2 * virtual page mapping and translated block handling
4 * Copyright (c) 2003 Fabrice Bellard
6 * This library is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU Lesser General Public
8 * License as published by the Free Software Foundation; either
9 * version 2 of the License, or (at your option) any later version.
11 * This library is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
14 * Lesser General Public License for more details.
16 * You should have received a copy of the GNU Lesser General Public
17 * License along with this library; if not, see <http://www.gnu.org/licenses/>.
23 #include <sys/types.h>
36 #include "qemu-common.h"
37 #include "cache-utils.h"
39 #if !defined(TARGET_IA64)
47 #if defined(CONFIG_USER_ONLY)
51 //#define DEBUG_TB_INVALIDATE
54 //#define DEBUG_UNASSIGNED
56 /* make various TB consistency checks */
57 //#define DEBUG_TB_CHECK
58 //#define DEBUG_TLB_CHECK
60 //#define DEBUG_IOPORT
61 //#define DEBUG_SUBPAGE
63 #if !defined(CONFIG_USER_ONLY)
64 /* TB consistency checks only implemented for usermode emulation. */
68 #define SMC_BITMAP_USE_THRESHOLD 10
70 #if defined(TARGET_SPARC64)
71 #define TARGET_PHYS_ADDR_SPACE_BITS 41
72 #elif defined(TARGET_SPARC)
73 #define TARGET_PHYS_ADDR_SPACE_BITS 36
74 #elif defined(TARGET_ALPHA)
75 #define TARGET_PHYS_ADDR_SPACE_BITS 42
76 #define TARGET_VIRT_ADDR_SPACE_BITS 42
77 #elif defined(TARGET_PPC64)
78 #define TARGET_PHYS_ADDR_SPACE_BITS 42
79 #elif defined(TARGET_X86_64) && !defined(CONFIG_KQEMU)
80 #define TARGET_PHYS_ADDR_SPACE_BITS 42
81 #elif defined(TARGET_I386) && !defined(CONFIG_KQEMU)
82 #define TARGET_PHYS_ADDR_SPACE_BITS 36
83 #elif defined(TARGET_IA64)
84 #define TARGET_PHYS_ADDR_SPACE_BITS 36
86 /* Note: for compatibility with kqemu, we use 32 bits for x86_64 */
87 #define TARGET_PHYS_ADDR_SPACE_BITS 32
90 static TranslationBlock
*tbs
;
91 int code_gen_max_blocks
;
92 TranslationBlock
*tb_phys_hash
[CODE_GEN_PHYS_HASH_SIZE
];
94 /* any access to the tbs or the page table must use this lock */
95 spinlock_t tb_lock
= SPIN_LOCK_UNLOCKED
;
97 #if defined(__arm__) || defined(__sparc_v9__)
98 /* The prologue must be reachable with a direct jump. ARM and Sparc64
99 have limited branch ranges (possibly also PPC) so place it in a
100 section close to code segment. */
101 #define code_gen_section \
102 __attribute__((__section__(".gen_code"))) \
103 __attribute__((aligned (32)))
104 #elif defined(_WIN32)
105 /* Maximum alignment for Win32 is 16. */
106 #define code_gen_section \
107 __attribute__((aligned (16)))
109 #define code_gen_section \
110 __attribute__((aligned (32)))
113 uint8_t code_gen_prologue
[1024] code_gen_section
;
114 static uint8_t *code_gen_buffer
;
115 static unsigned long code_gen_buffer_size
;
116 /* threshold to flush the translated code buffer */
117 static unsigned long code_gen_buffer_max_size
;
118 uint8_t *code_gen_ptr
;
120 #if !defined(CONFIG_USER_ONLY)
122 uint8_t *phys_ram_dirty
;
124 static int in_migration
;
126 typedef struct RAMBlock
{
130 struct RAMBlock
*next
;
133 static RAMBlock
*ram_blocks
;
134 /* TODO: When we implement (and use) ram deallocation (e.g. for hotplug)
135 then we can no longer assume contiguous ram offsets, and external uses
136 of this variable will break. */
137 ram_addr_t last_ram_offset
;
141 /* current CPU in the current thread. It is only valid inside
143 CPUState
*cpu_single_env
;
144 /* 0 = Do not count executed instructions.
145 1 = Precise instruction counting.
146 2 = Adaptive rate instruction counting. */
148 /* Current instruction counter. While executing translated code this may
149 include some instructions that have not yet been executed. */
152 typedef struct PageDesc
{
153 /* list of TBs intersecting this ram page */
154 TranslationBlock
*first_tb
;
155 /* in order to optimize self modifying code, we count the number
156 of lookups we do to a given page to use a bitmap */
157 unsigned int code_write_count
;
158 uint8_t *code_bitmap
;
159 #if defined(CONFIG_USER_ONLY)
164 typedef struct PhysPageDesc
{
165 /* offset in host memory of the page + io_index in the low bits */
166 ram_addr_t phys_offset
;
167 ram_addr_t region_offset
;
171 #if defined(CONFIG_USER_ONLY) && defined(TARGET_VIRT_ADDR_SPACE_BITS)
172 /* XXX: this is a temporary hack for alpha target.
173 * In the future, this is to be replaced by a multi-level table
174 * to actually be able to handle the complete 64 bits address space.
176 #define L1_BITS (TARGET_VIRT_ADDR_SPACE_BITS - L2_BITS - TARGET_PAGE_BITS)
178 #define L1_BITS (32 - L2_BITS - TARGET_PAGE_BITS)
181 #define L1_SIZE (1 << L1_BITS)
182 #define L2_SIZE (1 << L2_BITS)
184 unsigned long qemu_real_host_page_size
;
185 unsigned long qemu_host_page_bits
;
186 unsigned long qemu_host_page_size
;
187 unsigned long qemu_host_page_mask
;
189 /* XXX: for system emulation, it could just be an array */
190 static PageDesc
*l1_map
[L1_SIZE
];
191 static PhysPageDesc
**l1_phys_map
;
193 #if !defined(CONFIG_USER_ONLY)
194 static void io_mem_init(void);
196 /* io memory support */
197 CPUWriteMemoryFunc
*io_mem_write
[IO_MEM_NB_ENTRIES
][4];
198 CPUReadMemoryFunc
*io_mem_read
[IO_MEM_NB_ENTRIES
][4];
199 void *io_mem_opaque
[IO_MEM_NB_ENTRIES
];
200 static char io_mem_used
[IO_MEM_NB_ENTRIES
];
201 static int io_mem_watch
;
205 static const char *logfilename
= "/tmp/qemu.log";
208 static int log_append
= 0;
211 static int tlb_flush_count
;
212 static int tb_flush_count
;
213 static int tb_phys_invalidate_count
;
215 #define SUBPAGE_IDX(addr) ((addr) & ~TARGET_PAGE_MASK)
216 typedef struct subpage_t
{
217 target_phys_addr_t base
;
218 CPUReadMemoryFunc
**mem_read
[TARGET_PAGE_SIZE
][4];
219 CPUWriteMemoryFunc
**mem_write
[TARGET_PAGE_SIZE
][4];
220 void *opaque
[TARGET_PAGE_SIZE
][2][4];
221 ram_addr_t region_offset
[TARGET_PAGE_SIZE
][2][4];
225 static void map_exec(void *addr
, long size
)
228 VirtualProtect(addr
, size
,
229 PAGE_EXECUTE_READWRITE
, &old_protect
);
233 static void map_exec(void *addr
, long size
)
235 unsigned long start
, end
, page_size
;
237 page_size
= getpagesize();
238 start
= (unsigned long)addr
;
239 start
&= ~(page_size
- 1);
241 end
= (unsigned long)addr
+ size
;
242 end
+= page_size
- 1;
243 end
&= ~(page_size
- 1);
245 mprotect((void *)start
, end
- start
,
246 PROT_READ
| PROT_WRITE
| PROT_EXEC
);
250 static void page_init(void)
252 /* NOTE: we can always suppose that qemu_host_page_size >=
256 SYSTEM_INFO system_info
;
258 GetSystemInfo(&system_info
);
259 qemu_real_host_page_size
= system_info
.dwPageSize
;
262 qemu_real_host_page_size
= getpagesize();
264 if (qemu_host_page_size
== 0)
265 qemu_host_page_size
= qemu_real_host_page_size
;
266 if (qemu_host_page_size
< TARGET_PAGE_SIZE
)
267 qemu_host_page_size
= TARGET_PAGE_SIZE
;
268 qemu_host_page_bits
= 0;
269 while ((1 << qemu_host_page_bits
) < qemu_host_page_size
)
270 qemu_host_page_bits
++;
271 qemu_host_page_mask
= ~(qemu_host_page_size
- 1);
272 l1_phys_map
= qemu_vmalloc(L1_SIZE
* sizeof(void *));
273 memset(l1_phys_map
, 0, L1_SIZE
* sizeof(void *));
275 #if !defined(_WIN32) && defined(CONFIG_USER_ONLY)
277 long long startaddr
, endaddr
;
282 last_brk
= (unsigned long)sbrk(0);
283 f
= fopen("/proc/self/maps", "r");
286 n
= fscanf (f
, "%llx-%llx %*[^\n]\n", &startaddr
, &endaddr
);
288 startaddr
= MIN(startaddr
,
289 (1ULL << TARGET_PHYS_ADDR_SPACE_BITS
) - 1);
290 endaddr
= MIN(endaddr
,
291 (1ULL << TARGET_PHYS_ADDR_SPACE_BITS
) - 1);
292 page_set_flags(startaddr
& TARGET_PAGE_MASK
,
293 TARGET_PAGE_ALIGN(endaddr
),
304 static inline PageDesc
**page_l1_map(target_ulong index
)
306 #if TARGET_LONG_BITS > 32
307 /* Host memory outside guest VM. For 32-bit targets we have already
308 excluded high addresses. */
309 if (index
> ((target_ulong
)L2_SIZE
* L1_SIZE
))
312 return &l1_map
[index
>> L2_BITS
];
315 static inline PageDesc
*page_find_alloc(target_ulong index
)
318 lp
= page_l1_map(index
);
324 /* allocate if not found */
325 #if defined(CONFIG_USER_ONLY)
326 size_t len
= sizeof(PageDesc
) * L2_SIZE
;
327 /* Don't use qemu_malloc because it may recurse. */
328 p
= mmap(0, len
, PROT_READ
| PROT_WRITE
,
329 MAP_PRIVATE
| MAP_ANONYMOUS
, -1, 0);
332 unsigned long addr
= h2g(p
);
333 page_set_flags(addr
& TARGET_PAGE_MASK
,
334 TARGET_PAGE_ALIGN(addr
+ len
),
338 p
= qemu_mallocz(sizeof(PageDesc
) * L2_SIZE
);
342 return p
+ (index
& (L2_SIZE
- 1));
345 static inline PageDesc
*page_find(target_ulong index
)
348 lp
= page_l1_map(index
);
355 return p
+ (index
& (L2_SIZE
- 1));
358 static PhysPageDesc
*phys_page_find_alloc(target_phys_addr_t index
, int alloc
)
363 p
= (void **)l1_phys_map
;
364 #if TARGET_PHYS_ADDR_SPACE_BITS > 32
366 #if TARGET_PHYS_ADDR_SPACE_BITS > (32 + L1_BITS)
367 #error unsupported TARGET_PHYS_ADDR_SPACE_BITS
369 lp
= p
+ ((index
>> (L1_BITS
+ L2_BITS
)) & (L1_SIZE
- 1));
372 /* allocate if not found */
375 p
= qemu_vmalloc(sizeof(void *) * L1_SIZE
);
376 memset(p
, 0, sizeof(void *) * L1_SIZE
);
380 lp
= p
+ ((index
>> L2_BITS
) & (L1_SIZE
- 1));
384 /* allocate if not found */
387 pd
= qemu_vmalloc(sizeof(PhysPageDesc
) * L2_SIZE
);
389 for (i
= 0; i
< L2_SIZE
; i
++) {
390 pd
[i
].phys_offset
= IO_MEM_UNASSIGNED
;
391 pd
[i
].region_offset
= (index
+ i
) << TARGET_PAGE_BITS
;
394 return ((PhysPageDesc
*)pd
) + (index
& (L2_SIZE
- 1));
397 static inline PhysPageDesc
*phys_page_find(target_phys_addr_t index
)
399 return phys_page_find_alloc(index
, 0);
402 #if !defined(CONFIG_USER_ONLY)
403 static void tlb_protect_code(ram_addr_t ram_addr
);
404 static void tlb_unprotect_code_phys(CPUState
*env
, ram_addr_t ram_addr
,
406 #define mmap_lock() do { } while(0)
407 #define mmap_unlock() do { } while(0)
410 #define DEFAULT_CODE_GEN_BUFFER_SIZE (32 * 1024 * 1024)
412 #if defined(CONFIG_USER_ONLY)
413 /* Currently it is not recommended to allocate big chunks of data in
414 user mode. It will change when a dedicated libc will be used */
415 #define USE_STATIC_CODE_GEN_BUFFER
418 #ifdef USE_STATIC_CODE_GEN_BUFFER
419 static uint8_t static_code_gen_buffer
[DEFAULT_CODE_GEN_BUFFER_SIZE
];
422 static void code_gen_alloc(unsigned long tb_size
)
427 #ifdef USE_STATIC_CODE_GEN_BUFFER
428 code_gen_buffer
= static_code_gen_buffer
;
429 code_gen_buffer_size
= DEFAULT_CODE_GEN_BUFFER_SIZE
;
430 map_exec(code_gen_buffer
, code_gen_buffer_size
);
432 code_gen_buffer_size
= tb_size
;
433 if (code_gen_buffer_size
== 0) {
434 #if defined(CONFIG_USER_ONLY)
435 /* in user mode, phys_ram_size is not meaningful */
436 code_gen_buffer_size
= DEFAULT_CODE_GEN_BUFFER_SIZE
;
438 /* XXX: needs adjustments */
439 code_gen_buffer_size
= (unsigned long)(ram_size
/ 4);
442 if (code_gen_buffer_size
< MIN_CODE_GEN_BUFFER_SIZE
)
443 code_gen_buffer_size
= MIN_CODE_GEN_BUFFER_SIZE
;
444 /* The code gen buffer location may have constraints depending on
445 the host cpu and OS */
446 #if defined(__linux__)
451 flags
= MAP_PRIVATE
| MAP_ANONYMOUS
;
452 #if defined(__x86_64__)
454 /* Cannot map more than that */
455 if (code_gen_buffer_size
> (800 * 1024 * 1024))
456 code_gen_buffer_size
= (800 * 1024 * 1024);
457 #elif defined(__sparc_v9__)
458 // Map the buffer below 2G, so we can use direct calls and branches
460 start
= (void *) 0x60000000UL
;
461 if (code_gen_buffer_size
> (512 * 1024 * 1024))
462 code_gen_buffer_size
= (512 * 1024 * 1024);
463 #elif defined(__arm__)
464 /* Map the buffer below 32M, so we can use direct calls and branches */
466 start
= (void *) 0x01000000UL
;
467 if (code_gen_buffer_size
> 16 * 1024 * 1024)
468 code_gen_buffer_size
= 16 * 1024 * 1024;
470 code_gen_buffer
= mmap(start
, code_gen_buffer_size
,
471 PROT_WRITE
| PROT_READ
| PROT_EXEC
,
473 if (code_gen_buffer
== MAP_FAILED
) {
474 fprintf(stderr
, "Could not allocate dynamic translator buffer\n");
478 #elif defined(__FreeBSD__) || defined(__DragonFly__)
482 flags
= MAP_PRIVATE
| MAP_ANONYMOUS
;
483 #if defined(__x86_64__)
484 /* FreeBSD doesn't have MAP_32BIT, use MAP_FIXED and assume
485 * 0x40000000 is free */
487 addr
= (void *)0x40000000;
488 /* Cannot map more than that */
489 if (code_gen_buffer_size
> (800 * 1024 * 1024))
490 code_gen_buffer_size
= (800 * 1024 * 1024);
492 code_gen_buffer
= mmap(addr
, code_gen_buffer_size
,
493 PROT_WRITE
| PROT_READ
| PROT_EXEC
,
495 if (code_gen_buffer
== MAP_FAILED
) {
496 fprintf(stderr
, "Could not allocate dynamic translator buffer\n");
501 code_gen_buffer
= qemu_malloc(code_gen_buffer_size
);
502 map_exec(code_gen_buffer
, code_gen_buffer_size
);
504 #endif /* !USE_STATIC_CODE_GEN_BUFFER */
505 map_exec(code_gen_prologue
, sizeof(code_gen_prologue
));
506 code_gen_buffer_max_size
= code_gen_buffer_size
-
507 code_gen_max_block_size();
508 code_gen_max_blocks
= code_gen_buffer_size
/ CODE_GEN_AVG_BLOCK_SIZE
;
509 tbs
= qemu_malloc(code_gen_max_blocks
* sizeof(TranslationBlock
));
512 /* Must be called before using the QEMU cpus. 'tb_size' is the size
513 (in bytes) allocated to the translation buffer. Zero means default
515 void cpu_exec_init_all(unsigned long tb_size
)
