2 * virtual page mapping and translated block handling
4 * Copyright (c) 2003 Fabrice Bellard
6 * This library is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU Lesser General Public
8 * License as published by the Free Software Foundation; either
9 * version 2 of the License, or (at your option) any later version.
11 * This library is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
14 * Lesser General Public License for more details.
16 * You should have received a copy of the GNU Lesser General Public
17 * License along with this library; if not, see <http://www.gnu.org/licenses/>.
23 #include <sys/types.h>
36 #include "qemu-common.h"
37 #include "cache-utils.h"
39 #if !defined(TARGET_IA64)
47 #if defined(CONFIG_USER_ONLY)
51 //#define DEBUG_TB_INVALIDATE
54 //#define DEBUG_UNASSIGNED
56 /* make various TB consistency checks */
57 //#define DEBUG_TB_CHECK
58 //#define DEBUG_TLB_CHECK
60 //#define DEBUG_IOPORT
61 //#define DEBUG_SUBPAGE
63 #if !defined(CONFIG_USER_ONLY)
64 /* TB consistency checks only implemented for usermode emulation. */
68 #define SMC_BITMAP_USE_THRESHOLD 10
70 #if defined(TARGET_SPARC64)
71 #define TARGET_PHYS_ADDR_SPACE_BITS 41
72 #elif defined(TARGET_SPARC)
73 #define TARGET_PHYS_ADDR_SPACE_BITS 36
74 #elif defined(TARGET_ALPHA)
75 #define TARGET_PHYS_ADDR_SPACE_BITS 42
76 #define TARGET_VIRT_ADDR_SPACE_BITS 42
77 #elif defined(TARGET_PPC64)
78 #define TARGET_PHYS_ADDR_SPACE_BITS 42
79 #elif defined(TARGET_X86_64) && !defined(CONFIG_KQEMU)
80 #define TARGET_PHYS_ADDR_SPACE_BITS 42
81 #elif defined(TARGET_I386) && !defined(CONFIG_KQEMU)
82 #define TARGET_PHYS_ADDR_SPACE_BITS 36
83 #elif defined(TARGET_IA64)
84 #define TARGET_PHYS_ADDR_SPACE_BITS 36
86 /* Note: for compatibility with kqemu, we use 32 bits for x86_64 */
87 #define TARGET_PHYS_ADDR_SPACE_BITS 32
90 static TranslationBlock
*tbs
;
91 int code_gen_max_blocks
;
92 TranslationBlock
*tb_phys_hash
[CODE_GEN_PHYS_HASH_SIZE
];
94 /* any access to the tbs or the page table must use this lock */
95 spinlock_t tb_lock
= SPIN_LOCK_UNLOCKED
;
97 #if defined(__arm__) || defined(__sparc_v9__)
98 /* The prologue must be reachable with a direct jump. ARM and Sparc64
99 have limited branch ranges (possibly also PPC) so place it in a
100 section close to code segment. */
101 #define code_gen_section \
102 __attribute__((__section__(".gen_code"))) \
103 __attribute__((aligned (32)))
104 #elif defined(_WIN32)
105 /* Maximum alignment for Win32 is 16. */
106 #define code_gen_section \
107 __attribute__((aligned (16)))
109 #define code_gen_section \
110 __attribute__((aligned (32)))
113 uint8_t code_gen_prologue
[1024] code_gen_section
;
114 static uint8_t *code_gen_buffer
;
115 static unsigned long code_gen_buffer_size
;
116 /* threshold to flush the translated code buffer */
117 static unsigned long code_gen_buffer_max_size
;
118 uint8_t *code_gen_ptr
;
120 #if !defined(CONFIG_USER_ONLY)
122 uint8_t *phys_ram_dirty
;
124 static int in_migration
;
126 typedef struct RAMBlock
{
130 struct RAMBlock
*next
;
133 static RAMBlock
*ram_blocks
;
134 /* TODO: When we implement (and use) ram deallocation (e.g. for hotplug)
135 then we can no longer assume contiguous ram offsets, and external uses
136 of this variable will break. */
137 ram_addr_t last_ram_offset
;
141 /* current CPU in the current thread. It is only valid inside
143 CPUState
*cpu_single_env
;
144 /* 0 = Do not count executed instructions.
145 1 = Precise instruction counting.
146 2 = Adaptive rate instruction counting. */
148 /* Current instruction counter. While executing translated code this may
149 include some instructions that have not yet been executed. */
152 typedef struct PageDesc
{
153 /* list of TBs intersecting this ram page */
154 TranslationBlock
*first_tb
;
155 /* in order to optimize self modifying code, we count the number
156 of lookups we do to a given page to use a bitmap */
157 unsigned int code_write_count
;
158 uint8_t *code_bitmap
;
159 #if defined(CONFIG_USER_ONLY)
164 typedef struct PhysPageDesc
{
165 /* offset in host memory of the page + io_index in the low bits */
166 ram_addr_t phys_offset
;
167 ram_addr_t region_offset
;
171 #if defined(CONFIG_USER_ONLY) && defined(TARGET_VIRT_ADDR_SPACE_BITS)
172 /* XXX: this is a temporary hack for alpha target.
173 * In the future, this is to be replaced by a multi-level table
174 * to actually be able to handle the complete 64 bits address space.
176 #define L1_BITS (TARGET_VIRT_ADDR_SPACE_BITS - L2_BITS - TARGET_PAGE_BITS)
178 #define L1_BITS (32 - L2_BITS - TARGET_PAGE_BITS)
181 #define L1_SIZE (1 << L1_BITS)
182 #define L2_SIZE (1 << L2_BITS)
184 unsigned long qemu_real_host_page_size
;
185 unsigned long qemu_host_page_bits
;
186 unsigned long qemu_host_page_size
;
187 unsigned long qemu_host_page_mask
;
189 /* XXX: for system emulation, it could just be an array */
190 static PageDesc
*l1_map
[L1_SIZE
];
191 static PhysPageDesc
**l1_phys_map
;
193 #if !defined(CONFIG_USER_ONLY)
194 static void io_mem_init(void);
196 /* io memory support */
197 CPUWriteMemoryFunc
*io_mem_write
[IO_MEM_NB_ENTRIES
][4];
198 CPUReadMemoryFunc
*io_mem_read
[IO_MEM_NB_ENTRIES
][4];
199 void *io_mem_opaque
[IO_MEM_NB_ENTRIES
];
200 static char io_mem_used
[IO_MEM_NB_ENTRIES
];
201 static int io_mem_watch
;
205 static const char *logfilename
= "/tmp/qemu.log";
208 static int log_append
= 0;
211 static int tlb_flush_count
;
212 static int tb_flush_count
;
213 static int tb_phys_invalidate_count
;
215 #define SUBPAGE_IDX(addr) ((addr) & ~TARGET_PAGE_MASK)
216 typedef struct subpage_t
{
217 target_phys_addr_t base
;
218 CPUReadMemoryFunc
**mem_read
[TARGET_PAGE_SIZE
][4];
219 CPUWriteMemoryFunc
**mem_write
[TARGET_PAGE_SIZE
][4];
220 void *opaque
[TARGET_PAGE_SIZE
][2][4];
221 ram_addr_t region_offset
[TARGET_PAGE_SIZE
][2][4];
225 static void map_exec(void *addr
, long size
)
228 VirtualProtect(addr
, size
,
229 PAGE_EXECUTE_READWRITE
, &old_protect
);
233 static void map_exec(void *addr
, long size
)
235 unsigned long start
, end
, page_size
;
237 page_size
= getpagesize();
238 start
= (unsigned long)addr
;
239 start
&= ~(page_size
- 1);
241 end
= (unsigned long)addr
+ size
;
242 end
+= page_size
- 1;
243 end
&= ~(page_size
- 1);
245 mprotect((void *)start
, end
- start
,
246 PROT_READ
| PROT_WRITE
| PROT_EXEC
);
250 static void page_init(void)
252 /* NOTE: we can always suppose that qemu_host_page_size >=
256 SYSTEM_INFO system_info
;
258 GetSystemInfo(&system_info
);
259 qemu_real_host_page_size
= system_info
.dwPageSize
;
262 qemu_real_host_page_size
= getpagesize();
264 if (qemu_host_page_size
== 0)
265 qemu_host_page_size
= qemu_real_host_page_size
;
266 if (qemu_host_page_size
< TARGET_PAGE_SIZE
)
267 qemu_host_page_size
= TARGET_PAGE_SIZE
;
268 qemu_host_page_bits
= 0;
269 while ((1 << qemu_host_page_bits
) < qemu_host_page_size
)
270 qemu_host_page_bits
++;
271 qemu_host_page_mask
= ~(qemu_host_page_size
- 1);
272 l1_phys_map
= qemu_vmalloc(L1_SIZE
* sizeof(void *));
273 memset(l1_phys_map
, 0, L1_SIZE
* sizeof(void *));
275 #if !defined(_WIN32) && defined(CONFIG_USER_ONLY)
277 long long startaddr
, endaddr
;
282 last_brk
= (unsigned long)sbrk(0);
283 f
= fopen("/proc/self/maps", "r");
286 n
= fscanf (f
, "%llx-%llx %*[^\n]\n", &startaddr
, &endaddr
);
288 startaddr
= MIN(startaddr
,
289 (1ULL << TARGET_PHYS_ADDR_SPACE_BITS
) - 1);
290 endaddr
= MIN(endaddr
,
291 (1ULL << TARGET_PHYS_ADDR_SPACE_BITS
) - 1);
292 page_set_flags(startaddr
& TARGET_PAGE_MASK
,
293 TARGET_PAGE_ALIGN(endaddr
),
304 static inline PageDesc
**page_l1_map(target_ulong index
)
306 #if TARGET_LONG_BITS > 32
307 /* Host memory outside guest VM. For 32-bit targets we have already
308 excluded high addresses. */
309 if (index
> ((target_ulong
)L2_SIZE
* L1_SIZE
))
312 return &l1_map
[index
>> L2_BITS
];
315 static inline PageDesc
*page_find_alloc(target_ulong index
)
318 lp
= page_l1_map(index
);
324 /* allocate if not found */
325 #if defined(CONFIG_USER_ONLY)
326 size_t len
= sizeof(PageDesc
) * L2_SIZE
;
327 /* Don't use qemu_malloc because it may recurse. */
328 p
= mmap(0, len
, PROT_READ
| PROT_WRITE
,
329 MAP_PRIVATE
| MAP_ANONYMOUS
, -1, 0);
332 unsigned long addr
= h2g(p
);
333 page_set_flags(addr
& TARGET_PAGE_MASK
,
334 TARGET_PAGE_ALIGN(addr
+ len
),
338 p
= qemu_mallocz(sizeof(PageDesc
) * L2_SIZE
);
342 return p
+ (index
& (L2_SIZE
- 1));
345 static inline PageDesc
*page_find(target_ulong index
)
348 lp
= page_l1_map(index
);
355 return p
+ (index
& (L2_SIZE
- 1));
358 static PhysPageDesc
*phys_page_find_alloc(target_phys_addr_t index
, int alloc
)
363 p
= (void **)l1_phys_map
;
364 #if TARGET_PHYS_ADDR_SPACE_BITS > 32
366 #if TARGET_PHYS_ADDR_SPACE_BITS > (32 + L1_BITS)
367 #error unsupported TARGET_PHYS_ADDR_SPACE_BITS
369 lp
= p
+ ((index
>> (L1_BITS
+ L2_BITS
)) & (L1_SIZE
- 1));
372 /* allocate if not found */
375 p
= qemu_vmalloc(sizeof(void *) * L1_SIZE
);
376 memset(p
, 0, sizeof(void *) * L1_SIZE
);
380 lp
= p
+ ((index
>> L2_BITS
) & (L1_SIZE
- 1));
384 /* allocate if not found */
387 pd
= qemu_vmalloc(sizeof(PhysPageDesc
) * L2_SIZE
);
389 for (i
= 0; i
< L2_SIZE
; i
++) {
390 pd
[i
].phys_offset
= IO_MEM_UNASSIGNED
;
391 pd
[i
].region_offset
= (index
+ i
) << TARGET_PAGE_BITS
;
394 return ((PhysPageDesc
*)pd
) + (index
& (L2_SIZE
- 1));
397 static inline PhysPageDesc
*phys_page_find(target_phys_addr_t index
)
399 return phys_page_find_alloc(index
, 0);
402 #if !defined(CONFIG_USER_ONLY)
403 static void tlb_protect_code(ram_addr_t ram_addr
);
404 static void tlb_unprotect_code_phys(CPUState
*env
, ram_addr_t ram_addr
,
406 #define mmap_lock() do { } while(0)
407 #define mmap_unlock() do { } while(0)
410 #define DEFAULT_CODE_GEN_BUFFER_SIZE (32 * 1024 * 1024)
412 #if defined(CONFIG_USER_ONLY)
413 /* Currently it is not recommended to allocate big chunks of data in
414 user mode. It will change when a dedicated libc will be used */
415 #define USE_STATIC_CODE_GEN_BUFFER
418 #ifdef USE_STATIC_CODE_GEN_BUFFER
419 static uint8_t static_code_gen_buffer
[DEFAULT_CODE_GEN_BUFFER_SIZE
];
422 static void code_gen_alloc(unsigned long tb_size
)
427 #ifdef USE_STATIC_CODE_GEN_BUFFER
428 code_gen_buffer
= static_code_gen_buffer
;
429 code_gen_buffer_size
= DEFAULT_CODE_GEN_BUFFER_SIZE
;
430 map_exec(code_gen_buffer
, code_gen_buffer_size
);
432 code_gen_buffer_size
= tb_size
;
433 if (code_gen_buffer_size
== 0) {
434 #if defined(CONFIG_USER_ONLY)
435 /* in user mode, phys_ram_size is not meaningful */
436 code_gen_buffer_size
= DEFAULT_CODE_GEN_BUFFER_SIZE
;
438 /* XXX: needs adjustments */
439 code_gen_buffer_size
= (unsigned long)(ram_size
/ 4);
442 if (code_gen_buffer_size
< MIN_CODE_GEN_BUFFER_SIZE
)
443 code_gen_buffer_size
= MIN_CODE_GEN_BUFFER_SIZE
;
444 /* The code gen buffer location may have constraints depending on
445 the host cpu and OS */
446 #if defined(__linux__)
451 flags
= MAP_PRIVATE
| MAP_ANONYMOUS
;
452 #if defined(__x86_64__)
454 /* Cannot map more than that */
455 if (code_gen_buffer_size
> (800 * 1024 * 1024))
456 code_gen_buffer_size
= (800 * 1024 * 1024);
457 #elif defined(__sparc_v9__)
458 // Map the buffer below 2G, so we can use direct calls and branches
460 start
= (void *) 0x60000000UL
;
461 if (code_gen_buffer_size
> (512 * 1024 * 1024))
462 code_gen_buffer_size
= (512 * 1024 * 1024);
463 #elif defined(__arm__)
464 /* Map the buffer below 32M, so we can use direct calls and branches */
466 start
= (void *) 0x01000000UL
;
467 if (code_gen_buffer_size
> 16 * 1024 * 1024)
468 code_gen_buffer_size
= 16 * 1024 * 1024;
470 code_gen_buffer
= mmap(start
, code_gen_buffer_size
,
471 PROT_WRITE
| PROT_READ
| PROT_EXEC
,
473 if (code_gen_buffer
== MAP_FAILED
) {
474 fprintf(stderr
, "Could not allocate dynamic translator buffer\n");
478 #elif defined(__FreeBSD__) || defined(__DragonFly__)
482 flags
= MAP_PRIVATE
| MAP_ANONYMOUS
;
483 #if defined(__x86_64__)
484 /* FreeBSD doesn't have MAP_32BIT, use MAP_FIXED and assume
485 * 0x40000000 is free */
487 addr
= (void *)0x40000000;
488 /* Cannot map more than that */
489 if (code_gen_buffer_size
> (800 * 1024 * 1024))
490 code_gen_buffer_size
= (800 * 1024 * 1024);
492 code_gen_buffer
= mmap(addr
, code_gen_buffer_size
,
493 PROT_WRITE
| PROT_READ
| PROT_EXEC
,
495 if (code_gen_buffer
== MAP_FAILED
) {
496 fprintf(stderr
, "Could not allocate dynamic translator buffer\n");
501 code_gen_buffer
= qemu_malloc(code_gen_buffer_size
);
502 map_exec(code_gen_buffer
, code_gen_buffer_size
);
504 #endif /* !USE_STATIC_CODE_GEN_BUFFER */
505 map_exec(code_gen_prologue
, sizeof(code_gen_prologue
));
506 code_gen_buffer_max_size
= code_gen_buffer_size
-
507 code_gen_max_block_size();
508 code_gen_max_blocks
= code_gen_buffer_size
/ CODE_GEN_AVG_BLOCK_SIZE
;
509 tbs
= qemu_malloc(code_gen_max_blocks
* sizeof(TranslationBlock
));
512 /* Must be called before using the QEMU cpus. 'tb_size' is the size
513 (in bytes) allocated to the translation buffer. Zero means default
515 void cpu_exec_init_all(unsigned long tb_size
)
