cpu-exec.c

   1 /*
   2  *  i386 emulator main execution loop
   3  *
   4  *  Copyright (c) 2003-2005 Fabrice Bellard
   5  *
   6  * This library is free software; you can redistribute it and/or
   7  * modify it under the terms of the GNU Lesser General Public
   8  * License as published by the Free Software Foundation; either
   9  * version 2 of the License, or (at your option) any later version.
  10  *
  11  * This library is distributed in the hope that it will be useful,
  12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  14  * Lesser General Public License for more details.
  15  *
  16  * You should have received a copy of the GNU Lesser General Public
  17  * License along with this library; if not, see <http://www.gnu.org/licenses/>.
  18  */
  19 #include "config.h"
  20 #include "exec.h"
  21 #include "disas.h"
  22 #include "tcg.h"
  23 #include "kvm.h"
  24 #include "qemu-barrier.h"
  25
  26 #if defined(__sparc__) && !defined(CONFIG_SOLARIS)
  27 // Work around ugly bugs in glibc that mangle global register contents
  28 #undef env
  29 #define env cpu_single_env
  30 #endif
  31
  32 int tb_invalidated_flag;
  33
  34 #define CONFIG_DEBUG_EXEC
  35
  36 int qemu_cpu_has_work(CPUState *env)
  37 {
  38     return cpu_has_work(env);
  39 }
  40
  41 void cpu_loop_exit(void)
  42 {
  43     env->current_tb = NULL;
  44     longjmp(env->jmp_env, 1);
  45 }
  46
  47 /* exit the current TB from a signal handler. The host registers are
  48    restored in a state compatible with the CPU emulator
  49  */
  50 #if defined(CONFIG_SOFTMMU)
  51 void cpu_resume_from_signal(CPUState *env1, void *puc)
  52 {
  53     env = env1;
  54
  55     /* XXX: restore cpu registers saved in host registers */
  56
  57     env->exception_index = -1;
  58     longjmp(env->jmp_env, 1);
  59 }
  60 #endif
  61
  62 /* Execute the code without caching the generated code. An interpreter
  63    could be used if available. */
  64 static void cpu_exec_nocache(int max_cycles, TranslationBlock *orig_tb)
  65 {
  66     unsigned long next_tb;
  67     TranslationBlock *tb;
  68
  69     /* Should never happen.
  70        We only end up here when an existing TB is too long.  */
  71     if (max_cycles > CF_COUNT_MASK)
  72         max_cycles = CF_COUNT_MASK;
  73
  74     tb = tb_gen_code(env, orig_tb->pc, orig_tb->cs_base, orig_tb->flags,
  75                      max_cycles);
  76     env->current_tb = tb;
  77     /* execute the generated code */
  78     next_tb = tcg_qemu_tb_exec(tb->tc_ptr);
  79     env->current_tb = NULL;
  80
  81     if ((next_tb & 3) == 2) {
  82         /* Restore PC.  This may happen if async event occurs before
  83            the TB starts executing.  */
  84         cpu_pc_from_tb(env, tb);
  85     }
  86     tb_phys_invalidate(tb, -1);
  87     tb_free(tb);
  88 }
  89
  90 static TranslationBlock *tb_find_slow(target_ulong pc,
  91                                       target_ulong cs_base,
  92                                       uint64_t flags)
  93 {
  94     TranslationBlock *tb, **ptb1;
  95     unsigned int h;
  96     tb_page_addr_t phys_pc, phys_page1, phys_page2;
  97     target_ulong virt_page2;
  98
  99     tb_invalidated_flag = 0;
 100
 101     /* find translated block using physical mappings */
 102     phys_pc = get_page_addr_code(env, pc);
 103     phys_page1 = phys_pc & TARGET_PAGE_MASK;
 104     phys_page2 = -1;
 105     h = tb_phys_hash_func(phys_pc);
 106     ptb1 = &tb_phys_hash[h];
 107     for(;;) {
 108         tb = *ptb1;
 109         if (!tb)
 110             goto not_found;
 111         if (tb->pc == pc &&
 112             tb->page_addr[0] == phys_page1 &&
 113             tb->cs_base == cs_base &&
 114             tb->flags == flags) {
 115             /* check next page if needed */
 116             if (tb->page_addr[1] != -1) {
 117                 virt_page2 = (pc & TARGET_PAGE_MASK) +
 118                     TARGET_PAGE_SIZE;
 119                 phys_page2 = get_page_addr_code(env, virt_page2);