518 code_gen_alloc(tb_size
);
519 code_gen_ptr
= code_gen_buffer
;
521 #if !defined(CONFIG_USER_ONLY)
526 #if defined(CPU_SAVE_VERSION) && !defined(CONFIG_USER_ONLY)
528 #define CPU_COMMON_SAVE_VERSION 1
530 static void cpu_common_save(QEMUFile
*f
, void *opaque
)
532 CPUState
*env
= opaque
;
534 cpu_synchronize_state(env
, 0);
536 qemu_put_be32s(f
, &env
->halted
);
537 qemu_put_be32s(f
, &env
->interrupt_request
);
540 static int cpu_common_load(QEMUFile
*f
, void *opaque
, int version_id
)
542 CPUState
*env
= opaque
;
544 if (version_id
!= CPU_COMMON_SAVE_VERSION
)
547 qemu_get_be32s(f
, &env
->halted
);
548 qemu_get_be32s(f
, &env
->interrupt_request
);
549 /* 0x01 was CPU_INTERRUPT_EXIT. This line can be removed when the
550 version_id is increased. */
551 env
->interrupt_request
&= ~0x01;
553 cpu_synchronize_state(env
, 1);
559 CPUState
*qemu_get_cpu(int cpu
)
561 CPUState
*env
= first_cpu
;
564 if (env
->cpu_index
== cpu
)
572 void cpu_exec_init(CPUState
*env
)
577 #if defined(CONFIG_USER_ONLY)
580 env
->next_cpu
= NULL
;
583 while (*penv
!= NULL
) {
584 penv
= &(*penv
)->next_cpu
;
587 env
->cpu_index
= cpu_index
;
589 TAILQ_INIT(&env
->breakpoints
);
590 TAILQ_INIT(&env
->watchpoints
);
592 env
->thread_id
= GetCurrentProcessId();
594 env
->thread_id
= getpid();
597 #if defined(CONFIG_USER_ONLY)
600 #if defined(CPU_SAVE_VERSION) && !defined(CONFIG_USER_ONLY)
601 register_savevm("cpu_common", cpu_index
, CPU_COMMON_SAVE_VERSION
,
602 cpu_common_save
, cpu_common_load
, env
);
603 register_savevm("cpu", cpu_index
, CPU_SAVE_VERSION
,
604 cpu_save
, cpu_load
, env
);
608 static inline void invalidate_page_bitmap(PageDesc
*p
)
610 if (p
->code_bitmap
) {
611 qemu_free(p
->code_bitmap
);
612 p
->code_bitmap
= NULL
;
614 p
->code_write_count
= 0;
617 /* set to NULL all the 'first_tb' fields in all PageDescs */
618 static void page_flush_tb(void)
623 for(i
= 0; i
< L1_SIZE
; i
++) {
626 for(j
= 0; j
< L2_SIZE
; j
++) {
628 invalidate_page_bitmap(p
);
635 /* flush all the translation blocks */
636 /* XXX: tb_flush is currently not thread safe */
637 void tb_flush(CPUState
*env1
)
640 #if defined(DEBUG_FLUSH)
641 printf("qemu: flush code_size=%ld nb_tbs=%d avg_tb_size=%ld\n",
642 (unsigned long)(code_gen_ptr
- code_gen_buffer
),
644 ((unsigned long)(code_gen_ptr
- code_gen_buffer
)) / nb_tbs
: 0);
646 if ((unsigned long)(code_gen_ptr
- code_gen_buffer
) > code_gen_buffer_size
)
647 cpu_abort(env1
, "Internal error: code buffer overflow\n");
651 for(env
= first_cpu
; env
!= NULL
; env
= env
->next_cpu
) {
652 memset (env
->tb_jmp_cache
, 0, TB_JMP_CACHE_SIZE
* sizeof (void *));
655 memset (tb_phys_hash
, 0, CODE_GEN_PHYS_HASH_SIZE
* sizeof (void *));
658 code_gen_ptr
= code_gen_buffer
;
659 /* XXX: flush processor icache at this point if cache flush is
664 #ifdef DEBUG_TB_CHECK
666 static void tb_invalidate_check(target_ulong address
)
668 TranslationBlock
*tb
;
670 address
&= TARGET_PAGE_MASK
;
671 for(i
= 0;i
< CODE_GEN_PHYS_HASH_SIZE
; i
++) {
672 for(tb
= tb_phys_hash
[i
]; tb
!= NULL
; tb
= tb
->phys_hash_next
) {
673 if (!(address
+ TARGET_PAGE_SIZE
<= tb
->pc
||
674 address
>= tb
->pc
+ tb
->size
)) {
675 printf("ERROR invalidate: address=" TARGET_FMT_lx
676 " PC=%08lx size=%04x\n",
677 address
, (long)tb
->pc
, tb
->size
);
683 /* verify that all the pages have correct rights for code */
684 static void tb_page_check(void)
686 TranslationBlock
*tb
;
687 int i
, flags1
, flags2
;
689 for(i
= 0;i
< CODE_GEN_PHYS_HASH_SIZE
; i
++) {
690 for(tb
= tb_phys_hash
[i
]; tb
!= NULL
; tb
= tb
->phys_hash_next
) {
691 flags1
= page_get_flags(tb
->pc
);
692 flags2
= page_get_flags(tb
->pc
+ tb
->size
- 1);
693 if ((flags1
& PAGE_WRITE
) || (flags2
& PAGE_WRITE
)) {
694 printf("ERROR page flags: PC=%08lx size=%04x f1=%x f2=%x\n",
695 (long)tb
->pc
, tb
->size
, flags1
, flags2
);
703 /* invalidate one TB */
704 static inline void tb_remove(TranslationBlock
**ptb
, TranslationBlock
*tb
,
707 TranslationBlock
*tb1
;
711 *ptb
= *(TranslationBlock
**)((char *)tb1
+ next_offset
);
714 ptb
= (TranslationBlock
**)((char *)tb1
+ next_offset
);
718 static inline void tb_page_remove(TranslationBlock
**ptb
, TranslationBlock
*tb
)
720 TranslationBlock
*tb1
;
726 tb1
= (TranslationBlock
*)((long)tb1
& ~3);
728 *ptb
= tb1
->page_next
[n1
];
731 ptb
= &tb1
->page_next
[n1
];
735 static inline void tb_jmp_remove(TranslationBlock
*tb
, int n
)
737 TranslationBlock
*tb1
, **ptb
;
740 ptb
= &tb
->jmp_next
[n
];
743 /* find tb(n) in circular list */
747 tb1
= (TranslationBlock
*)((long)tb1
& ~3);
748 if (n1
== n
&& tb1
== tb
)
751 ptb
= &tb1
->jmp_first
;
753 ptb
= &tb1
->jmp_next
[n1
];
756 /* now we can suppress tb(n) from the list */
757 *ptb
= tb
->jmp_next
[n
];
759 tb
->jmp_next
[n
] = NULL
;
763 /* reset the jump entry 'n' of a TB so that it is not chained to
765 static inline void tb_reset_jump(TranslationBlock
*tb
, int n
)
767 tb_set_jmp_target(tb
, n
, (unsigned long)(tb
->tc_ptr
+ tb
->tb_next_offset
[n
]));
770 void tb_phys_invalidate(TranslationBlock
*tb
, target_ulong page_addr
)
775 target_phys_addr_t phys_pc
;
776 TranslationBlock
*tb1
, *tb2
;
778 /* remove the TB from the hash list */
779 phys_pc
= tb
->page_addr
[0] + (tb
->pc
& ~TARGET_PAGE_MASK
);
780 h
= tb_phys_hash_func(phys_pc
);
781 tb_remove(&tb_phys_hash
[h
], tb
,
782 offsetof(TranslationBlock
, phys_hash_next
));
784 /* remove the TB from the page list */
785 if (tb
->page_addr
[0] != page_addr
) {
786 p
= page_find(tb
->page_addr
[0] >> TARGET_PAGE_BITS
);
787 tb_page_remove(&p
->first_tb
, tb
);
788 invalidate_page_bitmap(p
);
790 if (tb
->page_addr
[1] != -1 && tb
->page_addr
[1] != page_addr
) {
791 p
= page_find(tb
->page_addr
[1] >> TARGET_PAGE_BITS
);
792 tb_page_remove(&p
->first_tb
, tb
);
793 invalidate_page_bitmap(p
);
796 tb_invalidated_flag
= 1;
798 /* remove the TB from the hash list */
799 h
= tb_jmp_cache_hash_func(tb
->pc
);
800 for(env
= first_cpu
; env
!= NULL
; env
= env
->next_cpu
) {
801 if (env
->tb_jmp_cache
[h
] == tb
)
802 env
->tb_jmp_cache
[h
] = NULL
;
805 /* suppress this TB from the two jump lists */
806 tb_jmp_remove(tb
, 0);
807 tb_jmp_remove(tb
, 1);
809 /* suppress any remaining jumps to this TB */
815 tb1
= (TranslationBlock
*)((long)tb1
& ~3);
816 tb2
= tb1
->jmp_next
[n1
];
817 tb_reset_jump(tb1
, n1
);
818 tb1
->jmp_next
[n1
] = NULL
;
821 tb
->jmp_first
= (TranslationBlock
*)((long)tb
| 2); /* fail safe */
823 tb_phys_invalidate_count
++;
826 static inline void set_bits(uint8_t *tab
, int start
, int len
)
832 mask
= 0xff << (start
& 7);
833 if ((start
& ~7) == (end
& ~7)) {
835 mask
&= ~(0xff << (end
& 7));
840 start
= (start
+ 8) & ~7;
842 while (start
< end1
) {
847 mask
= ~(0xff << (end
& 7));
853 static void build_page_bitmap(PageDesc
*p
)
855 int n
, tb_start
, tb_end
;
856 TranslationBlock
*tb
;
858 p
->code_bitmap
= qemu_mallocz(TARGET_PAGE_SIZE
/ 8);
863 tb
= (TranslationBlock
*)((long)tb
& ~3);
864 /* NOTE: this is subtle as a TB may span two physical pages */
866 /* NOTE: tb_end may be after the end of the page, but
867 it is not a problem */
868 tb_start
= tb
->pc
& ~TARGET_PAGE_MASK
;
869 tb_end
= tb_start
+ tb
->size
;
870 if (tb_end
> TARGET_PAGE_SIZE
)
871 tb_end
= TARGET_PAGE_SIZE
;
874 tb_end
= ((tb
->pc
+ tb
->size
) & ~TARGET_PAGE_MASK
);
876 set_bits(p
->code_bitmap
, tb_start
, tb_end
- tb_start
);
877 tb
= tb
->page_next
[n
];
881 TranslationBlock
*tb_gen_code(CPUState
*env
,
882 target_ulong pc
, target_ulong cs_base
,
883 int flags
, int cflags
)
885 TranslationBlock
*tb
;
887 target_ulong phys_pc
, phys_page2
, virt_page2
;
890 phys_pc
= get_phys_addr_code(env
, pc
);
893 /* flush must be done */
895 /* cannot fail at this point */
897 /* Don't forget to invalidate previous TB info. */
898 tb_invalidated_flag
= 1;
900 tc_ptr
= code_gen_ptr
;
902 tb
->cs_base
= cs_base
;
905 cpu_gen_code(env
, tb
, &code_gen_size
);
906 code_gen_ptr
= (void *)(((unsigned long)code_gen_ptr
+ code_gen_size
+ CODE_GEN_ALIGN
- 1) & ~(CODE_GEN_ALIGN
- 1));
908 /* check next page if needed */
909 virt_page2
= (pc
+ tb
->size
- 1) & TARGET_PAGE_MASK
;
911 if ((pc
& TARGET_PAGE_MASK
) != virt_page2
) {
912 phys_page2
= get_phys_addr_code(env
, virt_page2
);
914 tb_link_phys(tb
, phys_pc
, phys_page2
);
918 /* invalidate all TBs which intersect with the target physical page
919 starting in range [start;end[. NOTE: start and end must refer to
920 the same physical page. 'is_cpu_write_access' should be true if called
921 from a real cpu write access: the virtual CPU will exit the current
922 TB if code is modified inside this TB. */
923 void tb_invalidate_phys_page_range(target_phys_addr_t start
, target_phys_addr_t end
,
924 int is_cpu_write_access
)
926 TranslationBlock
*tb
, *tb_next
, *saved_tb
;
927 CPUState
*env
= cpu_single_env
;
928 target_ulong tb_start
, tb_end
;
931 #ifdef TARGET_HAS_PRECISE_SMC
932 int current_tb_not_found
= is_cpu_write_access
;
933 TranslationBlock
*current_tb
= NULL
;
934 int current_tb_modified
= 0;
935 target_ulong current_pc
= 0;
936 target_ulong current_cs_base
= 0;
937 int current_flags
= 0;
938 #endif /* TARGET_HAS_PRECISE_SMC */
940 p
= page_find(start
>> TARGET_PAGE_BITS
);
943 if (!p
->code_bitmap
&&
944 ++p
->code_write_count
>= SMC_BITMAP_USE_THRESHOLD
&&
945 is_cpu_write_access
) {
946 /* build code bitmap */
947 build_page_bitmap(p
);
950 /* we remove all the TBs in the range [start, end[ */
951 /* XXX: see if in some cases it could be faster to invalidate all the code */
955 tb
= (TranslationBlock
*)((long)tb
& ~3);
956 tb_next
= tb
->page_next
[n
];
957 /* NOTE: this is subtle as a TB may span two physical pages */
959 /* NOTE: tb_end may be after the end of the page, but
960 it is not a problem */
961 tb_start
= tb
->page_addr
[0] + (tb
->pc
& ~TARGET_PAGE_MASK
);
962 tb_end
= tb_start
+ tb
->size
;
964 tb_start
= tb
->page_addr
[1];
965 tb_end
= tb_start
+ ((tb
->pc
+ tb
->size
) & ~TARGET_PAGE_MASK
);
967 if (!(tb_end
<= start
|| tb_start
>= end
)) {
968 #ifdef TARGET_HAS_PRECISE_SMC
969 if (current_tb_not_found
) {
970 current_tb_not_found
= 0;
972 if (env
->mem_io_pc
) {
973 /* now we have a real cpu fault */
974 current_tb
= tb_find_pc(env
->mem_io_pc
);
977 if (current_tb
== tb
&&
978 (current_tb
->cflags
& CF_COUNT_MASK
) != 1) {
979 /* If we are modifying the current TB, we must stop
980 its execution. We could be more precise by checking
981 that the modification is after the current PC, but it
982 would require a specialized function to partially
983 restore the CPU state */
985 current_tb_modified
= 1;
986 cpu_restore_state(current_tb
, env
,
987 env
->mem_io_pc
, NULL
);
988 cpu_get_tb_cpu_state(env
, ¤t_pc
, ¤t_cs_base
,
991 #endif /* TARGET_HAS_PRECISE_SMC */
992 /* we need to do that to handle the case where a signal
993 occurs while doing tb_phys_invalidate() */
996 saved_tb
= env
->current_tb
;
997 env
->current_tb
= NULL
;
999 tb_phys_invalidate(tb
, -1);
1001 env
->current_tb
= saved_tb
;
1002 if (env
->interrupt_request
&& env
->current_tb
)
1003 cpu_interrupt(env
, env
->interrupt_request
);
1008 #if !defined(CONFIG_USER_ONLY)
1009 /* if no code remaining, no need to continue to use slow writes */
1011 invalidate_page_bitmap(p
);
1012 if (is_cpu_write_access
) {
1013 tlb_unprotect_code_phys(env
, start
, env
->mem_io_vaddr
);
1017 #ifdef TARGET_HAS_PRECISE_SMC
1018 if (current_tb_modified
) {
1019 /* we generate a block containing just the instruction
1020 modifying the memory. It will ensure that it cannot modify
1022 env
->current_tb
= NULL
;
1023 tb_gen_code(env
, current_pc
, current_cs_base
, current_flags
, 1);
1024 cpu_resume_from_signal(env
, NULL
);
1029 /* len must be <= 8 and start must be a multiple of len */
1030 static inline void tb_invalidate_phys_page_fast(target_phys_addr_t start
, int len
)
1036 qemu_log("modifying code at 0x%x size=%d EIP=%x PC=%08x\n",
1037 cpu_single_env
->mem_io_vaddr
, len
,
1038 cpu_single_env
->eip
,
1039 cpu_single_env
->eip
+ (long)cpu_single_env
->segs
[R_CS
].base
);
1042 p
= page_find(start
>> TARGET_PAGE_BITS
);
1045 if (p
->code_bitmap
) {
1046 offset
= start
& ~TARGET_PAGE_MASK
;
1047 b
= p
->code_bitmap
[offset
>> 3] >> (offset
& 7);
1048 if (b
& ((1 << len
) - 1))
1052 tb_invalidate_phys_page_range(start
, start
+ len
, 1);
1056 #if !defined(CONFIG_SOFTMMU)
1057 static void tb_invalidate_phys_page(target_phys_addr_t addr
,
1058 unsigned long pc
, void *puc
)
1060 TranslationBlock
*tb
;
1063 #ifdef TARGET_HAS_PRECISE_SMC
1064 TranslationBlock
*current_tb
= NULL
;
1065 CPUState
*env
= cpu_single_env
;
1066 int current_tb_modified
= 0;
1067 target_ulong current_pc
= 0;
1068 target_ulong current_cs_base
= 0;
1069 int current_flags
= 0;
1072 addr
&= TARGET_PAGE_MASK
;
1073 p
= page_find(addr
>> TARGET_PAGE_BITS
);
1077 #ifdef TARGET_HAS_PRECISE_SMC
1078 if (tb
&& pc
!= 0) {
1079 current_tb
= tb_find_pc(pc
);
1082 while (tb
!= NULL
) {
1084 tb
= (TranslationBlock
*)((long)tb
& ~3);
1085 #ifdef TARGET_HAS_PRECISE_SMC
1086 if (current_tb
== tb
&&
