2 * emulator main execution loop
4 * Copyright (c) 2003-2005 Fabrice Bellard
6 * This library is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU Lesser General Public
8 * License as published by the Free Software Foundation; either
9 * version 2 of the License, or (at your option) any later version.
11 * This library is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
14 * Lesser General Public License for more details.
16 * You should have received a copy of the GNU Lesser General Public
17 * License along with this library; if not, see <http://www.gnu.org/licenses/>.
23 #include "qemu-barrier.h"
26 int tb_invalidated_flag
;
28 //#define CONFIG_DEBUG_EXEC
30 bool qemu_cpu_has_work(CPUArchState
*env
)
32 return cpu_has_work(env
);
35 void cpu_loop_exit(CPUArchState
*env
)
37 env
->current_tb
= NULL
;
38 longjmp(env
->jmp_env
, 1);
41 /* exit the current TB from a signal handler. The host registers are
42 restored in a state compatible with the CPU emulator
44 #if defined(CONFIG_SOFTMMU)
45 void cpu_resume_from_signal(CPUArchState
*env
, void *puc
)
47 /* XXX: restore cpu registers saved in host registers */
49 env
->exception_index
= -1;
50 longjmp(env
->jmp_env
, 1);
54 /* Execute the code without caching the generated code. An interpreter
55 could be used if available. */
56 static void cpu_exec_nocache(CPUArchState
*env
, int max_cycles
,
57 TranslationBlock
*orig_tb
)
59 tcg_target_ulong next_tb
;
62 /* Should never happen.
63 We only end up here when an existing TB is too long. */
64 if (max_cycles
> CF_COUNT_MASK
)
65 max_cycles
= CF_COUNT_MASK
;
67 tb
= tb_gen_code(env
, orig_tb
->pc
, orig_tb
->cs_base
, orig_tb
->flags
,
70 /* execute the generated code */
71 next_tb
= tcg_qemu_tb_exec(env
, tb
->tc_ptr
);
72 env
->current_tb
= NULL
;
74 if ((next_tb
& 3) == 2) {
75 /* Restore PC. This may happen if async event occurs before
76 the TB starts executing. */
77 cpu_pc_from_tb(env
, tb
);
79 tb_phys_invalidate(tb
, -1);
83 static TranslationBlock
*tb_find_slow(CPUArchState
*env
,
88 TranslationBlock
*tb
, **ptb1
;
90 tb_page_addr_t phys_pc
, phys_page1
;
91 target_ulong virt_page2
;
93 tb_invalidated_flag
= 0;
95 /* find translated block using physical mappings */
96 phys_pc
= get_page_addr_code(env
, pc
);
97 phys_page1
= phys_pc
& TARGET_PAGE_MASK
;
98 h
= tb_phys_hash_func(phys_pc
);
99 ptb1
= &tb_phys_hash
[h
];
105 tb
->page_addr
[0] == phys_page1
&&
106 tb
->cs_base
== cs_base
&&
107 tb
->flags
== flags
) {
108 /* check next page if needed */
109 if (tb
->page_addr
[1] != -1) {
110 tb_page_addr_t phys_page2
;
112 virt_page2
= (pc
& TARGET_PAGE_MASK
) +
114 phys_page2
= get_page_addr_code(env
, virt_page2
);
115 if (tb
->page_addr
[1] == phys_page2
)
121 ptb1
= &tb
->phys_hash_next
;
