2 * virtual page mapping and translated block handling
4 * Copyright (c) 2003 Fabrice Bellard
6 * This library is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU Lesser General Public
8 * License as published by the Free Software Foundation; either
9 * version 2 of the License, or (at your option) any later version.
11 * This library is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
14 * Lesser General Public License for more details.
16 * You should have received a copy of the GNU Lesser General Public
17 * License along with this library; if not, see <http://www.gnu.org/licenses/>.
23 #include <sys/types.h>
36 #include "qemu-common.h"
41 #if defined(CONFIG_USER_ONLY)
46 //#define DEBUG_TB_INVALIDATE
49 //#define DEBUG_UNASSIGNED
51 /* make various TB consistency checks */
52 //#define DEBUG_TB_CHECK
53 //#define DEBUG_TLB_CHECK
55 //#define DEBUG_IOPORT
56 //#define DEBUG_SUBPAGE
58 #if !defined(CONFIG_USER_ONLY)
59 /* TB consistency checks only implemented for usermode emulation. */
63 #define SMC_BITMAP_USE_THRESHOLD 10
65 #if defined(TARGET_SPARC64)
66 #define TARGET_PHYS_ADDR_SPACE_BITS 41
67 #elif defined(TARGET_SPARC)
68 #define TARGET_PHYS_ADDR_SPACE_BITS 36
69 #elif defined(TARGET_ALPHA)
70 #define TARGET_PHYS_ADDR_SPACE_BITS 42
71 #define TARGET_VIRT_ADDR_SPACE_BITS 42
72 #elif defined(TARGET_PPC64)
73 #define TARGET_PHYS_ADDR_SPACE_BITS 42
74 #elif defined(TARGET_X86_64)
75 #define TARGET_PHYS_ADDR_SPACE_BITS 42
76 #elif defined(TARGET_I386)
77 #define TARGET_PHYS_ADDR_SPACE_BITS 36
79 #define TARGET_PHYS_ADDR_SPACE_BITS 32
82 static TranslationBlock
*tbs
;
83 int code_gen_max_blocks
;
84 TranslationBlock
*tb_phys_hash
[CODE_GEN_PHYS_HASH_SIZE
];
86 /* any access to the tbs or the page table must use this lock */
87 spinlock_t tb_lock
= SPIN_LOCK_UNLOCKED
;
89 #if defined(__arm__) || defined(__sparc_v9__)
90 /* The prologue must be reachable with a direct jump. ARM and Sparc64
91 have limited branch ranges (possibly also PPC) so place it in a
92 section close to code segment. */
93 #define code_gen_section \
94 __attribute__((__section__(".gen_code"))) \
95 __attribute__((aligned (32)))
97 /* Maximum alignment for Win32 is 16. */
98 #define code_gen_section \
99 __attribute__((aligned (16)))
101 #define code_gen_section \
102 __attribute__((aligned (32)))
105 uint8_t code_gen_prologue
[1024] code_gen_section
;
106 static uint8_t *code_gen_buffer
;
107 static unsigned long code_gen_buffer_size
;
108 /* threshold to flush the translated code buffer */
109 static unsigned long code_gen_buffer_max_size
;
110 uint8_t *code_gen_ptr
;
112 #if !defined(CONFIG_USER_ONLY)
114 uint8_t *phys_ram_dirty
;
115 static int in_migration
;
117 typedef struct RAMBlock
{
121 struct RAMBlock
*next
;
124 static RAMBlock
*ram_blocks
;
125 /* TODO: When we implement (and use) ram deallocation (e.g. for hotplug)
126 then we can no longer assume contiguous ram offsets, and external uses
127 of this variable will break. */
128 ram_addr_t last_ram_offset
;
132 /* current CPU in the current thread. It is only valid inside
134 CPUState
*cpu_single_env
;
135 /* 0 = Do not count executed instructions.
136 1 = Precise instruction counting.
137 2 = Adaptive rate instruction counting. */
139 /* Current instruction counter. While executing translated code this may
140 include some instructions that have not yet been executed. */
143 typedef struct PageDesc
{
144 /* list of TBs intersecting this ram page */
145 TranslationBlock
*first_tb
;
146 /* in order to optimize self modifying code, we count the number
147 of lookups we do to a given page to use a bitmap */
148 unsigned int code_write_count
;
149 uint8_t *code_bitmap
;
150 #if defined(CONFIG_USER_ONLY)
155 typedef struct PhysPageDesc
{
156 /* offset in host memory of the page + io_index in the low bits */
157 ram_addr_t phys_offset
;
158 ram_addr_t region_offset
;
162 #if defined(CONFIG_USER_ONLY) && defined(TARGET_VIRT_ADDR_SPACE_BITS)
163 /* XXX: this is a temporary hack for alpha target.
164 * In the future, this is to be replaced by a multi-level table
165 * to actually be able to handle the complete 64 bits address space.
167 #define L1_BITS (TARGET_VIRT_ADDR_SPACE_BITS - L2_BITS - TARGET_PAGE_BITS)
169 #define L1_BITS (32 - L2_BITS - TARGET_PAGE_BITS)
172 #define L1_SIZE (1 << L1_BITS)
173 #define L2_SIZE (1 << L2_BITS)
175 unsigned long qemu_real_host_page_size
;
176 unsigned long qemu_host_page_bits
;
177 unsigned long qemu_host_page_size
;
178 unsigned long qemu_host_page_mask
;
180 /* XXX: for system emulation, it could just be an array */
181 static PageDesc
*l1_map
[L1_SIZE
];
183 #if !defined(CONFIG_USER_ONLY)
184 static PhysPageDesc
**l1_phys_map
;
186 static void io_mem_init(void);
188 /* io memory support */
189 CPUWriteMemoryFunc
*io_mem_write
[IO_MEM_NB_ENTRIES
][4];
190 CPUReadMemoryFunc
*io_mem_read
[IO_MEM_NB_ENTRIES
][4];
191 void *io_mem_opaque
[IO_MEM_NB_ENTRIES
];
192 static char io_mem_used
[IO_MEM_NB_ENTRIES
];
193 static int io_mem_watch
;
198 static const char *logfilename
= "qemu.log";
200 static const char *logfilename
= "/tmp/qemu.log";
204 static int log_append
= 0;
207 static int tlb_flush_count
;
208 static int tb_flush_count
;
209 static int tb_phys_invalidate_count
;
212 static void map_exec(void *addr
, long size
)
215 VirtualProtect(addr
, size
,
216 PAGE_EXECUTE_READWRITE
, &old_protect
);
220 static void map_exec(void *addr
, long size
)
222 unsigned long start
, end
, page_size
;
224 page_size
= getpagesize();
225 start
= (unsigned long)addr
;
226 start
&= ~(page_size
- 1);
228 end
= (unsigned long)addr
+ size
;
229 end
+= page_size
- 1;
230 end
&= ~(page_size
- 1);
232 mprotect((void *)start
, end
- start
,
233 PROT_READ
| PROT_WRITE
| PROT_EXEC
);
237 static void page_init(void)
239 /* NOTE: we can always suppose that qemu_host_page_size >=
243 SYSTEM_INFO system_info
;
245 GetSystemInfo(&system_info
);
246 qemu_real_host_page_size
= system_info
.dwPageSize
;
249 qemu_real_host_page_size
= getpagesize();
251 if (qemu_host_page_size
== 0)
252 qemu_host_page_size
= qemu_real_host_page_size
;
253 if (qemu_host_page_size
< TARGET_PAGE_SIZE
)
254 qemu_host_page_size
= TARGET_PAGE_SIZE
;
255 qemu_host_page_bits
= 0;
256 while ((1 << qemu_host_page_bits
) < qemu_host_page_size
)
257 qemu_host_page_bits
++;
258 qemu_host_page_mask
= ~(qemu_host_page_size
- 1);
259 #if !defined(CONFIG_USER_ONLY)
260 l1_phys_map
= qemu_vmalloc(L1_SIZE
* sizeof(void *));
261 memset(l1_phys_map
, 0, L1_SIZE
* sizeof(void *));
264 #if !defined(_WIN32) && defined(CONFIG_USER_ONLY)
266 long long startaddr
, endaddr
;
271 last_brk
= (unsigned long)sbrk(0);
272 f
= fopen("/proc/self/maps", "r");
275 n
= fscanf (f
, "%llx-%llx %*[^\n]\n", &startaddr
, &endaddr
);
277 startaddr
= MIN(startaddr
,
278 (1ULL << TARGET_PHYS_ADDR_SPACE_BITS
) - 1);
279 endaddr
= MIN(endaddr
,
280 (1ULL << TARGET_PHYS_ADDR_SPACE_BITS
) - 1);
281 page_set_flags(startaddr
& TARGET_PAGE_MASK
,
282 TARGET_PAGE_ALIGN(endaddr
),
293 static inline PageDesc
**page_l1_map(target_ulong index
)
295 #if TARGET_LONG_BITS > 32
296 /* Host memory outside guest VM. For 32-bit targets we have already
297 excluded high addresses. */
298 if (index
> ((target_ulong
)L2_SIZE
* L1_SIZE
))
301 return &l1_map
[index
>> L2_BITS
];
304 static inline PageDesc
*page_find_alloc(target_ulong index
)
307 lp
= page_l1_map(index
);
313 /* allocate if not found */
314 #if defined(CONFIG_USER_ONLY)
315 size_t len
= sizeof(PageDesc
) * L2_SIZE
;
316 /* Don't use qemu_malloc because it may recurse. */
317 p
= mmap(NULL
, len
, PROT_READ
| PROT_WRITE
,
318 MAP_PRIVATE
| MAP_ANONYMOUS
, -1, 0);
321 unsigned long addr
= h2g(p
);
322 page_set_flags(addr
& TARGET_PAGE_MASK
,
323 TARGET_PAGE_ALIGN(addr
+ len
),
327 p
= qemu_mallocz(sizeof(PageDesc
) * L2_SIZE
);
331 return p
+ (index
& (L2_SIZE
- 1));
334 static inline PageDesc
*page_find(target_ulong index
)
337 lp
= page_l1_map(index
);
345 return p
+ (index
& (L2_SIZE
- 1));
348 #if !defined(CONFIG_USER_ONLY)
349 static PhysPageDesc
*phys_page_find_alloc(target_phys_addr_t index
, int alloc
)
354 p
= (void **)l1_phys_map
;
355 #if TARGET_PHYS_ADDR_SPACE_BITS > 32
357 #if TARGET_PHYS_ADDR_SPACE_BITS > (32 + L1_BITS)
358 #error unsupported TARGET_PHYS_ADDR_SPACE_BITS
360 lp
= p
+ ((index
>> (L1_BITS
+ L2_BITS
)) & (L1_SIZE
- 1));
363 /* allocate if not found */
366 p
= qemu_vmalloc(sizeof(void *) * L1_SIZE
);
367 memset(p
, 0, sizeof(void *) * L1_SIZE
);
371 lp
= p
+ ((index
>> L2_BITS
) & (L1_SIZE
- 1));
375 /* allocate if not found */
378 pd
= qemu_vmalloc(sizeof(PhysPageDesc
) * L2_SIZE
);
380 for (i
= 0; i
< L2_SIZE
; i
++) {
381 pd
[i
].phys_offset
= IO_MEM_UNASSIGNED
;
382 pd
[i
].region_offset
= (index
+ i
) << TARGET_PAGE_BITS
;
385 return ((PhysPageDesc
*)pd
) + (index
& (L2_SIZE
- 1));
388 static inline PhysPageDesc
*phys_page_find(target_phys_addr_t index
)
390 return phys_page_find_alloc(index
, 0);
393 static void tlb_protect_code(ram_addr_t ram_addr
);
394 static void tlb_unprotect_code_phys(CPUState
*env
, ram_addr_t ram_addr
,
396 #define mmap_lock() do { } while(0)
397 #define mmap_unlock() do { } while(0)
400 #define DEFAULT_CODE_GEN_BUFFER_SIZE (32 * 1024 * 1024)
402 #if defined(CONFIG_USER_ONLY)
403 /* Currently it is not recommended to allocate big chunks of data in
404 user mode. It will change when a dedicated libc will be used */
405 #define USE_STATIC_CODE_GEN_BUFFER
408 #ifdef USE_STATIC_CODE_GEN_BUFFER
409 static uint8_t static_code_gen_buffer
[DEFAULT_CODE_GEN_BUFFER_SIZE
];
412 static void code_gen_alloc(unsigned long tb_size
)
414 #ifdef USE_STATIC_CODE_GEN_BUFFER
415 code_gen_buffer
= static_code_gen_buffer
;
416 code_gen_buffer_size
= DEFAULT_CODE_GEN_BUFFER_SIZE
;
417 map_exec(code_gen_buffer
, code_gen_buffer_size
);
419 code_gen_buffer_size
= tb_size
;
420 if (code_gen_buffer_size
== 0) {
421 #if defined(CONFIG_USER_ONLY)
422 /* in user mode, phys_ram_size is not meaningful */
423 code_gen_buffer_size
= DEFAULT_CODE_GEN_BUFFER_SIZE
;
425 /* XXX: needs adjustments */
426 code_gen_buffer_size
= (unsigned long)(ram_size
/ 4);
429 if (code_gen_buffer_size
< MIN_CODE_GEN_BUFFER_SIZE
)
430 code_gen_buffer_size
= MIN_CODE_GEN_BUFFER_SIZE
;
431 /* The code gen buffer location may have constraints depending on
432 the host cpu and OS */
433 #if defined(__linux__)
438 flags
= MAP_PRIVATE
| MAP_ANONYMOUS
;
439 #if defined(__x86_64__)
441 /* Cannot map more than that */
442 if (code_gen_buffer_size
> (800 * 1024 * 1024))
443 code_gen_buffer_size
= (800 * 1024 * 1024);
444 #elif defined(__sparc_v9__)
445 // Map the buffer below 2G, so we can use direct calls and branches
447 start
= (void *) 0x60000000UL
;
448 if (code_gen_buffer_size
> (512 * 1024 * 1024))
449 code_gen_buffer_size
= (512 * 1024 * 1024);
450 #elif defined(__arm__)
451 /* Map the buffer below 32M, so we can use direct calls and branches */
453 start
= (void *) 0x01000000UL
;
454 if (code_gen_buffer_size
> 16 * 1024 * 1024)
455 code_gen_buffer_size
= 16 * 1024 * 1024;
457 code_gen_buffer
= mmap(start
, code_gen_buffer_size
,
458 PROT_WRITE
| PROT_READ
| PROT_EXEC
,
460 if (code_gen_buffer
== MAP_FAILED
) {
461 fprintf(stderr
, "Could not allocate dynamic translator buffer\n");
465 #elif defined(__FreeBSD__) || defined(__FreeBSD_kernel__) || defined(__DragonFly__)
469 flags
= MAP_PRIVATE
| MAP_ANONYMOUS
;
470 #if defined(__x86_64__)
471 /* FreeBSD doesn't have MAP_32BIT, use MAP_FIXED and assume
472 * 0x40000000 is free */
474 addr
= (void *)0x40000000;
475 /* Cannot map more than that */
476 if (code_gen_buffer_size
> (800 * 1024 * 1024))
477 code_gen_buffer_size
= (800 * 1024 * 1024);
479 code_gen_buffer
= mmap(addr
, code_gen_buffer_size
,
480 PROT_WRITE
| PROT_READ
| PROT_EXEC
,
482 if (code_gen_buffer
== MAP_FAILED
) {
483 fprintf(stderr
, "Could not allocate dynamic translator buffer\n");
488 code_gen_buffer
= qemu_malloc(code_gen_buffer_size
);
489 map_exec(code_gen_buffer
, code_gen_buffer_size
);
491 #endif /* !USE_STATIC_CODE_GEN_BUFFER */
492 map_exec(code_gen_prologue
, sizeof(code_gen_prologue
));
493 code_gen_buffer_max_size
= code_gen_buffer_size
-
494 code_gen_max_block_size();
495 code_gen_max_blocks
= code_gen_buffer_size
/ CODE_GEN_AVG_BLOCK_SIZE
;
496 tbs
= qemu_malloc(code_gen_max_blocks
