cpu-exec.c

   1 /*
   2  *  i386 emulator main execution loop
   3  *
   4  *  Copyright (c) 2003-2005 Fabrice Bellard
   5  *
   6  * This library is free software; you can redistribute it and/or
   7  * modify it under the terms of the GNU Lesser General Public
   8  * License as published by the Free Software Foundation; either
   9  * version 2 of the License, or (at your option) any later version.
  10  *
  11  * This library is distributed in the hope that it will be useful,
  12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  14  * Lesser General Public License for more details.
  15  *
  16  * You should have received a copy of the GNU Lesser General Public
  17  * License along with this library; if not, see <http://www.gnu.org/licenses/>.
  18  */
  19 #include "config.h"
  20 #include "exec.h"
  21 #include "disas.h"
  22 #if !defined(TARGET_IA64)
  23 #include "tcg.h"
  24 #endif
  25 #include "kvm.h"
  26 #include "qemu-barrier.h"
  27
  28 #if !defined(CONFIG_SOFTMMU)
  29 #undef EAX
  30 #undef ECX
  31 #undef EDX
  32 #undef EBX
  33 #undef ESP
  34 #undef EBP
  35 #undef ESI
  36 #undef EDI
  37 #undef EIP
  38 #include <signal.h>
  39 #ifdef __linux__
  40 #include <sys/ucontext.h>
  41 #endif
  42 #endif
  43
  44 #include "qemu-kvm.h"
  45
  46 #if defined(__sparc__) && !defined(CONFIG_SOLARIS)
  47 // Work around ugly bugs in glibc that mangle global register contents
  48 #undef env
  49 #define env cpu_single_env
  50 #endif
  51
  52 int tb_invalidated_flag;
  53
  54 //#define CONFIG_DEBUG_EXEC
  55 //#define DEBUG_SIGNAL
  56
  57 int qemu_cpu_has_work(CPUState *env)
  58 {
  59     return cpu_has_work(env);
  60 }
  61
  62 void cpu_loop_exit(void)
  63 {
  64     env->current_tb = NULL;
  65     longjmp(env->jmp_env, 1);
  66 }
  67
  68 /* exit the current TB from a signal handler. The host registers are
  69    restored in a state compatible with the CPU emulator
  70  */
  71 void cpu_resume_from_signal(CPUState *env1, void *puc)
  72 {
  73 #if !defined(CONFIG_SOFTMMU)
  74 #ifdef __linux__
  75     struct ucontext *uc = puc;
  76 #elif defined(__OpenBSD__)
  77     struct sigcontext *uc = puc;
  78 #endif
  79 #endif
  80
  81     env = env1;
  82
  83     /* XXX: restore cpu registers saved in host registers */
  84
  85 #if !defined(CONFIG_SOFTMMU)
  86     if (puc) {
  87         /* XXX: use siglongjmp ? */
  88 #ifdef __linux__
  89 #ifdef __ia64
  90         sigprocmask(SIG_SETMASK, (sigset_t *)&uc->uc_sigmask, NULL);
  91 #else
  92         sigprocmask(SIG_SETMASK, &uc->uc_sigmask, NULL);
  93 #endif
  94 #elif defined(__OpenBSD__)
  95         sigprocmask(SIG_SETMASK, &uc->sc_mask, NULL);
  96 #endif
  97     }
  98 #endif
  99     env->exception_index = -1;
 100     longjmp(env->jmp_env, 1);
 101 }
 102
 103 /* Execute the code without caching the generated code. An interpreter
 104    could be used if available. */
 105 static void cpu_exec_nocache(int max_cycles, TranslationBlock *orig_tb)
 106 {
 107     unsigned long next_tb;
 108     TranslationBlock *tb;
 109
 110     /* Should never happen.
 111        We only end up here when an existing TB is too long.  */
 112     if (max_cycles > CF_COUNT_MASK)
 113         max_cycles = CF_COUNT_MASK;
 114
 115     tb = tb_gen_code(env, orig_tb->pc, orig_tb->cs_base, orig_tb->flags,
 116                      max_cycles);
 117     env->current_tb = tb;
 118     /* execute the generated code */
 119     next_tb = tcg_qemu_tb_exec(tb->tc_ptr);
 120     env->current_tb = NULL;
 121
 122     if ((next_tb & 3) == 2) {
 123         /* Restore PC.  This may happen if async event occurs before
 124            the TB starts executing.  */
 125         cpu_pc_from_tb(env, tb);
 126     }
 127     tb_phys_invalidate(tb, -1);
 128     tb_free(tb);
 129 }
 130
 131 static TranslationBlock *tb_find_slow(target_ulong pc,
 132                                       target_ulong cs_base,
 133                                       uint64_t flags)
 134 {
 135     TranslationBlock *tb, **ptb1;
 136     unsigned int h;
 137     tb_page_addr_t phys_pc, phys_page1, phys_page2;
 138     target_ulong virt_page2;
 139
 140     tb_invalidated_flag = 0;
 141
 142     /* find translated block using physical mappings */
 143     phys_pc = get_page_addr_code(env, pc);
 144     phys_page1 = phys_pc & TARGET_PAGE_MASK;
 145     phys_page2 = -1;
 146     h = tb_phys_hash_func(phys_pc);
 147     ptb1 = &tb_phys_hash[h];
 148     for(;;) {
 149         tb = *ptb1;
 150         if (!tb)
 151             goto not_found;
 152         if (tb->pc == pc &&
 153             tb->page_addr[0] == phys_page1 &&
 154             tb->cs_base == cs_base &&
 155             tb->flags == flags) {
 156             /* check next page if needed */
 157             if (tb->page_addr[1] != -1) {
 158                 virt_page2 = (pc & TARGET_PAGE_MASK) +
 159                     TARGET_PAGE_SIZE;
 160                 phys_page2 = get_page_addr_code(env, virt_page2);
 161                 if (tb->page_addr[1] == phys_page2)
 162                     goto found;
 163             } else {
 164                 goto found;
 165             }
 166         }
 167         ptb1 = &tb->phys_hash_next;
 168     }
 169  not_found:
 170    /* if no translated code available, then translate it now */
 171     tb = tb_gen_code(env, pc, cs_base, flags, 0);
 172
 173  found:
 174     /* Move the last found TB to the head of the list */
 175     if (likely(*ptb1)) {
 176         *ptb1 = tb->phys_hash_next;
 177         tb->phys_hash_next = tb_phys_hash[h];
 178         tb_phys_hash[h] = tb;
 179     }
 180     /* we add the TB in the virtual pc hash table */
 181     env->tb_jmp_cache[tb_jmp_cache_hash_func(pc)] = tb;
 182     return tb;
 183 }
 184
 185 static inline TranslationBlock *tb_find_fast(void)
 186 {
 187     TranslationBlock *tb;
 188     target_ulong cs_base, pc;
 189     int flags;
 190
 191     /* we record a subset of the CPU state. It will
 192        always be the same before a given translated block
 193        is executed. */
 194     cpu_get_tb_cpu_state(env, &pc, &cs_base, &flags);
 195     tb = env->tb_jmp_cache[tb_jmp_cache_hash_func(pc)];
 196     if (unlikely(!tb || tb->pc != pc || tb->cs_base != cs_base ||
 197                  tb->flags != flags)) {
 198         tb = tb_find_slow(pc, cs_base, flags);
 199     }
 200     return tb;
 201 }
 202
 203 /* main execution loop */
 204
 205 volatile sig_atomic_t exit_request;
 206
 207 int cpu_exec(CPUState *env1)
 208 {
 209     volatile host_reg_t saved_env_reg;
 210     int ret, interrupt_request;