124 /* if no translated code available, then translate it now */
125 tb
= tb_gen_code(env
, pc
, cs_base
, flags
, 0);
128 /* Move the last found TB to the head of the list */
130 *ptb1
= tb
->phys_hash_next
;
131 tb
->phys_hash_next
= tb_phys_hash
[h
];
132 tb_phys_hash
[h
] = tb
;
134 /* we add the TB in the virtual pc hash table */
135 env
->tb_jmp_cache
[tb_jmp_cache_hash_func(pc
)] = tb
;
139 static inline TranslationBlock
*tb_find_fast(CPUArchState
*env
)
141 TranslationBlock
*tb
;
142 target_ulong cs_base
, pc
;
145 /* we record a subset of the CPU state. It will
146 always be the same before a given translated block
148 cpu_get_tb_cpu_state(env
, &pc
, &cs_base
, &flags
);
149 tb
= env
->tb_jmp_cache
[tb_jmp_cache_hash_func(pc
)];
150 if (unlikely(!tb
|| tb
->pc
!= pc
|| tb
->cs_base
!= cs_base
||
151 tb
->flags
!= flags
)) {
152 tb
= tb_find_slow(env
, pc
, cs_base
, flags
);
157 static CPUDebugExcpHandler
*debug_excp_handler
;
159 CPUDebugExcpHandler
*cpu_set_debug_excp_handler(CPUDebugExcpHandler
*handler
)
161 CPUDebugExcpHandler
*old_handler
= debug_excp_handler
;
163 debug_excp_handler
= handler
;
167 static void cpu_handle_debug_exception(CPUArchState
*env
)
171 if (!env
->watchpoint_hit
) {
172 QTAILQ_FOREACH(wp
, &env
->watchpoints
, entry
) {
173 wp
->flags
&= ~BP_WATCHPOINT_HIT
;
176 if (debug_excp_handler
) {
177 debug_excp_handler(env
);
181 /* main execution loop */
183 volatile sig_atomic_t exit_request
;
185 int cpu_exec(CPUArchState
*env
)
188 CPUState
*cpu
= ENV_GET_CPU(env
);
190 int ret
, interrupt_request
;
191 TranslationBlock
*tb
;
193 tcg_target_ulong next_tb
;
196 if (!cpu_has_work(env
)) {
203 cpu_single_env
= env
;
205 if (unlikely(exit_request
)) {
206 env
->exit_request
= 1;
209 #if defined(TARGET_I386)
210 /* put eflags in CPU temporary format */
211 CC_SRC
= env
->eflags
& (CC_O
| CC_S
| CC_Z
| CC_A
| CC_P
| CC_C
);
212 DF
= 1 - (2 * ((env
->eflags
>> 10) & 1));
213 CC_OP
= CC_OP_EFLAGS
;
214 env
->eflags
&= ~(DF_MASK
| CC_O
| CC_S
| CC_Z
| CC_A
| CC_P
| CC_C
);
215 #elif defined(TARGET_SPARC)
216 #elif defined(TARGET_M68K)
217 env
->cc_op
= CC_OP_FLAGS
;
218 env
->cc_dest
= env
->sr
& 0xf;
219 env
->cc_x
= (env
->sr
>> 4) & 1;
220 #elif defined(TARGET_ALPHA)
221 #elif defined(TARGET_ARM)
222 #elif defined(TARGET_UNICORE32)
223 #elif defined(TARGET_PPC)
224 env
->reserve_addr
= -1;
225 #elif defined(TARGET_LM32)
226 #elif defined(TARGET_MICROBLAZE)
227 #elif defined(TARGET_MIPS)
228 #elif defined(TARGET_OPENRISC)
229 #elif defined(TARGET_SH4)
230 #elif defined(TARGET_CRIS)
231 #elif defined(TARGET_S390X)
232 #elif defined(TARGET_XTENSA)
235 #error unsupported target CPU
237 env
->exception_index
= -1;
239 /* prepare setjmp context for exception handling */
241 if (setjmp(env