* sizeof(TranslationBlock
));
499 /* Must be called before using the QEMU cpus. 'tb_size' is the size
500 (in bytes) allocated to the translation buffer. Zero means default
502 void cpu_exec_init_all(unsigned long tb_size
)
505 code_gen_alloc(tb_size
);
506 code_gen_ptr
= code_gen_buffer
;
508 #if !defined(CONFIG_USER_ONLY)
513 #if defined(CPU_SAVE_VERSION) && !defined(CONFIG_USER_ONLY)
515 static void cpu_common_pre_save(void *opaque
)
517 CPUState
*env
= opaque
;
519 cpu_synchronize_state(env
);
522 static int cpu_common_pre_load(void *opaque
)
524 CPUState
*env
= opaque
;
526 cpu_synchronize_state(env
);
530 static int cpu_common_post_load(void *opaque
, int version_id
)
532 CPUState
*env
= opaque
;
534 /* 0x01 was CPU_INTERRUPT_EXIT. This line can be removed when the
535 version_id is increased. */
536 env
->interrupt_request
&= ~0x01;
542 static const VMStateDescription vmstate_cpu_common
= {
543 .name
= "cpu_common",
545 .minimum_version_id
= 1,
546 .minimum_version_id_old
= 1,
547 .pre_save
= cpu_common_pre_save
,
548 .pre_load
= cpu_common_pre_load
,
549 .post_load
= cpu_common_post_load
,
550 .fields
= (VMStateField
[]) {
551 VMSTATE_UINT32(halted
, CPUState
),
552 VMSTATE_UINT32(interrupt_request
, CPUState
),
553 VMSTATE_END_OF_LIST()
558 CPUState
*qemu_get_cpu(int cpu
)
560 CPUState
*env
= first_cpu
;
563 if (env
->cpu_index
== cpu
)
571 void cpu_exec_init(CPUState
*env
)
576 #if defined(CONFIG_USER_ONLY)
579 env
->next_cpu
= NULL
;
582 while (*penv
!= NULL
) {
583 penv
= &(*penv
)->next_cpu
;
586 env
->cpu_index
= cpu_index
;
588 QTAILQ_INIT(&env
->breakpoints
);
589 QTAILQ_INIT(&env
->watchpoints
);
591 #if defined(CONFIG_USER_ONLY)
594 #if defined(CPU_SAVE_VERSION) && !defined(CONFIG_USER_ONLY)
595 vmstate_register(cpu_index
, &vmstate_cpu_common
, env
);
596 register_savevm("cpu", cpu_index
, CPU_SAVE_VERSION
,
597 cpu_save
, cpu_load
, env
);
601 static inline void invalidate_page_bitmap(PageDesc
*p
)
603 if (p
->code_bitmap
) {
604 qemu_free(p
->code_bitmap
);
605 p
->code_bitmap
= NULL
;
607 p
->code_write_count
= 0;
610 /* set to NULL all the 'first_tb' fields in all PageDescs */
611 static void page_flush_tb(void)
616 for(i
= 0; i
< L1_SIZE
; i
++) {
619 for(j
= 0; j
< L2_SIZE
; j
++) {
621 invalidate_page_bitmap(p
);
628 /* flush all the translation blocks */
629 /* XXX: tb_flush is currently not thread safe */
630 void tb_flush(CPUState
*env1
)
633 #if defined(DEBUG_FLUSH)
634 printf("qemu: flush code_size=%ld nb_tbs=%d avg_tb_size=%ld\n",
635 (unsigned long)(code_gen_ptr
- code_gen_buffer
),
637 ((unsigned long)(code_gen_ptr
- code_gen_buffer
)) / nb_tbs
: 0);
639 if ((unsigned long)(code_gen_ptr
- code_gen_buffer
) > code_gen_buffer_size
)
640 cpu_abort(env1
, "Internal error: code buffer overflow\n");
644 for(env
= first_cpu
; env
!= NULL
; env
= env
->next_cpu
) {
645 memset (env
->tb_jmp_cache
, 0, TB_JMP_CACHE_SIZE
* sizeof (void *));
648 memset (tb_phys_hash
, 0, CODE_GEN_PHYS_HASH_SIZE
* sizeof (void *));
651 code_gen_ptr
= code_gen_buffer
;
652 /* XXX: flush processor icache at this point if cache flush is
657 #ifdef DEBUG_TB_CHECK
659 static void tb_invalidate_check(target_ulong address
)
661 TranslationBlock
*tb
;
663 address
&= TARGET_PAGE_MASK
;
664 for(i
= 0;i
< CODE_GEN_PHYS_HASH_SIZE
; i
++) {
665 for(tb
= tb_phys_hash
[i
]; tb
!= NULL
; tb
= tb
->phys_hash_next
) {
666 if (!(address
+ TARGET_PAGE_SIZE
<= tb
->pc
||
667 address
>= tb
->pc
+ tb
->size
)) {
668 printf("ERROR invalidate: address=" TARGET_FMT_lx
669 " PC=%08lx size=%04x\n",
670 address
, (long)tb
->pc
, tb
->size
);
676 /* verify that all the pages have correct rights for code */
677 static void tb_page_check(void)
679 TranslationBlock
*tb
;
680 int i
, flags1
, flags2
;
682 for(i
= 0;i
< CODE_GEN_PHYS_HASH_SIZE
; i
++) {
683 for(tb
= tb_phys_hash
[i
]; tb
!= NULL
; tb
= tb
->phys_hash_next
) {
684 flags1
= page_get_flags(tb
->pc
);
685 flags2
= page_get_flags(tb
->pc
+ tb
->size
- 1);
686 if ((flags1
& PAGE_WRITE
) || (flags2
& PAGE_WRITE
)) {
687 printf("ERROR page flags: PC=%08lx size=%04x f1=%x f2=%x\n",
688 (long)tb
->pc
, tb
->size
, flags1
, flags2
);
696 /* invalidate one TB */
697 static inline void tb_remove(TranslationBlock
**ptb
, TranslationBlock
*tb
,
700 TranslationBlock
*tb1
;
704 *ptb
= *(TranslationBlock
**)((char *)tb1
+ next_offset
);
707 ptb
= (TranslationBlock
**)((char *)tb1
+ next_offset
);
711 static inline void tb_page_remove(TranslationBlock
**ptb
, TranslationBlock
*tb
)
713 TranslationBlock
*tb1
;
719 tb1
= (TranslationBlock
*)((long)tb1
& ~3);
721 *ptb
= tb1
->page_next
[n1
];
724 ptb
= &tb1
->page_next
[n1
];
728 static inline void tb_jmp_remove(TranslationBlock
*tb
, int n
)
730 TranslationBlock
*tb1
, **ptb
;
733 ptb
= &tb
->jmp_next
[n
];
736 /* find tb(n) in circular list */
740 tb1
= (TranslationBlock
*)((long)tb1
& ~3);
741 if (n1
== n
&& tb1
== tb
)
744 ptb
= &tb1
->jmp_first
;
746 ptb
= &tb1
->jmp_next
[n1
];
749 /* now we can suppress tb(n) from the list */
750 *ptb
= tb
->jmp_next
[n
];
752 tb
->jmp_next
[n
] = NULL
;
756 /* reset the jump entry 'n' of a TB so that it is not chained to
758 static inline void tb_reset_jump(TranslationBlock
*tb
, int n
)
760 tb_set_jmp_target(tb
, n
, (unsigned long)(tb
->tc_ptr
+ tb
->tb_next_offset
[n
]));
763 void tb_phys_invalidate(TranslationBlock
*tb
, target_ulong page_addr
)
768 target_phys_addr_t phys_pc
;
769 TranslationBlock
*tb1
, *tb2
;
771 /* remove the TB from the hash list */
772 phys_pc
= tb
->page_addr
[0] + (tb
->pc
& ~TARGET_PAGE_MASK
);
773 h
= tb_phys_hash_func(phys_pc
);
774 tb_remove(&tb_phys_hash
[h
], tb
,
775 offsetof(TranslationBlock
, phys_hash_next
));
777 /* remove the TB from the page list */
778 if (tb
->page_addr
[0] != page_addr
) {
779 p
= page_find(tb
->page_addr
[0] >> TARGET_PAGE_BITS
);
780 tb_page_remove(&p
->first_tb
, tb
);
781 invalidate_page_bitmap(p
);
783 if (tb
->page_addr
[1] != -1 && tb
->page_addr
[1] != page_addr
) {
784 p
= page_find(tb
->page_addr
[1] >> TARGET_PAGE_BITS
);
785 tb_page_remove(&p
->first_tb
, tb
);
786 invalidate_page_bitmap(p
);
789 tb_invalidated_flag
= 1;
791 /* remove the TB from the hash list */
792 h
= tb_jmp_cache_hash_func(tb
->pc
);
793 for(env
= first_cpu
; env
!= NULL
; env
= env
->next_cpu
) {
794 if (env
->tb_jmp_cache
[h
] == tb
)
795 env
->tb_jmp_cache
[h
] = NULL
;
798 /* suppress this TB from the two jump lists */
799 tb_jmp_remove(tb
, 0);
800 tb_jmp_remove(tb
, 1);
802 /* suppress any remaining jumps to this TB */
808 tb1
= (TranslationBlock
*)((long)tb1
& ~3);
809 tb2
= tb1
->jmp_next
[n1
];
810 tb_reset_jump(tb1
, n1
);
811 tb1
->jmp_next
[n1
] = NULL
;
814 tb
->jmp_first
= (TranslationBlock
*)((long)tb
| 2); /* fail safe */
816 tb_phys_invalidate_count
++;
819 static inline void set_bits(uint8_t *tab
, int start
, int len
)
825 mask
= 0xff << (start
& 7);
826 if ((start
& ~7) == (end
& ~7)) {
828 mask
&= ~(0xff << (end
& 7));
833 start
= (start
+ 8) & ~7;
835 while (start
< end1
) {
840 mask
= ~(0xff << (end
& 7));
846 static void build_page_bitmap(PageDesc
*p
)
848 int n
, tb_start
, tb_end
;
849 TranslationBlock
*tb
;
851 p
->code_bitmap
= qemu_mallocz(TARGET_PAGE_SIZE
/ 8);
856 tb
= (TranslationBlock
*)((long)tb
& ~3);
857 /* NOTE: this is subtle as a TB may span two physical pages */
859 /* NOTE: tb_end may be after the end of the page, but
860 it is not a problem */
861 tb_start
= tb
->pc
& ~TARGET_PAGE_MASK
;
862 tb_end
= tb_start
+ tb
->size
;
863 if (tb_end
> TARGET_PAGE_SIZE
)
864 tb_end
= TARGET_PAGE_SIZE
;
867 tb_end
= ((tb
->pc
+ tb
->size
) & ~TARGET_PAGE_MASK
);
869 set_bits(p
->code_bitmap
, tb_start
, tb_end
- tb_start
);
870 tb
= tb
->page_next
[n
];
874 TranslationBlock
*tb_gen_code(CPUState
*env
,
875 target_ulong pc
, target_ulong cs_base
,
876 int flags
, int cflags
)
878 TranslationBlock
*tb
;
880 target_ulong phys_pc
, phys_page2
, virt_page2
;
883 phys_pc
= get_phys_addr_code(env
, pc
);
886 /* flush must be done */
888 /* cannot fail at this point */
890 /* Don't forget to invalidate previous TB info. */
891 tb_invalidated_flag
= 1;
893 tc_ptr
= code_gen_ptr
;
895 tb
->cs_base
= cs_base
;
898 cpu_gen_code(env
, tb
, &code_gen_size
);
899 code_gen_ptr
= (void *)(((unsigned long)code_gen_ptr
+ code_gen_size
+ CODE_GEN_ALIGN
- 1) & ~(CODE_GEN_ALIGN
- 1));
901 /* check next page if needed */
902 virt_page2
= (pc
+ tb
->size
- 1) & TARGET_PAGE_MASK
;
904 if ((pc
& TARGET_PAGE_MASK
) != virt_page2
) {
905 phys_page2
= get_phys_addr_code(env
, virt_page2
);
907 tb_link_phys(tb
, phys_pc
, phys_page2
);
911 /* invalidate all TBs which intersect with the target physical page
912 starting in range [start;end[. NOTE: start and end must refer to
913 the same physical page. 'is_cpu_write_access' should be true if called
914 from a real cpu write access: the virtual CPU will exit the current
915 TB if code is modified inside this TB. */
916 void tb_invalidate_phys_page_range(target_phys_addr_t start
, target_phys_addr_t end
,
917 int is_cpu_write_access
)
919 TranslationBlock
*tb
, *tb_next
, *saved_tb
;
920 CPUState
*env
= cpu_single_env
;
921 target_ulong tb_start
, tb_end
;
924 #ifdef TARGET_HAS_PRECISE_SMC
925 int current_tb_not_found
= is_cpu_write_access
;
926 TranslationBlock
*current_tb
= NULL
;
927 int current_tb_modified
= 0;
928 target_ulong current_pc
= 0;
929 target_ulong current_cs_base
= 0;
930 int current_flags
= 0;
931 #endif /* TARGET_HAS_PRECISE_SMC */
933 p
= page_find(start
>> TARGET_PAGE_BITS
);
936 if (!p
->code_bitmap
&&
937 ++p
->code_write_count
>= SMC_BITMAP_USE_THRESHOLD
&&
938 is_cpu_write_access
) {
939 /* build code bitmap */
940 build_page_bitmap(p
);
943 /* we remove all the TBs in the range [start, end[ */
944 /* XXX: see if in some cases it could be faster to invalidate all the code */
948 tb
= (TranslationBlock
*)((long)tb
& ~3);
949 tb_next
= tb
->page_next
[n
];
950 /* NOTE: this is subtle as a TB may span two physical pages */
952 /* NOTE: tb_end may be after the end of the page, but
953 it is not a problem */
954 tb_start
= tb
->page_addr
[0] + (tb
->pc
& ~TARGET_PAGE_MASK
);
955 tb_end
= tb_start
+ tb
->size
;
957 tb_start
= tb
->page_addr
[1];
958 tb_end
= tb_start
+ ((tb
->pc
+ tb
->size
) & ~TARGET_PAGE_MASK
);
960 if (!(tb_end
<= start
|| tb_start
>= end
)) {
961 #ifdef TARGET_HAS_PRECISE_SMC
962 if (current_tb_not_found
) {
963 current_tb_not_found
= 0;
965 if (env
->mem_io_pc
) {
966 /* now we have a real cpu fault */
967 current_tb
= tb_find_pc(env
->mem_io_pc
);
970 if (current_tb
== tb
&&
971 (current_tb
->cflags
& CF_COUNT_MASK
) != 1) {
972 /* If we are modifying the current TB, we must stop
973 its execution. We could be more precise by checking
974 that the modification is after the current PC, but it
975 would require a specialized function to partially
976 restore the CPU state */
978 current_tb_modified
= 1;
979 cpu_restore_state(current_tb
, env
,
980 env
->mem_io_pc
, NULL
);
981 cpu_get_tb_cpu_state(env
, ¤t_pc
, ¤t_cs_base
,
984 #endif /* TARGET_HAS_PRECISE_SMC */
985 /* we need to do that to handle the case where a signal
986 occurs while doing tb_phys_invalidate() */
989 saved_tb
= env
->current_tb
;
990 env
->current_tb
= NULL
;
992 tb_phys_invalidate(tb
, -1);
994 env
->current_tb
= saved_tb
;
995 if (env
->interrupt_request
&& env
->current_tb
)
996 cpu_interrupt(env
, env
->interrupt_request
);
1001 #if !defined(CONFIG_USER_ONLY)
1002 /* if no code remaining, no need to continue to use slow writes */
1004 invalidate_page_bitmap(p
);
1005 if (is_cpu_write_access
) {
1006 tlb_unprotect_code_phys(env
, start
, env
->mem_io_vaddr
);
1010 #ifdef TARGET_HAS_PRECISE_SMC
1011 if (current_tb_modified
) {
1012 /* we generate a block containing just the instruction
1013 modifying the memory. It will ensure that it cannot modify
1015 env
->current_tb
= NULL
;
1016 tb_gen_code(env
, current_pc
, current_cs_base
, current_flags
, 1);
1017 cpu_resume_from_signal(env
, NULL
);
1022 /* len must be <= 8 and start must be a multiple of len */
1023 static inline void tb_invalidate_phys_page_fast(target_phys_addr_t start
, int len
)
1029 qemu_log("modifying code at 0x%x size=%d EIP=%x PC=%08x\n",
1030 cpu_single_env
->mem_io_vaddr
, len
,
1031 cpu_single_env
->eip
,
1032 cpu_single_env
->eip
+ (long)cpu_single_env
->segs
[R_CS