 120                 if (tb->page_addr[1] == phys_page2)
 121                     goto found;
 122             } else {
 123                 goto found;
 124             }
 125         }
 126         ptb1 = &tb->phys_hash_next;
 127     }
 128  not_found:
 129    /* if no translated code available, then translate it now */
 130     tb = tb_gen_code(env, pc, cs_base, flags, 0);
 131
 132  found:
 133     /* Move the last found TB to the head of the list */
 134     if (likely(*ptb1)) {
 135         *ptb1 = tb->phys_hash_next;
 136         tb->phys_hash_next = tb_phys_hash[h];
 137         tb_phys_hash[h] = tb;
 138     }
 139     /* we add the TB in the virtual pc hash table */
 140     env->tb_jmp_cache[tb_jmp_cache_hash_func(pc)] = tb;
 141     return tb;
 142 }
 143
 144 static inline TranslationBlock *tb_find_fast(void)
 145 {
 146     TranslationBlock *tb;
 147     target_ulong cs_base, pc;
 148     int flags;
 149
 150     /* we record a subset of the CPU state. It will
 151        always be the same before a given translated block
 152        is executed. */
 153     cpu_get_tb_cpu_state(env, &pc, &cs_base, &flags);
 154     tb = env->tb_jmp_cache[tb_jmp_cache_hash_func(pc)];
 155     if (unlikely(!tb || tb->pc != pc || tb->cs_base != cs_base ||
 156                  tb->flags != flags)) {
 157         tb = tb_find_slow(pc, cs_base, flags);
 158     }
 159     return tb;
 160 }
 161
 162 static CPUDebugExcpHandler *debug_excp_handler;
 163
 164 CPUDebugExcpHandler *cpu_set_debug_excp_handler(CPUDebugExcpHandler *handler)
 165 {
 166     CPUDebugExcpHandler *old_handler = debug_excp_handler;
 167
 168     debug_excp_handler = handler;
 169     return old_handler;
 170 }
 171
 172 static void cpu_handle_debug_exception(CPUState *env)
 173 {
 174     CPUWatchpoint *wp;
 175
 176     if (!env->watchpoint_hit) {
 177         QTAILQ_FOREACH(wp, &env->watchpoints, entry) {
 178             wp->flags &= ~BP_WATCHPOINT_HIT;
 179         }
 180     }
 181     if (debug_excp_handler) {
 182         debug_excp_handler(env);
 183     }
 184 }
 185
 186 /* main execution loop */
 187
 188 volatile sig_atomic_t exit_request;
 189
 190 int cpu_exec(CPUState *env1)
 191 {
 192     volatile host_reg_t saved_env_reg;
 193     int ret, interrupt_request;
 194     TranslationBlock *tb;
 195     uint8_t *tc_ptr;
 196     unsigned long next_tb;
 197
 198     if (env1->halted) {
 199         if (!cpu_has_work(env1)) {
 200             return EXCP_HALTED;
 201         }
 202
 203         env1->halted = 0;
 204     }
 205
 206     cpu_single_env = env1;
 207
 208     /* the access to env below is actually saving the global register's
 209        value, so that files not including target-xyz/exec.h are free to
 210        use it.  */
 211     QEMU_BUILD_BUG_ON (sizeof (saved_env_reg) != sizeof (env));
 212     saved_env_reg = (host_reg_t) env;
 213     barrier();
 214     env = env1;
 215
 216     if (unlikely(exit_request)) {
 217         env->exit_request = 1;
 218     }
 219
 220 #if defined(TARGET_I386)
 221     /* put eflags in CPU temporary format */
 222     CC_SRC = env->eflags & (CC_O | CC_S | CC_Z | CC_A | CC_P | CC_C);
 223     DF = 1 - (2 * ((env->eflags >> 10) & 1));
 224     CC_OP = CC_OP_EFLAGS;
 225     env->eflags &= ~(DF_MASK | CC_O | CC_S | CC_Z | CC_A | CC_P | CC_C);
 226 #elif defined(TARGET_SPARC)
 227 #elif defined(TARGET_M68K)
 228     env->cc_op = CC_OP_FLAGS;
 229     env->cc_dest = env->sr & 0xf;
 230     env->cc_x = (env->sr >> 4) & 1;
 231 #elif defined(TARGET_ALPHA)
 232 #elif defined(TARGET_ARM)
 233 #elif defined(TARGET_UNICORE32)
 234 #elif defined(TARGET_PPC)
 235 #elif defined(TARGET_LM32)
 236 #elif defined(TARGET_MICROBLAZE)
 237 #elif defined(TARGET_MIPS)
 238 #elif defined(TARGET_SH4)
 239 #elif defined(TARGET_CRIS)
 240 #elif defined(TARGET_OPENRISC)
 241 #elif defined(TARGET_S390X)
 242     /* XXXXX */
 243 #else
 244 #error unsupported target CPU
 245 #endif
 246     env->exception_index = -1;
 247
