2 * User emulator execution
4 * Copyright (c) 2003-2005 Fabrice Bellard
6 * This library is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU Lesser General Public
8 * License as published by the Free Software Foundation; either
9 * version 2.1 of the License, or (at your option) any later version.
11 * This library is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
14 * Lesser General Public License for more details.
16 * You should have received a copy of the GNU Lesser General Public
17 * License along with this library; if not, see <http://www.gnu.org/licenses/>.
19 #include "qemu/osdep.h"
21 #include "disas/disas.h"
22 #include "exec/exec-all.h"
24 #include "qemu/bitops.h"
25 #include "exec/cpu_ldst.h"
26 #include "translate-all.h"
27 #include "exec/helper-proto.h"
28 #include "qemu/atomic128.h"
40 #include <sys/ucontext.h>
43 __thread
uintptr_t helper_retaddr
;
45 //#define DEBUG_SIGNAL
47 /* exit the current TB from a signal handler. The host registers are
48 restored in a state compatible with the CPU emulator
50 static void cpu_exit_tb_from_sighandler(CPUState
*cpu
, sigset_t
*old_set
)
52 /* XXX: use siglongjmp ? */
53 sigprocmask(SIG_SETMASK
, old_set
, NULL
);
54 cpu_loop_exit_noexc(cpu
);
57 /* 'pc' is the host PC at which the exception was raised. 'address' is
58 the effective address of the memory exception. 'is_write' is 1 if a
59 write caused the exception and otherwise 0'. 'old_set' is the
60 signal set which should be restored */
61 static inline int handle_cpu_signal(uintptr_t pc
, siginfo_t
*info
,
62 int is_write
, sigset_t
*old_set
)
64 CPUState
*cpu
= current_cpu
;
66 unsigned long address
= (unsigned long)info
->si_addr
;
67 MMUAccessType access_type
= is_write
? MMU_DATA_STORE
: MMU_DATA_LOAD
;
69 switch (helper_retaddr
) {
72 * Fault during host memory operation within a helper function.
73 * The helper's host return address, saved here, gives us a
74 * pointer into the generated code that will unwind to the
82 * Fault during host memory operation within generated code.
83 * (Or, a unrelated bug within qemu, but we can't tell from here).
85 * We take the host pc from the signal frame. However, we cannot
86 * use that value directly. Within cpu_restore_state_from_tb, we
87 * assume PC comes from GETPC(), as used by the helper functions,
88 * so we adjust the address by -GETPC_ADJ to form an address that
89 * is within the call insn, so that the address does not accidentially
90 * match the beginning of the next guest insn. However, when the
91 * pc comes from the signal frame it points to the actual faulting
92 * host memory insn and not the return from a call insn.
94 * Therefore, adjust to compensate for what will be done later
95 * by cpu_restore_state_from_tb.
102 * Fault during host read for translation, or loosely, "execution".
104 * The guest pc is already pointing to the start of the TB for which
105 * code is being generated. If the guest translator manages the
106 * page crossings correctly, this is exactly the correct address
107 * (and if the translator doesn't handle page boundaries correctly
108 * there's little we can do about that here). Therefore, do not
109 * trigger the unwinder.
111 * Like tb_gen_code, release the memory lock before cpu_loop_exit.
114 access_type
= MMU_INST_FETCH
;
119 /* For synchronous signals we expect to be coming from the vCPU
120 * thread (so current_cpu should be valid) and either from running
121 * code or during translation which can fault as we cross pages.
123 * If neither is true then something has gone wrong and we should
124 * abort rather than try and restart the vCPU execution.
126 if (!cpu
|| !cpu
->running
) {
127 printf("qemu:%s received signal outside vCPU context @ pc=0x%"
128 PRIxPTR
"\n", __func__
, pc
);
132 #if defined(DEBUG_SIGNAL)
133 printf("qemu: SIGSEGV pc=0x%08lx address=%08lx w=%d oldset=0x%08lx\n",
134 pc
, address
, is_write
, *(unsigned long *)old_set
);
136 /* XXX: locking issue */
137 /* Note that it is important that we don't call page_unprotect() unless
138 * this is really a "write to nonwriteable page" fault, because
139 * page_unprotect() assumes that if it is called for an access to
140 * a page that's writeable this means we had two threads racing and
141 * another thread got there first and already made the page writeable;
142 * so we will retry the access. If we were to call page_unprotect()
143 * for some other kind of fault that should really be passed to the
144 * guest, we'd end up in an infinite loop of retrying the faulting
147 if (is_write
&& info
->si_signo
== SIGSEGV
&& info
->si_code
== SEGV_ACCERR
&&
148 h2g_valid(address
)) {
149 switch (page_unprotect(h2g(address
), pc
)) {
151 /* Fault not caused by a page marked unwritable to protect
152 * cached translations, must be the guest binary's problem.