518 code_gen_alloc(tb_size
);
519 code_gen_ptr
= code_gen_buffer
;
521 #if !defined(CONFIG_USER_ONLY)
526 #if defined(CPU_SAVE_VERSION) && !defined(CONFIG_USER_ONLY)
528 #define CPU_COMMON_SAVE_VERSION 1
530 static void cpu_common_save(QEMUFile
*f
, void *opaque
)
532 CPUState
*env
= opaque
;
534 cpu_synchronize_state(env
, 0);
536 qemu_put_be32s(f
, &env
->halted
);
537 qemu_put_be32s(f
, &env
->interrupt_request
);
540 static int cpu_common_load(QEMUFile
*f
, void *opaque
, int version_id
)
542 CPUState
*env
= opaque
;
544 if (version_id
!= CPU_COMMON_SAVE_VERSION
)
547 qemu_get_be32s(f
, &env
->halted
);
548 qemu_get_be32s(f
, &env
->interrupt_request
);
549 /* 0x01 was CPU_INTERRUPT_EXIT. This line can be removed when the
550 version_id is increased. */
551 env
->interrupt_request
&= ~0x01;
553 cpu_synchronize_state(env
, 1);
559 CPUState
*qemu_get_cpu(int cpu
)
561 CPUState
*env
= first_cpu
;
564 if (env
->cpu_index
== cpu
)
572 void cpu_exec_init(CPUState
*env
)
577 #if defined(CONFIG_USER_ONLY)
580 env
->next_cpu
= NULL
;
583 while (*penv
!= NULL
) {
584 penv
= &(*penv
)->next_cpu
;
587 env
->cpu_index
= cpu_index
;
589 TAILQ_INIT(&env
->breakpoints
);
590 TAILQ_INIT(&env
->watchpoints
);
592 env
->thread_id
= GetCurrentProcessId();
594 env
->thread_id
= getpid();
597 #if defined(CONFIG_USER_ONLY)
600 #if defined(CPU_SAVE_VERSION) && !defined(CONFIG_USER_ONLY)
601 register_savevm("cpu_common", cpu_index
, CPU_COMMON_SAVE_VERSION
,
602 cpu_common_save
, cpu_common_load
, env
);
603 register_savevm("cpu", cpu_index
, CPU_SAVE_VERSION
,
604 cpu_save
, cpu_load
, env
);
608 static inline void invalidate_page_bitmap(PageDesc
*p
)
610 if (p
->code_bitmap
) {
611 qemu_free(p
->code_bitmap
);
612 p
->code_bitmap
= NULL
;
614 p
->code_write_count
= 0;
617 /* set to NULL all the 'first_tb' fields in all PageDescs */
618 static void page_flush_tb(void)
623 for(i
= 0; i
< L1_SIZE
; i
++) {
626 for(j
= 0; j
< L2_SIZE
; j
++) {
628 invalidate_page_bitmap(p
);
635 /* flush all the translation blocks */
636 /* XXX: tb_flush is currently not thread safe */
637 void tb_flush(CPUState
*env1
)
640 #if defined(DEBUG_FLUSH)
641 printf("qemu: flush code_size=%ld nb_tbs=%d avg_tb_size=%ld\n",
642 (unsigned long)(code_gen_ptr
- code_gen_buffer
),
644 ((unsigned long)(code_gen_ptr
- code_gen_buffer
)) / nb_tbs
: 0);
646 if ((unsigned long)(code_gen_ptr
- code_gen_buffer
) > code_gen_buffer_size
)
647 cpu_abort(env1
, "Internal error: code buffer overflow\n");
651 for(env
= first_cpu
; env
!= NULL
; env
= env
->next_cpu
) {
652 memset (env
->tb_jmp_cache
, 0, TB_JMP_CACHE_SIZE
* sizeof (void *));
655 memset (tb_phys_hash
, 0, CODE_GEN_PHYS_HASH_SIZE
* sizeof (void *));
658 code_gen_ptr
= code_gen_buffer
;
659 /* XXX: flush processor icache at this point if cache flush is
664 #ifdef DEBUG_TB_CHECK
666 static void tb_invalidate_check(target_ulong address
)
668 TranslationBlock
*tb
;
670 address
&= TARGET_PAGE_MASK
;
671 for(i
= 0;i
< CODE_GEN_PHYS_HASH_SIZE
; i
++) {
672 for(tb
= tb_phys_hash
[i
]; tb
!= NULL
; tb
= tb
->phys_hash_next
) {
673 if (!(address
+ TARGET_PAGE_SIZE
<= tb
->pc
||
674 address
>= tb
->pc
+ tb
->size
)) {
675 printf("ERROR invalidate: address=" TARGET_FMT_lx
676 " PC=%08lx size=%04x\n",
677 address
, (long)tb
->pc
, tb
->size
);
683 /* verify that all the pages have correct rights for code */
684 static void tb_page_check(void)
686 TranslationBlock
*tb
;
687 int i
, flags1
, flags2
;
689 for(i
= 0;i
< CODE_GEN_PHYS_HASH_SIZE
; i
++) {
690 for(tb
= tb_phys_hash
[i
]; tb
!= NULL
; tb
= tb
->phys_hash_next
) {
691 flags1
= page_get_flags(tb
->pc
);
692 flags2
= page_get_flags(tb
->pc
+ tb
->size
- 1);
693 if ((flags1
& PAGE_WRITE
) || (flags2
& PAGE_WRITE
)) {
694 printf("ERROR page flags: PC=%08lx size=%04x f1=%x f2=%x\n",
695 (long)tb
->pc
, tb
->size
, flags1
, flags2
);
703 /* invalidate one TB */
704 static inline void tb_remove(TranslationBlock
**ptb
, TranslationBlock
*tb
,
707 TranslationBlock
*tb1
;
711 *ptb
= *(TranslationBlock
**)((char *)tb1
+ next_offset
);
714 ptb
= (TranslationBlock
**)((char *)tb1
+ next_offset
);
718 static inline void tb_page_remove(TranslationBlock
**ptb
, TranslationBlock
*tb
)
720 TranslationBlock
*tb1
;
726 tb1
= (TranslationBlock
*)((long)tb1
& ~3);
728 *ptb
= tb1
->page_next
[n1
];
731 ptb
= &tb1
->page_next
[n1
];
735 static inline void tb_jmp_remove(TranslationBlock
*tb
, int n
)
737 TranslationBlock
*tb1
, **ptb
;
740 ptb
= &tb
->jmp_next
[n
];
743 /* find tb(n) in circular list */
747 tb1
= (TranslationBlock
*)((long)tb1
& ~3);
748 if (n1
== n
&& tb1
== tb
)
751 ptb
= &tb1
->jmp_first
;
753 ptb
= &tb1
->jmp_next
[n1
];
756 /* now we can suppress tb(n) from the list */
757 *ptb
= tb
->jmp_next
[n
];
759 tb
->jmp_next
[n
] = NULL
;
763 /* reset the jump entry 'n' of a TB so that it is not chained to
765 static inline void tb_reset_jump(TranslationBlock
*tb
, int n
)
767 tb_set_jmp_target(tb
, n
, (unsigned long)(tb
->tc_ptr
+ tb
->tb_next_offset
[n
]));
770 void tb_phys_invalidate(TranslationBlock
*tb
, target_ulong page_addr
)
775 target_phys_addr_t phys_pc
;
776 TranslationBlock
*tb1
, *tb2
;
778 /* remove the TB from the hash list */
779 phys_pc
= tb
->page_addr
[0] + (tb
->pc
& ~TARGET_PAGE_MASK
);
780 h
= tb_phys_hash_func(phys_pc
);
781 tb_remove(&tb_phys_hash
[h
], tb
,
782 offsetof(TranslationBlock
, phys_hash_next
));
784 /* remove the TB from the page list */
785 if (tb
->page_addr
[0] != page_addr
) {
786 p
= page_find(tb
->page_addr
[0] >> TARGET_PAGE_BITS
);
787 tb_page_remove(&p
->first_tb
, tb
);
788 invalidate_page_bitmap(p
);
790 if (tb
->page_addr
[1] != -1 && tb
->page_addr
[1] != page_addr
) {
791 p
= page_find(tb
->page_addr
[1] >> TARGET_PAGE_BITS
);
792 tb_page_remove(&p
->first_tb
, tb
);
793 invalidate_page_bitmap(p
);
796 tb_invalidated_flag
= 1;
798 /* remove the TB from the hash list */
799 h
= tb_jmp_cache_hash_func(tb
->pc
);
800 for(env
= first_cpu
; env
!= NULL
; env
= env
->next_cpu
) {
801 if (env
->tb_jmp_cache
[h
] == tb
)
802 env
->tb_jmp_cache
[h
] = NULL
;
805 /* suppress this TB from the two jump lists */
806 tb_jmp_remove(tb
, 0);
807 tb_jmp_remove(tb
, 1);
809 /* suppress any remaining jumps to this TB */
815 tb1
= (TranslationBlock
*)((long)tb1
& ~3);
816 tb2
= tb1
->jmp_next
[n1
];
817 tb_reset_jump(tb1
, n1
);
818 tb1
->jmp_next
[n1
] = NULL
;
821 tb
->jmp_first
= (TranslationBlock
*)((long)tb
| 2); /* fail safe */
823 tb_phys_invalidate_count
++;
826 static inline void set_bits(uint8_t *tab
, int start
, int len
)
832 mask
= 0xff << (start
& 7);
833 if ((start
& ~7) == (end
& ~7)) {
835 mask
&= ~(0xff << (end
& 7));
840 start
= (start
+ 8) & ~7;
842 while (start
< end1
) {
847 mask
= ~(0xff << (end
& 7));
853 static void build_page_bitmap(PageDesc
*p
)
855 int n
, tb_start
, tb_end
;
856 TranslationBlock
*tb
;
858 p
->code_bitmap
= qemu_mallocz(TARGET_PAGE_SIZE
/ 8);
863 tb
= (TranslationBlock
*)((long)tb
& ~3);
864 /* NOTE: this is subtle as a TB may span two physical pages */
866 /* NOTE: tb_end may be after the end of the page, but
867 it is not a problem */
868 tb_start
= tb
->pc
& ~TARGET_PAGE_MASK
;
869 tb_end
= tb_start
+ tb
->size
;
870 if (tb_end
> TARGET_PAGE_SIZE
)
871 tb_end
= TARGET_PAGE_SIZE
;
874 tb_end
= ((tb
->pc
+ tb
->size
) & ~TARGET_PAGE_MASK
);
876 set_bits(p
->code_bitmap
, tb_start
, tb_end
- tb_start
);
877 tb
= tb
->page_next
[n
];
881 TranslationBlock
*tb_gen_code(CPUState
*env
,
882 target_ulong pc
, target_ulong cs_base
,
883 int flags
, int cflags
)
885 TranslationBlock
*tb
;
887 target_ulong phys_pc
, phys_page2
, virt_page2
;
890 phys_pc
= get_phys_addr_code(env
, pc
);
893 /* flush must be done */
895 /* cannot fail at this point */
897 /* Don't forget to invalidate previous TB info. */
898 tb_invalidated_flag
= 1;
900 tc_ptr
= code_gen_ptr
;
902 tb
->cs_base
= cs_base
;
905 cpu_gen_code(env
, tb
, &code_gen_size
);
906 code_gen_ptr
= (void *)(((unsigned long)code_gen_ptr
+ code_gen_size
+ CODE_GEN_ALIGN
- 1) & ~(CODE_GEN_ALIGN
- 1));
908 /* check next page if needed */
909 virt_page2
= (pc
+ tb
->size
- 1) & TARGET_PAGE_MASK
;
911 if ((pc
& TARGET_PAGE_MASK
) != virt_page2
) {
912 phys_page2
= get_phys_addr_code(env
, virt_page2
);
914 tb_link_phys(tb
, phys_pc
, phys_page2
);
918 /* invalidate all TBs which intersect with the target physical page
919 starting in range [start;end[. NOTE: start and end must refer to
920 the same physical page. 'is_cpu_write_access' should be true if called
921 from a real cpu write access: the virtual CPU will exit the current
922 TB if code is modified inside this TB. */
923 void tb_invalidate_phys_page_range(target_phys_addr_t start
, target_phys_addr_t end
,
924 int is_cpu_write_access
)
926 TranslationBlock
*tb
, *tb_next
, *saved_tb
;
927 CPUState
*env
= cpu_single_env
;
928 target_ulong tb_start
, tb_end
;
931 #ifdef TARGET_HAS_PRECISE_SMC
932 int current_tb_not_found
= is_cpu_write_access
;
933 TranslationBlock
*current_tb
= NULL
;
934 int current_tb_modified
= 0;
935 target_ulong current_pc
= 0;
936 target_ulong current_cs_base
= 0;
937 int current_flags
= 0;
938 #endif /* TARGET_HAS_PRECISE_SMC */
940 p
= page_find(start
>> TARGET_PAGE_BITS
);
943 if (!p
->code_bitmap
&&
944 ++p
->code_write_count
>= SMC_BITMAP_USE_THRESHOLD
&&
945 is_cpu_write_access
) {
946 /* build code bitmap */
947 build_page_bitmap(p
);
950 /* we remove all the TBs in the range [start, end[ */
951 /* XXX: see if in some cases it could be faster to invalidate all the code */
955 tb
= (TranslationBlock
*)((long)tb
& ~3);
956 tb_next
= tb
->page_next
[n
];
957 /* NOTE: this is subtle as a TB may span two physical pages */
959 /* NOTE: tb_end may be after the end of the page, but
960 it is not a problem */
961 tb_start
= tb
->page_addr
[0] + (tb
->pc
& ~TARGET_PAGE_MASK
);
962 tb_end
= tb_start
+ tb
->size
;
964 tb_start
= tb
->page_addr
[1];
965 tb_end
= tb_start
+ ((tb
->pc
+ tb
->size
) & ~TARGET_PAGE_MASK
);
967 if (!(tb_end
<= start
|| tb_start
>= end
)) {
968 #ifdef TARGET_HAS_PRECISE_SMC
969 if (current_tb_not_found
) {
970 current_tb_not_found
= 0;
972 if (env
->mem_io_pc
) {
973 /* now we have a real cpu fault */
974 current_tb
= tb_find_pc(env
->mem_io_pc
);
977 if (current_tb
== tb
&&
978 (current_tb
->cflags
& CF_COUNT_MASK
) != 1) {
979 /* If we are modifying the current TB, we must stop
980 its execution. We could be more precise by checking
981 that the modification is after the current PC, but it
982 would require a specialized function to partially
983 restore the CPU state */
985 current_tb_modified
= 1;
986 cpu_restore_state(current_tb
, env
,
987 env
->mem_io_pc
, NULL
);
988 cpu_get_tb_cpu_state(env
, ¤t_pc
, ¤t_cs_base
,
991 #endif /* TARGET_HAS_PRECISE_SMC */
992 /* we need to do that to handle the case where a signal
993 occurs while doing tb_phys_invalidate() */
996 saved_tb
= env
->current_tb
;
997 env
->current_tb
= NULL
;
999 tb_phys_invalidate(tb
, -1);
1001 env
->current_tb
= saved_tb
;
1002 if (env
->interrupt_request
&& env
->current_tb
)
1003 cpu_interrupt(env
, env
->interrupt_request
);
1008 #if !defined(CONFIG_USER_ONLY)
1009 /* if no code remaining, no need to continue to use slow writes */
1011 invalidate_page_bitmap(p
);
1012 if (is_cpu_write_access
) {
1013 tlb_unprotect_code_phys(env
, start
, env
->mem_io_vaddr
);
1017 #ifdef TARGET_HAS_PRECISE_SMC
1018 if (current_tb_modified
) {
1019 /* we generate a block containing just the instruction
1020 modifying the memory. It will ensure that it cannot modify
1022 env
->current_tb
= NULL
;
1023 tb_gen_code(env
, current_pc
, current_cs_base
, current_flags
, 1);
1024 cpu_resume_from_signal(env
, NULL
);
1029 /* len must be <= 8 and start must be a multiple of len */
1030 static inline void tb_invalidate_phys_page_fast(target_phys_addr_t start
, int len
)
1036 qemu_log("modifying code at 0x%x size=%d EIP=%x PC=%08x\n",
1037 cpu_single_env
->mem_io_vaddr
, len
,
1038 cpu_single_env
->eip
,
1039 cpu_single_env
->eip
+ (long)cpu_single_env
->segs
[R_CS
].base
);
1042 p
= page_find(start
>> TARGET_PAGE_BITS
);
1045 if (p
->code_bitmap
) {
1046 offset
= start
& ~TARGET_PAGE_MASK
;
1047 b
= p
->code_bitmap
[offset
>> 3] >> (offset
& 7);
1048 if (b
& ((1 << len
) - 1))
1052 tb_invalidate_phys_page_range(start
, start
+ len
, 1);
1056 #if !defined(CONFIG_SOFTMMU)
1057 static void tb_invalidate_phys_page(target_phys_addr_t addr
,
1058 unsigned long pc
, void *puc
)
1060 TranslationBlock
*tb
;
1063 #ifdef TARGET_HAS_PRECISE_SMC
1064 TranslationBlock
*current_tb
= NULL
;
1065 CPUState
*env
= cpu_single_env
;
1066 int current_tb_modified
= 0;
1067 target_ulong current_pc
= 0;
1068 target_ulong current_cs_base
= 0;
1069 int current_flags
= 0;
1072 addr
&= TARGET_PAGE_MASK
;
1073 p
= page_find(addr
>> TARGET_PAGE_BITS
);
1077 #ifdef TARGET_HAS_PRECISE_SMC
1078 if (tb
&& pc
!= 0) {
1079 current_tb
= tb_find_pc(pc
);
1082 while (tb
!= NULL
) {
1084 tb
= (TranslationBlock
*)((long)tb
& ~3);
1085 #ifdef TARGET_HAS_PRECISE_SMC
1086 if (current_tb
== tb
&&