 211     TranslationBlock *tb;
 212     uint8_t *tc_ptr;
 213     unsigned long next_tb;
 214
 215     if (cpu_halted(env1) == EXCP_HALTED)
 216         return EXCP_HALTED;
 217
 218     cpu_single_env = env1;
 219
 220     /* the access to env below is actually saving the global register's
 221        value, so that files not including target-xyz/exec.h are free to
 222        use it.  */
 223     QEMU_BUILD_BUG_ON (sizeof (saved_env_reg) != sizeof (env));
 224     saved_env_reg = (host_reg_t) env;
 225     barrier();
 226     env = env1;
 227
 228     if (unlikely(exit_request)) {
 229         env->exit_request = 1;
 230     }
 231
 232 #if defined(TARGET_I386)
 233     /* put eflags in CPU temporary format */
 234     CC_SRC = env->eflags & (CC_O | CC_S | CC_Z | CC_A | CC_P | CC_C);
 235     DF = 1 - (2 * ((env->eflags >> 10) & 1));
 236     CC_OP = CC_OP_EFLAGS;
 237     env->eflags &= ~(DF_MASK | CC_O | CC_S | CC_Z | CC_A | CC_P | CC_C);
 238 #elif defined(TARGET_SPARC)
 239 #elif defined(TARGET_M68K)
 240     env->cc_op = CC_OP_FLAGS;
 241     env->cc_dest = env->sr & 0xf;
 242     env->cc_x = (env->sr >> 4) & 1;
 243 #elif defined(TARGET_ALPHA)
 244 #elif defined(TARGET_ARM)
 245 #elif defined(TARGET_PPC)
 246 #elif defined(TARGET_MICROBLAZE)
 247 #elif defined(TARGET_MIPS)
 248 #elif defined(TARGET_SH4)
 249 #elif defined(TARGET_CRIS)
 250 #elif defined(TARGET_S390X)
 251 #elif defined(TARGET_IA64)
 252     /* XXXXX */
 253 #else
 254 #error unsupported target CPU
 255 #endif
 256     env->exception_index = -1;
 257
 258     /* prepare setjmp context for exception handling */
 259     for(;;) {
 260         if (setjmp(env->jmp_env) == 0) {
 261 #if defined(__sparc__) && !defined(CONFIG_SOLARIS)
 262 #undef env
 263             env = cpu_single_env;
 264 #define env cpu_single_env
 265 #endif
 266             /* if an exception is pending, we execute it here */
 267             if (env->exception_index >= 0) {
 268                 if (env->exception_index >= EXCP_INTERRUPT) {
 269                     /* exit request from the cpu execution loop */
 270                     ret = env->exception_index;
 271                     break;
 272                 } else {
 273 #if defined(CONFIG_USER_ONLY)
 274                     /* if user mode only, we simulate a fake exception
 275                        which will be handled outside the cpu execution
 276                        loop */
 277 #if defined(TARGET_I386)
 278                     do_interrupt_user(env->exception_index,
 279                                       env->exception_is_int,
 280                                       env->error_code,
 281                                       env->exception_next_eip);
 282                     /* successfully delivered */
 283                     env->old_exception = -1;
 284 #endif
 285                     ret = env->exception_index;
 286                     break;
 287 #else
 288 #if defined(TARGET_I386)
 289                     /* simulate a real cpu exception. On i386, it can
 290                        trigger new exceptions, but we do not handle
 291                        double or triple faults yet. */
 292                     do_interrupt(env->exception_index,
 293                                  env->exception_is_int,
 294                                  env->error_code,
 295                                  env->exception_next_eip, 0);
 296                     /* successfully delivered */
 297                     env->old_exception = -1;
 298 #elif defined(TARGET_PPC)
 299                     do_interrupt(env);
 300 #elif defined(TARGET_MICROBLAZE)
 301                     do_interrupt(env);
 302 #elif defined(TARGET_MIPS)
 303                     do_interrupt(env);
 304 #elif defined(TARGET_SPARC)
 305                     do_interrupt(env);
 306 #elif defined(TARGET_ARM)
 307                     do_interrupt(env);
 308 #elif defined(TARGET_SH4)
 309                     do_interrupt(env);
 310 #elif defined(TARGET_ALPHA)
 311                     do_interrupt(env);
 312 #elif defined(TARGET_CRIS)
 313                     do_interrupt(env);
 314 #elif defined(TARGET_M68K)
 315                     do_interrupt(0);
 316 #elif defined(TARGET_IA64)
 317                     do_interrupt(env);
 318 #endif
 319                     env->exception_index = -1;
 320 #endif
 321                 }
 322             }
 323
 324             next_tb = 0; /* force lookup of first TB */
 325             for(;;) {
 326                 interrupt_request = env->interrupt_request;
 327                 if (unlikely(interrupt_request)) {
 328                     if (unlikely(env->singlestep_enabled & SSTEP_NOIRQ)) {
 329                         /* Mask out external interrupts for this step. */
 330                         interrupt_request &= ~(CPU_INTERRUPT_HARD |
 331                                                CPU_INTERRUPT_FIQ |
 332                                                CPU_INTERRUPT_SMI |
 333                                                CPU_INTERRUPT_NMI);
 334                     }
 335                     if (interrupt_request & CPU_INTERRUPT_DEBUG) {
 336                         env->interrupt_request &= ~CPU_INTERRUPT_DEBUG;
 337                         env->exception_index = EXCP_DEBUG;
 338                         cpu_loop_exit();
 339                     }
 340 #if defined(TARGET_ARM) || defined(TARGET_SPARC) || defined(TARGET_MIPS) || \
 341     defined(TARGET_PPC) || defined(TARGET_ALPHA) || defined(TARGET_CRIS) || \
 342     defined(TARGET_MICROBLAZE)
 343                     if (interrupt_request & CPU_INTERRUPT_HALT) {
 344                         env->interrupt_request &= ~CPU_INTERRUPT_HALT;
 345                         env->halted = 1;
 346                         env->exception_index = EXCP_HLT;
 347                         cpu_loop_exit();
 348                     }
 349 #endif
 350 #if defined(TARGET_I386)
 351                     if (interrupt_request & CPU_INTERRUPT_INIT) {
 352                             svm_check_intercept(SVM_EXIT_INIT);
 353                             do_cpu_init(env);
 354                             env->exception_index = EXCP_HALTED;
 355                             cpu_loop_exit();
 356                     } else if (interrupt_request & CPU_INTERRUPT_SIPI) {
 357                             do_cpu_sipi(env);
 358                     } else if (env->hflags2 & HF2_GIF_MASK) {
 359                         if ((interrupt_request & CPU_INTERRUPT_SMI) &&
 360                             !(env->hflags & HF_SMM_MASK)) {
