2 * virtual page mapping and translated block handling
4 * Copyright (c) 2003 Fabrice Bellard
6 * This library is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU Lesser General Public
8 * License as published by the Free Software Foundation; either
9 * version 2 of the License, or (at your option) any later version.
11 * This library is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
14 * Lesser General Public License for more details.
16 * You should have received a copy of the GNU Lesser General Public
17 * License along with this library; if not, write to the Free Software
18 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston MA 02110-1301 USA
24 #include <sys/types.h>
37 #include "qemu-common.h"
38 #include "cache-utils.h"
40 #if !defined(TARGET_IA64)
48 #if defined(CONFIG_USER_ONLY)
52 //#define DEBUG_TB_INVALIDATE
55 //#define DEBUG_UNASSIGNED
57 /* make various TB consistency checks */
58 //#define DEBUG_TB_CHECK
59 //#define DEBUG_TLB_CHECK
61 //#define DEBUG_IOPORT
62 //#define DEBUG_SUBPAGE
64 #if !defined(CONFIG_USER_ONLY)
65 /* TB consistency checks only implemented for usermode emulation. */
69 #define SMC_BITMAP_USE_THRESHOLD 10
71 #if defined(TARGET_SPARC64)
72 #define TARGET_PHYS_ADDR_SPACE_BITS 41
73 #elif defined(TARGET_SPARC)
74 #define TARGET_PHYS_ADDR_SPACE_BITS 36
75 #elif defined(TARGET_ALPHA)
76 #define TARGET_PHYS_ADDR_SPACE_BITS 42
77 #define TARGET_VIRT_ADDR_SPACE_BITS 42
78 #elif defined(TARGET_PPC64)
79 #define TARGET_PHYS_ADDR_SPACE_BITS 42
80 #elif defined(TARGET_X86_64) && !defined(CONFIG_KQEMU)
81 #define TARGET_PHYS_ADDR_SPACE_BITS 42
82 #elif defined(TARGET_I386) && !defined(CONFIG_KQEMU)
83 #define TARGET_PHYS_ADDR_SPACE_BITS 36
84 #elif defined(TARGET_IA64)
85 #define TARGET_PHYS_ADDR_SPACE_BITS 36
87 /* Note: for compatibility with kqemu, we use 32 bits for x86_64 */
88 #define TARGET_PHYS_ADDR_SPACE_BITS 32
91 static TranslationBlock
*tbs
;
92 int code_gen_max_blocks
;
93 TranslationBlock
*tb_phys_hash
[CODE_GEN_PHYS_HASH_SIZE
];
95 /* any access to the tbs or the page table must use this lock */
96 spinlock_t tb_lock
= SPIN_LOCK_UNLOCKED
;
98 #if defined(__arm__) || defined(__sparc_v9__)
99 /* The prologue must be reachable with a direct jump. ARM and Sparc64
100 have limited branch ranges (possibly also PPC) so place it in a
101 section close to code segment. */
102 #define code_gen_section \
103 __attribute__((__section__(".gen_code"))) \
104 __attribute__((aligned (32)))
106 #define code_gen_section \
107 __attribute__((aligned (32)))
110 uint8_t code_gen_prologue
[1024] code_gen_section
;
111 static uint8_t *code_gen_buffer
;
112 static unsigned long code_gen_buffer_size
;
113 /* threshold to flush the translated code buffer */
114 static unsigned long code_gen_buffer_max_size
;
115 uint8_t *code_gen_ptr
;
117 #if !defined(CONFIG_USER_ONLY)
119 uint8_t *phys_ram_dirty
;
121 static int in_migration
;
123 typedef struct RAMBlock
{
127 struct RAMBlock
*next
;
130 static RAMBlock
*ram_blocks
;
131 /* TODO: When we implement (and use) ram deallocation (e.g. for hotplug)
132 then we can no longer assume contiguous ram offsets, and external uses
133 of this variable will break. */
134 ram_addr_t last_ram_offset
;
138 /* current CPU in the current thread. It is only valid inside
140 CPUState
*cpu_single_env
;
141 /* 0 = Do not count executed instructions.
142 1 = Precise instruction counting.
143 2 = Adaptive rate instruction counting. */
145 /* Current instruction counter. While executing translated code this may
146 include some instructions that have not yet been executed. */
149 typedef struct PageDesc
{
150 /* list of TBs intersecting this ram page */
151 TranslationBlock
*first_tb
;
152 /* in order to optimize self modifying code, we count the number
153 of lookups we do to a given page to use a bitmap */
154 unsigned int code_write_count
;
155 uint8_t *code_bitmap
;
156 #if defined(CONFIG_USER_ONLY)
161 typedef struct PhysPageDesc
{
162 /* offset in host memory of the page + io_index in the low bits */
163 ram_addr_t phys_offset
;
164 ram_addr_t region_offset
;
168 #if defined(CONFIG_USER_ONLY) && defined(TARGET_VIRT_ADDR_SPACE_BITS)
169 /* XXX: this is a temporary hack for alpha target.
170 * In the future, this is to be replaced by a multi-level table
171 * to actually be able to handle the complete 64 bits address space.
173 #define L1_BITS (TARGET_VIRT_ADDR_SPACE_BITS - L2_BITS - TARGET_PAGE_BITS)
175 #define L1_BITS (32 - L2_BITS - TARGET_PAGE_BITS)
178 #define L1_SIZE (1 << L1_BITS)
179 #define L2_SIZE (1 << L2_BITS)
181 unsigned long qemu_real_host_page_size
;
182 unsigned long qemu_host_page_bits
;
183 unsigned long qemu_host_page_size
;
184 unsigned long qemu_host_page_mask
;
186 /* XXX: for system emulation, it could just be an array */
187 static PageDesc
*l1_map
[L1_SIZE
];
188 static PhysPageDesc
**l1_phys_map
;
190 #if !defined(CONFIG_USER_ONLY)
191 static void io_mem_init(void);
193 /* io memory support */
194 CPUWriteMemoryFunc
*io_mem_write
[IO_MEM_NB_ENTRIES
][4];
195 CPUReadMemoryFunc
*io_mem_read
[IO_MEM_NB_ENTRIES
][4];
196 void *io_mem_opaque
[IO_MEM_NB_ENTRIES
];
197 static char io_mem_used
[IO_MEM_NB_ENTRIES
];
198 static int io_mem_watch
;
202 static const char *logfilename
= "/tmp/qemu.log";
205 static int log_append
= 0;
208 static int tlb_flush_count
;
209 static int tb_flush_count
;
210 static int tb_phys_invalidate_count
;
212 #define SUBPAGE_IDX(addr) ((addr) & ~TARGET_PAGE_MASK)
213 typedef struct subpage_t
{
214 target_phys_addr_t base
;
215 CPUReadMemoryFunc
**mem_read
[TARGET_PAGE_SIZE
][4];
216 CPUWriteMemoryFunc
**mem_write
[TARGET_PAGE_SIZE
][4];
217 void *opaque
[TARGET_PAGE_SIZE
][2][4];
218 ram_addr_t region_offset
[TARGET_PAGE_SIZE
][2][4];
222 static void map_exec(void *addr
, long size
)
225 VirtualProtect(addr
, size
,
226 PAGE_EXECUTE_READWRITE
, &old_protect
);
230 static void map_exec(void *addr
, long size
)
232 unsigned long start
, end
, page_size
;
234 page_size
= getpagesize();
235 start
= (unsigned long)addr
;
236 start
&= ~(page_size
- 1);
238 end
= (unsigned long)addr
+ size
;
239 end
+= page_size
- 1;
240 end
&= ~(page_size
- 1);
242 mprotect((void *)start
, end
- start
,
243 PROT_READ
| PROT_WRITE
| PROT_EXEC
);
247 static void page_init(void)
249 /* NOTE: we can always suppose that qemu_host_page_size >=
253 SYSTEM_INFO system_info
;
255 GetSystemInfo(&system_info
);
256 qemu_real_host_page_size
= system_info
.dwPageSize
;
259 qemu_real_host_page_size
= getpagesize();
261 if (qemu_host_page_size
== 0)
262 qemu_host_page_size
= qemu_real_host_page_size
;
263 if (qemu_host_page_size
< TARGET_PAGE_SIZE
)
264 qemu_host_page_size
= TARGET_PAGE_SIZE
;
265 qemu_host_page_bits
= 0;
266 while ((1 << qemu_host_page_bits
) < qemu_host_page_size
)
267 qemu_host_page_bits
++;
268 qemu_host_page_mask
= ~(qemu_host_page_size
- 1);
269 l1_phys_map
= qemu_vmalloc(L1_SIZE
* sizeof(void *));
270 memset(l1_phys_map
, 0, L1_SIZE
* sizeof(void *));
272 #if !defined(_WIN32) && defined(CONFIG_USER_ONLY)
274 long long startaddr
, endaddr
;
279 last_brk
= (unsigned long)sbrk(0);
280 f
= fopen("/proc/self/maps", "r");
283 n
= fscanf (f
, "%llx-%llx %*[^\n]\n", &startaddr
, &endaddr
);
285 startaddr
= MIN(startaddr
,
286 (1ULL << TARGET_PHYS_ADDR_SPACE_BITS
) - 1);
287 endaddr
= MIN(endaddr
,
288 (1ULL << TARGET_PHYS_ADDR_SPACE_BITS
) - 1);
289 page_set_flags(startaddr
& TARGET_PAGE_MASK
,
290 TARGET_PAGE_ALIGN(endaddr
),
301 static inline PageDesc
**page_l1_map(target_ulong index
)
303 #if TARGET_LONG_BITS > 32
304 /* Host memory outside guest VM. For 32-bit targets we have already
305 excluded high addresses. */
306 if (index
> ((target_ulong
)L2_SIZE
* L1_SIZE
))
309 return &l1_map
[index
>> L2_BITS
];
312 static inline PageDesc
*page_find_alloc(target_ulong index
)
315 lp
= page_l1_map(index
);
321 /* allocate if not found */
322 #if defined(CONFIG_USER_ONLY)
323 size_t len
= sizeof(PageDesc
) * L2_SIZE
;
324 /* Don't use qemu_malloc because it may recurse. */
325 p
= mmap(0, len
, PROT_READ
| PROT_WRITE
,
326 MAP_PRIVATE
| MAP_ANONYMOUS
, -1, 0);
329 unsigned long addr
= h2g(p
);
330 page_set_flags(addr
& TARGET_PAGE_MASK
,
331 TARGET_PAGE_ALIGN(addr
+ len
),
335 p
= qemu_mallocz(sizeof(PageDesc
) * L2_SIZE
);
339 return p
+ (index
& (L2_SIZE
- 1));
342 static inline PageDesc
*page_find(target_ulong index
)
345 lp
= page_l1_map(index
);
352 return p
+ (index
& (L2_SIZE
- 1));
355 static PhysPageDesc
*phys_page_find_alloc(target_phys_addr_t index
, int alloc
)
360 p
= (void **)l1_phys_map
;
361 #if TARGET_PHYS_ADDR_SPACE_BITS > 32
363 #if TARGET_PHYS_ADDR_SPACE_BITS > (32 + L1_BITS)
364 #error unsupported TARGET_PHYS_ADDR_SPACE_BITS
366 lp
= p
+ ((index
>> (L1_BITS
+ L2_BITS
)) & (L1_SIZE
- 1));
369 /* allocate if not found */
372 p
= qemu_vmalloc(sizeof(void *) * L1_SIZE
);
373 memset(p
, 0, sizeof(void *) * L1_SIZE
);
377 lp
= p
+ ((index
>> L2_BITS
) & (L1_SIZE
- 1));
381 /* allocate if not found */
384 pd
= qemu_vmalloc(sizeof(PhysPageDesc
) * L2_SIZE
);
386 for (i
= 0; i
< L2_SIZE
; i
++) {
387 pd
[i
].phys_offset
= IO_MEM_UNASSIGNED
;
388 pd
[i
].region_offset
= (index
+ i
) << TARGET_PAGE_BITS
;
391 return ((PhysPageDesc
*)pd
) + (index
& (L2_SIZE
- 1));
394 static inline PhysPageDesc
*phys_page_find(target_phys_addr_t index
)
396 return phys_page_find_alloc(index
, 0);
399 #if !defined(CONFIG_USER_ONLY)
400 static void tlb_protect_code(ram_addr_t ram_addr
);
401 static void tlb_unprotect_code_phys(CPUState
*env
, ram_addr_t ram_addr
,
403 #define mmap_lock() do { } while(0)
404 #define mmap_unlock() do { } while(0)
407 #define DEFAULT_CODE_GEN_BUFFER_SIZE (32 * 1024 * 1024)
409 #if defined(CONFIG_USER_ONLY)
410 /* Currently it is not recommended to allocate big chunks of data in
411 user mode. It will change when a dedicated libc will be used */
412 #define USE_STATIC_CODE_GEN_BUFFER
415 #ifdef USE_STATIC_CODE_GEN_BUFFER
416 static uint8_t static_code_gen_buffer
[DEFAULT_CODE_GEN_BUFFER_SIZE
];
419 static void code_gen_alloc(unsigned long tb_size
)
424 #ifdef USE_STATIC_CODE_GEN_BUFFER
425 code_gen_buffer
= static_code_gen_buffer
;
426 code_gen_buffer_size
= DEFAULT_CODE_GEN_BUFFER_SIZE
;
427 map_exec(code_gen_buffer
, code_gen_buffer_size
);
429 code_gen_buffer_size
= tb_size
;
430 if (code_gen_buffer_size
== 0) {
431 #if defined(CONFIG_USER_ONLY)
432 /* in user mode, phys_ram_size is not meaningful */
433 code_gen_buffer_size
= DEFAULT_CODE_GEN_BUFFER_SIZE
;
435 /* XXX: needs adjustments */
436 code_gen_buffer_size
= (unsigned long)(ram_size
/ 4);
439 if (code_gen_buffer_size
< MIN_CODE_GEN_BUFFER_SIZE
)
440 code_gen_buffer_size
= MIN_CODE_GEN_BUFFER_SIZE
;
441 /* The code gen buffer location may have constraints depending on
442 the host cpu and OS */
443 #if defined(__linux__)
448 flags
= MAP_PRIVATE
| MAP_ANONYMOUS
;
449 #if defined(__x86_64__)
451 /* Cannot map more than that */
452 if (code_gen_buffer_size
> (800 * 1024 * 1024))
453 code_gen_buffer_size
= (800 * 1024 * 1024);
454 #elif defined(__sparc_v9__)
455 // Map the buffer below 2G, so we can use direct calls and branches
457 start
= (void *) 0x60000000UL
;
458 if (code_gen_buffer_size
> (512 * 1024 * 1024))
459 code_gen_buffer_size
= (512 * 1024 * 1024);
460 #elif defined(__arm__)
461 /* Map the buffer below 32M, so we can use direct calls and branches */
463 start
= (void *) 0x01000000UL
;
464 if (code_gen_buffer_size
> 16 * 1024 * 1024)
465 code_gen_buffer_size
= 16 * 1024 * 1024;
467 code_gen_buffer
= mmap(start
, code_gen_buffer_size
,
468 PROT_WRITE
| PROT_READ
| PROT_EXEC
,
470 if (code_gen_buffer
== MAP_FAILED
) {
471 fprintf(stderr
, "Could not allocate dynamic translator buffer\n");
475 #elif defined(__FreeBSD__) || defined(__DragonFly__)
479 flags
= MAP_PRIVATE
| MAP_ANONYMOUS
;
480 #if defined(__x86_64__)
481 /* FreeBSD doesn't have MAP_32BIT, use MAP_FIXED and assume
482 * 0x40000000 is free */
484 addr
= (void *)0x40000000;
485 /* Cannot map more than that */
486 if (code_gen_buffer_size
> (800 * 1024 * 1024))
487 code_gen_buffer_size
= (800 * 1024 * 1024);
489 code_gen_buffer
= mmap(addr
, code_gen_buffer_size
,
490 PROT_WRITE
| PROT_READ
| PROT_EXEC
,
492 if (code_gen_buffer
== MAP_FAILED
) {
493 fprintf(stderr
, "Could not allocate dynamic translator buffer\n");
498 code_gen_buffer
= qemu_malloc(code_gen_buffer_size
);
499 map_exec(code_gen_buffer
, code_gen_buffer_size
);
501 #endif /* !USE_STATIC_CODE_GEN_BUFFER */
502 map_exec(code_gen_prologue
, sizeof(code_gen_prologue
));
503 code_gen_buffer_max_size
= code_gen_buffer_size
-
504 code_gen_max_block_size();
505 code_gen_max_blocks
= code_gen_buffer_size
/ CODE_GEN_AVG_BLOCK_SIZE
;
506 tbs
= qemu_malloc(code_gen_max_blocks
* sizeof(TranslationBlock
));
509 /* Must be called before using the QEMU cpus. 'tb_size' is the size
510 (in bytes) allocated to the translation buffer. Zero means default
512 void cpu_exec_init_all(unsigned long tb_size
)
515 code_gen_alloc(tb_size
);
516 code_gen_ptr
= code_gen_buffer
;
518 #if !defined(CONFIG_USER_ONLY)