].base
);
1035 p
= page_find(start
>> TARGET_PAGE_BITS
);
1038 if (p
->code_bitmap
) {
1039 offset
= start
& ~TARGET_PAGE_MASK
;
1040 b
= p
->code_bitmap
[offset
>> 3] >> (offset
& 7);
1041 if (b
& ((1 << len
) - 1))
1045 tb_invalidate_phys_page_range(start
, start
+ len
, 1);
1049 #if !defined(CONFIG_SOFTMMU)
1050 static void tb_invalidate_phys_page(target_phys_addr_t addr
,
1051 unsigned long pc
, void *puc
)
1053 TranslationBlock
*tb
;
1056 #ifdef TARGET_HAS_PRECISE_SMC
1057 TranslationBlock
*current_tb
= NULL
;
1058 CPUState
*env
= cpu_single_env
;
1059 int current_tb_modified
= 0;
1060 target_ulong current_pc
= 0;
1061 target_ulong current_cs_base
= 0;
1062 int current_flags
= 0;
1065 addr
&= TARGET_PAGE_MASK
;
1066 p
= page_find(addr
>> TARGET_PAGE_BITS
);
1070 #ifdef TARGET_HAS_PRECISE_SMC
1071 if (tb
&& pc
!= 0) {
1072 current_tb
= tb_find_pc(pc
);
1075 while (tb
!= NULL
) {
1077 tb
= (TranslationBlock
*)((long)tb
& ~3);
1078 #ifdef TARGET_HAS_PRECISE_SMC
1079 if (current_tb
== tb
&&
1080 (current_tb
->cflags
& CF_COUNT_MASK
) != 1) {
1081 /* If we are modifying the current TB, we must stop
1082 its execution. We could be more precise by checking
1083 that the modification is after the current PC, but it
1084 would require a specialized function to partially
1085 restore the CPU state */
1087 current_tb_modified
= 1;
1088 cpu_restore_state(current_tb
, env
, pc
, puc
);
1089 cpu_get_tb_cpu_state(env
, ¤t_pc
, ¤t_cs_base
,
1092 #endif /* TARGET_HAS_PRECISE_SMC */
1093 tb_phys_invalidate(tb
, addr
);
1094 tb
= tb
->page_next
[n
];
1097 #ifdef TARGET_HAS_PRECISE_SMC
1098 if (current_tb_modified
) {
1099 /* we generate a block containing just the instruction
1100 modifying the memory. It will ensure that it cannot modify
1102 env
->current_tb
= NULL
;
1103 tb_gen_code(env
, current_pc
, current_cs_base
, current_flags
, 1);
1104 cpu_resume_from_signal(env
, puc
);
1110 /* add the tb in the target page and protect it if necessary */
1111 static inline void tb_alloc_page(TranslationBlock
*tb
,
1112 unsigned int n
, target_ulong page_addr
)
1115 TranslationBlock
*last_first_tb
;
1117 tb
->page_addr
[n
] = page_addr
;
1118 p
= page_find_alloc(page_addr
>> TARGET_PAGE_BITS
);
1119 tb
->page_next
[n
] = p
->first_tb
;
1120 last_first_tb
= p
->first_tb
;
1121 p
->first_tb
= (TranslationBlock
*)((long)tb
| n
);
1122 invalidate_page_bitmap(p
);
1124 #if defined(TARGET_HAS_SMC) || 1
1126 #if defined(CONFIG_USER_ONLY)
1127 if (p
->flags
& PAGE_WRITE
) {
1132 /* force the host page as non writable (writes will have a
1133 page fault + mprotect overhead) */
1134 page_addr
&= qemu_host_page_mask
;
1136 for(addr
= page_addr
; addr
< page_addr
+ qemu_host_page_size
;
1137 addr
+= TARGET_PAGE_SIZE
) {
1139 p2
= page_find (addr
>> TARGET_PAGE_BITS
);
1143 p2
->flags
&= ~PAGE_WRITE
;
1144 page_get_flags(addr
);
1146 mprotect(g2h(page_addr
), qemu_host_page_size
,
1147 (prot
& PAGE_BITS
) & ~PAGE_WRITE
);
1148 #ifdef DEBUG_TB_INVALIDATE
1149 printf("protecting code page: 0x" TARGET_FMT_lx
"\n",
1154 /* if some code is already present, then the pages are already
1155 protected. So we handle the case where only the first TB is
1156 allocated in a physical page */
1157 if (!last_first_tb
) {
1158 tlb_protect_code(page_addr
);
1162 #endif /* TARGET_HAS_SMC */
1165 /* Allocate a new translation block. Flush the translation buffer if
1166 too many translation blocks or too much generated code. */
1167 TranslationBlock
*tb_alloc(target_ulong pc
)
1169 TranslationBlock
*tb
;
1171 if (nb_tbs
>= code_gen_max_blocks
||
1172 (code_gen_ptr
- code_gen_buffer
) >= code_gen_buffer_max_size
)
1174 tb
= &tbs
[nb_tbs
++];
1180 void tb_free(TranslationBlock
*tb
)
1182 /* In practice this is mostly used for single use temporary TB
1183 Ignore the hard cases and just back up if this TB happens to
1184 be the last one generated. */
1185 if (nb_tbs
> 0 && tb
== &tbs
[nb_tbs
- 1]) {
1186 code_gen_ptr
= tb
->tc_ptr
;
1191 /* add a new TB and link it to the physical page tables. phys_page2 is
1192 (-1) to indicate that only one page contains the TB. */
1193 void tb_link_phys(TranslationBlock
*tb
,
1194 target_ulong phys_pc
, target_ulong phys_page2
)
1197 TranslationBlock
**ptb
;
1199 /* Grab the mmap lock to stop another thread invalidating this TB
1200 before we are done. */
1202 /* add in the physical hash table */
1203 h
= tb_phys_hash_func(phys_pc
);
1204 ptb
= &tb_phys_hash
[h
];
1205 tb
->phys_hash_next
= *ptb
;
1208 /* add in the page list */
1209 tb_alloc_page(tb
, 0, phys_pc
& TARGET_PAGE_MASK
);
1210 if (phys_page2
!= -1)
1211 tb_alloc_page(tb
, 1, phys_page2
);
1213 tb
->page_addr
[1] = -1;
1215 tb
->jmp_first
= (TranslationBlock
*)((long)tb
| 2);
1216 tb
->jmp_next
[0] = NULL
;
1217 tb
->jmp_next
[1] = NULL
;
1219 /* init original jump addresses */
1220 if (tb
->tb_next_offset
[0] != 0xffff)
1221 tb_reset_jump(tb
, 0);
1222 if (tb
->tb_next_offset
[1] != 0xffff)
1223 tb_reset_jump(tb
, 1);
1225 #ifdef DEBUG_TB_CHECK
1231 /* find the TB 'tb' such that tb[0].tc_ptr <= tc_ptr <
1232 tb[1].tc_ptr. Return NULL if not found */
1233 TranslationBlock
*tb_find_pc(unsigned long tc_ptr
)
1235 int m_min
, m_max
, m
;
1237 TranslationBlock
*tb
;
1241 if (tc_ptr
< (unsigned long)code_gen_buffer
||
1242 tc_ptr
>= (unsigned long)code_gen_ptr
)
1244 /* binary search (cf Knuth) */
1247 while (m_min
<= m_max
) {
1248 m
= (m_min
+ m_max
) >> 1;
1250 v
= (unsigned long)tb
->tc_ptr
;
1253 else if (tc_ptr
< v
) {
1262 static void tb_reset_jump_recursive(TranslationBlock
*tb
);
1264 static inline void tb_reset_jump_recursive2(TranslationBlock
*tb
, int n
)
1266 TranslationBlock
*tb1
, *tb_next
, **ptb
;
1269 tb1
= tb
->jmp_next
[n
];
1271 /* find head of list */
1274 tb1
= (TranslationBlock
*)((long)tb1
& ~3);
1277 tb1
= tb1
->jmp_next
[n1
];
1279 /* we are now sure now that tb jumps to tb1 */
1282 /* remove tb from the jmp_first list */
1283 ptb
= &tb_next
->jmp_first
;
1287 tb1
= (TranslationBlock
*)((long)tb1
& ~3);
1288 if (n1
== n
&& tb1
== tb
)
1290 ptb
= &tb1
->jmp_next
[n1
];
1292 *ptb
= tb
->jmp_next
[n
];
1293 tb
->jmp_next
[n
] = NULL
;
1295 /* suppress the jump to next tb in generated code */
1296 tb_reset_jump(tb
, n
);
1298 /* suppress jumps in the tb on which we could have jumped */
1299 tb_reset_jump_recursive(tb_next
);
1303 static void tb_reset_jump_recursive(TranslationBlock
*tb
)
1305 tb_reset_jump_recursive2(tb
, 0);
1306 tb_reset_jump_recursive2(tb
, 1);
1309 #if defined(TARGET_HAS_ICE)
1310 #if defined(CONFIG_USER_ONLY)
1311 static void breakpoint_invalidate(CPUState
*env
, target_ulong pc
)
1313 tb_invalidate_phys_page_range(pc
, pc
+ 1, 0);
1316 static void breakpoint_invalidate(CPUState
*env
, target_ulong pc
)
1318 target_phys_addr_t addr
;
1320 ram_addr_t ram_addr
;
1323 addr
= cpu_get_phys_page_debug(env
, pc
);
1324 p
= phys_page_find(addr
>> TARGET_PAGE_BITS
);
1326 pd
= IO_MEM_UNASSIGNED
;
1328 pd
= p
->phys_offset
;
1330 ram_addr
= (pd
& TARGET_PAGE_MASK
) | (pc
& ~TARGET_PAGE_MASK
);
1331 tb_invalidate_phys_page_range(ram_addr
, ram_addr
+ 1, 0);
1334 #endif /* TARGET_HAS_ICE */
1336 /* Add a watchpoint. */
1337 int cpu_watchpoint_insert(CPUState
*env
, target_ulong addr
, target_ulong len
,
1338 int flags
, CPUWatchpoint
**watchpoint
)
1340 target_ulong len_mask
= ~(len
- 1);
1343 /* sanity checks: allow power-of-2 lengths, deny unaligned watchpoints */
1344 if ((len
!= 1 && len
!= 2 && len
!= 4 && len
!= 8) || (addr
& ~len_mask
)) {
1345 fprintf(stderr
, "qemu: tried to set invalid watchpoint at "
1346 TARGET_FMT_lx
", len=" TARGET_FMT_lu
"\n", addr
, len
);
1349 wp
= qemu_malloc(sizeof(*wp
));
1352 wp
->len_mask
= len_mask
;
1355 /* keep all GDB-injected watchpoints in front */
1357 QTAILQ_INSERT_HEAD(&env
->watchpoints
, wp
, entry
);
1359 QTAILQ_INSERT_TAIL(&env
->watchpoints
, wp
, entry
);
1361 tlb_flush_page(env
, addr
);
1368 /* Remove a specific watchpoint. */
1369 int cpu_watchpoint_remove(CPUState
*env
, target_ulong addr
, target_ulong len
,
1372 target_ulong len_mask
= ~(len
- 1);
1375 QTAILQ_FOREACH(wp
, &env
->watchpoints
, entry
) {
1376 if (addr
== wp
->vaddr
&& len_mask
== wp
->len_mask
1377 && flags
== (wp
->flags
& ~BP_WATCHPOINT_HIT
)) {
1378 cpu_watchpoint_remove_by_ref(env
, wp
);
1385 /* Remove a specific watchpoint by reference. */
1386 void cpu_watchpoint_remove_by_ref(CPUState
*env
, CPUWatchpoint
*watchpoint
)
1388 QTAILQ_REMOVE(&env
->watchpoints
, watchpoint
, entry
);
1390 tlb_flush_page(env
, watchpoint
->vaddr
);
1392 qemu_free(watchpoint
);
1395 /* Remove all matching watchpoints. */
1396 void cpu_watchpoint_remove_all(CPUState
*env
, int mask
)
1398 CPUWatchpoint
*wp
, *next
;
1400 QTAILQ_FOREACH_SAFE(wp
, &env
->watchpoints
, entry
, next
) {
1401 if (wp
->flags
& mask
)
1402 cpu_watchpoint_remove_by_ref(env
, wp
);
1406 /* Add a breakpoint. */
1407 int cpu_breakpoint_insert(CPUState
*env
, target_ulong pc
, int flags
,
1408 CPUBreakpoint
**breakpoint
)
1410 #if defined(TARGET_HAS_ICE)
1413 bp
= qemu_malloc(sizeof(*bp
));
1418 /* keep all GDB-injected breakpoints in front */
1420 QTAILQ_INSERT_HEAD(&env
->breakpoints
, bp
, entry
);
1422 QTAILQ_INSERT_TAIL(&env
->breakpoints
, bp
, entry
);
1424 breakpoint_invalidate(env
, pc
);
1434 /* Remove a specific breakpoint. */
1435 int cpu_breakpoint_remove(CPUState
*env
, target_ulong pc
, int flags
)
1437 #if defined(TARGET_HAS_ICE)
1440 QTAILQ_FOREACH(bp
, &env
->breakpoints
, entry
) {
1441 if (bp
->pc
== pc
&& bp
->flags
== flags
) {
1442 cpu_breakpoint_remove_by_ref(env
, bp
);
1452 /* Remove a specific breakpoint by reference. */
1453 void cpu_breakpoint_remove_by_ref(CPUState
*env
, CPUBreakpoint
*breakpoint
)
1455 #if defined(TARGET_HAS_ICE)
1456 QTAILQ_REMOVE(&env
->breakpoints
, breakpoint
, entry
);
1458 breakpoint_invalidate(env
, breakpoint
->pc
);
1460 qemu_free(breakpoint
);
1464 /* Remove all matching breakpoints. */
1465 void cpu_breakpoint_remove_all(CPUState
*env
, int mask
)
1467 #if defined(TARGET_HAS_ICE)
1468 CPUBreakpoint
*bp
, *next
;
1470 QTAILQ_FOREACH_SAFE(bp
, &env
->breakpoints
, entry
, next
) {
1471 if (bp
->flags
& mask
)
1472 cpu_breakpoint_remove_by_ref(env
, bp
);
1477 /* enable or disable single step mode. EXCP_DEBUG is returned by the
1478 CPU loop after each instruction */
1479 void cpu_single_step(CPUState
*env
, int enabled
)
1481 #if defined(TARGET_HAS_ICE)
1482 if (env
->singlestep_enabled
!= enabled
) {
1483 env
->singlestep_enabled
= enabled
;
1485 kvm_update_guest_debug(env
, 0);
1487 /* must flush all the translated code to avoid inconsistencies */
1488 /* XXX: only flush what is necessary */
1495 /* enable or disable low levels log */
1496 void cpu_set_log(int log_flags
)
1498 loglevel
= log_flags
;
1499 if (loglevel
&& !logfile
) {
1500 logfile
= fopen(logfilename
, log_append
? "a" : "w");
1502 perror(logfilename
);
1505 #if !defined(CONFIG_SOFTMMU)
1506 /* must avoid mmap() usage of glibc by setting a buffer "by hand" */
1508 static char logfile_buf
[4096];
1509 setvbuf(logfile
, logfile_buf
, _IOLBF
, sizeof(logfile_buf
));
1511 #elif !defined(_WIN32)
1512 /* Win32 doesn't support line-buffering and requires size >= 2 */
1513 setvbuf(logfile
, NULL
, _IOLBF
, 0);
1517 if (!loglevel
&& logfile
) {
1523 void cpu_set_log_filename(const char *filename
)
1525 logfilename
= strdup(filename
);
1530 cpu_set_log(loglevel
);
1533 static void cpu_unlink_tb(CPUState
*env
)
1535 /* FIXME: TB unchaining isn't SMP safe. For now just ignore the
1536 problem and hope the cpu will stop of its own accord. For userspace
1537 emulation this often isn't actually as bad as it sounds. Often
1538 signals are used primarily to interrupt blocking syscalls. */
1539 TranslationBlock
*tb
;
1540 static spinlock_t interrupt_lock
= SPIN_LOCK_UNLOCKED
;
1542 spin_lock(&interrupt_lock
);
1543 tb
= env
->current_tb
;
1544 /* if the cpu is currently executing code, we must unlink it and
1545 all the potentially executing TB */
1547 env
->current_tb
= NULL
;
1548 tb_reset_jump_recursive(tb
);
1550 spin_unlock(&interrupt_lock
);
1553 /* mask must never be zero, except for A20 change call */
1554 void cpu_interrupt(CPUState
*env
, int mask
)
1558 old_mask
= env
->interrupt_request
;
1559 env
->interrupt_request
|= mask
;
1561 #ifndef CONFIG_USER_ONLY