 248     /* prepare setjmp context for exception handling */
 249     for(;;) {
 250         if (setjmp(env->jmp_env) == 0) {
 251 #if defined(__sparc__) && !defined(CONFIG_SOLARIS)
 252 #undef env
 253             env = cpu_single_env;
 254 #define env cpu_single_env
 255 #endif
 256             /* if an exception is pending, we execute it here */
 257             if (env->exception_index >= 0) {
 258                 if (env->exception_index >= EXCP_INTERRUPT) {
 259                     /* exit request from the cpu execution loop */
 260                     ret = env->exception_index;
 261                     if (ret == EXCP_DEBUG) {
 262                         cpu_handle_debug_exception(env);
 263                     }
 264                     break;
 265                 } else {
 266 #if defined(CONFIG_USER_ONLY)
 267                     /* if user mode only, we simulate a fake exception
 268                        which will be handled outside the cpu execution
 269                        loop */
 270 #if defined(TARGET_I386)
 271                     do_interrupt_user(env->exception_index,
 272                                       env->exception_is_int,
 273                                       env->error_code,
 274                                       env->exception_next_eip);
 275                     /* successfully delivered */
 276                     env->old_exception = -1;
 277 #endif
 278                     ret = env->exception_index;
 279                     break;
 280 #else
 281 #if defined(TARGET_I386)
 282                     /* simulate a real cpu exception. On i386, it can
 283                        trigger new exceptions, but we do not handle
 284                        double or triple faults yet. */
 285                     do_interrupt(env->exception_index,
 286                                  env->exception_is_int,
 287                                  env->error_code,
 288                                  env->exception_next_eip, 0);
 289                     /* successfully delivered */
 290                     env->old_exception = -1;
 291 #elif defined(TARGET_PPC)
 292                     do_interrupt(env);
 293 #elif defined(TARGET_LM32)
 294                     do_interrupt(env);
 295 #elif defined(TARGET_MICROBLAZE)
 296                     do_interrupt(env);
 297 #elif defined(TARGET_MIPS)
 298                     do_interrupt(env);
 299 #elif defined(TARGET_SPARC)
 300                     do_interrupt(env);
 301 #elif defined(TARGET_ARM)
 302                     do_interrupt(env);
 303 #elif defined(TARGET_UNICORE32)
 304                     do_interrupt(env);
 305 #elif defined(TARGET_SH4)
 306                     do_interrupt(env);
 307 #elif defined(TARGET_ALPHA)
 308                     do_interrupt(env);
 309 #elif defined(TARGET_CRIS)
 310                     do_interrupt(env);
 311 #elif defined(TARGET_M68K)
 312                     do_interrupt(0);
 313 #elif defined(TARGET_OPENRISC)
 314                     /* XXX: tempo */
 315                     do_interrupt(0);
 316 #elif defined(TARGET_S390X)
 317                     do_interrupt(env);
 318 #endif
 319                     env->exception_index = -1;
 320 #endif
 321                 }
 322             }
 323
 324             next_tb = 0; /* force lookup of first TB */
 325             for(;;) {
 326                 interrupt_request = env->interrupt_request;
 327                 if (unlikely(interrupt_request)) {
 328                     if (unlikely(env->singlestep_enabled & SSTEP_NOIRQ)) {
 329                         /* Mask out external interrupts for this step. */
 330                         interrupt_request &= ~CPU_INTERRUPT_SSTEP_MASK;
 331                     }
 332                     if (interrupt_request & CPU_INTERRUPT_DEBUG) {
 333                         env->interrupt_request &= ~CPU_INTERRUPT_DEBUG;
 334                         env->exception_index = EXCP_DEBUG;
 335                         cpu_loop_exit();