->jmp_env
) == 0) {
242 /* if an exception is pending, we execute it here */
243 if (env
->exception_index
>= 0) {
244 if (env
->exception_index
>= EXCP_INTERRUPT
) {
245 /* exit request from the cpu execution loop */
246 ret
= env
->exception_index
;
247 if (ret
== EXCP_DEBUG
) {
248 cpu_handle_debug_exception(env
);
252 #if defined(CONFIG_USER_ONLY)
253 /* if user mode only, we simulate a fake exception
254 which will be handled outside the cpu execution
256 #if defined(TARGET_I386)
259 ret
= env
->exception_index
;
263 env
->exception_index
= -1;
268 next_tb
= 0; /* force lookup of first TB */
270 interrupt_request
= env
->interrupt_request
;
271 if (unlikely(interrupt_request
)) {
272 if (unlikely(env
->singlestep_enabled
& SSTEP_NOIRQ
)) {
273 /* Mask out external interrupts for this step. */
274 interrupt_request
&= ~CPU_INTERRUPT_SSTEP_MASK
;
276 if (interrupt_request
& CPU_INTERRUPT_DEBUG
) {
277 env
->interrupt_request
&= ~CPU_INTERRUPT_DEBUG
;
278 env
->exception_index
= EXCP_DEBUG
;
281 #if defined(TARGET_ARM) || defined(TARGET_SPARC) || defined(TARGET_MIPS) || \
282 defined(TARGET_PPC) || defined(TARGET_ALPHA) || defined(TARGET_CRIS) || \
283 defined(TARGET_MICROBLAZE) || defined(TARGET_LM32) || defined(TARGET_UNICORE32)
284 if (interrupt_request
& CPU_INTERRUPT_HALT
) {
285 env
->interrupt_request
&= ~CPU_INTERRUPT_HALT
;
287 env
->exception_index
= EXCP_HLT
;
291 #if defined(TARGET_I386)
292 #if !defined(CONFIG_USER_ONLY)
293 if (interrupt_request
& CPU_INTERRUPT_POLL
) {
294 env
->interrupt_request
&= ~CPU_INTERRUPT_POLL
;
295 apic_poll_irq(env
->apic_state
);
298 if (interrupt_request
& CPU_INTERRUPT_INIT
) {
299 cpu_svm_check_intercept_param(env
, SVM_EXIT_INIT
,
301 do_cpu_init(x86_env_get_cpu(env
));
302 env
->exception_index
= EXCP_HALTED
;
304 } else if (interrupt_request
& CPU_INTERRUPT_SIPI
) {
305 do_cpu_sipi(x86_env_get_cpu(env
));
306 } else if (env
->hflags2
& HF2_GIF_MASK
) {
307 if ((interrupt_request
& CPU_INTERRUPT_SMI
) &&
308 !(env
->hflags
& HF_SMM_MASK
)) {
309 cpu_svm_check_intercept_param(env
, SVM_EXIT_SMI
,
311 env
->interrupt_request
&= ~CPU_INTERRUPT_SMI
;
314 } else if ((interrupt_request
& CPU_INTERRUPT_NMI
) &&
315 !(env
->hflags2
& HF2_NMI_MASK
)) {
316 env
->interrupt_request
&= ~CPU_INTERRUPT_NMI
;
317 env
->hflags2
|= HF2_NMI_MASK
;
318 do_interrupt_x86_hardirq(env
, EXCP02_NMI
, 1);
320 } else if (interrupt_request
& CPU_INTERRUPT_MCE
) {
321 env
->interrupt_request
&= ~CPU_INTERRUPT_MCE
;
322 do_interrupt_x86_hardirq(env
, EXCP12_MCHK
, 0);
324 } else if ((interrupt_request
& CPU_INTERRUPT_HARD
) &&
325 (((env
->hflags2
& HF2_VINTR_MASK
) &&
326 (env
->hflags2
& HF2_HIF_MASK
)) ||
327 (!(env
->hflags2
& HF2_VINTR_MASK
) &&
328 (env
->eflags
& IF_MASK
&&