1087 (current_tb
->cflags
& CF_COUNT_MASK
) != 1) {
1088 /* If we are modifying the current TB, we must stop
1089 its execution. We could be more precise by checking
1090 that the modification is after the current PC, but it
1091 would require a specialized function to partially
1092 restore the CPU state */
1094 current_tb_modified
= 1;
1095 cpu_restore_state(current_tb
, env
, pc
, puc
);
1096 cpu_get_tb_cpu_state(env
, ¤t_pc
, ¤t_cs_base
,
1099 #endif /* TARGET_HAS_PRECISE_SMC */
1100 tb_phys_invalidate(tb
, addr
);
1101 tb
= tb
->page_next
[n
];
1104 #ifdef TARGET_HAS_PRECISE_SMC
1105 if (current_tb_modified
) {
1106 /* we generate a block containing just the instruction
1107 modifying the memory. It will ensure that it cannot modify
1109 env
->current_tb
= NULL
;
1110 tb_gen_code(env
, current_pc
, current_cs_base
, current_flags
, 1);
1111 cpu_resume_from_signal(env
, puc
);
1117 /* add the tb in the target page and protect it if necessary */
1118 static inline void tb_alloc_page(TranslationBlock
*tb
,
1119 unsigned int n
, target_ulong page_addr
)
1122 TranslationBlock
*last_first_tb
;
1124 tb
->page_addr
[n
] = page_addr
;
1125 p
= page_find_alloc(page_addr
>> TARGET_PAGE_BITS
);
1126 tb
->page_next
[n
] = p
->first_tb
;
1127 last_first_tb
= p
->first_tb
;
1128 p
->first_tb
= (TranslationBlock
*)((long)tb
| n
);
1129 invalidate_page_bitmap(p
);
1131 #if defined(TARGET_HAS_SMC) || 1
1133 #if defined(CONFIG_USER_ONLY)
1134 if (p
->flags
& PAGE_WRITE
) {
1139 /* force the host page as non writable (writes will have a
1140 page fault + mprotect overhead) */
1141 page_addr
&= qemu_host_page_mask
;
1143 for(addr
= page_addr
; addr
< page_addr
+ qemu_host_page_size
;
1144 addr
+= TARGET_PAGE_SIZE
) {
1146 p2
= page_find (addr
>> TARGET_PAGE_BITS
);
1150 p2
->flags
&= ~PAGE_WRITE
;
1151 page_get_flags(addr
);
1153 mprotect(g2h(page_addr
), qemu_host_page_size
,
1154 (prot
& PAGE_BITS
) & ~PAGE_WRITE
);
1155 #ifdef DEBUG_TB_INVALIDATE
1156 printf("protecting code page: 0x" TARGET_FMT_lx
"\n",
1161 /* if some code is already present, then the pages are already
1162 protected. So we handle the case where only the first TB is
1163 allocated in a physical page */
1164 if (!last_first_tb
) {
1165 tlb_protect_code(page_addr
);
1169 #endif /* TARGET_HAS_SMC */
1172 /* Allocate a new translation block. Flush the translation buffer if
1173 too many translation blocks or too much generated code. */
1174 TranslationBlock
*tb_alloc(target_ulong pc
)
1176 TranslationBlock
*tb
;
1178 if (nb_tbs
>= code_gen_max_blocks
||
1179 (code_gen_ptr
- code_gen_buffer
) >= code_gen_buffer_max_size
)
1181 tb
= &tbs
[nb_tbs
++];
1187 void tb_free(TranslationBlock
*tb
)
1189 /* In practice this is mostly used for single use temporary TB
1190 Ignore the hard cases and just back up if this TB happens to
1191 be the last one generated. */
1192 if (nb_tbs
> 0 && tb
== &tbs
[nb_tbs
- 1]) {
1193 code_gen_ptr
= tb
->tc_ptr
;
1198 /* add a new TB and link it to the physical page tables. phys_page2 is
1199 (-1) to indicate that only one page contains the TB. */
1200 void tb_link_phys(TranslationBlock
*tb
,
1201 target_ulong phys_pc
, target_ulong phys_page2
)
1204 TranslationBlock
**ptb
;
1206 /* Grab the mmap lock to stop another thread invalidating this TB
1207 before we are done. */
1209 /* add in the physical hash table */
1210 h
= tb_phys_hash_func(phys_pc
);
1211 ptb
= &tb_phys_hash
[h
];
1212 tb
->phys_hash_next
= *ptb
;
1215 /* add in the page list */
1216 tb_alloc_page(tb
, 0, phys_pc
& TARGET_PAGE_MASK
);
1217 if (phys_page2
!= -1)
1218 tb_alloc_page(tb
, 1, phys_page2
);
1220 tb
->page_addr
[1] = -1;
1222 tb
->jmp_first
= (TranslationBlock
*)((long)tb
| 2);
1223 tb
->jmp_next
[0] = NULL
;
1224 tb
->jmp_next
[1] = NULL
;
1226 /* init original jump addresses */
1227 if (tb
->tb_next_offset
[0] != 0xffff)
1228 tb_reset_jump(tb
, 0);
1229 if (tb
->tb_next_offset
[1] != 0xffff)
1230 tb_reset_jump(tb
, 1);
1232 #ifdef DEBUG_TB_CHECK
1238 /* find the TB 'tb' such that tb[0].tc_ptr <= tc_ptr <
1239 tb[1].tc_ptr. Return NULL if not found */
1240 TranslationBlock
*tb_find_pc(unsigned long tc_ptr
)
1242 int m_min
, m_max
, m
;
1244 TranslationBlock
*tb
;
1248 if (tc_ptr
< (unsigned long)code_gen_buffer
||
1249 tc_ptr
>= (unsigned long)code_gen_ptr
)
1251 /* binary search (cf Knuth) */
1254 while (m_min
<= m_max
) {
1255 m
= (m_min
+ m_max
) >> 1;
1257 v
= (unsigned long)tb
->tc_ptr
;
1260 else if (tc_ptr
< v
) {
1269 static void tb_reset_jump_recursive(TranslationBlock
*tb
);
1271 static inline void tb_reset_jump_recursive2(TranslationBlock
*tb
, int n
)
1273 TranslationBlock
*tb1
, *tb_next
, **ptb
;
1276 tb1
= tb
->jmp_next
[n
];
1278 /* find head of list */
1281 tb1
= (TranslationBlock
*)((long)tb1
& ~3);
1284 tb1
= tb1
->jmp_next
[n1
];
1286 /* we are now sure now that tb jumps to tb1 */
1289 /* remove tb from the jmp_first list */
1290 ptb
= &tb_next
->jmp_first
;
1294 tb1
= (TranslationBlock
*)((long)tb1
& ~3);
1295 if (n1
== n
&& tb1
== tb
)
1297 ptb
= &tb1
->jmp_next
[n1
];
1299 *ptb
= tb
->jmp_next
[n
];
1300 tb
->jmp_next
[n
] = NULL
;
1302 /* suppress the jump to next tb in generated code */
1303 tb_reset_jump(tb
, n
);
1305 /* suppress jumps in the tb on which we could have jumped */
1306 tb_reset_jump_recursive(tb_next
);
1310 static void tb_reset_jump_recursive(TranslationBlock
*tb
)
1312 tb_reset_jump_recursive2(tb
, 0);
1313 tb_reset_jump_recursive2(tb
, 1);
1316 #if defined(TARGET_HAS_ICE)
1317 static void breakpoint_invalidate(CPUState
*env
, target_ulong pc
)
1319 target_phys_addr_t addr
;
1321 ram_addr_t ram_addr
;
1324 addr
= cpu_get_phys_page_debug(env
, pc
);
1325 p
= phys_page_find(addr
>> TARGET_PAGE_BITS
);
1327 pd
= IO_MEM_UNASSIGNED
;
1329 pd
= p
->phys_offset
;
1331 ram_addr
= (pd
& TARGET_PAGE_MASK
) | (pc
& ~TARGET_PAGE_MASK
);
1332 tb_invalidate_phys_page_range(ram_addr
, ram_addr
+ 1, 0);
1336 /* Add a watchpoint. */
1337 int cpu_watchpoint_insert(CPUState
*env
, target_ulong addr
, target_ulong len
,
1338 int flags
, CPUWatchpoint
**watchpoint
)
1340 target_ulong len_mask
= ~(len
- 1);
1343 /* sanity checks: allow power-of-2 lengths, deny unaligned watchpoints */
1344 if ((len
!= 1 && len
!= 2 && len
!= 4 && len
!= 8) || (addr
& ~len_mask
)) {
1345 fprintf(stderr
, "qemu: tried to set invalid watchpoint at "
1346 TARGET_FMT_lx
", len=" TARGET_FMT_lu
"\n", addr
, len
);
1349 wp
= qemu_malloc(sizeof(*wp
));
1352 wp
->len_mask
= len_mask
;
1355 /* keep all GDB-injected watchpoints in front */
1357 TAILQ_INSERT_HEAD(&env
->watchpoints
, wp
, entry
);
1359 TAILQ_INSERT_TAIL(&env
->watchpoints
, wp
, entry
);
1361 tlb_flush_page(env
, addr
);
1368 /* Remove a specific watchpoint. */
1369 int cpu_watchpoint_remove(CPUState
*env
, target_ulong addr
, target_ulong len
,
1372 target_ulong len_mask
= ~(len
- 1);
1375 TAILQ_FOREACH(wp
, &env
->watchpoints
, entry
) {
1376 if (addr
== wp
->vaddr
&& len_mask
== wp
->len_mask
1377 && flags
== (wp
->flags
& ~BP_WATCHPOINT_HIT
)) {
1378 cpu_watchpoint_remove_by_ref(env
, wp
);
1385 /* Remove a specific watchpoint by reference. */
1386 void cpu_watchpoint_remove_by_ref(CPUState
*env
, CPUWatchpoint
*watchpoint
)
1388 TAILQ_REMOVE(&env
->watchpoints
, watchpoint
, entry
);
1390 tlb_flush_page(env
, watchpoint
->vaddr
);
1392 qemu_free(watchpoint
);
1395 /* Remove all matching watchpoints. */
1396 void cpu_watchpoint_remove_all(CPUState
*env
, int mask
)
1398 CPUWatchpoint
*wp
, *next
;
1400 TAILQ_FOREACH_SAFE(wp
, &env
->watchpoints
, entry
, next
) {
1401 if (wp
->flags
& mask
)
1402 cpu_watchpoint_remove_by_ref(env
, wp
);
1406 /* Add a breakpoint. */
1407 int cpu_breakpoint_insert(CPUState
*env
, target_ulong pc
, int flags
,
1408 CPUBreakpoint
**breakpoint
)
1410 #if defined(TARGET_HAS_ICE)
1413 bp
= qemu_malloc(sizeof(*bp
));
1418 /* keep all GDB-injected breakpoints in front */
1420 TAILQ_INSERT_HEAD(&env
->breakpoints
, bp
, entry
);
1422 TAILQ_INSERT_TAIL(&env
->breakpoints
, bp
, entry
);
1424 breakpoint_invalidate(env
, pc
);
1434 /* Remove a specific breakpoint. */
1435 int cpu_breakpoint_remove(CPUState
*env
, target_ulong pc
, int flags
)
1437 #if defined(TARGET_HAS_ICE)
1440 TAILQ_FOREACH(bp
, &env
->breakpoints
, entry
) {
1441 if (bp
->pc
== pc
&& bp
->flags
== flags
) {
1442 cpu_breakpoint_remove_by_ref(env
, bp
);
1452 /* Remove a specific breakpoint by reference. */
1453 void cpu_breakpoint_remove_by_ref(CPUState
*env
, CPUBreakpoint
*breakpoint
)
1455 #if defined(TARGET_HAS_ICE)
1456 TAILQ_REMOVE(&env
->breakpoints
, breakpoint
, entry
);
1458 breakpoint_invalidate(env
, breakpoint
->pc
);
1460 qemu_free(breakpoint
);
1464 /* Remove all matching breakpoints. */
1465 void cpu_breakpoint_remove_all(CPUState
*env
, int mask
)
1467 #if defined(TARGET_HAS_ICE)
1468 CPUBreakpoint
*bp
, *next
;
1470 TAILQ_FOREACH_SAFE(bp
, &env
->breakpoints
, entry
, next
) {
1471 if (bp
->flags
& mask
)
1472 cpu_breakpoint_remove_by_ref(env
, bp
);
1477 /* enable or disable single step mode. EXCP_DEBUG is returned by the
1478 CPU loop after each instruction */
1479 void cpu_single_step(CPUState
*env
, int enabled
)
1481 #if defined(TARGET_HAS_ICE)
1482 if (env
->singlestep_enabled
!= enabled
) {
1483 env
->singlestep_enabled
= enabled
;
1485 kvm_update_guest_debug(env
, 0);
1487 /* must flush all the translated code to avoid inconsistencies */
1488 /* XXX: only flush what is necessary */
1495 /* enable or disable low levels log */
1496 void cpu_set_log(int log_flags
)
1498 loglevel
= log_flags
;
1499 if (loglevel
&& !logfile
) {
1500 logfile
= fopen(logfilename
, log_append
? "a" : "w");
1502 perror(logfilename
);
1505 #if !defined(CONFIG_SOFTMMU)
1506 /* must avoid mmap() usage of glibc by setting a buffer "by hand" */
1508 static char logfile_buf
[4096];
1509 setvbuf(logfile
, logfile_buf
, _IOLBF
, sizeof(logfile_buf
));
1512 setvbuf(logfile
, NULL
, _IOLBF
, 0);
1516 if (!loglevel
&& logfile
) {
1522 void cpu_set_log_filename(const char *filename
)
1524 logfilename
= strdup(filename
);
1529 cpu_set_log(loglevel
);
1532 static void cpu_unlink_tb(CPUState
*env
)
1534 #if defined(USE_NPTL)
1535 /* FIXME: TB unchaining isn't SMP safe. For now just ignore the
1536 problem and hope the cpu will stop of its own accord. For userspace
1537 emulation this often isn't actually as bad as it sounds. Often
1538 signals are used primarily to interrupt blocking syscalls. */
1540 TranslationBlock
*tb
;
1541 static spinlock_t interrupt_lock
= SPIN_LOCK_UNLOCKED
;
1543 tb
= env
->current_tb
;
1544 /* if the cpu is currently executing code, we must unlink it and
1545 all the potentially executing TB */
1546 if (tb
&& !testandset(&interrupt_lock
)) {
1547 env
->current_tb
= NULL
;
1548 tb_reset_jump_recursive(tb
);
1549 resetlock(&interrupt_lock
);
1554 /* mask must never be zero, except for A20 change call */
1555 void cpu_interrupt(CPUState
*env
, int mask
)
1559 old_mask
= env
->interrupt_request
;
1560 env
->interrupt_request
|= mask
;
1561 if (kvm_enabled() && !qemu_kvm_irqchip_in_kernel())
1562 kvm_update_interrupt_request(env
);
1564 #ifndef CONFIG_USER_ONLY
1566 * If called from iothread context, wake the target cpu in
1569 if (!qemu_cpu_self(env
)) {
1576 env
->icount_decr
.u16
.high
= 0xffff;
1577 #ifndef CONFIG_USER_ONLY
1579 && (mask
& ~old_mask
) != 0) {
1580 cpu_abort(env
, "Raised interrupt while not in I/O function");
1588 void cpu_reset_interrupt(CPUState
*env
, int mask
)
1590 env
->interrupt_request
&= ~mask
;
1593 void cpu_exit(CPUState
*env
)
1595 env
->exit_request
= 1;
1599 const CPULogItem cpu_log_items
[] = {
1600 { CPU_LOG_TB_OUT_ASM
, "out_asm",
1601 "show generated host assembly code for each compiled TB" },
1602 { CPU_LOG_TB_IN_ASM
, "in_asm",
1603 "show target assembly code for each compiled TB" },
1604 { CPU_LOG_TB_OP
, "op",
1605 "show micro ops for each compiled TB" },
1606 { CPU_LOG_TB_OP_OPT
, "op_opt",
1609 "before eflags optimization and "
1611 "after liveness analysis" },
1612 { CPU_LOG_INT
, "int",
1613 "show interrupts/exceptions in short format" },
1614 { CPU_LOG_EXEC
, "exec",
1615 "show trace before each executed TB (lots of logs)" },
1616 { CPU_LOG_TB_CPU
, "cpu",
1617 "show CPU state before block translation" },
1619 { CPU_LOG_PCALL
, "pcall",
1620 "show protected mode far calls/returns/exceptions" },
1621 { CPU_LOG_RESET
, "cpu_reset",
1622 "show CPU state before CPU resets" },
1625 { CPU_LOG_IOPORT
, "ioport",
1626 "show all i/o ports accesses" },
1631 static int cmp1(const char *s1
, int n
, const char *s2
)
1633 if (strlen(s2
) != n
)
1635 return memcmp(s1
, s2
, n
) == 0;
1638 /* takes a comma separated list of log masks. Return 0 if error. */
1639 int cpu_str_to_log_mask(const char *str
)
1641 const CPULogItem
*item
;
1648 p1
= strchr(p
, ',');
1651 if(cmp1(p
,p1
-p
,"all")) {
1652 for(item
= cpu_log_items
; item
->mask
!= 0; item
++) {
1656 for(item
= cpu_log_items
; item
->mask
!= 0; item
++) {
1657 if (cmp1(p
, p1
- p
, item
->name
))
1671 void cpu_abort(CPUState
*env
, const char *fmt
, ...)