1563 * If called from iothread context, wake the target cpu in
1566 if (!qemu_cpu_self(env
)) {
1573 env
->icount_decr
.u16
.high
= 0xffff;
1574 #ifndef CONFIG_USER_ONLY
1576 && (mask
& ~old_mask
) != 0) {
1577 cpu_abort(env
, "Raised interrupt while not in I/O function");
1585 void cpu_reset_interrupt(CPUState
*env
, int mask
)
1587 env
->interrupt_request
&= ~mask
;
1590 void cpu_exit(CPUState
*env
)
1592 env
->exit_request
= 1;
1596 const CPULogItem cpu_log_items
[] = {
1597 { CPU_LOG_TB_OUT_ASM
, "out_asm",
1598 "show generated host assembly code for each compiled TB" },
1599 { CPU_LOG_TB_IN_ASM
, "in_asm",
1600 "show target assembly code for each compiled TB" },
1601 { CPU_LOG_TB_OP
, "op",
1602 "show micro ops for each compiled TB" },
1603 { CPU_LOG_TB_OP_OPT
, "op_opt",
1606 "before eflags optimization and "
1608 "after liveness analysis" },
1609 { CPU_LOG_INT
, "int",
1610 "show interrupts/exceptions in short format" },
1611 { CPU_LOG_EXEC
, "exec",
1612 "show trace before each executed TB (lots of logs)" },
1613 { CPU_LOG_TB_CPU
, "cpu",
1614 "show CPU state before block translation" },
1616 { CPU_LOG_PCALL
, "pcall",
1617 "show protected mode far calls/returns/exceptions" },
1618 { CPU_LOG_RESET
, "cpu_reset",
1619 "show CPU state before CPU resets" },
1622 { CPU_LOG_IOPORT
, "ioport",
1623 "show all i/o ports accesses" },
1628 #ifndef CONFIG_USER_ONLY
1629 static QLIST_HEAD(memory_client_list
, CPUPhysMemoryClient
) memory_client_list
1630 = QLIST_HEAD_INITIALIZER(memory_client_list
);
1632 static void cpu_notify_set_memory(target_phys_addr_t start_addr
,
1634 ram_addr_t phys_offset
)
1636 CPUPhysMemoryClient
*client
;
1637 QLIST_FOREACH(client
, &memory_client_list
, list
) {
1638 client
->set_memory(client
, start_addr
, size
, phys_offset
);
1642 static int cpu_notify_sync_dirty_bitmap(target_phys_addr_t start
,
1643 target_phys_addr_t end
)
1645 CPUPhysMemoryClient
*client
;
1646 QLIST_FOREACH(client
, &memory_client_list
, list
) {
1647 int r
= client
->sync_dirty_bitmap(client
, start
, end
);
1654 static int cpu_notify_migration_log(int enable
)
1656 CPUPhysMemoryClient
*client
;
1657 QLIST_FOREACH(client
, &memory_client_list
, list
) {
1658 int r
= client
->migration_log(client
, enable
);
1665 static void phys_page_for_each_in_l1_map(PhysPageDesc
**phys_map
,
1666 CPUPhysMemoryClient
*client
)
1671 for (l1
= 0; l1
< L1_SIZE
; ++l1
) {
1676 for (l2
= 0; l2
< L2_SIZE
; ++l2
) {
1677 if (pd
[l2
].phys_offset
== IO_MEM_UNASSIGNED
) {
1680 client
->set_memory(client
, pd
[l2
].region_offset
,
1681 TARGET_PAGE_SIZE
, pd
[l2
].phys_offset
);
1686 static void phys_page_for_each(CPUPhysMemoryClient
*client
)
1688 #if TARGET_PHYS_ADDR_SPACE_BITS > 32
1690 #if TARGET_PHYS_ADDR_SPACE_BITS > (32 + L1_BITS)
1691 #error unsupported TARGET_PHYS_ADDR_SPACE_BITS
1693 void **phys_map
= (void **)l1_phys_map
;
1698 for (l1
= 0; l1
< L1_SIZE
; ++l1
) {
1700 phys_page_for_each_in_l1_map(phys_map
[l1
], client
);
1707 phys_page_for_each_in_l1_map(l1_phys_map
, client
);
1711 void cpu_register_phys_memory_client(CPUPhysMemoryClient
*client
)
1713 QLIST_INSERT_HEAD(&memory_client_list
, client
, list
);
1714 phys_page_for_each(client
);
1717 void cpu_unregister_phys_memory_client(CPUPhysMemoryClient
*client
)
1719 QLIST_REMOVE(client
, list
);
1723 static int cmp1(const char *s1
, int n
, const char *s2
)
1725 if (strlen(s2
) != n
)
1727 return memcmp(s1
, s2
, n
) == 0;
1730 /* takes a comma separated list of log masks. Return 0 if error. */
1731 int cpu_str_to_log_mask(const char *str
)
1733 const CPULogItem
*item
;
1740 p1
= strchr(p
, ',');
1743 if(cmp1(p
,p1
-p
,"all")) {
1744 for(item
= cpu_log_items
; item
->mask
!= 0; item
++) {
1748 for(item
= cpu_log_items
; item
->mask
!= 0; item
++) {
1749 if (cmp1(p
, p1
- p
, item
->name
))
1763 void cpu_abort(CPUState
*env
, const char *fmt
, ...)
1770 fprintf(stderr
, "qemu: fatal: ");
1771 vfprintf(stderr
, fmt
, ap
);
1772 fprintf(stderr
, "\n");
1774 cpu_dump_state(env
, stderr
, fprintf
, X86_DUMP_FPU
| X86_DUMP_CCOP
);
1776 cpu_dump_state(env
, stderr
, fprintf
, 0);
1778 if (qemu_log_enabled()) {
1779 qemu_log("qemu: fatal: ");
1780 qemu_log_vprintf(fmt
, ap2
);
1783 log_cpu_state(env
, X86_DUMP_FPU
| X86_DUMP_CCOP
);
1785 log_cpu_state(env
, 0);
1792 #if defined(CONFIG_USER_ONLY)
1794 struct sigaction act
;
1795 sigfillset(&act
.sa_mask
);
1796 act
.sa_handler
= SIG_DFL
;
1797 sigaction(SIGABRT
, &act
, NULL
);
1803 CPUState
*cpu_copy(CPUState
*env
)
1805 CPUState
*new_env
= cpu_init(env
->cpu_model_str
);
1806 CPUState
*next_cpu
= new_env
->next_cpu
;
1807 int cpu_index
= new_env
->cpu_index
;
1808 #if defined(TARGET_HAS_ICE)
1813 memcpy(new_env
, env
, sizeof(CPUState
));
1815 /* Preserve chaining and index. */
1816 new_env
->next_cpu
= next_cpu
;
1817 new_env
->cpu_index
= cpu_index
;
1819 /* Clone all break/watchpoints.
1820 Note: Once we support ptrace with hw-debug register access, make sure
1821 BP_CPU break/watchpoints are handled correctly on clone. */
1822 QTAILQ_INIT(&env
->breakpoints
);
1823 QTAILQ_INIT(&env
->watchpoints
);
1824 #if defined(TARGET_HAS_ICE)
1825 QTAILQ_FOREACH(bp
, &env
->breakpoints
, entry
) {
1826 cpu_breakpoint_insert(new_env
, bp
->pc
, bp
->flags
, NULL
);
1828 QTAILQ_FOREACH(wp
, &env
->watchpoints
, entry
) {
1829 cpu_watchpoint_insert(new_env
, wp
->vaddr
, (~wp
->len_mask
) + 1,
1837 #if !defined(CONFIG_USER_ONLY)
1839 static inline void tlb_flush_jmp_cache(CPUState
*env
, target_ulong addr
)
1843 /* Discard jump cache entries for any tb which might potentially
1844 overlap the flushed page. */
1845 i
= tb_jmp_cache_hash_page(addr
- TARGET_PAGE_SIZE
);
1846 memset (&env
->tb_jmp_cache
[i
], 0,
1847 TB_JMP_PAGE_SIZE
* sizeof(TranslationBlock
*));
1849 i
= tb_jmp_cache_hash_page(addr
);
1850 memset (&env
->tb_jmp_cache
[i
], 0,
1851 TB_JMP_PAGE_SIZE
* sizeof(TranslationBlock
*));
1854 static CPUTLBEntry s_cputlb_empty_entry
= {
1861 /* NOTE: if flush_global is true, also flush global entries (not
1863 void tlb_flush(CPUState
*env
, int flush_global
)
1867 #if defined(DEBUG_TLB)
1868 printf("tlb_flush:\n");
1870 /* must reset current TB so that interrupts cannot modify the
1871 links while we are modifying them */
1872 env
->current_tb
= NULL
;
1874 for(i
= 0; i
< CPU_TLB_SIZE
; i
++) {
1876 for (mmu_idx
= 0; mmu_idx
< NB_MMU_MODES
; mmu_idx
++) {
1877 env
->tlb_table
[mmu_idx
][i
] = s_cputlb_empty_entry
;
1881 memset (env
->tb_jmp_cache
, 0, TB_JMP_CACHE_SIZE
* sizeof (void *));
1886 static inline void tlb_flush_entry(CPUTLBEntry
*tlb_entry
, target_ulong addr
)
1888 if (addr
== (tlb_entry
->addr_read
&
1889 (TARGET_PAGE_MASK
| TLB_INVALID_MASK
)) ||
1890 addr
== (tlb_entry
->addr_write
&
1891 (TARGET_PAGE_MASK
| TLB_INVALID_MASK
)) ||
1892 addr
== (tlb_entry
->addr_code
&
1893 (TARGET_PAGE_MASK
| TLB_INVALID_MASK
))) {
1894 *tlb_entry
= s_cputlb_empty_entry
;
1898 void tlb_flush_page(CPUState
*env
, target_ulong addr
)
1903 #if defined(DEBUG_TLB)
1904 printf("tlb_flush_page: " TARGET_FMT_lx
"\n", addr
);
1906 /* must reset current TB so that interrupts cannot modify the
1907 links while we are modifying them */
1908 env
->current_tb
= NULL
;
1910 addr
&= TARGET_PAGE_MASK
;
1911 i
= (addr
>> TARGET_PAGE_BITS
) & (CPU_TLB_SIZE
- 1);
1912 for (mmu_idx
= 0; mmu_idx
< NB_MMU_MODES
; mmu_idx
++)
1913 tlb_flush_entry(&env
->tlb_table
[mmu_idx
][i
], addr
);
1915 tlb_flush_jmp_cache(env
, addr
);
1918 /* update the TLBs so that writes to code in the virtual page 'addr'
1920 static void tlb_protect_code(ram_addr_t ram_addr
)
1922 cpu_physical_memory_reset_dirty(ram_addr
,
1923 ram_addr
+ TARGET_PAGE_SIZE
,
1927 /* update the TLB so that writes in physical page 'phys_addr' are no longer
1928 tested for self modifying code */
1929 static void tlb_unprotect_code_phys(CPUState
*env
, ram_addr_t ram_addr
,
1932 phys_ram_dirty
[ram_addr
>> TARGET_PAGE_BITS
] |= CODE_DIRTY_FLAG
;
1935 static inline void tlb_reset_dirty_range(CPUTLBEntry
*tlb_entry
,
1936 unsigned long start
, unsigned long length
)
1939 if ((tlb_entry
->addr_write
& ~TARGET_PAGE_MASK
) == IO_MEM_RAM
) {
1940 addr
= (tlb_entry
->addr_write
& TARGET_PAGE_MASK
) + tlb_entry
->addend
;
1941 if ((addr
- start
) < length
) {
1942 tlb_entry
->addr_write
= (tlb_entry
->addr_write
& TARGET_PAGE_MASK
) | TLB_NOTDIRTY
;
1947 /* Note: start and end must be within the same ram block. */
1948 void cpu_physical_memory_reset_dirty(ram_addr_t start
, ram_addr_t end
,
1952 unsigned long length
, start1
;
1956 start
&= TARGET_PAGE_MASK
;
1957 end
= TARGET_PAGE_ALIGN(end
);
1959 length
= end
- start
;
1962 len
= length
>> TARGET_PAGE_BITS
;
1963 mask
= ~dirty_flags
;
1964 p
= phys_ram_dirty
+ (start
>> TARGET_PAGE_BITS
);
1965 for(i
= 0; i
< len
; i
++)
1968 /* we modify the TLB cache so that the dirty bit will be set again
1969 when accessing the range */
1970 start1
= (unsigned long)qemu_get_ram_ptr(start
);
1971 /* Chek that we don't span multiple blocks - this breaks the
1972 address comparisons below. */
1973 if ((unsigned long)qemu_get_ram_ptr(end
- 1) - start1
1974 != (end
- 1) - start
) {
1978 for(env
= first_cpu
; env
!= NULL
; env
= env
->next_cpu
) {
1980 for (mmu_idx
= 0; mmu_idx
< NB_MMU_MODES
; mmu_idx
++) {
1981 for(i
= 0; i
< CPU_TLB_SIZE
; i
++)
1982 tlb_reset_dirty_range(&env
->tlb_table
[mmu_idx
][i
],
1988 int cpu_physical_memory_set_dirty_tracking(int enable
)
1991 in_migration
= enable
;
1992 ret
= cpu_notify_migration_log(!!enable
);
1996 int cpu_physical_memory_get_dirty_tracking(void)
1998 return in_migration
;
2001 int cpu_physical_sync_dirty_bitmap(target_phys_addr_t start_addr
,
2002 target_phys_addr_t end_addr
)
2006 ret
= cpu_notify_sync_dirty_bitmap(start_addr
, end_addr
);
2010 static inline void tlb_update_dirty(CPUTLBEntry
*tlb_entry
)
2012 ram_addr_t ram_addr
;
2015 if ((tlb_entry
->addr_write
& ~TARGET_PAGE_MASK
) == IO_MEM_RAM
) {
2016 p
= (void *)(unsigned long)((tlb_entry
->addr_write
& TARGET_PAGE_MASK
)
2017 + tlb_entry
->addend
);
2018 ram_addr
= qemu_ram_addr_from_host(p
);
2019 if (!cpu_physical_memory_is_dirty(ram_addr
)) {
2020 tlb_entry
->addr_write
|= TLB_NOTDIRTY
;
2025 /* update the TLB according to the current state of the dirty bits */
2026 void cpu_tlb_update_dirty(CPUState
*env
)
2030 for (mmu_idx
= 0; mmu_idx
< NB_MMU_MODES
; mmu_idx
++) {
2031 for(i
= 0; i
< CPU_TLB_SIZE
; i
++)
2032 tlb_update_dirty(&env
->tlb_table
[mmu_idx
][i
]);
2036 static inline void tlb_set_dirty1(CPUTLBEntry
*tlb_entry
, target_ulong vaddr
)
2038 if (tlb_entry
->addr_write
== (vaddr
| TLB_NOTDIRTY
))
2039 tlb_entry
->addr_write
= vaddr
;
2042 /* update the TLB corresponding to virtual page vaddr
2043 so that it is no longer dirty */
2044 static inline void tlb_set_dirty(CPUState
*env
, target_ulong vaddr
)
2049 vaddr
&= TARGET_PAGE_MASK
;
2050 i
= (vaddr
>> TARGET_PAGE_BITS
) & (CPU_TLB_SIZE
- 1);
2051 for (mmu_idx
= 0; mmu_idx
< NB_MMU_MODES
; mmu_idx
++)
2052 tlb_set_dirty1(&env
->tlb_table
[mmu_idx
][i
], vaddr
);
2055 /* add a new TLB entry. At most one entry for a given virtual address
2056 is permitted. Return 0 if OK or 2 if the page could not be mapped
2057 (can only happen in non SOFTMMU mode for I/O pages or pages
2058 conflicting with the host address space). */
2059 int tlb_set_page_exec(CPUState
*env
, target_ulong vaddr
,
2060 target_phys_addr_t paddr
, int prot
,
2061 int mmu_idx
, int is_softmmu
)
2066 target_ulong address
;
2067 target_ulong code_address
;
2068 target_phys_addr_t addend
;
2072 target_phys_addr_t iotlb
;
2074 p
= phys_page_find(paddr
>> TARGET_PAGE_BITS
);
2076 pd
= IO_MEM_UNASSIGNED
;
2078 pd
= p
->phys_offset
;
2080 #if defined(DEBUG_TLB)
2081 printf("tlb_set_page: vaddr=" TARGET_FMT_lx
" paddr=0x%08x prot=%x idx=%d smmu=%d pd=0x%08lx\n",
2082 vaddr
, (int)paddr
, prot
, mmu_idx
, is_softmmu
, pd
);
2087 if ((pd
& ~TARGET_PAGE_MASK
) > IO_MEM_ROM
&& !(pd
& IO_MEM_ROMD
)) {
2088 /* IO memory case (romd handled later) */
2089 address
|= TLB_MMIO
;
2091 addend
= (unsigned long)qemu_get_ram_ptr(pd
& TARGET_PAGE_MASK
);
2092 if ((pd
& ~TARGET_PAGE_MASK
) <= IO_MEM_ROM
) {
2094 iotlb
= pd
& TARGET_PAGE_MASK
;
2095 if ((pd
& ~TARGET_PAGE_MASK
) == IO_MEM_RAM
)
2096 iotlb
|= IO_MEM_NOTDIRTY
;
2098 iotlb
|= IO_MEM_ROM
;
2100 /* IO handlers are currently passed a physical address.