 361                             svm_check_intercept(SVM_EXIT_SMI);
 362                             env->interrupt_request &= ~CPU_INTERRUPT_SMI;
 363                             do_smm_enter();
 364                             next_tb = 0;
 365                         } else if ((interrupt_request & CPU_INTERRUPT_NMI) &&
 366                                    !(env->hflags2 & HF2_NMI_MASK)) {
 367                             env->interrupt_request &= ~CPU_INTERRUPT_NMI;
 368                             env->hflags2 |= HF2_NMI_MASK;
 369                             do_interrupt(EXCP02_NMI, 0, 0, 0, 1);
 370                             next_tb = 0;
 371                         } else if (interrupt_request & CPU_INTERRUPT_MCE) {
 372                             env->interrupt_request &= ~CPU_INTERRUPT_MCE;
 373                             do_interrupt(EXCP12_MCHK, 0, 0, 0, 0);
 374                             next_tb = 0;
 375                         } else if ((interrupt_request & CPU_INTERRUPT_HARD) &&
 376                                    (((env->hflags2 & HF2_VINTR_MASK) &&
 377                                      (env->hflags2 & HF2_HIF_MASK)) ||
 378                                     (!(env->hflags2 & HF2_VINTR_MASK) &&
 379                                      (env->eflags & IF_MASK &&
 380                                       !(env->hflags & HF_INHIBIT_IRQ_MASK))))) {
 381                             int intno;
 382                             svm_check_intercept(SVM_EXIT_INTR);
 383                             env->interrupt_request &= ~(CPU_INTERRUPT_HARD | CPU_INTERRUPT_VIRQ);
 384                             intno = cpu_get_pic_interrupt(env);
 385                             qemu_log_mask(CPU_LOG_TB_IN_ASM, "Servicing hardware INT=0x%02x\n", intno);
 386 #if defined(__sparc__) && !defined(CONFIG_SOLARIS)
 387 #undef env
 388                     env = cpu_single_env;
 389 #define env cpu_single_env
 390 #endif
 391                             do_interrupt(intno, 0, 0, 0, 1);
 392                             /* ensure that no TB jump will be modified as
 393                                the program flow was changed */
 394                             next_tb = 0;
 395 #if !defined(CONFIG_USER_ONLY)
 396                         } else if ((interrupt_request & CPU_INTERRUPT_VIRQ) &&
 397                                    (env->eflags & IF_MASK) &&
 398                                    !(env->hflags & HF_INHIBIT_IRQ_MASK)) {
 399                             int intno;
 400                             /* FIXME: this should respect TPR */
 401                             svm_check_intercept(SVM_EXIT_VINTR);
 402                             intno = ldl_phys(env->vm_vmcb + offsetof(struct vmcb, control.int_vector));
 403                             qemu_log_mask(CPU_LOG_TB_IN_ASM, "Servicing virtual hardware INT=0x%02x\n", intno);
 404                             do_interrupt(intno, 0, 0, 0, 1);
 405                             env->interrupt_request &= ~CPU_INTERRUPT_VIRQ;
 406                             next_tb = 0;
 407 #endif
 408                         }
 409                     }
 410 #elif defined(TARGET_PPC)
 411 #if 0
 412                     if ((interrupt_request & CPU_INTERRUPT_RESET)) {
 413                         cpu_reset(env);
 414                     }
 415 #endif
 416                     if (interrupt_request & CPU_INTERRUPT_HARD) {
 417                         ppc_hw_interrupt(env);
 418                         if (env->pending_interrupts == 0)
 419                             env->interrupt_request &= ~CPU_INTERRUPT_HARD;
 420                         next_tb = 0;
 421                     }
 422 #elif defined(TARGET_MICROBLAZE)
 423                     if ((interrupt_request & CPU_INTERRUPT_HARD)
 424                         && (env->sregs[SR_MSR] & MSR_IE)
 425                         && !(env->sregs[SR_MSR] & (MSR_EIP | MSR_BIP))
 426                         && !(env->iflags & (D_FLAG | IMM_FLAG))) {
 427                         env->exception_index = EXCP_IRQ;
 428                         do_interrupt(env);
 429                         next_tb = 0;
 430                     }
 431 #elif defined(TARGET_MIPS)
 432                     if ((interrupt_request & CPU_INTERRUPT_HARD) &&
 433                         cpu_mips_hw_interrupts_pending(env)) {
 434                         /* Raise it */
 435                         env->exception_index = EXCP_EXT_INTERRUPT;
 436                         env->error_code = 0;
 437                         do_interrupt(env);
 438                         next_tb = 0;
 439                     }
 440 #elif defined(TARGET_SPARC)
 441                     if (interrupt_request & CPU_INTERRUPT_HARD) {
 442                         if (cpu_interrupts_enabled(env) &&
 443                             env->interrupt_index > 0) {
 444                             int pil = env->interrupt_index & 0xf;
 445                             int type = env->interrupt_index & 0xf0;
 446
 447                             if (((type == TT_EXTINT) &&
 448                                   cpu_pil_allowed(env, pil)) ||
 449                                   type != TT_EXTINT) {
 450                                 env->exception_index = env->interrupt_index;
 451                                 do_interrupt(env);
 452                                 next_tb = 0;
 453                             }
 454                         }
 455                     } else if (interrupt_request & CPU_INTERRUPT_TIMER) {
 456                         //do_interrupt(0, 0, 0, 0, 0);
 457                         env->interrupt_request &= ~CPU_INTERRUPT_TIMER;
 458                     }
 459 #elif defined(TARGET_ARM)
 460                     if (interrupt_request & CPU_INTERRUPT_FIQ
 461                         && !(env->uncached_cpsr & CPSR_F)) {
 462                         env->exception_index = EXCP_FIQ;
 463                         do_interrupt(env);
 464                         next_tb = 0;
 465                     }
 466                     /* ARMv7-M interrupt return works by loading a magic value
 467                        into the PC.  On real hardware the load causes the
 468                        return to occur.  The qemu implementation performs the
 469                        jump normally, then does the exception return when the
 470                        CPU tries to execute code at the magic address.
 471                        This will cause the magic PC value to be pushed to
 472                        the stack if an interrupt occured at the wrong time.