1678 fprintf(stderr
, "qemu: fatal: ");
1679 vfprintf(stderr
, fmt
, ap
);
1680 fprintf(stderr
, "\n");
1682 cpu_dump_state(env
, stderr
, fprintf
, X86_DUMP_FPU
| X86_DUMP_CCOP
);
1684 cpu_dump_state(env
, stderr
, fprintf
, 0);
1686 if (qemu_log_enabled()) {
1687 qemu_log("qemu: fatal: ");
1688 qemu_log_vprintf(fmt
, ap2
);
1691 log_cpu_state(env
, X86_DUMP_FPU
| X86_DUMP_CCOP
);
1693 log_cpu_state(env
, 0);
1703 CPUState
*cpu_copy(CPUState
*env
)
1705 CPUState
*new_env
= cpu_init(env
->cpu_model_str
);
1706 CPUState
*next_cpu
= new_env
->next_cpu
;
1707 int cpu_index
= new_env
->cpu_index
;
1708 #if defined(TARGET_HAS_ICE)
1713 memcpy(new_env
, env
, sizeof(CPUState
));
1715 /* Preserve chaining and index. */
1716 new_env
->next_cpu
= next_cpu
;
1717 new_env
->cpu_index
= cpu_index
;
1719 /* Clone all break/watchpoints.
1720 Note: Once we support ptrace with hw-debug register access, make sure
1721 BP_CPU break/watchpoints are handled correctly on clone. */
1722 TAILQ_INIT(&env
->breakpoints
);
1723 TAILQ_INIT(&env
->watchpoints
);
1724 #if defined(TARGET_HAS_ICE)
1725 TAILQ_FOREACH(bp
, &env
->breakpoints
, entry
) {
1726 cpu_breakpoint_insert(new_env
, bp
->pc
, bp
->flags
, NULL
);
1728 TAILQ_FOREACH(wp
, &env
->watchpoints
, entry
) {
1729 cpu_watchpoint_insert(new_env
, wp
->vaddr
, (~wp
->len_mask
) + 1,
1737 #if !defined(CONFIG_USER_ONLY)
1739 static inline void tlb_flush_jmp_cache(CPUState
*env
, target_ulong addr
)
1743 /* Discard jump cache entries for any tb which might potentially
1744 overlap the flushed page. */
1745 i
= tb_jmp_cache_hash_page(addr
- TARGET_PAGE_SIZE
);
1746 memset (&env
->tb_jmp_cache
[i
], 0,
1747 TB_JMP_PAGE_SIZE
* sizeof(TranslationBlock
*));
1749 i
= tb_jmp_cache_hash_page(addr
);
1750 memset (&env
->tb_jmp_cache
[i
], 0,
1751 TB_JMP_PAGE_SIZE
* sizeof(TranslationBlock
*));
1754 static CPUTLBEntry s_cputlb_empty_entry
= {
1761 /* NOTE: if flush_global is true, also flush global entries (not
1763 void tlb_flush(CPUState
*env
, int flush_global
)
1767 #if defined(DEBUG_TLB)
1768 printf("tlb_flush:\n");
1770 /* must reset current TB so that interrupts cannot modify the
1771 links while we are modifying them */
1772 env
->current_tb
= NULL
;
1774 for(i
= 0; i
< CPU_TLB_SIZE
; i
++) {
1776 for (mmu_idx
= 0; mmu_idx
< NB_MMU_MODES
; mmu_idx
++) {
1777 env
->tlb_table
[mmu_idx
][i
] = s_cputlb_empty_entry
;
1781 memset (env
->tb_jmp_cache
, 0, TB_JMP_CACHE_SIZE
* sizeof (void *));
1784 if (env
->kqemu_enabled
) {
1785 kqemu_flush(env
, flush_global
);
1791 static inline void tlb_flush_entry(CPUTLBEntry
*tlb_entry
, target_ulong addr
)
1793 if (addr
== (tlb_entry
->addr_read
&
1794 (TARGET_PAGE_MASK
| TLB_INVALID_MASK
)) ||
1795 addr
== (tlb_entry
->addr_write
&
1796 (TARGET_PAGE_MASK
| TLB_INVALID_MASK
)) ||
1797 addr
== (tlb_entry
->addr_code
&
1798 (TARGET_PAGE_MASK
| TLB_INVALID_MASK
))) {
1799 *tlb_entry
= s_cputlb_empty_entry
;
1803 void tlb_flush_page(CPUState
*env
, target_ulong addr
)
1808 #if defined(DEBUG_TLB)
1809 printf("tlb_flush_page: " TARGET_FMT_lx
"\n", addr
);
1811 /* must reset current TB so that interrupts cannot modify the
1812 links while we are modifying them */
1813 env
->current_tb
= NULL
;
1815 addr
&= TARGET_PAGE_MASK
;
1816 i
= (addr
>> TARGET_PAGE_BITS
) & (CPU_TLB_SIZE
- 1);
1817 for (mmu_idx
= 0; mmu_idx
< NB_MMU_MODES
; mmu_idx
++)
1818 tlb_flush_entry(&env
->tlb_table
[mmu_idx
][i
], addr
);
1820 tlb_flush_jmp_cache(env
, addr
);
1823 if (env
->kqemu_enabled
) {
1824 kqemu_flush_page(env
, addr
);
1829 /* update the TLBs so that writes to code in the virtual page 'addr'
1831 static void tlb_protect_code(ram_addr_t ram_addr
)
1833 cpu_physical_memory_reset_dirty(ram_addr
,
1834 ram_addr
+ TARGET_PAGE_SIZE
,
1838 /* update the TLB so that writes in physical page 'phys_addr' are no longer
1839 tested for self modifying code */
1840 static void tlb_unprotect_code_phys(CPUState
*env
, ram_addr_t ram_addr
,
1843 phys_ram_dirty
[ram_addr
>> TARGET_PAGE_BITS
] |= CODE_DIRTY_FLAG
;
1846 static inline void tlb_reset_dirty_range(CPUTLBEntry
*tlb_entry
,
1847 unsigned long start
, unsigned long length
)
1850 if ((tlb_entry
->addr_write
& ~TARGET_PAGE_MASK
) == IO_MEM_RAM
) {
1851 addr
= (tlb_entry
->addr_write
& TARGET_PAGE_MASK
) + tlb_entry
->addend
;
1852 if ((addr
- start
) < length
) {
1853 tlb_entry
->addr_write
= (tlb_entry
->addr_write
& TARGET_PAGE_MASK
) | TLB_NOTDIRTY
;
1858 /* Note: start and end must be within the same ram block. */
1859 void cpu_physical_memory_reset_dirty(ram_addr_t start
, ram_addr_t end
,
1863 unsigned long length
, start1
;
1867 start
&= TARGET_PAGE_MASK
;
1868 end
= TARGET_PAGE_ALIGN(end
);
1870 length
= end
- start
;
1873 len
= length
>> TARGET_PAGE_BITS
;
1875 /* XXX: should not depend on cpu context */
1877 if (env
->kqemu_enabled
) {
1880 for(i
= 0; i
< len
; i
++) {
1881 kqemu_set_notdirty(env
, addr
);
1882 addr
+= TARGET_PAGE_SIZE
;
1886 mask
= ~dirty_flags
;
1887 p
= phys_ram_dirty
+ (start
>> TARGET_PAGE_BITS
);
1888 for(i
= 0; i
< len
; i
++)
1891 /* we modify the TLB cache so that the dirty bit will be set again
1892 when accessing the range */
1893 start1
= (unsigned long)qemu_get_ram_ptr(start
);
1894 /* Chek that we don't span multiple blocks - this breaks the
1895 address comparisons below. */
1896 if ((unsigned long)qemu_get_ram_ptr(end
- 1) - start1
1897 != (end
- 1) - start
) {
1901 for(env
= first_cpu
; env
!= NULL
; env
= env
->next_cpu
) {
1903 for (mmu_idx
= 0; mmu_idx
< NB_MMU_MODES
; mmu_idx
++) {
1904 for(i
= 0; i
< CPU_TLB_SIZE
; i
++)
1905 tlb_reset_dirty_range(&env
->tlb_table
[mmu_idx
][i
],
1911 int cpu_physical_memory_set_dirty_tracking(int enable
)
1913 if (kvm_enabled()) {
1914 return kvm_set_migration_log(enable
);
1919 int cpu_physical_memory_get_dirty_tracking(void)
1921 return in_migration
;
1924 int cpu_physical_sync_dirty_bitmap(target_phys_addr_t start_addr
,
1925 target_phys_addr_t end_addr
)
1930 ret
= kvm_physical_sync_dirty_bitmap(start_addr
, end_addr
);
1934 static inline void tlb_update_dirty(CPUTLBEntry
*tlb_entry
)
1936 ram_addr_t ram_addr
;
1939 if ((tlb_entry
->addr_write
& ~TARGET_PAGE_MASK
) == IO_MEM_RAM
) {
1940 p
= (void *)(unsigned long)((tlb_entry
->addr_write
& TARGET_PAGE_MASK
)
1941 + tlb_entry
->addend
);
1942 ram_addr
= qemu_ram_addr_from_host(p
);
1943 if (!cpu_physical_memory_is_dirty(ram_addr
)) {
1944 tlb_entry
->addr_write
|= TLB_NOTDIRTY
;
1949 /* update the TLB according to the current state of the dirty bits */
1950 void cpu_tlb_update_dirty(CPUState
*env
)
1954 for (mmu_idx
= 0; mmu_idx
< NB_MMU_MODES
; mmu_idx
++) {
1955 for(i
= 0; i
< CPU_TLB_SIZE
; i
++)
1956 tlb_update_dirty(&env
->tlb_table
[mmu_idx
][i
]);
1960 static inline void tlb_set_dirty1(CPUTLBEntry
*tlb_entry
, target_ulong vaddr
)
1962 if (tlb_entry
->addr_write
== (vaddr
| TLB_NOTDIRTY
))
1963 tlb_entry
->addr_write
= vaddr
;
1966 /* update the TLB corresponding to virtual page vaddr
1967 so that it is no longer dirty */
1968 static inline void tlb_set_dirty(CPUState
*env
, target_ulong vaddr
)
1973 vaddr
&= TARGET_PAGE_MASK
;
1974 i
= (vaddr
>> TARGET_PAGE_BITS
) & (CPU_TLB_SIZE
- 1);
1975 for (mmu_idx
= 0; mmu_idx
< NB_MMU_MODES
; mmu_idx
++)
1976 tlb_set_dirty1(&env
->tlb_table
[mmu_idx
][i
], vaddr
);
1979 /* add a new TLB entry. At most one entry for a given virtual address
1980 is permitted. Return 0 if OK or 2 if the page could not be mapped
1981 (can only happen in non SOFTMMU mode for I/O pages or pages
1982 conflicting with the host address space). */
1983 int tlb_set_page_exec(CPUState
*env
, target_ulong vaddr
,
1984 target_phys_addr_t paddr
, int prot
,
1985 int mmu_idx
, int is_softmmu
)
1990 target_ulong address
;
1991 target_ulong code_address
;
1992 target_phys_addr_t addend
;
1996 target_phys_addr_t iotlb
;
1998 p
= phys_page_find(paddr
>> TARGET_PAGE_BITS
);
2000 pd
= IO_MEM_UNASSIGNED
;
2002 pd
= p
->phys_offset
;
2004 #if defined(DEBUG_TLB)
2005 printf("tlb_set_page: vaddr=" TARGET_FMT_lx
" paddr=0x%08x prot=%x idx=%d smmu=%d pd=0x%08lx\n",
2006 vaddr
, (int)paddr
, prot
, mmu_idx
, is_softmmu
, pd
);
2011 if ((pd
& ~TARGET_PAGE_MASK
) > IO_MEM_ROM
&& !(pd
& IO_MEM_ROMD
)) {
2012 /* IO memory case (romd handled later) */
2013 address
|= TLB_MMIO
;
2015 addend
= (unsigned long)qemu_get_ram_ptr(pd
& TARGET_PAGE_MASK
);
2016 if ((pd
& ~TARGET_PAGE_MASK
) <= IO_MEM_ROM
) {
2018 iotlb
= pd
& TARGET_PAGE_MASK
;
2019 if ((pd
& ~TARGET_PAGE_MASK
) == IO_MEM_RAM
)
2020 iotlb
|= IO_MEM_NOTDIRTY
;
2022 iotlb
|= IO_MEM_ROM
;
2024 /* IO handlers are currently passed a physical address.