1087 (current_tb
->cflags
& CF_COUNT_MASK
) != 1) {
1088 /* If we are modifying the current TB, we must stop
1089 its execution. We could be more precise by checking
1090 that the modification is after the current PC, but it
1091 would require a specialized function to partially
1092 restore the CPU state */
1094 current_tb_modified
= 1;
1095 cpu_restore_state(current_tb
, env
, pc
, puc
);
1096 cpu_get_tb_cpu_state(env
, ¤t_pc
, ¤t_cs_base
,
1099 #endif /* TARGET_HAS_PRECISE_SMC */
1100 tb_phys_invalidate(tb
, addr
);
1101 tb
= tb
->page_next
[n
];
1104 #ifdef TARGET_HAS_PRECISE_SMC
1105 if (current_tb_modified
) {
1106 /* we generate a block containing just the instruction
1107 modifying the memory. It will ensure that it cannot modify
1109 env
->current_tb
= NULL
;
1110 tb_gen_code(env
, current_pc
, current_cs_base
, current_flags
, 1);
1111 cpu_resume_from_signal(env
, puc
);
1117 /* add the tb in the target page and protect it if necessary */
1118 static inline void tb_alloc_page(TranslationBlock
*tb
,
1119 unsigned int n
, target_ulong page_addr
)
1122 TranslationBlock
*last_first_tb
;
1124 tb
->page_addr
[n
] = page_addr
;
1125 p
= page_find_alloc(page_addr
>> TARGET_PAGE_BITS
);
1126 tb
->page_next
[n
] = p
->first_tb
;
1127 last_first_tb
= p
->first_tb
;
1128 p
->first_tb
= (TranslationBlock
*)((long)tb
| n
);
1129 invalidate_page_bitmap(p
);
1131 #if defined(TARGET_HAS_SMC) || 1
1133 #if defined(CONFIG_USER_ONLY)
1134 if (p
->flags
& PAGE_WRITE
) {
1139 /* force the host page as non writable (writes will have a
1140 page fault + mprotect overhead) */
1141 page_addr
&= qemu_host_page_mask
;
1143 for(addr
= page_addr
; addr
< page_addr
+ qemu_host_page_size
;
1144 addr
+= TARGET_PAGE_SIZE
) {
1146 p2
= page_find (addr
>> TARGET_PAGE_BITS
);
1150 p2
->flags
&= ~PAGE_WRITE
;
1151 page_get_flags(addr
);
1153 mprotect(g2h(page_addr
), qemu_host_page_size
,
1154 (prot
& PAGE_BITS
) & ~PAGE_WRITE
);
1155 #ifdef DEBUG_TB_INVALIDATE
1156 printf("protecting code page: 0x" TARGET_FMT_lx
"\n",
1161 /* if some code is already present, then the pages are already
1162 protected. So we handle the case where only the first TB is
1163 allocated in a physical page */
1164 if (!last_first_tb
) {
1165 tlb_protect_code(page_addr
);
1169 #endif /* TARGET_HAS_SMC */
1172 /* Allocate a new translation block. Flush the translation buffer if
1173 too many translation blocks or too much generated code. */
1174 TranslationBlock
*tb_alloc(target_ulong pc
)
1176 TranslationBlock
*tb
;
1178 if (nb_tbs
>= code_gen_max_blocks
||
1179 (code_gen_ptr
- code_gen_buffer
) >= code_gen_buffer_max_size
)
1181 tb
= &tbs
[nb_tbs
++];
1187 void tb_free(TranslationBlock
*tb
)
1189 /* In practice this is mostly used for single use temporary TB
1190 Ignore the hard cases and just back up if this TB happens to
1191 be the last one generated. */
1192 if (nb_tbs
> 0 && tb
== &tbs
[nb_tbs
- 1]) {
1193 code_gen_ptr
= tb
->tc_ptr
;
1198 /* add a new TB and link it to the physical page tables. phys_page2 is
1199 (-1) to indicate that only one page contains the TB. */
1200 void tb_link_phys(TranslationBlock
*tb
,
1201 target_ulong phys_pc
, target_ulong phys_page2
)
1204 TranslationBlock
**ptb
;
1206 /* Grab the mmap lock to stop another thread invalidating this TB
1207 before we are done. */
1209 /* add in the physical hash table */
1210 h
= tb_phys_hash_func(phys_pc
);
1211 ptb
= &tb_phys_hash
[h
];
1212 tb
->phys_hash_next
= *ptb
;
1215 /* add in the page list */
1216 tb_alloc_page(tb
, 0, phys_pc
& TARGET_PAGE_MASK
);
1217 if (phys_page2
!= -1)
1218 tb_alloc_page(tb
, 1, phys_page2
);
1220 tb
->page_addr
[1] = -1;
1222 tb
->jmp_first
= (TranslationBlock
*)((long)tb
| 2);
1223 tb
->jmp_next
[0] = NULL
;
1224 tb
->jmp_next
[1] = NULL
;
1226 /* init original jump addresses */
1227 if (tb
->tb_next_offset
[0] != 0xffff)
1228 tb_reset_jump(tb
, 0);
1229 if (tb
->tb_next_offset
[1] != 0xffff)
1230 tb_reset_jump(tb
, 1);
1232 #ifdef DEBUG_TB_CHECK
1238 /* find the TB 'tb' such that tb[0].tc_ptr <= tc_ptr <
1239 tb[1].tc_ptr. Return NULL if not found */
1240 TranslationBlock
*tb_find_pc(unsigned long tc_ptr
)
1242 int m_min
, m_max
, m
;
1244 TranslationBlock
*tb
;
1248 if (tc_ptr
< (unsigned long)code_gen_buffer
||
1249 tc_ptr
>= (unsigned long)code_gen_ptr
)
1251 /* binary search (cf Knuth) */
1254 while (m_min
<= m_max
) {
1255 m
= (m_min
+ m_max
) >> 1;
1257 v
= (unsigned long)tb
->tc_ptr
;
1260 else if (tc_ptr
< v
) {
1269 static void tb_reset_jump_recursive(TranslationBlock
*tb
);
1271 static inline void tb_reset_jump_recursive2(TranslationBlock
*tb
, int n
)
1273 TranslationBlock
*tb1
, *tb_next
, **ptb
;
1276 tb1
= tb
->jmp_next
[n
];
1278 /* find head of list */
1281 tb1
= (TranslationBlock
*)((long)tb1
& ~3);
1284 tb1
= tb1
->jmp_next
[n1
];
1286 /* we are now sure now that tb jumps to tb1 */
1289 /* remove tb from the jmp_first list */
1290 ptb
= &tb_next
->jmp_first
;
1294 tb1
= (TranslationBlock
*)((long)tb1
& ~3);
1295 if (n1
== n
&& tb1
== tb
)
1297 ptb
= &tb1
->jmp_next
[n1
];
1299 *ptb
= tb
->jmp_next
[n
];
1300 tb
->jmp_next
[n
] = NULL
;
1302 /* suppress the jump to next tb in generated code */
1303 tb_reset_jump(tb
, n
);
1305 /* suppress jumps in the tb on which we could have jumped */
1306 tb_reset_jump_recursive(tb_next
);
1310 static void tb_reset_jump_recursive(TranslationBlock
*tb
)
1312 tb_reset_jump_recursive2(tb
, 0);
1313 tb_reset_jump_recursive2(tb
, 1);
1316 #if defined(TARGET_HAS_ICE)
1317 static void breakpoint_invalidate(CPUState
*env
, target_ulong pc
)
1319 target_phys_addr_t addr
;
1321 ram_addr_t ram_addr
;
1324 addr
= cpu_get_phys_page_debug(env
, pc
);
1325 p
= phys_page_find(addr
>> TARGET_PAGE_BITS
);
1327 pd
= IO_MEM_UNASSIGNED
;
1329 pd
= p
->phys_offset
;
1331 ram_addr
= (pd
& TARGET_PAGE_MASK
) | (pc
& ~TARGET_PAGE_MASK
);
1332 tb_invalidate_phys_page_range(ram_addr
, ram_addr
+ 1, 0);
1336 /* Add a watchpoint. */
1337 int cpu_watchpoint_insert(CPUState
*env
, target_ulong addr
, target_ulong len
,
1338 int flags
, CPUWatchpoint
**watchpoint
)
1340 target_ulong len_mask
= ~(len
- 1);
1343 /* sanity checks: allow power-of-2 lengths, deny unaligned watchpoints */
1344 if ((len
!= 1 && len
!= 2 && len
!= 4 && len
!= 8) || (addr
& ~len_mask
)) {
1345 fprintf(stderr
, "qemu: tried to set invalid watchpoint at "
1346 TARGET_FMT_lx
", len=" TARGET_FMT_lu
"\n", addr
, len
);
1349 wp
= qemu_malloc(sizeof(*wp
));
1352 wp
->len_mask
= len_mask
;
1355 /* keep all GDB-injected watchpoints in front */
1357 TAILQ_INSERT_HEAD(&env
->watchpoints
, wp
, entry
);
1359 TAILQ_INSERT_TAIL(&env
->watchpoints
, wp
, entry
);
1361 tlb_flush_page(env
, addr
);
1368 /* Remove a specific watchpoint. */
1369 int cpu_watchpoint_remove(CPUState
*env
, target_ulong addr
, target_ulong len
,
1372 target_ulong len_mask
= ~(len
- 1);
1375 TAILQ_FOREACH(wp
, &env
->watchpoints
, entry
) {
1376 if (addr
== wp
->vaddr
&& len_mask
== wp
->len_mask
1377 && flags
== (wp
->flags
& ~BP_WATCHPOINT_HIT
)) {
1378 cpu_watchpoint_remove_by_ref(env
, wp
);
1385 /* Remove a specific watchpoint by reference. */
1386 void cpu_watchpoint_remove_by_ref(CPUState
*env
, CPUWatchpoint
*watchpoint
)
1388 TAILQ_REMOVE(&env
->watchpoints
, watchpoint
, entry
);
1390 tlb_flush_page(env
, watchpoint
->vaddr
);
1392 qemu_free(watchpoint
);
1395 /* Remove all matching watchpoints. */
1396 void cpu_watchpoint_remove_all(CPUState
*env
, int mask
)
1398 CPUWatchpoint
*wp
, *next
;
1400 TAILQ_FOREACH_SAFE(wp
, &env
->watchpoints
, entry
, next
) {
1401 if (wp
->flags
& mask
)
1402 cpu_watchpoint_remove_by_ref(env
, wp
);
1406 /* Add a breakpoint. */
1407 int cpu_breakpoint_insert(CPUState
*env
, target_ulong pc
, int flags
,
1408 CPUBreakpoint
**breakpoint
)
1410 #if defined(TARGET_HAS_ICE)
1413 bp
= qemu_malloc(sizeof(*bp
));
1418 /* keep all GDB-injected breakpoints in front */
1420 TAILQ_INSERT_HEAD(&env
->breakpoints
, bp
, entry
);
1422 TAILQ_INSERT_TAIL(&env
->breakpoints
, bp
, entry
);
1424 breakpoint_invalidate(env
, pc
);
1434 /* Remove a specific breakpoint. */
1435 int cpu_breakpoint_remove(CPUState
*env
, target_ulong pc
, int flags
)
1437 #if defined(TARGET_HAS_ICE)
1440 TAILQ_FOREACH(bp
, &env
->breakpoints
, entry
) {
1441 if (bp
->pc
== pc
&& bp
->flags
== flags
) {
1442 cpu_breakpoint_remove_by_ref(env
, bp
);
1452 /* Remove a specific breakpoint by reference. */
1453 void cpu_breakpoint_remove_by_ref(CPUState
*env
, CPUBreakpoint
*breakpoint
)
1455 #if defined(TARGET_HAS_ICE)
1456 TAILQ_REMOVE(&env
->breakpoints
, breakpoint
, entry
);
1458 breakpoint_invalidate(env
, breakpoint
->pc
);
1460 qemu_free(breakpoint
);
1464 /* Remove all matching breakpoints. */
1465 void cpu_breakpoint_remove_all(CPUState
*env
, int mask
)
1467 #if defined(TARGET_HAS_ICE)
1468 CPUBreakpoint
*bp
, *next
;
1470 TAILQ_FOREACH_SAFE(bp
, &env
->breakpoints
, entry
, next
) {
1471 if (bp
->flags
& mask
)
1472 cpu_breakpoint_remove_by_ref(env
, bp
);
1477 /* enable or disable single step mode. EXCP_DEBUG is returned by the
1478 CPU loop after each instruction */
1479 void cpu_single_step(CPUState
*env
, int enabled
)
1481 #if defined(TARGET_HAS_ICE)
1482 if (env
->singlestep_enabled
!= enabled
) {
1483 env
->singlestep_enabled
= enabled
;
1485 kvm_update_guest_debug(env
, 0);
1487 /* must flush all the translated code to avoid inconsistencies */
1488 /* XXX: only flush what is necessary */
1495 /* enable or disable low levels log */
1496 void cpu_set_log(int log_flags
)
1498 loglevel
= log_flags
;
1499 if (loglevel
&& !logfile
) {
1500 logfile
= fopen(logfilename
, log_append
? "a" : "w");
1502 perror(logfilename
);
1505 #if !defined(CONFIG_SOFTMMU)
1506 /* must avoid mmap() usage of glibc by setting a buffer "by hand" */
1508 static char logfile_buf
[4096];
1509 setvbuf(logfile
, logfile_buf
, _IOLBF
, sizeof(logfile_buf
));
1512 setvbuf(logfile
, NULL
, _IOLBF
, 0);
1516 if (!loglevel
&& logfile
) {
1522 void cpu_set_log_filename(const char *filename
)
1524 logfilename
= strdup(filename
);
1529 cpu_set_log(loglevel
);
1532 static void cpu_unlink_tb(CPUState
*env
)
1534 #if defined(USE_NPTL)
1535 /* FIXME: TB unchaining isn't SMP safe. For now just ignore the
1536 problem and hope the cpu will stop of its own accord. For userspace
1537 emulation this often isn't actually as bad as it sounds. Often
1538 signals are used primarily to interrupt blocking syscalls. */
1540 TranslationBlock
*tb
;
1541 static spinlock_t interrupt_lock
= SPIN_LOCK_UNLOCKED
;
1543 tb
= env
->current_tb
;
1544 /* if the cpu is currently executing code, we must unlink it and
1545 all the potentially executing TB */
1546 if (tb
&& !testandset(&interrupt_lock
)) {
1547 env
->current_tb
= NULL
;
1548 tb_reset_jump_recursive(tb
);
1549 resetlock(&interrupt_lock
);
1554 /* mask must never be zero, except for A20 change call */
1555 void cpu_interrupt(CPUState
*env
, int mask
)
1559 old_mask
= env
->interrupt_request
;
1560 env
->interrupt_request
|= mask
;
1561 if (kvm_enabled() && !qemu_kvm_irqchip_in_kernel())
1562 kvm_update_interrupt_request(env
);
1564 #ifndef CONFIG_USER_ONLY
1566 * If called from iothread context, wake the target cpu in
1569 if (!qemu_cpu_self(env
)) {
1576 env
->icount_decr
.u16
.high
= 0xffff;
1577 #ifndef CONFIG_USER_ONLY
1579 && (mask
& ~old_mask
) != 0) {
1580 cpu_abort(env
, "Raised interrupt while not in I/O function");
1588 void cpu_reset_interrupt(CPUState
*env
, int mask
)
1590 env
->interrupt_request
&= ~mask
;
1593 void cpu_exit(CPUState
*env
)
1595 env
->exit_request
= 1;
1599 const CPULogItem cpu_log_items
[] = {
1600 { CPU_LOG_TB_OUT_ASM
, "out_asm",
1601 "show generated host assembly code for each compiled TB" },
1602 { CPU_LOG_TB_IN_ASM
, "in_asm",
1603 "show target assembly code for each compiled TB" },
1604 { CPU_LOG_TB_OP
, "op",
1605 "show micro ops for each compiled TB" },
1606 { CPU_LOG_TB_OP_OPT
, "op_opt",
1609 "before eflags optimization and "
1611 "after liveness analysis" },
1612 { CPU_LOG_INT
, "int",
1613 "show interrupts/exceptions in short format" },
1614 { CPU_LOG_EXEC
, "exec",
1615 "show trace before each executed TB (lots of logs)" },
1616 { CPU_LOG_TB_CPU
, "cpu",
1617 "show CPU state before block translation" },
1619 { CPU_LOG_PCALL
, "pcall",
1620 "show protected mode far calls/returns/exceptions" },
1621 { CPU_LOG_RESET
, "cpu_reset",
1622 "show CPU state before CPU resets" },
1625 { CPU_LOG_IOPORT
, "ioport",
1626 "show all i/o ports accesses" },
1631 static int cmp1(const char *s1
, int n
, const char *s2
)
1633 if (strlen(s2
) != n
)
1635 return memcmp(s1
, s2
, n
) == 0;
1638 /* takes a comma separated list of log masks. Return 0 if error. */
1639 int cpu_str_to_log_mask(const char *str
)
1641 const CPULogItem
*item
;
1648 p1
= strchr(p
, ',');
1651 if(cmp1(p
,p1
-p
,"all")) {
1652 for(item
= cpu_log_items
; item
->mask
!= 0; item
++) {
1656 for(item
= cpu_log_items
; item
->mask
!= 0; item
++) {
1657 if (cmp1(p
, p1
- p
, item
->name
))
1671 void cpu_abort(CPUState
*env
, const char *fmt
, ...)