156 /* Fault caused by protection of cached translation; TBs
157 * invalidated, so resume execution. Retain helper_retaddr
158 * for a possible second fault.
162 /* Fault caused by protection of cached translation, and the
163 * currently executing TB was modified and must be exited
164 * immediately. Clear helper_retaddr for next execution.
166 clear_helper_retaddr();
167 cpu_exit_tb_from_sighandler(cpu
, old_set
);
171 g_assert_not_reached();
175 /* Convert forcefully to guest address space, invalid addresses
176 are still valid segv ones */
177 address
= h2g_nocheck(address
);
180 * There is no way the target can handle this other than raising
181 * an exception. Undo signal and retaddr state prior to longjmp.
183 sigprocmask(SIG_SETMASK
, old_set
, NULL
);
184 clear_helper_retaddr();
186 cc
= CPU_GET_CLASS(cpu
);
187 cc
->tlb_fill(cpu
, address
, 0, access_type
, MMU_USER_IDX
, false, pc
);
188 g_assert_not_reached();
191 void *probe_access(CPUArchState
*env
, target_ulong addr
, int size
,
192 MMUAccessType access_type
, int mmu_idx
, uintptr_t retaddr
)
196 g_assert(-(addr
| TARGET_PAGE_MASK
) >= size
);
198 switch (access_type
) {
209 g_assert_not_reached();
212 if (!guest_addr_valid(addr
) || page_check_range(addr
, size
, flags
) < 0) {
213 CPUState
*cpu
= env_cpu(env
);
214 CPUClass
*cc
= CPU_GET_CLASS(cpu
);
215 cc
->tlb_fill(cpu
, addr
, size
, access_type
, MMU_USER_IDX
, false,
217 g_assert_not_reached();
220 return size
? g2h(addr
) : NULL
;
223 #if defined(__i386__)
225 #if defined(__NetBSD__)
226 #include <ucontext.h>
228 #define EIP_sig(context) ((context)->uc_mcontext.__gregs[_REG_EIP])
229 #define TRAP_sig(context) ((context)->uc_mcontext.__gregs[_REG_TRAPNO])
230 #define ERROR_sig(context) ((context)->uc_mcontext.__gregs[_REG_ERR])
231 #define MASK_sig(context) ((context)->uc_sigmask)
232 #elif defined(__FreeBSD__) || defined(__DragonFly__)
233 #include <ucontext.h>
235 #define EIP_sig(context) (*((unsigned long *)&(context)->uc_mcontext.mc_eip))
236 #define TRAP_sig(context) ((context)->uc_mcontext.mc_trapno)
237 #define ERROR_sig(context) ((context)->uc_mcontext.mc_err)
238 #define MASK_sig(context) ((context)->uc_sigmask)
239 #elif defined(__OpenBSD__)
240 #define EIP_sig(context) ((context)->sc_eip)
241 #define TRAP_sig(context) ((context)->sc_trapno)
242 #define ERROR_sig(context) ((context)->sc_err)
243 #define MASK_sig(context) ((context)->sc_mask)
245 #define EIP_sig(context) ((context)->uc_mcontext.gregs[REG_EIP])
246 #define TRAP_sig(context) ((context)->uc_mcontext.gregs[REG_TRAPNO])
247 #define ERROR_sig(context) ((context)->uc_mcontext.gregs[REG_ERR])
248 #define MASK_sig(context) ((context)->uc_sigmask)
251 int cpu_signal_handler(int host_signum
, void *pinfo
,
254 siginfo_t
*info
= pinfo
;
255 #if defined(__NetBSD__) || defined(__FreeBSD__) || defined(__DragonFly__)
256 ucontext_t
*uc
= puc
;
257 #elif defined(__OpenBSD__)
258 struct sigcontext
*uc
= puc
;
260 ucontext_t
*uc
= puc
;
269 #define REG_TRAPNO TRAPNO
272 trapno
= TRAP_sig(uc
);
273 return handle_cpu_signal(pc
, info
,
274 trapno
== 0xe ? (ERROR_sig(uc
) >> 1) & 1 : 0,