2025 It would be nice to pass an offset from the base address
2026 of that region. This would avoid having to special case RAM,
2027 and avoid full address decoding in every device.
2028 We can't use the high bits of pd for this because
2029 IO_MEM_ROMD uses these as a ram address. */
2030 iotlb
= (pd
& ~TARGET_PAGE_MASK
);
2032 iotlb
+= p
->region_offset
;
2038 code_address
= address
;
2039 /* Make accesses to pages with watchpoints go via the
2040 watchpoint trap routines. */
2041 TAILQ_FOREACH(wp
, &env
->watchpoints
, entry
) {
2042 if (vaddr
== (wp
->vaddr
& TARGET_PAGE_MASK
)) {
2043 iotlb
= io_mem_watch
+ paddr
;
2044 /* TODO: The memory case can be optimized by not trapping
2045 reads of pages with a write breakpoint. */
2046 address
|= TLB_MMIO
;
2050 index
= (vaddr
>> TARGET_PAGE_BITS
) & (CPU_TLB_SIZE
- 1);
2051 env
->iotlb
[mmu_idx
][index
] = iotlb
- vaddr
;
2052 te
= &env
->tlb_table
[mmu_idx
][index
];
2053 te
->addend
= addend
- vaddr
;
2054 if (prot
& PAGE_READ
) {
2055 te
->addr_read
= address
;
2060 if (prot
& PAGE_EXEC
) {
2061 te
->addr_code
= code_address
;
2065 if (prot
& PAGE_WRITE
) {
2066 if ((pd
& ~TARGET_PAGE_MASK
) == IO_MEM_ROM
||
2067 (pd
& IO_MEM_ROMD
)) {
2068 /* Write access calls the I/O callback. */
2069 te
->addr_write
= address
| TLB_MMIO
;
2070 } else if ((pd
& ~TARGET_PAGE_MASK
) == IO_MEM_RAM
&&
2071 !cpu_physical_memory_is_dirty(pd
)) {
2072 te
->addr_write
= address
| TLB_NOTDIRTY
;
2074 te
->addr_write
= address
;
2077 te
->addr_write
= -1;
2084 void tlb_flush(CPUState
*env
, int flush_global
)
2088 void tlb_flush_page(CPUState
*env
, target_ulong addr
)
2092 int tlb_set_page_exec(CPUState
*env
, target_ulong vaddr
,
2093 target_phys_addr_t paddr
, int prot
,
2094 int mmu_idx
, int is_softmmu
)
2100 * Walks guest process memory "regions" one by one
2101 * and calls callback function 'fn' for each region.
2103 int walk_memory_regions(void *priv
,
2104 int (*fn
)(void *, unsigned long, unsigned long, unsigned long))
2106 unsigned long start
, end
;
2108 int i
, j
, prot
, prot1
;
2114 for (i
= 0; i
<= L1_SIZE
; i
++) {
2115 p
= (i
< L1_SIZE
) ? l1_map
[i
] : NULL
;
2116 for (j
= 0; j
< L2_SIZE
; j
++) {
2117 prot1
= (p
== NULL
) ? 0 : p
[j
].flags
;
2119 * "region" is one continuous chunk of memory
2120 * that has same protection flags set.
2122 if (prot1
!= prot
) {
2123 end
= (i
<< (32 - L1_BITS
)) | (j
<< TARGET_PAGE_BITS
);
2125 rc
= (*fn
)(priv
, start
, end
, prot
);
2126 /* callback can stop iteration by returning != 0 */
2143 static int dump_region(void *priv
, unsigned long start
,
2144 unsigned long end
, unsigned long prot
)
2146 FILE *f
= (FILE *)priv
;
2148 (void) fprintf(f
, "%08lx-%08lx %08lx %c%c%c\n",
2149 start
, end
, end
- start
,
2150 ((prot
& PAGE_READ
) ? 'r' : '-'),
2151 ((prot
& PAGE_WRITE
) ? 'w' : '-'),
2152 ((prot
& PAGE_EXEC
) ? 'x' : '-'));
2157 /* dump memory mappings */
2158 void page_dump(FILE *f
)
2160 (void) fprintf(f
, "%-8s %-8s %-8s %s\n",
2161 "start", "end", "size", "prot");
2162 walk_memory_regions(f
, dump_region
);
2165 int page_get_flags(target_ulong address
)
2169 p
= page_find(address
>> TARGET_PAGE_BITS
);
2175 /* modify the flags of a page and invalidate the code if
2176 necessary. The flag PAGE_WRITE_ORG is positioned automatically
2177 depending on PAGE_WRITE */
2178 void page_set_flags(target_ulong start
, target_ulong end
, int flags
)
2183 /* mmap_lock should already be held. */
2184 start
= start
& TARGET_PAGE_MASK
;
2185 end
= TARGET_PAGE_ALIGN(end
);
2186 if (flags
& PAGE_WRITE
)
2187 flags
|= PAGE_WRITE_ORG
;
2188 for(addr
= start
; addr
< end
; addr
+= TARGET_PAGE_SIZE
) {
2189 p
= page_find_alloc(addr
>> TARGET_PAGE_BITS
);
2190 /* We may be called for host regions that are outside guest
2194 /* if the write protection is set, then we invalidate the code
2196 if (!(p
->flags
& PAGE_WRITE
) &&
2197 (flags
& PAGE_WRITE
) &&
2199 tb_invalidate_phys_page(addr
, 0, NULL
);
2205 int page_check_range(target_ulong start
, target_ulong len
, int flags
)
2211 if (start
+ len
< start
)
2212 /* we've wrapped around */
2215 end
= TARGET_PAGE_ALIGN(start
+len
); /* must do before we loose bits in the next step */
2216 start
= start
& TARGET_PAGE_MASK
;
2218 for(addr
= start
; addr
< end
; addr
+= TARGET_PAGE_SIZE
) {
2219 p
= page_find(addr
>> TARGET_PAGE_BITS
);
2222 if( !(p
->flags
& PAGE_VALID
) )
2225 if ((flags
& PAGE_READ
) && !(p
->flags
& PAGE_READ
))
2227 if (flags
& PAGE_WRITE
) {
2228 if (!(p
->flags
& PAGE_WRITE_ORG
))
2230 /* unprotect the page if it was put read-only because it
2231 contains translated code */
2232 if (!(p
->flags
& PAGE_WRITE
)) {
2233 if (!page_unprotect(addr
, 0, NULL
))
2242 /* called from signal handler: invalidate the code and unprotect the
2243 page. Return TRUE if the fault was successfully handled. */
2244 int page_unprotect(target_ulong address
, unsigned long pc
, void *puc
)
2246 unsigned int page_index
, prot
, pindex
;
2248 target_ulong host_start
, host_end
, addr
;
2250 /* Technically this isn't safe inside a signal handler. However we
2251 know this only ever happens in a synchronous SEGV handler, so in
2252 practice it seems to be ok. */
2255 host_start
= address
& qemu_host_page_mask
;
2256 page_index
= host_start
>> TARGET_PAGE_BITS
;
2257 p1
= page_find(page_index
);
2262 host_end
= host_start
+ qemu_host_page_size
;
2265 for(addr
= host_start
;addr
< host_end
; addr
+= TARGET_PAGE_SIZE
) {
2269 /* if the page was really writable, then we change its
2270 protection back to writable */
2271 if (prot
& PAGE_WRITE_ORG
) {
2272 pindex
= (address
- host_start
) >> TARGET_PAGE_BITS
;
2273 if (!(p1
[pindex
].flags
& PAGE_WRITE
)) {
2274 mprotect((void *)g2h(host_start
), qemu_host_page_size
,
2275 (prot
& PAGE_BITS
) | PAGE_WRITE
);
2276 p1
[pindex
].flags
|= PAGE_WRITE
;
2277 /* and since the content will be modified, we must invalidate
2278 the corresponding translated code. */
2279 tb_invalidate_phys_page(address
, pc
, puc
);
2280 #ifdef DEBUG_TB_CHECK
2281 tb_invalidate_check(address
);
2291 static inline void tlb_set_dirty(CPUState
*env
,
2292 unsigned long addr
, target_ulong vaddr
)
2295 #endif /* defined(CONFIG_USER_ONLY) */
2297 #if !defined(CONFIG_USER_ONLY)
2299 static int subpage_register (subpage_t
*mmio
, uint32_t start
, uint32_t end
,
2300 ram_addr_t memory
, ram_addr_t region_offset
);
2301 static void *subpage_init (target_phys_addr_t base
, ram_addr_t
*phys
,
2302 ram_addr_t orig_memory
, ram_addr_t region_offset
);
2303 #define CHECK_SUBPAGE(addr, start_addr, start_addr2, end_addr, end_addr2, \
2306 if (addr > start_addr) \
2309 start_addr2 = start_addr & ~TARGET_PAGE_MASK; \
2310 if (start_addr2 > 0) \
2314 if ((start_addr + orig_size) - addr >= TARGET_PAGE_SIZE) \
2315 end_addr2 = TARGET_PAGE_SIZE - 1; \
2317 end_addr2 = (start_addr + orig_size - 1) & ~TARGET_PAGE_MASK; \
2318 if (end_addr2 < TARGET_PAGE_SIZE - 1) \
2323 /* register physical memory. 'size' must be a multiple of the target
2324 page size. If (phys_offset & ~TARGET_PAGE_MASK) != 0, then it is an
2325 io memory page. The address used when calling the IO function is
2326 the offset from the start of the region, plus region_offset. Both
2327 start_addr and region_offset are rounded down to a page boundary
2328 before calculating this offset. This should not be a problem unless
2329 the low bits of start_addr and region_offset differ. */
2330 void cpu_register_physical_memory_offset(target_phys_addr_t start_addr
,
2332 ram_addr_t phys_offset
,
2333 ram_addr_t region_offset
)
2335 target_phys_addr_t addr
, end_addr
;
2338 ram_addr_t orig_size
= size
;
2342 /* XXX: should not depend on cpu context */
2344 if (env
->kqemu_enabled
) {
2345 kqemu_set_phys_mem(start_addr
, size
, phys_offset
);
2349 kvm_set_phys_mem(start_addr
, size
, phys_offset
);
2351 if (phys_offset
== IO_MEM_UNASSIGNED
) {
2352 region_offset
= start_addr
;
2354 region_offset
&= TARGET_PAGE_MASK
;
2355 size
= (size
+ TARGET_PAGE_SIZE
- 1) & TARGET_PAGE_MASK
;
2356 end_addr
= start_addr
+ (target_phys_addr_t
)size
;
2357 for(addr
= start_addr
; addr
!= end_addr
; addr
+= TARGET_PAGE_SIZE
) {
2358 p
= phys_page_find(addr
>> TARGET_PAGE_BITS
);
2359 if (p
&& p
->phys_offset
!= IO_MEM_UNASSIGNED
) {
2360 ram_addr_t orig_memory
= p
->phys_offset
;
2361 target_phys_addr_t start_addr2
, end_addr2
;
2362 int need_subpage
= 0;
2364 CHECK_SUBPAGE(addr
, start_addr
, start_addr2
, end_addr
, end_addr2
,
2366 if (need_subpage
|| phys_offset
& IO_MEM_SUBWIDTH
) {
2367 if (!(orig_memory
& IO_MEM_SUBPAGE
)) {
2368 subpage
= subpage_init((addr
& TARGET_PAGE_MASK
),
2369 &p
->phys_offset
, orig_memory
,
2372 subpage
= io_mem_opaque
[(orig_memory
& ~TARGET_PAGE_MASK
)
2375 subpage_register(subpage
, start_addr2
, end_addr2
, phys_offset
,
2377 p
->region_offset
= 0;
2379 p
->phys_offset
= phys_offset
;
2380 if ((phys_offset
& ~TARGET_PAGE_MASK
) <= IO_MEM_ROM
||
2381 (phys_offset
& IO_MEM_ROMD
))
2382 phys_offset
+= TARGET_PAGE_SIZE
;
2385 p
= phys_page_find_alloc(addr
>> TARGET_PAGE_BITS
, 1);
2386 p
->phys_offset
= phys_offset
;
2387 p
->region_offset
= region_offset
;
2388 if ((phys_offset
& ~TARGET_PAGE_MASK
) <= IO_MEM_ROM
||
2389 (phys_offset
& IO_MEM_ROMD
)) {
2390 phys_offset
+= TARGET_PAGE_SIZE
;
2392 target_phys_addr_t start_addr2
, end_addr2
;
2393 int need_subpage
= 0;
2395 CHECK_SUBPAGE(addr
, start_addr
, start_addr2
, end_addr
,
2396 end_addr2
, need_subpage
);
2398 if (need_subpage
|| phys_offset
& IO_MEM_SUBWIDTH
) {
2399 subpage
= subpage_init((addr
& TARGET_PAGE_MASK
),
2400 &p
->phys_offset
, IO_MEM_UNASSIGNED
,
2401 addr
& TARGET_PAGE_MASK
);
2402 subpage_register(subpage
, start_addr2
, end_addr2
,
2403 phys_offset
, region_offset
);
2404 p
->region_offset
= 0;
2408 region_offset
+= TARGET_PAGE_SIZE
;
2411 /* since each CPU stores ram addresses in its TLB cache, we must
2412 reset the modified entries */
2414 for(env
= first_cpu
; env
!= NULL
; env
= env
->next_cpu
) {
2419 /* XXX: temporary until new memory mapping API */
2420 ram_addr_t
cpu_get_physical_page_desc(target_phys_addr_t addr
)
2424 p
= phys_page_find(addr
>> TARGET_PAGE_BITS
);
2426 return IO_MEM_UNASSIGNED
;
2427 return p
->phys_offset
;
2430 void qemu_register_coalesced_mmio(target_phys_addr_t addr
, ram_addr_t size
)
2433 kvm_coalesce_mmio_region(addr
, size
);
2436 void qemu_unregister_coalesced_mmio(target_phys_addr_t addr
, ram_addr_t size
)
2439 kvm_uncoalesce_mmio_region(addr
, size
);
2443 /* XXX: better than nothing */
2444 static ram_addr_t
kqemu_ram_alloc(ram_addr_t size
)
2447 if ((last_ram_offset
+ size
) > kqemu_phys_ram_size
) {
2448 fprintf(stderr
, "Not enough memory (requested_size = %" PRIu64
", max memory = %" PRIu64
")\n",
2449 (uint64_t)size
, (uint64_t)kqemu_phys_ram_size
);
2452 addr
= last_ram_offset
;
2453 last_ram_offset
= TARGET_PAGE_ALIGN(last_ram_offset
+ size
);
2460 #include <sys/vfs.h>
2462 #define HUGETLBFS_MAGIC 0x958458f6
2464 static long gethugepagesize(const char *path
)
2470 ret
= statfs(path
, &fs
);
2471 } while (ret
!= 0 && errno
== EINTR
);
2478 if (fs
.f_type
!= HUGETLBFS_MAGIC
)
2479 fprintf(stderr
, "Warning: path not on HugeTLBFS: %s\n", path
);
2484 static void *file_ram_alloc(ram_addr_t memory
, const char *path
)
2492 unsigned long hpagesize
;
2493 extern int mem_prealloc
;
2499 hpagesize
= gethugepagesize(path
);
2504 if (memory
< hpagesize
) {
2508 if (kvm_enabled() && !kvm_has_sync_mmu()) {
2509 fprintf(stderr
, "host lacks mmu notifiers, disabling --mem-path\n");
2513 if (asprintf(&filename
, "%s/kvm.XXXXXX", path
) == -1) {
2517 fd
= mkstemp(filename
);
2526 memory
= (memory
+hpagesize
-1) & ~(hpagesize
-1);
2529 * ftruncate is not supported by hugetlbfs in older
2530 * hosts, so don't bother checking for errors.