523 #if defined(CPU_SAVE_VERSION) && !defined(CONFIG_USER_ONLY)
525 #define CPU_COMMON_SAVE_VERSION 1
527 static void cpu_common_save(QEMUFile
*f
, void *opaque
)
529 CPUState
*env
= opaque
;
531 cpu_synchronize_state(env
, 0);
533 qemu_put_be32s(f
, &env
->halted
);
534 qemu_put_be32s(f
, &env
->interrupt_request
);
537 static int cpu_common_load(QEMUFile
*f
, void *opaque
, int version_id
)
539 CPUState
*env
= opaque
;
541 if (version_id
!= CPU_COMMON_SAVE_VERSION
)
544 qemu_get_be32s(f
, &env
->halted
);
545 qemu_get_be32s(f
, &env
->interrupt_request
);
546 /* 0x01 was CPU_INTERRUPT_EXIT. This line can be removed when the
547 version_id is increased. */
548 env
->interrupt_request
&= ~0x01;
550 cpu_synchronize_state(env
, 1);
556 void cpu_exec_init(CPUState
*env
)
561 #if defined(CONFIG_USER_ONLY)
564 env
->next_cpu
= NULL
;
567 while (*penv
!= NULL
) {
568 penv
= &(*penv
)->next_cpu
;
571 env
->cpu_index
= cpu_index
;
573 TAILQ_INIT(&env
->breakpoints
);
574 TAILQ_INIT(&env
->watchpoints
);
576 env
->thread_id
= GetCurrentProcessId();
578 env
->thread_id
= getpid();
581 #if defined(CONFIG_USER_ONLY)
584 #if defined(CPU_SAVE_VERSION) && !defined(CONFIG_USER_ONLY)
585 register_savevm("cpu_common", cpu_index
, CPU_COMMON_SAVE_VERSION
,
586 cpu_common_save
, cpu_common_load
, env
);
587 register_savevm("cpu", cpu_index
, CPU_SAVE_VERSION
,
588 cpu_save
, cpu_load
, env
);
592 static inline void invalidate_page_bitmap(PageDesc
*p
)
594 if (p
->code_bitmap
) {
595 qemu_free(p
->code_bitmap
);
596 p
->code_bitmap
= NULL
;
598 p
->code_write_count
= 0;
601 /* set to NULL all the 'first_tb' fields in all PageDescs */
602 static void page_flush_tb(void)
607 for(i
= 0; i
< L1_SIZE
; i
++) {
610 for(j
= 0; j
< L2_SIZE
; j
++) {
612 invalidate_page_bitmap(p
);
619 /* flush all the translation blocks */
620 /* XXX: tb_flush is currently not thread safe */
621 void tb_flush(CPUState
*env1
)
624 #if defined(DEBUG_FLUSH)
625 printf("qemu: flush code_size=%ld nb_tbs=%d avg_tb_size=%ld\n",
626 (unsigned long)(code_gen_ptr
- code_gen_buffer
),
628 ((unsigned long)(code_gen_ptr
- code_gen_buffer
)) / nb_tbs
: 0);
630 if ((unsigned long)(code_gen_ptr
- code_gen_buffer
) > code_gen_buffer_size
)
631 cpu_abort(env1
, "Internal error: code buffer overflow\n");
635 for(env
= first_cpu
; env
!= NULL
; env
= env
->next_cpu
) {
636 memset (env
->tb_jmp_cache
, 0, TB_JMP_CACHE_SIZE
* sizeof (void *));
639 memset (tb_phys_hash
, 0, CODE_GEN_PHYS_HASH_SIZE
* sizeof (void *));
642 code_gen_ptr
= code_gen_buffer
;
643 /* XXX: flush processor icache at this point if cache flush is
648 #ifdef DEBUG_TB_CHECK
650 static void tb_invalidate_check(target_ulong address
)
652 TranslationBlock
*tb
;
654 address
&= TARGET_PAGE_MASK
;
655 for(i
= 0;i
< CODE_GEN_PHYS_HASH_SIZE
; i
++) {
656 for(tb
= tb_phys_hash
[i
]; tb
!= NULL
; tb
= tb
->phys_hash_next
) {
657 if (!(address
+ TARGET_PAGE_SIZE
<= tb
->pc
||
658 address
>= tb
->pc
+ tb
->size
)) {
659 printf("ERROR invalidate: address=%08lx PC=%08lx size=%04x\n",
660 address
, (long)tb
->pc
, tb
->size
);
666 /* verify that all the pages have correct rights for code */
667 static void tb_page_check(void)
669 TranslationBlock
*tb
;
670 int i
, flags1
, flags2
;
672 for(i
= 0;i
< CODE_GEN_PHYS_HASH_SIZE
; i
++) {
673 for(tb
= tb_phys_hash
[i
]; tb
!= NULL
; tb
= tb
->phys_hash_next
) {
674 flags1
= page_get_flags(tb
->pc
);
675 flags2
= page_get_flags(tb
->pc
+ tb
->size
- 1);
676 if ((flags1
& PAGE_WRITE
) || (flags2
& PAGE_WRITE
)) {
677 printf("ERROR page flags: PC=%08lx size=%04x f1=%x f2=%x\n",
678 (long)tb
->pc
, tb
->size
, flags1
, flags2
);
684 static void tb_jmp_check(TranslationBlock
*tb
)
686 TranslationBlock
*tb1
;
689 /* suppress any remaining jumps to this TB */
693 tb1
= (TranslationBlock
*)((long)tb1
& ~3);
696 tb1
= tb1
->jmp_next
[n1
];
698 /* check end of list */
700 printf("ERROR: jmp_list from 0x%08lx\n", (long)tb
);
706 /* invalidate one TB */
707 static inline void tb_remove(TranslationBlock
**ptb
, TranslationBlock
*tb
,
710 TranslationBlock
*tb1
;
714 *ptb
= *(TranslationBlock
**)((char *)tb1
+ next_offset
);
717 ptb
= (TranslationBlock
**)((char *)tb1
+ next_offset
);
721 static inline void tb_page_remove(TranslationBlock
**ptb
, TranslationBlock
*tb
)
723 TranslationBlock
*tb1
;
729 tb1
= (TranslationBlock
*)((long)tb1
& ~3);
731 *ptb
= tb1
->page_next
[n1
];
734 ptb
= &tb1
->page_next
[n1
];
738 static inline void tb_jmp_remove(TranslationBlock
*tb
, int n
)
740 TranslationBlock
*tb1
, **ptb
;
743 ptb
= &tb
->jmp_next
[n
];
746 /* find tb(n) in circular list */
750 tb1
= (TranslationBlock
*)((long)tb1
& ~3);
751 if (n1
== n
&& tb1
== tb
)
754 ptb
= &tb1
->jmp_first
;
756 ptb
= &tb1
->jmp_next
[n1
];
759 /* now we can suppress tb(n) from the list */
760 *ptb
= tb
->jmp_next
[n
];
762 tb
->jmp_next
[n
] = NULL
;
766 /* reset the jump entry 'n' of a TB so that it is not chained to
768 static inline void tb_reset_jump(TranslationBlock
*tb
, int n
)
770 tb_set_jmp_target(tb
, n
, (unsigned long)(tb
->tc_ptr
+ tb
->tb_next_offset
[n
]));
773 void tb_phys_invalidate(TranslationBlock
*tb
, target_ulong page_addr
)
778 target_phys_addr_t phys_pc
;
779 TranslationBlock
*tb1
, *tb2
;
781 /* remove the TB from the hash list */
782 phys_pc
= tb
->page_addr
[0] + (tb
->pc
& ~TARGET_PAGE_MASK
);
783 h
= tb_phys_hash_func(phys_pc
);
784 tb_remove(&tb_phys_hash
[h
], tb
,
785 offsetof(TranslationBlock
, phys_hash_next
));
787 /* remove the TB from the page list */
788 if (tb
->page_addr
[0] != page_addr
) {
789 p
= page_find(tb
->page_addr
[0] >> TARGET_PAGE_BITS
);
790 tb_page_remove(&p
->first_tb
, tb
);
791 invalidate_page_bitmap(p
);
793 if (tb
->page_addr
[1] != -1 && tb
->page_addr
[1] != page_addr
) {
794 p
= page_find(tb
->page_addr
[1] >> TARGET_PAGE_BITS
);
795 tb_page_remove(&p
->first_tb
, tb
);
796 invalidate_page_bitmap(p
);
799 tb_invalidated_flag
= 1;
801 /* remove the TB from the hash list */
802 h
= tb_jmp_cache_hash_func(tb
->pc
);
803 for(env
= first_cpu
; env
!= NULL
; env
= env
->next_cpu
) {
804 if (env
->tb_jmp_cache
[h
] == tb
)
805 env
->tb_jmp_cache
[h
] = NULL
;
808 /* suppress this TB from the two jump lists */
809 tb_jmp_remove(tb
, 0);
810 tb_jmp_remove(tb
, 1);
812 /* suppress any remaining jumps to this TB */
818 tb1
= (TranslationBlock
*)((long)tb1
& ~3);
819 tb2
= tb1
->jmp_next
[n1
];
820 tb_reset_jump(tb1
, n1
);
821 tb1
->jmp_next
[n1
] = NULL
;
824 tb
->jmp_first
= (TranslationBlock
*)((long)tb
| 2); /* fail safe */
826 tb_phys_invalidate_count
++;
829 static inline void set_bits(uint8_t *tab
, int start
, int len
)
835 mask
= 0xff << (start
& 7);
836 if ((start
& ~7) == (end
& ~7)) {
838 mask
&= ~(0xff << (end
& 7));
843 start
= (start
+ 8) & ~7;
845 while (start
< end1
) {
850 mask
= ~(0xff << (end
& 7));
856 static void build_page_bitmap(PageDesc
*p
)
858 int n
, tb_start
, tb_end
;
859 TranslationBlock
*tb
;
861 p
->code_bitmap
= qemu_mallocz(TARGET_PAGE_SIZE
/ 8);
866 tb
= (TranslationBlock
*)((long)tb
& ~3);
867 /* NOTE: this is subtle as a TB may span two physical pages */
869 /* NOTE: tb_end may be after the end of the page, but
870 it is not a problem */
871 tb_start
= tb
->pc
& ~TARGET_PAGE_MASK
;
872 tb_end
= tb_start
+ tb
->size
;
873 if (tb_end
> TARGET_PAGE_SIZE
)
874 tb_end
= TARGET_PAGE_SIZE
;
877 tb_end
= ((tb
->pc
+ tb
->size
) & ~TARGET_PAGE_MASK
);
879 set_bits(p
->code_bitmap
, tb_start
, tb_end
- tb_start
);
880 tb
= tb
->page_next
[n
];
884 TranslationBlock
*tb_gen_code(CPUState
*env
,
885 target_ulong pc
, target_ulong cs_base
,
886 int flags
, int cflags
)
888 TranslationBlock
*tb
;
890 target_ulong phys_pc
, phys_page2
, virt_page2
;
893 phys_pc
= get_phys_addr_code(env
, pc
);
896 /* flush must be done */
898 /* cannot fail at this point */
900 /* Don't forget to invalidate previous TB info. */
901 tb_invalidated_flag
= 1;
903 tc_ptr
= code_gen_ptr
;
905 tb
->cs_base
= cs_base
;
908 cpu_gen_code(env
, tb
, &code_gen_size
);
909 code_gen_ptr
= (void *)(((unsigned long)code_gen_ptr
+ code_gen_size
+ CODE_GEN_ALIGN
- 1) & ~(CODE_GEN_ALIGN
- 1));
911 /* check next page if needed */
912 virt_page2
= (pc
+ tb
->size
- 1) & TARGET_PAGE_MASK
;
914 if ((pc
& TARGET_PAGE_MASK
) != virt_page2
) {
915 phys_page2
= get_phys_addr_code(env
, virt_page2
);
917 tb_link_phys(tb
, phys_pc
, phys_page2
);
921 /* invalidate all TBs which intersect with the target physical page
922 starting in range [start;end[. NOTE: start and end must refer to
923 the same physical page. 'is_cpu_write_access' should be true if called
924 from a real cpu write access: the virtual CPU will exit the current
925 TB if code is modified inside this TB. */
926 void tb_invalidate_phys_page_range(target_phys_addr_t start
, target_phys_addr_t end
,
927 int is_cpu_write_access
)
929 TranslationBlock
*tb
, *tb_next
, *saved_tb
;
930 CPUState
*env
= cpu_single_env
;
931 target_ulong tb_start
, tb_end
;
934 #ifdef TARGET_HAS_PRECISE_SMC
935 int current_tb_not_found
= is_cpu_write_access
;
936 TranslationBlock
*current_tb
= NULL
;
937 int current_tb_modified
= 0;
938 target_ulong current_pc
= 0;
939 target_ulong current_cs_base
= 0;
940 int current_flags
= 0;
941 #endif /* TARGET_HAS_PRECISE_SMC */
943 p
= page_find(start
>> TARGET_PAGE_BITS
);
946 if (!p
->code_bitmap
&&
947 ++p
->code_write_count
>= SMC_BITMAP_USE_THRESHOLD
&&
948 is_cpu_write_access
) {
949 /* build code bitmap */
950 build_page_bitmap(p
);
953 /* we remove all the TBs in the range [start, end[ */
954 /* XXX: see if in some cases it could be faster to invalidate all the code */
958 tb
= (TranslationBlock
*)((long)tb
& ~3);
959 tb_next
= tb
->page_next
[n
];
960 /* NOTE: this is subtle as a TB may span two physical pages */
962 /* NOTE: tb_end may be after the end of the page, but
963 it is not a problem */
964 tb_start
= tb
->page_addr
[0] + (tb
->pc
& ~TARGET_PAGE_MASK
);
965 tb_end
= tb_start
+ tb
->size
;
967 tb_start
= tb
->page_addr
[1];
968 tb_end
= tb_start
+ ((tb
->pc
+ tb
->size
) & ~TARGET_PAGE_MASK
);
970 if (!(tb_end
<= start
|| tb_start
>= end
)) {
971 #ifdef TARGET_HAS_PRECISE_SMC
972 if (current_tb_not_found
) {
973 current_tb_not_found
= 0;
975 if (env
->mem_io_pc
) {
976 /* now we have a real cpu fault */
977 current_tb
= tb_find_pc(env
->mem_io_pc
);
980 if (current_tb
== tb
&&
981 (current_tb
->cflags
& CF_COUNT_MASK
) != 1) {
982 /* If we are modifying the current TB, we must stop
983 its execution. We could be more precise by checking
984 that the modification is after the current PC, but it
985 would require a specialized function to partially
986 restore the CPU state */
988 current_tb_modified
= 1;
989 cpu_restore_state(current_tb
, env
,
990 env
->mem_io_pc
, NULL
);
991 cpu_get_tb_cpu_state(env
, ¤t_pc
, ¤t_cs_base
,
994 #endif /* TARGET_HAS_PRECISE_SMC */
995 /* we need to do that to handle the case where a signal
996 occurs while doing tb_phys_invalidate() */
999 saved_tb
= env
->current_tb
;
1000 env
->current_tb
= NULL
;
1002 tb_phys_invalidate(tb
, -1);
1004 env
->current_tb
= saved_tb
;
1005 if (env
->interrupt_request
&& env
->current_tb
)
1006 cpu_interrupt(env
, env
->interrupt_request
);
1011 #if !defined(CONFIG_USER_ONLY)
1012 /* if no code remaining, no need to continue to use slow writes */
1014 invalidate_page_bitmap(p
);
1015 if (is_cpu_write_access
) {
1016 tlb_unprotect_code_phys(env
, start
, env
->mem_io_vaddr
);
1020 #ifdef TARGET_HAS_PRECISE_SMC
1021 if (current_tb_modified
) {
1022 /* we generate a block containing just the instruction
1023 modifying the memory. It will ensure that it cannot modify
1025 env
->current_tb
= NULL
;
1026 tb_gen_code(env
, current_pc
, current_cs_base
, current_flags
, 1);
1027 cpu_resume_from_signal(env
, NULL
);
1032 /* len must be <= 8 and start must be a multiple of len */
1033 static inline void tb_invalidate_phys_page_fast(target_phys_addr_t start
, int len
)
1039 qemu_log("modifying code at 0x%x size=%d EIP=%x PC=%08x\n",
1040 cpu_single_env
->mem_io_vaddr
, len
,
1041 cpu_single_env
->eip
,
1042 cpu_single_env
->eip
+ (long)cpu_single_env
->segs
[R_CS
].base
);
1045 p
= page_find(start
>> TARGET_PAGE_BITS
);
1048 if (p
->code_bitmap
) {
1049 offset
= start
& ~TARGET_PAGE_MASK
;
1050 b
= p
->code_bitmap
[offset
>> 3] >> (offset
& 7);
1051 if (b
& ((1 << len
) - 1))
1055 tb_invalidate_phys_page_range(start
, start
+ len
, 1);
1059 #if !defined(CONFIG_SOFTMMU)
1060 static void tb_invalidate_phys_page(target_phys_addr_t addr
,
1061 unsigned long pc
, void *puc
)
1063 TranslationBlock
*tb
;
1066 #ifdef TARGET_HAS_PRECISE_SMC
1067 TranslationBlock
*current_tb
= NULL
;
1068 CPUState
*env
= cpu_single_env
;
1069 int current_tb_modified
= 0;
1070 target_ulong current_pc
= 0;
1071 target_ulong current_cs_base
= 0;
1072 int current_flags
= 0;
1075 addr
&= TARGET_PAGE_MASK
;
1076 p
= page_find(addr
>> TARGET_PAGE_BITS
);
1080 #ifdef TARGET_HAS_PRECISE_SMC
1081 if (tb
&& pc
!= 0) {
1082 current_tb
= tb_find_pc(pc
);
1085 while (tb
!= NULL
) {
1087 tb
= (TranslationBlock
*)((long)tb
& ~3);
1088 #ifdef TARGET_HAS_PRECISE_SMC