2101 It would be nice to pass an offset from the base address
2102 of that region. This would avoid having to special case RAM,
2103 and avoid full address decoding in every device.
2104 We can't use the high bits of pd for this because
2105 IO_MEM_ROMD uses these as a ram address. */
2106 iotlb
= (pd
& ~TARGET_PAGE_MASK
);
2108 iotlb
+= p
->region_offset
;
2114 code_address
= address
;
2115 /* Make accesses to pages with watchpoints go via the
2116 watchpoint trap routines. */
2117 QTAILQ_FOREACH(wp
, &env
->watchpoints
, entry
) {
2118 if (vaddr
== (wp
->vaddr
& TARGET_PAGE_MASK
)) {
2119 iotlb
= io_mem_watch
+ paddr
;
2120 /* TODO: The memory case can be optimized by not trapping
2121 reads of pages with a write breakpoint. */
2122 address
|= TLB_MMIO
;
2126 index
= (vaddr
>> TARGET_PAGE_BITS
) & (CPU_TLB_SIZE
- 1);
2127 env
->iotlb
[mmu_idx
][index
] = iotlb
- vaddr
;
2128 te
= &env
->tlb_table
[mmu_idx
][index
];
2129 te
->addend
= addend
- vaddr
;
2130 if (prot
& PAGE_READ
) {
2131 te
->addr_read
= address
;
2136 if (prot
& PAGE_EXEC
) {
2137 te
->addr_code
= code_address
;
2141 if (prot
& PAGE_WRITE
) {
2142 if ((pd
& ~TARGET_PAGE_MASK
) == IO_MEM_ROM
||
2143 (pd
& IO_MEM_ROMD
)) {
2144 /* Write access calls the I/O callback. */
2145 te
->addr_write
= address
| TLB_MMIO
;
2146 } else if ((pd
& ~TARGET_PAGE_MASK
) == IO_MEM_RAM
&&
2147 !cpu_physical_memory_is_dirty(pd
)) {
2148 te
->addr_write
= address
| TLB_NOTDIRTY
;
2150 te
->addr_write
= address
;
2153 te
->addr_write
= -1;
2160 void tlb_flush(CPUState
*env
, int flush_global
)
2164 void tlb_flush_page(CPUState
*env
, target_ulong addr
)
2168 int tlb_set_page_exec(CPUState
*env
, target_ulong vaddr
,
2169 target_phys_addr_t paddr
, int prot
,
2170 int mmu_idx
, int is_softmmu
)
2176 * Walks guest process memory "regions" one by one
2177 * and calls callback function 'fn' for each region.
2179 int walk_memory_regions(void *priv
,
2180 int (*fn
)(void *, unsigned long, unsigned long, unsigned long))
2182 unsigned long start
, end
;
2184 int i
, j
, prot
, prot1
;
2190 for (i
= 0; i
<= L1_SIZE
; i
++) {
2191 p
= (i
< L1_SIZE
) ? l1_map
[i
] : NULL
;
2192 for (j
= 0; j
< L2_SIZE
; j
++) {
2193 prot1
= (p
== NULL
) ? 0 : p
[j
].flags
;
2195 * "region" is one continuous chunk of memory
2196 * that has same protection flags set.
2198 if (prot1
!= prot
) {
2199 end
= (i
<< (32 - L1_BITS
)) | (j
<< TARGET_PAGE_BITS
);
2201 rc
= (*fn
)(priv
, start
, end
, prot
);
2202 /* callback can stop iteration by returning != 0 */
2219 static int dump_region(void *priv
, unsigned long start
,
2220 unsigned long end
, unsigned long prot
)
2222 FILE *f
= (FILE *)priv
;
2224 (void) fprintf(f
, "%08lx-%08lx %08lx %c%c%c\n",
2225 start
, end
, end
- start
,
2226 ((prot
& PAGE_READ
) ? 'r' : '-'),
2227 ((prot
& PAGE_WRITE
) ? 'w' : '-'),
2228 ((prot
& PAGE_EXEC
) ? 'x' : '-'));
2233 /* dump memory mappings */
2234 void page_dump(FILE *f
)
2236 (void) fprintf(f
, "%-8s %-8s %-8s %s\n",
2237 "start", "end", "size", "prot");
2238 walk_memory_regions(f
, dump_region
);
2241 int page_get_flags(target_ulong address
)
2245 p
= page_find(address
>> TARGET_PAGE_BITS
);
2251 /* modify the flags of a page and invalidate the code if
2252 necessary. The flag PAGE_WRITE_ORG is positioned automatically
2253 depending on PAGE_WRITE */
2254 void page_set_flags(target_ulong start
, target_ulong end
, int flags
)
2259 /* mmap_lock should already be held. */
2260 start
= start
& TARGET_PAGE_MASK
;
2261 end
= TARGET_PAGE_ALIGN(end
);
2262 if (flags
& PAGE_WRITE
)
2263 flags
|= PAGE_WRITE_ORG
;
2264 for(addr
= start
; addr
< end
; addr
+= TARGET_PAGE_SIZE
) {
2265 p
= page_find_alloc(addr
>> TARGET_PAGE_BITS
);
2266 /* We may be called for host regions that are outside guest
2270 /* if the write protection is set, then we invalidate the code
2272 if (!(p
->flags
& PAGE_WRITE
) &&
2273 (flags
& PAGE_WRITE
) &&
2275 tb_invalidate_phys_page(addr
, 0, NULL
);
2281 int page_check_range(target_ulong start
, target_ulong len
, int flags
)
2287 if (start
+ len
< start
)
2288 /* we've wrapped around */
2291 end
= TARGET_PAGE_ALIGN(start
+len
); /* must do before we loose bits in the next step */
2292 start
= start
& TARGET_PAGE_MASK
;
2294 for(addr
= start
; addr
< end
; addr
+= TARGET_PAGE_SIZE
) {
2295 p
= page_find(addr
>> TARGET_PAGE_BITS
);
2298 if( !(p
->flags
& PAGE_VALID
) )
2301 if ((flags
& PAGE_READ
) && !(p
->flags
& PAGE_READ
))
2303 if (flags
& PAGE_WRITE
) {
2304 if (!(p
->flags
& PAGE_WRITE_ORG
))
2306 /* unprotect the page if it was put read-only because it
2307 contains translated code */
2308 if (!(p
->flags
& PAGE_WRITE
)) {
2309 if (!page_unprotect(addr
, 0, NULL
))
2318 /* called from signal handler: invalidate the code and unprotect the
2319 page. Return TRUE if the fault was successfully handled. */
2320 int page_unprotect(target_ulong address
, unsigned long pc
, void *puc
)
2322 unsigned int page_index
, prot
, pindex
;
2324 target_ulong host_start
, host_end
, addr
;
2326 /* Technically this isn't safe inside a signal handler. However we
2327 know this only ever happens in a synchronous SEGV handler, so in
2328 practice it seems to be ok. */
2331 host_start
= address
& qemu_host_page_mask
;
2332 page_index
= host_start
>> TARGET_PAGE_BITS
;
2333 p1
= page_find(page_index
);
2338 host_end
= host_start
+ qemu_host_page_size
;
2341 for(addr
= host_start
;addr
< host_end
; addr
+= TARGET_PAGE_SIZE
) {
2345 /* if the page was really writable, then we change its
2346 protection back to writable */
2347 if (prot
& PAGE_WRITE_ORG
) {
2348 pindex
= (address
- host_start
) >> TARGET_PAGE_BITS
;
2349 if (!(p1
[pindex
].flags
& PAGE_WRITE
)) {
2350 mprotect((void *)g2h(host_start
), qemu_host_page_size
,
2351 (prot
& PAGE_BITS
) | PAGE_WRITE
);
2352 p1
[pindex
].flags
|= PAGE_WRITE
;
2353 /* and since the content will be modified, we must invalidate
2354 the corresponding translated code. */
2355 tb_invalidate_phys_page(address
, pc
, puc
);
2356 #ifdef DEBUG_TB_CHECK
2357 tb_invalidate_check(address
);
2367 static inline void tlb_set_dirty(CPUState
*env
,
2368 unsigned long addr
, target_ulong vaddr
)
2371 #endif /* defined(CONFIG_USER_ONLY) */
2373 #if !defined(CONFIG_USER_ONLY)
2375 #define SUBPAGE_IDX(addr) ((addr) & ~TARGET_PAGE_MASK)
2376 typedef struct subpage_t
{
2377 target_phys_addr_t base
;
2378 CPUReadMemoryFunc
* const *mem_read
[TARGET_PAGE_SIZE
][4];
2379 CPUWriteMemoryFunc
* const *mem_write
[TARGET_PAGE_SIZE
][4];
2380 void *opaque
[TARGET_PAGE_SIZE
][2][4];
2381 ram_addr_t region_offset
[TARGET_PAGE_SIZE
][2][4];
2384 static int subpage_register (subpage_t
*mmio
, uint32_t start
, uint32_t end
,
2385 ram_addr_t memory
, ram_addr_t region_offset
);
2386 static void *subpage_init (target_phys_addr_t base
, ram_addr_t
*phys
,
2387 ram_addr_t orig_memory
, ram_addr_t region_offset
);
2388 #define CHECK_SUBPAGE(addr, start_addr, start_addr2, end_addr, end_addr2, \
2391 if (addr > start_addr) \
2394 start_addr2 = start_addr & ~TARGET_PAGE_MASK; \
2395 if (start_addr2 > 0) \
2399 if ((start_addr + orig_size) - addr >= TARGET_PAGE_SIZE) \
2400 end_addr2 = TARGET_PAGE_SIZE - 1; \
2402 end_addr2 = (start_addr + orig_size - 1) & ~TARGET_PAGE_MASK; \
2403 if (end_addr2 < TARGET_PAGE_SIZE - 1) \
2408 /* register physical memory.