 473                        We avoid this by disabling interrupts when
 474                        pc contains a magic address.  */
 475                     if (interrupt_request & CPU_INTERRUPT_HARD
 476                         && ((IS_M(env) && env->regs[15] < 0xfffffff0)
 477                             || !(env->uncached_cpsr & CPSR_I))) {
 478                         env->exception_index = EXCP_IRQ;
 479                         do_interrupt(env);
 480                         next_tb = 0;
 481                     }
 482 #elif defined(TARGET_SH4)
 483                     if (interrupt_request & CPU_INTERRUPT_HARD) {
 484                         do_interrupt(env);
 485                         next_tb = 0;
 486                     }
 487 #elif defined(TARGET_ALPHA)
 488                     if (interrupt_request & CPU_INTERRUPT_HARD) {
 489                         do_interrupt(env);
 490                         next_tb = 0;
 491                     }
 492 #elif defined(TARGET_CRIS)
 493                     if (interrupt_request & CPU_INTERRUPT_HARD
 494                         && (env->pregs[PR_CCS] & I_FLAG)
 495                         && !env->locked_irq) {
 496                         env->exception_index = EXCP_IRQ;
 497                         do_interrupt(env);
 498                         next_tb = 0;
 499                     }
 500                     if (interrupt_request & CPU_INTERRUPT_NMI
 501                         && (env->pregs[PR_CCS] & M_FLAG)) {
 502                         env->exception_index = EXCP_NMI;
 503                         do_interrupt(env);
 504                         next_tb = 0;
 505                     }
 506 #elif defined(TARGET_M68K)
 507                     if (interrupt_request & CPU_INTERRUPT_HARD
 508                         && ((env->sr & SR_I) >> SR_I_SHIFT)
 509                             < env->pending_level) {
 510                         /* Real hardware gets the interrupt vector via an
 511                            IACK cycle at this point.  Current emulated
 512                            hardware doesn't rely on this, so we
 513                            provide/save the vector when the interrupt is
 514                            first signalled.  */
 515                         env->exception_index = env->pending_vector;
 516                         do_interrupt(1);
 517                         next_tb = 0;
 518                     }
 519 #endif
 520                    /* Don't use the cached interupt_request value,
 521                       do_interrupt may have updated the EXITTB flag. */
 522                     if (env->interrupt_request & CPU_INTERRUPT_EXITTB) {
 523                         env->interrupt_request &= ~CPU_INTERRUPT_EXITTB;
 524                         /* ensure that no TB jump will be modified as
 525                            the program flow was changed */
 526                         next_tb = 0;
 527                     }
 528                 }
 529                 if (unlikely(env->exit_request)) {
 530                     env->exit_request = 0;
 531                     env->exception_index = EXCP_INTERRUPT;
 532                     cpu_loop_exit();
 533                 }
 534 #if defined(DEBUG_DISAS) || defined(CONFIG_DEBUG_EXEC)
 535                 if (qemu_loglevel_mask(CPU_LOG_TB_CPU)) {
 536                     /* restore flags in standard format */
 537 #if defined(TARGET_I386)
 538                     env->eflags = env->eflags | helper_cc_compute_all(CC_OP) | (DF & DF_MASK);
 539                     log_cpu_state(env, X86_DUMP_CCOP);
 540                     env->eflags &= ~(DF_MASK | CC_O | CC_S | CC_Z | CC_A | CC_P | CC_C);
 541 #elif defined(TARGET_M68K)
 542                     cpu_m68k_flush_flags(env, env->cc_op);
 543                     env->cc_op = CC_OP_FLAGS;
 544                     env->sr = (env->sr & 0xffe0)
 545                               | env->cc_dest | (env->cc_x << 4);
 546                     log_cpu_state(env, 0);
 547 #else
 548                     log_cpu_state(env, 0);
 549 #endif
 550                 }
 551 #endif /* DEBUG_DISAS || CONFIG_DEBUG_EXEC */
 552                 spin_lock(&tb_lock);
 553                 tb = tb_find_fast();
 554                 /* Note: we do it here to avoid a gcc bug on Mac OS X when
 555                    doing it in tb_find_slow */
 556                 if (tb_invalidated_flag) {
 557                     /* as some TB could have been invalidated because
 558                        of memory exceptions while generating the code, we
 559                        must recompute the hash index here */
 560                     next_tb = 0;
 561                     tb_invalidated_flag = 0;
 562                 }
 563 #ifdef CONFIG_DEBUG_EXEC
 564                 qemu_log_mask(CPU_LOG_EXEC, "Trace 0x%08lx [" TARGET_FMT_lx "] %s\n",
 565                              (long)tb->tc_ptr, tb->pc,
 566                              lookup_symbol(tb->pc));
 567 #endif
 568                 /* see if we can patch the calling TB. When the TB
 569                    spans two pages, we cannot safely do a direct
 570                    jump. */
 571                 if (next_tb != 0 && tb->page_addr[1] == -1) {
 572                     tb_add_jump((TranslationBlock *)(next_tb & ~3), next_tb & 3, tb);
 573                 }
 574                 spin_unlock(&tb_lock);
 575
 576                 /* cpu_interrupt might be called while translating the
 577                    TB, but before it is linked into a potentially
 578                    infinite loop and becomes env->current_tb. Avoid
 579                    starting execution if there is a pending interrupt. */
 580                 env->current_tb = tb;
 581                 barrier();
 582                 if (likely(!env->exit_request)) {
 583                     tc_ptr = tb->tc_ptr;
 584                 /* execute the generated code */
 585 #if defined(__sparc__) && !defined(CONFIG_SOLARIS)
 586 #undef env
 587                     env = cpu_single_env;
 588 #define env cpu_single_env
 589 #endif
 590                     next_tb = tcg_qemu_tb_exec(tc_ptr);
 591                     if ((next_tb & 3) == 2) {