1089 if (current_tb
== tb
&&
1090 (current_tb
->cflags
& CF_COUNT_MASK
) != 1) {
1091 /* If we are modifying the current TB, we must stop
1092 its execution. We could be more precise by checking
1093 that the modification is after the current PC, but it
1094 would require a specialized function to partially
1095 restore the CPU state */
1097 current_tb_modified
= 1;
1098 cpu_restore_state(current_tb
, env
, pc
, puc
);
1099 cpu_get_tb_cpu_state(env
, ¤t_pc
, ¤t_cs_base
,
1102 #endif /* TARGET_HAS_PRECISE_SMC */
1103 tb_phys_invalidate(tb
, addr
);
1104 tb
= tb
->page_next
[n
];
1107 #ifdef TARGET_HAS_PRECISE_SMC
1108 if (current_tb_modified
) {
1109 /* we generate a block containing just the instruction
1110 modifying the memory. It will ensure that it cannot modify
1112 env
->current_tb
= NULL
;
1113 tb_gen_code(env
, current_pc
, current_cs_base
, current_flags
, 1);
1114 cpu_resume_from_signal(env
, puc
);
1120 /* add the tb in the target page and protect it if necessary */
1121 static inline void tb_alloc_page(TranslationBlock
*tb
,
1122 unsigned int n
, target_ulong page_addr
)
1125 TranslationBlock
*last_first_tb
;
1127 tb
->page_addr
[n
] = page_addr
;
1128 p
= page_find_alloc(page_addr
>> TARGET_PAGE_BITS
);
1129 tb
->page_next
[n
] = p
->first_tb
;
1130 last_first_tb
= p
->first_tb
;
1131 p
->first_tb
= (TranslationBlock
*)((long)tb
| n
);
1132 invalidate_page_bitmap(p
);
1134 #if defined(TARGET_HAS_SMC) || 1
1136 #if defined(CONFIG_USER_ONLY)
1137 if (p
->flags
& PAGE_WRITE
) {
1142 /* force the host page as non writable (writes will have a
1143 page fault + mprotect overhead) */
1144 page_addr
&= qemu_host_page_mask
;
1146 for(addr
= page_addr
; addr
< page_addr
+ qemu_host_page_size
;
1147 addr
+= TARGET_PAGE_SIZE
) {
1149 p2
= page_find (addr
>> TARGET_PAGE_BITS
);
1153 p2
->flags
&= ~PAGE_WRITE
;
1154 page_get_flags(addr
);
1156 mprotect(g2h(page_addr
), qemu_host_page_size
,
1157 (prot
& PAGE_BITS
) & ~PAGE_WRITE
);
1158 #ifdef DEBUG_TB_INVALIDATE
1159 printf("protecting code page: 0x" TARGET_FMT_lx
"\n",
1164 /* if some code is already present, then the pages are already
1165 protected. So we handle the case where only the first TB is
1166 allocated in a physical page */
1167 if (!last_first_tb
) {
1168 tlb_protect_code(page_addr
);
1172 #endif /* TARGET_HAS_SMC */
1175 /* Allocate a new translation block. Flush the translation buffer if
1176 too many translation blocks or too much generated code. */
1177 TranslationBlock
*tb_alloc(target_ulong pc
)
1179 TranslationBlock
*tb
;
1181 if (nb_tbs
>= code_gen_max_blocks
||
1182 (code_gen_ptr
- code_gen_buffer
) >= code_gen_buffer_max_size
)
1184 tb
= &tbs
[nb_tbs
++];
1190 void tb_free(TranslationBlock
*tb
)
1192 /* In practice this is mostly used for single use temporary TB
1193 Ignore the hard cases and just back up if this TB happens to
1194 be the last one generated. */
1195 if (nb_tbs
> 0 && tb
== &tbs
[nb_tbs
- 1]) {
1196 code_gen_ptr
= tb
->tc_ptr
;
1201 /* add a new TB and link it to the physical page tables. phys_page2 is
1202 (-1) to indicate that only one page contains the TB. */
1203 void tb_link_phys(TranslationBlock
*tb
,
1204 target_ulong phys_pc
, target_ulong phys_page2
)
1207 TranslationBlock
**ptb
;
1209 /* Grab the mmap lock to stop another thread invalidating this TB
1210 before we are done. */
1212 /* add in the physical hash table */
1213 h
= tb_phys_hash_func(phys_pc
);
1214 ptb
= &tb_phys_hash
[h
];
1215 tb
->phys_hash_next
= *ptb
;
1218 /* add in the page list */
1219 tb_alloc_page(tb
, 0, phys_pc
& TARGET_PAGE_MASK
);
1220 if (phys_page2
!= -1)
1221 tb_alloc_page(tb
, 1, phys_page2
);
1223 tb
->page_addr
[1] = -1;
1225 tb
->jmp_first
= (TranslationBlock
*)((long)tb
| 2);
1226 tb
->jmp_next
[0] = NULL
;
1227 tb
->jmp_next
[1] = NULL
;
1229 /* init original jump addresses */
1230 if (tb
->tb_next_offset
[0] != 0xffff)
1231 tb_reset_jump(tb
, 0);
1232 if (tb
->tb_next_offset
[1] != 0xffff)
1233 tb_reset_jump(tb
, 1);
1235 #ifdef DEBUG_TB_CHECK
1241 /* find the TB 'tb' such that tb[0].tc_ptr <= tc_ptr <
1242 tb[1].tc_ptr. Return NULL if not found */
1243 TranslationBlock
*tb_find_pc(unsigned long tc_ptr
)
1245 int m_min
, m_max
, m
;
1247 TranslationBlock
*tb
;
1251 if (tc_ptr
< (unsigned long)code_gen_buffer
||
1252 tc_ptr
>= (unsigned long)code_gen_ptr
)
1254 /* binary search (cf Knuth) */
1257 while (m_min
<= m_max
) {
1258 m
= (m_min
+ m_max
) >> 1;
1260 v
= (unsigned long)tb
->tc_ptr
;
1263 else if (tc_ptr
< v
) {
1272 static void tb_reset_jump_recursive(TranslationBlock
*tb
);
1274 static inline void tb_reset_jump_recursive2(TranslationBlock
*tb
, int n
)
1276 TranslationBlock
*tb1
, *tb_next
, **ptb
;
1279 tb1
= tb
->jmp_next
[n
];
1281 /* find head of list */
1284 tb1
= (TranslationBlock
*)((long)tb1
& ~3);
1287 tb1
= tb1
->jmp_next
[n1
];
1289 /* we are now sure now that tb jumps to tb1 */
1292 /* remove tb from the jmp_first list */
1293 ptb
= &tb_next
->jmp_first
;
1297 tb1
= (TranslationBlock
*)((long)tb1
& ~3);
1298 if (n1
== n
&& tb1
== tb
)
1300 ptb
= &tb1
->jmp_next
[n1
];
1302 *ptb
= tb
->jmp_next
[n
];
1303 tb
->jmp_next
[n
] = NULL
;
1305 /* suppress the jump to next tb in generated code */
1306 tb_reset_jump(tb
, n
);
1308 /* suppress jumps in the tb on which we could have jumped */
1309 tb_reset_jump_recursive(tb_next
);
1313 static void tb_reset_jump_recursive(TranslationBlock
*tb
)
1315 tb_reset_jump_recursive2(tb
, 0);
1316 tb_reset_jump_recursive2(tb
, 1);
1319 #if defined(TARGET_HAS_ICE)
1320 static void breakpoint_invalidate(CPUState
*env
, target_ulong pc
)
1322 target_phys_addr_t addr
;
1324 ram_addr_t ram_addr
;
1327 addr
= cpu_get_phys_page_debug(env
, pc
);
1328 p
= phys_page_find(addr
>> TARGET_PAGE_BITS
);
1330 pd
= IO_MEM_UNASSIGNED
;
1332 pd
= p
->phys_offset
;
1334 ram_addr
= (pd
& TARGET_PAGE_MASK
) | (pc
& ~TARGET_PAGE_MASK
);
1335 tb_invalidate_phys_page_range(ram_addr
, ram_addr
+ 1, 0);
1339 /* Add a watchpoint. */
1340 int cpu_watchpoint_insert(CPUState
*env
, target_ulong addr
, target_ulong len
,
1341 int flags
, CPUWatchpoint
**watchpoint
)
1343 target_ulong len_mask
= ~(len
- 1);
1346 /* sanity checks: allow power-of-2 lengths, deny unaligned watchpoints */
1347 if ((len
!= 1 && len
!= 2 && len
!= 4 && len
!= 8) || (addr
& ~len_mask
)) {
1348 fprintf(stderr
, "qemu: tried to set invalid watchpoint at "
1349 TARGET_FMT_lx
", len=" TARGET_FMT_lu
"\n", addr
, len
);
1352 wp
= qemu_malloc(sizeof(*wp
));
1355 wp
->len_mask
= len_mask
;
1358 /* keep all GDB-injected watchpoints in front */
1360 TAILQ_INSERT_HEAD(&env
->watchpoints
, wp
, entry
);
1362 TAILQ_INSERT_TAIL(&env
->watchpoints
, wp
, entry
);
1364 tlb_flush_page(env
, addr
);
1371 /* Remove a specific watchpoint. */
1372 int cpu_watchpoint_remove(CPUState
*env
, target_ulong addr
, target_ulong len
,
1375 target_ulong len_mask
= ~(len
- 1);
1378 TAILQ_FOREACH(wp
, &env
->watchpoints
, entry
) {
1379 if (addr
== wp
->vaddr
&& len_mask
== wp
->len_mask
1380 && flags
== (wp
->flags
& ~BP_WATCHPOINT_HIT
)) {
1381 cpu_watchpoint_remove_by_ref(env
, wp
);
1388 /* Remove a specific watchpoint by reference. */
1389 void cpu_watchpoint_remove_by_ref(CPUState
*env
, CPUWatchpoint
*watchpoint
)
1391 TAILQ_REMOVE(&env
->watchpoints
, watchpoint
, entry
);
1393 tlb_flush_page(env
, watchpoint
->vaddr
);
1395 qemu_free(watchpoint
);
1398 /* Remove all matching watchpoints. */
1399 void cpu_watchpoint_remove_all(CPUState
*env
, int mask
)
1401 CPUWatchpoint
*wp
, *next
;
1403 TAILQ_FOREACH_SAFE(wp
, &env
->watchpoints
, entry
, next
) {
1404 if (wp
->flags
& mask
)
1405 cpu_watchpoint_remove_by_ref(env
, wp
);
1409 /* Add a breakpoint. */
1410 int cpu_breakpoint_insert(CPUState
*env
, target_ulong pc
, int flags
,
1411 CPUBreakpoint
**breakpoint
)
1413 #if defined(TARGET_HAS_ICE)
1416 bp
= qemu_malloc(sizeof(*bp
));
1421 /* keep all GDB-injected breakpoints in front */
1423 TAILQ_INSERT_HEAD(&env
->breakpoints
, bp
, entry
);
1425 TAILQ_INSERT_TAIL(&env
->breakpoints
, bp
, entry
);
1427 breakpoint_invalidate(env
, pc
);
1437 /* Remove a specific breakpoint. */
1438 int cpu_breakpoint_remove(CPUState
*env
, target_ulong pc
, int flags
)
1440 #if defined(TARGET_HAS_ICE)
1443 TAILQ_FOREACH(bp
, &env
->breakpoints
, entry
) {
1444 if (bp
->pc
== pc
&& bp
->flags
== flags
) {
1445 cpu_breakpoint_remove_by_ref(env
, bp
);
1455 /* Remove a specific breakpoint by reference. */
1456 void cpu_breakpoint_remove_by_ref(CPUState
*env
, CPUBreakpoint
*breakpoint
)
1458 #if defined(TARGET_HAS_ICE)
1459 TAILQ_REMOVE(&env
->breakpoints
, breakpoint
, entry
);
1461 breakpoint_invalidate(env
, breakpoint
->pc
);
1463 qemu_free(breakpoint
);
1467 /* Remove all matching breakpoints. */
1468 void cpu_breakpoint_remove_all(CPUState
*env
, int mask
)
1470 #if defined(TARGET_HAS_ICE)
1471 CPUBreakpoint
*bp
, *next
;
1473 TAILQ_FOREACH_SAFE(bp
, &env
->breakpoints
, entry
, next
) {
1474 if (bp
->flags
& mask
)
1475 cpu_breakpoint_remove_by_ref(env
, bp
);
1480 /* enable or disable single step mode. EXCP_DEBUG is returned by the
1481 CPU loop after each instruction */
1482 void cpu_single_step(CPUState
*env
, int enabled
)
1484 #if defined(TARGET_HAS_ICE)
1485 if (env
->singlestep_enabled
!= enabled
) {
1486 env
->singlestep_enabled
= enabled
;
1488 kvm_update_guest_debug(env
, 0);
1490 /* must flush all the translated code to avoid inconsistencies */
1491 /* XXX: only flush what is necessary */
1498 /* enable or disable low levels log */
1499 void cpu_set_log(int log_flags
)
1501 loglevel
= log_flags
;
1502 if (loglevel
&& !logfile
) {
1503 logfile
= fopen(logfilename
, log_append
? "a" : "w");
1505 perror(logfilename
);
1508 #if !defined(CONFIG_SOFTMMU)
1509 /* must avoid mmap() usage of glibc by setting a buffer "by hand" */
1511 static char logfile_buf
[4096];
1512 setvbuf(logfile
, logfile_buf
, _IOLBF
, sizeof(logfile_buf
));
1515 setvbuf(logfile
, NULL
, _IOLBF
, 0);
1519 if (!loglevel
&& logfile
) {
1525 void cpu_set_log_filename(const char *filename
)
1527 logfilename
= strdup(filename
);
1532 cpu_set_log(loglevel
);
1535 static void cpu_unlink_tb(CPUState
*env
)
1537 #if defined(USE_NPTL)
1538 /* FIXME: TB unchaining isn't SMP safe. For now just ignore the
1539 problem and hope the cpu will stop of its own accord. For userspace
1540 emulation this often isn't actually as bad as it sounds. Often
1541 signals are used primarily to interrupt blocking syscalls. */
1543 TranslationBlock
*tb
;
1544 static spinlock_t interrupt_lock
= SPIN_LOCK_UNLOCKED
;
1546 tb
= env
->current_tb
;
1547 /* if the cpu is currently executing code, we must unlink it and
1548 all the potentially executing TB */
1549 if (tb
&& !testandset(&interrupt_lock
)) {
1550 env
->current_tb
= NULL
;
1551 tb_reset_jump_recursive(tb
);
1552 resetlock(&interrupt_lock
);
1557 /* mask must never be zero, except for A20 change call */
1558 void cpu_interrupt(CPUState
*env
, int mask
)
1562 old_mask
= env
->interrupt_request
;
1563 env
->interrupt_request
|= mask
;
1564 if (kvm_enabled() && !qemu_kvm_irqchip_in_kernel())
1565 kvm_update_interrupt_request(env
);
1567 #ifndef CONFIG_USER_ONLY
1569 * If called from iothread context, wake the target cpu in
1572 if (!qemu_cpu_self(env
)) {
1579 env
->icount_decr
.u16
.high
= 0xffff;
1580 #ifndef CONFIG_USER_ONLY
1582 && (mask
& ~old_mask
) != 0) {
1583 cpu_abort(env
, "Raised interrupt while not in I/O function");
1591 void cpu_reset_interrupt(CPUState
*env
, int mask
)
1593 env
->interrupt_request
&= ~mask
;
1596 void cpu_exit(CPUState
*env
)
1598 env
->exit_request
= 1;
1602 const CPULogItem cpu_log_items
[] = {
1603 { CPU_LOG_TB_OUT_ASM
, "out_asm",
1604 "show generated host assembly code for each compiled TB" },
1605 { CPU_LOG_TB_IN_ASM
, "in_asm",
1606 "show target assembly code for each compiled TB" },
1607 { CPU_LOG_TB_OP
, "op",
1608 "show micro ops for each compiled TB" },
1609 { CPU_LOG_TB_OP_OPT
, "op_opt",
1612 "before eflags optimization and "
1614 "after liveness analysis" },
1615 { CPU_LOG_INT
, "int",
1616 "show interrupts/exceptions in short format" },
1617 { CPU_LOG_EXEC
, "exec",
1618 "show trace before each executed TB (lots of logs)" },
1619 { CPU_LOG_TB_CPU
, "cpu",
1620 "show CPU state before block translation" },
1622 { CPU_LOG_PCALL
, "pcall",
1623 "show protected mode far calls/returns/exceptions" },
1624 { CPU_LOG_RESET
, "cpu_reset",
1625 "show CPU state before CPU resets" },
1628 { CPU_LOG_IOPORT
, "ioport",
1629 "show all i/o ports accesses" },
1634 static int cmp1(const char *s1
, int n
, const char *s2
)
1636 if (strlen(s2
) != n
)
1638 return memcmp(s1
, s2
, n
) == 0;
1641 /* takes a comma separated list of log masks. Return 0 if error. */
1642 int cpu_str_to_log_mask(const char *str
)
1644 const CPULogItem
*item
;
1651 p1
= strchr(p
, ',');
1654 if(cmp1(p
,p1
-p
,"all")) {
1655 for(item
= cpu_log_items
; item
->mask
!= 0; item
++) {
1659 for(item
= cpu_log_items
; item
->mask
!= 0; item
++) {
1660 if (cmp1(p
, p1
- p
, item
->name
))
1674 void cpu_abort(CPUState
*env
, const char *fmt
, ...)
