599 #endif
2600 return 0;
2601 }
2602
2603 static uint32_t unassigned_mem_readl(void *opaque, target_phys_addr_t addr)
2604 {
2605 #ifdef DEBUG_UNASSIGNED
2606 printf("Unassigned mem read " TARGET_FMT_plx "\n", addr);
2607 #endif
2608 #if defined(TARGET_SPARC)
2609 do_unassigned_access(addr, 0, 0, 0, 4);
2610 #endif
2611 return 0;
2612 }
2613
2614 static void unassigned_mem_writeb(void *opaque, target_phys_addr_t addr, uint32_t val)
2615 {
2616 #ifdef DEBUG_UNASSIGNED
2617 printf("Unassigned mem write " TARGET_FMT_plx " = 0x%x\n", addr, val);
2618 #endif
2619 #if defined(TARGET_SPARC)
2620 do_unassigned_access(addr, 1, 0, 0, 1);
2621 #endif
2622 }
2623
2624 static void unassigned_mem_writew(void *opaque, target_phys_addr_t addr, uint32_t val)
2625 {
2626 #ifdef DEBUG_UNASSIGNED
2627 printf("Unassigned mem write " TARGET_FMT_plx " = 0x%x\n", addr, val);
2628 #endif
2629 #if defined(TARGET_SPARC)
2630 do_unassigned_access(addr, 1, 0, 0, 2);
2631 #endif
2632 }
2633
2634 static void unassigned_mem_writel(void *opaque, target_phys_addr_t addr, uint32_t val)
2635 {
2636 #ifdef DEBUG_UNASSIGNED
2637 printf("Unassigned mem write " TARGET_FMT_plx " = 0x%x\n", addr, val);
2638 #endif
2639 #if defined(TARGET_SPARC)
2640 do_unassigned_access(addr, 1, 0, 0, 4);
2641 #endif
2642 }
2643
2644 static CPUReadMemoryFunc *unassigned_mem_read[3] = {
2645 unassigned_mem_readb,
2646 unassigned_mem_readw,
2647 unassigned_mem_readl,
2648 };
2649
2650 static CPUWriteMemoryFunc *unassigned_mem_write[3] = {
2651 unassigned_mem_writeb,
2652 unassigned_mem_writew,
2653 unassigned_mem_writel,
2654 };
2655
2656 static void notdirty_mem_writeb(void *opaque, target_phys_addr_t ram_addr,
2657 uint32_t val)
2658 {
2659 int dirty_flags;
2660 dirty_flags = phys_ram_dirty[ram_addr >> TARGET_PAGE_BITS];
2661 if (!(dirty_flags & CODE_DIRTY_FLAG)) {
2662 #if !defined(CONFIG_USER_ONLY)
2663 tb_invalidate_phys_page_fast(ram_addr, 1);
2664 dirty_flags = phys_ram_dirty[ram_addr >> TARGET_PAGE_BITS];
2665 #endif
2666 }
2667 stb_p(qemu_get_ram_ptr(ram_addr), val);
2668 #ifdef CONFIG_KQEMU
2669 if (cpu_single_env->kqemu_enabled &&
2670 (dirty_flags & KQEMU_MODIFY_PAGE_MASK) != KQEMU_MODIFY_PAGE_MASK)
2671 kqemu_modify_page(cpu_single_env, ram_addr);
2672 #endif
2673 dirty_flags |= (0xff & ~CODE_DIRTY_FLAG);
2674 phys_ram_dirty[ram_addr >> TARGET_PAGE_BITS] = dirty_flags;
2675 /* we remove the notdirty callback only if the code has been
2676 flushed */
2677 if (dirty_flags == 0xff)
2678 tlb_set_dirty(cpu_single_env, cpu_single_env->mem_io_vaddr);
2679 }
2680
2681 static void notdirty_mem_writew(void *opaque, target_phys_addr_t ram_addr,
2682 uint32_t val)
2683 {
2684 int dirty_flags;
2685 dirty_flags = phys_ram_dirty[ram_addr >> TARGET_PAGE_BITS];
2686 if (!(dirty_flags & CODE_DIRTY_FLAG)) {
2687 #if !defined(CONFIG_USER_ONLY)
2688 tb_invalidate_phys_page_fast(ram_addr, 2);
2689 dirty_flags = phys_ram_dirty[ram_addr >> TARGET_PAGE_BITS];
2690 #endif
2691 }
2692 stw_p(qemu_get_ram_ptr(ram_addr), val);
2693 #ifdef CONFIG_KQEMU
2694 if (cpu_single_env->kqemu_enabled &&
2695 (dirty_flags & KQEMU_MODIFY_PAGE_MASK) != KQEMU_MODIFY_PAGE_MASK)
2696 kqemu_modify_page(cpu_single_env, ram_addr);
2697 #endif
2698 dirty_flags |= (0xff & ~CODE_DIRTY_FLAG);
2699 phys_ram_dirty[ram_addr >> TARGET_PAGE_BITS] = dirty_flags;
2700 /* we remove the notdirty callback only if the code has been
2701 flushed */
2702 if (dirty_flags == 0xff)
2703 tlb_set_dirty(cpu_single_env, cpu_single_env->mem_io_vaddr);
2704 }
2705
2706 static void notdirty_mem_writel(void *opaque, target_phys_addr_t ram_addr,
2707 uint32_t val)
2708 {
2709 int dirty_flags;
2710 dirty_flags = phys_ram_dirty[ram_addr >> TARGET_PAGE_BITS];
2711 if (!(dirty_flags & CODE_DIRTY_FLAG)) {
2712 #if !defined(CONFIG_USER_ONLY)
2713 tb_invalidate_phys_page_fast(ram_addr, 4);
2714 dirty_flags = phys_ram_dirty[ram_addr >> TARGET_PAGE_BITS];
2715 #endif
2716 }
2717 stl_p(qemu_get_ram_ptr(ram_addr), val);
2718 #ifdef CONFIG_KQEMU
2719 if (cpu_single_env->kqemu_enabled &&
2720 (dirty_flags & KQEMU_MODIFY_PAGE_MASK) != KQEMU_MODIFY_PAGE_MASK)
2721 kqemu_modify_page(cpu_single_env, ram_addr);
2722 #endif
2723 dirty_flags |= (0xff & ~CODE_DIRTY_FLAG);
2724 phys_ram_dirty[ram_addr >> TARGET_PAGE_BITS] = dirty_flags;
2725 /* we remove the notdirty callback only if the code has been
2726 flushed */
2727 if (dirty_flags == 0xff)
2728 tlb_set_dirty(cpu_single_env, cpu_single_env->mem_io_vaddr);
2729 }
2730
2731 static CPUReadMemoryFunc *error_mem_read[3] = {
2732 NULL, /* never used */
2733 NULL, /* never used */