2409 For RAM, 'size' must be a multiple of the target page size.
2410 If (phys_offset & ~TARGET_PAGE_MASK) != 0, then it is an
2411 io memory page. The address used when calling the IO function is
2412 the offset from the start of the region, plus region_offset. Both
2413 start_addr and region_offset are rounded down to a page boundary
2414 before calculating this offset. This should not be a problem unless
2415 the low bits of start_addr and region_offset differ. */
2416 void cpu_register_physical_memory_offset(target_phys_addr_t start_addr
,
2418 ram_addr_t phys_offset
,
2419 ram_addr_t region_offset
)
2421 target_phys_addr_t addr
, end_addr
;
2424 ram_addr_t orig_size
= size
;
2427 cpu_notify_set_memory(start_addr
, size
, phys_offset
);
2429 if (phys_offset
== IO_MEM_UNASSIGNED
) {
2430 region_offset
= start_addr
;
2432 region_offset
&= TARGET_PAGE_MASK
;
2433 size
= (size
+ TARGET_PAGE_SIZE
- 1) & TARGET_PAGE_MASK
;
2434 end_addr
= start_addr
+ (target_phys_addr_t
)size
;
2435 for(addr
= start_addr
; addr
!= end_addr
; addr
+= TARGET_PAGE_SIZE
) {
2436 p
= phys_page_find(addr
>> TARGET_PAGE_BITS
);
2437 if (p
&& p
->phys_offset
!= IO_MEM_UNASSIGNED
) {
2438 ram_addr_t orig_memory
= p
->phys_offset
;
2439 target_phys_addr_t start_addr2
, end_addr2
;
2440 int need_subpage
= 0;
2442 CHECK_SUBPAGE(addr
, start_addr
, start_addr2
, end_addr
, end_addr2
,
2444 if (need_subpage
|| phys_offset
& IO_MEM_SUBWIDTH
) {
2445 if (!(orig_memory
& IO_MEM_SUBPAGE
)) {
2446 subpage
= subpage_init((addr
& TARGET_PAGE_MASK
),
2447 &p
->phys_offset
, orig_memory
,
2450 subpage
= io_mem_opaque
[(orig_memory
& ~TARGET_PAGE_MASK
)
2453 subpage_register(subpage
, start_addr2
, end_addr2
, phys_offset
,
2455 p
->region_offset
= 0;
2457 p
->phys_offset
= phys_offset
;
2458 if ((phys_offset
& ~TARGET_PAGE_MASK
) <= IO_MEM_ROM
||
2459 (phys_offset
& IO_MEM_ROMD
))
2460 phys_offset
+= TARGET_PAGE_SIZE
;
2463 p
= phys_page_find_alloc(addr
>> TARGET_PAGE_BITS
, 1);
2464 p
->phys_offset
= phys_offset
;
2465 p
->region_offset
= region_offset
;
2466 if ((phys_offset
& ~TARGET_PAGE_MASK
) <= IO_MEM_ROM
||
2467 (phys_offset
& IO_MEM_ROMD
)) {
2468 phys_offset
+= TARGET_PAGE_SIZE
;
2470 target_phys_addr_t start_addr2
, end_addr2
;
2471 int need_subpage
= 0;
2473 CHECK_SUBPAGE(addr
, start_addr
, start_addr2
, end_addr
,
2474 end_addr2
, need_subpage
);
2476 if (need_subpage
|| phys_offset
& IO_MEM_SUBWIDTH
) {
2477 subpage
= subpage_init((addr
& TARGET_PAGE_MASK
),
2478 &p
->phys_offset
, IO_MEM_UNASSIGNED
,
2479 addr
& TARGET_PAGE_MASK
);
2480 subpage_register(subpage
, start_addr2
, end_addr2
,
2481 phys_offset
, region_offset
);
2482 p
->region_offset
= 0;
2486 region_offset
+= TARGET_PAGE_SIZE
;
2489 /* since each CPU stores ram addresses in its TLB cache, we must
2490 reset the modified entries */
2492 for(env
= first_cpu
; env
!= NULL
; env
= env
->next_cpu
) {
2497 /* XXX: temporary until new memory mapping API */
2498 ram_addr_t
cpu_get_physical_page_desc(target_phys_addr_t addr
)
2502 p
= phys_page_find(addr
>> TARGET_PAGE_BITS
);
2504 return IO_MEM_UNASSIGNED
;
2505 return p
->phys_offset
;
2508 void qemu_register_coalesced_mmio(target_phys_addr_t addr
, ram_addr_t size
)
2511 kvm_coalesce_mmio_region(addr
, size
);
2514 void qemu_unregister_coalesced_mmio(target_phys_addr_t addr
, ram_addr_t size
)
2517 kvm_uncoalesce_mmio_region(addr
, size
);
2520 void qemu_flush_coalesced_mmio_buffer(void)
2523 kvm_flush_coalesced_mmio_buffer();
2526 ram_addr_t
qemu_ram_alloc(ram_addr_t size
)
2528 RAMBlock
*new_block
;
2530 size
= TARGET_PAGE_ALIGN(size
);
2531 new_block
= qemu_malloc(sizeof(*new_block
));
2533 #if defined(TARGET_S390X) && defined(CONFIG_KVM)
2534 /* XXX S390 KVM requires the topmost vma of the RAM to be < 256GB */
2535 new_block
->host
= mmap((void*)0x1000000, size
, PROT_EXEC
|PROT_READ
|PROT_WRITE
,
2536 MAP_SHARED
| MAP_ANONYMOUS
, -1, 0);
2538 new_block
->host
= qemu_vmalloc(size
);
2540 #ifdef MADV_MERGEABLE
2541 madvise(new_block
->host
, size
, MADV_MERGEABLE
);
2543 new_block
->offset
= last_ram_offset
;
2544 new_block
->length
= size
;
2546 new_block
->next
= ram_blocks
;
2547 ram_blocks
= new_block
;
2549 phys_ram_dirty
= qemu_realloc(phys_ram_dirty
,
2550 (last_ram_offset
+ size
) >> TARGET_PAGE_BITS
);
2551 memset(phys_ram_dirty
+ (last_ram_offset
>> TARGET_PAGE_BITS
),
2552 0xff, size
>> TARGET_PAGE_BITS
);
2554 last_ram_offset
+= size
;
2557 kvm_setup_guest_memory(new_block
->host
, size
);
2559 return new_block
->offset
;
2562 void qemu_ram_free(ram_addr_t addr
)
2564 /* TODO: implement this. */
2567 /* Return a host pointer to ram allocated with qemu_ram_alloc.
2568 With the exception of the softmmu code in this file, this should
2569 only be used for local memory (e.g. video ram) that the device owns,
2570 and knows it isn't going to access beyond the end of the block.
2572 It should not be used for general purpose DMA.
2573 Use cpu_physical_memory_map/cpu_physical_memory_rw instead.
2575 void *qemu_get_ram_ptr(ram_addr_t addr
)
2582 prevp
= &ram_blocks
;
2584 while (block
&& (block
->offset
> addr
2585 || block
->offset
+ block
->length
<= addr
)) {
2587 prevp
= &prev
->next
;
2589 block
= block
->next
;
2592 fprintf(stderr
, "Bad ram offset %" PRIx64
"\n", (uint64_t)addr
);
2595 /* Move this entry to to start of the list. */
2597 prev
->next
= block
->next
;
2598 block
->next
= *prevp
;
2601 return block
->host
+ (addr
- block
->offset
);
2604 /* Some of the softmmu routines need to translate from a host pointer
2605 (typically a TLB entry) back to a ram offset. */
2606 ram_addr_t
qemu_ram_addr_from_host(void *ptr
)
2610 uint8_t *host
= ptr
;
2614 while (block
&& (block
->host
> host
2615 || block
->host
+ block
->length
<= host
)) {
2617 block
= block
->next
;
2620 fprintf(stderr
, "Bad ram pointer %p\n", ptr
);
2623 return block
->offset
+ (host
- block
->host
);
2626 static uint32_t unassigned_mem_readb(void *opaque
, target_phys_addr_t addr
)
2628 #ifdef DEBUG_UNASSIGNED
2629 printf("Unassigned mem read " TARGET_FMT_plx
"\n", addr
);
2631 #if defined(TARGET_SPARC) || defined(TARGET_MICROBLAZE)
2632 do_unassigned_access(addr
, 0, 0, 0, 1);
2637 static uint32_t unassigned_mem_readw(void *opaque
, target_phys_addr_t addr
)
2639 #ifdef DEBUG_UNASSIGNED
2640 printf("Unassigned mem read " TARGET_FMT_plx
"\n", addr
);
2642 #if defined(TARGET_SPARC) || defined(TARGET_MICROBLAZE)
2643 do_unassigned_access(addr
, 0, 0, 0, 2);
2648 static uint32_t unassigned_mem_readl(void *opaque
, target_phys_addr_t addr
)
2650 #ifdef DEBUG_UNASSIGNED
2651 printf("Unassigned mem read " TARGET_FMT_plx
"\n", addr
);
2653 #if defined(TARGET_SPARC) || defined(TARGET_MICROBLAZE)
2654 do_unassigned_access(addr
, 0, 0, 0, 4);
2659 static void unassigned_mem_writeb(void *opaque
, target_phys_addr_t addr
, uint32_t val
)
2661 #ifdef DEBUG_UNASSIGNED
2662 printf("Unassigned mem write " TARGET_FMT_plx
" = 0x%x\n", addr
, val
);
2664 #if defined(TARGET_SPARC) || defined(TARGET_MICROBLAZE)
2665 do_unassigned_access(addr
, 1, 0, 0, 1);
2669 static void unassigned_mem_writew(void *opaque
, target_phys_addr_t addr
, uint32_t val
)
2671 #ifdef DEBUG_UNASSIGNED
2672 printf("Unassigned mem write " TARGET_FMT_plx
" = 0x%x\n", addr
, val
);
2674 #if defined(TARGET_SPARC) || defined(TARGET_MICROBLAZE)
2675 do_unassigned_access(addr
, 1, 0, 0, 2);
2679 static void unassigned_mem_writel(void *opaque
, target_phys_addr_t addr
, uint32_t val
)
2681 #ifdef DEBUG_UNASSIGNED
2682 printf("Unassigned mem write " TARGET_FMT_plx
" = 0x%x\n", addr
, val
);
2684 #if defined(TARGET_SPARC) || defined(TARGET_MICROBLAZE)
2685 do_unassigned_access(addr
, 1, 0, 0, 4);
2689 static CPUReadMemoryFunc
* const unassigned_mem_read
[3] = {
2690 unassigned_mem_readb
,
2691 unassigned_mem_readw
,
2692 unassigned_mem_readl
,
2695 static CPUWriteMemoryFunc
* const unassigned_mem_write
[3] = {
2696 unassigned_mem_writeb
,
2697 unassigned_mem_writew
,
2698 unassigned_mem_writel
,
2701 static void notdirty_mem_writeb(void *opaque
, target_phys_addr_t ram_addr
,
2705 dirty_flags
= phys_ram_dirty
[ram_addr
>> TARGET_PAGE_BITS
];
2706 if (!(dirty_flags
& CODE_DIRTY_FLAG
)) {
2707 #if !defined(CONFIG_USER_ONLY)
2708 tb_invalidate_phys_page_fast(ram_addr
, 1);
2709 dirty_flags
= phys_ram_dirty
[ram_addr
>> TARGET_PAGE_BITS
];
2712 stb_p(qemu_get_ram_ptr(ram_addr
), val
);
2713 dirty_flags
|= (0xff & ~CODE_DIRTY_FLAG
);
2714 phys_ram_dirty
[ram_addr
>> TARGET_PAGE_BITS
] = dirty_flags
;
2715 /* we remove the notdirty callback only if the code has been
2717 if (dirty_flags
== 0xff)
2718 tlb_set_dirty(cpu_single_env
, cpu_single_env
->mem_io_vaddr
);
2721 static void notdirty_mem_writew(void *opaque
, target_phys_addr_t ram_addr
,
2725 dirty_flags
= phys_ram_dirty
[ram_addr
>> TARGET_PAGE_BITS
];
2726 if (!(dirty_flags
& CODE_DIRTY_FLAG
)) {
2727 #if !defined(CONFIG_USER_ONLY)
2728 tb_invalidate_phys_page_fast(ram_addr
, 2);
2729 dirty_flags
= phys_ram_dirty
[ram_addr
>> TARGET_PAGE_BITS
];
2732 stw_p(qemu_get_ram_ptr(ram_addr
), val
);
2733 dirty_flags
|= (0xff & ~CODE_DIRTY_FLAG
);
2734 phys_ram_dirty
[ram_addr
>> TARGET_PAGE_BITS
] = dirty_flags
;
2735 /* we remove the notdirty callback only if the code has been
2737 if (dirty_flags
== 0xff)
2738 tlb_set_dirty(cpu_single_env
, cpu_single_env
->mem_io_vaddr
);
2741 static void notdirty_mem_writel(void *opaque
, target_phys_addr_t ram_addr
,
2745 dirty_flags
= phys_ram_dirty
[ram_addr
>> TARGET_PAGE_BITS
];
2746 if (!(dirty_flags
& CODE_DIRTY_FLAG
)) {
2747 #if !defined(CONFIG_USER_ONLY)
2748 tb_invalidate_phys_page_fast(ram_addr
, 4);
2749 dirty_flags
= phys_ram_dirty
[ram_addr
>> TARGET_PAGE_BITS
];
2752 stl_p(qemu_get_ram_ptr(ram_addr
), val
);
2753 dirty_flags
|= (0xff & ~CODE_DIRTY_FLAG
);
2754 phys_ram_dirty
[ram_addr
>> TARGET_PAGE_BITS
] = dirty_flags
;
2755 /* we remove the notdirty callback only if the code has been
2757 if (dirty_flags
== 0xff)
2758 tlb_set_dirty(cpu_single_env
, cpu_single_env
->mem_io_vaddr
);
2761 static CPUReadMemoryFunc
* const error_mem_read
[3] = {
2762 NULL
, /* never used */
2763 NULL
, /* never used */
2764 NULL
, /* never used */
2767 static CPUWriteMemoryFunc
* const notdirty_mem_write
[3] = {
2768 notdirty_mem_writeb
,
2769 notdirty_mem_writew
,
2770 notdirty_mem_writel
,
2773 /* Generate a debug exception if a watchpoint has been hit. */
2774 static void check_watchpoint(int offset
, int len_mask
, int flags
)
2776 CPUState
*env
= cpu_single_env
;
2777 target_ulong pc
, cs_base
;
2778 TranslationBlock
*tb
;
2783 if (env
->watchpoint_hit
) {
2784 /* We re-entered the check after replacing the TB. Now raise
2785 * the debug interrupt so that is will trigger after the
2786 * current instruction. */
2787 cpu_interrupt(env
, CPU_INTERRUPT_DEBUG
);
2790 vaddr
= (env
->mem_io_vaddr
& TARGET_PAGE_MASK
) + offset
;
2791 QTAILQ_FOREACH(wp
, &env
->watchpoints
, entry
) {
2792 if ((vaddr
== (wp
->vaddr
& len_mask
) ||
2793 (vaddr
& wp
->len_mask
) == wp
->vaddr
) && (wp
->flags
& flags
)) {
2794 wp
->flags
|= BP_WATCHPOINT_HIT
;
2795 if (!env
->watchpoint_hit
) {
2796 env
->watchpoint_hit
= wp
;
2797 tb
= tb_find_pc(env
->mem_io_pc
);
2799 cpu_abort(env
, "check_watchpoint: could not find TB for "
2800 "pc=%p", (void *)env
->mem_io_pc
);
2802 cpu_restore_state(tb
, env
, env
->mem_io_pc
, NULL
);
2803 tb_phys_invalidate(tb
, -1);
2804 if (wp
->flags
& BP_STOP_BEFORE_ACCESS
) {
2805 env
->exception_index
= EXCP_DEBUG
;
2807 cpu_get_tb_cpu_state(env
, &pc
, &cs_base
, &cpu_flags
);
2808 tb_gen_code(env
, pc
, cs_base
, cpu_flags
, 1);
2810 cpu_resume_from_signal(env
, NULL
);
2813 wp
->flags
&= ~BP_WATCHPOINT_HIT
;
2818 /* Watchpoint access routines. Watchpoints are inserted using TLB tricks,
2819 so these check for a hit then pass through to the normal out-of-line
2821 static uint32_t watch_mem_readb(void *opaque
, target_phys_addr_t addr
)
2823 check_watchpoint(addr
& ~TARGET_PAGE_MASK
, ~0x0, BP_MEM_READ
);
2824 return ldub_phys(addr
);