1681 fprintf(stderr
, "qemu: fatal: ");
1682 vfprintf(stderr
, fmt
, ap
);
1683 fprintf(stderr
, "\n");
1685 cpu_dump_state(env
, stderr
, fprintf
, X86_DUMP_FPU
| X86_DUMP_CCOP
);
1687 cpu_dump_state(env
, stderr
, fprintf
, 0);
1689 if (qemu_log_enabled()) {
1690 qemu_log("qemu: fatal: ");
1691 qemu_log_vprintf(fmt
, ap2
);
1694 log_cpu_state(env
, X86_DUMP_FPU
| X86_DUMP_CCOP
);
1696 log_cpu_state(env
, 0);
1706 CPUState
*cpu_copy(CPUState
*env
)
1708 CPUState
*new_env
= cpu_init(env
->cpu_model_str
);
1709 CPUState
*next_cpu
= new_env
->next_cpu
;
1710 int cpu_index
= new_env
->cpu_index
;
1711 #if defined(TARGET_HAS_ICE)
1716 memcpy(new_env
, env
, sizeof(CPUState
));
1718 /* Preserve chaining and index. */
1719 new_env
->next_cpu
= next_cpu
;
1720 new_env
->cpu_index
= cpu_index
;
1722 /* Clone all break/watchpoints.
1723 Note: Once we support ptrace with hw-debug register access, make sure
1724 BP_CPU break/watchpoints are handled correctly on clone. */
1725 TAILQ_INIT(&env
->breakpoints
);
1726 TAILQ_INIT(&env
->watchpoints
);
1727 #if defined(TARGET_HAS_ICE)
1728 TAILQ_FOREACH(bp
, &env
->breakpoints
, entry
) {
1729 cpu_breakpoint_insert(new_env
, bp
->pc
, bp
->flags
, NULL
);
1731 TAILQ_FOREACH(wp
, &env
->watchpoints
, entry
) {
1732 cpu_watchpoint_insert(new_env
, wp
->vaddr
, (~wp
->len_mask
) + 1,
1740 #if !defined(CONFIG_USER_ONLY)
1742 static inline void tlb_flush_jmp_cache(CPUState
*env
, target_ulong addr
)
1746 /* Discard jump cache entries for any tb which might potentially
1747 overlap the flushed page. */
1748 i
= tb_jmp_cache_hash_page(addr
- TARGET_PAGE_SIZE
);
1749 memset (&env
->tb_jmp_cache
[i
], 0,
1750 TB_JMP_PAGE_SIZE
* sizeof(TranslationBlock
*));
1752 i
= tb_jmp_cache_hash_page(addr
);
1753 memset (&env
->tb_jmp_cache
[i
], 0,
1754 TB_JMP_PAGE_SIZE
* sizeof(TranslationBlock
*));
1757 /* NOTE: if flush_global is true, also flush global entries (not
1759 void tlb_flush(CPUState
*env
, int flush_global
)
1763 #if defined(DEBUG_TLB)
1764 printf("tlb_flush:\n");
1766 /* must reset current TB so that interrupts cannot modify the
1767 links while we are modifying them */
1768 env
->current_tb
= NULL
;
1770 for(i
= 0; i
< CPU_TLB_SIZE
; i
++) {
1771 env
->tlb_table
[0][i
].addr_read
= -1;
1772 env
->tlb_table
[0][i
].addr_write
= -1;
1773 env
->tlb_table
[0][i
].addr_code
= -1;
1774 env
->tlb_table
[1][i
].addr_read
= -1;
1775 env
->tlb_table
[1][i
].addr_write
= -1;
1776 env
->tlb_table
[1][i
].addr_code
= -1;
1777 #if (NB_MMU_MODES >= 3)
1778 env
->tlb_table
[2][i
].addr_read
= -1;
1779 env
->tlb_table
[2][i
].addr_write
= -1;
1780 env
->tlb_table
[2][i
].addr_code
= -1;
1782 #if (NB_MMU_MODES >= 4)
1783 env
->tlb_table
[3][i
].addr_read
= -1;
1784 env
->tlb_table
[3][i
].addr_write
= -1;
1785 env
->tlb_table
[3][i
].addr_code
= -1;
1787 #if (NB_MMU_MODES >= 5)
1788 env
->tlb_table
[4][i
].addr_read
= -1;
1789 env
->tlb_table
[4][i
].addr_write
= -1;
1790 env
->tlb_table
[4][i
].addr_code
= -1;
1795 memset (env
->tb_jmp_cache
, 0, TB_JMP_CACHE_SIZE
* sizeof (void *));
1798 if (env
->kqemu_enabled
) {
1799 kqemu_flush(env
, flush_global
);
1805 static inline void tlb_flush_entry(CPUTLBEntry
*tlb_entry
, target_ulong addr
)
1807 if (addr
== (tlb_entry
->addr_read
&
1808 (TARGET_PAGE_MASK
| TLB_INVALID_MASK
)) ||
1809 addr
== (tlb_entry
->addr_write
&
1810 (TARGET_PAGE_MASK
| TLB_INVALID_MASK
)) ||
1811 addr
== (tlb_entry
->addr_code
&
1812 (TARGET_PAGE_MASK
| TLB_INVALID_MASK
))) {
1813 tlb_entry
->addr_read
= -1;
1814 tlb_entry
->addr_write
= -1;
1815 tlb_entry
->addr_code
= -1;
1819 void tlb_flush_page(CPUState
*env
, target_ulong addr
)
1823 #if defined(DEBUG_TLB)
1824 printf("tlb_flush_page: " TARGET_FMT_lx
"\n", addr
);
1826 /* must reset current TB so that interrupts cannot modify the
1827 links while we are modifying them */
1828 env
->current_tb
= NULL
;
1830 addr
&= TARGET_PAGE_MASK
;
1831 i
= (addr
>> TARGET_PAGE_BITS
) & (CPU_TLB_SIZE
- 1);
1832 tlb_flush_entry(&env
->tlb_table
[0][i
], addr
);
1833 tlb_flush_entry(&env
->tlb_table
[1][i
], addr
);
1834 #if (NB_MMU_MODES >= 3)
1835 tlb_flush_entry(&env
->tlb_table
[2][i
], addr
);
1837 #if (NB_MMU_MODES >= 4)
1838 tlb_flush_entry(&env
->tlb_table
[3][i
], addr
);
1840 #if (NB_MMU_MODES >= 5)
1841 tlb_flush_entry(&env
->tlb_table
[4][i
], addr
);
1844 tlb_flush_jmp_cache(env
, addr
);
1847 if (env
->kqemu_enabled
) {
1848 kqemu_flush_page(env
, addr
);
1853 /* update the TLBs so that writes to code in the virtual page 'addr'
1855 static void tlb_protect_code(ram_addr_t ram_addr
)
1857 cpu_physical_memory_reset_dirty(ram_addr
,
1858 ram_addr
+ TARGET_PAGE_SIZE
,
1862 /* update the TLB so that writes in physical page 'phys_addr' are no longer
1863 tested for self modifying code */
1864 static void tlb_unprotect_code_phys(CPUState
*env
, ram_addr_t ram_addr
,
1867 phys_ram_dirty
[ram_addr
>> TARGET_PAGE_BITS
] |= CODE_DIRTY_FLAG
;
1870 static inline void tlb_reset_dirty_range(CPUTLBEntry
*tlb_entry
,
1871 unsigned long start
, unsigned long length
)
1874 if ((tlb_entry
->addr_write
& ~TARGET_PAGE_MASK
) == IO_MEM_RAM
) {
1875 addr
= (tlb_entry
->addr_write
& TARGET_PAGE_MASK
) + tlb_entry
->addend
;
1876 if ((addr
- start
) < length
) {
1877 tlb_entry
->addr_write
= (tlb_entry
->addr_write
& TARGET_PAGE_MASK
) | TLB_NOTDIRTY
;
1882 /* Note: start and end must be within the same ram block. */
1883 void cpu_physical_memory_reset_dirty(ram_addr_t start
, ram_addr_t end
,
1887 unsigned long length
, start1
;
1891 start
&= TARGET_PAGE_MASK
;
1892 end
= TARGET_PAGE_ALIGN(end
);
1894 length
= end
- start
;
1897 len
= length
>> TARGET_PAGE_BITS
;
1899 /* XXX: should not depend on cpu context */
1901 if (env
->kqemu_enabled
) {
1904 for(i
= 0; i
< len
; i
++) {
1905 kqemu_set_notdirty(env
, addr
);
1906 addr
+= TARGET_PAGE_SIZE
;
1910 mask
= ~dirty_flags
;
1911 p
= phys_ram_dirty
+ (start
>> TARGET_PAGE_BITS
);
1912 for(i
= 0; i
< len
; i
++)
1915 /* we modify the TLB cache so that the dirty bit will be set again
1916 when accessing the range */
1917 start1
= (unsigned long)qemu_get_ram_ptr(start
);
1918 /* Chek that we don't span multiple blocks - this breaks the
1919 address comparisons below. */
1920 if ((unsigned long)qemu_get_ram_ptr(end
- 1) - start1
1921 != (end
- 1) - start
) {
1925 for(env
= first_cpu
; env
!= NULL
; env
= env
->next_cpu
) {
1926 for(i
= 0; i
< CPU_TLB_SIZE
; i
++)
1927 tlb_reset_dirty_range(&env
->tlb_table
[0][i
], start1
, length
);
1928 for(i
= 0; i
< CPU_TLB_SIZE
; i
++)
1929 tlb_reset_dirty_range(&env
->tlb_table
[1][i
], start1
, length
);
1930 #if (NB_MMU_MODES >= 3)
1931 for(i
= 0; i
< CPU_TLB_SIZE
; i
++)
1932 tlb_reset_dirty_range(&env
->tlb_table
[2][i
], start1
, length
);
1934 #if (NB_MMU_MODES >= 4)
1935 for(i
= 0; i
< CPU_TLB_SIZE
; i
++)
1936 tlb_reset_dirty_range(&env
->tlb_table
[3][i
], start1
, length
);
1938 #if (NB_MMU_MODES >= 5)
1939 for(i
= 0; i
< CPU_TLB_SIZE
; i
++)
1940 tlb_reset_dirty_range(&env
->tlb_table
[4][i
], start1
, length
);
1945 int cpu_physical_memory_set_dirty_tracking(int enable
)
1947 if (kvm_enabled()) {
1948 return kvm_set_migration_log(enable
);
1953 int cpu_physical_memory_get_dirty_tracking(void)
1955 return in_migration
;
1958 int cpu_physical_sync_dirty_bitmap(target_phys_addr_t start_addr
,
1959 target_phys_addr_t end_addr
)
1964 ret
= kvm_physical_sync_dirty_bitmap(start_addr
, end_addr
);
1968 static inline void tlb_update_dirty(CPUTLBEntry
*tlb_entry
)
1970 ram_addr_t ram_addr
;
1973 if ((tlb_entry
->addr_write
& ~TARGET_PAGE_MASK
) == IO_MEM_RAM
) {
1974 p
= (void *)(unsigned long)((tlb_entry
->addr_write
& TARGET_PAGE_MASK
)
1975 + tlb_entry
->addend
);
1976 ram_addr
= qemu_ram_addr_from_host(p
);
1977 if (!cpu_physical_memory_is_dirty(ram_addr
)) {
1978 tlb_entry
->addr_write
|= TLB_NOTDIRTY
;
1983 /* update the TLB according to the current state of the dirty bits */
1984 void cpu_tlb_update_dirty(CPUState
*env
)
1987 for(i
= 0; i
< CPU_TLB_SIZE
; i
++)
1988 tlb_update_dirty(&env
->tlb_table
[0][i
]);
1989 for(i
= 0; i
< CPU_TLB_SIZE
; i
++)
1990 tlb_update_dirty(&env
->tlb_table
[1][i
]);
1991 #if (NB_MMU_MODES >= 3)
1992 for(i
= 0; i
< CPU_TLB_SIZE
; i
++)
1993 tlb_update_dirty(&env
->tlb_table
[2][i
]);
1995 #if (NB_MMU_MODES >= 4)
1996 for(i
= 0; i
< CPU_TLB_SIZE
; i
++)
1997 tlb_update_dirty(&env
->tlb_table
[3][i
]);
1999 #if (NB_MMU_MODES >= 5)
2000 for(i
= 0; i
< CPU_TLB_SIZE
; i
++)
2001 tlb_update_dirty(&env
->tlb_table
[4][i
]);
2005 static inline void tlb_set_dirty1(CPUTLBEntry
*tlb_entry
, target_ulong vaddr
)
2007 if (tlb_entry
->addr_write
== (vaddr
| TLB_NOTDIRTY
))
2008 tlb_entry
->addr_write
= vaddr
;
2011 /* update the TLB corresponding to virtual page vaddr
2012 so that it is no longer dirty */
2013 static inline void tlb_set_dirty(CPUState
*env
, target_ulong vaddr
)
2017 vaddr
&= TARGET_PAGE_MASK
;
2018 i
= (vaddr
>> TARGET_PAGE_BITS
) & (CPU_TLB_SIZE
- 1);
2019 tlb_set_dirty1(&env
->tlb_table
[0][i
], vaddr
);
2020 tlb_set_dirty1(&env
->tlb_table
[1][i
], vaddr
);
2021 #if (NB_MMU_MODES >= 3)
2022 tlb_set_dirty1(&env
->tlb_table
[2][i
], vaddr
);
2024 #if (NB_MMU_MODES >= 4)
2025 tlb_set_dirty1(&env
->tlb_table
[3][i
], vaddr
);
2027 #if (NB_MMU_MODES >= 5)
2028 tlb_set_dirty1(&env
->tlb_table
[4][i
], vaddr
);
2032 /* add a new TLB entry. At most one entry for a given virtual address
2033 is permitted. Return 0 if OK or 2 if the page could not be mapped
2034 (can only happen in non SOFTMMU mode for I/O pages or pages
2035 conflicting with the host address space). */
2036 int tlb_set_page_exec(CPUState
*env
, target_ulong vaddr
,
2037 target_phys_addr_t paddr
, int prot
,
2038 int mmu_idx
, int is_softmmu
)
2043 target_ulong address
;
2044 target_ulong code_address
;
2045 target_phys_addr_t addend
;
2049 target_phys_addr_t iotlb
;
2051 p
= phys_page_find(paddr
>> TARGET_PAGE_BITS
);
2053 pd
= IO_MEM_UNASSIGNED
;
2055 pd
= p
->phys_offset
;
2057 #if defined(DEBUG_TLB)
2058 printf("tlb_set_page: vaddr=" TARGET_FMT_lx
" paddr=0x%08x prot=%x idx=%d smmu=%d pd=0x%08lx\n",
2059 vaddr
, (int)paddr
, prot
, mmu_idx
, is_softmmu
, pd
);
2064 if ((pd
& ~TARGET_PAGE_MASK
) > IO_MEM_ROM
&& !(pd
& IO_MEM_ROMD
)) {
2065 /* IO memory case (romd handled later) */
2066 address
|= TLB_MMIO
;
2068 addend
= (unsigned long)qemu_get_ram_ptr(pd
& TARGET_PAGE_MASK
);
2069 if ((pd
& ~TARGET_PAGE_MASK
) <= IO_MEM_ROM
) {
2071 iotlb
= pd
& TARGET_PAGE_MASK
;
2072 if ((pd
& ~TARGET_PAGE_MASK
) == IO_MEM_RAM
)
2073 iotlb
|= IO_MEM_NOTDIRTY
;
2075 iotlb
|= IO_MEM_ROM
;
2077 /* IO handlers are currently passed a physical address.