2734 NULL, /* never used */
2735 };
2736
2737 static CPUWriteMemoryFunc *notdirty_mem_write[3] = {
2738 notdirty_mem_writeb,
2739 notdirty_mem_writew,
2740 notdirty_mem_writel,
2741 };
2742
2743 /* Generate a debug exception if a watchpoint has been hit. */
2744 static void check_watchpoint(int offset, int len_mask, int flags)
2745 {
2746 CPUState *env = cpu_single_env;
2747 target_ulong pc, cs_base;
2748 TranslationBlock *tb;
2749 target_ulong vaddr;
2750 CPUWatchpoint *wp;
2751 int cpu_flags;
2752
2753 if (env->watchpoint_hit) {
2754 /* We re-entered the check after replacing the TB. Now raise
2755 * the debug interrupt so that is will trigger after the
2756 * current instruction. */
2757 cpu_interrupt(env, CPU_INTERRUPT_DEBUG);
2758 return;
2759 }
2760 vaddr = (env->mem_io_vaddr & TARGET_PAGE_MASK) + offset;
2761 TAILQ_FOREACH(wp, &env->watchpoints, entry) {
2762 if ((vaddr == (wp->vaddr & len_mask) ||
2763 (vaddr & wp->len_mask) == wp->vaddr) && (wp->flags & flags)) {
2764 wp->flags |= BP_WATCHPOINT_HIT;
2765 if (!env->watchpoint_hit) {
2766 env->watchpoint_hit = wp;
2767 tb = tb_find_pc(env->mem_io_pc);
2768 if (!tb) {
2769 cpu_abort(env, "check_watchpoint: could not find TB for "
2770 "pc=%p", (void *)env->mem_io_pc);
2771 }
2772 cpu_restore_state(tb, env, env->mem_io_pc, NULL);
2773 tb_phys_invalidate(tb, -1);
2774 if (wp->flags & BP_STOP_BEFORE_ACCESS) {
2775 env->exception_index = EXCP_DEBUG;
2776 } else {
2777 cpu_get_tb_cpu_state(env, &pc, &cs_base, &cpu_flags);
2778 tb_gen_code(env, pc, cs_base, cpu_flags, 1);
2779 }
2780 cpu_resume_from_signal(env, NULL);
2781 }
2782 } else {
2783 wp->flags &= ~BP_WATCHPOINT_HIT;
2784 }
2785 }
2786 }
2787
2788 /* Watchpoint access routines. Watchpoints are inserted using TLB tricks,
2789 so these check for a hit then pass through to the normal out-of-line
2790 phys routines. */
2791 static uint32_t watch_mem_readb(void *opaque, target_phys_addr_t addr)
2792 {
2793 check_watchpoint(addr & ~TARGET_PAGE_MASK, ~0x0, BP_MEM_READ);
2794 return ldub_phys(addr);
2795 }
2796
2797 static uint32_t watch_mem_readw(void *opaque, target_phys_addr_t addr)
2798 {
2799 check_watchpoint(addr & ~TARGET_PAGE_MASK, ~0x1, BP_MEM_READ);
2800 return lduw_phys(addr);
2801 }
2802
2803 static uint32_t watch_mem_readl(void *opaque, target_phys_addr_t addr)
2804 {
2805 check_watchpoint(addr & ~TARGET_PAGE_MASK, ~0x3, BP_MEM_READ);
2806 return ldl_phys(addr);
2807 }
2808
2809 static void watch_mem_writeb(void *opaque, target_phys_addr_t addr,
2810 uint32_t val)
2811 {
2812 check_watchpoint(addr & ~TARGET_PAGE_MASK, ~0x0, BP_MEM_WRITE);
2813 stb_phys(addr, val);
2814 }
2815
2816 static void watch_mem_writew(void *opaque, target_phys_addr_t addr,
2817 uint32_t val)
2818 {
2819 check_watchpoint(addr & ~TARGET_PAGE_MASK, ~0x1, BP_MEM_WRITE);
2820 stw_phys(addr, val);
2821 }
2822
2823 static void watch_mem_writel(void *opaque, target_phys_addr_t addr,
2824 uint32_t val)
2825 {
2826 check_watchpoint(addr & ~TARGET_PAGE_MASK, ~0x3, BP_MEM_WRITE);
2827 stl_phys(addr, val);
2828 }
2829
2830 static CPUReadMemoryFunc *watch_mem_read[3] = {
2831 watch_mem_readb,
2832 watch_mem_readw,
2833 watch_mem_readl,
2834 };
2835
2836 static CPUWriteMemoryFunc *watch_mem_write[3] = {
2837 watch_mem_writeb,
2838 watch_mem_writew,
2839 watch_mem_writel,
2840 };
2841
2842 static inline uint32_t subpage_readlen (subpage_t *mmio, target_phys_addr_t addr,
2843 unsigned int len)
2844 {
2845 uint32_t ret;
2846 unsigned int idx;
2847
2848 idx = SUBPAGE_IDX(addr);
2849 #if defined(DEBUG_SUBPAGE)
2850 printf("%s: subpage %p len %d addr " TARGET_FMT_plx " idx %d\n", __func__,
2851 mmio, len, addr, idx);
2852 #endif
2853 ret = (**mmio->mem_read[idx][len])(mmio->opaque[idx][0][len],
2854 addr + mmio->region_offset[idx][0][len]);
2855
2856 return ret;
2857 }
2858
2859 static inline void subpage_writelen (subpage_t *mmio, target_phys_addr_t addr,
2860 uint32_t value, unsigned int len)
2861 {
2862 unsigned int idx;
2863
2864 idx = SUBPAGE_IDX(addr);
2865 #if defined(DEBUG_SUBPAGE)
2866 printf("%s: subpage %p len %d addr " TARGET_FMT_plx " idx %d value %08x\n", __func__,
2867 mmio, len, addr, idx, value);
2868 #endif
2869 (**mmio->mem_write[idx][len])(mmio->opaque[idx][1][len],
2870 addr + mmio->region_offset[idx][1][len],
2871 value);
2872 }
2873
2874 static uint32_t subpage_readb (void *opaque, target_phys_addr_t addr)
2875 {
2876 #if defined(DEBUG_SUBPAGE)
2877 printf("%s: addr " TARGET_FMT_plx "\n", __func__, addr);
2878 #endif
2879
2880 return subpage_readlen(opaque, addr, 0);
2881 }
2882