2827 static uint32_t watch_mem_readw(void *opaque
, target_phys_addr_t addr
)
2829 check_watchpoint(addr
& ~TARGET_PAGE_MASK
, ~0x1, BP_MEM_READ
);
2830 return lduw_phys(addr
);
2833 static uint32_t watch_mem_readl(void *opaque
, target_phys_addr_t addr
)
2835 check_watchpoint(addr
& ~TARGET_PAGE_MASK
, ~0x3, BP_MEM_READ
);
2836 return ldl_phys(addr
);
2839 static void watch_mem_writeb(void *opaque
, target_phys_addr_t addr
,
2842 check_watchpoint(addr
& ~TARGET_PAGE_MASK
, ~0x0, BP_MEM_WRITE
);
2843 stb_phys(addr
, val
);
2846 static void watch_mem_writew(void *opaque
, target_phys_addr_t addr
,
2849 check_watchpoint(addr
& ~TARGET_PAGE_MASK
, ~0x1, BP_MEM_WRITE
);
2850 stw_phys(addr
, val
);
2853 static void watch_mem_writel(void *opaque
, target_phys_addr_t addr
,
2856 check_watchpoint(addr
& ~TARGET_PAGE_MASK
, ~0x3, BP_MEM_WRITE
);
2857 stl_phys(addr
, val
);
2860 static CPUReadMemoryFunc
* const watch_mem_read
[3] = {
2866 static CPUWriteMemoryFunc
* const watch_mem_write
[3] = {
2872 static inline uint32_t subpage_readlen (subpage_t
*mmio
, target_phys_addr_t addr
,
2878 idx
= SUBPAGE_IDX(addr
);
2879 #if defined(DEBUG_SUBPAGE)
2880 printf("%s: subpage %p len %d addr " TARGET_FMT_plx
" idx %d\n", __func__
,
2881 mmio
, len
, addr
, idx
);
2883 ret
= (**mmio
->mem_read
[idx
][len
])(mmio
->opaque
[idx
][0][len
],
2884 addr
+ mmio
->region_offset
[idx
][0][len
]);
2889 static inline void subpage_writelen (subpage_t
*mmio
, target_phys_addr_t addr
,
2890 uint32_t value
, unsigned int len
)
2894 idx
= SUBPAGE_IDX(addr
);
2895 #if defined(DEBUG_SUBPAGE)
2896 printf("%s: subpage %p len %d addr " TARGET_FMT_plx
" idx %d value %08x\n", __func__
,
2897 mmio
, len
, addr
, idx
, value
);
2899 (**mmio
->mem_write
[idx
][len
])(mmio
->opaque
[idx
][1][len
],
2900 addr
+ mmio
->region_offset
[idx
][1][len
],
2904 static uint32_t subpage_readb (void *opaque
, target_phys_addr_t addr
)
2906 #if defined(DEBUG_SUBPAGE)
2907 printf("%s: addr " TARGET_FMT_plx
"\n", __func__
, addr
);
2910 return subpage_readlen(opaque
, addr
, 0);
2913 static void subpage_writeb (void *opaque
, target_phys_addr_t addr
,
2916 #if defined(DEBUG_SUBPAGE)
2917 printf("%s: addr " TARGET_FMT_plx
" val %08x\n", __func__
, addr
, value
);
2919 subpage_writelen(opaque
, addr
, value
, 0);
2922 static uint32_t subpage_readw (void *opaque
, target_phys_addr_t addr
)
2924 #if defined(DEBUG_SUBPAGE)
2925 printf("%s: addr " TARGET_FMT_plx
"\n", __func__
, addr
);
2928 return subpage_readlen(opaque
, addr
, 1);
2931 static void subpage_writew (void *opaque
, target_phys_addr_t addr
,
2934 #if defined(DEBUG_SUBPAGE)
2935 printf("%s: addr " TARGET_FMT_plx
" val %08x\n", __func__
, addr
, value
);
2937 subpage_writelen(opaque
, addr
, value
, 1);
2940 static uint32_t subpage_readl (void *opaque
, target_phys_addr_t addr
)
2942 #if defined(DEBUG_SUBPAGE)
2943 printf("%s: addr " TARGET_FMT_plx
"\n", __func__
, addr
);
2946 return subpage_readlen(opaque
, addr
, 2);
2949 static void subpage_writel (void *opaque
,
2950 target_phys_addr_t addr
, uint32_t value
)
2952 #if defined(DEBUG_SUBPAGE)
2953 printf("%s: addr " TARGET_FMT_plx
" val %08x\n", __func__
, addr
, value
);
2955 subpage_writelen(opaque
, addr
, value
, 2);
2958 static CPUReadMemoryFunc
* const subpage_read
[] = {
2964 static CPUWriteMemoryFunc
* const subpage_write
[] = {
2970 static int subpage_register (subpage_t
*mmio
, uint32_t start
, uint32_t end
,
2971 ram_addr_t memory
, ram_addr_t region_offset
)
2976 if (start
>= TARGET_PAGE_SIZE
|| end
>= TARGET_PAGE_SIZE
)
2978 idx
= SUBPAGE_IDX(start
);
2979 eidx
= SUBPAGE_IDX(end
);
2980 #if defined(DEBUG_SUBPAGE)
2981 printf("%s: %p start %08x end %08x idx %08x eidx %08x mem %ld\n", __func__
,
2982 mmio
, start
, end
, idx
, eidx
, memory
);
2984 memory
>>= IO_MEM_SHIFT
;
2985 for (; idx
<= eidx
; idx
++) {
2986 for (i
= 0; i
< 4; i
++) {
2987 if (io_mem_read
[memory
][i
]) {
2988 mmio
->mem_read
[idx
][i
] = &io_mem_read
[memory
][i
];
2989 mmio
->opaque
[idx
][0][i
] = io_mem_opaque
[memory
];
2990 mmio
->region_offset
[idx
][0][i
] = region_offset
;
2992 if (io_mem_write
[memory
][i
]) {
2993 mmio
->mem_write
[idx
][i
] = &io_mem_write
[memory
][i
];
2994 mmio
->opaque
[idx
][1][i
] = io_mem_opaque
[memory
];
2995 mmio
->region_offset
[idx
][1][i
] = region_offset
;
3003 static void *subpage_init (target_phys_addr_t base
, ram_addr_t
*phys
,
3004 ram_addr_t orig_memory
, ram_addr_t region_offset
)
3009 mmio
= qemu_mallocz(sizeof(subpage_t
));
3012 subpage_memory
= cpu_register_io_memory(subpage_read
, subpage_write
, mmio
);
3013 #if defined(DEBUG_SUBPAGE)
3014 printf("%s: %p base " TARGET_FMT_plx
" len %08x %d\n", __func__
,
3015 mmio
, base
, TARGET_PAGE_SIZE
, subpage_memory
);
3017 *phys
= subpage_memory
| IO_MEM_SUBPAGE
;
3018 subpage_register(mmio
, 0, TARGET_PAGE_SIZE
- 1, orig_memory
,
3024 static int get_free_io_mem_idx(void)
3028 for (i
= 0; i
<IO_MEM_NB_ENTRIES
; i
++)
3029 if (!io_mem_used
[i
]) {
3033 fprintf(stderr
, "RAN out out io_mem_idx, max %d !\n", IO_MEM_NB_ENTRIES
);
3037 /* mem_read and mem_write are arrays of functions containing the
3038 function to access byte (index 0), word (index 1) and dword (index
3039 2). Functions can be omitted with a NULL function pointer.
3040 If io_index is non zero, the corresponding io zone is
3041 modified. If it is zero, a new io zone is allocated. The return
3042 value can be used with cpu_register_physical_memory(). (-1) is
3043 returned if error. */
3044 static int cpu_register_io_memory_fixed(int io_index
,
3045 CPUReadMemoryFunc
* const *mem_read
,
3046 CPUWriteMemoryFunc
* const *mem_write
,
3049 int i
, subwidth
= 0;
3051 if (io_index
<= 0) {
3052 io_index
= get_free_io_mem_idx();
3056 io_index
>>= IO_MEM_SHIFT
;
3057 if (io_index
>= IO_MEM_NB_ENTRIES
)
3061 for(i
= 0;i
< 3; i
++) {
3062 if (!mem_read
[i
] || !mem_write
[i
])
3063 subwidth
= IO_MEM_SUBWIDTH
;
3064 io_mem_read
[io_index
][i
] = mem_read
[i
];
3065 io_mem_write
[io_index
][i
] = mem_write
[i
];
3067 io_mem_opaque
[io_index
] = opaque
;
3068 return (io_index
<< IO_MEM_SHIFT
) | subwidth
;
3071 int cpu_register_io_memory(CPUReadMemoryFunc
* const *mem_read
,
3072 CPUWriteMemoryFunc
* const *mem_write
,
3075 return cpu_register_io_memory_fixed(0, mem_read
, mem_write
, opaque
);
3078 void cpu_unregister_io_memory(int io_table_address
)
3081 int io_index
= io_table_address
>> IO_MEM_SHIFT
;
3083 for (i
=0;i
< 3; i
++) {
3084 io_mem_read
[io_index
][i
] = unassigned_mem_read
[i
];
3085 io_mem_write
[io_index
][i
] = unassigned_mem_write
[i
];
3087 io_mem_opaque
[io_index
] = NULL
;
3088 io_mem_used
[io_index
] = 0;
3091 static void io_mem_init(void)
3095 cpu_register_io_memory_fixed(IO_MEM_ROM
, error_mem_read
, unassigned_mem_write
, NULL
);
3096 cpu_register_io_memory_fixed(IO_MEM_UNASSIGNED
, unassigned_mem_read
, unassigned_mem_write
, NULL
);
3097 cpu_register_io_memory_fixed(IO_MEM_NOTDIRTY
, error_mem_read
, notdirty_mem_write
, NULL
);
3101 io_mem_watch
= cpu_register_io_memory(watch_mem_read
,
3102 watch_mem_write
, NULL
);
3105 #endif /* !defined(CONFIG_USER_ONLY) */
3107 /* physical memory access (slow version, mainly for debug) */
3108 #if defined(CONFIG_USER_ONLY)
3109 int cpu_memory_rw_debug(CPUState
*env
, target_ulong addr
,
3110 uint8_t *buf
, int len
, int is_write
)
3117 page
= addr
& TARGET_PAGE_MASK
;
3118 l
= (page
+ TARGET_PAGE_SIZE
) - addr
;
3121 flags
= page_get_flags(page
);
3122 if (!(flags
& PAGE_VALID
))
3125 if (!(flags
& PAGE_WRITE
))
3127 /* XXX: this code should not depend on lock_user */
3128 if (!(p
= lock_user(VERIFY_WRITE
, addr
, l
, 0)))
3131 unlock_user(p
, addr
, l
);
3133 if (!(flags
& PAGE_READ
))
3135 /* XXX: this code should not depend on lock_user */
3136 if (!(p
= lock_user(VERIFY_READ
, addr
, l
, 1)))
3139 unlock_user(p
, addr
, 0);
3149 void cpu_physical_memory_rw(target_phys_addr_t addr
, uint8_t *buf
,
3150 int len
, int is_write
)
3155 target_phys_addr_t page
;
3160 page
= addr
& TARGET_PAGE_MASK
;
3161 l
= (page
+ TARGET_PAGE_SIZE
) - addr
;
3164 p
= phys_page_find(page
>> TARGET_PAGE_BITS
);
3166 pd
= IO_MEM_UNASSIGNED
;
3168 pd
= p
->phys_offset
;
3172 if ((pd
& ~TARGET_PAGE_MASK
) != IO_MEM_RAM
) {
3173 target_phys_addr_t addr1
= addr
;
3174 io_index
= (pd
>> IO_MEM_SHIFT
) & (IO_MEM_NB_ENTRIES
- 1);
3176 addr1
= (addr
& ~TARGET_PAGE_MASK
) + p
->region_offset
;
3177 /* XXX: could force cpu_single_env to NULL to avoid
3179 if (l
>= 4 && ((addr1
& 3) == 0)) {
3180 /* 32 bit write access */
3182 io_mem_write
[io_index
][2](io_mem_opaque
[io_index
], addr1
, val
);
3184 } else if (l
>= 2 && ((addr1
& 1) == 0)) {
3185 /* 16 bit write access */
3187 io_mem_write
[io_index
][1](io_mem_opaque
[io_index
], addr1
, val
);
3190 /* 8 bit write access */
3192 io_mem_write
[io_index
][0](io_mem_opaque
[io_index
], addr1
, val
);
3196 unsigned long addr1
;
3197 addr1
= (pd
& TARGET_PAGE_MASK
) + (addr
& ~TARGET_PAGE_MASK
);
3199 ptr
= qemu_get_ram_ptr(addr1
);
3200 memcpy(ptr
, buf
, l
);
3201 if (!cpu_physical_memory_is_dirty(addr1
)) {
3202 /* invalidate code */
3203 tb_invalidate_phys_page_range(addr1
, addr1
+ l
, 0);
3205 phys_ram_dirty
[addr1
>> TARGET_PAGE_BITS
] |=
3206 (0xff & ~CODE_DIRTY_FLAG
);
3210 if ((pd
& ~TARGET_PAGE_MASK
) > IO_MEM_ROM
&&
3211 !(pd
& IO_MEM_ROMD
)) {
3212 target_phys_addr_t addr1
= addr
;
3214 io_index
= (pd
>> IO_MEM_SHIFT
) & (IO_MEM_NB_ENTRIES
- 1);
3216 addr1
= (addr
& ~TARGET_PAGE_MASK
) + p
->region_offset
;
3217 if (l
>= 4 && ((addr1
& 3) == 0)) {
3218 /* 32 bit read access */
3219 val
= io_mem_read
[io_index
][2](io_mem_opaque
[io_index
], addr1
);
3222 } else if (l
>= 2 && ((addr1
& 1) == 0)) {
3223 /* 16 bit read access */
3224 val
= io_mem_read
[io_index
][1](io_mem_opaque
[io_index
], addr1
);
3228 /* 8 bit read access */
3229 val
= io_mem_read
[io_index
][0](io_mem_opaque
[io_index
], addr1
);
3235 ptr
= qemu_get_ram_ptr(pd
& TARGET_PAGE_MASK
) +
3236 (addr
& ~TARGET_PAGE_MASK
);
3237 memcpy(buf
, ptr
, l
);
3246 /* used for ROM loading : can write in RAM and ROM */
3247 void cpu_physical_memory_write_rom(target_phys_addr_t addr
,
3248 const uint8_t *buf
, int len
)
3252 target_phys_addr_t page
;
3257 page
= addr
& TARGET_PAGE_MASK
;
3258 l
= (page
+ TARGET_PAGE_SIZE
) - addr
;
3261 p
= phys_page_find(page
>> TARGET_PAGE_BITS
);
3263 pd
= IO_MEM_UNASSIGNED
;
3265 pd
= p
->phys_offset
;
3268 if ((pd
& ~TARGET_PAGE_MASK
) != IO_MEM_RAM
&&
3269 (pd
& ~TARGET_PAGE_MASK
) != IO_MEM_ROM
&&
3270 !(pd
& IO_MEM_ROMD
)) {
3273 unsigned long addr1
;
3274 addr1
= (pd
& TARGET_PAGE_MASK
) + (addr
& ~TARGET_PAGE_MASK
);
3276 ptr
= qemu_get_ram_ptr(addr1
);
3277 memcpy(ptr
, buf
, l
);
3287 target_phys_addr_t addr
;
3288 target_phys_addr_t len
;
3291 static BounceBuffer bounce
;
3293 typedef struct MapClient
{
3295 void (*callback
)(void *opaque
);
3296 QLIST_ENTRY(MapClient
) link
;
3299 static QLIST_HEAD(map_client_list
, MapClient
) map_client_list
3300 = QLIST_HEAD_INITIALIZER(map_client_list
);
3302 void *cpu_register_map_client(void *opaque
, void (*callback
)(void *opaque
))
3304 MapClient
*client
= qemu_malloc(sizeof(*client
));
3306 client
->opaque
= opaque
;
3307 client
->callback
= callback
;
3308 QLIST_INSERT_HEAD(&map_client_list
, client
, link
);
3312 void cpu_unregister_map_client(void *_client
)
3314 MapClient
*client
= (MapClient
*)_client
;
3316 QLIST_REMOVE(client
, link
);
3320 static void cpu_notify_map_clients(void)
3324 while (!QLIST_EMPTY(&map_client_list
)) {
3325 client
= QLIST_FIRST(&map_client_list
);
3326 client
->callback(client
->opaque
);
3327 cpu_unregister_map_client(client
);
3331 /* Map a physical memory region into a host virtual address.
3332 * May map a subset of the requested range, given by and returned in *plen.
3333 * May return NULL if resources needed to perform the mapping are exhausted.
3334 * Use only for reads OR writes - not for read-modify-write operations.
3335 * Use cpu_register_map_client() to know when retrying the map operation is
3336 * likely to succeed.