2531 * If anything goes wrong with it under other filesystems,
2534 ftruncate(fd
, memory
);
2537 /* NB: MAP_POPULATE won't exhaustively alloc all phys pages in the case
2538 * MAP_PRIVATE is requested. For mem_prealloc we mmap as MAP_SHARED
2539 * to sidestep this quirk.
2541 flags
= mem_prealloc
? MAP_POPULATE
|MAP_SHARED
: MAP_PRIVATE
;
2542 area
= mmap(0, memory
, PROT_READ
|PROT_WRITE
, flags
, fd
, 0);
2544 area
= mmap(0, memory
, PROT_READ
|PROT_WRITE
, MAP_PRIVATE
, fd
, 0);
2546 if (area
== MAP_FAILED
) {
2547 perror("alloc_mem_area: can't mmap hugetlbfs pages");
2556 static void *file_ram_alloc(ram_addr_t memory
, const char *path
)
2563 extern const char *mem_path
;
2565 ram_addr_t
qemu_ram_alloc(ram_addr_t size
)
2567 RAMBlock
*new_block
;
2570 if (kqemu_phys_ram_base
) {
2571 return kqemu_ram_alloc(size
);
2575 size
= TARGET_PAGE_ALIGN(size
);
2576 new_block
= qemu_malloc(sizeof(*new_block
));
2578 new_block
->host
= file_ram_alloc(size
, mem_path
);
2579 if (!new_block
->host
) {
2580 new_block
->host
= qemu_vmalloc(size
);
2581 #ifdef MADV_MERGEABLE
2582 madvise(new_block
->host
, size
, MADV_MERGEABLE
);
2585 new_block
->offset
= last_ram_offset
;
2586 new_block
->length
= size
;
2588 new_block
->next
= ram_blocks
;
2589 ram_blocks
= new_block
;
2591 phys_ram_dirty
= qemu_realloc(phys_ram_dirty
,
2592 (last_ram_offset
+ size
) >> TARGET_PAGE_BITS
);
2593 memset(phys_ram_dirty
+ (last_ram_offset
>> TARGET_PAGE_BITS
),
2594 0xff, size
>> TARGET_PAGE_BITS
);
2596 last_ram_offset
+= size
;
2599 kvm_setup_guest_memory(new_block
->host
, size
);
2601 return new_block
->offset
;
2604 void qemu_ram_free(ram_addr_t addr
)
2606 /* TODO: implement this. */
2609 /* Return a host pointer to ram allocated with qemu_ram_alloc.
2610 With the exception of the softmmu code in this file, this should
2611 only be used for local memory (e.g. video ram) that the device owns,
2612 and knows it isn't going to access beyond the end of the block.
2614 It should not be used for general purpose DMA.
2615 Use cpu_physical_memory_map/cpu_physical_memory_rw instead.
2617 void *qemu_get_ram_ptr(ram_addr_t addr
)
2624 if (kqemu_phys_ram_base
) {
2625 return kqemu_phys_ram_base
+ addr
;
2630 prevp
= &ram_blocks
;
2632 while (block
&& (block
->offset
> addr
2633 || block
->offset
+ block
->length
<= addr
)) {
2635 prevp
= &prev
->next
;
2637 block
= block
->next
;
2640 fprintf(stderr
, "Bad ram offset %" PRIx64
"\n", (uint64_t)addr
);
2643 /* Move this entry to to start of the list. */
2645 prev
->next
= block
->next
;
2646 block
->next
= *prevp
;
2649 return block
->host
+ (addr
- block
->offset
);
2652 /* Some of the softmmu routines need to translate from a host pointer
2653 (typically a TLB entry) back to a ram offset. */
2654 ram_addr_t
qemu_ram_addr_from_host(void *ptr
)
2659 uint8_t *host
= ptr
;
2662 if (kqemu_phys_ram_base
) {
2663 return host
- kqemu_phys_ram_base
;
2668 prevp
= &ram_blocks
;
2670 while (block
&& (block
->host
> host
2671 || block
->host
+ block
->length
<= host
)) {
2673 prevp
= &prev
->next
;
2675 block
= block
->next
;
2678 fprintf(stderr
, "Bad ram pointer %p\n", ptr
);
2681 return block
->offset
+ (host
- block
->host
);
2684 static uint32_t unassigned_mem_readb(void *opaque
, target_phys_addr_t addr
)
2686 #ifdef DEBUG_UNASSIGNED
2687 printf("Unassigned mem read " TARGET_FMT_plx
"\n", addr
);
2689 #if defined(TARGET_SPARC)
2690 do_unassigned_access(addr
, 0, 0, 0, 1);
2695 static uint32_t unassigned_mem_readw(void *opaque
, target_phys_addr_t addr
)
2697 #ifdef DEBUG_UNASSIGNED
2698 printf("Unassigned mem read " TARGET_FMT_plx
"\n", addr
);
2700 #if defined(TARGET_SPARC)
2701 do_unassigned_access(addr
, 0, 0, 0, 2);
2706 static uint32_t unassigned_mem_readl(void *opaque
, target_phys_addr_t addr
)
2708 #ifdef DEBUG_UNASSIGNED
2709 printf("Unassigned mem read " TARGET_FMT_plx
"\n", addr
);
2711 #if defined(TARGET_SPARC)
2712 do_unassigned_access(addr
, 0, 0, 0, 4);
2717 static void unassigned_mem_writeb(void *opaque
, target_phys_addr_t addr
, uint32_t val
)
2719 #ifdef DEBUG_UNASSIGNED
2720 printf("Unassigned mem write " TARGET_FMT_plx
" = 0x%x\n", addr
, val
);
2722 #if defined(TARGET_SPARC)
2723 do_unassigned_access(addr
, 1, 0, 0, 1);
2727 static void unassigned_mem_writew(void *opaque
, target_phys_addr_t addr
, uint32_t val
)
2729 #ifdef DEBUG_UNASSIGNED
2730 printf("Unassigned mem write " TARGET_FMT_plx
" = 0x%x\n", addr
, val
);
2732 #if defined(TARGET_SPARC)
2733 do_unassigned_access(addr
, 1, 0, 0, 2);
2737 static void unassigned_mem_writel(void *opaque
, target_phys_addr_t addr
, uint32_t val
)
2739 #ifdef DEBUG_UNASSIGNED
2740 printf("Unassigned mem write " TARGET_FMT_plx
" = 0x%x\n", addr
, val
);
2742 #if defined(TARGET_SPARC)
2743 do_unassigned_access(addr
, 1, 0, 0, 4);
2747 static CPUReadMemoryFunc
*unassigned_mem_read
[3] = {
2748 unassigned_mem_readb
,
2749 unassigned_mem_readw
,
2750 unassigned_mem_readl
,
2753 static CPUWriteMemoryFunc
*unassigned_mem_write
[3] = {
2754 unassigned_mem_writeb
,
2755 unassigned_mem_writew
,
2756 unassigned_mem_writel
,
2759 static void notdirty_mem_writeb(void *opaque
, target_phys_addr_t ram_addr
,
2763 dirty_flags
= phys_ram_dirty
[ram_addr
>> TARGET_PAGE_BITS
];
2764 if (!(dirty_flags
& CODE_DIRTY_FLAG
)) {
2765 #if !defined(CONFIG_USER_ONLY)
2766 tb_invalidate_phys_page_fast(ram_addr
, 1);
2767 dirty_flags
= phys_ram_dirty
[ram_addr
>> TARGET_PAGE_BITS
];
2770 stb_p(qemu_get_ram_ptr(ram_addr
), val
);
2772 if (cpu_single_env
->kqemu_enabled
&&
2773 (dirty_flags
& KQEMU_MODIFY_PAGE_MASK
) != KQEMU_MODIFY_PAGE_MASK
)
2774 kqemu_modify_page(cpu_single_env
, ram_addr
);
2776 dirty_flags
|= (0xff & ~CODE_DIRTY_FLAG
);
2777 phys_ram_dirty
[ram_addr
>> TARGET_PAGE_BITS
] = dirty_flags
;
2778 /* we remove the notdirty callback only if the code has been
2780 if (dirty_flags
== 0xff)
2781 tlb_set_dirty(cpu_single_env
, cpu_single_env
->mem_io_vaddr
);
2784 static void notdirty_mem_writew(void *opaque
, target_phys_addr_t ram_addr
,
2788 dirty_flags
= phys_ram_dirty
[ram_addr
>> TARGET_PAGE_BITS
];
2789 if (!(dirty_flags
& CODE_DIRTY_FLAG
)) {
2790 #if !defined(CONFIG_USER_ONLY)
2791 tb_invalidate_phys_page_fast(ram_addr
, 2);
2792 dirty_flags
= phys_ram_dirty
[ram_addr
>> TARGET_PAGE_BITS
];
2795 stw_p(qemu_get_ram_ptr(ram_addr
), val
);
2797 if (cpu_single_env
->kqemu_enabled
&&
2798 (dirty_flags
& KQEMU_MODIFY_PAGE_MASK
) != KQEMU_MODIFY_PAGE_MASK
)
2799 kqemu_modify_page(cpu_single_env
, ram_addr
);
2801 dirty_flags
|= (0xff & ~CODE_DIRTY_FLAG
);
2802 phys_ram_dirty
[ram_addr
>> TARGET_PAGE_BITS
] = dirty_flags
;
2803 /* we remove the notdirty callback only if the code has been
2805 if (dirty_flags
== 0xff)
2806 tlb_set_dirty(cpu_single_env
, cpu_single_env
->mem_io_vaddr
);
2809 static void notdirty_mem_writel(void *opaque
, target_phys_addr_t ram_addr
,
2813 dirty_flags
= phys_ram_dirty
[ram_addr
>> TARGET_PAGE_BITS
];
2814 if (!(dirty_flags
& CODE_DIRTY_FLAG
)) {
2815 #if !defined(CONFIG_USER_ONLY)
2816 tb_invalidate_phys_page_fast(ram_addr
, 4);
2817 dirty_flags
= phys_ram_dirty
[ram_addr
>> TARGET_PAGE_BITS
];
2820 stl_p(qemu_get_ram_ptr(ram_addr
), val
);
2822 if (cpu_single_env
->kqemu_enabled
&&
2823 (dirty_flags
& KQEMU_MODIFY_PAGE_MASK
) != KQEMU_MODIFY_PAGE_MASK
)
2824 kqemu_modify_page(cpu_single_env
, ram_addr
);
2826 dirty_flags
|= (0xff & ~CODE_DIRTY_FLAG
);
2827 phys_ram_dirty
[ram_addr
>> TARGET_PAGE_BITS
] = dirty_flags
;
2828 /* we remove the notdirty callback only if the code has been
2830 if (dirty_flags
== 0xff)
2831 tlb_set_dirty(cpu_single_env
, cpu_single_env
->mem_io_vaddr
);
2834 static CPUReadMemoryFunc
*error_mem_read
[3] = {
2835 NULL
, /* never used */
2836 NULL
, /* never used */
2837 NULL
, /* never used */
2840 static CPUWriteMemoryFunc
*notdirty_mem_write
[3] = {
2841 notdirty_mem_writeb
,
2842 notdirty_mem_writew
,
2843 notdirty_mem_writel
,
2846 /* Generate a debug exception if a watchpoint has been hit. */
2847 static void check_watchpoint(int offset
, int len_mask
, int flags
)
2849 CPUState
*env
= cpu_single_env
;
2850 target_ulong pc
, cs_base
;
2851 TranslationBlock
*tb
;
2856 if (env
->watchpoint_hit
) {
2857 /* We re-entered the check after replacing the TB. Now raise
2858 * the debug interrupt so that is will trigger after the
2859 * current instruction. */
2860 cpu_interrupt(env
, CPU_INTERRUPT_DEBUG
);
2863 vaddr
= (env
->mem_io_vaddr
& TARGET_PAGE_MASK
) + offset
;
2864 TAILQ_FOREACH(wp
, &env
->watchpoints
, entry
) {
2865 if ((vaddr
== (wp
->vaddr
& len_mask
) ||
2866 (vaddr
& wp
->len_mask
) == wp
->vaddr
) && (wp
->flags
& flags
)) {
2867 wp
->flags
|= BP_WATCHPOINT_HIT
;
2868 if (!env
->watchpoint_hit
) {
2869 env
->watchpoint_hit
= wp
;
2870 tb
= tb_find_pc(env
->mem_io_pc
);
2872 cpu_abort(env
, "check_watchpoint: could not find TB for "
2873 "pc=%p", (void *)env
->mem_io_pc
);
2875 cpu_restore_state(tb
, env
, env
->mem_io_pc
, NULL
);
2876 tb_phys_invalidate(tb
, -1);
2877 if (wp
->flags
& BP_STOP_BEFORE_ACCESS
) {
2878 env
->exception_index
= EXCP_DEBUG
;
2880 cpu_get_tb_cpu_state(env
, &pc
, &cs_base
, &cpu_flags
);
2881 tb_gen_code(env
, pc
, cs_base
, cpu_flags
, 1);
2883 cpu_resume_from_signal(env
, NULL
);
2886 wp
->flags
&= ~BP_WATCHPOINT_HIT
;
2891 /* Watchpoint access routines. Watchpoints are inserted using TLB tricks,
2892 so these check for a hit then pass through to the normal out-of-line
2894 static uint32_t watch_mem_readb(void *opaque
, target_phys_addr_t addr
)
2896 check_watchpoint(addr
& ~TARGET_PAGE_MASK
, ~0x0, BP_MEM_READ
);
2897 return ldub_phys(addr
);
2900 static uint32_t watch_mem_readw(void *opaque
, target_phys_addr_t addr
)
2902 check_watchpoint(addr
& ~TARGET_PAGE_MASK
, ~0x1, BP_MEM_READ
);
2903 return lduw_phys(addr
);
2906 static uint32_t watch_mem_readl(void *opaque
, target_phys_addr_t addr
)
2908 check_watchpoint(addr
& ~TARGET_PAGE_MASK
, ~0x3, BP_MEM_READ
);
2909 return ldl_phys(addr
);
2912 static void watch_mem_writeb(void *opaque
, target_phys_addr_t addr
,
2915 check_watchpoint(addr
& ~TARGET_PAGE_MASK
, ~0x0, BP_MEM_WRITE
);
2916 stb_phys(addr
, val
);
2919 static void watch_mem_writew(void *opaque
, target_phys_addr_t addr
,
2922 check_watchpoint(addr
& ~TARGET_PAGE_MASK
, ~0x1, BP_MEM_WRITE
);
2923 stw_phys(addr
, val
);
2926 static void watch_mem_writel(void *opaque
, target_phys_addr_t addr
,
2929 check_watchpoint(addr
& ~TARGET_PAGE_MASK
, ~0x3, BP_MEM_WRITE
);
2930 stl_phys(addr
, val
);
2933 static CPUReadMemoryFunc
*watch_mem_read
[3] = {
2939 static CPUWriteMemoryFunc
*watch_mem_write
[3] = {
2945 static inline uint32_t subpage_readlen (subpage_t
*mmio
, target_phys_addr_t addr
,
2951 idx
= SUBPAGE_IDX(addr
);
2952 #if defined(DEBUG_SUBPAGE)
2953 printf("%s: subpage %p len %d addr " TARGET_FMT_plx
" idx %d\n", __func__
,
2954 mmio
, len
, addr
, idx
);
2956 ret
= (**mmio
->mem_read
[idx
][len
])(mmio
->opaque
[idx
][0][len
],
2957 addr
+ mmio
->region_offset
[idx
][0][len
]);
2962 static inline void subpage_writelen (subpage_t