 336                     }
 337 #if defined(TARGET_ARM) || defined(TARGET_SPARC) || defined(TARGET_MIPS) || \
 338     defined(TARGET_PPC) || defined(TARGET_ALPHA) || defined(TARGET_CRIS) || \
 339     defined(TARGET_MICROBLAZE) || defined(TARGET_LM32) || defined(TARGET_UNICORE32)
 340                     if (interrupt_request & CPU_INTERRUPT_HALT) {
 341                         env->interrupt_request &= ~CPU_INTERRUPT_HALT;
 342                         env->halted = 1;
 343                         env->exception_index = EXCP_HLT;
 344                         cpu_loop_exit();
 345                     }
 346 #endif
 347 #if defined(TARGET_I386)
 348                     if (interrupt_request & CPU_INTERRUPT_INIT) {
 349                             svm_check_intercept(SVM_EXIT_INIT);
 350                             do_cpu_init(env);
 351                             env->exception_index = EXCP_HALTED;
 352                             cpu_loop_exit();
 353                     } else if (interrupt_request & CPU_INTERRUPT_SIPI) {
 354                             do_cpu_sipi(env);
 355                     } else if (env->hflags2 & HF2_GIF_MASK) {
 356                         if ((interrupt_request & CPU_INTERRUPT_SMI) &&
 357                             !(env->hflags & HF_SMM_MASK)) {
 358                             svm_check_intercept(SVM_EXIT_SMI);
 359                             env->interrupt_request &= ~CPU_INTERRUPT_SMI;
 360                             do_smm_enter();
 361                             next_tb = 0;
 362                         } else if ((interrupt_request & CPU_INTERRUPT_NMI) &&
 363                                    !(env->hflags2 & HF2_NMI_MASK)) {
 364                             env->interrupt_request &= ~CPU_INTERRUPT_NMI;
 365                             env->hflags2 |= HF2_NMI_MASK;
 366                             do_interrupt(EXCP02_NMI, 0, 0, 0, 1);
 367                             next_tb = 0;
 368                         } else if (interrupt_request & CPU_INTERRUPT_MCE) {
 369                             env->interrupt_request &= ~CPU_INTERRUPT_MCE;
 370                             do_interrupt(EXCP12_MCHK, 0, 0, 0, 0);
 371                             next_tb = 0;
 372                         } else if ((interrupt_request & CPU_INTERRUPT_HARD) &&
 373                                    (((env->hflags2 & HF2_VINTR_MASK) &&
 374                                      (env->hflags2 & HF2_HIF_MASK)) ||
 375                                     (!(env->hflags2 & HF2_VINTR_MASK) &&
 376                                      (env->eflags & IF_MASK &&
 377                                       !(env->hflags & HF_INHIBIT_IRQ_MASK))))) {
 378                             int intno;
 379                             svm_check_intercept(SVM_EXIT_INTR);
 380                             env->interrupt_request &= ~(CPU_INTERRUPT_HARD | CPU_INTERRUPT_VIRQ);
 381                             intno = cpu_get_pic_interrupt(env);
 382                             qemu_log_mask(CPU_LOG_TB_IN_ASM, "Servicing hardware INT=0x%02x\n", intno);
 383 #if defined(__sparc__) && !defined(CONFIG_SOLARIS)
 384 #undef env
 385                     env = cpu_single_env;
 386 #define env cpu_single_env
 387 #endif
 388                             do_interrupt(intno, 0, 0, 0, 1);
 389                             /* ensure that no TB jump will be modified as
 390                                the program flow was changed */
 391                             next_tb = 0;
 392 #if !defined(CONFIG_USER_ONLY)
 393                         } else if ((interrupt_request & CPU_INTERRUPT_VIRQ) &&
 394                                    (env->eflags & IF_MASK) &&
 395                                    !(env->hflags & HF_INHIBIT_IRQ_MASK)) {
 396                             int intno;
 397                             /* FIXME: this should respect TPR */
 398                             svm_check_intercept(SVM_EXIT_VINTR);
 399                             intno = ldl_phys(env->vm_vmcb + offsetof(struct vmcb, control.int_vector));