329 !(env
->hflags
& HF_INHIBIT_IRQ_MASK
))))) {
331 cpu_svm_check_intercept_param(env
, SVM_EXIT_INTR
,
333 env
->interrupt_request
&= ~(CPU_INTERRUPT_HARD
| CPU_INTERRUPT_VIRQ
);
334 intno
= cpu_get_pic_interrupt(env
);
335 qemu_log_mask(CPU_LOG_TB_IN_ASM
, "Servicing hardware INT=0x%02x\n", intno
);
336 do_interrupt_x86_hardirq(env
, intno
, 1);
337 /* ensure that no TB jump will be modified as
338 the program flow was changed */
340 #if !defined(CONFIG_USER_ONLY)
341 } else if ((interrupt_request
& CPU_INTERRUPT_VIRQ
) &&
342 (env
->eflags
& IF_MASK
) &&
343 !(env
->hflags
& HF_INHIBIT_IRQ_MASK
)) {
345 /* FIXME: this should respect TPR */
346 cpu_svm_check_intercept_param(env
, SVM_EXIT_VINTR
,
348 intno
= ldl_phys(env
->vm_vmcb
+ offsetof(struct vmcb
, control
.int_vector
));
349 qemu_log_mask(CPU_LOG_TB_IN_ASM
, "Servicing virtual hardware INT=0x%02x\n", intno
);
350 do_interrupt_x86_hardirq(env
, intno
, 1);
351 env
->interrupt_request
&= ~CPU_INTERRUPT_VIRQ
;
356 #elif defined(TARGET_PPC)
357 if ((interrupt_request
& CPU_INTERRUPT_RESET
)) {
360 if (interrupt_request
& CPU_INTERRUPT_HARD
) {
361 ppc_hw_interrupt(env
);
362 if (env
->pending_interrupts
== 0)
363 env
->interrupt_request
&= ~CPU_INTERRUPT_HARD
;
366 #elif defined(TARGET_LM32)
367 if ((interrupt_request
& CPU_INTERRUPT_HARD
)
368 && (env
->ie
& IE_IE
)) {
369 env
->exception_index
= EXCP_IRQ
;
373 #elif defined(TARGET_MICROBLAZE)
374 if ((interrupt_request
& CPU_INTERRUPT_HARD
)
375 && (env
->sregs
[SR_MSR
] & MSR_IE
)
376 && !(env
->sregs
[SR_MSR
] & (MSR_EIP
| MSR_BIP
))
377 && !(env
->iflags
& (D_FLAG
| IMM_FLAG
))) {
378 env
->exception_index
= EXCP_IRQ
;
382 #elif defined(TARGET_MIPS)
383 if ((interrupt_request
& CPU_INTERRUPT_HARD
) &&
384 cpu_mips_hw_interrupts_pending(env
)) {
386 env
->exception_index
= EXCP_EXT_INTERRUPT
;
391 #elif defined(TARGET_SPARC)
392 if (interrupt_request
& CPU_INTERRUPT_HARD
) {
393 if (cpu_interrupts_enabled(env
) &&
394 env
->interrupt_index
> 0) {
395 int pil
= env
->interrupt_index
& 0xf;
396 int type
= env
->interrupt_index
& 0xf0;
398 if (((type
== TT_EXTINT
) &&
399 cpu_pil_allowed(env
, pil
)) ||
401 env
->exception_index
= env
->interrupt_index
;
407 #elif defined(TARGET_ARM)
408 if (interrupt_request
& CPU_INTERRUPT_FIQ
409 && !(env
->uncached_cpsr
& CPSR_F
)) {
410 env
->exception_index
= EXCP_FIQ
;
414 /* ARMv7-M interrupt return works by loading a magic value
415 into the PC. On real hardware the load causes the
416 return to occur. The qemu implementation performs the
417 jump normally, then does the exception return when the
418 CPU tries to execute code at the magic address.
419 This will cause the magic PC value to be pushed to
420 the stack if an interrupt occurred at the wrong time.