278 #elif defined(__x86_64__)
281 #define PC_sig(context) _UC_MACHINE_PC(context)
282 #define TRAP_sig(context) ((context)->uc_mcontext.__gregs[_REG_TRAPNO])
283 #define ERROR_sig(context) ((context)->uc_mcontext.__gregs[_REG_ERR])
284 #define MASK_sig(context) ((context)->uc_sigmask)
285 #elif defined(__OpenBSD__)
286 #define PC_sig(context) ((context)->sc_rip)
287 #define TRAP_sig(context) ((context)->sc_trapno)
288 #define ERROR_sig(context) ((context)->sc_err)
289 #define MASK_sig(context) ((context)->sc_mask)
290 #elif defined(__FreeBSD__) || defined(__DragonFly__)
291 #include <ucontext.h>
293 #define PC_sig(context) (*((unsigned long *)&(context)->uc_mcontext.mc_rip))
294 #define TRAP_sig(context) ((context)->uc_mcontext.mc_trapno)
295 #define ERROR_sig(context) ((context)->uc_mcontext.mc_err)
296 #define MASK_sig(context) ((context)->uc_sigmask)
298 #define PC_sig(context) ((context)->uc_mcontext.gregs[REG_RIP])
299 #define TRAP_sig(context) ((context)->uc_mcontext.gregs[REG_TRAPNO])
300 #define ERROR_sig(context) ((context)->uc_mcontext.gregs[REG_ERR])
301 #define MASK_sig(context) ((context)->uc_sigmask)
304 int cpu_signal_handler(int host_signum
, void *pinfo
,
307 siginfo_t
*info
= pinfo
;
309 #if defined(__NetBSD__) || defined(__FreeBSD__) || defined(__DragonFly__)
310 ucontext_t
*uc
= puc
;
311 #elif defined(__OpenBSD__)
312 struct sigcontext
*uc
= puc
;
314 ucontext_t
*uc
= puc
;
318 return handle_cpu_signal(pc
, info
,
319 TRAP_sig(uc
) == 0xe ? (ERROR_sig(uc
) >> 1) & 1 : 0,
323 #elif defined(_ARCH_PPC)
325 /***********************************************************************
326 * signal context platform-specific definitions
330 /* All Registers access - only for local access */
331 #define REG_sig(reg_name, context) \
332 ((context)->uc_mcontext.regs->reg_name)
333 /* Gpr Registers access */
334 #define GPR_sig(reg_num, context) REG_sig(gpr[reg_num], context)
335 /* Program counter */
336 #define IAR_sig(context) REG_sig(nip, context)
337 /* Machine State Register (Supervisor) */
338 #define MSR_sig(context) REG_sig(msr, context)
340 #define CTR_sig(context) REG_sig(ctr, context)
341 /* User's integer exception register */
342 #define XER_sig(context) REG_sig(xer, context)
344 #define LR_sig(context) REG_sig(link, context)
345 /* Condition register */
346 #define CR_sig(context) REG_sig(ccr, context)
348 /* Float Registers access */
349 #define FLOAT_sig(reg_num, context) \
350 (((double *)((char *)((context)->uc_mcontext.regs + 48 * 4)))[reg_num])
351 #define FPSCR_sig(context) \
352 (*(int *)((char *)((context)->uc_mcontext.regs + (48 + 32 * 2) * 4)))
353 /* Exception Registers access */
354 #define DAR_sig(context) REG_sig(dar, context)
355 #define DSISR_sig(context) REG_sig(dsisr, context)
356 #define TRAP_sig(context) REG_sig(trap, context)
359 #if defined(__FreeBSD__) || defined(__FreeBSD_kernel__)
360 #include <ucontext.h>
361 #define IAR_sig(context) ((context)->uc_mcontext.mc_srr0)
362 #define MSR_sig(context) ((context)->uc_mcontext.mc_srr1)
363 #define CTR_sig(context) ((context)->uc_mcontext.mc_ctr)
364 #define XER_sig(context) ((context)->uc_mcontext.mc_xer)