2883 static void subpage_writeb (void *opaque, target_phys_addr_t addr,
2884 uint32_t value)
2885 {
2886 #if defined(DEBUG_SUBPAGE)
2887 printf("%s: addr " TARGET_FMT_plx " val %08x\n", __func__, addr, value);
2888 #endif
2889 subpage_writelen(opaque, addr, value, 0);
2890 }
2891
2892 static uint32_t subpage_readw (void *opaque, target_phys_addr_t addr)
2893 {
2894 #if defined(DEBUG_SUBPAGE)
2895 printf("%s: addr " TARGET_FMT_plx "\n", __func__, addr);
2896 #endif
2897
2898 return subpage_readlen(opaque, addr, 1);
2899 }
2900
2901 static void subpage_writew (void *opaque, target_phys_addr_t addr,
2902 uint32_t value)
2903 {
2904 #if defined(DEBUG_SUBPAGE)
2905 printf("%s: addr " TARGET_FMT_plx " val %08x\n", __func__, addr, value);
2906 #endif
2907 subpage_writelen(opaque, addr, value, 1);
2908 }
2909
2910 static uint32_t subpage_readl (void *opaque, target_phys_addr_t addr)
2911 {
2912 #if defined(DEBUG_SUBPAGE)
2913 printf("%s: addr " TARGET_FMT_plx "\n", __func__, addr);
2914 #endif
2915
2916 return subpage_readlen(opaque, addr, 2);
2917 }
2918
2919 static void subpage_writel (void *opaque,
2920 target_phys_addr_t addr, uint32_t value)
2921 {
2922 #if defined(DEBUG_SUBPAGE)
2923 printf("%s: addr " TARGET_FMT_plx " val %08x\n", __func__, addr, value);
2924 #endif
2925 subpage_writelen(opaque, addr, value, 2);
2926 }
2927
2928 static CPUReadMemoryFunc *subpage_read[] = {
2929 &subpage_readb,
2930 &subpage_readw,
2931 &subpage_readl,
2932 };
2933
2934 static CPUWriteMemoryFunc *subpage_write[] = {
2935 &subpage_writeb,
2936 &subpage_writew,
2937 &subpage_writel,
2938 };
2939
2940 static int subpage_register (subpage_t *mmio, uint32_t start, uint32_t end,
2941 ram_addr_t memory, ram_addr_t region_offset)
2942 {
2943 int idx, eidx;
2944 unsigned int i;
2945
2946 if (start >= TARGET_PAGE_SIZE || end >= TARGET_PAGE_SIZE)
2947 return -1;
2948 idx = SUBPAGE_IDX(start);
2949 eidx = SUBPAGE_IDX(end);
2950 #if defined(DEBUG_SUBPAGE)
2951 printf("%s: %p start %08x end %08x idx %08x eidx %08x mem %d\n", __func__,
2952 mmio, start, end, idx, eidx, memory);
2953 #endif
2954 memory >>= IO_MEM_SHIFT;
2955 for (; idx <= eidx; idx++) {
2956 for (i = 0; i < 4; i++) {
2957 if (io_mem_read[memory][i]) {
2958 mmio->mem_read[idx][i] = &io_mem_read[memory][i];
2959 mmio->opaque[idx][0][i] = io_mem_opaque[memory];
2960 mmio->region_offset[idx][0][i] = region_offset;
2961 }
2962 if (io_mem_write[memory][i]) {
2963 mmio->mem_write[idx][i] = &io_mem_write[memory][i];
2964 mmio->opaque[idx][1][i] = io_mem_opaque[memory];
2965 mmio->region_offset[idx][1][i] = region_offset;
2966 }
2967 }
2968 }
2969
2970 return 0;
2971 }
2972
2973 static void *subpage_init (target_phys_addr_t base, ram_addr_t *phys,
2974 ram_addr_t orig_memory, ram_addr_t region_offset)
2975 {
2976 subpage_t *mmio;
2977 int subpage_memory;
2978
2979 mmio = qemu_mallocz(sizeof(subpage_t));
2980
2981 mmio->base = base;
2982 subpage_memory = cpu_register_io_memory(0, subpage_read, subpage_write, mmio);
2983 #if defined(DEBUG_SUBPAGE)
2984 printf("%s: %p base " TARGET_FMT_plx " len %08x %d\n", __func__,
2985 mmio, base, TARGET_PAGE_SIZE, subpage_memory);
2986 #endif
2987 *phys = subpage_memory | IO_MEM_SUBPAGE;
2988 subpage_register(mmio, 0, TARGET_PAGE_SIZE - 1, orig_memory,
2989 region_offset);
2990
2991 return mmio;
2992 }
2993
2994 static int get_free_io_mem_idx(void)
2995 {
2996 int i;
2997
2998 for (i = 0; i<IO_MEM_NB_ENTRIES; i++)
2999 if (!io_mem_used[i]) {
3000 io_mem_used[i] = 1;
3001 return i;
3002 }
3003
3004 return -1;
3005 }
3006
3007 static void io_mem_init(void)
3008 {
3009 int i;
3010
3011 cpu_register_io_memory(IO_MEM_ROM >> IO_MEM_SHIFT, error_mem_read, unassigned_mem_write, NULL);
3012 cpu_register_io_memory(IO_MEM_UNASSIGNED >> IO_MEM_SHIFT, unassigned_mem_read, unassigned_mem_write, NULL);
3013 cpu_register_io_memory(IO_MEM_NOTDIRTY >> IO_MEM_SHIFT, error_mem_read, notdirty_mem_write, NULL);
3014 for (i=0; i<5; i++)
3015 io_mem_used[i] = 1;
3016
3017 io_mem_watch = cpu_register_io_memory(0, watch_mem_read,
3018 watch_mem_write, NULL);
3019 #ifdef CONFIG_KQEMU
3020 if (kqemu_phys_ram_base) {
3021 /* alloc dirty bits array */
3022 phys_ram_dirty = qemu_vmalloc(kqemu_phys_ram_size >> TARGET_PAGE_BITS);
3023 memset(phys_ram_dirty, 0xff, kqemu_phys_ram_size >> TARGET_PAGE_BITS);
3024 }
3025 #endif
3026 }
3027
3028 /* mem_read and mem_write are arrays of functions containing the
3029 function to access byte (index 0), word (index 1) and dword (index
3030 2). Functions can be omitted with a NULL function pointer. The
3031 registered functions may be modified dynamically later.