 400                             qemu_log_mask(CPU_LOG_TB_IN_ASM, "Servicing virtual hardware INT=0x%02x\n", intno);
 401                             do_interrupt(intno, 0, 0, 0, 1);
 402                             env->interrupt_request &= ~CPU_INTERRUPT_VIRQ;
 403                             next_tb = 0;
 404 #endif
 405                         }
 406                     }
 407 #elif defined(TARGET_PPC)
 408 #if 0
 409                     if ((interrupt_request & CPU_INTERRUPT_RESET)) {
 410                         cpu_reset(env);
 411                     }
 412 #endif
 413                     if (interrupt_request & CPU_INTERRUPT_HARD) {
 414                         ppc_hw_interrupt(env);
 415                         if (env->pending_interrupts == 0)
 416                             env->interrupt_request &= ~CPU_INTERRUPT_HARD;
 417                         next_tb = 0;
 418                     }
 419 #elif defined(TARGET_LM32)
 420                     if ((interrupt_request & CPU_INTERRUPT_HARD)
 421                         && (env->ie & IE_IE)) {
 422                         env->exception_index = EXCP_IRQ;
 423                         do_interrupt(env);
 424                         next_tb = 0;
 425                     }
 426 #elif defined(TARGET_MICROBLAZE)
 427                     if ((interrupt_request & CPU_INTERRUPT_HARD)
 428                         && (env->sregs[SR_MSR] & MSR_IE)
 429                         && !(env->sregs[SR_MSR] & (MSR_EIP | MSR_BIP))
 430                         && !(env->iflags & (D_FLAG | IMM_FLAG))) {
 431                         env->exception_index = EXCP_IRQ;
 432                         do_interrupt(env);
 433                         next_tb = 0;
 434                     }
 435 #elif defined(TARGET_MIPS)
 436                     if ((interrupt_request & CPU_INTERRUPT_HARD) &&
 437                         cpu_mips_hw_interrupts_pending(env)) {
 438                         /* Raise it */
 439                         env->exception_index = EXCP_EXT_INTERRUPT;
 440                         env->error_code = 0;
 441                         do_interrupt(env);
 442                         next_tb = 0;
 443                     }
 444 #elif defined(TARGET_SPARC)
 445                     if (interrupt_request & CPU_INTERRUPT_HARD) {
 446                         if (cpu_interrupts_enabled(env) &&
 447                             env->interrupt_index > 0) {
 448                             int pil = env->interrupt_index & 0xf;
 449                             int type = env->interrupt_index & 0xf0;
 450
 451                             if (((type == TT_EXTINT) &&
 452                                   cpu_pil_allowed(env, pil)) ||
 453                                   type != TT_EXTINT) {
 454                                 env->exception_index = env->interrupt_index;
 455                                 do_interrupt(env);
 456                                 next_tb = 0;
 457                             }
 458                         }
 459                     }
 460 #elif defined(TARGET_ARM)
 461                     if (interrupt_request & CPU_INTERRUPT_FIQ
 462                         && !(env->uncached_cpsr & CPSR_F)) {
 463                         env->exception_index = EXCP_FIQ;
 464                         do_interrupt(env);
 465                         next_tb = 0;
 466                     }
 467                     /* ARMv7-M interrupt return works by loading a magic value
 468                        into the PC.  On real hardware the load causes the
 469                        return to occur.  The qemu implementation performs the
 470                        jump normally, then does the exception return when the
 471                        CPU tries to execute code at the magic address.
 472                        This will cause the magic PC value to be pushed to
 473                        the stack if an interrupt occurred at the wrong time.
