2 * Generic intermediate code generation.
4 * Copyright (C) 2016-2017 LluĂs Vilanova <vilanova@ac.upc.edu>
6 * This work is licensed under the terms of the GNU GPL, version 2 or later.
7 * See the COPYING file in the top-level directory.
10 #include "qemu/osdep.h"
12 #include "qemu/error-report.h"
13 #include "exec/exec-all.h"
14 #include "exec/translator.h"
15 #include "exec/plugin-gen.h"
16 #include "tcg/tcg-op-common.h"
17 #include "internal-target.h"
19 static void set_can_do_io(DisasContextBase
*db
, bool val
)
21 if (db
->saved_can_do_io
!= val
) {
22 db
->saved_can_do_io
= val
;
24 QEMU_BUILD_BUG_ON(sizeof_field(CPUState
, neg
.can_do_io
) != 1);
25 tcg_gen_st8_i32(tcg_constant_i32(val
), tcg_env
,
26 offsetof(ArchCPU
, parent_obj
.neg
.can_do_io
) -
27 offsetof(ArchCPU
, env
));
31 bool translator_io_start(DisasContextBase
*db
)
33 set_can_do_io(db
, true);
36 * Ensure that this instruction will be the last in the TB.
37 * The target may override this to something more forceful.
39 if (db
->is_jmp
== DISAS_NEXT
) {
40 db
->is_jmp
= DISAS_TOO_MANY
;
45 static TCGOp
*gen_tb_start(DisasContextBase
*db
, uint32_t cflags
)
47 TCGv_i32 count
= NULL
;
48 TCGOp
*icount_start_insn
= NULL
;
50 if ((cflags
& CF_USE_ICOUNT
) || !(cflags
& CF_NOIRQ
)) {
51 count
= tcg_temp_new_i32();
52 tcg_gen_ld_i32(count
, tcg_env
,
53 offsetof(ArchCPU
, parent_obj
.neg
.icount_decr
.u32
)
54 - offsetof(ArchCPU
, env
));
57 if (cflags
& CF_USE_ICOUNT
) {
59 * We emit a sub with a dummy immediate argument. Keep the insn index
60 * of the sub so that we later (when we know the actual insn count)
61 * can update the argument with the actual insn count.
63 tcg_gen_sub_i32(count
, count
, tcg_constant_i32(0));
64 icount_start_insn
= tcg_last_op();
68 * Emit the check against icount_decr.u32 to see if we should exit
69 * unless we suppress the check with CF_NOIRQ. If we are using
70 * icount and have suppressed interruption the higher level code
71 * should have ensured we don't run more instructions than the
74 if (cflags
& CF_NOIRQ
) {
75 tcg_ctx
->exitreq_label
= NULL
;
77 tcg_ctx
->exitreq_label
= gen_new_label();
78 tcg_gen_brcondi_i32(TCG_COND_LT
, count
, 0, tcg_ctx
->exitreq_label
);
81 if (cflags
& CF_USE_ICOUNT
) {
82 tcg_gen_st16_i32(count
, tcg_env
,
83 offsetof(ArchCPU
, parent_obj
.neg
.icount_decr
.u16
.low
)
84 - offsetof(ArchCPU
, env
));
88 * cpu->neg.can_do_io is set automatically here at the beginning of
89 * each translation block. The cost is minimal, plus it would be
90 * very easy to forget doing it in the translator.
92 set_can_do_io(db
, db
->max_insns
== 1);
94 return icount_start_insn
;
97 static void gen_tb_end(const TranslationBlock
*tb
, uint32_t cflags
,
98 TCGOp
*icount_start_insn
, int num_insns
)
100 if (cflags
& CF_USE_ICOUNT
) {
102 * Update the num_insn immediate parameter now that we know
103 * the actual insn count.