3338 void *cpu_physical_memory_map(target_phys_addr_t addr
,
3339 target_phys_addr_t
*plen
,
3342 target_phys_addr_t len
= *plen
;
3343 target_phys_addr_t done
= 0;
3345 uint8_t *ret
= NULL
;
3347 target_phys_addr_t page
;
3350 unsigned long addr1
;
3353 page
= addr
& TARGET_PAGE_MASK
;
3354 l
= (page
+ TARGET_PAGE_SIZE
) - addr
;
3357 p
= phys_page_find(page
>> TARGET_PAGE_BITS
);
3359 pd
= IO_MEM_UNASSIGNED
;
3361 pd
= p
->phys_offset
;
3364 if ((pd
& ~TARGET_PAGE_MASK
) != IO_MEM_RAM
) {
3365 if (done
|| bounce
.buffer
) {
3368 bounce
.buffer
= qemu_memalign(TARGET_PAGE_SIZE
, TARGET_PAGE_SIZE
);
3372 cpu_physical_memory_rw(addr
, bounce
.buffer
, l
, 0);
3374 ptr
= bounce
.buffer
;
3376 addr1
= (pd
& TARGET_PAGE_MASK
) + (addr
& ~TARGET_PAGE_MASK
);
3377 ptr
= qemu_get_ram_ptr(addr1
);
3381 } else if (ret
+ done
!= ptr
) {
3393 /* Unmaps a memory region previously mapped by cpu_physical_memory_map().
3394 * Will also mark the memory as dirty if is_write == 1. access_len gives
3395 * the amount of memory that was actually read or written by the caller.
3397 void cpu_physical_memory_unmap(void *buffer
, target_phys_addr_t len
,
3398 int is_write
, target_phys_addr_t access_len
)
3400 if (buffer
!= bounce
.buffer
) {
3402 ram_addr_t addr1
= qemu_ram_addr_from_host(buffer
);
3403 while (access_len
) {
3405 l
= TARGET_PAGE_SIZE
;
3408 if (!cpu_physical_memory_is_dirty(addr1
)) {
3409 /* invalidate code */
3410 tb_invalidate_phys_page_range(addr1
, addr1
+ l
, 0);
3412 phys_ram_dirty
[addr1
>> TARGET_PAGE_BITS
] |=
3413 (0xff & ~CODE_DIRTY_FLAG
);
3422 cpu_physical_memory_write(bounce
.addr
, bounce
.buffer
, access_len
);
3424 qemu_vfree(bounce
.buffer
);
3425 bounce
.buffer
= NULL
;
3426 cpu_notify_map_clients();
3429 /* warning: addr must be aligned */
3430 uint32_t ldl_phys(target_phys_addr_t addr
)
3438 p
= phys_page_find(addr
>> TARGET_PAGE_BITS
);
3440 pd
= IO_MEM_UNASSIGNED
;
3442 pd
= p
->phys_offset
;
3445 if ((pd
& ~TARGET_PAGE_MASK
) > IO_MEM_ROM
&&
3446 !(pd
& IO_MEM_ROMD
)) {
3448 io_index
= (pd
>> IO_MEM_SHIFT
) & (IO_MEM_NB_ENTRIES
- 1);
3450 addr
= (addr
& ~TARGET_PAGE_MASK
) + p
->region_offset
;
3451 val
= io_mem_read
[io_index
][2](io_mem_opaque
[io_index
], addr
);
3454 ptr
= qemu_get_ram_ptr(pd
& TARGET_PAGE_MASK
) +
3455 (addr
& ~TARGET_PAGE_MASK
);
3461 /* warning: addr must be aligned */
3462 uint64_t ldq_phys(target_phys_addr_t addr
)
3470 p
= phys_page_find(addr
>> TARGET_PAGE_BITS
);
3472 pd
= IO_MEM_UNASSIGNED
;
3474 pd
= p
->phys_offset
;
3477 if ((pd
& ~TARGET_PAGE_MASK
) > IO_MEM_ROM
&&
3478 !(pd
& IO_MEM_ROMD
)) {
3480 io_index
= (pd
>> IO_MEM_SHIFT
) & (IO_MEM_NB_ENTRIES
- 1);
3482 addr
= (addr
& ~TARGET_PAGE_MASK
) + p
->region_offset
;
3483 #ifdef TARGET_WORDS_BIGENDIAN
3484 val
= (uint64_t)io_mem_read
[io_index
][2](io_mem_opaque
[io_index
], addr
) << 32;
3485 val
|= io_mem_read
[io_index
][2](io_mem_opaque
[io_index
], addr
+ 4);
3487 val
= io_mem_read
[io_index
][2](io_mem_opaque
[io_index
], addr
);
3488 val
|= (uint64_t)io_mem_read
[io_index
][2](io_mem_opaque
[io_index
], addr
+ 4) << 32;
3492 ptr
= qemu_get_ram_ptr(pd
& TARGET_PAGE_MASK
) +
3493 (addr
& ~TARGET_PAGE_MASK
);
3500 uint32_t ldub_phys(target_phys_addr_t addr
)
3503 cpu_physical_memory_read(addr
, &val
, 1);
3508 uint32_t lduw_phys(target_phys_addr_t addr
)
3511 cpu_physical_memory_read(addr
, (uint8_t *)&val
, 2);
3512 return tswap16(val
);
3515 /* warning: addr must be aligned. The ram page is not masked as dirty
3516 and the code inside is not invalidated. It is useful if the dirty
3517 bits are used to track modified PTEs */
3518 void stl_phys_notdirty(target_phys_addr_t addr
, uint32_t val
)
3525 p
= phys_page_find(addr
>> TARGET_PAGE_BITS
);
3527 pd
= IO_MEM_UNASSIGNED
;
3529 pd
= p
->phys_offset
;
3532 if ((pd
& ~TARGET_PAGE_MASK
) != IO_MEM_RAM
) {
3533 io_index
= (pd
>> IO_MEM_SHIFT
) & (IO_MEM_NB_ENTRIES
- 1);
3535 addr
= (addr
& ~TARGET_PAGE_MASK
) + p
->region_offset
;
3536 io_mem_write
[io_index
][2](io_mem_opaque
[io_index
], addr
, val
);
3538 unsigned long addr1
= (pd
& TARGET_PAGE_MASK
) + (addr
& ~TARGET_PAGE_MASK
);
3539 ptr
= qemu_get_ram_ptr(addr1
);
3542 if (unlikely(in_migration
)) {
3543 if (!cpu_physical_memory_is_dirty(addr1
)) {
3544 /* invalidate code */
3545 tb_invalidate_phys_page_range(addr1
, addr1
+ 4, 0);
3547 phys_ram_dirty
[addr1
>> TARGET_PAGE_BITS
] |=
3548 (0xff & ~CODE_DIRTY_FLAG
);
3554 void stq_phys_notdirty(target_phys_addr_t addr
, uint64_t val
)
3561 p
= phys_page_find(addr
>> TARGET_PAGE_BITS
);
3563 pd
= IO_MEM_UNASSIGNED
;
3565 pd
= p
->phys_offset
;
3568 if ((pd
& ~TARGET_PAGE_MASK
) != IO_MEM_RAM
) {
3569 io_index
= (pd
>> IO_MEM_SHIFT
) & (IO_MEM_NB_ENTRIES
- 1);
3571 addr
= (addr
& ~TARGET_PAGE_MASK
) + p
->region_offset
;
3572 #ifdef TARGET_WORDS_BIGENDIAN
3573 io_mem_write
[io_index
][2](io_mem_opaque
[io_index
], addr
, val
>> 32);
3574 io_mem_write
[io_index
][2](io_mem_opaque
[io_index
], addr
+ 4, val
);
3576 io_mem_write
[io_index
][2](io_mem_opaque
[io_index
], addr
, val
);
3577 io_mem_write
[io_index
][2](io_mem_opaque
[io_index
], addr
+ 4, val
>> 32);
3580 ptr
= qemu_get_ram_ptr(pd
& TARGET_PAGE_MASK
) +
3581 (addr
& ~TARGET_PAGE_MASK
);
3586 /* warning: addr must be aligned */
3587 void stl_phys(target_phys_addr_t addr
, uint32_t val
)
3594 p
= phys_page_find(addr
>> TARGET_PAGE_BITS
);
3596 pd
= IO_MEM_UNASSIGNED
;
3598 pd
= p
->phys_offset
;
3601 if ((pd
& ~TARGET_PAGE_MASK
) != IO_MEM_RAM
) {
3602 io_index
= (pd
>> IO_MEM_SHIFT
) & (IO_MEM_NB_ENTRIES
- 1);
3604 addr
= (addr
& ~TARGET_PAGE_MASK
) + p
->region_offset
;
3605 io_mem_write
[io_index
][2](io_mem_opaque
[io_index
], addr
, val
);
3607 unsigned long addr1
;
3608 addr1
= (pd
& TARGET_PAGE_MASK
) + (addr
& ~TARGET_PAGE_MASK
);
3610 ptr
= qemu_get_ram_ptr(addr1
);
3612 if (!cpu_physical_memory_is_dirty(addr1
)) {
3613 /* invalidate code */
3614 tb_invalidate_phys_page_range(addr1
, addr1
+ 4, 0);
3616 phys_ram_dirty
[addr1
>> TARGET_PAGE_BITS
] |=
3617 (0xff & ~CODE_DIRTY_FLAG
);
3623 void stb_phys(target_phys_addr_t addr
, uint32_t val
)
3626 cpu_physical_memory_write(addr
, &v
, 1);
3630 void stw_phys(target_phys_addr_t addr
, uint32_t val
)
3632 uint16_t v
= tswap16(val
);
3633 cpu_physical_memory_write(addr
, (const uint8_t *)&v
, 2);
3637 void stq_phys(target_phys_addr_t addr
, uint64_t val
)
3640 cpu_physical_memory_write(addr
, (const uint8_t *)&val
, 8);
3643 /* virtual memory access for debug (includes writing to ROM) */
3644 int cpu_memory_rw_debug(CPUState
*env
, target_ulong addr
,
3645 uint8_t *buf
, int len
, int is_write
)
3648 target_phys_addr_t phys_addr
;
3652 page
= addr
& TARGET_PAGE_MASK
;
3653 phys_addr
= cpu_get_phys_page_debug(env
, page
);
3654 /* if no physical page mapped, return an error */
3655 if (phys_addr
== -1)
3657 l
= (page
+ TARGET_PAGE_SIZE
) - addr
;
3660 phys_addr
+= (addr
& ~TARGET_PAGE_MASK
);
3662 cpu_physical_memory_write_rom(phys_addr
, buf
, l
);
3664 cpu_physical_memory_rw(phys_addr
, buf
, l
, is_write
);
3673 /* in deterministic execution mode, instructions doing device I/Os
3674 must be at the end of the TB */
3675 void cpu_io_recompile(CPUState
*env
, void *retaddr
)
3677 TranslationBlock
*tb
;
3679 target_ulong pc
, cs_base
;
3682 tb
= tb_find_pc((unsigned long)retaddr
);
3684 cpu_abort(env
, "cpu_io_recompile: could not find TB for pc=%p",
3687 n
= env
->icount_decr
.u16
.low
+ tb
->icount
;
3688 cpu_restore_state(tb
, env
, (unsigned long)retaddr
, NULL
);
3689 /* Calculate how many instructions had been executed before the fault
3691 n
= n
- env
->icount_decr
.u16
.low
;
3692 /* Generate a new TB ending on the I/O insn. */
3694 /* On MIPS and SH, delay slot instructions can only be restarted if
3695 they were already the first instruction in the TB. If this is not
3696 the first instruction in a TB then re-execute the preceding
3698 #if defined(TARGET_MIPS)
3699 if ((env
->hflags
& MIPS_HFLAG_BMASK
) != 0 && n
> 1) {
3700 env
->active_tc
.PC
-= 4;
3701 env
->icount_decr
.u16
.low
++;
3702 env
->hflags
&= ~MIPS_HFLAG_BMASK
;
3704 #elif defined(TARGET_SH4)
3705 if ((env
->flags
& ((DELAY_SLOT
| DELAY_SLOT_CONDITIONAL
))) != 0
3708 env
->icount_decr
.u16
.low
++;
3709 env
->flags
&= ~(DELAY_SLOT
| DELAY_SLOT_CONDITIONAL
);
3712 /* This should never happen. */
3713 if (n
> CF_COUNT_MASK
)
3714 cpu_abort(env
, "TB too big during recompile");
3716 cflags
= n
| CF_LAST_IO
;
3718 cs_base
= tb
->cs_base
;
3720 tb_phys_invalidate(tb
, -1);
3721 /* FIXME: In theory this could raise an exception. In practice
3722 we have already translated the block once so it's probably ok. */
3723 tb_gen_code(env
, pc
, cs_base
, flags
, cflags
);
3724 /* TODO: If env->pc != tb->pc (i.e. the faulting instruction was not
3725 the first in the TB) then we end up generating a whole new TB and
3726 repeating the fault, which is horribly inefficient.
3727 Better would be to execute just this insn uncached, or generate a
3729 cpu_resume_from_signal(env
, NULL
);
3732 void dump_exec_info(FILE *f
,
3733 int (*cpu_fprintf
)(FILE *f
, const char *fmt
, ...))
3735 int i
, target_code_size
, max_target_code_size
;
3736 int direct_jmp_count
, direct_jmp2_count
, cross_page
;
3737 TranslationBlock
*tb
;
3739 target_code_size
= 0;
3740 max_target_code_size
= 0;
3742 direct_jmp_count
= 0;
3743 direct_jmp2_count
= 0;
3744 for(i
= 0; i
< nb_tbs
; i
++) {
3746 target_code_size
+= tb
->size
;
3747 if (tb
->size
> max_target_code_size
)
3748 max_target_code_size
= tb
->size
;
3749 if (tb
->page_addr
[1] != -1)
3751 if (tb
->tb_next_offset
[0] != 0xffff) {
3753 if (tb
->tb_next_offset
[1] != 0xffff) {
3754 direct_jmp2_count
++;
3758 /* XXX: avoid using doubles ? */
3759 cpu_fprintf(f
, "Translation buffer state:\n");
3760 cpu_fprintf(f
, "gen code size %ld/%ld\n",
3761 code_gen_ptr
- code_gen_buffer
, code_gen_buffer_max_size
);
3762 cpu_fprintf(f
, "TB count %d/%d\n",
3763 nb_tbs
, code_gen_max_blocks
);
3764 cpu_fprintf(f
, "TB avg target size %d max=%d bytes\n",
3765 nb_tbs
? target_code_size
/ nb_tbs
: 0,
3766 max_target_code_size
);
3767 cpu_fprintf(f
, "TB avg host size %d bytes (expansion ratio: %0.1f)\n",
3768 nb_tbs
? (code_gen_ptr
- code_gen_buffer
) / nb_tbs
: 0,
3769 target_code_size
? (double) (code_gen_ptr
- code_gen_buffer
) / target_code_size
: 0);
3770 cpu_fprintf(f
, "cross page TB count %d (%d%%)\n",
3772 nb_tbs
? (cross_page
* 100) / nb_tbs
: 0);
3773 cpu_fprintf(f
, "direct jump count %d (%d%%) (2 jumps=%d %d%%)\n",
3775 nb_tbs
? (direct_jmp_count
* 100) / nb_tbs
: 0,
3777 nb_tbs
? (direct_jmp2_count
* 100) / nb_tbs
: 0);
3778 cpu_fprintf(f
, "\nStatistics:\n");
3779 cpu_fprintf(f
, "TB flush count %d\n", tb_flush_count
);
3780 cpu_fprintf(f
, "TB invalidate count %d\n", tb_phys_invalidate_count
);
3781 cpu_fprintf(f
, "TLB flush count %d\n", tlb_flush_count
);
3782 tcg_dump_info(f
, cpu_fprintf
);
3785 #if !defined(CONFIG_USER_ONLY)
3787 #define MMUSUFFIX _cmmu
3788 #define GETPC() NULL
3789 #define env cpu_single_env
3790 #define SOFTMMU_CODE_ACCESS
3793 #include "softmmu_template.h"
3796 #include "softmmu_template.h"
3799 #include "softmmu_template.h"
3802 #include "softmmu_template.h"