421 We avoid this by disabling interrupts when
422 pc contains a magic address. */
423 if (interrupt_request
& CPU_INTERRUPT_HARD
424 && ((IS_M(env
) && env
->regs
[15] < 0xfffffff0)
425 || !(env
->uncached_cpsr
& CPSR_I
))) {
426 env
->exception_index
= EXCP_IRQ
;
430 #elif defined(TARGET_UNICORE32)
431 if (interrupt_request
& CPU_INTERRUPT_HARD
432 && !(env
->uncached_asr
& ASR_I
)) {
436 #elif defined(TARGET_SH4)
437 if (interrupt_request
& CPU_INTERRUPT_HARD
) {
441 #elif defined(TARGET_ALPHA)
444 /* ??? This hard-codes the OSF/1 interrupt levels. */
445 switch (env
->pal_mode
? 7 : env
->ps
& PS_INT_MASK
) {
447 if (interrupt_request
& CPU_INTERRUPT_HARD
) {
448 idx
= EXCP_DEV_INTERRUPT
;
452 if (interrupt_request
& CPU_INTERRUPT_TIMER
) {
453 idx
= EXCP_CLK_INTERRUPT
;
457 if (interrupt_request
& CPU_INTERRUPT_SMP
) {
458 idx
= EXCP_SMP_INTERRUPT
;
462 if (interrupt_request
& CPU_INTERRUPT_MCHK
) {
467 env
->exception_index
= idx
;
473 #elif defined(TARGET_CRIS)
474 if (interrupt_request
& CPU_INTERRUPT_HARD
475 && (env
->pregs
[PR_CCS
] & I_FLAG
)
476 && !env
->locked_irq
) {
477 env
->exception_index
= EXCP_IRQ
;
481 if (interrupt_request
& CPU_INTERRUPT_NMI
) {
482 unsigned int m_flag_archval
;
483 if (env
->pregs
[PR_VR
] < 32) {
484 m_flag_archval
= M_FLAG_V10
;
486 m_flag_archval
= M_FLAG_V32
;
488 if ((env
->pregs
[PR_CCS
] & m_flag_archval
)) {
489 env
->exception_index
= EXCP_NMI
;
494 #elif defined(TARGET_M68K)
495 if (interrupt_request
& CPU_INTERRUPT_HARD
496 && ((env
->sr
& SR_I
) >> SR_I_SHIFT
)
497 < env
->pending_level
) {
498 /* Real hardware gets the interrupt vector via an
499 IACK cycle at this point. Current emulated
500 hardware doesn't rely on this, so we
501 provide/save the vector when the interrupt is
503 env
->exception_index
= env
->pending_vector
;
504 do_interrupt_m68k_hardirq(env
);
507 #elif defined(TARGET_S390X) && !defined(CONFIG_USER_ONLY)
508 if ((interrupt_request
& CPU_INTERRUPT_HARD
) &&
509 (env
->psw
.mask
& PSW_MASK_EXT
)) {
513 #elif defined(TARGET_XTENSA)
514 if (interrupt_request
& CPU_INTERRUPT_HARD
) {
515 env
->exception_index
= EXC_IRQ
;
520 /* Don't use the cached interrupt_request value,
521 do_interrupt may have updated the EXITTB flag. */
522 if (env
->interrupt_request
& CPU_INTERRUPT_EXITTB
) {
523 env
->interrupt_request
&= ~CPU_INTERRUPT_EXITTB
;
524 /* ensure that no TB jump will be modified as
525 the program flow was changed */
529 if (unlikely(env
->exit_request
)) {
530 env
->exit_request
= 0;
531 env
->exception_index
= EXCP_INTERRUPT
;
534 #if defined(DEBUG_DISAS) || defined(CONFIG_DEBUG_EXEC)
535 if (qemu_loglevel_mask(CPU_LOG_TB_CPU
)) {
536 /* restore flags in standard format */
537 #if defined(TARGET_I386)
538 env
->eflags
= env
->eflags
| cpu_cc_compute_all(env
, CC_OP
)
540 log_cpu_state(env
, X86_DUMP_CCOP
);
541 env
->eflags
&= ~(DF_MASK
| CC_O
| CC_S
| CC_Z
| CC_A
| CC_P
| CC_C
);
542 #elif defined(TARGET_M68K)
543 cpu_m68k_flush_flags(env
, env
->cc_op
);
544 env
->cc_op
= CC_OP_FLAGS
;
545 env
->sr
= (env
->sr
& 0xffe0)
546 | env
->cc_dest