2078 It would be nice to pass an offset from the base address
2079 of that region. This would avoid having to special case RAM,
2080 and avoid full address decoding in every device.
2081 We can't use the high bits of pd for this because
2082 IO_MEM_ROMD uses these as a ram address. */
2083 iotlb
= (pd
& ~TARGET_PAGE_MASK
);
2085 iotlb
+= p
->region_offset
;
2091 code_address
= address
;
2092 /* Make accesses to pages with watchpoints go via the
2093 watchpoint trap routines. */
2094 TAILQ_FOREACH(wp
, &env
->watchpoints
, entry
) {
2095 if (vaddr
== (wp
->vaddr
& TARGET_PAGE_MASK
)) {
2096 iotlb
= io_mem_watch
+ paddr
;
2097 /* TODO: The memory case can be optimized by not trapping
2098 reads of pages with a write breakpoint. */
2099 address
|= TLB_MMIO
;
2103 index
= (vaddr
>> TARGET_PAGE_BITS
) & (CPU_TLB_SIZE
- 1);
2104 env
->iotlb
[mmu_idx
][index
] = iotlb
- vaddr
;
2105 te
= &env
->tlb_table
[mmu_idx
][index
];
2106 te
->addend
= addend
- vaddr
;
2107 if (prot
& PAGE_READ
) {
2108 te
->addr_read
= address
;
2113 if (prot
& PAGE_EXEC
) {
2114 te
->addr_code
= code_address
;
2118 if (prot
& PAGE_WRITE
) {
2119 if ((pd
& ~TARGET_PAGE_MASK
) == IO_MEM_ROM
||
2120 (pd
& IO_MEM_ROMD
)) {
2121 /* Write access calls the I/O callback. */
2122 te
->addr_write
= address
| TLB_MMIO
;
2123 } else if ((pd
& ~TARGET_PAGE_MASK
) == IO_MEM_RAM
&&
2124 !cpu_physical_memory_is_dirty(pd
)) {
2125 te
->addr_write
= address
| TLB_NOTDIRTY
;
2127 te
->addr_write
= address
;
2130 te
->addr_write
= -1;
2137 void tlb_flush(CPUState
*env
, int flush_global
)
2141 void tlb_flush_page(CPUState
*env
, target_ulong addr
)
2145 int tlb_set_page_exec(CPUState
*env
, target_ulong vaddr
,
2146 target_phys_addr_t paddr
, int prot
,
2147 int mmu_idx
, int is_softmmu
)
2152 /* dump memory mappings */
2153 void page_dump(FILE *f
)
2155 unsigned long start
, end
;
2156 int i
, j
, prot
, prot1
;
2159 fprintf(f
, "%-8s %-8s %-8s %s\n",
2160 "start", "end", "size", "prot");
2164 for(i
= 0; i
<= L1_SIZE
; i
++) {
2169 for(j
= 0;j
< L2_SIZE
; j
++) {
2174 if (prot1
!= prot
) {
2175 end
= (i
<< (32 - L1_BITS
)) | (j
<< TARGET_PAGE_BITS
);
2177 fprintf(f
, "%08lx-%08lx %08lx %c%c%c\n",
2178 start
, end
, end
- start
,
2179 prot
& PAGE_READ
? 'r' : '-',
2180 prot
& PAGE_WRITE
? 'w' : '-',
2181 prot
& PAGE_EXEC
? 'x' : '-');
2195 int page_get_flags(target_ulong address
)
2199 p
= page_find(address
>> TARGET_PAGE_BITS
);
2205 /* modify the flags of a page and invalidate the code if
2206 necessary. The flag PAGE_WRITE_ORG is positioned automatically
2207 depending on PAGE_WRITE */
2208 void page_set_flags(target_ulong start
, target_ulong end
, int flags
)
2213 /* mmap_lock should already be held. */
2214 start
= start
& TARGET_PAGE_MASK
;
2215 end
= TARGET_PAGE_ALIGN(end
);
2216 if (flags
& PAGE_WRITE
)
2217 flags
|= PAGE_WRITE_ORG
;
2218 for(addr
= start
; addr
< end
; addr
+= TARGET_PAGE_SIZE
) {
2219 p
= page_find_alloc(addr
>> TARGET_PAGE_BITS
);
2220 /* We may be called for host regions that are outside guest
2224 /* if the write protection is set, then we invalidate the code
2226 if (!(p
->flags
& PAGE_WRITE
) &&
2227 (flags
& PAGE_WRITE
) &&
2229 tb_invalidate_phys_page(addr
, 0, NULL
);
2235 int page_check_range(target_ulong start
, target_ulong len
, int flags
)
2241 if (start
+ len
< start
)
2242 /* we've wrapped around */
2245 end
= TARGET_PAGE_ALIGN(start
+len
); /* must do before we loose bits in the next step */
2246 start
= start
& TARGET_PAGE_MASK
;
2248 for(addr
= start
; addr
< end
; addr
+= TARGET_PAGE_SIZE
) {
2249 p
= page_find(addr
>> TARGET_PAGE_BITS
);
2252 if( !(p
->flags
& PAGE_VALID
) )
2255 if ((flags
& PAGE_READ
) && !(p
->flags
& PAGE_READ
))
2257 if (flags
& PAGE_WRITE
) {
2258 if (!(p
->flags
& PAGE_WRITE_ORG
))
2260 /* unprotect the page if it was put read-only because it
2261 contains translated code */
2262 if (!(p
->flags
& PAGE_WRITE
)) {
2263 if (!page_unprotect(addr
, 0, NULL
))
2272 /* called from signal handler: invalidate the code and unprotect the
2273 page. Return TRUE if the fault was successfully handled. */
2274 int page_unprotect(target_ulong address
, unsigned long pc
, void *puc
)
2276 unsigned int page_index
, prot
, pindex
;
2278 target_ulong host_start
, host_end
, addr
;
2280 /* Technically this isn't safe inside a signal handler. However we
2281 know this only ever happens in a synchronous SEGV handler, so in
2282 practice it seems to be ok. */
2285 host_start
= address
& qemu_host_page_mask
;
2286 page_index
= host_start
>> TARGET_PAGE_BITS
;
2287 p1
= page_find(page_index
);
2292 host_end
= host_start
+ qemu_host_page_size
;
2295 for(addr
= host_start
;addr
< host_end
; addr
+= TARGET_PAGE_SIZE
) {
2299 /* if the page was really writable, then we change its
2300 protection back to writable */
2301 if (prot
& PAGE_WRITE_ORG
) {
2302 pindex
= (address
- host_start
) >> TARGET_PAGE_BITS
;
2303 if (!(p1
[pindex
].flags
& PAGE_WRITE
)) {
2304 mprotect((void *)g2h(host_start
), qemu_host_page_size
,
2305 (prot
& PAGE_BITS
) | PAGE_WRITE
);
2306 p1
[pindex
].flags
|= PAGE_WRITE
;
2307 /* and since the content will be modified, we must invalidate
2308 the corresponding translated code. */
2309 tb_invalidate_phys_page(address
, pc
, puc
);
2310 #ifdef DEBUG_TB_CHECK
2311 tb_invalidate_check(address
);
2321 static inline void tlb_set_dirty(CPUState
*env
,
2322 unsigned long addr
, target_ulong vaddr
)
2325 #endif /* defined(CONFIG_USER_ONLY) */
2327 #if !defined(CONFIG_USER_ONLY)
2329 static int subpage_register (subpage_t
*mmio
, uint32_t start
, uint32_t end
,
2330 ram_addr_t memory
, ram_addr_t region_offset
);
2331 static void *subpage_init (target_phys_addr_t base
, ram_addr_t
*phys
,
2332 ram_addr_t orig_memory
, ram_addr_t region_offset
);
2333 #define CHECK_SUBPAGE(addr, start_addr, start_addr2, end_addr, end_addr2, \
2336 if (addr > start_addr) \
2339 start_addr2 = start_addr & ~TARGET_PAGE_MASK; \
2340 if (start_addr2 > 0) \
2344 if ((start_addr + orig_size) - addr >= TARGET_PAGE_SIZE) \
2345 end_addr2 = TARGET_PAGE_SIZE - 1; \
2347 end_addr2 = (start_addr + orig_size - 1) & ~TARGET_PAGE_MASK; \
2348 if (end_addr2 < TARGET_PAGE_SIZE - 1) \
2353 /* register physical memory. 'size' must be a multiple of the target
2354 page size. If (phys_offset & ~TARGET_PAGE_MASK) != 0, then it is an
2355 io memory page. The address used when calling the IO function is
2356 the offset from the start of the region, plus region_offset. Both
2357 start_addr and region_offset are rounded down to a page boundary
2358 before calculating this offset. This should not be a problem unless
2359 the low bits of start_addr and region_offset differ. */
2360 void cpu_register_physical_memory_offset(target_phys_addr_t start_addr
,
2362 ram_addr_t phys_offset
,
2363 ram_addr_t region_offset
)
2365 target_phys_addr_t addr
, end_addr
;
2368 ram_addr_t orig_size
= size
;
2372 /* XXX: should not depend on cpu context */
2374 if (env
->kqemu_enabled
) {
2375 kqemu_set_phys_mem(start_addr
, size
, phys_offset
);
2379 kvm_set_phys_mem(start_addr
, size
, phys_offset
);
2381 if (phys_offset
== IO_MEM_UNASSIGNED
) {
2382 region_offset
= start_addr
;
2384 region_offset
&= TARGET_PAGE_MASK
;
2385 size
= (size
+ TARGET_PAGE_SIZE
- 1) & TARGET_PAGE_MASK
;
2386 end_addr
= start_addr
+ (target_phys_addr_t
)size
;
2387 for(addr
= start_addr
; addr
!= end_addr
; addr
+= TARGET_PAGE_SIZE
) {
2388 p
= phys_page_find(addr
>> TARGET_PAGE_BITS
);
2389 if (p
&& p
->phys_offset
!= IO_MEM_UNASSIGNED
) {
2390 ram_addr_t orig_memory
= p
->phys_offset
;
2391 target_phys_addr_t start_addr2
, end_addr2
;
2392 int need_subpage
= 0;
2394 CHECK_SUBPAGE(addr
, start_addr
, start_addr2
, end_addr
, end_addr2
,
2396 if (need_subpage
|| phys_offset
& IO_MEM_SUBWIDTH
) {
2397 if (!(orig_memory
& IO_MEM_SUBPAGE
)) {
2398 subpage
= subpage_init((addr
& TARGET_PAGE_MASK
),
2399 &p
->phys_offset
, orig_memory
,
2402 subpage
= io_mem_opaque
[(orig_memory
& ~TARGET_PAGE_MASK
)
2405 subpage_register(subpage
, start_addr2
, end_addr2
, phys_offset
,
2407 p
->region_offset
= 0;
2409 p
->phys_offset
= phys_offset
;
2410 if ((phys_offset
& ~TARGET_PAGE_MASK
) <= IO_MEM_ROM
||
2411 (phys_offset
& IO_MEM_ROMD
))
2412 phys_offset
+= TARGET_PAGE_SIZE
;
2415 p
= phys_page_find_alloc(addr
>> TARGET_PAGE_BITS
, 1);
2416 p
->phys_offset
= phys_offset
;
2417 p
->region_offset
= region_offset
;
2418 if ((phys_offset
& ~TARGET_PAGE_MASK
) <= IO_MEM_ROM
||
2419 (phys_offset
& IO_MEM_ROMD
)) {
2420 phys_offset
+= TARGET_PAGE_SIZE
;
2422 target_phys_addr_t start_addr2
, end_addr2
;
2423 int need_subpage
= 0;
2425 CHECK_SUBPAGE(addr
, start_addr
, start_addr2
, end_addr
,
2426 end_addr2
, need_subpage
);
2428 if (need_subpage
|| phys_offset
& IO_MEM_SUBWIDTH
) {
2429 subpage
= subpage_init((addr
& TARGET_PAGE_MASK
),
2430 &p
->phys_offset
, IO_MEM_UNASSIGNED
,
2431 addr
& TARGET_PAGE_MASK
);
2432 subpage_register(subpage
, start_addr2
, end_addr2
,
2433 phys_offset
, region_offset
);
2434 p
->region_offset
= 0;
2438 region_offset
+= TARGET_PAGE_SIZE
;
2441 /* since each CPU stores ram addresses in its TLB cache, we must
2442 reset the modified entries */
2444 for(env
= first_cpu
; env
!= NULL
; env
= env
->next_cpu
) {
2449 /* XXX: temporary until new memory mapping API */
2450 ram_addr_t
cpu_get_physical_page_desc(target_phys_addr_t addr
)
2454 p
= phys_page_find(addr
>> TARGET_PAGE_BITS
);
2456 return IO_MEM_UNASSIGNED
;
2457 return p
->phys_offset
;
2460 void qemu_register_coalesced_mmio(target_phys_addr_t addr
, ram_addr_t size
)
2463 kvm_coalesce_mmio_region(addr
, size
);
2466 void qemu_unregister_coalesced_mmio(target_phys_addr_t addr
, ram_addr_t size
)
2469 kvm_uncoalesce_mmio_region(addr
, size
);
2473 /* XXX: better than nothing */
2474 static ram_addr_t
kqemu_ram_alloc(ram_addr_t size
)
2477 if ((last_ram_offset
+ size
) > kqemu_phys_ram_size
) {
2478 fprintf(stderr
, "Not enough memory (requested_size = %" PRIu64
", max memory = %" PRIu64
")\n",
2479 (uint64_t)size
, (uint64_t)kqemu_phys_ram_size
);
2482 addr
= last_ram_offset
;
2483 last_ram_offset
= TARGET_PAGE_ALIGN(last_ram_offset
+ size
);
2490 #include <sys/vfs.h>
2492 #define HUGETLBFS_MAGIC 0x958458f6
2494 static long gethugepagesize(const char *path
)
2500 ret
= statfs(path
, &fs
);
2501 } while (ret
!= 0 && errno
== EINTR
);
2508 if (fs
.f_type
!= HUGETLBFS_MAGIC
)
2509 fprintf(stderr
, "Warning: path not on HugeTLBFS: %s\n", path
);
2514 static void *file_ram_alloc(ram_addr_t memory
, const char *path
)
2522 unsigned long hpagesize
;
2523 extern int mem_prealloc
;
2529 hpagesize
= gethugepagesize(path
);
2534 if (memory
< hpagesize
) {
2538 if (kvm_enabled() && !kvm_has_sync_mmu()) {
2539 fprintf(stderr
, "host lacks mmu notifiers, disabling --mem-path\n");
2543 if (asprintf(&filename
, "%s/kvm.XXXXXX", path
) == -1) {
2547 fd
= mkstemp(filename
);
2556 memory
= (memory
+hpagesize
-1) & ~(hpagesize
-1);
2559 * ftruncate is not supported by hugetlbfs in older
2560 * hosts, so don't bother checking for errors.