1678 fprintf(stderr
, "qemu: fatal: ");
1679 vfprintf(stderr
, fmt
, ap
);
1680 fprintf(stderr
, "\n");
1682 cpu_dump_state(env
, stderr
, fprintf
, X86_DUMP_FPU
| X86_DUMP_CCOP
);
1684 cpu_dump_state(env
, stderr
, fprintf
, 0);
1686 if (qemu_log_enabled()) {
1687 qemu_log("qemu: fatal: ");
1688 qemu_log_vprintf(fmt
, ap2
);
1691 log_cpu_state(env
, X86_DUMP_FPU
| X86_DUMP_CCOP
);
1693 log_cpu_state(env
, 0);
1703 CPUState
*cpu_copy(CPUState
*env
)
1705 CPUState
*new_env
= cpu_init(env
->cpu_model_str
);
1706 CPUState
*next_cpu
= new_env
->next_cpu
;
1707 int cpu_index
= new_env
->cpu_index
;
1708 #if defined(TARGET_HAS_ICE)
1713 memcpy(new_env
, env
, sizeof(CPUState
));
1715 /* Preserve chaining and index. */
1716 new_env
->next_cpu
= next_cpu
;
1717 new_env
->cpu_index
= cpu_index
;
1719 /* Clone all break/watchpoints.
1720 Note: Once we support ptrace with hw-debug register access, make sure
1721 BP_CPU break/watchpoints are handled correctly on clone. */
1722 TAILQ_INIT(&env
->breakpoints
);
1723 TAILQ_INIT(&env
->watchpoints
);
1724 #if defined(TARGET_HAS_ICE)
1725 TAILQ_FOREACH(bp
, &env
->breakpoints
, entry
) {
1726 cpu_breakpoint_insert(new_env
, bp
->pc
, bp
->flags
, NULL
);
1728 TAILQ_FOREACH(wp
, &env
->watchpoints
, entry
) {
1729 cpu_watchpoint_insert(new_env
, wp
->vaddr
, (~wp
->len_mask
) + 1,
1737 #if !defined(CONFIG_USER_ONLY)
1739 static inline void tlb_flush_jmp_cache(CPUState
*env
, target_ulong addr
)
1743 /* Discard jump cache entries for any tb which might potentially
1744 overlap the flushed page. */
1745 i
= tb_jmp_cache_hash_page(addr
- TARGET_PAGE_SIZE
);
1746 memset (&env
->tb_jmp_cache
[i
], 0,
1747 TB_JMP_PAGE_SIZE
* sizeof(TranslationBlock
*));
1749 i
= tb_jmp_cache_hash_page(addr
);
1750 memset (&env
->tb_jmp_cache
[i
], 0,
1751 TB_JMP_PAGE_SIZE
* sizeof(TranslationBlock
*));
1754 static CPUTLBEntry s_cputlb_empty_entry
= {
1761 /* NOTE: if flush_global is true, also flush global entries (not
1763 void tlb_flush(CPUState
*env
, int flush_global
)
1767 #if defined(DEBUG_TLB)
1768 printf("tlb_flush:\n");
1770 /* must reset current TB so that interrupts cannot modify the
1771 links while we are modifying them */
1772 env
->current_tb
= NULL
;
1774 for(i
= 0; i
< CPU_TLB_SIZE
; i
++) {
1776 for (mmu_idx
= 0; mmu_idx
< NB_MMU_MODES
; mmu_idx
++) {
1777 env
->tlb_table
[mmu_idx
][i
] = s_cputlb_empty_entry
;
1781 memset (env
->tb_jmp_cache
, 0, TB_JMP_CACHE_SIZE
* sizeof (void *));
1784 if (env
->kqemu_enabled
) {
1785 kqemu_flush(env
, flush_global
);
1791 static inline void tlb_flush_entry(CPUTLBEntry
*tlb_entry
, target_ulong addr
)
1793 if (addr
== (tlb_entry
->addr_read
&
1794 (TARGET_PAGE_MASK
| TLB_INVALID_MASK
)) ||
1795 addr
== (tlb_entry
->addr_write
&
1796 (TARGET_PAGE_MASK
| TLB_INVALID_MASK
)) ||
1797 addr
== (tlb_entry
->addr_code
&
1798 (TARGET_PAGE_MASK
| TLB_INVALID_MASK
))) {
1799 *tlb_entry
= s_cputlb_empty_entry
;
1803 void tlb_flush_page(CPUState
*env
, target_ulong addr
)
1808 #if defined(DEBUG_TLB)
1809 printf("tlb_flush_page: " TARGET_FMT_lx
"\n", addr
);
1811 /* must reset current TB so that interrupts cannot modify the
1812 links while we are modifying them */
1813 env
->current_tb
= NULL
;
1815 addr
&= TARGET_PAGE_MASK
;
1816 i
= (addr
>> TARGET_PAGE_BITS
) & (CPU_TLB_SIZE
- 1);
1817 for (mmu_idx
= 0; mmu_idx
< NB_MMU_MODES
; mmu_idx
++)
1818 tlb_flush_entry(&env
->tlb_table
[mmu_idx
][i
], addr
);
1820 tlb_flush_jmp_cache(env
, addr
);
1823 if (env
->kqemu_enabled
) {
1824 kqemu_flush_page(env
, addr
);
1829 /* update the TLBs so that writes to code in the virtual page 'addr'
1831 static void tlb_protect_code(ram_addr_t ram_addr
)
1833 cpu_physical_memory_reset_dirty(ram_addr
,
1834 ram_addr
+ TARGET_PAGE_SIZE
,
1838 /* update the TLB so that writes in physical page 'phys_addr' are no longer
1839 tested for self modifying code */
1840 static void tlb_unprotect_code_phys(CPUState
*env
, ram_addr_t ram_addr
,
1843 phys_ram_dirty
[ram_addr
>> TARGET_PAGE_BITS
] |= CODE_DIRTY_FLAG
;
1846 static inline void tlb_reset_dirty_range(CPUTLBEntry
*tlb_entry
,
1847 unsigned long start
, unsigned long length
)
1850 if ((tlb_entry
->addr_write
& ~TARGET_PAGE_MASK
) == IO_MEM_RAM
) {
1851 addr
= (tlb_entry
->addr_write
& TARGET_PAGE_MASK
) + tlb_entry
->addend
;
1852 if ((addr
- start
) < length
) {
1853 tlb_entry
->addr_write
= (tlb_entry
->addr_write
& TARGET_PAGE_MASK
) | TLB_NOTDIRTY
;
1858 /* Note: start and end must be within the same ram block. */
1859 void cpu_physical_memory_reset_dirty(ram_addr_t start
, ram_addr_t end
,
1863 unsigned long length
, start1
;
1867 start
&= TARGET_PAGE_MASK
;
1868 end
= TARGET_PAGE_ALIGN(end
);
1870 length
= end
- start
;
1873 len
= length
>> TARGET_PAGE_BITS
;
1875 /* XXX: should not depend on cpu context */
1877 if (env
->kqemu_enabled
) {
1880 for(i
= 0; i
< len
; i
++) {
1881 kqemu_set_notdirty(env
, addr
);
1882 addr
+= TARGET_PAGE_SIZE
;
1886 mask
= ~dirty_flags
;
1887 p
= phys_ram_dirty
+ (start
>> TARGET_PAGE_BITS
);
1888 for(i
= 0; i
< len
; i
++)
1891 /* we modify the TLB cache so that the dirty bit will be set again
1892 when accessing the range */
1893 start1
= (unsigned long)qemu_get_ram_ptr(start
);
1894 /* Chek that we don't span multiple blocks - this breaks the
1895 address comparisons below. */
1896 if ((unsigned long)qemu_get_ram_ptr(end
- 1) - start1
1897 != (end
- 1) - start
) {
1901 for(env
= first_cpu
; env
!= NULL
; env
= env
->next_cpu
) {
1903 for (mmu_idx
= 0; mmu_idx
< NB_MMU_MODES
; mmu_idx
++) {
1904 for(i
= 0; i
< CPU_TLB_SIZE
; i
++)
1905 tlb_reset_dirty_range(&env
->tlb_table
[mmu_idx
][i
],
1911 int cpu_physical_memory_set_dirty_tracking(int enable
)
1913 if (kvm_enabled()) {
1914 return kvm_set_migration_log(enable
);
1919 int cpu_physical_memory_get_dirty_tracking(void)
1921 return in_migration
;
1924 int cpu_physical_sync_dirty_bitmap(target_phys_addr_t start_addr
,
1925 target_phys_addr_t end_addr
)
1930 ret
= kvm_physical_sync_dirty_bitmap(start_addr
, end_addr
);
1934 static inline void tlb_update_dirty(CPUTLBEntry
*tlb_entry
)
1936 ram_addr_t ram_addr
;
1939 if ((tlb_entry
->addr_write
& ~TARGET_PAGE_MASK
) == IO_MEM_RAM
) {
1940 p
= (void *)(unsigned long)((tlb_entry
->addr_write
& TARGET_PAGE_MASK
)
1941 + tlb_entry
->addend
);
1942 ram_addr
= qemu_ram_addr_from_host(p
);
1943 if (!cpu_physical_memory_is_dirty(ram_addr
)) {
1944 tlb_entry
->addr_write
|= TLB_NOTDIRTY
;
1949 /* update the TLB according to the current state of the dirty bits */
1950 void cpu_tlb_update_dirty(CPUState
*env
)
1954 for (mmu_idx
= 0; mmu_idx
< NB_MMU_MODES
; mmu_idx
++) {
1955 for(i
= 0; i
< CPU_TLB_SIZE
; i
++)
1956 tlb_update_dirty(&env
->tlb_table
[mmu_idx
][i
]);
1960 static inline void tlb_set_dirty1(CPUTLBEntry
*tlb_entry
, target_ulong vaddr
)
1962 if (tlb_entry
->addr_write
== (vaddr
| TLB_NOTDIRTY
))
1963 tlb_entry
->addr_write
= vaddr
;
1966 /* update the TLB corresponding to virtual page vaddr
1967 so that it is no longer dirty */
1968 static inline void tlb_set_dirty(CPUState
*env
, target_ulong vaddr
)
1973 vaddr
&= TARGET_PAGE_MASK
;
1974 i
= (vaddr
>> TARGET_PAGE_BITS
) & (CPU_TLB_SIZE
- 1);
1975 for (mmu_idx
= 0; mmu_idx
< NB_MMU_MODES
; mmu_idx
++)
1976 tlb_set_dirty1(&env
->tlb_table
[mmu_idx
][i
], vaddr
);
1979 /* add a new TLB entry. At most one entry for a given virtual address
1980 is permitted. Return 0 if OK or 2 if the page could not be mapped
1981 (can only happen in non SOFTMMU mode for I/O pages or pages
1982 conflicting with the host address space). */
1983 int tlb_set_page_exec(CPUState
*env
, target_ulong vaddr
,
1984 target_phys_addr_t paddr
, int prot
,
1985 int mmu_idx
, int is_softmmu
)
1990 target_ulong address
;
1991 target_ulong code_address
;
1992 target_phys_addr_t addend
;
1996 target_phys_addr_t iotlb
;
1998 p
= phys_page_find(paddr
>> TARGET_PAGE_BITS
);
2000 pd
= IO_MEM_UNASSIGNED
;
2002 pd
= p
->phys_offset
;
2004 #if defined(DEBUG_TLB)
2005 printf("tlb_set_page: vaddr=" TARGET_FMT_lx
" paddr=0x%08x prot=%x idx=%d smmu=%d pd=0x%08lx\n",
2006 vaddr
, (int)paddr
, prot
, mmu_idx
, is_softmmu
, pd
);
2011 if ((pd
& ~TARGET_PAGE_MASK
) > IO_MEM_ROM
&& !(pd
& IO_MEM_ROMD
)) {
2012 /* IO memory case (romd handled later) */
2013 address
|= TLB_MMIO
;
2015 addend
= (unsigned long)qemu_get_ram_ptr(pd
& TARGET_PAGE_MASK
);
2016 if ((pd
& ~TARGET_PAGE_MASK
) <= IO_MEM_ROM
) {
2018 iotlb
= pd
& TARGET_PAGE_MASK
;
2019 if ((pd
& ~TARGET_PAGE_MASK
) == IO_MEM_RAM
)
2020 iotlb
|= IO_MEM_NOTDIRTY
;
2022 iotlb
|= IO_MEM_ROM
;
2024 /* IO handlers are currently passed a physical address.