3032 If io_index is non zero, the corresponding io zone is
3033 modified. If it is zero, a new io zone is allocated. The return
3034 value can be used with cpu_register_physical_memory(). (-1) is
3035 returned if error. */
3036 int cpu_register_io_memory(int io_index,
3037 CPUReadMemoryFunc **mem_read,
3038 CPUWriteMemoryFunc **mem_write,
3039 void *opaque)
3040 {
3041 int i, subwidth = 0;
3042
3043 if (io_index <= 0) {
3044 io_index = get_free_io_mem_idx();
3045 if (io_index == -1)
3046 return io_index;
3047 } else {
3048 if (io_index >= IO_MEM_NB_ENTRIES)
3049 return -1;
3050 }
3051
3052 for(i = 0;i < 3; i++) {
3053 if (!mem_read[i] || !mem_write[i])
3054 subwidth = IO_MEM_SUBWIDTH;
3055 io_mem_read[io_index][i] = mem_read[i];
3056 io_mem_write[io_index][i] = mem_write[i];
3057 }
3058 io_mem_opaque[io_index] = opaque;
3059 return (io_index << IO_MEM_SHIFT) | subwidth;
3060 }
3061
3062 void cpu_unregister_io_memory(int io_table_address)
3063 {
3064 int i;
3065 int io_index = io_table_address >> IO_MEM_SHIFT;
3066
3067 for (i=0;i < 3; i++) {
3068 io_mem_read[io_index][i] = unassigned_mem_read[i];
3069 io_mem_write[io_index][i] = unassigned_mem_write[i];
3070 }
3071 io_mem_opaque[io_index] = NULL;
3072 io_mem_used[io_index] = 0;
3073 }
3074
3075 CPUWriteMemoryFunc **cpu_get_io_memory_write(int io_index)
3076 {
3077 return io_mem_write[io_index >> IO_MEM_SHIFT];
3078 }
3079
3080 CPUReadMemoryFunc **cpu_get_io_memory_read(int io_index)
3081 {
3082 return io_mem_read[io_index >> IO_MEM_SHIFT];
3083 }
3084
3085 #endif /* !defined(CONFIG_USER_ONLY) */
3086
3087 /* physical memory access (slow version, mainly for debug) */
3088 #if defined(CONFIG_USER_ONLY)
3089 void cpu_physical_memory_rw(target_phys_addr_t addr, uint8_t *buf,
3090 int len, int is_write)
3091 {
3092 int l, flags;
3093 target_ulong page;
3094 void * p;
3095
3096 while (len > 0) {
3097 page = addr & TARGET_PAGE_MASK;
3098 l = (page + TARGET_PAGE_SIZE) - addr;
3099 if (l > len)
3100 l = len;
3101 flags = page_get_flags(page);
3102 if (!(flags & PAGE_VALID))
3103 return;
3104 if (is_write) {
3105 if (!(flags & PAGE_WRITE))
3106 return;
3107 /* XXX: this code should not depend on lock_user */
3108 if (!(p = lock_user(VERIFY_WRITE, addr, l, 0)))
3109 /* FIXME - should this return an error rather than just fail? */
3110 return;
3111 memcpy(p, buf, l);
3112 unlock_user(p, addr, l);
3113 } else {
3114 if (!(flags & PAGE_READ))
3115 return;
3116 /* XXX: this code should not depend on lock_user */
3117 if (!(p = lock_user(VERIFY_READ, addr, l, 1)))
3118 /* FIXME - should this return an error rather than just fail? */
3119 return;
3120 memcpy(buf, p, l);
3121 unlock_user(p, addr, 0);
3122 }
3123 len -= l;
3124 buf += l;
3125 addr += l;
3126 }
3127 }
3128
3129 #else
3130 void cpu_physical_memory_rw(target_phys_addr_t addr, uint8_t *buf,
3131 int len, int is_write)
3132 {
3133 int l, io_index;
3134 uint8_t *ptr;
3135 uint32_t val;
3136 target_phys_addr_t page;
3137 unsigned long pd;
3138 PhysPageDesc *p;
3139
3140 while (len > 0) {
3141 page = addr & TARGET_PAGE_MASK;
3142 l = (page + TARGET_PAGE_SIZE) - addr;
3143 if (l > len)
3144 l = len;
3145 p = phys_page_find(page >> TARGET_PAGE_BITS);
3146 if (!p) {
3147 pd = IO_MEM_UNASSIGNED;
3148 } else {
3149 pd = p->phys_offset;
3150 }
3151
3152 if (is_write) {
3153 if ((pd & ~TARGET_PAGE_MASK) != IO_MEM_RAM) {
3154 target_phys_addr_t addr1 = addr;
3155 io_index = (pd >> IO_MEM_SHIFT) & (IO_MEM_NB_ENTRIES - 1);
3156 if (p)
3157 addr1 = (addr & ~TARGET_PAGE_MASK) + p->region_offset;
3158 /* XXX: could force cpu_single_env to NULL to avoid
3159 potential bugs */
3160 if (l >= 4 && ((addr1 & 3) == 0)) {
3161 /* 32 bit write access */
3162 val = ldl_p(buf);
3163 io_mem_write[io_index][2](io_mem_opaque[io_index], addr1, val);
3164 l = 4;
3165 } else if (l >= 2 && ((addr1 & 1) == 0)) {
3166 /* 16 bit write access */
3167 val = lduw_p(buf);
3168 io_mem_write[io_index][1](io_mem_opaque[io_index], addr1, val);
3169 l = 2;
3170 } else {
3171 /* 8 bit write access */
3172 val = ldub_p(buf);
3173 io_mem_write[io_index][0](io_mem_opaque[io_index], addr1, val);
3174 l = 1;
3175 }
3176 } else {