365 #define LR_sig(context) ((context)->uc_mcontext.mc_lr)
366 #define CR_sig(context) ((context)->uc_mcontext.mc_cr)
367 /* Exception Registers access */
368 #define DAR_sig(context) ((context)->uc_mcontext.mc_dar)
369 #define DSISR_sig(context) ((context)->uc_mcontext.mc_dsisr)
370 #define TRAP_sig(context) ((context)->uc_mcontext.mc_exc)
371 #endif /* __FreeBSD__|| __FreeBSD_kernel__ */
373 int cpu_signal_handler(int host_signum
, void *pinfo
,
376 siginfo_t
*info
= pinfo
;
377 #if defined(__FreeBSD__) || defined(__FreeBSD_kernel__)
378 ucontext_t
*uc
= puc
;
380 ucontext_t
*uc
= puc
;
389 if (DSISR_sig(uc
) & 0x00800000) {
393 if (TRAP_sig(uc
) != 0x400 && (DSISR_sig(uc
) & 0x02000000)) {
397 return handle_cpu_signal(pc
, info
, is_write
, &uc
->uc_sigmask
);
400 #elif defined(__alpha__)
402 int cpu_signal_handler(int host_signum
, void *pinfo
,
405 siginfo_t
*info
= pinfo
;
406 ucontext_t
*uc
= puc
;
407 uint32_t *pc
= uc
->uc_mcontext
.sc_pc
;
411 /* XXX: need kernel patch to get write flag faster */
412 switch (insn
>> 26) {
415 case 0x0f: /* stq_u */
422 case 0x2e: /* stl_c */
423 case 0x2f: /* stq_c */
427 return handle_cpu_signal(pc
, info
, is_write
, &uc
->uc_sigmask
);
429 #elif defined(__sparc__)
431 int cpu_signal_handler(int host_signum
, void *pinfo
,
434 siginfo_t
*info
= pinfo
;
437 #if !defined(__arch64__) || defined(CONFIG_SOLARIS)
438 uint32_t *regs
= (uint32_t *)(info
+ 1);
439 void *sigmask
= (regs
+ 20);
440 /* XXX: is there a standard glibc define ? */
441 unsigned long pc
= regs
[1];
444 struct sigcontext
*sc
= puc
;
445 unsigned long pc
= sc
->sigc_regs
.tpc
;
446 void *sigmask
= (void *)sc
->sigc_mask
;
447 #elif defined(__OpenBSD__)
448 struct sigcontext
*uc
= puc
;
449 unsigned long pc
= uc
->sc_pc
;
450 void *sigmask
= (void *)(long)uc
->sc_mask
;
451 #elif defined(__NetBSD__)
452 ucontext_t
*uc
= puc
;
453 unsigned long pc
= _UC_MACHINE_PC(uc
);
454 void *sigmask
= (void *)&uc
->uc_sigmask
;
458 /* XXX: need kernel patch to get write flag faster */
460 insn
= *(uint32_t *)pc
;
461 if ((insn
>> 30) == 3) {
462 switch ((insn
>> 19) & 0x3f) {
464 case 0x15: /* stba */
466 case 0x16: /* stha */
470 case 0x17: /* stda */
472 case 0x1e: /* stxa */
474 case 0x34: /* stfa */
475 case 0x27: /* stdf */
476 case 0x37: /* stdfa */
477 case 0x26: /* stqf */
478 case 0x36: /* stqfa */
479 case 0x25: /* stfsr */
480 case 0x3c: /* casa */
481 case 0x3e: /* casxa */
486 return handle_cpu_signal(pc
, info
, is_write
, sigmask
);
489 #elif defined(__arm__)
491 #if defined(__NetBSD__)
492 #include <ucontext.h>
495 int cpu_signal_handler(int host_signum
, void *pinfo
,
498 siginfo_t
*info
= pinfo
;
499 #if defined(__NetBSD__)
500 ucontext_t
*uc
= puc
;
502 ucontext_t
*uc
= puc
;
507 #if defined(__NetBSD__)
508 pc
= uc
->uc_mcontext
.__gregs
[_REG_R15
];
509 #elif defined(__GLIBC__) && (__GLIBC__ < 2 || (__GLIBC__ == 2 && __GLIBC_MINOR__ <= 3))
510 pc
= uc
->uc_mcontext
.gregs
[R15
];
512 pc
= uc
->uc_mcontext
.arm_pc
;
515 /* error_code is the FSR value, in which bit 11 is WnR (assuming a v6 or
516 * later processor; on v5 we will always report this as a read).