105 tcg_set_insn_param(icount_start_insn
, 2,
106 tcgv_i32_arg(tcg_constant_i32(num_insns
)));
109 if (tcg_ctx
->exitreq_label
) {
110 gen_set_label(tcg_ctx
->exitreq_label
);
111 tcg_gen_exit_tb(tb
, TB_EXIT_REQUESTED
);
115 bool translator_use_goto_tb(DisasContextBase
*db
, vaddr dest
)
117 /* Suppress goto_tb if requested. */
118 if (tb_cflags(db
->tb
) & CF_NO_GOTO_TB
) {
122 /* Check for the dest on the same page as the start of the TB. */
123 return ((db
->pc_first
^ dest
) & TARGET_PAGE_MASK
) == 0;
126 void translator_loop(CPUState
*cpu
, TranslationBlock
*tb
, int *max_insns
,
127 vaddr pc
, void *host_pc
, const TranslatorOps
*ops
,
128 DisasContextBase
*db
)
130 uint32_t cflags
= tb_cflags(tb
);
131 TCGOp
*icount_start_insn
;
134 /* Initialize DisasContext */
138 db
->is_jmp
= DISAS_NEXT
;
140 db
->max_insns
= *max_insns
;
141 db
->singlestep_enabled
= cflags
& CF_SINGLE_STEP
;
142 db
->saved_can_do_io
= -1;
143 db
->host_addr
[0] = host_pc
;
144 db
->host_addr
[1] = NULL
;
146 ops
->init_disas_context(db
, cpu
);
147 tcg_debug_assert(db
->is_jmp
== DISAS_NEXT
); /* no early exit */
149 /* Start translating. */
150 icount_start_insn
= gen_tb_start(db
, cflags
);
151 ops
->tb_start(db
, cpu
);
152 tcg_debug_assert(db
->is_jmp
== DISAS_NEXT
); /* no early exit */
154 plugin_enabled
= plugin_gen_tb_start(cpu
, db
, cflags
& CF_MEMI_ONLY
);
155 db
->plugin_enabled
= plugin_enabled
;
158 *max_insns
= ++db
->num_insns
;
159 ops
->insn_start(db
, cpu
);
160 tcg_debug_assert(db
->is_jmp
== DISAS_NEXT
); /* no early exit */
162 if (plugin_enabled
) {
163 plugin_gen_insn_start(cpu
, db
);
167 * Disassemble one instruction. The translate_insn hook should
168 * update db->pc_next and db->is_jmp to indicate what should be
169 * done next -- either exiting this loop or locate the start of
170 * the next instruction.
172 if (db
->num_insns
== db
->max_insns
) {
173 /* Accept I/O on the last instruction. */
174 set_can_do_io(db
, true);
176 ops
->translate_insn(db
, cpu
);
179 * We can't instrument after instructions that change control
180 * flow although this only really affects post-load operations.
182 * Calling plugin_gen_insn_end() before we possibly stop translation
183 * is important. Even if this ends up as dead code, plugin generation
184 * needs to see a matching plugin_gen_insn_{start,end}() pair in order
185 * to accurately track instrumented helpers that might access memory.
187 if (plugin_enabled
) {
188 plugin_gen_insn_end();
191 /* Stop translation if translate_insn so indicated. */
192 if (db
->is_jmp
!= DISAS_NEXT
) {
196 /* Stop translation if the output buffer is full,
197 or we have executed all of the allowed instructions. */
198 if (tcg_op_buf_full() || db
->num_insns
>= db
->max_insns
) {
199 db
->is_jmp
= DISAS_TOO_MANY
;
204 /* Emit code to exit the TB, as indicated by db->is_jmp. */
205 ops
->tb_stop(db
, cpu
);
206 gen_tb_end(tb
, cflags
, icount_start_insn
, db
->num_insns
);
208 if (plugin_enabled
) {
209 plugin_gen_tb_end(cpu
, db
->num_insns
);
212 /* The disas_log hook may use these values rather than recompute. */
213 tb
->size
= db
->pc_next
- db
->pc_first
;
214 tb
->icount
= db
->num_insns
;
216 if (qemu_loglevel_mask(CPU_LOG_TB_IN_ASM
)
217 && qemu_log_in_addr_range(db
->pc_first
)) {
218 FILE *logfile
= qemu_log_trylock();
220 fprintf(logfile
, "----------------\n");
221 ops
->disas_log(db
, cpu
, logfile
);
222 fprintf(logfile
, "\n");
223 qemu_log_unlock(logfile
);
228 static void *translator_access(CPUArchState
*env
, DisasContextBase
*db
,
229 vaddr pc
, size_t len
)
233 TranslationBlock
*tb
;
237 /* Use slow path if first page is MMIO. */
238 if (unlikely(tb_page_addr0(tb
) == -1)) {
243 if (likely(is_same_page(db
, end
))) {
244 host
= db
->host_addr
[0];
247 host
= db
->host_addr
[1];
248 base
= TARGET_PAGE_ALIGN(db
->pc_first
);
250 tb_page_addr_t page0
, old_page1
, new_page1
;
252 new_page1
= get_page_addr_code_hostp(env
, base
, &db
->host_addr
[1]);
255 * If the second page is MMIO, treat as if the first page
256 * was MMIO as well, so that we do not cache the TB.