3177 unsigned long addr1;
3178 addr1 = (pd & TARGET_PAGE_MASK) + (addr & ~TARGET_PAGE_MASK);
3179 /* RAM case */
3180 ptr = qemu_get_ram_ptr(addr1);
3181 memcpy(ptr, buf, l);
3182 if (!cpu_physical_memory_is_dirty(addr1)) {
3183 /* invalidate code */
3184 tb_invalidate_phys_page_range(addr1, addr1 + l, 0);
3185 /* set dirty bit */
3186 phys_ram_dirty[addr1 >> TARGET_PAGE_BITS] |=
3187 (0xff & ~CODE_DIRTY_FLAG);
3188 }
3189 /* qemu doesn't execute guest code directly, but kvm does
3190 therefore flush instruction caches */
3191 if (kvm_enabled())
3192 flush_icache_range((unsigned long)ptr,
3193 ((unsigned long)ptr)+l);
3194 }
3195 } else {
3196 if ((pd & ~TARGET_PAGE_MASK) > IO_MEM_ROM &&
3197 !(pd & IO_MEM_ROMD)) {
3198 target_phys_addr_t addr1 = addr;
3199 /* I/O case */
3200 io_index = (pd >> IO_MEM_SHIFT) & (IO_MEM_NB_ENTRIES - 1);
3201 if (p)
3202 addr1 = (addr & ~TARGET_PAGE_MASK) + p->region_offset;
3203 if (l >= 4 && ((addr1 & 3) == 0)) {
3204 /* 32 bit read access */
3205 val = io_mem_read[io_index][2](io_mem_opaque[io_index], addr1);
3206 stl_p(buf, val);
3207 l = 4;
3208 } else if (l >= 2 && ((addr1 & 1) == 0)) {
3209 /* 16 bit read access */
3210 val = io_mem_read[io_index][1](io_mem_opaque[io_index], addr1);
3211 stw_p(buf, val);
3212 l = 2;
3213 } else {
3214 /* 8 bit read access */
3215 val = io_mem_read[io_index][0](io_mem_opaque[io_index], addr1);
3216 stb_p(buf, val);
3217 l = 1;
3218 }
3219 } else {
3220 /* RAM case */
3221 ptr = qemu_get_ram_ptr(pd & TARGET_PAGE_MASK) +
3222 (addr & ~TARGET_PAGE_MASK);
3223 memcpy(buf, ptr, l);
3224 }
3225 }
3226 len -= l;
3227 buf += l;
3228 addr += l;
3229 }
3230 }
3231
3232 /* used for ROM loading : can write in RAM and ROM */
3233 void cpu_physical_memory_write_rom(target_phys_addr_t addr,
3234 const uint8_t *buf, int len)
3235 {
3236 int l;
3237 uint8_t *ptr;
3238 target_phys_addr_t page;
3239 unsigned long pd;
3240 PhysPageDesc *p;
3241
3242 while (len > 0) {
3243 page = addr & TARGET_PAGE_MASK;
3244 l = (page + TARGET_PAGE_SIZE) - addr;
3245 if (l > len)
3246 l = len;
3247 p = phys_page_find(page >> TARGET_PAGE_BITS);
3248 if (!p) {
3249 pd = IO_MEM_UNASSIGNED;
3250 } else {
3251 pd = p->phys_offset;
3252 }
3253
3254 if ((pd & ~TARGET_PAGE_MASK) != IO_MEM_RAM &&
3255 (pd & ~TARGET_PAGE_MASK) != IO_MEM_ROM &&
3256 !(pd & IO_MEM_ROMD)) {
3257 /* do nothing */
3258 } else {
3259 unsigned long addr1;
3260 addr1 = (pd & TARGET_PAGE_MASK) + (addr & ~TARGET_PAGE_MASK);
3261 /* ROM/RAM case */
3262 ptr = qemu_get_ram_ptr(addr1);
3263 memcpy(ptr, buf, l);
3264 }
3265 len -= l;
3266 buf += l;
3267 addr += l;
3268 }
3269 }
3270
3271 typedef struct {
3272 void *buffer;
3273 target_phys_addr_t addr;
3274 target_phys_addr_t len;
3275 } BounceBuffer;
3276
3277 static BounceBuffer bounce;
3278
3279 typedef struct MapClient {
3280 void *opaque;
3281 void (*callback)(void *opaque);
3282 LIST_ENTRY(MapClient) link;
3283 } MapClient;
3284
3285 static LIST_HEAD(map_client_list, MapClient) map_client_list
3286 = LIST_HEAD_INITIALIZER(map_client_list);
3287
3288 void *cpu_register_map_client(void *opaque, void (*callback)(void *opaque))
3289 {
3290 MapClient *client = qemu_malloc(sizeof(*client));
3291
3292 client->opaque = opaque;
3293 client->callback = callback;
3294 LIST_INSERT_HEAD(&map_client_list, client, link);
3295 return client;
3296 }
3297
3298 void cpu_unregister_map_client(void *_client)
3299 {
3300 MapClient *client = (MapClient *)_client;
3301
3302 LIST_REMOVE(client, link);
3303 }
3304
3305 static void cpu_notify_map_clients(void)
3306 {
3307 MapClient *client;
3308
3309 while (!LIST_EMPTY(&map_client_list)) {
3310 client = LIST_FIRST(&map_client_list);
3311 client->callback(client->opaque);
3312 LIST_REMOVE(client, link);
3313 }
3314 }
3315
3316 /* Map a physical memory region into a host virtual address.
3317 * May map a subset of the requested range, given by and returned in *plen.
3318 * May return NULL if resources needed to perform the mapping are exhausted.
3319 * Use only for reads OR writes - not for read-modify-write operations.
3320 * Use cpu_register_map_client() to know when retrying the map operation is
3321 * likely to succeed.