*mmio
, target_phys_addr_t addr
,
2963 uint32_t value
, unsigned int len
)
2967 idx
= SUBPAGE_IDX(addr
);
2968 #if defined(DEBUG_SUBPAGE)
2969 printf("%s: subpage %p len %d addr " TARGET_FMT_plx
" idx %d value %08x\n", __func__
,
2970 mmio
, len
, addr
, idx
, value
);
2972 (**mmio
->mem_write
[idx
][len
])(mmio
->opaque
[idx
][1][len
],
2973 addr
+ mmio
->region_offset
[idx
][1][len
],
2977 static uint32_t subpage_readb (void *opaque
, target_phys_addr_t addr
)
2979 #if defined(DEBUG_SUBPAGE)
2980 printf("%s: addr " TARGET_FMT_plx
"\n", __func__
, addr
);
2983 return subpage_readlen(opaque
, addr
, 0);
2986 static void subpage_writeb (void *opaque
, target_phys_addr_t addr
,
2989 #if defined(DEBUG_SUBPAGE)
2990 printf("%s: addr " TARGET_FMT_plx
" val %08x\n", __func__
, addr
, value
);
2992 subpage_writelen(opaque
, addr
, value
, 0);
2995 static uint32_t subpage_readw (void *opaque
, target_phys_addr_t addr
)
2997 #if defined(DEBUG_SUBPAGE)
2998 printf("%s: addr " TARGET_FMT_plx
"\n", __func__
, addr
);
3001 return subpage_readlen(opaque
, addr
, 1);
3004 static void subpage_writew (void *opaque
, target_phys_addr_t addr
,
3007 #if defined(DEBUG_SUBPAGE)
3008 printf("%s: addr " TARGET_FMT_plx
" val %08x\n", __func__
, addr
, value
);
3010 subpage_writelen(opaque
, addr
, value
, 1);
3013 static uint32_t subpage_readl (void *opaque
, target_phys_addr_t addr
)
3015 #if defined(DEBUG_SUBPAGE)
3016 printf("%s: addr " TARGET_FMT_plx
"\n", __func__
, addr
);
3019 return subpage_readlen(opaque
, addr
, 2);
3022 static void subpage_writel (void *opaque
,
3023 target_phys_addr_t addr
, uint32_t value
)
3025 #if defined(DEBUG_SUBPAGE)
3026 printf("%s: addr " TARGET_FMT_plx
" val %08x\n", __func__
, addr
, value
);
3028 subpage_writelen(opaque
, addr
, value
, 2);
3031 static CPUReadMemoryFunc
*subpage_read
[] = {
3037 static CPUWriteMemoryFunc
*subpage_write
[] = {
3043 static int subpage_register (subpage_t
*mmio
, uint32_t start
, uint32_t end
,
3044 ram_addr_t memory
, ram_addr_t region_offset
)
3049 if (start
>= TARGET_PAGE_SIZE
|| end
>= TARGET_PAGE_SIZE
)
3051 idx
= SUBPAGE_IDX(start
);
3052 eidx
= SUBPAGE_IDX(end
);
3053 #if defined(DEBUG_SUBPAGE)
3054 printf("%s: %p start %08x end %08x idx %08x eidx %08x mem %ld\n", __func__
,
3055 mmio
, start
, end
, idx
, eidx
, memory
);
3057 memory
>>= IO_MEM_SHIFT
;
3058 for (; idx
<= eidx
; idx
++) {
3059 for (i
= 0; i
< 4; i
++) {
3060 if (io_mem_read
[memory
][i
]) {
3061 mmio
->mem_read
[idx
][i
] = &io_mem_read
[memory
][i
];
3062 mmio
->opaque
[idx
][0][i
] = io_mem_opaque
[memory
];
3063 mmio
->region_offset
[idx
][0][i
] = region_offset
;
3065 if (io_mem_write
[memory
][i
]) {
3066 mmio
->mem_write
[idx
][i
] = &io_mem_write
[memory
][i
];
3067 mmio
->opaque
[idx
][1][i
] = io_mem_opaque
[memory
];
3068 mmio
->region_offset
[idx
][1][i
] = region_offset
;
3076 static void *subpage_init (target_phys_addr_t base
, ram_addr_t
*phys
,
3077 ram_addr_t orig_memory
, ram_addr_t region_offset
)
3082 mmio
= qemu_mallocz(sizeof(subpage_t
));
3085 subpage_memory
= cpu_register_io_memory(subpage_read
, subpage_write
, mmio
);
3086 #if defined(DEBUG_SUBPAGE)
3087 printf("%s: %p base " TARGET_FMT_plx
" len %08x %d\n", __func__
,
3088 mmio
, base
, TARGET_PAGE_SIZE
, subpage_memory
);
3090 *phys
= subpage_memory
| IO_MEM_SUBPAGE
;
3091 subpage_register(mmio
, 0, TARGET_PAGE_SIZE
- 1, orig_memory
,
3097 static int get_free_io_mem_idx(void)
3101 for (i
= 0; i
<IO_MEM_NB_ENTRIES
; i
++)
3102 if (!io_mem_used
[i
]) {
3110 /* mem_read and mem_write are arrays of functions containing the
3111 function to access byte (index 0), word (index 1) and dword (index
3112 2). Functions can be omitted with a NULL function pointer.
3113 If io_index is non zero, the corresponding io zone is
3114 modified. If it is zero, a new io zone is allocated. The return
3115 value can be used with cpu_register_physical_memory(). (-1) is
3116 returned if error. */
3117 static int cpu_register_io_memory_fixed(int io_index
,
3118 CPUReadMemoryFunc
**mem_read
,
3119 CPUWriteMemoryFunc
**mem_write
,
3122 int i
, subwidth
= 0;
3124 if (io_index
<= 0) {
3125 io_index
= get_free_io_mem_idx();
3129 io_index
>>= IO_MEM_SHIFT
;
3130 if (io_index
>= IO_MEM_NB_ENTRIES
)
3134 for(i
= 0;i
< 3; i
++) {
3135 if (!mem_read
[i
] || !mem_write
[i
])
3136 subwidth
= IO_MEM_SUBWIDTH
;
3137 io_mem_read
[io_index
][i
] = mem_read
[i
];
3138 io_mem_write
[io_index
][i
] = mem_write
[i
];
3140 io_mem_opaque
[io_index
] = opaque
;
3141 return (io_index
<< IO_MEM_SHIFT
) | subwidth
;
3144 int cpu_register_io_memory(CPUReadMemoryFunc
**mem_read
,
3145 CPUWriteMemoryFunc
**mem_write
,
3148 return cpu_register_io_memory_fixed(0, mem_read
, mem_write
, opaque
);
3151 void cpu_unregister_io_memory(int io_table_address
)
3154 int io_index
= io_table_address
>> IO_MEM_SHIFT
;
3156 for (i
=0;i
< 3; i
++) {
3157 io_mem_read
[io_index
][i
] = unassigned_mem_read
[i
];
3158 io_mem_write
[io_index
][i
] = unassigned_mem_write
[i
];
3160 io_mem_opaque
[io_index
] = NULL
;
3161 io_mem_used
[io_index
] = 0;
3164 static void io_mem_init(void)
3168 cpu_register_io_memory_fixed(IO_MEM_ROM
, error_mem_read
, unassigned_mem_write
, NULL
);
3169 cpu_register_io_memory_fixed(IO_MEM_UNASSIGNED
, unassigned_mem_read
, unassigned_mem_write
, NULL
);
3170 cpu_register_io_memory_fixed(IO_MEM_NOTDIRTY
, error_mem_read
, notdirty_mem_write
, NULL
);
3174 io_mem_watch
= cpu_register_io_memory(watch_mem_read
,
3175 watch_mem_write
, NULL
);
3177 if (kqemu_phys_ram_base
) {
3178 /* alloc dirty bits array */
3179 phys_ram_dirty
= qemu_vmalloc(kqemu_phys_ram_size
>> TARGET_PAGE_BITS
);
3180 memset(phys_ram_dirty
, 0xff, kqemu_phys_ram_size
>> TARGET_PAGE_BITS
);
3185 #endif /* !defined(CONFIG_USER_ONLY) */
3187 /* physical memory access (slow version, mainly for debug) */
3188 #if defined(CONFIG_USER_ONLY)
3189 void cpu_physical_memory_rw(target_phys_addr_t addr
, uint8_t *buf
,
3190 int len
, int is_write
)
3197 page
= addr
& TARGET_PAGE_MASK
;
3198 l
= (page
+ TARGET_PAGE_SIZE
) - addr
;
3201 flags
= page_get_flags(page
);
3202 if (!(flags
& PAGE_VALID
))
3205 if (!(flags
& PAGE_WRITE
))
3207 /* XXX: this code should not depend on lock_user */
3208 if (!(p
= lock_user(VERIFY_WRITE
, addr
, l
, 0)))
3209 /* FIXME - should this return an error rather than just fail? */
3212 unlock_user(p
, addr
, l
);
3214 if (!(flags
& PAGE_READ
))
3216 /* XXX: this code should not depend on lock_user */
3217 if (!(p
= lock_user(VERIFY_READ
, addr
, l
, 1)))
3218 /* FIXME - should this return an error rather than just fail? */
3221 unlock_user(p
, addr
, 0);
3230 void cpu_physical_memory_rw(target_phys_addr_t addr
, uint8_t *buf
,
3231 int len
, int is_write
)
3236 target_phys_addr_t page
;
3241 page
= addr
& TARGET_PAGE_MASK
;
3242 l
= (page
+ TARGET_PAGE_SIZE
) - addr
;
3245 p
= phys_page_find(page
>> TARGET_PAGE_BITS
);
3247 pd
= IO_MEM_UNASSIGNED
;
3249 pd
= p
->phys_offset
;
3253 if ((pd
& ~TARGET_PAGE_MASK
) != IO_MEM_RAM
) {
3254 target_phys_addr_t addr1
= addr
;
3255 io_index
= (pd
>> IO_MEM_SHIFT
) & (IO_MEM_NB_ENTRIES
- 1);
3257 addr1
= (addr
& ~TARGET_PAGE_MASK
) + p
->region_offset
;
3258 /* XXX: could force cpu_single_env to NULL to avoid
3260 if (l
>= 4 && ((addr1
& 3) == 0)) {
3261 /* 32 bit write access */
3263 io_mem_write
[io_index
][2](io_mem_opaque
[io_index
], addr1
, val
);
3265 } else if (l
>= 2 && ((addr1
& 1) == 0)) {
3266 /* 16 bit write access */
3268 io_mem_write
[io_index
][1](io_mem_opaque
[io_index
], addr1
, val
);
3271 /* 8 bit write access */
3273 io_mem_write
[io_index
][0](io_mem_opaque
[io_index
], addr1
, val
);
3277 unsigned long addr1
;
3278 addr1
= (pd
& TARGET_PAGE_MASK
) + (addr
& ~TARGET_PAGE_MASK
);
3280 ptr
= qemu_get_ram_ptr(addr1
);
3281 memcpy(ptr
, buf
, l
);
3282 if (!cpu_physical_memory_is_dirty(addr1
)) {
3283 /* invalidate code */
3284 tb_invalidate_phys_page_range(addr1
, addr1
+ l
, 0);
3286 phys_ram_dirty
[addr1
>> TARGET_PAGE_BITS
] |=
3287 (0xff & ~CODE_DIRTY_FLAG
);
3289 /* qemu doesn't execute guest code directly, but kvm does
3290 therefore flush instruction caches */
3292 flush_icache_range((unsigned long)ptr
,
3293 ((unsigned long)ptr
)+l
);
3296 if ((pd
& ~TARGET_PAGE_MASK
) > IO_MEM_ROM
&&
3297 !(pd
& IO_MEM_ROMD
)) {
3298 target_phys_addr_t addr1
= addr
;
3300 io_index
= (pd
>> IO_MEM_SHIFT
) & (IO_MEM_NB_ENTRIES
- 1);
3302 addr1
= (addr
& ~TARGET_PAGE_MASK
) + p
->region_offset
;
3303 if (l
>= 4 && ((addr1
& 3) == 0)) {
3304 /* 32 bit read access */
3305 val
= io_mem_read
[io_index
][2](io_mem_opaque
[io_index
], addr1
);
3308 } else if (l
>= 2 && ((addr1
& 1) == 0)) {
3309 /* 16 bit read access */
3310 val
= io_mem_read
[io_index
][1](io_mem_opaque
[io_index
], addr1
);
3314 /* 8 bit read access */
3315 val
= io_mem_read
[io_index
][0](io_mem_opaque
[io_index
], addr1
);
3321 ptr
= qemu_get_ram_ptr(pd
& TARGET_PAGE_MASK
) +
3322 (addr
& ~TARGET_PAGE_MASK
);
3323 memcpy(buf
, ptr
, l
);
3332 /* used for ROM loading : can write in RAM and ROM */
3333 void cpu_physical_memory_write_rom(target_phys_addr_t addr
,
3334 const uint8_t *buf
, int len
)
3338 target_phys_addr_t page
;
3343 page
= addr
& TARGET_PAGE_MASK
;
3344 l
= (page
+ TARGET_PAGE_SIZE
) - addr
;
3347 p
= phys_page_find(page
>> TARGET_PAGE_BITS
);
3349 pd
= IO_MEM_UNASSIGNED
;
3351 pd
= p
->phys_offset
;
3354 if ((pd
& ~TARGET_PAGE_MASK
) != IO_MEM_RAM
&&
3355 (pd
& ~TARGET_PAGE_MASK
) != IO_MEM_ROM
&&
3356 !(pd
& IO_MEM_ROMD
)) {
3359 unsigned long addr1
;
3360 addr1
= (pd
& TARGET_PAGE_MASK
) + (addr
& ~TARGET_PAGE_MASK
);
3362 ptr
= qemu_get_ram_ptr(addr1
);
3363 memcpy(ptr
, buf
, l
);
3373 target_phys_addr_t addr
;
3374 target_phys_addr_t len
;
3377 static BounceBuffer bounce
;
3379 typedef struct MapClient
{
3381 void (*callback
)(void *opaque
);
3382 LIST_ENTRY(MapClient
) link
;
3385 static LIST_HEAD(map_client_list
, MapClient
) map_client_list
3386 = LIST_HEAD_INITIALIZER(map_client_list
);
3388 void *cpu_register_map_client(void *opaque
, void (*callback
)(void *opaque
))
3390 MapClient
*client
= qemu_malloc(sizeof(*client
));
3392 client
->opaque
= opaque
;
3393 client
->callback
= callback
;
3394 LIST_INSERT_HEAD(&map_client_list
, client
, link
);
3398 void cpu_unregister_map_client(void *_client
)
3400 MapClient
*client
= (MapClient
*)_client
;
3402 LIST_REMOVE(client
, link
);
3406 static void cpu_notify_map_clients(void)
3410 while (!LIST_EMPTY(&map_client_list
)) {
3411 client
= LIST_FIRST(&map_client_list
);
3412 client
->callback(client
->opaque
);
3413 cpu_unregister_map_client(client
);
3417 /* Map a physical memory region into a host virtual address.
3418 * May map a subset of the requested range, given by and returned in *plen.
3419 * May return NULL if resources needed to perform the mapping are exhausted.
3420 * Use only for reads OR writes - not for read-modify-write operations.
3421 * Use cpu_register_map_client() to know when retrying the map operation is
3422 * likely to succeed.