2025 It would be nice to pass an offset from the base address
2026 of that region. This would avoid having to special case RAM,
2027 and avoid full address decoding in every device.
2028 We can't use the high bits of pd for this because
2029 IO_MEM_ROMD uses these as a ram address. */
2030 iotlb
= (pd
& ~TARGET_PAGE_MASK
);
2032 iotlb
+= p
->region_offset
;
2038 code_address
= address
;
2039 /* Make accesses to pages with watchpoints go via the
2040 watchpoint trap routines. */
2041 TAILQ_FOREACH(wp
, &env
->watchpoints
, entry
) {
2042 if (vaddr
== (wp
->vaddr
& TARGET_PAGE_MASK
)) {
2043 iotlb
= io_mem_watch
+ paddr
;
2044 /* TODO: The memory case can be optimized by not trapping
2045 reads of pages with a write breakpoint. */
2046 address
|= TLB_MMIO
;
2050 index
= (vaddr
>> TARGET_PAGE_BITS
) & (CPU_TLB_SIZE
- 1);
2051 env
->iotlb
[mmu_idx
][index
] = iotlb
- vaddr
;
2052 te
= &env
->tlb_table
[mmu_idx
][index
];
2053 te
->addend
= addend
- vaddr
;
2054 if (prot
& PAGE_READ
) {
2055 te
->addr_read
= address
;
2060 if (prot
& PAGE_EXEC
) {
2061 te
->addr_code
= code_address
;
2065 if (prot
& PAGE_WRITE
) {
2066 if ((pd
& ~TARGET_PAGE_MASK
) == IO_MEM_ROM
||
2067 (pd
& IO_MEM_ROMD
)) {
2068 /* Write access calls the I/O callback. */
2069 te
->addr_write
= address
| TLB_MMIO
;
2070 } else if ((pd
& ~TARGET_PAGE_MASK
) == IO_MEM_RAM
&&
2071 !cpu_physical_memory_is_dirty(pd
)) {
2072 te
->addr_write
= address
| TLB_NOTDIRTY
;
2074 te
->addr_write
= address
;
2077 te
->addr_write
= -1;
2084 void tlb_flush(CPUState
*env
, int flush_global
)
2088 void tlb_flush_page(CPUState
*env
, target_ulong addr
)
2092 int tlb_set_page_exec(CPUState
*env
, target_ulong vaddr
,
2093 target_phys_addr_t paddr
, int prot
,
2094 int mmu_idx
, int is_softmmu
)
2100 * Walks guest process memory "regions" one by one
2101 * and calls callback function 'fn' for each region.
2103 int walk_memory_regions(void *priv
,
2104 int (*fn
)(void *, unsigned long, unsigned long, unsigned long))
2106 unsigned long start
, end
;
2108 int i
, j
, prot
, prot1
;
2114 for (i
= 0; i
<= L1_SIZE
; i
++) {
2115 p
= (i
< L1_SIZE
) ? l1_map
[i
] : NULL
;
2116 for (j
= 0; j
< L2_SIZE
; j
++) {
2117 prot1
= (p
== NULL
) ? 0 : p
[j
].flags
;
2119 * "region" is one continuous chunk of memory
2120 * that has same protection flags set.
2122 if (prot1
!= prot
) {
2123 end
= (i
<< (32 - L1_BITS
)) | (j
<< TARGET_PAGE_BITS
);
2125 rc
= (*fn
)(priv
, start
, end
, prot
);
2126 /* callback can stop iteration by returning != 0 */
2143 static int dump_region(void *priv
, unsigned long start
,
2144 unsigned long end
, unsigned long prot
)
2146 FILE *f
= (FILE *)priv
;
2148 (void) fprintf(f
, "%08lx-%08lx %08lx %c%c%c\n",
2149 start
, end
, end
- start
,
2150 ((prot
& PAGE_READ
) ? 'r' : '-'),
2151 ((prot
& PAGE_WRITE
) ? 'w' : '-'),
2152 ((prot
& PAGE_EXEC
) ? 'x' : '-'));
2157 /* dump memory mappings */
2158 void page_dump(FILE *f
)
2160 (void) fprintf(f
, "%-8s %-8s %-8s %s\n",
2161 "start", "end", "size", "prot");
2162 walk_memory_regions(f
, dump_region
);
2165 int page_get_flags(target_ulong address
)
2169 p
= page_find(address
>> TARGET_PAGE_BITS
);
2175 /* modify the flags of a page and invalidate the code if
2176 necessary. The flag PAGE_WRITE_ORG is positioned automatically
2177 depending on PAGE_WRITE */
2178 void page_set_flags(target_ulong start
, target_ulong end
, int flags
)
2183 /* mmap_lock should already be held. */
2184 start
= start
& TARGET_PAGE_MASK
;
2185 end
= TARGET_PAGE_ALIGN(end
);
2186 if (flags
& PAGE_WRITE
)
2187 flags
|= PAGE_WRITE_ORG
;
2188 for(addr
= start
; addr
< end
; addr
+= TARGET_PAGE_SIZE
) {
2189 p
= page_find_alloc(addr
>> TARGET_PAGE_BITS
);
2190 /* We may be called for host regions that are outside guest
2194 /* if the write protection is set, then we invalidate the code
2196 if (!(p
->flags
& PAGE_WRITE
) &&
2197 (flags
& PAGE_WRITE
) &&
2199 tb_invalidate_phys_page(addr
, 0, NULL
);
2205 int page_check_range(target_ulong start
, target_ulong len
, int flags
)
2211 if (start
+ len
< start
)
2212 /* we've wrapped around */
2215 end
= TARGET_PAGE_ALIGN(start
+len
); /* must do before we loose bits in the next step */
2216 start
= start
& TARGET_PAGE_MASK
;
2218 for(addr
= start
; addr
< end
; addr
+= TARGET_PAGE_SIZE
) {
2219 p
= page_find(addr
>> TARGET_PAGE_BITS
);
2222 if( !(p
->flags
& PAGE_VALID
) )
2225 if ((flags
& PAGE_READ
) && !(p
->flags
& PAGE_READ
))
2227 if (flags
& PAGE_WRITE
) {
2228 if (!(p
->flags
& PAGE_WRITE_ORG
))
2230 /* unprotect the page if it was put read-only because it
2231 contains translated code */
2232 if (!(p
->flags
& PAGE_WRITE
)) {
2233 if (!page_unprotect(addr
, 0, NULL
))
2242 /* called from signal handler: invalidate the code and unprotect the
2243 page. Return TRUE if the fault was successfully handled. */
2244 int page_unprotect(target_ulong address
, unsigned long pc
, void *puc
)
2246 unsigned int page_index
, prot
, pindex
;
2248 target_ulong host_start
, host_end
, addr
;
2250 /* Technically this isn't safe inside a signal handler. However we
2251 know this only ever happens in a synchronous SEGV handler, so in
2252 practice it seems to be ok. */
2255 host_start
= address
& qemu_host_page_mask
;
2256 page_index
= host_start
>> TARGET_PAGE_BITS
;
2257 p1
= page_find(page_index
);
2262 host_end
= host_start
+ qemu_host_page_size
;
2265 for(addr
= host_start
;addr
< host_end
; addr
+= TARGET_PAGE_SIZE
) {
2269 /* if the page was really writable, then we change its
2270 protection back to writable */
2271 if (prot
& PAGE_WRITE_ORG
) {
2272 pindex
= (address
- host_start
) >> TARGET_PAGE_BITS
;
2273 if (!(p1
[pindex
].flags
& PAGE_WRITE
)) {
2274 mprotect((void *)g2h(host_start
), qemu_host_page_size
,
2275 (prot
& PAGE_BITS
) | PAGE_WRITE
);
2276 p1
[pindex
].flags
|= PAGE_WRITE
;
2277 /* and since the content will be modified, we must invalidate
2278 the corresponding translated code. */
2279 tb_invalidate_phys_page(address
, pc
, puc
);
2280 #ifdef DEBUG_TB_CHECK
2281 tb_invalidate_check(address
);
2291 static inline void tlb_set_dirty(CPUState
*env
,
2292 unsigned long addr
, target_ulong vaddr
)
2295 #endif /* defined(CONFIG_USER_ONLY) */
2297 #if !defined(CONFIG_USER_ONLY)
2299 static int subpage_register (subpage_t
*mmio
, uint32_t start
, uint32_t end
,
2300 ram_addr_t memory
, ram_addr_t region_offset
);
2301 static void *subpage_init (target_phys_addr_t base
, ram_addr_t
*phys
,
2302 ram_addr_t orig_memory
, ram_addr_t region_offset
);
2303 #define CHECK_SUBPAGE(addr, start_addr, start_addr2, end_addr, end_addr2, \
2306 if (addr > start_addr) \
2309 start_addr2 = start_addr & ~TARGET_PAGE_MASK; \
2310 if (start_addr2 > 0) \
2314 if ((start_addr + orig_size) - addr >= TARGET_PAGE_SIZE) \
2315 end_addr2 = TARGET_PAGE_SIZE - 1; \
2317 end_addr2 = (start_addr + orig_size - 1) & ~TARGET_PAGE_MASK; \
2318 if (end_addr2 < TARGET_PAGE_SIZE - 1) \
2323 /* register physical memory. 'size' must be a multiple of the target
2324 page size. If (phys_offset & ~TARGET_PAGE_MASK) != 0, then it is an
2325 io memory page. The address used when calling the IO function is
2326 the offset from the start of the region, plus region_offset. Both
2327 start_addr and region_offset are rounded down to a page boundary
2328 before calculating this offset. This should not be a problem unless
2329 the low bits of start_addr and region_offset differ. */
2330 void cpu_register_physical_memory_offset(target_phys_addr_t start_addr
,
2332 ram_addr_t phys_offset
,
2333 ram_addr_t region_offset
)
2335 target_phys_addr_t addr
, end_addr
;
2338 ram_addr_t orig_size
= size
;
2342 /* XXX: should not depend on cpu context */
2344 if (env
->kqemu_enabled
) {
2345 kqemu_set_phys_mem(start_addr
, size
, phys_offset
);
2349 kvm_set_phys_mem(start_addr
, size
, phys_offset
);
2351 if (phys_offset
== IO_MEM_UNASSIGNED
) {
2352 region_offset
= start_addr
;
2354 region_offset
&= TARGET_PAGE_MASK
;
2355 size
= (size
+ TARGET_PAGE_SIZE
- 1) & TARGET_PAGE_MASK
;
2356 end_addr
= start_addr
+ (target_phys_addr_t
)size
;
2357 for(addr
= start_addr
; addr
!= end_addr
; addr
+= TARGET_PAGE_SIZE
) {
2358 p
= phys_page_find(addr
>> TARGET_PAGE_BITS
);
2359 if (p
&& p
->phys_offset
!= IO_MEM_UNASSIGNED
) {
2360 ram_addr_t orig_memory
= p
->phys_offset
;
2361 target_phys_addr_t start_addr2
, end_addr2
;
2362 int need_subpage
= 0;
2364 CHECK_SUBPAGE(addr
, start_addr
, start_addr2
, end_addr
, end_addr2
,
2366 if (need_subpage
|| phys_offset
& IO_MEM_SUBWIDTH
) {
2367 if (!(orig_memory
& IO_MEM_SUBPAGE
)) {
2368 subpage
= subpage_init((addr
& TARGET_PAGE_MASK
),
2369 &p
->phys_offset
, orig_memory
,
2372 subpage
= io_mem_opaque
[(orig_memory
& ~TARGET_PAGE_MASK
)
2375 subpage_register(subpage
, start_addr2
, end_addr2
, phys_offset
,
2377 p
->region_offset
= 0;
2379 p
->phys_offset
= phys_offset
;
2380 if ((phys_offset
& ~TARGET_PAGE_MASK
) <= IO_MEM_ROM
||
2381 (phys_offset
& IO_MEM_ROMD
))
2382 phys_offset
+= TARGET_PAGE_SIZE
;
2385 p
= phys_page_find_alloc(addr
>> TARGET_PAGE_BITS
, 1);
2386 p
->phys_offset
= phys_offset
;
2387 p
->region_offset
= region_offset
;
2388 if ((phys_offset
& ~TARGET_PAGE_MASK
) <= IO_MEM_ROM
||
2389 (phys_offset
& IO_MEM_ROMD
)) {
2390 phys_offset
+= TARGET_PAGE_SIZE
;
2392 target_phys_addr_t start_addr2
, end_addr2
;
2393 int need_subpage
= 0;
2395 CHECK_SUBPAGE(addr
, start_addr
, start_addr2
, end_addr
,
2396 end_addr2
, need_subpage
);
2398 if (need_subpage
|| phys_offset
& IO_MEM_SUBWIDTH
) {
2399 subpage
= subpage_init((addr
& TARGET_PAGE_MASK
),
2400 &p
->phys_offset
, IO_MEM_UNASSIGNED
,
2401 addr
& TARGET_PAGE_MASK
);
2402 subpage_register(subpage
, start_addr2
, end_addr2
,
2403 phys_offset
, region_offset
);
2404 p
->region_offset
= 0;
2408 region_offset
+= TARGET_PAGE_SIZE
;
2411 /* since each CPU stores ram addresses in its TLB cache, we must
2412 reset the modified entries */
2414 for(env
= first_cpu
; env
!= NULL
; env
= env
->next_cpu
) {
2419 /* XXX: temporary until new memory mapping API */
2420 ram_addr_t
cpu_get_physical_page_desc(target_phys_addr_t addr
)
2424 p
= phys_page_find(addr
>> TARGET_PAGE_BITS
);
2426 return IO_MEM_UNASSIGNED
;
2427 return p
->phys_offset
;
2430 void qemu_register_coalesced_mmio(target_phys_addr_t addr
, ram_addr_t size
)
2433 kvm_coalesce_mmio_region(addr
, size
);
2436 void qemu_unregister_coalesced_mmio(target_phys_addr_t addr
, ram_addr_t size
)
2439 kvm_uncoalesce_mmio_region(addr
, size
);
2443 /* XXX: better than nothing */
2444 static ram_addr_t
kqemu_ram_alloc(ram_addr_t size
)
2447 if ((last_ram_offset
+ size
) > kqemu_phys_ram_size
) {
2448 fprintf(stderr
, "Not enough memory (requested_size = %" PRIu64
", max memory = %" PRIu64
")\n",
2449 (uint64_t)size
, (uint64_t)kqemu_phys_ram_size
);
2452 addr
= last_ram_offset
;
2453 last_ram_offset
= TARGET_PAGE_ALIGN(last_ram_offset
+ size
);
2460 #include <sys/vfs.h>
2462 #define HUGETLBFS_MAGIC 0x958458f6
2464 static long gethugepagesize(const char *path
)
2470 ret
= statfs(path
, &fs
);
2471 } while (ret
!= 0 && errno
== EINTR
);
2478 if (fs
.f_type
!= HUGETLBFS_MAGIC
)
2479 fprintf(stderr
, "Warning: path not on HugeTLBFS: %s\n", path
);
2484 static void *file_ram_alloc(ram_addr_t memory
, const char *path
)
2492 unsigned long hpagesize
;
2493 extern int mem_prealloc
;
2499 hpagesize
= gethugepagesize(path
);
2504 if (memory
< hpagesize
) {
2508 if (kvm_enabled() && !kvm_has_sync_mmu()) {
2509 fprintf(stderr
, "host lacks mmu notifiers, disabling --mem-path\n");
2513 if (asprintf(&filename
, "%s/kvm.XXXXXX", path
) == -1) {
2517 fd
= mkstemp(filename
);
2526 memory
= (memory
+hpagesize
-1) & ~(hpagesize
-1);
2529 * ftruncate is not supported by hugetlbfs in older
2530 * hosts, so don't bother checking for errors.