2561 * If anything goes wrong with it under other filesystems,
2564 ftruncate(fd
, memory
);
2567 /* NB: MAP_POPULATE won't exhaustively alloc all phys pages in the case
2568 * MAP_PRIVATE is requested. For mem_prealloc we mmap as MAP_SHARED
2569 * to sidestep this quirk.
2571 flags
= mem_prealloc
? MAP_POPULATE
|MAP_SHARED
: MAP_PRIVATE
;
2572 area
= mmap(0, memory
, PROT_READ
|PROT_WRITE
, flags
, fd
, 0);
2574 area
= mmap(0, memory
, PROT_READ
|PROT_WRITE
, MAP_PRIVATE
, fd
, 0);
2576 if (area
== MAP_FAILED
) {
2577 perror("alloc_mem_area: can't mmap hugetlbfs pages");
2586 static void *file_ram_alloc(ram_addr_t memory
, const char *path
)
2593 extern const char *mem_path
;
2595 ram_addr_t
qemu_ram_alloc(ram_addr_t size
)
2597 RAMBlock
*new_block
;
2600 if (kqemu_phys_ram_base
) {
2601 return kqemu_ram_alloc(size
);
2605 size
= TARGET_PAGE_ALIGN(size
);
2606 new_block
= qemu_malloc(sizeof(*new_block
));
2608 new_block
->host
= file_ram_alloc(size
, mem_path
);
2609 if (!new_block
->host
) {
2610 new_block
->host
= qemu_vmalloc(size
);
2612 new_block
->offset
= last_ram_offset
;
2613 new_block
->length
= size
;
2615 new_block
->next
= ram_blocks
;
2616 ram_blocks
= new_block
;
2618 phys_ram_dirty
= qemu_realloc(phys_ram_dirty
,
2619 (last_ram_offset
+ size
) >> TARGET_PAGE_BITS
);
2620 memset(phys_ram_dirty
+ (last_ram_offset
>> TARGET_PAGE_BITS
),
2621 0xff, size
>> TARGET_PAGE_BITS
);
2623 last_ram_offset
+= size
;
2626 kvm_setup_guest_memory(new_block
->host
, size
);
2628 return new_block
->offset
;
2631 void qemu_ram_free(ram_addr_t addr
)
2633 /* TODO: implement this. */
2636 /* Return a host pointer to ram allocated with qemu_ram_alloc.
2637 With the exception of the softmmu code in this file, this should
2638 only be used for local memory (e.g. video ram) that the device owns,
2639 and knows it isn't going to access beyond the end of the block.
2641 It should not be used for general purpose DMA.
2642 Use cpu_physical_memory_map/cpu_physical_memory_rw instead.
2644 void *qemu_get_ram_ptr(ram_addr_t addr
)
2651 if (kqemu_phys_ram_base
) {
2652 return kqemu_phys_ram_base
+ addr
;
2657 prevp
= &ram_blocks
;
2659 while (block
&& (block
->offset
> addr
2660 || block
->offset
+ block
->length
<= addr
)) {
2662 prevp
= &prev
->next
;
2664 block
= block
->next
;
2667 fprintf(stderr
, "Bad ram offset %" PRIx64
"\n", (uint64_t)addr
);
2670 /* Move this entry to to start of the list. */
2672 prev
->next
= block
->next
;
2673 block
->next
= *prevp
;
2676 return block
->host
+ (addr
- block
->offset
);
2679 /* Some of the softmmu routines need to translate from a host pointer
2680 (typically a TLB entry) back to a ram offset. */
2681 ram_addr_t
qemu_ram_addr_from_host(void *ptr
)
2686 uint8_t *host
= ptr
;
2689 if (kqemu_phys_ram_base
) {
2690 return host
- kqemu_phys_ram_base
;
2695 prevp
= &ram_blocks
;
2697 while (block
&& (block
->host
> host
2698 || block
->host
+ block
->length
<= host
)) {
2700 prevp
= &prev
->next
;
2702 block
= block
->next
;
2705 fprintf(stderr
, "Bad ram pointer %p\n", ptr
);
2708 return block
->offset
+ (host
- block
->host
);
2711 static uint32_t unassigned_mem_readb(void *opaque
, target_phys_addr_t addr
)
2713 #ifdef DEBUG_UNASSIGNED
2714 printf("Unassigned mem read " TARGET_FMT_plx
"\n", addr
);
2716 #if defined(TARGET_SPARC)
2717 do_unassigned_access(addr
, 0, 0, 0, 1);
2722 static uint32_t unassigned_mem_readw(void *opaque
, target_phys_addr_t addr
)
2724 #ifdef DEBUG_UNASSIGNED
2725 printf("Unassigned mem read " TARGET_FMT_plx
"\n", addr
);
2727 #if defined(TARGET_SPARC)
2728 do_unassigned_access(addr
, 0, 0, 0, 2);
2733 static uint32_t unassigned_mem_readl(void *opaque
, target_phys_addr_t addr
)
2735 #ifdef DEBUG_UNASSIGNED
2736 printf("Unassigned mem read " TARGET_FMT_plx
"\n", addr
);
2738 #if defined(TARGET_SPARC)
2739 do_unassigned_access(addr
, 0, 0, 0, 4);
2744 static void unassigned_mem_writeb(void *opaque
, target_phys_addr_t addr
, uint32_t val
)
2746 #ifdef DEBUG_UNASSIGNED
2747 printf("Unassigned mem write " TARGET_FMT_plx
" = 0x%x\n", addr
, val
);
2749 #if defined(TARGET_SPARC)
2750 do_unassigned_access(addr
, 1, 0, 0, 1);
2754 static void unassigned_mem_writew(void *opaque
, target_phys_addr_t addr
, uint32_t val
)
2756 #ifdef DEBUG_UNASSIGNED
2757 printf("Unassigned mem write " TARGET_FMT_plx
" = 0x%x\n", addr
, val
);
2759 #if defined(TARGET_SPARC)
2760 do_unassigned_access(addr
, 1, 0, 0, 2);
2764 static void unassigned_mem_writel(void *opaque
, target_phys_addr_t addr
, uint32_t val
)
2766 #ifdef DEBUG_UNASSIGNED
2767 printf("Unassigned mem write " TARGET_FMT_plx
" = 0x%x\n", addr
, val
);
2769 #if defined(TARGET_SPARC)
2770 do_unassigned_access(addr
, 1, 0, 0, 4);
2774 static CPUReadMemoryFunc
*unassigned_mem_read
[3] = {
2775 unassigned_mem_readb
,
2776 unassigned_mem_readw
,
2777 unassigned_mem_readl
,
2780 static CPUWriteMemoryFunc
*unassigned_mem_write
[3] = {
2781 unassigned_mem_writeb
,
2782 unassigned_mem_writew
,
2783 unassigned_mem_writel
,
2786 static void notdirty_mem_writeb(void *opaque
, target_phys_addr_t ram_addr
,
2790 dirty_flags
= phys_ram_dirty
[ram_addr
>> TARGET_PAGE_BITS
];
2791 if (!(dirty_flags
& CODE_DIRTY_FLAG
)) {
2792 #if !defined(CONFIG_USER_ONLY)
2793 tb_invalidate_phys_page_fast(ram_addr
, 1);
2794 dirty_flags
= phys_ram_dirty
[ram_addr
>> TARGET_PAGE_BITS
];
2797 stb_p(qemu_get_ram_ptr(ram_addr
), val
);
2799 if (cpu_single_env
->kqemu_enabled
&&
2800 (dirty_flags
& KQEMU_MODIFY_PAGE_MASK
) != KQEMU_MODIFY_PAGE_MASK
)
2801 kqemu_modify_page(cpu_single_env
, ram_addr
);
2803 dirty_flags
|= (0xff & ~CODE_DIRTY_FLAG
);
2804 phys_ram_dirty
[ram_addr
>> TARGET_PAGE_BITS
] = dirty_flags
;
2805 /* we remove the notdirty callback only if the code has been
2807 if (dirty_flags
== 0xff)
2808 tlb_set_dirty(cpu_single_env
, cpu_single_env
->mem_io_vaddr
);
2811 static void notdirty_mem_writew(void *opaque
, target_phys_addr_t ram_addr
,
2815 dirty_flags
= phys_ram_dirty
[ram_addr
>> TARGET_PAGE_BITS
];
2816 if (!(dirty_flags
& CODE_DIRTY_FLAG
)) {
2817 #if !defined(CONFIG_USER_ONLY)
2818 tb_invalidate_phys_page_fast(ram_addr
, 2);
2819 dirty_flags
= phys_ram_dirty
[ram_addr
>> TARGET_PAGE_BITS
];
2822 stw_p(qemu_get_ram_ptr(ram_addr
), val
);
2824 if (cpu_single_env
->kqemu_enabled
&&
2825 (dirty_flags
& KQEMU_MODIFY_PAGE_MASK
) != KQEMU_MODIFY_PAGE_MASK
)
2826 kqemu_modify_page(cpu_single_env
, ram_addr
);
2828 dirty_flags
|= (0xff & ~CODE_DIRTY_FLAG
);
2829 phys_ram_dirty
[ram_addr
>> TARGET_PAGE_BITS
] = dirty_flags
;
2830 /* we remove the notdirty callback only if the code has been
2832 if (dirty_flags
== 0xff)
2833 tlb_set_dirty(cpu_single_env
, cpu_single_env
->mem_io_vaddr
);
2836 static void notdirty_mem_writel(void *opaque
, target_phys_addr_t ram_addr
,
2840 dirty_flags
= phys_ram_dirty
[ram_addr
>> TARGET_PAGE_BITS
];
2841 if (!(dirty_flags
& CODE_DIRTY_FLAG
)) {
2842 #if !defined(CONFIG_USER_ONLY)
2843 tb_invalidate_phys_page_fast(ram_addr
, 4);
2844 dirty_flags
= phys_ram_dirty
[ram_addr
>> TARGET_PAGE_BITS
];
2847 stl_p(qemu_get_ram_ptr(ram_addr
), val
);
2849 if (cpu_single_env
->kqemu_enabled
&&
2850 (dirty_flags
& KQEMU_MODIFY_PAGE_MASK
) != KQEMU_MODIFY_PAGE_MASK
)
2851 kqemu_modify_page(cpu_single_env
, ram_addr
);
2853 dirty_flags
|= (0xff & ~CODE_DIRTY_FLAG
);
2854 phys_ram_dirty
[ram_addr
>> TARGET_PAGE_BITS
] = dirty_flags
;
2855 /* we remove the notdirty callback only if the code has been
2857 if (dirty_flags
== 0xff)
2858 tlb_set_dirty(cpu_single_env
, cpu_single_env
->mem_io_vaddr
);
2861 static CPUReadMemoryFunc
*error_mem_read
[3] = {
2862 NULL
, /* never used */
2863 NULL
, /* never used */
2864 NULL
, /* never used */
2867 static CPUWriteMemoryFunc
*notdirty_mem_write
[3] = {
2868 notdirty_mem_writeb
,
2869 notdirty_mem_writew
,
2870 notdirty_mem_writel
,
2873 /* Generate a debug exception if a watchpoint has been hit. */
2874 static void check_watchpoint(int offset
, int len_mask
, int flags
)
2876 CPUState
*env
= cpu_single_env
;
2877 target_ulong pc
, cs_base
;
2878 TranslationBlock
*tb
;
2883 if (env
->watchpoint_hit
) {
2884 /* We re-entered the check after replacing the TB. Now raise
2885 * the debug interrupt so that is will trigger after the
2886 * current instruction. */
2887 cpu_interrupt(env
, CPU_INTERRUPT_DEBUG
);
2890 vaddr
= (env
->mem_io_vaddr
& TARGET_PAGE_MASK
) + offset
;
2891 TAILQ_FOREACH(wp
, &env
->watchpoints
, entry
) {
2892 if ((vaddr
== (wp
->vaddr
& len_mask
) ||
2893 (vaddr
& wp
->len_mask
) == wp
->vaddr
) && (wp
->flags
& flags
)) {
2894 wp
->flags
|= BP_WATCHPOINT_HIT
;
2895 if (!env
->watchpoint_hit
) {
2896 env
->watchpoint_hit
= wp
;
2897 tb
= tb_find_pc(env
->mem_io_pc
);
2899 cpu_abort(env
, "check_watchpoint: could not find TB for "
2900 "pc=%p", (void *)env
->mem_io_pc
);
2902 cpu_restore_state(tb
, env
, env
->mem_io_pc
, NULL
);
2903 tb_phys_invalidate(tb
, -1);
2904 if (wp
->flags
& BP_STOP_BEFORE_ACCESS
) {
2905 env
->exception_index
= EXCP_DEBUG
;
2907 cpu_get_tb_cpu_state(env
, &pc
, &cs_base
, &cpu_flags
);
2908 tb_gen_code(env
, pc
, cs_base
, cpu_flags
, 1);
2910 cpu_resume_from_signal(env
, NULL
);
2913 wp
->flags
&= ~BP_WATCHPOINT_HIT
;
2918 /* Watchpoint access routines. Watchpoints are inserted using TLB tricks,
2919 so these check for a hit then pass through to the normal out-of-line
2921 static uint32_t watch_mem_readb(void *opaque
, target_phys_addr_t addr
)
2923 check_watchpoint(addr
& ~TARGET_PAGE_MASK
, ~0x0, BP_MEM_READ
);
2924 return ldub_phys(addr
);
2927 static uint32_t watch_mem_readw(void *opaque
, target_phys_addr_t addr
)
2929 check_watchpoint(addr
& ~TARGET_PAGE_MASK
, ~0x1, BP_MEM_READ
);
2930 return lduw_phys(addr
);
2933 static uint32_t watch_mem_readl(void *opaque
, target_phys_addr_t addr
)
2935 check_watchpoint(addr
& ~TARGET_PAGE_MASK
, ~0x3, BP_MEM_READ
);
2936 return ldl_phys(addr
);
2939 static void watch_mem_writeb(void *opaque
, target_phys_addr_t addr
,
2942 check_watchpoint(addr
& ~TARGET_PAGE_MASK
, ~0x0, BP_MEM_WRITE
);
2943 stb_phys(addr
, val
);
2946 static void watch_mem_writew(void *opaque
, target_phys_addr_t addr
,
2949 check_watchpoint(addr
& ~TARGET_PAGE_MASK
, ~0x1, BP_MEM_WRITE
);
2950 stw_phys(addr
, val
);
2953 static void watch_mem_writel(void *opaque
, target_phys_addr_t addr
,
2956 check_watchpoint(addr
& ~TARGET_PAGE_MASK
, ~0x3, BP_MEM_WRITE
);
2957 stl_phys(addr
, val
);
2960 static CPUReadMemoryFunc
*watch_mem_read
[3] = {
2966 static CPUWriteMemoryFunc
*watch_mem_write
[3] = {
2972 static inline uint32_t subpage_readlen (subpage_t
*mmio
, target_phys_addr_t addr
,
2978 idx
= SUBPAGE_IDX(addr
);
2979 #if defined(DEBUG_SUBPAGE)
2980 printf("%s: subpage %p len %d addr " TARGET_FMT_plx
" idx %d\n", __func__
,
2981 mmio
, len
, addr
, idx
);
2983 ret
= (**mmio
->mem_read
[idx
][len
])(mmio
->opaque
[idx
][0][len
],
2984 addr
+ mmio
->region_offset