518 is_write
= extract32(uc
->uc_mcontext
.error_code
, 11, 1);
519 return handle_cpu_signal(pc
, info
, is_write
, &uc
->uc_sigmask
);
522 #elif defined(__aarch64__)
525 /* Pre-3.16 kernel headers don't have these, so provide fallback definitions */
526 #define ESR_MAGIC 0x45535201
528 struct _aarch64_ctx head
;
533 static inline struct _aarch64_ctx
*first_ctx(ucontext_t
*uc
)
535 return (struct _aarch64_ctx
*)&uc
->uc_mcontext
.__reserved
;
538 static inline struct _aarch64_ctx
*next_ctx(struct _aarch64_ctx
*hdr
)
540 return (struct _aarch64_ctx
*)((char *)hdr
+ hdr
->size
);
543 int cpu_signal_handler(int host_signum
, void *pinfo
, void *puc
)
545 siginfo_t
*info
= pinfo
;
546 ucontext_t
*uc
= puc
;
547 uintptr_t pc
= uc
->uc_mcontext
.pc
;
549 struct _aarch64_ctx
*hdr
;
550 struct esr_context
const *esrctx
= NULL
;
552 /* Find the esr_context, which has the WnR bit in it */
553 for (hdr
= first_ctx(uc
); hdr
->magic
; hdr
= next_ctx(hdr
)) {
554 if (hdr
->magic
== ESR_MAGIC
) {
555 esrctx
= (struct esr_context
const *)hdr
;
561 /* For data aborts ESR.EC is 0b10010x: then bit 6 is the WnR bit */
562 uint64_t esr
= esrctx
->esr
;
563 is_write
= extract32(esr
, 27, 5) == 0x12 && extract32(esr
, 6, 1) == 1;
566 * Fall back to parsing instructions; will only be needed
567 * for really ancient (pre-3.16) kernels.
569 uint32_t insn
= *(uint32_t *)pc
;
571 is_write
= ((insn
& 0xbfff0000) == 0x0c000000 /* C3.3.1 */
572 || (insn
& 0xbfe00000) == 0x0c800000 /* C3.3.2 */
573 || (insn
& 0xbfdf0000) == 0x0d000000 /* C3.3.3 */
574 || (insn
& 0xbfc00000) == 0x0d800000 /* C3.3.4 */
575 || (insn
& 0x3f400000) == 0x08000000 /* C3.3.6 */
576 || (insn
& 0x3bc00000) == 0x39000000 /* C3.3.13 */
577 || (insn
& 0x3fc00000) == 0x3d800000 /* ... 128bit */
578 /* Ignore bits 10, 11 & 21, controlling indexing. */
579 || (insn
& 0x3bc00000) == 0x38000000 /* C3.3.8-12 */
580 || (insn
& 0x3fe00000) == 0x3c800000 /* ... 128bit */
581 /* Ignore bits 23 & 24, controlling indexing. */
582 || (insn
& 0x3a400000) == 0x28000000); /* C3.3.7,14-16 */
584 return handle_cpu_signal(pc
, info
, is_write
, &uc
->uc_sigmask
);
587 #elif defined(__s390__)
589 int cpu_signal_handler(int host_signum
, void *pinfo
,
592 siginfo_t
*info
= pinfo
;
593 ucontext_t
*uc
= puc
;
598 pc
= uc
->uc_mcontext
.psw
.addr
;
600 /* ??? On linux, the non-rt signal handler has 4 (!) arguments instead
601 of the normal 2 arguments. The 3rd argument contains the "int_code"
602 from the hardware which does in fact contain the is_write value.