 474                        We avoid this by disabling interrupts when
 475                        pc contains a magic address.  */
 476                     if (interrupt_request & CPU_INTERRUPT_HARD
 477                         && ((IS_M(env) && env->regs[15] < 0xfffffff0)
 478                             || !(env->uncached_cpsr & CPSR_I))) {
 479                         env->exception_index = EXCP_IRQ;
 480                         do_interrupt(env);
 481                         next_tb = 0;
 482                     }
 483 #elif defined(TARGET_UNICORE32)
 484                     if (interrupt_request & CPU_INTERRUPT_HARD
 485                         && !(env->uncached_asr & ASR_I)) {
 486                         do_interrupt(env);
 487                         next_tb = 0;
 488                     }
 489 #elif defined(TARGET_SH4)
 490                     if (interrupt_request & CPU_INTERRUPT_HARD) {
 491                         do_interrupt(env);
 492                         next_tb = 0;
 493                     }
 494 #elif defined(TARGET_ALPHA)
 495                     if (interrupt_request & CPU_INTERRUPT_HARD) {
 496                         do_interrupt(env);
 497                         next_tb = 0;
 498                     }
 499 #elif defined(TARGET_CRIS)
 500                     if (interrupt_request & CPU_INTERRUPT_HARD
 501                         && (env->pregs[PR_CCS] & I_FLAG)
 502                         && !env->locked_irq) {
 503                         env->exception_index = EXCP_IRQ;
 504                         do_interrupt(env);
 505                         next_tb = 0;
 506                     }
 507                     if (interrupt_request & CPU_INTERRUPT_NMI
 508                         && (env->pregs[PR_CCS] & M_FLAG)) {
 509                         env->exception_index = EXCP_NMI;
 510                         do_interrupt(env);
 511                         next_tb = 0;
 512                     }
 513 #elif defined(TARGET_M68K)
 514                     if (interrupt_request & CPU_INTERRUPT_HARD
 515                         && ((env->sr & SR_I) >> SR_I_SHIFT)
 516                             < env->pending_level) {
 517                         /* Real hardware gets the interrupt vector via an
 518                            IACK cycle at this point.  Current emulated
 519                            hardware doesn't rely on this, so we
 520                            provide/save the vector when the interrupt is
 521                            first signalled.  */
 522                         env->exception_index = env->pending_vector;
 523                         do_interrupt(1);
 524                         next_tb = 0;
 525                     }
 526 #elif defined(TARGET_OPENRISC)
 527                     if (interrupt_request & CPU_INTERRUPT_HARD) {
 528                         do_interrupt(env);
 529                         next_tb = 0;
 530                     }
 531 #elif defined(TARGET_S390X) && !defined(CONFIG_USER_ONLY)
 532                     if ((interrupt_request & CPU_INTERRUPT_HARD) &&
 533                         (env->psw.mask & PSW_MASK_EXT)) {
 534                         do_interrupt(env);
 535                         next_tb = 0;
 536                     }
 537 #endif
 538                    /* Don't use the cached interrupt_request value,
 539                       do_interrupt may have updated the EXITTB flag. */
 540                     if (env->interrupt_request & CPU_INTERRUPT_EXITTB) {
 541                         env->interrupt_request &= ~CPU_INTERRUPT_EXITTB;
 542                         /* ensure that no TB jump will be modified as
 543                            the program flow was changed */
 544                         next_tb = 0;
 545                     }
 546                 }
 547                 if (unlikely(env->exit_request)) {
 548                     env->exit_request = 0;
 549                     env->exception_index = EXCP_INTERRUPT;
 550                     cpu_loop_exit();
 551                 }
 552 #if defined(DEBUG_DISAS) || defined(CONFIG_DEBUG_EXEC)
 553                 if (qemu_loglevel_mask(CPU_LOG_TB_CPU)) {
 554                     /* restore flags in standard format */
 555 #if defined(TARGET_I386)
 556                     env->eflags = env->eflags | helper_cc_compute_all(CC_OP) | (DF & DF_MASK);
 557                     log_cpu_state(env, X86_DUMP_CCOP);
 558                     env->eflags &= ~(DF_MASK | CC_O | CC_S | CC_Z | CC_A | CC_P | CC_C);
 559 #elif defined(TARGET_M68K)
 560                     cpu_m68k_flush_flags(env, env->cc_op);
 561                     env->cc_op = CC_OP_FLAGS;
 562                     env->sr = (env->sr & 0xffe0)
 563                               | env->cc_dest | (env->cc_x << 4);
 564                     log_cpu_state(env, 0);
 565 #elif defined(TARGET_OPENRISC)
 566                     /* OR1K */
 567                     log_cpu_state(env, 0);
 568 #else
 569                     log_cpu_state(env, 0);
 570 #endif