[idx
][0][len
]);
2989 static inline void subpage_writelen (subpage_t
*mmio
, target_phys_addr_t addr
,
2990 uint32_t value
, unsigned int len
)
2994 idx
= SUBPAGE_IDX(addr
);
2995 #if defined(DEBUG_SUBPAGE)
2996 printf("%s: subpage %p len %d addr " TARGET_FMT_plx
" idx %d value %08x\n", __func__
,
2997 mmio
, len
, addr
, idx
, value
);
2999 (**mmio
->mem_write
[idx
][len
])(mmio
->opaque
[idx
][1][len
],
3000 addr
+ mmio
->region_offset
[idx
][1][len
],
3004 static uint32_t subpage_readb (void *opaque
, target_phys_addr_t addr
)
3006 #if defined(DEBUG_SUBPAGE)
3007 printf("%s: addr " TARGET_FMT_plx
"\n", __func__
, addr
);
3010 return subpage_readlen(opaque
, addr
, 0);
3013 static void subpage_writeb (void *opaque
, target_phys_addr_t addr
,
3016 #if defined(DEBUG_SUBPAGE)
3017 printf("%s: addr " TARGET_FMT_plx
" val %08x\n", __func__
, addr
, value
);
3019 subpage_writelen(opaque
, addr
, value
, 0);
3022 static uint32_t subpage_readw (void *opaque
, target_phys_addr_t addr
)
3024 #if defined(DEBUG_SUBPAGE)
3025 printf("%s: addr " TARGET_FMT_plx
"\n", __func__
, addr
);
3028 return subpage_readlen(opaque
, addr
, 1);
3031 static void subpage_writew (void *opaque
, target_phys_addr_t addr
,
3034 #if defined(DEBUG_SUBPAGE)
3035 printf("%s: addr " TARGET_FMT_plx
" val %08x\n", __func__
, addr
, value
);
3037 subpage_writelen(opaque
, addr
, value
, 1);
3040 static uint32_t subpage_readl (void *opaque
, target_phys_addr_t addr
)
3042 #if defined(DEBUG_SUBPAGE)
3043 printf("%s: addr " TARGET_FMT_plx
"\n", __func__
, addr
);
3046 return subpage_readlen(opaque
, addr
, 2);
3049 static void subpage_writel (void *opaque
,
3050 target_phys_addr_t addr
, uint32_t value
)
3052 #if defined(DEBUG_SUBPAGE)
3053 printf("%s: addr " TARGET_FMT_plx
" val %08x\n", __func__
, addr
, value
);
3055 subpage_writelen(opaque
, addr
, value
, 2);
3058 static CPUReadMemoryFunc
*subpage_read
[] = {
3064 static CPUWriteMemoryFunc
*subpage_write
[] = {
3070 static int subpage_register (subpage_t
*mmio
, uint32_t start
, uint32_t end
,
3071 ram_addr_t memory
, ram_addr_t region_offset
)
3076 if (start
>= TARGET_PAGE_SIZE
|| end
>= TARGET_PAGE_SIZE
)
3078 idx
= SUBPAGE_IDX(start
);
3079 eidx
= SUBPAGE_IDX(end
);
3080 #if defined(DEBUG_SUBPAGE)
3081 printf("%s: %p start %08x end %08x idx %08x eidx %08x mem %d\n", __func__
,
3082 mmio
, start
, end
, idx
, eidx
, memory
);
3084 memory
>>= IO_MEM_SHIFT
;
3085 for (; idx
<= eidx
; idx
++) {
3086 for (i
= 0; i
< 4; i
++) {
3087 if (io_mem_read
[memory
][i
]) {
3088 mmio
->mem_read
[idx
][i
] = &io_mem_read
[memory
][i
];
3089 mmio
->opaque
[idx
][0][i
] = io_mem_opaque
[memory
];
3090 mmio
->region_offset
[idx
][0][i
] = region_offset
;
3092 if (io_mem_write
[memory
][i
]) {
3093 mmio
->mem_write
[idx
][i
] = &io_mem_write
[memory
][i
];
3094 mmio
->opaque
[idx
][1][i
] = io_mem_opaque
[memory
];
3095 mmio
->region_offset
[idx
][1][i
] = region_offset
;
3103 static void *subpage_init (target_phys_addr_t base
, ram_addr_t
*phys
,
3104 ram_addr_t orig_memory
, ram_addr_t region_offset
)
3109 mmio
= qemu_mallocz(sizeof(subpage_t
));
3112 subpage_memory
= cpu_register_io_memory(0, subpage_read
, subpage_write
, mmio
);
3113 #if defined(DEBUG_SUBPAGE)
3114 printf("%s: %p base " TARGET_FMT_plx
" len %08x %d\n", __func__
,
3115 mmio
, base
, TARGET_PAGE_SIZE
, subpage_memory
);
3117 *phys
= subpage_memory
| IO_MEM_SUBPAGE
;
3118 subpage_register(mmio
, 0, TARGET_PAGE_SIZE
- 1, orig_memory
,
3124 static int get_free_io_mem_idx(void)
3128 for (i
= 0; i
<IO_MEM_NB_ENTRIES
; i
++)
3129 if (!io_mem_used
[i
]) {
3137 static void io_mem_init(void)
3141 cpu_register_io_memory(IO_MEM_ROM
>> IO_MEM_SHIFT
, error_mem_read
, unassigned_mem_write
, NULL
);
3142 cpu_register_io_memory(IO_MEM_UNASSIGNED
>> IO_MEM_SHIFT
, unassigned_mem_read
, unassigned_mem_write
, NULL
);
3143 cpu_register_io_memory(IO_MEM_NOTDIRTY
>> IO_MEM_SHIFT
, error_mem_read
, notdirty_mem_write
, NULL
);
3147 io_mem_watch
= cpu_register_io_memory(0, watch_mem_read
,
3148 watch_mem_write
, NULL
);
3150 if (kqemu_phys_ram_base
) {
3151 /* alloc dirty bits array */
3152 phys_ram_dirty
= qemu_vmalloc(kqemu_phys_ram_size
>> TARGET_PAGE_BITS
);
3153 memset(phys_ram_dirty
, 0xff, kqemu_phys_ram_size
>> TARGET_PAGE_BITS
);
3158 /* mem_read and mem_write are arrays of functions containing the
3159 function to access byte (index 0), word (index 1) and dword (index
3160 2). Functions can be omitted with a NULL function pointer.
3161 If io_index is non zero, the corresponding io zone is
3162 modified. If it is zero, a new io zone is allocated. The return
3163 value can be used with cpu_register_physical_memory(). (-1) is
3164 returned if error. */
3165 int cpu_register_io_memory(int io_index
,
3166 CPUReadMemoryFunc
**mem_read
,
3167 CPUWriteMemoryFunc
**mem_write
,
3170 int i
, subwidth
= 0;
3172 if (io_index
<= 0) {
3173 io_index
= get_free_io_mem_idx();
3177 if (io_index
>= IO_MEM_NB_ENTRIES
)
3181 for(i
= 0;i
< 3; i
++) {
3182 if (!mem_read
[i
] || !mem_write
[i
])
3183 subwidth
= IO_MEM_SUBWIDTH
;
3184 io_mem_read
[io_index
][i
] = mem_read
[i
];
3185 io_mem_write
[io_index
][i
] = mem_write
[i
];
3187 io_mem_opaque
[io_index
] = opaque
;
3188 return (io_index
<< IO_MEM_SHIFT
) | subwidth
;
3191 void cpu_unregister_io_memory(int io_table_address
)
3194 int io_index
= io_table_address
>> IO_MEM_SHIFT
;
3196 for (i
=0;i
< 3; i
++) {
3197 io_mem_read
[io_index
][i
] = unassigned_mem_read
[i
];
3198 io_mem_write
[io_index
][i
] = unassigned_mem_write
[i
];
3200 io_mem_opaque
[io_index
] = NULL
;
3201 io_mem_used
[io_index
] = 0;
3204 #endif /* !defined(CONFIG_USER_ONLY) */
3206 /* physical memory access (slow version, mainly for debug) */
3207 #if defined(CONFIG_USER_ONLY)
3208 void cpu_physical_memory_rw(target_phys_addr_t addr
, uint8_t *buf
,
3209 int len
, int is_write
)
3216 page
= addr
& TARGET_PAGE_MASK
;
3217 l
= (page
+ TARGET_PAGE_SIZE
) - addr
;
3220 flags
= page_get_flags(page
);
3221 if (!(flags
& PAGE_VALID
))
3224 if (!(flags
& PAGE_WRITE
))
3226 /* XXX: this code should not depend on lock_user */
3227 if (!(p
= lock_user(VERIFY_WRITE
, addr
, l
, 0)))
3228 /* FIXME - should this return an error rather than just fail? */
3231 unlock_user(p
, addr
, l
);
3233 if (!(flags
& PAGE_READ
))
3235 /* XXX: this code should not depend on lock_user */
3236 if (!(p
= lock_user(VERIFY_READ
, addr
, l
, 1)))
3237 /* FIXME - should this return an error rather than just fail? */
3240 unlock_user(p
, addr
, 0);
3249 void cpu_physical_memory_rw(target_phys_addr_t addr
, uint8_t *buf
,
3250 int len
, int is_write
)
3255 target_phys_addr_t page
;
3260 page
= addr
& TARGET_PAGE_MASK
;
3261 l
= (page
+ TARGET_PAGE_SIZE
) - addr
;
3264 p
= phys_page_find(page
>> TARGET_PAGE_BITS
);
3266 pd
= IO_MEM_UNASSIGNED
;
3268 pd
= p
->phys_offset
;
3272 if ((pd
& ~TARGET_PAGE_MASK
) != IO_MEM_RAM
) {
3273 target_phys_addr_t addr1
= addr
;
3274 io_index
= (pd
>> IO_MEM_SHIFT
) & (IO_MEM_NB_ENTRIES
- 1);
3276 addr1
= (addr
& ~TARGET_PAGE_MASK
) + p
->region_offset
;
3277 /* XXX: could force cpu_single_env to NULL to avoid
3279 if (l
>= 4 && ((addr1
& 3) == 0)) {
3280 /* 32 bit write access */
3282 io_mem_write
[io_index
][2](io_mem_opaque
[io_index
], addr1
, val
);
3284 } else if (l
>= 2 && ((addr1
& 1) == 0)) {
3285 /* 16 bit write access */
3287 io_mem_write
[io_index
][1](io_mem_opaque
[io_index
], addr1
, val
);
3290 /* 8 bit write access */
3292 io_mem_write
[io_index
][0](io_mem_opaque
[io_index
], addr1
, val
);
3296 unsigned long addr1
;
3297 addr1
= (pd
& TARGET_PAGE_MASK
) + (addr
& ~TARGET_PAGE_MASK
);
3299 ptr
= qemu_get_ram_ptr(addr1
);
3300 memcpy(ptr
, buf
, l
);
3301 if (!cpu_physical_memory_is_dirty(addr1
)) {
3302 /* invalidate code */
3303 tb_invalidate_phys_page_range(addr1
, addr1
+ l
, 0);
3305 phys_ram_dirty
[addr1
>> TARGET_PAGE_BITS
] |=
3306 (0xff & ~CODE_DIRTY_FLAG
);
3308 /* qemu doesn't execute guest code directly, but kvm does
3309 therefore flush instruction caches */
3311 flush_icache_range((unsigned long)ptr
,
3312 ((unsigned long)ptr
)+l
);
3315 if ((pd
& ~TARGET_PAGE_MASK
) > IO_MEM_ROM
&&
3316 !(pd
& IO_MEM_ROMD
)) {
3317 target_phys_addr_t addr1
= addr
;
3319 io_index
= (pd
>> IO_MEM_SHIFT
) & (IO_MEM_NB_ENTRIES
- 1);
3321 addr1
= (addr
& ~TARGET_PAGE_MASK
) + p
->region_offset
;
3322 if (l
>= 4 && ((addr1
& 3) == 0)) {
3323 /* 32 bit read access */
3324 val
= io_mem_read
[io_index
][2](io_mem_opaque
[io_index
], addr1
);
3327 } else if (l
>= 2 && ((addr1
& 1) == 0)) {
3328 /* 16 bit read access */
3329 val
= io_mem_read
[io_index
][1](io_mem_opaque
[io_index
], addr1
);
3333 /* 8 bit read access */
3334 val
= io_mem_read
[io_index
][0](io_mem_opaque
[io_index
], addr1
);
3340 ptr
= qemu_get_ram_ptr(pd
& TARGET_PAGE_MASK
) +
3341 (addr
& ~TARGET_PAGE_MASK
);
3342 memcpy(buf
, ptr
, l
);
3351 /* used for ROM loading : can write in RAM and ROM */
3352 void cpu_physical_memory_write_rom(target_phys_addr_t addr
,
3353 const uint8_t *buf
, int len
)
3357 target_phys_addr_t page
;
3362 page
= addr
& TARGET_PAGE_MASK
;
3363 l
= (page
+ TARGET_PAGE_SIZE
) - addr
;
3366 p
= phys_page_find(page
>> TARGET_PAGE_BITS
);
3368 pd
= IO_MEM_UNASSIGNED
;
3370 pd
= p
->phys_offset
;
3373 if ((pd
& ~TARGET_PAGE_MASK
) != IO_MEM_RAM
&&
3374 (pd
& ~TARGET_PAGE_MASK
) != IO_MEM_ROM
&&
3375 !(pd
& IO_MEM_ROMD
)) {
3378 unsigned long addr1
;
3379 addr1
= (pd
& TARGET_PAGE_MASK
) + (addr
& ~TARGET_PAGE_MASK
);
3381 ptr
= qemu_get_ram_ptr(addr1
);
3382 memcpy(ptr
, buf
, l
);
3392 target_phys_addr_t addr
;
3393 target_phys_addr_t len
;
3396 static BounceBuffer bounce
;
3398 typedef struct MapClient
{
3400 void (*callback
)(void *opaque
);
3401 LIST_ENTRY(MapClient
) link
;
3404 static LIST_HEAD(map_client_list
, MapClient
) map_client_list
3405 = LIST_HEAD_INITIALIZER(map_client_list
);
3407 void *cpu_register_map_client(void *opaque
, void (*callback
)(void *opaque
))
3409 MapClient
*client
= qemu_malloc(sizeof(*client
));
3411 client
->opaque
= opaque
;
3412 client
->callback
= callback
;
3413 LIST_INSERT_HEAD(&map_client_list
, client
, link
);
3417 void cpu_unregister_map_client(void *_client
)
3419 MapClient
*client
= (MapClient
*)_client
;
3421 LIST_REMOVE(client
, link
);
3424 static void cpu_notify_map_clients(void)
3428 while (!LIST_EMPTY(&map_client_list
)) {
3429 client
= LIST_FIRST(&map_client_list
);
3430 client
->callback(client
->opaque
);
3431 LIST_REMOVE(client
, link
);
3435 /* Map a physical memory region into a host virtual address.
3436 * May map a subset of the requested range, given by and returned in *plen.
3437 * May return NULL if resources needed to perform the mapping are exhausted.
3438 * Use only for reads OR writes - not for read-modify-write operations.
3439 * Use cpu_register_map_client() to know when retrying the map operation is
3440 * likely to succeed.