 592                         /* Instruction counter expired.  */
 593                         int insns_left;
 594                         tb = (TranslationBlock *)(long)(next_tb & ~3);
 595                         /* Restore PC.  */
 596                         cpu_pc_from_tb(env, tb);
 597                         insns_left = env->icount_decr.u32;
 598                         if (env->icount_extra && insns_left >= 0) {
 599                             /* Refill decrementer and continue execution.  */
 600                             env->icount_extra += insns_left;
 601                             if (env->icount_extra > 0xffff) {
 602                                 insns_left = 0xffff;
 603                             } else {
 604                                 insns_left = env->icount_extra;
 605                             }
 606                             env->icount_extra -= insns_left;
 607                             env->icount_decr.u16.low = insns_left;
 608                         } else {
 609                             if (insns_left > 0) {
 610                                 /* Execute remaining instructions.  */
 611                                 cpu_exec_nocache(insns_left, tb);
 612                             }
 613                             env->exception_index = EXCP_INTERRUPT;
 614                             next_tb = 0;
 615                             cpu_loop_exit();
 616                         }
 617                     }
 618                 }
 619                 env->current_tb = NULL;
 620                 /* reset soft MMU for next block (it can currently
 621                    only be set by a memory fault) */
 622             } /* for(;;) */
 623         }
 624     } /* for(;;) */
 625
 626
 627 #if defined(TARGET_I386)
 628     /* restore flags in standard format */
 629     env->eflags = env->eflags | helper_cc_compute_all(CC_OP) | (DF & DF_MASK);
 630 #elif defined(TARGET_ARM)
 631     /* XXX: Save/restore host fpu exception state?.  */
 632 #elif defined(TARGET_SPARC)
 633 #elif defined(TARGET_PPC)
 634 #elif defined(TARGET_M68K)
 635     cpu_m68k_flush_flags(env, env->cc_op);
 636     env->cc_op = CC_OP_FLAGS;
 637     env->sr = (env->sr & 0xffe0)
 638               | env->cc_dest | (env->cc_x << 4);
 639 #elif defined(TARGET_MICROBLAZE)
 640 #elif defined(TARGET_MIPS)
 641 #elif defined(TARGET_SH4)
 642 #elif defined(TARGET_IA64)
 643 #elif defined(TARGET_ALPHA)
 644 #elif defined(TARGET_CRIS)
 645 #elif defined(TARGET_S390X)
 646     /* XXXXX */
 647 #else
 648 #error unsupported target CPU
 649 #endif
 650
 651     /* restore global registers */
 652     barrier();
 653     env = (void *) saved_env_reg;
 654
 655     /* fail safe : never use cpu_single_env outside cpu_exec() */
 656     cpu_single_env = NULL;
 657     return ret;
 658 }
 659
 660 /* must only be called from the generated code as an exception can be
 661    generated */
 662 void tb_invalidate_page_range(target_ulong start, target_ulong end)
 663 {
 664     /* XXX: cannot enable it yet because it yields to MMU exception
 665        where NIP != read address on PowerPC */
 666 #if 0
 667     target_ulong phys_addr;
 668     phys_addr = get_phys_addr_code(env, start);
 669     tb_invalidate_phys_page_range(phys_addr, phys_addr + end - start, 0);
 670 #endif
 671 }
 672
 673 #if defined(TARGET_I386) && defined(CONFIG_USER_ONLY)
 674
 675 void cpu_x86_load_seg(CPUX86State *s, int seg_reg, int selector)
 676 {
 677     CPUX86State *saved_env;
 678
 679     saved_env = env;
 680     env = s;
 681     if (!(env->cr[0] & CR0_PE_MASK) || (env->eflags & VM_MASK)) {
 682         selector &= 0xffff;
 683         cpu_x86_load_seg_cache(env, seg_reg, selector,
 684                                (selector << 4), 0xffff, 0);
 685     } else {
 686         helper_load_seg(seg_reg, selector);
 687     }
 688     env = saved_env;
 689 }
 690
 691 void cpu_x86_fsave(CPUX86State *s, target_ulong ptr, int data32)
 692 {
 693     CPUX86State *saved_env;
 694
 695     saved_env = env;
 696     env = s;
 697
 698     helper_fsave(ptr, data32);
 699
 700     env = saved_env;
 701 }
 702
 703 void cpu_x86_frstor(CPUX86State *s, target_ulong ptr, int data32)
 704 {
 705     CPUX86State *saved_env;
 706
 707     saved_env = env;
 708     env = s;
 709
 710     helper_frstor(ptr, data32);
 711
 712     env = saved_env;
 713 }
 714
 715 #endif /* TARGET_I386 */
 716
 717 #if !defined(CONFIG_SOFTMMU)
 718
 719 #if defined(TARGET_I386)
 720 #define EXCEPTION_ACTION raise_exception_err(env->exception_index, env->error_code)
 721 #else
 722 #define EXCEPTION_ACTION cpu_loop_exit()
 723 #endif
 724
 725 /* 'pc' is the host PC at which the exception was raised. 'address' is
 726    the effective address of the memory exception. 'is_write' is 1 if a
 727    write caused the exception and otherwise 0'. 'old_set' is the
 728    signal set which should be restored */
 729 static inline int handle_cpu_signal(unsigned long pc, unsigned long address,
 730                                     int is_write, sigset_t *old_set,
 731                                     void *puc)
 732 {
 733     TranslationBlock *tb;
 734     int ret;
 735
 736     if (cpu_single_env)
 737         env = cpu_single_env; /* XXX: find a correct solution for multithread */
 738 #if defined(DEBUG_SIGNAL)
 739     qemu_printf("qemu: SIGSEGV pc=0x%08lx address=%08lx w=%d oldset=0x%08lx\n",
 740                 pc, address, is_write, *(unsigned long *)old_set);
 741 #endif
 742     /* XXX: locking issue */
 743     if (is_write && page_unprotect(h2g(address), pc, puc)) {
 744         return 1;
 745     }
 746
 747     /* see if it is an MMU fault */
 748     ret = cpu_handle_mmu_fault(env, address, is_write, MMU_USER_IDX, 0);
 749     if (ret < 0)
 750         return 0; /* not an MMU fault */
 751     if (ret == 0)
 752         return 1; /* the MMU fault was handled without causing real CPU fault */
 753     /* now we have a real cpu fault */
 754     tb = tb_find_pc(pc);
 755     if (tb) {
 756         /* the PC is inside the translated code. It means that we have
 757            a virtual CPU fault */
 758         cpu_restore_state(tb, env, pc, puc);
 759     }
 760