2531 * If anything goes wrong with it under other filesystems,
2534 ftruncate(fd
, memory
);
2537 /* NB: MAP_POPULATE won't exhaustively alloc all phys pages in the case
2538 * MAP_PRIVATE is requested. For mem_prealloc we mmap as MAP_SHARED
2539 * to sidestep this quirk.
2541 flags
= mem_prealloc
? MAP_POPULATE
|MAP_SHARED
: MAP_PRIVATE
;
2542 area
= mmap(0, memory
, PROT_READ
|PROT_WRITE
, flags
, fd
, 0);
2544 area
= mmap(0, memory
, PROT_READ
|PROT_WRITE
, MAP_PRIVATE
, fd
, 0);
2546 if (area
== MAP_FAILED
) {
2547 perror("alloc_mem_area: can't mmap hugetlbfs pages");
2556 static void *file_ram_alloc(ram_addr_t memory
, const char *path
)
2563 extern const char *mem_path
;
2565 ram_addr_t
qemu_ram_alloc(ram_addr_t size
)
2567 RAMBlock
*new_block
;
2570 if (kqemu_phys_ram_base
) {
2571 return kqemu_ram_alloc(size
);
2575 size
= TARGET_PAGE_ALIGN(size
);
2576 new_block
= qemu_malloc(sizeof(*new_block
));
2578 new_block
->host
= file_ram_alloc(size
, mem_path
);
2579 if (!new_block
->host
) {
2580 new_block
->host
= qemu_vmalloc(size
);
2582 new_block
->offset
= last_ram_offset
;
2583 new_block
->length
= size
;
2585 new_block
->next
= ram_blocks
;
2586 ram_blocks
= new_block
;
2588 phys_ram_dirty
= qemu_realloc(phys_ram_dirty
,
2589 (last_ram_offset
+ size
) >> TARGET_PAGE_BITS
);
2590 memset(phys_ram_dirty
+ (last_ram_offset
>> TARGET_PAGE_BITS
),
2591 0xff, size
>> TARGET_PAGE_BITS
);
2593 last_ram_offset
+= size
;
2596 kvm_setup_guest_memory(new_block
->host
, size
);
2598 return new_block
->offset
;
2601 void qemu_ram_free(ram_addr_t addr
)
2603 /* TODO: implement this. */
2606 /* Return a host pointer to ram allocated with qemu_ram_alloc.
2607 With the exception of the softmmu code in this file, this should
2608 only be used for local memory (e.g. video ram) that the device owns,
2609 and knows it isn't going to access beyond the end of the block.
2611 It should not be used for general purpose DMA.
2612 Use cpu_physical_memory_map/cpu_physical_memory_rw instead.
2614 void *qemu_get_ram_ptr(ram_addr_t addr
)
2621 if (kqemu_phys_ram_base
) {
2622 return kqemu_phys_ram_base
+ addr
;
2627 prevp
= &ram_blocks
;
2629 while (block
&& (block
->offset
> addr
2630 || block
->offset
+ block
->length
<= addr
)) {
2632 prevp
= &prev
->next
;
2634 block
= block
->next
;
2637 fprintf(stderr
, "Bad ram offset %" PRIx64
"\n", (uint64_t)addr
);
2640 /* Move this entry to to start of the list. */
2642 prev
->next
= block
->next
;
2643 block
->next
= *prevp
;
2646 return block
->host
+ (addr
- block
->offset
);
2649 /* Some of the softmmu routines need to translate from a host pointer
2650 (typically a TLB entry) back to a ram offset. */
2651 ram_addr_t
qemu_ram_addr_from_host(void *ptr
)
2656 uint8_t *host
= ptr
;
2659 if (kqemu_phys_ram_base
) {
2660 return host
- kqemu_phys_ram_base
;
2665 prevp
= &ram_blocks
;
2667 while (block
&& (block
->host
> host
2668 || block
->host
+ block
->length
<= host
)) {
2670 prevp
= &prev
->next
;
2672 block
= block
->next
;
2675 fprintf(stderr
, "Bad ram pointer %p\n", ptr
);
2678 return block
->offset
+ (host
- block
->host
);
2681 static uint32_t unassigned_mem_readb(void *opaque
, target_phys_addr_t addr
)
2683 #ifdef DEBUG_UNASSIGNED
2684 printf("Unassigned mem read " TARGET_FMT_plx
"\n", addr
);
2686 #if defined(TARGET_SPARC)
2687 do_unassigned_access(addr
, 0, 0, 0, 1);
2692 static uint32_t unassigned_mem_readw(void *opaque
, target_phys_addr_t addr
)
2694 #ifdef DEBUG_UNASSIGNED
2695 printf("Unassigned mem read " TARGET_FMT_plx
"\n", addr
);
2697 #if defined(TARGET_SPARC)
2698 do_unassigned_access(addr
, 0, 0, 0, 2);
2703 static uint32_t unassigned_mem_readl(void *opaque
, target_phys_addr_t addr
)
2705 #ifdef DEBUG_UNASSIGNED
2706 printf("Unassigned mem read " TARGET_FMT_plx
"\n", addr
);
2708 #if defined(TARGET_SPARC)
2709 do_unassigned_access(addr
, 0, 0, 0, 4);
2714 static void unassigned_mem_writeb(void *opaque
, target_phys_addr_t addr
, uint32_t val
)
2716 #ifdef DEBUG_UNASSIGNED
2717 printf("Unassigned mem write " TARGET_FMT_plx
" = 0x%x\n", addr
, val
);
2719 #if defined(TARGET_SPARC)
2720 do_unassigned_access(addr
, 1, 0, 0, 1);
2724 static void unassigned_mem_writew(void *opaque
, target_phys_addr_t addr
, uint32_t val
)
2726 #ifdef DEBUG_UNASSIGNED
2727 printf("Unassigned mem write " TARGET_FMT_plx
" = 0x%x\n", addr
, val
);
2729 #if defined(TARGET_SPARC)
2730 do_unassigned_access(addr
, 1, 0, 0, 2);
2734 static void unassigned_mem_writel(void *opaque
, target_phys_addr_t addr
, uint32_t val
)
2736 #ifdef DEBUG_UNASSIGNED
2737 printf("Unassigned mem write " TARGET_FMT_plx
" = 0x%x\n", addr
, val
);
2739 #if defined(TARGET_SPARC)
2740 do_unassigned_access(addr
, 1, 0, 0, 4);
2744 static CPUReadMemoryFunc
*unassigned_mem_read
[3] = {
2745 unassigned_mem_readb
,
2746 unassigned_mem_readw
,
2747 unassigned_mem_readl
,
2750 static CPUWriteMemoryFunc
*unassigned_mem_write
[3] = {
2751 unassigned_mem_writeb
,
2752 unassigned_mem_writew
,
2753 unassigned_mem_writel
,
2756 static void notdirty_mem_writeb(void *opaque
, target_phys_addr_t ram_addr
,
2760 dirty_flags
= phys_ram_dirty
[ram_addr
>> TARGET_PAGE_BITS
];
2761 if (!(dirty_flags
& CODE_DIRTY_FLAG
)) {
2762 #if !defined(CONFIG_USER_ONLY)
2763 tb_invalidate_phys_page_fast(ram_addr
, 1);
2764 dirty_flags
= phys_ram_dirty
[ram_addr
>> TARGET_PAGE_BITS
];
2767 stb_p(qemu_get_ram_ptr(ram_addr
), val
);
2769 if (cpu_single_env
->kqemu_enabled
&&
2770 (dirty_flags
& KQEMU_MODIFY_PAGE_MASK
) != KQEMU_MODIFY_PAGE_MASK
)
2771 kqemu_modify_page(cpu_single_env
, ram_addr
);
2773 dirty_flags
|= (0xff & ~CODE_DIRTY_FLAG
);
2774 phys_ram_dirty
[ram_addr
>> TARGET_PAGE_BITS
] = dirty_flags
;
2775 /* we remove the notdirty callback only if the code has been
2777 if (dirty_flags
== 0xff)
2778 tlb_set_dirty(cpu_single_env
, cpu_single_env
->mem_io_vaddr
);
2781 static void notdirty_mem_writew(void *opaque
, target_phys_addr_t ram_addr
,
2785 dirty_flags
= phys_ram_dirty
[ram_addr
>> TARGET_PAGE_BITS
];
2786 if (!(dirty_flags
& CODE_DIRTY_FLAG
)) {
2787 #if !defined(CONFIG_USER_ONLY)
2788 tb_invalidate_phys_page_fast(ram_addr
, 2);
2789 dirty_flags
= phys_ram_dirty
[ram_addr
>> TARGET_PAGE_BITS
];
2792 stw_p(qemu_get_ram_ptr(ram_addr
), val
);
2794 if (cpu_single_env
->kqemu_enabled
&&
2795 (dirty_flags
& KQEMU_MODIFY_PAGE_MASK
) != KQEMU_MODIFY_PAGE_MASK
)
2796 kqemu_modify_page(cpu_single_env
, ram_addr
);
2798 dirty_flags
|= (0xff & ~CODE_DIRTY_FLAG
);
2799 phys_ram_dirty
[ram_addr
>> TARGET_PAGE_BITS
] = dirty_flags
;
2800 /* we remove the notdirty callback only if the code has been
2802 if (dirty_flags
== 0xff)
2803 tlb_set_dirty(cpu_single_env
, cpu_single_env
->mem_io_vaddr
);
2806 static void notdirty_mem_writel(void *opaque
, target_phys_addr_t ram_addr
,
2810 dirty_flags
= phys_ram_dirty
[ram_addr
>> TARGET_PAGE_BITS
];
2811 if (!(dirty_flags
& CODE_DIRTY_FLAG
)) {
2812 #if !defined(CONFIG_USER_ONLY)
2813 tb_invalidate_phys_page_fast(ram_addr
, 4);
2814 dirty_flags
= phys_ram_dirty
[ram_addr
>> TARGET_PAGE_BITS
];
2817 stl_p(qemu_get_ram_ptr(ram_addr
), val
);
2819 if (cpu_single_env
->kqemu_enabled
&&
2820 (dirty_flags
& KQEMU_MODIFY_PAGE_MASK
) != KQEMU_MODIFY_PAGE_MASK
)
2821 kqemu_modify_page(cpu_single_env
, ram_addr
);
2823 dirty_flags
|= (0xff & ~CODE_DIRTY_FLAG
);
2824 phys_ram_dirty
[ram_addr
>> TARGET_PAGE_BITS
] = dirty_flags
;
2825 /* we remove the notdirty callback only if the code has been
2827 if (dirty_flags
== 0xff)
2828 tlb_set_dirty(cpu_single_env
, cpu_single_env
->mem_io_vaddr
);
2831 static CPUReadMemoryFunc
*error_mem_read
[3] = {
2832 NULL
, /* never used */
2833 NULL
, /* never used */
2834 NULL
, /* never used */
2837 static CPUWriteMemoryFunc
*notdirty_mem_write
[3] = {
2838 notdirty_mem_writeb
,
2839 notdirty_mem_writew
,
2840 notdirty_mem_writel
,
2843 /* Generate a debug exception if a watchpoint has been hit. */
2844 static void check_watchpoint(int offset
, int len_mask
, int flags
)
2846 CPUState
*env
= cpu_single_env
;
2847 target_ulong pc
, cs_base
;
2848 TranslationBlock
*tb
;
2853 if (env
->watchpoint_hit
) {
2854 /* We re-entered the check after replacing the TB. Now raise
2855 * the debug interrupt so that is will trigger after the
2856 * current instruction. */
2857 cpu_interrupt(env
, CPU_INTERRUPT_DEBUG
);
2860 vaddr
= (env
->mem_io_vaddr
& TARGET_PAGE_MASK
) + offset
;
2861 TAILQ_FOREACH(wp
, &env
->watchpoints
, entry
) {
2862 if ((vaddr
== (wp
->vaddr
& len_mask
) ||
2863 (vaddr
& wp
->len_mask
) == wp
->vaddr
) && (wp
->flags
& flags
)) {
2864 wp
->flags
|= BP_WATCHPOINT_HIT
;
2865 if (!env
->watchpoint_hit
) {
2866 env
->watchpoint_hit
= wp
;
2867 tb
= tb_find_pc(env
->mem_io_pc
);
2869 cpu_abort(env
, "check_watchpoint: could not find TB for "
2870 "pc=%p", (void *)env
->mem_io_pc
);
2872 cpu_restore_state(tb
, env
, env
->mem_io_pc
, NULL
);
2873 tb_phys_invalidate(tb
, -1);
2874 if (wp
->flags
& BP_STOP_BEFORE_ACCESS
) {
2875 env
->exception_index
= EXCP_DEBUG
;
2877 cpu_get_tb_cpu_state(env
, &pc
, &cs_base
, &cpu_flags
);
2878 tb_gen_code(env
, pc
, cs_base
, cpu_flags
, 1);
2880 cpu_resume_from_signal(env
, NULL
);
2883 wp
->flags
&= ~BP_WATCHPOINT_HIT
;
2888 /* Watchpoint access routines. Watchpoints are inserted using TLB tricks,
2889 so these check for a hit then pass through to the normal out-of-line
2891 static uint32_t watch_mem_readb(void *opaque
, target_phys_addr_t addr
)
2893 check_watchpoint(addr
& ~TARGET_PAGE_MASK
, ~0x0, BP_MEM_READ
);
2894 return ldub_phys(addr
);
2897 static uint32_t watch_mem_readw(void *opaque
, target_phys_addr_t addr
)
2899 check_watchpoint(addr
& ~TARGET_PAGE_MASK
, ~0x1, BP_MEM_READ
);
2900 return lduw_phys(addr
);
2903 static uint32_t watch_mem_readl(void *opaque
, target_phys_addr_t addr
)
2905 check_watchpoint(addr
& ~TARGET_PAGE_MASK
, ~0x3, BP_MEM_READ
);
2906 return ldl_phys(addr
);
2909 static void watch_mem_writeb(void *opaque
, target_phys_addr_t addr
,
2912 check_watchpoint(addr
& ~TARGET_PAGE_MASK
, ~0x0, BP_MEM_WRITE
);
2913 stb_phys(addr
, val
);
2916 static void watch_mem_writew(void *opaque
, target_phys_addr_t addr
,
2919 check_watchpoint(addr
& ~TARGET_PAGE_MASK
, ~0x1, BP_MEM_WRITE
);
2920 stw_phys(addr
, val
);
2923 static void watch_mem_writel(void *opaque
, target_phys_addr_t addr
,
2926 check_watchpoint(addr
& ~TARGET_PAGE_MASK
, ~0x3, BP_MEM_WRITE
);
2927 stl_phys(addr
, val
);
2930 static CPUReadMemoryFunc
*watch_mem_read
[3] = {
2936 static CPUWriteMemoryFunc
*watch_mem_write
[3] = {
2942 static inline uint32_t subpage_readlen (subpage_t
*mmio
, target_phys_addr_t addr
,
2948 idx
= SUBPAGE_IDX(addr
);
2949 #if defined(DEBUG_SUBPAGE)
2950 printf("%s: subpage %p len %d addr " TARGET_FMT_plx
" idx %d\n", __func__
,
2951 mmio
, len
, addr
, idx
);
2953 ret
= (**mmio
->mem_read
[idx
][len
])(mmio
->opaque
[idx
][0][len
],
2954 addr
+ mmio
->region_offset
[idx
][0][len
]);
2959 static inline void subpage_writelen (subpage_t
*mmio
, target_phys_addr_t addr