3424 void *cpu_physical_memory_map(target_phys_addr_t addr
,
3425 target_phys_addr_t
*plen
,
3428 target_phys_addr_t len
= *plen
;
3429 target_phys_addr_t done
= 0;
3431 uint8_t *ret
= NULL
;
3433 target_phys_addr_t page
;
3436 unsigned long addr1
;
3439 page
= addr
& TARGET_PAGE_MASK
;
3440 l
= (page
+ TARGET_PAGE_SIZE
) - addr
;
3443 p
= phys_page_find(page
>> TARGET_PAGE_BITS
);
3445 pd
= IO_MEM_UNASSIGNED
;
3447 pd
= p
->phys_offset
;
3450 if ((pd
& ~TARGET_PAGE_MASK
) != IO_MEM_RAM
) {
3451 if (done
|| bounce
.buffer
) {
3454 bounce
.buffer
= qemu_memalign(TARGET_PAGE_SIZE
, TARGET_PAGE_SIZE
);
3458 cpu_physical_memory_rw(addr
, bounce
.buffer
, l
, 0);
3460 ptr
= bounce
.buffer
;
3462 addr1
= (pd
& TARGET_PAGE_MASK
) + (addr
& ~TARGET_PAGE_MASK
);
3463 ptr
= qemu_get_ram_ptr(addr1
);
3467 } else if (ret
+ done
!= ptr
) {
3479 /* Unmaps a memory region previously mapped by cpu_physical_memory_map().
3480 * Will also mark the memory as dirty if is_write == 1. access_len gives
3481 * the amount of memory that was actually read or written by the caller.
3483 void cpu_physical_memory_unmap(void *buffer
, target_phys_addr_t len
,
3484 int is_write
, target_phys_addr_t access_len
)
3486 unsigned long flush_len
= (unsigned long)access_len
;
3488 if (buffer
!= bounce
.buffer
) {
3490 ram_addr_t addr1
= qemu_ram_addr_from_host(buffer
);
3491 while (access_len
) {
3493 l
= TARGET_PAGE_SIZE
;
3496 if (!cpu_physical_memory_is_dirty(addr1
)) {
3497 /* invalidate code */
3498 tb_invalidate_phys_page_range(addr1
, addr1
+ l
, 0);
3500 phys_ram_dirty
[addr1
>> TARGET_PAGE_BITS
] |=
3501 (0xff & ~CODE_DIRTY_FLAG
);
3506 dma_flush_range((unsigned long)buffer
,
3507 (unsigned long)buffer
+ flush_len
);
3512 cpu_physical_memory_write(bounce
.addr
, bounce
.buffer
, access_len
);
3514 qemu_free(bounce
.buffer
);
3515 bounce
.buffer
= NULL
;
3516 cpu_notify_map_clients();
3519 /* warning: addr must be aligned */
3520 uint32_t ldl_phys(target_phys_addr_t addr
)
3528 p
= phys_page_find(addr
>> TARGET_PAGE_BITS
);
3530 pd
= IO_MEM_UNASSIGNED
;
3532 pd
= p
->phys_offset
;
3535 if ((pd
& ~TARGET_PAGE_MASK
) > IO_MEM_ROM
&&
3536 !(pd
& IO_MEM_ROMD
)) {
3538 io_index
= (pd
>> IO_MEM_SHIFT
) & (IO_MEM_NB_ENTRIES
- 1);
3540 addr
= (addr
& ~TARGET_PAGE_MASK
) + p
->region_offset
;
3541 val
= io_mem_read
[io_index
][2](io_mem_opaque
[io_index
], addr
);
3544 ptr
= qemu_get_ram_ptr(pd
& TARGET_PAGE_MASK
) +
3545 (addr
& ~TARGET_PAGE_MASK
);
3551 /* warning: addr must be aligned */
3552 uint64_t ldq_phys(target_phys_addr_t addr
)
3560 p
= phys_page_find(addr
>> TARGET_PAGE_BITS
);
3562 pd
= IO_MEM_UNASSIGNED
;
3564 pd
= p
->phys_offset
;
3567 if ((pd
& ~TARGET_PAGE_MASK
) > IO_MEM_ROM
&&
3568 !(pd
& IO_MEM_ROMD
)) {
3570 io_index
= (pd
>> IO_MEM_SHIFT
) & (IO_MEM_NB_ENTRIES
- 1);
3572 addr
= (addr
& ~TARGET_PAGE_MASK
) + p
->region_offset
;
3573 #ifdef TARGET_WORDS_BIGENDIAN
3574 val
= (uint64_t)io_mem_read
[io_index
][2](io_mem_opaque
[io_index
], addr
) << 32;
3575 val
|= io_mem_read
[io_index
][2](io_mem_opaque
[io_index
], addr
+ 4);
3577 val
= io_mem_read
[io_index
][2](io_mem_opaque
[io_index
], addr
);
3578 val
|= (uint64_t)io_mem_read
[io_index
][2](io_mem_opaque
[io_index
], addr
+ 4) << 32;
3582 ptr
= qemu_get_ram_ptr(pd
& TARGET_PAGE_MASK
) +
3583 (addr
& ~TARGET_PAGE_MASK
);
3590 uint32_t ldub_phys(target_phys_addr_t addr
)
3593 cpu_physical_memory_read(addr
, &val
, 1);
3598 uint32_t lduw_phys(target_phys_addr_t addr
)
3601 cpu_physical_memory_read(addr
, (uint8_t *)&val
, 2);
3602 return tswap16(val
);
3605 /* warning: addr must be aligned. The ram page is not masked as dirty
3606 and the code inside is not invalidated. It is useful if the dirty
3607 bits are used to track modified PTEs */
3608 void stl_phys_notdirty(target_phys_addr_t addr
, uint32_t val
)
3615 p
= phys_page_find(addr
>> TARGET_PAGE_BITS
);
3617 pd
= IO_MEM_UNASSIGNED
;
3619 pd
= p
->phys_offset
;
3622 if ((pd
& ~TARGET_PAGE_MASK
) != IO_MEM_RAM
) {
3623 io_index
= (pd
>> IO_MEM_SHIFT
) & (IO_MEM_NB_ENTRIES
- 1);
3625 addr
= (addr
& ~TARGET_PAGE_MASK
) + p
->region_offset
;
3626 io_mem_write
[io_index
][2](io_mem_opaque
[io_index
], addr
, val
);
3628 unsigned long addr1
= (pd
& TARGET_PAGE_MASK
) + (addr
& ~TARGET_PAGE_MASK
);
3629 ptr
= qemu_get_ram_ptr(addr1
);
3632 if (unlikely(in_migration
)) {
3633 if (!cpu_physical_memory_is_dirty(addr1
)) {
3634 /* invalidate code */
3635 tb_invalidate_phys_page_range(addr1
, addr1
+ 4, 0);
3637 phys_ram_dirty
[addr1
>> TARGET_PAGE_BITS
] |=
3638 (0xff & ~CODE_DIRTY_FLAG
);
3644 void stq_phys_notdirty(target_phys_addr_t addr
, uint64_t val
)
3651 p
= phys_page_find(addr
>> TARGET_PAGE_BITS
);
3653 pd
= IO_MEM_UNASSIGNED
;
3655 pd
= p
->phys_offset
;
3658 if ((pd
& ~TARGET_PAGE_MASK
) != IO_MEM_RAM
) {
3659 io_index
= (pd
>> IO_MEM_SHIFT
) & (IO_MEM_NB_ENTRIES
- 1);
3661 addr
= (addr
& ~TARGET_PAGE_MASK
) + p
->region_offset
;
3662 #ifdef TARGET_WORDS_BIGENDIAN
3663 io_mem_write
[io_index
][2](io_mem_opaque
[io_index
], addr
, val
>> 32);
3664 io_mem_write
[io_index
][2](io_mem_opaque
[io_index
], addr
+ 4, val
);
3666 io_mem_write
[io_index
][2](io_mem_opaque
[io_index
], addr
, val
);
3667 io_mem_write
[io_index
][2](io_mem_opaque
[io_index
], addr
+ 4, val
>> 32);
3670 ptr
= qemu_get_ram_ptr(pd
& TARGET_PAGE_MASK
) +
3671 (addr
& ~TARGET_PAGE_MASK
);
3676 /* warning: addr must be aligned */
3677 void stl_phys(target_phys_addr_t addr
, uint32_t val
)
3684 p
= phys_page_find(addr
>> TARGET_PAGE_BITS
);
3686 pd
= IO_MEM_UNASSIGNED
;
3688 pd
= p
->phys_offset
;
3691 if ((pd
& ~TARGET_PAGE_MASK
) != IO_MEM_RAM
) {
3692 io_index
= (pd
>> IO_MEM_SHIFT
) & (IO_MEM_NB_ENTRIES
- 1);
3694 addr
= (addr
& ~TARGET_PAGE_MASK
) + p
->region_offset
;
3695 io_mem_write
[io_index
][2](io_mem_opaque
[io_index
], addr
, val
);
3697 unsigned long addr1
;
3698 addr1
= (pd
& TARGET_PAGE_MASK
) + (addr
& ~TARGET_PAGE_MASK
);
3700 ptr
= qemu_get_ram_ptr(addr1
);
3702 if (!cpu_physical_memory_is_dirty(addr1
)) {
3703 /* invalidate code */
3704 tb_invalidate_phys_page_range(addr1
, addr1
+ 4, 0);
3706 phys_ram_dirty
[addr1
>> TARGET_PAGE_BITS
] |=
3707 (0xff & ~CODE_DIRTY_FLAG
);
3713 void stb_phys(target_phys_addr_t addr
, uint32_t val
)
3716 cpu_physical_memory_write(addr
, &v
, 1);
3720 void stw_phys(target_phys_addr_t addr
, uint32_t val
)
3722 uint16_t v
= tswap16(val
);
3723 cpu_physical_memory_write(addr
, (const uint8_t *)&v
, 2);
3727 void stq_phys(target_phys_addr_t addr
, uint64_t val
)
3730 cpu_physical_memory_write(addr
, (const uint8_t *)&val
, 8);
3735 /* virtual memory access for debug (includes writing to ROM) */
3736 int cpu_memory_rw_debug(CPUState
*env
, target_ulong addr
,
3737 uint8_t *buf
, int len
, int is_write
)
3740 target_phys_addr_t phys_addr
;
3744 page
= addr
& TARGET_PAGE_MASK
;
3745 phys_addr
= cpu_get_phys_page_debug(env
, page
);
3746 /* if no physical page mapped, return an error */
3747 if (phys_addr
== -1)
3749 l
= (page
+ TARGET_PAGE_SIZE
) - addr
;
3752 phys_addr
+= (addr
& ~TARGET_PAGE_MASK
);
3753 #if !defined(CONFIG_USER_ONLY)
3755 cpu_physical_memory_write_rom(phys_addr
, buf
, l
);
3758 cpu_physical_memory_rw(phys_addr
, buf
, l
, is_write
);
3766 /* in deterministic execution mode, instructions doing device I/Os
3767 must be at the end of the TB */
3768 void cpu_io_recompile(CPUState
*env
, void *retaddr
)
3770 TranslationBlock
*tb
;
3772 target_ulong pc
, cs_base
;
3775 tb
= tb_find_pc((unsigned long)retaddr
);
3777 cpu_abort(env
, "cpu_io_recompile: could not find TB for pc=%p",
3780 n
= env
->icount_decr
.u16
.low
+ tb
->icount
;
3781 cpu_restore_state(tb
, env
, (unsigned long)retaddr
, NULL
);
3782 /* Calculate how many instructions had been executed before the fault
3784 n
= n
- env
->icount_decr
.u16
.low
;
3785 /* Generate a new TB ending on the I/O insn. */
3787 /* On MIPS and SH, delay slot instructions can only be restarted if
3788 they were already the first instruction in the TB. If this is not
3789 the first instruction in a TB then re-execute the preceding
3791 #if defined(TARGET_MIPS)
3792 if ((env
->hflags
& MIPS_HFLAG_BMASK
) != 0 && n
> 1) {
3793 env
->active_tc
.PC
-= 4;
3794 env
->icount_decr
.u16
.low
++;
3795 env
->hflags
&= ~MIPS_HFLAG_BMASK
;
3797 #elif defined(TARGET_SH4)
3798 if ((env
->flags
& ((DELAY_SLOT
| DELAY_SLOT_CONDITIONAL
))) != 0
3801 env
->icount_decr
.u16
.low
++;
3802 env
->flags
&= ~(DELAY_SLOT
| DELAY_SLOT_CONDITIONAL
);
3805 /* This should never happen. */
3806 if (n
> CF_COUNT_MASK
)
3807 cpu_abort(env
, "TB too big during recompile");
3809 cflags
= n
| CF_LAST_IO
;
3811 cs_base
= tb
->cs_base
;
3813 tb_phys_invalidate(tb
, -1);
3814 /* FIXME: In theory this could raise an exception. In practice
3815 we have already translated the block once so it's probably ok. */
3816 tb_gen_code(env
, pc
, cs_base
, flags
, cflags
);
3817 /* TODO: If env->pc != tb->pc (i.e. the faulting instruction was not
3818 the first in the TB) then we end up generating a whole new TB and
3819 repeating the fault, which is horribly inefficient.
3820 Better would be to execute just this insn uncached, or generate a
3822 cpu_resume_from_signal(env
, NULL
);
3825 void dump_exec_info(FILE *f
,
3826 int (*cpu_fprintf
)(FILE *f
, const char *fmt
, ...))
3828 int i
, target_code_size
, max_target_code_size
;
3829 int direct_jmp_count
, direct_jmp2_count
, cross_page
;
3830 TranslationBlock
*tb
;
3832 target_code_size
= 0;
3833 max_target_code_size
= 0;
3835 direct_jmp_count
= 0;
3836 direct_jmp2_count
= 0;
3837 for(i
= 0; i
< nb_tbs
; i
++) {
3839 target_code_size
+= tb
->size
;
3840 if (tb
->size
> max_target_code_size
)
3841 max_target_code_size
= tb
->size
;
3842 if (tb
->page_addr
[1] != -1)
3844 if (tb
->tb_next_offset
[0] != 0xffff) {
3846 if (tb
->tb_next_offset
[1] != 0xffff) {
3847 direct_jmp2_count
++;
3851 /* XXX: avoid using doubles ? */
3852 cpu_fprintf(f
, "Translation buffer state:\n");
3853 cpu_fprintf(f
, "gen code size %ld/%ld\n",
3854 code_gen_ptr
- code_gen_buffer
, code_gen_buffer_max_size
);
3855 cpu_fprintf(f
, "TB count %d/%d\n",
3856 nb_tbs
, code_gen_max_blocks
);
3857 cpu_fprintf(f
, "TB avg target size %d max=%d bytes\n",
3858 nb_tbs
? target_code_size
/ nb_tbs
: 0,
3859 max_target_code_size
);
3860 cpu_fprintf(f
, "TB avg host size %d bytes (expansion ratio: %0.1f)\n",
3861 nb_tbs
? (code_gen_ptr
- code_gen_buffer
) / nb_tbs
: 0,
3862 target_code_size
? (double) (code_gen_ptr
- code_gen_buffer
) / target_code_size
: 0);
3863 cpu_fprintf(f
, "cross page TB count %d (%d%%)\n",
3865 nb_tbs
? (cross_page
* 100) / nb_tbs
: 0);
3866 cpu_fprintf(f
, "direct jump count %d (%d%%) (2 jumps=%d %d%%)\n",
3868 nb_tbs
? (direct_jmp_count
* 100) / nb_tbs
: 0,
3870 nb_tbs
? (direct_jmp2_count
* 100) / nb_tbs
: 0);
3871 cpu_fprintf(f
, "\nStatistics:\n");
3872 cpu_fprintf(f
, "TB flush count %d\n", tb_flush_count
);
3873 cpu_fprintf(f
, "TB invalidate count %d\n", tb_phys_invalidate_count
);
3874 cpu_fprintf(f
, "TLB flush count %d\n", tlb_flush_count
);
3875 tcg_dump_info(f
, cpu_fprintf
);
3878 #if !defined(CONFIG_USER_ONLY)
3880 #define MMUSUFFIX _cmmu
3881 #define GETPC() NULL
3882 #define env cpu_single_env
3883 #define SOFTMMU_CODE_ACCESS
3886 #include "softmmu_template.h"
3889 #include "softmmu_template.h"
3892 #include "softmmu_template.h"
3895 #include "softmmu_template.h"