258 if (unlikely(new_page1
== -1)) {
260 tb_set_page_addr0(tb
, -1);
265 * If this is not the first time around, and page1 matches,
266 * then we already have the page locked. Alternately, we're
267 * not doing anything to prevent the PTE from changing, so
268 * we might wind up with a different page, requiring us to
271 old_page1
= tb_page_addr1(tb
);
272 if (likely(new_page1
!= old_page1
)) {
273 page0
= tb_page_addr0(tb
);
274 if (unlikely(old_page1
!= -1)) {
275 tb_unlock_page1(page0
, old_page1
);
277 tb_set_page_addr1(tb
, new_page1
);
278 tb_lock_page1(page0
, new_page1
);
280 host
= db
->host_addr
[1];
283 /* Use slow path when crossing pages. */
284 if (is_same_page(db
, pc
)) {
289 tcg_debug_assert(pc
>= base
);
290 return host
+ (pc
- base
);
293 static void plugin_insn_append(abi_ptr pc
, const void *from
, size_t size
)
296 struct qemu_plugin_insn
*insn
= tcg_ctx
->plugin_insn
;
302 off
= pc
- insn
->vaddr
;
303 if (off
< insn
->data
->len
) {
304 g_byte_array_set_size(insn
->data
, off
);
305 } else if (off
> insn
->data
->len
) {
306 /* we have an unexpected gap */
307 g_assert_not_reached();
310 insn
->data
= g_byte_array_append(insn
->data
, from
, size
);
314 uint8_t translator_ldub(CPUArchState
*env
, DisasContextBase
*db
, abi_ptr pc
)
317 void *p
= translator_access(env
, db
, pc
, sizeof(ret
));
320 plugin_insn_append(pc
, p
, sizeof(ret
));
323 ret
= cpu_ldub_code(env
, pc
);
324 plugin_insn_append(pc
, &ret
, sizeof(ret
));
328 uint16_t translator_lduw(CPUArchState
*env
, DisasContextBase
*db
, abi_ptr pc
)
331 void *p
= translator_access(env
, db
, pc
, sizeof(ret
));
334 plugin_insn_append(pc
, p
, sizeof(ret
));
337 ret
= cpu_lduw_code(env
, pc
);
339 plugin_insn_append(pc
, &plug
, sizeof(ret
));
343 uint32_t translator_ldl(CPUArchState
*env
, DisasContextBase
*db
, abi_ptr pc
)
346 void *p
= translator_access(env
, db
, pc
, sizeof(ret
));
349 plugin_insn_append(pc
, p
, sizeof(ret
));
352 ret
= cpu_ldl_code(env
, pc
);
354 plugin_insn_append(pc
, &plug
, sizeof(ret
));
358 uint64_t translator_ldq(CPUArchState
*env
, DisasContextBase
*db
, abi_ptr pc
)
361 void *p
= translator_access(env
, db
, pc
, sizeof(ret
));
364 plugin_insn_append(pc
, p
, sizeof(ret
));
367 ret
= cpu_ldq_code(env
, pc
);
369 plugin_insn_append(pc
, &plug
, sizeof(ret
));
373 void translator_fake_ldb(uint8_t insn8
, abi_ptr pc
)
375 plugin_insn_append(pc
, &insn8
, sizeof(insn8
));