3322 */
3323 void *cpu_physical_memory_map(target_phys_addr_t addr,
3324 target_phys_addr_t *plen,
3325 int is_write)
3326 {
3327 target_phys_addr_t len = *plen;
3328 target_phys_addr_t done = 0;
3329 int l;
3330 uint8_t *ret = NULL;
3331 uint8_t *ptr;
3332 target_phys_addr_t page;
3333 unsigned long pd;
3334 PhysPageDesc *p;
3335 unsigned long addr1;
3336
3337 while (len > 0) {
3338 page = addr & TARGET_PAGE_MASK;
3339 l = (page + TARGET_PAGE_SIZE) - addr;
3340 if (l > len)
3341 l = len;
3342 p = phys_page_find(page >> TARGET_PAGE_BITS);
3343 if (!p) {
3344 pd = IO_MEM_UNASSIGNED;
3345 } else {
3346 pd = p->phys_offset;
3347 }
3348
3349 if ((pd & ~TARGET_PAGE_MASK) != IO_MEM_RAM) {
3350 if (done || bounce.buffer) {
3351 break;
3352 }
3353 bounce.buffer = qemu_memalign(TARGET_PAGE_SIZE, TARGET_PAGE_SIZE);
3354 bounce.addr = addr;
3355 bounce.len = l;
3356 if (!is_write) {
3357 cpu_physical_memory_rw(addr, bounce.buffer, l, 0);
3358 }
3359 ptr = bounce.buffer;
3360 } else {
3361 addr1 = (pd & TARGET_PAGE_MASK) + (addr & ~TARGET_PAGE_MASK);
3362 ptr = qemu_get_ram_ptr(addr1);
3363 }
3364 if (!done) {
3365 ret = ptr;
3366 } else if (ret + done != ptr) {
3367 break;
3368 }
3369
3370 len -= l;
3371 addr += l;
3372 done += l;
3373 }
3374 *plen = done;
3375 return ret;
3376 }
3377
3378 /* Unmaps a memory region previously mapped by cpu_physical_memory_map().
3379 * Will also mark the memory as dirty if is_write == 1. access_len gives
3380 * the amount of memory that was actually read or written by the caller.
3381 */
3382 void cpu_physical_memory_unmap(void *buffer, target_phys_addr_t len,
3383 int is_write, target_phys_addr_t access_len)
3384 {
3385 if (buffer != bounce.buffer) {
3386 if (is_write) {
3387 ram_addr_t addr1 = qemu_ram_addr_from_host(buffer);
3388 while (access_len) {
3389 unsigned l;
3390 l = TARGET_PAGE_SIZE;
3391 if (l > access_len)
3392 l = access_len;
3393 if (!cpu_physical_memory_is_dirty(addr1)) {
3394 /* invalidate code */
3395 tb_invalidate_phys_page_range(addr1, addr1 + l, 0);
3396 /* set dirty bit */
3397 phys_ram_dirty[addr1 >> TARGET_PAGE_BITS] |=
3398 (0xff & ~CODE_DIRTY_FLAG);
3399 }
3400 addr1 += l;
3401 access_len -= l;
3402 }
3403 }
3404 return;
3405 }
3406 if (is_write) {
3407 cpu_physical_memory_write(bounce.addr, bounce.buffer, access_len);
3408 }
3409 qemu_free(bounce.buffer);
3410 bounce.buffer = NULL;
3411 cpu_notify_map_clients();
3412 }
3413
3414 /* warning: addr must be aligned */
3415 uint32_t ldl_phys(target_phys_addr_t addr)
3416 {
3417 int io_index;
3418 uint8_t *ptr;
3419 uint32_t val;
3420 unsigned long pd;
3421 PhysPageDesc *p;
3422
3423 p = phys_page_find(addr >> TARGET_PAGE_BITS);
3424 if (!p) {
3425 pd = IO_MEM_UNASSIGNED;
3426 } else {
3427 pd = p->phys_offset;
3428 }
3429
3430 if ((pd & ~TARGET_PAGE_MASK) > IO_MEM_ROM &&
3431 !(pd & IO_MEM_ROMD)) {
3432 /* I/O case */
3433 io_index = (pd >> IO_MEM_SHIFT) & (IO_MEM_NB_ENTRIES - 1);
3434 if (p)
3435 addr = (addr & ~TARGET_PAGE_MASK) + p->region_offset;
3436 val = io_mem_read[io_index][2](io_mem_opaque[io_index], addr);
3437 } else {
3438 /* RAM case */
3439 ptr = qemu_get_ram_ptr(pd & TARGET_PAGE_MASK) +
3440 (addr & ~TARGET_PAGE_MASK);
3441 val = ldl_p(ptr);
3442 }
3443 return val;
3444 }
3445
3446 /* warning: addr must be aligned */
3447 uint64_t ldq_phys(target_phys_addr_t addr)
3448 {
3449 int io_index;
3450 uint8_t *ptr;
3451 uint64_t val;
3452 unsigned long pd;
3453 PhysPageDesc *p;
3454
3455 p = phys_page_find(addr >> TARGET_PAGE_BITS);
3456 if (!p) {
3457 pd = IO_MEM_UNASSIGNED;
3458 } else {
3459 pd = p->phys_offset;
3460 }
3461
3462 if ((pd & ~TARGET_PAGE_MASK) > IO_MEM_ROM &&
3463 !(pd & IO_MEM_ROMD)) {
3464 /* I/O case */
3465 io_index = (pd >> IO_MEM_SHIFT) & (IO_MEM_NB_ENTRIES - 1);
3466 if (p)
3467 addr = (addr & ~TARGET_PAGE_MASK) + p->region_offset;
3468 #ifdef TARGET_WORDS_BIGENDIAN
3469 val = (uint64_t)io_mem_read[io_index][2](io_mem_opaque[io_index], addr) << 32;
3470 val |= io_mem_read[io_index][2](io_mem_opaque[io_index], addr + 4);
3471 #else
3472 val = io_mem_read[io_index][2](io_mem_opaque[io_index], addr);
3473 val |= (uint64_t)io_mem_read[io_index][2](io_mem_opaque[io_index], addr + 4) << 32;
3474 #endif
3475 } else {
3476 /* RAM case */
3477 ptr = qemu_get_ram_ptr(pd & TARGET_PAGE_MASK) +
3478 (addr & ~TARGET_PAGE_MASK);
3479 val = ldq_p(ptr);
3480 }
3481 return val;
3482 }
3483
3484 /* XXX: optimize */
3485 uint32_t ldub_phys(target_phys_addr_t addr)
3486 {
3487 uint8_t val;
3488 cpu_physical_memory_read(addr, &val, 1);
3489 return val;
3490 }
3491
3492 /* XXX: optimize */
3493 uint32_t lduw_phys(target_phys_addr_t addr)
3494 {
3495 uint16_t val;
3496 cpu_physical_memory_read(addr, (uint8_t *)&val, 2);