| (env
->cc_x
<< 4);
547 log_cpu_state(env
, 0);
549 log_cpu_state(env
, 0);
552 #endif /* DEBUG_DISAS || CONFIG_DEBUG_EXEC */
554 tb
= tb_find_fast(env
);
555 /* Note: we do it here to avoid a gcc bug on Mac OS X when
556 doing it in tb_find_slow */
557 if (tb_invalidated_flag
) {
558 /* as some TB could have been invalidated because
559 of memory exceptions while generating the code, we
560 must recompute the hash index here */
562 tb_invalidated_flag
= 0;
564 #ifdef CONFIG_DEBUG_EXEC
565 qemu_log_mask(CPU_LOG_EXEC
, "Trace %p [" TARGET_FMT_lx
"] %s\n",
567 lookup_symbol(tb
->pc
));
569 /* see if we can patch the calling TB. When the TB
570 spans two pages, we cannot safely do a direct
572 if (next_tb
!= 0 && tb
->page_addr
[1] == -1) {
573 tb_add_jump((TranslationBlock
*)(next_tb
& ~3), next_tb
& 3, tb
);
575 spin_unlock(&tb_lock
);
577 /* cpu_interrupt might be called while translating the
578 TB, but before it is linked into a potentially
579 infinite loop and becomes env->current_tb. Avoid
580 starting execution if there is a pending interrupt. */
581 env
->current_tb
= tb
;
583 if (likely(!env
->exit_request
)) {
585 /* execute the generated code */
586 next_tb
= tcg_qemu_tb_exec(env
, tc_ptr
);
587 if ((next_tb
& 3) == 2) {
588 /* Instruction counter expired. */
590 tb
= (TranslationBlock
*)(next_tb
& ~3);
592 cpu_pc_from_tb(env
, tb
);
593 insns_left
= env
->icount_decr
.u32
;
594 if (env
->icount_extra
&& insns_left
>= 0) {
595 /* Refill decrementer and continue execution. */
596 env
->icount_extra
+= insns_left
;
597 if (env
->icount_extra
> 0xffff) {
600 insns_left
= env
->icount_extra
;
602 env
->icount_extra
-= insns_left
;
603 env
->icount_decr
.u16
.low
= insns_left
;
605 if (insns_left
> 0) {
606 /* Execute remaining instructions. */
607 cpu_exec_nocache(env
, insns_left
, tb
);
609 env
->exception_index
= EXCP_INTERRUPT
;
615 env
->current_tb
= NULL
;
616 /* reset soft MMU for next block (it can currently
617 only be set by a memory fault) */
620 /* Reload env after longjmp - the compiler may have smashed all
621 * local variables as longjmp is marked 'noreturn'. */
622 env
= cpu_single_env
;
627 #if defined(TARGET_I386)
628 /* restore flags in standard format */
629 env
->eflags
= env
->eflags
| cpu_cc_compute_all(env
, CC_OP
)
631 #elif defined(TARGET_ARM)
632 /* XXX: Save/restore host fpu exception state?. */
633 #elif defined(TARGET_UNICORE32)
634 #elif defined(TARGET_SPARC)
635 #elif defined(TARGET_PPC)
636 #elif defined(TARGET_LM32)
637 #elif defined(TARGET_M68K)
638 cpu_m68k_flush_flags(env
, env
->cc_op
);
639 env
->cc_op
= CC_OP_FLAGS
;
640 env
->sr
= (env
->sr
& 0xffe0)
641 | env
->cc_dest
| (env
->cc_x
<< 4);
642 #elif defined(TARGET_MICROBLAZE)
643 #elif defined(TARGET_MIPS)
644 #elif defined(TARGET_OPENRISC)
645 #elif defined(TARGET_SH4)
646 #elif defined(TARGET_ALPHA)
647 #elif defined(TARGET_CRIS)
648 #elif defined(TARGET_S390X)
649 #elif defined(TARGET_XTENSA)
652 #error unsupported target CPU
655 /* fail safe : never use cpu_single_env outside cpu_exec() */
656 cpu_single_env
= NULL
;