603 The rt signal handler, as far as I can tell, does not give this value
604 at all. Not that we could get to it from here even if it were. */
605 /* ??? This is not even close to complete, since it ignores all
606 of the read-modify-write instructions. */
607 pinsn
= (uint16_t *)pc
;
608 switch (pinsn
[0] >> 8) {
614 case 0xc4: /* RIL format insns */
615 switch (pinsn
[0] & 0xf) {
617 case 0xb: /* STGRL */
618 case 0x7: /* STHRL */
622 case 0xe3: /* RXY format insns */
623 switch (pinsn
[2] & 0xff) {
626 case 0x72: /* STCY */
627 case 0x70: /* STHY */
628 case 0x8e: /* STPQ */
629 case 0x3f: /* STRVH */
630 case 0x3e: /* STRV */
631 case 0x2f: /* STRVG */
636 return handle_cpu_signal(pc
, info
, is_write
, &uc
->uc_sigmask
);
639 #elif defined(__mips__)
641 int cpu_signal_handler(int host_signum
, void *pinfo
,
644 siginfo_t
*info
= pinfo
;
645 ucontext_t
*uc
= puc
;
646 greg_t pc
= uc
->uc_mcontext
.pc
;
649 /* XXX: compute is_write */
651 return handle_cpu_signal(pc
, info
, is_write
, &uc
->uc_sigmask
);
654 #elif defined(__riscv)
656 int cpu_signal_handler(int host_signum
, void *pinfo
,
659 siginfo_t
*info
= pinfo
;
660 ucontext_t
*uc
= puc
;
661 greg_t pc
= uc
->uc_mcontext
.__gregs
[REG_PC
];
662 uint32_t insn
= *(uint32_t *)pc
;
665 /* Detect store by reading the instruction at the program
666 counter. Note: we currently only generate 32-bit
667 instructions so we thus only detect 32-bit stores */
668 switch (((insn
>> 0) & 0b11)) {
670 switch (((insn
>> 2) & 0b11111)) {
672 switch (((insn
>> 12) & 0b111)) {
685 switch (((insn
>> 12) & 0b111)) {
700 /* Check for compressed instructions */
701 switch (((insn
>> 13) & 0b111)) {
703 switch (insn
& 0b11) {
713 switch (insn
& 0b11) {
726 return handle_cpu_signal(pc
, info
, is_write
, &uc
->uc_sigmask
);
731 #error host CPU specific signal handler needed
735 /* The softmmu versions of these helpers are in cputlb.c. */
737 /* Do not allow unaligned operations to proceed. Return the host address. */
738 static void *atomic_mmu_lookup(CPUArchState
*env
, target_ulong addr
,
739 int size
, uintptr_t retaddr
)
741 /* Enforce qemu required alignment. */
742 if (unlikely(addr
& (size
- 1))) {
743 cpu_loop_exit_atomic(env_cpu(env
), retaddr
);
745 void *ret
= g2h(addr
);
746 set_helper_retaddr(retaddr
);
750 /* Macro to call the above, with local variables from the use context. */
751 #define ATOMIC_MMU_DECLS do {} while (0)
752 #define ATOMIC_MMU_LOOKUP atomic_mmu_lookup(env, addr, DATA_SIZE, GETPC())
753 #define ATOMIC_MMU_CLEANUP do { clear_helper_retaddr(); } while (0)
755 #define ATOMIC_NAME(X) HELPER(glue(glue(atomic_ ## X, SUFFIX), END))
759 #include "atomic_template.h"
762 #include "atomic_template.h"
765 #include "atomic_template.h"
767 #ifdef CONFIG_ATOMIC64
769 #include "atomic_template.h"
772 /* The following is only callable from other helpers, and matches up
773 with the softmmu version. */
775 #if HAVE_ATOMIC128 || HAVE_CMPXCHG128
779 #undef ATOMIC_MMU_LOOKUP
781 #define EXTRA_ARGS , TCGMemOpIdx oi, uintptr_t retaddr
782 #define ATOMIC_NAME(X) \
783 HELPER(glue(glue(glue(atomic_ ## X, SUFFIX), END), _mmu))
784 #define ATOMIC_MMU_LOOKUP atomic_mmu_lookup(env, addr, DATA_SIZE, retaddr)
787 #include "atomic_template.h"