 761     /* we restore the process signal mask as the sigreturn should
 762        do it (XXX: use sigsetjmp) */
 763     sigprocmask(SIG_SETMASK, old_set, NULL);
 764     EXCEPTION_ACTION;
 765
 766     /* never comes here */
 767     return 1;
 768 }
 769
 770 #if defined(__i386__)
 771
 772 #if defined(__APPLE__)
 773 # include <sys/ucontext.h>
 774
 775 # define EIP_sig(context)  (*((unsigned long*)&(context)->uc_mcontext->ss.eip))
 776 # define TRAP_sig(context)    ((context)->uc_mcontext->es.trapno)
 777 # define ERROR_sig(context)   ((context)->uc_mcontext->es.err)
 778 # define MASK_sig(context)    ((context)->uc_sigmask)
 779 #elif defined (__NetBSD__)
 780 # include <ucontext.h>
 781
 782 # define EIP_sig(context)     ((context)->uc_mcontext.__gregs[_REG_EIP])
 783 # define TRAP_sig(context)    ((context)->uc_mcontext.__gregs[_REG_TRAPNO])
 784 # define ERROR_sig(context)   ((context)->uc_mcontext.__gregs[_REG_ERR])
 785 # define MASK_sig(context)    ((context)->uc_sigmask)
 786 #elif defined (__FreeBSD__) || defined(__DragonFly__)
 787 # include <ucontext.h>
 788
 789 # define EIP_sig(context)  (*((unsigned long*)&(context)->uc_mcontext.mc_eip))
 790 # define TRAP_sig(context)    ((context)->uc_mcontext.mc_trapno)
 791 # define ERROR_sig(context)   ((context)->uc_mcontext.mc_err)
 792 # define MASK_sig(context)    ((context)->uc_sigmask)
 793 #elif defined(__OpenBSD__)
 794 # define EIP_sig(context)     ((context)->sc_eip)
 795 # define TRAP_sig(context)    ((context)->sc_trapno)
 796 # define ERROR_sig(context)   ((context)->sc_err)
 797 # define MASK_sig(context)    ((context)->sc_mask)
 798 #else
 799 # define EIP_sig(context)     ((context)->uc_mcontext.gregs[REG_EIP])
 800 # define TRAP_sig(context)    ((context)->uc_mcontext.gregs[REG_TRAPNO])
 801 # define ERROR_sig(context)   ((context)->uc_mcontext.gregs[REG_ERR])
 802 # define MASK_sig(context)    ((context)->uc_sigmask)
 803 #endif
 804
 805 int cpu_signal_handler(int host_signum, void *pinfo,
 806                        void *puc)
 807 {
 808     siginfo_t *info = pinfo;
 809 #if defined(__NetBSD__) || defined (__FreeBSD__) || defined(__DragonFly__)
 810     ucontext_t *uc = puc;
 811 #elif defined(__OpenBSD__)
 812     struct sigcontext *uc = puc;
 813 #else
 814     struct ucontext *uc = puc;
 815 #endif
 816     unsigned long pc;
 817     int trapno;
 818
 819 #ifndef REG_EIP
 820 /* for glibc 2.1 */
 821 #define REG_EIP    EIP
 822 #define REG_ERR    ERR
 823 #define REG_TRAPNO TRAPNO
 824 #endif
 825     pc = EIP_sig(uc);
 826     trapno = TRAP_sig(uc);
 827     return handle_cpu_signal(pc, (unsigned long)info->si_addr,
 828                              trapno == 0xe ?
 829                              (ERROR_sig(uc) >> 1) & 1 : 0,
 830                              &MASK_sig(uc), puc);
 831 }
 832
 833 #elif defined(__x86_64__)
 834
 835 #ifdef __NetBSD__
 836 #define PC_sig(context)       _UC_MACHINE_PC(context)
 837 #define TRAP_sig(context)     ((context)->uc_mcontext.__gregs[_REG_TRAPNO])
 838 #define ERROR_sig(context)    ((context)->uc_mcontext.__gregs[_REG_ERR])
 839 #define MASK_sig(context)     ((context)->uc_sigmask)
 840 #elif defined(__OpenBSD__)
 841 #define PC_sig(context)       ((context)->sc_rip)
 842 #define TRAP_sig(context)     ((context)->sc_trapno)
 843 #define ERROR_sig(context)    ((context)->sc_err)
 844 #define MASK_sig(context)     ((context)->sc_mask)
 845 #elif defined (__FreeBSD__) || defined(__DragonFly__)
 846 #include <ucontext.h>
 847
 848 #define PC_sig(context)  (*((unsigned long*)&(context)->uc_mcontext.mc_rip))
 849 #define TRAP_sig(context)     ((context)->uc_mcontext.mc_trapno)
 850 #define ERROR_sig(context)    ((context)->uc_mcontext.mc_err)
 851 #define MASK_sig(context)     ((context)->uc_sigmask)
 852 #else
 853 #define PC_sig(context)       ((context)->uc_mcontext.gregs[REG_RIP])
 854 #define TRAP_sig(context)     ((context)->uc_mcontext.gregs[REG_TRAPNO])
 855 #define ERROR_sig(context)    ((context)->uc_mcontext.gregs[REG_ERR])
 856 #define MASK_sig(context)     ((context)->uc_sigmask)
 857 #endif
 858
 859 int cpu_signal_handler(int host_signum, void *pinfo,
 860                        void *puc)
 861 {
 862     siginfo_t *info = pinfo;
 863     unsigned long pc;
 864 #if defined(__NetBSD__) || defined (__FreeBSD__) || defined(__DragonFly__)
 865     ucontext_t *uc = puc;
 866 #elif defined(__OpenBSD__)
 867     struct sigcontext *uc = puc;
 868 #else
 869     struct ucontext *uc = puc;
 870 #endif
 871
 872     pc = PC_sig(uc);
 873     return handle_cpu_signal(pc, (unsigned long)info->si_addr,
 874                              TRAP_sig(uc) == 0xe ?
 875                              (ERROR_sig(uc) >> 1) & 1 : 0,
 876                              &MASK_sig(uc), puc);
 877 }
 878
 879 #elif defined(_ARCH_PPC)
 880
 881 /***********************************************************************
 882  * signal context platform-specific definitions
 883  * From Wine
 884  */
 885 #ifdef linux
 886 /* All Registers access - only for local access */
 887 # define REG_sig(reg_name, context)             ((context)->uc_mcontext.regs->reg_name)
 888 /* Gpr Registers access  */
 889 # define GPR_sig(reg_num, context)              REG_sig(gpr[reg_num], context)
 890 # define IAR_sig(context)                       REG_sig(nip, context)   /* Program counter */
 891 # define MSR_sig(context)                       REG_sig(msr, context)   /* Machine State Register (Supervisor) */
 892 # define CTR_sig(context)                       REG_sig(ctr, context)   /* Count register */
 893 # define XER_sig(context)                       REG_sig(xer, context) /* User's integer exception register */
 894 # define LR_sig(context)                        REG_sig(link, context) /* Link register */
 895 # define CR_sig(context)                        REG_sig(ccr, context) /* Condition register */
 896 /* Float Registers access  */
 897 # define FLOAT_sig(reg_num, context)            (((double*)((char*)((context)->uc_mcontext.regs+48*4)))[reg_num])
 898 # define FPSCR_sig(context)                     (*(int*)((char*)((context)->uc_mcontext.regs+(48+32*2)*4)))
 899 /* Exception Registers access */