3497 return tswap16(val);
3498 }
3499
3500 /* warning: addr must be aligned. The ram page is not masked as dirty
3501 and the code inside is not invalidated. It is useful if the dirty
3502 bits are used to track modified PTEs */
3503 void stl_phys_notdirty(target_phys_addr_t addr, uint32_t val)
3504 {
3505 int io_index;
3506 uint8_t *ptr;
3507 unsigned long pd;
3508 PhysPageDesc *p;
3509
3510 p = phys_page_find(addr >> TARGET_PAGE_BITS);
3511 if (!p) {
3512 pd = IO_MEM_UNASSIGNED;
3513 } else {
3514 pd = p->phys_offset;
3515 }
3516
3517 if ((pd & ~TARGET_PAGE_MASK) != IO_MEM_RAM) {
3518 io_index = (pd >> IO_MEM_SHIFT) & (IO_MEM_NB_ENTRIES - 1);
3519 if (p)
3520 addr = (addr & ~TARGET_PAGE_MASK) + p->region_offset;
3521 io_mem_write[io_index][2](io_mem_opaque[io_index], addr, val);
3522 } else {
3523 unsigned long addr1 = (pd & TARGET_PAGE_MASK) + (addr & ~TARGET_PAGE_MASK);
3524 ptr = qemu_get_ram_ptr(addr1);
3525 stl_p(ptr, val);
3526
3527 if (unlikely(in_migration)) {
3528 if (!cpu_physical_memory_is_dirty(addr1)) {
3529 /* invalidate code */
3530 tb_invalidate_phys_page_range(addr1, addr1 + 4, 0);
3531 /* set dirty bit */
3532 phys_ram_dirty[addr1 >> TARGET_PAGE_BITS] |=
3533 (0xff & ~CODE_DIRTY_FLAG);
3534 }
3535 }
3536 }
3537 }
3538
3539 void stq_phys_notdirty(target_phys_addr_t addr, uint64_t val)
3540 {
3541 int io_index;
3542 uint8_t *ptr;
3543 unsigned long pd;
3544 PhysPageDesc *p;
3545
3546 p = phys_page_find(addr >> TARGET_PAGE_BITS);
3547 if (!p) {
3548 pd = IO_MEM_UNASSIGNED;
3549 } else {
3550 pd = p->phys_offset;
3551 }
3552
3553 if ((pd & ~TARGET_PAGE_MASK) != IO_MEM_RAM) {
3554 io_index = (pd >> IO_MEM_SHIFT) & (IO_MEM_NB_ENTRIES - 1);
3555 if (p)
3556 addr = (addr & ~TARGET_PAGE_MASK) + p->region_offset;
3557 #ifdef TARGET_WORDS_BIGENDIAN
3558 io_mem_write[io_index][2](io_mem_opaque[io_index], addr, val >> 32);
3559 io_mem_write[io_index][2](io_mem_opaque[io_index], addr + 4, val);
3560 #else
3561 io_mem_write[io_index][2](io_mem_opaque[io_index], addr, val);
3562 io_mem_write[io_index][2](io_mem_opaque[io_index], addr + 4, val >> 32);
3563 #endif
3564 } else {
3565 ptr = qemu_get_ram_ptr(pd & TARGET_PAGE_MASK) +
3566 (addr & ~TARGET_PAGE_MASK);
3567 stq_p(ptr, val);
3568 }
3569 }
3570
3571 /* warning: addr must be aligned */
3572 void stl_phys(target_phys_addr_t addr, uint32_t val)
3573 {
3574 int io_index;
3575 uint8_t *ptr;
3576 unsigned long pd;
3577 PhysPageDesc *p;
3578
3579 p = phys_page_find(addr >> TARGET_PAGE_BITS);
3580 if (!p) {
3581 pd = IO_MEM_UNASSIGNED;
3582 } else {
3583 pd = p->phys_offset;
3584 }
3585
3586 if ((pd & ~TARGET_PAGE_MASK) != IO_MEM_RAM) {
3587 io_index = (pd >> IO_MEM_SHIFT) & (IO_MEM_NB_ENTRIES - 1);
3588 if (p)
3589 addr = (addr & ~TARGET_PAGE_MASK) + p->region_offset;
3590 io_mem_write[io_index][2](io_mem_opaque[io_index], addr, val);
3591 } else {
3592 unsigned long addr1;
3593 addr1 = (pd & TARGET_PAGE_MASK) + (addr & ~TARGET_PAGE_MASK);
3594 /* RAM case */
3595 ptr = qemu_get_ram_ptr(addr1);
3596 stl_p(ptr, val);
3597 if (!cpu_physical_memory_is_dirty(addr1)) {
3598 /* invalidate code */
3599 tb_invalidate_phys_page_range(addr1, addr1 + 4, 0);
3600 /* set dirty bit */
3601 phys_ram_dirty[addr1 >> TARGET_PAGE_BITS] |=
3602 (0xff & ~CODE_DIRTY_FLAG);
3603 }
3604 }
3605 }
3606
3607 /* XXX: optimize */
3608 void stb_phys(target_phys_addr_t addr, uint32_t val)
3609 {
3610 uint8_t v = val;
3611 cpu_physical_memory_write(addr, &v, 1);
3612 }
3613
3614 /* XXX: optimize */
3615 void stw_phys(target_phys_addr_t addr, uint32_t val)
3616 {
3617 uint16_t v = tswap16(val);
3618 cpu_physical_memory_write(addr, (const uint8_t *)&v, 2);
3619 }
3620
3621 /* XXX: optimize */
3622 void stq_phys(target_phys_addr_t addr, uint64_t val)
3623 {
3624 val = tswap64(val);
3625 cpu_physical_memory_write(addr, (const uint8_t *)&val, 8);
3626 }
3627
3628 #endif
3629
3630 /* virtual memory access for debug (includes writing to ROM) */
3631 int cpu_memory_rw_debug(CPUState *env, target_ulong addr,
3632 uint8_t *buf, int len, int is_write)
3633 {
3634 int l;
3635 target_phys_addr_t phys_addr;
3636 target_ulong page;
3637
3638 while (len > 0) {
3639 page = addr & TARGET_PAGE_MASK;
3640 phys_addr = cpu_get_phys_page_debug(env, page);
3641 /* if no physical page mapped, return an error */
3642 if (phys_addr == -1)
3643 return -1;
3644 l = (page + TARGET_PAGE_SIZE) - addr;
3645 if (l > len)
3646 l = len;
3647 phys_addr += (addr & ~TARGET_PAGE_MASK);
3648 #if !defined(CONFIG_USER_ONLY)
3649 if (is_write)
3650 cpu_physical_memory_write_rom(phys_addr, buf, l);
3651 else
3652 #endif
3653 cpu_physical_memory_rw(phys_addr, buf, l, is_write);
3654 len -= l;
3655 buf += l;
3656 addr += l;
3657 }
3658 return 0;