3442 void *cpu_physical_memory_map(target_phys_addr_t addr
,
3443 target_phys_addr_t
*plen
,
3446 target_phys_addr_t len
= *plen
;
3447 target_phys_addr_t done
= 0;
3449 uint8_t *ret
= NULL
;
3451 target_phys_addr_t page
;
3454 unsigned long addr1
;
3457 page
= addr
& TARGET_PAGE_MASK
;
3458 l
= (page
+ TARGET_PAGE_SIZE
) - addr
;
3461 p
= phys_page_find(page
>> TARGET_PAGE_BITS
);
3463 pd
= IO_MEM_UNASSIGNED
;
3465 pd
= p
->phys_offset
;
3468 if ((pd
& ~TARGET_PAGE_MASK
) != IO_MEM_RAM
) {
3469 if (done
|| bounce
.buffer
) {
3472 bounce
.buffer
= qemu_memalign(TARGET_PAGE_SIZE
, TARGET_PAGE_SIZE
);
3476 cpu_physical_memory_rw(addr
, bounce
.buffer
, l
, 0);
3478 ptr
= bounce
.buffer
;
3480 addr1
= (pd
& TARGET_PAGE_MASK
) + (addr
& ~TARGET_PAGE_MASK
);
3481 ptr
= qemu_get_ram_ptr(addr1
);
3485 } else if (ret
+ done
!= ptr
) {
3497 /* Unmaps a memory region previously mapped by cpu_physical_memory_map().
3498 * Will also mark the memory as dirty if is_write == 1. access_len gives
3499 * the amount of memory that was actually read or written by the caller.
3501 void cpu_physical_memory_unmap(void *buffer
, target_phys_addr_t len
,
3502 int is_write
, target_phys_addr_t access_len
)
3504 unsigned long flush_len
= (unsigned long)access_len
;
3506 if (buffer
!= bounce
.buffer
) {
3508 ram_addr_t addr1
= qemu_ram_addr_from_host(buffer
);
3509 while (access_len
) {
3511 l
= TARGET_PAGE_SIZE
;
3514 if (!cpu_physical_memory_is_dirty(addr1
)) {
3515 /* invalidate code */
3516 tb_invalidate_phys_page_range(addr1
, addr1
+ l
, 0);
3518 phys_ram_dirty
[addr1
>> TARGET_PAGE_BITS
] |=
3519 (0xff & ~CODE_DIRTY_FLAG
);
3524 dma_flush_range((unsigned long)buffer
,
3525 (unsigned long)buffer
+ flush_len
);
3530 cpu_physical_memory_write(bounce
.addr
, bounce
.buffer
, access_len
);
3532 qemu_free(bounce
.buffer
);
3533 bounce
.buffer
= NULL
;
3534 cpu_notify_map_clients();
3537 /* warning: addr must be aligned */
3538 uint32_t ldl_phys(target_phys_addr_t addr
)
3546 p
= phys_page_find(addr
>> TARGET_PAGE_BITS
);
3548 pd
= IO_MEM_UNASSIGNED
;
3550 pd
= p
->phys_offset
;
3553 if ((pd
& ~TARGET_PAGE_MASK
) > IO_MEM_ROM
&&
3554 !(pd
& IO_MEM_ROMD
)) {
3556 io_index
= (pd
>> IO_MEM_SHIFT
) & (IO_MEM_NB_ENTRIES
- 1);
3558 addr
= (addr
& ~TARGET_PAGE_MASK
) + p
->region_offset
;
3559 val
= io_mem_read
[io_index
][2](io_mem_opaque
[io_index
], addr
);
3562 ptr
= qemu_get_ram_ptr(pd
& TARGET_PAGE_MASK
) +
3563 (addr
& ~TARGET_PAGE_MASK
);
3569 /* warning: addr must be aligned */
3570 uint64_t ldq_phys(target_phys_addr_t addr
)
3578 p
= phys_page_find(addr
>> TARGET_PAGE_BITS
);
3580 pd
= IO_MEM_UNASSIGNED
;
3582 pd
= p
->phys_offset
;
3585 if ((pd
& ~TARGET_PAGE_MASK
) > IO_MEM_ROM
&&
3586 !(pd
& IO_MEM_ROMD
)) {
3588 io_index
= (pd
>> IO_MEM_SHIFT
) & (IO_MEM_NB_ENTRIES
- 1);
3590 addr
= (addr
& ~TARGET_PAGE_MASK
) + p
->region_offset
;
3591 #ifdef TARGET_WORDS_BIGENDIAN
3592 val
= (uint64_t)io_mem_read
[io_index
][2](io_mem_opaque
[io_index
], addr
) << 32;
3593 val
|= io_mem_read
[io_index
][2](io_mem_opaque
[io_index
], addr
+ 4);
3595 val
= io_mem_read
[io_index
][2](io_mem_opaque
[io_index
], addr
);
3596 val
|= (uint64_t)io_mem_read
[io_index
][2](io_mem_opaque
[io_index
], addr
+ 4) << 32;
3600 ptr
= qemu_get_ram_ptr(pd
& TARGET_PAGE_MASK
) +
3601 (addr
& ~TARGET_PAGE_MASK
);
3608 uint32_t ldub_phys(target_phys_addr_t addr
)
3611 cpu_physical_memory_read(addr
, &val
, 1);
3616 uint32_t lduw_phys(target_phys_addr_t addr
)
3619 cpu_physical_memory_read(addr
, (uint8_t *)&val
, 2);
3620 return tswap16(val
);
3623 /* warning: addr must be aligned. The ram page is not masked as dirty
3624 and the code inside is not invalidated. It is useful if the dirty
3625 bits are used to track modified PTEs */
3626 void stl_phys_notdirty(target_phys_addr_t addr
, uint32_t val
)
3633 p
= phys_page_find(addr
>> TARGET_PAGE_BITS
);
3635 pd
= IO_MEM_UNASSIGNED
;
3637 pd
= p
->phys_offset
;
3640 if ((pd
& ~TARGET_PAGE_MASK
) != IO_MEM_RAM
) {
3641 io_index
= (pd
>> IO_MEM_SHIFT
) & (IO_MEM_NB_ENTRIES
- 1);
3643 addr
= (addr
& ~TARGET_PAGE_MASK
) + p
->region_offset
;
3644 io_mem_write
[io_index
][2](io_mem_opaque
[io_index
], addr
, val
);
3646 unsigned long addr1
= (pd
& TARGET_PAGE_MASK
) + (addr
& ~TARGET_PAGE_MASK
);
3647 ptr
= qemu_get_ram_ptr(addr1
);
3650 if (unlikely(in_migration
)) {
3651 if (!cpu_physical_memory_is_dirty(addr1
)) {
3652 /* invalidate code */
3653 tb_invalidate_phys_page_range(addr1
, addr1
+ 4, 0);
3655 phys_ram_dirty
[addr1
>> TARGET_PAGE_BITS
] |=
3656 (0xff & ~CODE_DIRTY_FLAG
);
3662 void stq_phys_notdirty(target_phys_addr_t addr
, uint64_t val
)
3669 p
= phys_page_find(addr
>> TARGET_PAGE_BITS
);
3671 pd
= IO_MEM_UNASSIGNED
;
3673 pd
= p
->phys_offset
;
3676 if ((pd
& ~TARGET_PAGE_MASK
) != IO_MEM_RAM
) {
3677 io_index
= (pd
>> IO_MEM_SHIFT
) & (IO_MEM_NB_ENTRIES
- 1);
3679 addr
= (addr
& ~TARGET_PAGE_MASK
) + p
->region_offset
;
3680 #ifdef TARGET_WORDS_BIGENDIAN
3681 io_mem_write
[io_index
][2](io_mem_opaque
[io_index
], addr
, val
>> 32);
3682 io_mem_write
[io_index
][2](io_mem_opaque
[io_index
], addr
+ 4, val
);
3684 io_mem_write
[io_index
][2](io_mem_opaque
[io_index
], addr
, val
);
3685 io_mem_write
[io_index
][2](io_mem_opaque
[io_index
], addr
+ 4, val
>> 32);
3688 ptr
= qemu_get_ram_ptr(pd
& TARGET_PAGE_MASK
) +
3689 (addr
& ~TARGET_PAGE_MASK
);
3694 /* warning: addr must be aligned */
3695 void stl_phys(target_phys_addr_t addr
, uint32_t val
)
3702 p
= phys_page_find(addr
>> TARGET_PAGE_BITS
);
3704 pd
= IO_MEM_UNASSIGNED
;
3706 pd
= p
->phys_offset
;
3709 if ((pd
& ~TARGET_PAGE_MASK
) != IO_MEM_RAM
) {
3710 io_index
= (pd
>> IO_MEM_SHIFT
) & (IO_MEM_NB_ENTRIES
- 1);
3712 addr
= (addr
& ~TARGET_PAGE_MASK
) + p
->region_offset
;
3713 io_mem_write
[io_index
][2](io_mem_opaque
[io_index
], addr
, val
);
3715 unsigned long addr1
;
3716 addr1
= (pd
& TARGET_PAGE_MASK
) + (addr
& ~TARGET_PAGE_MASK
);
3718 ptr
= qemu_get_ram_ptr(addr1
);
3720 if (!cpu_physical_memory_is_dirty(addr1
)) {
3721 /* invalidate code */
3722 tb_invalidate_phys_page_range(addr1
, addr1
+ 4, 0);
3724 phys_ram_dirty
[addr1
>> TARGET_PAGE_BITS
] |=
3725 (0xff & ~CODE_DIRTY_FLAG
);
3731 void stb_phys(target_phys_addr_t addr
, uint32_t val
)
3734 cpu_physical_memory_write(addr
, &v
, 1);
3738 void stw_phys(target_phys_addr_t addr
, uint32_t val
)
3740 uint16_t v
= tswap16(val
);
3741 cpu_physical_memory_write(addr
, (const uint8_t *)&v
, 2);
3745 void stq_phys(target_phys_addr_t addr
, uint64_t val
)
3748 cpu_physical_memory_write(addr
, (const uint8_t *)&val
, 8);
3753 /* virtual memory access for debug (includes writing to ROM) */
3754 int cpu_memory_rw_debug(CPUState
*env
, target_ulong addr
,
3755 uint8_t *buf
, int len
, int is_write
)
3758 target_phys_addr_t phys_addr
;
3762 page
= addr
& TARGET_PAGE_MASK
;
3763 phys_addr
= cpu_get_phys_page_debug(env
, page
);
3764 /* if no physical page mapped, return an error */
3765 if (phys_addr
== -1)
3767 l
= (page
+ TARGET_PAGE_SIZE
) - addr
;
3770 phys_addr
+= (addr
& ~TARGET_PAGE_MASK
);
3771 #if !defined(CONFIG_USER_ONLY)
3773 cpu_physical_memory_write_rom(phys_addr
, buf
, l
);
3776 cpu_physical_memory_rw(phys_addr
, buf
, l
, is_write
);
3784 /* in deterministic execution mode, instructions doing device I/Os
3785 must be at the end of the TB */
3786 void cpu_io_recompile(CPUState
*env
, void *retaddr
)
3788 TranslationBlock
*tb
;
3790 target_ulong pc
, cs_base
;
3793 tb
= tb_find_pc((unsigned long)retaddr
);
3795 cpu_abort(env
, "cpu_io_recompile: could not find TB for pc=%p",
3798 n
= env
->icount_decr
.u16
.low
+ tb
->icount
;
3799 cpu_restore_state(tb
, env
, (unsigned long)retaddr
, NULL
);
3800 /* Calculate how many instructions had been executed before the fault
3802 n
= n
- env
->icount_decr
.u16
.low
;
3803 /* Generate a new TB ending on the I/O insn. */
3805 /* On MIPS and SH, delay slot instructions can only be restarted if
3806 they were already the first instruction in the TB. If this is not
3807 the first instruction in a TB then re-execute the preceding
3809 #if defined(TARGET_MIPS)
3810 if ((env
->hflags
& MIPS_HFLAG_BMASK
) != 0 && n
> 1) {
3811 env
->active_tc
.PC
-= 4;
3812 env
->icount_decr
.u16
.low
++;
3813 env
->hflags
&= ~MIPS_HFLAG_BMASK
;
3815 #elif defined(TARGET_SH4)
3816 if ((env
->flags
& ((DELAY_SLOT
| DELAY_SLOT_CONDITIONAL
))) != 0
3819 env
->icount_decr
.u16
.low
++;
3820 env
->flags
&= ~(DELAY_SLOT
| DELAY_SLOT_CONDITIONAL
);
3823 /* This should never happen. */
3824 if (n
> CF_COUNT_MASK
)
3825 cpu_abort(env
, "TB too big during recompile");
3827 cflags
= n
| CF_LAST_IO
;
3829 cs_base
= tb
->cs_base
;
3831 tb_phys_invalidate(tb
, -1);
3832 /* FIXME: In theory this could raise an exception. In practice
3833 we have already translated the block once so it's probably ok. */
3834 tb_gen_code(env
, pc
, cs_base
, flags
, cflags
);
3835 /* TODO: If env->pc != tb->pc (i.e. the faulting instruction was not
3836 the first in the TB) then we end up generating a whole new TB and
3837 repeating the fault, which is horribly inefficient.
3838 Better would be to execute just this insn uncached, or generate a
3840 cpu_resume_from_signal(env
, NULL
);
3843 void dump_exec_info(FILE *f
,
3844 int (*cpu_fprintf
)(FILE *f
, const char *fmt
, ...))
3846 int i
, target_code_size
, max_target_code_size
;
3847 int direct_jmp_count
, direct_jmp2_count
, cross_page
;
3848 TranslationBlock
*tb
;
3850 target_code_size
= 0;
3851 max_target_code_size
= 0;
3853 direct_jmp_count
= 0;
3854 direct_jmp2_count
= 0;
3855 for(i
= 0; i
< nb_tbs
; i
++) {
3857 target_code_size
+= tb
->size
;
3858 if (tb
->size
> max_target_code_size
)
3859 max_target_code_size
= tb
->size
;
3860 if (tb
->page_addr
[1] != -1)
3862 if (tb
->tb_next_offset
[0] != 0xffff) {
3864 if (tb
->tb_next_offset
[1] != 0xffff) {
3865 direct_jmp2_count
++;
3869 /* XXX: avoid using doubles ? */
3870 cpu_fprintf(f
, "Translation buffer state:\n");
3871 cpu_fprintf(f
, "gen code size %ld/%ld\n",
3872 code_gen_ptr
- code_gen_buffer
, code_gen_buffer_max_size
);
3873 cpu_fprintf(f
, "TB count %d/%d\n",
3874 nb_tbs
, code_gen_max_blocks
);
3875 cpu_fprintf(f
, "TB avg target size %d max=%d bytes\n",
3876 nb_tbs
? target_code_size
/ nb_tbs
: 0,
3877 max_target_code_size
);
3878 cpu_fprintf(f
, "TB avg host size %d bytes (expansion ratio: %0.1f)\n",
3879 nb_tbs
? (code_gen_ptr
- code_gen_buffer
) / nb_tbs
: 0,
3880 target_code_size
? (double) (code_gen_ptr
- code_gen_buffer
) / target_code_size
: 0);
3881 cpu_fprintf(f
, "cross page TB count %d (%d%%)\n",
3883 nb_tbs
? (cross_page
* 100) / nb_tbs
: 0);
3884 cpu_fprintf(f
, "direct jump count %d (%d%%) (2 jumps=%d %d%%)\n",
3886 nb_tbs
? (direct_jmp_count
* 100) / nb_tbs
: 0,
3888 nb_tbs
? (direct_jmp2_count
* 100) / nb_tbs
: 0);
3889 cpu_fprintf(f
, "\nStatistics:\n");
3890 cpu_fprintf(f
, "TB flush count %d\n", tb_flush_count
);
3891 cpu_fprintf(f
, "TB invalidate count %d\n", tb_phys_invalidate_count
);
3892 cpu_fprintf(f
, "TLB flush count %d\n", tlb_flush_count
);
3893 tcg_dump_info(f
, cpu_fprintf
);
3896 #if !defined(CONFIG_USER_ONLY)
3898 #define MMUSUFFIX _cmmu
3899 #define GETPC() NULL
3900 #define env cpu_single_env
3901 #define SOFTMMU_CODE_ACCESS
3904 #include "softmmu_template.h"
3907 #include "softmmu_template.h"
3910 #include "softmmu_template.h"
3913 #include "softmmu_template.h"