 900 # define DAR_sig(context)                       REG_sig(dar, context)
 901 # define DSISR_sig(context)                     REG_sig(dsisr, context)
 902 # define TRAP_sig(context)                      REG_sig(trap, context)
 903 #endif /* linux */
 904
 905 #if defined(__FreeBSD__) || defined(__FreeBSD_kernel__)
 906 #include <ucontext.h>
 907 # define IAR_sig(context)               ((context)->uc_mcontext.mc_srr0)
 908 # define MSR_sig(context)               ((context)->uc_mcontext.mc_srr1)
 909 # define CTR_sig(context)               ((context)->uc_mcontext.mc_ctr)
 910 # define XER_sig(context)               ((context)->uc_mcontext.mc_xer)
 911 # define LR_sig(context)                ((context)->uc_mcontext.mc_lr)
 912 # define CR_sig(context)                ((context)->uc_mcontext.mc_cr)
 913 /* Exception Registers access */
 914 # define DAR_sig(context)               ((context)->uc_mcontext.mc_dar)
 915 # define DSISR_sig(context)             ((context)->uc_mcontext.mc_dsisr)
 916 # define TRAP_sig(context)              ((context)->uc_mcontext.mc_exc)
 917 #endif /* __FreeBSD__|| __FreeBSD_kernel__ */
 918
 919 #ifdef __APPLE__
 920 # include <sys/ucontext.h>
 921 typedef struct ucontext SIGCONTEXT;
 922 /* All Registers access - only for local access */
 923 # define REG_sig(reg_name, context)             ((context)->uc_mcontext->ss.reg_name)
 924 # define FLOATREG_sig(reg_name, context)        ((context)->uc_mcontext->fs.reg_name)
 925 # define EXCEPREG_sig(reg_name, context)        ((context)->uc_mcontext->es.reg_name)
 926 # define VECREG_sig(reg_name, context)          ((context)->uc_mcontext->vs.reg_name)
 927 /* Gpr Registers access */
 928 # define GPR_sig(reg_num, context)              REG_sig(r##reg_num, context)
 929 # define IAR_sig(context)                       REG_sig(srr0, context)  /* Program counter */
 930 # define MSR_sig(context)                       REG_sig(srr1, context)  /* Machine State Register (Supervisor) */
 931 # define CTR_sig(context)                       REG_sig(ctr, context)
 932 # define XER_sig(context)                       REG_sig(xer, context) /* Link register */
 933 # define LR_sig(context)                        REG_sig(lr, context)  /* User's integer exception register */
 934 # define CR_sig(context)                        REG_sig(cr, context)  /* Condition register */
 935 /* Float Registers access */
 936 # define FLOAT_sig(reg_num, context)            FLOATREG_sig(fpregs[reg_num], context)
 937 # define FPSCR_sig(context)                     ((double)FLOATREG_sig(fpscr, context))
 938 /* Exception Registers access */
 939 # define DAR_sig(context)                       EXCEPREG_sig(dar, context)     /* Fault registers for coredump */
 940 # define DSISR_sig(context)                     EXCEPREG_sig(dsisr, context)
 941 # define TRAP_sig(context)                      EXCEPREG_sig(exception, context) /* number of powerpc exception taken */
 942 #endif /* __APPLE__ */
 943
 944 int cpu_signal_handler(int host_signum, void *pinfo,
 945                        void *puc)
 946 {
 947     siginfo_t *info = pinfo;
 948 #if defined(__FreeBSD__) || defined(__FreeBSD_kernel__)
 949     ucontext_t *uc = puc;
 950 #else
 951     struct ucontext *uc = puc;
 952 #endif
 953     unsigned long pc;
 954     int is_write;
 955
 956     pc = IAR_sig(uc);
 957     is_write = 0;
 958 #if 0
 959     /* ppc 4xx case */
 960     if (DSISR_sig(uc) & 0x00800000)
 961         is_write = 1;
 962 #else
 963     if (TRAP_sig(uc) != 0x400 && (DSISR_sig(uc) & 0x02000000))
 964         is_write = 1;
 965 #endif
 966     return handle_cpu_signal(pc, (unsigned long)info->si_addr,
 967                              is_write, &uc->uc_sigmask, puc);
 968 }
 969
 970 #elif defined(__alpha__)
 971
 972 int cpu_signal_handler(int host_signum, void *pinfo,
 973                            void *puc)
 974 {
 975     siginfo_t *info = pinfo;
 976     struct ucontext *uc = puc;
 977     uint32_t *pc = uc->uc_mcontext.sc_pc;
 978     uint32_t insn = *pc;
 979     int is_write = 0;
 980
 981     /* XXX: need kernel patch to get write flag faster */
 982     switch (insn >> 26) {
 983     case 0x0d: // stw
 984     case 0x0e: // stb
 985     case 0x0f: // stq_u
 986     case 0x24: // stf
 987     case 0x25: // stg
 988     case 0x26: // sts
 989     case 0x27: // stt
 990     case 0x2c: // stl
 991     case 0x2d: // stq
 992     case 0x2e: // stl_c
 993     case 0x2f: // stq_c
 994         is_write = 1;
 995     }
 996
 997     return handle_cpu_signal(pc, (unsigned long)info->si_addr,
 998                              is_write, &uc->uc_sigmask, puc);
 999 }
1000 #elif defined(__sparc__)
1001
1002 int cpu_signal_handler(int host_signum, void *pinfo,
1003                        void *puc)
1004 {
1005     siginfo_t *info = pinfo;
1006     int is_write;
1007     uint32_t insn;
1008 #if !defined(__arch64__) || defined(CONFIG_SOLARIS)
1009     uint32_t *regs = (uint32_t *)(info + 1);
1010     void *sigmask = (regs + 20);
1011     /* XXX: is there a standard glibc define ? */
1012     unsigned long pc = regs[1];
1013 #else
1014 #ifdef __linux__
1015     struct sigcontext *sc = puc;
1016     unsigned long pc = sc->sigc_regs.tpc;
1017     void *sigmask = (void *)sc->sigc_mask;
1018 #elif defined(__OpenBSD__)
1019     struct sigcontext *uc = puc;
1020     unsigned long pc = uc->sc_pc;
1021     void *sigmask = (void *)(long)uc->sc_mask;
1022 #endif
1023 #endif
1024
1025     /* XXX: need kernel patch to get write flag faster */
1026     is_write = 0;
1027     insn = *(uint32_t *)pc;
1028     if ((insn >> 30) == 3) {
1029       switch((insn >> 19) & 0x3f) {
1030       case 0x05: // stb
1031       case 0x15: // stba
1032       case 0x06: // sth
1033       case 0x16: // stha
1034       case 0x04: // st
1035       case 0x14: // sta
1036       case 0x07: // std
1037       case 0x17: // stda
1038       case 0x0e: // stx
1039       case 0x1e: // stxa
1040       case 0x24: // stf
1041       case 0x34: // stfa
1042       case 0x27: // stdf
1043       case 0x37: // stdfa
1044       case 0x26: // stqf
1045       case 0x36: // stqfa
1046       case 0x25: // stfsr
1047       case 0x3c: // casa
1048       case 0x3e: // casxa
1049         is_write = 1;