,
2960 uint32_t value
, unsigned int len
)
2964 idx
= SUBPAGE_IDX(addr
);
2965 #if defined(DEBUG_SUBPAGE)
2966 printf("%s: subpage %p len %d addr " TARGET_FMT_plx
" idx %d value %08x\n", __func__
,
2967 mmio
, len
, addr
, idx
, value
);
2969 (**mmio
->mem_write
[idx
][len
])(mmio
->opaque
[idx
][1][len
],
2970 addr
+ mmio
->region_offset
[idx
][1][len
],
2974 static uint32_t subpage_readb (void *opaque
, target_phys_addr_t addr
)
2976 #if defined(DEBUG_SUBPAGE)
2977 printf("%s: addr " TARGET_FMT_plx
"\n", __func__
, addr
);
2980 return subpage_readlen(opaque
, addr
, 0);
2983 static void subpage_writeb (void *opaque
, target_phys_addr_t addr
,
2986 #if defined(DEBUG_SUBPAGE)
2987 printf("%s: addr " TARGET_FMT_plx
" val %08x\n", __func__
, addr
, value
);
2989 subpage_writelen(opaque
, addr
, value
, 0);
2992 static uint32_t subpage_readw (void *opaque
, target_phys_addr_t addr
)
2994 #if defined(DEBUG_SUBPAGE)
2995 printf("%s: addr " TARGET_FMT_plx
"\n", __func__
, addr
);
2998 return subpage_readlen(opaque
, addr
, 1);
3001 static void subpage_writew (void *opaque
, target_phys_addr_t addr
,
3004 #if defined(DEBUG_SUBPAGE)
3005 printf("%s: addr " TARGET_FMT_plx
" val %08x\n", __func__
, addr
, value
);
3007 subpage_writelen(opaque
, addr
, value
, 1);
3010 static uint32_t subpage_readl (void *opaque
, target_phys_addr_t addr
)
3012 #if defined(DEBUG_SUBPAGE)
3013 printf("%s: addr " TARGET_FMT_plx
"\n", __func__
, addr
);
3016 return subpage_readlen(opaque
, addr
, 2);
3019 static void subpage_writel (void *opaque
,
3020 target_phys_addr_t addr
, uint32_t value
)
3022 #if defined(DEBUG_SUBPAGE)
3023 printf("%s: addr " TARGET_FMT_plx
" val %08x\n", __func__
, addr
, value
);
3025 subpage_writelen(opaque
, addr
, value
, 2);
3028 static CPUReadMemoryFunc
*subpage_read
[] = {
3034 static CPUWriteMemoryFunc
*subpage_write
[] = {
3040 static int subpage_register (subpage_t
*mmio
, uint32_t start
, uint32_t end
,
3041 ram_addr_t memory
, ram_addr_t region_offset
)
3046 if (start
>= TARGET_PAGE_SIZE
|| end
>= TARGET_PAGE_SIZE
)
3048 idx
= SUBPAGE_IDX(start
);
3049 eidx
= SUBPAGE_IDX(end
);
3050 #if defined(DEBUG_SUBPAGE)
3051 printf("%s: %p start %08x end %08x idx %08x eidx %08x mem %ld\n", __func__
,
3052 mmio
, start
, end
, idx
, eidx
, memory
);
3054 memory
>>= IO_MEM_SHIFT
;
3055 for (; idx
<= eidx
; idx
++) {
3056 for (i
= 0; i
< 4; i
++) {
3057 if (io_mem_read
[memory
][i
]) {
3058 mmio
->mem_read
[idx
][i
] = &io_mem_read
[memory
][i
];
3059 mmio
->opaque
[idx
][0][i
] = io_mem_opaque
[memory
];
3060 mmio
->region_offset
[idx
][0][i
] = region_offset
;
3062 if (io_mem_write
[memory
][i
]) {
3063 mmio
->mem_write
[idx
][i
] = &io_mem_write
[memory
][i
];
3064 mmio
->opaque
[idx
][1][i
] = io_mem_opaque
[memory
];
3065 mmio
->region_offset
[idx
][1][i
] = region_offset
;
3073 static void *subpage_init (target_phys_addr_t base
, ram_addr_t
*phys
,
3074 ram_addr_t orig_memory
, ram_addr_t region_offset
)
3079 mmio
= qemu_mallocz(sizeof(subpage_t
));
3082 subpage_memory
= cpu_register_io_memory(subpage_read
, subpage_write
, mmio
);
3083 #if defined(DEBUG_SUBPAGE)
3084 printf("%s: %p base " TARGET_FMT_plx
" len %08x %d\n", __func__
,
3085 mmio
, base
, TARGET_PAGE_SIZE
, subpage_memory
);
3087 *phys
= subpage_memory
| IO_MEM_SUBPAGE
;
3088 subpage_register(mmio
, 0, TARGET_PAGE_SIZE
- 1, orig_memory
,
3094 static int get_free_io_mem_idx(void)
3098 for (i
= 0; i
<IO_MEM_NB_ENTRIES
; i
++)
3099 if (!io_mem_used
[i
]) {
3107 /* mem_read and mem_write are arrays of functions containing the
3108 function to access byte (index 0), word (index 1) and dword (index
3109 2). Functions can be omitted with a NULL function pointer.
3110 If io_index is non zero, the corresponding io zone is
3111 modified. If it is zero, a new io zone is allocated. The return
3112 value can be used with cpu_register_physical_memory(). (-1) is
3113 returned if error. */
3114 static int cpu_register_io_memory_fixed(int io_index
,
3115 CPUReadMemoryFunc
**mem_read
,
3116 CPUWriteMemoryFunc
**mem_write
,
3119 int i
, subwidth
= 0;
3121 if (io_index
<= 0) {
3122 io_index
= get_free_io_mem_idx();
3126 io_index
>>= IO_MEM_SHIFT
;
3127 if (io_index
>= IO_MEM_NB_ENTRIES
)
3131 for(i
= 0;i
< 3; i
++) {
3132 if (!mem_read
[i
] || !mem_write
[i
])
3133 subwidth
= IO_MEM_SUBWIDTH
;
3134 io_mem_read
[io_index
][i
] = mem_read
[i
];
3135 io_mem_write
[io_index
][i
] = mem_write
[i
];
3137 io_mem_opaque
[io_index
] = opaque
;
3138 return (io_index
<< IO_MEM_SHIFT
) | subwidth
;
3141 int cpu_register_io_memory(CPUReadMemoryFunc
**mem_read
,
3142 CPUWriteMemoryFunc
**mem_write
,
3145 return cpu_register_io_memory_fixed(0, mem_read
, mem_write
, opaque
);
3148 void cpu_unregister_io_memory(int io_table_address
)
3151 int io_index
= io_table_address
>> IO_MEM_SHIFT
;
3153 for (i
=0;i
< 3; i
++) {
3154 io_mem_read
[io_index
][i
] = unassigned_mem_read
[i
];
3155 io_mem_write
[io_index
][i
] = unassigned_mem_write
[i
];
3157 io_mem_opaque
[io_index
] = NULL
;
3158 io_mem_used
[io_index
] = 0;
3161 static void io_mem_init(void)
3165 cpu_register_io_memory_fixed(IO_MEM_ROM
, error_mem_read
, unassigned_mem_write
, NULL
);
3166 cpu_register_io_memory_fixed(IO_MEM_UNASSIGNED
, unassigned_mem_read
, unassigned_mem_write
, NULL
);
3167 cpu_register_io_memory_fixed(IO_MEM_NOTDIRTY
, error_mem_read
, notdirty_mem_write
, NULL
);
3171 io_mem_watch
= cpu_register_io_memory(watch_mem_read
,
3172 watch_mem_write
, NULL
);
3174 if (kqemu_phys_ram_base
) {
3175 /* alloc dirty bits array */
3176 phys_ram_dirty
= qemu_vmalloc(kqemu_phys_ram_size
>> TARGET_PAGE_BITS
);
3177 memset(phys_ram_dirty
, 0xff, kqemu_phys_ram_size
>> TARGET_PAGE_BITS
);
3182 #endif /* !defined(CONFIG_USER_ONLY) */
3184 /* physical memory access (slow version, mainly for debug) */
3185 #if defined(CONFIG_USER_ONLY)
3186 void cpu_physical_memory_rw(target_phys_addr_t addr
, uint8_t *buf
,
3187 int len
, int is_write
)
3194 page
= addr
& TARGET_PAGE_MASK
;
3195 l
= (page
+ TARGET_PAGE_SIZE
) - addr
;
3198 flags
= page_get_flags(page
);
3199 if (!(flags
& PAGE_VALID
))
3202 if (!(flags
& PAGE_WRITE
))
3204 /* XXX: this code should not depend on lock_user */
3205 if (!(p
= lock_user(VERIFY_WRITE
, addr
, l
, 0)))
3206 /* FIXME - should this return an error rather than just fail? */
3209 unlock_user(p
, addr
, l
);
3211 if (!(flags
& PAGE_READ
))
3213 /* XXX: this code should not depend on lock_user */
3214 if (!(p
= lock_user(VERIFY_READ
, addr
, l
, 1)))
3215 /* FIXME - should this return an error rather than just fail? */
3218 unlock_user(p
, addr
, 0);
3227 void cpu_physical_memory_rw(target_phys_addr_t addr
, uint8_t *buf
,
3228 int len
, int is_write
)
3233 target_phys_addr_t page
;
3238 page
= addr
& TARGET_PAGE_MASK
;
3239 l
= (page
+ TARGET_PAGE_SIZE
) - addr
;
3242 p
= phys_page_find(page
>> TARGET_PAGE_BITS
);
3244 pd
= IO_MEM_UNASSIGNED
;
3246 pd
= p
->phys_offset
;
3250 if ((pd
& ~TARGET_PAGE_MASK
) != IO_MEM_RAM
) {
3251 target_phys_addr_t addr1
= addr
;
3252 io_index
= (pd
>> IO_MEM_SHIFT
) & (IO_MEM_NB_ENTRIES
- 1);
3254 addr1
= (addr
& ~TARGET_PAGE_MASK
) + p
->region_offset
;
3255 /* XXX: could force cpu_single_env to NULL to avoid
3257 if (l
>= 4 && ((addr1
& 3) == 0)) {
3258 /* 32 bit write access */
3260 io_mem_write
[io_index
][2](io_mem_opaque
[io_index
], addr1
, val
);
3262 } else if (l
>= 2 && ((addr1
& 1) == 0)) {
3263 /* 16 bit write access */
3265 io_mem_write
[io_index
][1](io_mem_opaque
[io_index
], addr1
, val
);
3268 /* 8 bit write access */
3270 io_mem_write
[io_index
][0](io_mem_opaque
[io_index
], addr1
, val
);
3274 unsigned long addr1
;
3275 addr1
= (pd
& TARGET_PAGE_MASK
) + (addr
& ~TARGET_PAGE_MASK
);
3277 ptr
= qemu_get_ram_ptr(addr1
);
3278 memcpy(ptr
, buf
, l
);
3279 if (!cpu_physical_memory_is_dirty(addr1
)) {
3280 /* invalidate code */
3281 tb_invalidate_phys_page_range(addr1
, addr1
+ l
, 0);
3283 phys_ram_dirty
[addr1
>> TARGET_PAGE_BITS
] |=
3284 (0xff & ~CODE_DIRTY_FLAG
);
3286 /* qemu doesn't execute guest code directly, but kvm does
3287 therefore flush instruction caches */
3289 flush_icache_range((unsigned long)ptr
,
3290 ((unsigned long)ptr
)+l
);
3293 if ((pd
& ~TARGET_PAGE_MASK
) > IO_MEM_ROM
&&
3294 !(pd
& IO_MEM_ROMD
)) {
3295 target_phys_addr_t addr1
= addr
;
3297 io_index
= (pd
>> IO_MEM_SHIFT
) & (IO_MEM_NB_ENTRIES
- 1);
3299 addr1
= (addr
& ~TARGET_PAGE_MASK
) + p
->region_offset
;
3300 if (l
>= 4 && ((addr1
& 3) == 0)) {
3301 /* 32 bit read access */
3302 val
= io_mem_read
[io_index
][2](io_mem_opaque
[io_index
], addr1
);
3305 } else if (l
>= 2 && ((addr1
& 1) == 0)) {
3306 /* 16 bit read access */
3307 val
= io_mem_read
[io_index
][1](io_mem_opaque
[io_index
], addr1
);
3311 /* 8 bit read access */
3312 val
= io_mem_read
[io_index
][0](io_mem_opaque
[io_index
], addr1
);
3318 ptr
= qemu_get_ram_ptr(pd
& TARGET_PAGE_MASK
) +
3319 (addr
& ~TARGET_PAGE_MASK
);
3320 memcpy(buf
, ptr
, l
);
3329 /* used for ROM loading : can write in RAM and ROM */
3330 void cpu_physical_memory_write_rom(target_phys_addr_t addr
,
3331 const uint8_t *buf
, int len
)
3335 target_phys_addr_t page
;
3340 page
= addr
& TARGET_PAGE_MASK
;
3341 l
= (page
+ TARGET_PAGE_SIZE
) - addr
;
3344 p
= phys_page_find(page
>> TARGET_PAGE_BITS
);
3346 pd
= IO_MEM_UNASSIGNED
;
3348 pd
= p
->phys_offset
;
3351 if ((pd
& ~TARGET_PAGE_MASK
) != IO_MEM_RAM
&&
3352 (pd
& ~TARGET_PAGE_MASK
) != IO_MEM_ROM
&&
3353 !(pd
& IO_MEM_ROMD
)) {
3356 unsigned long addr1
;
3357 addr1
= (pd
& TARGET_PAGE_MASK
) + (addr
& ~TARGET_PAGE_MASK
);
3359 ptr
= qemu_get_ram_ptr(addr1
);
3360 memcpy(ptr
, buf
, l
);
3370 target_phys_addr_t addr
;
3371 target_phys_addr_t len
;
3374 static BounceBuffer bounce
;
3376 typedef struct MapClient
{
3378 void (*callback
)(void *opaque
);
3379 LIST_ENTRY(MapClient
) link
;
3382 static LIST_HEAD(map_client_list
, MapClient
) map_client_list
3383 = LIST_HEAD_INITIALIZER(map_client_list
);
3385 void *cpu_register_map_client(void *opaque
, void (*callback
)(void *opaque
))
3387 MapClient
*client
= qemu_malloc(sizeof(*client
));
3389 client
->opaque
= opaque
;
3390 client
->callback
= callback
;
3391 LIST_INSERT_HEAD(&map_client_list
, client
, link
);
3395 void cpu_unregister_map_client(void *_client
)
3397 MapClient
*client
= (MapClient
*)_client
;
3399 LIST_REMOVE(client
, link
);
3403 static void cpu_notify_map_clients(void)
3407 while (!LIST_EMPTY(&map_client_list
)) {
3408 client
= LIST_FIRST(&map_client_list
);
3409 client
->callback(client
->opaque
);
3410 cpu_unregister_map_client(client
);
3414 /* Map a physical memory region into a host virtual address.
3415 * May map a subset of the requested range, given by and returned in *plen.
3416 * May return NULL if resources needed to perform the mapping are exhausted.
3417 * Use only for reads OR writes - not for read-modify-write operations.
3418 * Use cpu_register_map_client() to know when retrying the map operation is
3419 * likely to succeed.