 571                 }
 572 #endif /* DEBUG_DISAS || CONFIG_DEBUG_EXEC */
 573                 spin_lock(&tb_lock);
 574                 tb = tb_find_fast();
 575                 /* Note: we do it here to avoid a gcc bug on Mac OS X when
 576                    doing it in tb_find_slow */
 577                 if (tb_invalidated_flag) {
 578                     /* as some TB could have been invalidated because
 579                        of memory exceptions while generating the code, we
 580                        must recompute the hash index here */
 581                     next_tb = 0;
 582                     tb_invalidated_flag = 0;
 583                 }
 584 #ifdef CONFIG_DEBUG_EXEC
 585                 qemu_log_mask(CPU_LOG_EXEC, "Trace 0x%08lx [" TARGET_FMT_lx "] %s\n",
 586                              (long)tb->tc_ptr, tb->pc,
 587                              lookup_symbol(tb->pc));
 588 #endif
 589                 /* see if we can patch the calling TB. When the TB
 590                    spans two pages, we cannot safely do a direct
 591                    jump. */
 592                 if (next_tb != 0 && tb->page_addr[1] == -1) {
 593                     tb_add_jump((TranslationBlock *)(next_tb & ~3), next_tb & 3, tb);
 594                 }
 595                 spin_unlock(&tb_lock);
 596
 597                 /* cpu_interrupt might be called while translating the
 598                    TB, but before it is linked into a potentially
 599                    infinite loop and becomes env->current_tb. Avoid
 600                    starting execution if there is a pending interrupt. */
 601                 env->current_tb = tb;
 602                 barrier();
 603                 if (likely(!env->exit_request)) {
 604                     tc_ptr = tb->tc_ptr;
 605                 /* execute the generated code */
 606 #if defined(__sparc__) && !defined(CONFIG_SOLARIS)
 607 #undef env
 608                     env = cpu_single_env;
 609 #define env cpu_single_env
 610 #endif
 611                     next_tb = tcg_qemu_tb_exec(tc_ptr);
 612                     if ((next_tb & 3) == 2) {
 613                         /* Instruction counter expired.  */
 614                         int insns_left;
 615                         tb = (TranslationBlock *)(long)(next_tb & ~3);
 616                         /* Restore PC.  */
 617                         cpu_pc_from_tb(env, tb);
 618                         insns_left = env->icount_decr.u32;
 619                         if (env->icount_extra && insns_left >= 0) {
 620                             /* Refill decrementer and continue execution.  */
 621                             env->icount_extra += insns_left;
 622                             if (env->icount_extra > 0xffff) {
 623                                 insns_left = 0xffff;
 624                             } else {
 625                                 insns_left = env->icount_extra;
 626                             }
 627                             env->icount_extra -= insns_left;
 628                             env->icount_decr.u16.low = insns_left;
 629                         } else {
 630                             if (insns_left > 0) {
 631                                 /* Execute remaining instructions.  */
 632                                 cpu_exec_nocache(insns_left, tb);
 633                             }
 634                             env->exception_index = EXCP_INTERRUPT;
 635                             next_tb = 0;
 636                             cpu_loop_exit();
 637                         }
 638                     }
 639                 }
 640                 env->current_tb = NULL;
 641                 /* reset soft MMU for next block (it can currently
 642                    only be set by a memory fault) */
 643             } /* for(;;) */
 644         }
 645     } /* for(;;) */
 646
 647
 648 #if defined(TARGET_I386)
 649     /* restore flags in standard format */
 650     env->eflags = env->eflags | helper_cc_compute_all(CC_OP) | (DF & DF_MASK);
 651 #elif defined(TARGET_ARM)
 652     /* XXX: Save/restore host fpu exception state?.  */
 653 #elif defined(TARGET_UNICORE32)
 654 #elif defined(TARGET_SPARC)
 655 #elif defined(TARGET_PPC)
 656 #elif defined(TARGET_LM32)
 657 #elif defined(TARGET_M68K)
 658     cpu_m68k_flush_flags(env, env->cc_op);
 659     env->cc_op = CC_OP_FLAGS;
 660     env->sr = (env->sr & 0xffe0)
 661               | env->cc_dest | (env->cc_x << 4);
 662 #elif defined(TARGET_MICROBLAZE)
 663 #elif defined(TARGET_MIPS)
 664 #elif defined(TARGET_SH4)
 665 #elif defined(TARGET_ALPHA)
 666 #elif defined(TARGET_CRIS)
 667 #elif defined(TARGET_OPENRISC)
 668 #elif defined(TARGET_S390X)
 669     /* XXXXX */
 670 #else
 671 #error unsupported target CPU
 672 #endif
 673
 674     /* restore global registers */
 675     barrier();
 676     env = (void *) saved_env_reg;
 677
 678     /* fail safe : never use cpu_single_env outside cpu_exec() */
 679     cpu_single_env = NULL;
 680     return ret;
 681 }