1050         break;
1051       }
1052     }
1053     return handle_cpu_signal(pc, (unsigned long)info->si_addr,
1054                              is_write, sigmask, NULL);
1055 }
1056
1057 #elif defined(__arm__)
1058
1059 int cpu_signal_handler(int host_signum, void *pinfo,
1060                        void *puc)
1061 {
1062     siginfo_t *info = pinfo;
1063     struct ucontext *uc = puc;
1064     unsigned long pc;
1065     int is_write;
1066
1067 #if (__GLIBC__ < 2 || (__GLIBC__ == 2 && __GLIBC_MINOR__ <= 3))
1068     pc = uc->uc_mcontext.gregs[R15];
1069 #else
1070     pc = uc->uc_mcontext.arm_pc;
1071 #endif
1072     /* XXX: compute is_write */
1073     is_write = 0;
1074     return handle_cpu_signal(pc, (unsigned long)info->si_addr,
1075                              is_write,
1076                              &uc->uc_sigmask, puc);
1077 }
1078
1079 #elif defined(__mc68000)
1080
1081 int cpu_signal_handler(int host_signum, void *pinfo,
1082                        void *puc)
1083 {
1084     siginfo_t *info = pinfo;
1085     struct ucontext *uc = puc;
1086     unsigned long pc;
1087     int is_write;
1088
1089     pc = uc->uc_mcontext.gregs[16];
1090     /* XXX: compute is_write */
1091     is_write = 0;
1092     return handle_cpu_signal(pc, (unsigned long)info->si_addr,
1093                              is_write,
1094                              &uc->uc_sigmask, puc);
1095 }
1096
1097 #elif defined(__ia64)
1098
1099 #ifndef __ISR_VALID
1100   /* This ought to be in <bits/siginfo.h>... */
1101 # define __ISR_VALID    1
1102 #endif
1103
1104 int cpu_signal_handler(int host_signum, void *pinfo, void *puc)
1105 {
1106     siginfo_t *info = pinfo;
1107     struct ucontext *uc = puc;
1108     unsigned long ip;
1109     int is_write = 0;
1110
1111     ip = uc->uc_mcontext.sc_ip;
1112     switch (host_signum) {
1113       case SIGILL:
1114       case SIGFPE:
1115       case SIGSEGV:
1116       case SIGBUS:
1117       case SIGTRAP:
1118           if (info->si_code && (info->si_segvflags & __ISR_VALID))
1119               /* ISR.W (write-access) is bit 33:  */
1120               is_write = (info->si_isr >> 33) & 1;
1121           break;
1122
1123       default:
1124           break;
1125     }
1126     return handle_cpu_signal(ip, (unsigned long)info->si_addr,
1127                              is_write,
1128                              (sigset_t *)&uc->uc_sigmask, puc);
1129 }
1130
1131 #elif defined(__s390__)
1132
1133 int cpu_signal_handler(int host_signum, void *pinfo,
1134                        void *puc)
1135 {
1136     siginfo_t *info = pinfo;
1137     struct ucontext *uc = puc;
1138     unsigned long pc;
1139     uint16_t *pinsn;
1140     int is_write = 0;
1141
1142     pc = uc->uc_mcontext.psw.addr;
1143
1144     /* ??? On linux, the non-rt signal handler has 4 (!) arguments instead
1145        of the normal 2 arguments.  The 3rd argument contains the "int_code"
1146        from the hardware which does in fact contain the is_write value.
1147        The rt signal handler, as far as I can tell, does not give this value
1148        at all.  Not that we could get to it from here even if it were.  */
1149     /* ??? This is not even close to complete, since it ignores all
1150        of the read-modify-write instructions.  */
1151     pinsn = (uint16_t *)pc;
1152     switch (pinsn[0] >> 8) {
1153     case 0x50: /* ST */
1154     case 0x42: /* STC */
1155     case 0x40: /* STH */
1156         is_write = 1;
1157         break;
1158     case 0xc4: /* RIL format insns */
1159         switch (pinsn[0] & 0xf) {
1160         case 0xf: /* STRL */
1161         case 0xb: /* STGRL */
1162         case 0x7: /* STHRL */
1163             is_write = 1;
1164         }
1165         break;
1166     case 0xe3: /* RXY format insns */
1167         switch (pinsn[2] & 0xff) {
1168         case 0x50: /* STY */
1169         case 0x24: /* STG */
1170         case 0x72: /* STCY */
1171         case 0x70: /* STHY */
1172         case 0x8e: /* STPQ */
1173         case 0x3f: /* STRVH */
1174         case 0x3e: /* STRV */
1175         case 0x2f: /* STRVG */
1176             is_write = 1;
1177         }
1178         break;
1179     }
1180     return handle_cpu_signal(pc, (unsigned long)info->si_addr,
1181                              is_write, &uc->uc_sigmask, puc);
1182 }
1183
1184 #elif defined(__mips__)
1185
1186 int cpu_signal_handler(int host_signum, void *pinfo,
1187                        void *puc)
1188 {
1189     siginfo_t *info = pinfo;
1190     struct ucontext *uc = puc;
1191     greg_t pc = uc->uc_mcontext.pc;
1192     int is_write;
1193
1194     /* XXX: compute is_write */
1195     is_write = 0;
1196     return handle_cpu_signal(pc, (unsigned long)info->si_addr,
1197                              is_write, &uc->uc_sigmask, puc);
1198 }
1199
1200 #elif defined(__hppa__)
1201
1202 int cpu_signal_handler(int host_signum, void *pinfo,
1203                        void *puc)
1204 {
1205     struct siginfo *info = pinfo;
1206     struct ucontext *uc = puc;
1207     unsigned long pc = uc->uc_mcontext.sc_iaoq[0];
1208     uint32_t insn = *(uint32_t *)pc;
1209     int is_write = 0;
1210
1211     /* XXX: need kernel patch to get write flag faster.  */
1212     switch (insn >> 26) {
1213     case 0x1a: /* STW */
1214     case 0x19: /* STH */
1215     case 0x18: /* STB */
1216     case 0x1b: /* STWM */
1217         is_write = 1;
1218         break;
1219
1220     case 0x09: /* CSTWX, FSTWX, FSTWS */
1221     case 0x0b: /* CSTDX, FSTDX, FSTDS */
1222         /* Distinguish from coprocessor load ... */
1223         is_write = (insn >> 9) & 1;
1224         break;
1225
1226     case 0x03:
1227         switch ((insn >> 6) & 15) {
1228         case 0xa: /* STWS */
1229         case 0x9: /* STHS */
1230         case 0x8: /* STBS */
1231         case 0xe: /* STWAS */
1232         case 0xc: /* STBYS */
1233             is_write = 1;
1234         }
1235         break;
1236     }
1237
1238     return handle_cpu_signal(pc, (unsigned long)info->si_addr,
1239                              is_write, &uc->uc_sigmask, puc);
1240 }
1241
1242 #else
1243
1244 #error host CPU specific signal handler needed
1245
1246 #endif
1247
1248 #endif /* !defined(CONFIG_SOFTMMU) */