3421 void *cpu_physical_memory_map(target_phys_addr_t addr
,
3422 target_phys_addr_t
*plen
,
3425 target_phys_addr_t len
= *plen
;
3426 target_phys_addr_t done
= 0;
3428 uint8_t *ret
= NULL
;
3430 target_phys_addr_t page
;
3433 unsigned long addr1
;
3436 page
= addr
& TARGET_PAGE_MASK
;
3437 l
= (page
+ TARGET_PAGE_SIZE
) - addr
;
3440 p
= phys_page_find(page
>> TARGET_PAGE_BITS
);
3442 pd
= IO_MEM_UNASSIGNED
;
3444 pd
= p
->phys_offset
;
3447 if ((pd
& ~TARGET_PAGE_MASK
) != IO_MEM_RAM
) {
3448 if (done
|| bounce
.buffer
) {
3451 bounce
.buffer
= qemu_memalign(TARGET_PAGE_SIZE
, TARGET_PAGE_SIZE
);
3455 cpu_physical_memory_rw(addr
, bounce
.buffer
, l
, 0);
3457 ptr
= bounce
.buffer
;
3459 addr1
= (pd
& TARGET_PAGE_MASK
) + (addr
& ~TARGET_PAGE_MASK
);
3460 ptr
= qemu_get_ram_ptr(addr1
);
3464 } else if (ret
+ done
!= ptr
) {
3476 /* Unmaps a memory region previously mapped by cpu_physical_memory_map().
3477 * Will also mark the memory as dirty if is_write == 1. access_len gives
3478 * the amount of memory that was actually read or written by the caller.
3480 void cpu_physical_memory_unmap(void *buffer
, target_phys_addr_t len
,
3481 int is_write
, target_phys_addr_t access_len
)
3483 unsigned long flush_len
= (unsigned long)access_len
;
3485 if (buffer
!= bounce
.buffer
) {
3487 ram_addr_t addr1
= qemu_ram_addr_from_host(buffer
);
3488 while (access_len
) {
3490 l
= TARGET_PAGE_SIZE
;
3493 if (!cpu_physical_memory_is_dirty(addr1
)) {
3494 /* invalidate code */
3495 tb_invalidate_phys_page_range(addr1
, addr1
+ l
, 0);
3497 phys_ram_dirty
[addr1
>> TARGET_PAGE_BITS
] |=
3498 (0xff & ~CODE_DIRTY_FLAG
);
3503 dma_flush_range((unsigned long)buffer
,
3504 (unsigned long)buffer
+ flush_len
);
3509 cpu_physical_memory_write(bounce
.addr
, bounce
.buffer
, access_len
);
3511 qemu_free(bounce
.buffer
);
3512 bounce
.buffer
= NULL
;
3513 cpu_notify_map_clients();
3516 /* warning: addr must be aligned */
3517 uint32_t ldl_phys(target_phys_addr_t addr
)
3525 p
= phys_page_find(addr
>> TARGET_PAGE_BITS
);
3527 pd
= IO_MEM_UNASSIGNED
;
3529 pd
= p
->phys_offset
;
3532 if ((pd
& ~TARGET_PAGE_MASK
) > IO_MEM_ROM
&&
3533 !(pd
& IO_MEM_ROMD
)) {
3535 io_index
= (pd
>> IO_MEM_SHIFT
) & (IO_MEM_NB_ENTRIES
- 1);
3537 addr
= (addr
& ~TARGET_PAGE_MASK
) + p
->region_offset
;
3538 val
= io_mem_read
[io_index
][2](io_mem_opaque
[io_index
], addr
);
3541 ptr
= qemu_get_ram_ptr(pd
& TARGET_PAGE_MASK
) +
3542 (addr
& ~TARGET_PAGE_MASK
);
3548 /* warning: addr must be aligned */
3549 uint64_t ldq_phys(target_phys_addr_t addr
)
3557 p
= phys_page_find(addr
>> TARGET_PAGE_BITS
);
3559 pd
= IO_MEM_UNASSIGNED
;
3561 pd
= p
->phys_offset
;
3564 if ((pd
& ~TARGET_PAGE_MASK
) > IO_MEM_ROM
&&
3565 !(pd
& IO_MEM_ROMD
)) {
3567 io_index
= (pd
>> IO_MEM_SHIFT
) & (IO_MEM_NB_ENTRIES
- 1);
3569 addr
= (addr
& ~TARGET_PAGE_MASK
) + p
->region_offset
;
3570 #ifdef TARGET_WORDS_BIGENDIAN
3571 val
= (uint64_t)io_mem_read
[io_index
][2](io_mem_opaque
[io_index
], addr
) << 32;
3572 val
|= io_mem_read
[io_index
][2](io_mem_opaque
[io_index
], addr
+ 4);
3574 val
= io_mem_read
[io_index
][2](io_mem_opaque
[io_index
], addr
);
3575 val
|= (uint64_t)io_mem_read
[io_index
][2](io_mem_opaque
[io_index
], addr
+ 4) << 32;
3579 ptr
= qemu_get_ram_ptr(pd
& TARGET_PAGE_MASK
) +
3580 (addr
& ~TARGET_PAGE_MASK
);
3587 uint32_t ldub_phys(target_phys_addr_t addr
)
3590 cpu_physical_memory_read(addr
, &val
, 1);
3595 uint32_t lduw_phys(target_phys_addr_t addr
)
3598 cpu_physical_memory_read(addr
, (uint8_t *)&val
, 2);
3599 return tswap16(val
);
3602 /* warning: addr must be aligned. The ram page is not masked as dirty
3603 and the code inside is not invalidated. It is useful if the dirty
3604 bits are used to track modified PTEs */
3605 void stl_phys_notdirty(target_phys_addr_t addr
, uint32_t val
)
3612 p
= phys_page_find(addr
>> TARGET_PAGE_BITS
);
3614 pd
= IO_MEM_UNASSIGNED
;
3616 pd
= p
->phys_offset
;
3619 if ((pd
& ~TARGET_PAGE_MASK
) != IO_MEM_RAM
) {
3620 io_index
= (pd
>> IO_MEM_SHIFT
) & (IO_MEM_NB_ENTRIES
- 1);
3622 addr
= (addr
& ~TARGET_PAGE_MASK
) + p
->region_offset
;
3623 io_mem_write
[io_index
][2](io_mem_opaque
[io_index
], addr
, val
);
3625 unsigned long addr1
= (pd
& TARGET_PAGE_MASK
) + (addr
& ~TARGET_PAGE_MASK
);
3626 ptr
= qemu_get_ram_ptr(addr1
);
3629 if (unlikely(in_migration
)) {
3630 if (!cpu_physical_memory_is_dirty(addr1
)) {
3631 /* invalidate code */
3632 tb_invalidate_phys_page_range(addr1
, addr1
+ 4, 0);
3634 phys_ram_dirty
[addr1
>> TARGET_PAGE_BITS
] |=
3635 (0xff & ~CODE_DIRTY_FLAG
);
3641 void stq_phys_notdirty(target_phys_addr_t addr
, uint64_t val
)
3648 p
= phys_page_find(addr
>> TARGET_PAGE_BITS
);
3650 pd
= IO_MEM_UNASSIGNED
;
3652 pd
= p
->phys_offset
;
3655 if ((pd
& ~TARGET_PAGE_MASK
) != IO_MEM_RAM
) {
3656 io_index
= (pd
>> IO_MEM_SHIFT
) & (IO_MEM_NB_ENTRIES
- 1);
3658 addr
= (addr
& ~TARGET_PAGE_MASK
) + p
->region_offset
;
3659 #ifdef TARGET_WORDS_BIGENDIAN
3660 io_mem_write
[io_index
][2](io_mem_opaque
[io_index
], addr
, val
>> 32);
3661 io_mem_write
[io_index
][2](io_mem_opaque
[io_index
], addr
+ 4, val
);
3663 io_mem_write
[io_index
][2](io_mem_opaque
[io_index
], addr
, val
);
3664 io_mem_write
[io_index
][2](io_mem_opaque
[io_index
], addr
+ 4, val
>> 32);
3667 ptr
= qemu_get_ram_ptr(pd
& TARGET_PAGE_MASK
) +
3668 (addr
& ~TARGET_PAGE_MASK
);
3673 /* warning: addr must be aligned */
3674 void stl_phys(target_phys_addr_t addr
, uint32_t val
)
3681 p
= phys_page_find(addr
>> TARGET_PAGE_BITS
);
3683 pd
= IO_MEM_UNASSIGNED
;
3685 pd
= p
->phys_offset
;
3688 if ((pd
& ~TARGET_PAGE_MASK
) != IO_MEM_RAM
) {
3689 io_index
= (pd
>> IO_MEM_SHIFT
) & (IO_MEM_NB_ENTRIES
- 1);
3691 addr
= (addr
& ~TARGET_PAGE_MASK
) + p
->region_offset
;
3692 io_mem_write
[io_index
][2](io_mem_opaque
[io_index
], addr
, val
);
3694 unsigned long addr1
;
3695 addr1
= (pd
& TARGET_PAGE_MASK
) + (addr
& ~TARGET_PAGE_MASK
);
3697 ptr
= qemu_get_ram_ptr(addr1
);
3699 if (!cpu_physical_memory_is_dirty(addr1
)) {
3700 /* invalidate code */
3701 tb_invalidate_phys_page_range(addr1
, addr1
+ 4, 0);
3703 phys_ram_dirty
[addr1
>> TARGET_PAGE_BITS
] |=
3704 (0xff & ~CODE_DIRTY_FLAG
);
3710 void stb_phys(target_phys_addr_t addr
, uint32_t val
)
3713 cpu_physical_memory_write(addr
, &v
, 1);
3717 void stw_phys(target_phys_addr_t addr
, uint32_t val
)
3719 uint16_t v
= tswap16(val
);
3720 cpu_physical_memory_write(addr
, (const uint8_t *)&v
, 2);
3724 void stq_phys(target_phys_addr_t addr
, uint64_t val
)
3727 cpu_physical_memory_write(addr
, (const uint8_t *)&val
, 8);
3732 /* virtual memory access for debug (includes writing to ROM) */
3733 int cpu_memory_rw_debug(CPUState
*env
, target_ulong addr
,
3734 uint8_t *buf
, int len
, int is_write
)
3737 target_phys_addr_t phys_addr
;
3741 page
= addr
& TARGET_PAGE_MASK
;
3742 phys_addr
= cpu_get_phys_page_debug(env
, page
);
3743 /* if no physical page mapped, return an error */
3744 if (phys_addr
== -1)
3746 l
= (page
+ TARGET_PAGE_SIZE
) - addr
;
3749 phys_addr
+= (addr
& ~TARGET_PAGE_MASK
);
3750 #if !defined(CONFIG_USER_ONLY)
3752 cpu_physical_memory_write_rom(phys_addr
, buf
, l
);
3755 cpu_physical_memory_rw(phys_addr
, buf
, l
, is_write
);
3763 /* in deterministic execution mode, instructions doing device I/Os
3764 must be at the end of the TB */
3765 void cpu_io_recompile(CPUState
*env
, void *retaddr
)
3767 TranslationBlock
*tb
;
3769 target_ulong pc
, cs_base
;
3772 tb
= tb_find_pc((unsigned long)retaddr
);
3774 cpu_abort(env
, "cpu_io_recompile: could not find TB for pc=%p",
3777 n
= env
->icount_decr
.u16
.low
+ tb
->icount
;
3778 cpu_restore_state(tb
, env
, (unsigned long)retaddr
, NULL
);
3779 /* Calculate how many instructions had been executed before the fault
3781 n
= n
- env
->icount_decr
.u16
.low
;
3782 /* Generate a new TB ending on the I/O insn. */
3784 /* On MIPS and SH, delay slot instructions can only be restarted if
3785 they were already the first instruction in the TB. If this is not
3786 the first instruction in a TB then re-execute the preceding
3788 #if defined(TARGET_MIPS)
3789 if ((env
->hflags
& MIPS_HFLAG_BMASK
) != 0 && n
> 1) {
3790 env
->active_tc
.PC
-= 4;
3791 env
->icount_decr
.u16
.low
++;
3792 env
->hflags
&= ~MIPS_HFLAG_BMASK
;
3794 #elif defined(TARGET_SH4)
3795 if ((env
->flags
& ((DELAY_SLOT
| DELAY_SLOT_CONDITIONAL
))) != 0
3798 env
->icount_decr
.u16
.low
++;
3799 env
->flags
&= ~(DELAY_SLOT
| DELAY_SLOT_CONDITIONAL
);
3802 /* This should never happen. */
3803 if (n
> CF_COUNT_MASK
)
3804 cpu_abort(env
, "TB too big during recompile");
3806 cflags
= n
| CF_LAST_IO
;
3808 cs_base
= tb
->cs_base
;
3810 tb_phys_invalidate(tb
, -1);
3811 /* FIXME: In theory this could raise an exception. In practice
3812 we have already translated the block once so it's probably ok. */
3813 tb_gen_code(env
, pc
, cs_base
, flags
, cflags
);
3814 /* TODO: If env->pc != tb->pc (i.e. the faulting instruction was not
3815 the first in the TB) then we end up generating a whole new TB and
3816 repeating the fault, which is horribly inefficient.
3817 Better would be to execute just this insn uncached, or generate a
3819 cpu_resume_from_signal(env
, NULL
);
3822 void dump_exec_info(FILE *f
,
3823 int (*cpu_fprintf
)(FILE *f
, const char *fmt
, ...))
3825 int i
, target_code_size
, max_target_code_size
;
3826 int direct_jmp_count
, direct_jmp2_count
, cross_page
;
3827 TranslationBlock
*tb
;
3829 target_code_size
= 0;
3830 max_target_code_size
= 0;
3832 direct_jmp_count
= 0;
3833 direct_jmp2_count
= 0;
3834 for(i
= 0; i
< nb_tbs
; i
++) {
3836 target_code_size
+= tb
->size
;
3837 if (tb
->size
> max_target_code_size
)
3838 max_target_code_size
= tb
->size
;
3839 if (tb
->page_addr
[1] != -1)
3841 if (tb
->tb_next_offset
[0] != 0xffff) {
3843 if (tb
->tb_next_offset
[1] != 0xffff) {
3844 direct_jmp2_count
++;
3848 /* XXX: avoid using doubles ? */
3849 cpu_fprintf(f
, "Translation buffer state:\n");
3850 cpu_fprintf(f
, "gen code size %ld/%ld\n",
3851 code_gen_ptr
- code_gen_buffer
, code_gen_buffer_max_size
);
3852 cpu_fprintf(f
, "TB count %d/%d\n",
3853 nb_tbs
, code_gen_max_blocks
);
3854 cpu_fprintf(f
, "TB avg target size %d max=%d bytes\n",
3855 nb_tbs
? target_code_size
/ nb_tbs
: 0,
3856 max_target_code_size
);
3857 cpu_fprintf(f
, "TB avg host size %d bytes (expansion ratio: %0.1f)\n",
3858 nb_tbs
? (code_gen_ptr
- code_gen_buffer
) / nb_tbs
: 0,
3859 target_code_size
? (double) (code_gen_ptr
- code_gen_buffer
) / target_code_size
: 0);
3860 cpu_fprintf(f
, "cross page TB count %d (%d%%)\n",
3862 nb_tbs
? (cross_page
* 100) / nb_tbs
: 0);
3863 cpu_fprintf(f
, "direct jump count %d (%d%%) (2 jumps=%d %d%%)\n",
3865 nb_tbs
? (direct_jmp_count
* 100) / nb_tbs
: 0,
3867 nb_tbs
? (direct_jmp2_count
* 100) / nb_tbs
: 0);
3868 cpu_fprintf(f
, "\nStatistics:\n");
3869 cpu_fprintf(f
, "TB flush count %d\n", tb_flush_count
);
3870 cpu_fprintf(f
, "TB invalidate count %d\n", tb_phys_invalidate_count
);
3871 cpu_fprintf(f
, "TLB flush count %d\n", tlb_flush_count
);
3872 tcg_dump_info(f
, cpu_fprintf
);
3875 #if !defined(CONFIG_USER_ONLY)
3877 #define MMUSUFFIX _cmmu
3878 #define GETPC() NULL
3879 #define env cpu_single_env
3880 #define SOFTMMU_CODE_ACCESS
3883 #include "softmmu_template.h"
3886 #include "softmmu_template.h"
3889 #include "softmmu_template.h"
3892 #include "softmmu_template.h"