3659 }
3660
3661 /* in deterministic execution mode, instructions doing device I/Os
3662 must be at the end of the TB */
3663 void cpu_io_recompile(CPUState *env, void *retaddr)
3664 {
3665 TranslationBlock *tb;
3666 uint32_t n, cflags;
3667 target_ulong pc, cs_base;
3668 uint64_t flags;
3669
3670 tb = tb_find_pc((unsigned long)retaddr);
3671 if (!tb) {
3672 cpu_abort(env, "cpu_io_recompile: could not find TB for pc=%p",
3673 retaddr);
3674 }
3675 n = env->icount_decr.u16.low + tb->icount;
3676 cpu_restore_state(tb, env, (unsigned long)retaddr, NULL);
3677 /* Calculate how many instructions had been executed before the fault
3678 occurred. */
3679 n = n - env->icount_decr.u16.low;
3680 /* Generate a new TB ending on the I/O insn. */
3681 n++;
3682 /* On MIPS and SH, delay slot instructions can only be restarted if
3683 they were already the first instruction in the TB. If this is not
3684 the first instruction in a TB then re-execute the preceding
3685 branch. */
3686 #if defined(TARGET_MIPS)
3687 if ((env->hflags & MIPS_HFLAG_BMASK) != 0 && n > 1) {
3688 env->active_tc.PC -= 4;
3689 env->icount_decr.u16.low++;
3690 env->hflags &= ~MIPS_HFLAG_BMASK;
3691 }
3692 #elif defined(TARGET_SH4)
3693 if ((env->flags & ((DELAY_SLOT | DELAY_SLOT_CONDITIONAL))) != 0
3694 && n > 1) {
3695 env->pc -= 2;
3696 env->icount_decr.u16.low++;
3697 env->flags &= ~(DELAY_SLOT | DELAY_SLOT_CONDITIONAL);
3698 }
3699 #endif
3700 /* This should never happen. */
3701 if (n > CF_COUNT_MASK)
3702 cpu_abort(env, "TB too big during recompile");
3703
3704 cflags = n | CF_LAST_IO;
3705 pc = tb->pc;
3706 cs_base = tb->cs_base;
3707 flags = tb->flags;
3708 tb_phys_invalidate(tb, -1);
3709 /* FIXME: In theory this could raise an exception. In practice
3710 we have already translated the block once so it's probably ok. */
3711 tb_gen_code(env, pc, cs_base, flags, cflags);
3712 /* TODO: If env->pc != tb->pc (i.e. the faulting instruction was not
3713 the first in the TB) then we end up generating a whole new TB and
3714 repeating the fault, which is horribly inefficient.
3715 Better would be to execute just this insn uncached, or generate a
3716 second new TB. */
3717 cpu_resume_from_signal(env, NULL);
3718 }
3719
3720 void dump_exec_info(FILE *f,
3721 int (*cpu_fprintf)(FILE *f, const char *fmt, ...))
3722 {
3723 int i, target_code_size, max_target_code_size;
3724 int direct_jmp_count, direct_jmp2_count, cross_page;
3725 TranslationBlock *tb;
3726
3727 target_code_size = 0;
3728 max_target_code_size = 0;
3729 cross_page = 0;
3730 direct_jmp_count = 0;
3731 direct_jmp2_count = 0;
3732 for(i = 0; i < nb_tbs; i++) {
3733 tb = &tbs[i];
3734 target_code_size += tb->size;
3735 if (tb->size > max_target_code_size)
3736 max_target_code_size = tb->size;
3737 if (tb->page_addr[1] != -1)
3738 cross_page++;
3739 if (tb->tb_next_offset[0] != 0xffff) {
3740 direct_jmp_count++;
3741 if (tb->tb_next_offset[1] != 0xffff) {
3742 direct_jmp2_count++;
3743 }
3744 }
3745 }
3746 /* XXX: avoid using doubles ? */
3747 cpu_fprintf(f, "Translation buffer state:\n");
3748 cpu_fprintf(f, "gen code size %ld/%ld\n",
3749 code_gen_ptr - code_gen_buffer, code_gen_buffer_max_size);
3750 cpu_fprintf(f, "TB count %d/%d\n",
3751 nb_tbs, code_gen_max_blocks);
3752 cpu_fprintf(f, "TB avg target size %d max=%d bytes\n",
3753 nb_tbs ? target_code_size / nb_tbs : 0,
3754 max_target_code_size);
3755 cpu_fprintf(f, "TB avg host size %d bytes (expansion ratio: %0.1f)\n",
3756 nb_tbs ? (code_gen_ptr - code_gen_buffer) / nb_tbs : 0,
3757 target_code_size ? (double) (code_gen_ptr - code_gen_buffer) / target_code_size : 0);
3758 cpu_fprintf(f, "cross page TB count %d (%d%%)\n",
3759 cross_page,
3760 nb_tbs ? (cross_page * 100) / nb_tbs : 0);
3761 cpu_fprintf(f, "direct jump count %d (%d%%) (2 jumps=%d %d%%)\n",
3762 direct_jmp_count,
3763 nb_tbs ? (direct_jmp_count * 100) / nb_tbs : 0,
3764 direct_jmp2_count,
3765 nb_tbs ? (direct_jmp2_count * 100) / nb_tbs : 0);
3766 cpu_fprintf(f, "\nStatistics:\n");
3767 cpu_fprintf(f, "TB flush count %d\n", tb_flush_count);
3768 cpu_fprintf(f, "TB invalidate count %d\n", tb_phys_invalidate_count);
3769 cpu_fprintf(f, "TLB flush count %d\n", tlb_flush_count);
3770 tcg_dump_info(f, cpu_fprintf);
3771 }
3772
3773 #if !defined(CONFIG_USER_ONLY)
3774
3775 #define MMUSUFFIX _cmmu
3776 #define GETPC() NULL
3777 #define env cpu_single_env
3778 #define SOFTMMU_CODE_ACCESS
3779
3780 #define SHIFT 0
3781 #include "softmmu_template.h"
3782
3783 #define SHIFT 1
3784 #include "softmmu_template.h"
3785
3786 #define SHIFT 2
3787 #include "softmmu_template.h"
3788
3789 #define SHIFT 3
3790 #include "softmmu_template.h"
3791
3792 #undef env
3793
3794 #endif
Patches shipped by Fedora